Graham McIntire
ee72c64246
- Convert ~290 short module names to FQCNs across all roles - Change become: yes/no to become: true/false, gather_facts: no to false - Remove deprecated inject_facts_as_vars from ansible.cfg - Add missing task names to import_tasks/include_role calls - Add become: yes to librenms clone task (partial-become fix) - Add pipefail to risky shell command in udp-gro-fix.yml - Quote all octal mode values - Harden .ansible-lint with production profile and empty skip_list - Update findings.md with all fixes
136 lines
No EOL
3.2 KiB
YAML
136 lines
No EOL
3.2 KiB
YAML
---
|
|
# Install and configure Syncthing
|
|
|
|
- name: Install required packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- apt-transport-https
|
|
- curl
|
|
- gnupg2
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Add Syncthing GPG key
|
|
ansible.builtin.get_url:
|
|
url: "https://syncthing.net/release-key.gpg"
|
|
dest: /usr/share/keyrings/syncthing-archive-keyring.gpg
|
|
mode: '0644'
|
|
|
|
- name: Add Syncthing repository
|
|
ansible.builtin.deb822_repository:
|
|
name: syncthing
|
|
types: deb
|
|
uris: https://apt.syncthing.net/
|
|
suites: syncthing
|
|
components: stable
|
|
signed_by: /usr/share/keyrings/syncthing-archive-keyring.gpg
|
|
state: present
|
|
|
|
- name: Install Syncthing
|
|
ansible.builtin.apt:
|
|
name: syncthing
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Ensure graham user exists
|
|
ansible.builtin.user:
|
|
name: graham
|
|
state: present
|
|
|
|
- name: Create Syncthing configuration directory
|
|
ansible.builtin.file:
|
|
path: /home/graham/.config/syncthing
|
|
state: directory
|
|
owner: graham
|
|
group: graham
|
|
mode: '0755'
|
|
|
|
- name: Deploy Syncthing configuration
|
|
ansible.builtin.template:
|
|
src: config.xml.j2
|
|
dest: /home/graham/.config/syncthing/config.xml
|
|
owner: graham
|
|
group: graham
|
|
mode: '0600'
|
|
backup: true
|
|
notify: restart syncthing
|
|
|
|
- name: Create Syncthing systemd service
|
|
ansible.builtin.copy:
|
|
content: |
|
|
[Unit]
|
|
Description=Syncthing - Open Source Continuous File Synchronization
|
|
Documentation=man:syncthing(1)
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=graham
|
|
ExecStart=/usr/bin/syncthing serve --no-browser --no-restart --logflags=0
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
SuccessExitStatus=3 4
|
|
RestartForceExitStatus=3 4
|
|
|
|
# Hardening
|
|
SystemCallArchitectures=native
|
|
MemoryDenyWriteExecute=true
|
|
NoNewPrivileges=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
dest: /etc/systemd/system/syncthing@graham.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: restart syncthing
|
|
|
|
- name: Stop old syncthing service if exists
|
|
ansible.builtin.systemd:
|
|
name: syncthing@syncthing
|
|
state: stopped
|
|
enabled: false
|
|
failed_when: false
|
|
|
|
- name: Enable and start Syncthing service
|
|
ansible.builtin.systemd:
|
|
name: syncthing@graham
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
|
|
- name: Check if ufw is installed
|
|
ansible.builtin.command: which ufw
|
|
register: ufw_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Configure firewall for Syncthing web UI
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: '8384'
|
|
proto: tcp
|
|
comment: 'Syncthing Web UI'
|
|
when:
|
|
- ansible_facts['os_family'] == "Debian"
|
|
- ufw_check.rc == 0
|
|
|
|
- name: Configure firewall for Syncthing sync protocol
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: '22000'
|
|
proto: tcp
|
|
comment: 'Syncthing Sync Protocol'
|
|
when:
|
|
- ansible_facts['os_family'] == "Debian"
|
|
- ufw_check.rc == 0
|
|
|
|
- name: Configure firewall for Syncthing discovery
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: '21027'
|
|
proto: udp
|
|
comment: 'Syncthing Local Discovery'
|
|
when:
|
|
- ansible_facts['os_family'] == "Debian"
|
|
- ufw_check.rc == 0 |