import old book
This commit is contained in:
@@ -0,0 +1,4 @@
|
||||
check:
|
||||
ansible-playbook --check -i inventory.ini -v --become-method community.general.run0 main.yaml
|
||||
run:
|
||||
ansible-playbook -i inventory.ini -v --become-method community.general.run0 main.yaml
|
||||
@@ -0,0 +1,2 @@
|
||||
[all]
|
||||
localhost ansible_connection=local
|
||||
@@ -0,0 +1,47 @@
|
||||
- name: backup stuff
|
||||
hosts: all
|
||||
vars:
|
||||
backup_directory: /var/backups/{{ ansible_date_time.date }}
|
||||
pre_tasks:
|
||||
|
||||
- name: create backup directory
|
||||
become: true
|
||||
file:
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0770'
|
||||
path: "{{ backup_directory }}"
|
||||
|
||||
- name: "let {{ ansible_user_id }} write to backup directory"
|
||||
register: setfacl
|
||||
failed_when:
|
||||
- setfacl.rc != 140
|
||||
- setfacl.rc != 0
|
||||
changed_when: setfacl.rc != 140
|
||||
become: true
|
||||
shell: |
|
||||
if { getfacl -tn {{ backup_directory }} | tr -d ' ' | grep -Fq 'user{{ansible_user_uid}}rwxrwx' ; }; then
|
||||
exit 140
|
||||
fi
|
||||
setfacl -dRmu:{{ ansible_user_id }}:rwX {{ backup_directory }}
|
||||
setfacl -mu:{{ ansible_user_id }}:rwX {{ backup_directory }}
|
||||
|
||||
- name: structure the backup directory
|
||||
file:
|
||||
state: directory
|
||||
path: "{{ backup_directory }}/{{ item }}"
|
||||
with_items:
|
||||
- disks
|
||||
- "system-{{ ansible_hostname }}/users"
|
||||
|
||||
roles:
|
||||
- storefacts
|
||||
- disks
|
||||
|
||||
tasks:
|
||||
- name: turn it into an archive
|
||||
community.general.archive:
|
||||
path: "{{ backup_directory }}"
|
||||
dest: "{{ backup_directory | dirname }}/{{ backup_directory | basename }}.tar"
|
||||
format: tar
|
||||
@@ -0,0 +1,4 @@
|
||||
setup:
|
||||
ansible all -a 'ansible-galaxy collection install community.general'
|
||||
play:
|
||||
ansible-playbook desktop-playbook.yml -v
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
VAGRANTFILE_API_VERSION = "2"
|
||||
|
||||
Vagrant.configure(VAGRANTFILE_API_VERSION) do | config |
|
||||
config.vm.box = "fedora/41-cloud-base"
|
||||
config.vm.provider :libvirt do | v |
|
||||
end
|
||||
config.ssh.insert_key = false
|
||||
config.vm.define "desktop" do | client |
|
||||
client.vm.hostname = "desktop"
|
||||
# client.vm.network :private_network, ip: "192.168.122.132"
|
||||
end
|
||||
end
|
||||
@@ -0,0 +1,3 @@
|
||||
[defaults]
|
||||
inventory = ./hosts.ini
|
||||
vault_password_file = ./secrets-client
|
||||
@@ -0,0 +1,368 @@
|
||||
---
|
||||
|
||||
- hosts: all
|
||||
name: setup desktop
|
||||
vars_files:
|
||||
- secrets
|
||||
tasks:
|
||||
- name: remove fedora fluff
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
allowerasing: true
|
||||
autoremove: true
|
||||
name:
|
||||
- anaconda-core
|
||||
- anaconda-live
|
||||
- anaconda-install-env-deps
|
||||
- cockpit-system
|
||||
- python3-botocore
|
||||
- firefox
|
||||
- nodejs
|
||||
state: absent
|
||||
- name: install core components
|
||||
become: true
|
||||
dnf:
|
||||
state: present
|
||||
name:
|
||||
- git
|
||||
- git-crypt
|
||||
- git-lfs
|
||||
- gnupg2
|
||||
- tmux
|
||||
- curl
|
||||
- acl
|
||||
- stow
|
||||
- make
|
||||
- just
|
||||
- zsh
|
||||
- neovim
|
||||
- nnn
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
- mosh
|
||||
- unzip
|
||||
- flatpak
|
||||
- name: install pup
|
||||
become: true
|
||||
unarchive:
|
||||
remote_src: yes
|
||||
creates: /usr/local/bin/pup
|
||||
dest: /usr/local/bin/
|
||||
src: https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0.4.0_linux_amd64.zip
|
||||
- name: install google-chrome dnf repository
|
||||
become: true
|
||||
copy:
|
||||
dest: /etc/yum.repos.d/google-chrome.repo
|
||||
content: |
|
||||
[google-chrome]
|
||||
name=google-chrome
|
||||
baseurl=https://dl.google.com/linux/chrome/rpm/stable/x86_64
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://dl.google.com/linux/linux_signing_key.pub
|
||||
- name: install tailscale dnf repository
|
||||
become: true
|
||||
copy:
|
||||
dest: /etc/yum.repos.d/tailscale.repo
|
||||
content: |
|
||||
[tailscale]
|
||||
name=Tailscale
|
||||
baseurl=https://pkgs.tailscale.com/stable/fedora/$basearch
|
||||
enabled=1
|
||||
type=rpm
|
||||
repo_gpgcheck=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://pkgs.tailscale.com/stable/fedora/repo.gpg
|
||||
- name: install dnf packages
|
||||
become: true
|
||||
dnf:
|
||||
state: present
|
||||
name:
|
||||
- aria2
|
||||
- bat
|
||||
- bc
|
||||
- btop
|
||||
- btrfs-progs
|
||||
- coreutils
|
||||
- moreutils
|
||||
- fcitx5-gtk4
|
||||
- file
|
||||
- gh
|
||||
- google-chrome-stable
|
||||
- gparted
|
||||
- jo
|
||||
- jq
|
||||
- jrnl
|
||||
- kitty
|
||||
- kitty-terminfo
|
||||
- lshw
|
||||
- mpv
|
||||
- ncdu
|
||||
- pandoc
|
||||
- podman
|
||||
- runc
|
||||
- pass
|
||||
- wtype
|
||||
- tailscale
|
||||
- rclone
|
||||
- rsync
|
||||
- seahorse
|
||||
- timew
|
||||
- toolbox
|
||||
- tree
|
||||
- fzf
|
||||
- socat
|
||||
- tree-sitter-cli
|
||||
- waybar
|
||||
- wkhtmltopdf
|
||||
- yq
|
||||
- ImageMagick
|
||||
- name: install flatpak applications
|
||||
become: true
|
||||
flatpak:
|
||||
state: present
|
||||
name:
|
||||
- https://valent.andyholmes.ca/valent.flatpakref
|
||||
- com.nextcloud.desktopclient.nextcloud
|
||||
- org.libreoffice.LibreOffice
|
||||
- org.mozilla.Thunderbird
|
||||
|
||||
- com.logseq.Logseq
|
||||
- com.github.xournalpp.xournalpp
|
||||
|
||||
- com.obsproject.Studio
|
||||
|
||||
- com.yubico.yubioath
|
||||
- com.github.tchx84.Flatseal
|
||||
|
||||
- org.gnome.Loupe
|
||||
- com.github.johnfactotum.Foliate
|
||||
- org.gnome.Papers
|
||||
- org.gnome.FileRoller
|
||||
- org.gnome.SimpleScan
|
||||
|
||||
- com.github.neithern.g4music
|
||||
- info.febvre.Komikku
|
||||
|
||||
- org.gimp.GIMP
|
||||
- net.scribus.Scribus
|
||||
- org.inkscape.Inkscape
|
||||
- org.darktable.Darktable
|
||||
- org.audacityteam.Audacity
|
||||
- name: create group myself
|
||||
become: true
|
||||
group:
|
||||
name: myself
|
||||
gid: 690
|
||||
system: true
|
||||
- name: create group rootlessmen
|
||||
become: true
|
||||
group:
|
||||
name: rootlessmen
|
||||
system: true
|
||||
- name: create users
|
||||
become: true
|
||||
with_items:
|
||||
- name: kevins
|
||||
uid: 6901
|
||||
groups: ["myself", "rootlessmen"]
|
||||
- name: kevinsamuel
|
||||
uid: 6902
|
||||
groups: myself
|
||||
- name: kevinnlsamuel
|
||||
uid: 6903
|
||||
groups: ["myself", "rootlessmen"]
|
||||
user:
|
||||
state: present
|
||||
name: "{{ item.name }}"
|
||||
uid: "{{ item.uid }}"
|
||||
groups: "{{ item.groups }}"
|
||||
skeleton: /dev/null
|
||||
append: true
|
||||
password: $1$aBLdYKQI$iB3ZfYF.QPCwVhgnkROUX.
|
||||
update_password: on_create
|
||||
shell: /bin/zsh
|
||||
|
||||
- name: use crun as podman engine
|
||||
become: true
|
||||
vars:
|
||||
file: /etc/containers/containers.conf
|
||||
block:
|
||||
- lineinfile:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
create: true
|
||||
path: "{{file}}"
|
||||
line: "[engine]"
|
||||
insertbefore: BOF
|
||||
- lineinfile:
|
||||
path: "{{file}}"
|
||||
line: 'runtime = "/usr/bin/runc"'
|
||||
search_string: 'runtime = '
|
||||
- name: create storage for rootlessmen
|
||||
become: true
|
||||
file:
|
||||
path: /var/lib/rootlessmen
|
||||
owner: root
|
||||
group: rootlessmen
|
||||
mode: "0770"
|
||||
state: directory
|
||||
- name: setup podman to use rootlessmen for storage
|
||||
become: true
|
||||
vars:
|
||||
file: /etc/containers/storage.conf
|
||||
block:
|
||||
- name: create container storage config
|
||||
lineinfile:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
create: true
|
||||
path: "{{file}}"
|
||||
line: "[storage]"
|
||||
insertbefore: BOF
|
||||
- name: setup storage config to use rootlessmen
|
||||
with_items:
|
||||
- line: 'driver_priority = ["btrfs", "overlay", "vfs"]'
|
||||
search_string: 'driver_priority = '
|
||||
- line: 'rootless_storage_path = "/var/lib/rootlessmen/$USER/storage"'
|
||||
search_string: 'rootless_storage_path = '
|
||||
lineinfile:
|
||||
path: "{{file}}"
|
||||
line: "{{item.line}}"
|
||||
search_string: "{{item.search_string}}"
|
||||
- name: set selinux fcontext for rootlessmen
|
||||
become: true
|
||||
with_items:
|
||||
- pathspec: /var/lib/rootlessmen/[^/]+/storage/artifacts(/.*)?
|
||||
type: container_ro_file_t
|
||||
- pathspec: /var/lib/rootlessmen/[^/]+/storage/volumes/[^/]*/.*
|
||||
type: container_file_t
|
||||
sefcontext:
|
||||
target: "{{item.pathspec}}"
|
||||
setype: "{{item.type}}"
|
||||
seuser: unconfined_u
|
||||
|
||||
- name: enable tpm-tss in dracut
|
||||
become: true
|
||||
lineinfile:
|
||||
path: /etc/dracut.conf.d/55-tpm.conf
|
||||
line: "add_dracutmodules+=' tpm2-tss '"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "1644"
|
||||
create: true
|
||||
state: present
|
||||
- name: tell PAM to unlock gnome-keyring in tty
|
||||
become: true
|
||||
with_items:
|
||||
- type: auth
|
||||
args: ""
|
||||
- type: session
|
||||
args: auto_start
|
||||
pamd:
|
||||
name: login
|
||||
state: before
|
||||
type: "{{item.type}}"
|
||||
control: include
|
||||
module_path: postlogin
|
||||
new_type: "-{{item.type}}"
|
||||
new_control: optional
|
||||
new_module_path: pam_gnome_keyring.so
|
||||
module_arguments: "{{item.args}}"
|
||||
|
||||
- name: create wifi networks
|
||||
become: true
|
||||
loop:
|
||||
- ssid: KEVINSAM_5
|
||||
zone: home
|
||||
- ssid: KEVINSAM
|
||||
zone: home
|
||||
- ssid: askKevin
|
||||
zone: work
|
||||
community.general.nmcli:
|
||||
state: present
|
||||
type: wifi
|
||||
zone: "{{ item.zone }}"
|
||||
conn_name: "{{ item.ssid }}"
|
||||
ssid: "{{ item.ssid }}"
|
||||
autoconnect: true
|
||||
wifi:
|
||||
hidden: true
|
||||
wifi_sec:
|
||||
key-mgmt: wpa-psk
|
||||
psk: "not really the key"
|
||||
|
||||
- name: create tailscale firewall zone
|
||||
become: true
|
||||
shell: |
|
||||
firewall-cmd --permanent --new-zone=tailscale
|
||||
firewall-cmd --permanent --zone=tailscale --add-interface=tailscale0
|
||||
firewall-cmd --permanent --zone=tailscale --add-forward
|
||||
firewall-cmd --permanent --zone=tailscale --set-target=ACCEPT
|
||||
firewall-cmd --reload
|
||||
|
||||
- name: other firewall rules
|
||||
become: true
|
||||
shell: |
|
||||
firewall-cmd --permanent --zone public --remove-service ssh
|
||||
firewall-cmd --permanent --zone public --add-service kdeconnect
|
||||
firewall-cmd --permanent --zone home --add-service=kdeconnect --add-service=mosh --add-service=ssh
|
||||
firewall-cmd --reload
|
||||
|
||||
- name: create /home/myself
|
||||
become: true
|
||||
file:
|
||||
state: directory
|
||||
path: /home/myself
|
||||
group: myself
|
||||
owner: kevins
|
||||
mode: '2770'
|
||||
- name: check if HOME.git is cloned
|
||||
become: true
|
||||
become_user: kevins
|
||||
register: home_repo
|
||||
stat:
|
||||
path: /home/myself/HOME.git/HEAD
|
||||
- name: "clone HOME.git"
|
||||
become: true
|
||||
become_user: kevins
|
||||
when: not home_repo.stat.exists
|
||||
shell: |
|
||||
mkdir -p /home/myself/HOME.git
|
||||
cd /home/myself/HOME.git
|
||||
git init --bare .
|
||||
git remote add \
|
||||
origin \
|
||||
-t stable \
|
||||
-m stable \
|
||||
https://{{PAT}}@github.com/kevinnlsamuel/HOME.git
|
||||
git fetch --set-upstream origin stable
|
||||
|
||||
- name: clone HOME to my selves
|
||||
vars:
|
||||
src: /home/myself/HOME.git
|
||||
dest: "/home/{{item}}/.local/state/HOME"
|
||||
with_items:
|
||||
- kevins
|
||||
- kevinsamuel
|
||||
- kevinnlsamuel
|
||||
become_user: "{{item}}"
|
||||
become: true
|
||||
failed_when:
|
||||
- result.rc != 140
|
||||
- result.rc != 0
|
||||
changed_when: "result.rc != 140"
|
||||
register: result
|
||||
shell: |
|
||||
mkdir -p "{{dest}}"
|
||||
cd "{{dest}}"
|
||||
if [ -f ".git/HEAD" ]; then exit 140 2>/dev/null; fi
|
||||
git init -b main
|
||||
git config --add safe.directory "{{src}}"
|
||||
git remote add myself "{{src}}"
|
||||
git pull myself main
|
||||
|
||||
# manually install:
|
||||
# - sieve
|
||||
@@ -0,0 +1,7 @@
|
||||
[all]
|
||||
; set to whatever the vm is
|
||||
172.35.1.142
|
||||
|
||||
[all:vars]
|
||||
ansible_user = admin
|
||||
ansible_ssh_private_key_file = ~/.ssh/keys/kevins.pub
|
||||
@@ -0,0 +1,2 @@
|
||||
collections:
|
||||
- name: community.general
|
||||
@@ -0,0 +1,27 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
38333432336134663937363161333833373365386635613338333761346662653566333439363132
|
||||
3437393431643233393133643133313963323134626465630a666565653234626630373837343933
|
||||
64633966303761333539633335393234396264616266323439303932623535396335663839323363
|
||||
3861643566303563610a333166363032636462353836303365333634643639353934386233353438
|
||||
31373664386332613637626663633030313232383435303966643835346536313737393030623038
|
||||
36616465653563366138633334343665363131313361343836383132346334306330636138666666
|
||||
35636631646431393130376232663665343736313466626235623032636462316438656238656463
|
||||
35396465643936613935646237373837373037333561393133633033303038373565386236336339
|
||||
36636666623835343662346461643735646237653236386132623334653734633431313735363765
|
||||
64323839663765326336336263323535373663323232323336386464623734373433353135393566
|
||||
30663130656336653832653862383464363261323831346632306539613139646632306133666132
|
||||
38363066666563383436316537626439313134363365326333623633383138346134356232646664
|
||||
31333834323138366635613933616363363131643330353166383234333236343833343432656163
|
||||
33663963333039303737386431396337636665633532373336383762363966343139346335353463
|
||||
33383632343630343134333062326138383562636666396336313530363939333965626130303332
|
||||
35306238663633613130616138613137393331343862666664613539346237616537376166303130
|
||||
62393633613666613235633736666361653764356161396532306135343162316262386136386538
|
||||
32353861633362323166616263656633346531336633323064336162323630343532323139366166
|
||||
64316130633436303230353133623036656337316232323538316562663663326438383736313261
|
||||
63633766326638363939346531643836616561366365326236393031643633633836353837613963
|
||||
35333532393435313435333935353935656631386264626535303265353732653832613935623238
|
||||
33643765633939343730636165313737393037343337653230313637306365303539636233643839
|
||||
35613463386439323965613763396535383730383431666437393338336562663035653461613035
|
||||
64346465313532373938383833343334666563333362643961626138653664623337383964383463
|
||||
64343031373534346161386134663933626335326337386634666133343533626662646136623134
|
||||
3536656133663039353436666339323437323162633139613632
|
||||
Executable
+4
@@ -0,0 +1,4 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
pass encryptions/com.kevinnlsamuel/playbooks/setup-workstations/secrets
|
||||
@@ -0,0 +1,35 @@
|
||||
#SPDX-License-Identifier: MIT-0
|
||||
galaxy_info:
|
||||
author: your name
|
||||
description: your role description
|
||||
company: your company (optional)
|
||||
|
||||
# If the issue tracker for your role is not on github, uncomment the
|
||||
# next line and provide a value
|
||||
# issue_tracker_url: http://example.com/issue/tracker
|
||||
|
||||
# Choose a valid license ID from https://spdx.org - some suggested licenses:
|
||||
# - BSD-3-Clause (default)
|
||||
# - MIT
|
||||
# - GPL-2.0-or-later
|
||||
# - GPL-3.0-only
|
||||
# - Apache-2.0
|
||||
# - CC-BY-4.0
|
||||
license: license (GPL-2.0-or-later, MIT, etc)
|
||||
|
||||
min_ansible_version: 2.1
|
||||
|
||||
# If this a Container Enabled role, provide the minimum Ansible Container version.
|
||||
# min_ansible_container_version:
|
||||
|
||||
galaxy_tags: []
|
||||
# List tags for your role here, one per line. A tag is a keyword that describes
|
||||
# and categorizes the role. Users find roles by searching for tags. Be sure to
|
||||
# remove the '[]' above, if you add tags to this list.
|
||||
#
|
||||
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
|
||||
# Maximum 20 tags per role.
|
||||
|
||||
dependencies: []
|
||||
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
|
||||
# if you add dependencies to this list.
|
||||
@@ -0,0 +1,48 @@
|
||||
- name: get list of disks
|
||||
changed_when: false
|
||||
shell: >
|
||||
lsblk
|
||||
--json
|
||||
--paths
|
||||
--filter 'MIN == 0 && TYPE == "disk" && MOUNTPOINT != "[SWAP]"'
|
||||
| jq '.blockdevices'
|
||||
register: disks
|
||||
|
||||
- name: backup partition tables
|
||||
become: true
|
||||
shell: |
|
||||
if [ {{ item.type }} != disk ]; then exit 0; fi
|
||||
sfdisk --dump {{ item.name }} >{{ backup_directory }}/disks/{{ item.name | basename }}.sfdisk
|
||||
loop: "{{ disks.stdout }}"
|
||||
|
||||
- name: get list of luks devices
|
||||
changed_when: false
|
||||
shell: >
|
||||
lsblk
|
||||
--json
|
||||
--paths
|
||||
| jq '[ .blockdevices[]|.children[]?|select(recurse(.children[]?)|.type == "crypt") ]'
|
||||
register: cryptdisks
|
||||
|
||||
- name: backup luks2 headers
|
||||
become: true
|
||||
loop: "{{ cryptdisks.stdout }}"
|
||||
shell: |
|
||||
rm -f {{ backup_directory }}/disks/{{ item.children[0].name | basename }}.luks2header
|
||||
cryptsetup luksHeaderBackup {{ item.name }} \
|
||||
--header-backup-file {{ backup_directory }}/disks/{{ item.children[0].name | basename }}.luks2header
|
||||
|
||||
- name: backup lvm volume groups
|
||||
become: true
|
||||
shell: |
|
||||
if [ ! -d /etc/lvm/backup ]; then exit 0; fi
|
||||
for vg in /etc/lvm/backup/*; do
|
||||
cp $vg {{backup_directory}}/disks/${vg##*/}.volumegroup
|
||||
done
|
||||
|
||||
# get list of disks
|
||||
# run sfdisk on it
|
||||
# get list of partitions with luks2
|
||||
# # backup their headers
|
||||
# get list of partitions with lvm2
|
||||
# # copy the metadata
|
||||
@@ -0,0 +1,6 @@
|
||||
galaxy_info:
|
||||
author: kevinnlsamuel
|
||||
description: sayin hello
|
||||
dependencies:
|
||||
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
|
||||
# if you add dependencies to this list.
|
||||
@@ -0,0 +1,6 @@
|
||||
- name: register greeting
|
||||
command: echo hello
|
||||
register: greeting
|
||||
- name: say greeting
|
||||
debug:
|
||||
msg: "{{ greeting.stdout }}"
|
||||
@@ -0,0 +1,4 @@
|
||||
- name: store facts
|
||||
template:
|
||||
src: facts.jinja2
|
||||
dest: "{{ backup_directory }}/ansible_facts.json"
|
||||
@@ -0,0 +1 @@
|
||||
{{ ansible_facts | to_nice_json }}
|
||||
Reference in New Issue
Block a user