feat(ansible): rename playbooks and update AnsibleTasks

Signed-off-by: Devin Buhl <devin@buhl.casa>
2022-06-08 09:42:09 -04:00
1 parent e7d8409bd7
commit 46f1a392fb
@@ -0,0 +1,11 @@
+---
+- name: Restart node
+  ansible.builtin.reboot:
+    msg: Restart node due to system changes
+
+- name: Restart unattended-upgrades
+  ansible.builtin.service:
+    name: unattended-upgrades.service
+    daemon_reload: true
+    enabled: true
+    state: restarted
@@ -0,0 +1,20 @@
+---
+- name: Update max_user_watches
+  ansible.posix.sysctl:
+    name: fs.inotify.max_user_watches
+    value: "65536"
+    state: present
+    sysctl_file: /etc/sysctl.d/98-kubernetes-fs.conf
+
+- name: Disable swap at runtime
+  ansible.builtin.command: swapoff -a
+  when: ansible_swaptotal_mb > 0
+
+- name: Disable swap on boot
+  ansible.posix.mount:
+    name: "{{ item }}"
+    fstype: swap
+    state: absent
+  loop:
+    - swap
+    - none
@@ -0,0 +1,19 @@
+---
+- name: Enable kernel modules runtime
+  community.general.modprobe:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - br_netfilter
+    - overlay
+    - rbd
+
+- name: Enable kernel modules on boot
+  ansible.builtin.copy:
+    mode: 0644
+    content: "{{ item }}"
+    dest: "/etc/modules-load.d/{{ item }}.conf"
+  loop:
+    - br_netfilter
+    - overlay
+    - rbd
@@ -0,0 +1,6 @@
+---
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ timezone }}"
+  when:
+    - timezone is defined
@@ -0,0 +1,28 @@
+---
+- include: locale.yml
+  tags:
+    - locale
+
+- include: packages.yml
+  tags:
+    - packages
+
+- import_tasks: kernel.yml
+  tags:
+    - kernel
+
+- include: network.yml
+  tags:
+    - network
+
+- include: filesystem.yml
+  tags:
+    - filesystem
+
+- include: unattended-upgrades.yml
+  tags:
+    - unattended-upgrades
+
+- include: user.yml
+  tags:
+    - user
@@ -0,0 +1,39 @@
+---
+- name: Set hostname to inventory hostname
+  ansible.builtin.hostname:
+    name: "{{ inventory_hostname }}"
+  when:
+    - ansible_hostname != inventory_hostname
+
+- name: Update /etc/hosts to include hostname
+  ansible.builtin.blockinfile:
+    path: /etc/hosts
+    create: true
+    block: |
+      127.0.0.1 localhost
+      127.0.1.1 {{ inventory_hostname }}
+
+      # The following lines are desirable for IPv6 capable hosts
+      ::1 ip6-localhost ip6-loopback
+      fe00::0 ip6-localnet
+      ff00::0 ip6-mcastprefix
+      ff02::1 ip6-allnodes
+      ff02::2 ip6-allrouters
+      ff02::3 ip6-allhosts
+
+- name: Set system controls for Kubernetes
+  ansible.posix.sysctl:
+    name: "{{ item.key }}"
+    value: "{{ item.value }}"
+    sysctl_file: /etc/sysctl.d/99-kubernetes.conf
+    reload: true
+  with_dict: "{{ sysctl_config }}"
+  vars:
+    sysctl_config:
+      net.ipv4.ip_forward: 1
+      net.ipv4.conf.all.forwarding: 1
+      net.ipv6.conf.all.forwarding: 1
+      net.bridge.bridge-nf-call-iptables: 1
+      net.bridge.bridge-nf-call-ip6tables: 1
+      net.ipv4.conf.default.rp_filter: 0
+      net.ipv4.conf.all.rp_filter: 0
@@ -0,0 +1,44 @@
+---
+- name: Upgrade all system packages
+  ansible.builtin.apt:
+    upgrade: full
+    update_cache: true
+
+- name: Install common packages
+  ansible.builtin.apt:
+    name:
+      - apt-transport-https
+      - arptables
+      - ebtables
+      - ca-certificates
+      - curl
+      - ebtables
+      - gdisk
+      - hdparm
+      - htop
+      - iputils-ping
+      - ipvsadm
+      - lvm2
+      - nano
+      - net-tools
+      - nfs-common
+      - nvme-cli
+      - open-iscsi
+      - psmisc
+      - smartmontools
+      - socat
+      - software-properties-common
+      - unattended-upgrades
+      - unzip
+    install_recommends: false
+
+- name: Install RasPi specific packages
+  ansible.builtin.apt:
+    name:
+      - linux-modules-extra-raspi
+    install_recommends: false
+  notify: Restart node
+  when: "'raspi' in ansible_kernel"
+
+- name: Restart node if necessary
+  ansible.builtin.meta: flush_handlers
@@ -0,0 +1,26 @@
+---
+- block:
+    - name: Copy 20auto-upgrades unattended-upgrades config
+      ansible.builtin.blockinfile:
+        path: /etc/apt/apt.conf.d/20auto-upgrades
+        mode: 0644
+        create: true
+        block: |
+          APT::Periodic::Update-Package-Lists "1";
+          APT::Periodic::Download-Upgradeable-Packages "1";
+          APT::Periodic::AutocleanInterval "7";
+          APT::Periodic::Unattended-Upgrade "1";
+    - name: Copy 50unattended-upgrades unattended-upgrades config
+      ansible.builtin.blockinfile:
+        path: /etc/apt/apt.conf.d/50unattended-upgrades
+        mode: 0644
+        create: true
+        block: |
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id} stable";
+              "${distro_id} ${distro_codename}-security";
+              "${distro_id} ${distro_codename}-updates";
+          };
+  notify: Restart unattended-upgrades
@@ -0,0 +1,16 @@
+---
+- name: Add user to sudoers
+  ansible.builtin.copy:
+    content: "{{ ansible_user }} ALL=(ALL:ALL) NOPASSWD:ALL"
+    dest: "/etc/sudoers.d/{{ ansible_user }}_nopasswd"
+    mode: "0440"
+
+- name: Add additional user SSH public keys
+  ansible.posix.authorized_key:
+    user: "{{ ansible_user }}"
+    key: "{{ item }}"
+  loop: "{{ ssh_authorized_keys }}"
+  when:
+    - ssh_authorized_keys is defined
+    - ssh_authorized_keys is iterable
+    - ssh_authorized_keys | length > 0