Graham McIntire
fb5803c866
- bootstrap.yml: support pkg for FreeBSD sudo/python3 install - base role: FreeBSD package sets, sudoers paths, host key regen, admin group, usermod process-in-use tolerance - freebsd role: pkg update/upgrade tasks - general role: standalone hostname tasks (ungated from network.skip), hostname_override support - inspircd role: deploy configs for ca/us manero.org irc servers with vault-backed secrets - uisp role: download and run installer on fresh hosts, skip if already running - netbox role: stop services before usermod to avoid process-in-use failures - hosts: add irc_servers group, ca/us.manero.org (Tailscale), drop staging.towerops.net - all.yml: graham user gets static ed25519 key alongside github keys
85 lines
2.8 KiB
YAML
85 lines
2.8 KiB
YAML
---
|
|
- name: Bootstrap new host - Setup sudo
|
|
hosts: all
|
|
tags: bootstrap
|
|
remote_user: graham
|
|
gather_facts: false
|
|
vars:
|
|
ansible_user: graham
|
|
tasks:
|
|
# Probe before attempting privilege escalation. If sudo already works for
|
|
# graham, the install-via-su tasks below would otherwise block on a root
|
|
# password prompt that the Makefile's `-K` is designed to feed — and on a
|
|
# passwordless-sudo host with no `-K` provided, hang indefinitely.
|
|
- name: Probe sudo state
|
|
ansible.builtin.raw: |
|
|
if command -v sudo >/dev/null 2>&1; then
|
|
if sudo -n true 2>/dev/null; then
|
|
echo "sudo-passwordless"
|
|
else
|
|
echo "sudo-needs-password"
|
|
fi
|
|
else
|
|
echo "sudo-missing"
|
|
fi
|
|
register: sudo_state
|
|
changed_when: false
|
|
|
|
- name: Ensure sudo is present
|
|
ansible.builtin.raw: |
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
apt-get update && apt-get install -y sudo
|
|
elif command -v dnf >/dev/null 2>&1; then
|
|
dnf install -y sudo
|
|
elif command -v yum >/dev/null 2>&1; then
|
|
yum install -y sudo
|
|
elif command -v apk >/dev/null 2>&1; then
|
|
apk add --no-cache sudo
|
|
elif command -v pkg >/dev/null 2>&1; then
|
|
pkg bootstrap -y && pkg install -y sudo
|
|
else
|
|
echo "Unsupported package manager for sudo installation" >&2
|
|
exit 1
|
|
fi
|
|
become: true
|
|
become_method: su
|
|
become_user: root
|
|
when: "'sudo-missing' in sudo_state.stdout"
|
|
|
|
- name: Ensure Python 3 is present
|
|
ansible.builtin.raw: |
|
|
if command -v python3 >/dev/null 2>&1; then
|
|
exit 0
|
|
fi
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
apt-get update && apt-get install -y python3 python3-apt
|
|
elif command -v dnf >/dev/null 2>&1; then
|
|
dnf install -y python3
|
|
elif command -v yum >/dev/null 2>&1; then
|
|
yum install -y python3
|
|
elif command -v apk >/dev/null 2>&1; then
|
|
apk add --no-cache python3 py3-pip
|
|
elif command -v pkg >/dev/null 2>&1; then
|
|
pkg install -y python3
|
|
else
|
|
echo "Unsupported package manager for python3 installation" >&2
|
|
exit 1
|
|
fi
|
|
changed_when: false
|
|
become: true
|
|
# Once sudo exists (newly installed or pre-existing) prefer it; only fall
|
|
# back to `su` if sudo really isn't there.
|
|
become_method: "{{ 'su' if 'sudo-missing' in sudo_state.stdout else 'sudo' }}"
|
|
become_user: root
|
|
|
|
- name: Bootstrap new host - Base configuration
|
|
hosts: all
|
|
tags: bootstrap
|
|
remote_user: graham
|
|
become: true
|
|
become_method: sudo # Requires -K if graham needs a sudo password (see bootstrap-init target)
|
|
vars:
|
|
ansible_user: graham
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
roles:
|
|
- base
|