jaydee/ansible
1
0
Fork 0
mirror of https://gitlab.sectorq.eu/jaydee/ansible.git synced 2025-07-01 23:48:32 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Compare commits

base: jaydee:d4ee9dc3eb5e1b7de1a6015945b198ee3e81b2a3
Branches Tags
jaydee:main
...
compare: jaydee:e6ab9ac621b035abe9e4040394148bd278c2cb32
Branches Tags
jaydee:main

7 Commits
d4ee9dc3eb ... e6ab9ac621

Author SHA1 Message Date
ladislav.dusa
e6ab9ac621 renamed customer user group 2025-04-16 12:36:30 +02:00
ladislav.dusa
c2ba911536 renamed customer user group 2025-04-16 12:36:15 +02:00
ladislav.dusa
9be37d9ad5 renamed customer user group 2025-04-16 11:38:58 +02:00
jaydee
80ddec608a lala 2025-04-16 09:32:40 +02:00
jaydee
24191afe3d alias 2025-04-16 09:31:09 +02:00
ladislav.dusa
4c1e374f23 renamed customer user group 2025-04-16 09:19:25 +02:00
ladislav.dusa
eaa4ecd07a renamed customer user group 2025-04-16 09:18:30 +02:00
26 changed files with 715 additions and 2551 deletions
Expand all files Collapse all files

38
all.yml
View File

@ -1,39 +1,67 @@
- hosts: datacenter - hosts: datacenter
name: Roles name: Roles
gather_facts: false
roles: roles:
- name: setup
role: setup
tags: setup
- name: common - name: common
tags: common tags: common
role: common
- name: hosts - name: hosts
role: hosts
tags: hosts tags: hosts
- name: ssh_config - name: ssh_config
role: ssh_config
tags: ssh_config tags: ssh_config
- name: sshd_config
role: sshd_config
tags: sshd_config
- name: ssh_keys
role: ssh_keys
tags: ssh_keys
- name: wake_on_lan - name: wake_on_lan
role: wake_on_lan
tags: wake_on_lan tags: wake_on_lan
- name: matter-server - name: matter-server
role: matter-server
tags: matter-server tags: matter-server
- name: docker - name: docker
role: docker
tags: docker tags: docker
- name: timeshift - name: timeshift
role: timeshift
tags: timeshift tags: timeshift
- name: monitoring - name: monitoring
role: monitoring
tags: monitoring tags: monitoring
- name: zabbix-agent - name: zabbix-agent
role: zabbix-agent
tags: zabbix-agent tags: zabbix-agent
- name: autofs_client - name: autofs_client
role: autofs_client
tags: autofs_client tags: autofs_client
- name: ldap_client - name: ldap_client
role: ldap_client
tags: ldap_client tags: ldap_client
- name: ssh_banner - name: ssh_banner
role: ssh_banner
tags: ssh_banner tags: ssh_banner
- name: omv_backup - name: omv_backup
role: omv_backup
tags: omv_backup tags: omv_backup
- name: wazuh-agent - name: wazuh-agent
role: wazuh-agent
tags: wazuh-agent tags: wazuh-agent
- role: mqtt-srv - name: mqtt-srv
role: mqtt-srv
tags: mqtt-srv tags: mqtt-srv
- role: vnc_server - name: vnc_server
role: vnc_server
tags: vnc_server tags: vnc_server
- role: promtail - name: promtail
role: promtail
tags: promtail tags: promtail
- role: sudoers - name: sudoers
tags: sudoers role: sudoers
tags: sudoers

1983
api_call.log
View File

File diff suppressed because it is too large Load Diff

7
collections/requirements.yml
View File

@ -1,3 +1,6 @@
--- # requirements.yml
# ansible-galaxy collection install -r collections/requirements.yml --force
collections: collections:
- name: community.general - name: community.general
source: https://galaxy.ansible.com
- name: community.docker

164
roles/autofs_client/tasks/main.yml
View File

@ -1,83 +1,95 @@
- block: - name: Setup autofs
- name: include vault become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
ansible.builtin.include_vars: block:
file: jaydee.yml - name: Include vault
- name: Install autofs ansible.builtin.include_vars:
ansible.builtin.apt: file: jaydee.yml
name: - name: Install autofs
- autofs ansible.builtin.apt:
- cifs-utils name:
state: present - autofs
- cifs-utils
state: present
- name: Creating a file with content - name: Creating a file with content
copy: ansible.builtin.copy:
dest: "/etc/auto.auth" dest: "/etc/auto.auth"
content: | content: |
username={{ samba_user }} username={{ samba_user }}
password={{ samba_password }} password={{ samba_password }}
mode: '0700'
- name: Creating a file with content owner: root
copy: group: root
dest: "/etc/auto.nas-movies"
content: |
movies -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw ://nas.home.lan/movies
- name: Creating a file with content
copy:
dest: "/etc/auto.nas-music"
content: |
music -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw ://nas.home.lan/music
- name: Creating a file with content
copy:
dest: "/etc/auto.nas-shows"
content: |
shows -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw ://nas.home.lan/shows
- name: Creating a file with content
copy:
dest: "/etc/auto.nas"
content: |
nas-data -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/Data
nas-docker-data -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/docker_data
nas-photo -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/Photo
nas-public -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/Public
nas-install -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/install
nas-downloads -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/downloads
nas-games -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/qda_2
# - name: Reconfigure autofs Server
# ansible.builtin.lineinfile:
# path: /etc/auto.master
# regexp: "^/media/nas.*"
# insertafter: '^/media/nas'
# line: "/media/nas /etc/auto.nas --timeout 360 --ghost"
- name: Reconfigure autofs Server - name: Creating a file with content
ansible.builtin.lineinfile: ansible.builtin.copy:
path: /etc/auto.master dest: "/etc/auto.nas-movies"
regexp: "^/media/data/music/nas.*" content: |
line: /media/data/music/nas /etc/auto.nas-music --timeout 360 --ghost movies -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw ://nas.home.lan/movies
- name: Reconfigure autofs Server mode: '0700'
ansible.builtin.lineinfile: owner: root
path: /etc/auto.master group: root
regexp: "^/media/data/movies/nas.*"
line: /media/data/movies/nas /etc/auto.nas-movies --timeout 360 --ghost
- name: Reconfigure autofs Server
ansible.builtin.lineinfile:
path: /etc/auto.master
regexp: "^/media/data/shows/nas.*"
line: /media/data/shows/nas /etc/auto.nas-shows --timeout 360 --ghost
- name: Reconfigure autofs Server
ansible.builtin.lineinfile:
path: /etc/auto.master
line: /media/nas /etc/auto.nas --timeout 360 --ghost
- name: Creating a file with content
ansible.builtin.copy:
dest: "/etc/auto.nas-music"
content: |
music -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw ://nas.home.lan/music
mode: '0700'
owner: root
group: root
- name: Creating a file with content
ansible.builtin.copy:
dest: "/etc/auto.nas-shows"
content: |
shows -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw ://nas.home.lan/shows
mode: '0700'
owner: root
group: root
- name: Creating a file with content
ansible.builtin.copy:
dest: "/etc/auto.nas"
content: |
nas-data -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/Data
nas-docker-data -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/docker_data
nas-photo -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/Photo
nas-public -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/Public
nas-install -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/install
nas-downloads -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/downloads
nas-games -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/qda_2
mode: '0700'
owner: root
group: root
# - name: Reconfigure autofs Server
# ansible.builtin.lineinfile:
# path: /etc/auto.master
# regexp: "^/media/nas.*"
# insertafter: '^/media/nas'
# line: "/media/nas /etc/auto.nas --timeout 360 --ghost"
- name: Reconfigure autofs Server
ansible.builtin.lineinfile:
path: /etc/auto.master
regexp: "^/media/data/music/nas.*"
line: /media/data/music/nas /etc/auto.nas-music --timeout 360 --ghost
- name: Reconfigure autofs Server
ansible.builtin.lineinfile:
path: /etc/auto.master
regexp: "^/media/data/movies/nas.*"
line: /media/data/movies/nas /etc/auto.nas-movies --timeout 360 --ghost
- name: Reconfigure autofs Server
ansible.builtin.lineinfile:
path: /etc/auto.master
regexp: "^/media/data/shows/nas.*"
line: /media/data/shows/nas /etc/auto.nas-shows --timeout 360 --ghost
- name: Reconfigure autofs Server
ansible.builtin.lineinfile:
path: /etc/auto.master
line: /media/nas /etc/auto.nas --timeout 360 --ghost
- name: Restart docker service
ansible.builtin.service:
- name: Restart docker service name: autofs
ansible.builtin.service: state: restarted
name: autofs
state: restarted
become: true

253
roles/docker/tasks/main.yml
View File

@ -1,113 +1,164 @@
- block: - name: Setup docker
- name: print arch become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
debug: block:
msg: "{{ ansible_architecture }}" - name: Print arch
- name: Install docker ansible.builtin.debug:
ansible.builtin.apt: msg: "{{ ansible_architecture }}"
name: - name: Install docker
- ca-certificates ansible.builtin.apt:
- curl name:
- telnet - ca-certificates
- net-tools - curl
- python3-pip - telnet
- python3-dev - net-tools
state: present - python3-pip
update_cache: true - python3-dev
- name: Get keys for raspotify state: present
ansible.builtin.shell: update_cache: true
install -m 0755 -d /etc/apt/keyrings - name: Get keys for raspotify
ansible.builtin.command:
install -m 0755 -d /etc/apt/keyrings
changed_when: my_output.rc != 0
- name: Get keys for raspotify - name: Add an Apt signing key to a specific keyring file
ansible.builtin.shell: ansible.builtin.apt_key:
curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc url: https://download.docker.com/linux/debian/gpg
when: keyring: /etc/apt/keyrings/docker.asc
when:
- ansible_distribution == "Debian" and ansible_distribution_major_version == "12" - ansible_distribution == "Debian" and ansible_distribution_major_version == "12"
- name: Get keys for raspotify
ansible.builtin.shell: # - name: Get keys for raspotify
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc # ansible.builtin.shell:
when: # curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
# when:
# - ansible_distribution == "Debian" and ansible_distribution_major_version == "12"
- name: Add an Apt signing key to a specific keyring file
ansible.builtin.apt_key:
url: https://download.docker.com/linux/ubuntu/gpg
keyring: /etc/apt/keyrings/docker.asc
when:
- ansible_distribution == "Ubuntu" - ansible_distribution == "Ubuntu"
- name: Get keys for raspotify # - name: Get keys for raspotify
ansible.builtin.shell: # ansible.builtin.shell:
chmod a+r /etc/apt/keyrings/docker.asc # curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
# when:
# - ansible_distribution == "Ubuntu"
- name: Change file ownership, group and permissions
ansible.builtin.file:
path: /etc/apt/keyrings/docker.asc
owner: root
group: root
mode: '0644'
- name: Get keys for raspotify # - name: Get keys for raspotify
ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null # ansible.builtin.shell:
when: # chmod a+r /etc/apt/keyrings/docker.asc
- name: Get keys for raspotify
ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc]\
https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" |\
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
when:
- ansible_distribution == "Debian" and ansible_distribution_major_version == "12" - ansible_distribution == "Debian" and ansible_distribution_major_version == "12"
- name: Get keys for raspotify changed_when: my_output.rc != 0
ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
when:
- ansible_distribution == "Ubuntu"
- name: Install docker
ansible.builtin.apt:
name:
- docker-ce
- docker-ce-cli
- containerd.io
- docker-buildx-plugin
- docker-compose-plugin
update_cache: true
- name: Create a directory docker.service.d - name: Get keys for raspotify
ansible.builtin.file: ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc]\
path: /etc/systemd/system/docker.service.d/ https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" |\
state: directory sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
mode: '0755' when:
- name: Create a directory for certs - ansible_distribution == "Ubuntu"
ansible.builtin.file: changed_when: my_output.rc != 0
path: /etc/docker/certs
state: directory
mode: '0700'
- name: Copy files
copy:
src: server-key.pem
dest: /etc/docker/certs/
- name: Copy files
copy:
src: ca.pem
dest: /etc/docker/certs/
- name: Copy files
copy:
src: server-cert.pem
dest: /etc/docker/certs/
- name: Creating a file with content
copy:
dest: "/etc/systemd/system/docker.service.d/override.conf"
content: |
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
notify: restart_docker
when: mode == "nocert"
- name: Creating a file with content
copy:
dest: "/etc/systemd/system/docker.service.d/override.conf"
content: |
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
notify: restart_docker
when: mode != "nocert"
- name: Just force systemd to reread configs - name: Install docker
ansible.builtin.systemd: ansible.builtin.apt:
daemon_reload: true name:
- docker-ce
- docker-ce-cli
- containerd.io
- docker-buildx-plugin
- docker-compose-plugin
update_cache: true
- name: Restart docker service - name: Create a directory docker.service.d
ansible.builtin.service: ansible.builtin.file:
name: docker path: /etc/systemd/system/docker.service.d/
state: restarted state: directory
mode: '0755'
- name: Create a directory for certs
ansible.builtin.file:
path: /etc/docker/certs
state: directory
mode: '0700'
owner: root
group: root
# - name: Get keys for raspotify - name: Copy files
# ansible.builtin.shell: docker plugin install grafana/loki-docker-driver:3.3.2-{{ ansible_architecture }} --alias loki --grant-all-permissions ansible.builtin.copy:
- name: Install a plugin src: server-key.pem
community.docker.docker_plugin: dest: /etc/docker/certs/
plugin_name: grafana/loki-docker-driver:3.3.2 mode: '0600'
alias: loki owner: root
state: present group: root
- name: Copy files
ansible.builtin.copy:
src: ca.pem
dest: /etc/docker/certs/
mode: '0600'
owner: root
group: root
- name: Copy files
ansible.builtin.copy:
src: server-cert.pem
dest: /etc/docker/certs/
mode: '0600'
owner: root
group: root
- name: Creating a file with content
ansible.builtin.copy:
dest: "/etc/systemd/system/docker.service.d/override.conf"
content: |
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
--tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
--tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
mode: '0600'
owner: root
group: root
notify: restart_docker
when: mode == "nocert"
- name: Creating a file with content
ansible.builtin.copy:
dest: "/etc/systemd/system/docker.service.d/override.conf"
content: |
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
--tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
--tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
mode: '0600'
owner: root
group: root
notify: restart_docker
when: mode != "nocert"
become: true - name: Just force systemd to reread configs
ansible.builtin.systemd:
daemon_reload: true
- name: Restart docker service
ansible.builtin.service:
name: docker
state: restarted
# - name: Get keys for raspotify
# ansible.builtin.shell: docker plugin install grafana/loki-docker-driver:3.3.2-{{ ansible_architecture }} --alias loki --grant-all-permissions
- name: Install a plugin
community.docker.docker_plugin:
plugin_name: grafana/loki-docker-driver:3.3.2
alias: loki
state: present

84
roles/fail2ban/tasks/main.yml
View File

@ -1,41 +1,51 @@
- block: - name: Setup Fail2ban
- name: Install fail2ban packages become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
ansible.builtin.apt: block:
name: - name: Install fail2ban packages
- fail2ban ansible.builtin.apt:
- sendmail name:
#add line to /etc/hosts - fail2ban
#127.0.0.1 m-server localhost.... - sendmail
- name: Copy files # add line to /etc/hosts
copy: # 127.0.0.1 m-server localhost....
src: "{{ item }}" - name: Copy files
dest: /etc/fail2ban/jail.d/ ansible.builtin.copy:
with_fileglob: src: "{{ item }}"
- "jail.d/*.conf" dest: /etc/fail2ban/jail.d/
mode: '0700'
owner: root
group: root
with_fileglob:
- "jail.d/*.conf"
- name: Copy files - name: Copy files
copy: ansible.builtin.copy:
src: "{{ item }}" src: "{{ item }}"
dest: /etc/fail2ban/filter.d/ dest: /etc/fail2ban/filter.d/
with_fileglob: mode: '0700'
- "filter.d/*.conf" owner: root
group: root
with_fileglob:
- "filter.d/*.conf"
- name: Copy files - name: Copy files
copy: ansible.builtin.copy:
src: "{{ item }}" src: "{{ item }}"
dest: /etc/fail2ban/action.d/ dest: /etc/fail2ban/action.d/
with_fileglob: mode: '0700'
- "action.d/*.conf" owner: root
group: root
with_fileglob:
- "action.d/*.conf"
- name: disable sendmail service - name: Disable sendmail service
ansible.builtin.service: ansible.builtin.service:
name: sendmail.service name: sendmail.service
state: stopped state: stopped
enabled: false enabled: false
- name: Restart fail2ban service - name: Restart fail2ban service
ansible.builtin.service: ansible.builtin.service:
name: fail2ban.service name: fail2ban.service
state: restarted state: restarted
enabled: true enabled: true
become: true

50
roles/hosts/tasks/main.yml
View File

@ -1,28 +1,28 @@
- name: Hosts - name: Hosts
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
block: block:
- name: Reconfigure hosts file - name: Reconfigure hosts file
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: "/etc/hosts" path: "/etc/hosts"
regexp: "^192.168.77.101 .*" regexp: "^192.168.77.101 .*"
line: "192.168.77.101 m-server m-server.home.lan" line: "192.168.77.101 m-server m-server.home.lan"
- name: Reconfigure hosts file - name: Reconfigure hosts file
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: "/etc/hosts" path: "/etc/hosts"
regexp: "^192.168.77.106 .*" regexp: "^192.168.77.106 .*"
line: "192.168.77.106 nas nas.home.lan" line: "192.168.77.106 nas nas.home.lan"
- name: Reconfigure hosts file - name: Reconfigure hosts file
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: "/etc/hosts" path: "/etc/hosts"
regexp: "^192.168.77.238 .*" regexp: "^192.168.77.238 .*"
line: "192.168.77.238 rpi5 rpi5.home.lan" line: "192.168.77.238 rpi5 rpi5.home.lan"
- name: Reconfigure hosts file - name: Reconfigure hosts file
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: "/etc/hosts" path: "/etc/hosts"
regexp: "^192.168.77.4 .*" regexp: "^192.168.77.4 .*"
line: "192.168.77.4 amd amd.home.lan" line: "192.168.77.4 amd amd.home.lan"
- name: Reconfigure hosts file - name: Reconfigure hosts file
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: "/etc/hosts" path: "/etc/hosts"
regexp: "^192.168.77.55 .*" regexp: "^192.168.77.55 .*"
line: "192.168.77.55 rack rack.home.lan" line: "192.168.77.55 rack rack.home.lan"

20
roles/loki-agent/tasks/main.yml
View File

@ -1,20 +0,0 @@
- block:
- name: Get keys
ansible.builtin.shell: curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
- name: Add repo
ansible.builtin.shell: echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
- name: Update cache
ansible.builtin.apt:
update_cache: true
- name: Instal wazuh
ansible.builtin.apt:
name: wazuh-agent
environment:
WAZUH_MANAGER: 'm-server.home.lan'
WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
- name: Restart wazuh service
ansible.builtin.service:
name: wazuh-agent
state: restarted
enabled: true
become: true

1
roles/loki-agent/vars/main.yml
View File

@ -1 +0,0 @@
ZABBIX_SERVER: "zabbix.home.lan"

22
roles/matter-server/tasks/main.yml
View File

@ -1,10 +1,12 @@
- block: - name: Setup matter server
- name: Reconfigure config become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
ansible.builtin.lineinfile: block:
path: /etc/sysctl.conf - name: Reconfigure config
regexp: "^Unet.ipv4.igmp_max_memberships.*" ansible.builtin.lineinfile:
line: "net.ipv4.igmp_max_memberships = 80" path: /etc/sysctl.conf
- name: Restart agent regexp: "^Unet.ipv4.igmp_max_memberships.*"
ansible.builtin.shell: echo 80 > /proc/sys/net/ipv4/igmp_max_memberships line: "net.ipv4.igmp_max_memberships = 80"
notify: restart_matter_server - name: Restart agent
become: true ansible.builtin.shell: echo 80 > /proc/sys/net/ipv4/igmp_max_memberships
notify: restart_matter_server
changed_when: my_output.rc != 0

45
roles/monitoring/tasks/main.yml
View File

@ -2,7 +2,7 @@
ansible.builtin.set_fact: ansible.builtin.set_fact:
zabbix_agent_cfg: "/etc/zabbix/zabbix_agent2.conf" zabbix_agent_cfg: "/etc/zabbix/zabbix_agent2.conf"
when: inventory_hostname != 'nas.home.lan' when: inventory_hostname != 'nas.home.lan'
- name: Get config for nas - name: Get config for nas
ansible.builtin.set_fact: ansible.builtin.set_fact:
zabbix_agent_cfg: "/opt/ZabbixAgent/etc/zabbix_agentd.conf" zabbix_agent_cfg: "/opt/ZabbixAgent/etc/zabbix_agentd.conf"
@ -29,42 +29,43 @@
become: true become: true
- name: Install a .deb package from the internet2 - name: Install a .deb package from the internet2
ansible.builtin.apt: ansible.builtin.apt:
#deb: https://repo.zabbix.com/zabbix/6.4/raspbian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb # deb: https://repo.zabbix.com/zabbix/6.4/raspbian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb
deb: https://repo.zabbix.com/zabbix/7.0/raspbian/pool/main/z/zabbix-release/zabbix-release_7.0-1+debian11_all.deb deb: https://repo.zabbix.com/zabbix/7.0/raspbian/pool/main/z/zabbix-release/zabbix-release_7.0-1+debian11_all.deb
retries: 5 retries: 5
delay: 5 delay: 5
when: when:
- ansible_facts.architecture == "armv7l" or ansible_facts.architecture == "aarch64" - ansible_facts.architecture == "armv7l" or ansible_facts.architecture == "aarch64"
become: true become: true
ignore_errors: true failed_when: my_output.rc != 0
- name: Install a .deb package from the internet3 - name: Install a .deb package from the internet3
ansible.builtin.apt: ansible.builtin.apt:
deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb
become: true become: true
when: when:
- ansible_facts.architecture != "armv7l" and ansible_distribution == "Debian" and ansible_distribution_major_version == "11" - ansible_facts.architecture != "armv7l" and ansible_distribution == "Debian" and ansible_distribution_major_version == "11"
- name: Install a .deb package from the internet4 - name: Install a .deb package from the internet4
ansible.builtin.apt: ansible.builtin.apt:
#deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb # deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb
deb: https://repo.zabbix.com/zabbix/7.2/debian/pool/main/z/zabbix-release/zabbix-release_7.2-1+debian12_all.deb deb: https://repo.zabbix.com/zabbix/7.2/debian/pool/main/z/zabbix-release/zabbix-release_7.2-1+debian12_all.deb
when: when:
- ansible_facts.architecture != "armv7l" and ansible_facts.architecture != "aarch64" and ansible_distribution == "Debian" and ansible_distribution_major_version == "12" - ansible_facts.architecture != "armv7l"
ignore_errors: true - ansible_facts.architecture != "aarch64"
- ansible_distribution == "Debian"
- ansible_distribution_major_version == "12"
failed_when: my_output.rc != 0
become: true become: true
# - name: Install a .deb package localy
# ansible.builtin.apt:
# deb: /tmp/zabbix-release_6.4-1+ubuntu22.04_all.deb
- name: Install zabbix packages - name: Install zabbix packages
ansible.builtin.apt: ansible.builtin.apt:
name: name:
- zabbix-agent2 - zabbix-agent2
- zabbix-agent2-plugin-mongodb - zabbix-agent2-plugin-mongodb
- zabbix-agent2-plugin-postgresql - zabbix-agent2-plugin-postgresql
update_cache: yes update_cache: false
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
ignore_errors: true failed_when: my_output.rc != 0
when: inventory_hostname != 'nas.home.lan' when: inventory_hostname != 'nas.home.lan'
- name: Reconfigure zabbix agent Server - name: Reconfigure zabbix agent Server
@ -99,14 +100,14 @@
regexp: "^Hostname=.*" regexp: "^Hostname=.*"
line: "Hostname={{ inventory_hostname }}" line: "Hostname={{ inventory_hostname }}"
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
- name: Reconfigure zabbix-agent2 config - name: Reconfigure zabbix-agent2 config
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: "{{ zabbix_agent_cfg }}" path: "{{ zabbix_agent_cfg }}"
insertafter: '^# UserParameter=' insertafter: '^# UserParameter='
regexp: "^UserParameter=system.certs.*" regexp: "^UserParameter=system.certs.*"
line: "UserParameter=system.certs,python3 /share/ZFS530_DATA/.qpkg/ZabbixAgent/cert_check2.py" line: "UserParameter=system.certs,python3 /share/ZFS530_DATA/.qpkg/ZabbixAgent/cert_check2.py"
when: inventory_hostname == 'nas.home.lan' when: inventory_hostname == 'nas.home.lan'
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
- name: Reconfigure zabbix-agent2 config - name: Reconfigure zabbix-agent2 config
@ -115,7 +116,7 @@
insertafter: '^# UserParameter=' insertafter: '^# UserParameter='
regexp: "^UserParameter=system.certs.*" regexp: "^UserParameter=system.certs.*"
line: "UserParameter=system.certs,python3 /usr/bin/cert_check2.py" line: "UserParameter=system.certs,python3 /usr/bin/cert_check2.py"
when: inventory_hostname == 'm-server.home.lan' when: inventory_hostname == 'm-server.home.lan'
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
- name: Reconfigure zabbix-agent2 config - name: Reconfigure zabbix-agent2 config
@ -140,14 +141,14 @@
regexp: "^HostMetadata=.*" regexp: "^HostMetadata=.*"
insertafter: '^# HostMetadata=' insertafter: '^# HostMetadata='
line: "HostMetadata=server;jaydee" line: "HostMetadata=server;jaydee"
when: inventory_hostname == 'nas.home.lan' or inventory_hostname == 'm-server.home.lan' when: inventory_hostname == 'nas.home.lan' or inventory_hostname == 'm-server.home.lan'
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
- name: Add the user 'to group video - name: Add the user 'to group video
ansible.builtin.user: ansible.builtin.user:
name: zabbix name: zabbix
groups: video groups: video
append: yes append: true
when: inventory_hostname != 'nas.home.lan' when: inventory_hostname != 'nas.home.lan'
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
@ -160,6 +161,8 @@
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
- name: Restart agent - name: Restart agent
ansible.builtin.shell: /etc/init.d/ZabbixAgent.sh restart ansible.builtin.command: /etc/init.d/ZabbixAgent.sh restart
when: inventory_hostname == 'nas.home.lan' when: inventory_hostname == 'nas.home.lan'
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" changed_when: my_output.rc != 0
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"

215
roles/mqtt-srv/tasks/main.yml
View File

@ -1,116 +1,125 @@
- block: - name: Setup mqtt_srv
- name: include vault become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
ansible.builtin.include_vars: block:
file: jaydee.yml - name: Include vault
- name: Delete content & directory ansible.builtin.include_vars:
ansible.builtin.file: file: jaydee.yml
state: absent - name: Delete content & directory
path: "{{ dest_folder }}" ansible.builtin.file:
- name: GIT pull state: absent
tags: path: "{{ dest_folder }}"
- git_pull - name: GIT pull
git: tags:
repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/mqtt_srv.git" - git_pull
dest: "{{ dest_folder }}" ansible.builtin.git:
update: yes repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/mqtt_srv.git"
clone: yes dest: "{{ dest_folder }}"
version: main update: true
- debug: clone: true
msg: "{{ inventory_hostname }}" version: main
- name: Print message
ansible.builtin.debug:
msg: "{{ inventory_hostname }}"
- name: Upload service config - name: Upload service config
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ dest_folder }}/mqtt_srv.service" src: "{{ dest_folder }}/mqtt_srv.service"
dest: /etc/systemd/system/mqtt_srv.service dest: /etc/systemd/system/mqtt_srv.service
remote_src: true remote_src: true
when: inventory_hostname != 'nas.home.lan' mode: '0755'
owner: root
group: root
when: inventory_hostname != 'nas.home.lan'
- name: Upload service script - name: Upload service script
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ dest_folder }}/mqtt_srv.py" src: "{{ dest_folder }}/mqtt_srv.py"
dest: /usr/bin/mqtt_srv.py dest: /usr/bin/mqtt_srv.py
mode: '755' mode: '0755'
owner: root owner: root
remote_src: true group: root
when: inventory_hostname != 'nas.home.lan' remote_src: true
when: inventory_hostname != 'nas.home.lan'
- name: Upload service script config
ansible.builtin.copy:
src: "{{ dest_folder }}/mqtt_srv.cfg"
dest: /etc/mqtt_srv/mqtt_srv.cfg
mode: '755'
owner: root
remote_src: true
when: inventory_hostname != 'nas.home.lan'
- name: Upload service script config
# - name: Upload service script1 ansible.builtin.copy:
# ansible.builtin.copy: src: "{{ dest_folder }}/mqtt_srv.cfg"
# src: scripts/mqtt_srv.sh dest: /etc/mqtt_srv/mqtt_srv.cfg
# dest: /jffs/scripts/mqtt_srv/ mode: '755'
# mode: '755' owner: root
# owner: admin remote_src: true
# when: inventory_hostname in groups['router'] when: inventory_hostname != 'nas.home.lan'
# become: false
# - name: Upload service script1
# ansible.builtin.copy:
# src: scripts/mqtt_srv.sh
# dest: /jffs/scripts/mqtt_srv/
# mode: '755'
# owner: admin
# when: inventory_hostname in groups['router']
# become: false
# - name: Upload service script # - name: Upload service script
# ansible.builtin.copy: # ansible.builtin.copy:
# src: scripts/mqtt_srv.py # src: scripts/mqtt_srv.py
# dest: /jffs/scripts/mqtt_srv/ # dest: /jffs/scripts/mqtt_srv/
# mode: '755' # mode: '755'
# owner: admin # owner: admin
# when: inventory_hostname in groups['router'] # when: inventory_hostname in groups['router']
# become: false # become: false
- name: Upload service script1 - name: Upload service script1
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ dest_folder }}/mqtt_srv.sh" src: "{{ dest_folder }}/mqtt_srv.sh"
dest: /etc/init.d/ dest: /etc/init.d/
mode: '755' mode: '755'
owner: admin owner: admin
remote_src: true remote_src: true
when: inventory_hostname == 'nas.home.lan' when: inventory_hostname == 'nas.home.lan'
- debug: - name: Print message
msg: "{{ dest_folder }}" ansible.builtin.debug:
- name: Upload service script2 msg: "{{ dest_folder }}"
ansible.builtin.copy:
src: "{{ dest_folder }}/mqtt_srv.py"
dest: /usr/bin/mqtt_srv.py
mode: '755'
owner: admin
remote_src: true
when: inventory_hostname == 'nas.home.lan'
- name: Install bottle python package - name: Upload service script2
ansible.builtin.shell: pip install {{ item }} --break-system-packages ansible.builtin.copy:
loop: src: "{{ dest_folder }}/mqtt_srv.py"
- paho-mqtt dest: /usr/bin/mqtt_srv.py
- getmac mode: '755'
- ping3 owner: admin
- psutil remote_src: true
- autorandr when: inventory_hostname == 'nas.home.lan'
when: inventory_hostname != 'nas.home.lan'
- name: Just force systemd to reread configs (2.4 and above) - name: Install bottle python package
ansible.builtin.systemd: ansible.builtin.pip:
daemon_reload: true name: "{{ item }}"
when: inventory_hostname != 'nas.home.lan' loop:
- paho-mqtt
- getmac
- ping3
- psutil
- autorandr
when: inventory_hostname != 'nas.home.lan'
- name: Just force systemd to reread configs (2.4 and above)
ansible.builtin.systemd:
daemon_reload: true
when: inventory_hostname != 'nas.home.lan'
- name: Restart mqtt_srv service - name: Restart mqtt_srv service
ansible.builtin.service: ansible.builtin.service:
name: mqtt_srv.service name: mqtt_srv.service
state: restarted state: restarted
enabled: true enabled: true
when: inventory_hostname != 'nas.home.lan' when: inventory_hostname != 'nas.home.lan'
- name: Restart mqtt service - name: Restart mqtt service
ansible.builtin.shell: "(/etc/init.d/mqtt_srv.sh restart >/dev/null 2>&1 &)" ansible.builtin.shell: "(/etc/init.d/mqtt_srv.sh restart >/dev/null 2>&1 &)"
async: 10 async: 10
poll: 0 poll: 0
when: inventory_hostname == 'nas.home.lan' when: inventory_hostname == 'nas.home.lan'
changed_when: my_output.rc != 0
become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"

27
roles/omv_backup/tasks/main.yml
View File

@ -1,23 +1,24 @@
- name: Omv Setup - name: Omv Setup
become: true become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
block: block:
- name: include vault - name: Include vault
ansible.builtin.include_vars: ansible.builtin.include_vars:
file: jaydee.yml file: jaydee.yml
- name: Delete content & directory - name: Delete content & directory
ansible.builtin.file: ansible.builtin.file:
state: absent state: absent
path: "{{ dest_folder }}" path: "{{ dest_folder }}"
- name: GIT pull - name: Pull repo
tags: tags:
- git_pull - git_pull
git: ansible.builtin.git:
repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/omv_backup.git" repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/omv_backup.git"
dest: "{{ dest_folder }}" dest: "{{ dest_folder }}"
update: yes update: true
clone: yes clone: true
version: main version: main
- debug: - name: Print
ansible.builtin.debug:
msg: "{{ inventory_hostname }}" msg: "{{ inventory_hostname }}"
- name: Create a directory if it does not exist - name: Create a directory if it does not exist
ansible.builtin.file: ansible.builtin.file:
@ -35,18 +36,21 @@
mode: '0755' mode: '0755'
owner: root owner: root
group: root group: root
when: inventory_hostname != 'nas.home.lan' when: inventory_hostname != 'nas.home.lan'
- name: Upload requirements - name: Upload requirements
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ dest_folder }}/requirements.txt" src: "{{ dest_folder }}/requirements.txt"
dest: /myapps/requirements.txt dest: /myapps/requirements.txt
remote_src: true remote_src: true
when: inventory_hostname != 'nas.home.lan' mode: '0755'
owner: root
group: root
when: inventory_hostname != 'nas.home.lan'
- name: Install venv - name: Install venv
ansible.builtin.apt: ansible.builtin.apt:
name: name:
- python3-virtualenv - python3-virtualenv
- name: Install specified python requirements in indicated (virtualenv) - name: Install specified python requirements in indicated (virtualenv)
@ -62,6 +66,9 @@
ansible.builtin.copy: ansible.builtin.copy:
src: omv_backup.service src: omv_backup.service
dest: /etc/systemd/system/omv_backup.service dest: /etc/systemd/system/omv_backup.service
mode: '0755'
owner: root
group: root
when: inventory_hostname == 'amd.home.lan' when: inventory_hostname == 'amd.home.lan'
- name: Restart omv service - name: Restart omv service
ansible.builtin.service: ansible.builtin.service:

25
roles/prevent_policy/tasks/main.yml
View File

@ -1,12 +1,15 @@
- block: - name: Setup policies
- name: Creating a file with content
copy:
dest: "/etc/polkit-1/rules.d/50_disable_pol.rules"
content: |
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.NetworkManager.wifi.scan") {
return polkit.Result.YES;
}
});
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
block:
- name: Creating a file with content
ansible.builtin.copy:
dest: "/etc/polkit-1/rules.d/50_disable_pol.rules"
content: |
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.NetworkManager.wifi.scan") {
return polkit.Result.YES;
}
});
mode: '0644'
owner: root
group: root

126
roles/promtail/tasks/main.yml
View File

@ -1,68 +1,76 @@
--- ---
- block: - name: Promtail
- name: Create dir become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
ansible.builtin.file: block:
path: /etc/apt/keyrings/ - name: Create dir
owner: root ansible.builtin.file:
group: root path: /etc/apt/keyrings/
owner: root
group: root
- name: Create Banner
ansible.builtin.shell: wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg
register: my_output
changed_when: my_output.rc != 0
# - name: < Fetch file that requires authentication.
# username/password only available since 2.8, in older versions you need to use url_username/url_password
# ansible.builtin.get_url:
# url: https://apt.grafana.com/gpg.key
# dest: /etc/foo.conf
# username: bar
# password: '{{ mysecret }}'
# changed_when: my_output.rc != 0
- name: Create Banner - name: Create Banner
ansible.builtin.shell: wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg ansible.builtin.shell: echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" | tee /etc/apt/sources.list.d/grafana.list
register: my_output register: my_output
changed_when: my_output.rc != 0 changed_when: my_output.rc != 0
- name: Create Banner - name: Install packages
ansible.builtin.shell: echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" | tee /etc/apt/sources.list.d/grafana.list ansible.builtin.apt:
register: my_output name:
changed_when: my_output.rc != 0 - promtail
update_cache: true
- name: Install packages - name: Creating a file with content
ansible.builtin.apt: ansible.builtin.copy:
name: dest: "/etc/promtail/config.yml"
- promtail owner: root
update_cache: true group: root
mode: '0644'
content: |
# This minimal config scrape only single log file.
# Primarily used in rpm/deb packaging where promtail service can be started during system init process.
# And too much scraping during init process can overload the complete system.
# https://github.com/grafana/loki/issues/11398
- name: Creating a file with content server:
ansible.builtin.copy: http_listen_port: 9080
dest: "/etc/promtail/config.yml" grpc_listen_port: 0
owner: root
group: root
mode: '0644'
content: |
# This minimal config scrape only single log file.
# Primarily used in rpm/deb packaging where promtail service can be started during system init process.
# And too much scraping during init process can overload the complete system.
# https://github.com/grafana/loki/issues/11398
server: positions:
http_listen_port: 9080 filename: /tmp/positions.yaml
grpc_listen_port: 0
positions: clients:
filename: /tmp/positions.yaml - url: http://192.168.77.101:3100/loki/api/v1/push
external_labels:
nodename: {{ inventory_hostname }}
clients: scrape_configs:
- url: http://192.168.77.101:3100/loki/api/v1/push - job_name: system
external_labels: static_configs:
nodename: {{ inventory_hostname }} - targets:
- localhost
labels:
job: varlogs1
#NOTE: Need to be modified to scrape any additional logs of the system.
__path__: /var/log/zabbix/*.log
- targets:
- localhost
labels:
job: omv_backup
__path__: /myapps/omv_backup.log
scrape_configs: - name: Sshd
- job_name: system ansible.builtin.service:
static_configs: name: promtail
- targets: state: restarted
- localhost
labels:
job: varlogs1
#NOTE: Need to be modified to scrape any additional logs of the system.
__path__: /var/log/zabbix/*.log
- targets:
- localhost
labels:
job: omv_backup
__path__: /myapps/omv_backup.log
- name: Sshd
ansible.builtin.service:
name: promtail
state: restarted
become: true

4
roles/requirements.yml
View File

@ -1,5 +1,5 @@
--- # requirements.yml
collections: collections:
- name: community.general - name: community.general
source: https://galaxy.ansible.com source: https://galaxy.ansible.com
- name: community.docker

5
roles/sendmail/handlers/main.yml
View File

@ -1,5 +0,0 @@
- name: restart_docker
ansible.builtin.service:
name: docker.service
state: restarted
become: true

57
roles/sendmail/tasks/main.yml
View File

@ -1,57 +0,0 @@
- block:
- name: Install docker
ansible.builtin.apt:
name:
- ca-certificates
- curl
- telnet
- net-tools
- python3-pip
- python3-dev
state: present
update_cache: true
- name: Get keys for raspotify
ansible.builtin.shell:
install -m 0755 -d /etc/apt/keyrings
- name: Get keys for raspotify
ansible.builtin.shell:
curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
- name: Get keys for raspotify
ansible.builtin.shell:
chmod a+r /etc/apt/keyrings/docker.asc
- name: Get keys for raspotify
ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
- name: Install docker
ansible.builtin.apt:
name:
- docker-ce
- docker-ce-cli
- containerd.io
- docker-buildx-plugin
- docker-compose-plugin
update_cache: true
- name: Create a directory docker.service.d
ansible.builtin.file:
path: /etc/systemd/system/docker.service.d/
state: directory
mode: '0755'
- name: Creating a file with content
copy:
dest: "/etc/systemd/system/docker.service.d/override.conf"
content: |
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H tcp://0.0.0.0:2375
notify: restart_docker
- name: Just force systemd to reread configs
ansible.builtin.systemd:
daemon_reload: true
become: true

5
roles/setup/tasks/main.yml Executable file
View File

@ -0,0 +1,5 @@
- name: Setup
become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
block:
- name: Gather facts
ansible.builtin.setup:

4
roles/ssh_config/tasks/main.yml
View File

@ -8,7 +8,7 @@
mode: '0600' mode: '0600'
owner: jd owner: jd
group: jd group: jd
when: inventory_hostname != 'nas.home.lan' when: inventory_hostname != 'nas.home.lan'
- name: Upload config - name: Upload config
ansible.builtin.copy: ansible.builtin.copy:
src: config src: config
@ -16,4 +16,4 @@
mode: '0600' mode: '0600'
owner: root owner: root
group: root group: root
when: inventory_hostname != 'nas.home.lan' when: inventory_hostname != 'nas.home.lan'

2
roles/ssh_config/vars/main.yml
View File

@ -1 +1 @@
dest_folder: "/tmp/ans_repo" dest_folder: "/tmp/ans_repo"

24
roles/ssh_keys/tasks/main.yml Executable file
View File

@ -0,0 +1,24 @@
- name: SSH keys deploy
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
block:
- name: Upload key
ansible.builtin.copy:
src: id_rsa
dest: /home/jd/.ssh/id_rsa
mode: '0600'
owner: jd
group: jd
when: inventory_hostname != 'nas.home.lan'
- name: Upload key
ansible.builtin.copy:
src: id_rsa
dest: /home/jd/.ssh/id_rsa.pub
mode: '0600'
owner: jd
group: jd
when: inventory_hostname != 'nas.home.lan'
- name: Set authorized key taken from file
ansible.posix.authorized_key:
user: jd
state: present
key: "{{ lookup('file', '/home/jd/.ssh/id_rsa.pub') }}"

14
roles/sshd_config/tasks/main.yml Executable file
View File

@ -0,0 +1,14 @@
- name: SSHD config Setup
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
block:
- name: Reconfigure sshd
ansible.builtin.replace:
path: /etc/ssh/sshd_config
regexp: "^PermitRootLogin"
replace: "#PermitRootLogin"
- name: Restart ssh service
ansible.builtin.service:
name: ssh
state: restarted
daemon_reload: true
enabled: true

1
roles/sshd_config/vars/main.yml Executable file
View File

@ -0,0 +1 @@
dest_folder: "/tmp/ans_repo"

52
roles/wazuh-agent/tasks/main.yml
View File

@ -1,20 +1,32 @@
- block: - name: Setup loki agent
- name: Get keys become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
ansible.builtin.shell: curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg block:
- name: Add repo - name: Get keys
ansible.builtin.shell: echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list ansible.builtin.command: |
- name: Update cache curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH |\
ansible.builtin.apt: gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg \
update_cache: true --import && chmod 644 /usr/share/keyrings/wazuh.gpg
- name: Instal wazuh changed_when: my_output.rc != 0
ansible.builtin.apt:
name: wazuh-agent - name: Add repo
environment: ansible.builtin.command: |
WAZUH_MANAGER: 'm-server.home.lan' echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" |\
WAZUH_AGENT_NAME: "{{ inventory_hostname }}" tee -a /etc/apt/sources.list.d/wazuh.list
- name: Restart wazuh service changed_when: my_output.rc != 0
ansible.builtin.service:
name: wazuh-agent - name: Update cache
state: restarted ansible.builtin.apt:
enabled: true update_cache: true
become: true
- name: Instal wazuh
ansible.builtin.apt:
name: wazuh-agent
environment:
WAZUH_MANAGER: 'm-server.home.lan'
WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
- name: Restart wazuh service
ansible.builtin.service:
name: wazuh-agent
state: restarted
enabled: true

38
ssh_key.pem Executable file
View File

@ -0,0 +1,38 @@
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAoz4u+IAB09hgWyllpplK8864SkDd5p89w01p9NioW4FrOjES5U65
9ny6geIZKFRDmrdvcADidsbmOGhIxnzup5f95Gt6KrJcMVvRqhQkV1R5xd2/lpcvo5J97W
4bfoIxSuMdJ6dVmW6UyP50e4BJVmu++Cwh8uYuH5uSEqAh80TLCnd3VReGDrXukAvVLuLk
EI6WVpLGEYwDbVwJORAxDhEc/g4fEQ5F2xmFtr8dYoTUBoed893Olum2oxqt6sf/hvdOTL
UYLrWx1jjmEhPKNqt72g5AjQOhY3dz+oB0z3EYxRH6B3PFcadL40fXuqJfF+w/hhC+oOkD
eueu+9maN/0JGtKyf8zJ094GdkuItAs5qg6HnG8wwl+8sMLsIL5ZiRjrMIMMDij/xNP0Z1
outwVBVf31PaOZ6/WV4JIkWvWQs7mx2YccjemexIXDlZzG731dVuRZ/724/OGLnQi5s65O
ar6UPqlbDF4tRjyBMhcMoPwH7uSU6TROfuFYhc0zAAAFiO2G2RLthtkSAAAAB3NzaC1yc2
EAAAGBAKM+LviAAdPYYFspZaaZSvPOuEpA3eafPcNNafTYqFuBazoxEuVOufZ8uoHiGShU
Q5q3b3AA4nbG5jhoSMZ87qeX/eRreiqyXDFb0aoUJFdUecXdv5aXL6OSfe1uG36CMUrjHS
enVZlulMj+dHuASVZrvvgsIfLmLh+bkhKgIfNEywp3d1UXhg617pAL1S7i5BCOllaSxhGM
A21cCTkQMQ4RHP4OHxEORdsZhba/HWKE1AaHnfPdzpbptqMarerH/4b3Tky1GC61sdY45h
ITyjare9oOQI0DoWN3c/qAdM9xGMUR+gdzxXGnS+NH17qiXxfsP4YQvqDpA3rnrvvZmjf9
CRrSsn/MydPeBnZLiLQLOaoOh5xvMMJfvLDC7CC+WYkY6zCDDA4o/8TT9GdaLrcFQVX99T
2jmev1leCSJFr1kLO5sdmHHI3pnsSFw5Wcxu99XVbkWf+9uPzhi50IubOuTmq+lD6pWwxe
LUY8gTIXDKD8B+7klOk0Tn7hWIXNMwAAAAMBAAEAAAGABj1wcTT/cjghXXVkeoJTQE+aHC
iE8vW1AtwDiAWnezFOxn+CupDlqzuTAOJXgNhRFJRyJjoPw2eQpv5W2H4vvJNNnrzRri55
jLTMURqKVcDtE2MJxE63gPgEEp6KCYNzhpUjk6pMq4aebwfJrxY1IiBl6+RP+zzQ7YoLrY
+Wd09IDaM0b2Rso5pRFLYxv3mSgI7axf4VToK8zMzfA2HlkM/sUkp65d2Bo8GYKrynzxDH
GWV3ZGTe//DOIkejofJkIpm8l3xHAhkOQuEu6HubbLNCrIbwtTeGQuVQW6EqdGIF55/wHu
vrwrjkaGT4rdsCD4Ue3aCDfc5PFgRkDSmGUwcQmSRiA3vDliYe33m61SXqngbE763EIv12
vQBzU+vRR/IjQQAfX7bEJNnZ//TbiiA0vQzXnjrxNtwJVgPAQduqJI7F9D6r6TvpLeB7TS
NjJErQivVj3Uwvjz2xHum9+Z9hOtA0hwuvqsRqvxarlIGpV12tDK/Qe2r/sUMHvEbBAAAA
wQCTkbTjZ+KyOGp54SlzFWXrxYZcswzr7UKms+WlmT8NFtqpwnLg6/KzyLURWVns3k2eTz
ZRC3lJhGVZyTyuVR9ek0wbI+f/JmnTsAPaas76KHcXszpxftwf6blZc1wZUEJLmRDTy5K2
tEDoll4lki2L2Wyv6KPWyG6Gai34YigW95vS7veaslLVIy/nNRkwBEBpwRtOV/YCy1SC3U
PRMaMUyHNzcdwbeT1uymU/UeGc+h8pTGriG/5EhbvCHhLqVV8AAADBAOMRDYvh6wT4f31K
JitrfTruY+Bdg9O9aqyQXzEkCtzJWoHTLQY/brMo0mvUxR9wSxKBwR+Nu9EXqkBpA3g1Hv
UgXv3NWrpAiAVVs6NHay0aDa1uIY/Ol8k6DbLL5R0k7tQc2nD44Ey9zme88/0sdHA2VIQ2
z/tlcPSQ8VKKhDmRY7BTE5YgeE6615nqvCq8e6CRSjFa0HKbfdFsmSnOHgil6Oc2MKT2pL
i/dKSxeAr2BP++xF9xYe0bVMdy4mEF8wAAAMEAuAsxC2bs0FnzoInge3W1ra55+qZF3LFp
efTVb26yciNYYeJLeks+nOjOQQd+kcISILdIhYnUGIumWQR/CiY2KL89AXLoTB6EIt5DGC
udKAjIzSeHtXTliZ1okgjGSmJeE6dhr0UwdLYyaFkdscbF17iTndLc74yCrKIoUnHfxBEc
/34AT8UdwkrJXj7e2nJyV9WGYz/Ga2xd3s56hVSTUckjxQaBnkZWFilw7ZAlHhPhSglTmd
pkgWv+Gd4evavBAAAAC2pkQG1vcmVmaW5lAQIDBAUGBw==
-----END OPENSSH PRIVATE KEY-----