feat(system-config): add system service configuration role
Port global-systemServiceConfigurationFiles() and global-postPackageConfiguration(). Manages: - Global zsh config (/etc/zshrc) - Mail aliases and postfix relay (local-only, smarthost to Cloudron) - Static DNS resolv.conf (replaces systemd-resolved symlinks) - rsyslog forwarding to LibreNMS (skipped on LibreNMS server itself) - DHCP client config (skipped on DHCP servers pfv-netinfra-01/02) - SNMP daemon config selected by host class (Pi/physical/Proxmox/VM) - NTP client config (skipped on NTP server hosts) - LLDP network discovery - Cockpit disallowed-users - Default user shells (zsh, conditional on user existence) - Process accounting (accton) - CPU governor on physical/Proxmox hosts (performance) - tuned profile on VM guests (virtual-guest) Infrastructure configs use Jinja2 templates parameterized by variables in group_vars/all.yml. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
This commit is contained in:
@@ -0,0 +1,3 @@
|
|||||||
|
# See man 5 aliases for format
|
||||||
|
postmaster: root
|
||||||
|
root: coo@turnsys.com
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
#/etc/cockpit/disallowed-users
|
||||||
|
# List of users which are not allowed to login to Cockpit
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
# Uncomment to start SNMP subagent and enable CDP, SONMP and EDP protocol
|
||||||
|
DAEMON_ARGS="-x -c -s -e"
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/.*/ tsysrootaccount@knel.net
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
Debian-snmp ALL = NOPASSWD: /bin/cat
|
||||||
@@ -0,0 +1,46 @@
|
|||||||
|
##########################################################################
|
||||||
|
# snmpd.conf
|
||||||
|
# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
|
||||||
|
###########################################################################
|
||||||
|
# SECTION: Monitor Various Aspects of the Running Host
|
||||||
|
#
|
||||||
|
|
||||||
|
# disk: Check for disk space usage of a partition.
|
||||||
|
# The agent can check the amount of available disk space, and make
|
||||||
|
# sure it is above a set limit.
|
||||||
|
#
|
||||||
|
load 3 3 3
|
||||||
|
rocommunity kn3lmgmt
|
||||||
|
sysservices 76
|
||||||
|
|
||||||
|
#syslocation Rack, Room, Building, City, Country [Lat, Lon]
|
||||||
|
syslocation R4, Server Room, SITER, Pflugerville, United States
|
||||||
|
syscontact coo@turnsys.com
|
||||||
|
|
||||||
|
#NTP
|
||||||
|
extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
|
||||||
|
|
||||||
|
#SMTP
|
||||||
|
extend mailq /usr/lib/check_mk_agent/local/postfix-queues
|
||||||
|
extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
|
||||||
|
|
||||||
|
#OS Distribution Detection
|
||||||
|
extend distro /usr/local/bin/distro
|
||||||
|
extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
|
||||||
|
|
||||||
|
#Hardware Detection
|
||||||
|
extend manufacturer /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/sys_vendor
|
||||||
|
extend hardware /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_name
|
||||||
|
extend serial /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_serial
|
||||||
|
|
||||||
|
#SMART
|
||||||
|
extend smart /usr/lib/check_mk_agent/local/smart
|
||||||
|
|
||||||
|
#Temperature
|
||||||
|
pass_persist .1.3.6.1.4.1.9.9.13.1.3 /usr/local/bin/temper-snmp
|
||||||
|
|
||||||
|
# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
|
||||||
|
# smuxpeer .1.3.6.1.4.1.674.10892.1
|
||||||
|
|
||||||
|
# LLDP collection
|
||||||
|
master agentx
|
||||||
@@ -0,0 +1,40 @@
|
|||||||
|
##########################################################################
|
||||||
|
# snmpd.conf
|
||||||
|
# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
|
||||||
|
###########################################################################
|
||||||
|
# SECTION: Monitor Various Aspects of the Running Host
|
||||||
|
#
|
||||||
|
|
||||||
|
# disk: Check for disk space usage of a partition.
|
||||||
|
# The agent can check the amount of available disk space, and make
|
||||||
|
# sure it is above a set limit.
|
||||||
|
#
|
||||||
|
load 3 3 3
|
||||||
|
rocommunity kn3lmgmt
|
||||||
|
sysservices 76
|
||||||
|
|
||||||
|
#syslocation Rack, Room, Building, City, Country [Lat, Lon]
|
||||||
|
syslocation SITER, Pflugerville, United States
|
||||||
|
syscontact coo@turnsys.com
|
||||||
|
|
||||||
|
#NTP
|
||||||
|
extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
|
||||||
|
|
||||||
|
#SMTP
|
||||||
|
extend mailq /usr/lib/check_mk_agent/local/postfix-queues
|
||||||
|
extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
|
||||||
|
|
||||||
|
#OS Distribution Detection
|
||||||
|
extend distro /usr/local/bin/distro
|
||||||
|
extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
|
||||||
|
|
||||||
|
|
||||||
|
#Hardware Detection
|
||||||
|
extend hardware /usr/bin/sudo /usr/bin/cat /sys/firmware/devicetree/base/model
|
||||||
|
extend serial /usr/bin/sudo /usr/bin/cat /sys/firmware/devicetree/base/serial-number
|
||||||
|
|
||||||
|
# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
|
||||||
|
# smuxpeer .1.3.6.1.4.1.674.10892.1
|
||||||
|
|
||||||
|
# LLDP collection
|
||||||
|
master agentx
|
||||||
@@ -0,0 +1,44 @@
|
|||||||
|
##########################################################################
|
||||||
|
# snmpd.conf
|
||||||
|
# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
|
||||||
|
###########################################################################
|
||||||
|
# SECTION: Monitor Various Aspects of the Running Host
|
||||||
|
#
|
||||||
|
|
||||||
|
# disk: Check for disk space usage of a partition.
|
||||||
|
# The agent can check the amount of available disk space, and make
|
||||||
|
# sure it is above a set limit.
|
||||||
|
#
|
||||||
|
load 3 3 3
|
||||||
|
rocommunity kn3lmgmt
|
||||||
|
sysservices 76
|
||||||
|
|
||||||
|
#syslocation Rack, Room, Building, City, Country [Lat, Lon]
|
||||||
|
syslocation R4, Server Room, SITER, Pflugerville, United States
|
||||||
|
syscontact coo@turnsys.com
|
||||||
|
|
||||||
|
#NTP
|
||||||
|
extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
|
||||||
|
|
||||||
|
#SMTP
|
||||||
|
extend mailq /usr/lib/check_mk_agent/local/postfix-queues
|
||||||
|
extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
|
||||||
|
|
||||||
|
#OS Distribution Detection
|
||||||
|
extend distro /usr/local/bin/distro
|
||||||
|
extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
|
||||||
|
|
||||||
|
# Socket statistics
|
||||||
|
extend ss /usr/lib/check_mk_agent/local/ss.py
|
||||||
|
|
||||||
|
#Hardware Detection
|
||||||
|
# (uncomment for x86 platforms)
|
||||||
|
extend manufacturer /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/sys_vendor
|
||||||
|
extend hardware /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_name
|
||||||
|
extend serial /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_serial
|
||||||
|
|
||||||
|
# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
|
||||||
|
# smuxpeer .1.3.6.1.4.1.674.10892.1
|
||||||
|
|
||||||
|
# LLDP collection
|
||||||
|
master agentx
|
||||||
@@ -0,0 +1,258 @@
|
|||||||
|
# ~/.zshrc file for zsh interactive shells.
|
||||||
|
# see /usr/share/doc/zsh/examples/zshrc for examples
|
||||||
|
|
||||||
|
setopt autocd # change directory just by typing its name
|
||||||
|
#setopt correct # auto correct mistakes
|
||||||
|
setopt interactivecomments # allow comments in interactive mode
|
||||||
|
setopt magicequalsubst # enable filename expansion for arguments of the form ‘anything=expression’
|
||||||
|
setopt nonomatch # hide error message if there is no match for the pattern
|
||||||
|
setopt notify # report the status of background jobs immediately
|
||||||
|
setopt numericglobsort # sort filenames numerically when it makes sense
|
||||||
|
setopt promptsubst # enable command substitution in prompt
|
||||||
|
|
||||||
|
WORDCHARS=${WORDCHARS//\/} # Don't consider certain characters part of the word
|
||||||
|
|
||||||
|
# hide EOL sign ('%')
|
||||||
|
PROMPT_EOL_MARK=""
|
||||||
|
|
||||||
|
# configure key keybindings
|
||||||
|
bindkey -v # emacs key bindings
|
||||||
|
bindkey ' ' magic-space # do history expansion on space
|
||||||
|
bindkey '^U' backward-kill-line # ctrl + U
|
||||||
|
bindkey '^[[3;5~' kill-word # ctrl + Supr
|
||||||
|
bindkey '^[[3~' delete-char # delete
|
||||||
|
bindkey '^[[1;5C' forward-word # ctrl + ->
|
||||||
|
bindkey '^[[1;5D' backward-word # ctrl + <-
|
||||||
|
bindkey '^[[5~' beginning-of-buffer-or-history # page up
|
||||||
|
bindkey '^[[6~' end-of-buffer-or-history # page down
|
||||||
|
bindkey '^[[H' beginning-of-line # home
|
||||||
|
bindkey '^[[F' end-of-line # end
|
||||||
|
bindkey '^[[Z' undo # shift + tab undo last action
|
||||||
|
|
||||||
|
# enable completion features
|
||||||
|
autoload -Uz compinit
|
||||||
|
compinit -d ~/.cache/zcompdump
|
||||||
|
zstyle ':completion:*:*:*:*:*' menu select
|
||||||
|
zstyle ':completion:*' auto-description 'specify: %d'
|
||||||
|
zstyle ':completion:*' completer _expand _complete
|
||||||
|
zstyle ':completion:*' format 'Completing %d'
|
||||||
|
zstyle ':completion:*' group-name ''
|
||||||
|
zstyle ':completion:*' list-colors ''
|
||||||
|
zstyle ':completion:*' list-prompt %SAt %p: Hit TAB for more, or the character to insert%s
|
||||||
|
zstyle ':completion:*' matcher-list 'm:{a-zA-Z}={A-Za-z}'
|
||||||
|
zstyle ':completion:*' rehash true
|
||||||
|
zstyle ':completion:*' select-prompt %SScrolling active: current selection at %p%s
|
||||||
|
zstyle ':completion:*' use-compctl false
|
||||||
|
zstyle ':completion:*' verbose true
|
||||||
|
zstyle ':completion:*:kill:*' command 'ps -u $USER -o pid,%cpu,tty,cputime,cmd'
|
||||||
|
|
||||||
|
# History configurations
|
||||||
|
HISTFILE=~/.zsh_history
|
||||||
|
HISTSIZE=10000
|
||||||
|
SAVEHIST=200000
|
||||||
|
setopt hist_expire_dups_first # delete duplicates first when HISTFILE size exceeds HISTSIZE
|
||||||
|
setopt hist_ignore_dups # ignore duplicated commands history list
|
||||||
|
setopt hist_ignore_space # ignore commands that start with space
|
||||||
|
setopt hist_verify # show command with history expansion to user before running it
|
||||||
|
#setopt share_history # share command history data
|
||||||
|
|
||||||
|
# force zsh to show the complete history
|
||||||
|
alias history="history 0"
|
||||||
|
|
||||||
|
# configure `time` format
|
||||||
|
TIMEFMT=$'\nreal\t%E\nuser\t%U\nsys\t%S\ncpu\t%P'
|
||||||
|
|
||||||
|
# make less more friendly for non-text input files, see lesspipe(1)
|
||||||
|
#[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
|
||||||
|
|
||||||
|
# set variable identifying the chroot you work in (used in the prompt below)
|
||||||
|
if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
|
||||||
|
debian_chroot=$(cat /etc/debian_chroot)
|
||||||
|
fi
|
||||||
|
|
||||||
|
# set a fancy prompt (non-color, unless we know we "want" color)
|
||||||
|
case "$TERM" in
|
||||||
|
xterm-color|*-256color) color_prompt=yes;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# uncomment for a colored prompt, if the terminal has the capability; turned
|
||||||
|
# off by default to not distract the user: the focus in a terminal window
|
||||||
|
# should be on the output of commands, not on the prompt
|
||||||
|
force_color_prompt=yes
|
||||||
|
|
||||||
|
if [ -n "$force_color_prompt" ]; then
|
||||||
|
if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
|
||||||
|
# We have color support; assume it's compliant with Ecma-48
|
||||||
|
# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
|
||||||
|
# a case would tend to support setf rather than setaf.)
|
||||||
|
color_prompt=yes
|
||||||
|
else
|
||||||
|
color_prompt=
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
configure_prompt() {
|
||||||
|
prompt_symbol=㉿
|
||||||
|
# Skull emoji for root terminal
|
||||||
|
#[ "$EUID" -eq 0 ] && prompt_symbol=💀
|
||||||
|
case "$PROMPT_ALTERNATIVE" in
|
||||||
|
twoline)
|
||||||
|
PROMPT=$'%F{%(#.blue.green)}┌──${debian_chroot:+($debian_chroot)─}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))─}(%B%F{%(#.red.blue)}%n'$prompt_symbol$'%m%b%F{%(#.blue.green)})-[%B%F{reset}%(6~.%-1~/…/%4~.%5~)%b%F{%(#.blue.green)}]\n└─%B%(#.%F{red}#.%F{blue}$)%b%F{reset} '
|
||||||
|
# Right-side prompt with exit codes and background processes
|
||||||
|
#RPROMPT=$'%(?.. %? %F{red}%B⨯%b%F{reset})%(1j. %j %F{yellow}%B⚙%b%F{reset}.)'
|
||||||
|
;;
|
||||||
|
oneline)
|
||||||
|
PROMPT=$'${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%B%F{%(#.red.blue)}%n@%m%b%F{reset}:%B%F{%(#.blue.green)}%~%b%F{reset}%(#.#.$) '
|
||||||
|
RPROMPT=
|
||||||
|
;;
|
||||||
|
backtrack)
|
||||||
|
PROMPT=$'${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%B%F{red}%n@%m%b%F{reset}:%B%F{blue}%~%b%F{reset}%(#.#.$) '
|
||||||
|
RPROMPT=
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
unset prompt_symbol
|
||||||
|
}
|
||||||
|
|
||||||
|
# The following block is surrounded by two delimiters.
|
||||||
|
# These delimiters must not be modified. Thanks.
|
||||||
|
# START KALI CONFIG VARIABLES
|
||||||
|
PROMPT_ALTERNATIVE=twoline
|
||||||
|
NEWLINE_BEFORE_PROMPT=yes
|
||||||
|
# STOP KALI CONFIG VARIABLES
|
||||||
|
|
||||||
|
if [ "$color_prompt" = yes ]; then
|
||||||
|
# override default virtualenv indicator in prompt
|
||||||
|
VIRTUAL_ENV_DISABLE_PROMPT=1
|
||||||
|
|
||||||
|
configure_prompt
|
||||||
|
|
||||||
|
# enable syntax-highlighting
|
||||||
|
if [ -f /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]; then
|
||||||
|
. /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
|
||||||
|
ZSH_HIGHLIGHT_HIGHLIGHTERS=(main brackets pattern)
|
||||||
|
ZSH_HIGHLIGHT_STYLES[default]=none
|
||||||
|
ZSH_HIGHLIGHT_STYLES[unknown-token]=underline
|
||||||
|
ZSH_HIGHLIGHT_STYLES[reserved-word]=fg=cyan,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[suffix-alias]=fg=green,underline
|
||||||
|
ZSH_HIGHLIGHT_STYLES[global-alias]=fg=green,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[precommand]=fg=green,underline
|
||||||
|
ZSH_HIGHLIGHT_STYLES[commandseparator]=fg=blue,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[autodirectory]=fg=green,underline
|
||||||
|
ZSH_HIGHLIGHT_STYLES[path]=bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[path_pathseparator]=
|
||||||
|
ZSH_HIGHLIGHT_STYLES[path_prefix_pathseparator]=
|
||||||
|
ZSH_HIGHLIGHT_STYLES[globbing]=fg=blue,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[history-expansion]=fg=blue,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[command-substitution]=none
|
||||||
|
ZSH_HIGHLIGHT_STYLES[command-substitution-delimiter]=fg=magenta,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[process-substitution]=none
|
||||||
|
ZSH_HIGHLIGHT_STYLES[process-substitution-delimiter]=fg=magenta,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[single-hyphen-option]=fg=green
|
||||||
|
ZSH_HIGHLIGHT_STYLES[double-hyphen-option]=fg=green
|
||||||
|
ZSH_HIGHLIGHT_STYLES[back-quoted-argument]=none
|
||||||
|
ZSH_HIGHLIGHT_STYLES[back-quoted-argument-delimiter]=fg=blue,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[single-quoted-argument]=fg=yellow
|
||||||
|
ZSH_HIGHLIGHT_STYLES[double-quoted-argument]=fg=yellow
|
||||||
|
ZSH_HIGHLIGHT_STYLES[dollar-quoted-argument]=fg=yellow
|
||||||
|
ZSH_HIGHLIGHT_STYLES[rc-quote]=fg=magenta
|
||||||
|
ZSH_HIGHLIGHT_STYLES[dollar-double-quoted-argument]=fg=magenta,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[back-double-quoted-argument]=fg=magenta,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[back-dollar-quoted-argument]=fg=magenta,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[assign]=none
|
||||||
|
ZSH_HIGHLIGHT_STYLES[redirection]=fg=blue,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[comment]=fg=black,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[named-fd]=none
|
||||||
|
ZSH_HIGHLIGHT_STYLES[numeric-fd]=none
|
||||||
|
ZSH_HIGHLIGHT_STYLES[arg0]=fg=cyan
|
||||||
|
ZSH_HIGHLIGHT_STYLES[bracket-error]=fg=red,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[bracket-level-1]=fg=blue,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[bracket-level-2]=fg=green,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[bracket-level-3]=fg=magenta,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[bracket-level-4]=fg=yellow,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[bracket-level-5]=fg=cyan,bold
|
||||||
|
ZSH_HIGHLIGHT_STYLES[cursor-matchingbracket]=standout
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
PROMPT='${debian_chroot:+($debian_chroot)}%n@%m:%~%(#.#.$) '
|
||||||
|
fi
|
||||||
|
unset color_prompt force_color_prompt
|
||||||
|
|
||||||
|
toggle_oneline_prompt(){
|
||||||
|
if [ "$PROMPT_ALTERNATIVE" = oneline ]; then
|
||||||
|
PROMPT_ALTERNATIVE=twoline
|
||||||
|
else
|
||||||
|
PROMPT_ALTERNATIVE=oneline
|
||||||
|
fi
|
||||||
|
configure_prompt
|
||||||
|
zle reset-prompt
|
||||||
|
}
|
||||||
|
zle -N toggle_oneline_prompt
|
||||||
|
bindkey ^P toggle_oneline_prompt
|
||||||
|
|
||||||
|
# If this is an xterm set the title to user@host:dir
|
||||||
|
case "$TERM" in
|
||||||
|
xterm*|rxvt*|Eterm|aterm|kterm|gnome*|alacritty)
|
||||||
|
TERM_TITLE=$'\e]0;${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%n@%m: %~\a'
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
precmd() {
|
||||||
|
# Print the previously configured title
|
||||||
|
print -Pnr -- "$TERM_TITLE"
|
||||||
|
|
||||||
|
# Print a new line before the prompt, but only if it is not the first line
|
||||||
|
if [ "$NEWLINE_BEFORE_PROMPT" = yes ]; then
|
||||||
|
if [ -z "$_NEW_LINE_BEFORE_PROMPT" ]; then
|
||||||
|
_NEW_LINE_BEFORE_PROMPT=1
|
||||||
|
else
|
||||||
|
print ""
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# enable color support of ls, less and man, and also add handy aliases
|
||||||
|
if [ -x /usr/bin/dircolors ]; then
|
||||||
|
test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
|
||||||
|
export LS_COLORS="$LS_COLORS:ow=30;44:" # fix ls color for folders with 777 permissions
|
||||||
|
|
||||||
|
alias ls='ls --color=auto'
|
||||||
|
#alias dir='dir --color=auto'
|
||||||
|
#alias vdir='vdir --color=auto'
|
||||||
|
|
||||||
|
alias grep='grep --color=auto'
|
||||||
|
alias fgrep='fgrep --color=auto'
|
||||||
|
alias egrep='egrep --color=auto'
|
||||||
|
alias diff='diff --color=auto'
|
||||||
|
alias ip='ip --color=auto'
|
||||||
|
|
||||||
|
export LESS_TERMCAP_mb=$'\E[1;31m' # begin blink
|
||||||
|
export LESS_TERMCAP_md=$'\E[1;36m' # begin bold
|
||||||
|
export LESS_TERMCAP_me=$'\E[0m' # reset bold/blink
|
||||||
|
export LESS_TERMCAP_so=$'\E[01;33m' # begin reverse video
|
||||||
|
export LESS_TERMCAP_se=$'\E[0m' # reset reverse video
|
||||||
|
export LESS_TERMCAP_us=$'\E[1;32m' # begin underline
|
||||||
|
export LESS_TERMCAP_ue=$'\E[0m' # reset underline
|
||||||
|
|
||||||
|
# Take advantage of $LS_COLORS for completion as well
|
||||||
|
zstyle ':completion:*' list-colors "${(s.:.)LS_COLORS}"
|
||||||
|
zstyle ':completion:*:*:kill:*:processes' list-colors '=(#b) #([0-9]#)*=0=01;31'
|
||||||
|
fi
|
||||||
|
|
||||||
|
# some more ls aliases
|
||||||
|
alias ll='ls -l'
|
||||||
|
alias la='ls -A'
|
||||||
|
alias l='ls -CF'
|
||||||
|
|
||||||
|
# enable auto-suggestions based on the history
|
||||||
|
if [ -f /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh ]; then
|
||||||
|
. /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh
|
||||||
|
# change suggestion color
|
||||||
|
ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=#999'
|
||||||
|
fi
|
||||||
|
|
||||||
|
# enable command-not-found if installed
|
||||||
|
if [ -f /etc/zsh_command_not_found ]; then
|
||||||
|
. /etc/zsh_command_not_found
|
||||||
|
fi
|
||||||
@@ -0,0 +1,43 @@
|
|||||||
|
---
|
||||||
|
- name: Update aliases db
|
||||||
|
ansible.builtin.command: newaliases
|
||||||
|
changed_when: true
|
||||||
|
|
||||||
|
- name: Restart rsyslog
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: rsyslog
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: Postmap generic
|
||||||
|
ansible.builtin.command: postmap /etc/postfix/generic
|
||||||
|
changed_when: true
|
||||||
|
|
||||||
|
- name: Restart postfix
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: postfix
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: Restart snmpd
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: snmpd
|
||||||
|
state: restarted
|
||||||
|
daemon_reload: true
|
||||||
|
|
||||||
|
- name: Restart lldpd
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: lldpd
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: Restart cockpit
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: cockpit
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: Restart ntpsec
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: ntpsec.service
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: Daemon reload
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
daemon_reload: true
|
||||||
@@ -0,0 +1,266 @@
|
|||||||
|
---
|
||||||
|
# system_config combines the legacy global-systemServiceConfigurationFiles()
|
||||||
|
# and global-postPackageConfiguration() functions.
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# Phase 1 — global-systemServiceConfigurationFiles
|
||||||
|
# ===========================================================================
|
||||||
|
|
||||||
|
- name: Deploy /etc/zshrc (global zsh config)
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: zshrc
|
||||||
|
dest: /etc/zshrc
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
|
||||||
|
- name: Deploy /etc/aliases
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: aliases
|
||||||
|
dest: /etc/aliases
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
notify: Update aliases db
|
||||||
|
|
||||||
|
- name: Deploy /etc/rsyslog.conf
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: rsyslog.conf.j2
|
||||||
|
dest: /etc/rsyslog.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
notify: Restart rsyslog
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# Phase 2 — global-postPackageConfiguration
|
||||||
|
# ===========================================================================
|
||||||
|
|
||||||
|
- name: Ensure auditd is enabled and running
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: auditd
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# --- Postfix (local-only relay) ---
|
||||||
|
- name: Deploy /etc/postfix/generic
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: postfix_generic
|
||||||
|
dest: /etc/postfix/generic
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
notify: Postmap generic
|
||||||
|
|
||||||
|
- name: Configure postfix main.cf
|
||||||
|
ansible.builtin.command: "postconf -e \"{{ item }}\""
|
||||||
|
loop:
|
||||||
|
- "inet_protocols = ipv4"
|
||||||
|
- "inet_interfaces = 127.0.0.1"
|
||||||
|
- "mydestination = 127.0.0.1"
|
||||||
|
- "relayhost = {{ postfix_relayhost }}"
|
||||||
|
- "smtp_generic_maps = hash:/etc/postfix/generic"
|
||||||
|
changed_when: true
|
||||||
|
notify: Restart postfix
|
||||||
|
|
||||||
|
- name: Flush postfix handlers before test mail
|
||||||
|
ansible.builtin.meta: flush_handlers
|
||||||
|
|
||||||
|
- name: Send provisioning test mail to root # noqa var-naming[no-role-prefix]
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
echo "hi from root to root" | mail -s "hi directly to root from $(hostname)" root
|
||||||
|
register: _test_mail
|
||||||
|
changed_when: false
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
# --- Default shells (conditional on user existence, matching legacy checks) ---
|
||||||
|
- name: Set root shell to zsh
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: root
|
||||||
|
shell: /usr/bin/zsh
|
||||||
|
|
||||||
|
- name: Set localuser shell to zsh (only if user exists)
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: localuser
|
||||||
|
shell: /usr/bin/zsh
|
||||||
|
when: localuser_exists | bool
|
||||||
|
|
||||||
|
- name: Set subodev shell to zsh (only if user exists)
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: subodev
|
||||||
|
shell: /usr/bin/zsh
|
||||||
|
when: subodev_exists | bool
|
||||||
|
|
||||||
|
# --- DHCP client config (skip on DHCP servers) ---
|
||||||
|
# The legacy script deployed dhclient.conf unconditionally, but DHCP servers
|
||||||
|
# (pfv-netinfra-01/02) should not have their client config overridden.
|
||||||
|
- name: Deploy /etc/dhcp/dhclient.conf (DHCP clients only)
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: dhclient.conf.j2
|
||||||
|
dest: /etc/dhcp/dhclient.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
when: not (is_dhcp_server | bool)
|
||||||
|
|
||||||
|
- name: Skip dhclient.conf deploy on DHCP server
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "Skipping dhclient.conf deploy — {{ inventory_hostname }} is a DHCP server."
|
||||||
|
when: is_dhcp_server | bool
|
||||||
|
|
||||||
|
# --- DNS resolv.conf (static, replaces any symlink) ---
|
||||||
|
- name: Remove existing /etc/resolv.conf (incl. systemd-resolved symlink)
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /etc/resolv.conf
|
||||||
|
state: absent
|
||||||
|
|
||||||
|
- name: Deploy static /etc/resolv.conf
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: resolv.conf.j2
|
||||||
|
dest: /etc/resolv.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
|
||||||
|
# --- SNMP ---
|
||||||
|
- name: Stop snmpd before reconfiguring
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: snmpd
|
||||||
|
state: stopped
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
- name: Deploy sudoers entry for Debian-snmp
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: snmp-sudo.conf
|
||||||
|
dest: /etc/sudoers.d/Debian-snmp
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0440"
|
||||||
|
validate: /usr/sbin/visudo -csf %s
|
||||||
|
|
||||||
|
- name: Quiet snmpd logging (replace -Lsd with -LS6d in unit)
|
||||||
|
ansible.builtin.replace:
|
||||||
|
path: /lib/systemd/system/snmpd.service
|
||||||
|
regexp: '-Lsd'
|
||||||
|
replace: '-LS6d'
|
||||||
|
notify: Daemon reload
|
||||||
|
|
||||||
|
# snmpd.conf selection: Pi > physical/proxmox > virtual guest > default
|
||||||
|
- name: Deploy snmpd.conf for Raspberry Pi
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: snmpd-rpi.conf
|
||||||
|
dest: /etc/snmp/snmpd.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
when: is_raspi | bool
|
||||||
|
notify: Restart snmpd
|
||||||
|
|
||||||
|
- name: Deploy snmpd.conf for physical/Proxmox host
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: snmpd-physicalhost.conf
|
||||||
|
dest: /etc/snmp/snmpd.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
when: (is_physical_host | bool) or (is_proxmox_host | bool)
|
||||||
|
notify: Restart snmpd
|
||||||
|
|
||||||
|
- name: Deploy snmpd.conf for virtual guests
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: snmpd.conf
|
||||||
|
dest: /etc/snmp/snmpd.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
when: is_virt_guest | bool
|
||||||
|
notify: Restart snmpd
|
||||||
|
|
||||||
|
# --- LLDP ---
|
||||||
|
- name: Deploy /etc/default/lldpd
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: lldpd
|
||||||
|
dest: /etc/default/lldpd
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
notify: Restart lldpd
|
||||||
|
|
||||||
|
# --- Cockpit ---
|
||||||
|
- name: Deploy /etc/cockpit/disallowed-users
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: disallowed-users
|
||||||
|
dest: /etc/cockpit/disallowed-users
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
notify: Restart cockpit
|
||||||
|
|
||||||
|
# --- rsyslog (skip on the LibreNMS syslog collector itself) ---
|
||||||
|
- name: Ensure rsyslog installed and running (except on LibreNMS server)
|
||||||
|
when: not (is_librenms_server | bool)
|
||||||
|
block:
|
||||||
|
- name: Install rsyslog (if missing)
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: rsyslog
|
||||||
|
state: present
|
||||||
|
update_cache: false
|
||||||
|
|
||||||
|
- name: Ensure rsyslog is running
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: rsyslog
|
||||||
|
state: started
|
||||||
|
|
||||||
|
- name: Skip rsyslog reconfig on LibreNMS server
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "Skipping rsyslog reconfig — {{ inventory_hostname }} is the LibreNMS syslog collector."
|
||||||
|
when: is_librenms_server | bool
|
||||||
|
|
||||||
|
# --- NTP (skip on NTP server hosts: pfv-netinfra-01/02, pfv-netboot) ---
|
||||||
|
- name: Deploy /etc/ntpsec/ntp.conf (clients only)
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: ntp.conf.j2
|
||||||
|
dest: /etc/ntpsec/ntp.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
backup: true
|
||||||
|
when: not (is_ntp_server | bool)
|
||||||
|
notify: Restart ntpsec
|
||||||
|
|
||||||
|
- name: Skip NTP client config on NTP server
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "Skipping NTP client config — {{ inventory_hostname }} is an NTP server."
|
||||||
|
when: is_ntp_server | bool
|
||||||
|
|
||||||
|
# --- Process accounting ---
|
||||||
|
- name: Enable process accounting (accton on)
|
||||||
|
ansible.builtin.command: /usr/sbin/accton on
|
||||||
|
changed_when: true
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
# --- CPU governor on bare metal (physical hosts AND Proxmox hosts) ---
|
||||||
|
- name: Set CPU governor to performance (physical and Proxmox hosts)
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
cpufreq-set -r -g performance
|
||||||
|
cpupower frequency-set --governor performance
|
||||||
|
when: (is_physical_host | bool) or (is_proxmox_host | bool)
|
||||||
|
changed_when: true
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
# --- tuned profile on VMs ---
|
||||||
|
- name: Set tuned profile to virtual-guest (VM guests only)
|
||||||
|
ansible.builtin.command: tuned-adm profile virtual-guest
|
||||||
|
when: is_virt_guest | bool
|
||||||
|
changed_when: true
|
||||||
|
failed_when: false
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
|
||||||
|
|
||||||
|
send host-name = gethostname();
|
||||||
|
request subnet-mask, broadcast-address, time-offset, routers,
|
||||||
|
domain-name, host-name,
|
||||||
|
domain-name-servers, domain-search, ntp-servers,
|
||||||
|
rfc3442-classless-static-routes;
|
||||||
|
|
||||||
|
# Pin DNS and NTP to the redundant pfv-netinfra-01/02 pair regardless of what
|
||||||
|
# the DHCP server advertises, so every host on this build uses the same
|
||||||
|
# authoritative recursive resolvers and time sources.
|
||||||
|
supersede domain-name-servers {{ dns_servers | join(', ') }};
|
||||||
|
supersede domain-search "{{ dns_search_domain }}";
|
||||||
|
supersede ntp-servers {{ ntp_servers | join(', ') }};
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
driftfile /var/lib/ntp/ntp.drift
|
||||||
|
leapfile /usr/share/zoneinfo/leap-seconds.list
|
||||||
|
|
||||||
|
# Redundant upstream time sources: pfv-netinfra-01/02 (Technitium/Pi-hole hosts
|
||||||
|
# also serving NTP). IPs are used (not hostnames) because the knel.net name for
|
||||||
|
# these hosts resolves to a Tailscale CGNAT address, not the LAN address, and
|
||||||
|
# because NTP must come up before DNS is available. iburst speeds initial sync.
|
||||||
|
{% for srv in ntp_servers %}
|
||||||
|
server {{ srv }} iburst
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
# Hardened client: sync from the configured servers but never serve time to
|
||||||
|
# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it
|
||||||
|
# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source
|
||||||
|
# address that upstream servers cannot reply to (symptoms: peers stuck in
|
||||||
|
# .INIT. with reach 0). Use restrict rules to control access instead.
|
||||||
|
restrict default ignore
|
||||||
|
restrict 127.0.0.1
|
||||||
|
restrict ::1
|
||||||
|
{% for srv in ntp_servers %}
|
||||||
|
restrict {{ srv }} nomodify notrap nopeer
|
||||||
|
{% endfor %}
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
# Managed by KNELIAC — do not edit; changes will be overwritten.
|
||||||
|
# Redundant recursive DNS via pfv-netinfra-01/02 (Technitium + Pi-hole).
|
||||||
|
# IPs are used (required: nameserver directives must be addresses, and the
|
||||||
|
# knel.net name for these hosts resolves to a Tailscale CGNAT address rather
|
||||||
|
# than the LAN address). If the primary is unreachable, glibc's resolver
|
||||||
|
# automatically falls through to the secondary.
|
||||||
|
domain {{ dns_search_domain }}
|
||||||
|
search {{ dns_search_domain }}
|
||||||
|
{% for ns in dns_servers %}
|
||||||
|
nameserver {{ ns }}
|
||||||
|
{% endfor %}
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
module(load="imuxsock") # provides support for local system logging
|
||||||
|
module(load="imklog") # provides kernel logging support
|
||||||
|
#module(load="immark") # provides --MARK-- message capability
|
||||||
|
|
||||||
|
*.* @{{ syslog_forward_host }}:514
|
||||||
|
:omusrmsg:EOF
|
||||||
Reference in New Issue
Block a user