KNELIAC/roles/system_config/tasks/main.yml

---
# system_config combines the legacy global-systemServiceConfigurationFiles()
# and global-postPackageConfiguration() functions.

# ===========================================================================
# Phase 1 — global-systemServiceConfigurationFiles
# ===========================================================================

- name: Deploy /etc/zshrc (global zsh config)
  ansible.builtin.copy:
    src: zshrc
    dest: /etc/zshrc
    owner: root
    group: root
    mode: "0644"
    backup: true

- name: Deploy /etc/aliases
  ansible.builtin.copy:
    src: aliases
    dest: /etc/aliases
    owner: root
    group: root
    mode: "0644"
    backup: true
  notify: Update aliases db

- name: Deploy /etc/rsyslog.conf
  ansible.builtin.template:
    src: rsyslog.conf.j2
    dest: /etc/rsyslog.conf
    owner: root
    group: root
    mode: "0644"
    backup: true
  notify: Restart rsyslog

# ===========================================================================
# Phase 2 — global-postPackageConfiguration
# ===========================================================================

- name: Ensure auditd is enabled and running
  ansible.builtin.systemd:
    name: auditd
    state: started
    enabled: true

# --- Postfix (local-only relay) ---
- name: Deploy /etc/postfix/generic
  ansible.builtin.copy:
    src: postfix_generic
    dest: /etc/postfix/generic
    owner: root
    group: root
    mode: "0644"
    backup: true
  notify: Postmap generic

- name: Configure postfix main.cf
  ansible.builtin.command: "postconf -e \"{{ item }}\""
  loop:
    - "inet_protocols = ipv4"
    - "inet_interfaces = 127.0.0.1"
    - "mydestination = 127.0.0.1"
    - "relayhost = {{ postfix_relayhost }}"
    - "smtp_generic_maps = hash:/etc/postfix/generic"
  changed_when: true
  notify: Restart postfix

- name: Flush postfix handlers before test mail
  ansible.builtin.meta: flush_handlers

- name: Send provisioning test mail to root  # noqa var-naming[no-role-prefix]
  ansible.builtin.shell: |
    echo "hi from root to root" | mail -s "hi directly to root from $(hostname)" root
  register: _test_mail
  changed_when: false
  failed_when: false

# --- Default shells (conditional on user existence, matching legacy checks) ---
- name: Set root shell to zsh
  ansible.builtin.user:
    name: root
    shell: /usr/bin/zsh

- name: Set localuser shell to zsh (only if user exists)
  ansible.builtin.user:
    name: localuser
    shell: /usr/bin/zsh
  when: localuser_exists | bool

- name: Set subodev shell to zsh (only if user exists)
  ansible.builtin.user:
    name: subodev
    shell: /usr/bin/zsh
  when: subodev_exists | bool

# --- DHCP client config (skip on DHCP servers) ---
# The legacy script deployed dhclient.conf unconditionally, but DHCP servers
# (pfv-netinfra-01/02) should not have their client config overridden.
- name: Deploy /etc/dhcp/dhclient.conf (DHCP clients only)
  ansible.builtin.template:
    src: dhclient.conf.j2
    dest: /etc/dhcp/dhclient.conf
    owner: root
    group: root
    mode: "0644"
    backup: true
  when: not (is_dhcp_server | bool)

- name: Skip dhclient.conf deploy on DHCP server
  ansible.builtin.debug:
    msg: "Skipping dhclient.conf deploy — {{ inventory_hostname }} is a DHCP server."
  when: is_dhcp_server | bool

# --- DNS resolv.conf (static, replaces any symlink) ---
- name: Remove existing /etc/resolv.conf (incl. systemd-resolved symlink)
  ansible.builtin.file:
    path: /etc/resolv.conf
    state: absent

- name: Deploy static /etc/resolv.conf
  ansible.builtin.template:
    src: resolv.conf.j2
    dest: /etc/resolv.conf
    owner: root
    group: root
    mode: "0644"

# --- SNMP ---
- name: Stop snmpd before reconfiguring
  ansible.builtin.service:
    name: snmpd
    state: stopped
  failed_when: false

- name: Deploy sudoers entry for Debian-snmp
  ansible.builtin.copy:
    src: snmp-sudo.conf
    dest: /etc/sudoers.d/Debian-snmp
    owner: root
    group: root
    mode: "0440"
    validate: /usr/sbin/visudo -csf %s

- name: Quiet snmpd logging (replace -Lsd with -LS6d in unit)
  ansible.builtin.replace:
    path: /lib/systemd/system/snmpd.service
    regexp: '-Lsd'
    replace: '-LS6d'
  notify: Daemon reload

# snmpd.conf selection: Pi > physical/proxmox > virtual guest > default
- name: Deploy snmpd.conf for Raspberry Pi
  ansible.builtin.copy:
    src: snmpd-rpi.conf
    dest: /etc/snmp/snmpd.conf
    owner: root
    group: root
    mode: "0644"
    backup: true
  when: is_raspi | bool
  notify: Restart snmpd

- name: Deploy snmpd.conf for physical/Proxmox host
  ansible.builtin.copy:
    src: snmpd-physicalhost.conf
    dest: /etc/snmp/snmpd.conf
    owner: root
    group: root
    mode: "0644"
    backup: true
  when: (is_physical_host | bool) or (is_proxmox_host | bool)
  notify: Restart snmpd

- name: Deploy snmpd.conf for virtual guests
  ansible.builtin.copy:
    src: snmpd.conf
    dest: /etc/snmp/snmpd.conf
    owner: root
    group: root
    mode: "0644"
    backup: true
  when: is_virt_guest | bool
  notify: Restart snmpd

# --- LLDP ---
- name: Deploy /etc/default/lldpd
  ansible.builtin.copy:
    src: lldpd
    dest: /etc/default/lldpd
    owner: root
    group: root
    mode: "0644"
    backup: true
  notify: Restart lldpd

# --- Cockpit ---
- name: Deploy /etc/cockpit/disallowed-users
  ansible.builtin.copy:
    src: disallowed-users
    dest: /etc/cockpit/disallowed-users
    owner: root
    group: root
    mode: "0644"
    backup: true
  notify: Restart cockpit

# --- rsyslog (skip on the LibreNMS syslog collector itself) ---
- name: Ensure rsyslog installed and running (except on LibreNMS server)
  when: not (is_librenms_server | bool)
  block:
    - name: Install rsyslog (if missing)
      ansible.builtin.apt:
        name: rsyslog
        state: present
        update_cache: false

    - name: Ensure rsyslog is running
      ansible.builtin.systemd:
        name: rsyslog
        state: started

- name: Skip rsyslog reconfig on LibreNMS server
  ansible.builtin.debug:
    msg: "Skipping rsyslog reconfig — {{ inventory_hostname }} is the LibreNMS syslog collector."
  when: is_librenms_server | bool

# --- NTP (skip on NTP server hosts: pfv-netinfra-01/02, pfv-netboot) ---
- name: Deploy /etc/ntpsec/ntp.conf (clients only)
  ansible.builtin.template:
    src: ntp.conf.j2
    dest: /etc/ntpsec/ntp.conf
    owner: root
    group: root
    mode: "0644"
    backup: true
  when: not (is_ntp_server | bool)
  notify: Restart ntpsec

- name: Skip NTP client config on NTP server
  ansible.builtin.debug:
    msg: "Skipping NTP client config — {{ inventory_hostname }} is an NTP server."
  when: is_ntp_server | bool

# --- Process accounting ---
- name: Enable process accounting (accton on)
  ansible.builtin.command: /usr/sbin/accton on
  changed_when: true
  failed_when: false

# --- CPU governor on bare metal (physical hosts AND Proxmox hosts) ---
- name: Set CPU governor to performance (physical and Proxmox hosts)
  ansible.builtin.shell: |
    cpufreq-set -r -g performance
    cpupower frequency-set --governor performance
  when: (is_physical_host | bool) or (is_proxmox_host | bool)
  changed_when: true
  failed_when: false

# --- tuned profile on VMs ---
- name: Set tuned profile to virtual-guest (VM guests only)
  ansible.builtin.command: tuned-adm profile virtual-guest
  when: is_virt_guest | bool
  changed_when: true
  failed_when: false