jaydee/ansible
1
0
Fork 0
mirror of https://gitlab.sectorq.eu/jaydee/ansible.git synced 2026-09-08 21:27:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

build-all

Browse Source
This commit is contained in:
jaydee
2026-05-26 23:36:52 +02:00
parent 50fe632963
commit e81af07721
4 changed files with 617 additions and 240 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/init/tasks/Debian.yml
+193
View File
@@ -0,0 +1,193 @@
- name: Init Debian
become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
block:
- name: Ensure required packages are installed
ansible.builtin.apt:
name:
- gpg
- wget
- lsb-release
state: present
update_cache: true
- name: Download HashiCorp GPG key
ansible.builtin.get_url:
url: https://apt.releases.hashicorp.com/gpg
dest: /tmp/hashicorp.gpg
mode: '0644'
- name: Convert HashiCorp GPG key to keyring format
ansible.builtin.command:
cmd: >
gpg --dearmor
-o /usr/share/keyrings/hashicorp-archive-keyring.gpg
/tmp/hashicorp.gpg
args:
creates: /usr/share/keyrings/hashicorp-archive-keyring.gpg
- name: Add HashiCorp repository
ansible.builtin.apt_repository:
repo: >-
deb [arch={{ ansible_architecture == 'x86_64' | ternary('amd64', ansible_architecture) }}
signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
https://apt.releases.hashicorp.com
{{ ansible_distribution_release }}
main
filename: hashicorp
state: present
- name: Update apt cache
ansible.builtin.apt:
update_cache: true
- name: Install Vault
ansible.builtin.apt:
name: vault
state: present
- name: Set vault address
copy:
dest: /etc/profile.d/vault.sh
content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
owner: root
group: root
mode: '0644'
- name: Read SSH CA public key from Vault
ansible.builtin.command:
cmd: vault read -field=public_key ssh/config/ca
register: vault_ca
changed_when: false
environment:
VAULT_ADDR: "{{ vault_addr }}"
VAULT_TOKEN: "{{ vault_token }}"
- name: Install trusted SSH user CA
ansible.builtin.copy:
content: "{{ vault_ca.stdout }}\n"
dest: /etc/ssh/trusted-user-ca-keys.pem
owner: root
group: root
mode: '0644'
- name: Enable Trusted User CA
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: "^TrustedUserCAKeys"
line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
state: present
- name: Enable PubkeyAuthentication
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: "^PubkeyAuthentication.*"
line: "PubkeyAuthentication yes"
state: present
- name: Create vault agent dir
file:
path: /etc/vault-agent
state: directory
owner: root
group: root
mode: '0644'
- name: Create vault agent config
copy:
dest: /etc/vault-agent/config.hcl
content: |
vault {
address = "http://vault.home.lan:8205"
}
auto_auth {
method "approle" {
mount_path = "auth/approle"
config = {
role_id_file_path = "/etc/vault-agent/role_id"
secret_id_file_path = "/etc/vault-agent/secret_id"
remove_secret_id_file_after_reading = false
}
}
sink "file" {
config = {
path = "/tmp/vault-token"
}
}
}
template {
destination = "/home/jd/.ssh/id_ed25519-cert.pub"
perms = "0644"
user = "jd"
group = "jd"
contents = <<EOH
{{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{ '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
EOH
}
owner: root
group: root
mode: '0644'
- name: Create file with token for vault agent
copy:
dest: /etc/vault-agent/token
content: "{{ vault_sshcert_token }}"
owner: root
group: root
mode: '0600'
- name: Create file with role_id for vault agent
copy:
dest: /etc/vault-agent/role_id
content: "{{ vault_ssh_client_role_id }}"
owner: root
group: root
mode: '0600'
- name: Create file with secret_id for vault agent
copy:
dest: /etc/vault-agent/secret_id
content: "{{ vault_ssh_client_secret_id }}"
owner: root
group: root
mode: '0600'
- name: Create service for vault agent
copy:
dest: /etc/systemd/system/vault-agent.service
content: |
[Unit]
Description=Vault Agent
After=network-online.target
[Service]
ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
Restart=always
User=root
Group=root
[Install]
WantedBy=multi-user.target
owner: root
group: root
mode: '0644'
- name: Enable and start vault agent service
systemd:
name: vault-agent
enabled: yes
state: started
- name: Restart sshd
ansible.builtin.service:
name: sshd
state: restarted
- name: Sync time
ansible.builtin.command:
cmd: chronyc makestep
changed_when: false
roles/init/tasks/Rocky.yml
+171
View File
@@ -0,0 +1,171 @@
- name: Init
become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
block:
- name: Install required dependencies
ansible.builtin.dnf:
name:
- dnf-plugins-core
- curl
state: present
- name: Add HashiCorp repository
ansible.builtin.get_url:
url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
dest: /etc/yum.repos.d/hashicorp.repo
mode: "0644"
- name: Clean DNF cache
ansible.builtin.command: dnf clean all
changed_when: false
- name: Install Vault
ansible.builtin.dnf:
name: vault
state: present
update_cache: yes
- name: Set vault address
copy:
dest: /etc/profile.d/vault.sh
content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
owner: root
group: root
mode: '0644'
- name: Read SSH CA public key from Vault
ansible.builtin.command:
cmd: vault read -field=public_key ssh/config/ca
register: vault_ca
changed_when: false
environment:
VAULT_ADDR: "{{ vault_addr }}"
VAULT_TOKEN: "{{ vault_token }}"
- name: Install trusted SSH user CA
ansible.builtin.copy:
content: "{{ vault_ca.stdout }}\n"
dest: /etc/ssh/trusted-user-ca-keys.pem
owner: root
group: root
mode: '0644'
- name: Enable Trusted User CA
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: "^TrustedUserCAKeys"
line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
state: present
- name: Enable PubkeyAuthentication
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: "^PubkeyAuthentication.*"
line: "PubkeyAuthentication yes"
state: present
- name: Create vault agent dir
file:
path: /etc/vault-agent
state: directory
owner: root
group: root
mode: '0644'
- name: Create vault agent config
copy:
dest: /etc/vault-agent/config.hcl
content: |
vault {
address = "http://vault.home.lan:8205"
}
auto_auth {
method "approle" {
mount_path = "auth/approle"
config = {
role_id_file_path = "/etc/vault-agent/role_id"
secret_id_file_path = "/etc/vault-agent/secret_id"
remove_secret_id_file_after_reading = false
}
}
sink "file" {
config = {
path = "/tmp/vault-token"
}
}
}
template {
destination = "/home/jd/.ssh/id_ed25519-cert.pub"
perms = "0644"
user = "jd"
group = "jd"
contents = <<EOH
{{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{ '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
EOH
}
owner: root
group: root
mode: '0644'
- name: Create file with token for vault agent
copy:
dest: /etc/vault-agent/token
content: "{{ vault_sshcert_token }}"
owner: root
group: root
mode: '0600'
- name: Create file with role_id for vault agent
copy:
dest: /etc/vault-agent/role_id
content: "{{ vault_ssh_client_role_id }}"
owner: root
group: root
mode: '0600'
- name: Create file with secret_id for vault agent
copy:
dest: /etc/vault-agent/secret_id
content: "{{ vault_ssh_client_secret_id }}"
owner: root
group: root
mode: '0600'
- name: Create service for vault agent
copy:
dest: /etc/systemd/system/vault-agent.service
content: |
[Unit]
Description=Vault Agent
After=network-online.target
[Service]
ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
Restart=always
User=root
Group=root
[Install]
WantedBy=multi-user.target
owner: root
group: root
mode: '0644'
- name: Enable and start vault agent service
systemd:
name: vault-agent
enabled: yes
state: started
- name: Restart sshd
ansible.builtin.service:
name: sshd
state: restarted
- name: Sync time
ansible.builtin.command:
cmd: chronyc makestep
changed_when: false
roles/init/tasks/common.yml
Executable
+243
View File
@@ -0,0 +1,243 @@
- name: Init
become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
block:
- name: Include vault
ansible.builtin.include_vars:
file: init.yml
- name: Change password for jd
ansible.builtin.user:
name: jd
password: "{{ jd_password | password_hash('sha512') }}"
- name: "Ensure sudo binary exist"
stat:
path: /usr/bin/sudo
register: sudo_binary
- name: "Install sudo if not present"
package:
name: sudo
state: present
when: not sudo_binary.stat.exists
- name: Check if group exists
getent:
database: group
key: sudo
register: group_check
ignore_errors: true
- name: Ensure deploy user exists
ansible.builtin.user:
name: jd
shell: /bin/bash
groups: sudo
append: true
when: group_check is succeeded
- name: Ensure directory sudoers.d exists
file:
path: /etc/sudoers.d
state: directory
owner: root
group: root
mode: '0755'
- name: Give jd passwordless sudo
copy:
dest: /etc/sudoers.d/jd
content: "jd ALL=(ALL) NOPASSWD:ALL\n"
owner: root
group: root
mode: '0440'
- name: Change password for root
ansible.builtin.user:
name: root
password: "{{ jd_password | password_hash('sha512') }}"
- name: Update become password for subsequent tasks
ansible.builtin.set_fact:
ansible_become_password: "{{ jd_password }}"
- name: Set timezone to Europe/Bratislava
ansible.builtin.command:
cmd: timedatectl set-timezone Europe/Bratislava
args:
creates: /etc/timezone
- name: Set hostname
ansible.builtin.hostname:
name: "{{ inventory_hostname }}"
- name: Add host entry to /etc/hosts
ansible.builtin.lineinfile:
path: /etc/hosts
regexp: "^127.0.0.1 .*"
line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}"
state: present
- name: Install required dependencies
ansible.builtin.dnf:
name:
- dnf-plugins-core
- curl
state: present
- name: Add HashiCorp repository
ansible.builtin.get_url:
url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
dest: /etc/yum.repos.d/hashicorp.repo
mode: "0644"
- name: Clean DNF cache
ansible.builtin.command: dnf clean all
changed_when: false
- name: Install Vault
ansible.builtin.dnf:
name: vault
state: present
update_cache: yes
- name: Set vault address
copy:
dest: /etc/profile.d/vault.sh
content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
owner: root
group: root
mode: '0644'
- name: Read SSH CA public key from Vault
ansible.builtin.command:
cmd: vault read -field=public_key ssh/config/ca
register: vault_ca
changed_when: false
environment:
VAULT_ADDR: "{{ vault_addr }}"
VAULT_TOKEN: "{{ vault_token }}"
- name: Install trusted SSH user CA
ansible.builtin.copy:
content: "{{ vault_ca.stdout }}\n"
dest: /etc/ssh/trusted-user-ca-keys.pem
owner: root
group: root
mode: '0644'
- name: Enable Trusted User CA
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: "^TrustedUserCAKeys"
line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
state: present
- name: Enable PubkeyAuthentication
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: "^PubkeyAuthentication.*"
line: "PubkeyAuthentication yes"
state: present
- name: Create vault agent dir
file:
path: /etc/vault-agent
state: directory
owner: root
group: root
mode: '0644'
- name: Create vault agent config
copy:
dest: /etc/vault-agent/config.hcl
content: |
vault {
address = "http://vault.home.lan:8205"
}
auto_auth {
method "approle" {
mount_path = "auth/approle"
config = {
role_id_file_path = "/etc/vault-agent/role_id"
secret_id_file_path = "/etc/vault-agent/secret_id"
remove_secret_id_file_after_reading = false
}
}
sink "file" {
config = {
path = "/tmp/vault-token"
}
}
}
template {
destination = "/home/jd/.ssh/id_ed25519-cert.pub"
perms = "0644"
user = "jd"
group = "jd"
contents = <<EOH
{{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{ '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
EOH
}
owner: root
group: root
mode: '0644'
- name: Create file with token for vault agent
copy:
dest: /etc/vault-agent/token
content: "{{ vault_sshcert_token }}"
owner: root
group: root
mode: '0600'
- name: Create file with role_id for vault agent
copy:
dest: /etc/vault-agent/role_id
content: "{{ vault_ssh_client_role_id }}"
owner: root
group: root
mode: '0600'
- name: Create file with secret_id for vault agent
copy:
dest: /etc/vault-agent/secret_id
content: "{{ vault_ssh_client_secret_id }}"
owner: root
group: root
mode: '0600'
- name: Create service for vault agent
copy:
dest: /etc/systemd/system/vault-agent.service
content: |
[Unit]
Description=Vault Agent
After=network-online.target
[Service]
ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
Restart=always
User=root
Group=root
[Install]
WantedBy=multi-user.target
owner: root
group: root
mode: '0644'
- name: Enable and start vault agent service
systemd:
name: vault-agent
enabled: yes
state: started
- name: Restart sshd
ansible.builtin.service:
name: sshd
state: restarted
- name: Sync time
ansible.builtin.command:
cmd: chronyc makestep
changed_when: false
roles/init/tasks/main.yml
+10 -240
View File
@@ -1,243 +1,13 @@
- name: Init - name: Include vault
become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}" ansible.builtin.include_vars:
block: file: jaydee.yml
- name: Include vault - name: Facts
ansible.builtin.include_vars: ansible.builtin.setup:
file: init.yml when: ansible_facts.architecture is not defined
- name: Change password for jd
ansible.builtin.user:
name: jd
password: "{{ jd_password | password_hash('sha512') }}"
- name: "Ensure sudo binary exist"
stat:
path: /usr/bin/sudo
register: sudo_binary
- name: "Install sudo if not present"
package:
name: sudo
state: present
when: not sudo_binary.stat.exists
- name: Check if group exists
getent:
database: group
key: sudo
register: group_check
ignore_errors: true
- name: Ensure deploy user exists
ansible.builtin.user:
name: jd
shell: /bin/bash
groups: sudo
append: true
when: group_check is succeeded
- name: Ensure directory sudoers.d exists
file:
path: /etc/sudoers.d
state: directory
owner: root
group: root
mode: '0755'
- name: Give jd passwordless sudo
copy:
dest: /etc/sudoers.d/jd
content: "jd ALL=(ALL) NOPASSWD:ALL\n"
owner: root
group: root
mode: '0440'
- name: Change password for root - name: Include common tasks
ansible.builtin.user: ansible.builtin.include_tasks: common.yml"
name: root
password: "{{ jd_password | password_hash('sha512') }}"
- name: Update become password for subsequent tasks - name: Include OS-specific tasks
ansible.builtin.set_fact: ansible.builtin.include_tasks: "{{ ansible_facts.os_family }}.yml"
ansible_become_password: "{{ jd_password }}"
- name: Set timezone to Europe/Bratislava
ansible.builtin.command:
cmd: timedatectl set-timezone Europe/Bratislava
args:
creates: /etc/timezone
- name: Set hostname
ansible.builtin.hostname:
name: "{{ inventory_hostname }}"
- name: Add host entry to /etc/hosts
ansible.builtin.lineinfile:
path: /etc/hosts
regexp: "^127.0.0.1 .*"
line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}"
state: present
- name: Install required dependencies
ansible.builtin.dnf:
name:
- dnf-plugins-core
- curl
state: present
- name: Add HashiCorp repository
ansible.builtin.get_url:
url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
dest: /etc/yum.repos.d/hashicorp.repo
mode: "0644"
- name: Clean DNF cache
ansible.builtin.command: dnf clean all
changed_when: false
- name: Install Vault
ansible.builtin.dnf:
name: vault
state: present
update_cache: yes
- name: Set vault address
copy:
dest: /etc/profile.d/vault.sh
content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
owner: root
group: root
mode: '0644'
- name: Read SSH CA public key from Vault
ansible.builtin.command:
cmd: vault read -field=public_key ssh/config/ca
register: vault_ca
changed_when: false
environment:
VAULT_ADDR: "{{ vault_addr }}"
VAULT_TOKEN: "{{ vault_token }}"
- name: Install trusted SSH user CA
ansible.builtin.copy:
content: "{{ vault_ca.stdout }}\n"
dest: /etc/ssh/trusted-user-ca-keys.pem
owner: root
group: root
mode: '0644'
- name: Enable Trusted User CA
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: "^TrustedUserCAKeys"
line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
state: present
- name: Enable PubkeyAuthentication
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: "^PubkeyAuthentication.*"
line: "PubkeyAuthentication yes"
state: present
- name: Create vault agent dir
file:
path: /etc/vault-agent
state: directory
owner: root
group: root
mode: '0644'
- name: Create vault agent config
copy:
dest: /etc/vault-agent/config.hcl
content: |
vault {
address = "http://vault.home.lan:8205"
}
auto_auth {
method "approle" {
mount_path = "auth/approle"
config = {
role_id_file_path = "/etc/vault-agent/role_id"
secret_id_file_path = "/etc/vault-agent/secret_id"
remove_secret_id_file_after_reading = false
}
}
sink "file" {
config = {
path = "/tmp/vault-token"
}
}
}
template {
destination = "/home/jd/.ssh/id_ed25519-cert.pub"
perms = "0644"
user = "jd"
group = "jd"
contents = <<EOH
{{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{ '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
EOH
}
owner: root
group: root
mode: '0644'
- name: Create file with token for vault agent
copy:
dest: /etc/vault-agent/token
content: "{{ vault_sshcert_token }}"
owner: root
group: root
mode: '0600'
- name: Create file with role_id for vault agent
copy:
dest: /etc/vault-agent/role_id
content: "{{ vault_ssh_client_role_id }}"
owner: root
group: root
mode: '0600'
- name: Create file with secret_id for vault agent
copy:
dest: /etc/vault-agent/secret_id
content: "{{ vault_ssh_client_secret_id }}"
owner: root
group: root
mode: '0600'
- name: Create service for vault agent
copy:
dest: /etc/systemd/system/vault-agent.service
content: |
[Unit]
Description=Vault Agent
After=network-online.target
[Service]
ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
Restart=always
User=root
Group=root
[Install]
WantedBy=multi-user.target
owner: root
group: root
mode: '0644'
- name: Enable and start vault agent service
systemd:
name: vault-agent
enabled: yes
state: started
- name: Restart sshd
ansible.builtin.service:
name: sshd
state: restarted
- name: Sync time
ansible.builtin.command:
cmd: chronyc makestep
changed_when: false