diff --git a/ansible/roles/debian/tasks/main.yml b/ansible/roles/debian/tasks/main.yml index ca01e81..3097261 100644 --- a/ansible/roles/debian/tasks/main.yml +++ b/ansible/roles/debian/tasks/main.yml @@ -1,3 +1,23 @@ +- name: "Disable Proxmox enterprise repository (requires paid subscription)" + ansible.builtin.command: + cmd: mv /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/pve-enterprise.list.disabled + removes: /etc/apt/sources.list.d/pve-enterprise.list + changed_when: true + +- name: "Read MariaDB repo file (if present)" + ansible.builtin.slurp: + path: /etc/apt/sources.list.d/mariadb.sources + register: _mariadb_repo_content + ignore_errors: true + +- name: "Remove stale MariaDB 12.2 repo (not available for trixie)" + ansible.builtin.file: + path: /etc/apt/sources.list.d/mariadb.sources + state: absent + when: + - _mariadb_repo_content.content is defined + - "'repo/12.2/debian' in (_mariadb_repo_content.content | b64decode)" + - name: "Install updates" ansible.builtin.apt: name: "*" @@ -12,4 +32,5 @@ ansible.builtin.lineinfile: path: /etc/fstab state: present + regexp: '^tmpfs\s+/run/shm\s+' line: "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0" diff --git a/ansible/roles/firewall/tasks/main.yml b/ansible/roles/firewall/tasks/main.yml index 1fc15db..ba4cd44 100644 --- a/ansible/roles/firewall/tasks/main.yml +++ b/ansible/roles/firewall/tasks/main.yml @@ -60,6 +60,16 @@ - ansible_os_family == "RedHat" - firewall_allow_rules | length > 0 +# --- UFW (Debian/Ubuntu) - Check current state --- + +- name: "Check ufw status" + ansible.builtin.command: ufw status + register: _fw_ufw_active + changed_when: false + failed_when: false + check_mode: false + when: ansible_os_family == "Debian" + # --- UFW (Debian/Ubuntu) - Disable when firewall not managed --- - name: Disable ufw @@ -68,16 +78,11 @@ when: - ansible_os_family == "Debian" - not (firewall_enabled | default(true)) + - _fw_ufw_active.stdout is defined + - "'Status: active' in _fw_ufw_active.stdout" # --- UFW (Debian/Ubuntu) - Configure when firewall managed --- -- name: Reset ufw to defaults - ufw: - state: reset - when: - - ansible_os_family == "Debian" - - firewall_enabled | default(true) - - name: Set default incoming policy to deny ufw: direction: incoming @@ -102,6 +107,18 @@ - ansible_os_family == "Debian" - firewall_enabled | default(true) +- name: "Capture existing ufw rules" + ansible.builtin.command: ufw status verbose + register: _fw_ufw_rules + changed_when: false + failed_when: false + check_mode: false + when: + - ansible_os_family == "Debian" + - firewall_enabled | default(true) + - _fw_ufw_active.stdout is defined + - "'Status: active' in _fw_ufw_active.stdout" + - name: Allow all traffic from trusted subnets ufw: rule: allow @@ -111,6 +128,7 @@ when: - ansible_os_family == "Debian" - firewall_enabled | default(true) + - _fw_ufw_rules.skipped | default(true) or item.subnet not in _fw_ufw_rules.stdout - name: Allow SSH from specific IPs ufw: @@ -124,6 +142,7 @@ - ansible_os_family == "Debian" - firewall_enabled | default(true) - firewall_ssh_allow_from | length > 0 + - _fw_ufw_rules.skipped | default(true) or item.ip not in _fw_ufw_rules.stdout - name: Allow per-host public services ufw: @@ -137,6 +156,7 @@ - ansible_os_family == "Debian" - firewall_enabled | default(true) - firewall_allow_rules | length > 0 + - _fw_ufw_rules.skipped | default(true) or (item.port | string + '/' + item.proto) not in _fw_ufw_rules.stdout - name: Enable IP forwarding ansible.posix.sysctl: @@ -173,3 +193,5 @@ when: - ansible_os_family == "Debian" - firewall_enabled | default(true) + - _fw_ufw_active.stdout is defined + - "'Status: active' not in _fw_ufw_active.stdout" diff --git a/ansible/roles/librenms/tasks/main.yml b/ansible/roles/librenms/tasks/main.yml index 759ac5e..4cefeb5 100644 --- a/ansible/roles/librenms/tasks/main.yml +++ b/ansible/roles/librenms/tasks/main.yml @@ -3,7 +3,7 @@ ansible.builtin.deb822_repository: name: mariadb types: deb - uris: https://mirror.rackspace.com/mariadb/repo/12.2/debian + uris: https://mirror.rackspace.com/mariadb/repo/11.8/debian suites: trixie components: main signed_by: https://mariadb.org/mariadb_release_signing_key.pgp diff --git a/ansible/roles/mailcow/tasks/main.yml b/ansible/roles/mailcow/tasks/main.yml index 11de7f2..da6c014 100644 --- a/ansible/roles/mailcow/tasks/main.yml +++ b/ansible/roles/mailcow/tasks/main.yml @@ -59,7 +59,15 @@ when: not mailcow_repo.stat.exists - name: Add Mailcow directory to git safe directories - command: git config --global --add safe.directory {{ mailcow_base_path }} + ansible.builtin.shell: | + if git config --global --get safe.directory {{ mailcow_base_path }} >/dev/null 2>&1; then + echo "already_present" + else + git config --global --add safe.directory {{ mailcow_base_path }} + echo "added" + fi + register: git_safe_dir + changed_when: "'added' in git_safe_dir.stdout" when: mailcow_repo.stat.exists - name: Update Mailcow repository @@ -141,6 +149,7 @@ args: chdir: "{{ mailcow_base_path }}" failed_when: false + changed_when: false - name: Prune unused Docker networks command: docker network prune -f @@ -150,11 +159,15 @@ command: docker compose pull args: chdir: "{{ mailcow_base_path }}" + register: mailcow_pull_result + changed_when: "'Pulling' in mailcow_pull_result.stdout or 'Downloaded' in mailcow_pull_result.stderr" - name: Start Mailcow services command: docker compose up -d args: chdir: "{{ mailcow_base_path }}" + register: mailcow_up_result + changed_when: "'Created' in mailcow_up_result.stdout or 'Starting' in mailcow_up_result.stdout" - name: Check if ufw is installed command: which ufw diff --git a/ansible/roles/tailscale/tasks/main.yml b/ansible/roles/tailscale/tasks/main.yml index 097759a..908d69e 100644 --- a/ansible/roles/tailscale/tasks/main.yml +++ b/ansible/roles/tailscale/tasks/main.yml @@ -4,7 +4,7 @@ url: https://pkgs.tailscale.com/stable/debian/bookworm.noarmor.gpg dest: /usr/share/keyrings/tailscale-archive-keyring.gpg mode: '0644' - force: true + force: false - name: Add Tailscale repository ansible.builtin.deb822_repository: