feat(ansible): rename playbooks and update AnsibleTasks
Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
15 files changed
+39
-12
No files matched your search
@@ -0,0 +1,20 @@
|
||||
---
|
||||
- name: Update max_user_watches
|
||||
ansible.posix.sysctl:
|
||||
name: fs.inotify.max_user_watches
|
||||
value: "65536"
|
||||
state: present
|
||||
sysctl_file: /etc/sysctl.d/98-kubernetes-fs.conf
|
||||
|
||||
- name: Disable swap at runtime
|
||||
ansible.builtin.command: swapoff -a
|
||||
when: ansible_swaptotal_mb > 0
|
||||
|
||||
- name: Disable swap on boot
|
||||
ansible.posix.mount:
|
||||
name: "{{ item }}"
|
||||
fstype: swap
|
||||
state: absent
|
||||
loop:
|
||||
- swap
|
||||
- none
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
- name: Enable kernel modules runtime
|
||||
community.general.modprobe:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- br_netfilter
|
||||
- overlay
|
||||
- rbd
|
||||
|
||||
- name: Enable kernel modules on boot
|
||||
ansible.builtin.copy:
|
||||
mode: 0644
|
||||
content: "{{ item }}"
|
||||
dest: "/etc/modules-load.d/{{ item }}.conf"
|
||||
loop:
|
||||
- br_netfilter
|
||||
- overlay
|
||||
- rbd
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
- name: Set timezone
|
||||
community.general.timezone:
|
||||
name: "{{ timezone }}"
|
||||
when:
|
||||
- timezone is defined
|
||||
@@ -0,0 +1,28 @@
|
||||
---
|
||||
- include: locale.yml
|
||||
tags:
|
||||
- locale
|
||||
|
||||
- include: packages.yml
|
||||
tags:
|
||||
- packages
|
||||
|
||||
- import_tasks: kernel.yml
|
||||
tags:
|
||||
- kernel
|
||||
|
||||
- include: network.yml
|
||||
tags:
|
||||
- network
|
||||
|
||||
- include: filesystem.yml
|
||||
tags:
|
||||
- filesystem
|
||||
|
||||
- include: unattended-upgrades.yml
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
- include: user.yml
|
||||
tags:
|
||||
- user
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
- name: Set hostname to inventory hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ inventory_hostname }}"
|
||||
when:
|
||||
- ansible_hostname != inventory_hostname
|
||||
|
||||
- name: Update /etc/hosts to include hostname
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/hosts
|
||||
create: true
|
||||
block: |
|
||||
127.0.0.1 localhost
|
||||
127.0.1.1 {{ inventory_hostname }}
|
||||
|
||||
# The following lines are desirable for IPv6 capable hosts
|
||||
::1 ip6-localhost ip6-loopback
|
||||
fe00::0 ip6-localnet
|
||||
ff00::0 ip6-mcastprefix
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
ff02::3 ip6-allhosts
|
||||
|
||||
- name: Set system controls for Kubernetes
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item.key }}"
|
||||
value: "{{ item.value }}"
|
||||
sysctl_file: /etc/sysctl.d/99-kubernetes.conf
|
||||
reload: true
|
||||
with_dict: "{{ sysctl_config }}"
|
||||
vars:
|
||||
sysctl_config:
|
||||
net.ipv4.ip_forward: 1
|
||||
net.ipv4.conf.all.forwarding: 1
|
||||
net.ipv6.conf.all.forwarding: 1
|
||||
net.bridge.bridge-nf-call-iptables: 1
|
||||
net.bridge.bridge-nf-call-ip6tables: 1
|
||||
net.ipv4.conf.default.rp_filter: 0
|
||||
net.ipv4.conf.all.rp_filter: 0
|
||||
@@ -0,0 +1,44 @@
|
||||
---
|
||||
- name: Upgrade all system packages
|
||||
ansible.builtin.apt:
|
||||
upgrade: full
|
||||
update_cache: true
|
||||
|
||||
- name: Install common packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- arptables
|
||||
- ebtables
|
||||
- ca-certificates
|
||||
- curl
|
||||
- ebtables
|
||||
- gdisk
|
||||
- hdparm
|
||||
- htop
|
||||
- iputils-ping
|
||||
- ipvsadm
|
||||
- lvm2
|
||||
- nano
|
||||
- net-tools
|
||||
- nfs-common
|
||||
- nvme-cli
|
||||
- open-iscsi
|
||||
- psmisc
|
||||
- smartmontools
|
||||
- socat
|
||||
- software-properties-common
|
||||
- unattended-upgrades
|
||||
- unzip
|
||||
install_recommends: false
|
||||
|
||||
- name: Install RasPi specific packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- linux-modules-extra-raspi
|
||||
install_recommends: false
|
||||
notify: Restart node
|
||||
when: "'raspi' in ansible_kernel"
|
||||
|
||||
- name: Restart node if necessary
|
||||
ansible.builtin.meta: flush_handlers
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
- block:
|
||||
- name: Copy 20auto-upgrades unattended-upgrades config
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
mode: 0644
|
||||
create: true
|
||||
block: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
- name: Copy 50unattended-upgrades unattended-upgrades config
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/apt/apt.conf.d/50unattended-upgrades
|
||||
mode: 0644
|
||||
create: true
|
||||
block: |
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id} stable";
|
||||
"${distro_id} ${distro_codename}-security";
|
||||
"${distro_id} ${distro_codename}-updates";
|
||||
};
|
||||
notify: Restart unattended-upgrades
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
- name: Add user to sudoers
|
||||
ansible.builtin.copy:
|
||||
content: "{{ ansible_user }} ALL=(ALL:ALL) NOPASSWD:ALL"
|
||||
dest: "/etc/sudoers.d/{{ ansible_user }}_nopasswd"
|
||||
mode: "0440"
|
||||
|
||||
- name: Add additional user SSH public keys
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ ansible_user }}"
|
||||
key: "{{ item }}"
|
||||
loop: "{{ ssh_authorized_keys }}"
|
||||
when:
|
||||
- ssh_authorized_keys is defined
|
||||
- ssh_authorized_keys is iterable
|
||||
- ssh_authorized_keys | length > 0
|
||||
Reference in new issue
Block a user