Replace the broken Rocky 10 box with a custom one

README.md

@@ -64,7 +64,7 @@ To submit, press `CTRL+d` twice.
 
 ## Copyrights and Licenses
 
-Copyright (C) 2019, 2020, 2022, 2023, 2025 Free I.T. Athens
+Copyright (C) 2019, 2020, 2022, 2023, 2025, 2026 Free I.T. Athens
 
 This program is free software: you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software

Vagrantfile

@@ -1,26 +1,25 @@
 # vi: set ft=ruby :
 
 # Set PLAYBOOK shell var for ./dev/playbook.yml
-PLAYBOOK=ENV["PLAYBOOK"]
+playbook=ENV["PLAYBOOK"]
-if !PLAYBOOK
+if !playbook
   if File.exist?('.playbook')
-    PLAYBOOK = IO.read('.playbook').split("\n")[0]
+    playbook = IO.read('.playbook').split("\n")[0]
   end
 
-  if !PLAYBOOK || PLAYBOOK.empty?
+  if !playbook || playbook.empty?
-    PLAYBOOK = "webserver"
+    playbook = "webserver"
   end
 else
-  File.write(".playbook", PLAYBOOK)
+  File.write(".playbook", playbook)
 end
 
 # Optionally allow more verbosity in Ansible
 VAGRANT_ANSIBLE_VERBOSE=ENV["VAGRANT_ANSIBLE_VERBOSE"] || false
 
 Vagrant.configure("2") do |config|
-  config.vm.box = "rockylinux/9"
+  config.vm.box = "krislamo.org/rocky10"
   config.vm.hostname = "fritadev"
-  config.vm.disk :disk, size: "100GB", primary: true
   config.vm.synced_folder ".", "/vagrant", disabled: true
   config.vm.network "private_network", type: "dhcp"
 
@@ -33,7 +32,6 @@ Vagrant.configure("2") do |config|
     libvirt.cpus = 2
     libvirt.memory = 4096
     libvirt.default_prefix = ""
-    libvirt.machine_virtual_size = 100
   end
 
   # Set VirtualBox settings
@@ -42,24 +40,11 @@ Vagrant.configure("2") do |config|
     vbox.memory = 4096
   end
 
-  # Expand XFS rootfs
-  config.vm.provision "shell", inline: <<-SHELL
-    set -xe
-    df -h /
-    dnf install -y cloud-utils-growpart
-    PART="$(findmnt -n -o SOURCE /)"
-    DISK="$(lsblk -n -o PKNAME "$PART")"
-    NUM="$(lsblk -n -o KNAME "$PART" | sed 's/.*[^0-9]//')"
-    growpart "/dev/$DISK" "$NUM" && \
-    xfs_growfs /
-    df -h /
-  SHELL
-
   # Provision with Ansible
   config.vm.provision "ansible" do |ansible|
     ENV['ANSIBLE_ROLES_PATH'] = File.dirname(__FILE__) + "/roles"
     ansible.compatibility_mode = "2.0"
-    ansible.playbook = "dev/" + PLAYBOOK + ".yml"
+    ansible.playbook = "dev/" + playbook + ".yml"
     ansible.verbose = VAGRANT_ANSIBLE_VERBOSE
   end
 end

dev/fog.yml

@@ -0,0 +1,8 @@
+- name: Install FRITA FOG Server
+  hosts: all
+  become: true
+  vars_files:
+    - vars/fog.yml
+  roles:
+    - common
+    - fog

dev/vars/fog.yml

@@ -0,0 +1,33 @@
+###################
+### common role ###
+###################
+
+firewalld:
+  # Turn 'drop' zone SSH access off after initial provision
+  # This example config defines an 'admin' zone for it instead
+  # drop_ssh: false
+  type: complex
+  zones:
+    admin:
+      source: 192.168.121.0/24
+      services:
+        - ssh
+        - cockpit
+        - http
+    fog:
+      interface: eth1
+      services:
+        - http
+      ports:
+        - 69/udp
+        - 111/tcp
+        - 111/udp
+        - 2049/tcp
+        - 2049/udp
+
+################
+### fog role ###
+################
+
+fog:
+  version: 1.5.10.1826 # defaults to stable

roles/common/tasks/main.yml

@@ -56,33 +56,51 @@
     state: present
     update_cache: true
 
+- name: Assert valid firewalld config
+  ansible.builtin.assert:
+    that:
+      - firewalld is mapping
+      - firewalld.type is defined
+      - firewalld.type in ['simple', 'complex']
+    fail_msg: "firewalld.type must be 'simple' or 'complex'"
+  when: firewalld is defined
+
 - name: Install firewalld
   ansible.builtin.dnf:
     name: firewalld
     state: present
+  when: firewalld is defined
 
 - name: Start and enable firewalld service
   ansible.builtin.systemd:
     name: firewalld
     state: started
     enabled: true
+  when: firewalld is defined
 
-- name: Set default zone to drop (deny incoming by default)
+- name: Update SSH rule in firewalld drop zone
-  ansible.posix.firewalld:
-    zone: drop
-    state: enabled
-    permanent: true
-    immediate: true
-
-- name: Allow SSH in drop zone with rate limiting via rich rule
   ansible.posix.firewalld:
     zone: drop
     rich_rule: 'rule service name="ssh" accept limit value="10/m"'
     permanent: true
     immediate: true
-    state: enabled
+    state: "{{ 'enabled' if (firewalld.drop_ssh | default(true)) else 'disabled' }}"
+  when: firewalld is defined
 
 - name: Set drop as the default zone
   ansible.builtin.command:
     cmd: firewall-cmd --set-default-zone=drop
-  changed_when: false
+  register: default_zone_result
+  changed_when: "'ZONE_ALREADY_SET' not in default_zone_result.stderr"
+  when: firewalld is defined
+
+- name: Install Cockpit
+  ansible.builtin.dnf:
+    name: cockpit
+    state: present
+
+- name: Enable and start Cockpit socket
+  ansible.builtin.systemd:
+    name: cockpit.socket
+    enabled: true
+    state: started

roles/fog/tasks/main.yml

@@ -0,0 +1,125 @@
+- name: Check if FOG is already installed
+  ansible.builtin.stat:
+    path: /opt/fog/.fogsettings
+  register: fog_installed
+
+- name: Upgrade system before FOG server install
+  ansible.builtin.dnf:
+    name: "*"
+    state: latest # noqa: package-latest
+  when: not fog_installed.stat.exists
+
+- name: Install git
+  ansible.builtin.dnf:
+    name: git
+    state: present
+
+- name: Set SELinux to permissive and make it persistent
+  ansible.posix.selinux:
+    policy: targeted
+    state: permissive
+
+- name: Ensure parent source directory exists
+  ansible.builtin.file:
+    path: /usr/local/src
+    state: directory
+    mode: "0755"
+
+- name: Clone FOG at specified version
+  ansible.builtin.git:
+    repo: https://github.com/FOGProject/fogproject.git
+    dest: /usr/local/src/fogproject
+    version: "{{ fog.version | default('stable') }}"
+    update: true
+
+- name: Run FOG installer first time
+  ansible.builtin.command: ./installfog.sh -Y
+  args:
+    chdir: /usr/local/src/fogproject/bin
+    creates: /opt/fog/.fogsettings
+
+- name: Create admin zone
+  ansible.posix.firewalld:
+    zone: admin
+    state: present
+    permanent: true
+  register: admin_zone
+  when:
+    - firewalld is defined
+    - firewalld.type == 'complex'
+
+- name: Create fog zone
+  ansible.posix.firewalld:
+    zone: fog
+    state: present
+    permanent: true
+  register: fog_zone
+  when:
+    - firewalld is defined
+    - firewalld.type == 'complex'
+
+- name: Reload firewalld if zones were created
+  ansible.builtin.command: firewall-cmd --reload
+  changed_when: true
+  when:
+    - firewalld is defined
+    - firewalld.type == 'complex'
+    - admin_zone.changed or fog_zone.changed
+
+- name: Bind admin source to admin zone
+  ansible.posix.firewalld:
+    zone: admin
+    source: "{{ firewalld.zones.admin.source }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  when:
+    - firewalld is defined
+    - firewalld.type == 'complex'
+
+- name: Bind fog interface to fog zone
+  ansible.posix.firewalld:
+    zone: fog
+    interface: "{{ firewalld.zones.fog.interface }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  when:
+    - firewalld is defined
+    - firewalld.type == 'complex'
+
+- name: Allow admin services
+  ansible.posix.firewalld:
+    zone: admin
+    service: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  loop: "{{ firewalld.zones.admin.services | default([]) }}"
+  when:
+    - firewalld is defined
+    - firewalld.type == 'complex'
+
+- name: Allow fog services
+  ansible.posix.firewalld:
+    zone: fog
+    service: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  loop: "{{ firewalld.zones.fog.services | default([]) }}"
+  when:
+    - firewalld is defined
+    - firewalld.type == 'complex'
+
+- name: Allow fog ports
+  ansible.posix.firewalld:
+    zone: fog
+    port: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  loop: "{{ firewalld.zones.fog.ports | default([]) }}"
+  when:
+    - firewalld is defined
+    - firewalld.type == 'complex'