From 3e616d9165e4915758fee83c47ed316150f480da Mon Sep 17 00:00:00 2001 From: DogeyStamp Date: Wed, 2 Mar 2022 19:58:31 -0500 Subject: [PATCH] Make process generally smoother --- group_vars/all/vars.yml | 6 ++ hosts.example | 7 +++ .../templates/bash_profile.j2 | 0 roles/networking/connection/tasks/main.yml | 57 +++++++++++++++---- .../networking/connection/templates/rmconn.sh | 8 +++ roles/networking/ssl/tasks/main.yml | 10 +++- roles/services/gitea/meta/main.yml | 2 - roles/services/gitea/tasks/main.yml | 14 +++++ roles/services/synapse/handlers/main.yml | 4 ++ roles/services/synapse/meta/main.yml | 2 - roles/services/synapse/tasks/main.yml | 19 +++++++ roles/services/website/meta/main.yml | 2 - roles/services/wiki/meta/main.yml | 2 - roles/system/handlers/main.yml | 4 -- roles/system/tasks/essential.yml | 12 +++- roles/system/tasks/initial.yml | 56 ++++++++++++++++++ roles/system/tasks/main.yml | 1 + roles/system/tasks/sshd.yml | 20 ++++++- roles/system/templates/doas.conf.j2 | 1 + run.yml | 30 +++++++--- tasks/set_host.yml | 15 +++++ tasks/ssh_port.yml | 42 ++++++++++++++ 22 files changed, 275 insertions(+), 39 deletions(-) create mode 100644 hosts.example rename roles/{system => dotfiles}/templates/bash_profile.j2 (100%) create mode 100644 roles/networking/connection/templates/rmconn.sh delete mode 100644 roles/services/gitea/meta/main.yml create mode 100644 roles/services/synapse/handlers/main.yml delete mode 100644 roles/services/synapse/meta/main.yml delete mode 100644 roles/services/website/meta/main.yml delete mode 100644 roles/services/wiki/meta/main.yml delete mode 100644 roles/system/handlers/main.yml create mode 100644 roles/system/tasks/initial.yml create mode 100644 roles/system/templates/doas.conf.j2 create mode 100644 tasks/set_host.yml create mode 100644 tasks/ssh_port.yml diff --git a/group_vars/all/vars.yml b/group_vars/all/vars.yml index 2940dfc..2bc1d7f 100644 --- a/group_vars/all/vars.yml +++ b/group_vars/all/vars.yml @@ -17,6 +17,9 @@ escalation_method: doas sshd_port: 2500 +# Username for the priviledged user +admin_username: maestro + # Username for unpriviledged user username: dogeystamp @@ -129,6 +132,9 @@ enable_nameserver: yes # SSL ACME (Let's Encrypt) enable_ssl: yes +# nginx: necessary for gitea, synapse, wiki, and website. +enable_webserver: yes + # Git server enable_gitea: yes diff --git a/hosts.example b/hosts.example new file mode 100644 index 0000000..e3a9c4d --- /dev/null +++ b/hosts.example @@ -0,0 +1,7 @@ +# Copy this to hosts. + +# fallback_host would be the DHCP address given to the host. +# It will be changed to local_ip during execution of the connection role. + +[sv] +your_hostname fallback_host=192.168.0.109 ansible_port=2500 ansible_connection=ssh ansible_ssh_private_key_file=~/.ssh/keys/patria diff --git a/roles/system/templates/bash_profile.j2 b/roles/dotfiles/templates/bash_profile.j2 similarity index 100% rename from roles/system/templates/bash_profile.j2 rename to roles/dotfiles/templates/bash_profile.j2 diff --git a/roles/networking/connection/tasks/main.yml b/roles/networking/connection/tasks/main.yml index 74ff3ff..80ba822 100644 --- a/roles/networking/connection/tasks/main.yml +++ b/roles/networking/connection/tasks/main.yml @@ -9,13 +9,36 @@ enabled: yes state: started -- name: Disable existing eth0 connection - community.general.nmcli: - conn_name: eth0 - state: absent - register: networkmanager_config +- name: Send script to remove externally managed eth0 connection + template: + src: rmconn.sh + dest: /root/rmconn.sh + mode: 700 + register: rmconn -- name: Set static IP address +- name: Run rmconn every 30 minutes + cron: + name: "Ensure eth0 is not externally managed" + minute: "*/30" + job: "/root/rmconn.sh" + state: present + +- name: Run rmconn every minute (temporarily) + cron: + name: "Ensure eth0 is not externally managed (temporary)" + minute: "*" + job: "/root/rmconn.sh" + state: present + when: rmconn.changed + +- name: Run rmconn at boot + cron: + name: "Ensure eth0 is not externally managed (at reboot)" + special_time: reboot + job: "/root/rmconn.sh" + state: present + +- name: Create NetworkManager connection community.general.nmcli: dns4: "{{ dns_forward }}" dns4_ignore_auto: yes @@ -25,11 +48,21 @@ conn_name: wired ifname: "{{ interface }}" type: ethernet - when: networkmanager_config.changed + register: nmcli_conf + poll: 0 + async: 1000 -- name: Cronjob to remove externally managed eth0 connection +- name: Set ansible_host to static IP + set_fact: + ansible_host: "{{ local_ip }}" + +- name: Reconnect to new IP + wait_for_connection: + timeout: 240 + + when: nmcli_conf.changed + +- name: Remove rmconn task at every minute cron: - name: "Ensure eth0 is not externally managed" - minute: "*/10" - job: "/usr/bin/nmcli connection down eth0 > /dev/null 2>&1; /usr/bin/nmcli connection down wired > /dev/null 2>&1; /usr/bin/nmcli connection up wired > /dev/null" - state: present + name: "Ensure eth0 is not externally managed (temporary)" + state: absent diff --git a/roles/networking/connection/templates/rmconn.sh b/roles/networking/connection/templates/rmconn.sh new file mode 100644 index 0000000..9408e8b --- /dev/null +++ b/roles/networking/connection/templates/rmconn.sh @@ -0,0 +1,8 @@ +#!/bin/sh + +sleep 30 + +/usr/bin/nmcli connection down {{ interface }} > /dev/null 2>&1 +/usr/bin/nmcli connection down "Wired connection 1" > /dev/null 2>&1 +/usr/bin/nmcli connection down wired > /dev/null 2>&1 +/usr/bin/nmcli connection up wired > /dev/null diff --git a/roles/networking/ssl/tasks/main.yml b/roles/networking/ssl/tasks/main.yml index 614af4b..1dd4193 100644 --- a/roles/networking/ssl/tasks/main.yml +++ b/roles/networking/ssl/tasks/main.yml @@ -1,6 +1,10 @@ -- name: Ensure nginx is installed +- name: Ensure relevant packages are installed community.general.pacman: - name: nginx + name: + - nginx + - certbot + - certbot-nginx + state: present - name: Create directories for ACME @@ -37,7 +41,7 @@ register: result when: cert_file.stat.exists -- name: Determine whethe certificate should be regenerated +- name: Determine whether the certificate should be regenerated set_fact: cert_regen: yes when: not cert_file.stat.exists or result.expired | bool diff --git a/roles/services/gitea/meta/main.yml b/roles/services/gitea/meta/main.yml deleted file mode 100644 index 96c394a..0000000 --- a/roles/services/gitea/meta/main.yml +++ /dev/null @@ -1,2 +0,0 @@ -dependencies: - - role: webserver diff --git a/roles/services/gitea/tasks/main.yml b/roles/services/gitea/tasks/main.yml index a7646d3..8745697 100644 --- a/roles/services/gitea/tasks/main.yml +++ b/roles/services/gitea/tasks/main.yml @@ -18,6 +18,20 @@ state: present notify: Restart gitea +- name: Find owner of data folder + stat: + path: "{{ dataroot }}/gitea/" + register: data_folder + +- name: Ensure data folder is under correct owner + file: + path: "{{ dataroot }}/gitea/" + state: directory + recurse: yes + owner: gitea + group: gitea + when: data_folder.stat.pw_name != "gitea" + - name: Ensure gitea is stopped service: name: gitea diff --git a/roles/services/synapse/handlers/main.yml b/roles/services/synapse/handlers/main.yml new file mode 100644 index 0000000..02632db --- /dev/null +++ b/roles/services/synapse/handlers/main.yml @@ -0,0 +1,4 @@ +- name: Restart synapse + service: + name: synapse + state: restarted diff --git a/roles/services/synapse/meta/main.yml b/roles/services/synapse/meta/main.yml deleted file mode 100644 index 96c394a..0000000 --- a/roles/services/synapse/meta/main.yml +++ /dev/null @@ -1,2 +0,0 @@ -dependencies: - - role: webserver diff --git a/roles/services/synapse/tasks/main.yml b/roles/services/synapse/tasks/main.yml index 511d310..7a9d282 100644 --- a/roles/services/synapse/tasks/main.yml +++ b/roles/services/synapse/tasks/main.yml @@ -7,16 +7,19 @@ copy: src: signing.key.secret dest: /etc/synapse/signing.key + notify: Restart synapse - name: Deploy matrix homeserver configuration template: src: homeserver.yaml.j2 dest: /etc/synapse/homeserver.yaml + notify: Restart synapse - name: Deploy matrix logging configuration template: src: log.config.j2 dest: /etc/synapse/log.config + notify: Restart synapse - name: Change systemd unit file to allow access to dataroot lineinfile: @@ -25,6 +28,22 @@ regexp: "^ReadWritePaths.*" line: "ReadWritePaths={{ dataroot }}/synapse/" state: present + notify: Restart synapse + +- name: Find owner of data folder + stat: + path: "{{ dataroot }}/synapse/" + register: data_folder + +- name: Ensure data folder is under correct owner + file: + path: "{{ dataroot }}/synapse/" + state: directory + recurse: yes + owner: synapse + group: synapse + when: data_folder.stat.pw_name != "synapse" + notify: Restart synapse - name: Enable matrix service service: diff --git a/roles/services/website/meta/main.yml b/roles/services/website/meta/main.yml deleted file mode 100644 index 96c394a..0000000 --- a/roles/services/website/meta/main.yml +++ /dev/null @@ -1,2 +0,0 @@ -dependencies: - - role: webserver diff --git a/roles/services/wiki/meta/main.yml b/roles/services/wiki/meta/main.yml deleted file mode 100644 index 96c394a..0000000 --- a/roles/services/wiki/meta/main.yml +++ /dev/null @@ -1,2 +0,0 @@ -dependencies: - - role: webserver diff --git a/roles/system/handlers/main.yml b/roles/system/handlers/main.yml deleted file mode 100644 index 784cf59..0000000 --- a/roles/system/handlers/main.yml +++ /dev/null @@ -1,4 +0,0 @@ -- name: Restart sshd - service: - name: sshd - state: restarted diff --git a/roles/system/tasks/essential.yml b/roles/system/tasks/essential.yml index 764fd63..7abe458 100644 --- a/roles/system/tasks/essential.yml +++ b/roles/system/tasks/essential.yml @@ -12,6 +12,16 @@ update_cache: yes upgrade: yes +- name: Determine if reboot for kernel update is needed + shell: + cmd: "if [[ $(pacman -Q linux | cut -d \" \" -f 2) > $(uname -r) ]]; then echo reboot; fi" + register: reboot_check + +- name: Reboot for kernel update + reboot: + when: + reboot_check.stdout == "reboot" + - name: Install utility packages community.general.pacman: name: "{{ util_pack }}" @@ -30,7 +40,7 @@ ansible.posix.authorized_key: user: "{{ username }}" state: present - key: "{{ lookup('file', '~/.ssh/keys/{{ ansible_hostname }}.pub')}}" + key: "{{ lookup('file', '~/.ssh/keys/{{ inventory_hostname }}.pub')}}" - name: Enable cron daemon service: diff --git a/roles/system/tasks/initial.yml b/roles/system/tasks/initial.yml new file mode 100644 index 0000000..053dd3d --- /dev/null +++ b/roles/system/tasks/initial.yml @@ -0,0 +1,56 @@ +- name: Determine whether initial setup is needed + set_fact: + initial_setup: yes + when: + ansible_user != admin_username + +- name: Fallback to su + set_fact: + ansible_become_method: "su" + ansible_become_user: "root" + ansible_become_password: "root" + when: + initial_setup is defined + +- setup: + +- name: Install opendoas + community.general.pacman: + name: opendoas + state: present + +- name: Configure doas + template: + src: doas.conf.j2 + dest: /etc/doas.conf + +- name: Create priviledged user + user: + name: "{{ admin_username }}" + groups: wheel + +- name: Deploy SSH key to admin user + ansible.posix.authorized_key: + user: "{{ admin_username }}" + state: present + key: "{{ lookup('file', '~/.ssh/keys/{{ inventory_hostname }}.pub')}}" + +- name: Reset variables to before fallback + set_fact: + ansible_become_method: "{{ escalation_method }}" + ansible_user: "{{ admin_username }}" + ansible_ssh_password: "" + when: + initial_setup is defined + +- name: Reconnect as new administrator + wait_for_connection: + timeout: 10 + when: + initial_setup is defined + +- name: Delete initial user + user: + name: "alarm" + force: yes + state: absent diff --git a/roles/system/tasks/main.yml b/roles/system/tasks/main.yml index f00961a..37f3c43 100644 --- a/roles/system/tasks/main.yml +++ b/roles/system/tasks/main.yml @@ -1,2 +1,3 @@ +- include_tasks: initial.yml - include_tasks: essential.yml - include_tasks: sshd.yml diff --git a/roles/system/tasks/sshd.yml b/roles/system/tasks/sshd.yml index ae7824b..16a2e6c 100644 --- a/roles/system/tasks/sshd.yml +++ b/roles/system/tasks/sshd.yml @@ -3,11 +3,27 @@ dest: /etc/ssh/sshd_config regexp: "^#PasswordAuthentication yes" line: "PasswordAuthentication no" - notify: Restart sshd + register: sshd_config - name: Change SSH port lineinfile: dest: /etc/ssh/sshd_config regexp: "^#Port 22" line: "Port {{ sshd_port }}" - notify: Restart sshd + register: sshd_config + +- name: Restart SSHD + service: + name: sshd + state: restarted + when: sshd_config.changed + +- name: Reset ansible_ssh_port + set_fact: + ansible_ssh_port: "{{ sshd_port }}" + when: sshd_config.changed + +- name: Reconnect under new port + wait_for_connection: + timeout: 10 + when: sshd_config.changed diff --git a/roles/system/templates/doas.conf.j2 b/roles/system/templates/doas.conf.j2 new file mode 100644 index 0000000..d2423e7 --- /dev/null +++ b/roles/system/templates/doas.conf.j2 @@ -0,0 +1 @@ +permit nopass :wheel diff --git a/run.yml b/run.yml index f74330c..fe6d595 100644 --- a/run.yml +++ b/run.yml @@ -2,27 +2,42 @@ - hosts: sv become: yes + gather_facts: no + + pre_tasks: + - import_tasks: tasks/set_host.yml + - import_tasks: tasks/ssh_port.yml + roles: - role: system - - - role: dotfiles - when: enable_dotfiles - + - role: filesystems when: enable_filesystems - role: networking/connection when: enable_connection + - role: firewall + when: enable_firewall + - role: networking/ddclient when: enable_ddclient - role: networking/nameserver when: enable_nameserver + - role: services/sftp + when: enable_sftpr + + - role: services/mail + when: enable_mail + - role: networking/ssl when: enable_ssl + - role: services/webserver + when: enable_webserver + - role: services/gitea when: enable_gitea @@ -35,8 +50,5 @@ - role: services/website when: enable_website - - role: services/sftp - when: enable_sftpr - - - role: services/mail - when: enable_mail + - role: dotfiles + when: enable_dotfiles diff --git a/tasks/set_host.yml b/tasks/set_host.yml new file mode 100644 index 0000000..69991ee --- /dev/null +++ b/tasks/set_host.yml @@ -0,0 +1,15 @@ +- name: Determine if host is up at static IP + local_action: "command ping -c 1 {{ local_ip }}" + become: no + ignore_errors: true + register: up_static + +- name: Switch ansible_host to fallback IP + set_fact: + ansible_host: "{{ fallback_host }}" + when: up_static.rc != 0 + +- name: Switch ansible_host to static IP + set_fact: + ansible_host: "{{ local_ip }}" + when: up_static.rc == 0 diff --git a/tasks/ssh_port.yml b/tasks/ssh_port.yml new file mode 100644 index 0000000..c3abe39 --- /dev/null +++ b/tasks/ssh_port.yml @@ -0,0 +1,42 @@ +- name: Set default user for SSH + set_fact: + ansible_user: "{{ admin_username }}" + +- name: Attempt ssh connection + become: no + wait_for_connection: + timeout: 10 + ignore_errors: true + register: ssh_result_default + +- name: Set ssh to fallback port + set_fact: + ansible_ssh_port: 22 + when: + - ssh_result_default is failed + +- name: Attempt ssh connection + become: no + wait_for_connection: + timeout: 10 + ignore_errors: true + register: ssh_result_port + when: + - ssh_result_default is failed + +- name: Set ssh to fallback port and default Arch Linux ARM credentials + set_fact: + ansible_ssh_port: "22" + ansible_user: "alarm" + ansible_ssh_password: "alarm" + when: + - ssh_result_default is failed + - ssh_result_port is failed + +- name: Attempt ssh connection + become: no + wait_for_connection: + timeout: 10 + when: + - ssh_result_default is failed + - ssh_result_port is failed