semaphore-playbooks/debian12-basic.yml

87 lines
2.1 KiB
YAML
Raw Normal View History

2023-07-21 00:23:22 +00:00
---
- name: Update web servers
hosts: all
remote_user: root
2023-07-21 04:09:23 +00:00
vars:
2023-07-21 04:12:06 +00:00
swapfile_size: 1024
2023-07-21 04:09:23 +00:00
swapfile_path: /swapfile
2023-07-21 00:23:22 +00:00
tasks:
- name: Update all packages to their latest version
ansible.builtin.apt:
name: "*"
state: latest
update_cache: yes
- name: Install a list of packages
ansible.builtin.apt:
pkg:
2023-07-21 03:00:58 +00:00
- htop
2023-07-21 04:09:23 +00:00
- unp
2023-07-21 04:18:56 +00:00
- ufw
2023-07-21 17:16:27 +00:00
- net-tools
2023-08-06 20:11:57 +00:00
- unzip
- btop
2023-07-21 04:09:23 +00:00
- name: Create swap file
2023-07-21 04:10:55 +00:00
command: dd if=/dev/zero of={{ swapfile_path }} bs=1M count={{ swapfile_size }}
2023-07-21 04:09:23 +00:00
args:
creates: "{{ swapfile_path }}"
register: swapfile_register_create
- name: Set swap file permissions
file:
path: "{{ swapfile_path }}"
state: "file"
owner: "root"
group: "root"
mode: "0600"
- name: Initialize swap file
command: mkswap {{ swapfile_path }}
when: swapfile_register_create is changed
- name: Enable swap file
command: swapon {{ swapfile_path }}
when: swapfile_register_create is changed
- name: Manage swap file in /etc/fstab
mount:
src: "{{ swapfile_path }}"
name: "none"
fstype: "swap"
opts: "sw,nofail"
dump: "0"
passno: "0"
2023-07-21 04:18:56 +00:00
state: "present"
2023-07-21 04:19:47 +00:00
- name: Allow all access to tcp port 22
community.general.ufw:
rule: allow
port: '22'
proto: tcp
2023-07-21 11:03:45 +00:00
#Monitoring Server
- name: Install monitoring service from deb
ansible.builtin.apt:
deb: https://kekscloud-releases.s3.eu-central-003.backblazeb2.com/http-server-status/stable.deb
2023-07-21 04:19:47 +00:00
2023-07-21 17:17:43 +00:00
- name: Allow all access to tcp port 3003
2023-07-21 17:16:27 +00:00
community.general.ufw:
rule: allow
port: '3003'
proto: tcp
2023-07-21 17:27:56 +00:00
- name: Enable service httpd and ensure it is not masked
ansible.builtin.systemd:
name: http-server-status
enabled: true
masked: no
2023-07-21 17:16:27 +00:00
2023-07-21 17:27:56 +00:00
- name: Make sure a service http-server-status.service is running
ansible.builtin.systemd:
2023-07-21 18:34:39 +00:00
state: restarted
2023-07-21 17:31:09 +00:00
name: http-server-status.service
2023-07-21 17:16:27 +00:00
2023-07-21 04:19:47 +00:00
- name: Allow everything and enable UFW
community.general.ufw:
state: enabled
2023-07-21 04:22:01 +00:00
policy: deny