From 054b2815758e93c699e9a6bb32853e2a4cdef2ff Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Mon, 23 Jun 2025 11:16:59 +0300 Subject: Add email, network, zfs tasks --- playbook.yml | 54 ++-------- tasks/email.yml | 54 ++++++++++ tasks/network.yml | 39 ++++++++ tasks/zfs.yml | 18 ++++ templates/aliases.j2 | 1 - templates/auth.conf.j2 | 1 - templates/dma.conf.j2 | 8 -- templates/etc_aliases.j2 | 1 + templates/etc_dma_auth.conf.j2 | 1 + templates/etc_dma_dma.conf.j2 | 8 ++ templates/etc_ssh_sshd_config.j2 | 121 +++++++++++++++++++++++ templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 | 33 +++++++ 12 files changed, 282 insertions(+), 57 deletions(-) create mode 100644 tasks/email.yml create mode 100644 tasks/network.yml create mode 100644 tasks/zfs.yml delete mode 100644 templates/aliases.j2 delete mode 100644 templates/auth.conf.j2 delete mode 100644 templates/dma.conf.j2 create mode 100644 templates/etc_aliases.j2 create mode 100644 templates/etc_dma_auth.conf.j2 create mode 100644 templates/etc_dma_dma.conf.j2 create mode 100644 templates/etc_ssh_sshd_config.j2 create mode 100644 templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 diff --git a/playbook.yml b/playbook.yml index 19ea687..45d45e1 100644 --- a/playbook.yml +++ b/playbook.yml @@ -1,5 +1,5 @@ --- -- name: Configure dma with generic SMTP on FreeBSD +- name: Configure my FreeBSD home server hosts: pursotin pre_tasks: @@ -21,51 +21,11 @@ dma_to_address: "{{ lookup('env', 'DMA_TO_ADDRESS') }}" tasks: - - name: Install dma - package: - name: dma - state: present + - name: Run network tasks + import_tasks: tasks/network.yml - - name: Create dma config directory - file: - path: /etc/dma - state: directory - owner: root - group: wheel - mode: "0755" + - name: Run email tasks + import_tasks: tasks/email.yml - - name: Configure dma.conf - template: - src: dma.conf.j2 - dest: /etc/dma/dma.conf - owner: root - group: wheel - mode: "0644" - - - name: Configure auth.conf - template: - src: auth.conf.j2 - dest: /etc/dma/auth.conf - owner: root - group: mail - mode: "0640" - - - name: Configure aliases - template: - src: aliases.j2 - dest: /etc/aliases - owner: root - group: wheel - mode: "0644" - - - name: Run newaliases - shell: newaliases - - - name: Test mail delivery - shell: echo "DMA test message from Ansible" | mail -s "Test DMA" root - register: mail_result - changed_when: false - - - name: Show mail result - debug: - var: mail_result + - name: Run ZFS tasks + import_tasks: tasks/zfs.yml diff --git a/tasks/email.yml b/tasks/email.yml new file mode 100644 index 0000000..fe83778 --- /dev/null +++ b/tasks/email.yml @@ -0,0 +1,54 @@ +- name: Install dma + package: + name: dma + state: present + +- name: Create dma config directory + file: + path: /etc/dma + state: directory + owner: root + group: wheel + mode: "0755" + +- name: Configure dma.conf + template: + src: etc_dma_dma.conf.j2 + dest: /etc/dma/dma.conf + owner: root + group: wheel + mode: "0644" + register: etc_dma_dma_conf + +- name: Configure auth.conf + template: + src: etc_dma_auth.conf.j2 + dest: /etc/dma/auth.conf + owner: root + group: mail + mode: "0640" + register: etc_dma_auth_conf + +- name: Configure aliases + template: + src: etc_aliases.j2 + dest: /etc/aliases + owner: root + group: wheel + mode: "0644" + register: etc_aliases_conf + +- name: Run newaliases + shell: newaliases + +- name: Test mail delivery + when: etc_dma_dma_conf.changed or etc_dma_auth_conf.changed or etc_aliases_conf.changed + block: + - name: Send email + shell: echo "DMA test message from Ansible" | mail -s "Test DMA" root + register: mail_result + changed_when: false + + - name: Show mail result + debug: + var: mail_result diff --git a/tasks/network.yml b/tasks/network.yml new file mode 100644 index 0000000..da194b9 --- /dev/null +++ b/tasks/network.yml @@ -0,0 +1,39 @@ +- name: Check existence of lan0 + shell: ifconfig lan0 || echo "failed" + register: lan0_status + +- name: Check existence of wan0 + shell: ifconfig wan0 || echo "failed" + register: wan0_status + +- name: Set up network interfaces + shell: | + sysrc -x ifconfig_igc0 + sysrc -x ifconfig_igc0_ipv6 + sysrc ifconfig_igc0_name="lan0" + sysrc ifconfig_igc1_name="wan0" + sysrc ifconfig_lan0="DHCP" + sysrc ifconfig_lan0_ipv6="inet6 accept_rtadv" + sysrc ifconfig_wan0="DHCP" + sysrc ifconfig_wan0_ipv6="inet6 accept_rtadv" + +- name: Restart networking if custom interfaces do not exist + shell: service netif restart + when: lan0_status.stdout.find('failed') != -1 or + wan0_status.stdout.find('failed') != -1 + +- name: Update facts + setup: + +- name: Set up sshd + template: + src: etc_ssh_sshd_config.j2 + dest: /etc/ssh/sshd_config + owner: root + group: wheel + mode: "0644" + register: etc_sshd_config + +- name: Restart sshd + shell: service sshd restart + when: etc_sshd_config.changed diff --git a/tasks/zfs.yml b/tasks/zfs.yml new file mode 100644 index 0000000..947ebb6 --- /dev/null +++ b/tasks/zfs.yml @@ -0,0 +1,18 @@ +- name: Ensure /usr/local/etc/rc.d/ exists + file: + path: /usr/local/etc/rc.d/ + state: directory + owner: root + group: wheel + mode: "0755" + +- name: Add zpool_gpt_labels rc.d service + template: + src: usr_local_etc_rc.d_zpool_gpt_labels.j2 + dest: /usr/local/etc/rc.d/zpool_gpt_labels + owner: root + group: wheel + mode: "0755" + +- name: Enable and start zpool_gpt_labels service + shell: service zpool_gpt_labels enable && service zpool_gpt_labels start diff --git a/templates/aliases.j2 b/templates/aliases.j2 deleted file mode 100644 index a9ac845..0000000 --- a/templates/aliases.j2 +++ /dev/null @@ -1 +0,0 @@ -root: {{ dma_to_address }} diff --git a/templates/auth.conf.j2 b/templates/auth.conf.j2 deleted file mode 100644 index a1000ea..0000000 --- a/templates/auth.conf.j2 +++ /dev/null @@ -1 +0,0 @@ -{{ smtp_user }}|{{ smtp_host }}:{{ smtp_password }} diff --git a/templates/dma.conf.j2 b/templates/dma.conf.j2 deleted file mode 100644 index dfaa04f..0000000 --- a/templates/dma.conf.j2 +++ /dev/null @@ -1,8 +0,0 @@ -SMARTHOST {{ smtp_host }} -PORT {{ smtp_port }} -AUTHPATH /etc/dma/auth.conf -SECURETRANSFER -STARTTLS -MAILNAME {{ dma_mail_hostname }} -MASQUERADE {{ ansible_hostname }}@{{ dma_mail_hostname }} -#NULLCLIENT diff --git a/templates/etc_aliases.j2 b/templates/etc_aliases.j2 new file mode 100644 index 0000000..a9ac845 --- /dev/null +++ b/templates/etc_aliases.j2 @@ -0,0 +1 @@ +root: {{ dma_to_address }} diff --git a/templates/etc_dma_auth.conf.j2 b/templates/etc_dma_auth.conf.j2 new file mode 100644 index 0000000..a1000ea --- /dev/null +++ b/templates/etc_dma_auth.conf.j2 @@ -0,0 +1 @@ +{{ smtp_user }}|{{ smtp_host }}:{{ smtp_password }} diff --git a/templates/etc_dma_dma.conf.j2 b/templates/etc_dma_dma.conf.j2 new file mode 100644 index 0000000..dfaa04f --- /dev/null +++ b/templates/etc_dma_dma.conf.j2 @@ -0,0 +1,8 @@ +SMARTHOST {{ smtp_host }} +PORT {{ smtp_port }} +AUTHPATH /etc/dma/auth.conf +SECURETRANSFER +STARTTLS +MAILNAME {{ dma_mail_hostname }} +MASQUERADE {{ ansible_hostname }}@{{ dma_mail_hostname }} +#NULLCLIENT diff --git a/templates/etc_ssh_sshd_config.j2 b/templates/etc_ssh_sshd_config.j2 new file mode 100644 index 0000000..b7ad162 --- /dev/null +++ b/templates/etc_ssh_sshd_config.j2 @@ -0,0 +1,121 @@ +# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +# Note that some of FreeBSD's defaults differ from OpenBSD's, and +# FreeBSD has a few additional options. + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# Change to yes to enable built-in password authentication. +# Note that passwords may also be accepted via KbdInteractiveAuthentication. +PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable PAM authentication +#KbdInteractiveAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +# Set this to 'no' to disable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin prohibit-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +#UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS yes +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#UseBlacklist no +#VersionAddendum FreeBSD-20250219 + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/libexec/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 b/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 new file mode 100644 index 0000000..36bc715 --- /dev/null +++ b/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 @@ -0,0 +1,33 @@ +#!/bin/sh + +# PROVIDE: zpool_gpt_labels +# REQUIRE: zfs +# BEFORE: LOGIN +# KEYWORD: nojail + +. /etc/rc.subr + +name="zpool_gpt_labels" +rcvar="zpool_gpt_labels_enable" +start_cmd="zpool_gpt_labels_start" + +zpool_gpt_labels_start() { + logger "Setting zpool vdev paths to GPT labels" + local zpool_status="$(zpool status)" + for i in 0 1 2 3; do + local raw="nda${i}p4.eli" + local path="/dev/gpt/zfs${i}.eli" + case "$zpool_status" in + *"$raw"*) + zpool set "path=${path}" zroot "${raw}" + logger "Setting ${raw} -> ${path}" + ;; + *) + logger "Skipping ${raw}..." + ;; + esac + done +} + +load_rc_config $name +run_rc_command "$1" -- cgit v1.3