138 lines
3.8 KiB
YAML
138 lines
3.8 KiB
YAML
|
|
# > /COPILOT_GENERATE I'm writing an ansible playbook to setup a new alpine server, I want you to help me to generate some tasks
|
|
|
|
- name: Setup an alpine machine
|
|
hosts: homelab
|
|
user: root
|
|
vars:
|
|
# alpine_version: v3.19
|
|
alpine_version: latest-stable
|
|
robo:
|
|
authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILPiEGbVaaSJq/9hGaou3gd6m4Jzyj4AIgCL5wGTxVz1"
|
|
allowed_commands:
|
|
- "docker ps"
|
|
vars_files:
|
|
../../variables/secrets.yaml
|
|
tasks:
|
|
- name: Change login message
|
|
template:
|
|
src: ../../files/alpine/motd.j2
|
|
dest: /etc/motd
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
backup: yes
|
|
|
|
- name: Update repositories
|
|
template:
|
|
src: ../../files/alpine/repositories.j2
|
|
dest: /etc/apk/repositories
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
backup: yes
|
|
|
|
- name: Update all packages
|
|
command: /sbin/apk upgrade -U -a
|
|
|
|
- name: Be sure python is installed
|
|
command: /sbin/apk add python3
|
|
args:
|
|
creates: /usr/bin/python3
|
|
|
|
- name: Disable password authentication for SSH
|
|
become: true
|
|
notify: Restart sshd
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?PasswordAuthentication'
|
|
line: 'PasswordAuthentication no'
|
|
state: present
|
|
|
|
- name: Allow users of the weel group to use doas command
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/doas.conf
|
|
regexp: '^#\s*permit persist :wheel'
|
|
line: 'permit persist :wheel'
|
|
state: present
|
|
|
|
- name: Create a user group named docker
|
|
ansible.builtin.group:
|
|
name: docker
|
|
|
|
- name: Setup users
|
|
ansible.builtin.user:
|
|
state: present
|
|
name: aleidk
|
|
password: "{{ users.aleidk.password | password_hash('sha512') }}"
|
|
groups:
|
|
- wheel
|
|
- docker
|
|
|
|
- name: Create a user for executing remote commands
|
|
ansible.builtin.user:
|
|
name: robo
|
|
system: true
|
|
create_home: true
|
|
groups: nogroup
|
|
state: present
|
|
|
|
- name: Add SSH public key for robo user
|
|
ansible.posix.authorized_key:
|
|
user: robo
|
|
state: present
|
|
key: "{{ robo.authorized_key }}"
|
|
key_options: "command=\"{{ robo.allowed_commands | join('; ') }}\""
|
|
|
|
handlers:
|
|
- name: Restart sshd
|
|
ansible.builtin.service:
|
|
name: sshd
|
|
state: restarted
|
|
|
|
- name: Setup Docker
|
|
hosts: docker
|
|
user: root
|
|
vars_files:
|
|
../../variables/secrets.yaml
|
|
tasks:
|
|
- name: Install packages
|
|
ansible.builtin.package:
|
|
state: present
|
|
name:
|
|
- docker
|
|
- py3-pip
|
|
- py3-docker-py
|
|
|
|
- name: Start docker service
|
|
ansible.builtin.service:
|
|
name: docker
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Setup Docker Swarm
|
|
when: docker_swarm_manager | bool
|
|
block:
|
|
- name: Enable Docker Swarm mode
|
|
community.docker.docker_swarm:
|
|
state: present
|
|
advertise_addr: "{{ ansible_default_ipv4.address }}"
|
|
|
|
- name: Check if Docker context exists
|
|
local_action: ansible.builtin.command docker context inspect {{ ansible_hostname }}
|
|
register: context_exists
|
|
ignore_errors: true
|
|
|
|
- name: Create Docker context for each Swarm manager machine
|
|
local_action: >
|
|
ansible.builtin.command docker context create {{ ansible_hostname }} --docker "host=ssh://{{ ansible_default_ipv4.address }}"
|
|
when: context_exists.stderr != ''
|
|
|
|
- name: Join Docker Swarm as a worker
|
|
community.docker.docker_swarm:
|
|
state: join
|
|
join_token: "{{ hostvars['manager']['docker_swarm_worker_token'] }}"
|
|
remote_addrs: ["{{ hostvars['manager']['ansible_default_ipv4']['address'] }}"]
|
|
when: not docker_swarm_manager | bool
|
|
|