4 posts tagged with "Ansible"

- hosts: filebeat
  gather_facts: True
  become: yes
  become_user: root
  become_method: su
  become_exe: sudo su
  roles:
    - filebeat_install

---
- name: Install necessary packages
  apt:
    name:
      - apt-transport-https
      - wget
    state: present

- name: Add Elastic GPG key
  apt_key:
    url: https://artifacts.elastic.co/GPG-KEY-elasticsearch
    state: present

- name: Add Elastic repository
  apt_repository:
    repo: "deb https://artifacts.elastic.co/packages/8.x/apt stable main"
    state: present
    filename: elastic-8.x

- name: Update apt and install filebeat
  apt:
    name: filebeat
    update_cache: yes
    state: present

- name: Enable filebeat service
  systemd:
    name: filebeat
    enabled: yes

- name: Write content to /etc/filebeat/ca.crt
    ansible.builtin.copy:
    dest: /etc/filebeat/ca.crt
    content: |
        Bag Attributes
        friendlyName: ca
        localKeyID: "urlocal ID"
        subject=/CN=Elasticsearch HTTP CA
        issuer=/CN=Elasticsearch HTTP CA
        -----BEGIN CERTIFICATE-----
        your ca
        -----END CERTIFICATE-----
    owner: root
    group: root
    mode: '0644'

---
- hosts: Ubuntu22
  gather_facts: True
  roles:
    - ubuntu_base

- hosts: Docker
  gather_facts: False
  roles:
    - docker

- hosts: Nginx
  gather_facts: True
  roles:
    - nginx

# Disable SELinux
- name: diskable SELinux
  selinux:
    state: disabled
  when: ansible_distribution == 'CentOS'


- name: Check if Service Exists
  shell: "systemctl -a|grep {{ need_to_stopped_service}}|wc -l"
  register: service_exists

- name: Stop service firewalld, if started
  ansible.builtin.service:
    name: "{{ need_to_stopped_service }}"
    state: stopped
    enabled: false
  when: service_exists|int > 0

- name: Set a hostname
  ansible.builtin.hostname:
    name: "{{ hostname }}"
  become: true

- name: install Base package
  apt:
    name: "{{ item }}"
    state: latest
  loop: "{{ base_packages }}"
  become: true
# set the TimeZone
- name: Set timezone to Asia/Manila
  community.general.timezone:
    name: "{{ time_zone }}"
  become: true


- name: Set sysctl file limits
  #pam_limits: domain='*' limit_type=`item`.`limit_type` limit_item=`item`.`limit_item` value=`item`.`value`
  become: true
  pam_limits:
      dest: "{{ item.dest }}"
      domain: '*'
      limit_type: "{{ item.limit_type }}"
      limit_item: "{{ item.limit_item }}"
      value: "{{ item.value }}"
  with_items:
      - { dest: '/etc/security/limits.conf',limit_type: 'soft',limit_item: 'nofile', value: '655350' }
      - { dest: '/etc/security/limits.conf',limit_type: 'hard',limit_item: 'nofile', value: '655350'}
      - { dest: '/etc/security/limits.conf',limit_type: 'soft',limit_item: 'nproc', value: '102400' }
      - { dest: '/etc/security/limits.conf',limit_type: 'hard',limit_item: 'nproc', value: '102400' }
      - { dest: '/etc/security/limits.conf',limit_type: 'soft',limit_item: 'sigpending', value: '255377' }
      - { dest: '/etc/security/limits.conf',limit_type: 'hard',limit_item: 'sigpending', value: '255377' }
      - { dest: '/etc/security/limits.d/90-nproc.conf', limit_type: 'soft',limit_item: 'nproc', value: '262144' }
      - { dest: '/etc/security/limits.d/90-nproc.conf', limit_type: 'hard',limit_item: 'nproc', value: '262144' }
  tags:
      - setlimits

# add ops group
- name: Ensure group "ops" exists
  become: true
  ansible.builtin.group:
    name: ops
    state: present

# add ops user
- name: Add the user 'ops' with a bash shell, appending the group ops
  become: true
  ansible.builtin.user:
    name: ops
    shell: /bin/bash
    groups: ops
    append: yes

# add sudo previleges to the ops user
- name: Config /etc/sudoers
  become: true
  lineinfile: dest=/etc/sudoers state=present  line='{{item}}' validate='visudo -cf %s'
  with_items:
    - "ops ALL=(ALL) NOPASSWD: ALL"
    - "Defaults: ops !requiretty"

- name: Set up multiple authorized keys
  become: true
  authorized_key:
    user: ops
    state: present
    key: '{{ item }}'
  with_file: "{{ ssh_pub_key }}"


# config ssh config
- name: Update sshd configuration safely, avoid locking yourself out
  become: true
  ansible.builtin.template:
    src: sshd_config.j2
    dest: /etc/ssh/sshd_config
    owner: root
    group: root
    mode: '0600'
    validate: /usr/sbin/sshd -t -f %s
    backup: yes
  notify:
    - (Handler) Restart SSHD Service
  tags:
    - ssd_config

base_packages:
  # - epel-release
  - vim
  - git
  - tree
  - lrzsz
  - lsof
  - net-tools
    # - openssl-devel
  - wget
    #  - nc

time_zone: Asia/Manila

ssh_config:
  port: 22
  disalbe_root_login: False
  disalbe_password_login: False


ssh_pub_key:
  - files/test.pub

need_to_stopped_service: firewalld

- name: (Handler) Restart SSHD Service
  become: true
  service:
    name: sshd
    state: restarted
    enabled: yes

---
test1: value1
ansible_ssh_port: 22
hostname: backend1

---
version: CentOS7