diff options
Diffstat (limited to 'rpi-base/tasks')
| -rw-r--r-- | rpi-base/tasks/main.yaml | 17 | ||||
| -rw-r--r-- | rpi-base/tasks/netplan.yaml | 25 |
2 files changed, 36 insertions, 6 deletions
diff --git a/rpi-base/tasks/main.yaml b/rpi-base/tasks/main.yaml index 2a94df5..b7168e3 100644 --- a/rpi-base/tasks/main.yaml +++ b/rpi-base/tasks/main.yaml @@ -13,9 +13,8 @@ become: yes timezone: name="{{rpi_base_timezone}}" -- name: setup wifi - become: yes - template: src="wpa_supplicant.conf.j2" dest="/etc/wpa_supplicant/wpa_supplicant.conf" mode="0600" +- include_tasks: netplan.yaml + when: ansible_distribution == "Ubuntu" - name: update apt package cache become: yes @@ -25,9 +24,12 @@ become: yes apt: name="{{rpi_base_apt_packages}}" state="latest" +# Periodic switches plus local policy in one file; the stock +# 50unattended-upgrades (security-only, no reboot) stays pristine and the +# debconf-owned 20auto-upgrades is left alone (52 sorts later and wins). - name: configure auto upgrades become: yes - copy: src="20auto-upgrades" dest="/etc/apt/apt.conf.d/20auto-upgrades" + copy: src="52unattended-upgrades-local" dest="/etc/apt/apt.conf.d/52unattended-upgrades-local" - name: configure logrotate become: yes @@ -69,9 +71,12 @@ append: yes no_log: true -- name: authorize ssh keys +- name: authorize ssh key become: yes - authorized_key: user="{{item}}" key="https://github.com/{{github_user}}.keys" + authorized_key: + user: "{{item}}" + key: "{{ lookup('file', rpi_base_ssh_public_key_file) }}" + exclusive: yes loop: - "{{admin_user_name}}" - "{{ansible_user}}" diff --git a/rpi-base/tasks/netplan.yaml b/rpi-base/tasks/netplan.yaml new file mode 100644 index 0000000..eda0e69 --- /dev/null +++ b/rpi-base/tasks/netplan.yaml @@ -0,0 +1,25 @@ +--- + +# One role-owned netplan file replaces cloud-init's render: eth0 always, +# wifi when enabled. cloud-init only re-renders on a new instance_id, so +# the deletion below sticks across reboots. +# +# RESCUE a dark pi: on the card's FAT partition, edit network-config (a +# phone hotspot entry works) and bump instance_id in meta-data, then +# boot. The re-rendered 50-cloud-init.yaml sorts after 40-net.yaml and +# overrides it; the next playbook run deletes it again. +- name: install netplan config + become: yes + template: src="40-net.yaml.j2" dest="/etc/netplan/40-net.yaml" mode="0600" + notify: apply netplan + +- name: remove the cloud-init netplan config + become: yes + file: path="/etc/netplan/50-cloud-init.yaml" state="absent" + notify: apply netplan + +# A rescue instance_id bump re-runs cloud-init's ssh module, which by +# default deletes and regenerates the host keys; keep them. +- name: keep ssh host keys on cloud-init re-runs + become: yes + copy: src="10-rpi-base.cfg" dest="/etc/cloud/cloud.cfg.d/10-rpi-base.cfg" |