playbook.yaml

---

- hosts: all
  become: true
  remote_user: mirror

  handlers:
    - import_tasks: handlers.yaml

  tasks:
    - name: "Load OS specific vault"
      include_vars: vault/common.yml

    - name: "Load OS specific vault"
      include_vars: "{{ lookup('first_found', params) }}"
      vars:
        params:
          files:
            - "{{ ansible_hostname|lower }}.yml"
            - default.yml
          paths:
            - 'vault'

    - name: Enable EPEL
      dnf:
        name: epel-release
        state: latest

    - name: Enable copr warthog9/epel8-missing-pieces
      include_role:
        name: devnullcake.copr-repository
      vars:
        copr_repository: "warthog9/epel8-missing-pieces"
        copr_repository_action: "install"
      when:
        ansible_distribution != 'Fedora'
        and
        (
          ansible_distribution_file_variety == 'RedHat'
          or
          ansible_distribution == 'CentOS'
          or
          ansible_distribution == 'Red Hat Enterprise Linux'
        )
        and
        ansible_facts['distribution_major_version']|int == 8

    - name: Enable copr warthog9/epel9-missing-pieces
      include_role:
        name: devnullcake.copr-repository
      vars:
        copr_repository: "warthog9/epel9-missing-pieces"
        copr_repository_action: "install"
      when:
        ansible_distribution != 'Fedora'
        and
        (
          ansible_distribution_file_variety == 'RedHat'
          or
          ansible_distribution == 'CentOS'
          or
          ansible_distribution == 'Red Hat Enterprise Linux'
        )
        and
        ansible_facts['distribution_major_version']|int == 9

    - name: Enable rsync backports repo
      ansible.builtin.yum_repository:
        name: backports-rsync
        description: AlmaLinux Backports - rsync
        file: almalinux-rsync
        baseurl: http://repo.almalinux.org/backports/$releasever/$basearch/rsync/
        gpgcheck: yes
        gpgkey:
          - file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
          - file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9

    - name: Install required software
      package:
        state: present
        name:
          - byobu
          - certbot
          - cockpit
          - cockpit-ws
          - dnf-automatic
          - dstat
          - duperemove
          - gnutls
          - lldpd
          - mosquitto
          - net-tools
          - pciutils
          - postfix
          - python3-certbot-nginx
          - python3-policycoreutils
          - policycoreutils-python-utils
          - rsync
          - rsync-daemon
          - rsyslog-gnutls
          - screen
          - smartmontools
          - tcpdump
          - traceroute
          - vim
          - wget
          - whois

    - name: Postfix make sure devnull@localhost exists
      include_role:
        name: repleo.aliases
      vars:
        aliases:
          - user: devnull
            alias: /dev/null

    - name: Enable postfix service
      systemd:
        name: postfix.service
        state: started
        enabled: yes

    - name: Install required software
      package:
        state: present
        name:
          - '@nginx:1.20/common'
      when:
        ansible_facts['distribution_major_version']|int == 8

    - name: Install required software
      package:
        state: present
        name:
          - nginx
          - nginx-mod-http-xslt-filter
      when:
        ansible_facts['distribution_major_version']|int == 9

    - name: Update all software
      dnf:
        state: latest
        name: "*"

    - name: Set timezone
      timezone:
        name: America/Los_Angeles

    - name: Install SSH keys
      authorized_key:
        user: mirror
        state: present
        key: '{{ main_ssh_keys }}'
      loop_control:
        loop_var: main_ssh_keys
      loop:
      with_items:
        - https://github.com/phirephly.keys
        - https://github.com/warthog9.keys
        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDbALSrSqVWdZfxIkUv7aSX4c1Qd96bFED3JyPv7fx2O Warthog9gandalfWSL"

    - name: Enable sshd_config.d on EL8
      copy:
        src: files/sshd_config.el8
        dest: /etc/ssh/sshd_config
      when:
        ansible_facts['distribution_major_version']|int == 8
      notify:
        - reload sshd

    - name: Install sshd config snippets
      copy:
        src: files/sshd_config.d
        dest: /etc/ssh/
      notify:
        - reload sshd

    - name: Check if TLS is already setup - ssl options
      stat:
        path: /etc/letsencrypt/options-ssl-nginx.conf
      register: letsencrypt_nginx_options 

    - name: Check if TLS is already setup - actual certificate
      stat:
        path: /etc/letsencrypt/live/{{ansible_nodename}}/fullchain.pem
      register: ssl_cert_fullchain

    - name: Ok lets setup letsencrypt quick
      set_fact: tls_setup=True

    - name: Ok lets setup letsencrypt quick
      set_fact: tls_setup=False
      when:
        not letsencrypt_nginx_options.stat.exists
        or
        not ssl_cert_fullchain.stat.exists

    - name: Configure Nginx - NO TLS
      template:
        src: templates/nginx.conf
        dest: /etc/nginx/nginx.conf
      notify:
        - reload nginx
      when: not tls_setup

    - name: Install Nginx index template
      template:
        src: templates/autoindex.xslt
        dest: /usr/share/nginx/html/autoindex.xslt
      notify:
        - reload nginx

    - name: Install HTTP Favicon
      copy:
        src: files/favicon.ico
        dest: /usr/share/nginx/html/favicon.ico

    - name: Install HTTP Robots.txt
      copy:
        src: files/robots.txt
        dest: /usr/share/nginx/html/robots.txt

    - name: Start NGINX without TLS
      service:
        name: nginx
        state: reloaded
        enabled: yes
      ignore_errors: yes
      when: not tls_setup

    - name: Snag SSL cert
      command: /usr/bin/certbot -d {{ansible_nodename}} --nginx --non-interactive --agree-tos -m mirror@fcix.net
      when: not tls_setup
      ignore_errors: true
      register: certbot_status

    - name: Ok lets setup letsencrypt quick
      set_fact: tls_setup=True
      when:
        not tls_setup
        and
        certbot_status.rc == 0

    # run this after we've done all the bits to make this work
    - name: Configure Nginx
      template:
        src: templates/nginx.conf
        dest: /etc/nginx/nginx.conf
      notify:
        - reload nginx
      when: tls_setup

    - name: Configure nftables firewall
      template:
        src: templates/nftables.conf
        dest: /etc/sysconfig/nftables.conf
      notify: reload firewall

    - name: Disable firewalld
      service:
        name: firewalld
        state: stopped
        enabled: no

    - name: Enable nftables
      service:
        name: nftables
        state: started
        enabled: yes

    - name: Copy over sysctl IP stack optimizations
      copy:
        src: files/sysctl.performancetune.conf
        dest: /etc/sysctl.d/50-performancetune.conf
      notify: reload sysctl

    - name: Install Update Script
      template:
        src: templates/update-mirror.sh
        dest: /usr/local/bin/update-mirror.sh
        mode: '0755'

    - name: Schedule cron tasks
      copy:
        src: "{{ item }}"
        dest: /etc/cron.d/
      with_fileglob: files/cron.d/*

    - name: Create Mirror Data Dir
      file:
        path: /data/mirror
        state: directory
        owner: mirror
        group: mirror

    - name: Create Mirror Log Dir
      file:
        path: /var/log/mirror
        state: directory
        owner: mirror
        group: mirror

    - name: Create Mirror Lock Dir
      file:
        path: /home/mirror/lock
        state: directory
        owner: mirror
        group: mirror

    - name: Configure Rsyncd
      template:
        src: templates/rsyncd.conf
        dest: /etc/rsyncd.conf

    - name: Enable rsyncd
      service:
        name: rsyncd
        state: started
        enabled: yes

    - name: Install mqtt-exec
      copy:
        src: files/mqtt-exec
        dest: /usr/local/bin/mqtt-exec
        mode: '0755'

    - name: Install mqtt-exec service unit
      copy:
        src: files/systemd.mqtt-exec.service
        dest: /etc/systemd/system/mqtt-exec.service

    - name: Enable mqtt-exec service
      systemd:
        name: mqtt-exec.service
        state: started
        enabled: yes

    - name: Enable LLDP
      service:
        name: lldpd
        state: started
        enabled: yes

    - name: Install chronyd config file
      copy:
        src: files/chrony.conf
        dest: /etc/chrony.conf
      notify: restart chrony

    - name: Enable chronyd service
      systemd:
        name: chronyd.service
        state: started
        enabled: yes

    - name: Setup fail2ban
      include_role:
        name: fail2ban

    - name: fail2ban- selinux module from template
      include_role:
        name: mwojtowicz.semodule
        tasks_from: semodule.yml
      vars:
        selinux_module: "{{ main_selinux_modules }}"
      loop_control:
        loop_var: main_selinux_modules
      loop:
        - my-nginx
        - my-f2bfsshd2
        - my-grep
        - my-reader3-6
        - my-reader3-7
        - my-reader0-3

    - name: set SELinux nis_enable
      seboolean:
        name: nis_enabled
        state: true
        persistent: true

    - name: set SELinux rsync_export_all_ro
      seboolean:
        name: rsync_export_all_ro
        state: true
        persistent: true

    - name: Copy Automatic update config
      copy:
        src: files/dnf-automatic.conf
        dest: /etc/dnf/automatic.conf
        mode: '0644'
        owner: root
        group: root

    - name: Ensure Automatic Updates are enabled
      systemd:
        name: dnf-automatic.timer
        state: started
        enabled: yes