62 lines
3.1 KiB
YAML
62 lines
3.1 KiB
YAML
---
|
|
# Notice that "# noqa: package-latest" is included in this file. This disabled a specific check for the Ansible linter,
|
|
# see: https://ansible.readthedocs.io/projects/lint/usage/#muting-warnings-to-avoid-false-positives.
|
|
# For a purely reproducible build this would be a good suggestion but I'm willing to take the risk with the Pi.
|
|
- name: Install raspberry pi
|
|
hosts: raspberry_pis
|
|
vars_files:
|
|
- vault.yml
|
|
roles:
|
|
# These roles are disabled after they have being applied once for performance reasons, it should be safe to enable them again.
|
|
# Notice that this role changes some settings on reruns (on the "Change various sysctl-settings" task), doesn't seem problematic though.
|
|
# - role: devsec.hardening.os_hardening
|
|
# become: true
|
|
# - role: devsec.hardening.ssh_hardening
|
|
# become: true
|
|
# - role: snapcraft
|
|
# - role: user
|
|
# - role: cloudflare-ddns
|
|
# - role: reverse-proxy
|
|
# - role: actual
|
|
- role: pi-hole
|
|
vars:
|
|
# devsec.hardening.os_hardening vars:
|
|
os_auth_pw_max_age: 99999 # Effectively disables the setting as mentioned in the docs.
|
|
os_cron_enabled: false # Cron isn't needed for the installation.
|
|
os_filesystem_whitelist:
|
|
- squashfs # Used by Snapcraft which is installed on the Raspberry Pi at some moment
|
|
sysctl_overwrite:
|
|
vm.mmap_rnd_bits: 16 # See the "sysctl - vm.mmap_rnd_bits" section of the docs.
|
|
net.ipv4.ip_forward: 1 # We're specifically going to allow ufw forwarding in the playbook.
|
|
# devsec.hardening.ssh_hardening vars:
|
|
ssh_allow_users: 'thomas'
|
|
ssh_client_port: 22 # Default, but duplicated here for documentation purpose. Not changed because its only accessible via LAN.
|
|
ssh_client_password_login: false # Default, but duplicated here for documentation purpose.
|
|
tasks:
|
|
# This task can be handy for debugging gathered facts, uncomment it if necessary:
|
|
# - name: Store gathered facts in local file
|
|
# delegate_to: localhost
|
|
# ansible.builtin.copy:
|
|
# dest: './.ansible_facts.json'
|
|
# content: "{{ ansible_facts }}"
|
|
# mode: "0600"
|
|
- name: Add FQDN name in /etc/hosts
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/hosts
|
|
line: "{{ ansible_facts['default_ipv4']['address'] }} {{ hostname }}.kleinendorst.info {{ hostname }}"
|
|
# For some reason sudo becomes very slow when this isn't correctly configured. Fixing the configuration as suggested
|
|
# here: https://www.linuxquestions.org/questions/linux-newbie-8/fedora-11-sudo-has-a-20-second-start-delay-732291/#post3575840
|
|
# fixed the problem for me. We could try to remove the default hostname variable which was added by using the "ansible_facts['hostname']"
|
|
# variable which is fetched in the special "Gathering facts" step.
|
|
- name: Configure hostname
|
|
become: true
|
|
ansible.builtin.hostname:
|
|
name: "{{ hostname }}"
|
|
# TODO: Replace this with setup that sets up unnattended updates on the machine itself.
|
|
- name: Update all packages to their latest version # noqa: package-latest
|
|
become: true
|
|
ansible.builtin.apt:
|
|
name: "*"
|
|
state: latest
|
|
# TODO: install vim on the system
|