diff options
| -rw-r--r-- | chaos-at-home/ch-router-obsd.yml | 2 | ||||
| -rw-r--r-- | roles/base/tasks/Debian.yml | 124 | ||||
| -rw-r--r-- | roles/base/tasks/OpenBSD.yml | 14 | ||||
| -rw-r--r-- | roles/base/tasks/main.yml | 135 | ||||
| -rw-r--r-- | roles/installer/openbsd/autoinstall/templates/install.site.j2 | 6 |
5 files changed, 156 insertions, 125 deletions
diff --git a/chaos-at-home/ch-router-obsd.yml b/chaos-at-home/ch-router-obsd.yml index fe3ef36f..76b79316 100644 --- a/chaos-at-home/ch-router-obsd.yml +++ b/chaos-at-home/ch-router-obsd.yml @@ -2,6 +2,6 @@ - name: Basic Setup hosts: ch-router-obsd roles: - #- role: base + - role: base - role: sshd - role: zsh diff --git a/roles/base/tasks/Debian.yml b/roles/base/tasks/Debian.yml new file mode 100644 index 00000000..25195ad2 --- /dev/null +++ b/roles/base/tasks/Debian.yml @@ -0,0 +1,124 @@ +--- +- name: load distrubtion specific variables + include_vars: "{{ item }}" + with_first_found: + - files: + - "{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}.yml" + skip: true + +- name: disable recommends and suggests + copy: + src: 02no-recommends + dest: /etc/apt/apt.conf.d/ + +- name: install base system tools + apt: + name: + - htop + - dstat + - lsof + - gawk + - psmisc + - less + - debian-goodies + - screen + - mtr-tiny + - tcpdump + - iptraf-ng + - unp + - dbus + - libpam-systemd + - aptitude + - ca-certificates + - file + - man-db + - manpages + - nano + state: present + +- name: install extra packages + apt: + name: "{{ base_packages_extra_host | union(base_packages_extra_group) }}" + state: present + +- name: install rngd + when: base_entropy_generator == 'rngd' + block: + - name: install rngd + apt: + name: "{{ base_rngd_package_name }}" + state: present + + - name: make sure haveged is removed/purged + apt: + name: haveged + state: absent + purge: yes + + +- name: install haveged + when: base_entropy_generator == 'haveged' + block: + - name: install haveged + apt: + name: haveged + state: present + + - name: make sure rngd is removed/purged + apt: + name: "{{ base_rngd_package_name }}" + state: absent + purge: yes + + +- name: Ensure /root is not world accessible + file: + path: /root + mode: 0700 + owner: root + group: root + state: directory + +- name: disable net/fs/misc kernel modules + loop: "{{ modules_blacklist.net | union(modules_blacklist.fs) | union(modules_blacklist.misc) }}" + lineinfile: + dest: /etc/modprobe.d/disablemod.conf + line: "install {{ item }} /bin/true" + create: yes + owner: root + group: root + mode: 0644 + +- name: Change various sysctl-settings, look at the sysctl-vars file for documentation + loop: "{{ sysctl_config | combine(sysctl_config_user) | dict2items }}" + loop_control: + label: "{{ item.key }} = {{ item.value }}" + sysctl: + name: "{{ item.key }}" + value: "{{ item.value }}" + sysctl_set: yes + state: present + reload: yes + ignoreerrors: yes + +- name: set kernel command line options + lineinfile: + path: /etc/default/grub + regexp: '^#?GRUB_CMDLINE_LINUX=' + line: 'GRUB_CMDLINE_LINUX="{{ install.kernel_cmdline | join(" ") }}"' + when: install is defined and install.kernel_cmdline is defined + notify: update grub + +- name: disable TSO (intel nic stability fix) + when: base_intel_nic_stability_fix + copy: + content: | + [Match] + MACAddress={{ ansible_default_ipv4.macaddress }} + + [Link] + TCPSegmentationOffload=false + GenericSegmentationOffload=false + GenericReceiveOffload=false + dest: /etc/systemd/network/00-disable-offloading.link diff --git a/roles/base/tasks/OpenBSD.yml b/roles/base/tasks/OpenBSD.yml new file mode 100644 index 00000000..4b64105c --- /dev/null +++ b/roles/base/tasks/OpenBSD.yml @@ -0,0 +1,14 @@ +--- +- name: install base system tools + openbsd_pkg: + name: + - htop + - screen-- + - mtr-- + - nano + state: present + +- name: install extra packages + openbsd_pkg: + name: "{{ base_packages_extra_host | union(base_packages_extra_group) }}" + state: present diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml index 3f1d9bee..5484a3a6 100644 --- a/roles/base/tasks/main.yml +++ b/roles/base/tasks/main.yml @@ -1,72 +1,15 @@ --- -- name: load distrubtion specific variables - include_vars: "{{ item }}" - with_first_found: - - files: - - "{{ ansible_distribution_release }}.yml" - - "{{ ansible_distribution }}.yml" - skip: true - -- name: disable recommends and suggests - copy: - src: 02no-recommends - dest: /etc/apt/apt.conf.d/ - -- name: install base system tools - apt: - name: - - htop - - dstat - - lsof - - gawk - - psmisc - - less - - debian-goodies - - screen - - mtr-tiny - - tcpdump - - iptraf-ng - - unp - - dbus - - libpam-systemd - - aptitude - - ca-certificates - - file - - man-db - - manpages - - nano - state: present - - -- name: install rngd - when: base_entropy_generator == 'rngd' - block: - - name: install rngd - apt: - name: "{{ base_rngd_package_name }}" - state: present - - - name: make sure haveged is removed/purged - apt: - name: haveged - state: absent - purge: yes - - -- name: install haveged - when: base_entropy_generator == 'haveged' - block: - - name: install haveged - apt: - name: haveged - state: present - - - name: make sure rngd is removed/purged - apt: - name: "{{ base_rngd_package_name }}" - state: absent - purge: yes - +- name: load os/distrubtion/version specific tasks + vars: + params: + files: + - "{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}.yml" + - "{{ ansible_os_family }}.yml" + loop: "{{ q('first_found', params) }}" + loop_control: + loop_var: tasks_file + include_tasks: "{{ tasks_file }}" - name: Remove startup message from screen lineinfile: @@ -93,59 +36,3 @@ copy: src: "{{ global_files_dir }}/common/htoprc" dest: "{{ item }}/.config/htop/" - -- name: Ensure /root is not world accessible - file: - path: /root - mode: 0700 - owner: root - group: root - state: directory - -- name: disable net/fs/misc kernel modules - loop: "{{ modules_blacklist.net | union(modules_blacklist.fs) | union(modules_blacklist.misc) }}" - lineinfile: - dest: /etc/modprobe.d/disablemod.conf - line: "install {{ item }} /bin/true" - create: yes - owner: root - group: root - mode: 0644 - -- name: Change various sysctl-settings, look at the sysctl-vars file for documentation - loop: "{{ sysctl_config | combine(sysctl_config_user) | dict2items }}" - loop_control: - label: "{{ item.key }} = {{ item.value }}" - sysctl: - name: "{{ item.key }}" - value: "{{ item.value }}" - sysctl_set: yes - state: present - reload: yes - ignoreerrors: yes - -- name: install extra packages - apt: - name: "{{ base_packages_extra_host | union(base_packages_extra_group) }}" - state: present - -- name: set kernel command line options - lineinfile: - path: /etc/default/grub - regexp: '^#?GRUB_CMDLINE_LINUX=' - line: 'GRUB_CMDLINE_LINUX="{{ install.kernel_cmdline | join(" ") }}"' - when: install is defined and install.kernel_cmdline is defined - notify: update grub - -- name: disable TSO (intel nic stability fix) - when: base_intel_nic_stability_fix - copy: - content: | - [Match] - MACAddress={{ ansible_default_ipv4.macaddress }} - - [Link] - TCPSegmentationOffload=false - GenericSegmentationOffload=false - GenericReceiveOffload=false - dest: /etc/systemd/network/00-disable-offloading.link diff --git a/roles/installer/openbsd/autoinstall/templates/install.site.j2 b/roles/installer/openbsd/autoinstall/templates/install.site.j2 index d12ed461..82928daa 100644 --- a/roles/installer/openbsd/autoinstall/templates/install.site.j2 +++ b/roles/installer/openbsd/autoinstall/templates/install.site.j2 @@ -16,5 +16,11 @@ sed -e 's/^\(\s*#*\s*Port.*\)/Port {{ hostvars[hostname].ansible_port }}/' -i /e echo "Installing python" pkg_add -Im python%3.7 +echo "Disable sndiod service on first boot" +cat <<EOF >> /etc/rc.firsttime + +rcctl disable sndiod +rcctl stop sndiod +EOF rm /install.site |