blob: 087d96465b85634c4ee0b9fb6c2b4529d424952b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
---
- name: turn swap off
become: yes
command: "swapoff -a"
changed_when: false
- name: remove swap apt package
become: yes
apt: state="absent" name="dphys-swapfile"
- name: set timezone
become: yes
timezone: name="{{rpi_base_timezone}}"
- name: setup wifi
become: yes
template: src="wpa_supplicant.conf.j2" dest="/etc/wpa_supplicant/wpa_supplicant.conf" mode="0600"
- name: update apt package cache
become: yes
apt: update_cache="yes" cache_valid_time="3600"
- name: install extra apt packages
become: yes
apt: name="{{rpi_base_apt_packages}}" state="latest"
- name: configure auto upgrades
become: yes
copy: src="20auto-upgrades" dest="/etc/apt/apt.conf.d/20auto-upgrades"
- name: configure logrotate
become: yes
copy: src="logrotate.conf" dest="/etc/logrotate.conf"
- name: configure journald max size
become: yes
copy: src="journald.conf" dest="/etc/systemd/journald.conf"
notify: restart journald
- name: configure log2ram disk size
become: yes
lineinfile:
path: "/etc/log2ram.conf"
regexp: "^SIZE="
line: "SIZE={{rpi_base_log_size}}"
notify: restart log2ram service
- name: configure fail2ban
become: yes
copy: src="jail.local" dest="/etc/fail2ban/jail.local"
- name: add users
become: yes
user:
name: "{{admin_user_name}}"
password: "{{admin_user_password}}"
groups: "sudo,users"
shell: "/bin/bash"
append: yes
no_log: true
- name: authorize ssh keys
become: yes
authorized_key: user="{{item}}" key="https://github.com/{{github_user}}.keys"
loop:
- "{{admin_user_name}}"
- "{{ansible_user}}"
- name: nopasswd sudo for admin user
become: yes
template:
src: "010_admin-nopasswd"
dest: "/etc/sudoers.d/010_admin-nopasswd"
- name: disable ssh password login
become: yes
lineinfile:
path: "/etc/ssh/sshd_config"
regexp: "^PasswordAuthentication"
insertafter: "^#PasswordAuthentication"
line: "PasswordAuthentication no"
- name: ensure log2ram service is started
become: yes
systemd: name="log2ram.service" enabled="yes" state="started"
# Push the controller's terminal type to the host so ssh sessions work from
# niche terminals. Skipped when the controller has no terminfo entry for the
# current TERM (e.g. running ansible from emacs eshell, TERM=emacs).
- name: get local terminfo
command: infocmp
delegate_to: localhost
register: terminfo
changed_when: false
failed_when: false
- name: install local terminfo on host
become: yes
shell: "tic -x -"
args:
stdin: "{{terminfo.stdout}}"
changed_when: false
when: terminfo.rc == 0
|
