summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--chaos-at-home/ch-router-obsd.yml2
-rw-r--r--roles/base/tasks/Debian.yml124
-rw-r--r--roles/base/tasks/OpenBSD.yml14
-rw-r--r--roles/base/tasks/main.yml135
-rw-r--r--roles/installer/openbsd/autoinstall/templates/install.site.j26
5 files changed, 156 insertions, 125 deletions
diff --git a/chaos-at-home/ch-router-obsd.yml b/chaos-at-home/ch-router-obsd.yml
index fe3ef36f..76b79316 100644
--- a/chaos-at-home/ch-router-obsd.yml
+++ b/chaos-at-home/ch-router-obsd.yml
@@ -2,6 +2,6 @@
- name: Basic Setup
hosts: ch-router-obsd
roles:
- #- role: base
+ - role: base
- role: sshd
- role: zsh
diff --git a/roles/base/tasks/Debian.yml b/roles/base/tasks/Debian.yml
new file mode 100644
index 00000000..25195ad2
--- /dev/null
+++ b/roles/base/tasks/Debian.yml
@@ -0,0 +1,124 @@
+---
+- name: load distrubtion specific variables
+ include_vars: "{{ item }}"
+ with_first_found:
+ - files:
+ - "{{ ansible_distribution_release }}.yml"
+ - "{{ ansible_distribution }}.yml"
+ skip: true
+
+- name: disable recommends and suggests
+ copy:
+ src: 02no-recommends
+ dest: /etc/apt/apt.conf.d/
+
+- name: install base system tools
+ apt:
+ name:
+ - htop
+ - dstat
+ - lsof
+ - gawk
+ - psmisc
+ - less
+ - debian-goodies
+ - screen
+ - mtr-tiny
+ - tcpdump
+ - iptraf-ng
+ - unp
+ - dbus
+ - libpam-systemd
+ - aptitude
+ - ca-certificates
+ - file
+ - man-db
+ - manpages
+ - nano
+ state: present
+
+- name: install extra packages
+ apt:
+ name: "{{ base_packages_extra_host | union(base_packages_extra_group) }}"
+ state: present
+
+- name: install rngd
+ when: base_entropy_generator == 'rngd'
+ block:
+ - name: install rngd
+ apt:
+ name: "{{ base_rngd_package_name }}"
+ state: present
+
+ - name: make sure haveged is removed/purged
+ apt:
+ name: haveged
+ state: absent
+ purge: yes
+
+
+- name: install haveged
+ when: base_entropy_generator == 'haveged'
+ block:
+ - name: install haveged
+ apt:
+ name: haveged
+ state: present
+
+ - name: make sure rngd is removed/purged
+ apt:
+ name: "{{ base_rngd_package_name }}"
+ state: absent
+ purge: yes
+
+
+- name: Ensure /root is not world accessible
+ file:
+ path: /root
+ mode: 0700
+ owner: root
+ group: root
+ state: directory
+
+- name: disable net/fs/misc kernel modules
+ loop: "{{ modules_blacklist.net | union(modules_blacklist.fs) | union(modules_blacklist.misc) }}"
+ lineinfile:
+ dest: /etc/modprobe.d/disablemod.conf
+ line: "install {{ item }} /bin/true"
+ create: yes
+ owner: root
+ group: root
+ mode: 0644
+
+- name: Change various sysctl-settings, look at the sysctl-vars file for documentation
+ loop: "{{ sysctl_config | combine(sysctl_config_user) | dict2items }}"
+ loop_control:
+ label: "{{ item.key }} = {{ item.value }}"
+ sysctl:
+ name: "{{ item.key }}"
+ value: "{{ item.value }}"
+ sysctl_set: yes
+ state: present
+ reload: yes
+ ignoreerrors: yes
+
+- name: set kernel command line options
+ lineinfile:
+ path: /etc/default/grub
+ regexp: '^#?GRUB_CMDLINE_LINUX='
+ line: 'GRUB_CMDLINE_LINUX="{{ install.kernel_cmdline | join(" ") }}"'
+ when: install is defined and install.kernel_cmdline is defined
+ notify: update grub
+
+- name: disable TSO (intel nic stability fix)
+ when: base_intel_nic_stability_fix
+ copy:
+ content: |
+ [Match]
+ MACAddress={{ ansible_default_ipv4.macaddress }}
+
+ [Link]
+ TCPSegmentationOffload=false
+ GenericSegmentationOffload=false
+ GenericReceiveOffload=false
+ dest: /etc/systemd/network/00-disable-offloading.link
diff --git a/roles/base/tasks/OpenBSD.yml b/roles/base/tasks/OpenBSD.yml
new file mode 100644
index 00000000..4b64105c
--- /dev/null
+++ b/roles/base/tasks/OpenBSD.yml
@@ -0,0 +1,14 @@
+---
+- name: install base system tools
+ openbsd_pkg:
+ name:
+ - htop
+ - screen--
+ - mtr--
+ - nano
+ state: present
+
+- name: install extra packages
+ openbsd_pkg:
+ name: "{{ base_packages_extra_host | union(base_packages_extra_group) }}"
+ state: present
diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml
index 3f1d9bee..5484a3a6 100644
--- a/roles/base/tasks/main.yml
+++ b/roles/base/tasks/main.yml
@@ -1,72 +1,15 @@
---
-- name: load distrubtion specific variables
- include_vars: "{{ item }}"
- with_first_found:
- - files:
- - "{{ ansible_distribution_release }}.yml"
- - "{{ ansible_distribution }}.yml"
- skip: true
-
-- name: disable recommends and suggests
- copy:
- src: 02no-recommends
- dest: /etc/apt/apt.conf.d/
-
-- name: install base system tools
- apt:
- name:
- - htop
- - dstat
- - lsof
- - gawk
- - psmisc
- - less
- - debian-goodies
- - screen
- - mtr-tiny
- - tcpdump
- - iptraf-ng
- - unp
- - dbus
- - libpam-systemd
- - aptitude
- - ca-certificates
- - file
- - man-db
- - manpages
- - nano
- state: present
-
-
-- name: install rngd
- when: base_entropy_generator == 'rngd'
- block:
- - name: install rngd
- apt:
- name: "{{ base_rngd_package_name }}"
- state: present
-
- - name: make sure haveged is removed/purged
- apt:
- name: haveged
- state: absent
- purge: yes
-
-
-- name: install haveged
- when: base_entropy_generator == 'haveged'
- block:
- - name: install haveged
- apt:
- name: haveged
- state: present
-
- - name: make sure rngd is removed/purged
- apt:
- name: "{{ base_rngd_package_name }}"
- state: absent
- purge: yes
-
+- name: load os/distrubtion/version specific tasks
+ vars:
+ params:
+ files:
+ - "{{ ansible_distribution_release }}.yml"
+ - "{{ ansible_distribution }}.yml"
+ - "{{ ansible_os_family }}.yml"
+ loop: "{{ q('first_found', params) }}"
+ loop_control:
+ loop_var: tasks_file
+ include_tasks: "{{ tasks_file }}"
- name: Remove startup message from screen
lineinfile:
@@ -93,59 +36,3 @@
copy:
src: "{{ global_files_dir }}/common/htoprc"
dest: "{{ item }}/.config/htop/"
-
-- name: Ensure /root is not world accessible
- file:
- path: /root
- mode: 0700
- owner: root
- group: root
- state: directory
-
-- name: disable net/fs/misc kernel modules
- loop: "{{ modules_blacklist.net | union(modules_blacklist.fs) | union(modules_blacklist.misc) }}"
- lineinfile:
- dest: /etc/modprobe.d/disablemod.conf
- line: "install {{ item }} /bin/true"
- create: yes
- owner: root
- group: root
- mode: 0644
-
-- name: Change various sysctl-settings, look at the sysctl-vars file for documentation
- loop: "{{ sysctl_config | combine(sysctl_config_user) | dict2items }}"
- loop_control:
- label: "{{ item.key }} = {{ item.value }}"
- sysctl:
- name: "{{ item.key }}"
- value: "{{ item.value }}"
- sysctl_set: yes
- state: present
- reload: yes
- ignoreerrors: yes
-
-- name: install extra packages
- apt:
- name: "{{ base_packages_extra_host | union(base_packages_extra_group) }}"
- state: present
-
-- name: set kernel command line options
- lineinfile:
- path: /etc/default/grub
- regexp: '^#?GRUB_CMDLINE_LINUX='
- line: 'GRUB_CMDLINE_LINUX="{{ install.kernel_cmdline | join(" ") }}"'
- when: install is defined and install.kernel_cmdline is defined
- notify: update grub
-
-- name: disable TSO (intel nic stability fix)
- when: base_intel_nic_stability_fix
- copy:
- content: |
- [Match]
- MACAddress={{ ansible_default_ipv4.macaddress }}
-
- [Link]
- TCPSegmentationOffload=false
- GenericSegmentationOffload=false
- GenericReceiveOffload=false
- dest: /etc/systemd/network/00-disable-offloading.link
diff --git a/roles/installer/openbsd/autoinstall/templates/install.site.j2 b/roles/installer/openbsd/autoinstall/templates/install.site.j2
index d12ed461..82928daa 100644
--- a/roles/installer/openbsd/autoinstall/templates/install.site.j2
+++ b/roles/installer/openbsd/autoinstall/templates/install.site.j2
@@ -16,5 +16,11 @@ sed -e 's/^\(\s*#*\s*Port.*\)/Port {{ hostvars[hostname].ansible_port }}/' -i /e
echo "Installing python"
pkg_add -Im python%3.7
+echo "Disable sndiod service on first boot"
+cat <<EOF >> /etc/rc.firsttime
+
+rcctl disable sndiod
+rcctl stop sndiod
+EOF
rm /install.site