update rocky9 from gigacoms
This commit is contained in:
a.kazantsev
parent
07af146990
commit
29dcdc660d
6 changed files with 176 additions and 79 deletions
|
|
@ -1,8 +1,8 @@
|
|||
---
|
||||
hostname: centos01.local.mrwho.ru
|
||||
ip4_addr: 172.20.21.101/24
|
||||
ip4_gate: 172.20.21.1
|
||||
ip4_dns:
|
||||
- 172.20.21.1
|
||||
- 192.168.1.1
|
||||
reboot_system: false
|
||||
|
||||
epel_repo_url: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_facts.distribution_major_version }}.noarch.rpm"
|
||||
epel_repo_gpg_key_url: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-{{ ansible_facts.distribution_major_version }}"
|
||||
epel_repofile_path: "/etc/yum.repos.d/epel.repo"
|
||||
epel_repo_disable: false
|
||||
sysctl_tune: true
|
||||
logrotate_interval: 14
|
||||
|
|
|
|||
|
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
- name: "Reboot Server"
|
||||
ansible.builtin.reboot:
|
||||
msg: "Rebooting due to kernel updates"
|
||||
reboot_timeout: 60
|
||||
|
|
@ -1,24 +1,36 @@
|
|||
---
|
||||
# - name: Add Nginx Repo
|
||||
# template:
|
||||
# src: nginx.repo.j2
|
||||
# dest: /etc/yum.repos.d/nginx.repo
|
||||
# owner: root
|
||||
# group: root
|
||||
# - name: Enable fastestmirror in DNF
|
||||
# community.general.ini_file:
|
||||
# path: /etc/dnf/dnf.conf
|
||||
# section: main
|
||||
# option: fastestmirror
|
||||
# value: "True"
|
||||
# state: present
|
||||
|
||||
# - name: Install EPEL repo
|
||||
# dnf:
|
||||
# name:
|
||||
# - epel-release
|
||||
# state: latest
|
||||
- name: Enable parallel downloads in DNF
|
||||
community.general.ini_file:
|
||||
path: /etc/dnf/dnf.conf
|
||||
section: main
|
||||
option: max_parallel_downloads
|
||||
value: "10"
|
||||
state: present
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
backup: true
|
||||
|
||||
- name: Upgrade all packages
|
||||
ansible.builtin.dnf: # noqa: package-latest
|
||||
name: "*"
|
||||
state: latest
|
||||
# - name: Ensure the crb repository is enabled
|
||||
# community.general.dnf_config_manager:
|
||||
# name: crb
|
||||
# state: enabled
|
||||
# when: crb_repo is true
|
||||
|
||||
- name: Install EPEL repo
|
||||
ansible.builtin.include_tasks: install-epel-repo.yml
|
||||
when: epel_repo is true
|
||||
|
||||
- name: Install soft
|
||||
ansible.builtin.dnf: # noqa: package-latest
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- net-tools
|
||||
- mc
|
||||
|
|
@ -27,13 +39,11 @@
|
|||
- sudo
|
||||
- traceroute
|
||||
- tcpdump
|
||||
# - screen
|
||||
- whois
|
||||
- telnet
|
||||
- sed
|
||||
- tar
|
||||
- unzip
|
||||
# - unrar
|
||||
- gzip
|
||||
- rsync
|
||||
- sysstat
|
||||
|
|
@ -53,14 +63,28 @@
|
|||
- numactl
|
||||
- lsof
|
||||
- nano
|
||||
# - htop
|
||||
# - btop
|
||||
- bind-utils
|
||||
- psmisc
|
||||
# - speedtest-cli
|
||||
- python-pip
|
||||
# - python-pip
|
||||
- open-vm-tools
|
||||
- qemu-guest-agent
|
||||
# - deltarpm
|
||||
- cloud-utils-growpart
|
||||
- iptraf-ng
|
||||
# - speedtest-cli
|
||||
# - deltarpm
|
||||
# - screen
|
||||
# - unrar
|
||||
# - htop
|
||||
# - btop
|
||||
state: present
|
||||
|
||||
state: latest
|
||||
# - name: Обновить всё
|
||||
# become: true
|
||||
# ansible.builtin.dnf:
|
||||
# name: "*"
|
||||
# state: latest
|
||||
|
||||
- name: Удалить старые ядра и ненужные зависимости
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
autoremove: true
|
||||
|
|
|
|||
|
|
@ -2,8 +2,9 @@
|
|||
- name: Set a hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ hostname }}"
|
||||
when: hostname is defined
|
||||
|
||||
- name: Set Prompt
|
||||
- name: Set Prompt coloring
|
||||
ansible.builtin.template:
|
||||
src: prompt.sh.j2
|
||||
dest: /etc/profile.d/prompt.sh
|
||||
|
|
@ -11,31 +12,66 @@
|
|||
group: root
|
||||
mode: "0644"
|
||||
|
||||
# - name: Create users
|
||||
# ansible.builtin.include_tasks:
|
||||
# file: create_users.yml
|
||||
- name: Добавить строку в файл, если её нет
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/vconsole.conf
|
||||
regexp: '^FONT\s*='
|
||||
line: 'FONT="UniCyr_8x16"'
|
||||
create: true
|
||||
|
||||
- name: Syctl tuning
|
||||
ansible.builtin.include_tasks:
|
||||
file: sysctl_tuning.yml
|
||||
ansible.builtin.include_tasks: sysctl_tuning.yml
|
||||
when: sysctl_tune is true
|
||||
|
||||
|
||||
############# DEPRICATED ###################
|
||||
# - name: Setup NIC to eth0
|
||||
# ansible.builtin.include_tasks:
|
||||
# file: set_network_nic.yml
|
||||
|
||||
- name: Setup NIC to eth0
|
||||
ansible.builtin.include_tasks:
|
||||
file: set_nic_names_eth.yml
|
||||
#
|
||||
# - name: Setup NIC to eth0
|
||||
# ansible.builtin.include_tasks:
|
||||
# file: set_nic_names_eth.yml
|
||||
############################################
|
||||
|
||||
- name: Install packages
|
||||
ansible.builtin.include_tasks:
|
||||
file: install_packages.yml
|
||||
|
||||
- name: Setup secutity options
|
||||
- name: Disable SELinux
|
||||
ansible.builtin.include_tasks:
|
||||
file: security_setup.yml
|
||||
|
||||
- name: Logrotate
|
||||
ansible.builtin.include_tasks:
|
||||
file: logrotate.yml
|
||||
|
||||
- name: Check if Cloud-Init present
|
||||
ansible.builtin.stat:
|
||||
path: /etc/cloud
|
||||
register: cloudinit_status
|
||||
|
||||
- name: Disable cloud-init
|
||||
ansible.builtin.file:
|
||||
path: /etc/cloud/cloud-init.disabled
|
||||
state: touch
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
when: cloudinit_status.stat.exists
|
||||
|
||||
- name: Migrate legacy network scripts to NetworkManager keyfiles
|
||||
ansible.builtin.command:
|
||||
cmd: nmcli connection migrate
|
||||
become: true
|
||||
register: migration_result
|
||||
changed_when: "'successfully migrated' in migration_result.stdout"
|
||||
|
||||
- name: Reboot System
|
||||
ansible.builtin.reboot:
|
||||
reboot_timeout: 60
|
||||
ansible.builtin.debug:
|
||||
msg:
|
||||
- "Going to reboot..."
|
||||
- "System: {{ ansible_distribution }}"
|
||||
- "Version: {{ ansible_distribution_version }}"
|
||||
notify: "Reboot Server"
|
||||
when: reboot_system is true
|
||||
|
|
|
|||
|
|
@ -1,13 +1,19 @@
|
|||
---
|
||||
- name: Установка зависимостей SELinux
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
name: "{{ (ansible_facts['distribution_major_version'] | int >= 8) | ternary('python3-libselinux', 'libselinux-python') }}"
|
||||
state: present
|
||||
|
||||
- name: Disable SELinux
|
||||
ansible.posix.selinux:
|
||||
state: disabled
|
||||
|
||||
- name: Explicitly specifying positional matched groups in replacement
|
||||
ansible.builtin.replace:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: ^(ListenAddress[ ]+)[^\n]+$
|
||||
replace: \g<1>0.0.0.0
|
||||
# - name: Explicitly specifying positional matched groups in replacement
|
||||
# ansible.builtin.replace:
|
||||
# path: /etc/ssh/sshd_config
|
||||
# regexp: ^(ListenAddress[ ]+)[^\n]+$
|
||||
# replace: \g<1>0.0.0.0
|
||||
|
||||
# - name: Disable Root Login
|
||||
# template:
|
||||
|
|
|
|||
|
|
@ -1,36 +1,62 @@
|
|||
---
|
||||
- name: Deploy kernel_tune.conf
|
||||
ansible.builtin.template:
|
||||
src: kernel_tune.conf.j2
|
||||
dest: /etc/sysctl.d/kernel_tune.conf
|
||||
mode: "0644"
|
||||
- name: Find all files in /etc/sysctl.d
|
||||
ansible.builtin.find:
|
||||
paths: /etc/sysctl.d
|
||||
recurse: true
|
||||
file_type: any
|
||||
register: files_to_delete
|
||||
|
||||
- name: Deploy tcp_tune.conf
|
||||
ansible.builtin.template:
|
||||
src: tcp_tune.conf.j2
|
||||
dest: /etc/sysctl.d/tcp_tune.conf
|
||||
mode: "0644"
|
||||
- name: Remove all files from /etc/sysctl.d
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
state: absent
|
||||
loop: "{{ files_to_delete.files }}"
|
||||
when: flush_sysctl_rules is true
|
||||
|
||||
- name: Deploy ip_spoofing.conf
|
||||
ansible.builtin.template:
|
||||
src: ip_spoofing.conf.j2
|
||||
dest: /etc/sysctl.d/ip_spoofing.conf
|
||||
mode: "0644"
|
||||
- name: Disable Default sysctl.d
|
||||
ansible.builtin.file:
|
||||
path: /etc/sysctl.d/50-redhat.conf
|
||||
state: touch
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Deploy ip_forward.conf
|
||||
ansible.builtin.template:
|
||||
src: ip_forward.conf.j2
|
||||
dest: /etc/sysctl.d/ip_forward.conf
|
||||
mode: "0644"
|
||||
- name: Disable Default sysctl.d
|
||||
ansible.builtin.file:
|
||||
path: /etc/sysctl.d/50-default.conf
|
||||
state: touch
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Deploy ip_bridge.conf
|
||||
ansible.builtin.template:
|
||||
src: ip_bridge.conf.j2
|
||||
dest: /etc/sysctl.d/ip_bridge.conf
|
||||
mode: "0644"
|
||||
- name: Kernel Tuning
|
||||
ansible.builtin.include_tasks: kernel_tune.yml
|
||||
|
||||
- name: Deploy httpd-tune.conf
|
||||
ansible.builtin.template:
|
||||
src: httpd-tune.conf.j2
|
||||
dest: /etc/sysctl.d/httpd-tune.conf
|
||||
mode: "0644"
|
||||
- name: TCP/UDP Tuning
|
||||
ansible.builtin.include_tasks: tcp_tune.yml
|
||||
|
||||
- name: IP Forwarding
|
||||
ansible.builtin.include_tasks: ip_forward.yml
|
||||
|
||||
- name: Проверить, загружен ли модуль br_netfilter
|
||||
ansible.builtin.stat:
|
||||
path: /sys/module/br_netfilter
|
||||
register: br_netfilter_status
|
||||
|
||||
- name: IP Bridge
|
||||
ansible.builtin.include_tasks: ip_bridge.yml
|
||||
when: br_netfilter_status.stat.exists
|
||||
|
||||
# Закоментировано, тк в некоторых случаях вызывает невозможность выделения памяти
|
||||
# - name: Set vm.overcommit_ratio
|
||||
# ansible.posix.sysctl:
|
||||
# name: vm.overcommit_ratio
|
||||
# value: 100
|
||||
# state: present
|
||||
# sysctl_file: /etc/sysctl.d/04-ip_httpd.conf
|
||||
# - name: Set vm.overcommit_memory
|
||||
# ansible.posix.sysctl:
|
||||
# name: vm.overcommit_memory
|
||||
# value: 2
|
||||
# state: present
|
||||
# sysctl_file: /etc/sysctl.d/04-ip_httpd.conf
|
||||
|
|
|
|||
Loading…
Reference in a new issue