Update base role to pass linting

This commit is contained in:
Kris Lamoureux 2023-10-20 21:30:25 -04:00
parent 7adb5f10e9
commit 5b09029239
Signed by: kris
GPG Key ID: 3EDA9C3441EDA925
11 changed files with 35 additions and 34 deletions

View File

@ -5,7 +5,12 @@ allow_reboot: false
manage_network: false manage_network: false
users: users:
- name: jellyfin jellyfin:
uid: 1001
gid: 1001
shell: /usr/sbin/nologin
home: false
system: true
samba: samba:
users: users:

View File

@ -5,6 +5,10 @@
listen: reboot_host listen: reboot_host
when: allow_reboot when: allow_reboot
- name: Reconfigure locales
ansible.builtin.command: dpkg-reconfigure -f noninteractive locales
listen: reconfigure_locales
- name: Restart WireGuard - name: Restart WireGuard
ansible.builtin.service: ansible.builtin.service:
name: wg-quick@wg0 name: wg-quick@wg0

View File

@ -2,4 +2,4 @@
ansible.builtin.file: ansible.builtin.file:
path: "~/.ansible/tmp" path: "~/.ansible/tmp"
state: directory state: directory
mode: 0700 mode: "700"

View File

@ -7,7 +7,7 @@
ansible.builtin.template: ansible.builtin.template:
src: ddclient.conf.j2 src: ddclient.conf.j2
dest: /etc/ddclient.conf dest: /etc/ddclient.conf
mode: 0600 mode: "600"
register: ddclient_settings register: ddclient_settings
- name: Start ddclient and enable on boot - name: Start ddclient and enable on boot

View File

@ -32,14 +32,14 @@
ansible.builtin.template: ansible.builtin.template:
src: fail2ban-ssh.conf.j2 src: fail2ban-ssh.conf.j2
dest: /etc/fail2ban/jail.d/sshd.conf dest: /etc/fail2ban/jail.d/sshd.conf
mode: 0640 mode: "640"
notify: restart_fail2ban notify: restart_fail2ban
- name: Install Fail2ban IP allow list - name: Install Fail2ban IP allow list
ansible.builtin.template: ansible.builtin.template:
src: fail2ban-allowlist.conf.j2 src: fail2ban-allowlist.conf.j2
dest: /etc/fail2ban/jail.d/allowlist.conf dest: /etc/fail2ban/jail.d/allowlist.conf
mode: 0640 mode: "640"
when: fail2ban_ignoreip is defined when: fail2ban_ignoreip is defined
notify: restart_fail2ban notify: restart_fail2ban

View File

@ -11,10 +11,10 @@
ansible.builtin.template: ansible.builtin.template:
src: msmtprc.j2 src: msmtprc.j2
dest: /root/.msmtprc dest: /root/.msmtprc
mode: 0600 mode: "600"
- name: Install /etc/aliases - name: Install /etc/aliases
ansible.builtin.copy: ansible.builtin.copy:
dest: /etc/aliases dest: /etc/aliases
content: "root: {{ mail.rootalias }}" content: "root: {{ mail.rootalias }}"
mode: 0644 mode: "644"

View File

@ -10,6 +10,6 @@
ansible.builtin.template: ansible.builtin.template:
src: "interface.j2" src: "interface.j2"
dest: "/etc/network/interfaces.d/{{ item.name }}" dest: "/etc/network/interfaces.d/{{ item.name }}"
mode: 0400 mode: "400"
loop: "{{ interfaces }}" loop: "{{ interfaces }}"
notify: reboot_host notify: reboot_host

View File

@ -3,23 +3,15 @@
name: samba name: samba
state: present state: present
- name: Create nologin shell accounts for Samba
ansible.builtin.user:
name: "{{ item.name }}"
state: present
shell: /usr/sbin/nologin
createhome: false
system: yes
loop: "{{ samba.users }}"
when: item.manage_user is defined and item.manage_user is true
- name: Create Samba users - name: Create Samba users
ansible.builtin.shell: "smbpasswd -a {{ item.name }}" ansible.builtin.command: "smbpasswd -a {{ item.name }}"
args: args:
stdin: "{{ item.password }}\n{{ item.password }}" stdin: "{{ item.password }}\n{{ item.password }}"
loop: "{{ samba.users }}" loop: "{{ samba.users }}"
loop_control:
label: "{{ item.name }}"
register: samba_users register: samba_users
changed_when: "'User added' in samba_users.stdout" changed_when: "'Added user' in samba_users.stdout"
- name: Ensure share directories exist - name: Ensure share directories exist
ansible.builtin.file: ansible.builtin.file:
@ -27,13 +19,14 @@
owner: "{{ item.owner }}" owner: "{{ item.owner }}"
group: "{{ item.group }}" group: "{{ item.group }}"
state: directory state: directory
mode: 0755 mode: "755"
loop: "{{ samba.shares }}" loop: "{{ samba.shares }}"
- name: Configure Samba shares - name: Configure Samba shares
ansible.builtin.template: ansible.builtin.template:
src: smb.conf.j2 src: smb.conf.j2
dest: /etc/samba/smb.conf dest: /etc/samba/smb.conf
mode: "700"
notify: restart_samba notify: restart_samba
- name: Start smbd and enable on boot - name: Start smbd and enable on boot

View File

@ -10,7 +10,7 @@
state: present state: present
- name: Check for existing GPG keys - name: Check for existing GPG keys
command: "gpg --list-keys {{ item.id }} 2>/dev/null" ansible.builtin.command: "gpg --list-keys {{ item.id }} 2>/dev/null"
register: gpg_check register: gpg_check
loop: "{{ root_gpgkeys }}" loop: "{{ root_gpgkeys }}"
failed_when: false failed_when: false
@ -18,20 +18,22 @@
when: root_gpgkeys is defined when: root_gpgkeys is defined
- name: Import GPG keys - name: Import GPG keys
command: "gpg --keyserver {{ item.item.server | default('keys.openpgp.org') }} --recv-key {{ item.item.id }}" ansible.builtin.command:
"gpg --keyserver {{ item.item.server | default('keys.openpgp.org') }} --recv-key {{ item.item.id }}"
register: gpg_check_import register: gpg_check_import
loop: "{{ gpg_check.results }}" loop: "{{ gpg_check.results }}"
loop_control: loop_control:
label: "{{ item.item }}" label: "{{ item.item }}"
changed_when: false
when: root_gpgkeys is defined and item.rc != 0 when: root_gpgkeys is defined and item.rc != 0
- name: Check GPG key imports - name: Check GPG key imports
fail: ansible.builtin.fail:
msg: "{{ item.stderr }}" msg: "{{ item.stderr }}"
loop: "{{ gpg_check_import.results }}" loop: "{{ gpg_check_import.results }}"
loop_control: loop_control:
label: "{{ item.item.item }}" label: "{{ item.item.item }}"
when: (item.skipped | default(false) == false) and ('imported' not in item.stderr) when: root_gpgkeys is defined and (not item.skipped | default(false)) and ('imported' not in item.stderr)
- name: Install NTPsec - name: Install NTPsec
ansible.builtin.apt: ansible.builtin.apt:
@ -47,7 +49,7 @@
community.general.locale_gen: community.general.locale_gen:
name: "{{ locale_default }}" name: "{{ locale_default }}"
state: present state: present
register: locale_gen_output notify: reconfigure_locales
- name: Set the default locale - name: Set the default locale
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -55,15 +57,11 @@
regexp: "^LANG=" regexp: "^LANG="
line: "LANG={{ locale_default }}" line: "LANG={{ locale_default }}"
- name: Reconfigure locales
ansible.builtin.command: dpkg-reconfigure -f noninteractive locales
when: locale_gen_output.changed
- name: Manage root authorized_keys - name: Manage root authorized_keys
ansible.builtin.template: ansible.builtin.template:
src: authorized_keys.j2 src: authorized_keys.j2
dest: /root/.ssh/authorized_keys dest: /root/.ssh/authorized_keys
mode: 0400 mode: "400"
when: authorized_keys is defined when: authorized_keys is defined
- name: Create system user groups - name: Create system user groups
@ -84,6 +82,7 @@
group: "{{ item.value.gid }}" group: "{{ item.value.gid }}"
shell: "{{ item.value.shell | default('/bin/bash') }}" shell: "{{ item.value.shell | default('/bin/bash') }}"
create_home: "{{ item.value.home | default(false) }}" create_home: "{{ item.value.home | default(false) }}"
system: "{{ item.value.system | default(false) }}"
loop: "{{ users | dict2items }}" loop: "{{ users | dict2items }}"
loop_control: loop_control:
label: "{{ item.key }}" label: "{{ item.key }}"

View File

@ -22,7 +22,7 @@
ansible.builtin.template: ansible.builtin.template:
src: wireguard.j2 src: wireguard.j2
dest: /etc/wireguard/wg0.conf dest: /etc/wireguard/wg0.conf
mode: 0400 mode: "400"
notify: restart_wireguard notify: restart_wireguard
- name: Start WireGuard interface - name: Start WireGuard interface

View File

@ -48,7 +48,7 @@
repo: "{{ item.url }}" repo: "{{ item.url }}"
dest: "{{ docker_repos_path }}/{{ item.name }}" dest: "{{ docker_repos_path }}/{{ item.name }}"
version: "{{ item.version }}" version: "{{ item.version }}"
accept_newhostkey: "{{ item.accept_newhostkey | default('false') }}" accept_newhostkey: "{{ item.accept_newhostkey | default(false) }}"
gpg_whitelist: "{{ item.trusted_keys | default([]) }}" gpg_whitelist: "{{ item.trusted_keys | default([]) }}"
verify_commit: "{{ true if (item.trusted_keys is defined and item.trusted_keys) else false }}" verify_commit: "{{ true if (item.trusted_keys is defined and item.trusted_keys) else false }}"
key_file: "{{ docker_repos_keys }}/id_{{ docker_repos_keytype }}" key_file: "{{ docker_repos_keys }}/id_{{ docker_repos_keytype }}"
@ -86,7 +86,7 @@
mode: 0400 mode: 0400
register: compose_env_update register: compose_env_update
notify: compose_restart notify: compose_restart
no_log: "{{ docker_compose_env_nolog | default('true') }}" no_log: "{{ docker_compose_env_nolog | default(true) }}"
loop: "{{ docker_compose_deploy }}" loop: "{{ docker_compose_deploy }}"
loop_control: loop_control:
label: "{{ item.name }}" label: "{{ item.name }}"