jmrothst
4078b0b064
Eliminate post-verification discovery and assert tasks (service_facts and package_facts) across all 19 roles and align AGENTS.md. Ansible's built-in declarative modules (package, service) already enforce target state natively and abort execution immediately on failure. The subsequent assertion loops were redundant, added significant runtime overhead, and produced false positives on non-service systemd units (.socket, .timer) and service aliases (e.g., dbus.socket failing under service_facts). - Remove service_facts and Assert Managed Services Are Active across 11 service roles (ensure_apache, ensure_cockpit, ensure_dbus, ensure_dovecot, ensure_fail2ban, ensure_firewalld, ensure_gitea, ensure_mariadb, ensure_podman, ensure_postfix, ensure_timezone). - Remove package_facts and Assert Managed Packages Are Installed across 8 package roles (ensure_ansible_prereq, ensure_git, ensure_os_patch, ensure_os_upgrade, ensure_repo_epel, ensure_repo_rpmfusion, ensure_rsync, ensure_vim). - Update AGENTS.md Section 8.2, Section 10, and Section 21 to codify declarative state enforcement and prohibit redundant post-task assertion loops.
235 lines
9.5 KiB
YAML
235 lines
9.5 KiB
YAML
---
|
|
# tasks file for ensure_mariadb
|
|
- name: Assert Target OS Is Supported
|
|
when:
|
|
- ansible_facts["system"] is defined
|
|
ansible.builtin.assert:
|
|
fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
|
|
quiet: true
|
|
that:
|
|
- ansible_facts["system"] == 'Linux'
|
|
- >-
|
|
ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
|
|
'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
|
|
- name: Include Variables
|
|
ansible.builtin.include_vars:
|
|
file: '{{ lookup("first_found", findme) }}'
|
|
name: ensure_mariadb
|
|
vars:
|
|
findme:
|
|
files:
|
|
- '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
|
|
}}-{{ ansible_facts["architecture"] }}.yml'
|
|
- '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
|
|
}}-default.yml'
|
|
- '{{ ansible_facts["distribution"] }}-default.yml'
|
|
- '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
|
|
}}-{{ ansible_facts["architecture"] }}.yml'
|
|
- '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
|
|
}}-default.yml'
|
|
- '{{ ansible_facts["os_family"] }}-default.yml'
|
|
- default.yml
|
|
paths: [../vars/]
|
|
errors: ignore
|
|
- name: Package Discovery
|
|
when:
|
|
- ansible_facts["packages"] is not defined
|
|
ansible.builtin.package_facts:
|
|
- name: Service Discovery
|
|
when:
|
|
- ansible_facts["services"] is not defined
|
|
ansible.builtin.service_facts:
|
|
- name: Ensure Sysctl
|
|
when:
|
|
- ensure_mariadb is defined
|
|
- ensure_mariadb.sysctl_list is defined
|
|
- ensure_mariadb.sysctl_list is iterable
|
|
ansible.posix.sysctl:
|
|
name: '{{ item.name }}'
|
|
reload: '{{ item.reload | default(omit) }}'
|
|
state: '{{ item.state }}'
|
|
sysctl_file: '{{ item.sysctl_file | default(omit) }}'
|
|
sysctl_set: '{{ item.sysctl_set | default(omit) }}'
|
|
value: '{{ item.value | default(omit) }}'
|
|
loop: '{{ ensure_mariadb.sysctl_list }}'
|
|
loop_control:
|
|
label: '{{ item.name }} will be {{ item.value }}'
|
|
notify:
|
|
- Ensure_Mariadb.Package_Facts
|
|
- Ensure_Mariadb.Service_Facts
|
|
- Ensure_Mariadb.Service_Reload
|
|
- Ensure_Mariadb.Service_Restart
|
|
- name: Ensure Packages
|
|
when:
|
|
- ensure_mariadb is defined
|
|
- ensure_mariadb.package_list is defined
|
|
- ensure_mariadb.package_list is iterable
|
|
ansible.builtin.package:
|
|
name: '{{ item.name }}'
|
|
state: '{{ item.state }}'
|
|
loop: '{{ ensure_mariadb.package_list }}'
|
|
loop_control:
|
|
label: '{{ item.name }} will be {{ item.state }}'
|
|
notify:
|
|
- Ensure_Mariadb.Package_Facts
|
|
- Ensure_Mariadb.Service_Facts
|
|
- Ensure_Mariadb.Service_Reload
|
|
- Ensure_Mariadb.Service_Restart
|
|
- name: Ensure Seboolean
|
|
when:
|
|
- ensure_mariadb is defined
|
|
- ensure_mariadb.seboolean_list is defined
|
|
- ensure_mariadb.seboolean_list is iterable
|
|
ansible.posix.seboolean:
|
|
name: '{{ item.name }}'
|
|
persistent: '{{ item.persistent }}'
|
|
state: '{{ item.state }}'
|
|
loop: '{{ ensure_mariadb.seboolean_list }}'
|
|
loop_control:
|
|
label: '{{ item.name }} will be {{ item.state }}'
|
|
notify:
|
|
- Ensure_Mariadb.Package_Facts
|
|
- Ensure_Mariadb.Service_Facts
|
|
- Ensure_Mariadb.Service_Reload
|
|
- Ensure_Mariadb.Service_Restart
|
|
- name: Ensure Configurations
|
|
when:
|
|
- ensure_mariadb is defined
|
|
- ensure_mariadb.template_list is defined
|
|
- ensure_mariadb.template_list is iterable
|
|
ansible.builtin.template:
|
|
backup: 'no'
|
|
dest: '{{ item.dest }}'
|
|
group: '{{ item.group | default(omit) }}'
|
|
mode: '{{ item.mode | default(omit) }}'
|
|
owner: '{{ item.owner | default(omit) }}'
|
|
selevel: '{{ item.selevel | default(omit) }}'
|
|
serole: '{{ item.serole | default(omit) }}'
|
|
setype: '{{ item.setype | default(omit) }}'
|
|
seuser: '{{ item.seuser | default(omit) }}'
|
|
src: '{{ item.src }}'
|
|
loop: '{{ ensure_mariadb.template_list }}'
|
|
loop_control:
|
|
label: '{{ item.dest }} will be ensured'
|
|
notify:
|
|
- Ensure_Mariadb.Package_Facts
|
|
- Ensure_Mariadb.Service_Facts
|
|
- Ensure_Mariadb.Service_Reload
|
|
- Ensure_Mariadb.Service_Restart
|
|
- name: Ensure Firewall
|
|
when:
|
|
- ansible_facts.packages["firewalld"] is defined
|
|
- ansible_facts.packages["python3-firewall"] is defined
|
|
- ensure_mariadb is defined
|
|
- ensure_mariadb.firewalld_list is defined
|
|
- ensure_mariadb.firewalld_list is iterable
|
|
ansible.posix.firewalld:
|
|
permanent: '{{ item.permanent }}'
|
|
service: '{{ item.service }}'
|
|
state: '{{ item.state }}'
|
|
loop: '{{ ensure_mariadb.firewalld_list }}'
|
|
loop_control:
|
|
label: '{{ item.service }} will be {{ item.state }}'
|
|
notify:
|
|
- Ensure_Mariadb.Package_Facts
|
|
- Ensure_Mariadb.Service_Facts
|
|
- Ensure_Mariadb.Service_Reload
|
|
- Ensure_Mariadb.Service_Restart
|
|
- name: Ensure Services
|
|
when:
|
|
- ensure_mariadb is defined
|
|
- ensure_mariadb.service_list is defined
|
|
- ensure_mariadb.service_list is iterable
|
|
ansible.builtin.service:
|
|
enabled: '{{ item.enabled }}'
|
|
name: '{{ item.name }}'
|
|
state: '{{ item.state }}'
|
|
loop: '{{ ensure_mariadb.service_list }}'
|
|
loop_control:
|
|
label: '{{ item.name }} will be {{ item.state }}'
|
|
notify:
|
|
- Ensure_Mariadb.Package_Facts
|
|
- Ensure_Mariadb.Service_Facts
|
|
- Ensure_Mariadb.Service_Reload
|
|
- Ensure_Mariadb.Service_Restart
|
|
- name: Flush Handlers
|
|
ansible.builtin.meta: flush_handlers
|
|
- name: Ensure Mariadb Databases
|
|
when: [mariadb_db_list is defined, mariadb_db_list is iterable]
|
|
ansible.mysql.mysql_db:
|
|
ca_cert: '{{ item.ca_cert | default(omit) }}'
|
|
chdir: '{{ item.chdir | default(omit) }}'
|
|
check_hostname: '{{ item.check_hostname | default(omit) }}'
|
|
client_cert: '{{ item.client_cert | default(omit) }}'
|
|
client_key: '{{ item.client_key | default(omit) }}'
|
|
collation: '{{ item.collation | default(omit) }}'
|
|
config_file: '{{ item.config_file | default(omit) }}'
|
|
config_overrides_defaults: '{{ item.config_overrides_defaults | default(omit) }}'
|
|
connect_timeout: '{{ item.connect_timeout | default(omit) }}'
|
|
dump_extra_args: '{{ item.dump_extra_args | default(omit) }}'
|
|
encoding: '{{ item.encoding | default(omit) }}'
|
|
force: '{{ item.force | default(omit) }}'
|
|
hex_blob: '{{ item.hex_blob | default(omit) }}'
|
|
ignore_tables: '{{ item.ignore_tables | default(omit) }}'
|
|
login_host: '{{ item.login_host | default(omit) }}'
|
|
login_password: '{{ item.login_password | default(omit) }}'
|
|
login_port: '{{ item.login_port | default(omit) }}'
|
|
login_unix_socket: '{{ item.login_unix_socket | default(omit) }}'
|
|
login_user: '{{ item.login_user | default(omit) }}'
|
|
master_data: '{{ item.master_data | default(omit) }}'
|
|
name: '{{ item.name }}'
|
|
pipefail: '{{ item.pipefail | default(omit) }}'
|
|
quick: '{{ item.quick | default(omit) }}'
|
|
restrict_config_file: '{{ item.restrict_config_file | default(omit) }}'
|
|
single_transaction: '{{ item.single_transaction | default(omit) }}'
|
|
skip_lock_tables: '{{ item.skip_lock_tables | default(omit) }}'
|
|
sql_log_bin: '{{ item.sql_log_bin | default(omit) }}'
|
|
state: '{{ item.state }}'
|
|
target: '{{ item.target | default(omit) }}'
|
|
unsafe_login_password: '{{ item.unsafe_login_password | default(omit) }}'
|
|
use_shell: '{{ item.use_shell | default(omit) }}'
|
|
loop: '{{ mariadb_db_list }}'
|
|
loop_control:
|
|
label: '{{ item.name }} will be {{ item.state }}'
|
|
- name: Ensure Mariadb Users
|
|
when: [mariadb_user_list is defined, mariadb_user_list is iterable]
|
|
ansible.mysql.mysql_user:
|
|
append_privs: '{{ item.append_privs | default(omit) }}'
|
|
attributes: '{{ item.attributes | default(omit) }}'
|
|
ca_cert: '{{ item.ca_cert | default(omit) }}'
|
|
check_hostname: '{{ item.check_hostname | default(omit) }}'
|
|
client_cert: '{{ item.client_cert | default(omit) }}'
|
|
client_key: '{{ item.client_key | default(omit) }}'
|
|
column_case_sensitive: '{{ item.column_case_sensitive | default(omit) }}'
|
|
config_file: '{{ item.config_file | default(omit) }}'
|
|
connect_timeout: '{{ item.connect_timeout | default(omit) }}'
|
|
encrypted: '{{ item.encrypted | default(omit) }}'
|
|
force_context: '{{ item.force_context | default(omit) }}'
|
|
host: '{{ item.host | default(omit) }}'
|
|
host_all: '{{ item.host_all | default(omit) }}'
|
|
locked: '{{ item.locked | default(omit) }}'
|
|
login_host: '{{ item.login_host | default(omit) }}'
|
|
login_password: '{{ item.login_password | default(omit) }}'
|
|
login_port: '{{ item.login_port | default(omit) }}'
|
|
login_unix_socket: '{{ item.login_unix_socket | default(omit) }}'
|
|
login_user: '{{ item.login_user | default(omit) }}'
|
|
name: '{{ item.name }}'
|
|
password: '{{ item.password | default(omit) }}'
|
|
password_expire: '{{ item.password_expire | default(omit) }}'
|
|
password_expire_interval: '{{ item.password_expire_interval | default(omit) }}'
|
|
plugin: '{{ item.plugin | default(omit) }}'
|
|
plugin_auth_string: '{{ item.plugin_auth_string | default(omit) }}'
|
|
plugin_hash_string: '{{ item.plugin_hash_string | default(omit) }}'
|
|
priv: '{{ item.priv | default(omit) }}'
|
|
resource_limits: '{{ item.resource_limits | default(omit) }}'
|
|
salt: '{{ item.salt | default(omit) }}'
|
|
session_vars: '{{ item.session_vars | default(omit) }}'
|
|
sql_log_bin: '{{ item.sql_log_bin | default(omit) }}'
|
|
state: '{{ item.state }}'
|
|
subtract_privs: '{{ item.subtract_privs | default(omit) }}'
|
|
tls_requires: '{{ item.tls_requires | default(omit) }}'
|
|
update_password: '{{ item.update_password | default(omit) }}'
|
|
loop: '{{ mariadb_user_list }}'
|
|
loop_control:
|
|
label: '{{ item.name }} will be {{ item.state }}'
|