Add fail2ban role and clean up yaml lint noise
This commit is contained in:
@@ -1,35 +1,37 @@
|
||||
---
|
||||
# tasks file for ensure_apache
|
||||
- name: 'include variables'
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- name: include variables
|
||||
when: ["ansible_facts[\"system\"] == 'Linux'"]
|
||||
ansible.builtin.include_vars:
|
||||
file: '{{ lookup("first_found", findme) }}'
|
||||
name: 'ensure_apache'
|
||||
name: ensure_apache
|
||||
vars:
|
||||
findme:
|
||||
files:
|
||||
- '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
|
||||
- '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
|
||||
- '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
|
||||
}}-{{ ansible_facts["architecture"] }}.yml'
|
||||
- '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
|
||||
}}-default.yml'
|
||||
- '{{ ansible_facts["distribution"] }}-default.yml'
|
||||
- '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
|
||||
- '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
|
||||
- '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
|
||||
}}-{{ ansible_facts["architecture"] }}.yml'
|
||||
- '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
|
||||
}}-default.yml'
|
||||
- '{{ ansible_facts["os_family"] }}-default.yml'
|
||||
- 'default.yml'
|
||||
paths:
|
||||
- '../vars/'
|
||||
errors: 'ignore'
|
||||
- name: 'package discovery'
|
||||
- default.yml
|
||||
paths: [../vars/]
|
||||
errors: ignore
|
||||
- name: package discovery
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- ansible_facts["packages"] is not defined
|
||||
ansible.builtin.package_facts:
|
||||
- name: 'service discovery'
|
||||
- name: service discovery
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- ansible_facts["services"] is not defined
|
||||
ansible.builtin.service_facts:
|
||||
- name: 'ensure sysctl'
|
||||
- name: ensure sysctl
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- ensure_apache is defined
|
||||
@@ -46,11 +48,11 @@
|
||||
loop_control:
|
||||
label: '{{ item.name }} will be {{ item.value }}'
|
||||
notify:
|
||||
- 'ensure_apache.package_facts'
|
||||
- 'ensure_apache.service_facts'
|
||||
- 'ensure_apache.service_reload'
|
||||
- 'ensure_apache.service_restart'
|
||||
- name: 'ensure packages'
|
||||
- ensure_apache.package_facts
|
||||
- ensure_apache.service_facts
|
||||
- ensure_apache.service_reload
|
||||
- ensure_apache.service_restart
|
||||
- name: ensure packages
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- ensure_apache is defined
|
||||
@@ -63,11 +65,11 @@
|
||||
loop_control:
|
||||
label: '{{ item.name }} will be {{ item.state }}'
|
||||
notify:
|
||||
- 'ensure_apache.package_facts'
|
||||
- 'ensure_apache.service_facts'
|
||||
- 'ensure_apache.service_reload'
|
||||
- 'ensure_apache.service_restart'
|
||||
- name: 'ensure seboolean'
|
||||
- ensure_apache.package_facts
|
||||
- ensure_apache.service_facts
|
||||
- ensure_apache.service_reload
|
||||
- ensure_apache.service_restart
|
||||
- name: ensure seboolean
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- ensure_apache is defined
|
||||
@@ -81,11 +83,11 @@
|
||||
loop_control:
|
||||
label: '{{ item.name }} will be {{ item.state }}'
|
||||
notify:
|
||||
- 'ensure_apache.package_facts'
|
||||
- 'ensure_apache.service_facts'
|
||||
- 'ensure_apache.service_reload'
|
||||
- 'ensure_apache.service_restart'
|
||||
- name: 'ensure configurations'
|
||||
- ensure_apache.package_facts
|
||||
- ensure_apache.service_facts
|
||||
- ensure_apache.service_reload
|
||||
- ensure_apache.service_restart
|
||||
- name: ensure configurations
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- http_vhost is defined
|
||||
@@ -107,11 +109,11 @@
|
||||
loop_control:
|
||||
label: '{{ item.dest }} will be ensured'
|
||||
notify:
|
||||
- 'ensure_apache.package_facts'
|
||||
- 'ensure_apache.service_facts'
|
||||
- 'ensure_apache.service_reload'
|
||||
- 'ensure_apache.service_restart'
|
||||
- name: 'ensure firewall'
|
||||
- ensure_apache.package_facts
|
||||
- ensure_apache.service_facts
|
||||
- ensure_apache.service_reload
|
||||
- ensure_apache.service_restart
|
||||
- name: ensure firewall
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- ansible_facts.packages["firewalld"] is defined
|
||||
@@ -127,11 +129,11 @@
|
||||
loop_control:
|
||||
label: '{{ item.service }} will be {{ item.state }}'
|
||||
notify:
|
||||
- 'ensure_apache.package_facts'
|
||||
- 'ensure_apache.service_facts'
|
||||
- 'ensure_apache.service_reload'
|
||||
- 'ensure_apache.service_restart'
|
||||
- name: 'ensure permissions'
|
||||
- ensure_apache.package_facts
|
||||
- ensure_apache.service_facts
|
||||
- ensure_apache.service_reload
|
||||
- ensure_apache.service_restart
|
||||
- name: ensure permissions
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- ensure_apache is defined
|
||||
@@ -158,11 +160,11 @@
|
||||
loop_control:
|
||||
label: '{{ item.path }} will be ensured'
|
||||
notify:
|
||||
- 'ensure_apache.package_facts'
|
||||
- 'ensure_apache.service_facts'
|
||||
- 'ensure_apache.service_reload'
|
||||
- 'ensure_apache.service_restart'
|
||||
- name: 'ensure vhost document roots'
|
||||
- ensure_apache.package_facts
|
||||
- ensure_apache.service_facts
|
||||
- ensure_apache.service_reload
|
||||
- ensure_apache.service_restart
|
||||
- name: ensure vhost document roots
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- ensure_apache is defined
|
||||
@@ -170,21 +172,21 @@
|
||||
- http_vhost is iterable
|
||||
- item.fqdn is defined
|
||||
ansible.builtin.file:
|
||||
path: '/srv/http/{{ item.fqdn }}'
|
||||
state: 'directory'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
path: /srv/http/{{ item.fqdn }}
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
setype: 'httpd_sys_content_t'
|
||||
setype: httpd_sys_content_t
|
||||
loop: '{{ http_vhost }}'
|
||||
loop_control:
|
||||
label: '/srv/http/{{ item.fqdn }} will be ensured'
|
||||
label: /srv/http/{{ item.fqdn }} will be ensured
|
||||
notify:
|
||||
- 'ensure_apache.package_facts'
|
||||
- 'ensure_apache.service_facts'
|
||||
- 'ensure_apache.service_reload'
|
||||
- 'ensure_apache.service_restart'
|
||||
- name: 'ensure website content from git repos'
|
||||
- ensure_apache.package_facts
|
||||
- ensure_apache.service_facts
|
||||
- ensure_apache.service_reload
|
||||
- ensure_apache.service_restart
|
||||
- name: ensure website content from git repos
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- ensure_apache is defined
|
||||
@@ -194,17 +196,17 @@
|
||||
- item.repo is defined
|
||||
ansible.builtin.git:
|
||||
accept_hostkey: 'yes'
|
||||
dest: '/srv/http/{{ item.fqdn }}'
|
||||
dest: /srv/http/{{ item.fqdn }}
|
||||
repo: '{{ item.repo }}'
|
||||
loop: '{{ http_vhost }}'
|
||||
loop_control:
|
||||
label: '/srv/http/{{ item.fqdn }} will be populated...'
|
||||
label: /srv/http/{{ item.fqdn }} will be populated...
|
||||
notify:
|
||||
- 'ensure_apache.package_facts'
|
||||
- 'ensure_apache.service_facts'
|
||||
- 'ensure_apache.service_reload'
|
||||
- 'ensure_apache.service_restart'
|
||||
- name: 'ensure services'
|
||||
- ensure_apache.package_facts
|
||||
- ensure_apache.service_facts
|
||||
- ensure_apache.service_reload
|
||||
- ensure_apache.service_restart
|
||||
- name: ensure services
|
||||
when:
|
||||
- ansible_facts["system"] == 'Linux'
|
||||
- ensure_apache is defined
|
||||
@@ -218,10 +220,9 @@
|
||||
loop_control:
|
||||
label: '{{ item.name }} will be {{ item.state }}'
|
||||
notify:
|
||||
- 'ensure_apache.package_facts'
|
||||
- 'ensure_apache.service_facts'
|
||||
- 'ensure_apache.service_reload'
|
||||
- 'ensure_apache.service_restart'
|
||||
- name: 'flush handlers'
|
||||
ansible.builtin.meta: 'flush_handlers'
|
||||
...
|
||||
- ensure_apache.package_facts
|
||||
- ensure_apache.service_facts
|
||||
- ensure_apache.service_reload
|
||||
- ensure_apache.service_restart
|
||||
- name: flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
Reference in New Issue
Block a user