blob: ed57a13163981fbd9bfd65beee2ea51404212713 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
|
- name: Set up resolv.conf
template:
src: etc_resolv.conf.j2
dest: /etc/resolv.conf
owner: root
group: wheel
mode: "0644"
register: resolv_conf
- name: Make resolv.conf immutable
shell: chflags schg /etc/resolv.conf
when: resolv_conf.changed
- name: Restart networking if interface configuration changed
shell: service netif restart && service routing restart
when: rc_conf.changed or resolv_conf.changed
- name: Set up sshd
template:
src: etc_ssh_sshd_config.j2
dest: /etc/ssh/sshd_config
owner: root
group: wheel
mode: "0644"
register: etc_sshd_config
- name: Start sshd
service:
name: sshd
state: started
register: started_sshd
- name: Restart sshd
service:
name: sshd
state: restarted
when: not started_sshd.changed and etc_sshd_config.changed
- name: Start syslogd
service:
name: syslogd
state: started
register: started_syslogd
- name: Restart syslogd
service:
name: syslogd
state: restarted
when: not started_syslogd.changed and rc_conf.changed
- name: Configure pf
template:
src: etc_pf.conf.j2
dest: /etc/pf.conf
owner: root
group: wheel
mode: "0644"
backup: yes
register: pf_conf
- name: Start pf
service:
name: pf
state: started
- name: Reload pf rules
shell: pfctl -f /etc/pf.conf
when: pf_conf.changed
- name: Configure nginx.conf
template:
src: usr_local_etc_nginx_nginx.conf.j2
dest: /usr/local/etc/nginx/nginx.conf
owner: root
group: wheel
mode: "0644"
register: nginx_conf
- name: Generate LetsEncrypt certs
shell: certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}"
when: nginx_conf.changed
- name: Copy over jan.systems HTML
ansible.posix.synchronize:
src: "{{ jan_systems_html_dir.rstrip('/') + '/' }}"
dest: /usr/local/www/jan.systems
- name: Start nginx
service:
name: nginx
state: started
register: started_nginx
- name: Restart nginx
service:
name: nginx
state: restarted
when: not started_nginx.changed and nginx_conf.changed
- name: Set up restore_jail_aliases.sh
template:
src: usr_local_bin_restore_jail_aliases.sh.j2
dest: /usr/local/bin/restore_jail_aliases.sh
owner: root
group: wheel
mode: "0755"
- name: Set up devd lan0_jail_restore.conf
template:
src: etc_devd_lan0_jail_restore.conf.j2
dest: /etc/devd/lan0_jail_restore.conf
owner: root
group: wheel
mode: "0644"
- name: Set up /usr/local/etc/do_dyndns_auth
template:
src: usr_local_etc_do_dyndns_auth.j2
dest: /usr/local/etc/do_dyndns_auth
owner: root
group: wheel
mode: "0600"
- name: Set up /usr/local/bin/do_dyndns.sh
template:
src: usr_local_bin_do_dyndns.sh.j2
dest: /usr/local/bin/do_dyndns.sh
owner: root
group: wheel
mode: "0755"
register: do_dyndns_sh
- name: Set up /usr/local/etc/rc.d/do_dyndns
template:
src: usr_local_etc_rc.d_do_dyndns.j2
dest: /usr/local/etc/rc.d/do_dyndns
owner: root
group: wheel
mode: "0755"
register: do_dyndns_rc
- name: Start do_dyndns
service:
name: do_dyndns
state: started
register: do_dyndns_start
- name: Restart do_dyndns
service:
name: do_dyndns
state: restarted
when: not do_dyndns_start.changed and (do_dyndns_sh.changed or do_dyndns_rc.changed)
|
