From 3735c11b9f0143d5d8c11c71b12551a8f8ef1335 Mon Sep 17 00:00:00 2001
From: mrwho <mrwho@mrwho.ru>
Date: Thu, 16 Jul 2026 21:33:07 +0300
Subject: [PATCH] feat(playbooks): add sysctl tuning and flush rules
 configuration

- Enable sysctl_tune to apply kernel parameter tuning
- Add flush_sysctl_rules to ensure rules are applied after changes
---
 inventory/template/group_vars/all/users.yml   | 33 +++++++++++++++++
 inventory/template/group_vars/all/vars.yml    | 37 +++++++++++++++++++
 inventory/template/group_vars/rocky9/vars.yml | 10 +++++
 inventory/template/hosts.yml                  | 10 +++++
 playbooks/rocky9.yml                          |  3 ++
 5 files changed, 93 insertions(+)
 create mode 100644 inventory/template/group_vars/all/users.yml
 create mode 100644 inventory/template/group_vars/all/vars.yml
 create mode 100644 inventory/template/group_vars/rocky9/vars.yml
 create mode 100644 inventory/template/hosts.yml

diff --git a/inventory/template/group_vars/all/users.yml b/inventory/template/group_vars/all/users.yml
new file mode 100644
index 0000000..b71aa44
--- /dev/null
+++ b/inventory/template/group_vars/all/users.yml
@@ -0,0 +1,33 @@
+---
+# ── Admin groups ───────────────────────────────────────────────────────────────
+# Add new users here. Each entry requires:
+#   username  — Linux username
+#   ssh_key   — public SSH key string (optional, but strongly recommended)
+#
+# To allow a group on a specific host/group, override `users_allowed_admin_groups`
+# in the corresponding group_vars/<group>/vars.yml or host_vars/<host>/vars.yml.
+
+users_admin_groups:
+  super_admin:
+    - username: mrwho
+      ssh_key: >-
+        ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAlQz8IhTEQ0utmWmwOC7FijieQULbeyXLDkjmYwSyptqj+7u0qyPPStQzN9leIISSKJ1/eJ5UbETTvc1R1Jg1tdTg5xZTMoz0jwruDP73vYIxLdeO4cZvjJIGyzS2PemUM+016uf4DLZ3jmK4hwEi2mF6UX+NYRPNIuPpr96gP1kYb1vrlG7P0cEk7EbGO6Deda3S64L0lDherSqc/Z7cn8nr6iemTdsBfl303vqFgXf/aWijuvVPUSpSiI3fR0NwvX/RW7oDIFls1dVU5CPkcwaX25Fu3voJ6e3lmduW+1s/vL1nMd5ourET+1Std3S75jqzkVsV3R74Xkgq5avn7w==
+
+  middle_admin: []
+    # Example:
+    # - username: m.ivanov
+    #   ssh_key: "ssh-rsa AAAA..."
+
+  junior_admin: []
+    # Example:
+    # - username: j.petrov
+    #   ssh_key: "ssh-rsa AAAA..."
+
+# ── Default access policy ──────────────────────────────────────────────────────
+# Which admin groups are provisioned on hosts by default.
+# Override in group_vars/<os_group>/vars.yml or host_vars/<host>/vars.yml
+# to restrict access on specific servers.
+users_allowed_admin_groups:
+  - super_admin
+  - middle_admin
+  - junior_admin
diff --git a/inventory/template/group_vars/all/vars.yml b/inventory/template/group_vars/all/vars.yml
new file mode 100644
index 0000000..9e95671
--- /dev/null
+++ b/inventory/template/group_vars/all/vars.yml
@@ -0,0 +1,37 @@
+---
+# ── SSH connection ─────────────────────────────────────────────────────────────
+# Credentials are injected from GitLab CI/CD Variables:
+#   ANSIBLE_SSH_USER        — remote user
+#   ANSIBLE_SSHKEY_ID_RSA   — private SSH key (записывается в ~/.ssh/id_rsa в before_script)
+#   ANSIBLE_BECOME_PASS     — sudo password
+ignored_interfaces: lo
+ansible_user:        "{{ lookup('env', 'ANSIBLE_SSH_USER') | mandatory }}"
+ansible_become:      true
+ansible_become_method: sudo
+ansible_become_pass: "{{ lookup('env', 'ANSIBLE_BECOME_PASS') | mandatory }}"
+
+ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
+
+# Zabbix agent default settings
+agent_major_version: "7.0"
+agent_variant: "2"
+agent_2_plugin_list: ['']
+agent_param_server:
+  - 10.203.0.50
+agent_param_serveractive:
+  - 10.203.0.50
+agent_param_tlsconnect: unencrypted
+agent_param_tlsaccept:
+  - unencrypted
+
+# Chrony NTP Client settings
+chrony_log_enable: true
+chrony_log: measurements statistics tracking
+chrony_logdir: /var/log/chrony/
+chrony_ntp_servers:
+  - router.local.mrwho.ru
+chrony_rtcsync: true
+chrony_timezone: Europe/Moscow
+# Firewalld defaults
+firewall_disable_conflicting_services: true
+firewall_transactional_update_reboot_ok: true
diff --git a/inventory/template/group_vars/rocky9/vars.yml b/inventory/template/group_vars/rocky9/vars.yml
new file mode 100644
index 0000000..fb6feb2
--- /dev/null
+++ b/inventory/template/group_vars/rocky9/vars.yml
@@ -0,0 +1,10 @@
+---
+# ── Rocky Linux 9 specifics ───────────────────────────────────────────────────
+ansible_python_interpreter: /usr/bin/python3
+
+# Группа для sudo-привилегий на RHEL-совместимых системах
+users_sudo_group: wheel
+
+# Переопределяем логику named-роли: RedHat.yml возвращает '2' для версий != 8,
+# на Rocky 9 нужен python3-netaddr / python3-dns
+named_python_version: "3"
diff --git a/inventory/template/hosts.yml b/inventory/template/hosts.yml
new file mode 100644
index 0000000..44f214e
--- /dev/null
+++ b/inventory/template/hosts.yml
@@ -0,0 +1,10 @@
+---
+all:
+  children:
+    centos:
+      hosts:
+#        router:
+#          ansible_host: 172.20.21.100
+
+        rocky9-template:
+          ansible_host: 172.20.21.106
\ No newline at end of file
diff --git a/playbooks/rocky9.yml b/playbooks/rocky9.yml
index 16f5b01..bfbf869 100644
--- a/playbooks/rocky9.yml
+++ b/playbooks/rocky9.yml
@@ -26,6 +26,9 @@
     epel_repo: true
     reboot_system: false
     hostname: "{{ inventory_hostname }}.local.mrwho.ru"
+    flush_sysctl_rules: true
+    sysctl_tune: true
+
     openssh_password_authentication: false
     openssh_permit_root_login: "no"  # Completely disable root SSH
     openssh_challenge_response_auth: false