renamed customer user group

all.yml

@@ -1,39 +1,67 @@
 - hosts: datacenter
   name: Roles
+  gather_facts: false
   roles:
+    - name: setup
+      role: setup
+      tags: setup
     - name: common
       tags: common
+      role: common
     - name: hosts
+      role: hosts
       tags: hosts
     - name: ssh_config
+      role: ssh_config
       tags: ssh_config
+    - name: sshd_config
+      role: sshd_config
+      tags: sshd_config
+    - name: ssh_keys
+      role: ssh_keys
+      tags: ssh_keys
     - name: wake_on_lan
+      role: wake_on_lan
       tags: wake_on_lan
     - name: matter-server
+      role: matter-server
       tags: matter-server
     - name: docker
+      role: docker
       tags: docker
     - name: timeshift
+      role: timeshift
       tags: timeshift
     - name: monitoring
+      role: monitoring
       tags: monitoring
     - name: zabbix-agent
+      role: zabbix-agent
       tags: zabbix-agent
     - name: autofs_client
+      role: autofs_client
       tags: autofs_client
     - name: ldap_client
+      role: ldap_client
       tags: ldap_client
     - name: ssh_banner
+      role: ssh_banner
       tags: ssh_banner
     - name: omv_backup
+      role: omv_backup
       tags: omv_backup
     - name: wazuh-agent
+      role: wazuh-agent
       tags: wazuh-agent
-    - role: mqtt-srv
+    - name: mqtt-srv
+      role: mqtt-srv
       tags: mqtt-srv
-    - role: vnc_server
+    - name: vnc_server
+      role: vnc_server
       tags: vnc_server
-    - role: promtail
+    - name: promtail
+      role: promtail
       tags: promtail
-    - role: sudoers
+    - name: sudoers
+      role: sudoers
       tags: sudoers

collections/requirements.yml

@@ -1,3 +1,6 @@
----
+# requirements.yml
+# ansible-galaxy collection install -r collections/requirements.yml --force
 collections:
   - name: community.general
+    source: https://galaxy.ansible.com
+  - name: community.docker

roles/autofs_client/tasks/main.yml

@@ -1,5 +1,7 @@
-- block:
-  - name: include vault
+- name: Setup autofs
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Include vault
       ansible.builtin.include_vars:
         file: jaydee.yml
     - name: Install autofs
@@ -10,30 +12,44 @@
         state: present
 
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/auto.auth"
         content: |
           username={{ samba_user }}
           password={{ samba_password }}
+        mode: '0700'
+        owner: root
+        group: root
 
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/auto.nas-movies"
         content: |
           movies  -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw    ://nas.home.lan/movies
+        mode: '0700'
+        owner: root
+        group: root
+
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/auto.nas-music"
         content: |
           music   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw    ://nas.home.lan/music
+        mode: '0700'
+        owner: root
+        group: root
+
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/auto.nas-shows"
         content: |
           shows   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw    ://nas.home.lan/shows
+        mode: '0700'
+        owner: root
+        group: root
 
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/auto.nas"
         content: |
           nas-data   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Data
@@ -43,6 +59,9 @@
           nas-install   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/install
           nas-downloads   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/downloads
           nas-games   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/qda_2
+        mode: '0700'
+        owner: root
+        group: root
     # - name: Reconfigure autofs Server
     #   ansible.builtin.lineinfile:
     #     path: /etc/auto.master
@@ -70,14 +89,7 @@
         path: /etc/auto.master
         line: /media/nas   /etc/auto.nas --timeout 360 --ghost
 
-
-
-
-
-
-
     - name: Restart docker service
       ansible.builtin.service:
         name: autofs
         state: restarted
-  become: true

roles/docker/tasks/main.yml

@@ -1,6 +1,8 @@
-- block:
-  - name: print arch
-    debug:
+- name: Setup docker
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Print arch
+      ansible.builtin.debug:
         msg: "{{ ansible_architecture }}"
     - name: Install docker
       ansible.builtin.apt:
@@ -14,32 +16,61 @@
         state: present
         update_cache: true
     - name: Get keys for raspotify
-    ansible.builtin.shell:
+      ansible.builtin.command:
         install -m 0755 -d /etc/apt/keyrings
+      changed_when: my_output.rc != 0
 
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+    - name: Add an Apt signing key to a specific keyring file
+      ansible.builtin.apt_key:
+        url: https://download.docker.com/linux/debian/gpg
+        keyring: /etc/apt/keyrings/docker.asc
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc     
+
+    # - name: Get keys for raspotify
+    #   ansible.builtin.shell:
+    #     curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+    #   when:
+    #     - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
+
+    - name: Add an Apt signing key to a specific keyring file
+      ansible.builtin.apt_key:
+        url: https://download.docker.com/linux/ubuntu/gpg
+        keyring: /etc/apt/keyrings/docker.asc
       when:
         - ansible_distribution == "Ubuntu"
 
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      chmod a+r /etc/apt/keyrings/docker.asc
+    # - name: Get keys for raspotify
+    #   ansible.builtin.shell:
+    #     curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+    #   when:
+    #     - ansible_distribution == "Ubuntu"
+    - name: Change file ownership, group and permissions
+      ansible.builtin.file:
+        path: /etc/apt/keyrings/docker.asc
+        owner: root
+        group: root
+        mode: '0644'
+
+    # - name: Get keys for raspotify
+    #   ansible.builtin.shell:
+    #     chmod a+r /etc/apt/keyrings/docker.asc
 
     - name: Get keys for raspotify
-    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+      ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc]\
+       https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" |\
+       sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
+      changed_when: my_output.rc != 0
+
     - name: Get keys for raspotify
-    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+      ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc]\
+       https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" |\
+       sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
       when:
         - ansible_distribution == "Ubuntu"
+      changed_when: my_output.rc != 0
 
     - name: Install docker
       ansible.builtin.apt:
@@ -61,34 +92,57 @@
         path: /etc/docker/certs
         state: directory
         mode: '0700'
+        owner: root
+        group: root
+
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: server-key.pem
         dest: /etc/docker/certs/
+        mode: '0600'
+        owner: root
+        group: root
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: ca.pem
         dest: /etc/docker/certs/
+        mode: '0600'
+        owner: root
+        group: root
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: server-cert.pem
         dest: /etc/docker/certs/
+        mode: '0600'
+        owner: root
+        group: root
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/systemd/system/docker.service.d/override.conf"
         content: |
           [Service]
           ExecStart=
-        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify     --tlscacert=/etc/docker/certs/ca.pem     --tlscert=/etc/docker/certs/server-cert.pem     --tlskey=/etc/docker/certs/server-key.pem     -H=0.0.0.0:2376
+          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
+          --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
+          --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+        mode: '0600'
+        owner: root
+        group: root
       notify: restart_docker
       when: mode == "nocert"
+
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/systemd/system/docker.service.d/override.conf"
         content: |
           [Service]
           ExecStart=
-        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify     --tlscacert=/etc/docker/certs/ca.pem     --tlscert=/etc/docker/certs/server-cert.pem     --tlskey=/etc/docker/certs/server-key.pem     -H=0.0.0.0:2376
+          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
+          --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
+          --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+        mode: '0600'
+        owner: root
+        group: root
       notify: restart_docker
       when: mode != "nocert"
 
@@ -108,6 +162,3 @@
         plugin_name: grafana/loki-docker-driver:3.3.2
         alias: loki
         state: present
-
-
-  become: true

roles/fail2ban/tasks/main.yml

@@ -1,4 +1,6 @@
-- block:
+- name: Setup Fail2ban
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
     - name: Install fail2ban packages
       ansible.builtin.apt:
         name:
@@ -7,27 +9,36 @@
   # add line  to /etc/hosts
   # 127.0.0.1 m-server localhost....
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: "{{ item }}"
         dest: /etc/fail2ban/jail.d/
+        mode: '0700'
+        owner: root
+        group: root
       with_fileglob:
         - "jail.d/*.conf"
 
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: "{{ item }}"
         dest: /etc/fail2ban/filter.d/
+        mode: '0700'
+        owner: root
+        group: root
       with_fileglob:
         - "filter.d/*.conf"
 
     - name: Copy files
-    copy:
+      ansible.builtin.copy:
         src: "{{ item }}"
         dest: /etc/fail2ban/action.d/
+        mode: '0700'
+        owner: root
+        group: root
       with_fileglob:
         - "action.d/*.conf"
 
-  - name: disable sendmail service
+    - name: Disable sendmail service
       ansible.builtin.service:
         name: sendmail.service
         state: stopped
@@ -38,4 +49,3 @@
         name: fail2ban.service
         state: restarted
         enabled: true
-  become: true

roles/loki-agent/tasks/main.yml

@@ -1,20 +0,0 @@
-- block:
-  - name: Get keys
-    ansible.builtin.shell: curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
-  - name: Add repo
-    ansible.builtin.shell: echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
-  - name: Update cache
-    ansible.builtin.apt:
-      update_cache: true
-  - name: Instal wazuh
-    ansible.builtin.apt:
-      name: wazuh-agent
-    environment:
-      WAZUH_MANAGER: 'm-server.home.lan'
-      WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
-  - name: Restart wazuh service
-    ansible.builtin.service:
-      name: wazuh-agent
-      state: restarted
-      enabled: true
-  become: true

roles/loki-agent/vars/main.yml

@@ -1 +0,0 @@
-ZABBIX_SERVER: "zabbix.home.lan"

roles/matter-server/tasks/main.yml

@@ -1,4 +1,6 @@
-- block:
+- name: Setup matter server
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
     - name: Reconfigure config
       ansible.builtin.lineinfile:
         path: /etc/sysctl.conf
@@ -7,4 +9,4 @@
     - name: Restart agent
       ansible.builtin.shell: echo 80 > /proc/sys/net/ipv4/igmp_max_memberships
       notify: restart_matter_server
-  become: true
+      changed_when: my_output.rc != 0

roles/monitoring/tasks/main.yml

@@ -36,7 +36,7 @@
   when:
     - ansible_facts.architecture == "armv7l" or ansible_facts.architecture == "aarch64"
   become: true
-  ignore_errors: true
+  failed_when: my_output.rc != 0
 
 - name: Install a .deb package from the internet3
   ansible.builtin.apt:
@@ -50,21 +50,22 @@
     # deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb
     deb: https://repo.zabbix.com/zabbix/7.2/debian/pool/main/z/zabbix-release/zabbix-release_7.2-1+debian12_all.deb
   when:
-    - ansible_facts.architecture != "armv7l" and  ansible_facts.architecture != "aarch64" and ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
-  ignore_errors: true
+    - ansible_facts.architecture != "armv7l"
+    - ansible_facts.architecture != "aarch64"
+    - ansible_distribution == "Debian"
+    - ansible_distribution_major_version  == "12"
+  failed_when: my_output.rc != 0
   become: true
-# - name: Install a .deb package localy
-#   ansible.builtin.apt:
-#     deb: /tmp/zabbix-release_6.4-1+ubuntu22.04_all.deb
+
 - name: Install zabbix packages
   ansible.builtin.apt:
     name:
       - zabbix-agent2
       - zabbix-agent2-plugin-mongodb
       - zabbix-agent2-plugin-postgresql
-    update_cache: yes
+    update_cache: false
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
-  ignore_errors: true
+  failed_when: my_output.rc != 0
   when: inventory_hostname != 'nas.home.lan'
 
 - name: Reconfigure zabbix agent Server
@@ -147,7 +148,7 @@
   ansible.builtin.user:
     name: zabbix
     groups: video
-    append: yes
+    append: true
   when: inventory_hostname != 'nas.home.lan'
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
 
@@ -160,6 +161,8 @@
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
 
 - name: Restart agent
-  ansible.builtin.shell: /etc/init.d/ZabbixAgent.sh restart
+  ansible.builtin.command: /etc/init.d/ZabbixAgent.sh restart
   when: inventory_hostname == 'nas.home.lan'
+  changed_when: my_output.rc != 0
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  

roles/mqtt-srv/tasks/main.yml

@@ -1,5 +1,7 @@
-- block:
-  - name: include vault
+- name: Setup mqtt_srv
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
+    - name: Include vault
       ansible.builtin.include_vars:
         file: jaydee.yml
     - name: Delete content & directory
@@ -9,13 +11,14 @@
     - name: GIT pull
       tags:
         - git_pull
-    git:
+      ansible.builtin.git:
         repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/mqtt_srv.git"
         dest: "{{ dest_folder }}"
-      update: yes
-      clone: yes
+        update: true
+        clone: true
         version: main
-  - debug:
+    - name: Print message
+      ansible.builtin.debug:
         msg: "{{ inventory_hostname }}"
 
     - name: Upload service config
@@ -23,14 +26,18 @@
         src: "{{ dest_folder }}/mqtt_srv.service"
         dest: /etc/systemd/system/mqtt_srv.service
         remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
       when: inventory_hostname != 'nas.home.lan'
 
     - name: Upload service script
       ansible.builtin.copy:
         src: "{{ dest_folder }}/mqtt_srv.py"
         dest: /usr/bin/mqtt_srv.py
-      mode: '755'
+        mode: '0755'
         owner: root
+        group: root
         remote_src: true
       when: inventory_hostname != 'nas.home.lan'
 
@@ -43,7 +50,6 @@
         remote_src: true
       when: inventory_hostname != 'nas.home.lan'
 
-    
     # - name: Upload service script1
     #   ansible.builtin.copy:
     #     src: scripts/mqtt_srv.sh
@@ -72,8 +78,10 @@
         remote_src: true
       when: inventory_hostname == 'nas.home.lan'
 
-  - debug:
+    - name: Print message
+      ansible.builtin.debug:
         msg: "{{ dest_folder }}"
+
     - name: Upload service script2
       ansible.builtin.copy:
         src: "{{ dest_folder }}/mqtt_srv.py"
@@ -84,7 +92,8 @@
       when: inventory_hostname == 'nas.home.lan'
 
     - name: Install bottle python package
-    ansible.builtin.shell: pip  install {{ item }}  --break-system-packages
+      ansible.builtin.pip:
+        name: "{{ item }}"
       loop:
         - paho-mqtt
         - getmac
@@ -112,5 +121,5 @@
       async: 10
       poll: 0
       when: inventory_hostname == 'nas.home.lan'
+      changed_when: my_output.rc != 0
       
-  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"

roles/omv_backup/tasks/main.yml

@@ -1,23 +1,24 @@
 - name: Omv Setup
-  become: true
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
   block:
-    - name: include vault
+    - name: Include vault
       ansible.builtin.include_vars:
         file: jaydee.yml
     - name: Delete content & directory
       ansible.builtin.file:
         state: absent
         path: "{{ dest_folder }}"
-    - name: GIT pull
+    - name: Pull repo
       tags:
         - git_pull
-      git:
+      ansible.builtin.git:
         repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/omv_backup.git"
         dest: "{{ dest_folder }}"
-        update: yes
-        clone: yes
+        update: true
+        clone: true
         version: main
-    - debug:
+    - name: Print
+      ansible.builtin.debug:
         msg: "{{ inventory_hostname }}"
     - name: Create a directory if it does not exist
       ansible.builtin.file:
@@ -42,6 +43,9 @@
         src: "{{ dest_folder }}/requirements.txt"
         dest: /myapps/requirements.txt
         remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
       when: inventory_hostname != 'nas.home.lan'
 
     - name: Install venv
@@ -62,6 +66,9 @@
       ansible.builtin.copy:
         src: omv_backup.service
         dest: /etc/systemd/system/omv_backup.service
+        mode: '0755'
+        owner: root
+        group: root
       when: inventory_hostname == 'amd.home.lan'
     - name: Restart omv service
       ansible.builtin.service:

roles/prevent_policy/tasks/main.yml

@@ -1,6 +1,8 @@
-- block:
+- name: Setup policies
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
     - name: Creating a file with content
-    copy:
+      ansible.builtin.copy:
         dest: "/etc/polkit-1/rules.d/50_disable_pol.rules"
         content: |
           polkit.addRule(function(action, subject) {
@@ -8,5 +10,6 @@
                 return polkit.Result.YES;
             }
           });
-  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
-    
+        mode: '0644'
+        owner: root
+        group: root

roles/promtail/tasks/main.yml

@@ -1,15 +1,24 @@
 ---
-- block:
+- name: Promtail
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
     - name: Create dir
       ansible.builtin.file:
         path: /etc/apt/keyrings/
         owner: root
         group: root
-
     - name: Create Banner
       ansible.builtin.shell: wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg
       register: my_output
       changed_when: my_output.rc != 0
+  # - name: < Fetch file that requires authentication.
+  #         username/password only available since 2.8, in older versions you need to use url_username/url_password
+  #   ansible.builtin.get_url:
+  #     url: https://apt.grafana.com/gpg.key
+  #     dest: /etc/foo.conf
+  #     username: bar
+  #     password: '{{ mysecret }}'
+  #   changed_when: my_output.rc != 0
 
     - name: Create Banner
       ansible.builtin.shell: echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" | tee /etc/apt/sources.list.d/grafana.list
@@ -65,4 +74,3 @@
       ansible.builtin.service:
         name: promtail
         state: restarted
-  become: true

roles/requirements.yml

@@ -1,5 +1,5 @@
----
+# requirements.yml
 collections:
   - name: community.general
     source: https://galaxy.ansible.com
-  
+  - name: community.docker

roles/sendmail/handlers/main.yml

@@ -1,5 +0,0 @@
-- name: restart_docker
-  ansible.builtin.service:
-    name: docker.service
-    state: restarted
-  become: true

roles/sendmail/tasks/main.yml

@@ -1,57 +0,0 @@
-- block:
-  - name: Install docker
-    ansible.builtin.apt:
-      name: 
-        - ca-certificates
-        - curl 
-        - telnet
-        - net-tools
-        - python3-pip
-        - python3-dev
-      state: present
-      update_cache: true
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      install -m 0755 -d /etc/apt/keyrings
-
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
-
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      chmod a+r /etc/apt/keyrings/docker.asc
-
-  - name: Get keys for raspotify
-    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-
-  - name: Install docker
-    ansible.builtin.apt:
-      name: 
-        - docker-ce
-        - docker-ce-cli
-        - containerd.io
-        - docker-buildx-plugin
-        - docker-compose-plugin
-      update_cache: true
-
-  - name: Create a directory docker.service.d
-    ansible.builtin.file:
-      path: /etc/systemd/system/docker.service.d/
-      state: directory
-      mode: '0755'
-
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/systemd/system/docker.service.d/override.conf"
-      content: |
-        [Service]
-        ExecStart=
-        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H tcp://0.0.0.0:2375
-    notify: restart_docker
-
-  - name: Just force systemd to reread configs
-    ansible.builtin.systemd:
-      daemon_reload: true
-
-  become: true

roles/setup/tasks/main.yml

@@ -0,0 +1,5 @@
+- name: Setup
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
+    - name: Gather facts
+      ansible.builtin.setup:

roles/ssh_keys/tasks/main.yml

@@ -0,0 +1,24 @@
+- name: SSH keys deploy
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Upload key
+      ansible.builtin.copy:
+        src: id_rsa
+        dest: /home/jd/.ssh/id_rsa
+        mode: '0600'
+        owner: jd
+        group: jd
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload key
+      ansible.builtin.copy:
+        src: id_rsa
+        dest: /home/jd/.ssh/id_rsa.pub
+        mode: '0600'
+        owner: jd
+        group: jd
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Set authorized key taken from file
+      ansible.posix.authorized_key:
+        user: jd
+        state: present
+        key: "{{ lookup('file', '/home/jd/.ssh/id_rsa.pub') }}"

roles/sshd_config/tasks/main.yml

@@ -0,0 +1,14 @@
+- name: SSHD config Setup
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Reconfigure sshd
+      ansible.builtin.replace:
+        path: /etc/ssh/sshd_config
+        regexp: "^PermitRootLogin"
+        replace: "#PermitRootLogin"
+    - name: Restart ssh service
+      ansible.builtin.service:
+        name: ssh
+        state: restarted
+        daemon_reload: true
+        enabled: true

roles/sshd_config/vars/main.yml

@@ -0,0 +1 @@
+dest_folder: "/tmp/ans_repo"

roles/wazuh-agent/tasks/main.yml

@@ -1,20 +1,32 @@
-- block:
+- name: Setup loki agent
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
     - name: Get keys
-    ansible.builtin.shell: curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
+      ansible.builtin.command: |
+        curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH |\
+        gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg \
+        --import && chmod 644 /usr/share/keyrings/wazuh.gpg
+      changed_when: my_output.rc != 0
+
     - name: Add repo
-    ansible.builtin.shell: echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
+      ansible.builtin.command: |
+        echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" |\
+        tee -a /etc/apt/sources.list.d/wazuh.list
+      changed_when: my_output.rc != 0
+
     - name: Update cache
       ansible.builtin.apt:
         update_cache: true
+
     - name: Instal wazuh
       ansible.builtin.apt:
         name: wazuh-agent
       environment:
         WAZUH_MANAGER: 'm-server.home.lan'
         WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
+
     - name: Restart wazuh service
       ansible.builtin.service:
         name: wazuh-agent
         state: restarted
         enabled: true
-  become: true

ssh_key.pem

@@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEAoz4u+IAB09hgWyllpplK8864SkDd5p89w01p9NioW4FrOjES5U65
+9ny6geIZKFRDmrdvcADidsbmOGhIxnzup5f95Gt6KrJcMVvRqhQkV1R5xd2/lpcvo5J97W
+4bfoIxSuMdJ6dVmW6UyP50e4BJVmu++Cwh8uYuH5uSEqAh80TLCnd3VReGDrXukAvVLuLk
+EI6WVpLGEYwDbVwJORAxDhEc/g4fEQ5F2xmFtr8dYoTUBoed893Olum2oxqt6sf/hvdOTL
+UYLrWx1jjmEhPKNqt72g5AjQOhY3dz+oB0z3EYxRH6B3PFcadL40fXuqJfF+w/hhC+oOkD
+eueu+9maN/0JGtKyf8zJ094GdkuItAs5qg6HnG8wwl+8sMLsIL5ZiRjrMIMMDij/xNP0Z1
+outwVBVf31PaOZ6/WV4JIkWvWQs7mx2YccjemexIXDlZzG731dVuRZ/724/OGLnQi5s65O
+ar6UPqlbDF4tRjyBMhcMoPwH7uSU6TROfuFYhc0zAAAFiO2G2RLthtkSAAAAB3NzaC1yc2
+EAAAGBAKM+LviAAdPYYFspZaaZSvPOuEpA3eafPcNNafTYqFuBazoxEuVOufZ8uoHiGShU
+Q5q3b3AA4nbG5jhoSMZ87qeX/eRreiqyXDFb0aoUJFdUecXdv5aXL6OSfe1uG36CMUrjHS
+enVZlulMj+dHuASVZrvvgsIfLmLh+bkhKgIfNEywp3d1UXhg617pAL1S7i5BCOllaSxhGM
+A21cCTkQMQ4RHP4OHxEORdsZhba/HWKE1AaHnfPdzpbptqMarerH/4b3Tky1GC61sdY45h
+ITyjare9oOQI0DoWN3c/qAdM9xGMUR+gdzxXGnS+NH17qiXxfsP4YQvqDpA3rnrvvZmjf9
+CRrSsn/MydPeBnZLiLQLOaoOh5xvMMJfvLDC7CC+WYkY6zCDDA4o/8TT9GdaLrcFQVX99T
+2jmev1leCSJFr1kLO5sdmHHI3pnsSFw5Wcxu99XVbkWf+9uPzhi50IubOuTmq+lD6pWwxe
+LUY8gTIXDKD8B+7klOk0Tn7hWIXNMwAAAAMBAAEAAAGABj1wcTT/cjghXXVkeoJTQE+aHC
+iE8vW1AtwDiAWnezFOxn+CupDlqzuTAOJXgNhRFJRyJjoPw2eQpv5W2H4vvJNNnrzRri55
+jLTMURqKVcDtE2MJxE63gPgEEp6KCYNzhpUjk6pMq4aebwfJrxY1IiBl6+RP+zzQ7YoLrY
++Wd09IDaM0b2Rso5pRFLYxv3mSgI7axf4VToK8zMzfA2HlkM/sUkp65d2Bo8GYKrynzxDH
+GWV3ZGTe//DOIkejofJkIpm8l3xHAhkOQuEu6HubbLNCrIbwtTeGQuVQW6EqdGIF55/wHu
+vrwrjkaGT4rdsCD4Ue3aCDfc5PFgRkDSmGUwcQmSRiA3vDliYe33m61SXqngbE763EIv12
+vQBzU+vRR/IjQQAfX7bEJNnZ//TbiiA0vQzXnjrxNtwJVgPAQduqJI7F9D6r6TvpLeB7TS
+NjJErQivVj3Uwvjz2xHum9+Z9hOtA0hwuvqsRqvxarlIGpV12tDK/Qe2r/sUMHvEbBAAAA
+wQCTkbTjZ+KyOGp54SlzFWXrxYZcswzr7UKms+WlmT8NFtqpwnLg6/KzyLURWVns3k2eTz
+ZRC3lJhGVZyTyuVR9ek0wbI+f/JmnTsAPaas76KHcXszpxftwf6blZc1wZUEJLmRDTy5K2
+tEDoll4lki2L2Wyv6KPWyG6Gai34YigW95vS7veaslLVIy/nNRkwBEBpwRtOV/YCy1SC3U
+PRMaMUyHNzcdwbeT1uymU/UeGc+h8pTGriG/5EhbvCHhLqVV8AAADBAOMRDYvh6wT4f31K
+JitrfTruY+Bdg9O9aqyQXzEkCtzJWoHTLQY/brMo0mvUxR9wSxKBwR+Nu9EXqkBpA3g1Hv
+UgXv3NWrpAiAVVs6NHay0aDa1uIY/Ol8k6DbLL5R0k7tQc2nD44Ey9zme88/0sdHA2VIQ2
+z/tlcPSQ8VKKhDmRY7BTE5YgeE6615nqvCq8e6CRSjFa0HKbfdFsmSnOHgil6Oc2MKT2pL
+i/dKSxeAr2BP++xF9xYe0bVMdy4mEF8wAAAMEAuAsxC2bs0FnzoInge3W1ra55+qZF3LFp
+efTVb26yciNYYeJLeks+nOjOQQd+kcISILdIhYnUGIumWQR/CiY2KL89AXLoTB6EIt5DGC
+udKAjIzSeHtXTliZ1okgjGSmJeE6dhr0UwdLYyaFkdscbF17iTndLc74yCrKIoUnHfxBEc
+/34AT8UdwkrJXj7e2nJyV9WGYz/Ga2xd3s56hVSTUckjxQaBnkZWFilw7ZAlHhPhSglTmd
+pkgWv+Gd4evavBAAAAC2pkQG1vcmVmaW5lAQIDBAUGBw==
+-----END OPENSSH PRIVATE KEY-----