From 2a89948bf13307cc936756c3a43bed51b3b49dc2 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Wed, 25 Dec 2019 18:20:54 +0100 Subject: openbsd vm install almost works now --- .../autoinstall/templates/auto_install.conf.j2 | 30 ++++++++++++++++++++++ .../openbsd/autoinstall/templates/boot.conf.j2 | 5 ++++ 2 files changed, 35 insertions(+) create mode 100644 roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 create mode 100644 roles/installer/openbsd/autoinstall/templates/boot.conf.j2 (limited to 'roles/installer/openbsd/autoinstall/templates') diff --git a/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 b/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 new file mode 100644 index 00000000..6719aae3 --- /dev/null +++ b/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 @@ -0,0 +1,30 @@ +System hostname = {{ hostvars[hostname].host_name }} + +Which network interface do you wish to configure = {{ install_interface | default(hostvars[hostname].network_cooked.primary.interface) }} +{% if 'install_dhcp' in hostvars[hostname] and hostvars[hostname].install_dhcp %} +IPv4 address = dhcp +{% else %} +IPv4 address = {{ hostvars[hostname].network_cooked.primary.ip }} +Netmask = {{ hostvars[hostname].network_cooked.primary.mask }} +Default IPv4 route = {{ hostvars[hostname].network_cooked.primary.gateway }} +{% endif %} +DNS domain name = {{ hostvars[hostname].network_cooked.domain }} +DNS nameservers = {{ hostvars[hostname].network_cooked.nameservers | join(' ') }} + +{% if obsd_autoinstall_serial_device is defined %} +Change the default console to {{ obsd_autoinstall_serial_device }} = yes +Which speed should {{ obsd_autoinstall_serial_device }} use = {{ obsd_autoinstall_tty_serial | default(115200) }} +{% endif %} + +{# TODO: what if there are more than one ssh keys? #} +Public ssh key for root account = {{ ssh_keys_root[0] }} +Password for root = ! +Setup a user = no +Start sshd(8) by default = yes +Allow root ssh login = prohibit-password + +What timezone are you in = Europe/Vienna + +Location of sets = http +HTTP Server = {{ obsd_autoinstall_http_server }} +Set name(s) = {{ obsd_autoinstall_file_sets }} diff --git a/roles/installer/openbsd/autoinstall/templates/boot.conf.j2 b/roles/installer/openbsd/autoinstall/templates/boot.conf.j2 new file mode 100644 index 00000000..d6cdcfeb --- /dev/null +++ b/roles/installer/openbsd/autoinstall/templates/boot.conf.j2 @@ -0,0 +1,5 @@ +{% if obsd_autoinstall_serial_device is defined %} +stty {{ obsd_autoinstall_serial_device }} {{ obsd_autoinstall_tty_serial | default(115200) }} +set tty {{ obsd_autoinstall_serial_device }} +{% endif %} +set image /bsd.rd -- cgit v1.2.3 From b0920686096aadd8e0bb5772956f4e1d443fe72b Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Wed, 25 Dec 2019 22:34:10 +0100 Subject: openbsd installer: generate iso with filesets --- .../openbsd/autoinstall/defaults/main.yml | 15 ++++++++-- roles/installer/openbsd/autoinstall/tasks/main.yml | 34 ++++++++++++++-------- .../autoinstall/templates/auto_install.conf.j2 | 8 +++-- roles/installer/openbsd/base/tasks/main.yml | 4 +-- roles/vm/define/templates/libvirt-domain.xml.j2 | 2 +- 5 files changed, 43 insertions(+), 20 deletions(-) (limited to 'roles/installer/openbsd/autoinstall/templates') diff --git a/roles/installer/openbsd/autoinstall/defaults/main.yml b/roles/installer/openbsd/autoinstall/defaults/main.yml index e3579ad0..cdea194e 100644 --- a/roles/installer/openbsd/autoinstall/defaults/main.yml +++ b/roles/installer/openbsd/autoinstall/defaults/main.yml @@ -1,8 +1,19 @@ --- # obsd_autoinstall_tmpdir: +obsd_autoinstall_arch: "{{ hostvars[hostname].install_cooked.arch | default('amd64') }}" +obsd_autoinstall_version: "{{ install_codename }}" +obsd_autoinstall_version_short: "{{ obsd_autoinstall_version | replace('.', '') }}" + # obsd_autoinstall_serial_device: com0 # obsd_autoinstall_serial_baudrate: 115200 -obsd_autoinstall_http_server: ftp2.eu.openbsd.org -obsd_autoinstall_file_sets: -comp* -game* -x* +obsd_autoinstall_file_sets: + - base + - man + #- comp + #- game + #- xbase + #- xfont + #- xserv + #- xshare diff --git a/roles/installer/openbsd/autoinstall/tasks/main.yml b/roles/installer/openbsd/autoinstall/tasks/main.yml index 333b437f..79aa8eda 100644 --- a/roles/installer/openbsd/autoinstall/tasks/main.yml +++ b/roles/installer/openbsd/autoinstall/tasks/main.yml @@ -1,20 +1,20 @@ --- - name: create basic cd-image directory structure + loop: + - etc + - sets file: - path: "{{ obsd_autoinstall_tmpdir }}/files/etc" + path: "{{ obsd_autoinstall_tmpdir }}/files/{{ item }}" state: directory - name: extract installer files from iso - vars: - arch: "{{ hostvars[hostname].install_cooked.arch | default('amd64') }}" - version: "{{ install_codename }}" iso_extract: - image: "{{ installer_path }}/openbsd-{{ version }}/{{ arch }}/cd.iso" + image: "{{ installer_path }}/openbsd-{{ obsd_autoinstall_version }}/{{ obsd_autoinstall_arch }}/install.iso" dest: "{{ obsd_autoinstall_tmpdir }}/files" files: - - "{{ version }}/{{ arch }}/cdbr" - - "{{ version }}/{{ arch }}/cdboot" - - "{{ version }}/{{ arch }}/bsd.rd" + - "{{ obsd_autoinstall_version }}/{{ obsd_autoinstall_arch }}/cdbr" + - "{{ obsd_autoinstall_version }}/{{ obsd_autoinstall_arch }}/cdboot" + - "{{ obsd_autoinstall_version }}/{{ obsd_autoinstall_arch }}/bsd.rd" - name: generate bootloader and installer configuration loop: @@ -27,15 +27,25 @@ - name: generate random seed shell: "head -c512 < /dev/random > {{ obsd_autoinstall_tmpdir }}/files/etc/random.seed" +- name: extract file-sets from iso + vars: + set_names: + - bsd + - bsd.rd + - "INSTALL.{{ obsd_autoinstall_arch }}" + - "{{ obsd_autoinstall_file_sets | product([obsd_autoinstall_version_short+'.tgz']) | map('join') | list }}" + iso_extract: + image: "{{ installer_path }}/openbsd-{{ obsd_autoinstall_version }}/{{ obsd_autoinstall_arch }}/install.iso" + dest: "{{ obsd_autoinstall_tmpdir }}/files/sets" + files: "{{ [obsd_autoinstall_version+'/'+obsd_autoinstall_arch+'/'] | product(set_names | flatten) | map('join') | list }}" + - name: generate host specific installer image - command: 'genisoimage -RTLldDN -o "cd.iso" -no-emul-boot -b "cdbr" -c "boot.catalog" files/' + command: 'genisoimage -RTLldDN -o "install.iso" -no-emul-boot -b "cdbr" -c "boot.catalog" files/' args: chdir: "{{ obsd_autoinstall_tmpdir }}/" # - print instructions # * attach to console # * select (S)hell -# * # mount_cd9660 /dev/cd0c /mnt -# * # cp /mnt/etc/auto_install.conf / -# * # autoinstall +# * # mount_cd9660 /dev/cd0c /mnt && cp /mnt/etc/auto_install.conf / && autoinstall # diff --git a/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 b/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 index 6719aae3..46a87cc8 100644 --- a/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 +++ b/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 @@ -25,6 +25,8 @@ Allow root ssh login = prohibit-password What timezone are you in = Europe/Vienna -Location of sets = http -HTTP Server = {{ obsd_autoinstall_http_server }} -Set name(s) = {{ obsd_autoinstall_file_sets }} +Location of sets = cd0 +Pathname to the sets = sets/ +Set name(s) = all +{# iso-images don't contain the SHA256.sig file but are verified when downloading the iso-file #} +Directory does not contain SHA256.sig. Continue without verification = yes diff --git a/roles/installer/openbsd/base/tasks/main.yml b/roles/installer/openbsd/base/tasks/main.yml index 04a4f4ce..0d5053d5 100644 --- a/roles/installer/openbsd/base/tasks/main.yml +++ b/roles/installer/openbsd/base/tasks/main.yml @@ -11,8 +11,8 @@ loop_control: label: "openbsd-{{ item.0.version }} {{ item.1 }}" get_url: - url: "{{ openbsd_installer_url }}/{{ item.0.version }}/{{ item.1 }}/cd{{ item.0.version | replace('.', '') }}.iso" - dest: "{{ installer_path }}/openbsd-{{ item.0.version }}/{{ item.1 }}/cd.iso" + url: "{{ openbsd_installer_url }}/{{ item.0.version }}/{{ item.1 }}/install{{ item.0.version | replace('.', '') }}.iso" + dest: "{{ installer_path }}/openbsd-{{ item.0.version }}/{{ item.1 }}/install.iso" mode: 0644 force: "{{ openbsd_installer_force_download }}" diff --git a/roles/vm/define/templates/libvirt-domain.xml.j2 b/roles/vm/define/templates/libvirt-domain.xml.j2 index 1abd43ed..2a2e4388 100644 --- a/roles/vm/define/templates/libvirt-domain.xml.j2 +++ b/roles/vm/define/templates/libvirt-domain.xml.j2 @@ -44,7 +44,7 @@ {% if vm_define_installer and install_distro == 'openbsd' %} - + -- cgit v1.2.3 From 7b2223d9eeefa92ea968836d6c65c4d96461cdf7 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Thu, 26 Dec 2019 03:35:16 +0100 Subject: openbsd: add site.tgz to further customize the installation --- inventory/hosts.ini | 2 +- roles/installer/openbsd/autoinstall/tasks/main.yml | 20 ++++++++++++++++---- .../autoinstall/templates/auto_install.conf.j2 | 4 ++-- .../openbsd/autoinstall/templates/install.site.j2 | 21 +++++++++++++++++++++ 4 files changed, 40 insertions(+), 7 deletions(-) create mode 100644 roles/installer/openbsd/autoinstall/templates/install.site.j2 (limited to 'roles/installer/openbsd/autoinstall/templates') diff --git a/inventory/hosts.ini b/inventory/hosts.ini index b45fb494..4847c64a 100644 --- a/inventory/hosts.ini +++ b/inventory/hosts.ini @@ -21,7 +21,7 @@ ch-testvm host_name=testvm ch-mimas2 host_name=mimas ch-gnocchi host_name=gnocchi ch-router host_name=router -ch-router-obsd host_name=router ansible_port=22 +ch-router-obsd host_name=router ch-gw-lan host_name=gw-lan ch-jump host_name=jump ansible_port=2342 ansible_host=ch-jump diff --git a/roles/installer/openbsd/autoinstall/tasks/main.yml b/roles/installer/openbsd/autoinstall/tasks/main.yml index 79aa8eda..a4e63f3f 100644 --- a/roles/installer/openbsd/autoinstall/tasks/main.yml +++ b/roles/installer/openbsd/autoinstall/tasks/main.yml @@ -1,10 +1,11 @@ --- -- name: create basic cd-image directory structure +- name: create temporary directories loop: - - etc - - sets + - files/etc + - files/sets + - site/ file: - path: "{{ obsd_autoinstall_tmpdir }}/files/{{ item }}" + path: "{{ obsd_autoinstall_tmpdir }}/{{ item }}" state: directory - name: extract installer files from iso @@ -39,6 +40,17 @@ dest: "{{ obsd_autoinstall_tmpdir }}/files/sets" files: "{{ [obsd_autoinstall_version+'/'+obsd_autoinstall_arch+'/'] | product(set_names | flatten) | map('join') | list }}" +- name: generate install.site script + template: + src: install.site.j2 + dest: "{{ obsd_autoinstall_tmpdir }}/site/install.site" + mode: 0755 + +- name: generate site tarball + archive: + path: "{{ obsd_autoinstall_tmpdir }}/site/" + dest: "{{ obsd_autoinstall_tmpdir }}/files/sets/site{{ obsd_autoinstall_version_short }}.tgz" + - name: generate host specific installer image command: 'genisoimage -RTLldDN -o "install.iso" -no-emul-boot -b "cdbr" -c "boot.catalog" files/' args: diff --git a/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 b/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 index 46a87cc8..18e85a80 100644 --- a/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 +++ b/roles/installer/openbsd/autoinstall/templates/auto_install.conf.j2 @@ -16,9 +16,9 @@ Change the default console to {{ obsd_autoinstall_serial_device }} = yes Which speed should {{ obsd_autoinstall_serial_device }} use = {{ obsd_autoinstall_tty_serial | default(115200) }} {% endif %} -{# TODO: what if there are more than one ssh keys? #} +{# we will install only one key for now, install.site will install the rest #} Public ssh key for root account = {{ ssh_keys_root[0] }} -Password for root = ! +Password for root = this-very-very-secure-password-will-be-overwritten-by-install.site Setup a user = no Start sshd(8) by default = yes Allow root ssh login = prohibit-password diff --git a/roles/installer/openbsd/autoinstall/templates/install.site.j2 b/roles/installer/openbsd/autoinstall/templates/install.site.j2 new file mode 100644 index 00000000..f4f9524d --- /dev/null +++ b/roles/installer/openbsd/autoinstall/templates/install.site.j2 @@ -0,0 +1,21 @@ +#!/bin/sh + +## TODO: enable this once we know how this works +## echo "Generating random root pasword" +## openssl rand -base64 24 | passwd root + +echo "Installing SSH keys for root" +cat < /root/.ssh/authorized_keys +{{ ssh_keys_root | join('\n') }} +EOF + +{% if hostvars[hostname].ansible_port is defined %} +echo "Setting SSH port to {{ hostvars[hostname].ansible_port }}" +sed -e 's/^\(\s*#*\s*Port.*\)/Port {{ hostvars[hostname].ansible_port }}/' -i /etc/ssh/sshd_config +{% endif %} + +echo "Installing python" +pkg_add -Im python%3.7 + + +rm /install.site -- cgit v1.2.3 From c7006b00fb5664423daeee3b83aa347cf959701b Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Thu, 26 Dec 2019 21:50:16 +0100 Subject: zsh and sshd role support debian and openbsd now --- .../openbsd/autoinstall/templates/install.site.j2 | 5 ++-- roles/sshd/handlers/main.yml | 2 +- roles/sshd/tasks/main.yml | 11 ++++++- roles/sshd/vars/Debian.yml | 3 ++ roles/sshd/vars/OpenBSD.yml | 2 ++ roles/zsh/tasks/main.yml | 35 ++++++++++++---------- roles/zsh/templates/banner.chaos-at-home.j2 | 2 +- roles/zsh/templates/banner.elevate.j2 | 2 +- roles/zsh/templates/banner.skillz.j2 | 2 +- roles/zsh/templates/banner.spreadspace.j2 | 2 +- roles/zsh/vars/Debian.yml | 12 ++++++++ roles/zsh/vars/OpenBSD.yml | 12 ++++++++ 12 files changed, 66 insertions(+), 24 deletions(-) create mode 100644 roles/sshd/vars/Debian.yml create mode 100644 roles/sshd/vars/OpenBSD.yml create mode 100644 roles/zsh/vars/Debian.yml create mode 100644 roles/zsh/vars/OpenBSD.yml (limited to 'roles/installer/openbsd/autoinstall/templates') diff --git a/roles/installer/openbsd/autoinstall/templates/install.site.j2 b/roles/installer/openbsd/autoinstall/templates/install.site.j2 index f4f9524d..d12ed461 100644 --- a/roles/installer/openbsd/autoinstall/templates/install.site.j2 +++ b/roles/installer/openbsd/autoinstall/templates/install.site.j2 @@ -1,8 +1,7 @@ #!/bin/sh -## TODO: enable this once we know how this works -## echo "Generating random root pasword" -## openssl rand -base64 24 | passwd root +echo "Generating random root pasword" +usermod -p "$(openssl rand -base64 24 | encrypt)" root echo "Installing SSH keys for root" cat < /root/.ssh/authorized_keys diff --git a/roles/sshd/handlers/main.yml b/roles/sshd/handlers/main.yml index f43817f2..ea76595a 100644 --- a/roles/sshd/handlers/main.yml +++ b/roles/sshd/handlers/main.yml @@ -1,5 +1,5 @@ --- - name: restart ssh service: - name: sshd + name: "{{ sshd_service_name }}" state: restarted diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml index f98ea536..d73d778b 100644 --- a/roles/sshd/tasks/main.yml +++ b/roles/sshd/tasks/main.yml @@ -1,4 +1,12 @@ --- +- name: load os/distrubtion/version specific variables + include_vars: "{{ item }}" + with_first_found: + - files: + - "{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}.yml" + - "{{ ansible_os_family }}.yml" + - name: hardening ssh-server config vars: sshd_options: @@ -32,6 +40,7 @@ exclusive: yes - name: delete root password + when: sshd_disabled_password is defined user: name: root - password: "!" + password: "{{ sshd_disabled_password }}" diff --git a/roles/sshd/vars/Debian.yml b/roles/sshd/vars/Debian.yml new file mode 100644 index 00000000..abbccabc --- /dev/null +++ b/roles/sshd/vars/Debian.yml @@ -0,0 +1,3 @@ +--- +sshd_service_name: ssh +sshd_disabled_password: '!' diff --git a/roles/sshd/vars/OpenBSD.yml b/roles/sshd/vars/OpenBSD.yml new file mode 100644 index 00000000..abdaf180 --- /dev/null +++ b/roles/sshd/vars/OpenBSD.yml @@ -0,0 +1,2 @@ +--- +sshd_service_name: sshd diff --git a/roles/zsh/tasks/main.yml b/roles/zsh/tasks/main.yml index f0aa696e..a5ae60ec 100644 --- a/roles/zsh/tasks/main.yml +++ b/roles/zsh/tasks/main.yml @@ -1,13 +1,21 @@ --- -- name: install zsh packages - openbsd_pkg: +- name: load os/distrubtion/version specific variables + include_vars: "{{ item }}" + with_first_found: + - files: + - "{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}.yml" + - "{{ ansible_os_family }}.yml" + +- name: install zsh package + package: name: zsh state: present - name: install zsh-config loop: - src: "zshrc" - dest: "/etc/zshrc" + dest: "{{ zsh_conf_base_dir }}/zshrc" - src: "zshrc.skel" dest: "/etc/skel/.zshrc" loop_control: @@ -20,19 +28,16 @@ loop: "{{ [ 'root' ] | union(zsh_loginshell_user | default([])) }}" user: name: "{{ item }}" - shell: /usr/local/bin/zsh - -- name: make zsh the default shell for useradd - lineinfile: - regexp: '^#?shell\s' - line: 'shell /usr/local/bin/zsh' - path: /etc/usermgmt.conf + shell: "{{ zsh_bin_path }}" -- name: make zsh the default shell for adduser +- name: make zsh the default shell for new users + loop: "{{ zsh_default_shell_lineinfile | dict2items }}" + loop_control: + label: "{{ item.key }} ('{{ item.value.regexp }}' -> '{{ item.value.line }}')" lineinfile: - regexp: '^#?defaultshell=' - line: 'defaultshell=/usr/local/bin/zsh' - path: /etc/adduser.conf + path: "{{ item.key }}" + regexp: "{{ item.value.regexp }}" + line: "{{ item.value.line }}" create: yes - name: install shell banner @@ -47,7 +52,7 @@ - name: enable banner for zsh login lineinfile: - path: /etc/zlogin + path: "{{ zsh_conf_base_dir }}/zlogin" line: /etc/banner.sh insertbefore: "^## END OF FILE #" create: yes diff --git a/roles/zsh/templates/banner.chaos-at-home.j2 b/roles/zsh/templates/banner.chaos-at-home.j2 index e9b6baa9..c0e71647 100644 --- a/roles/zsh/templates/banner.chaos-at-home.j2 +++ b/roles/zsh/templates/banner.chaos-at-home.j2 @@ -1,4 +1,4 @@ -#!/bin/ksh +#!{{ zsh_banner_shell }} echo -e "" echo -e " \033[0;37m █████╗██╗ ██╗ ████╗ █████╗ ██████╗\033[1;30m ██████╗ \033[0;37m██╗ ██╗ █████╗ ███╗ ███╗█████╗\033[0m" diff --git a/roles/zsh/templates/banner.elevate.j2 b/roles/zsh/templates/banner.elevate.j2 index cca0850d..03dfa73b 100644 --- a/roles/zsh/templates/banner.elevate.j2 +++ b/roles/zsh/templates/banner.elevate.j2 @@ -1,4 +1,4 @@ -#!/bin/ksh +#!{{ zsh_banner_shell }} echo -e "" echo -e " \033[1;37m██████████ ██ ██████████ ▜█▙ ▟█▛ ▟██▙ ██████████ ██████████\033[0m" diff --git a/roles/zsh/templates/banner.skillz.j2 b/roles/zsh/templates/banner.skillz.j2 index f750f9e6..4c883d22 100644 --- a/roles/zsh/templates/banner.skillz.j2 +++ b/roles/zsh/templates/banner.skillz.j2 @@ -1,4 +1,4 @@ -#!/bin/ksh +#!{{ zsh_banner_shell }} echo -e "" echo -e " \033[1;35m███████╗██╗ ██╗██╗██╗ ██╗ ███████╗\033[0;35m ██████╗ ██╗███████╗\033[0m" diff --git a/roles/zsh/templates/banner.spreadspace.j2 b/roles/zsh/templates/banner.spreadspace.j2 index 580aa4c8..c592804e 100644 --- a/roles/zsh/templates/banner.spreadspace.j2 +++ b/roles/zsh/templates/banner.spreadspace.j2 @@ -1,4 +1,4 @@ -#!/bin/ksh +#!{{ zsh_banner_shell }} echo -e "" echo -e " \033[0;33m█████╗█████╗ █████╗ █████╗ ████╗ █████╗ █████╗█████╗ ████╗ ████╗█████╗\033[0m" diff --git a/roles/zsh/vars/Debian.yml b/roles/zsh/vars/Debian.yml new file mode 100644 index 00000000..7138fd2f --- /dev/null +++ b/roles/zsh/vars/Debian.yml @@ -0,0 +1,12 @@ +--- +zsh_banner_shell: /bin/bash +zsh_bin_path: /bin/zsh +zsh_conf_base_dir: /etc/zsh + +zsh_default_shell_lineinfile: + /etc/default/useradd: + regexp: '^#?SHELL=' + line: 'SHELL=/bin/zsh' + /etc/adduser.conf: + regexp: '^#?DSHELL=' + line: 'DSHELL=/bin/zsh' diff --git a/roles/zsh/vars/OpenBSD.yml b/roles/zsh/vars/OpenBSD.yml new file mode 100644 index 00000000..d11fe11e --- /dev/null +++ b/roles/zsh/vars/OpenBSD.yml @@ -0,0 +1,12 @@ +--- +zsh_banner_shell: /bin/ksh +zsh_bin_path: /usr/local/bin/zsh +zsh_conf_base_dir: /etc + +zsh_default_shell_lineinfile: + /etc/usermgmt.conf: + regexp: '^#?shell\s' + line: 'shell /usr/local/bin/zsh' + /etc/adduser.conf: + regexp: '^#?defaultshell=' + line: 'defaultshell=/usr/local/bin/zsh' -- cgit v1.2.3 From f5b24e7977b5e453bde40b52f1cf7bbc1bb67ae2 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Thu, 26 Dec 2019 23:24:40 +0100 Subject: base role supports openbsd now too --- chaos-at-home/ch-router-obsd.yml | 2 +- roles/base/tasks/Debian.yml | 124 +++++++++++++++++++ roles/base/tasks/OpenBSD.yml | 14 +++ roles/base/tasks/main.yml | 135 ++------------------- .../openbsd/autoinstall/templates/install.site.j2 | 6 + 5 files changed, 156 insertions(+), 125 deletions(-) create mode 100644 roles/base/tasks/Debian.yml create mode 100644 roles/base/tasks/OpenBSD.yml (limited to 'roles/installer/openbsd/autoinstall/templates') diff --git a/chaos-at-home/ch-router-obsd.yml b/chaos-at-home/ch-router-obsd.yml index fe3ef36f..76b79316 100644 --- a/chaos-at-home/ch-router-obsd.yml +++ b/chaos-at-home/ch-router-obsd.yml @@ -2,6 +2,6 @@ - name: Basic Setup hosts: ch-router-obsd roles: - #- role: base + - role: base - role: sshd - role: zsh diff --git a/roles/base/tasks/Debian.yml b/roles/base/tasks/Debian.yml new file mode 100644 index 00000000..25195ad2 --- /dev/null +++ b/roles/base/tasks/Debian.yml @@ -0,0 +1,124 @@ +--- +- name: load distrubtion specific variables + include_vars: "{{ item }}" + with_first_found: + - files: + - "{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}.yml" + skip: true + +- name: disable recommends and suggests + copy: + src: 02no-recommends + dest: /etc/apt/apt.conf.d/ + +- name: install base system tools + apt: + name: + - htop + - dstat + - lsof + - gawk + - psmisc + - less + - debian-goodies + - screen + - mtr-tiny + - tcpdump + - iptraf-ng + - unp + - dbus + - libpam-systemd + - aptitude + - ca-certificates + - file + - man-db + - manpages + - nano + state: present + +- name: install extra packages + apt: + name: "{{ base_packages_extra_host | union(base_packages_extra_group) }}" + state: present + +- name: install rngd + when: base_entropy_generator == 'rngd' + block: + - name: install rngd + apt: + name: "{{ base_rngd_package_name }}" + state: present + + - name: make sure haveged is removed/purged + apt: + name: haveged + state: absent + purge: yes + + +- name: install haveged + when: base_entropy_generator == 'haveged' + block: + - name: install haveged + apt: + name: haveged + state: present + + - name: make sure rngd is removed/purged + apt: + name: "{{ base_rngd_package_name }}" + state: absent + purge: yes + + +- name: Ensure /root is not world accessible + file: + path: /root + mode: 0700 + owner: root + group: root + state: directory + +- name: disable net/fs/misc kernel modules + loop: "{{ modules_blacklist.net | union(modules_blacklist.fs) | union(modules_blacklist.misc) }}" + lineinfile: + dest: /etc/modprobe.d/disablemod.conf + line: "install {{ item }} /bin/true" + create: yes + owner: root + group: root + mode: 0644 + +- name: Change various sysctl-settings, look at the sysctl-vars file for documentation + loop: "{{ sysctl_config | combine(sysctl_config_user) | dict2items }}" + loop_control: + label: "{{ item.key }} = {{ item.value }}" + sysctl: + name: "{{ item.key }}" + value: "{{ item.value }}" + sysctl_set: yes + state: present + reload: yes + ignoreerrors: yes + +- name: set kernel command line options + lineinfile: + path: /etc/default/grub + regexp: '^#?GRUB_CMDLINE_LINUX=' + line: 'GRUB_CMDLINE_LINUX="{{ install.kernel_cmdline | join(" ") }}"' + when: install is defined and install.kernel_cmdline is defined + notify: update grub + +- name: disable TSO (intel nic stability fix) + when: base_intel_nic_stability_fix + copy: + content: | + [Match] + MACAddress={{ ansible_default_ipv4.macaddress }} + + [Link] + TCPSegmentationOffload=false + GenericSegmentationOffload=false + GenericReceiveOffload=false + dest: /etc/systemd/network/00-disable-offloading.link diff --git a/roles/base/tasks/OpenBSD.yml b/roles/base/tasks/OpenBSD.yml new file mode 100644 index 00000000..4b64105c --- /dev/null +++ b/roles/base/tasks/OpenBSD.yml @@ -0,0 +1,14 @@ +--- +- name: install base system tools + openbsd_pkg: + name: + - htop + - screen-- + - mtr-- + - nano + state: present + +- name: install extra packages + openbsd_pkg: + name: "{{ base_packages_extra_host | union(base_packages_extra_group) }}" + state: present diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml index 3f1d9bee..5484a3a6 100644 --- a/roles/base/tasks/main.yml +++ b/roles/base/tasks/main.yml @@ -1,72 +1,15 @@ --- -- name: load distrubtion specific variables - include_vars: "{{ item }}" - with_first_found: - - files: - - "{{ ansible_distribution_release }}.yml" - - "{{ ansible_distribution }}.yml" - skip: true - -- name: disable recommends and suggests - copy: - src: 02no-recommends - dest: /etc/apt/apt.conf.d/ - -- name: install base system tools - apt: - name: - - htop - - dstat - - lsof - - gawk - - psmisc - - less - - debian-goodies - - screen - - mtr-tiny - - tcpdump - - iptraf-ng - - unp - - dbus - - libpam-systemd - - aptitude - - ca-certificates - - file - - man-db - - manpages - - nano - state: present - - -- name: install rngd - when: base_entropy_generator == 'rngd' - block: - - name: install rngd - apt: - name: "{{ base_rngd_package_name }}" - state: present - - - name: make sure haveged is removed/purged - apt: - name: haveged - state: absent - purge: yes - - -- name: install haveged - when: base_entropy_generator == 'haveged' - block: - - name: install haveged - apt: - name: haveged - state: present - - - name: make sure rngd is removed/purged - apt: - name: "{{ base_rngd_package_name }}" - state: absent - purge: yes - +- name: load os/distrubtion/version specific tasks + vars: + params: + files: + - "{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}.yml" + - "{{ ansible_os_family }}.yml" + loop: "{{ q('first_found', params) }}" + loop_control: + loop_var: tasks_file + include_tasks: "{{ tasks_file }}" - name: Remove startup message from screen lineinfile: @@ -93,59 +36,3 @@ copy: src: "{{ global_files_dir }}/common/htoprc" dest: "{{ item }}/.config/htop/" - -- name: Ensure /root is not world accessible - file: - path: /root - mode: 0700 - owner: root - group: root - state: directory - -- name: disable net/fs/misc kernel modules - loop: "{{ modules_blacklist.net | union(modules_blacklist.fs) | union(modules_blacklist.misc) }}" - lineinfile: - dest: /etc/modprobe.d/disablemod.conf - line: "install {{ item }} /bin/true" - create: yes - owner: root - group: root - mode: 0644 - -- name: Change various sysctl-settings, look at the sysctl-vars file for documentation - loop: "{{ sysctl_config | combine(sysctl_config_user) | dict2items }}" - loop_control: - label: "{{ item.key }} = {{ item.value }}" - sysctl: - name: "{{ item.key }}" - value: "{{ item.value }}" - sysctl_set: yes - state: present - reload: yes - ignoreerrors: yes - -- name: install extra packages - apt: - name: "{{ base_packages_extra_host | union(base_packages_extra_group) }}" - state: present - -- name: set kernel command line options - lineinfile: - path: /etc/default/grub - regexp: '^#?GRUB_CMDLINE_LINUX=' - line: 'GRUB_CMDLINE_LINUX="{{ install.kernel_cmdline | join(" ") }}"' - when: install is defined and install.kernel_cmdline is defined - notify: update grub - -- name: disable TSO (intel nic stability fix) - when: base_intel_nic_stability_fix - copy: - content: | - [Match] - MACAddress={{ ansible_default_ipv4.macaddress }} - - [Link] - TCPSegmentationOffload=false - GenericSegmentationOffload=false - GenericReceiveOffload=false - dest: /etc/systemd/network/00-disable-offloading.link diff --git a/roles/installer/openbsd/autoinstall/templates/install.site.j2 b/roles/installer/openbsd/autoinstall/templates/install.site.j2 index d12ed461..82928daa 100644 --- a/roles/installer/openbsd/autoinstall/templates/install.site.j2 +++ b/roles/installer/openbsd/autoinstall/templates/install.site.j2 @@ -16,5 +16,11 @@ sed -e 's/^\(\s*#*\s*Port.*\)/Port {{ hostvars[hostname].ansible_port }}/' -i /e echo "Installing python" pkg_add -Im python%3.7 +echo "Disable sndiod service on first boot" +cat <> /etc/rc.firsttime + +rcctl disable sndiod +rcctl stop sndiod +EOF rm /install.site -- cgit v1.2.3