Changeset 13994

Timestamp:

27 Jun 2016, 11:42:12 (8 years ago)

Author:

uli

Message:

Turn (some) tasks from playbook into roles.

Location:

main/waeup-ansible

Files:

• bootstrap.yml (modified) (2 diffs)
• roles (added)
• roles/core (added)
• roles/core/tasks (added)
• roles/core/tasks/main.yml (added)
• roles/openssh (added)
• roles/openssh/handlers (added)
• roles/openssh/handlers/main.yml (added)
• roles/openssh/tasks (added)
• roles/openssh/tasks/main.yml (added)

main/waeup-ansible/bootstrap.yml

@@ -18 +18 @@
     deploy_public_key: "{{ lookup('file', 'files/id-deploy.pub') }}"
 
-  handlers:
-    - name: "restart sshd"
-      service:
-        name="ssh"
-        enabled=yes
-        state=restarted
-
   tasks:
-    - name: "bootstrap | create 'deploy' user"
-      user:
-        name="{{ deploy_user }}"
-        append=yes
-        uid=2222
-
     - name: "bootstrap | update authorized key of 'deploy'"
       authorized_key:
@@ -44 +31 @@
         state=present
 
-    - name: "bootstrap | sshd_config - disable weak keys"
-      lineinfile:
-        dest=/etc/ssh/sshd_config
-        backrefs=yes
-        line={{ item.line }}
-        regexp={{ item.regexp }}
-      with_items:
-        - { regexp: '^HostKey /etc/ssh/ssh_host_dsa_key', line: '# HostKey /etc/ssh/ssh_host_dsa_key' }
-        - { regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key', line: '# HostKey /etc/ssh/ssh_host_ecdsa_key' }
-      notify: "restart sshd"
-
-    - name: "bootstrap | sshd_config - set key bits to 4096"
-      lineinfile:
-        dest=/etc/ssh/sshd_config
-        backrefs=yes
-        line='ServerKeyBits 4096'
-        regexp='^ServerKeyBits 1024'
-        state=present
-      notify: "restart sshd"
-
-    - name: "bootstrap | sshd_config - set secure ciphers from bettercrypto.org"
-      lineinfile:
-        dest=/etc/ssh/sshd_config
-        line='Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr'
-        state=present
-      notify: "restart sshd"
-
-    - name: "bootstrap | sshd_config - set secure MACs from bettercrypto.org"
-      lineinfile:
-        dest=/etc/ssh/sshd_config
-        line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160'
-        state=present
-      notify: "restart sshd"
-
-    - name: "bootstrap | sshd_config - set secure kex algos from bettercrypto.org"
-      lineinfile:
-        dest=/etc/ssh/sshd_config
-        line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1'
-        state=present
-      notify: "restart sshd"
-
-    - name: "bootstrap | remove short moduli (<2048 bits) from /etc/ssh/moduli"
-      replace:
-        dest=/etc/ssh/moduli
-        regexp='^([0-9]+\s){4}(1[0-9]{3}\s)'
-      notify: "restart sshd"
+  roles:
+    - openssh
+    - core