blob: 13eba1560018552acba9c8264e4bb8dd2a3c3bf1 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
---
- name: load distrubtion specific variables
include_vars: "{{ item }}"
with_first_found:
- files:
- "{{ ansible_distribution_release }}.yml"
- "{{ ansible_distribution }}.yml"
skip: true
- name: disable recommends, suggests and pdiffs
loop:
- 02no-recommends
- 02no-pdiffs
copy:
src: "{{ item }}"
dest: /etc/apt/apt.conf.d/
- name: install base system tools
apt:
name:
- htop
- dstat
- lsof
- gawk
- psmisc
- less
- debian-goodies
- screen
- mtr-tiny
- tcpdump
- iptraf-ng
- ethtool
- unp
- dbus
- libpam-systemd
- aptitude
- ca-certificates
- file
- man-db
- manpages
- nano
- curl
state: present
- name: install extra packages
apt:
name: "{{ base_packages_extra_host | union(base_packages_extra_group) }}"
state: present
- name: install rngd
when: base_entropy_generator == 'rngd'
block:
- name: install rngd
apt:
name: "{{ base_rngd_package_name }}"
state: present
- name: make sure haveged is removed/purged
apt:
name: haveged
state: absent
purge: yes
- name: install haveged
when: base_entropy_generator == 'haveged'
block:
- name: install haveged
apt:
name: haveged
state: present
- name: make sure rngd is removed/purged
apt:
name: "{{ base_rngd_package_name }}"
state: absent
purge: yes
- name: Ensure /root is not world accessible
file:
path: /root
mode: 0700
owner: root
group: root
state: directory
- name: disable net/fs/misc kernel modules
copy:
content: |
{% for item in (base_modules_blacklist | map('extract', base_modules_blacklist_) | flatten | sort | list) %}
install {{ item }} /bin/true
{% endfor %}
dest: /etc/modprobe.d/disablemod.conf
owner: root
group: root
mode: 0644
- name: Change various sysctl-settings, look at the sysctl-vars file for documentation
loop: "{{ base_sysctl_config | combine(base_sysctl_config_user) | dict2items }}"
loop_control:
label: "{{ item.key }} = {{ item.value }}"
sysctl:
name: "{{ item.key }}"
value: "{{ item.value }}"
sysctl_set: yes
state: present
reload: yes
ignoreerrors: yes
- name: set kernel command line options
when: install is defined and install.kernel_cmdline is defined
lineinfile:
path: /etc/default/grub
regexp: '^#?GRUB_CMDLINE_LINUX='
line: 'GRUB_CMDLINE_LINUX="{{ install.kernel_cmdline | join(" ") }}"'
notify: update grub
## see https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1814403
- name: lower grub recordfail timeout for ubuntu/efi systems
when:
- ansible_distribution == "Ubuntu"
- install.efi | default(false)
lineinfile:
path: /etc/default/grub
regexp: '^#?GRUB_RECORDFAIL_TIMEOUT='
line: 'GRUB_RECORDFAIL_TIMEOUT="3"'
insertafter: '^#?GRUB_TIMEOUT='
notify: update grub
- name: apply stability fix/workaround for machines using intel NIC
when: base_intel_nic_stability_fix
import_tasks: intel-nic.yml
|
