update rocky9 from gigacoms

roles/rocky9/defaults/main.yml

@@ -1,8 +1,8 @@
 ---
-hostname: centos01.local.mrwho.ru
+
-ip4_addr: 172.20.21.101/24
+epel_repo_url: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_facts.distribution_major_version }}.noarch.rpm"
-ip4_gate: 172.20.21.1
+epel_repo_gpg_key_url: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-{{ ansible_facts.distribution_major_version }}"
-ip4_dns:
+epel_repofile_path: "/etc/yum.repos.d/epel.repo"
-  - 172.20.21.1
+epel_repo_disable: false
-  - 192.168.1.1
+sysctl_tune: true
-reboot_system: false
+logrotate_interval: 14

roles/rocky9/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: "Reboot Server"
+  ansible.builtin.reboot:
+    msg: "Rebooting due to kernel updates"
+    reboot_timeout: 60

roles/rocky9/tasks/install_packages.yml

@@ -1,24 +1,36 @@
 ---
-# - name: Add Nginx Repo
+# - name: Enable fastestmirror in DNF
-#   template:
+#  community.general.ini_file:
-#     src: nginx.repo.j2
+#    path: /etc/dnf/dnf.conf
-#     dest: /etc/yum.repos.d/nginx.repo
+#    section: main
-#     owner: root
+#    option: fastestmirror
-#     group: root
+#   value: "True"
+#    state: present
 
-# - name: Install EPEL repo
+- name: Enable parallel downloads in DNF
-#   dnf:
+  community.general.ini_file:
-#     name:
+    path: /etc/dnf/dnf.conf
-#       - epel-release
+    section: main
-#     state: latest
+    option: max_parallel_downloads
+    value: "10"
+    state: present
+    owner: root
+    group: root
+    mode: '0644'
+    backup: true
 
-- name: Upgrade all packages
+# - name: Ensure the crb repository is enabled
-  ansible.builtin.dnf: # noqa: package-latest
+#  community.general.dnf_config_manager:
-    name: "*"
+#    name: crb
-    state: latest
+#    state: enabled
+#  when: crb_repo is true
+
+- name: Install EPEL repo
+  ansible.builtin.include_tasks: install-epel-repo.yml
+  when: epel_repo is true
 
 - name: Install soft
-  ansible.builtin.dnf: # noqa: package-latest
+  ansible.builtin.dnf:
     name:
       - net-tools
       - mc
@@ -27,13 +39,11 @@
       - sudo
       - traceroute
       - tcpdump
-      #      - screen
       - whois
       - telnet
       - sed
       - tar
       - unzip
-      #      - unrar
       - gzip
       - rsync
       - sysstat
@@ -53,14 +63,28 @@
       - numactl
       - lsof
       - nano
-      #      - htop
-      #      - btop
       - bind-utils
       - psmisc
-      #      - speedtest-cli
+#      - python-pip
-      - python-pip
       - open-vm-tools
       - qemu-guest-agent
-      # - deltarpm
+      - cloud-utils-growpart
+      - iptraf-ng
+#      - speedtest-cli
+#      - deltarpm
+#      - screen
+#      - unrar
+#      - htop
+#      - btop
+    state: present
 
-    state: latest
+# - name: Обновить всё
+#  become: true
+#  ansible.builtin.dnf:
+#    name: "*"
+#    state: latest
+
+- name: Удалить старые ядра и ненужные зависимости
+  become: true
+  ansible.builtin.dnf:
+    autoremove: true

roles/rocky9/tasks/main.yml

@@ -2,8 +2,9 @@
 - name: Set a hostname
   ansible.builtin.hostname:
     name: "{{ hostname }}"
+  when: hostname is defined
 
-- name: Set Prompt
+- name: Set Prompt coloring
   ansible.builtin.template:
     src: prompt.sh.j2
     dest: /etc/profile.d/prompt.sh
@@ -11,31 +12,66 @@
     group: root
     mode: "0644"
 
-# - name: Create users
+- name: Добавить строку в файл, если её нет
-#   ansible.builtin.include_tasks:
+  ansible.builtin.lineinfile:
-#     file: create_users.yml
+    path: /etc/vconsole.conf
+    regexp: '^FONT\s*='
+    line: 'FONT="UniCyr_8x16"'
+    create: true
 
 - name: Syctl tuning
-  ansible.builtin.include_tasks:
+  ansible.builtin.include_tasks: sysctl_tuning.yml
-    file: sysctl_tuning.yml
+  when: sysctl_tune is true
 
+
+############# DEPRICATED ###################
 # - name: Setup NIC to eth0
 #   ansible.builtin.include_tasks:
 #     file: set_network_nic.yml
-
+#
-- name: Setup NIC to eth0
+# - name: Setup NIC to eth0
-  ansible.builtin.include_tasks:
+#  ansible.builtin.include_tasks:
-    file: set_nic_names_eth.yml
+#    file: set_nic_names_eth.yml
+############################################
 
 - name: Install packages
   ansible.builtin.include_tasks:
     file: install_packages.yml
 
-- name: Setup secutity options
+- name: Disable SELinux
   ansible.builtin.include_tasks:
     file: security_setup.yml
 
+- name: Logrotate
+  ansible.builtin.include_tasks: 
+    file: logrotate.yml
+
+- name: Check if Cloud-Init present
+  ansible.builtin.stat:
+    path: /etc/cloud
+  register: cloudinit_status
+
+- name: Disable cloud-init
+  ansible.builtin.file:
+    path: /etc/cloud/cloud-init.disabled
+    state: touch
+    owner: root
+    group: root
+    mode: '0644'
+  when: cloudinit_status.stat.exists
+
+- name: Migrate legacy network scripts to NetworkManager keyfiles
+  ansible.builtin.command:
+    cmd: nmcli connection migrate
+  become: true
+  register: migration_result
+  changed_when: "'successfully migrated' in migration_result.stdout"
+
 - name: Reboot System
-  ansible.builtin.reboot:
+  ansible.builtin.debug:
-    reboot_timeout: 60
+    msg:
+      - "Going to reboot..."
+      - "System: {{ ansible_distribution }}"
+      - "Version: {{ ansible_distribution_version }}"
+  notify: "Reboot Server"
   when: reboot_system is true

roles/rocky9/tasks/security_setup.yml

@@ -1,13 +1,19 @@
 ---
+- name: Установка зависимостей SELinux
+  become: true
+  ansible.builtin.package:
+    name: "{{ (ansible_facts['distribution_major_version'] | int >= 8) | ternary('python3-libselinux', 'libselinux-python') }}"
+    state: present
+
 - name: Disable SELinux
   ansible.posix.selinux:
     state: disabled
 
-- name: Explicitly specifying positional matched groups in replacement
+# - name: Explicitly specifying positional matched groups in replacement
-  ansible.builtin.replace:
+#  ansible.builtin.replace:
-    path: /etc/ssh/sshd_config
+#    path: /etc/ssh/sshd_config
-    regexp: ^(ListenAddress[ ]+)[^\n]+$
+#    regexp: ^(ListenAddress[ ]+)[^\n]+$
-    replace: \g<1>0.0.0.0
+#    replace: \g<1>0.0.0.0
 
 # - name: Disable Root Login
 #   template:

roles/rocky9/tasks/sysctl_tuning.yml

@@ -1,36 +1,62 @@
 ---
-- name: Deploy kernel_tune.conf
+- name: Find all files in /etc/sysctl.d
-  ansible.builtin.template:
+  ansible.builtin.find:
-    src: kernel_tune.conf.j2
+    paths: /etc/sysctl.d
-    dest: /etc/sysctl.d/kernel_tune.conf
+    recurse: true
-    mode: "0644"
+    file_type: any
+  register: files_to_delete
 
-- name: Deploy tcp_tune.conf
+- name: Remove all files from /etc/sysctl.d
-  ansible.builtin.template:
+  ansible.builtin.file:
-    src: tcp_tune.conf.j2
+    path: "{{ item.path }}"
-    dest: /etc/sysctl.d/tcp_tune.conf
+    state: absent
-    mode: "0644"
+  loop: "{{ files_to_delete.files }}"
+  when: flush_sysctl_rules is true
 
-- name: Deploy ip_spoofing.conf
+- name: Disable Default sysctl.d
-  ansible.builtin.template:
+  ansible.builtin.file:
-    src: ip_spoofing.conf.j2
+    path: /etc/sysctl.d/50-redhat.conf
-    dest: /etc/sysctl.d/ip_spoofing.conf
+    state: touch
-    mode: "0644"
+    owner: root
+    group: root
+    mode: '0644'
 
-- name: Deploy ip_forward.conf
+- name: Disable Default sysctl.d
-  ansible.builtin.template:
+  ansible.builtin.file:
-    src: ip_forward.conf.j2
+    path: /etc/sysctl.d/50-default.conf
-    dest: /etc/sysctl.d/ip_forward.conf
+    state: touch
-    mode: "0644"
+    owner: root
+    group: root
+    mode: '0644'
 
-- name: Deploy ip_bridge.conf
+- name: Kernel Tuning
-  ansible.builtin.template:
+  ansible.builtin.include_tasks: kernel_tune.yml
-    src: ip_bridge.conf.j2
-    dest: /etc/sysctl.d/ip_bridge.conf
-    mode: "0644"
 
-- name: Deploy httpd-tune.conf
+- name: TCP/UDP Tuning
-  ansible.builtin.template:
+  ansible.builtin.include_tasks: tcp_tune.yml
-    src: httpd-tune.conf.j2
+
-    dest: /etc/sysctl.d/httpd-tune.conf
+- name: IP Forwarding
-    mode: "0644"
+  ansible.builtin.include_tasks: ip_forward.yml
+
+- name: Проверить, загружен ли модуль br_netfilter
+  ansible.builtin.stat:
+    path: /sys/module/br_netfilter
+  register: br_netfilter_status
+
+- name: IP Bridge
+  ansible.builtin.include_tasks: ip_bridge.yml
+  when: br_netfilter_status.stat.exists
+
+# Закоментировано, тк в некоторых случаях вызывает невозможность выделения памяти
+# - name: Set vm.overcommit_ratio
+#  ansible.posix.sysctl:
+#    name: vm.overcommit_ratio
+#    value: 100
+#    state: present
+#    sysctl_file: /etc/sysctl.d/04-ip_httpd.conf
+# - name: Set vm.overcommit_memory
+#  ansible.posix.sysctl:
+#    name: vm.overcommit_memory
+#    value: 2
+#    state: present
+#    sysctl_file: /etc/sysctl.d/04-ip_httpd.conf