feat(system-config): add system service configuration role
Port global-systemServiceConfigurationFiles() and global-postPackageConfiguration(). Manages: - Global zsh config (/etc/zshrc) - Mail aliases and postfix relay (local-only, smarthost to Cloudron) - Static DNS resolv.conf (replaces systemd-resolved symlinks) - rsyslog forwarding to LibreNMS (skipped on LibreNMS server itself) - DHCP client config (skipped on DHCP servers pfv-netinfra-01/02) - SNMP daemon config selected by host class (Pi/physical/Proxmox/VM) - NTP client config (skipped on NTP server hosts) - LLDP network discovery - Cockpit disallowed-users - Default user shells (zsh, conditional on user existence) - Process accounting (accton) - CPU governor on physical/Proxmox hosts (performance) - tuned profile on VM guests (virtual-guest) Infrastructure configs use Jinja2 templates parameterized by variables in group_vars/all.yml. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
This commit is contained in:
@@ -0,0 +1,266 @@
|
||||
---
|
||||
# system_config combines the legacy global-systemServiceConfigurationFiles()
|
||||
# and global-postPackageConfiguration() functions.
|
||||
|
||||
# ===========================================================================
|
||||
# Phase 1 — global-systemServiceConfigurationFiles
|
||||
# ===========================================================================
|
||||
|
||||
- name: Deploy /etc/zshrc (global zsh config)
|
||||
ansible.builtin.copy:
|
||||
src: zshrc
|
||||
dest: /etc/zshrc
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
|
||||
- name: Deploy /etc/aliases
|
||||
ansible.builtin.copy:
|
||||
src: aliases
|
||||
dest: /etc/aliases
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
notify: Update aliases db
|
||||
|
||||
- name: Deploy /etc/rsyslog.conf
|
||||
ansible.builtin.template:
|
||||
src: rsyslog.conf.j2
|
||||
dest: /etc/rsyslog.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
notify: Restart rsyslog
|
||||
|
||||
# ===========================================================================
|
||||
# Phase 2 — global-postPackageConfiguration
|
||||
# ===========================================================================
|
||||
|
||||
- name: Ensure auditd is enabled and running
|
||||
ansible.builtin.systemd:
|
||||
name: auditd
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
# --- Postfix (local-only relay) ---
|
||||
- name: Deploy /etc/postfix/generic
|
||||
ansible.builtin.copy:
|
||||
src: postfix_generic
|
||||
dest: /etc/postfix/generic
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
notify: Postmap generic
|
||||
|
||||
- name: Configure postfix main.cf
|
||||
ansible.builtin.command: "postconf -e \"{{ item }}\""
|
||||
loop:
|
||||
- "inet_protocols = ipv4"
|
||||
- "inet_interfaces = 127.0.0.1"
|
||||
- "mydestination = 127.0.0.1"
|
||||
- "relayhost = {{ postfix_relayhost }}"
|
||||
- "smtp_generic_maps = hash:/etc/postfix/generic"
|
||||
changed_when: true
|
||||
notify: Restart postfix
|
||||
|
||||
- name: Flush postfix handlers before test mail
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: Send provisioning test mail to root # noqa var-naming[no-role-prefix]
|
||||
ansible.builtin.shell: |
|
||||
echo "hi from root to root" | mail -s "hi directly to root from $(hostname)" root
|
||||
register: _test_mail
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
# --- Default shells (conditional on user existence, matching legacy checks) ---
|
||||
- name: Set root shell to zsh
|
||||
ansible.builtin.user:
|
||||
name: root
|
||||
shell: /usr/bin/zsh
|
||||
|
||||
- name: Set localuser shell to zsh (only if user exists)
|
||||
ansible.builtin.user:
|
||||
name: localuser
|
||||
shell: /usr/bin/zsh
|
||||
when: localuser_exists | bool
|
||||
|
||||
- name: Set subodev shell to zsh (only if user exists)
|
||||
ansible.builtin.user:
|
||||
name: subodev
|
||||
shell: /usr/bin/zsh
|
||||
when: subodev_exists | bool
|
||||
|
||||
# --- DHCP client config (skip on DHCP servers) ---
|
||||
# The legacy script deployed dhclient.conf unconditionally, but DHCP servers
|
||||
# (pfv-netinfra-01/02) should not have their client config overridden.
|
||||
- name: Deploy /etc/dhcp/dhclient.conf (DHCP clients only)
|
||||
ansible.builtin.template:
|
||||
src: dhclient.conf.j2
|
||||
dest: /etc/dhcp/dhclient.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
when: not (is_dhcp_server | bool)
|
||||
|
||||
- name: Skip dhclient.conf deploy on DHCP server
|
||||
ansible.builtin.debug:
|
||||
msg: "Skipping dhclient.conf deploy — {{ inventory_hostname }} is a DHCP server."
|
||||
when: is_dhcp_server | bool
|
||||
|
||||
# --- DNS resolv.conf (static, replaces any symlink) ---
|
||||
- name: Remove existing /etc/resolv.conf (incl. systemd-resolved symlink)
|
||||
ansible.builtin.file:
|
||||
path: /etc/resolv.conf
|
||||
state: absent
|
||||
|
||||
- name: Deploy static /etc/resolv.conf
|
||||
ansible.builtin.template:
|
||||
src: resolv.conf.j2
|
||||
dest: /etc/resolv.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
# --- SNMP ---
|
||||
- name: Stop snmpd before reconfiguring
|
||||
ansible.builtin.service:
|
||||
name: snmpd
|
||||
state: stopped
|
||||
failed_when: false
|
||||
|
||||
- name: Deploy sudoers entry for Debian-snmp
|
||||
ansible.builtin.copy:
|
||||
src: snmp-sudo.conf
|
||||
dest: /etc/sudoers.d/Debian-snmp
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0440"
|
||||
validate: /usr/sbin/visudo -csf %s
|
||||
|
||||
- name: Quiet snmpd logging (replace -Lsd with -LS6d in unit)
|
||||
ansible.builtin.replace:
|
||||
path: /lib/systemd/system/snmpd.service
|
||||
regexp: '-Lsd'
|
||||
replace: '-LS6d'
|
||||
notify: Daemon reload
|
||||
|
||||
# snmpd.conf selection: Pi > physical/proxmox > virtual guest > default
|
||||
- name: Deploy snmpd.conf for Raspberry Pi
|
||||
ansible.builtin.copy:
|
||||
src: snmpd-rpi.conf
|
||||
dest: /etc/snmp/snmpd.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
when: is_raspi | bool
|
||||
notify: Restart snmpd
|
||||
|
||||
- name: Deploy snmpd.conf for physical/Proxmox host
|
||||
ansible.builtin.copy:
|
||||
src: snmpd-physicalhost.conf
|
||||
dest: /etc/snmp/snmpd.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
when: (is_physical_host | bool) or (is_proxmox_host | bool)
|
||||
notify: Restart snmpd
|
||||
|
||||
- name: Deploy snmpd.conf for virtual guests
|
||||
ansible.builtin.copy:
|
||||
src: snmpd.conf
|
||||
dest: /etc/snmp/snmpd.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
when: is_virt_guest | bool
|
||||
notify: Restart snmpd
|
||||
|
||||
# --- LLDP ---
|
||||
- name: Deploy /etc/default/lldpd
|
||||
ansible.builtin.copy:
|
||||
src: lldpd
|
||||
dest: /etc/default/lldpd
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
notify: Restart lldpd
|
||||
|
||||
# --- Cockpit ---
|
||||
- name: Deploy /etc/cockpit/disallowed-users
|
||||
ansible.builtin.copy:
|
||||
src: disallowed-users
|
||||
dest: /etc/cockpit/disallowed-users
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
notify: Restart cockpit
|
||||
|
||||
# --- rsyslog (skip on the LibreNMS syslog collector itself) ---
|
||||
- name: Ensure rsyslog installed and running (except on LibreNMS server)
|
||||
when: not (is_librenms_server | bool)
|
||||
block:
|
||||
- name: Install rsyslog (if missing)
|
||||
ansible.builtin.apt:
|
||||
name: rsyslog
|
||||
state: present
|
||||
update_cache: false
|
||||
|
||||
- name: Ensure rsyslog is running
|
||||
ansible.builtin.systemd:
|
||||
name: rsyslog
|
||||
state: started
|
||||
|
||||
- name: Skip rsyslog reconfig on LibreNMS server
|
||||
ansible.builtin.debug:
|
||||
msg: "Skipping rsyslog reconfig — {{ inventory_hostname }} is the LibreNMS syslog collector."
|
||||
when: is_librenms_server | bool
|
||||
|
||||
# --- NTP (skip on NTP server hosts: pfv-netinfra-01/02, pfv-netboot) ---
|
||||
- name: Deploy /etc/ntpsec/ntp.conf (clients only)
|
||||
ansible.builtin.template:
|
||||
src: ntp.conf.j2
|
||||
dest: /etc/ntpsec/ntp.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
backup: true
|
||||
when: not (is_ntp_server | bool)
|
||||
notify: Restart ntpsec
|
||||
|
||||
- name: Skip NTP client config on NTP server
|
||||
ansible.builtin.debug:
|
||||
msg: "Skipping NTP client config — {{ inventory_hostname }} is an NTP server."
|
||||
when: is_ntp_server | bool
|
||||
|
||||
# --- Process accounting ---
|
||||
- name: Enable process accounting (accton on)
|
||||
ansible.builtin.command: /usr/sbin/accton on
|
||||
changed_when: true
|
||||
failed_when: false
|
||||
|
||||
# --- CPU governor on bare metal (physical hosts AND Proxmox hosts) ---
|
||||
- name: Set CPU governor to performance (physical and Proxmox hosts)
|
||||
ansible.builtin.shell: |
|
||||
cpufreq-set -r -g performance
|
||||
cpupower frequency-set --governor performance
|
||||
when: (is_physical_host | bool) or (is_proxmox_host | bool)
|
||||
changed_when: true
|
||||
failed_when: false
|
||||
|
||||
# --- tuned profile on VMs ---
|
||||
- name: Set tuned profile to virtual-guest (VM guests only)
|
||||
ansible.builtin.command: tuned-adm profile virtual-guest
|
||||
when: is_virt_guest | bool
|
||||
changed_when: true
|
||||
failed_when: false
|
||||
Reference in New Issue
Block a user