jpp/ansible-roles
1
0
Fork 0
mirror of https://git.lapiole.org/dani/ansible-roles.git synced 2025-04-16 02:03:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update to 2022-09-08 18:00

Browse Source
This commit is contained in:
Daniel Berteaud 2022-09-08 18:00:11 +02:00
parent 472469ee4e
commit 5b5815da8d
16 changed files with 32 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
roles/consul/tasks/install.yml
View File

@ -40,7 +40,7 @@
content: |
complete -C {{ consul_root_dir }}/bin/consul consul
dest: /etc/bash_completion.d/consul
mode: 755
mode: 0644
tags: consul
- name: Deploy systemd service unit

4
roles/consul/tasks/iptables.yml
View File

@ -6,10 +6,10 @@
state: "{{ (('tcp' in consul_services[item].proto or 'udp' in consul_services[item].proto) and consul_services[item].src_ip | length > 0) | ternary('present', 'absent') }}"
rules: |
{% if 'tcp' in consul_services[item].proto %}
-A INPUT -m state --state NEW -p tcp --dport {{ consul_services[item].port }} -s {{ consul_services[item].src_ip | join(',') }} -j ACCEPT
-A INPUT -m state --state NEW -p tcp --dport {{ consul_services[item].port }} -s {{ consul_services[item].src_ip | flatten | join(',') }} -j ACCEPT
{% endif %}
{% if 'udp' in consul_services[item].proto %}
-A INPUT -m state --state NEW -p udp --dport {{ consul_services[item].port }} -s {{ consul_services[item].src_ip | join(',') }} -j ACCEPT
-A INPUT -m state --state NEW -p udp --dport {{ consul_services[item].port }} -s {{ consul_services[item].src_ip | flatten | join(',') }} -j ACCEPT
{% endif %}
loop: "{{ consul_services.keys() | list }}"
tags: firewall,consul

3
roles/consul/templates/consul.service.j2
View File

@ -14,7 +14,8 @@ ExecStart={{ consul_root_dir }}/bin/consul agent -config-dir={{ consul_root_dir
ExecReload=/bin/kill --signal HUP $MAINPID
SuccessExitStatus=1
Restart=on-failure
RestartSec=2
RestartSec=5
StartLimitInterval=0
LimitNOFILE=65536
[Install]

4
roles/letsencrypt/templates/domains.txt.j2
View File

@ -71,3 +71,7 @@
# mysql
{{ mysql_letsencrypt_cert }}
{% endif %}
{% if 'vault' in ansible_role_names and vault_letsencrypt_cert is defined and vault_letsencrypt_cert is string and vault_letsencrypt_cert not in letsencrypt_certs | default([]) | map(attribute='common_name') %}
# Vault
{{ vault_letsencrypt_cert }}
{% endif %}

6
roles/metabase/defaults/main.yml
View File

@ -1,15 +1,15 @@
---
# Version to deploy
metabase_version: 0.44.1
metabase_version: 0.44.2
# URL to fetch the jar
metabase_jar_url: https://downloads.metabase.com/v{{ metabase_version }}/metabase.jar
# Expected sha256 of the jar
metabase_jar_sha256: 4c842b9b374b0ffa7031b7757722e1dddd9b6aebbb5afe82d82b6eb9730d3791
metabase_jar_sha256: 23471284af7fdbd9088cbb4f0c6972cacca9a1f155f408b80dbaade08c13480f
# When building from source
metabase_archive_url: https://github.com/metabase/metabase/archive/refs/tags/v{{ metabase_version }}.tar.gz
# Expected sha256 of the archive
metabase_archive_sha256: 522fb5a92234fb6bc1ed46819523271c51d4e3d2c13fa5230430cff3802d0ff1
metabase_archive_sha256: bdbfff6f2a7bd0434b8a9885e10f5b0d5c52d0e1918a4b9d091c596b5e5d06ca
# Should ansible handle upgrades ? If set to false, only the initial install (and the config) will be handled
metabase_manage_upgrade: True

2
roles/nomad/defaults/main.yml
View File

@ -180,7 +180,7 @@ nomad_base_conf:
# address: http://localhost:8500
# allow_unauthenticated: True
# tags: []
ssl: "{{ (consul_conf is defined and consul_conf.tls is defined and consul_conf.tls.enabled is defined and consul_conf.tls.enabled) | ternary(True, False) }}"
ssl: False
ca_file: "{{ nomad_root_dir }}/tls/consul_ca.crt"
cert_file: "{{ nomad_root_dir }}/tls/consul.crt"
key_file: "{{ nomad_root_dir }}/tls/consul.key"

2
roles/nomad/tasks/conf.yml
View File

@ -168,6 +168,6 @@
- what: issuing_ca
where: consul_ca.crt.tpl
notify: restart consul-template-nomad
when: nomad_vault_secrets.consul_pki.enabled and nomad_conf.client.enabled and nomad_conf.consul.ssl
when: nomad_vault_secrets.consul_pki.enabled and nomad_conf.consul.ssl
tags: nomad

7
roles/nomad/tasks/install.yml
View File

@ -49,6 +49,11 @@
- name: Link in /usr/local/bin
file: src={{ nomad_root_dir }}/bin/nomad dest=/usr/local/bin/nomad state=link force=True
tags: nomad
- when: nomad_install_mode != 'none' and nomad_conf.client.enabled
block:
- name: Download plugins
get_url:
url: "{{ nomad_plugins[item].archive_url }}"
@ -101,7 +106,7 @@
content: |
complete -C {{ nomad_root_dir }}/bin/nomad nomad
dest: /etc/bash_completion.d/nomad
mode: 755
mode: 0644
tags: nomad
- name: Deploy systemd service unit

4
roles/nomad/tasks/iptables.yml
View File

@ -6,10 +6,10 @@
state: "{{ (('tcp' in nomad_services[item].proto or 'udp' in nomad_services[item].proto) and nomad_services[item].src_ip | length > 0) | ternary('present', 'absent') }}"
rules: |
{% if 'tcp' in nomad_services[item].proto %}
-A INPUT -m state --state NEW -p tcp --dport {{ nomad_services[item].port }} -s {{ nomad_services[item].src_ip | join(',') }} -j ACCEPT
-A INPUT -m state --state NEW -p tcp --dport {{ nomad_services[item].port }} -s {{ nomad_services[item].src_ip | flatten | join(',') }} -j ACCEPT
{% endif %}
{% if 'udp' in nomad_services[item].proto %}
-A INPUT -m state --state NEW -p udp --dport {{ nomad_services[item].port }} -s {{ nomad_services[item].src_ip | join(',') }} -j ACCEPT
-A INPUT -m state --state NEW -p udp --dport {{ nomad_services[item].port }} -s {{ nomad_services[item].src_ip | flatten | join(',') }} -j ACCEPT
{% endif %}
loop: "{{ nomad_services.keys() | list }}"
tags: firewall,nomad

2
roles/nomad/templates/consul-template.hcl.j2
View File

@ -59,7 +59,7 @@ template {
{% endif %}
{% if nomad_vault_secrets.consul_pki.enabled and nomad_conf.client.enabled and nomad_conf.consul.ssl %}
{% if nomad_vault_secrets.consul_pki.enabled and nomad_conf.consul.ssl %}
template {
source = "{{ nomad_root_dir }}/consul-template/consul.crt.tpl"
left_delimiter = "[["

3
roles/nomad/templates/nomad.service.j2
View File

@ -23,7 +23,8 @@ Restart=on-failure
LimitNOFILE=65536
LimitNPROC=infinity
Restart=on-failure
RestartSec=2
RestartSec=5
StartLimitInterval=0
TasksMax=infinity
OOMScoreAdjust=-1000

4
roles/vault/defaults/main.yml
View File

@ -95,8 +95,8 @@ vault_base_conf:
# retry_join:
# - leader_api_addr: https://vault-1.example.org:8200
# leader_ca_cert: /opt/vault/tls/ca-vault-1.crt
# - https://vault-2.example.org:8200
# - https://vault-3.example.org:8200
# - leader_api_addr: https://vault-2.example.org:8200
# - leader_api_addr: https://vault-3.example.org:8200
retry_join: []
# Service registration on consul

1
roles/vault/handlers/main.yml
View File

@ -9,3 +9,4 @@
- name: restart consul-template-vault
service: name=consul-template-vault state=restarted
when: vault_secrets.nomad.enabled

5
roles/vault/tasks/install.yml
View File

@ -40,7 +40,7 @@
content: |
complete -C {{ vault_root_dir }}/bin/vault vault
dest: /etc/bash_completion.d/vault
mode: 755
mode: 0644
tags: vault
- name: Deploy systemd service unit
@ -52,13 +52,12 @@
- name: Install consul-template unit
template: src=consul-template-vault.service.j2 dest=/etc/systemd/system/consul-template-vault.service
notify: restart consul-template-vault
when: vault_secrets.nomad.enabled
register: vault_secrets_nomad_unit
tags: vault
- name: Reload systemd
systemd: daemon_reload=True
when: vault_unit.changed or (vault_secrets_nomad_unit is defined and vault_secrets_nomad_unit.changed)
when: vault_unit.changed or vault_secrets_nomad_unit.changed
tags: vault
- name: Install dehydrated hook

3
roles/vault/tasks/iptables.yml
View File

@ -4,7 +4,6 @@
iptables_raw:
name: vault_port_{{ item }}
state: "{{ (vault_services[item].src_ip | length > 0) | ternary('present', 'absent') }}"
rules: |
-A INPUT -m state --state NEW -p tcp --dport {{ vault_services[item].port }} -j ACCEPT
rules: "-A INPUT -m state --state NEW -p tcp --dport {{ vault_services[item].port }} -s {{ vault_services[item].src_ip | flatten | join(',') }} -j ACCEPT"
loop: "{{ vault_services.keys() | list }}"
tags: firewall,vault

1
roles/vault/templates/vault.service.j2
View File

@ -25,6 +25,7 @@ KillMode=process
KillSignal=SIGINT
Restart=on-failure
RestartSec=5
StartLimitInterval=0
TimeoutStopSec=30
LimitNOFILE=65536
LimitMEMLOCK=infinity