diff options
79 files changed, 1886 insertions, 634 deletions
diff --git a/chaos-at-home/ch-hpws-maxi.yml b/chaos-at-home/ch-hpws-maxi.yml new file mode 100644 index 00000000..8d0e42a9 --- /dev/null +++ b/chaos-at-home/ch-hpws-maxi.yml @@ -0,0 +1,14 @@ +--- +- name: Basic Setup + hosts: ch-hpws-maxi + roles: + - role: apt-repo/base + - role: core/base + - role: core/sshd/base + - role: core/zsh + - role: core/ntp + - role: core/cpu-microcode + - role: apt-repo/obs-studio + - role: apt-repo/spreadspace + - role: ws/base + - role: core/admin-users diff --git a/chaos-at-home/ch-hpws-mini1.yml b/chaos-at-home/ch-hpws-mini1.yml new file mode 100644 index 00000000..70fe8192 --- /dev/null +++ b/chaos-at-home/ch-hpws-mini1.yml @@ -0,0 +1,14 @@ +--- +- name: Basic Setup + hosts: ch-hpws-mini1 + roles: + - role: apt-repo/base + - role: core/base + - role: core/sshd/base + - role: core/zsh + - role: core/ntp + - role: core/cpu-microcode + - role: apt-repo/obs-studio + - role: apt-repo/spreadspace + - role: ws/base + - role: core/admin-users diff --git a/common/iso-generate.yml b/common/iso-generate.yml index 504d91ae..78047e13 100644 --- a/common/iso-generate.yml +++ b/common/iso-generate.yml @@ -3,7 +3,9 @@ hosts: "{{ install_hostnames }}" connection: local gather_facts: no + vars: + installer_variant: debian roles: - - role: installer/debian/iso - installer_base_path: "{{ global_cache_dir }}/debian-installer" + - role: "installer/{{ installer_variant }}/iso" + installer_base_path: "{{ global_cache_dir }}/{{ installer_variant }}-installer" installer_keyrings_path: "{{ global_files_dir }}/common/keyrings" diff --git a/common/iso-install.yml b/common/iso-install.yml index ea132d4e..810761d2 100644 --- a/common/iso-install.yml +++ b/common/iso-install.yml @@ -1,26 +1,23 @@ --- -- name: preparations and sanity checks +- name: preparations, sanity checks and basic installation hosts: "{{ install_hostname }}" connection: local gather_facts: no + vars: + installer_variant: debian roles: - - role: installer/debian/iso - installer_base_path: "{{ global_cache_dir }}/debian-installer" + - role: "installer/{{ installer_variant }}/iso" + installer_base_path: "{{ global_cache_dir }}/{{ installer_variant }}-installer" installer_keyrings_path: "{{ global_files_dir }}/common/keyrings" post_tasks: - set_fact: iso_install_image_path: "{{ iso_install_target_dir }}/{{ install_hostname }}.iso" - -- name: basic installation - hosts: "{{ install_hostname }}" - gather_facts: no - tasks: - pause: prompt: | The generated image can be found at: - {{ iso_install_image_path }} + {{ iso_install_image_path | realpath }} Please load the image into the machine and boot from it. {% if install_distro == "debian" and install_cooked.efi is defined and install_cooked.efi %} @@ -33,6 +30,12 @@ {% endif %} Once the installation is done press ENTER to continue or CTRL-C then A to abort. + {% if installer_variant == 'ubuntu' %} + + Hint: You are using the ubuntu installer, this means the final system initialization and + cleanup is done by cloud-init on first boot. These steps need to be finished before the + playbook can continue. + {% endif %} - name: wait for new machine to start up, apply early roles and reboot diff --git a/common/usb-generate.yml b/common/usb-generate.yml index 30b0f190..7031839c 100644 --- a/common/usb-generate.yml +++ b/common/usb-generate.yml @@ -3,12 +3,13 @@ hosts: "{{ install_hostnames }}" connection: local gather_facts: no + vars: + installer_variant: debian vars_prompt: - name: usb_install_path - prompt: Where is the USB installation medium mounted to? + prompt: "Path to the the USB installation mountpoint or device" private: no - roles: - - role: installer/debian/usb - installer_base_path: "{{ global_cache_dir }}/debian-installer" + - role: "installer/{{ installer_variant }}/usb" + installer_base_path: "{{ global_cache_dir }}/{{ installer_variant }}-installer" installer_keyrings_path: "{{ global_files_dir }}/common/keyrings" diff --git a/common/usb-install.yml b/common/usb-install.yml index 81fe239a..a7bbe012 100644 --- a/common/usb-install.yml +++ b/common/usb-install.yml @@ -1,28 +1,30 @@ --- -- name: preparations and sanity checks +- name: preparations, sanity checks and basic installation hosts: "{{ install_hostname }}" connection: local gather_facts: no + vars: + installer_variant: debian vars_prompt: - name: usb_install_path - prompt: Where is the USB installation medium mounted to? + prompt: "Path to the the USB installation mountpoint or device" private: no - roles: - - role: installer/debian/usb - installer_base_path: "{{ global_cache_dir }}/debian-installer" + - role: "installer/{{ installer_variant }}/usb" + installer_base_path: "{{ global_cache_dir }}/{{ installer_variant }}-installer" installer_keyrings_path: "{{ global_files_dir }}/common/keyrings" - - -- name: basic installation - hosts: "{{ install_hostname }}" - gather_facts: no - tasks: + post_tasks: - pause: prompt: | Please unmount the USB the stick, plug it into the machine and boot from it. Once the installation is done press ENTER to continue or CTRL-C then A to abort. + {% if installer_variant == 'ubuntu' %} + + Hint: You are using the ubuntu installer, this means the final system initialization and + cleanup is done by cloud-init on first boot. These steps need to be finished before the + playbook can continue. + {% endif %} - name: wait for new machine to start up, apply early roles and reboot diff --git a/dan/ele-coturn.yml b/dan/ele-coturn.yml new file mode 100644 index 00000000..7e7edaa1 --- /dev/null +++ b/dan/ele-coturn.yml @@ -0,0 +1,15 @@ +--- +- name: Basic Setup + hosts: ele-coturn + roles: + - role: apt-repo/base + - role: core/base + - role: core/sshd/base + - role: core/zsh + - role: core/ntp + - role: kubernetes/base + - role: kubernetes/standalone/base + - role: apt-repo/spreadspace + - role: acmetool/base + - role: apps/coturn + - role: apps/mumble diff --git a/dan/ele-jitsi.yml b/dan/ele-jitsi.yml new file mode 100644 index 00000000..f5213032 --- /dev/null +++ b/dan/ele-jitsi.yml @@ -0,0 +1,15 @@ +--- +- name: Basic Setup + hosts: ele-jitsi + roles: + - role: apt-repo/base + - role: core/base + - role: core/sshd/base + - role: core/zsh + - role: core/ntp + - role: kubernetes/base + - role: kubernetes/standalone/base + - role: apt-repo/spreadspace + - role: acmetool/base + - role: nginx/base + - role: apps/jitsi/meet diff --git a/dan/group_vars/emc.yml b/dan/group_vars/emc.yml index a8c4004f..311fbe31 100644 --- a/dan/group_vars/emc.yml +++ b/dan/group_vars/emc.yml @@ -1,10 +1,10 @@ $ANSIBLE_VAULT;1.2;AES256;dan -62373236353033346534363864356138396637653435313339373964323334386465323634303863 -6132306331343566333838386530326332353037393637660a643534326336383665306230316237 -64633266336233306661663231333031663933373432353139323163373932323930393636373035 -6238346263333632660a646533653935633964326439386237303838613166383331393534383566 -36336662346632326663633734656435396339343264363733343434323061623438663662343866 -33643237623235356431303638323836633137383334363830623565396161623563623439663762 -35356135666465366463336564343730616633383863313833303830333464356234383339363334 -61613331663264356462396165663565303463333932363331386134663230363262393664346161 -6133 +38623432343430343233653166646531333662656531626437333834373837653562663538323934 +3063636231616330373135313364306635623561383530350a306366373065336530653939326134 +63663764666665663030326639303634663166316234346339313934653563386163386434383738 +3937306234656563660a373639613435303066366134303134633261363237626463666661643636 +34346662313338633236373035316539306166643038653266633234653862383639613965373738 +35663863326138396134656266666636636435323563616130623734646638623938303036306664 +64666131643238613565336431323466656532633332623439333232396133353331666636383062 +66316534613464373133663564333837303762663334396132386539613031326431356137663733 +3332 diff --git a/dan/host_vars/ele-coturn.yml b/dan/host_vars/ele-coturn.yml new file mode 100644 index 00000000..7574b0b4 --- /dev/null +++ b/dan/host_vars/ele-coturn.yml @@ -0,0 +1,18 @@ +$ANSIBLE_VAULT;1.2;AES256;dan +33643766613664653232346436333636376564396235303135336164383263616335656464363862 +6165653236323338323133316434636332396537666662320a333461656262333233313133626163 +64366339353039373061393532333036636439383637653535343036303033666261386636653638 +6162613361396234390a353966623732663633326663333531666131616336383463356234626363 +34633830323862343266656165306264303465343930653161383336626230653335326261646637 +64636637386666396232326435626630613865343864663361623637396264363433323065653864 +34343130376436396536623162623633623837396332363566323136336435306230306132333862 +33303936653530633738613662626163336132393834393438393662653363626137623466616430 +39656262633933346239663562336635653633353162316430313137366562323366613332323966 +37646635653931323335306537396538333431616538653435663335343064353966323666386636 +65303730623863623262626238363361333864333839393331663465643837643937653234626234 +65356430663832613338343737653335363531393133646236313730393165393132383739333962 +62333538363139663764316238636466343538666462386266616133346563373763313663616364 +35663536343064323234396662353035386239653532623739643237366139303737633436656438 +38323233646565323839326539343232313234383862313835363730616335303766656437343761 +64366338343661313530623664333935303762323363613731666330623238393966656431323538 +6635 diff --git a/dan/host_vars/ele-jitsi.yml b/dan/host_vars/ele-jitsi.yml new file mode 100644 index 00000000..a97ec42a --- /dev/null +++ b/dan/host_vars/ele-jitsi.yml @@ -0,0 +1,22 @@ +$ANSIBLE_VAULT;1.2;AES256;dan +65396235316532653335326234663533333566343234613963356665343735353438326336306661 +3232376265623734393135363137343565646366383766650a373063663439313266633066656361 +32646335633534643536316631353764393061366363353162613533643338393461633166346133 +3962313836326438340a343531356237396536346437383934393838353232303632303735353230 +33363361323833626366613666636262336363306664363861613434626163303862366234373739 +30333065316264396532306666353863653533313139663766393934346337656133393362343565 +33616637633832653639346431373634373830623266326339326364313136316639363335626361 +39633131653762316266326538616239663833303664333131363665366638313736343165616439 +64383336353032366331333233623939626463656261393834653563373464366165323664396463 +66376431633965643261656231346666613163306639636431616139616466643137313931613833 +66323862646362616433393862633634656330313766396564396461646530363062616333616231 +38643036663961316139376635613039306362303635306265376435633662353066393633643435 +37386136666130363363396438386166363161393832646439323137616236303861643231353433 +39386134626533383964623731383938636632616435663335346561303061633535313266313336 +62303637616631653663386236396664363164303032333133313330303164346464666135623065 +61313131616335663531343364306462633732633766333838666333646133653965393033636663 +39613462653262343461616233323939623432386136643633623162633462376630656265373032 +65626266356562393237303338646461393030386464393835613566356334393663323462303237 +61666331653838363233626165636230646361393662666337323932643032343434386139363664 +63356235646230343265613163353534316264303237373830393832333937616535313233666639 +34353034636562633532616231633463633132376463646631363939323830616133 diff --git a/dan/host_vars/sk-cloudio.yml b/dan/host_vars/sk-cloudio.yml index a3792ba0..9c25fff0 100644 --- a/dan/host_vars/sk-cloudio.yml +++ b/dan/host_vars/sk-cloudio.yml @@ -1,75 +1,75 @@ $ANSIBLE_VAULT;1.2;AES256;dan -33356331336333323935386132333263653562353535333436323532666535333730353430623536 -3565346438356365313562333739373534336430356532350a636530303331613761613763613964 -39363731316137356566333166626637613861636335353030393266323466643862343962366462 -6131613839386333390a663961346139383038393732366336613262356433366330616139303762 -32636263383631316432666234363163663863386339383037393262633337646264353137366532 -61383035313766336434343265376333623262643431653165363765306432313933316436373733 -34393262636231316339323931313661353837653462363062386364613133303461326332656636 -30366339636565323936383366373136613038656338303532363066643630303638303430616665 -66393835383438363839313164393630666335356639633134656561643539393933393532633437 -63313563633530623662666538643937353266306336656230363234393830623830626437623234 -64366462313635353536326638373234663362333564363737643631323061663437636538616662 -39626237336232306265373139343831343064303238636234336133653733343162373962373836 -62306438636661383238313766343638306166326332333964376435656465666166383564386130 -31633230343132636265623235363266336136653534666637383232373831616636633237393666 -36353939333031363937663236396530636131363765616565643739613832313966303064353664 -64653137393332306332663235333234623234316363383164306665643861616261356336313763 -39313938393065663136633431313132363134326338336464323763363035383164303936376337 -31643936353764353137626166623164616162393730353365353330313233336163356238623664 -37333665363832643961376432656637363037323064343138393938646461616463613033376535 -37316662616537633537303034313632633634363932336631383936653263663731626637373231 -37396363316264373262363766303631313938353961643131363163633135356262333039646237 -39343662306566343734336365613865633761383238346361663563616432633136336462653930 -37613233356638336531366633646133643738616237643334626266363339323232336466326163 -61666363353366316434393166616238376333373762656330316234386263313866346563343632 -38333330626332323934643561636437616663343239653466383938646433633336353938326163 -61656336616339313836646266623765396662333365393131653034393333653165643863323862 -33386634303363333339313330306336316132636230306364626337363639306239366265373538 -38353934623332323563633939633962663530646437643234326434626531366462396139653332 -30383766636335646464373963623235386337396565373362386633336539636630656361633664 -38346138343431633264326434323863666636346537656565663535303564306133396131343631 -64646538333231326534643830363335366566663761643866663436313763323265356162666233 -38626461633262393862663434396635616366316235656437633765353635346165666539303931 -64383532306365366266383561333230393462653738303466396138323665343132613361656530 -30313534323231336662333461656235333330613138393762393262316562616431326262643465 -65376635363537646562346639316537656639363439353363623034666233366136333263363166 -38336366636536393363353234376636363735643033353366363166303461353831636465626363 -31623133636534653035663937313333333334303065663232353731356461323139346235613763 -63646539363933643865613034396633653534363236306333613762383264336334313336376236 -32393661356562393339613232316137303335363062343933613635313439663762613535656435 -64613263363964386462306139616335663334636238636233303739333031363731313033643262 -30373462386662356632376238323964316234353766363732613134643661373233613239643534 -31343233623065376361373134623265383063616239666336326333663436363837653964393431 -30383630613636383965633334306338643665366633623539336633653564396135353832636537 -30376230306263343739666132396438633261323834346565633965353266613831366264353136 -64386231386266636130333430633735623731313336313032653130643561323336373635323930 -30373235393437306435306136316536623339666136306638376439356661386134383464613939 -65323139316130376239396234616534633332323630623763666131663965363636613535313033 -61663434343865383637633462613931343161623536623263356664373264353839323239376361 -64336631663962343831333466636234363231363263646138323334356464633230613332396539 -66653835653030313036326261333764326632386261343836363566313964643865336661643036 -64623963656434313164646333373337326565663931623966336332633038623561653665393863 -39646266633635356132343536303935616335323762376537343038323535386234316134643036 -38393531626136343766623037653161333331386161643966313236306133316563306439623236 -30626133636534636536393961623238616233393136343166633764336436333161626139616330 -62393132326232303732353135333934373663313534616563353361633337356635353766306537 -64636263373738343638623133663633396137633266353565633035376461346164373665383163 -38663133656565363862336162623435373863393165613838323133336239323337393335633932 -32323636356136633864653630386134376462643064376233383237646133613738633133356433 -31383139663965663864346637336633383531366161333833306539313736623132316530636139 -39653331336264363639323965313966623431306337383537366232313033353466316365666434 -32336563383031306165653361363235346165393761643066613034363663353666666464393131 -35333730656562613837353937393361653938323138633165373435316639356337633864303065 -38393135663536633736613762353939316565633865366539316537363461363039373164626437 -64353436303165353836313737313535646636346562373830666536353136326335383333656231 -39333761653534353964613865323264646531316539666633626632646133393233316261633838 -30353065663865613234396664613336373162656162346162306163343434323935336264333137 -64303934646436346232343564393834613237613663333866646134663730613263666432393035 -32663933353738303964396362326565613731303037633765353662366162306663653535396464 -31393863366238303832373533373736386465353761636561393463343635373565383736613632 -65313534653933613839356336336463333062663738333662333132613536303161306533396430 -30616366663662313434326534653738653366656164373362643662613834306163373033353831 -37393561343535353935306233643830383163386432306265663864303939353932613961353234 -36343765613565623465663436643066633937303763323363316364613430313938653337633234 -3762353332376532666361336135633739636436356532396362 +37636638346239383864616463363336656666623865663037653136353765323262343935666339 +6233653962663839386232616630306165336263346364610a386163346566633835643030663366 +39383230303564626233616466363932663237376531303034643738376232646364323464366330 +3133616136303130620a373265623638396162303632363133336164346332336561306530303837 +65623533656431303465633165656536353832303934626266303336396239323332623066373733 +37653164306633366164353135393935346633653065623136643461366565623035323262323939 +64366532616164333061386363633632663666613931656661656335653836633934633936636365 +66306633363164363537356134363962646133373036383563336330393766366261666234333033 +39326239303032383261356236363134613537306337313031623731396533363032303638366238 +36616230646562333265313536353635363164373166323462386138333036383735376263353333 +65336465383564643933336332386161346638376266303934346134343435373734376139333935 +38663630623035643438636364653935386564316133343030666638306363643239663038396263 +35623830353437303531663166353033323062363663623737653166313439303430336234656566 +31616637383763383837623437666333356537373738303165656366383666643639666565393361 +31323162616265303666383133386335373835373838336532303162333736353461363261323137 +64383038333332613837396461616535323361316663356166643663366435373063303139626538 +63633630393332626439303465316331656339643530323363326662616439353233343836353261 +66643563333564336339663136333561313731616633353537396362656461353837653039643831 +30356465373133646130396139386637343637313438316332383362373661663439383430643333 +36353666373837653238353335373164333535643232356463346537363934616563323635346332 +39333962323133333937363436663839636262393363386666393035396435653764333438326639 +39633966313338356530616430303936346333333734376234666230363432633166626434333335 +62396161373935663165326233316336323664386561633137336236653965363735363462393933 +32623531366663343763326131346137333866313764633736373037616137613564366532643961 +33306262383662633163663236653538326430663831396665663162326133323861336662333034 +39393461333732303533613632323433326438343030646133353036626135626139626363366331 +36333665353836346637623936333234346630326465346131343139666237613434656266326335 +37313635313431633265343739653265643832353765643763353730666230613539663132313033 +66643064356465666436353165663464393531386661653862303561303831656161336634383162 +30613035356638356237353831356632353035303138626436336136336465323462323038616530 +33616336336464663964633961343964613463373133653132353336633732343266346237396131 +34346630613661326339356662343732616635303662643263383061383939653164623961656436 +61346539653438353631366465323836646166376666316436633565356335343062383864633961 +61663937633865633830383165346338316531636639623661306139313164616338623365313532 +35393863346132356262613166373462653833643963376330303866393730326366366565333332 +33313031313366303034343636613431613563626139353736363161326232636330323165306636 +64353463363935303633656661336431626434613132303166326164383035303262343438643162 +36636563323734616538303430376162363666366462613561663165663562616162633536643563 +34343632353163306138393362623364303930333035616630343162663361343032316633313464 +63316432323166306233663432323336646161306363336338663861633634373135666132613631 +33373632646661333065316637376335303439326164396164633639336238643764343466313132 +65643562656365303832303436666435613532383162656635323564636365356564393663613263 +37623765383563366135323064316162663665626261663230383939356661303731373064346465 +36633230373836333838383966313431316364636530363035656231616565623363333631646232 +61303239643530396136663861376130373330386432636263666330336536383162656262323232 +61356266396139306537333638663733316631663762666132633563313432376564613962383163 +62613539626239326666386531376665663964366365376338376334376139346337636633663264 +34336161653930326539653236633563316330666465303434303432663739653664346331316530 +31396266363539613163653465653132363838626561363438663362303162373464626561636434 +61336432336462653764636139656363353333636366656364666262363462663961336164333434 +31396538626135306232653761633032346266303635633531326139323862386566396332353265 +38313437346534346136616639396461636231376465323034333835383864636161326432313437 +36343164383739386262316166326663393334323232653234626133306131383836316631353135 +62383266643137623836393663663236306634316231326262356338316338623138376530656330 +62386664306337636637306131366235653636353338363031306433633532313437363631633261 +39306233376339303161643435316539353433356364393038386565333962303761376336343631 +37633536363835656237353361623332613561303430623335333838356266383038356164626439 +62626162666438623039376334343365376535353738656535633136306239346430313533373339 +61663962373830393734313832326636346638646635666366393661313331373032646134386166 +33633132313931353066356563646532356431343063626535623638326531353462303832343837 +61326635353439643265343865313436376166386435623032623864393632313962386537333436 +37393066626337393562336531336237333065656261613336343239623734653264643565613637 +39383062373936363330646339646632663563626264326464393330633130646161333037313738 +65363932363230656365346436376363353631333961323965636534643265393630316630343761 +34616532366536636136306638396462333864393835623431633561386434363366336134346238 +64363965333561333665383965663265353664356666333864363137356566323236656666313935 +32616436326664643762633533353935396663663135316561346136396562346637616166613130 +38373263383566663533633531666137373566396133303733343937333837386136366265623661 +37643838383531636562363766343538316130386265643930346536383739393030633937643961 +31623132633632653232336430303238643161316263613930653232376465386536306130353563 +31353431623364633462616235636438323935613366313133633130623635313566363234616332 +30313238393038353665333832643030303166613464326561303638316233363539613132343838 +33656231616436303130656664363333663931373538356138343637316237616639316633623333 +6365663233363761643038323131383338383435373766613737 diff --git a/files/common/keyrings/ubuntu-cdimage.gpg b/files/common/keyrings/ubuntu-cdimage.gpg Binary files differnew file mode 100644 index 00000000..f6c3538f --- /dev/null +++ b/files/common/keyrings/ubuntu-cdimage.gpg diff --git a/inventory/group_vars/chaos-at-home/network.yml b/inventory/group_vars/chaos-at-home/network.yml index fa34a7a0..3e796dbc 100644 --- a/inventory/group_vars/chaos-at-home/network.yml +++ b/inventory/group_vars/chaos-at-home/network.yml @@ -18,6 +18,8 @@ network_zones: ch-thetys: 22 ch-dione: 23 ch-helene: 24 + ch-hpws-maxi: 30 + ch-hpws-mini1: 31 ch-prometheus: 200 ch-epimetheus: 201 ch-gw-lan: 254 diff --git a/inventory/group_vars/elevate-festival/vars.yml b/inventory/group_vars/elevate-festival/vars.yml index 39641ff4..ee2b7da8 100644 --- a/inventory/group_vars/elevate-festival/vars.yml +++ b/inventory/group_vars/elevate-festival/vars.yml @@ -67,23 +67,23 @@ network_zones: vlan: 42 prefix: 192.168.42.0/24 offsets: + ### Encoder/Mixer ele-sw-spreadencoder: 1 ele-sw-spreadmixer: 2 ele-sw-spreadmixer4k: 3 ele-dione: 100 ## ipmi ele-helene: 101 ## ipmi - ### Forum Stadtpark - ele-sw-forum0: 10 - ele-sw-forum1: 11 - ele-sw-forum2: 12 - ele-br-forum1: 18 # --> ele-br-parkhouse0 - ele-br-forum0: 19 # --> ele-br-uhrturm0 - ele-ap-forum0: 110 - ele-ap-forum1: 111 - ele-ap-forum2: 112 - ele-ap-forum3: 113 + # ele-sw-forum0: 10 + # ele-sw-forum1: 11 + # ele-sw-forum2: 12 + # ele-br-forum1: 18 # --> ele-br-parkhouse0 + # ele-br-forum0: 19 # --> ele-br-uhrturm0 + # ele-ap-forum0: 110 + # ele-ap-forum1: 111 + # ele-ap-forum2: 112 + # ele-ap-forum3: 113 ### Dom im Berg # ele-sw-dom0: 20 @@ -94,24 +94,50 @@ network_zones: # ele-ap-kunsthaus0: 130 ### Orpheum - ele-sw-orpheum0: 40 - ele-br-orpheum0: 49 # --> ele-br-uhrturm1 - ele-ap-orpheum0: 140 + # ele-sw-orpheum0: 40 + # ele-br-orpheum0: 49 # --> ele-br-uhrturm1 + # ele-ap-orpheum0: 140 ### Uhrturm/Rosengarten/Uhrturm-Kasematten - ele-sw-uhrturm0: 50 - ele-br-uhrturm1: 58 # --> ele-br-orpheum0 - ele-br-uhrturm0: 59 # --> ele-br-forum0 - ele-ap-uhrturm0: 150 + # ele-sw-uhrturm0: 50 + # ele-br-uhrturm1: 58 # --> ele-br-orpheum0 + # ele-br-uhrturm0: 59 # --> ele-br-forum0 + # ele-ap-uhrturm0: 150 ### Parkhouse - ele-sw-parkhouse0: 60 - ele-br-parkhouse0: 69 # --> ele-br-forum1 - ele-ap-parkhouse0: 160 + # ele-sw-parkhouse0: 60 + # ele-br-parkhouse0: 69 # --> ele-br-forum1 + # ele-ap-parkhouse0: 160 + + ### Next Liberty + ele-sw-nextlib0: 70 + ele-sw-nextlib1: 71 + ele-sw-nextlib2: 72 + ele-sw-nextlib3: 73 + ele-sw-nextlib4: 74 + ele-br-nextlib0: 79 # --> ele-br-tub0 + ele-ap-nextlib0: 170 + ele-ap-nextlib1: 171 + ele-ap-nextlib2: 172 + ele-ap-nextlib3: 173 + ele-ap-nextlib4: 174 + ele-ap-nextlib5: 175 + ### TU Bibliothek + ele-sw-tub0: 90 + ele-br-tub0: 99 # --> ele-br-nextlib0 + ### Dolmetsch ele-dol-mixer: 200 ele-dol-translator: 201 + + ### UPS + ele-ups-nextlib0: 210 + ele-ups-nextlib1: 211 + ele-ups-nextlib2: 212 + ele-ups-nextlib3: 213 + + ### Other datacop: 249 equinox-t450s: 250 ele-router: 254 @@ -212,18 +238,6 @@ network_zones: gateway: 10.12.241.142 offsets: ele-tub: 14 - ele-br-tub0: 13 - ele-br-uhrturm2: 12 - ele-router: 11 - equinox-t450s: 10 - datacop: 9 - ele-ups-forum0: 8 - ele-ups-forum1: 7 - ele-ups-uhrturm0: 6 - ele-ups-parkhouse0: 5 - nhg: 3 - ele-helene: 2 - ele-dione: 1 dns: - 10.12.0.10 @@ -231,8 +245,10 @@ network_zones: description: "transfer network for upstream via mur.at" prefix: 172.31.255.240/28 offsets: - ele-tub: 1 - ff-10g: 2 + ele-dione: 1 + ele-helene: 2 + equinox-t450s: 10 + ele-router: 13 ele-mur: 14 datacop_lte: diff --git a/inventory/host_vars/ch-calypso.yml b/inventory/host_vars/ch-calypso.yml index 024e6896..52c57d89 100644 --- a/inventory/host_vars/ch-calypso.yml +++ b/inventory/host_vars/ch-calypso.yml @@ -1,13 +1,13 @@ --- -preseed_language: de -preseed_country: AT -preseed_locales: +debian_preseed_language: de +debian_preseed_country: AT +debian_preseed_locales: - de_AT.UTF-8 - de_DE.UTF-8 - en_US.UTF-8 -preseed_no_splash: no -preseed_install_tasks: +debian_preseed_no_splash: no +debian_preseed_install_tasks: - xubuntu-desktop diff --git a/inventory/host_vars/ch-equinox-t450s.yml b/inventory/host_vars/ch-equinox-t450s.yml index 2820f653..df7759e3 100644 --- a/inventory/host_vars/ch-equinox-t450s.yml +++ b/inventory/host_vars/ch-equinox-t450s.yml @@ -1,17 +1,17 @@ --- -preseed_language: de -preseed_country: AT -preseed_locales: +debian_preseed_language: de +debian_preseed_country: AT +debian_preseed_locales: - de_AT.UTF-8 - de_DE.UTF-8 - en_US.UTF-8 -preseed_no_splash: no -preseed_install_tasks: +debian_preseed_no_splash: no +debian_preseed_install_tasks: - xubuntu-desktop -preseed_no_netplan: yes -preseed_manual_partitioning: yes +debian_preseed_no_netplan: yes +debian_preseed_manual_partitioning: yes install: efi: yes @@ -85,6 +85,7 @@ ws_base_extra_packages: - cmake - cpu-x - cura + - ddrescueview - debhelper - dh-lua - dh-make @@ -114,6 +115,7 @@ ws_base_extra_packages: - freerdp2-x11 - fzf - gcc-avr + - gddrescue - gdebi - gerbv - ghex diff --git a/inventory/host_vars/ch-equinox-ws.yml b/inventory/host_vars/ch-equinox-ws.yml index 88d536b2..8e97ab10 100644 --- a/inventory/host_vars/ch-equinox-ws.yml +++ b/inventory/host_vars/ch-equinox-ws.yml @@ -1,14 +1,14 @@ --- -preseed_language: de -preseed_country: AT -preseed_locales: +debian_preseed_language: de +debian_preseed_country: AT +debian_preseed_locales: - de_AT.UTF-8 - de_DE.UTF-8 - en_US.UTF-8 -preseed_kernel_image: linux-generic-hwe-20.04 -preseed_no_splash: no -preseed_install_tasks: +debian_preseed_kernel_image: linux-generic-hwe-20.04 +debian_preseed_no_splash: no +debian_preseed_install_tasks: - xubuntu-desktop @@ -84,6 +84,7 @@ ws_base_extra_packages: - clinfo - cmake - cpu-x + - ddrescueview - debhelper - dh-lua - dh-make @@ -113,6 +114,7 @@ ws_base_extra_packages: - freerdp2-x11 - fzf - gcc-avr + - gddrescue - gdebi - gerbv - ghex diff --git a/inventory/host_vars/ch-hpws-maxi.yml b/inventory/host_vars/ch-hpws-maxi.yml new file mode 100644 index 00000000..c5637069 --- /dev/null +++ b/inventory/host_vars/ch-hpws-maxi.yml @@ -0,0 +1,62 @@ +--- +debian_preseed_language: de +debian_preseed_country: AT +debian_preseed_locales: + - de_AT.UTF-8 + - de_DE.UTF-8 + - en_US.UTF-8 + +debian_preseed_no_splash: no +debian_preseed_install_tasks: + - xubuntu-desktop + + +install: + efi: yes + disks: + primary: /dev/disk/by-id/ata-WDC_WDS120G2G0A-00JH30_200854443001 + system_lvm: + size: 50G + volumes: + - name: root + size: 20G + filesystem: ext4 + mountpoint: / + - name: var+log + size: 768M + filesystem: ext4 + mountpoint: /var/log + mount_options: + - noatime + - nodev + - noexec + +network: + nameservers: "{{ network_zones.lan.dns }}" + domain: "{{ host_domain }}" + primary: &_network_primary_ + name: eno1 + address: "{{ network_zones.lan.prefix | ipaddr(network_zones.lan.offsets[inventory_hostname]) | ipaddr('address/prefix') }}" + gateway: "{{ network_zones.lan.gateway }}" + interfaces: + - *_network_primary_ + + +apt_repo_components: + - main + - restricted + - universe + - multiverse + +base_modules_blacklist: "{{ base_modules_blacklist_all_but_sound }}" + +admin_users_host: + - equinox + +ws_base_extra_packages: + # needs apt-repo/obs-studio + - obs-studio + +ws_base_lightdm_defaults: + autologin-user: equinox + autologin-user-timeout: 0 diff --git a/inventory/host_vars/ch-hpws-mini1.yml b/inventory/host_vars/ch-hpws-mini1.yml new file mode 100644 index 00000000..bb51be47 --- /dev/null +++ b/inventory/host_vars/ch-hpws-mini1.yml @@ -0,0 +1,62 @@ +--- +debian_preseed_language: de +debian_preseed_country: AT +debian_preseed_locales: + - de_AT.UTF-8 + - de_DE.UTF-8 + - en_US.UTF-8 + +debian_preseed_no_splash: no +debian_preseed_install_tasks: + - xubuntu-desktop + + +install: + efi: yes + disks: + primary: /dev/disk/by-id/ata-WDC_WDS120G2G0A-00JH30_20123D806706 + system_lvm: + size: 50G + volumes: + - name: root + size: 20G + filesystem: ext4 + mountpoint: / + - name: var+log + size: 768M + filesystem: ext4 + mountpoint: /var/log + mount_options: + - noatime + - nodev + - noexec + +network: + nameservers: "{{ network_zones.lan.dns }}" + domain: "{{ host_domain }}" + primary: &_network_primary_ + name: eno1 + address: "{{ network_zones.lan.prefix | ipaddr(network_zones.lan.offsets[inventory_hostname]) | ipaddr('address/prefix') }}" + gateway: "{{ network_zones.lan.gateway }}" + interfaces: + - *_network_primary_ + + +apt_repo_components: + - main + - restricted + - universe + - multiverse + +base_modules_blacklist: "{{ base_modules_blacklist_all_but_sound }}" + +admin_users_host: + - equinox + +ws_base_extra_packages: + # needs apt-repo/obs-studio + - obs-studio + +ws_base_lightdm_defaults: + autologin-user: equinox + autologin-user-timeout: 0 diff --git a/inventory/host_vars/ch-mc.yml b/inventory/host_vars/ch-mc.yml index 730a6569..529c331e 100644 --- a/inventory/host_vars/ch-mc.yml +++ b/inventory/host_vars/ch-mc.yml @@ -1,13 +1,13 @@ --- -preseed_language: de -preseed_country: AT -preseed_locales: +debian_preseed_language: de +debian_preseed_country: AT +debian_preseed_locales: - de_AT.UTF-8 - de_DE.UTF-8 - en_US.UTF-8 -preseed_no_splash: no -preseed_install_tasks: +debian_preseed_no_splash: no +debian_preseed_install_tasks: - xubuntu-desktop diff --git a/inventory/host_vars/ch-telesto.yml b/inventory/host_vars/ch-telesto.yml index f9ee0469..df580821 100644 --- a/inventory/host_vars/ch-telesto.yml +++ b/inventory/host_vars/ch-telesto.yml @@ -1,13 +1,13 @@ --- -preseed_language: de -preseed_country: AT -preseed_locales: +debian_preseed_language: de +debian_preseed_country: AT +debian_preseed_locales: - de_AT.UTF-8 - de_DE.UTF-8 - en_US.UTF-8 -preseed_no_splash: no -preseed_install_tasks: +debian_preseed_no_splash: no +debian_preseed_install_tasks: - xubuntu-desktop diff --git a/inventory/host_vars/ele-coturn.yml b/inventory/host_vars/ele-coturn.yml new file mode 100644 index 00000000..862ced63 --- /dev/null +++ b/inventory/host_vars/ele-coturn.yml @@ -0,0 +1,56 @@ +--- +install: + cloud: + credentials: + token: "{{ vault_hcloud_api_token }}" + +network: {} + +docker_storage: + type: lvm + vg: "{{ host_name }}" + lv: docker + size: 5G + fs: ext4 + +kubelet_storage: + type: lvm + vg: "{{ host_name }}" + lv: kubelet + size: 5G + fs: ext4 + + +acmetool_directory_server: "{{ acmetool_directory_server_le_live_v2 }}" + + +kubernetes_version: 1.21.2 +kubernetes_container_runtime: docker +kubernetes_standalone_max_pods: 100 +kubernetes_standalone_pod_cidr: 192.168.255.0/24 +kubernetes_standalone_cni_variant: with-portmap + + +coturn_version: 4.5.2-r2 +coturn_realm: elev8.at +coturn_hostnames: + - stun.elev8.at + - turn.elev8.at + +coturn_auth_secret: "{{ vault_coturn_auth_secret }}" +coturn_listening_port: 3478 +coturn_tls_listening_port: 443 +coturn_install_nginx_vhost: no + + +mumble_version: 1.3.4 +mumble_instance: elev8.at +mumble_hostnames: + - mumble.elev8.at + +mumble_superuser_password: "{{ vault_mumble_superuser_password }}" + +mumble_config_options: + bonjour: false + welcometext: "Welcome to the Mumble Server of the Elevate Festival<br>Intercom for Staff of Elevate 2021" + rememberchannel: true diff --git a/inventory/host_vars/ele-jitsi.yml b/inventory/host_vars/ele-jitsi.yml new file mode 100644 index 00000000..80032c54 --- /dev/null +++ b/inventory/host_vars/ele-jitsi.yml @@ -0,0 +1,52 @@ +--- +install: + cloud: + credentials: + token: "{{ vault_hcloud_api_token }}" + +network: {} + +docker_storage: + type: lvm + vg: "{{ host_name }}" + lv: docker + size: 5G + fs: ext4 + +kubelet_storage: + type: lvm + vg: "{{ host_name }}" + lv: kubelet + size: 5G + fs: ext4 + + +ssh_users_root: + - equinox + - datacop + +acmetool_directory_server: "{{ acmetool_directory_server_le_live_v2 }}" + + +kubernetes_version: 1.21.2 +kubernetes_container_runtime: docker +kubernetes_standalone_max_pods: 100 +kubernetes_standalone_pod_cidr: 192.168.255.0/24 +kubernetes_standalone_cni_variant: with-portmap + + +jitsi_meet_version: stable-5963 +jitsi_meet_hostname: remote.elev8.at + +jitsi_meet_p2p_enable: no + +jitsi_meet_secrets: "{{ vault_jitsi_meet_secrets }}" + +jitsi_meet_auth: + enable_guests: yes + users: + operator: "{{ vault_jitsi_meet_auth_user_passwords['operator'] }}" + +jitsi_meet_streamui: + http_port: "{{ jitsi_meet_http_port + 1 }}" + image_tag: latest diff --git a/inventory/host_vars/ele-router.yml b/inventory/host_vars/ele-router.yml index 520bd751..9b660f99 100644 --- a/inventory/host_vars/ele-router.yml +++ b/inventory/host_vars/ele-router.yml @@ -3,6 +3,9 @@ ssh_users_root: - equinox - datacop +network_mgmt_zone: "{{ network_zones.mgmt }}" + + wireguard_keys: gwhetzner: pub: "fqaKDJbSj6V0H98d78d/lnFLolefgp6zDPH9bN4+zUY=" @@ -24,102 +27,38 @@ wireguard_gateway_tunnels: allowed_ips: - 0.0.0.0/0 - - -network_mgmt_zone: "{{ network_zones.mgmt }}" -network_internal_zone_names__emc: - - emc -network_internal_zone_names__wan: - - lan - - guest - - mixer - - infoscreens - -network_internal_zone_names: "{{ network_internal_zone_names__wan + network_internal_zone_names__emc }}" - - openwrt_network_external: - - name: switch_vlan - options: - device: 'switch0' - ## for some reason vlan-id 502 does not work. why?? - #vlan: '{{ network_zones.forum_a1.vlan }}' - vlan: '1' - ports: '4 6t' - - - name: interface 'wanforum' + - name: interface 'wanmur' options: - ## for some reason vlan-id 502 does not work. why?? - #ifname: 'eth0.{{ network_zones.forum_a1.vlan }}' - ifname: 'eth0.1' - proto: dhcp - defaultroute: '0' ## see static route 'forumdefault' below - accept_ra: 0 - - - name: rule - options: - priority: 40000 - lookup: 101 - - - name: route 'forumdefault' - options: - interface: 'wanforum' - table: 101 - target: '0.0.0.0/0' - gateway: 192.168.0.254 ## A1 router @ForumStadtpark uses this address - - - - name: switch_vlan - options: - device: 'switch0' - ## for some reason vlan-id 502 does not work. why?? - #vlan: '{{ network_zones.funkfeuer.vlan }}' - vlan: '2' - ports: '3 6t' - - - name: interface 'wanff' - options: - ## for some reason vlan-id 502 does not work. why?? - #ifname: 'eth0.{{ network_zones.funkfeuer.vlan }}' - ifname: 'eth0.2' + ifname: 'eth5' proto: static - ipaddr: "{{ network_zones.funkfeuer.prefix | ipaddr(network_zones.funkfeuer.offsets[inventory_hostname]) | ipaddr('address') }}" - netmask: "{{ network_zones.funkfeuer.prefix | ipaddr('netmask') }}" + ipaddr: "{{ network_zones.murat_transfer.prefix | ipaddr(network_zones.murat_transfer.offsets[inventory_hostname]) | ipaddr('address') }}" + netmask: "{{ network_zones.murat_transfer.prefix | ipaddr('netmask') }}" accept_ra: 0 - name: rule options: - priority: 39000 - src: "{{ network_zones.funkfeuer.prefix | ipaddr(network_zones.funkfeuer.offsets[inventory_hostname]) | ipaddr('address') }}/32" - lookup: 102 + priority: 41050 + src: "{{ network_zones.murat_transfer.prefix | ipaddr(network_zones.murat_transfer.offsets[inventory_hostname]) | ipaddr('address') }}/32" + lookup: 105 - name: rule options: - priority: 39001 - mark: 102 - lookup: 102 + priority: 41051 + mark: 105 + lookup: 105 - - name: route 'ffdefault' + - name: route 'murdefault' options: - interface: 'wanff' - table: 102 + interface: 'wanmur' + table: 105 target: '0.0.0.0/0' - gateway: "{{ network_zones.funkfeuer.gateway }}" + gateway: "{{ network_zones.murat_transfer.prefix | ipaddr(network_zones.murat_transfer.offsets['ele-mur']) | ipaddr('address') }}" - - name: switch_vlan - options: - device: 'switch0' - ## for some reason vlan-id 512 does not work. why?? - #vlan: '{{ network_zones.datacop_lte.vlan }}' - vlan: '3' - ports: '2 6t' - - name: interface 'wanlte' options: - ## for some reason vlan-id 512 does not work. why?? - #ifname: 'eth0.{{ network_zones.datacop_lte.vlan }}' - ifname: 'eth0.3' + ifname: 'eth4' proto: static ipaddr: "{{ network_zones.datacop_lte.prefix | ipaddr(network_zones.datacop_lte.offsets[inventory_hostname]) | ipaddr('address') }}" netmask: "{{ network_zones.datacop_lte.prefix | ipaddr('netmask') }}" @@ -127,34 +66,42 @@ openwrt_network_external: - name: rule options: - priority: 38000 + priority: 41040 src: "{{ network_zones.datacop_lte.prefix | ipaddr(network_zones.datacop_lte.offsets[inventory_hostname]) | ipaddr('address') }}/32" - lookup: 103 + lookup: 104 - name: rule options: - priority: 38001 - mark: 103 - lookup: 103 + priority: 41041 + mark: 104 + lookup: 104 - name: route 'ltedefault' options: interface: 'wanlte' - table: 103 + table: 104 target: '0.0.0.0/0' gateway: "{{ network_zones.datacop_lte.gateway }}" + - name: rule + options: + priority: 50000 + lookup: 105 + +network_internal_zone_names__wanmur: + - lan + - guest + - mixer + - infoscreens +network_internal_zone_names__wanlte: [] +network_internal_zone_names__wgemc: + - emc +network_internal_zone_names: "{{ network_internal_zone_names__wanmur + network_internal_zone_names__wanlte + network_internal_zone_names__wgemc }}" openwrt_network_internal: "{{ openwrt_network_internal_yaml | from_yaml }}" openwrt_network_internal_yaml: | {% for zone_name in network_internal_zone_names %} - - name: switch_vlan - options: - device: 'switch0' - vlan: '{{ network_zones[zone_name].vlan }}' - ports: '0t 6t' - - name: "interface '{{ zone_name }}'" options: ifname: "eth0.{{ network_zones[zone_name].vlan }}" @@ -162,16 +109,9 @@ openwrt_network_internal_yaml: | ipaddr: "{{ network_zones[zone_name].gateway }}" netmask: "{{ network_zones[zone_name].prefix | ipaddr('netmask') }}" accept_ra: 0 - {% if zone_name in network_internal_zone_names__emc %} - - - name: rule - options: - priority: 33000 - in: "{{ zone_name }}" - lookup: 200 - {% endif %} {% endfor %} + openwrt_network_base: - name: globals 'globals' options: @@ -184,18 +124,6 @@ openwrt_network_base: ipaddr: 127.0.0.1 netmask: 255.0.0.0 - - name: switch - options: - name: 'switch0' - reset: '1' - enable_vlan: '1' - - - name: switch_vlan - options: - device: 'switch0' - vlan: '{{ network_mgmt_zone.vlan }}' - ports: '0t 1 6t' - - name: interface 'mgmt' options: ifname: "eth0.{{ network_mgmt_zone.vlan }}" @@ -205,15 +133,11 @@ openwrt_network_base: accept_ra: 0 -openwrt_dhcp_external: - - name: dhcp 'wanforum' - options: - interface: 'wanforum' - ignore: '1' - - name: dhcp 'wanff' +openwrt_dhcp_external: + - name: dhcp 'wanmur' options: - interface: 'wanff' + interface: 'wanmur' ignore: '1' - name: dhcp 'wanlte' @@ -221,6 +145,7 @@ openwrt_dhcp_external: interface: 'wanlte' ignore: '1' + openwrt_dhcp_internal: "{{ openwrt_dhcp_internal_yaml | from_yaml }}" openwrt_dhcp_internal_yaml: | {% for zone_name in network_internal_zone_names %} @@ -238,6 +163,7 @@ openwrt_dhcp_internal_yaml: | {% endif %} {% endfor %} + openwrt_dhcp_base: - name: dnsmasq options: @@ -256,6 +182,8 @@ openwrt_dhcp_base: leasefile: '/tmp/dhcp.leases' resolvfile: '/tmp/resolv.conf.auto' localservice: '1' + server: + - 1.1.1.1 - name: odhcpd 'odhcpd' options: @@ -271,12 +199,12 @@ openwrt_dhcp_base: openwrt_variant: openwrt -openwrt_release: 19.07.1 -openwrt_arch: ramips -openwrt_target: mt7621 -openwrt_profile: ubnt-erx +openwrt_release: 19.07.7 +openwrt_arch: x86 +openwrt_target: 64 +openwrt_profile: Generic openwrt_output_image_suffixes: - - "{{ openwrt_profile }}-squashfs-sysupgrade.bin" + - "combined-ext4.img.gz" openwrt_packages_remove: - ppp @@ -311,13 +239,13 @@ openwrt_mixin: content: "{{ wireguard_gateway_tunnels['wg-emc'].priv_key }}\n" mode: "0600" - /etc/rc.d/S21network-emc: - link: "../init.d/network-emc" + /etc/rc.d/S21network-wgemc: + link: "../init.d/network-wgemc" - /etc/rc.d/K91network-emc: - link: "../init.d/network-emc" + /etc/rc.d/K91network-wgemc: + link: "../init.d/network-wgemc" - /etc/init.d/network-emc: + /etc/init.d/network-wgemc: mode: "0755" content: | #!/bin/sh /etc/rc.common @@ -327,7 +255,7 @@ openwrt_mixin: start() { ip link add dev wg-emc type wireguard - wg set wg-emc fwmark 102 private-key /etc/wireguard/wg-emc.priv + wg set wg-emc fwmark 105 private-key /etc/wireguard/wg-emc.priv {% for peer in wireguard_gateway_tunnels['wg-emc'].peers %} wg set wg-emc peer {{ peer.pub_key }} endpoint {{ peer.endpoint.host }}:{{ peer.endpoint.port }} persistent-keepalive {{ peer.keepalive_interval }} allowed-ips {{ peer.allowed_ips | join(',') }} @@ -343,7 +271,6 @@ openwrt_mixin: stop() { ip link del dev wg-emc - ip rule del pref 33000 } /etc/rc.d/S22network-fw: @@ -361,65 +288,63 @@ openwrt_mixin: STOP=91 start() { - WAN_IF=$(uci get network.wanforum.ifname) - FF_IF=$(uci get network.wanff.ifname) - LTE_IF=$(uci get network.wanlte.ifname) + ### management MGMT_IF=$(uci get network.mgmt.ifname) MGMT_IPADDR=$(uci get network.mgmt.ipaddr) MGMT_NETMASK=$(uci get network.mgmt.netmask) - - - iptables -A INPUT -i lo -d 127.0.0.0/8 -s 127.0.0.0/8 -j ACCEPT + iptables -A INPUT -i lo -d 127.0.0.0/8 -j ACCEPT iptables -A INPUT -i "$MGMT_IF" -d "$MGMT_IPADDR" -s "$MGMT_IPADDR/$MGMT_NETMASK" -j ACCEPT - ### todo: limit the destination address? - iptables -A INPUT -i "$WAN_IF" -p icmp -j ACCEPT - iptables -A INPUT -i "$WAN_IF" -p tcp --dport {{ ansible_port }} -j ACCEPT - iptables -A INPUT -i "$WAN_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - iptables -A INPUT -i "$FF_IF" -p icmp -j ACCEPT - iptables -A INPUT -i "$FF_IF" -p tcp --dport {{ ansible_port }} -j ACCEPT - iptables -A INPUT -i "$FF_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + ### external zones + # mur + iptables -A INPUT -i "eth5" -p icmp -j ACCEPT + iptables -A INPUT -i "eth5" -p tcp --dport {{ ansible_port }} -j ACCEPT + iptables -A INPUT -i "eth5" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - iptables -A INPUT -i "$LTE_IF" -p icmp -j ACCEPT - iptables -A INPUT -i "$LTE_IF" -p tcp --dport {{ ansible_port }} -j ACCEPT - iptables -A INPUT -i "$LTE_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + # LTE + iptables -A INPUT -i "eth4" -p icmp -j ACCEPT + iptables -A INPUT -i "eth4" -p tcp --dport {{ ansible_port }} -j ACCEPT + iptables -A INPUT -i "eth4" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + # Wireguard EMC iptables -A INPUT -i "wg-emc" -p icmp -j ACCEPT iptables -A INPUT -i "wg-emc" -p tcp --dport {{ ansible_port }} -j ACCEPT iptables -A INPUT -i "wg-emc" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -o "wg-emc" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu - # all internal zones - for zone in {{ network_internal_zone_names | join(' ') }}; do - interface=$(uci get "network.$zone.ifname") - ipaddr=$(uci get "network.$zone.ipaddr") - netmask=$(uci get "network.$zone.netmask") - - ### todo: only add this if dhcp is in network_zones[zone] - iptables -A INPUT -i "$interface" -p udp --dport 67 --sport 68 -j ACCEPT - - ### todo: only do this if dhcp is in network_zones[zone] or $ipaddr is in network_zones[zone].dns - iptables -A INPUT -i "$interface" -p udp --dport 53 -d "$ipaddr" -s "$ipaddr/$netmask" -j ACCEPT - iptables -A INPUT -i "$interface" -p tcp --dport 53 -d "$ipaddr" -s "$ipaddr/$netmask" -j ACCEPT - - iptables -A INPUT -i "$interface" -p icmp -d "$ipaddr" -s "$ipaddr/$netmask" -j ACCEPT - iptables -A INPUT -i "$interface" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - - case "$zone" in - {{ network_internal_zone_names__wan | join('|') }}) - iptables -A FORWARD -i "$interface" -o "$WAN_IF" -s "$ipaddr/$netmask" -j ACCEPT - iptables -A FORWARD -i "$WAN_IF" -o "$interface" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - iptables -t nat -A POSTROUTING -o "$WAN_IF" -s "$ipaddr/$netmask" -j MASQUERADE - ;; - {{ network_internal_zone_names__emc | join('|') }}) - iptables -A FORWARD -i "$interface" -o "wg-emc" -s "$ipaddr/$netmask" -j ACCEPT - iptables -A FORWARD -i "wg-emc" -o "$interface" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - iptables -t nat -A POSTROUTING -o "wg-emc" -s "$ipaddr/$netmask" -j MASQUERADE - ;; - esac - done + ### internal zones + {% for zone_name in network_internal_zone_names %} + # {{ zone_name }} + {% if 'dhcp' in network_zones[zone_name] %} + iptables -A INPUT -i "eth0.{{ network_zones[zone_name].vlan }}" -p udp --dport 67 --sport 68 -j ACCEPT + {% endif %} + {% if 'dhcp' in network_zones[zone_name] or network_zones[zone_name].gateway in network_zones[zone_name].dns %} + iptables -A INPUT -i "eth0.{{ network_zones[zone_name].vlan }}" -p udp --dport 53 -d "{{ network_zones[zone_name].gateway }}" -s "{{ network_zones[zone_name].prefix }}" -j ACCEPT + iptables -A INPUT -i "eth0.{{ network_zones[zone_name].vlan }}" -p tcp --dport 53 -d "{{ network_zones[zone_name].gateway }}" -s "{{ network_zones[zone_name].prefix }}" -j ACCEPT + {% endif %} + iptables -A INPUT -i "eth0.{{ network_zones[zone_name].vlan }}" -p icmp -d "{{ network_zones[zone_name].gateway }}" -s "{{ network_zones[zone_name].prefix }}" -j ACCEPT + iptables -A INPUT -i "eth0.{{ network_zones[zone_name].vlan }}" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + + {% if zone_name in network_internal_zone_names__wanmur %} + {% set ext_interface = "eth5" %} + {% set rt_table = "105" %} + {% elif zone_name in network_internal_zone_names__wanlte %} + {% set ext_interface = "eth4" %} + {% set rt_table = "104" %} + {% elif zone_name in network_internal_zone_names__wgemc %} + {% set ext_interface = "wg-emc" %} + {% set rt_table = "200" %} + {% endif %} + iptables -A FORWARD -i "eth0.{{ network_zones[zone_name].vlan }}" -o "{{ ext_interface }}" -s "{{ network_zones[zone_name].prefix }}" -j ACCEPT + iptables -A FORWARD -i "{{ ext_interface }}" -o "eth0.{{ network_zones[zone_name].vlan }}" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + iptables -t nat -A POSTROUTING -o "{{ ext_interface }}" -s "{{ network_zones[zone_name].prefix }}" -j MASQUERADE + ip rule add pref {{ loop.index + 33000 }} iif "eth0.{{ network_zones[zone_name].vlan }}" lookup {{ rt_table }} + + {% endfor %} + + ### iptables -P INPUT DROP iptables -P FORWARD DROP } @@ -430,6 +355,9 @@ openwrt_mixin: iptables -P FORWARD ACCEPT iptables -F FORWARD iptables -t nat -F POSTROUTING + {% for zone_name in network_internal_zone_names %} + ip rule del pref {{ loop.index + 33000 }} + {% endfor %} } @@ -453,12 +381,6 @@ openwrt_uci: - '2.lede.pool.ntp.org' - '3.lede.pool.ntp.org' - - name: gpio_switch 'poe_passthrough' - options: - name: 'PoE Passthrough' - gpio_pin: '0' - value: '0' - dropbear: - name: dropbear options: diff --git a/inventory/host_vars/ele-telesto.yml b/inventory/host_vars/ele-telesto.yml index 6e642dee..5aa6c608 100644 --- a/inventory/host_vars/ele-telesto.yml +++ b/inventory/host_vars/ele-telesto.yml @@ -1,13 +1,13 @@ --- -preseed_language: de -preseed_country: AT -preseed_locales: +debian_preseed_language: de +debian_preseed_country: AT +debian_preseed_locales: - de_AT.UTF-8 - de_DE.UTF-8 - en_US.UTF-8 -preseed_no_splash: no -preseed_install_tasks: +debian_preseed_no_splash: no +debian_preseed_install_tasks: - xubuntu-desktop diff --git a/inventory/host_vars/glt-coturn.yml b/inventory/host_vars/glt-coturn.yml index f598384d..9cff4891 100644 --- a/inventory/host_vars/glt-coturn.yml +++ b/inventory/host_vars/glt-coturn.yml @@ -20,7 +20,7 @@ kubernetes_standalone_pod_cidr: 192.168.255.0/24 kubernetes_standalone_cni_variant: with-portmap -coturn_version: 4.5.2 +coturn_version: 4.5.2-r2 coturn_realm: linuxtage.at coturn_hostnames: - cdn13.linuxtage.at diff --git a/inventory/host_vars/lw-telesto.yml b/inventory/host_vars/lw-telesto.yml index ce9847a9..8e9a0061 100644 --- a/inventory/host_vars/lw-telesto.yml +++ b/inventory/host_vars/lw-telesto.yml @@ -1,13 +1,13 @@ --- -preseed_language: de -preseed_country: AT -preseed_locales: +debian_preseed_language: de +debian_preseed_country: AT +debian_preseed_locales: - de_AT.UTF-8 - de_DE.UTF-8 - en_US.UTF-8 -preseed_no_splash: no -preseed_install_tasks: +debian_preseed_no_splash: no +debian_preseed_install_tasks: - xubuntu-desktop diff --git a/inventory/host_vars/s2-mr-snuggles.yml b/inventory/host_vars/s2-mr-snuggles.yml index b8151728..482f7651 100644 --- a/inventory/host_vars/s2-mr-snuggles.yml +++ b/inventory/host_vars/s2-mr-snuggles.yml @@ -1,17 +1,17 @@ --- -preseed_language: de -preseed_country: AT -preseed_locales: +debian_preseed_language: de +debian_preseed_country: AT +debian_preseed_locales: - de_AT.UTF-8 - de_DE.UTF-8 - en_US.UTF-8 -preseed_no_splash: no -preseed_install_tasks: +debian_preseed_no_splash: no +debian_preseed_install_tasks: - xubuntu-desktop -preseed_no_netplan: yes -preseed_manual_partitioning: yes +debian_preseed_no_netplan: yes +debian_preseed_manual_partitioning: yes install: efi: no diff --git a/inventory/host_vars/sk-cloudio/collabora.yml b/inventory/host_vars/sk-cloudio/collabora.yml index 99cb5242..2346d007 100644 --- a/inventory/host_vars/sk-cloudio/collabora.yml +++ b/inventory/host_vars/sk-cloudio/collabora.yml @@ -3,7 +3,7 @@ collabora_code_base_path: /srv/storage/collabora/code collabora_code_instances: o.skillz.biz: - version: 6.4.8.1 + version: 6.4.10.2 port: 8200 hostname: o.skillz.biz admin: diff --git a/inventory/host_vars/sk-cloudio/coturn.yml b/inventory/host_vars/sk-cloudio/coturn.yml index dd749f41..ae4a187c 100644 --- a/inventory/host_vars/sk-cloudio/coturn.yml +++ b/inventory/host_vars/sk-cloudio/coturn.yml @@ -1,11 +1,11 @@ --- coturn_base_path: /srv/storage/coturn -coturn_version: 4.5.2 -coturn_realm: elev8.at +coturn_version: 4.5.2-r2 +coturn_realm: elevate.at coturn_hostnames: - - stun.elev8.at - - turn.elev8.at + - stun.elevate.at + - turn.elevate.at coturn_max_bps: 1048576 ## 8Mbit/s coturn_bps_capacity: 13107200 ## 100Mbit/s diff --git a/inventory/host_vars/sk-cloudio/jitsi.yml b/inventory/host_vars/sk-cloudio/jitsi.yml index 8c593bb5..be279ead 100644 --- a/inventory/host_vars/sk-cloudio/jitsi.yml +++ b/inventory/host_vars/sk-cloudio/jitsi.yml @@ -1,8 +1,8 @@ --- jitsi_meet_base_path: /srv/storage/jitsi/meet -jitsi_meet_version: stable-5390-3 -jitsi_meet_hostname: meet.elev8.at +jitsi_meet_version: stable-5963 +jitsi_meet_hostname: meet.elevate.at jitsi_meet_p2p_enable: no diff --git a/inventory/host_vars/sk-cloudio/keycloak.yml b/inventory/host_vars/sk-cloudio/keycloak.yml index b9bc445d..92ce73bd 100644 --- a/inventory/host_vars/sk-cloudio/keycloak.yml +++ b/inventory/host_vars/sk-cloudio/keycloak.yml @@ -8,7 +8,7 @@ keycloak_zfs: keycloak_instances: id.elevate.at: # new: true - version: 11.0.3 + version: 14.0.0 port: 8500 hostname: id.elevate.at admin: @@ -18,5 +18,5 @@ keycloak_instances: quota: 1G database: type: mariadb - version: 10.5.8 + version: 10.5.11 password: "{{ vault_keycloak_database_passwords['id.elevate.at'] }}" diff --git a/inventory/host_vars/sk-cloudio/nextcloud.yml b/inventory/host_vars/sk-cloudio/nextcloud.yml index 80a825b1..d7db2ea5 100644 --- a/inventory/host_vars/sk-cloudio/nextcloud.yml +++ b/inventory/host_vars/sk-cloudio/nextcloud.yml @@ -8,7 +8,7 @@ nextcloud_zfs: nextcloud_instances: wolke.elevate.at: # new: true - version: 21.0.2 + version: 21.0.3 port: 8100 hostnames: - wolke.elevate.at @@ -20,7 +20,7 @@ nextcloud_instances: password: "{{ vault_nextcloud_database_passwords['wolke.elevate.at'] }}" insomnia.skillz.biz: # new: true - version: 21.0.2 + version: 21.0.3 port: 8101 hostnames: - insomnia.skillz.biz @@ -32,7 +32,7 @@ nextcloud_instances: password: "{{ vault_nextcloud_database_passwords['insomnia.skillz.biz'] }}" nc.skillz.biz: # new: true - version: 21.0.2 + version: 21.0.3 port: 8102 hostnames: - nc.skillz.biz @@ -44,7 +44,7 @@ nextcloud_instances: password: "{{ vault_nextcloud_database_passwords['nc.skillz.biz'] }}" wae.elevate.at: # new: true - version: 21.0.2 + version: 21.0.3 port: 8104 hostnames: - wae.elevate.at diff --git a/inventory/host_vars/sk-tomnext-nc.yml b/inventory/host_vars/sk-tomnext-nc.yml index 9b9b940d..c9f0be3e 100644 --- a/inventory/host_vars/sk-tomnext-nc.yml +++ b/inventory/host_vars/sk-tomnext-nc.yml @@ -123,7 +123,7 @@ nextcloud_zfs: nextcloud_instances: team.tomwaitz.eu: # new: true - version: 21.0.2 + version: 21.0.3 port: 8100 hostnames: - team.tomwaitz.eu @@ -146,7 +146,7 @@ collabora_code_base_path: /srv/storage/collabora/code collabora_code_instances: o.tomwaitz.eu: - version: 6.4.8.1 + version: 6.4.10.2 port: 8200 hostname: o.tomwaitz.eu admin: diff --git a/inventory/hosts.ini b/inventory/hosts.ini index 1c1051aa..ef99f81b 100644 --- a/inventory/hosts.ini +++ b/inventory/hosts.ini @@ -46,6 +46,8 @@ ch-thetys host_name=thetys ch-dione host_name=dione ch-helene host_name=helene ch-k8s-master host_name=k8s-master +ch-hpws-maxi +ch-hpws-mini1 [chaos-at-home:children] mz-chaos-at-home @@ -231,6 +233,8 @@ ele-orpheum ele-tub ele-gwhetzner ele-mur +ele-coturn +ele-jitsi [elevate:children] ele-ap @@ -399,6 +403,8 @@ sk-tomnext [hcloud] ch-mimas2 ele-lt +ele-coturn +ele-jitsi glt-coturn glt-jitsi glt-stream @@ -456,6 +462,8 @@ k8s-chtest [standalone-kubelet] sk-cloudio ele-thetys +ele-coturn +ele-jitsi lw-thetys s2-thetys sk-tomnext-nc diff --git a/roles/acmetool/base/tasks/selfsigned.yml b/roles/acmetool/base/tasks/selfsigned.yml index 9c7d9b23..449fbdb9 100644 --- a/roles/acmetool/base/tasks/selfsigned.yml +++ b/roles/acmetool/base/tasks/selfsigned.yml @@ -63,7 +63,7 @@ - name: install selfsigned interim certificate and fullchain loop: - cert - - fullchein + - fullchain ansible.builtin.copy: content: "{{ selfsigned_interim_cert.certificate }}" dest: "{{ tmpdir }}/{{ item }}" diff --git a/roles/apps/collabora/code/templates/config/loolwsd.6.4.10.2.xml.j2 b/roles/apps/collabora/code/templates/config/loolwsd.6.4.10.2.xml.j2 new file mode 100644 index 00000000..7f6c7c0f --- /dev/null +++ b/roles/apps/collabora/code/templates/config/loolwsd.6.4.10.2.xml.j2 @@ -0,0 +1,192 @@ +<!-- -*- nxml-child-indent: 4; tab-width: 4; indent-tabs-mode: nil -*- --> + +<config> + + <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> + <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> + + <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> + + <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> + <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> + <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> + + <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> + <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path> + + <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion> + <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children> + <per_document desc="Document-specific settings, including LO Core settings."> + <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> + <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> + <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url> + <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> + <pdf_resolution_dpi desc="The resolution, in DPI, used to render PDF documents as image. Memory consumption grows proportionally. Must be a positive value less than 385. Defaults to 96." type="uint" default="96">96</pdf_resolution_dpi> + <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> + <!-- Idle save and auto save are checked every 30 seconds --> + <!-- They are disabled when the value is zero or negative. --> + <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs> + <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs> + <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit> + <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> + <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> + <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> + <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> + <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> + <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> + <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false"> + <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> + <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> + <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> + <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> + <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> + <lost_kit_grace_period_secs desc="The minimum grace period for a lost kit process (not referenced by loolwsd) to resolve its lost status before it is terminated. To disable the cleanup of lost kits use value 0" default="120">120</lost_kit_grace_period_secs> + </cleanup> + </per_document> + + <per_view desc="View-specific settings."> + <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs> + <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> + </per_view> + + <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html> + + <logging> + <color type="bool">true</color> + <level type="string" desc="Can be 0-8 (with the lowest numbers being the least verbose), or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> + <most_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from the client can not set a more verbose log level than this" default="notice">notice</most_verbose_level_settable_from_client> + <least_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from a client can not set a less verbose log level than this" default="fatal">fatal</least_verbose_level_settable_from_client> + <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> + <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" + See also: https://docs.libreoffice.org/sal/html/sal_log.html --> + <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> + <file enable="false"> + <!-- If you use other path than /var/log and you run loolwsd from systemd, make sure that you enable that path in loolwsd.service (ReadWritePaths). --> + <property name="path" desc="Log file path.">/var/log/loolwsd.log</property> + <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> + <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> + <property name="compress" desc="Enable/disable log file compression.">true</property> + <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> + <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> + <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> + <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> + </file> + <anonymize> + <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> + <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> + </anonymize> + </logging> + + <trace_event desc="The possibility to turn on generation of a Chrome Trace Event file" enable="false"> + <path desc="Output path for the Trace Event file, to which they will be written if turned on at run-time" type="string" default="/var/log/loolwsd.trace.json">/var/log/loolwsd.trace.json</path> + </trace_event> + + <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging> + + <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> + <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path> + <filter> + <message desc="Regex pattern of messages to exclude"></message> + </filter> + <outgoing> + <record desc="Whether or not to record outgoing messages" default="false">false</record> + </outgoing> + </trace> + + <net desc="Network settings"> + <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only. + You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> + <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> + <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen> + <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> + <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> + <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> + <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> + <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> + <host desc="The IPv6 loopback (localhost) address.">::1</host> + <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> + </post_allow> + <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> + <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> + </net> + + <ssl desc="SSL settings"> + <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> + <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> + <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path> + <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path> + <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path> + <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> + <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> + <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> + <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> + <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> + <pin></pin> + </pins> + </hpkp> + </ssl> + + <security desc="Altering these defaults potentially opens you to significant risk"> + <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> + <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> + <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs> + <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic, Beanshell, Javascript and Python scripts. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ item.value.macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> + <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ item.value.macros.security_level | default('1') }}</macro_security_level> + </security> + + <watermark> + <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> + <text desc="Watermark text to be displayed on the document if entered" type="string"></text> + </watermark> + + <welcome> + <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">false</enable> + <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button> + <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path> + </welcome> + + <user_interface> + <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode> + </user_interface> + + <storage desc="Backend storage"> + <filesystem allow="false" /> + <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true"> + <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> +{% for backend in item.value.backend_storages %} + <host allow="true">{{ backend }}</host> +{% endfor %} + <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> + <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies> + <locking desc="Locking settings"> + <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> + </locking> + </wopi> + <ssl desc="SSL settings"> + <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> + <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable> + <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path> + <key_file_path desc="Path to the key file" relative="false"></key_file_path> + <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path> + <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list> + </ssl> + </storage> + + <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent> + + <admin_console desc="Web admin console settings."> + <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> + <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> + <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> + <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">{{ item.value.admin.password }}</password> + </admin_console> + + <monitors desc="Addresses of servers we connect to on start for monitoring"> + </monitors> + + + +</config> diff --git a/roles/apps/coturn/defaults/main.yml b/roles/apps/coturn/defaults/main.yml index 34629dbd..842e7f05 100644 --- a/roles/apps/coturn/defaults/main.yml +++ b/roles/apps/coturn/defaults/main.yml @@ -3,7 +3,7 @@ coturn_uid: 930 coturn_gid: 930 coturn_base_path: /srv/coturn -# coturn_version: 4.5.1.1 +# coturn_version: 4.5.2-r2 # coturn_realm: example.com # coturn_hostnames: # - stun.example.com diff --git a/roles/apps/coturn/tasks/main.yml b/roles/apps/coturn/tasks/main.yml index a35734a8..838385ea 100644 --- a/roles/apps/coturn/tasks/main.yml +++ b/roles/apps/coturn/tasks/main.yml @@ -77,10 +77,6 @@ acmetool_cert_name: "coturn-{{ coturn_realm }}" acmetool_cert_hostnames: "{{ coturn_hostnames }}" -- name: apply hacky fix to support binding to privileged ports - when: (coturn_listening_port < 1024) or (coturn_tls_listening_port < 1024) - import_tasks: privileged-ports-hack.yml - - name: install pod manifest vars: kubernetes_standalone_pod: diff --git a/roles/apps/coturn/tasks/privileged-ports-hack.yml b/roles/apps/coturn/tasks/privileged-ports-hack.yml deleted file mode 100644 index 6025b7e7..00000000 --- a/roles/apps/coturn/tasks/privileged-ports-hack.yml +++ /dev/null @@ -1,31 +0,0 @@ ---- -### This hack is necessary because: https://github.com/kubernetes/kubernetes/issues/56374 and https://github.com/moby/moby/issues/8460. -### AFAIK there are two possible workarounds at the moment: -## - Setting sysctl net.ipv4.ip_unprivileged_port_start=0. -## This does not work because kubelet would not allow this for containers using host networking (and actually this would be a bad idea anyway). -## - Adding the CAP_NET_BIND_SERVICE capability on the turnserver binary file inside the container. -## This is what we are doing here - at least until the upstream container includes this: https://github.com/instrumentisto/coturn-docker-image/issues/40 - -- name: create build directory for custom image - file: - path: "{{ coturn_base_path }}/{{ coturn_realm }}/build" - state: directory - -- name: generate Dockerfile for custom image - copy: - content: | - FROM instrumentisto/coturn:{{ coturn_version }} - RUN apk --no-cache add libcap && setcap CAP_NET_BIND_SERVICE=+ep /usr/bin/turnserver - dest: "{{ coturn_base_path }}/{{ coturn_realm }}/build/Dockerfile" - register: coturn_custom_image_docker - -- name: build custom image - docker_image: - name: "instrumentisto/coturn/{{ coturn_realm }}:{{ coturn_version }}" - state: present - force_source: "{{ coturn_custom_image_docker is changed }}" - source: build - build: - path: "{{ coturn_base_path }}/{{ coturn_realm }}/build" - network: host - pull: yes diff --git a/roles/apps/coturn/templates/pod-spec.yml.j2 b/roles/apps/coturn/templates/pod-spec.yml.j2 index a0842784..20612e4b 100644 --- a/roles/apps/coturn/templates/pod-spec.yml.j2 +++ b/roles/apps/coturn/templates/pod-spec.yml.j2 @@ -12,13 +12,9 @@ terminationGracePeriodSeconds: 0 hostNetwork: true containers: - name: coturn -{% if (coturn_listening_port < 1024) or (coturn_tls_listening_port < 1024) %} - image: "instrumentisto/coturn/{{ coturn_realm }}:{{ coturn_version }}" -{% else %} - image: "instrumentisto/coturn:{{ coturn_version }}" -{% endif %} + image: "coturn/coturn:{{ coturn_version }}" args: - - --log-file=stdout + - --log-file=stdout resources: limits: memory: "1Gi" diff --git a/roles/apps/jitsi/meet/defaults/main.yml b/roles/apps/jitsi/meet/defaults/main.yml index 527f39b9..2580fe15 100644 --- a/roles/apps/jitsi/meet/defaults/main.yml +++ b/roles/apps/jitsi/meet/defaults/main.yml @@ -1,7 +1,7 @@ --- jitsi_meet_base_path: /srv/jitsi/meet -# jitsi_meet_version: 4101-2 +# jitsi_meet_version: stable-5963 jitsi_meet_inst_name: "{{ jitsi_meet_hostname }}" # jitsi_meet_hostname: meet.example.com @@ -14,6 +14,16 @@ jitsi_meet_timezone: Europe/Vienna ### generate these using: openssl rand -hex 16 # jitsi_meet_secrets: -# jicofo_component_secret: "" +# jicofo_component_secret: "" ### only needed for versions older than stable-5765-1 # jicofo_auth_password: "" # jvb_auth_password: "" +# streamuidisplay_auth_password: "" ### only needed if streamui is enabled + +# jitsi_meet_auth: +# enable_guests: true +# users: +# foo: secret + +# jitsi_meet_streamui: +# http_port: "{{ jitsi_meet_http_port + 1 }}" +# image_tag: latest diff --git a/roles/apps/jitsi/meet/tasks/main.yml b/roles/apps/jitsi/meet/tasks/main.yml index 8fcef577..e83c789e 100644 --- a/roles/apps/jitsi/meet/tasks/main.yml +++ b/roles/apps/jitsi/meet/tasks/main.yml @@ -1,21 +1,79 @@ --- - name: create jitsi-meet scripts subdirectories loop: - - jicofo - - prosody - - web - - jvb + - jicofo + - prosody + - web + - jvb file: path: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/{{ item }}" state: directory -- name: generate prosody cont-init.d script +- name: generate stream-ui specific cont-init scripts + when: jitsi_meet_streamui is defined + block: + - name: generate stream-ui specific cont-init scripts for prosody + copy: + content: | + #!/usr/bin/with-contenv bash + cat << EOF > /config/conf.d/stream-ui.cfg.lua + VirtualHost "stream-ui.meet.jitsi" + modules_enabled = { + "ping"; + } + authentication = "internal_hashed" + EOF + prosodyctl --config "/config/prosody.cfg.lua" register display stream-ui.meet.jitsi "{{ jitsi_meet_secrets.streamuidisplay_auth_password }}" + dest: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/prosody/streamui.sh" + mode: 0750 + + - name: generate stream-ui specific cont-init scripts for web + copy: + content: | + #!/usr/bin/with-contenv bash + cat << EOF >> /config/config.js + + // Hide Stream-UI Displays + config.hiddenDomain = 'stream-ui.meet.jitsi'; + EOF + dest: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/web/streamui.sh" + mode: 0755 + +- name: generate generic prosody cont-init script copy: content: | #!/usr/bin/with-contenv bash sed -e 's#^\(component_interface\s*=\)#-- \1#g' -i /config/prosody.cfg.lua + {% if jitsi_meet_auth is defined %} + + echo "authentication enabled:" + {% for username, password in jitsi_meet_auth.users.items() %} + echo " * registering user: {{ username }}" + prosodyctl --config "/config/prosody.cfg.lua" register "{{ username }}" $XMPP_DOMAIN "{{ password }}" + {% endfor %} + {% endif %} dest: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/prosody/cont-init.sh" - mode: 0755 + mode: 0750 + + +- name: configure base pod config hash items + set_fact: + kubernetes_standalone_pod_config_hash_items_base: + - path: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/prosody/cont-init.sh" + properties: + - checksum + kubernetes_standalone_pod_config_hash_items_streamui: [] + +- name: configure stream-ui pod config hash items + when: jitsi_meet_streamui is defined + set_fact: + kubernetes_standalone_pod_config_hash_items_streamui: + - path: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/prosody/streamui.sh" + properties: + - checksum + - path: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/prosody/streamui.sh" + properties: + - checksum - name: install pod manifest vars: @@ -23,14 +81,26 @@ name: "jitsi-meet-{{ jitsi_meet_inst_name }}" spec: "{{ lookup('template', 'pod-spec.yml.j2') }}" mode: "0600" - config_hash_items: - - path: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/prosody/cont-init.sh" - properties: - - checksum + config_hash_items: "{{ kubernetes_standalone_pod_config_hash_items_base + kubernetes_standalone_pod_config_hash_items_streamui }}" include_role: name: kubernetes/standalone/pod -## TODO: https://github.com/jitsi/jitsi-meet/blob/master/doc/turn.md + +- name: configure base http proxy locations + set_fact: + nginx_vhost_locations_base: + '/': + proxy_pass: "http://127.0.0.1:{{ jitsi_meet_http_port }}" + extra_directives: |- + client_max_body_size 0; + nginx_vhost_locations_streamui: {} + +- name: configure stream-ui http proxy locations + when: jitsi_meet_streamui is defined + set_fact: + nginx_vhost_locations_streamui: + '/stream-ui/': + proxy_pass: "http://127.0.0.1:{{ jitsi_meet_streamui.http_port }}/" - name: configure nginx vhost vars: @@ -40,10 +110,6 @@ acme: true hostnames: - "{{ jitsi_meet_hostname }}" - locations: - '/': - proxy_pass: "http://127.0.0.1:{{ jitsi_meet_http_port }}" - extra_directives: |- - client_max_body_size 0; + locations: "{{ nginx_vhost_locations_base | combine(nginx_vhost_locations_streamui) }}" include_role: name: nginx/vhost diff --git a/roles/apps/jitsi/meet/templates/pod-spec.yml.j2 b/roles/apps/jitsi/meet/templates/pod-spec.yml.j2 index 43eb0806..95f49982 100644 --- a/roles/apps/jitsi/meet/templates/pod-spec.yml.j2 +++ b/roles/apps/jitsi/meet/templates/pod-spec.yml.j2 @@ -22,6 +22,13 @@ containers: subPath: jicofo mountPath: /config env: +{% if jitsi_meet_auth is defined %} + - name: ENABLE_AUTH + value: "1" + - name: AUTH_TYPE + value: "internal" + +{% endif %} - name: XMPP_SERVER value: 127.0.0.1 - name: XMPP_DOMAIN @@ -33,8 +40,10 @@ containers: - name: XMPP_INTERNAL_MUC_DOMAIN value: internal-muc.meet.jitsi +{% if 'jicofo_component_secret' in jitsi_meet_secrets %} - name: JICOFO_COMPONENT_SECRET value: "{{ jitsi_meet_secrets.jicofo_component_secret }}" +{% endif %} - name: JICOFO_AUTH_USER value: focus - name: JICOFO_AUTH_PASSWORD @@ -57,6 +66,13 @@ containers: - name: scripts subPath: prosody/cont-init.sh mountPath: /etc/cont-init.d/99-k8s + readOnly: yes +{% if jitsi_meet_streamui is defined %} + - name: scripts + subPath: prosody/streamui.sh + mountPath: /etc/cont-init.d/90-streamui + readOnly: yes +{% endif %} - name: config subPath: prosody mountPath: /config @@ -66,17 +82,32 @@ containers: - name: ENABLE_LOBBY value: "1" +{% if jitsi_meet_auth is defined %} + - name: ENABLE_AUTH + value: "1" + - name: AUTH_TYPE + value: "internal" + - name: ENABLE_GUESTS + value: "{{ (jitsi_meet_auth.enable_guests | default(false)) | ternary('1', '0') }}" + +{% endif %} - name: XMPP_DOMAIN value: meet.jitsi - name: XMPP_AUTH_DOMAIN value: auth.meet.jitsi +{% if jitsi_meet_auth is defined and (jitsi_meet_auth.enable_guests | default(false)) %} + - name: XMPP_GUEST_DOMAIN + value: guest.meet.jitsi +{% endif %} - name: XMPP_MUC_DOMAIN value: muc.meet.jitsi - name: XMPP_INTERNAL_MUC_DOMAIN value: internal-muc.meet.jitsi +{% if 'jicofo_component_secret' in jitsi_meet_secrets %} - name: JICOFO_COMPONENT_SECRET value: "{{ jitsi_meet_secrets.jicofo_component_secret }}" +{% endif %} - name: JICOFO_AUTH_USER value: focus - name: JICOFO_AUTH_PASSWORD @@ -86,8 +117,6 @@ containers: value: jvb - name: JVB_AUTH_PASSWORD value: "{{ jitsi_meet_secrets.jvb_auth_password }}" - - name: JVB_TCP_HARVESTER_DISABLED - value: "true" - name: TZ value: {{ jitsi_meet_timezone }} @@ -105,6 +134,12 @@ containers: hostPort: {{ jitsi_meet_http_port }} hostIP: 127.0.0.1 volumeMounts: +{% if jitsi_meet_streamui is defined %} + - name: scripts + subPath: web/streamui.sh + mountPath: /etc/cont-init.d/90-streamui + readOnly: yes +{% endif %} - name: config subPath: web mountPath: /config @@ -115,28 +150,33 @@ containers: value: "1" - name: ENABLE_HTTP_REDIRECT value: "0" + - name: ENABLE_P2P value: "{{ jitsi_meet_p2p_enable | ternary('true', 'false') }}" - - name: XMPP_SERVER - value: 127.0.0.1 +{% if jitsi_meet_auth is defined %} + - name: ENABLE_AUTH + value: "1" + - name: ENABLE_GUESTS + value: "{{ (jitsi_meet_auth.enable_guests | default(false)) | ternary('1', '0') }}" + +{% endif %} - name: XMPP_DOMAIN value: meet.jitsi - name: XMPP_AUTH_DOMAIN value: auth.meet.jitsi - - name: XMPP_INTERNAL_MUC_DOMAIN - value: internal-muc.meet.jitsi - - name: XMPP_BOSH_URL_BASE - value: http://127.0.0.1:5280 +{% if jitsi_meet_auth is defined and (jitsi_meet_auth.enable_guests | default(false)) %} + - name: XMPP_GUEST_DOMAIN + value: guest.meet.jitsi +{% endif %} - name: XMPP_MUC_DOMAIN value: muc.meet.jitsi + - name: XMPP_BOSH_URL_BASE + value: http://127.0.0.1:5280 - name: JICOFO_AUTH_USER value: focus - - name: JVB_TCP_HARVESTER_DISABLED - value: "true" - - name: TZ value: {{ jitsi_meet_timezone }} @@ -159,24 +199,19 @@ containers: env: - name: XMPP_SERVER value: 127.0.0.1 - - name: XMPP_DOMAIN - value: meet.jitsi - name: XMPP_AUTH_DOMAIN value: auth.meet.jitsi - name: XMPP_INTERNAL_MUC_DOMAIN value: internal-muc.meet.jitsi - - name: JICOFO_AUTH_USER - value: focus - - name: JICOFO_AUTH_PASSWORD - value: "{{ jitsi_meet_secrets.jicofo_auth_password }}" - - name: JVB_AUTH_USER value: jvb - name: JVB_AUTH_PASSWORD value: "{{ jitsi_meet_secrets.jvb_auth_password }}" + - name: JVB_BREWERY_MUC value: jvbbrewery + - name: JVB_PORT value: "{{ jitsi_meet_jvb_port }}" - name: JVB_TCP_HARVESTER_DISABLED @@ -187,6 +222,21 @@ containers: - name: TZ value: {{ jitsi_meet_timezone }} +{% if jitsi_meet_streamui is defined %} +- name: stream-ui + image: "get.more.failed.systems/public_projects/jitsi-stream-ui:{{ jitsi_meet_streamui.image_tag }}" + resources: + requests: + memory: "256Mi" + limits: + memory: "1Gi" + ports: + - protocol: TCP + containerPort: 3000 + hostPort: {{ jitsi_meet_streamui.http_port }} + hostIP: 127.0.0.1 + +{% endif %} volumes: - name: scripts hostPath: diff --git a/roles/installer/debian/base/tasks/main.yml b/roles/installer/debian/base/tasks/main.yml index 662b8acb..56ca7dc0 100644 --- a/roles/installer/debian/base/tasks/main.yml +++ b/roles/installer/debian/base/tasks/main.yml @@ -17,7 +17,7 @@ src: "{{ item }}" dest: "{{ installer_base_path }}/keyrings/{{ item | basename }}" -- name: copy ubuntu keyring file +- name: copy ubuntu archive keyring file copy: src: "{{ global_files_dir }}/common/keyrings/ubuntu-archive.gpg" dest: "{{ installer_base_path }}/keyrings/ubuntu-archive.gpg" diff --git a/roles/installer/debian/iso/tasks/main.yml b/roles/installer/debian/iso/tasks/main.yml index 3170c7b5..cfbb9721 100644 --- a/roles/installer/debian/iso/tasks/main.yml +++ b/roles/installer/debian/iso/tasks/main.yml @@ -4,7 +4,7 @@ vars: debian_installer_distro: "{{ install_distro }}" debian_installer_codename: "{{ install_codename }}" - debian_installer_arch: "{{ install.arch | default('amd64') }}" + debian_installer_arch: "{{ install_cooked.arch | default('amd64') }}" debian_installer_variant: mini-iso import_role: role: installer/debian/fetch @@ -28,8 +28,8 @@ - name: generate host specific initial ramdisk vars: - preseed_initrd: "{{ tmpdir.path }}/initrd.gz" - preseed_tmpdir: "{{ tmpdir.path }}" + debian_preseed_initrd: "{{ tmpdir.path }}/initrd.gz" + debian_preseed_tmpdir: "{{ tmpdir.path }}" import_role: name: installer/debian/preseed diff --git a/roles/installer/debian/iso/templates/grub.cfg.j2 b/roles/installer/debian/iso/templates/grub.cfg.j2 index 12b8837b..e2f480fa 100644 --- a/roles/installer/debian/iso/templates/grub.cfg.j2 +++ b/roles/installer/debian/iso/templates/grub.cfg.j2 @@ -15,6 +15,6 @@ set timeout=10 set default=0 menuentry "automated installer for {{ inventory_hostname }}" { - linux /linux --- auto {{ (install_cooked.kernel_cmdline | default([])) | join(' ') }} - initrd /initrd.gz + linux /linux --- auto {{ (install_cooked.kernel_cmdline | default([])) | join(' ') }} + initrd /initrd.gz } diff --git a/roles/installer/debian/preseed/defaults/main.yml b/roles/installer/debian/preseed/defaults/main.yml index b8d22ea6..fd57ef57 100644 --- a/roles/installer/debian/preseed/defaults/main.yml +++ b/roles/installer/debian/preseed/defaults/main.yml @@ -1,35 +1,35 @@ --- -# preseed_initrd -# preseed_tmpdir: +# debian_preseed_initrd: +# debian_preseed_tmpdir: -preseed_language: en -preseed_country: US -preseed_locales: +debian_preseed_language: en +debian_preseed_country: US +debian_preseed_locales: - en_US.UTF-8 -preseed_keyboard_layout: de -preseed_keyboard_variant: nodeadkeys +debian_preseed_keyboard_layout: de +debian_preseed_keyboard_variant: nodeadkeys -preseed_timezone: Europe/Vienna +debian_preseed_timezone: Europe/Vienna -# preseed_force_net_ifnames_policy: path -preseed_no_netplan: no +# debian_preseed_force_net_ifnames_policy: path +debian_preseed_no_netplan: no -# preseed_kernel_image: -preseed_virtual_machine: no -preseed_no_splash: yes +# debian_preseed_kernel_image: +debian_preseed_virtual_machine: no +debian_preseed_no_splash: yes -preseed_manual_partitioning: no +debian_preseed_manual_partitioning: no -preseed_efi_esp_size: 128M -preseed_swraid_boot_size: 256M +debian_preseed_efi_esp_size: 128M +debian_preseed_swraid_boot_size: 256M ## not used, see templates/partman_config.j2 -preseed_system_lvm_reserve_default: 384M +debian_preseed_system_lvm_reserve_default: 384M -preseed_system_lvm_size_default: all -preseed_system_lvm_volumes_default: +debian_preseed_system_lvm_size_default: all +debian_preseed_system_lvm_volumes_default: - name: root size: 2560M filesystem: ext4 @@ -48,4 +48,4 @@ preseed_system_lvm_volumes_default: - noexec -preseed_install_tasks: [] +debian_preseed_install_tasks: [] diff --git a/roles/installer/debian/preseed/tasks/main.yml b/roles/installer/debian/preseed/tasks/main.yml index 525ba848..e3ea660f 100644 --- a/roles/installer/debian/preseed/tasks/main.yml +++ b/roles/installer/debian/preseed/tasks/main.yml @@ -1,45 +1,45 @@ --- - name: Generate preseed file template: - src: "preseed_{{ preseed_template_name | default(install_distro + '-' + install_codename) }}.cfg.j2" - dest: "{{ preseed_tmpdir }}/preseed.cfg" + src: "preseed_{{ debian_preseed_template_name | default(install_distro + '-' + install_codename) }}.cfg.j2" + dest: "{{ debian_preseed_tmpdir }}/preseed.cfg" - name: Generate partmam early-command script - when: not preseed_manual_partitioning + when: not debian_preseed_manual_partitioning template: src: "partman_early-command.sh.j2" - dest: "{{ preseed_tmpdir }}/partman_early-command.sh" + dest: "{{ debian_preseed_tmpdir }}/partman_early-command.sh" mode: 0755 - name: Generate authorized_keys file authorized_key: user: root manage_dir: no - path: "{{ preseed_tmpdir }}/authorized_keys" + path: "{{ debian_preseed_tmpdir }}/authorized_keys" key: "{{ ssh_keys_root | join('\n') }}" - name: force net interface name policy - when: preseed_force_net_ifnames_policy is defined + when: debian_preseed_force_net_ifnames_policy is defined block: - name: prepare directories to force network interface name policy file: - path: "{{ preseed_tmpdir }}/etc/systemd/network" + path: "{{ debian_preseed_tmpdir }}/etc/systemd/network" state: directory - name: install link unit to force network interface name policy copy: - dest: "{{ preseed_tmpdir }}/etc/systemd/network/90-namepolicy.link" + dest: "{{ debian_preseed_tmpdir }}/etc/systemd/network/90-namepolicy.link" content: | [Match] OriginalName=* [Link] - NamePolicy={{ preseed_force_net_ifnames_policy }} + NamePolicy={{ debian_preseed_force_net_ifnames_policy }} - name: Inject files into initramfs - shell: cpio -H newc -o | gzip -9 >> '{{ preseed_initrd }}' + shell: cpio -H newc -o | gzip -9 >> '{{ debian_preseed_initrd }}' args: - chdir: "{{ preseed_tmpdir }}" + chdir: "{{ debian_preseed_tmpdir }}" stdin: | preseed.cfg partman_early-command.sh diff --git a/roles/installer/debian/preseed/templates/partman_config.j2 b/roles/installer/debian/preseed/templates/partman_config.j2 index 9f8c7dcd..77bc0f8b 100644 --- a/roles/installer/debian/preseed/templates/partman_config.j2 +++ b/roles/installer/debian/preseed/templates/partman_config.j2 @@ -32,10 +32,10 @@ d-i partman-basicfilesystems/choose_label string msdos d-i partman-basicfilesystems/default_label string msdos {% endif %} -{% set system_lvm_size = install_cooked.system_lvm.size | default(preseed_system_lvm_size_default) %} -{% set system_lvm_volumes = install_cooked.system_lvm.volumes | default(preseed_system_lvm_volumes_default) %} +{% set system_lvm_size = install_cooked.system_lvm.size | default(debian_preseed_system_lvm_size_default) %} +{% set system_lvm_volumes = install_cooked.system_lvm.volumes | default(debian_preseed_system_lvm_volumes_default) %} {# on small disks this probably triggers: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=896826 ... #} -{# set system_lvm_reserve = install_cooked.system_lvm.reserve | default(preseed_system_lvm_reserve_default) #} +{# set system_lvm_reserve = install_cooked.system_lvm.reserve | default(debian_preseed_system_lvm_reserve_default) #} {# set system_lvm_pv_size_min_mb = (((system_lvm_volumes | map(attribute='size') | map('human_to_bytes') | sum) / (1024*1024)) | int) + (((system_lvm_reserve | human_to_bytes) / (1024*1024)) | int) #} {# ... so let's go for a 1 MB minimum. #} {% set system_lvm_pv_size_min_mb = 1 %} @@ -48,14 +48,14 @@ d-i partman-auto/method string lvm d-i partman-auto/expert_recipe string \ ansible :: \ {% if (install_cooked.efi | default(false)) %} -{% set efi_esp_size_mb = (((preseed_efi_esp_size | default(preseed_efi_esp_size)) | human_to_bytes) / (1024*1024)) | int %} +{% set efi_esp_size_mb = ((debian_preseed_efi_esp_size | human_to_bytes) / (1024*1024)) | int %} {{ efi_esp_size_mb }} {{ efi_esp_size_mb }} {{ efi_esp_size_mb }} fat16 \ $primary{ } $bootable{ } \ method{ efi } format{ } \ . \ {% endif %} {% if install_cooked.disks.primary == "software-raid" %} -{% set swraid_boot_size_mb = (((preseed_swraid_boot_size | default(preseed_swraid_boot_size)) | human_to_bytes) / (1024*1024)) | int %} +{% set swraid_boot_size_mb = ((debian_preseed_swraid_boot_size | human_to_bytes) / (1024*1024)) | int %} {{ swraid_boot_size_mb }} {{ swraid_boot_size_mb }} {{ swraid_boot_size_mb }} raid \ $lvmignore{ } $primary{ } $bootable{ } \ method{ raid } \ diff --git a/roles/installer/debian/preseed/templates/preseed_debian-bullseye.cfg.j2 b/roles/installer/debian/preseed/templates/preseed_debian-bullseye.cfg.j2 index 3b240961..fa3304f4 100644 --- a/roles/installer/debian/preseed/templates/preseed_debian-bullseye.cfg.j2 +++ b/roles/installer/debian/preseed/templates/preseed_debian-bullseye.cfg.j2 @@ -2,15 +2,15 @@ # spreadspace preseed file for Debian bullseye based machines ######################################################################### -d-i debian-installer/language string {{ preseed_language }} -d-i debian-installer/country string {{ preseed_country }} -d-i debian-installer/locale string {{ preseed_locales | first }} -d-i localechooser/preferred-locale string {{ preseed_locales | first }} -d-i localechooser/supported-locales multiselect {{ preseed_locales | join(', ') }} +d-i debian-installer/language string {{ debian_preseed_language }} +d-i debian-installer/country string {{ debian_preseed_country }} +d-i debian-installer/locale string {{ debian_preseed_locales | first }} +d-i localechooser/preferred-locale string {{ debian_preseed_locales | first }} +d-i localechooser/supported-locales multiselect {{ debian_preseed_locales | join(', ') }} -d-i keyboard-configuration/xkb-keymap select {{ preseed_keyboard_layout }} -d-i keyboard-configuration/layoutcode string {{ preseed_keyboard_layout }} -d-i keyboard-configuration/variantcode string {{ preseed_keyboard_variant }} +d-i keyboard-configuration/xkb-keymap select {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/layoutcode string {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/variantcode string {{ debian_preseed_keyboard_variant }} d-i hw-detect/load_firmware boolean false @@ -47,24 +47,24 @@ d-i passwd/root-password-again password this-very-very-secure-password-will-be-r d-i clock-setup/utc boolean true -d-i time/zone string {{ preseed_timezone }} +d-i time/zone string {{ debian_preseed_timezone }} d-i clock-setup/ntp boolean false -{% if not preseed_manual_partitioning %} +{% if not debian_preseed_manual_partitioning %} {% include 'partman_config.j2' %} {% endif %} -{% if preseed_kernel_image is defined %} -d-i base-installer/kernel/image string {{ preseed_kernel_image }} +{% if debian_preseed_kernel_image is defined %} +d-i base-installer/kernel/image string {{ debian_preseed_kernel_image }} {% endif %} d-i base-installer/install-recommends boolean false d-i apt-setup/security_host string {{ apt_repo_providers[apt_repo_provider].debian_security.host }} d-i apt-setup/security_path string {{ apt_repo_providers[apt_repo_provider].debian_security.path }} -tasksel tasksel/first multiselect {{ preseed_install_tasks | join(', ') }} +tasksel tasksel/first multiselect {{ debian_preseed_install_tasks | join(', ') }} d-i pkgsel/include string openssh-server {{ python_basename }} {{ python_basename }}-apt d-i pkgsel/upgrade select safe-upgrade popularity-contest popularity-contest/participate boolean false @@ -76,13 +76,13 @@ d-i preseed/late_command string \ lvremove -f {{ host_name }}/dummy; \ in-target bash -c "apt-get update -q && apt-get full-upgrade -y -q"; \ in-target bash -c "sed -e 's/^allow-hotplug/auto/' -i /etc/network/interfaces"; \ -{% if preseed_force_net_ifnames_policy is defined %} +{% if debian_preseed_force_net_ifnames_policy is defined %} mkdir -p /target/etc/systemd/network; \ in-target bash -c "echo '[Match]' > /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "echo 'OriginalName=*' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "echo '' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "echo '[Link]' >> /etc/systemd/network/90-namepolicy.link"; \ - in-target bash -c "echo 'NamePolicy={{ preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ + in-target bash -c "echo 'NamePolicy={{ debian_preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "update-initramfs -u"; \ {% endif %} in-target bash -c "passwd -d root && passwd -l root"; \ diff --git a/roles/installer/debian/preseed/templates/preseed_debian-buster.cfg.j2 b/roles/installer/debian/preseed/templates/preseed_debian-buster.cfg.j2 index 41e9d5ba..23fe064d 100644 --- a/roles/installer/debian/preseed/templates/preseed_debian-buster.cfg.j2 +++ b/roles/installer/debian/preseed/templates/preseed_debian-buster.cfg.j2 @@ -2,15 +2,15 @@ # spreadspace preseed file for Debian buster based machines ######################################################################### -d-i debian-installer/language string {{ preseed_language }} -d-i debian-installer/country string {{ preseed_country }} -d-i debian-installer/locale string {{ preseed_locales | first }} -d-i localechooser/preferred-locale string {{ preseed_locales | first }} -d-i localechooser/supported-locales multiselect {{ preseed_locales | join(', ') }} +d-i debian-installer/language string {{ debian_preseed_language }} +d-i debian-installer/country string {{ debian_preseed_country }} +d-i debian-installer/locale string {{ debian_preseed_locales | first }} +d-i localechooser/preferred-locale string {{ debian_preseed_locales | first }} +d-i localechooser/supported-locales multiselect {{ debian_preseed_locales | join(', ') }} -d-i keyboard-configuration/xkb-keymap select {{ preseed_keyboard_layout }} -d-i keyboard-configuration/layoutcode string {{ preseed_keyboard_layout }} -d-i keyboard-configuration/variantcode string {{ preseed_keyboard_variant }} +d-i keyboard-configuration/xkb-keymap select {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/layoutcode string {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/variantcode string {{ debian_preseed_keyboard_variant }} d-i hw-detect/load_firmware boolean false @@ -47,24 +47,24 @@ d-i passwd/root-password-again password this-very-very-secure-password-will-be-r d-i clock-setup/utc boolean true -d-i time/zone string {{ preseed_timezone }} +d-i time/zone string {{ debian_preseed_timezone }} d-i clock-setup/ntp boolean false -{% if not preseed_manual_partitioning %} +{% if not debian_preseed_manual_partitioning %} {% include 'partman_config.j2' %} {% endif %} -{% if preseed_kernel_image is defined %} -d-i base-installer/kernel/image string {{ preseed_kernel_image }} +{% if debian_preseed_kernel_image is defined %} +d-i base-installer/kernel/image string {{ debian_preseed_kernel_image }} {% endif %} d-i base-installer/install-recommends boolean false d-i apt-setup/security_host string {{ apt_repo_providers[apt_repo_provider].debian_security.host }} d-i apt-setup/security_path string {{ apt_repo_providers[apt_repo_provider].debian_security.path }} -tasksel tasksel/first multiselect {{ preseed_install_tasks | join(', ') }} +tasksel tasksel/first multiselect {{ debian_preseed_install_tasks | join(', ') }} d-i pkgsel/include string openssh-server {{ python_basename }} {{ python_basename }}-apt d-i pkgsel/upgrade select safe-upgrade popularity-contest popularity-contest/participate boolean false @@ -76,13 +76,13 @@ d-i preseed/late_command string \ lvremove -f {{ host_name }}/dummy; \ in-target bash -c "apt-get update -q && apt-get full-upgrade -y -q"; \ in-target bash -c "sed -e 's/^allow-hotplug/auto/' -i /etc/network/interfaces"; \ -{% if preseed_force_net_ifnames_policy is defined %} +{% if debian_preseed_force_net_ifnames_policy is defined %} mkdir -p /target/etc/systemd/network; \ in-target bash -c "echo '[Match]' > /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "echo 'OriginalName=*' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "echo '' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "echo '[Link]' >> /etc/systemd/network/90-namepolicy.link"; \ - in-target bash -c "echo 'NamePolicy={{ preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ + in-target bash -c "echo 'NamePolicy={{ debian_preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "update-initramfs -u"; \ {% endif %} in-target bash -c "passwd -d root && passwd -l root"; \ diff --git a/roles/installer/debian/preseed/templates/preseed_debian-jessie.cfg.j2 b/roles/installer/debian/preseed/templates/preseed_debian-jessie.cfg.j2 index 1a3d6fd0..46a8be9a 100644 --- a/roles/installer/debian/preseed/templates/preseed_debian-jessie.cfg.j2 +++ b/roles/installer/debian/preseed/templates/preseed_debian-jessie.cfg.j2 @@ -2,15 +2,15 @@ # spreadspace preseed file for Debian jessie based machines ######################################################################### -d-i debian-installer/language string {{ preseed_language }} -d-i debian-installer/country string {{ preseed_country }} -d-i debian-installer/locale string {{ preseed_locales | first }} -d-i localechooser/preferred-locale string {{ preseed_locales | first }} -d-i localechooser/supported-locales multiselect {{ preseed_locales | join(', ') }} +d-i debian-installer/language string {{ debian_preseed_language }} +d-i debian-installer/country string {{ debian_preseed_country }} +d-i debian-installer/locale string {{ debian_preseed_locales | first }} +d-i localechooser/preferred-locale string {{ debian_preseed_locales | first }} +d-i localechooser/supported-locales multiselect {{ debian_preseed_locales | join(', ') }} -d-i keyboard-configuration/xkb-keymap select {{ preseed_keyboard_layout }} -d-i keyboard-configuration/layoutcode string {{ preseed_keyboard_layout }} -d-i keyboard-configuration/variantcode string {{ preseed_keyboard_variant }} +d-i keyboard-configuration/xkb-keymap select {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/layoutcode string {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/variantcode string {{ debian_preseed_keyboard_variant }} d-i hw-detect/load_firmware boolean false @@ -47,24 +47,24 @@ d-i passwd/root-password-again password this-very-very-secure-password-will-be-r d-i clock-setup/utc boolean true -d-i time/zone string {{ preseed_timezone }} +d-i time/zone string {{ debian_preseed_timezone }} d-i clock-setup/ntp boolean false -{% if not preseed_manual_partitioning %} +{% if not debian_preseed_manual_partitioning %} {% include 'partman_config.j2' %} {% endif %} -{% if preseed_kernel_image is defined %} -d-i base-installer/kernel/image string {{ preseed_kernel_image }} +{% if debian_preseed_kernel_image is defined %} +d-i base-installer/kernel/image string {{ debian_preseed_kernel_image }} {% endif %} d-i base-installer/install-recommends boolean false d-i apt-setup/security_host string #d-i apt-setup/security_host string -tasksel tasksel/first multiselect {{ preseed_install_tasks | join(', ') }} +tasksel tasksel/first multiselect {{ debian_preseed_install_tasks | join(', ') }} d-i pkgsel/include string openssh-server {{ python_basename }} {{ python_basename }}-apt d-i pkgsel/upgrade select safe-upgrade popularity-contest popularity-contest/participate boolean false @@ -76,10 +76,10 @@ d-i preseed/late_command string \ lvremove -f {{ host_name }}/dummy; \ in-target bash -c "apt-get update -q && apt-get full-upgrade -y -q"; \ in-target bash -c "sed -e 's/^allow-hotplug/auto/' -i /etc/network/interfaces"; \ -{% if preseed_force_net_ifnames_policy is defined %} +{% if debian_preseed_force_net_ifnames_policy is defined %} mkdir -p /target/etc/systemd/network; \ in-target bash -c "echo '[Link]' > /etc/systemd/network/90-namepolicy.link"; \ - in-target bash -c "echo 'NamePolicy={{ preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ + in-target bash -c "echo 'NamePolicy={{ debian_preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "update-initramfs -u"; \ {% endif %} in-target bash -c "passwd -d root && passwd -l root"; \ diff --git a/roles/installer/debian/preseed/templates/preseed_debian-stretch.cfg.j2 b/roles/installer/debian/preseed/templates/preseed_debian-stretch.cfg.j2 index f5227e54..172f1879 100644 --- a/roles/installer/debian/preseed/templates/preseed_debian-stretch.cfg.j2 +++ b/roles/installer/debian/preseed/templates/preseed_debian-stretch.cfg.j2 @@ -2,15 +2,15 @@ # spreadspace preseed file for Debian stretch based machines ######################################################################### -d-i debian-installer/language string {{ preseed_language }} -d-i debian-installer/country string {{ preseed_country }} -d-i debian-installer/locale string {{ preseed_locales | first }} -d-i localechooser/preferred-locale string {{ preseed_locales | first }} -d-i localechooser/supported-locales multiselect {{ preseed_locales | join(', ') }} +d-i debian-installer/language string {{ debian_preseed_language }} +d-i debian-installer/country string {{ debian_preseed_country }} +d-i debian-installer/locale string {{ debian_preseed_locales | first }} +d-i localechooser/preferred-locale string {{ debian_preseed_locales | first }} +d-i localechooser/supported-locales multiselect {{ debian_preseed_locales | join(', ') }} -d-i keyboard-configuration/xkb-keymap select {{ preseed_keyboard_layout }} -d-i keyboard-configuration/layoutcode string {{ preseed_keyboard_layout }} -d-i keyboard-configuration/variantcode string {{ preseed_keyboard_variant }} +d-i keyboard-configuration/xkb-keymap select {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/layoutcode string {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/variantcode string {{ debian_preseed_keyboard_variant }} d-i hw-detect/load_firmware boolean false @@ -47,24 +47,24 @@ d-i passwd/root-password-again password this-very-very-secure-password-will-be-r d-i clock-setup/utc boolean true -d-i time/zone string {{ preseed_timezone }} +d-i time/zone string {{ debian_preseed_timezone }} d-i clock-setup/ntp boolean false -{% if not preseed_manual_partitioning %} +{% if not debian_preseed_manual_partitioning %} {% include 'partman_config.j2' %} {% endif %} -{% if preseed_kernel_image is defined %} -d-i base-installer/kernel/image string {{ preseed_kernel_image }} +{% if debian_preseed_kernel_image is defined %} +d-i base-installer/kernel/image string {{ debian_preseed_kernel_image }} {% endif %} d-i base-installer/install-recommends boolean false d-i apt-setup/security_host string {{ apt_repo_providers[apt_repo_provider].debian_security.host }} d-i apt-setup/security_path string {{ apt_repo_providers[apt_repo_provider].debian_security.path }} -tasksel tasksel/first multiselect {{ preseed_install_tasks | join(', ') }} +tasksel tasksel/first multiselect {{ debian_preseed_install_tasks | join(', ') }} d-i pkgsel/include string openssh-server {{ python_basename }} {{ python_basename }}-apt d-i pkgsel/upgrade select safe-upgrade popularity-contest popularity-contest/participate boolean false @@ -76,10 +76,10 @@ d-i preseed/late_command string \ lvremove -f {{ host_name }}/dummy; \ in-target bash -c "apt-get update -q && apt-get full-upgrade -y -q"; \ in-target bash -c "sed -e 's/^allow-hotplug/auto/' -i /etc/network/interfaces"; \ -{% if preseed_force_net_ifnames_policy is defined %} +{% if debian_preseed_force_net_ifnames_policy is defined %} mkdir -p /target/etc/systemd/network; \ in-target bash -c "echo '[Link]' > /etc/systemd/network/90-namepolicy.link"; \ - in-target bash -c "echo 'NamePolicy={{ preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ + in-target bash -c "echo 'NamePolicy={{ debian_preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "update-initramfs -u"; \ {% endif %} in-target bash -c "passwd -d root && passwd -l root"; \ diff --git a/roles/installer/debian/preseed/templates/preseed_ubuntu-bionic.cfg.j2 b/roles/installer/debian/preseed/templates/preseed_ubuntu-bionic.cfg.j2 index a987a6c2..5768ad9c 100644 --- a/roles/installer/debian/preseed/templates/preseed_ubuntu-bionic.cfg.j2 +++ b/roles/installer/debian/preseed/templates/preseed_ubuntu-bionic.cfg.j2 @@ -2,20 +2,20 @@ # spreadspace preseed file for Ubuntu bionic based machines ######################################################################### -d-i debian-installer/language string {{ preseed_language }} -d-i debian-installer/country string {{ preseed_country }} -d-i debian-installer/locale string {{ preseed_locales | first }} -d-i localechooser/preferred-locale string {{ preseed_locales | first }} -d-i localechooser/supported-locales multiselect {{ preseed_locales | join(', ') }} +d-i debian-installer/language string {{ debian_preseed_language }} +d-i debian-installer/country string {{ debian_preseed_country }} +d-i debian-installer/locale string {{ debian_preseed_locales | first }} +d-i localechooser/preferred-locale string {{ debian_preseed_locales | first }} +d-i localechooser/supported-locales multiselect {{ debian_preseed_locales | join(', ') }} d-i localechooser/translation/warn-light boolean true d-i console-setup/ask_detect boolean false -d-i keyboard-configuration/layoutcode string {{ preseed_keyboard_layout }} -d-i keyboard-configuration/variantcode string {{ preseed_keyboard_variant }} +d-i keyboard-configuration/layoutcode string {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/variantcode string {{ debian_preseed_keyboard_variant }} d-i hw-detect/load_firmware boolean false -{% if preseed_no_netplan %} +{% if debian_preseed_no_netplan %} d-i netcfg/do_not_use_netplan boolean true {% endif %} d-i netcfg/choose_interface select {{ install_interface | default(network_cooked.primary.name) }} @@ -52,21 +52,21 @@ d-i passwd/root-password-again password this-very-very-secure-password-will-be-r d-i clock-setup/utc boolean true -d-i time/zone string {{ preseed_timezone }} +d-i time/zone string {{ debian_preseed_timezone }} d-i clock-setup/ntp boolean false -{% if not preseed_manual_partitioning %} +{% if not debian_preseed_manual_partitioning %} {% include 'partman_config.j2' %} {% endif %} -{% if preseed_kernel_image is defined %} -d-i base-installer/kernel/image string {{ preseed_kernel_image }} -{% elif preseed_virtual_machine %} +{% if debian_preseed_kernel_image is defined %} +d-i base-installer/kernel/image string {{ debian_preseed_kernel_image }} +{% elif debian_preseed_virtual_machine %} d-i base-installer/kernel/image string linux-virtual {% endif %} -{% if preseed_no_splash %} +{% if debian_preseed_no_splash %} d-i debian-installer/splash boolean false d-i debian-installer/add-kernel-opts string nosplash {% endif %} @@ -78,8 +78,8 @@ d-i apt-setup/security_path string {{ apt_repo_providers[apt_repo_provider].ubun d-i apt-setup/multiarch string amd64 {% endif %} -tasksel tasksel/first multiselect {{ preseed_install_tasks | join(', ') }} -d-i pkgsel/include string openssh-server {{ python_basename }} {{ python_basename }}-apt{% if preseed_no_netplan %} ifupdown{% endif %}{{ '' }} +tasksel tasksel/first multiselect {{ debian_preseed_install_tasks | join(', ') }} +d-i pkgsel/include string openssh-server {{ python_basename }} {{ python_basename }}-apt{% if debian_preseed_no_netplan %} ifupdown{% endif %}{{ '' }} d-i pkgsel/upgrade select safe-upgrade popularity-contest popularity-contest/participate boolean false d-i pkgsel/update-policy select none @@ -92,14 +92,14 @@ d-i preseed/late_command string \ in-target bash -c "swapoff -a; sed -e '/^\/swapfile/d' -i /etc/fstab; rm -f /swapfile"; \ in-target bash -c "apt-get update -q && apt-get full-upgrade -y -q"; \ in-target bash -c "env SUDO_FORCE_REMOVE=yes apt-get purge -y -q ubuntu-minimal sudo ubuntu-advantage-tools"; \ -{% if preseed_no_netplan %} +{% if debian_preseed_no_netplan %} in-target bash -c "apt-get purge -y -q netplan.io && apt-get autoremove -y -q && rm -rf /etc/netplan"; \ {% endif %} in-target bash -c "sed -e 's/^allow-hotplug/auto/' -i /etc/network/interfaces"; \ -{% if preseed_force_net_ifnames_policy is defined %} +{% if debian_preseed_force_net_ifnames_policy is defined %} mkdir -p /target/etc/systemd/network; \ in-target bash -c "echo '[Link]' > /etc/systemd/network/90-namepolicy.link"; \ - in-target bash -c "echo 'NamePolicy={{ preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ + in-target bash -c "echo 'NamePolicy={{ debian_preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "update-initramfs -u"; \ {% endif %} in-target bash -c "passwd -d root && passwd -l root"; \ diff --git a/roles/installer/debian/preseed/templates/preseed_ubuntu-focal.cfg.j2 b/roles/installer/debian/preseed/templates/preseed_ubuntu-focal.cfg.j2 index f33098a3..25c5f13d 100644 --- a/roles/installer/debian/preseed/templates/preseed_ubuntu-focal.cfg.j2 +++ b/roles/installer/debian/preseed/templates/preseed_ubuntu-focal.cfg.j2 @@ -2,20 +2,20 @@ # spreadspace preseed file for Ubuntu focal based machines ######################################################################### -d-i debian-installer/language string {{ preseed_language }} -d-i debian-installer/country string {{ preseed_country }} -d-i debian-installer/locale string {{ preseed_locales | first }} -d-i localechooser/preferred-locale string {{ preseed_locales | first }} -d-i localechooser/supported-locales multiselect {{ preseed_locales | join(', ') }} +d-i debian-installer/language string {{ debian_preseed_language }} +d-i debian-installer/country string {{ debian_preseed_country }} +d-i debian-installer/locale string {{ debian_preseed_locales | first }} +d-i localechooser/preferred-locale string {{ debian_preseed_locales | first }} +d-i localechooser/supported-locales multiselect {{ debian_preseed_locales | join(', ') }} d-i localechooser/translation/warn-light boolean true d-i console-setup/ask_detect boolean false -d-i keyboard-configuration/layoutcode string {{ preseed_keyboard_layout }} -d-i keyboard-configuration/variantcode string {{ preseed_keyboard_variant }} +d-i keyboard-configuration/layoutcode string {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/variantcode string {{ debian_preseed_keyboard_variant }} d-i hw-detect/load_firmware boolean false -{% if preseed_no_netplan %} +{% if debian_preseed_no_netplan %} d-i netcfg/do_not_use_netplan boolean true {% endif %} d-i netcfg/choose_interface select {{ install_interface | default(network_cooked.primary.name) }} @@ -52,21 +52,21 @@ d-i passwd/root-password-again password this-very-very-secure-password-will-be-r d-i clock-setup/utc boolean true -d-i time/zone string {{ preseed_timezone }} +d-i time/zone string {{ debian_preseed_timezone }} d-i clock-setup/ntp boolean false -{% if not preseed_manual_partitioning %} +{% if not debian_preseed_manual_partitioning %} {% include 'partman_config.j2' %} {% endif %} -{% if preseed_kernel_image is defined %} -d-i base-installer/kernel/image string {{ preseed_kernel_image }} -{% elif preseed_virtual_machine %} +{% if debian_preseed_kernel_image is defined %} +d-i base-installer/kernel/image string {{ debian_preseed_kernel_image }} +{% elif debian_preseed_virtual_machine %} d-i base-installer/kernel/image string linux-virtual {% endif %} -{% if preseed_no_splash %} +{% if debian_preseed_no_splash %} d-i debian-installer/splash boolean false d-i debian-installer/add-kernel-opts string nosplash {% endif %} @@ -78,8 +78,8 @@ d-i apt-setup/security_path string {{ apt_repo_providers[apt_repo_provider].ubun d-i apt-setup/multiarch string amd64 {% endif %} -tasksel tasksel/first multiselect {{ preseed_install_tasks | join(', ') }} -d-i pkgsel/include string openssh-server {{ python_basename }} {{ python_basename }}-apt{% if preseed_no_netplan %} ifupdown{% endif %}{{ '' }} +tasksel tasksel/first multiselect {{ debian_preseed_install_tasks | join(', ') }} +d-i pkgsel/include string openssh-server {{ python_basename }} {{ python_basename }}-apt{% if debian_preseed_no_netplan %} ifupdown{% endif %}{{ '' }} d-i pkgsel/upgrade select safe-upgrade popularity-contest popularity-contest/participate boolean false d-i pkgsel/update-policy select none @@ -92,17 +92,17 @@ d-i preseed/late_command string \ in-target bash -c "swapoff -a; sed -e '/^\/swapfile/d' -i /etc/fstab; rm -f /swapfile"; \ in-target bash -c "apt-get update -q && apt-get full-upgrade -y -q"; \ in-target bash -c "env SUDO_FORCE_REMOVE=yes apt-get purge -y -q ubuntu-minimal sudo ubuntu-advantage-tools"; \ -{% if preseed_no_netplan %} +{% if debian_preseed_no_netplan %} in-target bash -c "apt-get purge -y -q netplan.io && apt-get autoremove -y -q && rm -rf /etc/netplan"; \ {% endif %} in-target bash -c "sed -e 's/^allow-hotplug/auto/' -i /etc/network/interfaces"; \ -{% if preseed_force_net_ifnames_policy is defined %} +{% if debian_preseed_force_net_ifnames_policy is defined %} mkdir -p /target/etc/systemd/network; \ in-target bash -c "echo '[Match]' > /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "echo 'OriginalName=*' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "echo '' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "echo '[Link]' >> /etc/systemd/network/90-namepolicy.link"; \ - in-target bash -c "echo 'NamePolicy={{ preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ + in-target bash -c "echo 'NamePolicy={{ debian_preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "update-initramfs -u"; \ {% endif %} in-target bash -c "passwd -d root && passwd -l root"; \ diff --git a/roles/installer/debian/preseed/templates/preseed_ubuntu-xenial.cfg.j2 b/roles/installer/debian/preseed/templates/preseed_ubuntu-xenial.cfg.j2 index ae4deeea..248afd67 100644 --- a/roles/installer/debian/preseed/templates/preseed_ubuntu-xenial.cfg.j2 +++ b/roles/installer/debian/preseed/templates/preseed_ubuntu-xenial.cfg.j2 @@ -2,16 +2,16 @@ # spreadspace preseed file for Ubuntu xenial based machines ######################################################################### -d-i debian-installer/language string {{ preseed_language }} -d-i debian-installer/country string {{ preseed_country }} -d-i debian-installer/locale string {{ preseed_locales | first }} -d-i localechooser/preferred-locale string {{ preseed_locales | first }} -d-i localechooser/supported-locales multiselect {{ preseed_locales | join(', ') }} +d-i debian-installer/language string {{ debian_preseed_language }} +d-i debian-installer/country string {{ debian_preseed_country }} +d-i debian-installer/locale string {{ debian_preseed_locales | first }} +d-i localechooser/preferred-locale string {{ debian_preseed_locales | first }} +d-i localechooser/supported-locales multiselect {{ debian_preseed_locales | join(', ') }} d-i localechooser/translation/warn-light boolean true d-i console-setup/ask_detect boolean false -d-i keyboard-configuration/layoutcode string {{ preseed_keyboard_layout }} -d-i keyboard-configuration/variantcode string {{ preseed_keyboard_variant }} +d-i keyboard-configuration/layoutcode string {{ debian_preseed_keyboard_layout }} +d-i keyboard-configuration/variantcode string {{ debian_preseed_keyboard_variant }} d-i hw-detect/load_firmware boolean false @@ -49,21 +49,21 @@ d-i passwd/root-password-again password this-very-very-secure-password-will-be-r d-i clock-setup/utc boolean true -d-i time/zone string {{ preseed_timezone }} +d-i time/zone string {{ debian_preseed_timezone }} d-i clock-setup/ntp boolean false -{% if not preseed_manual_partitioning %} +{% if not debian_preseed_manual_partitioning %} {% include 'partman_config.j2' %} {% endif %} -{% if preseed_kernel_image is defined %} -d-i base-installer/kernel/image string {{ preseed_kernel_image }} -{% elif preseed_virtual_machine %} +{% if debian_preseed_kernel_image is defined %} +d-i base-installer/kernel/image string {{ debian_preseed_kernel_image }} +{% elif debian_preseed_virtual_machine %} d-i base-installer/kernel/image string linux-virtual {% endif %} -{% if preseed_no_splash %} +{% if debian_preseed_no_splash %} d-i debian-installer/splash boolean false d-i debian-installer/add-kernel-opts string nosplash {% endif %} @@ -75,7 +75,7 @@ d-i apt-setup/security_path string {{ apt_repo_providers[apt_repo_provider].ubun d-i apt-setup/multiarch string amd64 {% endif %} -tasksel tasksel/first multiselect {{ preseed_install_tasks | join(', ') }} +tasksel tasksel/first multiselect {{ debian_preseed_install_tasks | join(', ') }} d-i pkgsel/include string openssh-server {{ python_basename }} {{ python_basename }}-apt d-i pkgsel/upgrade select safe-upgrade popularity-contest popularity-contest/participate boolean false @@ -89,10 +89,10 @@ d-i preseed/late_command string \ in-target bash -c "apt-get update -q && apt-get full-upgrade -y -q"; \ in-target bash -c "env SUDO_FORCE_REMOVE=yes apt-get purge -y -q ubuntu-minimal sudo ubuntu-advantage-tools"; \ in-target bash -c "sed -e 's/^allow-hotplug/auto/' -i /etc/network/interfaces"; \ -{% if preseed_force_net_ifnames_policy is defined %} +{% if debian_preseed_force_net_ifnames_policy is defined %} mkdir -p /target/etc/systemd/network; \ in-target bash -c "echo '[Link]' > /etc/systemd/network/90-namepolicy.link"; \ - in-target bash -c "echo 'NamePolicy={{ preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ + in-target bash -c "echo 'NamePolicy={{ debian_preseed_force_net_ifnames_policy }}' >> /etc/systemd/network/90-namepolicy.link"; \ in-target bash -c "update-initramfs -u"; \ {% endif %} in-target bash -c "passwd -d root && passwd -l root"; \ diff --git a/roles/installer/debian/usb/tasks/main.yml b/roles/installer/debian/usb/tasks/main.yml index e02f38e6..491cde3d 100644 --- a/roles/installer/debian/usb/tasks/main.yml +++ b/roles/installer/debian/usb/tasks/main.yml @@ -8,15 +8,15 @@ - name: fail if usb drive mountpoint does not exist run_once: true assert: - that: usb_install_mountpoint.stat.exists - msg: the path to the usb drive does not exist + that: usb_install_mountpoint.stat.exists and usb_install_mountpoint.stat.isdir + msg: the path to the usb drive does not exist or is not a directory - name: download installer run_once: true vars: debian_installer_distro: "{{ install_distro }}" debian_installer_codename: "{{ install_codename }}" - debian_installer_arch: "{{ install.arch | default('amd64') }}" + debian_installer_arch: "{{ install_cooked.arch | default('amd64') }}" debian_installer_variant: netboot import_role: role: installer/debian/fetch @@ -51,8 +51,8 @@ - name: generate host specific initial ramdisk vars: - preseed_initrd: "{{ usb_install_path }}/initrd.{{ inventory_hostname }}.gz" - preseed_tmpdir: "{{ tmpdir.path }}" + debian_preseed_initrd: "{{ usb_install_path }}/initrd.{{ inventory_hostname }}.gz" + debian_preseed_tmpdir: "{{ tmpdir.path }}" import_role: name: installer/debian/preseed @@ -109,12 +109,12 @@ $ sudo syslinux -i /dev/CHANGEME1 -d bios $ sudo fdisk /dev/CHANGEME [Here, make sure partition 1 is marked bootable.] - $ cp /usr/lib/syslinux/modules/bios/* {{ usb_install_path }}/bios/ + $ cp /usr/lib/syslinux/modules/bios/* {{ (usb_install_path, 'bios/') | path_join }} for UEFI these steps need to be done $ sudo apt install syslinux-efi - $ cp /usr/lib/syslinux/modules/efi64/* {{ usb_install_path }}/EFI/boot/ - $ cp /usr/lib/SYSLINUX.EFI/efi64/syslinux.efi {{ usb_install_path }}/EFI/boot/bootx64.efi + $ cp /usr/lib/syslinux/modules/efi64/* {{ (usb_install_path, 'EFI/boot/') | path_join }} + $ cp /usr/lib/SYSLINUX.EFI/efi64/syslinux.efi {{ (usb_install_path, 'EFI/boot/bootx64.efi') | path_join }} This will NOT be done automatically. diff --git a/roles/installer/debian/usb/templates/syslinux.cfg.j2 b/roles/installer/debian/usb/templates/syslinux.cfg.j2 index 98890372..40c877d2 100644 --- a/roles/installer/debian/usb/templates/syslinux.cfg.j2 +++ b/roles/installer/debian/usb/templates/syslinux.cfg.j2 @@ -18,7 +18,7 @@ MENU TITLE {{ install_distro }} / {{ install_codename }} {% for host in ansible_play_hosts_all %} LABEL {{ host }} - MENU LABEL automatic installer for {{ host }} + MENU LABEL automated installer for {{ host }} KERNEL {{ syslinux_base_path }}linux INITRD {{ syslinux_base_path }}initrd.{{ host }}.gz APPEND auto fb=false {{ (hostvars[host].install_cooked.kernel_cmdline | default([])) | join(' ') }} diff --git a/roles/installer/ubuntu/autoinstall/defaults/main.yml b/roles/installer/ubuntu/autoinstall/defaults/main.yml new file mode 100644 index 00000000..4af5a42d --- /dev/null +++ b/roles/installer/ubuntu/autoinstall/defaults/main.yml @@ -0,0 +1,38 @@ +--- +# ubuntu_autoinstall_tmpdir: + +ubuntu_autoinstall_locale: en_US + +ubuntu_autoinstall_keyboard_layout: de +ubuntu_autoinstall_keyboard_variant: nodeadkeys + +ubuntu_autoinstall_timezone: Europe/Vienna + +# ubuntu_autoinstall_kernel_image: +ubuntu_autoinstall_virtual_machine: no + + +ubuntu_autoinstall_efi_esp_size: 128M +ubuntu_autoinstall_swraid_boot_size: 256M + +ubuntu_autoinstall_system_lvm_size_default: all +ubuntu_autoinstall_system_lvm_volumes_default: + - name: root + size: 2.5G + filesystem: ext4 + mountpoint: / + - name: var + size: 1280M + filesystem: ext4 + mountpoint: /var + - name: var+log + size: 768M + filesystem: ext4 + mountpoint: /var/log + mount_options: + - nodev + - noatime + - noexec + + +ubuntu_autoinstall_install_tasks: [] diff --git a/roles/installer/ubuntu/autoinstall/files/early-command.py b/roles/installer/ubuntu/autoinstall/files/early-command.py new file mode 100644 index 00000000..93d72b2d --- /dev/null +++ b/roles/installer/ubuntu/autoinstall/files/early-command.py @@ -0,0 +1,25 @@ +#!/usr/bin/env python3 + +import os +from shutil import copyfile +import yaml + +os.umask(0o077) +copyfile('/autoinstall.yaml', '/autoinstall.yaml_before-early-command') + +config = {} +with open('/autoinstall.yaml', 'r') as file: + config = yaml.safe_load(file) + +try: + for c in config['storage']['config']: + if 'type' not in c or c['type'] != 'disk' or 'path' not in c: + continue + + c['path'] = os.path.realpath(c['path']) + + with open('/autoinstall.yaml', 'w') as file: + yaml.dump(config, file, default_flow_style=False) + +except KeyError: + pass diff --git a/roles/installer/ubuntu/autoinstall/tasks/main.yml b/roles/installer/ubuntu/autoinstall/tasks/main.yml new file mode 100644 index 00000000..a7ea67ba --- /dev/null +++ b/roles/installer/ubuntu/autoinstall/tasks/main.yml @@ -0,0 +1,21 @@ +--- +- name: create autoinstall sub-directory + file: + path: "{{ ubuntu_autoinstall_tmpdir }}/autoinstall/{{ inventory_hostname }}" + state: directory + +- name: create empty meta-data file + copy: + content: "" + dest: "{{ ubuntu_autoinstall_tmpdir }}/autoinstall/{{ inventory_hostname }}/meta-data" + +- name: copy early-command script + run_once: yes + copy: + src: early-command.py + dest: "{{ ubuntu_autoinstall_tmpdir }}/autoinstall/early-command.py" + +- name: generate autoinstall.yml as user-data + template: + src: autoinstall.yml.j2 + dest: "{{ ubuntu_autoinstall_tmpdir }}/autoinstall/{{ inventory_hostname }}/user-data" diff --git a/roles/installer/ubuntu/autoinstall/templates/autoinstall.yml.j2 b/roles/installer/ubuntu/autoinstall/templates/autoinstall.yml.j2 new file mode 100644 index 00000000..e166a78f --- /dev/null +++ b/roles/installer/ubuntu/autoinstall/templates/autoinstall.yml.j2 @@ -0,0 +1,261 @@ +#cloud-config +autoinstall: + version: 1 + early-commands: + - python3 /cdrom/autoinstall/early-command.py + + locale: "{{ ubuntu_autoinstall_locale }}" + keyboard: + layout: "{{ ubuntu_autoinstall_keyboard_layout }}" + variant: "{{ ubuntu_autoinstall_keyboard_variant }}" + toggle: null + + network: + version: 2 + ethernets: + {{ install_interface | default(network_cooked.primary.name) }}: +{% if install_dhcp | default(false) %} + dhcp4: yes +{% else %} + addresses: + - {{ network_cooked.primary.address }} + gateway4: {{ network_cooked.primary.gateway }} +{% if (network_cooked.nameservers | default([]) | length) > 0 %} + nameservers: + search: [ {{ host_domain }} ] + addresses: [ {{ network_cooked.nameservers | join(', ') }} ] +{% endif %} +{% endif %} + + storage: + config: +{% if install_cooked.disks.primary != "software-raid" %} + - id: disk-primary + type: disk + path: {{ install_cooked.disks.primary }} +{% if install_cooked.efi | default(false) %} + ptable: gpt +{% else %} + ptable: msdos + grub_device: true +{% endif %} + wipe: superblock-recursive +{% else %} +{% for raid_member in install_cooked.disks.raid.members %} + - id: raid-disk{{ loop.index }} + type: disk + path: {{ raid_member }} +{% if install_cooked.efi | default(false) %} + ptable: gpt +{% else %} + ptable: msdos + grub_device: true +{% endif %} + wipe: superblock-recursive +{% endfor %} +{% endif %} + +{% if install_cooked.efi | default(false) %} +{% set part_offset = 1 %} +{% if install_cooked.disks.primary != "software-raid" %} + - id: partition-esp + type: partition + device: disk-primary + flag: boot + number: 1 + size: {{ ubuntu_autoinstall_efi_esp_size | human_to_bytes }} + grub_device: true + - id: format-esp + type: format + volume: partition-esp + label: efi + fstype: fat32 + - id: mount-esp + type: mount + device: format-esp + path: /boot/efi +{% else %} +{% for raid_member in install_cooked.disks.raid.members %} + - id: partition-esp{{ loop.index }} + type: partition + device: raid-disk{{ loop.index }} + flag: boot + number: 1 + size: {{ ubuntu_autoinstall_efi_esp_size | human_to_bytes }} + grub_device: true + - id: format-esp{{ loop.index }} + type: format + volume: partition-esp{{ loop.index }} + label: efi + fstype: fat32 + - id: mount-esp{{ loop.index }} + type: mount + device: format-esp{{ loop.index }} + path: /boot/efi +{% endfor %} +{% endif %} + +{% else %} +{% set part_offset = 0 %} +{% endif %} +{% if install_cooked.disks.primary == "software-raid" %} +{% for raid_member in install_cooked.disks.raid.members %} + - id: raid-partition-boot{{ loop.index }} + type: partition + device: raid-disk{{ loop.index }} + number: {{ part_offset + 1 }} + size: {{ ubuntu_autoinstall_swraid_boot_size | human_to_bytes }} +{% endfor %} + - id: partition-boot + type: raid + name: md-boot + raidlevel: {{ install_cooked.disks.raid.level }} + devices: +{% for raid_member in install_cooked.disks.raid.members %} + - raid-partition-boot{{ loop.index }} +{% endfor %} + - id: format-boot + type: format + volume: partition-boot + fstype: ext4 + - id: mount-boot + type: mount + device: format-boot + path: /boot +{% set part_offset = part_offset + 1 %} + +{% endif %} +{% set system_lvm_size = install_cooked.system_lvm.size | default(ubuntu_autoinstall_system_lvm_size_default) %} +{% set system_lvm_volumes = install_cooked.system_lvm.volumes | default(ubuntu_autoinstall_system_lvm_volumes_default) %} +{% if install_cooked.disks.primary != "software-raid" %} + - id: partition-lvm + type: partition + device: disk-primary + flag: linux + number: {{ part_offset + 1 }} +{% if system_lvm_size != 'all' %} + size: {{ system_lvm_size | human_to_bytes }} + - id: partition-unused + type: partition + device: disk-primary + flag: linux + number: {{ part_offset + 2 }} +{% endif %} + size: -1 + +{% else %} +{% for raid_member in install_cooked.disks.raid.members %} + - id: raid-partition-lvm{{ loop.index }} + type: partition + device: raid-disk{{ loop.index }} + number: {{ part_offset + 1 }} +{% if system_lvm_size != 'all' %} + size: {{ system_lvm_size | human_to_bytes }} + - id: raid-partition-unused{{ loop.index }} + type: partition + device: raid-disk{{ loop.index }} + flag: linux + number: {{ part_offset + 2 }} +{% endif %} + size: -1 +{% endfor %} + - id: partition-lvm + type: raid + name: md-lvm + raidlevel: {{ install_cooked.disks.raid.level }} + devices: +{% for raid_member in install_cooked.disks.raid.members %} + - raid-partition-lvm{{ loop.index }} +{% endfor %} + +{% endif %} + - id: lvm-vg-system + type: lvm_volgroup + devices: + - partition-lvm + name: {{ host_name }} + +{% for volume in system_lvm_volumes %} + - id: lvm-lv-{{ volume.name }} + type: lvm_partition + volgroup: lvm-vg-system + name: {{ volume.name }} + size: {{ volume.size | human_to_bytes }} + - id: format-{{ volume.name }} + type: format + fstype: {{ volume.filesystem }} + volume: lvm-lv-{{ volume.name }} + - id: mount-{{ volume.name }} + type: mount + device: format-{{ volume.name }} + path: {{ volume.mountpoint }} +{% if 'mount_options' in volume and (volume.mount_options | length) > 0 %} + options: '{{ volume.mount_options | join(",") }}' +{% endif %} + +{% endfor %} + apt: + primary: + - uri: http://{{ apt_repo_providers[apt_repo_provider].ubuntu.host }}{{ apt_repo_providers[apt_repo_provider].ubuntu.path }} + arches: + - amd64 + + user-data: + hostname: "{{ host_name }}" + timezone: "{{ ubuntu_autoinstall_timezone }}" + disable_root: false + users: + - name: root + ssh_authorized_keys: +{% for key in ssh_keys_root %} + - {{ key }} +{% endfor %} + runcmd: + - [ apt-get, -y, -q, purge, snapd, cloud-init, cloud-guest-utils, cloud-initramfs-copymods, cloud-initramfs-dyn-netconf, python3-cryptography, gpg, sosreport, update-notifier-common, ssh-import-id ] + - [ rm, -rf, /etc/cloud, /var/lib/cloud ] + - [ apt-get, -y, -q, auto-remove ] + - [ bash, -c, 'dpkg -l | grep "^rc" | awk "{ print(\$2) }" | xargs dpkg -P' ] +{% if ubuntu_autoinstall_virtual_machine %} + - [ poweroff ] +{% endif %} + + ssh: + install-server: true + + packages: + - python3 + - python3-apt +{% for task in ubuntu_autoinstall_install_tasks %} + - {{ task }}^ +{% endfor %} + + late-commands: + - curtin in-target --target=/target -- swapoff -a; sed -e '/^\/swapfile/d' -i /etc/fstab; rm -f /swapfile +{% if ansible_port is defined %} + - curtin in-target --target=/target -- sed -e 's/^\(\s*#*\s*Port.*\)/Port {{ ansible_port }}/' -i /etc/ssh/sshd_config +{% endif %} + - curtin in-target --target=/target -- apt-mark manual iputils-ping isc-dhcp-client netcat-openbsd netplan.io sudo + - curtin in-target --target=/target -- apt-get -y -q purge policykit-1 multipath-tools ubuntu-minimal unattended-upgrades sound-theme-freedesktop thin-provisioning-tools cryptsetup byobu open-iscsi btrfs-progs pollinate lxd-agent-loader open-vm-tools +{% if install_cooked.disks.primary != "software-raid" %} + - curtin in-target --target=/target -- apt-get -y -q purge mdadm +{% endif %} + - curtin in-target --target=/target -- env SUDO_FORCE_REMOVE=yes apt-get -y -q purge sudo + - curtin in-target --target=/target -- apt-get -y -q autoremove + - curtin in-target --target=/target -- bash -c 'dpkg -l | grep "^rc" | awk "{ print(\$2) }" | xargs dpkg -P' +{# purging the snapd package here would trigger a bug in den postrm script because some filesystems in /run/ can not be unmounted... #} +{# to workadound this issue we only remove the package here and rely on cloud-init to fully purge it on first boot (see user-data: above) #} + - curtin in-target --target=/target -- apt-get -y -q remove snapd + - curtin in-target --target=/target -- bash -c 'apt-get update -q && apt-get full-upgrade -y -q' +{% if ubuntu_autoinstall_kernel_image is defined or ubuntu_autoinstall_virtual_machine %} + +write_files: + - path: /run/kernel-meta-package + content: | +{% if ubuntu_autoinstall_kernel_image is defined %} + {{ ubuntu_autoinstall_kernel_image }} +{% else %} + linux-virtual +{% endif %} + owner: root:root + permissions: "0644" +{% endif %} diff --git a/roles/installer/ubuntu/base/tasks/main.yml b/roles/installer/ubuntu/base/tasks/main.yml new file mode 100644 index 00000000..c48ed4b5 --- /dev/null +++ b/roles/installer/ubuntu/base/tasks/main.yml @@ -0,0 +1,15 @@ +--- +- name: install gpgv + apt: + name: gpgv + state: present + +- name: prepare directory keyrings + file: + name: "{{ installer_base_path }}/keyrings" + state: directory + +- name: copy ubuntu cdimage keyring file + copy: + src: "{{ global_files_dir }}/common/keyrings/ubuntu-cdimage.gpg" + dest: "{{ installer_base_path }}/keyrings/ubuntu-cdimage.gpg" diff --git a/roles/installer/ubuntu/fetch/defaults/main.yml b/roles/installer/ubuntu/fetch/defaults/main.yml new file mode 100644 index 00000000..f6ac2bc0 --- /dev/null +++ b/roles/installer/ubuntu/fetch/defaults/main.yml @@ -0,0 +1,7 @@ +--- +# ubuntu_installer_codename: bionic | focal +ubuntu_installer_arch: amd64 +# ubuntu_installer_variant: live-server | desktop +# ubuntu_installer_version: 20.04.1 + +ubuntu_installer_force_download: no diff --git a/roles/installer/ubuntu/fetch/tasks/fetch-latest.yml b/roles/installer/ubuntu/fetch/tasks/fetch-latest.yml new file mode 100644 index 00000000..9baa6d97 --- /dev/null +++ b/roles/installer/ubuntu/fetch/tasks/fetch-latest.yml @@ -0,0 +1,13 @@ +--- +- name: downloading SHA256SUMS and signature file for latest release + loop: + - SHA256SUMS + - SHA256SUMS.gpg + get_url: + url: "https://releases.ubuntu.com/{{ ubuntu_installer_codename }}/{{ item }}" + dest: "{{ ubuntu_installer_target_dir }}/{{ item }}" + force: "{{ ubuntu_installer_force_download }}" + +- name: set download url to releases.ubuntu.com + set_fact: + ubuntu_installer_base_url: "https://releases.ubuntu.com/{{ ubuntu_installer_codename }}" diff --git a/roles/installer/ubuntu/fetch/tasks/fetch-version.yml b/roles/installer/ubuntu/fetch/tasks/fetch-version.yml new file mode 100644 index 00000000..868adc95 --- /dev/null +++ b/roles/installer/ubuntu/fetch/tasks/fetch-version.yml @@ -0,0 +1,41 @@ +--- +## we need to try old-releases.ubuntu.com first because otherwise it would be impossible to download the initial release +## of any codename release. (i.e. 20.04) +- name: try downloading SHA256SUMS and signature file from old-releases.ubuntu.com + loop: + - SHA256SUMS + - SHA256SUMS.gpg + get_url: + url: "https://old-releases.ubuntu.com/releases/{{ ubuntu_installer_version }}/{{ item }}" + dest: "{{ ubuntu_installer_target_dir }}/{{ item }}" + force: yes + register: ubuntu_installer_old + failed_when: "'status_code' in ubuntu_installer_old and ubuntu_installer_old.status_code not in [200, 404]" + +- when: 404 not in (ubuntu_installer_old.results | selectattr('status_code', 'defined') | map(attribute='status_code') | list) + block: + - name: check if SHA256SUM actually contains the correct iso + command: grep -E '^[0-9a-z]{64}\s+\*ubuntu-{{ ubuntu_installer_version }}-{{ ubuntu_installer_variant }}-{{ ubuntu_installer_arch }}.iso$' "{{ ubuntu_installer_target_dir }}/SHA256SUMS" + changed_when: false + failed_when: false + register: ubuntu_installer_old_sha256sum + + - name: set download url to old-releases.ubuntu.com + when: (ubuntu_installer_old_sha256sum.stdout_lines | length) > 0 + set_fact: + ubuntu_installer_base_url: "https://old-releases.ubuntu.com/releases/{{ ubuntu_installer_version }}" + +- when: ubuntu_installer_base_url is not defined + block: + - name: try downloading SHA256SUMS and signature file from releases.ubuntu.com + loop: + - SHA256SUMS + - SHA256SUMS.gpg + get_url: + url: "https://releases.ubuntu.com/{{ ubuntu_installer_version }}/{{ item }}" + dest: "{{ ubuntu_installer_target_dir }}/{{ item }}" + force: yes + + - name: set download url to releases.ubuntu.com + set_fact: + ubuntu_installer_base_url: "https://releases.ubuntu.com/{{ ubuntu_installer_version }}" diff --git a/roles/installer/ubuntu/fetch/tasks/main.yml b/roles/installer/ubuntu/fetch/tasks/main.yml new file mode 100644 index 00000000..618cfd22 --- /dev/null +++ b/roles/installer/ubuntu/fetch/tasks/main.yml @@ -0,0 +1,43 @@ +--- +- name: prepare directories for installer files + file: + name: "{{ ubuntu_installer_target_dir }}" + state: directory + +- include_tasks: "fetch-{{ (ubuntu_installer_version is defined) | ternary('version', 'latest') }}.yml" + +- name: verfiy signature of SHA256SUMS file + command: >- + gpgv --keyring "{{ installer_keyrings_path | default(installer_base_path+'/keyrings') }}/ubuntu-cdimage.gpg" + "{{ ubuntu_installer_target_dir }}/SHA256SUMS.gpg" "{{ ubuntu_installer_target_dir }}/SHA256SUMS" + changed_when: False + register: ubuntu_installer_gpg_result + +- debug: + var: ubuntu_installer_gpg_result.stderr_lines + + +- name: download and verify installer files + block: + - name: extract file hash from SHA256SUMS + command: grep -E '^[0-9a-z]{64}\s+\*ubuntu-{{ ubuntu_installer_version | default("[0-9.]+") }}-{{ ubuntu_installer_variant }}-{{ ubuntu_installer_arch }}.iso$' "{{ ubuntu_installer_target_dir }}/SHA256SUMS" + changed_when: false + register: ubuntu_installer_sha256sum + + - name: extract filename from SHA256SUM + set_fact: + ubuntu_installer_filename: "{{ (ubuntu_installer_sha256sum.stdout.split(' ') | last)[1:] }}" + + - debug: + msg: "will be downloading: {{ ubuntu_installer_base_url }}/{{ ubuntu_installer_filename }} (this will probably take a while...)" + + - name: download/verify installer file + get_url: + url: "{{ ubuntu_installer_base_url }}/{{ ubuntu_installer_filename }}" + dest: "{{ ubuntu_installer_target_dir }}/{{ ubuntu_installer_filename }}" + checksum: "sha256:{{ ubuntu_installer_sha256sum.stdout.split(' ') | first }}" + force: "{{ ubuntu_installer_force_download }}" + + rescue: + - fail: + msg: "download/verification of installer files failed. Is the cd-image variant '{{ ubuntu_installer_variant }}' available for {{ ubuntu_installer_codename }}?" diff --git a/roles/installer/ubuntu/fetch/vars/main.yml b/roles/installer/ubuntu/fetch/vars/main.yml new file mode 100644 index 00000000..caf1fa67 --- /dev/null +++ b/roles/installer/ubuntu/fetch/vars/main.yml @@ -0,0 +1,2 @@ +--- +ubuntu_installer_target_dir: "{{ installer_base_path }}/{{ ubuntu_installer_codename }}/{{ ubuntu_installer_version | default('latest') }}-{{ ubuntu_installer_variant }}" diff --git a/roles/installer/ubuntu/iso/defaults/main.yml b/roles/installer/ubuntu/iso/defaults/main.yml new file mode 100644 index 00000000..cf498757 --- /dev/null +++ b/roles/installer/ubuntu/iso/defaults/main.yml @@ -0,0 +1,5 @@ +--- +ubuntu_installer_iso_variant: live-server +# ubuntu_installer_iso_variant: desktop + +iso_install_target_dir: "{{ global_artifacts_dir }}/{{ inventory_hostname }}/ubuntu-installer" diff --git a/roles/installer/ubuntu/iso/tasks/main.yml b/roles/installer/ubuntu/iso/tasks/main.yml new file mode 100644 index 00000000..ecfc2265 --- /dev/null +++ b/roles/installer/ubuntu/iso/tasks/main.yml @@ -0,0 +1,55 @@ +--- +- name: download installer + run_once: true + vars: + ubuntu_installer_codename: "{{ install_codename }}" + ubuntu_installer_arch: "{{ install_cooked.arch | default('amd64') }}" + ubuntu_installer_variant: "{{ ubuntu_installer_iso_variant }}" + import_role: + role: installer/ubuntu/fetch + +- block: + - name: create temporary workdir + tempfile: + prefix: "iso-install.{{ inventory_hostname }}." + state: directory + register: tmpdir + + - name: generate autoinstall files + vars: + ubuntu_autoinstall_tmpdir: "{{ tmpdir.path }}" + import_role: + name: installer/ubuntu/autoinstall + + - name: generate isolinux configuration for BIOS boot + template: + src: isolinux.cfg.j2 + dest: "{{ tmpdir.path }}/isolinux.cfg" + + - name: generate grub configuration for UEFI boot + template: + src: grub.cfg.j2 + dest: "{{ tmpdir.path }}/grub.cfg" + + + - name: create destination directory + file: + path: "{{ iso_install_target_dir }}" + state: directory + + - name: make sure target image does not exist + file: + path: "{{ iso_install_target_dir }}/{{ inventory_hostname }}.iso" + state: absent + + - name: generate target iso image + command: xorriso -indev "{{ ubuntu_installer_target_dir }}/{{ ubuntu_installer_filename }}" -outdev "{{ iso_install_target_dir }}/{{ inventory_hostname }}.iso" -pathspecs on -boot_image any replay -update isolinux.cfg /isolinux/isolinux.cfg -update grub.cfg /boot/grub/grub.cfg -add /autoinstall=autoinstall + args: + chdir: "{{ tmpdir.path }}" + + always: + - name: cleanup temporary workdir + when: tmpdir.path is defined + file: + path: "{{ tmpdir.path }}" + state: absent diff --git a/roles/installer/ubuntu/iso/templates/grub.cfg.j2 b/roles/installer/ubuntu/iso/templates/grub.cfg.j2 new file mode 100644 index 00000000..ccbc25eb --- /dev/null +++ b/roles/installer/ubuntu/iso/templates/grub.cfg.j2 @@ -0,0 +1,18 @@ +if loadfont $prefix/font.pf2 ; then + set gfxmode=auto + insmod efi_gop + insmod efi_uga + insmod gfxterm + terminal_output gfxterm +fi + +set menu_color_normal=white/black +set menu_color_highlight=black/light-gray +set timeout=10 +set default=0 + +menuentry "automated installer for {{ inventory_hostname }}" { + set gfxpayload=keep + linux /casper/vmlinuz quiet nopersistent autoinstall "ds=nocloud;s=/cdrom/autoinstall/{{ inventory_hostname }}/" {{ (install_cooked.kernel_cmdline | default([])) | join(' ') }} + initrd /casper/initrd +} diff --git a/roles/installer/ubuntu/iso/templates/isolinux.cfg.j2 b/roles/installer/ubuntu/iso/templates/isolinux.cfg.j2 new file mode 100644 index 00000000..99401b8b --- /dev/null +++ b/roles/installer/ubuntu/iso/templates/isolinux.cfg.j2 @@ -0,0 +1,15 @@ +DEFAULT {{ inventory_hostname }} +TIMEOUT 100 +PROMPT 1 +SAY ***************************************** +SAY ** +SAY ** Distro: {{ install_distro }} +SAY ** Codename: {{ install_codename }} +SAY ** +SAY ** will be booting automated installer for {{ inventory_hostname }} in 10s ... +SAY ** + +LABEL {{ inventory_hostname }} + KERNEL /casper/vmlinuz + INITRD /casper/initrd + APPEND quiet nopersistent autoinstall ds=nocloud;s=/cdrom/autoinstall/{{ inventory_hostname }}/ {{ (install_cooked.kernel_cmdline | default([])) | join(' ') }} diff --git a/roles/installer/ubuntu/usb/defaults/main.yml b/roles/installer/ubuntu/usb/defaults/main.yml new file mode 100644 index 00000000..5467946d --- /dev/null +++ b/roles/installer/ubuntu/usb/defaults/main.yml @@ -0,0 +1,6 @@ +--- +ubuntu_installer_usb_variant: live-server +# ubuntu_installer_usb_variant: desktop + +### path to the unmounted usb drive (/dev/...) +# installer_ubuntu_usb_devicepath diff --git a/roles/installer/ubuntu/usb/tasks/main.yml b/roles/installer/ubuntu/usb/tasks/main.yml new file mode 100644 index 00000000..c7eb9e41 --- /dev/null +++ b/roles/installer/ubuntu/usb/tasks/main.yml @@ -0,0 +1,71 @@ +--- +- name: check if usb drive device exists + run_once: true + stat: + path: "{{ usb_install_path }}" + register: usb_install_device + +- name: fail if usb drive path is not a device + run_once: true + assert: + that: usb_install_device.stat.exists and usb_install_device.stat.isblk + msg: the path to the usb drive does not exist or is not a block device + +- name: download installer + run_once: true + vars: + ubuntu_installer_codename: "{{ install_codename }}" + ubuntu_installer_arch: "{{ install_cooked.arch | default('amd64') }}" + ubuntu_installer_variant: "{{ ubuntu_installer_usb_variant }}" + import_role: + role: installer/ubuntu/fetch + +- name: write ISO image to usb stick + pause: + prompt: | + Please write the image to the USB drive using something like this: + + $ sudo ddrescue {{ (ubuntu_installer_target_dir, ubuntu_installer_filename) | path_join | realpath }} {{ usb_install_path }} -D --force + + This will NOT be done automatically. + +- block: + - name: create temporary workdir + run_once: true + tempfile: + prefix: "usb-install.{{ inventory_hostname }}." + state: directory + register: tmpdir + + - name: generate autoinstall files + vars: + ubuntu_autoinstall_tmpdir: "{{ tmpdir.path }}" + import_role: + name: installer/ubuntu/autoinstall + + - name: generate isolinux configuration for BIOS boot + run_once: true + template: + src: isolinux.cfg.j2 + dest: "{{ tmpdir.path }}/isolinux.cfg" + + - name: generate grub configuration for UEFI boot + run_once: true + template: + src: grub.cfg.j2 + dest: "{{ tmpdir.path }}/grub.cfg" + + - name: update iso9660 filesystem on installer usb drive + run_once: true + become: yes + command: xorriso -dev "stdio:{{ usb_install_path }}" -pathspecs on -boot_image any replay -update isolinux.cfg /isolinux/isolinux.cfg -update grub.cfg /boot/grub/grub.cfg -find / -disk_name autoinstall -type d -exec rm_r -- -add /autoinstall=autoinstall + args: + chdir: "{{ tmpdir.path }}" + + always: + - name: cleanup temporary workdir + run_once: true + when: tmpdir.path is defined + file: + path: "{{ tmpdir.path }}" + state: absent diff --git a/roles/installer/ubuntu/usb/templates/grub.cfg.j2 b/roles/installer/ubuntu/usb/templates/grub.cfg.j2 new file mode 100644 index 00000000..adeb5672 --- /dev/null +++ b/roles/installer/ubuntu/usb/templates/grub.cfg.j2 @@ -0,0 +1,22 @@ +if loadfont $prefix/font.pf2 ; then + set gfxmode=auto + insmod efi_gop + insmod efi_uga + insmod gfxterm + terminal_output gfxterm +fi + +set menu_color_normal=white/black +set menu_color_highlight=black/light-gray +{% if (ansible_play_hosts_all | length) == 1 %} +set timeout=10 +set default=0 +{% endif %} +{% for host in ansible_play_hosts_all %} + +menuentry "automated installer for {{ host }}" { + set gfxpayload=keep + linux /casper/vmlinuz quiet nopersistent autoinstall "ds=nocloud;s=/cdrom/autoinstall/{{ host }}/" {{ (hostvars[host].install_cooked.kernel_cmdline | default([])) | join(' ') }} + initrd /casper/initrd +} +{% endfor %} diff --git a/roles/installer/ubuntu/usb/templates/isolinux.cfg.j2 b/roles/installer/ubuntu/usb/templates/isolinux.cfg.j2 new file mode 100644 index 00000000..03d581d4 --- /dev/null +++ b/roles/installer/ubuntu/usb/templates/isolinux.cfg.j2 @@ -0,0 +1,25 @@ +{% if (ansible_play_hosts_all | length) == 1 %} +DEFAULT {{ inventory_hostname }} +TIMEOUT 100 +PROMPT 1 +SAY ***************************************** +SAY ** +SAY ** Distro: {{ install_distro }} +SAY ** Codename: {{ install_codename }} +SAY ** +SAY ** will be booting automated installer for {{ inventory_hostname }} in 10s ... +SAY ** +{% else %} +DEFAULT menu.c32 +TIMEOUT 0 +PROMPT 0 +MENU TITLE {{ install_distro }} / {{ install_codename }} +{% endif %} +{% for host in ansible_play_hosts_all %} + +LABEL {{ host }} + MENU LABEL automated installer for {{ host }} + KERNEL /casper/vmlinuz + INITRD /casper/initrd + APPEND quiet nopersistent autoinstall ds=nocloud;s=/cdrom/autoinstall/{{ host }}/ {{ (hostvars[host].install_cooked.kernel_cmdline | default([])) | join(' ') }} +{% endfor %} diff --git a/roles/vm/guest/install/tasks/installer-debian.yml b/roles/vm/guest/install/tasks/installer-debian.yml index 9e484b88..ab7342da 100644 --- a/roles/vm/guest/install/tasks/installer-debian.yml +++ b/roles/vm/guest/install/tasks/installer-debian.yml @@ -21,11 +21,11 @@ - name: generate host specific initial ramdisk vars: - preseed_initrd: "{{ tmpdir.path }}/initrd.gz" - preseed_tmpdir: "{{ tmpdir.path }}" - preseed_virtual_machine: yes - preseed_force_net_ifnames_policy: path - preseed_no_netplan: yes + debian_preseed_initrd: "{{ tmpdir.path }}/initrd.gz" + debian_preseed_tmpdir: "{{ tmpdir.path }}" + debian_preseed_virtual_machine: yes + debian_preseed_force_net_ifnames_policy: path + debian_preseed_no_netplan: yes install_interface: enp1s1 import_role: name: installer/debian/preseed |