From 28c9375b0df379112ecac5157809916af27a7ce3 Mon Sep 17 00:00:00 2001 From: Patrick Toal Date: Mon, 3 May 2021 13:47:44 -0400 Subject: [PATCH] Build Windows Templates in RHV --- build_windows_template.yml | 12 + buildvm_artifact.json | 7 + requested.txt | 76 -- rhv_setup.yml | 33 +- .../felixfontein.acme_certificate/.gitignore | 1 + roles/felixfontein.acme_certificate/.yamllint | 45 ++ .../CHANGELOG.md | 19 + roles/felixfontein.acme_certificate/LICENSE | 21 + roles/felixfontein.acme_certificate/README.md | 360 ++++++++++ .../felixfontein.acme_certificate/ansible.cfg | 2 + .../defaults/main.yml | 47 ++ .../filter_plugins/path_filter.py | 19 + .../meta/.galaxy_install_info | 2 + .../meta/main.yml | 25 + .../sample-playbook.yml | 62 ++ .../tasks/dns-dme-cleanup.yml | 18 + .../tasks/dns-dme-create.yml | 32 + .../tasks/dns-hosttech-cleanup.yml | 19 + .../tasks/dns-hosttech-create.yml | 23 + .../tasks/dns-ns1-cleanup.yml | 16 + .../tasks/dns-ns1-create.yml | 27 + .../tasks/dns-route53-cleanup.yml | 19 + .../tasks/dns-route53-create.yml | 20 + .../tasks/http-cleanup.yml | 15 + .../tasks/http-create.yml | 31 + .../tasks/main.yml | 189 +++++ roles/geerlingguy.gitlab/.ansible-lint | 4 + .../.github/workflows/ci.yml | 75 ++ .../.github/workflows/release.yml | 38 + .../meta/.galaxy_install_info | 2 +- .../molecule/default/version.yml | 31 + .../meta/.galaxy_install_info | 2 +- .../meta/.galaxy_install_info | 2 +- .../.yamllint.yml | 12 + .../meta/.galaxy_install_info | 2 +- .../requirements.yml | 3 + .../tasks/check_subid.yml | 37 + .../linux-system-roles.network/.ansible-lint | 12 + .../.github/stale.yml | 12 + .../.github/workflows/markdownlint.yml | 11 + .../.github/workflows/tox.yml | 51 ++ roles/linux-system-roles.network/.lgtm.yml | 5 + .../linux-system-roles.network/.mdl_style.rb | 9 + roles/linux-system-roles.network/.mdlrc | 1 + .../.travis/custom.sh | 11 + .../linux-system-roles.network/.yamllint.yml | 23 + roles/linux-system-roles.network/CHANGELOG.md | 49 ++ .../ansible_pytest_extra_requirements.txt | 7 + .../contributing.md | 409 +++++++++++ .../custom_requirements.txt | 4 + .../examples/bond_simple.yml | 36 + .../examples/bond_with_vlan.yml | 38 + .../examples/bridge_with_vlan.yml | 36 + .../examples/down_profile.yml | 1 + .../examples/dummy_simple.yml | 17 + .../examples/eth_dns_support.yml | 44 ++ .../examples/eth_simple_auto.yml | 18 + .../examples/eth_with_802_1x.yml | 30 + .../examples/eth_with_vlan.yml | 29 + .../examples/ethtool_coalesce.yml | 38 + .../examples/ethtool_features.yml | 19 + .../examples/ethtool_features_default.yml | 14 + .../examples/ipv6_disabled.yml | 12 + .../examples/remove+down_profile.yml | 12 + .../examples/remove_profile.yml | 1 + .../examples/team_simple.yml | 33 + .../examples/wireless_wpa_psk.yml | 15 + .../library/__init__.py | 0 .../meta/.galaxy_install_info | 2 +- .../module_utils/__init__.py | 0 .../module_utils/network_lsr/ethtool.py | 56 ++ .../module_utils/network_lsr/nm/__init__.py | 7 + .../network_lsr/nm/active_connection.py | 128 ++++ .../module_utils/network_lsr/nm/client.py | 96 +++ .../module_utils/network_lsr/nm/connection.py | 113 +++ .../module_utils/network_lsr/nm/error.py | 5 + .../module_utils/network_lsr/nm/provider.py | 58 ++ .../molecule_extra_requirements.txt | 3 + .../pylint_extra_requirements.txt | 5 + .../pytest_extra_requirements.txt | 12 + .../scripts/print_all_options.py | 184 +++++ .../tests/ensure_provider_tests.py | 227 ++++++ .../tests/files/cacert.key | 30 + .../tests/files/cacert.pem | 21 + .../tests/files/client.key | 31 + .../tests/files/client.key.nocrypt | 27 + .../tests/files/client.pem | 22 + .../tests/files/dh.pem | 8 + .../tests/files/server.key | 31 + .../tests/files/server.pem | 22 + .../tests/get_coverage.sh | 65 ++ .../tests/get_coverage.yml | 82 +++ .../tests/get_total_coverage.sh | 34 + .../tests/integration/conftest.py | 8 + .../tests/integration/test_ethernet.py | 114 +++ .../tests/merge_coverage.sh | 35 + .../tests/module_utils | 1 + .../linux-system-roles.network/tests/modules | 1 + .../tests/playbooks/down_profile.yml | 10 + .../tests/playbooks/files | 1 + .../playbooks/integration_pytest_python3.yml | 149 ++++ .../manual_test_ethtool_coalesce.yml | 115 +++ .../tests/playbooks/remove_profile.yml | 10 + .../tests/playbooks/run_tasks.yml | 6 + .../tests/playbooks/tests_802_1x.yml | 124 ++++ .../tests/playbooks/tests_802_1x_updated.yml | 13 + .../tests/playbooks/tests_bond.yml | 97 +++ .../tests/playbooks/tests_bond_deprecated.yml | 97 +++ .../tests/playbooks/tests_bridge.yml | 55 ++ .../playbooks/tests_checkpoint_cleanup.yml | 82 +++ .../tests/playbooks/tests_dummy.yml | 30 + .../tests/playbooks/tests_eth_dns_support.yml | 110 +++ .../tests/playbooks/tests_ethernet.yml | 64 ++ .../playbooks/tests_ethtool_coalesce.yml | 102 +++ .../tests/playbooks/tests_ipv6.yml | 94 +++ .../tests/playbooks/tests_ipv6_disabled.yml | 60 ++ .../tests/playbooks/tests_provider.yml | 35 + .../tests/playbooks/tests_reapply.yml | 66 ++ .../tests/playbooks/tests_team.yml | 30 + .../tests_team_plugin_installation.yml | 40 ++ .../tests/playbooks/tests_wireless.yml | 88 +++ .../tests_wireless_plugin_installation.yml | 40 ++ .../tests/setup_module_utils.sh | 41 ++ .../tests/tasks/activate_profile.yml | 9 + .../tests/tasks/assert_device_absent.yml | 7 + .../tests/tasks/assert_device_present.yml | 7 + ...sert_output_in_stderr_without_warnings.yml | 12 + .../tests/tasks/assert_profile_absent.yml | 7 + .../tests/tasks/assert_profile_present.yml | 7 + .../tests/tasks/cleanup_802_1x_server.yml | 19 + .../tests/tasks/cleanup_mock_wifi.yml | 7 + .../tests/tasks/cleanup_profile+device.yml | 9 + .../tasks/create_and_remove_interface.yml | 20 + .../tests/tasks/create_bridge_profile.yml | 15 + .../create_bridge_profile_no_autoconnect.yml | 16 + .../tests/tasks/create_dummy_profile.yml | 15 + .../tests/tasks/create_team_profile.yml | 15 + .../create_test_interfaces_with_dhcp.yml | 73 ++ .../tests/tasks/delete_interface.yml | 6 + .../tests/tasks/el_repo_setup.yml | 26 + .../tests/tasks/enable_epel.yml | 24 + .../tests/tasks/get_NetworkManager_NVR.yml | 19 + .../tests/tasks/get_current_interfaces.yml | 8 + .../tests/tasks/get_interface_stat.yml | 9 + .../tasks/get_modules_and_utils_paths.yml | 92 +++ .../tests/tasks/get_profile_stat.yml | 24 + .../tests/tasks/manage_test_interface.yml | 59 ++ .../create_and_remove_with_initscripts.yml | 23 + .../tests/tasks/provider/create_with_nm.yml | 15 + .../tests/tasks/provider/default_with_nm.yml | 8 + .../tests/tasks/remove+down_profile.yml | 10 + .../tests/tasks/remove_profile.yml | 9 + .../remove_test_interfaces_with_dhcp.yml | 25 + .../tests/tasks/run_test.yml | 68 ++ .../tests/tasks/setup_802.1x.yml | 11 + .../tests/tasks/setup_802_1x_server.yml | 75 ++ .../tests/tasks/setup_mock_wifi.yml | 82 +++ .../tests/tasks/setup_test_interface.yml | 7 + .../tests/tasks/show_interfaces.yml | 5 + .../tests/tasks/test_802.1x_capath.yml | 108 +++ .../tests/tests_802_1x_nm.yml | 20 + .../tests/tests_802_1x_updated_nm.yml | 20 + .../tests_bond_deprecated_initscripts.yml | 14 + .../tests/tests_bond_deprecated_nm.yml | 19 + .../tests/tests_bond_initscripts.yml | 14 + .../tests/tests_bond_nm.yml | 20 + .../tests/tests_bridge_initscripts.yml | 14 + .../tests/tests_bridge_nm.yml | 20 + .../tests/tests_default_initscripts.yml | 10 + .../tests/tests_default_nm.yml | 14 + .../tests/tests_dummy_nm.yml | 19 + .../tests/tests_eth_dns_support_nm.yml | 19 + .../tests/tests_ethernet_initscripts.yml | 15 + .../tests/tests_ethernet_nm.yml | 21 + .../tests/tests_ethtool_coalesce_nm.yml | 41 ++ .../tests/tests_helpers_and_asserts.yml | 30 + .../tests/tests_integration_pytest.yml | 10 + .../tests/tests_ipv6_disabled_nm.yml | 20 + .../tests/tests_ipv6_initscripts.yml | 13 + .../tests/tests_ipv6_nm.yml | 19 + .../tests/tests_provider_nm.yml | 39 + .../tests/tests_reapply_nm.yml | 21 + .../tests/tests_regression_nm.yml | 31 + .../tests/tests_states_initscripts.yml | 15 + .../tests/tests_states_nm.yml | 21 + .../tests/tests_team_nm.yml | 22 + .../tests_team_plugin_installation_nm.yml | 19 + .../tests/tests_wireless_nm.yml | 22 + .../tests_wireless_plugin_installation_nm.yml | 19 + roles/oatakan.ansible-role-ovirt/.travis.yml | 29 + roles/oatakan.ansible-role-ovirt/README.md | 38 + .../defaults/main.yml | 15 + .../meta/.galaxy_install_info | 2 + .../oatakan.ansible-role-ovirt/meta/main.yml | 25 + .../tasks/deprovision.yml | 65 ++ .../oatakan.ansible-role-ovirt/tasks/main.yml | 25 + .../tasks/preflight_check.yml | 40 ++ .../tasks/provision.yml | 183 +++++ .../tasks/template_check.yml | 52 ++ .../tasks/wait_for_disk.yml | 18 + .../tasks/wait_for_disk_pre29.yml | 17 + .../tasks/wait_for_ip.yml | 69 ++ .../tasks/wait_for_ip_pre29.yml | 69 ++ .../templates/cloud_init.yml.j2 | 20 + .../templates/unattended.xml.j2 | 226 ++++++ .../tests/inventory | 1 + .../oatakan.ansible-role-ovirt/tests/test.yml | 5 + .../oatakan.ansible-role-ovirt/vars/main.yml | 3 + .../README.md | 2 + .../defaults/main.yml | 22 + .../meta/.galaxy_install_info | 2 + .../meta/main.yml | 24 + .../tasks/main.yml | 132 ++++ .../tests/inventory | 2 + .../tests/test.yml | 5 + .../meta/.galaxy_install_info | 2 +- .../defaults/main.yml | 4 + .../meta/.galaxy_install_info | 2 +- .../tasks/main.yml | 24 +- .../vars/main.yml | 2 +- .../files/Install-WMF3Hotfix.ps1 | 152 ++++ .../files/Upgrade-PowerShell.ps1 | 400 +++++++++++ .../meta/.galaxy_install_info | 2 +- .../tasks/enable_tls_system_default.yml | 51 ++ .../tasks/security-update-win2012.yml | 32 + .../tasks/update-agent-win2008.yml | 13 + .../tasks/winrm-memfix.yml | 69 ++ roles/oatakan.windows_update/.travis.yml | 29 + roles/oatakan.windows_update/LICENSE | 21 + roles/oatakan.windows_update/README.md | 53 ++ .../oatakan.windows_update/defaults/main.yml | 25 + .../files/win-updates.ps1 | 229 ++++++ .../meta/.galaxy_install_info | 2 + roles/oatakan.windows_update/meta/main.yml | 30 + roles/oatakan.windows_update/tasks/main.yml | 49 ++ .../tasks/updates-all.yml | 43 ++ .../tasks/updates-powershell.yml | 98 +++ .../tasks/updates-win2008r2.yml | 81 +++ .../tasks/updates-with-retry.yml | 84 +++ roles/oatakan.windows_update/tests/inventory | 1 + roles/oatakan.windows_update/tests/test.yml | 7 + .../meta/.galaxy_install_info | 2 +- roles/requirements.yml | 25 + roles/systemli.apt_repositories/.editorconfig | 17 + .../.github/dependabot.yml | 7 + .../.github/workflows/main.yml | 53 ++ roles/systemli.apt_repositories/.yamllint | 33 + roles/systemli.apt_repositories/LICENSE | 675 ++++++++++++++++++ roles/systemli.apt_repositories/README.md | 107 +++ .../defaults/main.yml | 8 + .../files/gitlab.asc | 52 ++ .../files/gitlab.gpg | Bin 0 -> 2298 bytes .../files/grafana.gpg | 30 + .../files/jitsi-archive-keyring.gpg | Bin 0 -> 2203 bytes .../systemli.apt_repositories/files/kubic.asc | 21 + .../files/prosody-debian-packages.gpg | Bin 0 -> 1686 bytes .../systemli.apt_repositories/files/sury.gpg | Bin 0 -> 1769 bytes .../meta/.galaxy_install_info | 2 + roles/systemli.apt_repositories/meta/main.yml | 23 + .../molecule/default/INSTALL.rst | 22 + .../molecule/default/converge.yml | 71 ++ .../molecule/default/molecule.yml | 15 + .../molecule/default/prepare.yml | 9 + .../roles/ansible-role-apt_repositories | 1 + .../molecule/default/tests/test_default.py | 15 + .../molecule/default/tests/test_default.yml | 8 + .../molecule/default/verify.yml | 9 + .../molecule/docker/INSTALL.rst | 39 + .../molecule/docker/molecule.yml | 19 + .../tasks/key_path.yml | 31 + .../systemli.apt_repositories/tasks/main.yml | 30 + .../systemli.apt_repositories/tasks/repo.yml | 83 +++ .../templates/pref.j2 | 16 + .../templates/repo.list.j2 | 1 + .../templates/repo.sources.j2 | 8 + .../systemli.apt_repositories/vars/gitlab.yml | 6 + .../vars/grafana.yml | 11 + .../systemli.apt_repositories/vars/jitsi.yml | 6 + .../systemli.apt_repositories/vars/kubic.yml | 11 + roles/systemli.apt_repositories/vars/null.yml | 1 + .../vars/prosody.yml | 6 + roles/systemli.apt_repositories/vars/sury.yml | 3 + simple_env/bindep.txt | 0 simple_env/context/Containerfile | 11 + simple_env/context/_build/requirements.yml | 28 + simple_env/execution-environment.yml | 12 + simple_env/requirements.txt | 1 + simple_env/requirements.yml | 28 + windows.yml | 58 -- windows_ad.yml | 16 + 290 files changed, 10931 insertions(+), 159 deletions(-) create mode 100644 build_windows_template.yml create mode 100644 buildvm_artifact.json delete mode 100644 requested.txt create mode 100644 roles/felixfontein.acme_certificate/.gitignore create mode 100644 roles/felixfontein.acme_certificate/.yamllint create mode 100644 roles/felixfontein.acme_certificate/CHANGELOG.md create mode 100644 roles/felixfontein.acme_certificate/LICENSE create mode 100644 roles/felixfontein.acme_certificate/README.md create mode 100644 roles/felixfontein.acme_certificate/ansible.cfg create mode 100644 roles/felixfontein.acme_certificate/defaults/main.yml create mode 100644 roles/felixfontein.acme_certificate/filter_plugins/path_filter.py create mode 100644 roles/felixfontein.acme_certificate/meta/.galaxy_install_info create mode 100644 roles/felixfontein.acme_certificate/meta/main.yml create mode 100644 roles/felixfontein.acme_certificate/sample-playbook.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/dns-dme-cleanup.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/dns-dme-create.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/dns-hosttech-cleanup.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/dns-hosttech-create.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/dns-ns1-cleanup.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/dns-ns1-create.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/dns-route53-cleanup.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/dns-route53-create.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/http-cleanup.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/http-create.yml create mode 100644 roles/felixfontein.acme_certificate/tasks/main.yml create mode 100644 roles/geerlingguy.gitlab/.ansible-lint create mode 100644 roles/geerlingguy.gitlab/.github/workflows/ci.yml create mode 100644 roles/geerlingguy.gitlab/.github/workflows/release.yml create mode 100644 roles/geerlingguy.gitlab/molecule/default/version.yml create mode 100644 roles/ikke_t.podman_container_systemd/.yamllint.yml create mode 100644 roles/ikke_t.podman_container_systemd/requirements.yml create mode 100644 roles/ikke_t.podman_container_systemd/tasks/check_subid.yml create mode 100644 roles/linux-system-roles.network/.ansible-lint create mode 100644 roles/linux-system-roles.network/.github/stale.yml create mode 100644 roles/linux-system-roles.network/.github/workflows/markdownlint.yml create mode 100644 roles/linux-system-roles.network/.github/workflows/tox.yml create mode 100644 roles/linux-system-roles.network/.lgtm.yml create mode 100644 roles/linux-system-roles.network/.mdl_style.rb create mode 100644 roles/linux-system-roles.network/.mdlrc create mode 100755 roles/linux-system-roles.network/.travis/custom.sh create mode 100644 roles/linux-system-roles.network/.yamllint.yml create mode 100644 roles/linux-system-roles.network/CHANGELOG.md create mode 100644 roles/linux-system-roles.network/ansible_pytest_extra_requirements.txt create mode 100644 roles/linux-system-roles.network/contributing.md create mode 100644 roles/linux-system-roles.network/custom_requirements.txt create mode 100644 roles/linux-system-roles.network/examples/bond_simple.yml create mode 100644 roles/linux-system-roles.network/examples/bond_with_vlan.yml create mode 100644 roles/linux-system-roles.network/examples/bridge_with_vlan.yml create mode 120000 roles/linux-system-roles.network/examples/down_profile.yml create mode 100644 roles/linux-system-roles.network/examples/dummy_simple.yml create mode 100644 roles/linux-system-roles.network/examples/eth_dns_support.yml create mode 100644 roles/linux-system-roles.network/examples/eth_simple_auto.yml create mode 100644 roles/linux-system-roles.network/examples/eth_with_802_1x.yml create mode 100644 roles/linux-system-roles.network/examples/eth_with_vlan.yml create mode 100644 roles/linux-system-roles.network/examples/ethtool_coalesce.yml create mode 100644 roles/linux-system-roles.network/examples/ethtool_features.yml create mode 100644 roles/linux-system-roles.network/examples/ethtool_features_default.yml create mode 100644 roles/linux-system-roles.network/examples/ipv6_disabled.yml create mode 100644 roles/linux-system-roles.network/examples/remove+down_profile.yml create mode 120000 roles/linux-system-roles.network/examples/remove_profile.yml create mode 100644 roles/linux-system-roles.network/examples/team_simple.yml create mode 100644 roles/linux-system-roles.network/examples/wireless_wpa_psk.yml create mode 100644 roles/linux-system-roles.network/library/__init__.py create mode 100644 roles/linux-system-roles.network/module_utils/__init__.py create mode 100644 roles/linux-system-roles.network/module_utils/network_lsr/ethtool.py create mode 100644 roles/linux-system-roles.network/module_utils/network_lsr/nm/__init__.py create mode 100644 roles/linux-system-roles.network/module_utils/network_lsr/nm/active_connection.py create mode 100644 roles/linux-system-roles.network/module_utils/network_lsr/nm/client.py create mode 100644 roles/linux-system-roles.network/module_utils/network_lsr/nm/connection.py create mode 100644 roles/linux-system-roles.network/module_utils/network_lsr/nm/error.py create mode 100644 roles/linux-system-roles.network/module_utils/network_lsr/nm/provider.py create mode 100644 roles/linux-system-roles.network/molecule_extra_requirements.txt create mode 100644 roles/linux-system-roles.network/pylint_extra_requirements.txt create mode 100644 roles/linux-system-roles.network/pytest_extra_requirements.txt create mode 100755 roles/linux-system-roles.network/scripts/print_all_options.py create mode 100755 roles/linux-system-roles.network/tests/ensure_provider_tests.py create mode 100644 roles/linux-system-roles.network/tests/files/cacert.key create mode 100644 roles/linux-system-roles.network/tests/files/cacert.pem create mode 100644 roles/linux-system-roles.network/tests/files/client.key create mode 100644 roles/linux-system-roles.network/tests/files/client.key.nocrypt create mode 100644 roles/linux-system-roles.network/tests/files/client.pem create mode 100644 roles/linux-system-roles.network/tests/files/dh.pem create mode 100644 roles/linux-system-roles.network/tests/files/server.key create mode 100644 roles/linux-system-roles.network/tests/files/server.pem create mode 100755 roles/linux-system-roles.network/tests/get_coverage.sh create mode 100644 roles/linux-system-roles.network/tests/get_coverage.yml create mode 100755 roles/linux-system-roles.network/tests/get_total_coverage.sh create mode 100644 roles/linux-system-roles.network/tests/integration/conftest.py create mode 100644 roles/linux-system-roles.network/tests/integration/test_ethernet.py create mode 100755 roles/linux-system-roles.network/tests/merge_coverage.sh create mode 120000 roles/linux-system-roles.network/tests/module_utils create mode 120000 roles/linux-system-roles.network/tests/modules create mode 100644 roles/linux-system-roles.network/tests/playbooks/down_profile.yml create mode 120000 roles/linux-system-roles.network/tests/playbooks/files create mode 100644 roles/linux-system-roles.network/tests/playbooks/integration_pytest_python3.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/manual_test_ethtool_coalesce.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/remove_profile.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/run_tasks.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_802_1x.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_802_1x_updated.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_bond.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_bond_deprecated.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_bridge.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_checkpoint_cleanup.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_dummy.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_eth_dns_support.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_ethernet.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_ethtool_coalesce.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_ipv6.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_ipv6_disabled.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_provider.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_reapply.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_team.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_team_plugin_installation.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_wireless.yml create mode 100644 roles/linux-system-roles.network/tests/playbooks/tests_wireless_plugin_installation.yml create mode 100755 roles/linux-system-roles.network/tests/setup_module_utils.sh create mode 100644 roles/linux-system-roles.network/tests/tasks/activate_profile.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/assert_device_absent.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/assert_device_present.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/assert_output_in_stderr_without_warnings.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/assert_profile_absent.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/assert_profile_present.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/cleanup_802_1x_server.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/cleanup_mock_wifi.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/cleanup_profile+device.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/create_and_remove_interface.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/create_bridge_profile.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/create_bridge_profile_no_autoconnect.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/create_dummy_profile.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/create_team_profile.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/create_test_interfaces_with_dhcp.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/delete_interface.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/el_repo_setup.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/enable_epel.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/get_NetworkManager_NVR.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/get_current_interfaces.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/get_interface_stat.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/get_modules_and_utils_paths.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/get_profile_stat.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/manage_test_interface.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/provider/create_and_remove_with_initscripts.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/provider/create_with_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/provider/default_with_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/remove+down_profile.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/remove_profile.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/remove_test_interfaces_with_dhcp.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/run_test.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/setup_802.1x.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/setup_802_1x_server.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/setup_mock_wifi.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/setup_test_interface.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/show_interfaces.yml create mode 100644 roles/linux-system-roles.network/tests/tasks/test_802.1x_capath.yml create mode 100644 roles/linux-system-roles.network/tests/tests_802_1x_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_802_1x_updated_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_bond_deprecated_initscripts.yml create mode 100644 roles/linux-system-roles.network/tests/tests_bond_deprecated_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_bond_initscripts.yml create mode 100644 roles/linux-system-roles.network/tests/tests_bond_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_bridge_initscripts.yml create mode 100644 roles/linux-system-roles.network/tests/tests_bridge_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_default_initscripts.yml create mode 100644 roles/linux-system-roles.network/tests/tests_default_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_dummy_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_eth_dns_support_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_ethernet_initscripts.yml create mode 100644 roles/linux-system-roles.network/tests/tests_ethernet_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_ethtool_coalesce_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_helpers_and_asserts.yml create mode 100644 roles/linux-system-roles.network/tests/tests_integration_pytest.yml create mode 100644 roles/linux-system-roles.network/tests/tests_ipv6_disabled_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_ipv6_initscripts.yml create mode 100644 roles/linux-system-roles.network/tests/tests_ipv6_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_provider_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_reapply_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_regression_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_states_initscripts.yml create mode 100644 roles/linux-system-roles.network/tests/tests_states_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_team_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_team_plugin_installation_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_wireless_nm.yml create mode 100644 roles/linux-system-roles.network/tests/tests_wireless_plugin_installation_nm.yml create mode 100644 roles/oatakan.ansible-role-ovirt/.travis.yml create mode 100644 roles/oatakan.ansible-role-ovirt/README.md create mode 100644 roles/oatakan.ansible-role-ovirt/defaults/main.yml create mode 100644 roles/oatakan.ansible-role-ovirt/meta/.galaxy_install_info create mode 100644 roles/oatakan.ansible-role-ovirt/meta/main.yml create mode 100644 roles/oatakan.ansible-role-ovirt/tasks/deprovision.yml create mode 100644 roles/oatakan.ansible-role-ovirt/tasks/main.yml create mode 100644 roles/oatakan.ansible-role-ovirt/tasks/preflight_check.yml create mode 100644 roles/oatakan.ansible-role-ovirt/tasks/provision.yml create mode 100644 roles/oatakan.ansible-role-ovirt/tasks/template_check.yml create mode 100644 roles/oatakan.ansible-role-ovirt/tasks/wait_for_disk.yml create mode 100644 roles/oatakan.ansible-role-ovirt/tasks/wait_for_disk_pre29.yml create mode 100644 roles/oatakan.ansible-role-ovirt/tasks/wait_for_ip.yml create mode 100644 roles/oatakan.ansible-role-ovirt/tasks/wait_for_ip_pre29.yml create mode 100644 roles/oatakan.ansible-role-ovirt/templates/cloud_init.yml.j2 create mode 100644 roles/oatakan.ansible-role-ovirt/templates/unattended.xml.j2 create mode 100644 roles/oatakan.ansible-role-ovirt/tests/inventory create mode 100644 roles/oatakan.ansible-role-ovirt/tests/test.yml create mode 100644 roles/oatakan.ansible-role-ovirt/vars/main.yml create mode 100644 roles/oatakan.ansible-role-windows-ad-controller/README.md create mode 100644 roles/oatakan.ansible-role-windows-ad-controller/defaults/main.yml create mode 100644 roles/oatakan.ansible-role-windows-ad-controller/meta/.galaxy_install_info create mode 100644 roles/oatakan.ansible-role-windows-ad-controller/meta/main.yml create mode 100644 roles/oatakan.ansible-role-windows-ad-controller/tasks/main.yml create mode 100644 roles/oatakan.ansible-role-windows-ad-controller/tests/inventory create mode 100644 roles/oatakan.ansible-role-windows-ad-controller/tests/test.yml create mode 100644 roles/oatakan.windows_template_build/files/Install-WMF3Hotfix.ps1 create mode 100644 roles/oatakan.windows_template_build/files/Upgrade-PowerShell.ps1 create mode 100644 roles/oatakan.windows_template_build/tasks/enable_tls_system_default.yml create mode 100644 roles/oatakan.windows_template_build/tasks/security-update-win2012.yml create mode 100644 roles/oatakan.windows_template_build/tasks/update-agent-win2008.yml create mode 100644 roles/oatakan.windows_template_build/tasks/winrm-memfix.yml create mode 100644 roles/oatakan.windows_update/.travis.yml create mode 100644 roles/oatakan.windows_update/LICENSE create mode 100644 roles/oatakan.windows_update/README.md create mode 100644 roles/oatakan.windows_update/defaults/main.yml create mode 100644 roles/oatakan.windows_update/files/win-updates.ps1 create mode 100644 roles/oatakan.windows_update/meta/.galaxy_install_info create mode 100644 roles/oatakan.windows_update/meta/main.yml create mode 100644 roles/oatakan.windows_update/tasks/main.yml create mode 100644 roles/oatakan.windows_update/tasks/updates-all.yml create mode 100644 roles/oatakan.windows_update/tasks/updates-powershell.yml create mode 100644 roles/oatakan.windows_update/tasks/updates-win2008r2.yml create mode 100644 roles/oatakan.windows_update/tasks/updates-with-retry.yml create mode 100644 roles/oatakan.windows_update/tests/inventory create mode 100644 roles/oatakan.windows_update/tests/test.yml create mode 100644 roles/requirements.yml create mode 100644 roles/systemli.apt_repositories/.editorconfig create mode 100644 roles/systemli.apt_repositories/.github/dependabot.yml create mode 100644 roles/systemli.apt_repositories/.github/workflows/main.yml create mode 100644 roles/systemli.apt_repositories/.yamllint create mode 100644 roles/systemli.apt_repositories/LICENSE create mode 100644 roles/systemli.apt_repositories/README.md create mode 100644 roles/systemli.apt_repositories/defaults/main.yml create mode 100644 roles/systemli.apt_repositories/files/gitlab.asc create mode 100644 roles/systemli.apt_repositories/files/gitlab.gpg create mode 100644 roles/systemli.apt_repositories/files/grafana.gpg create mode 100644 roles/systemli.apt_repositories/files/jitsi-archive-keyring.gpg create mode 100644 roles/systemli.apt_repositories/files/kubic.asc create mode 100644 roles/systemli.apt_repositories/files/prosody-debian-packages.gpg create mode 100644 roles/systemli.apt_repositories/files/sury.gpg create mode 100644 roles/systemli.apt_repositories/meta/.galaxy_install_info create mode 100644 roles/systemli.apt_repositories/meta/main.yml create mode 100644 roles/systemli.apt_repositories/molecule/default/INSTALL.rst create mode 100644 roles/systemli.apt_repositories/molecule/default/converge.yml create mode 100644 roles/systemli.apt_repositories/molecule/default/molecule.yml create mode 100644 roles/systemli.apt_repositories/molecule/default/prepare.yml create mode 120000 roles/systemli.apt_repositories/molecule/default/roles/ansible-role-apt_repositories create mode 100644 roles/systemli.apt_repositories/molecule/default/tests/test_default.py create mode 100644 roles/systemli.apt_repositories/molecule/default/tests/test_default.yml create mode 100644 roles/systemli.apt_repositories/molecule/default/verify.yml create mode 100644 roles/systemli.apt_repositories/molecule/docker/INSTALL.rst create mode 100644 roles/systemli.apt_repositories/molecule/docker/molecule.yml create mode 100644 roles/systemli.apt_repositories/tasks/key_path.yml create mode 100644 roles/systemli.apt_repositories/tasks/main.yml create mode 100644 roles/systemli.apt_repositories/tasks/repo.yml create mode 100644 roles/systemli.apt_repositories/templates/pref.j2 create mode 100644 roles/systemli.apt_repositories/templates/repo.list.j2 create mode 100644 roles/systemli.apt_repositories/templates/repo.sources.j2 create mode 100644 roles/systemli.apt_repositories/vars/gitlab.yml create mode 100644 roles/systemli.apt_repositories/vars/grafana.yml create mode 100644 roles/systemli.apt_repositories/vars/jitsi.yml create mode 100644 roles/systemli.apt_repositories/vars/kubic.yml create mode 100644 roles/systemli.apt_repositories/vars/null.yml create mode 100644 roles/systemli.apt_repositories/vars/prosody.yml create mode 100644 roles/systemli.apt_repositories/vars/sury.yml create mode 100644 simple_env/bindep.txt create mode 100644 simple_env/context/Containerfile create mode 100644 simple_env/context/_build/requirements.yml create mode 100644 simple_env/execution-environment.yml create mode 100644 simple_env/requirements.txt create mode 100644 simple_env/requirements.yml delete mode 100644 windows.yml create mode 100644 windows_ad.yml diff --git a/build_windows_template.yml b/build_windows_template.yml new file mode 100644 index 0000000..4fac521 --- /dev/null +++ b/build_windows_template.yml @@ -0,0 +1,12 @@ +- name: create an ovirt windows template + hosts: windows_template_base + gather_facts: False + connection: local + become: no + + vars: + ansible_python_interpreter: "{{ ansible_playbook_python }}" + + + roles: + - oatakan.windows_ovirt_template diff --git a/buildvm_artifact.json b/buildvm_artifact.json new file mode 100644 index 0000000..0cb7813 --- /dev/null +++ b/buildvm_artifact.json @@ -0,0 +1,7 @@ +{ + "version": "1.0.0", + "plays": [], + "stdout": [], + "status": "successful", + "status_color": 10 +} \ No newline at end of file diff --git a/requested.txt b/requested.txt deleted file mode 100644 index 3d40a38..0000000 --- a/requested.txt +++ /dev/null @@ -1,76 +0,0 @@ -ack -asciidoctor -asciinema -aspell-dict-ca -aspell-dict-en -aspell-dict-uk -astyle -automake -avahi -cdrtools -certbot -cracklib -curl -dash -davix -db62 -dbus-python37 -dupd -emacs -emacs-mac-app-devel -fd -ffmpeg -gconf -gdk-pixbuf2 -git-delta -gmime -gnutar -go -gtk2 -gtk3 -html2text -icedtea6-plugs -ipmitool -isync -jq -kubectl-1.17 -libglade2 -libvterm -minicom -mpvim -msmtp -mtr -mu -ncdu -nut -nvm -offlineimap -oniguruma6 -openconnect -OpenIPMI -openjfx11 -openssh -p5.28-yaml-libyaml -pass -perl5 -php-crack -plantuml -Platypus -poppler -py-boto3 -py-libxml2 -py27-opengl-accelerate -py27-pygtk -py37-curl -py37-msgpack -py37-SDL2 -py38-powerline -py38-virtualenvwrapper -ranger -ripgrep -sassc -terminal-notifier -topgrade -virt-viewer -xapian-bindings-python27 -yarn diff --git a/rhv_setup.yml b/rhv_setup.yml index 6fb8015..f6a75ce 100644 --- a/rhv_setup.yml +++ b/rhv_setup.yml @@ -73,13 +73,27 @@ src: "{{ key_files_prefix}}-rootchain.pem" dest: /etc/pki/ca-trust/source/anchors/ register: rootchain_result - notify: restart httpd + notify: + - update ca-trust + - restart httpd - name: Certificate store updated command: /usr/bin/update-ca-trust when: rootchain_result.changed notify: restart httpd + - name: Apache CA is file, not link + file: + path: /etc/pki/ovirt-engine/apache-ca.pem + state: file + register: apache_ca_stat + + - name: Apache CA link is removed + file: + path: /etc/pki/ovirt-engine/apache-ca.pem + state: absent + when: apache_ca_stat.state == "file" + - name: CA Rootchain in Apache config copy: src: "{{ key_files_prefix }}-rootchain.pem" @@ -92,6 +106,9 @@ src: "{{ key_files_prefix }}.key" dest: /etc/pki/ovirt-engine/keys/apache.key.nopass backup: yes + owner: root + group: ovirt + mode: 640 notify: restart httpd - name: Certificate installed @@ -99,6 +116,9 @@ src: "{{ key_files_prefix }}.pem" dest: /etc/pki/ovirt-engine/certs/apache.cer backup: yes + owner: root + group: ovirt + mode: 644 notify: restart httpd - name: Trust Store Configuration @@ -121,8 +141,7 @@ - SSL_CERTIFICATE=/etc/pki/ovirt-engine/apache.cer - SSL_KEY=/etc/pki/ovirt-engine/keys/apache.key.nopass notify: - - restart ovn - - restart ovirt-engine + - restart ovirt-websocket-proxy handlers: - name: restart httpd @@ -130,6 +149,9 @@ name: httpd state: restarted + - name: update ca-trust + command: update-ca-trust + - name: restart ovn service: name: ovirt-provider-ovn @@ -140,6 +162,11 @@ name: ovirt-engine state: restarted + - name: restart ovirt-websocket-proxy + service: + name: ovirt-websocket-proxy + state: restarted + - name: Create RHV/ovirt VLANs hosts: rhv.mgmt.toal.ca diff --git a/roles/felixfontein.acme_certificate/.gitignore b/roles/felixfontein.acme_certificate/.gitignore new file mode 100644 index 0000000..ed8ebf5 --- /dev/null +++ b/roles/felixfontein.acme_certificate/.gitignore @@ -0,0 +1 @@ +__pycache__ \ No newline at end of file diff --git a/roles/felixfontein.acme_certificate/.yamllint b/roles/felixfontein.acme_certificate/.yamllint new file mode 100644 index 0000000..6a8c00d --- /dev/null +++ b/roles/felixfontein.acme_certificate/.yamllint @@ -0,0 +1,45 @@ +--- +extends: default + +rules: + line-length: + max: 140 + level: warning + document-start: + present: true + document-end: + present: false + truthy: + level: error + allowed-values: + - 'yes' + - 'no' + - 'true' + - 'false' + - 'True' + - 'False' + indentation: + spaces: 2 + indent-sequences: consistent + key-duplicates: enable + trailing-spaces: enable + new-line-at-end-of-file: disable + hyphens: + max-spaces-after: 1 + empty-lines: + max: 2 + max-start: 0 + max-end: 0 + commas: + max-spaces-before: 0 + min-spaces-after: 1 + max-spaces-after: 1 + colons: + max-spaces-before: 0 + max-spaces-after: 1 + brackets: + min-spaces-inside: 0 + max-spaces-inside: 0 + braces: + min-spaces-inside: 0 + max-spaces-inside: 0 diff --git a/roles/felixfontein.acme_certificate/CHANGELOG.md b/roles/felixfontein.acme_certificate/CHANGELOG.md new file mode 100644 index 0000000..58da626 --- /dev/null +++ b/roles/felixfontein.acme_certificate/CHANGELOG.md @@ -0,0 +1,19 @@ +# Changelog for acme_certificate + +## Version 1.1.1 (2020-05-22) + +- Linting, to make Galaxy more happy. (ansible-lint does not like missing modules. This might get better with collections.) + +## Version 1.1.0 (2020-05-22) + +- Added better namespacing for role parameters; all role parameters now start with `acme_certificate_`. The old, shorter names can still be used for now. Support for them will be dropped in version 2.0.0, to be released later this year. +- Dropped support for GCDNS (which never worked). +- Support for DNS provider NS1 for DNS challenges (thanks to @timelapserduck). +- Lint YAML files (thanks to @pgporada). +- Allow `key_path` to not have trailing slash (thanks to @nwmcsween). +- Fix curve used for P-256. +- Require Ansible 2.8.3. + +## Version 1.0 (2019-07-01) + +First version published on Ansible Galaxy. diff --git a/roles/felixfontein.acme_certificate/LICENSE b/roles/felixfontein.acme_certificate/LICENSE new file mode 100644 index 0000000..347b83e --- /dev/null +++ b/roles/felixfontein.acme_certificate/LICENSE @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2015--2020 Felix Fontein + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/roles/felixfontein.acme_certificate/README.md b/roles/felixfontein.acme_certificate/README.md new file mode 100644 index 0000000..902abfe --- /dev/null +++ b/roles/felixfontein.acme_certificate/README.md @@ -0,0 +1,360 @@ +# acme_certificate 1.1.1 + +Allows to obtain certificates from Let's Encrypt with minimal interaction with the webserver. Most code is executed on the controller, and the account key is never send to the nodes. + +The role can be installed via [Ansible Galaxy](https://galaxy.ansible.com/felixfontein/acme_certificate): + + ansible-galaxy install felixfontein.acme_certificate + +For changes in this role, see [the changelog](CHANGELOG.md). + +## Description + +This is an [Ansible](https://github.com/ansible/ansible) role which can use any CA supporting the ACME protocol, such as [Let's Encrypt](https://letsencrypt.org/) or [Buypass](https://www.buypass.com/ssl/products/acme), to issue TLS/SSL certificates for your server. This role requires Ansible 2.8.3 or newer and is based on the [acme_certificate module](https://docs.ansible.com/ansible/latest/acme_certificate_module.html) coming with Ansible. + +The main advantage of this approach over others is that *almost no code is executed on your webserver*: only when you use HTTP challenges, files need to be copied onto your webserver, and afterwards deleted from it. Everything else is executed on your local machine! + +(This does not cover installing the certificates, you have to do that yourself in another role.) + +## Requirements + +Requires the Python [cryptography](https://pypi.org/project/cryptography/) library installed on the controller, available to the Python version used to execute the playbook. If `cryptography` is not installed, a recent enough version of [PyOpenSSL](https://pypi.org/project/pyOpenSSL/) is currently supported as a fallback by the Ansible `openssl_privatekey` and `openssl_csr` modules. + +The `openssl` binary must also be available in the executable path on the controller. It is needed by the `acme_certificate` module in case `cryptography` is not installed, and it is used for certificate chain validation. + +If DNS challenges are used, there can be other requirements depending on the DNS provider. For example, for Amazon's Route 53, the Ansible `route53` module requires the Python `boto` package. + +## Account Key Setup + +You can create an account key using the `openssl` binary as follows: + + # RSA 4096 bit key + openssl genrsa 4096 -out keys/acme-account.key + # ECC 256 bit key (P-256) + openssl ecparam -name prime256v1 -genkey -out keys/acme-account.key + # ECC 384 bit key (P-384) + openssl ecparam -name secp384r1 -genkey -out keys/acme-account.key + +With Ansible, you can use the `openssl_privatekey` module as follows: + + - name: Generate RSA 4096 key + openssl_privatekey: + path: keys/acme-account.key + type: RSA + size: 4096 + - name: Generate ECC 256 bit key (P-256) + openssl_privatekey: + path: keys/acme-account.key + type: ECC + curve: secp256r1 + - name: Generate ECC 384 bit key (P-384) + openssl_privatekey: + path: keys/acme-account.key + type: ECC + curve: secp384r1 + +Make sure you store the account key safely. As opposed to certificate private keys, there is no need to regenerate it frequently, and it makes recovation of certificates issued with it very simple. + +## Role Variables + +Please note that from May 2020 on, all variables must be prefixed with `acme_certificate_`. For some time, the module will still use the old (short) variable names if the longer ones are not defined. Please upgrade your role usage as soon as possible. + +These are the main variables: + +- `acme_certificate_acme_account`: Path to the private ACME account key. Must always be specified. +- `acme_certificate_acme_email`: Your email address which shall be associated to the ACME account. Must always be specified. +- `acme_certificate_algorithm`: The algorithm used for creating private keys. The default is `"rsa"`; other choices are `"p-256"`, `"p-384"` or `"p-521"` for the NIST elliptic curves `prime256v1`, `secp384r1` and `secp521r1`, respectively. +- `acme_certificate_key_length`: The bitlength to use for RSA private keys. The default is 4096. +- `acme_certificate_key_name`: The basename for storing the keys and certificates. The default is the first domain specified, with `*` replaced by `_`. +- `acme_certificate_keys_path`: Where the keys and certificates are stored. Default value is `"keys/"`. +- `acme_certificate_keys_old_path`: Where old keys and certificates should be copied to; used in case `acme_certificate_keys_old_store` is true. Default value is `"keys/old/"`. +- `acme_certificate_keys_old_store`: If set to `true`, will make copies of old keys and certificates. The copies will be stored in the directory specified by `acme_certificate_keys_old_store`. Default value is `false`. +- `acme_certificate_keys_old_prepend_timestamp`: Whether copies of old keys and certificates should be prepended by the current date and time. Default value is `false`. +- `acme_certificate_ocsp_must_staple`: Whether a certificate with the OCSP Must Staple extension is requested. Default value is `false`. +- `acme_certificate_agreement`: The terms of service document the user agrees to. Default value is `https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf`. +- `acme_certificate_acme_directory`: The ACME directory to use. Default is `https://acme-v02.api.letsencrypt.org/directory`, which is the current production ACME v2 endpoint of Let's Encrypt. +- `acme_certificate_acme_version`: The ACME directory's version. Default is 2. Use 1 for ACME v1. +- `acme_certificate_challenge`: The challenge type to use. Should be `http-01` for HTTP challenges (needs access to web server) or `dns-01` for DNS challenges (needs access to DNS provider). +- `acme_certificate_root_certificate`: The root certificate for the ACME directory. Default value is `https://letsencrypt.org/certs/isrgrootx1.pem` for the root certificate of Let's Encrypt. +- `acme_certificate_deactivate_authzs`: Whether `authz`s (authorizations) should be deactivated afterwards. Default value is `true`. Set to `false` to be able to re-use `authz`s. +- `acme_certificate_modify_account`: Whether the ACME account should be created (if it doesn't exist) and the contact data (email address) should be updated. Default value is `true`. Set to `false` if you want to use the `acme_account` module to manage your ACME account (not done by this role). +- `acme_certificate_privatekey_mode`: Which file mode to use for the private key file. Default value is `"0600"`, which means read- and writeable by the owner, but not accessible by anyone else (except possibly `root`). + +### HTTP Challenges + +For HTTP challenges, the following variables define how the challenges can be put onto the (remote) webserver: + +- `acme_certificate_server_location`: Location where `.well-known/acme-challenge/` will be served from. Default is `/var/www/challenges`. +- `acme_certificate_http_become`: Argument for `become:` for the `file` and `copy` tasks. Default value is `false`. +- `acme_certificate_http_challenge_user`: The user the challenge files are owned by. Default value is `root`. +- `acme_certificate_http_challenge_group`: The group the challenge files are owned by. Default value is `http`. +- `acme_certificate_http_challenge_folder_mode`: The mode to use for the challenge folder. Default value is `0750` (octal). +- `acme_certificate_http_challenge_file_mode`: The mode to use for the challenge files. Default value is `0640` (octal). + +The following subsection shows how to configure [nginx](https://nginx.org/) for HTTP challenges. Configuring other webservers can be done in a similar way. + +#### Nginx configuration + +Assume that for one of your TLS/SSL protected domains, you use a HTTP-to-HTTPS redirect. Let's assume it looks like this: + + server { + listen example.com:80; + server_name example.com *.example.com; + return 301 https://www.example.com$request_uri; + } + +To allow the `acme_certificate` role to put something at `http://*.example.com/.well-known/acme-challenge/`, you can change this to: + + server { + listen example.com:80; + server_name example.com *.example.com; + location /.well-known/acme-challenge/ { + alias /var/www/challenges/; + try_files $uri =404; + } + location / { + return 301 https://www.example.com$request_uri; + } + } + +With this nginx config, all other URLs on `*.example.com` and `example.com` are still redirected, while everything in `*.example.com/.well-known/acme-challenge/` is served from `/var/www/challenges`. When adjusting the location of `/var/www/challenges`, you must also change `acme_certificate_server_location`. + +You can even improve on this by redirecting all URLs in `*.example.com/.well-known/acme-challenge/` which do not resolve to a valid file in `/var/www/challenges` to your HTTPS server as well. One way to do this is: + + server { + listen example.com:80; + server_name example.com *.example.com; + location /.well-known/acme-challenge/ { + alias /var/www/lechallenges/; + try_files $uri @forward_https; + } + location @forward_https { + return 301 https://www.example.com$request_uri; + } + location / { + return 301 https://www.example.com$request_uri; + } + } + +With this config, if `/var/www/challenges/` is empty, your HTTP server will behave as if the `/.well-known/acme-challenge/` location isn't specified. + +### DNS Challenges + +If DNS challenges are used, the following variables define how the challenges can be fulfilled: + +- `acme_certificate_dns_provider`: must be one of `route53`, `hosttech`, and `ns1`. Each needs more information: + - For `route53` (Amazon Route 53), the credentials must be passed as `acme_certificate_aws_access_key` and `acme_certificate_aws_secret_key`. + - For `hosttech` (hosttech GmbH, requires external [hosttech_dns_record module](https://github.com/felixfontein/ansible-hosttech)). + - For `ns1` ([ns1.com](https://ns1.com)) the key for your API account must be passed as `acme_certificate_ns1_secret_key`. Also it depends on external module `ns1_record`. Assuming default directory structure and settings, you may need download 2 files into machine where playbook executed: + + ```bash + curl --create-dirs -L -o ~/.ansible/plugins/module_utils/ns1.py https://github.com/ns1/ns1-ansible-modules/raw/master/module_utils/ns1.py + curl --create-dirs -L -o ~/.ansible/plugins/modules/ns1_record.py https://github.com/ns1/ns1-ansible-modules/raw/master/library/ns1_record.py + ``` + +Please note that the DNS challenge code is not perfect. The Route 53, Hosttech and NS1 functionality has been tested. One thing that is not complete yet is that the code tries to extract the DNS zone from the domain by taking the last two components separated by dots. This will fail for example for `.co.uk` domains or other nested zones. + +Support for more DNS providers can be added by adding `tasks/dns-NAME-create.yml` and `tasks/dns-NAME-cleanup.yml` files with similar content as in the existing files. + +## Account key conversion + +Note that this Ansible role expects the Let's Encrypt account key to be in PEM format and not in JWK format, which is used by the [official Let's Encrypt client certbot](https://github.com/certbot/certbot). If you have created an account key with the official client and now want to use this key with this ansible role, you have to convert it. One tool which can do this is [pem-jwk](https://github.com/dannycoates/pem-jwk). + +## Generated Files + +Let's assume you created TLS keys for `www.example.com`. You have to copy the relevant files to your webserver. The ansible role created the following files: + + * `keys/www.example.com.key`: this is the private key for the certificate. Ensure nobody can access it. + * `keys/www.example.com.pem`: this is the certificate itself. + * `keys/www.example.com-chain.pem`: this is the intermediate certificate(s) needed for a trust path. + * `keys/www.example.com.cnf`: this is an OpenSSL configuration file used to create the Certificate Signing Request. You can safely delete it. + * `keys/www.example.com.csr`: this is the Certificate Signing Request used to obtain the certificate. You can safely delete it. + * `keys/www.example.com-fullchain.pem`: this is the certificate combined with the intermediate certificate(s). + * `keys/www.example.com-rootchain.pem`: this is the intermediate certificate(s) combined with the root certificate. You might need this for OCSP stapling. + * `keys/www.example.com-root.pem`: this is the root certificate of Let's Encrypt. + +For configuring your webserver, you need the private key (`keys/www.example.com.key`), and either the certificate with intermediate certificate(s) combined in one file (`keys/www.example.com-fullchain.pem`), or the certificate and the intermediate certificate(s) as two separate files (`keys/www.example.com.pem` and `keys/www.example.com-chain.pem`). If you want to use [OCSP stapling](https://en.wikipedia.org/wiki/OCSP_stapling), you will also need `keys/www.example.com-rootchain.pem`. + +To get these files onto your web server, you could add tasks as follows: + + - name: copy private keys + copy: + src: keys/{{ item }} + dest: /etc/ssl/private/ + owner: root + group: root + mode: "0400" + with_items: + - www.example.com.key + notify: reload webserver + + - name: copy certificates + copy: + src: keys/{{ item }} + dest: /etc/ssl/server-certs/ + owner: root + group: root + mode: "0444" + with_items: + - www.example.com-rootchain.pem + - www.example.com-fullchain.pem + - www.example.com.pem + notify: reload webserver + +The webserver configuration could look as follows (for nginx): + + server { + listen www.example.com:443 ssl; # IPv4: listen to IP www.example.com points to + listen [::]:443 ssl; # IPv6: listen to localhost + server_name www.example.com; + + # Allowing only TLS 1.0 and 1.2, with a very selective amount of ciphers. + # According to SSL Lab's SSL server test, this will block: + # - Android 2.3.7 + # - IE 6 and 8 under Windows XP + # - Java 6, 7 and 8 + # If that's not acceptable for you, choose other cipher lists. Look for + # example at https://wiki.mozilla.org/Security/Server_Side_TLS + ssl_protocols TLSv1.2 TLSv1; + ssl_prefer_server_ciphers on; + ssl_ciphers "-ALL !ADH !aNULL !EXP !EXPORT40 !EXPORT56 !RC4 !3DES !eNULL !NULL !DES !MD5 !LOW ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES256-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-RSA-AES256-SHA DHE-RSA-AES256-SHA"; + + # The certificate chain sent to the browser, as well as the private key. + # Make sure your private key is only accessible by the webserver during + # configuration loading (which by default is done with user root). + ssl_certificate /etc/ssl/server-certs/www.example.com-fullchain.pem; + ssl_certificate_key /etc/ssl/private/www.example.com.key; + + # For OCSP stapling, we need a DNS resolver. Here only public Quad9 and + # Google DNS servers are specified; I would prepent them by your hoster's + # DNS servers. You can usually find their IPs in /etc/resolv.conf on your + # webserver. + resolver 9.9.9.9 8.8.8.8 8.8.4.4 valid=300s; + resolver_timeout 10s; + + # Enabling OCSP stapling. Nginx will take care of retrieving the OCSP data + # automatically. See https://wiki.mozilla.org/Security/Server_Side_TLS#OCSP_Stapling + # for details on OCSP stapling. + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /etc/ssl/server-certs/www.example.com-rootchain.pem; + + # Enables a SSL session cache. Adjust the numbers depending on your site's usage. + ssl_session_cache shared:SSL:50m; + ssl_session_timeout 30m; + ssl_session_tickets off; + + # You should only use HSTS with proper certificates; the ones from Let's Encrypt + # are fine for this, self-signed ones are not. See MozillaWiki for more details: + # https://wiki.mozilla.org/Security/Server_Side_TLS#HSTS:_HTTP_Strict_Transport_Security + add_header Strict-Transport-Security "max-age=3155760000;"; + + charset utf-8; + + access_log /var/log/nginx/www.example.com.log combined; + error_log /var/log/nginx/www.example.com.log error; + + location / { + root /var/www/www.example.com; + index index.html; + } + } + +## Dependencies + +This role doesn't depend on other roles. + +## Example Playbook + +This role can be used as follows. Note that it obtains several certificates, and defines variables used for all certificates globally: + + --- + - name: getting certificates for webserver + hosts: webserver + vars: + acme_certificate_acme_account: 'keys/acme-account.key' + acme_certificate_acme_email: 'mail@example.com' + # For HTTP challenges: + acme_certificate_server_location: '/var/www/challenges/' + acme_certificate_http_challenge_user: root + acme_certificate_http_challenge_group: http + acme_certificate_http_challenge_folder_mode: "0750" + acme_certificate_http_challenge_file_mode: "0640" + # For DNS challenges with route53: + acme_certificate_dns_provider: route53 + acme_certificate_aws_access_key: REPLACE_WITH_YOUR_ACCESS_KEY + acme_certificate_aws_secret_key: REPLACE_WITH_YOUR_SECRET_KEY + # For DNS challenges with ns1: + # acme_certificate_dns_provider: ns1 + # acme_certificate_ns1_secret_key: REPLACE_WITH_YOUR_SECRET_KEY + roles: + - role: acme_certificate + acme_certificate_domains: ['example.com', 'www.example.com'] + # Use DNS challenges: + acme_certificate_challenge: dns-01 + # The certificate files will be stored at: + # keys/example.com.key (private key) + # keys/example.com.csr (certificate signing request) + # keys/example.com.pem (certificate) + # keys/example.com.cnf (OpenSSL config for CSR creation -- can be safely deleted) + # keys/example.com-chain.pem (intermediate certificate) + # keys/example.com-fullchain.pem (certificate with intermediate certificate) + # keys/example.com-root.pem (root certificate) + # keys/example.com-rootchain.pem (intermediate certificate with root certificate) + - role: acme_certificate + acme_certificate_domains: ['another.example.com'] + acme_certificate_key_name: 'another.example.com-rsa' + acme_certificate_key_length: 4096 + # Use HTTP challenges: + acme_certificate_challenge: http-01 + # The certificate files will be stored at: + # keys/another.example.com-rsa.key (private key) + # keys/another.example.com-rsa.csr (certificate signing request) + # keys/another.example.com-rsa.pem (certificate) + # keys/another.example.com-rsa.cnf (OpenSSL config for CSR creation -- can be safely deleted) + # keys/another.example.com-rsa-chain.pem (intermediate certificate) + # keys/another.example.com-rsa-fullchain.pem (certificate with intermediate certificate) + # keys/another.example.com-rsa-root.pem (root certificate) + # keys/another.example.com-rsa-rootchain.pem (intermediate certificate with root certificate) + - role: acme_certificate + acme_certificate_domains: ['another.example.com'] + acme_certificate_key_name: 'another.example.com-ecc' + acme_certificate_algorithm: 'p-256' + # Use HTTP challenges (default for challenge is http-01). + # The certificate files will be stored at: + # keys/another.example.com-ecc.key (private key) + # keys/another.example.com-ecc.csr (certificate signing request) + # keys/another.example.com-ecc.pem (certificate) + # keys/another.example.com-ecc.cnf (OpenSSL config for CSR creation -- can be safely deleted) + # keys/another.example.com-ecc-chain.pem (intermediate certificate) + # keys/another.example.com-ecc-fullchain.pem (certificate with intermediate certificate) + # keys/another.example.com-ecc-root.pem (root certificate) + # keys/another.example.com-ecc-rootchain.pem (intermediate certificate with root certificate) + +## License + +The MIT License (MIT) + +Copyright (c) 2018-2020 Felix Fontein + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +## Author Information + +The homepage for this role is https://github.com/felixfontein/acme-certificate/. Please use the issue tracker to report problems. diff --git a/roles/felixfontein.acme_certificate/ansible.cfg b/roles/felixfontein.acme_certificate/ansible.cfg new file mode 100644 index 0000000..613d83b --- /dev/null +++ b/roles/felixfontein.acme_certificate/ansible.cfg @@ -0,0 +1,2 @@ +[defaults] +roles_path = ../ diff --git a/roles/felixfontein.acme_certificate/defaults/main.yml b/roles/felixfontein.acme_certificate/defaults/main.yml new file mode 100644 index 0000000..477082d --- /dev/null +++ b/roles/felixfontein.acme_certificate/defaults/main.yml @@ -0,0 +1,47 @@ +--- +acme_certificate_domains: '{{ domains }}' +acme_certificate_dns_provider: '{{ dns_provider }}' +acme_certificate_acme_account: '{{ acme_account }}' +acme_certificate_acme_email: '{{ acme_email }}' + +acme_certificate_algorithm: '{{ algorithm | default("rsa") }}' +acme_certificate_key_length: '{{ key_length | default(4096) }}' +acme_certificate_key_name: "{{ key_name | default(acme_certificate_domains[0].replace('*', '_')) }}" +acme_certificate_keys_path: '{{ keys_path | default("keys/") }}' +acme_certificate_keys_old_path: '{{ keys_old_path | default("keys/old/") }}' +acme_certificate_keys_old_store: '{{ keys_old_store | default(false) }}' +acme_certificate_keys_old_prepend_timestamp: '{{ keys_old_prepend_timestamp | default(false) }}' +acme_certificate_ocsp_must_staple: '{{ ocsp_must_staple | default(false) }}' +acme_certificate_terms_agreed: '{{ terms_agreed | default(true) }}' +acme_certificate_acme_directory: '{{ acme_directory | default("https://acme-v02.api.letsencrypt.org/directory") }}' +acme_certificate_acme_version: '{{ acme_version | default(2) }}' +# For ACME v1: +# acme_certificate_acme_directory: https://acme-v01.api.letsencrypt.org/directory +# acme_certificate_acme_version: 1 +# For staging, use: +# acme_certificate_acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory (ACME v2) +# acme_certificate_acme_directory: https://acme-staging.api.letsencrypt.org/directory (ACME v1) +acme_certificate_challenge: '{{ challenge | default("http-01") }}' +acme_certificate_root_certificate: '{{ root_certificate | default("https://letsencrypt.org/certs/isrgrootx1.pem") }}' +# For staging, use: +# root_certificate: https://letsencrypt.org/certs/fakelerootx1.pem +acme_certificate_deactivate_authzs: '{{ deactivate_authzs | default(true) }}' +acme_certificate_modify_account: '{{ modify_account | default(true) }}' +acme_certificate_validate_certs: '{{ validate_certs | default(true) }}' +acme_certificate_verify_certs: '{{ verify_certs | default(true) }}' +acme_certificate_privatekey_mode: '{{ privatekey_mode | default("0600") }}' + +# For HTTP challenges: +acme_certificate_server_location: '{{ server_location | default("/var/www/challenges") }}' +acme_certificate_http_become: '{{ http_become | default(false) }}' +acme_certificate_http_challenge_user: '{{ http_challenge_user | default("root") }}' +acme_certificate_http_challenge_group: '{{ http_challenge_group | default("http") }}' +acme_certificate_http_challenge_folder_mode: '{{ http_challenge_folder_mode | default("0750") }}' +acme_certificate_http_challenge_file_mode: '{{ http_challenge_file_mode | default("0640") }}' + +# DNS challenge credentials +acme_certificate_hosttech_username: '{{ hosttech_username | default(omit) }}' +acme_certificate_hosttech_password: '{{ hosttech_password | default(omit) }}' +acme_certificate_ns1_secret_key: '{{ ns1_secret_key | default(omit) }}' +acme_certificate_aws_access_key: '{{ aws_access_key | default(omit) }}' +acme_certificate_aws_secret_key: '{{ aws_secret_key | default(omit) }}' diff --git a/roles/felixfontein.acme_certificate/filter_plugins/path_filter.py b/roles/felixfontein.acme_certificate/filter_plugins/path_filter.py new file mode 100644 index 0000000..fdb0aa7 --- /dev/null +++ b/roles/felixfontein.acme_certificate/filter_plugins/path_filter.py @@ -0,0 +1,19 @@ +# -*- coding: utf-8 -*- + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + +import os.path + + +def path_join(list): + return os.path.join(*list) + + +class FilterModule(object): + ''' Ansible core jinja2 filters ''' + + def filters(self): + return { + 'path_join': path_join, + } diff --git a/roles/felixfontein.acme_certificate/meta/.galaxy_install_info b/roles/felixfontein.acme_certificate/meta/.galaxy_install_info new file mode 100644 index 0000000..8a6f868 --- /dev/null +++ b/roles/felixfontein.acme_certificate/meta/.galaxy_install_info @@ -0,0 +1,2 @@ +install_date: Mon Apr 19 15:24:27 2021 +version: 1.1.1 diff --git a/roles/felixfontein.acme_certificate/meta/main.yml b/roles/felixfontein.acme_certificate/meta/main.yml new file mode 100644 index 0000000..d2f6423 --- /dev/null +++ b/roles/felixfontein.acme_certificate/meta/main.yml @@ -0,0 +1,25 @@ +--- +galaxy_info: + role_name: acme_certificate + author: Felix Fontein + description: > + Wrapper of Ansible's included acme_certificate module, whose aim is that almost no code + is executed on the webserver. Requires the Python cryptography library as well as the + OpenSSL binary installed locally and available on executable path. + + license: MIT + + min_ansible_version: 2.8.3 + + galaxy_tags: + - acme + - letsencrypt + - buypass + - ssl + - tls + - https + - encryption + - security + - web + +dependencies: [] diff --git a/roles/felixfontein.acme_certificate/sample-playbook.yml b/roles/felixfontein.acme_certificate/sample-playbook.yml new file mode 100644 index 0000000..d106f6b --- /dev/null +++ b/roles/felixfontein.acme_certificate/sample-playbook.yml @@ -0,0 +1,62 @@ +--- +- name: getting certificates for webserver + hosts: webserver + vars: + acme_certificate_acme_account: 'keys/acme-account.key' + acme_certificate_acme_email: 'mail@example.com' + # For HTTP challenges: + acme_certificate_server_location: '/var/www/challenges/' + acme_certificate_http_challenge_user: root + acme_certificate_http_challenge_group: http + acme_certificate_http_challenge_folder_mode: "0750" + acme_certificate_http_challenge_file_mode: "0640" + # For DNS challenges with route53: + acme_certificate_dns_provider: route53 + acme_certificate_aws_access_key: REPLACE_WITH_YOUR_ACCESS_KEY + acme_certificate_aws_secret_key: REPLACE_WITH_YOUR_SECRET_KEY + # For DNS challenges with ns1: + # acme_certificate_dns_provider: ns1 + # acme_certificate_ns1_secret_key: REPLACE_WITH_YOUR_SECRET_KEY + roles: + - role: acme_certificate + acme_certificate_domains: ['example.com', 'www.example.com'] + # Use DNS challenges: + acme_certificate_challenge: dns-01 + # The certificate files will be stored at: + # keys/example.com.key (private key) + # keys/example.com.csr (certificate signing request) + # keys/example.com.pem (certificate) + # keys/example.com.cnf (OpenSSL config for CSR creation -- can be safely deleted) + # keys/example.com-chain.pem (intermediate certificate) + # keys/example.com-fullchain.pem (certificate with intermediate certificate) + # keys/example.com-root.pem (root certificate) + # keys/example.com-rootchain.pem (intermediate certificate with root certificate) + - role: acme_certificate + acme_certificate_domains: ['another.example.com'] + acme_certificate_key_name: 'another.example.com-rsa' + acme_certificate_key_length: 4096 + # Use HTTP challenges: + acme_certificate_challenge: http-01 + # The certificate files will be stored at: + # keys/another.example.com-rsa.key (private key) + # keys/another.example.com-rsa.csr (certificate signing request) + # keys/another.example.com-rsa.pem (certificate) + # keys/another.example.com-rsa.cnf (OpenSSL config for CSR creation -- can be safely deleted) + # keys/another.example.com-rsa-chain.pem (intermediate certificate) + # keys/another.example.com-rsa-fullchain.pem (certificate with intermediate certificate) + # keys/another.example.com-rsa-root.pem (root certificate) + # keys/another.example.com-rsa-rootchain.pem (intermediate certificate with root certificate) + - role: acme_certificate + acme_certificate_domains: ['another.example.com'] + acme_certificate_key_name: 'another.example.com-ecc' + acme_certificate_algorithm: 'p-256' + # Use HTTP challenges (default for challenge is http-01). + # The certificate files will be stored at: + # keys/another.example.com-ecc.key (private key) + # keys/another.example.com-ecc.csr (certificate signing request) + # keys/another.example.com-ecc.pem (certificate) + # keys/another.example.com-ecc.cnf (OpenSSL config for CSR creation -- can be safely deleted) + # keys/another.example.com-ecc-chain.pem (intermediate certificate) + # keys/another.example.com-ecc-fullchain.pem (certificate with intermediate certificate) + # keys/another.example.com-ecc-root.pem (root certificate) + # keys/another.example.com-ecc-rootchain.pem (intermediate certificate with root certificate) diff --git a/roles/felixfontein.acme_certificate/tasks/dns-dme-cleanup.yml b/roles/felixfontein.acme_certificate/tasks/dns-dme-cleanup.yml new file mode 100644 index 0000000..95d03f6 --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/dns-dme-cleanup.yml @@ -0,0 +1,18 @@ +--- +# Clean up DNS challenges for DNS provider DNSMadeEasy +- name: Cleaning up challenge DNS entries for domains {{ ', '.join(domains) }} via DNSMadeEasy + connection: local + community.general.dnsmadeeasy: + account_key: "{{ dme_account_key }}" + account_secret: "{{ dme_account_secret }}" + domain: "{{ item.key |regex_replace('^(?:.*\\.|)([^.]+\\.[^.]+)$', '\\1') }}" + record_ttl: 60 + record_type: TXT + record_name: "{{ item.key |regex_replace('^(.*)(\\.[^.]+\\.[^.]+)$', '\\1') }}" + record_value: "{{ item.value|first }}" + state: absent + run_once: True + with_dict: "{{ acme_certificate_INTERNAL_challenge.challenge_data_dns }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs diff --git a/roles/felixfontein.acme_certificate/tasks/dns-dme-create.yml b/roles/felixfontein.acme_certificate/tasks/dns-dme-create.yml new file mode 100644 index 0000000..aa7e391 --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/dns-dme-create.yml @@ -0,0 +1,32 @@ +--- +# Create DNS challenges for DNS provider Amazon Route53 +- name: Creating challenge DNS entries for domains {{ ', '.join(domains) }} via DNSMadeEasy + connection: local + community.general.dnsmadeeasy: + account_key: "{{ dme_account_key }}" + account_secret: "{{ dme_account_secret }}" + # This is fragile, and will only work for 2-level domain (eg: corp.com, NOT corp.co.uk ) + domain: "{{ item.key | regex_replace('^(?:.*\\.|)([^.]+\\.[^.]+)$', '\\1') }}" + record_ttl: 60 + record_type: TXT + record_name: "{{ item.key |regex_replace('^(.*)(\\.[^.]+\\.[^.]+)$', '\\1') }}" + record_value: "{{ item.value|first }}" + state: present + # Need dnsmadeeasy module fixed (https://github.com/ansible/ansible/issues/58305) + run_once: True + with_dict: "{{ acme_certificate_INTERNAL_challenge.challenge_data_dns }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs + +- name: Wait for DNS entries to become available + shell: "dig txt {{ item.key }} +short @8.8.8.8" + register: dig_result + until: "item.value|first in dig_result.stdout" + retries: 60 + delay: 5 + with_dict: "{{ acme_certificate_INTERNAL_challenge.challenge_data_dns }}" + +- name: Pause for 60s for more propagation + pause: + minutes: 1 diff --git a/roles/felixfontein.acme_certificate/tasks/dns-hosttech-cleanup.yml b/roles/felixfontein.acme_certificate/tasks/dns-hosttech-cleanup.yml new file mode 100644 index 0000000..a4b6482 --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/dns-hosttech-cleanup.yml @@ -0,0 +1,19 @@ +--- +# Clean up DNS challenges for DNS provider HostTech +- name: Cleaning up challenge DNS entries for domains {{ ', '.join(acme_certificate_domains) }} via HostTech API + hosttech_dns_record: + state: absent + zone: "{{ item.key | regex_replace('^(?:.*\\.|)([^.]+\\.[^.]+)$', '\\1') }}" + record: "{{ item.key }}" + type: TXT + ttl: 300 + value: "{{ item.value }}" + overwrite: true + hosttech_username: "{{ acme_certificate_hosttech_username }}" + hosttech_password: "{{ acme_certificate_hosttech_password }}" + delegate_to: localhost + run_once: true + with_dict: "{{ acme_certificate_INTERNAL_challenge.get('challenge_data_dns', {}) }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs diff --git a/roles/felixfontein.acme_certificate/tasks/dns-hosttech-create.yml b/roles/felixfontein.acme_certificate/tasks/dns-hosttech-create.yml new file mode 100644 index 0000000..ed4accb --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/dns-hosttech-create.yml @@ -0,0 +1,23 @@ +--- +# Create DNS challenges for DNS provider HostTech +- name: Creating challenge DNS entries for domains {{ ', '.join(acme_certificate_domains) }} via HostTech API + hosttech_dns_record: + state: present + zone: "{{ item.key | regex_replace('^(?:.*\\.|)([^.]+\\.[^.]+)$', '\\1') }}" + record: "{{ item.key }}" + type: TXT + ttl: 300 + value: "{{ item.value }}" + overwrite: true + hosttech_username: "{{ acme_certificate_hosttech_username }}" + hosttech_password: "{{ acme_certificate_hosttech_password }}" + delegate_to: localhost + run_once: true + with_dict: "{{ acme_certificate_INTERNAL_challenge.challenge_data_dns }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs + +- name: Wait for DNS entries to propagate + pause: + seconds: 10 diff --git a/roles/felixfontein.acme_certificate/tasks/dns-ns1-cleanup.yml b/roles/felixfontein.acme_certificate/tasks/dns-ns1-cleanup.yml new file mode 100644 index 0000000..7a9e331 --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/dns-ns1-cleanup.yml @@ -0,0 +1,16 @@ +--- +- name: Cleaning up challenge DNS entries for domains {{ ', '.join(acme_certificate_domains) }} via NS1 API + ns1_record: + apiKey: "{{ acme_certificate_ns1_secret_key }}" + name: "{{ item.key }}" + zone: "{{ item.key | regex_replace('^(?:.*\\.|)([^.]+\\.[^.]+)$', '\\1') }}" + state: absent + type: TXT + answers: [] + delegate_to: localhost + run_once: true + when: "'_acme-challenge' in item.key" + with_dict: "{{ acme_certificate_INTERNAL_challenge.get('challenge_data_dns', {}) }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs diff --git a/roles/felixfontein.acme_certificate/tasks/dns-ns1-create.yml b/roles/felixfontein.acme_certificate/tasks/dns-ns1-create.yml new file mode 100644 index 0000000..3f4a220 --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/dns-ns1-create.yml @@ -0,0 +1,27 @@ +--- +- name: Creating challenge DNS entries for domains {{ ', '.join(acme_certificate_domains) }} via NS1 DNS + ns1_record: + apiKey: "{{ acme_certificate_ns1_secret_key }}" + name: "{{ item.key }}" + zone: "{{ item.key | regex_replace('^(?:.*\\.|)([^.]+\\.[^.]+)$', '\\1') }}" + state: present + type: TXT + answers: + - answer: + - "{{ item.value[0] }}" + meta: + up: true + delegate_to: localhost + when: "'_acme-challenge' in item.key" + run_once: true + with_dict: "{{ acme_certificate_INTERNAL_challenge.challenge_data_dns }}" + +- name: Check if DNS changes propagated at dns1.p01.nsone.net with 10-seconds intervals + command: "dig TXT {{ item.key }} +short @dns1.p01.nsone.net" + register: dig + until: "item.value[0] in dig.stdout" + with_dict: "{{ acme_certificate_INTERNAL_challenge.challenge_data_dns }}" + retries: 6 + delay: 10 + changed_when: false + ignore_errors: yes \ No newline at end of file diff --git a/roles/felixfontein.acme_certificate/tasks/dns-route53-cleanup.yml b/roles/felixfontein.acme_certificate/tasks/dns-route53-cleanup.yml new file mode 100644 index 0000000..c6dcc4a --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/dns-route53-cleanup.yml @@ -0,0 +1,19 @@ +--- +# Clean up DNS challenges for DNS provider Amazon Route53 +- name: Cleaning up challenge DNS entries for domains {{ ', '.join(acme_certificate_domains) }} via Route53 + route53: + state: absent + zone: "{{ item.key | regex_replace('^(?:.*\\.|)([^.]+\\.[^.]+)$', '\\1') }}" + record: "{{ item.key }}" + type: TXT + ttl: 60 + value: "{{ item.value | map('regex_replace', '^(.*)$', '\"\\1\"' ) | list }}" + overwrite: true + aws_access_key: "{{ acme_certificate_aws_access_key }}" + aws_secret_key: "{{ acme_certificate_aws_secret_key }}" + delegate_to: localhost + run_once: true + with_dict: "{{ acme_certificate_INTERNAL_challenge.get('challenge_data_dns', {}) }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs diff --git a/roles/felixfontein.acme_certificate/tasks/dns-route53-create.yml b/roles/felixfontein.acme_certificate/tasks/dns-route53-create.yml new file mode 100644 index 0000000..e80ce08 --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/dns-route53-create.yml @@ -0,0 +1,20 @@ +--- +# Create DNS challenges for DNS provider Amazon Route53 +- name: Creating challenge DNS entries for domains {{ ', '.join(acme_certificate_domains) }} via Route53 + route53: + state: present + zone: "{{ item.key | regex_replace('^(?:.*\\.|)([^.]+\\.[^.]+)$', '\\1') }}" + record: "{{ item.key }}" + type: TXT + ttl: 60 + value: "{{ item.value | map('regex_replace', '^(.*)$', '\"\\1\"' ) | list }}" + overwrite: true + aws_access_key: "{{ acme_certificate_aws_access_key }}" + aws_secret_key: "{{ acme_certificate_aws_secret_key }}" + wait: true + delegate_to: localhost + run_once: true + with_dict: "{{ acme_certificate_INTERNAL_challenge.challenge_data_dns }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs diff --git a/roles/felixfontein.acme_certificate/tasks/http-cleanup.yml b/roles/felixfontein.acme_certificate/tasks/http-cleanup.yml new file mode 100644 index 0000000..8243cc8 --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/http-cleanup.yml @@ -0,0 +1,15 @@ +--- +# Clean up challenge files on server. +- name: "Cleaning up challenge files for domains {{ ', '.join(acme_certificate_domains) }}" + file: + path: >- + {{ [ + acme_certificate_server_location, + item.value[acme_certificate_challenge].resource[('.well-known/acme-challenge/'|length):] + ] | path_join }}" + state: absent + with_dict: "{{ acme_certificate_INTERNAL_challenge.get('acme_certificate_challenge_data', {}) }}" + become: "{{ acme_certificate_http_become }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs diff --git a/roles/felixfontein.acme_certificate/tasks/http-create.yml b/roles/felixfontein.acme_certificate/tasks/http-create.yml new file mode 100644 index 0000000..1cdf343 --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/http-create.yml @@ -0,0 +1,31 @@ +--- +# Create up challenge files directory on server. +- name: Creating challenge destination directory + file: + dest: "{{ acme_certificate_server_location }}" + state: directory + owner: "{{ acme_certificate_http_challenge_user }}" + group: "{{ acme_certificate_http_challenge_group }}" + mode: "{{ acme_certificate_http_challenge_folder_mode }}" + become: "{{ acme_certificate_http_become }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs + +# Create challenge files on server. +- name: "Copying challenge files for domains {{ ', '.join(acme_certificate_domains) }}" + copy: + dest: >- + {{ [ + acme_certificate_server_location, + item.value[acme_certificate_challenge].resource[('.well-known/acme-challenge/'|length):] + ] | path_join }} + content: "{{ item.value[acme_certificate_challenge].resource_value }}" + owner: "{{ acme_certificate_http_challenge_user }}" + group: "{{ acme_certificate_http_challenge_group }}" + mode: "{{ acme_certificate_http_challenge_file_mode }}" + with_dict: "{{ acme_certificate_INTERNAL_challenge.challenge_data }}" + become: "{{ acme_certificate_http_become }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs diff --git a/roles/felixfontein.acme_certificate/tasks/main.yml b/roles/felixfontein.acme_certificate/tasks/main.yml new file mode 100644 index 0000000..5a5f239 --- /dev/null +++ b/roles/felixfontein.acme_certificate/tasks/main.yml @@ -0,0 +1,189 @@ +--- +- name: Determine whether to force private key regeneration (1/2) + set_fact: + acme_certificate_INTERNAL_force_regenerate_private_key: no + +- name: Determine whether to force private key regeneration (2/2) + set_fact: + acme_certificate_INTERNAL_force_regenerate_private_key: yes + tags: + - issue-tls-certs-newkey + +- block: + - name: Ansible version check + assert: + that: "ansible_version.string is version('2.8.3', '>=')" + msg: "This version of the acme-certificate role must be used with Ansible 2.8.3 or later." + run_once: yes + + - name: Sanity checks + assert: + that: "acme_certificate_challenge != 'dns-01' or acme_certificate_dns_provider is not undefined" + msg: "acme_certificate_dns_provider must be defined for dns-01 DNS challenge" + run_once: yes + + - name: "Test whether old certificate files for domains {{ ', '.join(acme_certificate_domains) }} exist" + stat: + path: "{{ [acme_certificate_keys_path, acme_certificate_key_name] | path_join }}.pem" + delegate_to: localhost + register: acme_certificate_INTERNAL_old_certificate_exists + when: "acme_certificate_keys_old_store" + run_once: yes + + - name: "Copying old certificate files for domains {{ ', '.join(acme_certificate_domains) }}" + copy: + src: "{{ [acme_certificate_keys_path, acme_certificate_key_name] | path_join }}{{ item }}" + dest: >- + {{ [ + acme_certificate_keys_old_path, + ( + (ansible_date_time.date ~ '-' ~ ansible_date_time.hour ~ ansible_date_time.minute ~ ansible_date_time.second ~ '-') + if acme_certificate_keys_old_prepend_timestamp else '' + ) ~ acme_certificate_key_name ~ item + ] | path_join }} + delegate_to: localhost + with_items: + - "-chain.pem" + - "-fullchain.pem" + - "-rootchain.pem" + - "-root.pem" + - ".key" + - ".pem" + when: "acme_certificate_keys_old_store and acme_certificate_INTERNAL_old_certificate_exists.stat.exists" + run_once: yes + + tags: + - issue-tls-certs-newkey + - issue-tls-certs + +- block: + - name: "Creating private key for domains {{ ', '.join(acme_certificate_domains) }} (RSA)" + openssl_privatekey: + path: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.key'] | path_join }}" + mode: "{{ acme_certificate_privatekey_mode }}" + type: "{{ 'RSA' if acme_certificate_algorithm == 'rsa' else 'ECC' }}" + size: "{{ acme_certificate_key_length if acme_certificate_algorithm == 'rsa' else omit }}" + curve: >- + {{ omit if acme_certificate_algorithm == 'rsa' else + 'secp256r1' if acme_certificate_algorithm == 'p-256' else + 'secp384r1' if acme_certificate_algorithm == 'p-384' else + 'secp521r1' if acme_certificate_algorithm == 'p-521' else + 'invalid value for acme_certificate_algorithm!' }} + force: "{{ acme_certificate_INTERNAL_force_regenerate_private_key }}" + delegate_to: localhost + run_once: yes + + - name: "Creating CSR for domains {{ ', '.join(acme_certificate_domains) }}" + openssl_csr: + path: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.csr'] | path_join }}" + privatekey_path: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.key'] | path_join }}" + subject_alt_name: | + {{ acme_certificate_domains | map('regex_replace', '^(.*)$', 'DNS:\1' ) | list }} + ocsp_must_staple: "{{ acme_certificate_ocsp_must_staple }}" + use_common_name_for_san: no + force: yes + delegate_to: localhost + run_once: yes + + - name: "Get root certificate for domains {{ ', '.join(acme_certificate_domains) }}" + get_url: + url: "{{ acme_certificate_root_certificate }}" + dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-root.pem'] | path_join }}" + force: yes + validate_certs: "{{ acme_certificate_validate_certs }}" + delegate_to: localhost + run_once: yes + + - block: + - name: "Preparing challenges for domains {{ ', '.join(acme_certificate_domains) }}" + acme_certificate: + account_key: "{{ acme_certificate_acme_account }}" + modify_account: "{{ acme_certificate_modify_account }}" + csr: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.csr'] | path_join }}" + dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.pem'] | path_join }}" + fullchain_dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-fullchain.pem'] | path_join }}" + chain_dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-chain.pem'] | path_join }}" + account_email: "{{ acme_certificate_acme_email }}" + terms_agreed: "{{ acme_certificate_terms_agreed }}" + challenge: "{{ acme_certificate_challenge }}" + acme_directory: "{{ acme_certificate_acme_directory }}" + acme_version: "{{ acme_certificate_acme_version }}" + force: yes + validate_certs: "{{ acme_certificate_validate_certs }}" + delegate_to: localhost + run_once: yes + register: acme_certificate_INTERNAL_challenge + + always: + - debug: + msg: >- + account URI: {{ acme_certificate_INTERNAL_challenge.get('account_uri') }}; + order URI: {{ acme_certificate_INTERNAL_challenge.get('order_uri') }} + run_once: yes + + - block: + # Set up HTTP challenges + - include_tasks: http-create.yml + when: "acme_certificate_challenge == 'http-01'" + + # Set up DNS challenges + - include_tasks: dns-{{ acme_certificate_dns_provider }}-create.yml + when: "acme_certificate_challenge == 'dns-01'" + + - name: "Getting certificates for domains {{ ', '.join(acme_certificate_domains) }}" + acme_certificate: + account_key: "{{ acme_certificate_acme_account }}" + modify_account: "{{ acme_certificate_modify_account }}" + csr: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.csr'] | path_join }}" + dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.pem'] | path_join }}" + fullchain_dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-fullchain.pem'] | path_join }}" + chain_dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-chain.pem'] | path_join }}" + account_email: "{{ acme_certificate_acme_email }}" + terms_agreed: "{{ acme_certificate_terms_agreed }}" + challenge: "{{ acme_certificate_challenge }}" + acme_directory: "{{ acme_certificate_acme_directory }}" + acme_version: "{{ acme_certificate_acme_version }}" + force: yes + data: "{{ acme_certificate_INTERNAL_challenge }}" + deactivate_authzs: "{{ acme_certificate_deactivate_authzs }}" + validate_certs: "{{ acme_certificate_validate_certs }}" + delegate_to: localhost + run_once: yes + + - name: "Form root chain for domains {{ ', '.join(acme_certificate_domains) }}" + copy: + dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-rootchain.pem'] | path_join }}" + content: | + {{ lookup('file', [acme_certificate_keys_path, acme_certificate_key_name ~ '-root.pem'] | path_join) }} + {{ lookup('file', [acme_certificate_keys_path, acme_certificate_key_name ~ '-chain.pem'] | path_join) }} + delegate_to: localhost + run_once: yes + always: + # Clean up HTTP challenges + - include_tasks: http-cleanup.yml + when: "acme_certificate_challenge == 'http-01'" + + # Clean up DNS challenges + - include_tasks: dns-{{ acme_certificate_dns_provider }}-cleanup.yml + when: "acme_certificate_challenge == 'dns-01'" + + when: acme_certificate_INTERNAL_challenge is changed + + tags: + - issue-tls-certs-newkey + - issue-tls-certs + +- name: "Verifying certificate for domains {{ ', '.join(acme_certificate_domains) }}" + command: >- + openssl verify + -CAfile "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-root.pem'] | path_join }}" + -untrusted "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-chain.pem'] | path_join }}" + "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.pem'] | path_join }}" + changed_when: no + delegate_to: localhost + run_once: yes + ignore_errors: "{{ not acme_certificate_verify_certs }}" + tags: + - issue-tls-certs-newkey + - issue-tls-certs + - verify-tls-certs diff --git a/roles/geerlingguy.gitlab/.ansible-lint b/roles/geerlingguy.gitlab/.ansible-lint new file mode 100644 index 0000000..4464759 --- /dev/null +++ b/roles/geerlingguy.gitlab/.ansible-lint @@ -0,0 +1,4 @@ +skip_list: + - 'yaml' + - 'role-name' + - 'package-latest' diff --git a/roles/geerlingguy.gitlab/.github/workflows/ci.yml b/roles/geerlingguy.gitlab/.github/workflows/ci.yml new file mode 100644 index 0000000..f4f3d3d --- /dev/null +++ b/roles/geerlingguy.gitlab/.github/workflows/ci.yml @@ -0,0 +1,75 @@ +--- +name: CI +'on': + pull_request: + push: + branches: + - master + schedule: + - cron: "0 7 * * 1" + +defaults: + run: + working-directory: 'geerlingguy.gitlab' + +jobs: + + lint: + name: Lint + runs-on: ubuntu-latest + steps: + - name: Check out the codebase. + uses: actions/checkout@v2 + with: + path: 'geerlingguy.gitlab' + + - name: Set up Python 3. + uses: actions/setup-python@v2 + with: + python-version: '3.x' + + - name: Install test dependencies. + run: pip3 install yamllint + + - name: Lint code. + run: | + yamllint . + + molecule: + name: Molecule + runs-on: ubuntu-latest + strategy: + matrix: + include: + - distro: centos7 + playbook: converge.yml + - distro: ubuntu1804 + playbook: converge.yml + - distro: debian9 + playbook: converge.yml + - distro: centos7 + playbook: version.yml + - distro: ubuntu1804 + playbook: version.yml + + steps: + - name: Check out the codebase. + uses: actions/checkout@v2 + with: + path: 'geerlingguy.gitlab' + + - name: Set up Python 3. + uses: actions/setup-python@v2 + with: + python-version: '3.x' + + - name: Install test dependencies. + run: pip3 install ansible molecule[docker] docker + + - name: Run Molecule tests. + run: molecule test + env: + PY_COLORS: '1' + ANSIBLE_FORCE_COLOR: '1' + MOLECULE_DISTRO: ${{ matrix.distro }} + MOLECULE_PLAYBOOK: ${{ matrix.playbook }} diff --git a/roles/geerlingguy.gitlab/.github/workflows/release.yml b/roles/geerlingguy.gitlab/.github/workflows/release.yml new file mode 100644 index 0000000..b7821d0 --- /dev/null +++ b/roles/geerlingguy.gitlab/.github/workflows/release.yml @@ -0,0 +1,38 @@ +--- +# This workflow requires a GALAXY_API_KEY secret present in the GitHub +# repository or organization. +# +# See: https://github.com/marketplace/actions/publish-ansible-role-to-galaxy +# See: https://github.com/ansible/galaxy/issues/46 + +name: Release +'on': + push: + tags: + - '*' + +defaults: + run: + working-directory: 'geerlingguy.gitlab' + +jobs: + + release: + name: Release + runs-on: ubuntu-latest + steps: + - name: Check out the codebase. + uses: actions/checkout@v2 + with: + path: 'geerlingguy.gitlab' + + - name: Set up Python 3. + uses: actions/setup-python@v2 + with: + python-version: '3.x' + + - name: Install Ansible. + run: pip3 install ansible-base + + - name: Trigger a new import on Galaxy. + run: ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }} $(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2) diff --git a/roles/geerlingguy.gitlab/meta/.galaxy_install_info b/roles/geerlingguy.gitlab/meta/.galaxy_install_info index 60757b7..91903f9 100644 --- a/roles/geerlingguy.gitlab/meta/.galaxy_install_info +++ b/roles/geerlingguy.gitlab/meta/.galaxy_install_info @@ -1,2 +1,2 @@ -install_date: Tue Apr 20 16:13:49 2021 +install_date: Wed Apr 21 16:48:33 2021 version: 3.1.0 diff --git a/roles/geerlingguy.gitlab/molecule/default/version.yml b/roles/geerlingguy.gitlab/molecule/default/version.yml new file mode 100644 index 0000000..f7060c9 --- /dev/null +++ b/roles/geerlingguy.gitlab/molecule/default/version.yml @@ -0,0 +1,31 @@ +--- +- name: Converge + hosts: all + become: true + + vars: + gitlab_restart_handler_failed_when: false + + pre_tasks: + - name: Update apt cache. + apt: update_cache=true cache_valid_time=600 + when: ansible_os_family == 'Debian' + changed_when: false + + - name: Remove the .dockerenv file so GitLab Omnibus doesn't get confused. + file: + path: /.dockerenv + state: absent + + - name: Set the test GitLab version number for Debian. + set_fact: + gitlab_version: '11.4.0-ce.0' + when: ansible_os_family == 'Debian' + + - name: Set the test GitLab version number for RedHat. + set_fact: + gitlab_version: '11.4.0-ce.0.el7' + when: ansible_os_family == 'RedHat' + + roles: + - role: geerlingguy.gitlab diff --git a/roles/geerlingguy.java/meta/.galaxy_install_info b/roles/geerlingguy.java/meta/.galaxy_install_info index 577b71d..68b1ad4 100644 --- a/roles/geerlingguy.java/meta/.galaxy_install_info +++ b/roles/geerlingguy.java/meta/.galaxy_install_info @@ -1,2 +1,2 @@ -install_date: Tue Apr 20 16:13:48 2021 +install_date: Wed Apr 21 16:48:32 2021 version: 1.10.0 diff --git a/roles/ikke_t.container_image_cleanup/meta/.galaxy_install_info b/roles/ikke_t.container_image_cleanup/meta/.galaxy_install_info index 37bdedc..e1f6f66 100644 --- a/roles/ikke_t.container_image_cleanup/meta/.galaxy_install_info +++ b/roles/ikke_t.container_image_cleanup/meta/.galaxy_install_info @@ -1,2 +1,2 @@ -install_date: Tue Apr 20 16:13:55 2021 +install_date: Wed Apr 21 16:48:44 2021 version: master diff --git a/roles/ikke_t.podman_container_systemd/.yamllint.yml b/roles/ikke_t.podman_container_systemd/.yamllint.yml new file mode 100644 index 0000000..de4c63a --- /dev/null +++ b/roles/ikke_t.podman_container_systemd/.yamllint.yml @@ -0,0 +1,12 @@ +--- + +extends: default + +rules: + # 80 chars should be enough, but don't fail if a line is longer + line-length: + max: 80 + level: warning + indentation: + spaces: 2 + indent-sequences: whatever diff --git a/roles/ikke_t.podman_container_systemd/meta/.galaxy_install_info b/roles/ikke_t.podman_container_systemd/meta/.galaxy_install_info index 61ca4ff..80608be 100644 --- a/roles/ikke_t.podman_container_systemd/meta/.galaxy_install_info +++ b/roles/ikke_t.podman_container_systemd/meta/.galaxy_install_info @@ -1,2 +1,2 @@ -install_date: Tue Apr 20 16:13:54 2021 +install_date: Wed Apr 21 16:48:42 2021 version: 2.1.0 diff --git a/roles/ikke_t.podman_container_systemd/requirements.yml b/roles/ikke_t.podman_container_systemd/requirements.yml new file mode 100644 index 0000000..68b4a8e --- /dev/null +++ b/roles/ikke_t.podman_container_systemd/requirements.yml @@ -0,0 +1,3 @@ +--- +collections: + - containers.podman diff --git a/roles/ikke_t.podman_container_systemd/tasks/check_subid.yml b/roles/ikke_t.podman_container_systemd/tasks/check_subid.yml new file mode 100644 index 0000000..d9bcd63 --- /dev/null +++ b/roles/ikke_t.podman_container_systemd/tasks/check_subid.yml @@ -0,0 +1,37 @@ +--- + +- name: check if user is in subuid file + find: + path: /etc/subuid + contains: '^{{ container_run_as_user }}:.*$' + register: uid_line_found + when: container_run_as_user != 'root' + +- name: check if group is in subgid file + find: + path: /etc/subgid + contains: '^{{ container_run_as_group }}:.*$' + register: gid_line_found + when: container_run_as_group != 'root' + +- name: ensure user is in subuid file, if it was missing + lineinfile: + path: /etc/subuid + regexp: "^{{ container_run_as_user }}:.*" + line: "{{ container_run_as_user }}:165536:65536" + create: true + mode: '0644' + owner: root + group: root + when: container_run_as_user != 'root' and not uid_line_found.matched + +- name: ensure group is in subgid file, if it was missing + lineinfile: + path: /etc/subgid + regexp: "^{{ container_run_as_group }}:.*" + line: "{{ container_run_as_group }}:165536:65536" + create: true + mode: '0644' + owner: root + group: root + when: container_run_as_group != 'root' and not gid_line_found.matched diff --git a/roles/linux-system-roles.network/.ansible-lint b/roles/linux-system-roles.network/.ansible-lint new file mode 100644 index 0000000..86012b1 --- /dev/null +++ b/roles/linux-system-roles.network/.ansible-lint @@ -0,0 +1,12 @@ +--- +skip_list: +- '106' # Role name does not match ^[a-z][a-z0-9_]+$ pattern +- '206' # Variables should have spaces before and after: {{ var_name }} +- '208' # File permissions unset or incorrect +- '301' # Commands should not change things if nothing needs doing +- '303' # Using command rather than module +- '305' # Use shell only when shell functionality is required +- '403' # Package installs should not use latest +- '502' # All tasks should be named +- '601' # Don't compare to literal True/False +- '602' # Don't compare to empty string diff --git a/roles/linux-system-roles.network/.github/stale.yml b/roles/linux-system-roles.network/.github/stale.yml new file mode 100644 index 0000000..bfb82b2 --- /dev/null +++ b/roles/linux-system-roles.network/.github/stale.yml @@ -0,0 +1,12 @@ +--- +# Configuration for probot-stale - https://github.com/probot/stale +daysUntilStale: 30 +daysUntilClose: 14 +staleLabel: stale +markComment: > + Thank you for your contribution! There was no activity in this pull request + recently. To avoid pull requests to pile up, an automated process marked this + pull request as stale. It will close this pull request if no further activity + occurs. The current policy is available at: + https://github.com//linux-system-roles/network/blob/main/.github/stale.yml +only: pulls diff --git a/roles/linux-system-roles.network/.github/workflows/markdownlint.yml b/roles/linux-system-roles.network/.github/workflows/markdownlint.yml new file mode 100644 index 0000000..dce6140 --- /dev/null +++ b/roles/linux-system-roles.network/.github/workflows/markdownlint.yml @@ -0,0 +1,11 @@ +--- +name: markdownlint +on: [push, pull_request] +jobs: + markdownlint: + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@main + - name: Run mdl + uses: actionshub/markdownlint@main diff --git a/roles/linux-system-roles.network/.github/workflows/tox.yml b/roles/linux-system-roles.network/.github/workflows/tox.yml new file mode 100644 index 0000000..c7add26 --- /dev/null +++ b/roles/linux-system-roles.network/.github/workflows/tox.yml @@ -0,0 +1,51 @@ +# yamllint disable rule:line-length +name: tox +on: # yamllint disable-line rule:truthy + - pull_request +env: + TOX_LSR: "git+https://github.com/linux-system-roles/tox-lsr@2.4.0" + LSR_ANSIBLE_TEST_DOCKER: "true" + LSR_ANSIBLES: 'ansible==2.8.* ansible==2.9.*' + LSR_MSCENARIOS: default + # LSR_EXTRA_PACKAGES: "libdbus-1-dev libgirepository1.0-dev python3-dev" + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} +jobs: + python: + runs-on: ubuntu-latest + strategy: + matrix: + pyver: ['2.7', '3.6', '3.7', '3.8'] + steps: + - name: checkout PR + uses: actions/checkout@v2 + - name: Set up Python + uses: actions/setup-python@v2 + with: + python-version: ${{ matrix.pyver }} + - name: Install platform dependencies, python, tox, tox-lsr + run: | + set -euxo pipefail + python -m pip install --upgrade pip + sudo apt-get update + sudo apt-get install git + pip install "$TOX_LSR" + lsr_ci_preinstall + - name: Run tox tests + run: | + set -euxo pipefail + toxpyver=$(echo "${{ matrix.pyver }}" | tr -d .) + toxenvs="py${toxpyver}" + case "$toxpyver" in + 27) toxenvs="${toxenvs},coveralls,flake8,pylint" ;; + 36) toxenvs="${toxenvs},coveralls,black,yamllint,ansible-lint,collection" ;; + 37) toxenvs="${toxenvs},coveralls" ;; + 38) toxenvs="${toxenvs},coveralls" ;; + esac + TOXENV="$toxenvs" lsr_ci_runtox + python-26: + runs-on: ubuntu-latest + steps: + - name: checkout PR + uses: actions/checkout@v2 + - name: Run py26 tests + uses: linux-system-roles/lsr-gh-action-py26@1.0.1 diff --git a/roles/linux-system-roles.network/.lgtm.yml b/roles/linux-system-roles.network/.lgtm.yml new file mode 100644 index 0000000..da28dfc --- /dev/null +++ b/roles/linux-system-roles.network/.lgtm.yml @@ -0,0 +1,5 @@ +--- +extraction: + python: + python_setup: + version: 2 diff --git a/roles/linux-system-roles.network/.mdl_style.rb b/roles/linux-system-roles.network/.mdl_style.rb new file mode 100644 index 0000000..3f44d3c --- /dev/null +++ b/roles/linux-system-roles.network/.mdl_style.rb @@ -0,0 +1,9 @@ +all +# https://github.com/markdownlint/markdownlint/blob/master/docs/RULES.md#md003---header-style +rule 'MD003', :style => :setext_with_atx +# https://github.com/markdownlint/markdownlint/blob/master/docs/RULES.md#md013---line-length +rule 'MD013', :line_length => 88 +# https://github.com/markdownlint/markdownlint/blob/master/docs/RULES.md#md029---ordered-list-item-prefix +rule 'MD029', :style => :ordered +# https://github.com/markdownlint/markdownlint/blob/master/docs/RULES.md#md024---multiple-headers-with-the-same-content +rule "MD024", :allow_different_nesting => true diff --git a/roles/linux-system-roles.network/.mdlrc b/roles/linux-system-roles.network/.mdlrc new file mode 100644 index 0000000..1f82ca2 --- /dev/null +++ b/roles/linux-system-roles.network/.mdlrc @@ -0,0 +1 @@ +style '.mdl_style.rb' diff --git a/roles/linux-system-roles.network/.travis/custom.sh b/roles/linux-system-roles.network/.travis/custom.sh new file mode 100755 index 0000000..a929d2a --- /dev/null +++ b/roles/linux-system-roles.network/.travis/custom.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# SPDX-License-Identifier: MIT + +set -e + +. "$LSR_SCRIPTDIR/utils.sh" + +# Write your custom commands here that should be run when `tox -e custom`: +if lsr_check_python_version python -eq '3.6'; then + (set -x; cd "${TOPDIR}/tests"; python ./ensure_provider_tests.py) +fi diff --git a/roles/linux-system-roles.network/.yamllint.yml b/roles/linux-system-roles.network/.yamllint.yml new file mode 100644 index 0000000..e50c134 --- /dev/null +++ b/roles/linux-system-roles.network/.yamllint.yml @@ -0,0 +1,23 @@ +# SPDX-License-Identifier: MIT +--- +extends: yamllint_defaults.yml +# possible customizations over the base yamllint config +# skip the yaml files in the /tests/ directory +# NOTE: If you want to customize `ignore` you'll have to +# copy in all of the config from .yamllint.yml, then +# add your own - so if you want to just add /tests/ to +# be ignored, you'll have to add the ignores from the base +# ignore: | +# /tests/ +# /.tox/ +# skip checking line length +# NOTE: the above does not apply to `rules` - you do not +# have to copy all of the rules from the base config +# rules: +# line-length: disable +rules: + truthy: disable + line-length: + ignore: | + /tests/tests_wireless_plugin_installation_nm.yml + /tests/tests_team_plugin_installation_nm.yml diff --git a/roles/linux-system-roles.network/CHANGELOG.md b/roles/linux-system-roles.network/CHANGELOG.md new file mode 100644 index 0000000..109910c --- /dev/null +++ b/roles/linux-system-roles.network/CHANGELOG.md @@ -0,0 +1,49 @@ +Changelog +========= + +[1.3.0] - 2021-04-08 +-------------------- + +### Changes + +- Use inclusive language + - `slave` is deprecated in favor of `port` + - `master` is deprecated in favor of `controller` + +### New features + +- Support disabling IPv6 +- Support `dns_options` when using one or more IPv4 nameservers +- Support Ethtool coalesce settings +- Support dummy interfaces + +### Bug fixes + +- Fix static IPv6 support for initscripts provider + +[1.2.0] - 2020-08-26 +-------------------- + +### Changes + +- Rename ethtool features to use underscores instead of dashes to support + Jinja2 dot notation. Accept old notation for compatibility with existing + playbooks. + +### New features + +- Initial 802.1x authentication support (only EAP-TLS) +- Wireless support +- Handle OracleLinux as a RHEL clone +- Remove dependency on ethtool command line tool +- initscripts: Support creating and activating bond profiles in one run +- Ignore up/down states if a profile is not defined and not present on the + managed host +- Document bond profiles + +### Bug fixes + +- NetworkManager: Always rollback checkpoint on failure +- NetworkManager: Try to reapply changes to reduce network interruptions +- initscripts: Fix dependencies for Fedora 32 +- Only log actual warnings as Ansible warnings diff --git a/roles/linux-system-roles.network/ansible_pytest_extra_requirements.txt b/roles/linux-system-roles.network/ansible_pytest_extra_requirements.txt new file mode 100644 index 0000000..0d79ed5 --- /dev/null +++ b/roles/linux-system-roles.network/ansible_pytest_extra_requirements.txt @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: MIT + +# ansible and dependencies for all supported platforms +ansible ; python_version > "2.6" +ansible<2.7 ; python_version < "2.7" +idna<2.8 ; python_version < "2.7" +PyYAML<5.1 ; python_version < "2.7" diff --git a/roles/linux-system-roles.network/contributing.md b/roles/linux-system-roles.network/contributing.md new file mode 100644 index 0000000..9c3a885 --- /dev/null +++ b/roles/linux-system-roles.network/contributing.md @@ -0,0 +1,409 @@ +Contributing to the Network Linux System Role +============================================= + +Where to start +-------------- + +- **Bugs and needed implementations** are listed on [Github + Issues](https://github.com/linux-system-roles/network/issues). Issues labeled with +[**help +wanted**](https://github.com/linux-system-roles/network/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22) +are likely to be suitable for new contributors! + +- **Code** is managed on + [Github](https://github.com/linux-system-roles/network), using [Pull +Requests](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests). + +- The code needs to be **compatible with Python 2.6, 2.7, 3.6, 3.7 and 3.8**. + +Code structure +-------------- + +The repository is structured as follows: + +- `./defaults/` - Contains the default role configuration. + +- `./examples/` - Contains YAML examples for different configurations. + +- `./library/network_connections.py` - Contains the internal Ansible module, which is + the main script. It controls the communication between the role and Ansible, imports + the YAML configuration and applies the changes to the provider (i.e. NetworkManager, + initscripts). + +- `./meta/` - Metadata of the project. + +- `./module_utils/network_lsr/` - Contains other files that are useful for the network + role (e.g. the YAML argument validator) + +- `./tasks/` - Declaration of the different tasks that the role is going to execute. + +- `./tests/playbooks/` - Contains the complete tests for the role. `./tests/test_*.yml` + are shims to run tests once for every provider. `./tests/tasks/` contains task + snippets that are used in multiple tests to avoid having the same code repeated + multiple times. + +The rest of files in the root folder mostly serve as configuration files for diferent +testing tools and bots that help with the manteinance of the project. + +The code files will always have the imports on the first place, followed by constants +and in the last place, classes and methods. The style of python coding for this project +is [**PEP 8**](https://www.python.org/dev/peps/pep-0008/), with automatic formatting +thanks to [Python Black](https://black.readthedocs.io/en/stable/). Make sure to install +the formatter, it will help you a lot throughout the whole coding process! + +Configuring Git +--------------- + +Before starting to contribute, make sure you have the basic git configuration: Your name +and email. This will be useful when signing your contributions. The following commands +will set your global name and email, althought you can change it later for every repo: + +```bash +git config --global user.name "Jane Doe" +git config --global user.email janedoe@example.com +``` + +The git editor is your system's default. If you feel more comfortable with a different +editor for writing your commits (such as Vim), change it with: + +```bash +git config --global core.editor vim +``` + +If you want to check your settings, use `git config --list` to see all the settings Git +can find. + +How to contribute +----------------- + +1. Make a + [fork](https://help.github.com/en/github/getting-started-with-github/fork-a-repo) +of this repository. + +2. Create a new git branch on your local fork (the name is not relevant) and make the + changes you need to complete an issue. + +3. Do not forget to run unit and integration tests before pushing any changes! + 1. This project uses [tox](https://tox.readthedocs.io/en/latest/) to run unit tests. + You can try it with `tox -e py36` in case you want to try it using Python 3.6, or + just `tox` if you want to run all the tests. + + 2. Check the formatting of the code with + [Python Black](https://black.readthedocs.io/en/stable/) + + 3. Check the YAML files are correctly formatted using `tox -e yamllint`. + + 4. Integration tests are executed as + [Ansible Playbooks](https://docs.ansible.com/ansible/latest/user_guide/playbooks.html). + + To run them you can use a cloud image like the [CentOS Linux 8.1 + VM](https://cloud.centos.org/centos/8/x86_64/images/CentOS-8-GenericCloud-8.1.1911-20200113.3.x86_64.qcow2) + and execute the command and download the package + `standard-test-roles-inventory-qemu` from the Fedora repository: + + ```bash + dnf install standard-test-roles-inventory-qemu + ``` + + Note that the last path is the one of the test you want to run: + + ```bash + TEST_SUBJECTS=CentOS-8-GenericCloud-8.1.1911-20200113.3.x86_64.qcow2 \ + ansible-playbook -v -i /usr/share/ansible/inventory/standard-inventory-qcow2 \ + tests/test_default.yml + ``` + + 5. Check the markdown format with + [mdl](https://github.com/markdownlint/markdownlint) after changing any + markdown document. + +4. Once the work is ready and commited, push the branch to your remote fork and click on + "new Pull Request" on Github. + +5. All set! Now wait for the continuous integration to pass and go over your commit if + there are any errors. If there is no problem with your contribution, the mantainer + will merge it to the main project. + +### Find other images for testing + +The CentOS project publishes cloud images for +[CentOS Linux 6](https://cloud.centos.org/centos/6/images/), +[CentOS Linux 7](https://cloud.centos.org/centos/7/images/) and +[CentOS Linux 8](https://cloud.centos.org/centos/8/x86_64/images/). + +- For qemu testing cases, we prefer the image architecture to be `x86_64-GenericCloud`. +- `2003` in `CentOS-7-x86_64-GenericCloud-2003.qcow2c` stands for image released in + March 2020. +- We can use the image with extension `.qcow2` and `.qcow2c`. +- To save the image, right click on the link above, then select "Save link as...". + +For Fedora, we recommend to use the [latest qcow2 +images](https://kojipkgs.fedoraproject.org/compose/cloud/). + +### Some important tips + +- Make sure your fork and branch are up-to-date with the main project. First of all, + [configure a remote upstream for your +fork](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/configuring-a-remote-for-a-fork), +and keep your branch up-to-date with the upstream using +`git pull --rebase upstream main`. + +- Try to make a commit per issue. + +- If you are asked to make changes to your PR, don't panic! Many times it is enough to + amend your previous commit adding the new content to it (`git commit --amend`). Be +sure to pull the latest upstream changes after that, and use `git push +--force-with-lease` to re-upload your commit with the changes! Another way of doing +changes to a PR is by [squashing +commits](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-request-merges#squash-and-merge-your-pull-request-commits). + +- There are times when someone has made changes on a file you were modifying while you + were making changes to your unfinished commit. At times like this, you need to make a +[**rebase**](https://help.github.com/en/github/using-git/about-git-rebase) with +conflicts. On the rebase you have to compare what the other person added to what you +added, and merge both file versions into one that combines it all. + +- If you have any doubt, do not hesitate to ask! You can join IRC channel \#systemroles + on freenode, or ask on the PR/issue itself. + +### Naming Ansible Items + +- All YAML or Python files, variables, arguments, repositories, and other such names + should follow standard Python naming conventions of being in + `snake_case_naming_schemes`. + +- Names should be mnemonic and descriptive and not strive to shorten more than + necessary. Systems support long identifier names, so use them to be descriptive + +- All defaults and all arguments to a role should have a name that begins with the role + name to help avoid collision with other names. Avoid names like `packages` in favor of + a name like `network_packages`. + +- Same argument applies for modules provided in the roles, they also need a `$ROLENAME_` + prefix: `network_module`. While they are usually implementation details and not intended + for direct use in playbooks, the unfortunate fact is that importing a role makes them + available to the rest of the playbook and therefore creates opportunities for name + collisions. + +- Moreover, internal variables (those that are not expected to be set by users) are to + be prefixed by two underscores: `__network_variable`. This includes variables set by + `set_fact` and `register`, because they persist in the namespace after the role has + finished! + +- Do not use special characters other than underscore in variable names, even if + YAML/JSON allow them. (Using such variables in Jinja2 or Python would be then very + confusing and probably not functional.) + +*Find more explanation on this matter in the [meta +standards](https://github.com/oasis-roles/meta_standards#naming-things).* + +### Write a good commit message + +Here are a few rules to keep in mind while writing a commit message + +1. Separate subject from body with a blank line +2. Limit the subject line to 50 characters +3. Capitalize the subject line +4. Do not end the subject line with a period +5. Use the imperative mood in the subject line +6. Wrap the body at 72 characters +7. Use the body to explain what and why vs. how + + A good commit message looks something like this: + +```text + Summarize changes in around 50 characters or less + + More detailed explanatory text, if necessary. Wrap it to about 72 + characters or so. In some contexts, the first line is treated as the + subject of the commit and the rest of the text as the body. The + blank line separating the summary from the body is critical (unless + you omit the body entirely); various tools like `log`, `shortlog` + and `rebase` can get confused if you run the two together. + + Explain the problem that this commit is solving. Focus on why you + are making this change as opposed to how (the code explains that). + Are there side effects or other unintuitive consequences of this + change? Here's the place to explain them. + + Further paragraphs come after blank lines. + + - Bullet points are okay, too + + - Typically a hyphen or asterisk is used for the bullet, preceded + by a single space, with blank lines in between, but conventions + vary here + + If you use an issue tracker, put references to them at the bottom, + like this: + + Resolves: #123 + See also: #456, #789 + +Do not forget to sign your commit! Use `git commit -s` +``` + +This is taken from [chris beams git commit](https://chris.beams.io/posts/git-commit/). +You may want to read this for a more detailed explanation (and links to other posts on +how to write a good commit message). This content is licensed under +[CC-BY-SA](https://creativecommons.org/licenses/by-sa/4.0/). + +### Sign off your commit + +You need to sign off your commit. By adding your 'Signed-off-by' line to the commit +messages you adhere to the +[Developer Certificate of Origin (DCO)](https://developercertificate.org/). + +Use the `-s` command-line option to append the `Signed-off-by` line when committing your +code: + +`$ git commit -s` + +This is the full text of the Developer Certificate of Origin: + +```text +Developer Certificate of Origin +Version 1.1 + +Copyright (C) 2004, 2006 The Linux Foundation and its contributors. +1 Letterman Drive +Suite D4700 +San Francisco, CA, 94129 + +Everyone is permitted to copy and distribute verbatim copies of this +license document, but changing it is not allowed. + + +Developer's Certificate of Origin 1.1 + +By making a contribution to this project, I certify that: + +(a) The contribution was created in whole or in part by me and I + have the right to submit it under the open source license + indicated in the file; or + +(b) The contribution is based upon previous work that, to the best + of my knowledge, is covered under an appropriate open source + license and I have the right under that license to submit that + work with modifications, whether created in whole or in part + by me, under the same open source license (unless I am + permitted to submit under a different license), as indicated + in the file; or + +(c) The contribution was provided directly to me by some other + person who certified (a), (b) or (c) and I have not modified + it. + +(d) I understand and agree that this project and the contribution + are public and that a record of the contribution (including all + personal information I submit with it, including my sign-off) is + maintained indefinitely and may be redistributed consistent with + this project or the open source license(s) involved. +``` + +### Debugging + +When using the `nm` provider, NetworkManager create a checkpoint and reverts the changes +on failures. This makes it hard to debug the error. To disable this, set the Ansible +variable `__network_debug_flags` to include the value `disable-checkpoints`. Also tests +clean up by default in case there are failures. They should be tagged as +`tests::cleanup` and can be skipped. To use both, run the test playbooks like this: + +```bash +ansible-playbook --skip-tags tests::cleanup \ + -e "__network_debug_flags=disable-checkpoints" \ + -i testhost, tests/playbooks/tests_802_1x.yml +``` + +### NetworkManager Documentation + +- [NM 1.0](https://lazka.github.io/pgi-docs/#NM-1.0), it contains a full explanation + about the NetworkManager API. + +### Integration tests with podman + +1. Create `~/.ansible/collections/ansible_collections/containers/podman/` if this + directory does not exist and `cd` into this directory. + + ```bash + mkdir -p ~/.ansible/collections/ansible_collections/containers/podman/ + cd ~/.ansible/collections/ansible_collections/containers/podman/ + ``` + +2. Clone the collection plugins for Ansible-Podman into the current directory. + + ```bash + git clone https://github.com/containers/ansible-podman-collections.git . + ``` + +3. Change directory into the `tests` subdirectory. + + ```bash + cd ~/network/tests + ``` + +4. Use podman with `-d` to run in the background (daemon). Use `c7` because + `centos/systemd` is centos7. + + ```bash + podman run --name lsr-ci-c7 --rm --privileged -v /sys/fs/cgroup:/sys/fs/cgroup:ro \ + -d registry.centos.org/centos/systemd + ``` + +5. Use `podman unshare` first to run "podman mount" in root mode, use `-vi` to run + ansible as inventory in verbose mode, use `-c podman` to use collection plugins. Note, + the following tests are currently not working with podman: + - `tests_802_1x_nm.yml` + - `tests_802_1x_updated_nm.yml` + - `tests_bond_initscripts.yml` + - `tests_bond_nm.yml` + - `tests_bridge_initscripts.yml` + - `tests_bridge_nm.yml` + - `tests_default_nm.yml` + - `tests_ethernet_nm.yml` + - `tests_reapply_nm.yml` + - `tests_states_nm.yml` + - `tests_vlan_mtu_initscripts.yml` + - `tests_vlan_mtu_nm.yml` + - `tests_wireless_nm.yml` + + ```bash + podman unshare + ansible-playbook -vi lsr-ci-c7, -c podman tests_provider_nm.yml + ``` + +6. NOTE that this leaves the container running in the background, to kill it: + + ```bash + podman stop lsr-ci-c7 + podman rm lsr-ci-c7 + ``` + +### Continuous integration + +The [continuous integration](https://en.wikipedia.org/wiki/Continuous_integration) (CI) +contains a set of automated tests that are triggered on a remote server. Some of them +are immediately triggered when pushing new content to a PR (i.e. the tests hosted on +TravisCI) while other need to be triggered by members of the project. This second +set of tests can be manually triggered. To trigger them, write a command as a PR +comment. The available commands are: + +- [citest] - Trigger a re-test for all machines. +- [citest bad] - Trigger a re-test for all machines with an error or failure status. +- [citest pending] - Trigger a re-test for all machines with a pending status. +- [citest commit:] - Whitelist a commit to be tested if the submitter is not + trusted. + +How to reach us +--------------- + +The mailing list for developers: systemroles@lists.fedorahosted.org + +[Subscribe to the mailing list](https://lists.fedorahosted.org/admin/lists/systemroles.lists.fedorahosted.org/) + +[Archive of the mailing list](https://lists.fedorahosted.org/archives/list/systemroles@lists.fedorahosted.org/) + +If you are using IRC, join the `#systemroles` IRC channel on +[freenode](https://freenode.net/kb/answer/chat) + +*Thanks for contributing and happy coding!!* diff --git a/roles/linux-system-roles.network/custom_requirements.txt b/roles/linux-system-roles.network/custom_requirements.txt new file mode 100644 index 0000000..e52eadf --- /dev/null +++ b/roles/linux-system-roles.network/custom_requirements.txt @@ -0,0 +1,4 @@ +# SPDX-License-Identifier: MIT + +# Write requirements for running your custom commands in tox here: +PyYAML; python_version == '2.7' or python_version >= '3.5' diff --git a/roles/linux-system-roles.network/examples/bond_simple.yml b/roles/linux-system-roles.network/examples/bond_simple.yml new file mode 100644 index 0000000..f9db265 --- /dev/null +++ b/roles/linux-system-roles.network/examples/bond_simple.yml @@ -0,0 +1,36 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: network-test + vars: + network_connections: + # Specify the bond profile + - name: bond0 + state: up + type: bond + interface_name: bond0 + # ip configuration (optional) + ip: + address: + - "192.0.2.24/24" + - "2001:db8::23/64" + # bond configuration settings: (optional) + bond: + mode: active-backup + miimon: 110 + + # add an ethernet profile to the bond + - name: member1 + state: up + type: ethernet + interface_name: eth1 + controller: bond0 + + # add a second ethernet profile to the bond + - name: member2 + state: up + type: ethernet + interface_name: eth2 + controller: bond0 + roles: + - linux-system-roles.network +... diff --git a/roles/linux-system-roles.network/examples/bond_with_vlan.yml b/roles/linux-system-roles.network/examples/bond_with_vlan.yml new file mode 100644 index 0000000..3e2b1a1 --- /dev/null +++ b/roles/linux-system-roles.network/examples/bond_with_vlan.yml @@ -0,0 +1,38 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: network-test + vars: + network_connections: + + # Create a bond profile, which is the parent of VLAN. + - name: prod2 + state: up + type: bond + interface_name: bond2 + ip: + dhcp4: no + auto6: no + bond: + mode: active-backup + miimon: 110 + + # set an ethernet as port to the bond + - name: prod2-port1 + state: up + type: ethernet + interface_name: "{{ network_interface_name2 }}" + controller: prod2 + + # on top of it, create a VLAN with ID 100 and static + # addressing + - name: prod2.100 + state: up + type: vlan + parent: prod2 + vlan_id: 100 + ip: + address: + - "192.0.2.{{ network_iphost }}/24" + + roles: + - linux-system-roles.network diff --git a/roles/linux-system-roles.network/examples/bridge_with_vlan.yml b/roles/linux-system-roles.network/examples/bridge_with_vlan.yml new file mode 100644 index 0000000..ebc7c4b --- /dev/null +++ b/roles/linux-system-roles.network/examples/bridge_with_vlan.yml @@ -0,0 +1,36 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: network-test + vars: + network_connections: + + # Create a bridge profile, which is the parent of VLAN. + - name: prod2 + state: up + type: bridge + interface_name: bridge2 + ip: + dhcp4: no + auto6: no + + # set an ethernet port to the bridge + - name: prod2-port1 + state: up + type: ethernet + interface_name: "{{ network_interface_name2 }}" + controller: prod2 + port_type: bridge + + # on top of it, create a VLAN with ID 100 and static + # addressing + - name: prod2.100 + state: up + type: vlan + parent: prod2 + vlan_id: 100 + ip: + address: + - "192.0.2.{{ network_iphost }}/24" + + roles: + - linux-system-roles.network diff --git a/roles/linux-system-roles.network/examples/down_profile.yml b/roles/linux-system-roles.network/examples/down_profile.yml new file mode 120000 index 0000000..fe44746 --- /dev/null +++ b/roles/linux-system-roles.network/examples/down_profile.yml @@ -0,0 +1 @@ +../tests/playbooks/down_profile.yml \ No newline at end of file diff --git a/roles/linux-system-roles.network/examples/dummy_simple.yml b/roles/linux-system-roles.network/examples/dummy_simple.yml new file mode 100644 index 0000000..db2266a --- /dev/null +++ b/roles/linux-system-roles.network/examples/dummy_simple.yml @@ -0,0 +1,17 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + network_connections: + # Specify the dummy profile + - name: dummy0 + state: up + type: dummy + interface_name: dummy0 + ip: + address: + - "192.0.2.42/30" + + roles: + - linux-system-roles.network +... diff --git a/roles/linux-system-roles.network/examples/eth_dns_support.yml b/roles/linux-system-roles.network/examples/eth_dns_support.yml new file mode 100644 index 0000000..43c3c2e --- /dev/null +++ b/roles/linux-system-roles.network/examples/eth_dns_support.yml @@ -0,0 +1,44 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + network_connections: + - name: eth0 + type: ethernet + ip: + route_metric4: 100 + dhcp4: no + gateway4: 192.0.2.1 + dns: + - 192.0.2.2 + - 198.51.100.5 + dns_search: + - example.com + - subdomain.example.com + dns_options: + - rotate + - timeout:1 + + route_metric6: -1 + auto6: no + gateway6: 2001:db8::1 + + address: + - 192.0.2.3/24 + - 198.51.100.3/26 + - 2001:db8::80/7 + + route: + - network: 198.51.100.128 + prefix: 26 + gateway: 198.51.100.1 + metric: 2 + - network: 198.51.100.64 + prefix: 26 + gateway: 198.51.100.6 + metric: 4 + route_append_only: no + rule_append_only: yes + roles: + - linux-system-roles.network +... diff --git a/roles/linux-system-roles.network/examples/eth_simple_auto.yml b/roles/linux-system-roles.network/examples/eth_simple_auto.yml new file mode 100644 index 0000000..0ba168a --- /dev/null +++ b/roles/linux-system-roles.network/examples/eth_simple_auto.yml @@ -0,0 +1,18 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: network-test + vars: + network_connections: + + # Create one ethernet profile and activate it. + # The profile uses automatic IP addressing + # and is tied to the interface by MAC address. + - name: prod1 + state: up + type: ethernet + autoconnect: yes + mac: "{{ network_mac1 }}" + mtu: 1450 + + roles: + - linux-system-roles.network diff --git a/roles/linux-system-roles.network/examples/eth_with_802_1x.yml b/roles/linux-system-roles.network/examples/eth_with_802_1x.yml new file mode 100644 index 0000000..92a93a9 --- /dev/null +++ b/roles/linux-system-roles.network/examples/eth_with_802_1x.yml @@ -0,0 +1,30 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: network-test + vars: + network_connections: + - name: eth0 + type: ethernet + ieee802_1x: + identity: myhost + eap: tls + private_key: /etc/pki/tls/client.key + # recommend vault encrypting the private key password + # see https://docs.ansible.com/ansible/latest/user_guide/vault.html + private_key_password: "p@55w0rD" + client_cert: /etc/pki/tls/client.pem + ca_cert: /etc/pki/tls/cacert.pem + domain_suffix_match: example.com + + # certs have to be deployed first + pre_tasks: + - name: copy certs/keys for 802.1x auth + copy: + src: "{{ item }}" + dest: "/etc/pki/tls/{{ item }}" + with_items: + - client.key + - client.pem + - cacert.pem + roles: + - linux-system-roles.network diff --git a/roles/linux-system-roles.network/examples/eth_with_vlan.yml b/roles/linux-system-roles.network/examples/eth_with_vlan.yml new file mode 100644 index 0000000..69da673 --- /dev/null +++ b/roles/linux-system-roles.network/examples/eth_with_vlan.yml @@ -0,0 +1,29 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: network-test + vars: + network_connections: + + # Create a profile for the underlying device of the VLAN. + - name: prod2 + type: ethernet + autoconnect: no + state: up + interface_name: "{{ network_interface_name2 }}" + ip: + dhcp4: no + auto6: no + + # on top of it, create a VLAN with ID 100 and static + # addressing + - name: prod2.100 + state: up + type: vlan + parent: prod2 + vlan_id: 100 + ip: + address: + - "192.0.2.{{ network_iphost }}/24" + + roles: + - linux-system-roles.network diff --git a/roles/linux-system-roles.network/examples/ethtool_coalesce.yml b/roles/linux-system-roles.network/examples/ethtool_coalesce.yml new file mode 100644 index 0000000..d0e8948 --- /dev/null +++ b/roles/linux-system-roles.network/examples/ethtool_coalesce.yml @@ -0,0 +1,38 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + tasks: + - include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ network_interface_name1 }}" + state: up + type: ethernet + ip: + dhcp4: no + auto6: no + ethtool: + coalesce: + adaptive_rx: yes + adaptive_tx: no + pkt_rate_high: 128 + pkt_rate_low: 128 + rx_frames: 128 + rx_frames_high: 128 + rx_frames_irq: 128 + rx_frames_low: 128 + rx_usecs: 128 + rx_usecs_high: 128 + rx_usecs_irq: 128 + rx_usecs_low: 128 + sample_interval: 128 + stats_block_usecs: 128 + tx_frames: 128 + tx_frames_high: 128 + tx_frames_irq: 128 + tx_frames_low: 128 + tx_usecs: 128 + tx_usecs_high: 128 + tx_usecs_irq: 128 + tx_usecs_low: 128 diff --git a/roles/linux-system-roles.network/examples/ethtool_features.yml b/roles/linux-system-roles.network/examples/ethtool_features.yml new file mode 100644 index 0000000..c580f89 --- /dev/null +++ b/roles/linux-system-roles.network/examples/ethtool_features.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + tasks: + - include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ network_interface_name1 }}" + state: up + type: ethernet + ip: + dhcp4: "no" + auto6: "no" + ethtool: + features: + gro: "no" + gso: "yes" + tx_sctp_segmentation: "no" diff --git a/roles/linux-system-roles.network/examples/ethtool_features_default.yml b/roles/linux-system-roles.network/examples/ethtool_features_default.yml new file mode 100644 index 0000000..78965e6 --- /dev/null +++ b/roles/linux-system-roles.network/examples/ethtool_features_default.yml @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + tasks: + - include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ network_interface_name1 }}" + state: up + type: ethernet + ip: + dhcp4: "no" + auto6: "no" diff --git a/roles/linux-system-roles.network/examples/ipv6_disabled.yml b/roles/linux-system-roles.network/examples/ipv6_disabled.yml new file mode 100644 index 0000000..dc29e78 --- /dev/null +++ b/roles/linux-system-roles.network/examples/ipv6_disabled.yml @@ -0,0 +1,12 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + network_connections: + - name: eth0 + type: ethernet + ip: + ipv6_disabled: true + roles: + - linux-system-roles.network +... diff --git a/roles/linux-system-roles.network/examples/remove+down_profile.yml b/roles/linux-system-roles.network/examples/remove+down_profile.yml new file mode 100644 index 0000000..da2b1b8 --- /dev/null +++ b/roles/linux-system-roles.network/examples/remove+down_profile.yml @@ -0,0 +1,12 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Set {{ profile }} down + hosts: all + vars: + network_connections: + - name: "{{ profile }}" + persistent_state: absent + state: down + roles: + - linux-system-roles.network +... diff --git a/roles/linux-system-roles.network/examples/remove_profile.yml b/roles/linux-system-roles.network/examples/remove_profile.yml new file mode 120000 index 0000000..d9959bc --- /dev/null +++ b/roles/linux-system-roles.network/examples/remove_profile.yml @@ -0,0 +1 @@ +../tests/playbooks/remove_profile.yml \ No newline at end of file diff --git a/roles/linux-system-roles.network/examples/team_simple.yml b/roles/linux-system-roles.network/examples/team_simple.yml new file mode 100644 index 0000000..99c5a38 --- /dev/null +++ b/roles/linux-system-roles.network/examples/team_simple.yml @@ -0,0 +1,33 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: network-test + vars: + network_connections: + # Specify the team profile + - name: team0 + state: up + type: team + interface_name: team0 + # ip configuration (optional) + ip: + address: + - "192.0.2.24/24" + - "2001:db8::23/64" + + # add an team profile to the team + - name: member1 + state: up + type: ethernet + interface_name: eth1 + controller: team0 + + # add a second team profile to the team + - name: member2 + state: up + type: ethernet + interface_name: eth2 + controller: team0 + + roles: + - linux-system-roles.network +... diff --git a/roles/linux-system-roles.network/examples/wireless_wpa_psk.yml b/roles/linux-system-roles.network/examples/wireless_wpa_psk.yml new file mode 100644 index 0000000..eeec22f --- /dev/null +++ b/roles/linux-system-roles.network/examples/wireless_wpa_psk.yml @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: network-test + vars: + network_connections: + - name: wlan0 + type: wireless + wireless: + ssid: "My WPA2-PSK Network" + key_mgmt: "wpa-psk" + # recommend vault encrypting the wireless password + # see https://docs.ansible.com/ansible/latest/user_guide/vault.html + password: "p@55w0rD" + roles: + - linux-system-roles.network diff --git a/roles/linux-system-roles.network/library/__init__.py b/roles/linux-system-roles.network/library/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/roles/linux-system-roles.network/meta/.galaxy_install_info b/roles/linux-system-roles.network/meta/.galaxy_install_info index 6f4ec76..ea24d3a 100644 --- a/roles/linux-system-roles.network/meta/.galaxy_install_info +++ b/roles/linux-system-roles.network/meta/.galaxy_install_info @@ -1,2 +1,2 @@ -install_date: Tue Apr 20 16:13:56 2021 +install_date: Wed Apr 21 16:48:45 2021 version: 1.3.0 diff --git a/roles/linux-system-roles.network/module_utils/__init__.py b/roles/linux-system-roles.network/module_utils/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/roles/linux-system-roles.network/module_utils/network_lsr/ethtool.py b/roles/linux-system-roles.network/module_utils/network_lsr/ethtool.py new file mode 100644 index 0000000..21e2152 --- /dev/null +++ b/roles/linux-system-roles.network/module_utils/network_lsr/ethtool.py @@ -0,0 +1,56 @@ +# SPDX-License-Identifier: BSD-3-Clause + +import array +import struct +import fcntl +import socket + +from .utils import Util + +ETHTOOL_GPERMADDR = 0x00000020 +SIOCETHTOOL = 0x8946 +MAX_ADDR_LEN = 32 +IFNAMESIZ = 16 + + +def get_perm_addr(ifname): + """ + Return the Permanent address value for the specified interface using the + ETHTOOL_GPERMADDR ioctl command. + + Please for further documentation, see: + https://github.com/torvalds/linux/blob/master/include/uapi/linux/ethtool.h#L734 + https://github.com/torvalds/linux/blob/master/include/uapi/linux/ethtool.h#L1388 + https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/tree/ethtool.c#n4172 + """ + try: + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sockfd = sock.fileno() + ifname = ifname.encode("utf-8") + if len(ifname) > IFNAMESIZ: + return None + + ecmd = array.array( + "B", + struct.pack( + "II%is" % MAX_ADDR_LEN, + ETHTOOL_GPERMADDR, + MAX_ADDR_LEN, + b"\x00" * MAX_ADDR_LEN, + ), + ) + ifreq = struct.pack("%isP" % IFNAMESIZ, ifname, ecmd.buffer_info()[0]) + + fcntl.ioctl(sockfd, SIOCETHTOOL, ifreq) + try: + res = ecmd.tobytes() + except AttributeError: # tobytes() is not available in python2 + res = ecmd.tostring() + _, size, perm_addr = struct.unpack("II%is" % MAX_ADDR_LEN, res) + perm_addr = Util.mac_ntoa(perm_addr[:size]) + except IOError: + perm_addr = None + finally: + sock.close() + + return perm_addr diff --git a/roles/linux-system-roles.network/module_utils/network_lsr/nm/__init__.py b/roles/linux-system-roles.network/module_utils/network_lsr/nm/__init__.py new file mode 100644 index 0000000..58fbb5a --- /dev/null +++ b/roles/linux-system-roles.network/module_utils/network_lsr/nm/__init__.py @@ -0,0 +1,7 @@ +# Relative import is not support by ansible 2.8 yet +# pylint: disable=import-error, no-name-in-module +from ansible.module_utils.network_lsr.nm import provider # noqa:E501 + +# pylint: enable=import-error, no-name-in-module + +provider.NetworkManagerProvider diff --git a/roles/linux-system-roles.network/module_utils/network_lsr/nm/active_connection.py b/roles/linux-system-roles.network/module_utils/network_lsr/nm/active_connection.py new file mode 100644 index 0000000..a6c5a37 --- /dev/null +++ b/roles/linux-system-roles.network/module_utils/network_lsr/nm/active_connection.py @@ -0,0 +1,128 @@ +# SPDX-License-Identifier: BSD-3-Clause + +# Handle NM.ActiveConnection + +import logging + +# Relative import is not support by ansible 2.8 yet +# pylint: disable=import-error, no-name-in-module +from ansible.module_utils.network_lsr.nm import client # noqa:E501 +from ansible.module_utils.network_lsr.nm import error # noqa:E501 + +# pylint: enable=import-error, no-name-in-module + + +NM_AC_STATE_CHANGED_SIGNAL = "state-changed" + + +def deactivate_active_connection(nm_ac, timeout, check_mode): + if not nm_ac or nm_ac.props.state == client.NM.ActiveConnectionState.DEACTIVATED: + logging.info("Connection is not active, no need to deactivate") + return False + if not check_mode: + main_loop = client.get_mainloop(timeout) + logging.debug( + "Deactivating {id} with timeout {timeout}".format( + id=nm_ac.get_id(), timeout=timeout + ) + ) + user_data = main_loop + handler_id = nm_ac.connect( + NM_AC_STATE_CHANGED_SIGNAL, _nm_ac_state_change_callback, user_data + ) + logging.debug( + "Registered {signal} on client.NM.ActiveConnection {id}".format( + signal=NM_AC_STATE_CHANGED_SIGNAL, id=nm_ac.get_id() + ) + ) + if nm_ac.props.state != client.NM.ActiveConnectionState.DEACTIVATING: + nm_client = client.get_client() + user_data = (main_loop, nm_ac, nm_ac.get_id(), handler_id) + nm_client.deactivate_connection_async( + nm_ac, + main_loop.cancellable, + _nm_ac_deactivate_call_back, + user_data, + ) + logging.debug( + "Deactivating client.NM.ActiveConnection {0}".format(nm_ac.get_id()) + ) + main_loop.run() + return True + + +def _nm_ac_state_change_callback(nm_ac, state, reason, user_data): + main_loop = user_data + if main_loop.is_cancelled: + return + logging.debug( + "Got client.NM.ActiveConnection state change: {id}: {state} {reason}".format( + id=nm_ac.get_id(), state=state, reason=reason + ) + ) + if nm_ac.props.state == client.NM.ActiveConnectionState.DEACTIVATED: + logging.debug( + "client.NM.ActiveConnection {0} is deactivated".format(nm_ac.get_id()) + ) + main_loop.quit() + + +def _nm_ac_deactivate_call_back(nm_client, result, user_data): + main_loop, nm_ac, nm_ac_id, handler_id = user_data + logging.debug("client.NM.ActiveConnection deactivating callback") + if main_loop.is_cancelled: + if nm_ac: + nm_ac.handler_disconnect(handler_id) + return + + try: + success = nm_client.deactivate_connection_finish(result) + except client.GLib.Error as e: + if e.matches( + client.NM.ManagerError.quark(), client.NM.ManagerError.CONNECTIONNOTACTIVE + ): + logging.info( + "Connection is not active on {0}, no need to deactivate".format( + nm_ac_id + ) + ) + if nm_ac: + nm_ac.handler_disconnect(handler_id) + main_loop.quit() + return + else: + _deactivate_fail( + main_loop, + handler_id, + nm_ac, + "Failed to deactivate connection {id}, error={error}".format( + id=nm_ac_id, error=e + ), + ) + return + except Exception as e: + _deactivate_fail( + main_loop, + handler_id, + nm_ac, + "Failed to deactivate connection {id}, error={error}".format( + id=nm_ac_id, error=e + ), + ) + return + + if not success: + _deactivate_fail( + main_loop, + handler_id, + nm_ac, + "Failed to deactivate connection {0}, error='None " + "returned from deactivate_connection_finish()'".format(nm_ac_id), + ) + + +def _deactivate_fail(main_loop, handler_id, nm_ac, msg): + if nm_ac: + nm_ac.handler_disconnect(handler_id) + logging.error(msg) + main_loop.fail(error.LsrNetworkNmError(msg)) diff --git a/roles/linux-system-roles.network/module_utils/network_lsr/nm/client.py b/roles/linux-system-roles.network/module_utils/network_lsr/nm/client.py new file mode 100644 index 0000000..4992887 --- /dev/null +++ b/roles/linux-system-roles.network/module_utils/network_lsr/nm/client.py @@ -0,0 +1,96 @@ +# SPDX-License-Identifier: BSD-3-Clause + +import logging + +# Relative import is not support by ansible 2.8 yet +# pylint: disable=import-error, no-name-in-module +from ansible.module_utils.network_lsr.nm import error # noqa:E501 + +import gi + +try: + gi.require_version("NM", "1.0") + + # It is required to state the NM version before importing it + # But this break the flake8 rule: https://www.flake8rules.com/rules/E402.html + # Use NOQA: E402 to suppress it. + from gi.repository import NM # NOQA: E402 + from gi.repository import GLib # NOQA: E402 + from gi.repository import Gio # NOQA: E402 + + # pylint: enable=import-error, no-name-in-module + + NM + GLib + Gio +except ValueError: + # This is to workaround a bug in ansible 2.9 which causes + # this code to be executed on the control node, where NM + # is not guaranteed to exist. On the other hand, it is + # ensured on the managed nodes as NM package is installed + # in the network role. Therefore, this exception handling + # does not affect the network installation and configuration + # on the managed nodes. + pass + + +def get_client(): + return NM.Client.new() + + +class _NmMainLoop(object): + def __init__(self, timeout): + self._mainloop = GLib.MainLoop() + self._cancellable = Gio.Cancellable.new() + self._timeout = timeout + self._timeout_id = None + + def run(self): + logging.debug("NM mainloop running") + user_data = None + self._timeout_id = GLib.timeout_add( + int(self._timeout * 1000), + self._timeout_call_back, + user_data, + ) + logging.debug("Added timeout checker") + self._mainloop.run() + + def _timeout_call_back(self, _user_data): + logging.error("Timeout") + self.fail(error.LsrNetworkNmError("Timeout")) + + @property + def cancellable(self): + return self._cancellable + + @property + def is_cancelled(self): + if self._cancellable: + return self._cancellable.is_cancelled() + return True + + def _clean_up(self): + logging.debug("NM mainloop cleaning up") + if self._timeout_id: + logging.debug("Removing timeout checker") + GLib.source_remove(self._timeout_id) + self._timeout_id = None + if self._cancellable: + logging.debug("Canceling all pending tasks") + self._cancellable.cancel() + self._cancellable = None + self._mainloop = None + + def quit(self): + logging.debug("NM mainloop quiting") + self._mainloop.quit() + self._clean_up() + + def fail(self, exception): + self.quit() + raise exception + + +def get_mainloop(timeout): + return _NmMainLoop(timeout) diff --git a/roles/linux-system-roles.network/module_utils/network_lsr/nm/connection.py b/roles/linux-system-roles.network/module_utils/network_lsr/nm/connection.py new file mode 100644 index 0000000..6982034 --- /dev/null +++ b/roles/linux-system-roles.network/module_utils/network_lsr/nm/connection.py @@ -0,0 +1,113 @@ +# SPDX-License-Identifier: BSD-3-Clause + +# Handle NM.RemoteConnection + +import logging + +# Relative import is not support by ansible 2.8 yet +# pylint: disable=import-error, no-name-in-module +from ansible.module_utils.network_lsr.nm import client # noqa:E501 +from ansible.module_utils.network_lsr.nm import error # noqa:E501 + +# pylint: enable=import-error, no-name-in-module + + +def delete_remote_connection(nm_profile, timeout, check_mode): + if not nm_profile: + logging.info("NULL NM.RemoteConnection, no need to delete") + return False + + if not check_mode: + main_loop = client.get_mainloop(timeout) + user_data = main_loop + nm_profile.delete_async( + main_loop.cancellable, + _nm_profile_delete_call_back, + user_data, + ) + logging.debug( + "Deleting profile {id}/{uuid} with timeout {timeout}".format( + id=nm_profile.get_id(), uuid=nm_profile.get_uuid(), timeout=timeout + ) + ) + main_loop.run() + return True + + +def _nm_profile_delete_call_back(nm_profile, result, user_data): + main_loop = user_data + if main_loop.is_cancelled: + return + + try: + success = nm_profile.delete_finish(result) + except Exception as e: + main_loop.fail( + error.LsrNetworkNmError( + "Connection deletion aborted on {id}/{uuid}: error={error}".format( + id=nm_profile.get_id(), uuid=nm_profile.get_uuid(), error=e + ) + ) + ) + if success: + main_loop.quit() + else: + main_loop.fail( + error.LsrNetworkNmError( + "Connection deletion aborted on {id}/{uuid}: error=unknown".format( + id=nm_profile.get_id(), uuid=nm_profile.get_uuid() + ) + ) + ) + + +def volatilize_remote_connection(nm_profile, timeout, check_mode): + if not nm_profile: + logging.info("NULL NM.RemoteConnection, no need to volatilize") + return False + if not check_mode: + main_loop = client.get_mainloop(timeout) + user_data = main_loop + nm_profile.update2( + None, # settings + client.NM.SettingsUpdate2Flags.IN_MEMORY_ONLY + | client.NM.SettingsUpdate2Flags.VOLATILE, + None, # args + main_loop.cancellable, + _nm_profile_volatile_update2_call_back, + user_data, + ) + logging.debug( + "Volatilizing profile {id}/{uuid} with timeout {timeout}".format( + id=nm_profile.get_id(), uuid=nm_profile.get_uuid(), timeout=timeout + ) + ) + main_loop.run() + return True + + +def _nm_profile_volatile_update2_call_back(nm_profile, result, user_data): + main_loop = user_data + if main_loop.is_cancelled: + return + + try: + success = nm_profile.update2_finish(result) + except Exception as e: + main_loop.fail( + error.LsrNetworkNmError( + "Connection volatilize aborted on {id}/{uuid}: error={error}".format( + id=nm_profile.get_id(), uuid=nm_profile.get_uuid(), error=e + ) + ) + ) + if success: + main_loop.quit() + else: + main_loop.fail( + error.LsrNetworkNmError( + "Connection volatilize aborted on {id}/{uuid}: error=unknown".format( + id=nm_profile.get_id(), uuid=nm_profile.get_uuid() + ) + ) + ) diff --git a/roles/linux-system-roles.network/module_utils/network_lsr/nm/error.py b/roles/linux-system-roles.network/module_utils/network_lsr/nm/error.py new file mode 100644 index 0000000..42014ec --- /dev/null +++ b/roles/linux-system-roles.network/module_utils/network_lsr/nm/error.py @@ -0,0 +1,5 @@ +# SPDX-License-Identifier: BSD-3-Clause + + +class LsrNetworkNmError(Exception): + pass diff --git a/roles/linux-system-roles.network/module_utils/network_lsr/nm/provider.py b/roles/linux-system-roles.network/module_utils/network_lsr/nm/provider.py new file mode 100644 index 0000000..52e7502 --- /dev/null +++ b/roles/linux-system-roles.network/module_utils/network_lsr/nm/provider.py @@ -0,0 +1,58 @@ +# SPDX-License-Identifier: BSD-3-Clause + +import logging + +# Relative import is not support by ansible 2.8 yet +# pylint: disable=import-error, no-name-in-module +from ansible.module_utils.network_lsr.nm import active_connection # noqa:E501 +from ansible.module_utils.network_lsr.nm import client # noqa:E501 +from ansible.module_utils.network_lsr.nm import connection # noqa:E501 + +# pylint: enable=import-error, no-name-in-module + + +class NetworkManagerProvider: + def deactivate_connection(self, connection_name, timeout, check_mode): + """ + Return True if changed. + """ + nm_client = client.get_client() + changed = False + for nm_ac in nm_client.get_active_connections(): + nm_profile = nm_ac.get_connection() + if nm_profile and nm_profile.get_id() == connection_name: + changed |= active_connection.deactivate_active_connection( + nm_ac, timeout, check_mode + ) + if not changed: + logging.info("No active connection for {0}".format(connection_name)) + + return changed + + def volatilize_connection_by_uuid(self, uuid, timeout, check_mode): + """ + Mark NM.RemoteConnection as volatile(delete on deactivation) via Update2, + if not supported, delete the profile. + + Return True if changed. + """ + nm_client = client.get_client() + changed = False + for nm_profile in nm_client.get_connections(): + if nm_profile and nm_profile.get_uuid() == uuid: + if hasattr(nm_profile, "update2"): + changed |= connection.volatilize_remote_connection( + nm_profile, timeout, check_mode + ) + else: + changed |= connection.delete_remote_connection( + nm_profile, timeout, check_mode + ) + if not changed: + logging.info("No connection with UUID {0} to volatilize".format(uuid)) + + return changed + + def get_connections(self): + nm_client = client.get_client() + return nm_client.get_connections() diff --git a/roles/linux-system-roles.network/molecule_extra_requirements.txt b/roles/linux-system-roles.network/molecule_extra_requirements.txt new file mode 100644 index 0000000..5ff4857 --- /dev/null +++ b/roles/linux-system-roles.network/molecule_extra_requirements.txt @@ -0,0 +1,3 @@ +# SPDX-License-Identifier: MIT + +# Write extra requirements for running molecule here: diff --git a/roles/linux-system-roles.network/pylint_extra_requirements.txt b/roles/linux-system-roles.network/pylint_extra_requirements.txt new file mode 100644 index 0000000..796e4d0 --- /dev/null +++ b/roles/linux-system-roles.network/pylint_extra_requirements.txt @@ -0,0 +1,5 @@ +# SPDX-License-Identifier: MIT + +# Write extra requirements for running pylint here: +mock +pytest diff --git a/roles/linux-system-roles.network/pytest_extra_requirements.txt b/roles/linux-system-roles.network/pytest_extra_requirements.txt new file mode 100644 index 0000000..9e2d328 --- /dev/null +++ b/roles/linux-system-roles.network/pytest_extra_requirements.txt @@ -0,0 +1,12 @@ +# SPDX-License-Identifier: MIT + +# Write extra requirements for running pytest here: +# If you need ansible then uncomment the following line: +#-ransible_pytest_extra_requirements.txt +# If you need mock then uncomment the following line: +mock ; python_version < "3.0" +# ansible and dependencies for all supported platforms +ansible ; python_version > "2.6" +ansible<2.7 ; python_version < "2.7" +idna<2.8 ; python_version < "2.7" +PyYAML<5.1 ; python_version < "2.7" diff --git a/roles/linux-system-roles.network/scripts/print_all_options.py b/roles/linux-system-roles.network/scripts/print_all_options.py new file mode 100755 index 0000000..b414fe8 --- /dev/null +++ b/roles/linux-system-roles.network/scripts/print_all_options.py @@ -0,0 +1,184 @@ +#!/usr/bin/python3 -tt +# SPDX-License-Identifier: BSD-3-Clause +# Helper to print all options that the module in the network role accepts for +# profiles + +from collections.abc import Mapping +from collections.abc import Sequence +from copy import deepcopy +from unittest import mock +import os +import sys + +PRIORITIES = ( + "name", + "type", + "interface_name", + "mac", + "state", + "persistent_state", + "controller", + "port_type", + "parent", + "ignore_errors", + "force_state_change", + "check_iface_exists", + "autoconnect", + "wait", + "zone", + "mtu", + "ip", + "ethernet", + "ethtool", + "bridge", + "bond", + "team", + "vlan", + "wireless", + "macvlan", + "infiniband", +) + + +import yaml + +parentdir = os.path.normpath(os.path.join(os.path.dirname(__file__), "..")) + +with mock.patch.object( + sys, + "path", + [parentdir, os.path.join(parentdir, "module_utils/network_lsr")] + sys.path, +): + with mock.patch.dict( + "sys.modules", + {"ansible": mock.Mock(), "ansible.module_utils": __import__("module_utils")}, + ): + import argument_validator as av + +COMMENT = "@@" +EMPTY = "/EMPTY/" + + +def parse_validator(validator): + default = validator.default_value + if isinstance(validator, av.ArgValidatorDict): + res = {} + for k, v in validator.nested.items(): + if ( + v.name + not in ( + "infiniband_transport_mode", + "infiniband_p_key", + "vlan_id", + ) + and not isinstance(v, av.ArgValidatorDeprecated) + ): + name = k + if not validator.required: + pass + # name += " DICT optional" + res[name] = parse_validator(v) + elif isinstance(validator, av.ArgValidatorList): + res = [parse_validator(validator.nested)] + elif isinstance(validator, av.ArgValidatorNum): + + minval = validator.val_min + maxval = validator.val_max + comment = f" {COMMENT}" + if not validator.required: + comment += " optional" + if minval is not None: + comment += " mininum=" + str(minval) + if maxval: + if maxval == 0xFFFFFFFF: + maxval = hex(maxval) + comment += " maximum=" + str(maxval) + + if default is not None: + res = str(default) + elif minval is not None: + res = str(minval) + elif maxval is not None: + res = str(maxval) + else: + res = "" + + res += comment + elif isinstance(validator, av.ArgValidatorIP): + res = f"{EMPTY} {COMMENT} IP Address" + elif isinstance(validator, av.ArgValidatorStr): + if default: + res = default + elif validator.enum_values: + res = "|".join(validator.enum_values) + else: + res = EMPTY + if not validator.required: + res += f" {COMMENT} optional" + + # res += " " + str(validator.__class__) + elif isinstance(validator, av.ArgValidatorBool): + if default is not None: + res = "yes" if default else "no" + else: + res = "yes|no" + + if not validator.required: + res += f" {COMMENT} optional" + else: + res = validator.name + f" {COMMENT} FIXME " + str(validator.__class__) + + return res + + +def represent_dict(dumper, data): + """ + Represent dictionary with insert order + """ + value = [] + + for item_key, item_value in data.items(): + node_key = dumper.represent_data(item_key) + node_value = dumper.represent_data(item_value) + value.append((node_key, node_value)) + + return yaml.nodes.MappingNode("tag:yaml.org,2002:map", value) + + +def priority_sorted(data): + if isinstance(data, Sequence) and not isinstance(data, str): + return [priority_sorted(item) for item in data] + + if isinstance(data, Mapping): + sorted_data = {} + for key in sorted(data, key=prioritize): + sorted_data[key] = priority_sorted(data[key]) + return sorted_data + + return deepcopy(data) + + +def prioritize(key): + try: + priority = PRIORITIES.index(key) + except ValueError: + priority = len(PRIORITIES) + return (priority, key) + + +yaml.add_representer(dict, represent_dict) +sorted_data = priority_sorted([parse_validator(av.ArgValidator_DictConnection())]) +yaml_example = ( + yaml.dump( + sorted_data, + explicit_start=True, + default_flow_style=False, + width=100, + ) + .replace(COMMENT, "#") + .replace(EMPTY, "") +) + +# yaml_example = re.sub(r"# ([^:]*):", r": # \1", yaml_example) + +print(yaml_example) diff --git a/roles/linux-system-roles.network/tests/ensure_provider_tests.py b/roles/linux-system-roles.network/tests/ensure_provider_tests.py new file mode 100755 index 0000000..078e99d --- /dev/null +++ b/roles/linux-system-roles.network/tests/ensure_provider_tests.py @@ -0,0 +1,227 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: BSD-3-Clause +""" Check that there is a playbook to run all role tests with both providers +""" +# vim: fileencoding=utf8 + +import glob +import os +import sys + + +GET_NM_VERSION = """ + - block: + - name: Install NetworkManager + package: + name: NetworkManager + state: present + - name: Get NetworkManager version + command: rpm -q --qf "%{version}" NetworkManager + args: + warn: false + register: NetworkManager_version + when: true + when: + - ansible_distribution_major_version != '6' + tags: + - always +""" + +MINIMUM_NM_VERSION_CHECK = """ + - NetworkManager_version.stdout is version({minimum_nm_version}, '>=') +""" + +EXTRA_RUN_CONDITION_PREFIX = " - " + +RUN_PLAYBOOK_WITH_NM = """# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook '{test_playbook}' with nm as provider + tasks: + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always +{get_nm_version} + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: {test_playbook} + when: + - ansible_distribution_major_version != '6' +{minimum_nm_version_check}{extra_run_condition}""" + +MINIMUM_VERSION = "minimum_version" +EXTRA_RUN_CONDITION = "extra_run_condition" +NM_ONLY_TESTS = { + "playbooks/tests_802_1x_updated.yml": {}, + "playbooks/tests_802_1x.yml": {}, + "playbooks/tests_eth_dns_support.yml": {}, + "playbooks/tests_dummy.yml": {}, + "playbooks/tests_ethtool_features.yml": { + MINIMUM_VERSION: "'1.20.0'", + "comment": "# NetworkManager 1.20.0 introduced ethtool settings support", + }, + "playbooks/tests_ipv6_disabled.yml": { + EXTRA_RUN_CONDITION: "ansible_distribution_major_version == '8'", + }, + "playbooks/tests_provider.yml": { + MINIMUM_VERSION: "'1.20.0'", + "comment": "# NetworKmanager 1.20.0 added support for forgetting profiles", + }, + "playbooks/tests_ethtool_coalesce.yml": { + MINIMUM_VERSION: "'1.25.1'", + "comment": "# NetworkManager 1.25.1 introduced ethtool coalesce support", + }, + "playbooks/tests_802_1x_updated.yml": {}, + "playbooks/tests_802_1x.yml": {}, + "playbooks/tests_reapply.yml": {}, + # team interface is not supported on Fedora + "playbooks/tests_team.yml": { + EXTRA_RUN_CONDITION: "ansible_distribution != 'Fedora'", + }, + "playbooks/tests_team_plugin_installation.yml": {}, + # mac80211_hwsim (used for tests_wireless) only seems to be available + # and working on RHEL/CentOS 7 + "playbooks/tests_wireless.yml": { + EXTRA_RUN_CONDITION: "ansible_distribution_major_version == '7'", + }, + "playbooks/tests_wireless_plugin_installation.yml": {}, +} + +IGNORE = [ + # checked by tests_regression_nm.yml + "playbooks/tests_checkpoint_cleanup.yml", +] + +RUN_PLAYBOOK_WITH_INITSCRIPTS = """# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +- hosts: all + name: Run playbook '{test_playbook}' with initscripts as provider + tasks: + - name: Set network provider to 'initscripts' + set_fact: + network_provider: initscripts + tags: + - always + +- import_playbook: {test_playbook} +""" + + +def create_nm_playbook(test_playbook): + fileroot = os.path.splitext(os.path.basename(test_playbook))[0] + nm_testfile = fileroot + "_nm.yml" + + minimum_nm_version = NM_ONLY_TESTS.get(test_playbook, {}).get(MINIMUM_VERSION) + extra_run_condition = NM_ONLY_TESTS.get(test_playbook, {}).get( + EXTRA_RUN_CONDITION, "" + ) + if extra_run_condition: + extra_run_condition = "{}{}\n".format( + EXTRA_RUN_CONDITION_PREFIX, extra_run_condition + ) + + nm_version_check = "" + if minimum_nm_version: + nm_version_check = MINIMUM_NM_VERSION_CHECK.format( + minimum_nm_version=minimum_nm_version + ) + + nominal_nm_testfile_data = RUN_PLAYBOOK_WITH_NM.format( + test_playbook=test_playbook, + get_nm_version=minimum_nm_version and GET_NM_VERSION or "", + minimum_nm_version_check=nm_version_check, + extra_run_condition=extra_run_condition, + ) + + return nm_testfile, nominal_nm_testfile_data + + +def create_initscripts_playbook(test_playbook): + fileroot = os.path.splitext(os.path.basename(test_playbook))[0] + init_testfile = fileroot + "_initscripts.yml" + + nominal_data = RUN_PLAYBOOK_WITH_INITSCRIPTS.format(test_playbook=test_playbook) + + return init_testfile, nominal_data + + +def check_playbook(generate, testfile, test_playbook, nominal_data): + is_missing = False + returncode = None + if generate: + print(testfile) + with open(testfile, "w") as ofile: + ofile.write(nominal_data) + + if not os.path.isfile(testfile) and not generate: + is_missing = True + else: + with open(testfile) as ifile: + testdata = ifile.read() + if testdata != nominal_data: + print(f"ERROR: Playbook does not match nominal value: {testfile}") + returncode = 1 + + return is_missing, returncode + + +def main(): + testsfiles = glob.glob("playbooks/tests_*.yml") + missing = [] + returncode = 0 + + # Generate files when specified + generate = bool(len(sys.argv) > 1 and sys.argv[1] == "generate") + + if not testsfiles: + print("ERROR: No tests found") + returncode = 1 + + for test_playbook in testsfiles: + if test_playbook in IGNORE: + continue + + nm_testfile, nominal_nm_testfile_data = create_nm_playbook(test_playbook) + + is_missing, new_returncode = check_playbook( + generate=generate, + testfile=nm_testfile, + test_playbook=test_playbook, + nominal_data=nominal_nm_testfile_data, + ) + if is_missing: + missing.append(test_playbook) + if new_returncode: + returncode = new_returncode + + if test_playbook not in NM_ONLY_TESTS: + init_testfile, nominal_init_testfile_data = create_initscripts_playbook( + test_playbook + ) + is_missing, new_returncode = check_playbook( + generate=generate, + testfile=init_testfile, + test_playbook=test_playbook, + nominal_data=nominal_init_testfile_data, + ) + if is_missing: + missing.append(test_playbook) + if new_returncode: + returncode = new_returncode + + if missing: + print("ERROR: No NM or initscripts tests found for:\n" + ", \n".join(missing)) + print("Try to generate them with '{} generate'".format(sys.argv[0])) + returncode = 1 + + return returncode + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/roles/linux-system-roles.network/tests/files/cacert.key b/roles/linux-system-roles.network/tests/files/cacert.key new file mode 100644 index 0000000..ee6710d --- /dev/null +++ b/roles/linux-system-roles.network/tests/files/cacert.key @@ -0,0 +1,30 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-256-CBC,B773C37C13C791B1B2F735A7D6D22F1D + +KcpCACKK2i/zLDkH/e2bM/3hzyuC7UkSJ32Vn2xvH6ukKzOpt71PJjtzucY3TgB7 +T8fYDJ0OGFfW/97M9OSjY10+wo/Vn+aTTCJWe2Y0+JeoV+bFJq33fuP0SlJI1PIU +CrxnWhFUM3iaDHjuJ32GaUCkLozKTRdb5KT0BttSdSudnT+9d6zHejCwvYEaGek0 +C3fifoN2xC47P+63UF40KWMP0+j83ZRtHXUUgQ9E0Eqmbag6jTBh2TvV/PiaWlRv +YCVMapOBs0ktSPPJACygRJcR63MocS9of7aRaPMCDP7HpzrjzKnHqJ+bPteuaE4k +UmVOlrBsJb4g/zpfT4Ee2waT/mKEiRtNhf8a7DNkc34I50iMqhOojM1zRPtQugO6 +5BGhFeciHCe7RzHvltWJRmLrl+H7Z8wvusxbSQRM5ZT18+wgBkgTb8dA3bmZS0Ws +JYcd9BN8zbsxETo/IFZ2gFOaVvOymVE5mscRR21RsiBi1vfqjl+pAt4ZrlGwVpxL +3z3yvT3lAx8Cgeg8dCxrDNb14Xwk+hkBblExLMXsUGCsRXJglk9QVPE0XjKD9XNa +mZnBHOpAsdPun58PRiaPpC+VgaFBhzPHTyBczCG1sjpkOiTJpGLpgveAq4wOXQGH +PMcux4ZDARYbJfGXANNqloIO3PHDPuhVmSAJZSMixDd4SLKjT6tALdqIv1BvOLl7 +Ay0y3Vie4oGc4EWjHqQA+r+6CATHHXtIOvWLJQ4/KQa/R+pTp0qDtXdOeHaAZzhv +BpqvQUouKUyxXlGFZrGUq9l+sFtjLlcKP33Yb2WHg4ct0gAVDIA6SK4rNH6+h/NS +rFQNOvArTeZgLCaG6htJh68WLF8p6687s4bKNM8niZ5VcsFTvMYPbfF5WdE0l53s +fZpZBf1v03ZRJYg2V9a0sNPEysaIaTJzs5lFeya78iTF/Epo4GtTHv8sWebVwh/H +FYINLIcPzzxAvw7a+7ymIsYZphomuEoCCoX85DPPbXfZOb2Bdysfdr7uyRsB480E +or6+gQxZJWxcO5tMR7+G8EuUgnPMelVNczw3UJHM+sl4Kjh9q3hF4ppWFTIOaPQ/ +BL3qPE/ZxSFC8UcG+QJEbNmPPQLXnpWPUZ3GmyH/+pPUZCkcWanpn0W3chGlJCsW +spkDMt/dpPtje1q7rfrWCVAYo4AeYzigSuxoyfpBfqcpD6wAssPQmWj4fFr91RW7 +p/iLlACpevyecALrJpU65yGWDvGWlx+dEqvdz7FRUSTkVrted/W3pmro8eDAInWx +17VM0hHfNE00hwpGaga2CY8q3EC+3kApSE6d8dbBtSzBp4YZsGq+p+Xkj7mTc/rn +mXJazUSPjNhWooI+0pN2VxB3HRBloNjsQOLaWVcSiv6l3wKl70ZbBjPkikO05k+v +QXayu3i9RjXvhT974atOqoqCSigc8ROsCYGxgHjwVMU9Spc9i8y6PrgX9ID6yk9f +9YcJjmtEi6MYh0uXNkx2m6utMjgcuAqP8yfPqeBRK2SOoLuBM9JKP8tjwq4ZBawj +SuWe82zTRjR2oXMgNy6gBBDGky+W7kNaNw/KksZUxdiNhzeDRbDG8hMJI1HcY4xQ +-----END RSA PRIVATE KEY----- diff --git a/roles/linux-system-roles.network/tests/files/cacert.pem b/roles/linux-system-roles.network/tests/files/cacert.pem new file mode 100644 index 0000000..5f0181e --- /dev/null +++ b/roles/linux-system-roles.network/tests/files/cacert.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDizCCAnOgAwIBAgIUG1DftQ2xyrN+HE+KHLFmKHZnIkcwDQYJKoZIhvcNAQEL +BQAwVDELMAkGA1UEBhMCWFgxFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UE +CgwTRGVmYXVsdCBDb21wYW55IEx0ZDEQMA4GA1UEAwwHVGVzdCBDQTAgFw0yMDA1 +MDMwNTI2MTFaGA8yMjk0MDIxNTA1MjYxMVowVDELMAkGA1UEBhMCWFgxFTATBgNV +BAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UECgwTRGVmYXVsdCBDb21wYW55IEx0ZDEQ +MA4GA1UEAwwHVGVzdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +AMGAmO9ugnI/jaw4qNTyh/O65BNEvzOIwLU0mo3wTOSiakoOuC0gqO4S+0FOmC6v +ceoArS+GllowzrgnnmM4EH9hqmiLeFKa4Z2graIm2W86ayN5k3psiMolONOZ8y0r +nAMj84FifDYIOHoYbKUeN5BDsotrHbrZ/PZhlZgN1ou3gapXqM12TkXdzaj//vRd +CORjwO1ubpzb17PFUNOLWaDf3ohfoMCG08UkGwIGK0mouJ1yflda27MCcLzmDxV8 +4dfI//R/6WtN1hzWSW9ae99VwSjlACH2go/0fDD+K9jvKkEVRZAqBEnM3voQCOah +P9NMJ30R9Sh8B/D2KXGyIU0CAwEAAaNTMFEwHQYDVR0OBBYEFDUKdAwDiWpUpayU +mjiWEcMcXjQdMB8GA1UdIwQYMBaAFDUKdAwDiWpUpayUmjiWEcMcXjQdMA8GA1Ud +EwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAKEyNiDawDJeaauDUmHgdNlG +WuBlvn4Lph/+J27njmAoIbKv3aDw+kndxI02ryCZTJOm8a1NqHfkNct4ny+Cj4cz +rNoZIyMucVoKGgCMYb5zwYtW3W7RshUZoBdQDBLiIuktNsWTyqss3yVPPq8Q1JJY +89dtjCNydL6dunFSrGjVJ2K5HaTyidti2IN9g2Sbxmxgoz71ZP09xmBxaY+O738M +z5nRdrb2DX0flmv5pcqSzn7063t9FGKOp2bF9NTpcEWkultsCOvsVcsO4X/18L4J +3W8FVltyCvunv4GQecWqlNHTRT+QI2h48EVEzHQnOGEe9q1C8WVGeQ3cZXMei8k= +-----END CERTIFICATE----- diff --git a/roles/linux-system-roles.network/tests/files/client.key b/roles/linux-system-roles.network/tests/files/client.key new file mode 100644 index 0000000..061b192 --- /dev/null +++ b/roles/linux-system-roles.network/tests/files/client.key @@ -0,0 +1,31 @@ +# password=test +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-256-CBC,C4A5E9A189773AB0F3CE3DCC98F208AE + +LPNSExpEERS+/qHJxd8puT+EaZ/dZ20gkU/C2eaNNJerzr4moSXG4ioh5ggz4utQ +w57fD5OYqPiloNIawi/Ta5Opo3zU+iMZPVQALLbemXWXmNMxqxNCGdonc4enxMoN +auLxpdYPW+infFmf0UPwZjWkrLnK8XFapTGDaNesfgMNSRVSt+DQL3xeKUjcuXfh +rYvF26/Ls8NHB0tCU449vCa5ta1fHPT78B0cWgCmhcg/L8/0veBYfwxnyu6l3E6Q +RXWcyaJoihhCSg9kCZOqQFKDtz3B9G8/G8P5n5udN2TYUK0ieCktocOip0r/aUfk +Rz/NPjej18tuvA9e+uho2DuEj7OV1Rt0Fr6G2NySDYAIjlzM1+GoDdX3R8Rva2eX +SJYEjQvvLMAXU9wLEGd2u9jw3h8g2rNPF34Mo/fZsU6f83WceN7wzaDjKBM9TC/U +DjeUpJ2LHr3SduRoq5K7PqTG6LlRx4ZC06P8Gwu/cjlHqHuMlLE6wWPHowp9O08S +zMzJji6csSzZ5x5U41xiBJd19G0tbfjGBOvxhVLC3hmfqMtRwgeKSZMUz5f0iFvS +V4LE/ZNXWv5OybEzMyIiQBRB0G8mq5BkQ3rU9uTMO6Xc6mosQy0jiCsQLYaX2IoT +kyU6ZqPgAeBD3g5zCGudcF4qqY3pWRU6cijpivsuyX58YmulhQJsB2rnoImv8ZOR +4Uw+fvAx38v/dH/aAGKNdQV/4z+CXpAX4SdqYgBx9wXu6Wva31AVrbDrKnpSlWYF +M9gAHgpuhW9OH7du/y7sePU6k37fHtqDX0V5XoyeRxixR+KGb8k3tt0HFA1GExSu +XyXcOOfwec7xNQjZBM9jREI0yO1tCbHEeLsLpQnf31cpfSQumBZoiim6Vyk7vCN8 +YBJ9qiVNrFiVogWl5hUrSS2MLQP1ZQBkedmOeKZpkZ26GW5yY0y27v2mHdhU2Dvd +otvLGiVKxSXlu+tqt1WkMvu6hcfrDZDCONW7emGW7xs2vdYdvADVlYs/Eb0WFXb1 +tLkwg3v7I23LeFRrKX4Fm5/biG4GuR4sj9iPLayrKWhpujIVFJqHTI3YhjIU56Qp +uPuClnoFsKrWS9DXaziuuXmLZlXH3e5aOO+M2H3JmXTRCojyjKlIJiJJmHGrfwfe +oJkSF+ABs2zrpteXU+Cnfn8V01TrtxPYIBF3CbOMZEvwgjPLX0UNtnss0hXH4rJe +9yF/PiKWehUow8q4Gpwt2PnLkUWyL21GwCwXf5Cq3yRAKtyrJTlJsdYV1f3brzfb +JkBgKaFJ44Ee7D75PAio8g/BIDpvUdZVXwn3FizjfAU+HhXonPSYb2M34C6I/frk +mJPgZ5hbpt1SoCCER48+rQygiLdNQH6OsuhJeEElPFYwNo6i5jZsZ9iE0rmJxGgk +m7Mhi491NdK8L6Kh8kM2Dgupsfcstmx4+pI3gmgnsYZApmFoQlfcg4MhbWqxznv+ +cPm1n2SZMoMLru44vbnjW+ZAggen5zNZOrsVt8UImSBVKfAIrgDUuYIv7uqUiKHI +yHmAkZDlqEbpkbUG9m60OeuEIgpN7MT3Kod387ZyOu9uaTZWdD18/N83E4eFecND +-----END RSA PRIVATE KEY----- diff --git a/roles/linux-system-roles.network/tests/files/client.key.nocrypt b/roles/linux-system-roles.network/tests/files/client.key.nocrypt new file mode 100644 index 0000000..b1e1dbf --- /dev/null +++ b/roles/linux-system-roles.network/tests/files/client.key.nocrypt @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEAuQipSk9+0rd/qBMDRiFzV8vDksaueVphejGEgiQhqtUDgjc/ +ot/o7M8fFVC6wau2ixTnEMHuZXgoBOKATxX805FggEsLLL98OnN7AyTTKOtHVfIm +gK3fJ1Y9l95+2nuJWhmaan0vr3YMp6z3lSa+hlhhTYx/mIvTZho/K3+METg8DEfl +QUSkhAlrFSEahr2Pu/yETr8c+8vKTDnZDLvcFyyuDtAz+clEQUVndWJQpQpSVfR9 +4xKuzaj10mUA9Utv4RkbNJ78/KgdTbaGIOVLUnYCJUg8d3/YV7aNCqraHBAZ9aoP +S4dl46KXC3qpaEBFfKaF+RcPSVUtc4eCQ74kKwIDAQABAoIBAGoArUN2IVjEaSy3 +n7OIrFSK1oL6sa+x+JARWDFaU7NTj0wFLL65ee5Yhh0m/6a+IbiyA+IUx+d3m62Y +uRsVpJ7r9RXqZ/99v8SYrctSSGpzx41USXyEn4ggnu6nN5MhHMHyUwVYrH3fqkZR +EBFxfcrnTO8pY1vYFwayWKgpzOt7ip30JF1E7RH0IWfA2koJ+hZgSumPmF31btBK +eqDaQ168u0at6I7nYvRIWVT68D2k+PMb/c/rlOUYSyy+VfCgnShWD+m1hlyaDF1c +cbVvOhsul3rFeEqbToGN/6yyDDcyolTvYxMm3vb6jmoExZyRsShv0XyhokSuCN9P +v5SeNpkCgYEA7OpIlsZUoTXm2ffCQiZd8gRtKk0O3dzmWTkcNEgj2uUNH6ANNy3W +gLojKeF2EyC3appRWLVRYN/m6r/Qj+rztZfW3Jw1UJQV+tLEOBzk3yBnRdh1aRgW +8YTH1+HJqlJ/2iKJRKRhseM5AHiTslp7ude6cWQxO52pJ6Rbp1z3fBUCgYEAx/B4 +LreIDJYDnYSyL/CvVkHEn1hCYX0oBpefzV6ofYDqv0OLe8BWOBsShQ3Crh0FuQTa +xV2xc+OzDewlu2OwNm4/X0qjXvoWkEMLBXKEHjPyxnbHLCYaaA/9ENmVIkc8aZWE +p7KcCYGlfiHpbdYWAD8KYdv5CsFHFbwhPwrD7z8CgYAEtsSq+1dDvebR/3QGDO1h +m2TwqofZMkQDEnfVMnpEKLqSHoUky+ywswNwGeRXjRcZL+jecv0jiFD36skjk/E1 +c8f6q8ED0W5+hyMQWsLTDboAUcZESQ5rz9CKIxv4H5wbowRIMV0gRP0lXUDTE6nS +kNBM4Ul5fjGXcFXChr8F4QKBgGSmAeoKi9tCHTnLVePaNnmmi/Nm+6uV1HNVGqXI +k+rx3bpAp1O5o+2Ee1MtdSYvB/V2oyadnrnnEvjcOrZVXZxY7V/r88fY/0jJ5x9r +4WRO5FTR8DuiRsLB4bP8xB1IXPoNwYSl3fTPJd8T9S1MizC+i1xt3rVyTHV9igLx +SWcDAoGBAMoynJvQUOssWwFTtNQK0ptz95rrTkO2bri+8MJfSh8tessekwPHVe6M +SBofFhDiesrHBHczJ61qDnb3GemA0kEbo023mxNo0HPam+OFgX5mrihizBZnRZjh +aecVouDd0uwacsB76fwP6Fl5GhkFvOSBKr2IKNJjUMXyvW8/XGZE +-----END RSA PRIVATE KEY----- diff --git a/roles/linux-system-roles.network/tests/files/client.pem b/roles/linux-system-roles.network/tests/files/client.pem new file mode 100644 index 0000000..a2f4517 --- /dev/null +++ b/roles/linux-system-roles.network/tests/files/client.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDrDCCApSgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwVDELMAkGA1UEBhMCWFgx +FTATBgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UECgwTRGVmYXVsdCBDb21wYW55 +IEx0ZDEQMA4GA1UEAwwHVGVzdCBDQTAgFw0yMDA1MDMwODUxMTdaGA8yMjk0MDIx +NTA4NTExN1owXzELMAkGA1UEBhMCWFgxFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEc +MBoGA1UECgwTRGVmYXVsdCBDb21wYW55IEx0ZDEbMBkGA1UEAwwSY2xpZW50LmV4 +YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuQipSk9+ +0rd/qBMDRiFzV8vDksaueVphejGEgiQhqtUDgjc/ot/o7M8fFVC6wau2ixTnEMHu +ZXgoBOKATxX805FggEsLLL98OnN7AyTTKOtHVfImgK3fJ1Y9l95+2nuJWhmaan0v +r3YMp6z3lSa+hlhhTYx/mIvTZho/K3+METg8DEflQUSkhAlrFSEahr2Pu/yETr8c ++8vKTDnZDLvcFyyuDtAz+clEQUVndWJQpQpSVfR94xKuzaj10mUA9Utv4RkbNJ78 +/KgdTbaGIOVLUnYCJUg8d3/YV7aNCqraHBAZ9aoPS4dl46KXC3qpaEBFfKaF+RcP +SVUtc4eCQ74kKwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1P +cGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUoUCV4T3pFwaQ +HYSlCr8Iqdd+/TcwHwYDVR0jBBgwFoAUNQp0DAOJalSlrJSaOJYRwxxeNB0wDQYJ +KoZIhvcNAQELBQADggEBALXhDSFirybmhZXcHuSqXn0tLp6mZintW+91B81bDUtO +FuCrWqXwV0iensm94mOeykGIR/r0Y0Y4uqOHpIznY+q5NIek0qIdirbdr5mCXK5y +fxXVIMM14GMTyIR9A4+IZaRkFbcrVnBhOdUpTQjp88jlzDr5jdyjTEnOZyOJH9kL +Qpd417iB4X5TxuQ2xe5EgHOCb8OfxO0a2BzlwtfUQAkz2v+h0RlVBwQFcE2NCJ3z +hvF3AWGl+5pkfWpY6d+1EPI3+82C6uRf8be/WKHPKu3i0irrVtZdMsKNkRiD5UUK +S4Y0WnoVu/DWSR8h9iPGSFKMkUcjFI8hgc4YQ6G4Odc= +-----END CERTIFICATE----- diff --git a/roles/linux-system-roles.network/tests/files/dh.pem b/roles/linux-system-roles.network/tests/files/dh.pem new file mode 100644 index 0000000..4dfaa5a --- /dev/null +++ b/roles/linux-system-roles.network/tests/files/dh.pem @@ -0,0 +1,8 @@ +-----BEGIN DH PARAMETERS----- +MIIBCAKCAQEAjbYPkANn2XGqDGCzse9wAfM0I5WJpp+Xl+iNJFmaKXBguo0BPYQt +hZOpJbKL3aNaFsRxhdAJ8UXzBP6oIzCejcGti+jw+xtVk8ietWEK6e91yi+Ak2g2 +/Xtt9hoYQkeoe5hkcv35NcJ0xdQwlSvMbY/j8HtKamx/A3zu+YPQAe/3AOe3L+JT +iEL5Gw00NPVnyEWKX4fVchAbMUkRsQKeXtsyOyDc4/RccjfLa1toyj8PRommK5UH +dkSqi04FTOUIx6aTwt21EehJuggLVDShoQdxGV+FzXmdtelLmerGMtVPBbf8DSkN +MKMBEg4d28DzjXPAWUHMD+JGPzAlvf87EwIBAg== +-----END DH PARAMETERS----- diff --git a/roles/linux-system-roles.network/tests/files/server.key b/roles/linux-system-roles.network/tests/files/server.key new file mode 100644 index 0000000..872ea8f --- /dev/null +++ b/roles/linux-system-roles.network/tests/files/server.key @@ -0,0 +1,31 @@ +# password=test +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-256-CBC,ED349A8B098E2D1DB70C30F77EF599AB + +j1rzje2sWFk3B9kD6eE7WrqVDynFEJ3t3kdOv0iUvH5Ybll1C7Qx3EFEdoM4z2OV +E6q3nr2DOvpMPox1DvBdIipWOQWJxkZyBHqNn4v4GR4c0uxLswsk7XSBQLUclRsn +QBGO6x8pcEA9u/O3PSrTt+pVozWrXWmR2UHNM//9WUsRpWF4Lv0EINzsfwmD7aJQ +nRcSfXsCggXP6wnJX5dgo5PlRm6R+bodgzePr0QRlh8TT6wnixZfWalYM5iUKlEF +GcE+VejZuBL69byl2AcRt8I5tQ+UZxmzhKPSsYN0NKD8vbcVVnp2sre/rbdTzWz5 +laF386g1M8QBimDE/V3Bw5b9Bg1ZP3arlpugVXGVNA+HFti8PVdkaMqLgkFIC2Xu +OwmNKffAPIItuB8leg5A76oLoIlllRqjWO9M/O+MqAlrJ96xLRiUeGkez4Pp7eFV +30YrlOXyzwZKfXoOPIfE5Mbz4CPqR67XuqW8jOryIGOryMB17b0+vdRpDY0wxk8/ +lGmc5rglDxLFA8dNemAHDednasCuVlrbsQsZRnPkKavXiSu7QCbvm1frAXZfnyRp +TpPmE6L4+nEy8PQnK/IxOCqRcy6e1SPezRpajRjB5ooDT8hDmDkG47NdnrB+kOKL +5LIpATLSGS9IVk0RW/M8EqJP1kRh2JOCQT3V+gUN0ttz8bjZpivKnp76/ztg0lo0 +oC2lhuXV5HOYHw1z5jDazsYpQDYoHgYWXnzPJJp6Ecn+nkjZMKQjDV9ZqE1miPrZ +E4V0ULNmWaAQHvwc98yR97ui1YHmw5XVMoeDhy3fhB6IOyaGGdEj9o2iQr8kp9GC +dxBKK/xMOU6kwDF9Nsfh46veRGTbhAJdGeWqdxscdCupkO8KRtZqzL454+9GnYfe +n1f7wxJh7aTLNjF2an5Qa9v7uU6D58+9blxG7ls5qGt4xjBNAXCc8bPpmLqeCW4G +Xz8iwxECvwWIQ+SjUcXuP8+/NO58B14kDNP03+1gA7AHIesa2CTvHLCyMPaN2oGK +3R4LNxQQDNygEzRj8vHjURU1FNRJ4RjCi7SbqoOsl31Hvef6j0lcW0Sz4UICcCJI +p4NPnApoaHewL4exvlJ80qPbFscuVevXBlUC2LdxXS+9E+c0NaLauEeNYCUoaBDi +HIpbxRKXmqLc4LAKYVuEcIBFhdXp3UC9niVd7Nrguu0lUJXC78OzpltxWrqX/u4E +O2aCNK0Yg9U+rxm6wyccqEyptIS2GRCIpUGD/LVF3mOC16NB/JeYGrOWvDptdCeg +9pJrakJjE1Fm3pg4Xc74bT6IDj0EKwKSvZhtlcsM9JaXWChe/ZrDPPI/NP6MuyW4 +jcqpa9HPBBSyaxKsEPXFJhdhrz8VfsU2e5VvcALaJaAOpHwZgaNUpvpsY4LPW9mi +lHsecEBiq6re0r7TAgBE1AnlaI4ho0fKSgSub3NWUZlEaBK3X2n/Li6op6LIsvM5 +iySYaAluQy4dANww0KhQHMIh0jbuZGzmG2Hxk/poorYRf60YJlbTnHVD/FKUdFX+ +rUow0iy8Ez1uF272u5orYW2tBbkhSaieKOT8f4HFCxUsgITbd8Lf/XJ6l6Qns6SK +-----END RSA PRIVATE KEY----- diff --git a/roles/linux-system-roles.network/tests/files/server.pem b/roles/linux-system-roles.network/tests/files/server.pem new file mode 100644 index 0000000..461b3ac --- /dev/null +++ b/roles/linux-system-roles.network/tests/files/server.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDrDCCApSgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwVDELMAkGA1UEBhMCWFgx +FTATBgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UECgwTRGVmYXVsdCBDb21wYW55 +IEx0ZDEQMA4GA1UEAwwHVGVzdCBDQTAgFw0yMDA1MDMwODUxMzBaGA8yMjk0MDIx +NTA4NTEzMFowXzELMAkGA1UEBhMCWFgxFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEc +MBoGA1UECgwTRGVmYXVsdCBDb21wYW55IEx0ZDEbMBkGA1UEAwwSc2VydmVyLmV4 +YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxcC44Amd +KQBDwR67aMTPqmNu6HfjadZqsD2xZj5XMVdn4karqsVYIbKMOq+SRzgm5aZ/kzQI +CpXJMXfj16cID6BCxNecfJVOfvPyI0kCUbMf1YZiRG2FmB2VsG8AVDGWmn4a7SmX +yaCA0ac8dkipnlCF2nddLhcBak/Ls+hjRYN7VSLLvxO8KT42ivhuP9YgGY1K5Yta +e90H4HBiKxbnkwOUxi9wobERSXSLgb4e+uX8WRrqxIIYmHF+Gzv5kilRFrPwKBmo +3idVPrqjschZe0o8m/nbNo3SzWGI9fdXn0+KgZoQdG3ZixX6uOhrCqJ3iJmnHkp4 +aXKL5Y7JmX/FFQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1P +cGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUx7TXCxUioob7 +5r/1kMypCYy9Mj0wHwYDVR0jBBgwFoAUNQp0DAOJalSlrJSaOJYRwxxeNB0wDQYJ +KoZIhvcNAQELBQADggEBAKtTPl4WJuxfMeut+aEw7vVRU+z5A7D35nlZPQI5nBTt +ybgqMNIjdcYT/JwT2GhbzcObc3STNEo582clVN9gTpK7mYKzBBf69nTsWeZzPuNt +JQbVbK4RHwFvyosJcw6NfzxE9OxeXhTcKQDQSGKP338sAWoapEZlXNrYOIJac6HX +Xo3dQqx/8BdO9hSv1u0/zClnL5lbk1RBylS24wIe8wLoiy4ftLjL4aOYOlonj7HU +hknTY6L30oOpG5VtH8SEv3xveH/5GNKwfoGltTzemCgVfb9IhyVTLB3tIv8OW6k1 +y3+YEzVniVB4gtJ5UniLN1V4lBf6t7MGn0ybAEbOxPI= +-----END CERTIFICATE----- diff --git a/roles/linux-system-roles.network/tests/get_coverage.sh b/roles/linux-system-roles.network/tests/get_coverage.sh new file mode 100755 index 0000000..858a8cf --- /dev/null +++ b/roles/linux-system-roles.network/tests/get_coverage.sh @@ -0,0 +1,65 @@ +#! /bin/bash +# SPDX-License-Identifier: BSD-3-Clause + +if [ -n "${DEBUG}" ] +then + set -x +fi +set -e + +if [ "$#" -lt 2 ] +then + echo "USAGE: ${0} host playbook" + echo "Get coverage info from host for playbook" + exit 1 +fi + +host="${1}" +shift +playbook="${1}" + +coverage_data="remote-coveragedata-${host}-${playbook%.yml}" +coverage="/root/.local/bin/coverage" + +echo "Getting coverage for ${playbook} on ${host}" >&2 + +call_ansible() { + local module="${1}" + shift + local args="${1}" + shift + ansible -m "${module}" -i "${host}", -a "${args}" all "${@}" +} + +remote_coverage_dir="$(mktemp -d /tmp/remote_coverage-XXXXXX)" +trap "rm -rf '${remote_coverage_dir}'" EXIT +ansible-playbook -i "${host}", get_coverage.yml -e "test_playbook=${playbook} destdir=${remote_coverage_dir}" + +#COVERAGE_FILE=remote-coverage coverage combine remote-coverage/tests_*/*/root/.coverage +./merge_coverage.sh coverage "${coverage_data}"-tmp $(find "${remote_coverage_dir}" -type f | tr , _) + +cat > tmp_merge_coveragerc <> tmp_merge_coveragerc +done + +COVERAGE_FILE="${coverage_data}" coverage combine --rcfile tmp_merge_coveragerc "${coverage_data}"-tmp + +test -n "${DEBUG}" && cat tmp_merge_coveragerc +rm tmp_merge_coveragerc + +COVERAGE_FILE="${coverage_data}" coverage report ||: +COVERAGE_FILE="${coverage_data}" coverage html --directory "htmlcov-${coverage_data}" ||: + +echo "Coverage collected in: ${coverage_data}" diff --git a/roles/linux-system-roles.network/tests/get_coverage.yml b/roles/linux-system-roles.network/tests/get_coverage.yml new file mode 100644 index 0000000..14893f1 --- /dev/null +++ b/roles/linux-system-roles.network/tests/get_coverage.yml @@ -0,0 +1,82 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +# This expects the variable test_playbook to be set from the outside +- name: Prepare for coverage extraction + hosts: all + tasks: + # Use set_fact to set variables to make them available in all plays + # 'vars:' Would only set variables for the current play + - name: set facts + set_fact: + coverage_module: network_connections + coverage: /root/.local/bin/coverage + destdir: "remote_coverage/{{ test_playbook }}" + + # This uses variables from the other set_fact task, therefore it needs to + # be its own task + - name: set more facts + set_fact: + coverage_file: + # yamllint disable-line rule:line-length + ansible-coverage-{{ coverage_module }}-{{ test_playbook|replace('.yml', '') }} + + - name: debug info + debug: + msg: + # yamllint disable-line rule:line-length + Getting coverage for '{{ coverage_module }}' with '{{ test_playbook }}' + + # combine data in case old data is left there + - command: "{{ coverage }} combine" + environment: + COVERAGE_FILE: "{{ coverage_file }}" + ignore_errors: yes + + - name: remove old data + file: + state: absent + path: "{{ coverage_file }}" + + - name: find coverage files to delete + find: + path: "{{ ansible_env.HOME }}" + patterns: ".coverage.*" + hidden: yes + register: files_to_delete + + - name: remove old data + file: + path: "{{ item.path }}" + state: absent + with_items: "{{ files_to_delete.files }}" + + - name: copy coveragerc + copy: + content: "[run]\ndisable_warnings = no-data-collected\n" + dest: .coveragerc + + - name: install latest pip + pip: + name: coverage + extra_args: --user --upgrade + +- import_playbook: "{{ test_playbook }}" + vars: + ansible_python_interpreter: + # yamllint disable-line rule:line-length + "{{ coverage }} run -p --include /*/modules/network_connections.py,/*/module_utils/network_lsr/*" + +- name: Gather coverage data + hosts: all + tasks: + - shell: "{{ coverage }} combine .coverage.*" + environment: + COVERAGE_FILE: "{{ coverage_file }}" + +- name: Get coverage data + hosts: all + tasks: + - fetch: + src: "{{ coverage_file }}" + dest: "{{ destdir }}" + flat: no diff --git a/roles/linux-system-roles.network/tests/get_total_coverage.sh b/roles/linux-system-roles.network/tests/get_total_coverage.sh new file mode 100755 index 0000000..ca61746 --- /dev/null +++ b/roles/linux-system-roles.network/tests/get_total_coverage.sh @@ -0,0 +1,34 @@ +#! /bin/bash +# SPDX-License-Identifier: BSD-3-Clause + +set -e +coverage_data=total-coveragedata +testhost="${1}" + +if [ "$#" -lt 1 ] +then + echo "USAGE: ${0} host" + echo "Get local and all remote coverage data for host" + exit 1 +fi + +rm -f remote-coveragedata* "${coveragedata}" + + +# collect pytest coverage +tox -e py26,py27,py36,py37 -- --cov-append + +for test_playbook in tests_*.yml +do + ./get_coverage.sh "${testhost}" "${test_playbook}" +done + +./merge_coverage.sh coverage "total-remote-coveragedata" remote-coveragedata-* +./covstats .coverage remote-coveragedata-* "total-remote-coveragedata" + +./merge_coverage.sh coverage "${coverage_data}" .coverage remote-coveragedata-* +echo "Total coverage:" +COVERAGE_FILE="${coverage_data}" coverage report ||: +COVERAGE_FILE="${coverage_data}" coverage html --directory "htmlcov-${coverage_data}" ||: +echo "Open HTML report with:" +echo "xdg-open htmlcov-${coverage_data}/index.html" diff --git a/roles/linux-system-roles.network/tests/integration/conftest.py b/roles/linux-system-roles.network/tests/integration/conftest.py new file mode 100644 index 0000000..1fb2c70 --- /dev/null +++ b/roles/linux-system-roles.network/tests/integration/conftest.py @@ -0,0 +1,8 @@ +# -*- coding: utf-8 -* +# SPDX-License-Identifier: BSD-3-Clause + + +def pytest_addoption(parser): + parser.addoption( + "--provider", action="store", default="nm", help="Network provider" + ) diff --git a/roles/linux-system-roles.network/tests/integration/test_ethernet.py b/roles/linux-system-roles.network/tests/integration/test_ethernet.py new file mode 100644 index 0000000..d104d23 --- /dev/null +++ b/roles/linux-system-roles.network/tests/integration/test_ethernet.py @@ -0,0 +1,114 @@ +# -*- coding: utf-8 -* +# SPDX-License-Identifier: BSD-3-Clause +import logging +import os +import subprocess + +import pytest + +try: + from unittest import mock +except ImportError: + import mock + +parent_dir = os.path.normpath(os.path.join(os.path.dirname(__file__), "..", "..")) + +with mock.patch.dict( + "sys.modules", + { + "ansible.module_utils.basic": mock.Mock(), + }, +): + import network_connections as nc + + +class PytestRunEnvironment(nc.RunEnvironment): + def log(self, connections, idx, severity, msg, **kwargs): + if severity == nc.LogLevel.ERROR: + logging.error("Error: {}".format(connections[idx])) + raise RuntimeError(msg) + else: + logging.debug("Log: {}".format(connections[idx])) + + def run_command(self, argv, encoding=None): + command = subprocess.Popen( + argv, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE + ) + return_code = command.wait() + out, err = command.communicate() + return return_code, out.decode("utf-8"), err.decode("utf-8") + + def _check_mode_changed(self, *args, **kwargs): + pass + + +def _configure_network(connections, provider): + cmd = nc.Cmd.create( + provider, + run_env=PytestRunEnvironment(), + connections_unvalidated=connections, + connection_validator=nc.ArgValidator_ListConnections(), + ) + cmd.run() + + +@pytest.fixture(scope="session") +def provider(request): + return request.config.getoption("--provider") + + +@pytest.fixture +def testnic1(): + veth_name = "testeth" + try: + subprocess.call( + [ + "ip", + "link", + "add", + veth_name, + "type", + "veth", + "peer", + "name", + veth_name + "peer", + ], + close_fds=True, + ) + yield veth_name + finally: + subprocess.call(["ip", "link", "delete", veth_name]) + + +def _get_ip_addresses(interface): + ip_address = subprocess.check_output(["ip", "address", "show", interface]) + return ip_address.decode("UTF-8") + + +@pytest.fixture +def network_lsr_nm_mock(): + with mock.patch.dict( + "sys.modules", + { + "ansible.module_utils.basic": mock.Mock(), + }, + ): + yield + + +def test_static_ip_with_ethernet(testnic1, provider, network_lsr_nm_mock): + ip_address = "192.0.2.127/24" + connections = [ + { + "name": testnic1, + "type": "ethernet", + "state": "up", + "ip": {"address": [ip_address]}, + } + ] + _configure_network(connections, provider) + assert ip_address in _get_ip_addresses(testnic1) + if provider == "initscripts": + assert os.path.exists("/etc/sysconfig/network-scripts/ifcfg-" + testnic1) + else: + subprocess.check_call(["nmcli", "connection", "show", testnic1]) diff --git a/roles/linux-system-roles.network/tests/merge_coverage.sh b/roles/linux-system-roles.network/tests/merge_coverage.sh new file mode 100755 index 0000000..a33e94d --- /dev/null +++ b/roles/linux-system-roles.network/tests/merge_coverage.sh @@ -0,0 +1,35 @@ +#! /bin/bash +# SPDX-License-Identifier: BSD-3-Clause + +if [ -n "${DEBUG}" ] +then + set -x +fi +set -e + +if [ "$#" -lt 3 ] +then + echo "USAGE: ${0} path_to_coverage_binary output_file input_files..." + echo "Merges all input_files into output file without removing input_files" + exit 1 +fi + +# path to coverage binary +coverage="${1}" +shift + +# read by coverage binary +export COVERAGE_FILE="${1}" +shift + +tempdir="$(mktemp -d /tmp/coverage_merge-XXXXXX)" +trap "rm -rf '${tempdir}'" EXIT + +cp --backup=numbered -- "${@}" "${tempdir}" +# FIXME: Would not work if coverage files are not hidden but they are by +# default +shopt -s dotglob +"${coverage}" combine "${tempdir}/"* + +echo "Merged data into ${COVERAGE_FILE}" +./covstats "${COVERAGE_FILE}" diff --git a/roles/linux-system-roles.network/tests/module_utils b/roles/linux-system-roles.network/tests/module_utils new file mode 120000 index 0000000..c3ce1a4 --- /dev/null +++ b/roles/linux-system-roles.network/tests/module_utils @@ -0,0 +1 @@ +../module_utils/ \ No newline at end of file diff --git a/roles/linux-system-roles.network/tests/modules b/roles/linux-system-roles.network/tests/modules new file mode 120000 index 0000000..d6bf720 --- /dev/null +++ b/roles/linux-system-roles.network/tests/modules @@ -0,0 +1 @@ +../library/ \ No newline at end of file diff --git a/roles/linux-system-roles.network/tests/playbooks/down_profile.yml b/roles/linux-system-roles.network/tests/playbooks/down_profile.yml new file mode 100644 index 0000000..5087240 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/down_profile.yml @@ -0,0 +1,10 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Set {{ profile }} down + hosts: all + vars: + network_connections: + - name: "{{ profile }}" + state: down + roles: + - linux-system-roles.network diff --git a/roles/linux-system-roles.network/tests/playbooks/files b/roles/linux-system-roles.network/tests/playbooks/files new file mode 120000 index 0000000..feb1228 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/files @@ -0,0 +1 @@ +../files \ No newline at end of file diff --git a/roles/linux-system-roles.network/tests/playbooks/integration_pytest_python3.yml b/roles/linux-system-roles.network/tests/playbooks/integration_pytest_python3.yml new file mode 100644 index 0000000..075355b --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/integration_pytest_python3.yml @@ -0,0 +1,149 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Install dependencies for integration tests + hosts: all + vars: + - rpmdependencies: + - git + - python3-pip + - rsync + + tasks: + - name: Install rpm dependencies + package: + state: present + name: "{{ rpmdependencies }}" + + - name: Install Pytest + command: "pip3 install pytest" + + +# Import needed in order to install initscripts dependencies on the remote +# system. +- import_playbook: "../tests_default_initscripts.yml" + +# Import needed in order to install Network Manager dependencies on the remote +# system. +- import_playbook: "../tests_default_nm.yml" + + +- name: Run Pytest tests + hosts: all + tasks: + - block: + - name: create tempdir for code to test + tempfile: + state: directory + prefix: lsrtest_ + register: _rundir + + - name: get tempfile for tar + tempfile: + prefix: lsrtest_ + suffix: ".tar" + register: temptar + delegate_to: localhost + + - include_tasks: ../tasks/get_modules_and_utils_paths.yml + + - name: get tests directory + set_fact: + tests_directory: "{{ lookup('first_found', params) }}" + vars: + params: + files: + - tests + - network + paths: + - "../.." + + # TODO: using tar and copying the file is a workaround for the + # synchronize module that does not work in test-harness. Related issue: + # https://github.com/linux-system-roles/test-harness/issues/102 + # + - name: Create Tar file + command: > + tar -cvf {{ temptar.path }} --exclude "*.pyc" + --exclude "__pycache__" + -C {{ tests_directory | realpath | dirname }} + {{ tests_directory | basename }} + -C {{ modules_parent_and_dir.stdout_lines[0] }} + {{ modules_parent_and_dir.stdout_lines[1] }} + -C {{ module_utils_parent_and_dir.stdout_lines[0] }} + {{ module_utils_parent_and_dir.stdout_lines[1] }} + delegate_to: localhost + + - name: Copy testrepo.tar to the remote system + copy: + src: "{{ temptar.path }}" + dest: "{{ _rundir.path }}" + + - name: Untar testrepo.tar + command: tar xf {{ temptar.path | basename }} + args: + chdir: "{{ _rundir.path }}" + + - file: + state: directory + path: "{{ _rundir.path }}/ansible" + + - name: Move module_utils to ansible directory + shell: | + if [ -d {{ _rundir.path }}/module_utils ]; then + mv {{ _rundir.path }}/module_utils {{ _rundir.path }}/ansible + fi + + - name: Fake out python module directories, primarily for python2 + shell: | + for dir in $(find {{ _rundir.path }} -type d -print); do + if [ ! -f "$dir/__init__.py" ]; then + touch "$dir/__init__.py" + fi + done + + - set_fact: + _lsr_python_path: "{{ + _rundir.path ~ '/' ~ + modules_parent_and_dir.stdout_lines[1] ~ ':' ~ _rundir.path + }}" + + - debug: + msg: path {{ _lsr_python_path }} + - command: ls -alrtFR {{ _rundir.path }} + + - block: + - name: Run pytest with nm + command: > + pytest + {{ _rundir.path }}/{{ tests_directory | basename }}/integration/ + --provider=nm + register: playbook_run + environment: + PYTHONPATH: "{{ _lsr_python_path }}" + always: + - debug: + var: playbook_run.stdout_lines + + - block: + - name: Run pytest with initscripts + command: > + pytest + {{ _rundir.path }}/{{ tests_directory | basename }}/integration/ + --provider=initscripts + register: playbook_run + environment: + PYTHONPATH: "{{ _lsr_python_path }}" + always: + - debug: + var: playbook_run.stdout_lines + always: + - name: remove local tar file + file: + state: absent + path: "{{ temptar.path }}" + delegate_to: localhost + + - name: remove tempdir + file: + state: absent + path: "{{ _rundir.path }}" diff --git a/roles/linux-system-roles.network/tests/playbooks/manual_test_ethtool_coalesce.yml b/roles/linux-system-roles.network/tests/playbooks/manual_test_ethtool_coalesce.yml new file mode 100644 index 0000000..8b2c456 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/manual_test_ethtool_coalesce.yml @@ -0,0 +1,115 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + interface: "{{ network_interface_name1 }}" + type: "{{ network_interface_type1 }}" + tasks: + - name: "INIT: Ethtool coalesce tests" + debug: + msg: "##################################################" + - include_tasks: tasks/show_interfaces.yml + - include_tasks: tasks/manage_test_interface.yml + vars: + state: present + - include_tasks: tasks/assert_device_present.yml + - name: Install ethtool (test dependency) + package: + name: ethtool + state: present + - block: + - name: >- + TEST: I can create a profile without changing the ethtool coalesce. + debug: + msg: "##################################################" + - name: Get current device coalesce + command: "ethtool --show-coalesce {{ interface }}" + register: original_ethtool_coalesce + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + state: up + type: ethernet + ip: + dhcp4: "no" + auto6: "no" + - name: Get current device coalesce + command: "ethtool --show-coalesce {{ interface }}" + register: ethtool_coalesce + - name: "ASSERT: The profile does not change the ethtool coalesce" + assert: + that: + - original_ethtool_coalesce.stdout == ethtool_coalesce.stdout + - name: >- + TEST: I can set rx-frames and adaptive-tx. + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + state: up + type: ethernet + ip: + dhcp4: "no" + auto6: "no" + ethtool: + coalesce: + rx_frames: 1 + tx_frames: 1 + - name: Get current device coalesce + command: "ethtool --show-coalesce {{ interface }}" + register: ethtool_coalesce + - name: + debug: + var: ethtool_coalesce.stdout_lines + - name: Assert device coalesce + assert: + that: + - >- + 'rx-frames: 1' in + ethtool_coalesce.stdout_lines + - >- + 'tx-frames: 1' in + ethtool_coalesce.stdout_lines + - name: "TEST: I can reset coalesce to their original value." + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + state: up + type: ethernet + ip: + dhcp4: "no" + auto6: "no" + - name: Get current device coalesce + command: "ethtool --show-coalesce {{ interface }}" + register: ethtool_coalesce + # Resetting the ethtools only works with NetworkManager + - name: "ASSERT: The profile does not change the ethtool coalesce" + assert: + that: + - original_ethtool_coalesce.stdout == ethtool_coalesce.stdout + when: + network_provider == 'nm' + always: + - block: + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: absent + state: down + ignore_errors: true + - include_tasks: tasks/manage_test_interface.yml + vars: + state: absent + tags: + - "tests::cleanup" diff --git a/roles/linux-system-roles.network/tests/playbooks/remove_profile.yml b/roles/linux-system-roles.network/tests/playbooks/remove_profile.yml new file mode 100644 index 0000000..a50e848 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/remove_profile.yml @@ -0,0 +1,10 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Remove {{ profile }} + hosts: all + vars: + network_connections: + - name: "{{ profile }}" + persistent_state: absent + roles: + - linux-system-roles.network diff --git a/roles/linux-system-roles.network/tests/playbooks/run_tasks.yml b/roles/linux-system-roles.network/tests/playbooks/run_tasks.yml new file mode 100644 index 0000000..ea56720 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/run_tasks.yml @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Run the tasklist {{ task }} + hosts: all + tasks: + - include_tasks: "{{ task }}" diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_802_1x.yml b/roles/linux-system-roles.network/tests/playbooks/tests_802_1x.yml new file mode 100644 index 0000000..9cce1ae --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_802_1x.yml @@ -0,0 +1,124 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + interface: 802-1x-test + tasks: + - name: "INIT: 802.1x tests" + debug: + msg: "##################################################" + - include_tasks: tasks/setup_802.1x.yml + - block: + - name: "TEST: 802.1x profile with private key password and ca cert" + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + interface_name: veth2 + state: up + type: ethernet + ip: + address: + - 203.0.113.2/24 + dhcp4: "no" + auto6: "no" + ieee802_1x: + identity: myhost + eap: tls + private_key: /etc/pki/tls/client.key + private_key_password: test + private_key_password_flags: + - none + client_cert: /etc/pki/tls/client.pem + ca_cert: /etc/pki/tls/cacert.pem + - name: "TEST: I can ping the EAP server" + command: ping -c1 203.0.113.1 + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: absent + state: down + - name: >- + TEST: 802.1x profile with unencrypted private key, + domain suffix match, and system ca certs + debug: + msg: "##################################################" + - name: Copy cacert to system truststore + copy: + src: cacert.pem + dest: /etc/pki/ca-trust/source/anchors/cacert.pem + mode: 0644 + - name: Update ca trust + command: update-ca-trust + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + interface_name: veth2 + state: up + type: ethernet + ip: + address: + - 203.0.113.2/24 + dhcp4: "no" + auto6: "no" + ieee802_1x: + identity: myhost + eap: tls + private_key: /etc/pki/tls/client.key.nocrypt + client_cert: /etc/pki/tls/client.pem + private_key_password_flags: + - not-required + system_ca_certs: True + domain_suffix_match: example.com + - name: "TEST: I can ping the EAP server" + command: ping -c1 203.0.113.1 + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: absent + state: down + + - include_tasks: tasks/test_802.1x_capath.yml + always: + - block: + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: absent + state: down + - name: br1 + persistent_state: absent + state: down + ignore_errors: true + - include_tasks: tasks/cleanup_802_1x_server.yml + - name: Remove test certificates + file: + state: absent + path: "/etc/pki/tls/{{ item }}" + with_items: + - client.key + - client.key.nocrypt + - client.pem + - cacert.pem + - name: Remove test CA + file: + state: absent + path: "{{ item }}" + with_items: + - /etc/pki/tls/my_ca_certs + - /etc/pki/ca-trust/source/anchors/cacert.pem + - name: Update ca trust + command: update-ca-trust + tags: + - "tests::cleanup" diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_802_1x_updated.yml b/roles/linux-system-roles.network/tests/playbooks/tests_802_1x_updated.yml new file mode 100644 index 0000000..82d5734 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_802_1x_updated.yml @@ -0,0 +1,13 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + tasks: + - name: Update NetworkManager + package: + name: NetworkManager + state: latest + - name: Restart NetworkManager + service: + name: NetworkManager + state: restarted +- import_playbook: tests_802_1x.yml diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_bond.yml b/roles/linux-system-roles.network/tests/playbooks/tests_bond.yml new file mode 100644 index 0000000..69f07f8 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_bond.yml @@ -0,0 +1,97 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + controller_profile: bond0 + controller_device: nm-bond + port1_profile: bond0.0 + dhcp_interface1: test1 + port2_profile: bond0.1 + dhcp_interface2: test2 + tasks: + - name: "INIT Prepare setup" + debug: + msg: "##################################################" + - import_tasks: tasks/create_test_interfaces_with_dhcp.yml + - import_tasks: tasks/assert_device_present.yml + vars: + interface: "{{ dhcp_interface1 }}" + - import_tasks: tasks/assert_device_present.yml + vars: + interface: "{{ dhcp_interface2 }}" + - block: + - name: "TEST Add Bond with 2 ports" + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + # Create a bond controller + - name: "{{ controller_profile }}" + state: up + type: bond + interface_name: "{{ controller_device }}" + bond: + mode: active-backup + miimon: 110 + # add an ethernet to the bond + - name: "{{ port1_profile }}" + state: up + type: ethernet + interface_name: "{{ dhcp_interface1 }}" + controller: "{{ controller_profile }}" + # add a second ethernet to the bond + - name: "{{ port2_profile }}" + state: up + type: ethernet + interface_name: "{{ dhcp_interface2 }}" + controller: "{{ controller_profile }}" + - import_tasks: tasks/assert_device_present.yml + vars: + interface: "{{ controller_device }}" + - include_tasks: tasks/assert_profile_present.yml + vars: + profile: "{{ item }}" + loop: + - "{{ controller_profile }}" + - "{{ port1_profile }}" + - "{{ port2_profile }}" + - command: grep 'Polling Interval' + /proc/net/bonding/{{ controller_device }} + name: "** TEST check polling interval" + register: result + until: "'110' in result.stdout" + - command: ip -4 a s {{ controller_device }} + name: "** TEST check IPv4" + register: result + until: "'192.0.2' in result.stdout" + retries: 20 + delay: 2 + - command: ip -6 a s {{ controller_device }} + name: "** TEST check IPv6" + register: result + until: "'2001' in result.stdout" + retries: 20 + delay: 2 + always: + - block: + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ port2_profile }}" + persistent_state: absent + state: down + - name: "{{ port1_profile }}" + persistent_state: absent + state: down + - name: "{{ controller_profile }}" + persistent_state: absent + state: down + ignore_errors: true + - command: ip link del {{ controller_device }} + ignore_errors: true + - import_tasks: tasks/remove_test_interfaces_with_dhcp.yml + tags: + - "tests::cleanup" diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_bond_deprecated.yml b/roles/linux-system-roles.network/tests/playbooks/tests_bond_deprecated.yml new file mode 100644 index 0000000..f37e19a --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_bond_deprecated.yml @@ -0,0 +1,97 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + controller_profile: bond0 + controller_device: nm-bond + port1_profile: bond0.0 + dhcp_interface1: test1 + port2_profile: bond0.1 + dhcp_interface2: test2 + tasks: + - name: "INIT Prepare setup" + debug: + msg: "##################################################" + - import_tasks: tasks/create_test_interfaces_with_dhcp.yml + - import_tasks: tasks/assert_device_present.yml + vars: + interface: "{{ dhcp_interface1 }}" + - import_tasks: tasks/assert_device_present.yml + vars: + interface: "{{ dhcp_interface2 }}" + - block: + - name: "TEST Add Bond with 2 ports using deprecated 'master' argument" + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + # Create a bond controller + - name: "{{ controller_profile }}" + state: up + type: bond + interface_name: "{{ controller_device }}" + bond: + mode: active-backup + miimon: 110 + # add an ethernet to the bond + - name: "{{ port1_profile }}" + state: up + type: ethernet + interface_name: "{{ dhcp_interface1 }}" + master: "{{ controller_profile }}" + # add a second ethernet to the bond + - name: "{{ port2_profile }}" + state: up + type: ethernet + interface_name: "{{ dhcp_interface2 }}" + master: "{{ controller_profile }}" + - import_tasks: tasks/assert_device_present.yml + vars: + interface: "{{ controller_device }}" + - include_tasks: tasks/assert_profile_present.yml + vars: + profile: "{{ item }}" + loop: + - "{{ controller_profile }}" + - "{{ port1_profile }}" + - "{{ port2_profile }}" + - command: grep 'Polling Interval' + /proc/net/bonding/{{ controller_device }} + name: "** TEST check polling interval" + register: result + until: "'110' in result.stdout" + - command: ip -4 a s {{ controller_device }} + name: "** TEST check IPv4" + register: result + until: "'192.0.2' in result.stdout" + retries: 20 + delay: 2 + - command: ip -6 a s {{ controller_device }} + name: "** TEST check IPv6" + register: result + until: "'2001' in result.stdout" + retries: 20 + delay: 2 + always: + - block: + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ port2_profile }}" + persistent_state: absent + state: down + - name: "{{ port1_profile }}" + persistent_state: absent + state: down + - name: "{{ controller_profile }}" + persistent_state: absent + state: down + ignore_errors: true + - command: ip link del {{ controller_device }} + ignore_errors: true + - import_tasks: tasks/remove_test_interfaces_with_dhcp.yml + tags: + - "tests::cleanup" diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_bridge.yml b/roles/linux-system-roles.network/tests/playbooks/tests_bridge.yml new file mode 100644 index 0000000..d79d6ad --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_bridge.yml @@ -0,0 +1,55 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Test configuring bridges + hosts: all + vars: + interface: LSR-TST-br31 + + tasks: + - name: "set interface={{ interface }}" + set_fact: + interface: "{{ interface }}" + - include_tasks: tasks/show_interfaces.yml + - include_tasks: tasks/assert_device_absent.yml + +- name: Add test bridge + hosts: all + vars: + network_connections: + - name: "{{ interface }}" + interface_name: "{{ interface }}" + state: up + type: bridge + ip: + dhcp4: no + auto6: yes + roles: + - linux-system-roles.network + +- import_playbook: run_tasks.yml + vars: + task: tasks/assert_device_present.yml + +- import_playbook: run_tasks.yml + vars: + profile: "{{ interface }}" + task: tasks/assert_profile_present.yml + +- import_playbook: down_profile.yml + vars: + profile: "{{ interface }}" +# FIXME: assert profile/device down + +- import_playbook: remove_profile.yml + vars: + profile: "{{ interface }}" + +- import_playbook: run_tasks.yml + vars: + profile: "{{ interface }}" + task: tasks/assert_profile_absent.yml + +# FIXME: Devices might still be left when profile is absent +# - import_playbook: run_tasks.yml +# vars: +# task: tasks/assert_device_absent.yml diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_checkpoint_cleanup.yml b/roles/linux-system-roles.network/tests/playbooks/tests_checkpoint_cleanup.yml new file mode 100644 index 0000000..18e3fd7 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_checkpoint_cleanup.yml @@ -0,0 +1,82 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This test is supposed to check that checkpoints are properly cleaned-up after +# failures in the module. This test currently uses the initscripts provider to +# mark a device as unmanaged for NM and then tries to activiate it using NM. +# This failed without removing the checkpoint. +--- +- hosts: all + vars: + interface: cptstbr + profile: "{{ interface }}" + network_provider: nm + pre_tasks: + - debug: + msg: Inside states tests + - include_tasks: tasks/show_interfaces.yml + - include_tasks: tasks/assert_device_absent.yml + roles: + - linux-system-roles.network + tasks: + - block: + # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1832897 + - package: + name: dbus-tools + state: present + # create test profile + - include_role: + name: linux-system-roles.network + vars: + network_provider: initscripts + network_connections: + - name: "{{ interface }}" + state: up + type: bridge + ip: + dhcp4: false + auto6: false + - include_tasks: tasks/assert_device_present.yml + - include_tasks: tasks/assert_profile_present.yml + # Use internal module directly for speedup + - network_connections: + provider: nm + connections: + - name: "{{ interface }}" + state: up + type: bridge + ip: + dhcp4: false + auto6: false + ignore_errors: true + register: error_trigger + - assert: + fail_msg: The module call did not fail. Therefore the test + condition was not triggered. This test needs to be adjusted or + dropped. + that: error_trigger.failed + # yamllint disable-line rule:line-length + - command: busctl --system tree --list org.freedesktop.NetworkManager + register: nm_dbus_objects + - debug: + var: nm_dbus_objects + - name: Assert that no checkpoints are left + assert: + fail_msg: Checkpoints not cleaned up + that: > + '/org/freedesktop/NetworkManager/Checkpoint/' not in + nm_dbus_objects.stdout_lines + always: + - block: + # Use internal module directly for speedup + - network_connections: + provider: nm + connections: + - name: "{{ interface }}" + persistent_state: absent + state: down + - file: + dest: "/etc/sysconfig/network-scripts/ifcfg-{{ interface }}" + state: absent + - command: ip link del "{{ interface }}" + ignore_errors: true + tags: + - "tests::cleanup" diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_dummy.yml b/roles/linux-system-roles.network/tests/playbooks/tests_dummy.yml new file mode 100644 index 0000000..8fe8762 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_dummy.yml @@ -0,0 +1,30 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + interface: dummy0 + profile: "{{ interface }}" + lsr_fail_debug: + - __network_connections_result + tasks: + - debug: + msg: "this is: playbooks/tests_dummy.yml" + tags: + - always + + - block: + - include_tasks: tasks/run_test.yml + vars: + lsr_description: Create a dummy interface + lsr_setup: + - tasks/delete_interface.yml + - tasks/assert_device_absent.yml + lsr_test: + - tasks/create_dummy_profile.yml + lsr_assert: + - tasks/assert_profile_present.yml + - tasks/assert_device_present.yml + lsr_cleanup: + - tasks/cleanup_profile+device.yml + tags: + - tests::dummy:create diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_eth_dns_support.yml b/roles/linux-system-roles.network/tests/playbooks/tests_eth_dns_support.yml new file mode 100644 index 0000000..0fe5c09 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_eth_dns_support.yml @@ -0,0 +1,110 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + +- name: Test configuring ethernet devices + hosts: all + vars: + type: veth + interface: ethtest0 + + + tasks: + - name: "set type={{ type }} and interface={{ interface }}" + set_fact: + type: "{{ type }}" + interface: "{{ interface }}" + - include_tasks: tasks/show_interfaces.yml + - include_tasks: tasks/manage_test_interface.yml + vars: + state: present + - include_tasks: tasks/assert_device_present.yml + + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + interface_name: "{{ interface }}" + state: up + type: ethernet + autoconnect: yes + ip: + route_metric4: 100 + dhcp4: no + gateway4: 192.0.2.1 + dns: + - 192.0.2.2 + - 198.51.100.5 + dns_search: + - example.com + - example.org + dns_options: + - rotate + - timeout:1 + + route_metric6: -1 + auto6: no + gateway6: 2001:db8::1 + + address: + - 192.0.2.3/24 + - 198.51.100.3/26 + - 2001:db8::80/7 + + route: + - network: 198.51.100.128 + prefix: 26 + gateway: 198.51.100.1 + metric: 2 + - network: 198.51.100.64 + prefix: 26 + gateway: 198.51.100.6 + metric: 4 + route_append_only: no + rule_append_only: yes + + - name: Verify nmcli connection DNS entry + shell: | + set -euxo pipefail + nmcli connection show {{ interface }} | grep ipv4.dns + register: ipv4_dns + ignore_errors: yes + + - name: "Assert that DNS addresses are configured correctly" + assert: + that: + - "'192.0.2.2' in ipv4_dns.stdout" + - "'198.51.100.5' in ipv4_dns.stdout" + msg: "DNS addresses are configured incorrectly" + + - name: "Assert that DNS search domains are configured correctly" + assert: + that: + - "'example.com' in ipv4_dns.stdout" + - "'example.org' in ipv4_dns.stdout" + msg: "DNS search domains are configured incorrectly" + + - name: "Assert that DNS options are configured correctly" + assert: + that: + - "'rotate' in ipv4_dns.stdout" + - "'timeout:1' in ipv4_dns.stdout" + msg: "DNS options are configured incorrectly" + +- import_playbook: down_profile.yml + vars: + profile: "{{ interface }}" +# FIXME: assert profile/device down +- import_playbook: remove_profile.yml + vars: + profile: "{{ interface }}" +# FIXME: assert profile away +- name: Remove interfaces + hosts: all + tasks: + - include_tasks: tasks/manage_test_interface.yml + vars: + state: absent + - include_tasks: tasks/assert_device_absent.yml +... diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_ethernet.yml b/roles/linux-system-roles.network/tests/playbooks/tests_ethernet.yml new file mode 100644 index 0000000..cd02579 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_ethernet.yml @@ -0,0 +1,64 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + tasks: + - debug: + msg: Inside ethernet tests + - debug: + var: network_provider + +- name: Test configuring ethernet devices + hosts: all + vars: + type: veth + interface: lsr27 + + tasks: + - name: "set type={{ type }} and interface={{ interface }}" + set_fact: + type: "{{ type }}" + interface: "{{ interface }}" + - include_tasks: tasks/show_interfaces.yml + - include_tasks: tasks/manage_test_interface.yml + vars: + state: present + - include_tasks: tasks/assert_device_present.yml + +- name: Test static interface up + hosts: all + vars: + network_connections: + - name: "{{ interface }}" + interface_name: "{{ interface }}" + state: up + type: ethernet + autoconnect: yes + ip: + address: 192.0.2.1/24 + roles: + - linux-system-roles.network + tasks: + - include_tasks: tasks/assert_output_in_stderr_without_warnings.yml + +- hosts: all + tasks: + - debug: + var: network_provider + +# FIXME: assert profile present +# FIXME: assert profile/device up + IP address +- import_playbook: down_profile.yml + vars: + profile: "{{ interface }}" +# FIXME: assert profile/device down +- import_playbook: remove_profile.yml + vars: + profile: "{{ interface }}" +# FIXME: assert profile away +- name: Remove interfaces + hosts: all + tasks: + - include_tasks: tasks/manage_test_interface.yml + vars: + state: absent + - include_tasks: tasks/assert_device_absent.yml diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_ethtool_coalesce.yml b/roles/linux-system-roles.network/tests/playbooks/tests_ethtool_coalesce.yml new file mode 100644 index 0000000..62ff0e1 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_ethtool_coalesce.yml @@ -0,0 +1,102 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + interface: testnic1 + type: veth + tasks: + - debug: + msg: "this is: playbooks/tests_ethtool_.coalesceyml" + tags: + - always + + - name: "INIT: Ethtool coalesce tests" + debug: + msg: "##################################################" + - include_tasks: tasks/show_interfaces.yml + - include_tasks: tasks/manage_test_interface.yml + vars: + state: present + - include_tasks: tasks/assert_device_present.yml + - name: Install ethtool (test dependency) + package: + name: ethtool + state: present + + - block: + - name: >- + TEST: I can create a profile without any coalescing option. + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + type: ethernet + autoconnect: no + ip: + dhcp4: no + auto6: no + - name: Get profile's coalescing options + command: nmcli -g ethtool.coalesce-rx-frames c show {{ interface }} + register: no_coalesce + - name: "ASSERT: The profile does not contain coalescing options" + assert: + that: no_coalesce.stdout == "" + - name: >- + TEST: I can set rx-frames. + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + type: ethernet + autoconnect: no + ip: + dhcp4: no + auto6: no + ethtool: + coalesce: + rx_frames: 128 + - name: Get profile's coalescing options + command: nmcli -g ethtool.coalesce-rx-frames c show {{ interface }} + register: with_coalesce + - name: Assert coalesce options set in profile + assert: + that: with_coalesce.stdout == '128' + - name: "TEST: I can clear coalescing options" + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + type: ethernet + autoconnect: no + ip: + dhcp4: no + auto6: no + - name: Get profile's coalescing options + command: nmcli -g ethtool.coalesce-rx-frames c show {{ interface }} + register: profile + - name: "ASSERT: The profile does reset coalescing options" + assert: + that: no_coalesce.stdout == "" + always: + - block: + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: absent + ignore_errors: true + - include_tasks: tasks/manage_test_interface.yml + vars: + state: absent + tags: + - "tests::cleanup" diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_ipv6.yml b/roles/linux-system-roles.network/tests/playbooks/tests_ipv6.yml new file mode 100644 index 0000000..98d98d1 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_ipv6.yml @@ -0,0 +1,94 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + type: veth + interface: veth0 + tasks: + - include_tasks: tasks/show_interfaces.yml + - include_tasks: tasks/manage_test_interface.yml + vars: + state: present + - name: Set up gateway ip on veth peer + shell: | + ip netns add ns1 + ip link set peer{{ interface }} netns ns1 + ip netns exec ns1 ip -6 addr add 2001:db8::1/32 dev peer{{ interface }} + ip netns exec ns1 ip link set peer{{ interface }} up + when: + # netns not available on RHEL/CentOS 6 + - ansible_distribution_major_version != '6' + - block: + - name: >- + TEST: I can configure an interface with static ipv6 config + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + type: ethernet + state: up + ip: + dhcp4: false + auto6: false + address: + - "2001:db8::2/32" + - "2001:db8::3/32" + - "2001:db8::4/32" + gateway6: "2001:db8::1" + - include_tasks: tasks/assert_device_present.yml + - include_tasks: tasks/assert_profile_present.yml + vars: + profile: "{{ interface }}" + - name: Get ip address information + command: "ip addr show {{ interface }}" + register: ip_addr + - name: + debug: + var: ip_addr.stdout + - name: Assert ipv6 addresses are correctly set + assert: + that: + - >- + 'inet6 2001:db8::2/32' in ip_addr.stdout + - >- + 'inet6 2001:db8::3/32' in ip_addr.stdout + - >- + 'inet6 2001:db8::4/32' in ip_addr.stdout + - name: Get ipv6 routes + command: "ip -6 route" + register: ipv6_route + - name: + debug: + var: ipv6_route.stdout + - name: Assert default ipv6 route is set + assert: + that: + - >- + "default via 2001:db8::1 dev {{ interface }}" + in ipv6_route.stdout + - name: Test gateway can be pinged + command: ping6 -c1 2001:db8::1 + when: + - ansible_distribution_major_version != '6' + always: + - name: "TEARDOWN: remove profiles." + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: absent + state: down + ignore_errors: true + - include_tasks: tasks/manage_test_interface.yml + vars: + state: absent + - name: Clean up namespace + command: ip netns delete ns1 + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_ipv6_disabled.yml b/roles/linux-system-roles.network/tests/playbooks/tests_ipv6_disabled.yml new file mode 100644 index 0000000..590b346 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_ipv6_disabled.yml @@ -0,0 +1,60 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + +- name: Test configuring ethernet devices + hosts: all + vars: + type: veth + interface: ethtest0 + + tasks: + - name: "set type={{ type }} and interface={{ interface }}" + set_fact: + type: "{{ type }}" + interface: "{{ interface }}" + - include_tasks: tasks/show_interfaces.yml + - include_tasks: tasks/manage_test_interface.yml + vars: + state: present + - include_tasks: tasks/assert_device_present.yml + + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + interface_name: "{{ interface }}" + type: ethernet + ip: + ipv6_disabled: true + + - name: Verify nmcli connection ipv6.method + shell: | + set -euxo pipefail + nmcli connection show {{ interface }} | grep ipv6.method + register: ipv6_method + ignore_errors: yes + + - name: "Assert that ipv6.method disabled is configured correctly" + assert: + that: + - "'disabled' in ipv6_method.stdout" + msg: "ipv6.method disabled is configured incorrectly" + +- import_playbook: down_profile.yml + vars: + profile: "{{ interface }}" +# FIXME: assert profile/device down +- import_playbook: remove_profile.yml + vars: + profile: "{{ interface }}" +# FIXME: assert profile away +- name: Remove interfaces + hosts: all + tasks: + - include_tasks: tasks/manage_test_interface.yml + vars: + state: absent + - include_tasks: tasks/assert_device_absent.yml +... diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_provider.yml b/roles/linux-system-roles.network/tests/playbooks/tests_provider.yml new file mode 100644 index 0000000..1db2d08 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_provider.yml @@ -0,0 +1,35 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + interface: testnic1 + profile: "{{ interface }}" + lsr_fail_debug: + - __network_connections_result + tasks: + - debug: + msg: "this is: playbooks/tests_states.yml" + tags: + - always + + + - block: + - include_tasks: tasks/run_test.yml + vars: + state: present + lsr_description: I can manage a veth interface with NM after I + managed it with initscripts. + lsr_setup: + - tasks/setup_test_interface.yml + # run role once with defaults but nm provider to ensure that + # NetworKManager is running + - tasks/provider/default_with_nm.yml + - tasks/provider/create_and_remove_with_initscripts.yml + lsr_test: + - tasks/provider/create_with_nm.yml + lsr_assert: + - tasks/assert_profile_present.yml + lsr_cleanup: + - tasks/cleanup_profile+device.yml + tags: + - tests::provider:initscripts_to_nm diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_reapply.yml b/roles/linux-system-roles.network/tests/playbooks/tests_reapply.yml new file mode 100644 index 0000000..4b1cb09 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_reapply.yml @@ -0,0 +1,66 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This test should check whether the NMDevice.reapply method is called by the +# role. This is probably a good candidate to test with pytest directly instead +# of via Ansible. Until there is better test support for this, just check the +# log output for the respective log message. +--- +- hosts: all + vars: + interface: rpltstbr + profile: "{{ interface }}" + network_provider: nm + pre_tasks: + - debug: + msg: Inside states tests + - include_tasks: tasks/show_interfaces.yml + - include_tasks: tasks/assert_device_absent.yml + roles: + - linux-system-roles.network + tasks: + - block: + # create test profile + - include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + state: up + type: bridge + ip: + dhcp4: false + auto6: false + - include_tasks: tasks/assert_device_present.yml + - include_tasks: tasks/assert_profile_present.yml + # Use internal module to get output + - network_connections: + provider: nm + connections: + - name: "{{ interface }}" + state: up + type: bridge + ip: + address: + - 192.0.2.72/31 + dhcp4: false + auto6: false + ignore_errors: true + register: test_module_run + - debug: + var: test_module_run + - name: Assert that reapply is found in log output + assert: + fail_msg: Reapply not found in log output + that: "{{ 'connection reapplied' in test_module_run.stderr }}" + always: + - block: + # Use internal module directly for speedup + - network_connections: + provider: nm + connections: + - name: "{{ interface }}" + persistent_state: absent + state: down + - command: ip link del "{{ interface }}" + ignore_errors: true + tags: + - "tests::cleanup" diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_team.yml b/roles/linux-system-roles.network/tests/playbooks/tests_team.yml new file mode 100644 index 0000000..67a7b80 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_team.yml @@ -0,0 +1,30 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + interface: team0 + profile: "{{ interface }}" + lsr_fail_debug: + - __network_connections_result + tasks: + - debug: + msg: "this is: playbooks/tests_team.yml" + tags: + - always + + - block: + - include_tasks: tasks/run_test.yml + vars: + lsr_description: Create a team interface without any port attached + lsr_setup: + - tasks/delete_interface.yml + - tasks/assert_device_absent.yml + lsr_test: + - tasks/create_team_profile.yml + lsr_assert: + - tasks/assert_profile_present.yml + - tasks/assert_device_present.yml + lsr_cleanup: + - tasks/cleanup_profile+device.yml + tags: + - tests::team:create diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_team_plugin_installation.yml b/roles/linux-system-roles.network/tests/playbooks/tests_team_plugin_installation.yml new file mode 100644 index 0000000..88690a3 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_team_plugin_installation.yml @@ -0,0 +1,40 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + tasks: + - name: remove the NetworkManager-team package + package: + name: "NetworkManager-team" + state: absent + + - name: "get the rpm package facts" + package_facts: + manager: "auto" + + - name: "Assert NetworkManager-team removed before team configuration" + assert: + that: + - "'NetworkManager-team' not in ansible_facts.packages" + msg: "NetworkManager-team is not removed before team configuration" + + - name: "Team interface configuration" + include_role: + name: linux-system-roles.network + vars: + network_connections: + # Specify the team profile + - name: team0 + persistent_state: present + type: team + interface_name: team0 + + - name: "get the rpm package facts" + package_facts: + manager: "auto" + + - name: "Assert NetworkManager-team is installed after team configuration" + assert: + that: + - "'NetworkManager-team' in ansible_facts.packages" + msg: "NetworkManager-team is not installed after team configuration" +... diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_wireless.yml b/roles/linux-system-roles.network/tests/playbooks/tests_wireless.yml new file mode 100644 index 0000000..822a15e --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_wireless.yml @@ -0,0 +1,88 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + vars: + interface: wlan0 + tasks: + - name: "INIT: wireless tests" + debug: + msg: "##################################################" + - include_tasks: tasks/setup_mock_wifi.yml + - name: Copy client certs + copy: + src: "{{ item }}" + dest: "/etc/pki/tls/{{ item }}" + mode: 0644 + with_items: + - client.key + - client.pem + - cacert.pem + - block: + - name: "TEST: wireless connection with WPA-PSK" + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_allow_restart: true + network_connections: + - name: "{{ interface }}" + state: up + type: wireless + ip: + address: + - 203.0.113.2/24 + dhcp4: "no" + auto6: "no" + wireless: + ssid: "mock_wifi" + key_mgmt: "wpa-psk" + password: "p@55w0rD" + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: absent + state: down + - name: "TEST: wireless connection with 802.1x TLS-EAP" + debug: + msg: "##################################################" + - import_role: + name: linux-system-roles.network + vars: + network_allow_restart: true + network_connections: + - name: "{{ interface }}" + state: up + type: wireless + ip: + address: + - 203.0.113.2/24 + dhcp4: "no" + auto6: "no" + wireless: + ssid: "mock_wifi" + key_mgmt: "wpa-eap" + ieee802_1x: + identity: myhost + eap: tls + private_key: /etc/pki/tls/client.key + private_key_password: test + private_key_password_flags: + - none + client_cert: /etc/pki/tls/client.pem + ca_cert: /etc/pki/tls/cacert.pem + always: + - block: + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: absent + state: down + ignore_errors: true + - include_tasks: tasks/cleanup_mock_wifi.yml + tags: + - "tests::cleanup" diff --git a/roles/linux-system-roles.network/tests/playbooks/tests_wireless_plugin_installation.yml b/roles/linux-system-roles.network/tests/playbooks/tests_wireless_plugin_installation.yml new file mode 100644 index 0000000..8288bc7 --- /dev/null +++ b/roles/linux-system-roles.network/tests/playbooks/tests_wireless_plugin_installation.yml @@ -0,0 +1,40 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + tasks: + - name: remove the NetworkManager-wifi package + package: + name: "NetworkManager-wifi" + state: absent + + - name: "get the rpm package facts" + package_facts: + manager: "auto" + + - name: "Assert NetworkManager-wifi removed before wireless configuration" + assert: + that: + - "'NetworkManager-wifi' not in ansible_facts.packages" + msg: "NetworkManager-wifi is not removed before wirelss configuration" + + - name: "wireless configuration" + include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: wlan0 + type: wireless + wireless: + ssid: "My WPA2-PSK Network" + key_mgmt: "wpa-psk" + password: "p@55w0rD" + + - name: "get the rpm package facts" + package_facts: + manager: "auto" + + - name: "Assert NetworkManager-wifi installed after wireless configuration" + assert: + that: + - "'NetworkManager-wifi' in ansible_facts.packages" + msg: "NetworkManager-wifi is not installed after wireless configured" diff --git a/roles/linux-system-roles.network/tests/setup_module_utils.sh b/roles/linux-system-roles.network/tests/setup_module_utils.sh new file mode 100755 index 0000000..18d6a00 --- /dev/null +++ b/roles/linux-system-roles.network/tests/setup_module_utils.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# SPDX-License-Identifier: MIT + +set -euo pipefail + +if [ -n "${DEBUG:-}" ] ; then + set -x +fi + +if [ ! -d "${1:-}" ] ; then + echo Either ansible is not installed, or there is no ansible/module_utils + echo in $1 - Skipping + exit 0 +fi + +if [ ! -d "${2:-}" ] ; then + echo Role has no module_utils - Skipping + exit 0 +fi + +# we need absolute path for $2 +absmoddir=$( readlink -f "$2" ) + +# clean up old links to module_utils +for item in "$1"/* ; do + if lnitem=$( readlink "$item" ) && test -n "$lnitem" ; then + case "$lnitem" in + *"${2}"*) rm -f "$item" ;; + esac + fi +done + +# add new links to module_utils +for item in "$absmoddir"/* ; do + case "$item" in + *__pycache__) continue;; + *.pyc) continue;; + esac + bnitem=$( basename "$item" ) + ln -s "$item" "$1/$bnitem" +done diff --git a/roles/linux-system-roles.network/tests/tasks/activate_profile.yml b/roles/linux-system-roles.network/tests/tasks/activate_profile.yml new file mode 100644 index 0000000..dea878c --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/activate_profile.yml @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + state: up +... diff --git a/roles/linux-system-roles.network/tests/tasks/assert_device_absent.yml b/roles/linux-system-roles.network/tests/tasks/assert_device_absent.yml new file mode 100644 index 0000000..39fa30a --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/assert_device_absent.yml @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include: get_interface_stat.yml +- name: "assert that interface {{ interface }} is absent" + assert: + that: not interface_stat.stat.exists + msg: "{{ interface }} exists" diff --git a/roles/linux-system-roles.network/tests/tasks/assert_device_present.yml b/roles/linux-system-roles.network/tests/tasks/assert_device_present.yml new file mode 100644 index 0000000..583b729 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/assert_device_present.yml @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include: get_interface_stat.yml +- name: "assert that interface {{ interface }} is present" + assert: + that: interface_stat.stat.exists + msg: "{{ interface }} does not exist" diff --git a/roles/linux-system-roles.network/tests/tasks/assert_output_in_stderr_without_warnings.yml b/roles/linux-system-roles.network/tests/tasks/assert_output_in_stderr_without_warnings.yml new file mode 100644 index 0000000..d760d3d --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/assert_output_in_stderr_without_warnings.yml @@ -0,0 +1,12 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: "Assert that warnings is empty" + assert: + that: + - "'warnings' not in __network_connections_result" + msg: "There are unexpected warnings" +- name: "Assert that there is output in stderr" + assert: + that: + - "'stderr' in __network_connections_result" + msg: "There are no messages in stderr" diff --git a/roles/linux-system-roles.network/tests/tasks/assert_profile_absent.yml b/roles/linux-system-roles.network/tests/tasks/assert_profile_absent.yml new file mode 100644 index 0000000..13f6eb1 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/assert_profile_absent.yml @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include: get_profile_stat.yml +- name: "assert that profile '{{ profile }}' is absent" + assert: + that: not lsr_net_profile_exists + msg: "profile {{ profile }} does exist" diff --git a/roles/linux-system-roles.network/tests/tasks/assert_profile_present.yml b/roles/linux-system-roles.network/tests/tasks/assert_profile_present.yml new file mode 100644 index 0000000..8e3bb0b --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/assert_profile_present.yml @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include: get_profile_stat.yml +- name: "assert that profile '{{ profile }}' is present" + assert: + that: lsr_net_profile_exists + msg: "profile {{ profile }} does not exist" diff --git a/roles/linux-system-roles.network/tests/tasks/cleanup_802_1x_server.yml b/roles/linux-system-roles.network/tests/tasks/cleanup_802_1x_server.yml new file mode 100644 index 0000000..2d1a888 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/cleanup_802_1x_server.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Remove test interfaces + shell: | + ip netns delete ns1 + ip link delete veth1-br + ip link delete veth2-br + ip link delete br1 + +- name: Kill hostapd process + shell: pkill hostapd +- name: Remove certs and config + file: + state: absent + path: "{{ item }}" + with_items: + - /etc/pki/tls/hostapd_test + - /etc/hostapd/wired.conf + - /etc/hostapd/hostapd.eap_user diff --git a/roles/linux-system-roles.network/tests/tasks/cleanup_mock_wifi.yml b/roles/linux-system-roles.network/tests/tasks/cleanup_mock_wifi.yml new file mode 100644 index 0000000..a80f337 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/cleanup_mock_wifi.yml @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Unload mac80211_hwsim module + shell: modprobe -r mac80211_hwsim + +- name: Kill hostapd process + shell: pkill hostapd diff --git a/roles/linux-system-roles.network/tests/tasks/cleanup_profile+device.yml b/roles/linux-system-roles.network/tests/tasks/cleanup_profile+device.yml new file mode 100644 index 0000000..92d1eba --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/cleanup_profile+device.yml @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- shell: | + nmcli con delete {{ interface }} + nmcli con load /etc/sysconfig/network-scripts/ifcfg-{{ interface }} + rm -f /etc/sysconfig/network-scripts/ifcfg-{{ interface }} + ip link del {{ interface }} + ignore_errors: true +... diff --git a/roles/linux-system-roles.network/tests/tasks/create_and_remove_interface.yml b/roles/linux-system-roles.network/tests/tasks/create_and_remove_interface.yml new file mode 100644 index 0000000..7ed96d4 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/create_and_remove_interface.yml @@ -0,0 +1,20 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_tasks: show_interfaces.yml +- include_tasks: manage_test_interface.yml + vars: + state: absent +- include_tasks: show_interfaces.yml +- include_tasks: assert_device_absent.yml + +- include_tasks: manage_test_interface.yml + vars: + state: present +- include_tasks: show_interfaces.yml +- include_tasks: assert_device_present.yml + +- include_tasks: manage_test_interface.yml + vars: + state: absent +- include_tasks: show_interfaces.yml +- include_tasks: assert_device_absent.yml diff --git a/roles/linux-system-roles.network/tests/tasks/create_bridge_profile.yml b/roles/linux-system-roles.network/tests/tasks/create_bridge_profile.yml new file mode 100644 index 0000000..e846127 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/create_bridge_profile.yml @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: present + type: bridge + ip: + dhcp4: false + auto6: false +- debug: + var: __network_connections_result +... diff --git a/roles/linux-system-roles.network/tests/tasks/create_bridge_profile_no_autoconnect.yml b/roles/linux-system-roles.network/tests/tasks/create_bridge_profile_no_autoconnect.yml new file mode 100644 index 0000000..308f57d --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/create_bridge_profile_no_autoconnect.yml @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + autoconnect: false + persistent_state: present + type: bridge + ip: + dhcp4: false + auto6: false +- debug: + var: __network_connections_result +... diff --git a/roles/linux-system-roles.network/tests/tasks/create_dummy_profile.yml b/roles/linux-system-roles.network/tests/tasks/create_dummy_profile.yml new file mode 100644 index 0000000..950be6b --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/create_dummy_profile.yml @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + state: up + type: dummy + ip: + address: + - "192.0.2.42/30" +- debug: + var: __network_connections_result +... diff --git a/roles/linux-system-roles.network/tests/tasks/create_team_profile.yml b/roles/linux-system-roles.network/tests/tasks/create_team_profile.yml new file mode 100644 index 0000000..8bd36b0 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/create_team_profile.yml @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: present + type: team + ip: + dhcp4: false + auto6: false +- debug: + var: __network_connections_result +... diff --git a/roles/linux-system-roles.network/tests/tasks/create_test_interfaces_with_dhcp.yml b/roles/linux-system-roles.network/tests/tasks/create_test_interfaces_with_dhcp.yml new file mode 100644 index 0000000..97d27b3 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/create_test_interfaces_with_dhcp.yml @@ -0,0 +1,73 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Install dnsmasq + package: + name: dnsmasq + state: present + + +- name: Create test interfaces + shell: | + # NM to see veth devices starting with test* as managed after ip add.. + echo 'ENV{ID_NET_DRIVER}=="veth",\ + ENV{INTERFACE}=="test*", \ + ENV{NM_UNMANAGED}="0"' >/etc/udev/rules.d/88-veth.rules + udevadm control --reload-rules + udevadm settle --timeout=5 + + # Setuptwo devices with IPv4/IPv6 auto support + ip link add {{dhcp_interface1}} type veth peer name {{dhcp_interface1}}p + ip link set {{dhcp_interface1}}p up + ip link add {{dhcp_interface2}} type veth peer name {{dhcp_interface2}}p + ip link set {{dhcp_interface2}}p up + + # Create the 'testbr' - providing both 10.x ipv4 and 2620:52:0 ipv6 dhcp + ip link add name testbr type bridge forward_delay 0 + ip link set testbr up + ip addr add 192.0.2.1/24 dev testbr + ip -6 addr add 2001:DB8::1/32 dev testbr + + if grep 'release 6' /etc/redhat-release; then + # We need bridge-utils and radvd only in rhel6 + if ! rpm -q --quiet radvd; then yum -y install radvd; fi + if ! rpm -q --quiet bridge-utils; then yum -y install bridge-utils; fi + + # We need to add iptables rule to allow dhcp request + iptables -I INPUT -i testbr -p udp --dport 67:68 --sport 67:68 -j ACCEPT + + # Add {{dhcp_interface1}}, {{dhcp_interface2}} peers into the testbr + brctl addif testbr {{dhcp_interface1}}p + brctl addif testbr {{dhcp_interface2}}p + + # in RHEL6 /run is not present + mkdir -p /run + + # and dnsmasq does not support ipv6 + dnsmasq \ + --pid-file=/run/dhcp_testbr.pid \ + --dhcp-leasefile=/run/dhcp_testbr.lease \ + --dhcp-range=192.0.2.1,192.0.2.254,240 \ + --interface=testbr --bind-interfaces + + # start radvd for ipv6 + echo 'interface testbr {' > /etc/radvd.conf + echo ' AdvSendAdvert on;' >> /etc/radvd.conf + echo ' prefix 2001:DB8::/64 { ' >> /etc/radvd.conf + echo ' AdvOnLink on; }; ' >> /etc/radvd.conf + echo ' }; ' >> /etc/radvd.conf + + # enable ipv6 forwarding + sysctl -w net.ipv6.conf.all.forwarding=1 + service radvd restart + + else + ip link set {{dhcp_interface1}}p master testbr + ip link set {{dhcp_interface2}}p master testbr + # Run joint DHCP4/DHCP6 server with RA enabled in veth namespace + dnsmasq \ + --pid-file=/run/dhcp_testbr.pid \ + --dhcp-leasefile=/run/dhcp_testbr.lease \ + --dhcp-range=192.0.2.1,192.0.2.254,240 \ + --dhcp-range=2001:DB8::10,2001:DB8::1FF,slaac,64,240 \ + --enable-ra --interface=testbr --bind-interfaces + fi diff --git a/roles/linux-system-roles.network/tests/tasks/delete_interface.yml b/roles/linux-system-roles.network/tests/tasks/delete_interface.yml new file mode 100644 index 0000000..064e17f --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/delete_interface.yml @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: remove test interface if necessary + command: "ip link del {{ interface }}" + ignore_errors: true +... diff --git a/roles/linux-system-roles.network/tests/tasks/el_repo_setup.yml b/roles/linux-system-roles.network/tests/tasks/el_repo_setup.yml new file mode 100644 index 0000000..0656e8c --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/el_repo_setup.yml @@ -0,0 +1,26 @@ +# SPDX-License-Identifier: BSD-3-Clause +- name: Fix CentOS6 Base repo + copy: + dest: /etc/yum.repos.d/CentOS-Base.repo + content: | + [base] + name=CentOS-$releasever - Base + baseurl=https://vault.centos.org/6.10/os/$basearch/ + gpgcheck=1 + gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6 + + [updates] + name=CentOS-$releasever - Updates + baseurl=https://vault.centos.org/6.10/updates/$basearch/ + gpgcheck=1 + gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6 + + [extras] + name=CentOS-$releasever - Extras + baseurl=https://vault.centos.org/6.10/extras/$basearch/ + gpgcheck=1 + gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6 + when: + - ansible_distribution == 'CentOS' + - ansible_distribution_major_version == '6' +- include_tasks: enable_epel.yml diff --git a/roles/linux-system-roles.network/tests/tasks/enable_epel.yml b/roles/linux-system-roles.network/tests/tasks/enable_epel.yml new file mode 100644 index 0000000..7924bd4 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/enable_epel.yml @@ -0,0 +1,24 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Enable EPEL {{ ansible_distribution_major_version }} + # yamllint disable-line rule:line-length + command: yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_distribution_major_version }}.noarch.rpm + args: + warn: false + creates: /etc/yum.repos.d/epel.repo + when: + - ansible_distribution in ['RedHat', 'CentOS'] + - ansible_distribution_major_version in ['7', '8'] + +- name: Enable EPEL 6 + copy: + dest: /etc/yum.repos.d/epel.repo + content: | + [epel] + name=Extra Packages for Enterprise Linux 6 - $basearch + baseurl=https://archives.fedoraproject.org/pub/archive/epel/6/$basearch + enabled=1 + gpgcheck=0 + when: + - ansible_distribution in ['RedHat', 'CentOS'] + - ansible_distribution_major_version == '6' diff --git a/roles/linux-system-roles.network/tests/tasks/get_NetworkManager_NVR.yml b/roles/linux-system-roles.network/tests/tasks/get_NetworkManager_NVR.yml new file mode 100644 index 0000000..6e0b4e6 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/get_NetworkManager_NVR.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- block: + - name: Get NetworkManager RPM version + command: + cmd: rpm -qa --qf '%{name}-%{version}-%{release}\n' NetworkManager + warn: false + register: __rpm_q_NetworkManager + + - name: Store NetworkManager version + set_fact: + NetworkManager_NVR: "{{ __rpm_q_NetworkManager.stdout }}" + + - name: Show NetworkManager version + debug: + var: NetworkManager_NVR + tags: + - always +... diff --git a/roles/linux-system-roles.network/tests/tasks/get_current_interfaces.yml b/roles/linux-system-roles.network/tests/tasks/get_current_interfaces.yml new file mode 100644 index 0000000..33a4a76 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/get_current_interfaces.yml @@ -0,0 +1,8 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- command: ls -1 + args: + chdir: /sys/class/net + register: _current_interfaces +- set_fact: + current_interfaces: "{{ _current_interfaces.stdout_lines }}" diff --git a/roles/linux-system-roles.network/tests/tasks/get_interface_stat.yml b/roles/linux-system-roles.network/tests/tasks/get_interface_stat.yml new file mode 100644 index 0000000..a8b8e5b --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/get_interface_stat.yml @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: "Get stat for interface {{ interface }}" + stat: + get_attributes: false + get_checksum: false + get_mime: false + path: "/sys/class/net/{{ interface }}" + register: interface_stat diff --git a/roles/linux-system-roles.network/tests/tasks/get_modules_and_utils_paths.yml b/roles/linux-system-roles.network/tests/tasks/get_modules_and_utils_paths.yml new file mode 100644 index 0000000..c71f169 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/get_modules_and_utils_paths.yml @@ -0,0 +1,92 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: set collection paths + set_fact: + collection_paths: | + {{ + (lookup("env","ANSIBLE_COLLECTIONS_PATH").split(":") + + lookup("env","ANSIBLE_COLLECTIONS_PATHS").split(":") + + lookup("config", "COLLECTIONS_PATHS")) | + select | list + }} + +- name: set search paths + set_fact: + modules_search_path: | + {{ + (lookup("env", "ANSIBLE_LIBRARY").split(":") + + ["../../library", "../library"] + + lookup("config", "DEFAULT_MODULE_PATH")) | + select | list + }} + module_utils_search_path: | + {{ + (lookup("env", "ANSIBLE_MODULE_UTILS").split(":") + + ["../../module_utils", "../module_utils"] + + lookup("config", "DEFAULT_MODULE_UTILS_PATH")) | + select | list + }} + +# the output should be something like +# - path to parent directory to chdir to in order to use tar +# - relative path under parent directory to tar +# e.g. for the local role case +# - ../.. +# - library +# would translate to tar -C ../.. library +# for the collection case +# - /home/user/.ansible/collections +# - ansible_collections/fedora/linux_system_roles/plugins/modules +# would translate to tar -C /home/user/.ansible/collections \ +# ansible_collections/fedora/linux_system_roles/plugins/modules +- name: find parent directory and path of modules + shell: | + set -euxo pipefail + for dir in {{ modules_search_path | join(" ") }}; do + if [ -f "$dir/network_connections.py" ]; then + readlink -f "$(dirname "$dir")" + basename "$dir" + exit 0 + fi + done + for dir in {{ collection_paths | join(" ") }}; do + if [ ! -d "$dir" ]; then continue; fi + cd "$dir" + for subdir in ansible_collections/*/*/plugins/modules; do + if [ -f "$subdir/network_connections.py" ]; then + echo "$dir" + echo "$subdir" + exit 0 + fi + done + done + echo network_connections.py not found + exit 1 + delegate_to: localhost + register: modules_parent_and_dir + +- name: find parent directory and path of module_utils + shell: | + set -euxo pipefail + for dir in {{ module_utils_search_path | join(" ") }}; do + if [ -d "$dir/network_lsr" ]; then + readlink -f "$(dirname "$dir")" + basename "$dir" + exit 0 + fi + done + for dir in {{ collection_paths | join(" ") }}; do + if [ ! -d "$dir" ]; then continue; fi + cd "$dir" + for subdir in ansible_collections/*/*/plugins/module_utils; do + if [ -d "$subdir/network_lsr" ]; then + echo "$dir" + echo "$subdir" + exit 0 + fi + done + done + echo network_lsr not found + exit 1 + delegate_to: localhost + register: module_utils_parent_and_dir diff --git a/roles/linux-system-roles.network/tests/tasks/get_profile_stat.yml b/roles/linux-system-roles.network/tests/tasks/get_profile_stat.yml new file mode 100644 index 0000000..efe3a9e --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/get_profile_stat.yml @@ -0,0 +1,24 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- set_fact: lsr_net_profile_exists=false + +- name: stat profile file + stat: + get_attributes: false + get_checksum: false + get_mime: false + path: /etc/sysconfig/network-scripts/ifcfg-{{ profile }} + register: profile_stat + +- set_fact: lsr_net_profile_exists=true + when: profile_stat.stat.exists + +# When certain profile is marked as absent but still up, the `nmcli connection` +# still show it with FILENAME starting with /run. Only consider profile exists +# when its FILENAME is in /etc folder +- shell: nmcli -f NAME,FILENAME connection show |grep {{ profile }} | grep /etc + register: nm_profile_exists + ignore_errors: yes + +- set_fact: lsr_net_profile_exists=true + when: nm_profile_exists.rc == 0 diff --git a/roles/linux-system-roles.network/tests/tasks/manage_test_interface.yml b/roles/linux-system-roles.network/tests/tasks/manage_test_interface.yml new file mode 100644 index 0000000..f421c27 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/manage_test_interface.yml @@ -0,0 +1,59 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- fail: + msg: "state needs to be present or absent, not '{{ state }}'" + when: state not in ["present", "absent"] + +- fail: + msg: "type needs to be dummy, tap or veth, not '{{ type }}'" + when: type not in ["dummy", "tap", "veth"] + +- include: show_interfaces.yml + +- name: Install iproute + package: + name: iproute + state: present + +# veth +- name: Create veth interface {{ interface }} + command: "{{ item }}" + with_items: + - ip link add {{ interface }} type veth peer name peer{{ interface }} + - ip link set peer{{ interface }} up + - ip link set {{ interface }} up + when: "type == 'veth' and state == 'present' and + interface not in current_interfaces" +- name: Set up veth as managed by NetworkManager + shell: nmcli d set {{ interface }} managed true + # The varible for `network_provider` is not exists yet, + # just ignore error for initscripts + ignore_errors: yes + when: "type == 'veth' and state == 'present'" + +- name: Delete veth interface {{ interface }} + command: ip link del {{ interface }} type veth + when: "type == 'veth' and state == 'absent' and + interface in current_interfaces" + +# dummy +- name: Create dummy interface {{ interface }} + command: ip link add "{{ interface }}" type dummy + when: "type == 'dummy' and state == 'present' and + interface not in current_interfaces" + +- name: Delete dummy interface {{ interface }} + command: ip link del "{{ interface }}" type dummy + when: "type == 'dummy' and state == 'absent' and + interface in current_interfaces" + +# tap +- name: Create tap interface {{ interface }} + command: ip tuntap add dev {{ interface }} mode tap + when: "type == 'tap' and state == 'present' + and interface not in current_interfaces" + +- name: Delete tap interface {{ interface }} + command: ip tuntap del dev {{ interface }} mode tap + when: "type == 'tap' and state == 'absent' and + interface in current_interfaces" diff --git a/roles/linux-system-roles.network/tests/tasks/provider/create_and_remove_with_initscripts.yml b/roles/linux-system-roles.network/tests/tasks/provider/create_and_remove_with_initscripts.yml new file mode 100644 index 0000000..fd011cb --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/provider/create_and_remove_with_initscripts.yml @@ -0,0 +1,23 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + state: up + persistent_state: present + type: ethernet + autoconnect: yes + ip: + address: 192.0.2.1/24 + network_provider: initscripts +- include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + state: down + persistent_state: absent + network_provider: initscripts +... diff --git a/roles/linux-system-roles.network/tests/tasks/provider/create_with_nm.yml b/roles/linux-system-roles.network/tests/tasks/provider/create_with_nm.yml new file mode 100644 index 0000000..077841c --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/provider/create_with_nm.yml @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + state: up + persistent_state: present + type: ethernet + autoconnect: yes + ip: + address: 192.0.2.1/24 + network_provider: nm +... diff --git a/roles/linux-system-roles.network/tests/tasks/provider/default_with_nm.yml b/roles/linux-system-roles.network/tests/tasks/provider/default_with_nm.yml new file mode 100644 index 0000000..967bb7f --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/provider/default_with_nm.yml @@ -0,0 +1,8 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_role: + name: linux-system-roles.network + vars: + network_connections: [] + network_provider: nm +... diff --git a/roles/linux-system-roles.network/tests/tasks/remove+down_profile.yml b/roles/linux-system-roles.network/tests/tasks/remove+down_profile.yml new file mode 100644 index 0000000..99c0c8e --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/remove+down_profile.yml @@ -0,0 +1,10 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: absent + state: down +... diff --git a/roles/linux-system-roles.network/tests/tasks/remove_profile.yml b/roles/linux-system-roles.network/tests/tasks/remove_profile.yml new file mode 100644 index 0000000..a7dbc12 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/remove_profile.yml @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface }}" + persistent_state: absent +... diff --git a/roles/linux-system-roles.network/tests/tasks/remove_test_interfaces_with_dhcp.yml b/roles/linux-system-roles.network/tests/tasks/remove_test_interfaces_with_dhcp.yml new file mode 100644 index 0000000..59b13a6 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/remove_test_interfaces_with_dhcp.yml @@ -0,0 +1,25 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Remove test interfaces + shell: | + ip link delete {{dhcp_interface1}} + ip link delete {{dhcp_interface2}} + ip link delete testbr + + # Remove udev rule for NM to see veth devices starting with test*..... + rm -rf /etc/udev/rules.d/88-veth.rules + udevadm control --reload-rules + udevadm settle --timeout=5 + + +- name: Stop dnsmasq/radvd services + shell: | + pkill -F /run/dhcp_testbr.pid + rm -rf /run/dhcp_testbr.pid + rm -rf /run/dhcp_testbr.lease + if grep 'release 6' /etc/redhat-release; then + # Stop radvd server + service radvd stop + iptables -D INPUT -i testbr -p udp --dport 67:68 --sport 67:68 -j ACCEPT + + fi diff --git a/roles/linux-system-roles.network/tests/tasks/run_test.yml b/roles/linux-system-roles.network/tests/tasks/run_test.yml new file mode 100644 index 0000000..cc9676e --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/run_test.yml @@ -0,0 +1,68 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Run test + block: + - name: "TEST: {{ lsr_description }}" + debug: + msg: "########## {{ lsr_description }} ##########" + + - debug: + var: "{{ item }}" + loop: + - lsr_description + - lsr_setup + - lsr_test + - lsr_assert + - lsr_assert_when + - lsr_fail_debug + - lsr_cleanup + + - include_tasks: tasks/show_interfaces.yml + + - name: setup + include_tasks: "{{ item }}" + loop: "{{ lsr_setup }}" + tags: + - "tests::setup" + + - name: test + include_tasks: "{{ item }}" + loop: "{{ lsr_test }}" + tags: + - "tests::test" + + - name: asserts + include_tasks: "{{ item }}" + loop: "{{ lsr_assert }}" + tags: + - "tests::assert" + + - name: conditional asserts + include_tasks: "{{ item['what'] }}" + when: + - "{{ item['when'] }}" + loop: "{{ lsr_assert_when|default([]) }}" + + - name: "Success in test '{{ lsr_description }}'" + debug: + msg: "+++++ Success in test '{{ lsr_description }}' +++++" + + rescue: + - name: "Failure in test '{{ lsr_description }}'" + debug: + msg: "!!!!! Failure in test '{{ lsr_description }}' !!!!!" + + - debug: + var: "{{ item }}" + loop: "{{ lsr_fail_debug | default([]) }}" + + - fail: + msg: "!!!!! Failure in test '{{ lsr_description }}' !!!!!" + + always: + - name: cleanup + include_tasks: "{{ item }}" + loop: "{{ lsr_cleanup }}" + tags: + - "tests::cleanup" +... diff --git a/roles/linux-system-roles.network/tests/tasks/setup_802.1x.yml b/roles/linux-system-roles.network/tests/tasks/setup_802.1x.yml new file mode 100644 index 0000000..e83e049 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/setup_802.1x.yml @@ -0,0 +1,11 @@ +- include_tasks: tasks/setup_802_1x_server.yml +- name: Copy client certs + copy: + src: "{{ item }}" + dest: "/etc/pki/tls/{{ item }}" + mode: 0644 + with_items: + - client.key + - client.key.nocrypt + - client.pem + - cacert.pem diff --git a/roles/linux-system-roles.network/tests/tasks/setup_802_1x_server.yml b/roles/linux-system-roles.network/tests/tasks/setup_802_1x_server.yml new file mode 100644 index 0000000..49d1ce1 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/setup_802_1x_server.yml @@ -0,0 +1,75 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Install hostapd + package: + name: hostapd + state: present + +- name: Create directory for test certificates + file: + state: directory + path: /etc/pki/tls/hostapd_test +- name: Copy server certificates + copy: + src: "{{ item }}" + dest: "/etc/pki/tls/hostapd_test/{{ item }}" + with_items: + - server.key + - dh.pem + - server.pem + - cacert.pem + +- name: Create test interfaces + shell: | + ip link add veth1 type veth peer name veth1-br + ip link add veth2 type veth peer name veth2-br + + ip link add br1 type bridge + ip link set br1 up + + ip netns add ns1 + + ip link set veth1 netns ns1 + + ip netns exec ns1 ip addr add 203.0.113.1/24 dev veth1 + + ip link set veth1-br up + ip link set veth2-br up + + ip link set veth1-br master br1 + ip link set veth2-br master br1 + + ip netns exec ns1 ip link set veth1 up + ip link set veth2 up + + # Enable forwarding of EAP 802.1x messages through software bridge "br1". + echo 8 > /sys/class/net/br1/bridge/group_fwd_mask + +- name: Create hostapd config + copy: + content: | + interface=veth1 + driver=wired + debug=2 + ieee8021x=1 + eap_reauth_period=3600 + eap_server=1 + use_pae_group_addr=1 + eap_user_file=/etc/hostapd/hostapd.eap_user + ca_cert=/etc/pki/tls/hostapd_test/cacert.pem + dh_file=/etc/pki/tls/hostapd_test/dh.pem + server_cert=/etc/pki/tls/hostapd_test/server.pem + private_key=/etc/pki/tls/hostapd_test/server.key + private_key_passwd=test + logger_syslog=-1 + logger_syslog_level=0 + dest: /etc/hostapd/wired.conf + +- name: Create eap_user_file config + copy: + content: | + * TLS + dest: /etc/hostapd/hostapd.eap_user + +- name: Run hostapd in namespace + shell: ip netns exec ns1 hostapd -B /etc/hostapd/wired.conf && sleep 5 diff --git a/roles/linux-system-roles.network/tests/tasks/setup_mock_wifi.yml b/roles/linux-system-roles.network/tests/tasks/setup_mock_wifi.yml new file mode 100644 index 0000000..997b704 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/setup_mock_wifi.yml @@ -0,0 +1,82 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Install packages required to set up mock wifi network + package: + name: + - hostapd + - NetworkManager + - wpa_supplicant + state: present + +- name: Ensure NetworkManager is running + service: + name: NetworkManager + state: started + +- name: Copy server certificates + copy: + src: "{{ item }}" + dest: "/etc/pki/tls/{{ item }}" + with_items: + - server.key + - dh.pem + - server.pem + - cacert.pem + +- name: Create hostapd config + copy: + content: | + interface=wlan1 + driver=nl80211 + ctrl_interface=/var/run/hostapd + ctrl_interface_group=0 + ssid=mock_wifi + country_code=EN + hw_mode=g + channel=7 + auth_algs=3 + wpa=3 + ieee8021x=1 + eapol_version=1 + wpa_key_mgmt=WPA-EAP WPA-PSK + wpa_passphrase=p@55w0rD + eap_reauth_period=3600 + eap_server=1 + use_pae_group_addr=1 + eap_user_file=/etc/hostapd/hostapd.eap_user + ca_cert=/etc/pki/tls/cacert.pem + dh_file=/etc/pki/tls/dh.pem + server_cert=/etc/pki/tls/server.pem + private_key=/etc/pki/tls/server.key + private_key_passwd=test + logger_syslog=-1 + logger_syslog_level=0 + dest: /etc/hostapd/wireless.conf + +- name: Create eap_user_file config + copy: + content: | + * TLS + dest: /etc/hostapd/hostapd.eap_user + +- name: Load mac80211_hwsim kernel module to mock a wifi network + shell: modprobe mac80211_hwsim && sleep 5 + +- name: Restart NetworkManager and wpa_supplicant + service: + name: "{{ item }}" + state: restarted + with_items: + - NetworkManager + - wpa_supplicant + +- name: Configure wlan0 and wlan1 (mock wifi interfaces) + shell: | + ip link set up wlan0 + ip link set up wlan1 + nmcli device set wlan1 managed off + ip add add 203.0.113.1/24 dev wlan1 + sleep 5 + +- name: Start hostapd + shell: hostapd -B /etc/hostapd/wireless.conf && sleep 5 diff --git a/roles/linux-system-roles.network/tests/tasks/setup_test_interface.yml b/roles/linux-system-roles.network/tests/tasks/setup_test_interface.yml new file mode 100644 index 0000000..fb767f3 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/setup_test_interface.yml @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include_tasks: tasks/manage_test_interface.yml + vars: + state: present + type: veth +... diff --git a/roles/linux-system-roles.network/tests/tasks/show_interfaces.yml b/roles/linux-system-roles.network/tests/tasks/show_interfaces.yml new file mode 100644 index 0000000..6c2fbec --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/show_interfaces.yml @@ -0,0 +1,5 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- include: get_current_interfaces.yml +- debug: + msg: "current_interfaces: {{ current_interfaces }}" diff --git a/roles/linux-system-roles.network/tests/tasks/test_802.1x_capath.yml b/roles/linux-system-roles.network/tests/tasks/test_802.1x_capath.yml new file mode 100644 index 0000000..bae8e27 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tasks/test_802.1x_capath.yml @@ -0,0 +1,108 @@ +--- +- name: >- + TEST: 802.1x profile with unencrypted private key and ca_path + debug: + msg: "##################################################" +- set_fact: + # Fixed versions/NVRs: + # 1.25.2 + # NetworkManager-1.24.2-1.fc33 + # NetworkManager-1.22.14-1.fc32 + # NetworkManager-1.20.12-1.fc31 + # 1.18.8 + __NM_capath_ignored_NVRs: + - NetworkManager-1.18.0-5.el7.x86_64 + - NetworkManager-1.18.4-3.el7.x86_64 + - NetworkManager-1.20.0-3.el8.x86_64 + - NetworkManager-1.22.8-4.el8.x86_64 + - NetworkManager-1.20.4-1.fc31.x86_64 + - NetworkManager-1.22.10-1.fc32.x86_64 + - NetworkManager-1.22.12-1.fc32.x86_64 +- name: Create directory for ca_path test + file: + path: "/etc/pki/tls/my_ca_certs" + state: directory + mode: 0755 +- name: Copy cacert to ca_path + copy: + src: "cacert.pem" + dest: "/etc/pki/tls/my_ca_certs/cacert.pem" + mode: 0644 +- name: Install openssl (test dependency) + package: + name: openssl + state: present +- name: Hash cacert + command: openssl x509 -hash -noout + -in /etc/pki/tls/my_ca_certs/cacert.pem + register: cacert_hash +- name: Add symlink for cacert + file: + state: link + path: "/etc/pki/tls/my_ca_certs/{{ cacert_hash.stdout }}.0" + src: cacert.pem +- name: Get NetworkManager version + command: + cmd: rpm -qa NetworkManager + warn: false + register: __network_NM_NVR +- block: + - import_role: + name: linux-system-roles.network + vars: + network_connections: + - name: "{{ interface | default('802-1x-test') }}" + interface_name: veth2 + state: up + type: ethernet + ip: + address: + - 203.0.113.2/24 + dhcp4: "no" + auto6: "no" + ieee802_1x: + identity: myhost_capath + eap: tls + private_key: /etc/pki/tls/client.key.nocrypt + client_cert: /etc/pki/tls/client.pem + private_key_password_flags: + - not-required + ca_path: /etc/pki/tls/my_ca_certs + - name: "TEST: I can ping the EAP server" + command: ping -c1 203.0.113.1 + - name: trigger failure in case the role did not fail + fail: + msg: after test + rescue: + - debug: + var: "{{ item }}" + with_items: + - ansible_failed_result + - ansible_failed_task + - __network_NM_NVR.stdout + - __NM_capath_ignored_NVRs + + - name: Assert role behavior + vars: + expected_failure: __network_NM_NVR.stdout in __NM_capath_ignored_NVRs + failure: __network_connections_result.failed + assert: + that: (failure and expected_failure) or + (not failure and not expected_failure) + msg: "Role {{ failure and 'failed' or 'did not fail' }} but was expected + {{ expected_failure and '' or 'not' }} to fail. + NM NVR: {{ __network_NM_NVR.stdout }}" + - name: Assert role failure + assert: + that: " + 'ieee802_1x.ca_path specified but not supported by NetworkManager' + in __network_connections_result.stderr" + when: + - __network_connections_result.failed + + + - name: Assert ping succeeded + assert: + that: + - "not 'cmd' in ansible_failed_result" +... diff --git a/roles/linux-system-roles.network/tests/tests_802_1x_nm.yml b/roles/linux-system-roles.network/tests/tests_802_1x_nm.yml new file mode 100644 index 0000000..a27d8ea --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_802_1x_nm.yml @@ -0,0 +1,20 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_802_1x.yml' with nm as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_802_1x.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_802_1x_updated_nm.yml b/roles/linux-system-roles.network/tests/tests_802_1x_updated_nm.yml new file mode 100644 index 0000000..5a25f5b --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_802_1x_updated_nm.yml @@ -0,0 +1,20 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_802_1x_updated.yml' with nm as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_802_1x_updated.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_bond_deprecated_initscripts.yml b/roles/linux-system-roles.network/tests/tests_bond_deprecated_initscripts.yml new file mode 100644 index 0000000..1e74bcc --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_bond_deprecated_initscripts.yml @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +- hosts: all + name: Run playbook 'playbooks/tests_bond_deprecated.yml' with initscripts + tasks: + - include_tasks: tasks/el_repo_setup.yml + - name: Set network provider to 'initscripts' + set_fact: + network_provider: initscripts + tags: + - always + +- import_playbook: playbooks/tests_bond_deprecated.yml diff --git a/roles/linux-system-roles.network/tests/tests_bond_deprecated_nm.yml b/roles/linux-system-roles.network/tests/tests_bond_deprecated_nm.yml new file mode 100644 index 0000000..5a910a2 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_bond_deprecated_nm.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_bond_deprecated.yml' with nm as provider + tasks: + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_bond_deprecated.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_bond_initscripts.yml b/roles/linux-system-roles.network/tests/tests_bond_initscripts.yml new file mode 100644 index 0000000..32fcc32 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_bond_initscripts.yml @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +- hosts: all + name: Run playbook 'playbooks/tests_bond.yml' with initscripts as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + - name: Set network provider to 'initscripts' + set_fact: + network_provider: initscripts + tags: + - always + +- import_playbook: playbooks/tests_bond.yml diff --git a/roles/linux-system-roles.network/tests/tests_bond_nm.yml b/roles/linux-system-roles.network/tests/tests_bond_nm.yml new file mode 100644 index 0000000..7075d95 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_bond_nm.yml @@ -0,0 +1,20 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_bond.yml' with nm as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_bond.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_bridge_initscripts.yml b/roles/linux-system-roles.network/tests/tests_bridge_initscripts.yml new file mode 100644 index 0000000..8ce42e6 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_bridge_initscripts.yml @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +- hosts: all + name: Run playbook 'playbooks/tests_bridge.yml' with initscripts as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + - name: Set network provider to 'initscripts' + set_fact: + network_provider: initscripts + tags: + - always + +- import_playbook: playbooks/tests_bridge.yml diff --git a/roles/linux-system-roles.network/tests/tests_bridge_nm.yml b/roles/linux-system-roles.network/tests/tests_bridge_nm.yml new file mode 100644 index 0000000..3d1b53a --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_bridge_nm.yml @@ -0,0 +1,20 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_bridge.yml' with nm as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_bridge.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_default_initscripts.yml b/roles/linux-system-roles.network/tests/tests_default_initscripts.yml new file mode 100644 index 0000000..006889c --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_default_initscripts.yml @@ -0,0 +1,10 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + tasks: + - include_tasks: tasks/el_repo_setup.yml + - name: Set network provider to 'initscripts' + set_fact: + network_provider: initscripts + +- import_playbook: tests_default.yml diff --git a/roles/linux-system-roles.network/tests/tests_default_nm.yml b/roles/linux-system-roles.network/tests/tests_default_nm.yml new file mode 100644 index 0000000..54bc3e1 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_default_nm.yml @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + tasks: + - include_tasks: tasks/el_repo_setup.yml + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + +# The test should run with NetworkManager, therefore it cannot run on +# RHEL/CentOS 6 +- import_playbook: tests_default.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_dummy_nm.yml b/roles/linux-system-roles.network/tests/tests_dummy_nm.yml new file mode 100644 index 0000000..63bb99b --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_dummy_nm.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_dummy.yml' with nm as provider + tasks: + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_dummy.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_eth_dns_support_nm.yml b/roles/linux-system-roles.network/tests/tests_eth_dns_support_nm.yml new file mode 100644 index 0000000..b35284c --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_eth_dns_support_nm.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_eth_dns_support.yml' with nm as provider + tasks: + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_eth_dns_support.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_ethernet_initscripts.yml b/roles/linux-system-roles.network/tests/tests_ethernet_initscripts.yml new file mode 100644 index 0000000..366b052 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_ethernet_initscripts.yml @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +- hosts: all + name: Run playbook 'playbooks/tests_ethernet.yml' with initscripts as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + + - name: Set network provider to 'initscripts' + set_fact: + network_provider: initscripts + tags: + - always + +- import_playbook: playbooks/tests_ethernet.yml diff --git a/roles/linux-system-roles.network/tests/tests_ethernet_nm.yml b/roles/linux-system-roles.network/tests/tests_ethernet_nm.yml new file mode 100644 index 0000000..238172d --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_ethernet_nm.yml @@ -0,0 +1,21 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_ethernet.yml' with nm as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_ethernet.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_ethtool_coalesce_nm.yml b/roles/linux-system-roles.network/tests/tests_ethtool_coalesce_nm.yml new file mode 100644 index 0000000..f38294a --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_ethtool_coalesce_nm.yml @@ -0,0 +1,41 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_ethtool_coalesce.yml' with nm as provider + tasks: + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + - block: + - name: Install NetworkManager + package: + name: NetworkManager + state: present + - name: Get NetworkManager version + command: rpm -q --qf "%{version}" NetworkManager + args: + warn: false + register: NetworkManager_version + when: true + when: + - ansible_distribution_major_version != '6' + tags: + - always + + +# workaround for: https://github.com/ansible/ansible/issues/27973 +# There is no way in Ansible to abort a playbook hosts with specific OS +# releases Therefore we include the playbook with the tests only if the hosts +# would support it. +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_ethtool_coalesce.yml + when: + - ansible_distribution_major_version != '6' + + - NetworkManager_version.stdout is version('1.25.1', '>=') diff --git a/roles/linux-system-roles.network/tests/tests_helpers_and_asserts.yml b/roles/linux-system-roles.network/tests/tests_helpers_and_asserts.yml new file mode 100644 index 0000000..64e2875 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_helpers_and_asserts.yml @@ -0,0 +1,30 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- name: Check that creating and removing test devices and assertions work + hosts: all + tasks: + - include_tasks: tasks/el_repo_setup.yml + + - name: test veth interface management + include_tasks: tasks/create_and_remove_interface.yml + vars: + type: veth + interface: veth1298 + + - name: test veth interface management + include_tasks: tasks/create_and_remove_interface.yml + vars: + type: dummy + interface: dummy1298 + +# FIXME: when: does not seem to work with include_tasks, therefore this cannot +# be safely tested for now +# - name: test tap interfaces +# include_tasks: tasks/create_and_remove_interface.yml +# vars: +# - type: tap +# - interface: tap1298 +# when: ansible_distribution_major_version > 6 +# # ip tuntap does not exist on RHEL6 +# # FIXME: Maybe use some other tool to manage devices, openvpn can do +# # this, but it is in EPEL diff --git a/roles/linux-system-roles.network/tests/tests_integration_pytest.yml b/roles/linux-system-roles.network/tests/tests_integration_pytest.yml new file mode 100644 index 0000000..9b80bd4 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_integration_pytest.yml @@ -0,0 +1,10 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +- hosts: all + tasks: + - include_tasks: tasks/el_repo_setup.yml + +- import_playbook: playbooks/integration_pytest_python3.yml + when: (ansible_distribution in ["CentOS", "RedHat"] and + ansible_distribution_major_version == "8") or + ansible_distribution == "Fedora" diff --git a/roles/linux-system-roles.network/tests/tests_ipv6_disabled_nm.yml b/roles/linux-system-roles.network/tests/tests_ipv6_disabled_nm.yml new file mode 100644 index 0000000..24ee62d --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_ipv6_disabled_nm.yml @@ -0,0 +1,20 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_ipv6_disabled.yml' with nm as provider + tasks: + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_ipv6_disabled.yml + when: + - ansible_distribution_major_version != '6' + - ansible_distribution_major_version == '8' diff --git a/roles/linux-system-roles.network/tests/tests_ipv6_initscripts.yml b/roles/linux-system-roles.network/tests/tests_ipv6_initscripts.yml new file mode 100644 index 0000000..736a8e0 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_ipv6_initscripts.yml @@ -0,0 +1,13 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +- hosts: all + name: Run playbook 'playbooks/tests_ipv6.yml' with initscripts as provider + tasks: + - name: Set network provider to 'initscripts' + set_fact: + network_provider: initscripts + tags: + - always + +- import_playbook: playbooks/tests_ipv6.yml diff --git a/roles/linux-system-roles.network/tests/tests_ipv6_nm.yml b/roles/linux-system-roles.network/tests/tests_ipv6_nm.yml new file mode 100644 index 0000000..f186912 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_ipv6_nm.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_ipv6.yml' with nm as provider + tasks: + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_ipv6.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_provider_nm.yml b/roles/linux-system-roles.network/tests/tests_provider_nm.yml new file mode 100644 index 0000000..67fcffe --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_provider_nm.yml @@ -0,0 +1,39 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_provider.yml' with nm as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + - block: + - name: Install NetworkManager + package: + name: NetworkManager + state: present + - name: Get NetworkManager version + command: rpm -q --qf "%{version}" NetworkManager + args: + warn: false + register: NetworkManager_version + when: true + when: + - ansible_distribution_major_version != '6' + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_provider.yml + when: + - ansible_distribution_major_version != '6' + + - NetworkManager_version.stdout is version('1.20.0', '>=') diff --git a/roles/linux-system-roles.network/tests/tests_reapply_nm.yml b/roles/linux-system-roles.network/tests/tests_reapply_nm.yml new file mode 100644 index 0000000..eb48ddb --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_reapply_nm.yml @@ -0,0 +1,21 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_reapply.yml' with nm as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_reapply.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_regression_nm.yml b/roles/linux-system-roles.network/tests/tests_regression_nm.yml new file mode 100644 index 0000000..b2c46e9 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_regression_nm.yml @@ -0,0 +1,31 @@ +# SPDX-License-Identifier: BSD-3-Clause +--- +# set network provider and gather facts +- hosts: all + tasks: + - include_tasks: tasks/el_repo_setup.yml + + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + - name: Install NetworkManager + package: + name: NetworkManager + state: present + - name: Get NetworkManager version + command: rpm -q --qf "%{version}" NetworkManager + args: + warn: "no" + when: true + register: NetworkManager_version + +# workaround for: https://github.com/ansible/ansible/issues/27973 +# There is no way in Ansible to abort a playbook hosts with specific OS +# releases Therefore we include the playbook with the tests only if the hosts +# would support it. +# The test requires NetworkManager, therefore it cannot run on RHEL/CentOS 6 +- import_playbook: playbooks/tests_checkpoint_cleanup.yml + when: + - ansible_distribution_major_version != '6' + # The test depends on behavior that is only visible with newer NM + - NetworkManager_version.stdout is version('1.22.0', '>=') diff --git a/roles/linux-system-roles.network/tests/tests_states_initscripts.yml b/roles/linux-system-roles.network/tests/tests_states_initscripts.yml new file mode 100644 index 0000000..fa94103 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_states_initscripts.yml @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +- hosts: all + name: Run playbook 'playbooks/tests_states.yml' with initscripts as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + + - name: Set network provider to 'initscripts' + set_fact: + network_provider: initscripts + tags: + - always + +- import_playbook: playbooks/tests_states.yml diff --git a/roles/linux-system-roles.network/tests/tests_states_nm.yml b/roles/linux-system-roles.network/tests/tests_states_nm.yml new file mode 100644 index 0000000..34c8a24 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_states_nm.yml @@ -0,0 +1,21 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_states.yml' with nm as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_states.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_team_nm.yml b/roles/linux-system-roles.network/tests/tests_team_nm.yml new file mode 100644 index 0000000..8048029 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_team_nm.yml @@ -0,0 +1,22 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_team.yml' with nm as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_team.yml + when: + - ansible_distribution_major_version != '6' + - ansible_distribution != 'Fedora' diff --git a/roles/linux-system-roles.network/tests/tests_team_plugin_installation_nm.yml b/roles/linux-system-roles.network/tests/tests_team_plugin_installation_nm.yml new file mode 100644 index 0000000..4572736 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_team_plugin_installation_nm.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_team_plugin_installation.yml' with nm as provider + tasks: + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_team_plugin_installation.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/linux-system-roles.network/tests/tests_wireless_nm.yml b/roles/linux-system-roles.network/tests/tests_wireless_nm.yml new file mode 100644 index 0000000..03b5ad6 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_wireless_nm.yml @@ -0,0 +1,22 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_wireless.yml' with nm as provider + tasks: + - include_tasks: tasks/el_repo_setup.yml + + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_wireless.yml + when: + - ansible_distribution_major_version != '6' + - ansible_distribution_major_version == '7' diff --git a/roles/linux-system-roles.network/tests/tests_wireless_plugin_installation_nm.yml b/roles/linux-system-roles.network/tests/tests_wireless_plugin_installation_nm.yml new file mode 100644 index 0000000..5e55f50 --- /dev/null +++ b/roles/linux-system-roles.network/tests/tests_wireless_plugin_installation_nm.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: BSD-3-Clause +# This file was generated by ensure_provider_tests.py +--- +# set network provider and gather facts +- hosts: all + name: Run playbook 'playbooks/tests_wireless_plugin_installation.yml' with nm as provider + tasks: + - name: Set network provider to 'nm' + set_fact: + network_provider: nm + tags: + - always + + +# The test requires or should run with NetworkManager, therefore it cannot run +# on RHEL/CentOS 6 +- import_playbook: playbooks/tests_wireless_plugin_installation.yml + when: + - ansible_distribution_major_version != '6' diff --git a/roles/oatakan.ansible-role-ovirt/.travis.yml b/roles/oatakan.ansible-role-ovirt/.travis.yml new file mode 100644 index 0000000..36bbf62 --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/README.md b/roles/oatakan.ansible-role-ovirt/README.md new file mode 100644 index 0000000..796c7e3 --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the ovirt module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/oatakan.ansible-role-ovirt/defaults/main.yml b/roles/oatakan.ansible-role-ovirt/defaults/main.yml new file mode 100644 index 0000000..1b397e4 --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/defaults/main.yml @@ -0,0 +1,15 @@ +--- + +role_action: provision + +ovirt: + url: '' + username: '' + password: '' + +ansible_port: 22 +instance_wait_retry_limit: 600 +instance_wait_connection_timeout: 300 + +wait_for_static_ip_assigned: yes + diff --git a/roles/oatakan.ansible-role-ovirt/meta/.galaxy_install_info b/roles/oatakan.ansible-role-ovirt/meta/.galaxy_install_info new file mode 100644 index 0000000..b85e00f --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/meta/.galaxy_install_info @@ -0,0 +1,2 @@ +install_date: Thu Apr 22 02:46:27 2021 +version: '' diff --git a/roles/oatakan.ansible-role-ovirt/meta/main.yml b/roles/oatakan.ansible-role-ovirt/meta/main.yml new file mode 100644 index 0000000..68ff9b1 --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/meta/main.yml @@ -0,0 +1,25 @@ +galaxy_info: + author: Orcun Atakan + description: Ansible galaxy role for creating virtual machines on ovirt/rhev + company: Red Hat + + license: license (GPLv2, CC-BY, etc) + + min_ansible_version: 1.2 + + platforms: + - name: EL + versions: + - all + + categories: + - all + + galaxy_tags: + - ovirt + - rhev + +collections: + - ovirt.ovirt + +dependencies: [] diff --git a/roles/oatakan.ansible-role-ovirt/tasks/deprovision.yml b/roles/oatakan.ansible-role-ovirt/tasks/deprovision.yml new file mode 100644 index 0000000..d3ae173 --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tasks/deprovision.yml @@ -0,0 +1,65 @@ +--- + +- name: remove vms + ovirt_vm: + auth: "{{ ovirt_auth }}" + name: "{{ item }}" + cluster: "{{ providers.ovirt.cluster | default('Default') }}" + storage_domain: "{{ item.storage_domain | default(omit) }}" + state: absent + wait: yes + async: 7200 + poll: 0 + register: undeploy + loop: "{{ ansible_play_hosts | intersect(nodes | map(attribute='name') | list) }}" + when: + - nodes is defined + - hostvars[item].name is defined + +- name: wait for vms to be deleted + async_status: + jid: "{{ item.ansible_job_id }}" + register: vm_remove + until: vm_remove.finished + retries: "{{ instance_wait_retry_limit }}" + delay: 10 + loop: "{{ undeploy.results }}" + when: + - nodes is defined + - undeploy.results is defined + - item.ansible_job_id is defined + +- name: delete additional disks + ovirt_disk: + auth: "{{ ovirt_auth }}" + name: "{% if item.1.name_prefix | default(true) %}{{ item.0.name }}_{% endif %}{{ item.1.name }}" + vm_name: "{{ item.0.name }}" + storage_domain: "{{ item.1.storage_domain | default(omit) }}" + state: absent + wait: no + async: 7200 + poll: 0 + register: delete_disks + with_subelements: + - "{{ nodes | json_query(query) }}" + - disks + - skip_missing: yes + when: + - nodes is defined + - item.1 is defined + - item.1.storage_domain is defined + vars: + query: "@[?contains(`{{ ansible_play_hosts }}`, name)]" + +- name: wait for disk deletion to complete + async_status: + jid: "{{ item.ansible_job_id }}" + register: disks_deletion + until: disks_deletion.finished + retries: "{{ instance_wait_retry_limit }}" + delay: 10 + with_items: "{{ delete_disks.results }}" + when: + - nodes is defined + - delete_disks.results is defined + - item.ansible_job_id is defined \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/tasks/main.yml b/roles/oatakan.ansible-role-ovirt/tasks/main.yml new file mode 100644 index 0000000..8f71530 --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tasks/main.yml @@ -0,0 +1,25 @@ +--- + +- block: + - name: obtain SSO token with using username/password credentials + ovirt_auth: + url: "{{ lookup('env', 'OVIRT_URL')|default(ovirt.url, true) }}" + username: "{{ lookup('env', 'OVIRT_USERNAME')|default(ovirt.username, true) }}" + password: "{{ lookup('env', 'OVIRT_PASSWORD')|default(ovirt.password, true) }}" + insecure: yes + + - include_tasks: provision.yml + when: role_action == 'provision' + + - include_tasks: deprovision.yml + run_once: yes + when: role_action == 'deprovision' + always: + - name: revoke the SSO token + ovirt_auth: + url: "{{ lookup('env', 'OVIRT_URL')|default(ovirt.url, true) }}" + username: "{{ lookup('env', 'OVIRT_USERNAME')|default(ovirt.username, true) }}" + password: "{{ lookup('env', 'OVIRT_PASSWORD')|default(ovirt.password, true) }}" + insecure: yes + ovirt_auth: "{{ ovirt_auth }}" + state: absent \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/tasks/preflight_check.yml b/roles/oatakan.ansible-role-ovirt/tasks/preflight_check.yml new file mode 100644 index 0000000..644057e --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tasks/preflight_check.yml @@ -0,0 +1,40 @@ +--- + +- name: fail if cluster name is not specified + fail: + msg: "cluster name is not specified, please specify providers.ovirt.cluster" + when: (providers.ovirt.cluster | default(None)) is undefined + +- name: get the datacenter name + ovirt_datacenter_info: + auth: "{{ ovirt_auth }}" + pattern: "Clusters.name = {{ providers.ovirt.cluster }}" + register: datacenter_info + +- name: fail if datacenter is not found + fail: + msg: "data center is not found" + when: datacenter_info.ovirt_datacenters | length == 0 + +- name: get storage information + ovirt_storage_domain_info: + auth: "{{ ovirt_auth }}" + pattern: "datacenter={{ datacenter_info.ovirt_datacenters[0].name }}" + register: storage_info + +- name: set data domain + set_fact: + disk_storage_domain: "{{ storage_info.ovirt_storage_domains|json_query(the_query)|list|first|default(None) }}" + vars: + the_query: "[?type=='data']" + +- name: set iso domain (deprecated as of oVirt/RHV 4.3) + set_fact: + iso_domain: "{{ storage_info.ovirt_storage_domains|json_query(the_query)|list|first|default(None) }}" + vars: + the_query: "[?type=='iso']" + +- include_tasks: template_check.yml + loop: "{{ nodes }}" + loop_control: + loop_var: node \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/tasks/provision.yml b/roles/oatakan.ansible-role-ovirt/tasks/provision.yml new file mode 100644 index 0000000..f244fca --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tasks/provision.yml @@ -0,0 +1,183 @@ +--- + +- include_tasks: preflight_check.yml + +- name: clone from template + ovirt_vm: + auth: "{{ ovirt_auth }}" + name: "{{ item.name }}" + template: "{{ item.template | default(omit) }}" + cluster: "{{ providers.ovirt.cluster | default('Default') }}" + state: present + wait: yes + memory: "{{ item.memory }}MiB" + memory_max: "{{ ((item.memory_max | string) + 'MiB') if item.memory_max is defined else omit }}" + memory_guaranteed: "{{ ((item.memory_guaranteed | string) + 'MiB') if item.memory_guaranteed is defined else omit }}" + cpu_mode: "{{ item.cpu_mode | default(omit) }}" + cpu_cores: "{{ item.cpu_cores | default(omit) }}" + cpu_sockets: "{{ item.cpu }}" + cpu_threads: "{{ item.cpu_threads | default(omit) }}" + cd_iso: "{{ node_iso_file[item] | default(omit) }}" + bios_type: "{{ item.bios_type | default(omit) }}" + ballooning_enabled: "{{ item.ballooning_enabled | default(omit) }}" + graphical_console: "{{ item.graphical_console | default(omit) }}" + host: "{{ item.host | default(omit) }}" + host_devices: "{{ item.host_devices | default(omit) }}" + placement_policy: "{{ item.placement_policy | default(omit) }}" + storage_domain: "{{ item.storage_domain | default(omit) }}" + type: "{{ item.type | default('server') }}" + high_availability: true + nics: + - name: nic1 + profile_name: "{{ item.networks[0].profile_name | default(item.networks[0].name) }}" + network: "{{ item.networks[0].name }}" + custom_properties: "{{ item.custom_properties | default(omit) }}" + operating_system: "{{ item.operating_system | default(omit) }}" + async: 7200 + poll: 0 + register: deploy + loop: "{{ nodes }}" + when: + - nodes is defined + +- name: wait for instance creation to complete + async_status: + jid: "{{ item.ansible_job_id }}" + register: deployed_instances + until: deployed_instances.finished + retries: "{{ instance_wait_retry_limit }}" + delay: 10 + no_log: false + with_items: "{{ deploy.results }}" + when: + - nodes is defined + - deploy.results is defined + - item.ansible_job_id is defined + +- name: create additional disks + ovirt_disk: + auth: "{{ ovirt_auth }}" + name: "{% if item.1.name_prefix | default(true) %}{{ item.0.name }}_{% endif %}{{ item.1.name }}" + vm_name: "{{ item.0.name }}" + size: "{{ item.1.size | default(omit) }}" + format: "{{ item.1.format | default(omit) }}" + interface: "{{ item.1.interface | default(omit) }}" + bootable: "{{ item.1.bootable | default(omit) }}" + storage_domain: "{{ item.1.storage_domain | default(omit) }}" + activate: yes + state: present + wait: yes + async: 7200 + poll: 0 + register: create_disks + with_subelements: + - "{{ nodes }}" + - disks + - skip_missing: yes + when: + - nodes is defined + - item.1 is defined + +- name: wait for disk creation to complete + async_status: + jid: "{{ item.ansible_job_id }}" + register: disks_creation + until: disks_creation.finished + retries: "{{ instance_wait_retry_limit }}" + delay: 10 + with_items: "{{ create_disks.results }}" + when: + - nodes is defined + - create_disks.results is defined + - item.ansible_job_id is defined + +- include_tasks: wait_for_disk_pre29.yml + when: ansible_version.full is version('2.9', '<') + +- include_tasks: wait_for_disk.yml + when: ansible_version.full is version('2.9', '>=') + +- name: linux - start and customize + ovirt_vm: + auth: "{{ ovirt_auth }}" + name: "{{ item.name }}" + state: running + cloud_init: + nic_boot_protocol: "{{ 'static' if item.networks[0].ip is defined and item.networks[0].netmask is defined and item.networks[0].gateway is defined else 'dhcp' }}" + nic_ip_address: "{{ item.networks[0].ip | default('') }}" + nic_netmask: "{{ item.networks[0].netmask | default('') }}" + nic_gateway: "{{ item.networks[0].gateway | default('') }}" + nic_name: "{{ item.networks[0].nic_name | default(item.networks[0].device_name) | default('eth0') }}" + host_name: "{{ item.name }}.{{ item.domain | default('') }}" + dns_servers: "{{ item.dns_servers|join(' ') | default([]) }}" + custom_script: "{{ item.custom_script | default('') }}" + user_name: "{{ item.user_name | default('') }}" + root_password: "{{ item.root_password | default('') }}" + async: 7200 + poll: 0 + register: deploy_linux + loop: "{{ nodes }}" + when: + - nodes is defined + - item.sysprep is not defined + +- name: windows - start and customize + ovirt_vm: + auth: "{{ ovirt_auth }}" + name: "{{ item.name }}" + state: running + sysprep: + custom_script: "{{ lookup('template', 'templates/unattended.xml.j2') }}" + host_name: "{{ item.name | default('') }}" + domain: "{{ item.domain | default('') }}" + user_name: "{{ item.user_name | default(ansible_user) }}" + root_password: "{{ item.root_password | default(ansible_password) }}" + async: 7200 + poll: 0 + register: deploy_windows + loop: "{{ nodes }}" + when: + - nodes is defined + - item.sysprep is defined + +- name: combine deployment results + set_fact: + deploy_results: "{{ deploy_results|default([]) + [ item ] }}" + with_items: "{{ deploy_linux.results + deploy_windows.results }}" + when: + - nodes is defined + - item.ansible_job_id is defined + +- name: wait for vms to be started + async_status: + jid: "{{ item.ansible_job_id }}" + register: instances + until: instances.finished + retries: "{{ instance_wait_retry_limit }}" + delay: 10 + with_items: "{{ deploy_results }}" + when: + - nodes is defined + - deploy_results is defined + - item.ansible_job_id is defined + +- name: assign tags to provisioned vms + ovirt_tag: + auth: "{{ ovirt_auth }}" + name: "{{ item.1 }}_{{ item.0.item.item[item.1] }}" + vms: ["{{ item.0.item.item.name }}"] + state: attached + with_nested: + - "{{ instances.results }}" + - [ 'app_name', 'role' ] + when: + - nodes is defined + - instances.results is defined + - item.0.vm is defined + - item.0.item.item[item.1] is defined + +- include_tasks: wait_for_ip_pre29.yml + when: ansible_version.full is version('2.9', '<') + +- include_tasks: wait_for_ip.yml + when: ansible_version.full is version('2.9', '>=') \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/tasks/template_check.yml b/roles/oatakan.ansible-role-ovirt/tasks/template_check.yml new file mode 100644 index 0000000..6e839d5 --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tasks/template_check.yml @@ -0,0 +1,52 @@ +--- + +- name: fail if no template and disk specified + fail: + msg: "at least one disk must be specified when no template is used" + when: + - node.template is undefined + - node.disks[0].size is undefined | default(False) + +- name: fail if both template and iso is specified + fail: + msg: "template and cd_iso are mutually exclusive, only define one of them" + when: + - node.template is defined + - node.cd_iso is defined + +- block: + - name: check if template exists + ovirt_template_info: + auth: "{{ ovirt_auth }}" + pattern: "name={{ node.template }} and datacenter={{ datacenter_info.ovirt_datacenters[0].name }}" + register: template_info + + - name: fail with message + fail: + msg: "template ({{ node.template }}) could not be found, make sure it exists" + when: ( template_info.ovirt_templates | default([]) ) | length == 0 + when: node.template is defined + +- block: + - name: check iso file on data domain + ovirt_disk_info: + auth: "{{ ovirt_auth }}" + pattern: "name={{ node.cd_iso }}" + register: ovirt_disk_main_iso + + - name: fail with message + fail: + msg: "iso file ({{ node.cd_iso }}) could not be found on the data domain and iso domain does not exists" + when: + - (ovirt_disk_main_iso.ovirt_disks[0].id | default(None)) is undefined + - iso_domain is undefined or iso_domain|length == 0 + when: node.cd_iso is defined + +- name: set iso file + set_fact: + node_iso_file: '{{ node_iso_file | default({}) | combine({node.name: ovirt_disk_main_iso.ovirt_disks[0].id | default(node.cd_iso) | default(None)}) }}' + when: (node_iso_file[node.name] | default(None)) is undefined + +- name: set os type + set_fact: + nodes_os_type: '{{ nodes_os_type | default({}) | combine({node.name: node.os_type | default(template_info.ovirt_templates[0].os.type) | default(None)}) }}' \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/tasks/wait_for_disk.yml b/roles/oatakan.ansible-role-ovirt/tasks/wait_for_disk.yml new file mode 100644 index 0000000..5c4e220 --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tasks/wait_for_disk.yml @@ -0,0 +1,18 @@ +--- + +- name: wait until the image is unlocked by the oVirt engine + ovirt_disk_info: + auth: "{{ ovirt_auth }}" + pattern: "name={% if item.1.name_prefix | default(true) %}{{ item.0.name }}_{% endif %}{{ item.1.name }}" + register: ovirt_disk_info + until: (ovirt_disk_info.ovirt_disks is defined) and (ovirt_disk_info.ovirt_disks | length > 0) and (ovirt_disk_info.ovirt_disks[0].status != "locked") + retries: 10 + delay: 3 + with_subelements: + - "{{ nodes }}" + - disks + - skip_missing: yes + when: + - nodes is defined + - disks_creation.results is defined + - item.1 is defined \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/tasks/wait_for_disk_pre29.yml b/roles/oatakan.ansible-role-ovirt/tasks/wait_for_disk_pre29.yml new file mode 100644 index 0000000..a47bcfc --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tasks/wait_for_disk_pre29.yml @@ -0,0 +1,17 @@ +--- + +- name: wait until the image is unlocked by the oVirt engine (<2.9) + ovirt_disk_facts: + auth: "{{ ovirt_auth }}" + pattern: "name={% if item.1.name_prefix | default(true) %}{{ item.0.name }}_{% endif %}{{ item.1.name }}" + until: (ovirt_disks is defined) and (ovirt_disks | length > 0) and (ovirt_disks[0].status != "locked") + retries: 10 + delay: 3 + with_subelements: + - "{{ nodes }}" + - disks + - skip_missing: yes + when: + - nodes is defined + - disks_creation.results is defined + - item.1 is defined \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/tasks/wait_for_ip.yml b/roles/oatakan.ansible-role-ovirt/tasks/wait_for_ip.yml new file mode 100644 index 0000000..d7c071e --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tasks/wait_for_ip.yml @@ -0,0 +1,69 @@ +--- + +#- name: waiting for ip address to be assigned +# ovirt_nic_info: +# auth: "{{ ovirt_auth }}" +# vm: "{{ item.vm.name }}" +# name: nic1 +# register: nics +# until: +# - nics.ovirt_nics | length > 0 +# - nics.ovirt_nics[0].reported_devices | length > 0 +# - nics.ovirt_nics[0].reported_devices[0].ips is defined +# - nics.ovirt_nics[0].reported_devices[0].ips | length > 0 +# - nics.ovirt_nics[0].reported_devices[0].ips[0].address is defined +# - nics.ovirt_nics[0].reported_devices[0].ips[0].version == 'v4' +# retries: 300 +# delay: 10 +# with_items: "{{ instances.results }}" +# when: +# - nodes is defined +# - instances.results is defined +# - item.vm is defined + +- name: waiting for servers to come online on predefined ip + wait_for: + host: "{{ item.networks[0].ip }}" + port: "{{ item.ansible_port | default(ansible_port) | default('22') }}" + with_items: "{{ nodes }}" + when: + - nodes is defined + - item.networks is defined + - item.networks[0].ip is defined + +- name: waiting for servers to come online on dhcp ip + wait_for: + host: "{{ (item.ovirt_nics[0].reported_devices[0].ips | json_query('[?version==`v4`].address'))[0] }}" + port: "{{ item.item.item.item.ansible_port | default(ansible_port) | default('22') }}" + with_items: "{{ nics.results }}" + when: + - nodes is defined + - nics.results is defined + - item.ovirt_nics is defined + - item.item.item.item.networks is defined + - item.item.item.item.networks[0].ip is not defined + +- name: waiting for ovirt to show the predefined ip + ovirt_nic_info: + auth: "{{ ovirt_auth }}" + vm: "{{ item.name }}" + name: nic1 + fetch_nested: yes + nested_attributes: + - ips + register: nics + until: + - nics.ovirt_nics | length > 0 + - nics.ovirt_nics[0].reported_devices | length > 0 + - nics.ovirt_nics[0].reported_devices[0].ips | length > 0 + - nics.ovirt_nics[0].reported_devices[0].ips[0].address is defined + - nics.ovirt_nics[0].reported_devices[0].ips[0].version == 'v4' + - nics.ovirt_nics[0].reported_devices[0].ips[0].address == item.networks[0].ip + retries: 300 + delay: 10 + with_items: "{{ nodes }}" + when: + - wait_for_static_ip_assigned|bool + - nodes is defined + - item.networks | length > 0 + - item.networks[0].ip is defined \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/tasks/wait_for_ip_pre29.yml b/roles/oatakan.ansible-role-ovirt/tasks/wait_for_ip_pre29.yml new file mode 100644 index 0000000..b28a667 --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tasks/wait_for_ip_pre29.yml @@ -0,0 +1,69 @@ +--- + +#- name: waiting for ip address to be assigned (<2.9) +# ovirt_nic_facts: +# auth: "{{ ovirt_auth }}" +# vm: "{{ item.vm.name }}" +# name: nic1 +# register: nics +# until: +# - nics.ansible_facts.ovirt_nics | length > 0 +# - nics.ansible_facts.ovirt_nics[0].reported_devices | length > 0 +# - nics.ansible_facts.ovirt_nics[0].reported_devices[0].ips is defined +# - nics.ansible_facts.ovirt_nics[0].reported_devices[0].ips | length > 0 +# - nics.ansible_facts.ovirt_nics[0].reported_devices[0].ips[0].address is defined +# - nics.ansible_facts.ovirt_nics[0].reported_devices[0].ips[0].version == 'v4' +# retries: 300 +# delay: 10 +# with_items: "{{ instances.results }}" +# when: +# - nodes is defined +# - instances.results is defined +# - item.vm is defined + +- name: waiting for servers to come online on predefined ip + wait_for: + host: "{{ item.networks[0].ip }}" + port: "{{ item.ansible_port | default(ansible_port) | default('22') }}" + with_items: "{{ nodes }}" + when: + - nodes is defined + - item.networks is defined + - item.networks[0].ip is defined + +- name: waiting for servers to come online on dhcp ip (<2.9) + wait_for: + host: "{{ (item.ansible_facts.ovirt_nics[0].reported_devices[0].ips | json_query('[?version==`v4`].address'))[0] }}" + port: "{{ item.item.item.item.ansible_port | default(ansible_port) | default('22') }}" + with_items: "{{ nics.results }}" + when: + - nodes is defined + - nics.results is defined + - item.ansible_facts is defined + - item.item.item.item.networks is defined + - item.item.item.item.networks[0].ip is not defined + +- name: waiting for ovirt to show the predefined ip (<2.9) + ovirt_nic_facts: + auth: "{{ ovirt_auth }}" + vm: "{{ item.name }}" + name: nic1 + fetch_nested: yes + nested_attributes: + - ips + register: nics + until: + - nics.ansible_facts.ovirt_nics | length > 0 + - nics.ansible_facts.ovirt_nics[0].reported_devices | length > 0 + - nics.ansible_facts.ovirt_nics[0].reported_devices[0].ips | length > 0 + - nics.ansible_facts.ovirt_nics[0].reported_devices[0].ips[0].address is defined + - nics.ansible_facts.ovirt_nics[0].reported_devices[0].ips[0].version == 'v4' + - nics.ansible_facts.ovirt_nics[0].reported_devices[0].ips[0].address == item.networks[0].ip + retries: 300 + delay: 10 + with_items: "{{ nodes }}" + when: + - wait_for_static_ip_assigned|bool + - nodes is defined + - item.networks | length > 0 + - item.networks[0].ip is defined \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/templates/cloud_init.yml.j2 b/roles/oatakan.ansible-role-ovirt/templates/cloud_init.yml.j2 new file mode 100644 index 0000000..cbcf082 --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/templates/cloud_init.yml.j2 @@ -0,0 +1,20 @@ +cloud_init: +{% if item.networks[0].ip is defined and item.networks[0].netmask is defined and item.networks[0].gateway is defined %} + nic_boot_protocol: static + nic_ip_address: "{{ item.networks[0].ip }}" + nic_netmask: "{{ item.networks[0].netmask }}" + nic_gateway: "{{ item.networks[0].gateway }}" +{% else %} + nic_boot_protocol: dhcp +{% endif %} + nic_name: {{ item.networks[0].nic_name | default(item.networks[0].device_name) | default('eth0') }} + host_name: "{{ item.name }}.{{ item.domain | default('') }}" +{% if item.dns_servers is defined %} + dns_servers: "{{ item.dns_servers|join(' ') }}" +{% endif %} +{% if item.user_name is defined %} + user_name: "{{ item.user_name }}" +{% endif %} +{% if item.root_password is defined %} + root_password: "{{ item.root_password }}" +{% endif %} \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/templates/unattended.xml.j2 b/roles/oatakan.ansible-role-ovirt/templates/unattended.xml.j2 new file mode 100644 index 0000000..593412d --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/templates/unattended.xml.j2 @@ -0,0 +1,226 @@ + + + + + + + {{ ansible_password | b64encode | b64decode }} + true</PlainText> + </AdministratorPassword> + <LocalAccounts> + <LocalAccount wcm:action="add"> + <Password> + <Value>{{ ansible_password | b64encode | b64decode }}</Value> + <PlainText>true</PlainText> + </Password> + <Description>{{ item.user_name | default('vagrant') }} User</Description> + <DisplayName>{{ item.user_name | default('vagrant') }}</DisplayName> + <Group>Administrators</Group> + <Name>{{ item.user_name | default('vagrant') }}</Name> + </LocalAccount> + </LocalAccounts> + </UserAccounts> + <OOBE> + <HideEULAPage>true</HideEULAPage> + <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE> + <NetworkLocation>Home</NetworkLocation> + <ProtectYourPC>1</ProtectYourPC> +{% if not '2008' in (windows_distro_name | default(item.template)) %} + <HideLocalAccountScreen>true</HideLocalAccountScreen> + <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen> + <HideOnlineAccountScreens>true</HideOnlineAccountScreens> +{% endif %} + <SkipMachineOOBE>true</SkipMachineOOBE> + <SkipUserOOBE>true</SkipUserOOBE> + </OOBE> + <AutoLogon> + <Password> + <Value>{{ ansible_password | b64encode | b64decode }}</Value> + <PlainText>true</PlainText> + </Password> + <Username>{{ item.user_name | default('vagrant') }}</Username> + <Enabled>true</Enabled> + </AutoLogon> + <FirstLogonCommands> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c powershell -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"</CommandLine> + <Description>Set Execution Policy 64 Bit</Description> + <Order>1</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> +{% if not '2008' in (windows_distro_name | default(item.template)) %} + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c powershell -Command "Set-NetConnectionProfile -NetworkCategory Private"</CommandLine> + <Description>Set network connection profile to private</Description> + <Order>2</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c winrm quickconfig -q</CommandLine> + <Description>winrm quickconfig -q</Description> + <Order>4</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c winrm quickconfig -transport:http</CommandLine> + <Description>winrm quickconfig -transport:http</Description> + <Order>5</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c winrm set winrm/config @{MaxTimeoutms="1800000"}</CommandLine> + <Description>Win RM MaxTimoutms</Description> + <Order>6</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c winrm set winrm/config/winrs @{MaxMemoryPerShellMB="800"}</CommandLine> + <Description>Win RM MaxMemoryPerShellMB</Description> + <Order>7</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c winrm set winrm/config/service @{AllowUnencrypted="true"}</CommandLine> + <Description>Win RM AllowUnencrypted</Description> + <Order>8</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c winrm set winrm/config/service/auth @{Basic="true"}</CommandLine> + <Description>Win RM auth Basic</Description> + <Order>9</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c winrm set winrm/config/client/auth @{Basic="true"}</CommandLine> + <Description>Win RM client auth Basic</Description> + <Order>10</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c winrm set winrm/config/listener?Address=*+Transport=HTTP @{Port="5985"} </CommandLine> + <Description>Win RM listener Address/Port</Description> + <Order>11</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c netsh firewall add portopening TCP 5985 "Port 5985"</CommandLine> + <Description>Win RM port open</Description> + <Order>12</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c net stop winrm</CommandLine> + <Description>Stop Win RM Service </Description> + <Order>13</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c sc config winrm start= auto</CommandLine> + <Description>Win RM Autostart</Description> + <Order>14</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c net start winrm</CommandLine> + <Description>Start Win RM Service</Description> + <Order>15</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> +{% else %} + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c reg add "HKLM\System\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f</CommandLine> + <Description>Network prompt</Description> + <Order>2</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c powershell -Command "{{ set_network_to_private }}"</CommandLine> + <Description>Set network connection profile to private</Description> + <Order>3</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> +{% endif %} + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c powershell -Command "& $([scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1'))) -ForceNewSSLCert -EnableCredSSP"</CommandLine> + <Description>Enable winrm</Description> + <Order>20</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c powershell -Command "Enable-WSManCredSSP -Role Server -Force"</CommandLine> + <Description>Enable winrm server role</Description> + <Order>21</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c powershell -Command "Set-Item -Path 'WSMan:\localhost\Service\Auth\CredSSP' -Value $true"</CommandLine> + <Description>Enable credssp authentication</Description> + <Order>22</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c powershell -Command "Resize-Partition -DriveLetter C -Size (Get-PartitionSupportedSize -DriveLetter C).Sizemax -ErrorAction SilentlyContinue"</CommandLine> + <Description>Extend OS disk</Description> + <Order>23</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> +{% if item.networks is defined and item.networks[0].ip is defined and item.networks[0].gateway is defined and item.networks[0].netmask is defined %} +{% if not '2008' in (windows_distro_name | default(item.template)) %} + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c powershell -Command "New-NetIPAddress –IPAddress {{ item.networks[0].ip }} -DefaultGateway {{ item.networks[0].gateway }} -PrefixLength {{ (item.networks[0].ip + '/' + item.networks[0].netmask) | ipaddr('prefix') }} -InterfaceIndex (Get-NetAdapter | Where-Object { ($_.Name -like '*Ethernet*') -and ($_.Status -like 'Up') })[0].InterfaceIndex"</CommandLine> + <Description>Set static ip</Description> + <Order>50</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> +{% else %} + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c netsh int ipv4 set address "Local Area connection" static {{ item.networks[0].ip }} {{ item.networks[0].netmask }} {{ item.networks[0].gateway }}</CommandLine> + <Description>Set static ip</Description> + <Order>50</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> +{% endif %} +{% if item.networks[0].dns_servers is defined %} +{% if not '2008' in (windows_distro_name | default(item.template)) %} + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c powershell -Command "Set-DNSClientServerAddress –InterfaceIndex (Get-NetAdapter | Where-Object { ($_.Name -like '*Ethernet*') -and ($_.Status -like 'Up') })[0].InterfaceIndex –ServerAddresses {{ item.networks[0].dns_servers|join(',') }}"</CommandLine> + <Description>Set static ip</Description> + <Order>51</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> +{% else %} + <SynchronousCommand wcm:action="add"> + <CommandLine>cmd.exe /c netsh int ipv4 set dns "Local Area connection" static {{ item.networks[0].dns_servers[0] }}</CommandLine> + <Description>Set static ip</Description> + <Order>51</Order> + <RequiresUserInput>true</RequiresUserInput> + </SynchronousCommand> +{% endif %} +{% endif %} +{% endif %} + </FirstLogonCommands> + <ShowWindowsLive>false</ShowWindowsLive> + </component> + </settings> + <settings pass="specialize"> + <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> + <OEMInformation> + <HelpCustomized>false</HelpCustomized> + </OEMInformation> + <!-- Rename computer here. --> + <ComputerName>{{ item.name }}</ComputerName> + <TimeZone>Central Standard Time</TimeZone> + <RegisteredOwner/> + </component> + <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> + <SkipAutoActivation>true</SkipAutoActivation> + </component> + <component name="Microsoft-Windows-Deployment" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> + <ExtendOSPartition> + <Extend>true</Extend> + </ExtendOSPartition> + </component> + </settings> + <cpi:offlineImage xmlns:cpi="urn:schemas-microsoft-com:cpi" cpi:source="catalog:d:/sources/install_windows 7 ENTERPRISE.clg"/> +</unattend> \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/tests/inventory b/roles/oatakan.ansible-role-ovirt/tests/inventory new file mode 100644 index 0000000..d18580b --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tests/inventory @@ -0,0 +1 @@ +localhost \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/tests/test.yml b/roles/oatakan.ansible-role-ovirt/tests/test.yml new file mode 100644 index 0000000..5ec89eb --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - ansible-role-ovirt \ No newline at end of file diff --git a/roles/oatakan.ansible-role-ovirt/vars/main.yml b/roles/oatakan.ansible-role-ovirt/vars/main.yml new file mode 100644 index 0000000..646a4fb --- /dev/null +++ b/roles/oatakan.ansible-role-ovirt/vars/main.yml @@ -0,0 +1,3 @@ +--- + +set_network_to_private: "([Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]'{DCB00C01-570F-4A9B-8D69-199FDBA5723B}'))).GetNetworkConnections() | % {$_.GetNetwork().SetCategory(1)}" \ No newline at end of file diff --git a/roles/oatakan.ansible-role-windows-ad-controller/README.md b/roles/oatakan.ansible-role-windows-ad-controller/README.md new file mode 100644 index 0000000..b19fadc --- /dev/null +++ b/roles/oatakan.ansible-role-windows-ad-controller/README.md @@ -0,0 +1,2 @@ +# ansible-role-windows-ad-controller +Ansible role to deploy Windows AD Controller diff --git a/roles/oatakan.ansible-role-windows-ad-controller/defaults/main.yml b/roles/oatakan.ansible-role-windows-ad-controller/defaults/main.yml new file mode 100644 index 0000000..3d7836e --- /dev/null +++ b/roles/oatakan.ansible-role-windows-ad-controller/defaults/main.yml @@ -0,0 +1,22 @@ +--- + +dns_domain_name: "example.com" +domain_admin_password: "sX{88h:_P#G:]TC#" +domain_admin_username: Admin + +users_password: "PiP@ssw0rd14" +ad_users: + - name: user1 + username: user1 + email: user1 + - name: user2 + username: user2 + email: user2 + +ad_groups: + - name: Ansible Users + scope: global + +child_ous: + - name: Company OU + description: Test organization \ No newline at end of file diff --git a/roles/oatakan.ansible-role-windows-ad-controller/meta/.galaxy_install_info b/roles/oatakan.ansible-role-windows-ad-controller/meta/.galaxy_install_info new file mode 100644 index 0000000..1af15b2 --- /dev/null +++ b/roles/oatakan.ansible-role-windows-ad-controller/meta/.galaxy_install_info @@ -0,0 +1,2 @@ +install_date: Thu Apr 22 15:31:09 2021 +version: '' diff --git a/roles/oatakan.ansible-role-windows-ad-controller/meta/main.yml b/roles/oatakan.ansible-role-windows-ad-controller/meta/main.yml new file mode 100644 index 0000000..b8024b5 --- /dev/null +++ b/roles/oatakan.ansible-role-windows-ad-controller/meta/main.yml @@ -0,0 +1,24 @@ +--- +galaxy_info: + author: Orcun Atakan + description: Ansible galaxy role for installing Windows AD Controller + company: Red Hat + + license: license (GPLv2, CC-BY, etc) + + min_ansible_version: 1.2 + + platforms: + - name: Windows + versions: + - all + + categories: + - all + + galaxy_tags: + - windows + - active directory + - ad + +dependencies: [] diff --git a/roles/oatakan.ansible-role-windows-ad-controller/tasks/main.yml b/roles/oatakan.ansible-role-windows-ad-controller/tasks/main.yml new file mode 100644 index 0000000..e4f517e --- /dev/null +++ b/roles/oatakan.ansible-role-windows-ad-controller/tasks/main.yml @@ -0,0 +1,132 @@ +--- + +- name: ensure required powershell module is present + win_psmodule: + name: xActiveDirectory + state: present + +- name: enable windows features + win_dsc: + resource_name: WindowsFeature + Name: "{{ item }}" + IncludeAllSubFeature: True + Ensure: Present + register: install_ad + ignore_errors: yes + loop: + - AD-Domain-Services + +- name: reboot if needed + win_reboot: +# when: item.reboot_required +# loop: "{{ install_ad.results }}" +# run_once: yes + +- name: add a new domain + win_dsc: + resource_name: xADDomain + DomainName: "{{ dns_domain_name }}" + DomainAdministratorCredential_username: "{{ domain_admin_username }}@{{ dns_domain_name }}" + DomainAdministratorCredential_password: "{{ domain_admin_password }}" + SafemodeAdministratorPassword_username: "{{ domain_admin_username }}@{{ dns_domain_name }}" + SafemodeAdministratorPassword_password: "{{ domain_admin_password }}" + register: add_domain + ignore_errors: yes + +- name: set parent dn + set_fact: + parent_dn: "DC={{ dns_domain_name.split('.') | join(',DC=') }}" + +- name: reboot if needed + win_reboot: + when: add_domain.reboot_required + +- name: wait for AD domain + win_dsc: + resource_name: xWaitForADDomain + DomainName: "{{ dns_domain_name }}" + +- name: adjust password policy + win_dsc: + resource_name: xADDomainDefaultPasswordPolicy + DomainName: "{{ dns_domain_name }}" + ComplexityEnabled: False + MinPasswordLength: 8 + PasswordHistoryCount: 10 + +- name: add child OU + win_dsc: + resource_name: xADOrganizationalUnit + Name: "{{ item.name }}" + Path: "{{ parent_dn }}" + Description: "{{ item.description }}" + Ensure: Present + register: child_ou + loop: "{{ child_ous }}" + +- name: add groups + win_dsc: + resource_name: xADGroup + GroupName: "{{ item.name }}" + GroupScope: "{{ item.scope }}" + Ensure: Present + loop: "{{ ad_groups }}" + +- name: add domain admin user + win_dsc: + resource_name: xADUser + UserName: "{{ domain_admin_username }}" + UserPrincipalName: "{{ domain_admin_username }}@{{ dns_domain_name }}" + Password_username: "{{ domain_admin_username }}" + Password_password: "{{ domain_admin_password }}" + DomainName: "{{ dns_domain_name }}" + Enabled: True + GivenName: "{{ domain_admin_username }}" + Surname: user + Company: AnsibleByRedHat + EmailAddress: "{{ domain_admin_username }}@{{ dns_domain_name }}" + PasswordNeverExpires: True + Ensure: Present + ignore_errors: yes + +- name: add admin user to Domain Admins group + win_dsc: + resource_name: xADGroup + GroupName: Domain Admins + MembersToInclude: "{{ domain_admin_username }}" + ignore_errors: yes + +- name: add domain users + win_dsc: + resource_name: xADUser + UserName: "{{ item.username }}" + UserPrincipalName: "{{ item.username }}@{{ dns_domain_name }}" + Password_username: "{{ item.username }}" + Password_password: "{{ users_password }}" + DomainName: "{{ dns_domain_name }}" + DomainAdministratorCredential_username: "{{ domain_admin_username }}@{{ dns_domain_name }}" + DomainAdministratorCredential_password: "{{ domain_admin_password }}" + Enabled: True + GivenName: "{{ item.name }}" + Surname: user + Company: AnsibleByRedHat + EmailAddress: "{{ item.username }}@{{ dns_domain_name }}" + Ensure: Present + loop: "{{ ad_users }}" + ignore_errors: yes + +- name: add domain users to groups + win_dsc: + resource_name: xADGroup + GroupName: "{{ item }}" + MembersToInclude: "{{ ad_users | map(attribute='username') | list }}" + loop: + - Ansible Users + - Remote Desktop Users + +- name: ensure registry service is running + win_dsc: + resource_name: Service + Name: TermService + StartupType: Automatic + State: Running \ No newline at end of file diff --git a/roles/oatakan.ansible-role-windows-ad-controller/tests/inventory b/roles/oatakan.ansible-role-windows-ad-controller/tests/inventory new file mode 100644 index 0000000..878877b --- /dev/null +++ b/roles/oatakan.ansible-role-windows-ad-controller/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/roles/oatakan.ansible-role-windows-ad-controller/tests/test.yml b/roles/oatakan.ansible-role-windows-ad-controller/tests/test.yml new file mode 100644 index 0000000..d4f353e --- /dev/null +++ b/roles/oatakan.ansible-role-windows-ad-controller/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - windows-ad-controller \ No newline at end of file diff --git a/roles/oatakan.windows_ovirt_guest_agent/meta/.galaxy_install_info b/roles/oatakan.windows_ovirt_guest_agent/meta/.galaxy_install_info index 8c763d2..3ba60bb 100644 --- a/roles/oatakan.windows_ovirt_guest_agent/meta/.galaxy_install_info +++ b/roles/oatakan.windows_ovirt_guest_agent/meta/.galaxy_install_info @@ -1,2 +1,2 @@ -install_date: Tue Apr 20 16:13:52 2021 +install_date: Wed Apr 21 16:48:38 2021 version: master diff --git a/roles/oatakan.windows_ovirt_template/defaults/main.yml b/roles/oatakan.windows_ovirt_template/defaults/main.yml index 9881548..6ff1a85 100644 --- a/roles/oatakan.windows_ovirt_template/defaults/main.yml +++ b/roles/oatakan.windows_ovirt_template/defaults/main.yml @@ -18,6 +18,10 @@ vm_failed: no custom_efi_enabled: no custom_efi_path: /usr/share/edk2.git/ovmf-x64/OVMF_CODE-pure-efi.fd +qemu_second_cdrom_device_bus_type: ide +qemu_second_cdrom_device_bus_id: 3 +qemu_second_cdrom_device_bus_unit: 0 + virtio_iso_url: https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-0.1.173-2/virtio-win.iso winrm_enable_script_url: https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1 diff --git a/roles/oatakan.windows_ovirt_template/meta/.galaxy_install_info b/roles/oatakan.windows_ovirt_template/meta/.galaxy_install_info index 5f0de89..d0405f4 100644 --- a/roles/oatakan.windows_ovirt_template/meta/.galaxy_install_info +++ b/roles/oatakan.windows_ovirt_template/meta/.galaxy_install_info @@ -1,2 +1,2 @@ -install_date: Tue Apr 20 16:13:50 2021 +install_date: Wed Apr 21 16:48:35 2021 version: master diff --git a/roles/oatakan.windows_ovirt_template/tasks/main.yml b/roles/oatakan.windows_ovirt_template/tasks/main.yml index 018ea2d..eb70636 100644 --- a/roles/oatakan.windows_ovirt_template/tasks/main.yml +++ b/roles/oatakan.windows_ovirt_template/tasks/main.yml @@ -2,9 +2,9 @@ - name: obtain SSO token with using username/password credentials ovirt.ovirt.ovirt_auth: - url: "{{ lookup('env', 'OVIRT_URL')|default(ovirt.url) }}" - username: "{{ lookup('env', 'OVIRT_USERNAME')|default(ovirt.username) }}" - password: "{{ lookup('env', 'OVIRT_PASSWORD')|default(ovirt.password) }}" + url: "{{ lookup('env', 'OVIRT_URL')|default(ovirt.url, true) }}" + username: "{{ lookup('env', 'OVIRT_USERNAME')|default(ovirt.username, true) }}" + password: "{{ lookup('env', 'OVIRT_PASSWORD')|default(ovirt.password, true) }}" insecure: yes - include_tasks: preflight_check_pre29.yml @@ -63,9 +63,9 @@ - name: refresh SSO credentials ovirt.ovirt.ovirt_auth: - url: "{{ lookup('env', 'OVIRT_URL')|default(ovirt.url) }}" - username: "{{ lookup('env', 'OVIRT_USERNAME')|default(ovirt.username) }}" - password: "{{ lookup('env', 'OVIRT_PASSWORD')|default(ovirt.password) }}" + url: "{{ lookup('env', 'OVIRT_URL')|default(ovirt.url, true) }}" + username: "{{ lookup('env', 'OVIRT_USERNAME')|default(ovirt.username, true) }}" + password: "{{ lookup('env', 'OVIRT_PASSWORD')|default(ovirt.password, true) }}" insecure: yes - include_tasks: stop_vm.yml @@ -78,9 +78,9 @@ rescue: - name: refresh SSO credentials ovirt.ovirt.ovirt_auth: - url: "{{ lookup('env', 'OVIRT_URL')|default(ovirt.url) }}" - username: "{{ lookup('env', 'OVIRT_USERNAME')|default(ovirt.username) }}" - password: "{{ lookup('env', 'OVIRT_PASSWORD')|default(ovirt.password) }}" + url: "{{ lookup('env', 'OVIRT_URL')|default(ovirt.url, true) }}" + username: "{{ lookup('env', 'OVIRT_USERNAME')|default(ovirt.username, true) }}" + password: "{{ lookup('env', 'OVIRT_PASSWORD')|default(ovirt.password, true) }}" insecure: yes - include_tasks: remove_template.yml @@ -93,9 +93,9 @@ always: - name: refresh SSO credentials ovirt.ovirt.ovirt_auth: - url: "{{ lookup('env', 'OVIRT_URL')|default(ovirt.url) }}" - username: "{{ lookup('env', 'OVIRT_USERNAME')|default(ovirt.username) }}" - password: "{{ lookup('env', 'OVIRT_PASSWORD')|default(ovirt.password) }}" + url: "{{ lookup('env', 'OVIRT_URL')|default(ovirt.url, true) }}" + username: "{{ lookup('env', 'OVIRT_USERNAME')|default(ovirt.username, true) }}" + password: "{{ lookup('env', 'OVIRT_PASSWORD')|default(ovirt.password, true) }}" insecure: yes - include_tasks: remove_vm.yml diff --git a/roles/oatakan.windows_ovirt_template/vars/main.yml b/roles/oatakan.windows_ovirt_template/vars/main.yml index 542591a..0049486 100644 --- a/roles/oatakan.windows_ovirt_template/vars/main.yml +++ b/roles/oatakan.windows_ovirt_template/vars/main.yml @@ -55,7 +55,7 @@ template: qemu_cmdline_second_iso: - -device - - ide-cd,bus=ide.3,unit=0,drive=drive-ua-0001,id=ua-0001,bootindex=3 + - ide-cd,bus={{ qemu_second_cdrom_device_bus_type }}.{{ qemu_second_cdrom_device_bus_id }},unit={{ qemu_second_cdrom_device_bus_unit }},drive=drive-ua-0001,id=ua-0001,bootindex=3 - -drive - format=raw,if=none,id=drive-ua-0001,werror=report,rerror=report,readonly=on,file=/rhev/data-center/{{ ovirt_datacenter_id }}/{{ ovirt_datastore_id }}/images/{{ ks_iso_file_disk_id }}/{{ ks_iso_file_image_id }} diff --git a/roles/oatakan.windows_template_build/files/Install-WMF3Hotfix.ps1 b/roles/oatakan.windows_template_build/files/Install-WMF3Hotfix.ps1 new file mode 100644 index 0000000..016af67 --- /dev/null +++ b/roles/oatakan.windows_template_build/files/Install-WMF3Hotfix.ps1 @@ -0,0 +1,152 @@ +#Requires -Version 3.0 +<#PSScriptInfo +.VERSION 1.0 +.GUID 6cf319d1-8c50-460b-99ee-71b11cf7270d +.AUTHOR + Jordan Borean <jborean93@gmail.com> +.COPYRIGHT + Jordan Borean 2017 +.TAGS + PowerShell,Ansible,WinRM,WMF,Hotfix +.LICENSEURI https://github.com/jborean93/ansible-windows/blob/master/LICENSE +.PROJECTURI https://github.com/jborean93/ansible-windows +.RELEASENOTES + Version 1.0: 2017-09-27 + Initial script created +#> + +<# +.DESCRIPTION +The script will install the WinRM hotfix KB2842230 which fixes the memory +issues that occur when running over WinRM with WMF 3.0. +The script will; + 1. Detect if running on PS version 3.0 and exit if it is not + 2. Check if KB2842230 is already installed and exit if it is + 3. Download the hotfix from Microsoft server's based on the OS version + 4. Extract the .msu file from the downloaded hotfix + 5. Install the .msu silently + 6. Detect if a reboot is required and prompt whether the user wants to restart + +Once the install is complete, if the install process returns an exit +code of 3010, it will ask the user whether to restart the computer now +or whether it will be done later. + +See https://github.com/jborean93/ansible-windows/tree/master/scripts for more +details. +.PARAMETER Verbose + [switch] - Whether to display Verbose logs on the console +.EXAMPLE + powershell.exe -ExecutionPolicy ByPass -File Install-WMF3Hotfix.ps1 +.EXAMPLE + powershell.exe -ExecutionPolicy ByPass -File Install-WMF3Hotfix.ps1 -Verbose +#> + +[CmdletBinding()] +Param() + +$ErrorActionPreference = "Stop" +if ($verbose) { + $VerbosePreference = "Continue" +} + +Function Run-Process($executable, $arguments) { + $process = New-Object -TypeName System.Diagnostics.Process + $psi = $process.StartInfo + $psi.FileName = $executable + $psi.Arguments = $arguments + Write-Verbose -Message "starting new process '$executable $arguments'" + $process.Start() | Out-Null + + $process.WaitForExit() | Out-Null + $exit_code = $process.ExitCode + Write-Verbose -Message "process completed with exit code '$exit_code'" + + return $exit_code +} + +Function Download-File($url, $path) { + Write-Verbose -Message "downloading url '$url' to '$path'" + $client = New-Object -TypeName System.Net.WebClient + $client.DownloadFile($url, $path) +} + +Function Extract-Zip($zip, $dest) { + Write-Verbose -Message "extracting '$zip' to '$dest'" + try { + Add-Type -AssemblyName System.IO.Compression.FileSystem > $null + $legacy = $false + } catch { + $legacy = $true + } + + if ($legacy) { + $shell = New-Object -ComObject Shell.Application + $zip_src = $shell.NameSpace($zip) + $zip_dest = $shell.NameSpace($dest) + $zip_dest.CopyHere($zip_src.Items(), 1044) + } else { + [System.IO.Compression.ZipFile]::ExtractToDirectory($zip, $dest) + } +} + +$tmp_dir = $env:temp +$kb = "KB2842230" +if ($PSVersionTable.PSVersion.Major -ne 3) { + Write-Verbose -Message "$kb is only applicable with Powershell v3, no action required" + exit 0 +} + +$hotfix_installed = Get-Hotfix -Id $kb -ErrorAction SilentlyContinue +if ($hotfix_installed -ne $null) { + Write-Verbose -Message "$kb is already installed" + exit 0 +} + +if (-not (Test-Path -Path $tmp_dir)) { + New-Item -Path $tmp_dir -ItemType Directory > $null +} +$os_version = [Version](Get-Item -Path "$env:SystemRoot\System32\kernel32.dll").VersionInfo.ProductVersion +$host_string = "$($os_version.Major).$($os_version.Minor)-$($env:PROCESSOR_ARCHITECTURE)" +switch($host_string) { + # These URLS point to the Ansible Core CI S3 bucket, MS no longer provide a link to Server 2008 so we need to + # rely on this URL. There are no guarantees this will stay up in the future. + "6.0-x86" { + $url = "https://s3.amazonaws.com/ansible-ci-files/hotfixes/KB2842230/464091_intl_i386_zip.exe" + } + "6.0-AMD64" { + $url = "https://s3.amazonaws.com/ansible-ci-files/hotfixes/KB2842230/464090_intl_x64_zip.exe" + } + "6.1-x86" { + $url = "https://s3.amazonaws.com/ansible-ci-files/hotfixes/KB2842230/463983_intl_i386_zip.exe" + } + "6.1-AMD64" { + $url = "https://s3.amazonaws.com/ansible-ci-files/hotfixes/KB2842230/463984_intl_x64_zip.exe" + } + "6.2-x86" { + $url = "https://s3.amazonaws.com/ansible-ci-files/hotfixes/KB2842230/463940_intl_i386_zip.exe" + } + "6.2-AMD64" { + $url = "https://s3.amazonaws.com/ansible-ci-files/hotfixes/KB2842230/463941_intl_x64_zip.exe" + } +} + +$filename = $url.Split("/")[-1] +$compressed_file = "$tmp_dir\$($filename).zip" +Download-File -url $url -path $compressed_file +Extract-Zip -zip $compressed_file -dest $tmp_dir +$file = Get-Item -Path "$tmp_dir\*$kb*.msu" +if ($file -eq $null) { + Write-Error -Message "unable to find extracted msu file for hotfix KB" + exit 1 +} + +$exit_code = Run-Process -executable $file.FullName -arguments "/quiet /norestart" +if ($exit_code -eq 3010) { + Write-Verbose "need to restart computer after hotfix $kb install" + Restart-Computer -Force +} elseif ($exit_code -ne 0) { + Write-Error -Message "failed to install hotfix $($kb): exit code $exit_code" +} else { + Write-Verbose -Message "hotfix $kb install complete" +} +exit $exit_code \ No newline at end of file diff --git a/roles/oatakan.windows_template_build/files/Upgrade-PowerShell.ps1 b/roles/oatakan.windows_template_build/files/Upgrade-PowerShell.ps1 new file mode 100644 index 0000000..19409cb --- /dev/null +++ b/roles/oatakan.windows_template_build/files/Upgrade-PowerShell.ps1 @@ -0,0 +1,400 @@ +# PSScriptInfo +# .VERSION 1.0 +# .GUID 23743bae-7604-459d-82c5-a23d36b0820e +# .AUTHOR +# Jordan Borean <jborean93@gmail.com> +# .COPYRIGHT +# Jordan Borean 2017 +# .TAGS +# PowerShell,Ansible +# .LICENSEURI https://github.com/jborean93/ansible-windows/blob/master/LICENSE +# .PROJECTURI https://github.com/jborean93/ansible-windows +# .RELEASENOTES +# Version 1.0: 2017-09-27 +# Initial script created +# .DESCRIPTION +# The script will upgrade the powershell version to whatever is supplied as +# the 'version' on the host. The current versions can be set as the target +# 'version': +# - 3.0 +# - 4.0 +# - 5.1 (default if -Version not set) +# +# This script can be run on the following OS' +# Windows Server 2008 (with SP2) - only supported version 3.0 +# Windows Server 2008 R2 (with SP1) +# Windows Server 2012 +# Windows Server 2012 R2 +# Windows Server 2016 +# +# Windows 7 (with SP1) +# Windows 8.1 +# Windows 10 +# +# All OS' can be upgraded to 5.1 except for Windows Server 2008. If running +# on Powershell 1.0 then this script will first upgrade the version to 2.0 +# before running the checks. This is because a lot of the upgrade paths need +# this version installed as a baseline. If the .NET Framework version +# installed is less than 4.5.2, it will be upgraded to 4.5.2 as this is +# supported on all hosts and is required for v5.0. +# +# As multiple packages can be installed in this process, multiple reboots may +# be required to continue with the install. If a reboot is required the +# script will detect if the 'username' and 'password' parameters have been +# supplied. If they have been supplied it will automatically reboot and login +# to continue the install process until it is all complete. If these +# parameters are not set then it will prompt the user for a reboot and +# require the user to log back in manually after the reboot before +# continuing. +# +# A log of this process is created in +# $env:SystemDrive\temp\upgrade_powershell.log which is usually C:\temp\. This +# log can used to see how the script faired after an automatic reboot. +# +# See https://github.com/jborean93/ansible-windows/tree/master/scripts for more +# details. +# .PARAMETER version +# [string] - The target powershell version to upgrade to. This can be; +# 3.0, +# 4.0, or +# 5.1 (default) +# Depending on the circumstances, the process to reach the target version +# may require multiple reboots. +# .PARAMETER username +# [string] - The username of a local admin user that will be automatically +# logged in after a reboot to continue the script install. The 'password' +# parameter is also required if this is set. +# .PARAMETER password +# [string] - The password for 'username', this is required if the 'username' +# parameter is also set. +# .PARAMETER Verbose +# [switch] - Whether to display Verbose logs on the console +# .EXAMPLE +# # upgrade from powershell 1.0 to 3.0 with automatic login and reboots +# Set-ExecutionPolicy Unrestricted -Force +# &.\Upgrade-PowerShell.ps1 -version 3.0 -username "Administrator" -password "Password" -Verbose +# .EXAMPLE +# # upgrade to 5.1 with defaults and manual login and reboots +# powershell.exe -ExecutionPolicy ByPass -File Upgrade-PowerShell.ps1 +# .EXAMPLE +# # upgrade to powershell 4.0 with automatic login and reboots +# powershell.exe -ExecutionPolicy ByPass -File Upgrade-PowerShell.ps1 -version 4.0 -username "Administrator" -password "Password" -Verbose + +Param( + [string]$version = "5.1", + [string]$username, + [string]$password, + [switch]$verbose = $false +) +$ErrorActionPreference = 'Stop' +if ($verbose) { + $VerbosePreference = "Continue" +} + +$tmp_dir = $env:temp +if (-not (Test-Path -Path $tmp_dir)) { + New-Item -Path $tmp_dir -ItemType Directory > $null +} + +Function Write-Log($message, $level="INFO") { + # Poor man's implementation of Log4Net + $date_stamp = Get-Date -Format s + $log_entry = "$date_stamp - $level - $message" + $log_file = "$tmp_dir\upgrade_powershell.log" + Write-Verbose -Message $log_entry + Add-Content -Path $log_file -Value $log_entry +} + +Function Reboot-AndResume { + Write-Log -message "adding script to run on next logon" + $script_path = $script:MyInvocation.MyCommand.Path + $ps_path = "$env:SystemDrive\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" + $arguments = "-version $version" + if ($username -and $password) { + $arguments = "$arguments -username `"$username`" -password `"$password`"" + } + if ($verbose) { + $arguments = "$arguments -Verbose" + } + + $command = "$ps_path -ExecutionPolicy ByPass -File $script_path $arguments" + $reg_key = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" + $reg_property_name = "ps-upgrade" + Set-ItemProperty -Path $reg_key -Name $reg_property_name -Value $command + + if ($username -and $password) { + $reg_winlogon_path = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" + Set-ItemProperty -Path $reg_winlogon_path -Name AutoAdminLogon -Value 1 + Set-ItemProperty -Path $reg_winlogon_path -Name DefaultUserName -Value $username + Set-ItemProperty -Path $reg_winlogon_path -Name DefaultPassword -Value $password + Write-Log -message "rebooting server to continue powershell upgrade" + } else { + Write-Log -message "need to reboot server to continue powershell upgrade" + $reboot_confirmation = Read-Host -Prompt "need to reboot server to continue powershell upgrade, do you wish to proceed (y/n)" + if ($reboot_confirmation -ne "y") { + $error_msg = "please reboot server manually and login to continue upgrade process, the script will restart on the next login automatically" + Write-Log -message $error_msg -level "ERROR" + throw $error_msg + } + } + + if (Get-Command -Name Restart-Computer -ErrorAction SilentlyContinue) { + Restart-Computer -Force + } else { + # PS v1 (Server 2008) doesn't have the cmdlet Restart-Computer, use el-traditional + shutdown /r /t 0 + } +} + +Function Run-Process($executable, $arguments) { + $process = New-Object -TypeName System.Diagnostics.Process + $psi = $process.StartInfo + $psi.FileName = $executable + $psi.Arguments = $arguments + Write-Log -message "starting new process '$executable $arguments'" + $process.Start() | Out-Null + + $process.WaitForExit() | Out-Null + $exit_code = $process.ExitCode + Write-Log -message "process completed with exit code '$exit_code'" + + return $exit_code +} + +Function Download-File($url, $path) { + Write-Log -message "downloading url '$url' to '$path'" + $client = New-Object -TypeName System.Net.WebClient + $client.DownloadFile($url, $path) +} + +Function Clear-AutoLogon { + $reg_winlogon_path = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" + Write-Log -message "clearing auto logon registry properties" + Set-ItemProperty -Path $reg_winlogon_path -Name AutoAdminLogon -Value 0 + Remove-ItemProperty -Path $reg_winlogon_path -Name DefaultUserName -ErrorAction SilentlyContinue + Remove-ItemProperty -Path $reg_winlogon_path -Name DefaultPassword -ErrorAction SilentlyContinue +} + +Function Download-Wmf5Server2008($architecture) { + if ($architecture -eq "x64") { + $zip_url = "http://download.microsoft.com/download/6/F/5/6F5FF66C-6775-42B0-86C4-47D41F2DA187/Win7AndW2K8R2-KB3191566-x64.zip" + $file = "$tmp_dir\Win7AndW2K8R2-KB3191566-x64.msu" + } else { + $zip_url = "http://download.microsoft.com/download/6/F/5/6F5FF66C-6775-42B0-86C4-47D41F2DA187/Win7-KB3191566-x86.zip" + $file = "$tmp_dir\Win7-KB3191566-x86.msu" + } + if (Test-Path -Path $file) { + return $file + } + + $filename = $zip_url.Split("/")[-1] + $zip_file = "$tmp_dir\$filename" + Download-File -url $zip_url -path $zip_file + + Write-Log -message "extracting '$zip_file' to '$tmp_dir'" + try { + Add-Type -AssemblyName System.IO.Compression.FileSystem > $null + $legacy = $false + } catch { + $legacy = $true + } + + if ($legacy) { + $shell = New-Object -ComObject Shell.Application + $zip_src = $shell.NameSpace($zip_file) + $zip_dest = $shell.NameSpace($tmp_dir) + $zip_dest.CopyHere($zip_src.Items(), 1044) + } else { + [System.IO.Compression.ZipFile]::ExtractToDirectory($zip_file, $tmp_dir) + } + + return $file +} + +Write-Log -message "starting script" +# on PS v1.0, upgrade to 2.0 and then run the script again +if ($PSVersionTable -eq $null) { + Write-Log -message "upgrading powershell v1.0 to v2.0" + $architecture = $env:PROCESSOR_ARCHITECTURE + if ($architecture -eq "AMD64") { + # this url not working + #$url = "https://download.microsoft.com/download/2/8/6/28686477-3242-4E96-9009-30B16BED89AF/Windows6.0-KB968930-x64.msu" + $url = "http://download.windowsupdate.com/msdownload/update/software/updt/2011/02/windows6.0-kb968930-x64_4de013d593181a2a04217ce3b0e7536ab56995aa.msu" + } else { + # this url not working + #$url = "https://download.microsoft.com/download/F/9/E/F9EF6ACB-2BA8-4845-9C10-85FC4A69B207/Windows6.0-KB968930-x86.msu" + $url = "http://download.windowsupdate.com/msdownload/update/software/updt/2011/02/windows6.0-kb968930-x86_16fd2e93be2e7265821191119ddfc0cdaa6f4243.msu" + } + $filename = $url.Split("/")[-1] + $file = "$tmp_dir\$filename" + Download-File -url $url -path $file + $exit_code = Run-Process -executable $file -arguments "/quiet /norestart" + if ($exit_code -ne 0 -and $exit_code -ne 3010) { + $error_msg = "failed to update Powershell from 1.0 to 2.0: exit code $exit_code" + Write-Log -message $error_msg -level "ERROR" + throw $error_msg + } + Reboot-AndResume +} + +# exit if the target version is the same as the actual version +$current_ps_version = [version]"$($PSVersionTable.PSVersion.Major).$($PSVersionTable.PSVersion.Minor)" +if ($current_ps_version -eq [version]$version) { + Write-Log -message "current and target PS version are the same, no action is required" + Clear-AutoLogon + exit 0 +} + +$os_version = [Version](Get-Item -Path "$env:SystemRoot\System32\kernel32.dll").VersionInfo.ProductVersion +$architecture = $env:PROCESSOR_ARCHITECTURE +if ($architecture -eq "AMD64") { + $architecture = "x64" +} else { + $architecture = "x86" +} + +$actions = @() +switch ($version) { + "3.0" { + $actions += "3.0" + break + } + "4.0" { + if ($os_version -lt [version]"6.1") { + $error_msg = "cannot upgrade Server 2008 to Powershell v4, v3 is the latest supported" + Write-Log -message $error_msg -level "ERROR" + throw $error_msg + } + $actions += "4.0" + break + } + "5.1" { + if ($os_version -lt [version]"6.1") { + $error_msg = "cannot upgrade Server 2008 to Powershell v5.1, v3 is the latest supported" + Write-Log -message $error_msg -level "ERROR" + throw $error_msg + } + # check if WMF 3 is installed, need to be uninstalled before 5.1 + if ($os_version.Minor -lt 2) { + $wmf3_installed = Get-Hotfix -Id "KB2506143" -ErrorAction SilentlyContinue + if ($wmf3_installed) { + $actions += "remove-3.0" + } + } + $actions += "5.1" + break + } + default { + $error_msg = "version '$version' is not supported in this upgrade script" + Write-Log -message $error_msg -level "ERROR" + throw $error_msg + } +} + +# detect if .NET 4.5.2 is not installed and add to the actions +$dotnet_path = "HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" +if (-not (Test-Path -Path $dotnet_path)) { + $dotnet_upgrade_needed = $true +} else { + $dotnet_version = Get-ItemProperty -Path $dotnet_path -Name Release -ErrorAction SilentlyContinue + if ($dotnet_version) { + # 379893 == 4.5.2 + if ($dotnet_version.Release -lt 379893) { + $dotnet_upgrade_needed = $true + } + } else { + $dotnet_upgrade_needed = $true + } +} +if ($dotnet_upgrade_needed) { + $actions = @("dotnet") + $actions +} + +Write-Log -message "The following actions will be performed: $($actions -join ", ")" +foreach ($action in $actions) { + $url = $null + $file = $null + $arguments = "/quiet /norestart" + + switch ($action) { + "dotnet" { + Write-Log -message "running .NET update to 4.5.2" + $url = "https://download.microsoft.com/download/E/2/1/E21644B5-2DF2-47C2-91BD-63C560427900/NDP452-KB2901907-x86-x64-AllOS-ENU.exe" + $error_msg = "failed to update .NET to 4.5.2" + $arguments = "/q /norestart" + break + } + "remove-3.0" { + # this is only run before a 5.1 install on Windows 7/2008 R2, the + # install zip needs to be downloaded and extracted before + # removing 3.0 as then the FileSystem assembly cannot be loaded + Write-Log -message "downloading WMF/PS v5.1 and removing WMF/PS v3 before version 5.1 install" + Download-Wmf5Server2008 -architecture $architecture > $null + + $file = "wusa.exe" + $arguments = "/uninstall /KB:2506143 /quiet /norestart" + break + } + "3.0" { + Write-Log -message "running powershell update to version 3" + if ($os_version.Minor -eq 1) { + $url = "https://download.microsoft.com/download/E/7/6/E76850B8-DA6E-4FF5-8CCE-A24FC513FD16/Windows6.1-KB2506143-$($architecture).msu" + } else { + $url = "https://download.microsoft.com/download/E/7/6/E76850B8-DA6E-4FF5-8CCE-A24FC513FD16/Windows6.0-KB2506146-$($architecture).msu" + } + $error_msg = "failed to update Powershell to version 3" + break + } + "4.0" { + Write-Log -message "running powershell update to version 4" + if ($os_version.Minor -eq 1) { + $url = "https://download.microsoft.com/download/3/D/6/3D61D262-8549-4769-A660-230B67E15B25/Windows6.1-KB2819745-$($architecture)-MultiPkg.msu" + } else { + $url = "https://download.microsoft.com/download/3/D/6/3D61D262-8549-4769-A660-230B67E15B25/Windows8-RT-KB2799888-x64.msu" + } + $error_msg = "failed to update Powershell to version 4" + break + } + "5.1" { + Write-Log -message "running powershell update to version 5.1" + if ($os_version.Minor -eq 1) { + # Server 2008 R2 and Windows 7, already downloaded in remove-3.0 + $file = Download-Wmf5Server2008 -architecture $architecture + } elseif ($os_version.Minor -eq 2) { + # Server 2012 + $url = "http://download.microsoft.com/download/6/F/5/6F5FF66C-6775-42B0-86C4-47D41F2DA187/W2K12-KB3191565-x64.msu" + } else { + # Server 2012 R2 and Windows 8.1 + if ($architecture -eq "x64") { + $url = "http://download.microsoft.com/download/6/F/5/6F5FF66C-6775-42B0-86C4-47D41F2DA187/Win8.1AndW2K12R2-KB3191564-x64.msu" + } else { + $url = "http://download.microsoft.com/download/6/F/5/6F5FF66C-6775-42B0-86C4-47D41F2DA187/Win8.1-KB3191564-x86.msu" + } + } + break + } + default { + $error_msg = "unknown action '$action'" + Write-Log -message $error_msg -level "ERROR" + } + } + + if ($file -eq $null) { + $filename = $url.Split("/")[-1] + $file = "$tmp_dir\$filename" + } + if ($url -ne $null) { + Download-File -url $url -path $file + } + + $exit_code = Run-Process -executable $file -arguments $arguments + if ($exit_code -ne 0 -and $exit_code -ne 3010) { + $log_msg = "$($error_msg): exit code $exit_code" + Write-Log -message $log_msg -level "ERROR" + throw $log_msg + } + if ($exit_code -eq 3010) { + Reboot-AndResume + break + } +} \ No newline at end of file diff --git a/roles/oatakan.windows_template_build/meta/.galaxy_install_info b/roles/oatakan.windows_template_build/meta/.galaxy_install_info index 9059431..3f292bb 100644 --- a/roles/oatakan.windows_template_build/meta/.galaxy_install_info +++ b/roles/oatakan.windows_template_build/meta/.galaxy_install_info @@ -1,2 +1,2 @@ -install_date: Tue Apr 20 16:13:51 2021 +install_date: Wed Apr 21 16:48:36 2021 version: master diff --git a/roles/oatakan.windows_template_build/tasks/enable_tls_system_default.yml b/roles/oatakan.windows_template_build/tasks/enable_tls_system_default.yml new file mode 100644 index 0000000..99ff2dd --- /dev/null +++ b/roles/oatakan.windows_template_build/tasks/enable_tls_system_default.yml @@ -0,0 +1,51 @@ +# on Windows 7 SP1, TLS 1.1 and 1.2 is not enabled by default +# this hotfix is needed to fix that +# see https://support.microsoft.com/en-us/topic/support-for-tls-system-default-versions-included-in-the-net-framework-3-5-1-on-windows-7-sp1-and-server-2008-r2-sp1-5ef38dda-8e6c-65dc-c395-62d2df58715a + +- name: download hotfix + raw: '(New-Object -TypeName System.Net.WebClient).DownloadFile("{{ enable_tls_support_hotfix.url }}", "{{ enable_tls_support_hotfix_download_location }}\\{{ enable_tls_support_hotfix.file }}")' + changed_when: False + check_mode: no + register: download_hotfix + until: download_hotfix is success + delay: 3 + retries: 5 + +- name: delete scheduled task if it exists (hotfix) + raw: 'SCHTASKS /Delete /TN hotfix_install /f' + args: + executable: cmd.exe + changed_when: False + check_mode: no + ignore_errors: yes + +- name: create a scheduled task to install hotfix + raw: SCHTASKS /Create /SC MONTHLY /MO first /D SUN /TN hotfix_install /TR "{{ enable_tls_support_hotfix_download_location }}\\{{ enable_tls_support_hotfix.file }} /quiet /norestart" + args: + executable: cmd.exe + changed_when: False + check_mode: no + +- name: run scheduled task (hotfix) + raw: 'SCHTASKS /Run /TN hotfix_install' + args: + executable: cmd.exe + changed_when: False + check_mode: no + +- pause: + seconds: 30 + +- name: delete scheduled task (hotfix) + raw: 'SCHTASKS /Delete /TN hotfix_install /f' + args: + executable: cmd.exe + changed_when: False + check_mode: no + ignore_errors: yes + +- name: remove hotfix file + raw: 'Remove-Item -Path {{ enable_tls_support_hotfix_download_location }}\{{ enable_tls_support_hotfix.file }} -Force' + changed_when: False + check_mode: no + ignore_errors: yes \ No newline at end of file diff --git a/roles/oatakan.windows_template_build/tasks/security-update-win2012.yml b/roles/oatakan.windows_template_build/tasks/security-update-win2012.yml new file mode 100644 index 0000000..b8453b7 --- /dev/null +++ b/roles/oatakan.windows_template_build/tasks/security-update-win2012.yml @@ -0,0 +1,32 @@ +--- +# this update is needed to enable .NET clients to use https (tslv12) on Windows 8.1 and Windows Server 2012 R2 +# see https://www.microsoft.com/en-us/download/confirmation.aspx?id=42883 + +- name: download hotfix + win_get_url: + url: '{{ dot_net_security_hotfix.url }}' + dest: '{{ dot_net_security_hotfix_download_location }}\{{ dot_net_security_hotfix.file }}' + register: download_hotfix + until: download_hotfix is success + delay: 3 + retries: 5 + +- name: install hotfix (PS >= 4) + win_hotfix: + source: '{{ dot_net_security_hotfix_download_location }}\{{ dot_net_security_hotfix.file }}' + state: present + register: hotfix_install + when: ansible_powershell_version is version('4', '>=') + +- name: debug hotfix installation result + debug: + var: hotfix_install + +- name: ensure hotfix file is removed + win_file: + path: '{{ dot_net_security_hotfix_download_location }}\{{ dot_net_security_hotfix.file }}' + state: absent + +- name: reboot if needed + win_reboot: + when: hotfix_install.reboot_required | default(False) \ No newline at end of file diff --git a/roles/oatakan.windows_template_build/tasks/update-agent-win2008.yml b/roles/oatakan.windows_template_build/tasks/update-agent-win2008.yml new file mode 100644 index 0000000..5b47060 --- /dev/null +++ b/roles/oatakan.windows_template_build/tasks/update-agent-win2008.yml @@ -0,0 +1,13 @@ +--- +# this updates windows update which is needed to install further updates +# see https://docs.microsoft.com/en-US/troubleshoot/windows-client/deployment/update-windows-update-agent + +- name: ensure Windows Update Agent on 2008 is installed + win_package: + path: "{{ windows_update_agent_url }}" + arguments: + - /quiet + - /norestart + - /wuforce + creates_path: C:\Windows\System32\wuaueng.dll + creates_version: 7.6.7600.320 \ No newline at end of file diff --git a/roles/oatakan.windows_template_build/tasks/winrm-memfix.yml b/roles/oatakan.windows_template_build/tasks/winrm-memfix.yml new file mode 100644 index 0000000..e44cd8e --- /dev/null +++ b/roles/oatakan.windows_template_build/tasks/winrm-memfix.yml @@ -0,0 +1,69 @@ +--- + +# see https://docs.ansible.com/ansible/latest/user_guide/windows_setup.html#winrm-memory-hotfix + +- name: download script + raw: '[Net.ServicePointManager]::SecurityProtocol = [Enum]::ToObject([Net.SecurityProtocolType], 3072); (New-Object -TypeName System.Net.WebClient).DownloadFile("{{ ps_memfix_script_url }}", "{{ ps_memfix_script_file }}")' + changed_when: False + check_mode: no + register: download_script + +- name: set execution policy + raw: 'Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Force' + changed_when: False + check_mode: no + ignore_errors: yes + +- name: delete scheduled task if it exists + raw: 'SCHTASKS /Delete /TN memfix /f' + args: + executable: cmd.exe + changed_when: False + check_mode: no + failed_when: False + +- name: create a scheduled task to run powershell script + raw: > + SCHTASKS /Create /SC MONTHLY /MO first /D SUN /TN memfix /TR "powershell.exe -Command + '& {{ ps_memfix_script_file }} -Verbose'" + args: + executable: cmd.exe + changed_when: False + check_mode: no + +- name: run scheduled task + raw: 'SCHTASKS /Run /TN memfix' + args: + executable: cmd.exe + changed_when: False + check_mode: no + +- name: wait for system to reboot after fix + wait_for_connection: + delay: 240 + sleep: 30 + timeout: 300 + +- name: wait for powershell memfix task to finish + raw: '((schtasks /query /TN memfix)[4] -split " +")[-2]' + changed_when: False + check_mode: no + register: memfix_status_check + failed_when: false + until: (memfix_status_check.stdout | trim | lower) == 'ready' + delay: 10 + retries: 30 + +- name: delete scheduled task + win_scheduled_task: + name: memfix + state: absent + register: delete_scheduled_task + until: delete_scheduled_task is success + delay: 10 + retries: 10 + +- name: delete script + win_file: + path: "{{ ps_memfix_script_file }}" + state: absent \ No newline at end of file diff --git a/roles/oatakan.windows_update/.travis.yml b/roles/oatakan.windows_update/.travis.yml new file mode 100644 index 0000000..36bbf62 --- /dev/null +++ b/roles/oatakan.windows_update/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/roles/oatakan.windows_update/LICENSE b/roles/oatakan.windows_update/LICENSE new file mode 100644 index 0000000..8a6444e --- /dev/null +++ b/roles/oatakan.windows_update/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2020 Orcun Atakan + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. \ No newline at end of file diff --git a/roles/oatakan.windows_update/README.md b/roles/oatakan.windows_update/README.md new file mode 100644 index 0000000..4ed01a1 --- /dev/null +++ b/roles/oatakan.windows_update/README.md @@ -0,0 +1,53 @@ +# windows_update +This repo contains an Ansible role that updates Windows systems. This role mainly utilizes the win_update module, in +addition to that it provides retry capability for older OSes with many updates pending such as Windows 2008 R2 and +Windows 7. It also reports on installed updates. + +> **_Note:_** This role is provided as an example only. Do not use this in production. You can fork/clone and add/remove steps for your environment based on your organization's security and operational requirements. + +Requirements +------------ + +Role Variables +-------------- + +Dependencies +------------ + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - name: update windows systems + hosts: all + gather_facts: True + become: no + vars: + win_update_category_names: + - CriticalUpdates + - DefinitionUpdates + - SecurityUpdates + - UpdateRollups + - Updates + + roles: + - oatakan.windows_update + +For disconnected environments, you can overwrite this variable to point to a local copy of a script to enable winrm: + +**winrm_enable_script_url:** https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1 + +you can also localize virtio-win and update the virtio_iso_url variable to point to your local url: + +**virtio_iso_url:** https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-0.1.173-2/virtio-win.iso + +License +------- + +MIT + +Author Information +------------------ + +Orcun Atakan diff --git a/roles/oatakan.windows_update/defaults/main.yml b/roles/oatakan.windows_update/defaults/main.yml new file mode 100644 index 0000000..e9a1b41 --- /dev/null +++ b/roles/oatakan.windows_update/defaults/main.yml @@ -0,0 +1,25 @@ +--- + +update_retry_limit: 10 +win_update_category_names: + - CriticalUpdates + - DefinitionUpdates + - SecurityUpdates + - UpdateRollups + - Updates + +hotfix_download_location: "{{ ansible_env.TEMP }}" + +hotfixes_group_1: + - kb: KB3020369 + file: Windows6.1-KB3020369-x64.msu + url: https://download.microsoft.com/download/F/D/3/FD3728D5-0D2F-44A6-B7DA-1215CC0C9B75/Windows6.1-KB3020369-x64.msu + - kb: KB3125574 + file: windows6.1-kb3125574-v4-x64_2dafb1d203c8964239af3048b5dd4b1264cd93b9.msu + url: http://download.windowsupdate.com/d/msdownload/update/software/updt/2016/05/windows6.1-kb3125574-v4-x64_2dafb1d203c8964239af3048b5dd4b1264cd93b9.msu + - kb: KB4474419 + file: windows6.1-kb4474419-v3-x64_b5614c6cea5cb4e198717789633dca16308ef79c.msu + url: http://download.windowsupdate.com/c/msdownload/update/software/secu/2019/09/windows6.1-kb4474419-v3-x64_b5614c6cea5cb4e198717789633dca16308ef79c.msu + - kb: KB4490628 + file: windows6.1-kb4490628-x64_d3de52d6987f7c8bdc2c015dca69eac96047c76e.msu + url: http://download.windowsupdate.com/c/msdownload/update/software/secu/2019/03/windows6.1-kb4490628-x64_d3de52d6987f7c8bdc2c015dca69eac96047c76e.msu \ No newline at end of file diff --git a/roles/oatakan.windows_update/files/win-updates.ps1 b/roles/oatakan.windows_update/files/win-updates.ps1 new file mode 100644 index 0000000..9fbdb15 --- /dev/null +++ b/roles/oatakan.windows_update/files/win-updates.ps1 @@ -0,0 +1,229 @@ +param($global:RestartRequired=0, + $global:MoreUpdates=0, + $global:MaxCycles=5, + $MaxUpdatesPerCycle=500) + +$Logfile = "C:\Windows\Temp\win-updates.log" + +function LogWrite { + Param ([string]$logstring) + $now = Get-Date -format s + Add-Content $Logfile -value "$now $logstring" + Write-Host $logstring +} + +function Check-ContinueRestartOrEnd() { + $RegistryKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" + $RegistryEntry = "CustomRebootRequired" + switch ($global:RestartRequired) { + 0 { + $prop = (Get-ItemProperty $RegistryKey).$RegistryEntry + if ($prop) { + LogWrite "Restart Registry Entry Exists - Removing It" + Remove-ItemProperty -Path $RegistryKey -Name $RegistryEntry -ErrorAction SilentlyContinue + } + + LogWrite "No Restart Required" + Check-WindowsUpdates + + if (($global:MoreUpdates -eq 1) -and ($script:Cycles -le $global:MaxCycles)) { + Install-WindowsUpdates + } elseif ($script:Cycles -gt $global:MaxCycles) { + LogWrite "Exceeded Cycle Count - Stopping" + } else { + LogWrite "Done Installing Windows Updates" + } + } + 1 { + $prop = (Get-ItemProperty $RegistryKey).$RegistryEntry + if (-not $prop) { + LogWrite "Restart Registry Entry Does Not Exist - Creating It" + Set-ItemProperty -Path $RegistryKey -Name $RegistryEntry -Value "1" + } else { + LogWrite "Restart Registry Entry Exists Already" + } + + #LogWrite "Restart Required - Restarting..." + #Restart-Computer + } + default { + LogWrite "Unsure If A Restart Is Required" + break + } + } +} + +function Install-WindowsUpdates() { + $script:Cycles++ + LogWrite "Evaluating Available Updates with limit of $($MaxUpdatesPerCycle):" + $UpdatesToDownload = New-Object -ComObject 'Microsoft.Update.UpdateColl' + $script:i = 0; + $CurrentUpdates = $SearchResult.Updates + while($script:i -lt $CurrentUpdates.Count -and $script:CycleUpdateCount -lt $MaxUpdatesPerCycle) { + $Update = $CurrentUpdates.Item($script:i) + if (($Update -ne $null) -and (!$Update.IsDownloaded)) { + [bool]$addThisUpdate = $false + if ($Update.InstallationBehavior.CanRequestUserInput) { + LogWrite "> Skipping: $($Update.Title) because it requires user input" + } else { + if (!($Update.EulaAccepted)) { + LogWrite "> Note: $($Update.Title) has a license agreement that must be accepted. Accepting the license." + $Update.AcceptEula() + [bool]$addThisUpdate = $true + $script:CycleUpdateCount++ + } else { + [bool]$addThisUpdate = $true + $script:CycleUpdateCount++ + } + } + + if ([bool]$addThisUpdate) { + LogWrite "Adding: $($Update.Title)" + $UpdatesToDownload.Add($Update) |Out-Null + } + } + $script:i++ + } + + if ($UpdatesToDownload.Count -eq 0) { + LogWrite "No Updates To Download..." + } else { + LogWrite 'Downloading Updates...' + $ok = 0; + while (! $ok) { + try { + $Downloader = $UpdateSession.CreateUpdateDownloader() + $Downloader.Updates = $UpdatesToDownload + $Downloader.Download() + $ok = 1; + } catch { + LogWrite $_.Exception | Format-List -force + LogWrite "Error downloading updates. Retrying in 30s." + $script:attempts = $script:attempts + 1 + Start-Sleep -s 30 + } + } + } + + $UpdatesToInstall = New-Object -ComObject 'Microsoft.Update.UpdateColl' + [bool]$rebootMayBeRequired = $false + LogWrite 'The following updates are downloaded and ready to be installed:' + foreach ($Update in $SearchResult.Updates) { + if (($Update.IsDownloaded)) { + LogWrite "> $($Update.Title)" + $UpdatesToInstall.Add($Update) |Out-Null + + if ($Update.InstallationBehavior.RebootBehavior -gt 0){ + [bool]$rebootMayBeRequired = $true + } + } + } + + if ($UpdatesToInstall.Count -eq 0) { + LogWrite 'No updates available to install...' + $global:MoreUpdates=0 + $global:RestartRequired=0 + break + } + + if ($rebootMayBeRequired) { + LogWrite 'These updates may require a reboot' + $global:RestartRequired=1 + } + + LogWrite 'Installing updates...' + + $Installer = $script:UpdateSession.CreateUpdateInstaller() + $Installer.Updates = $UpdatesToInstall + $InstallationResult = $Installer.Install() + + LogWrite "Installation Result: $($InstallationResult.ResultCode)" + LogWrite "Reboot Required: $($InstallationResult.RebootRequired)" + LogWrite 'Listing of updates installed and individual installation results:' + if ($InstallationResult.RebootRequired) { + $global:RestartRequired=1 + } else { + $global:RestartRequired=0 + } + + for($i=0; $i -lt $UpdatesToInstall.Count; $i++) { + New-Object -TypeName PSObject -Property @{ + Title = $UpdatesToInstall.Item($i).Title + Result = $InstallationResult.GetUpdateResult($i).ResultCode + } + LogWrite "Item: " $UpdatesToInstall.Item($i).Title + LogWrite "Result: " $InstallationResult.GetUpdateResult($i).ResultCode; + } + + Check-ContinueRestartOrEnd +} + +function Check-WindowsUpdates() { + LogWrite "Checking For Windows Updates" + $Username = $env:USERDOMAIN + "\" + $env:USERNAME + + New-EventLog -Source $ScriptName -LogName 'Windows Powershell' -ErrorAction SilentlyContinue + + $Message = "Script: " + $ScriptPath + "`nScript User: " + $Username + "`nStarted: " + (Get-Date).toString() + + Write-EventLog -LogName 'Windows Powershell' -Source $ScriptName -EventID "104" -EntryType "Information" -Message $Message + LogWrite $Message + + $script:UpdateSearcher = $script:UpdateSession.CreateUpdateSearcher() + $script:successful = $FALSE + $script:attempts = 0 + $script:maxAttempts = 12 + while(-not $script:successful -and $script:attempts -lt $script:maxAttempts) { + try { + $script:SearchResult = $script:UpdateSearcher.Search("IsInstalled=0 and Type='Software' and IsHidden=0") + $script:successful = $TRUE + } catch { + LogWrite $_.Exception | Format-List -force + LogWrite "Search call to UpdateSearcher was unsuccessful. Retrying in 10s." + $script:attempts = $script:attempts + 1 + Start-Sleep -s 10 + } + } + + if ($SearchResult.Updates.Count -ne 0) { + $Message = "There are " + $SearchResult.Updates.Count + " more updates." + LogWrite $Message + try { + for($i=0; $i -lt $script:SearchResult.Updates.Count; $i++) { + LogWrite $script:SearchResult.Updates.Item($i).Title + LogWrite $script:SearchResult.Updates.Item($i).Description + LogWrite $script:SearchResult.Updates.Item($i).RebootRequired + LogWrite $script:SearchResult.Updates.Item($i).EulaAccepted + } + $global:MoreUpdates=1 + } catch { + LogWrite $_.Exception | Format-List -force + LogWrite "Showing SearchResult was unsuccessful. Rebooting." + $global:RestartRequired=1 + $global:MoreUpdates=0 + Check-ContinueRestartOrEnd + LogWrite "Show never happen to see this text!" + Restart-Computer + } + } else { + LogWrite 'There are no applicable updates' + $global:RestartRequired=0 + $global:MoreUpdates=0 + } +} + +$script:ScriptName = $MyInvocation.MyCommand.ToString() +$script:ScriptPath = $MyInvocation.MyCommand.Path +$script:UpdateSession = New-Object -ComObject 'Microsoft.Update.Session' +$script:UpdateSession.ClientApplicationID = 'Packer Windows Update Installer' +$script:UpdateSearcher = $script:UpdateSession.CreateUpdateSearcher() +$script:SearchResult = New-Object -ComObject 'Microsoft.Update.UpdateColl' +$script:Cycles = 0 +$script:CycleUpdateCount = 0 + +Check-WindowsUpdates +if ($global:MoreUpdates -eq 1) { + Install-WindowsUpdates +} else { + Check-ContinueRestartOrEnd +} \ No newline at end of file diff --git a/roles/oatakan.windows_update/meta/.galaxy_install_info b/roles/oatakan.windows_update/meta/.galaxy_install_info new file mode 100644 index 0000000..60c3454 --- /dev/null +++ b/roles/oatakan.windows_update/meta/.galaxy_install_info @@ -0,0 +1,2 @@ +install_date: Wed Apr 21 17:13:32 2021 +version: master diff --git a/roles/oatakan.windows_update/meta/main.yml b/roles/oatakan.windows_update/meta/main.yml new file mode 100644 index 0000000..a810a78 --- /dev/null +++ b/roles/oatakan.windows_update/meta/main.yml @@ -0,0 +1,30 @@ +--- +galaxy_info: + author: Orcun Atakan + description: Ansible galaxy role for updating Microsoft Windows systems + role_name: windows_update + company: Red Hat + + license: MIT + + min_ansible_version: 2.5 + + platforms: + - name: Windows + versions: + - all + + cloud_platforms: + - amazon + - google + - azure + - azure + - vmware + - ovirt + + galaxy_tags: + - windows + - update + - template + +dependencies: [] diff --git a/roles/oatakan.windows_update/tasks/main.yml b/roles/oatakan.windows_update/tasks/main.yml new file mode 100644 index 0000000..5f1aa06 --- /dev/null +++ b/roles/oatakan.windows_update/tasks/main.yml @@ -0,0 +1,49 @@ +--- + +- name: disable firewall for Domain, Public and Private profiles + win_shell: Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False + when: "'Windows Server 2012' in ansible_distribution" + +- name: disable firewall for Domain, Public and Private profiles + win_shell: netsh advfirewall set allprofiles state off + when: "'Windows Server 2008' in ansible_distribution or 'Windows 7' in ansible_distribution" + +- name: get used space before update + win_shell: Get-PSDrive C | Select-Object Used | ConvertTo-Json + register: used_space_before_update + ignore_errors: yes + +- include_tasks: updates-all.yml + when: + - "'Windows Server 2008' not in ansible_distribution" + - "'Windows 7' not in ansible_distribution" + +#- include_tasks: updates-powershell.yml +# when: +# - install_updates | bool +# - "'Windows Server 2008' in ansible_distribution" + +- include_tasks: updates-win2008r2.yml + when: + - "'Windows Server 2008' in ansible_distribution or 'Windows 7' in ansible_distribution" + +- name: get used space after update + win_shell: Get-PSDrive C | Select-Object Used | ConvertTo-Json + register: used_space_after_update + ignore_errors: yes + +- debug: + msg: + - "Used space before update: {{ ((used_space_before_update.stdout | from_json)['Used']|int / (1024*1024*1024)) | round(2, 'floor') }} GB" + - "Used space after update: {{ ((used_space_after_update.stdout | from_json)['Used']|int / (1024*1024*1024)) | round(2, 'floor') }} GB" + when: + - used_space_before_update.stdout is defined + - used_space_after_update.stdout is defined + +- name: enabled firewall for Domain, Public and Private profiles + win_shell: Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True + when: "'Windows Server 2012' in ansible_distribution" + +- name: enable firewall for Domain, Public and Private profiles + win_shell: netsh advfirewall set allprofiles state on + when: "'Windows Server 2008' in ansible_distribution or 'Windows 7' in ansible_distribution" \ No newline at end of file diff --git a/roles/oatakan.windows_update/tasks/updates-all.yml b/roles/oatakan.windows_update/tasks/updates-all.yml new file mode 100644 index 0000000..108b25b --- /dev/null +++ b/roles/oatakan.windows_update/tasks/updates-all.yml @@ -0,0 +1,43 @@ +--- + +- name: check for available updates + win_updates: + category_names: "{{ win_update_category_names }}" + blacklist: "{{ win_update_blacklist | default(omit) }}" + state: searched + register: available_updates + +- debug: + msg: | + {{ inventory_hostname }} has {{ available_updates.found_update_count }} updates available. + {% for key, value in available_updates.updates.items() %} + - {{ value.title }} + {% endfor %} + when: available_updates.updates is defined + +- include_tasks: updates-with-retry.yml + when: + - available_updates.updates is defined + - available_updates.found_update_count > 0 + +- name: check for missing updates. + win_updates: + state: searched + register: available_updates + +- name: list missing updates + debug: + var: available_updates + +- name: check to see if update is finished + win_shell: gwmi -Class win32_computersystem -ComputerName 127.0.0.1 | select -ExpandProperty username -ErrorAction Stop + register: logon_status + until: logon_status is success + delay: 10 + retries: 100 + ignore_errors: yes + when: "'Server' not in ansible_distribution" + +- name: reboot windows + win_reboot: + when: "'Server' not in ansible_distribution" \ No newline at end of file diff --git a/roles/oatakan.windows_update/tasks/updates-powershell.yml b/roles/oatakan.windows_update/tasks/updates-powershell.yml new file mode 100644 index 0000000..2f1a45c --- /dev/null +++ b/roles/oatakan.windows_update/tasks/updates-powershell.yml @@ -0,0 +1,98 @@ +--- + +- name: update over multiple reboots + block: + - name: check for available updates + win_updates: + category_names: + - CriticalUpdates + - DefinitionUpdates + - SecurityUpdates + - UpdateRollups + - Updates + state: searched + register: available_updates + + - debug: + msg: | + {{ inventory_hostname }} has {{ available_updates.found_update_count }} updates available. + {% for key, value in available_updates.updates.items() %} + - {{ value.title }} + {% endfor %} + when: available_updates.updates is defined + + - block: + - name: install windows updates using powershell script + script: win-updates.ps1 + become: yes + become_method: runas + become_user: SYSTEM + when: + - available_updates.updates is defined + - available_updates.found_update_count > 0 + + rescue: + - name: reboot the system to recover from a failed update + win_reboot: + reboot_timeout: 7200 + + - name: wait for system to be responsive after update + wait_for_connection: + delay: 60 + sleep: 10 + timeout: 600 + + - name: check to see if reboot is required + win_reg_stat: + path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update + name: CustomRebootRequired + register: update_reboot_required_key + + - name: reboot the system to continue with the update + win_reboot: + reboot_timeout: 7200 + when: update_reboot_required_key.exists + + - name: check for missing updates + win_updates: + category_names: + - CriticalUpdates + - DefinitionUpdates + - SecurityUpdates + - UpdateRollups + - Updates + state: searched + register: missing_updates + + - debug: + msg: | + {{ inventory_hostname }} has {{ missing_updates.found_update_count }} updates still missing. + {% for key, value in missing_updates.updates.items() %} + - {{ value.title }} + {% endfor %} + when: missing_updates.updates is defined + + - block: + - name: set update count + set_fact: + update_retry_count: '{{ update_retry_count | default(0) | int + 1 }}' + + - name: still more updates - need to retry + fail: + msg: > + '{{ inventory_hostname }} has {{ missing_updates.found_update_count }} updates still missing. + {{ (update_retry_limit | int) - (update_retry_count | int) }} more retries left' + when: ((update_retry_limit | int) - (update_retry_count | int) > 0) + when: missing_updates.found_update_count > 0 + + - name: ensure the CustomRebootRequired key doesn't exist + win_regedit: + path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update + name: CustomRebootRequired + state: absent + + rescue: + - debug: + msg: "Still more updates remaining - retrying..." + + - include_tasks: updates-powershell.yml \ No newline at end of file diff --git a/roles/oatakan.windows_update/tasks/updates-win2008r2.yml b/roles/oatakan.windows_update/tasks/updates-win2008r2.yml new file mode 100644 index 0000000..700c36f --- /dev/null +++ b/roles/oatakan.windows_update/tasks/updates-win2008r2.yml @@ -0,0 +1,81 @@ +--- + +- name: ensure Windows ADK with DISM is installed + win_chocolatey: + name: windows-adk-deploy + state: present + version: 10.0.17134.0 + register: install_windows_adk_deploy + +- name: ensure PATH contains Windows ADK + win_path: + scope: machine + state: present + elements: "C:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\amd64\\DISM" + +- name: download hotfix group 1 (PS >= 4) + win_get_url: + url: '{{ item.url }}' + dest: '{{ hotfix_download_location }}\{{ item.file }}' + loop: "{{ hotfixes_group_1 }}" + +- name: install hotfix group 1 + win_hotfix: + source: '{{ hotfix_download_location }}\{{ item.file }}' + state: present + register: hotfix_install_group_1 + loop: "{{ hotfixes_group_1 }}" + when: ansible_powershell_version is version('4', '>=') + +- name: install hotfix (PS == 3) + win_shell: '{{ hotfix_download_location }}\{{ item.file }} /quiet /norestart' + register: hotfix_install_group_1 + loop: "{{ hotfixes_group_1 }}" + when: ansible_powershell_version is version('3', '==') + +- name: debug hotfix installation result + debug: + var: hotfix_install_group_1 + +- name: ensure hotfix file is removed (group 1) + win_file: + path: '{{ hotfix_download_location }}\{{ item.file }}' + state: absent + loop: "{{ hotfixes_group_1 }}" + +- name: reboot from starting update + win_reboot: + +- name: check for available updates + win_updates: + category_names: "{{ win_update_category_names }}" + blacklist: "{{ win_update_blacklist | default(omit) }}" + state: searched + register: available_updates + +- debug: + msg: | + {{ inventory_hostname }} has {{ available_updates.found_update_count }} updates available. + {% for key, value in available_updates.updates.items() %} + - {{ value.title }} + {% endfor %} + when: available_updates.updates is defined + +- include_tasks: updates-with-retry.yml + when: + - available_updates.updates is defined + - available_updates.found_update_count > 0 + +- name: check for missing updates. + win_updates: + state: searched + register: available_updates + +- name: list missing updates + debug: + var: available_updates + +- name: make sure Windows ADK with DISM for Server 2008 R2 is not installed + win_chocolatey: + name: windows-adk-deploy + state: absent \ No newline at end of file diff --git a/roles/oatakan.windows_update/tasks/updates-with-retry.yml b/roles/oatakan.windows_update/tasks/updates-with-retry.yml new file mode 100644 index 0000000..facf18d --- /dev/null +++ b/roles/oatakan.windows_update/tasks/updates-with-retry.yml @@ -0,0 +1,84 @@ +--- + +- name: update over multiple reboots + block: + - block: + - name: install all windows updates + win_updates: + category_names: "{{ win_update_category_names }}" + blacklist: "{{ (win_update_blacklist | default([])) + (failed_kb | default([])) }}" + whitelist: "{{ win_update_whitelist | default(omit) }}" + reboot: yes + register: installed_updates + + rescue: + - name: reboot the system to recover from a failed update + win_reboot: + reboot_timeout: 7200 + + - name: set failed KB to skip + set_fact: + failed_kb: "{{ failed_kb|default([]) + [installed_updates.msg | regex_replace('^.*\\((KB.*)\\).*','\\1')] }}" + when: + - installed_updates.msg is defined + - ('Failed' in installed_updates.msg) + - ('KB' in installed_updates.msg) + + - name: fail to retry + fail: + msg: "There are failed updates: {{ failed_kb | join(' ') }}" + when: + - failed_kb is defined + - failed_kb | length > 0 + + - name: wait for system to be responsive after update + wait_for_connection: + delay: 60 + sleep: 10 + timeout: 600 + + - name: work on any skipped KB + win_updates: + category_names: "{{ win_update_category_names }}" + blacklist: "{{ win_update_blacklist | default(omit) }}" + whitelist: "{{ failed_kb | default([]) }}" + reboot: yes + register: installed_updates_retry_skipped + when: + - failed_kb is defined + - failed_kb | length > 0 + + - name: check for missing updates + win_updates: + category_names: "{{ win_update_category_names }}" + blacklist: "{{ win_update_blacklist | default(omit) }}" + state: searched + register: missing_updates + + - debug: + msg: | + {{ inventory_hostname }} has {{ missing_updates.found_update_count }} updates still missing. + {% for key, value in missing_updates.updates.items() %} + - {{ value.title }} + {% endfor %} + when: missing_updates.updates is defined + + - name: still more updates - need to retry + fail: + msg: > + '{{ inventory_hostname }} has {{ missing_updates.found_update_count }} updates still missing. + {{ (update_retry_limit | int) - (update_retry_count | int) }} more retries left' + when: + - missing_updates.found_update_count > 0 + - ((update_retry_limit | int) - (update_retry_count | int) >= 0) + + rescue: + - name: set update count + set_fact: + update_retry_count: '{{ update_retry_count | default(0) | int + 1 }}' + + - debug: + msg: "Still more updates remaining - retrying... ({{ update_retry_count }}/{{ update_retry_limit }})" + + - include_tasks: updates-with-retry.yml + when: ((update_retry_limit | int) - (update_retry_count | int) >= 0) \ No newline at end of file diff --git a/roles/oatakan.windows_update/tests/inventory b/roles/oatakan.windows_update/tests/inventory new file mode 100644 index 0000000..d18580b --- /dev/null +++ b/roles/oatakan.windows_update/tests/inventory @@ -0,0 +1 @@ +localhost \ No newline at end of file diff --git a/roles/oatakan.windows_update/tests/test.yml b/roles/oatakan.windows_update/tests/test.yml new file mode 100644 index 0000000..2c0141f --- /dev/null +++ b/roles/oatakan.windows_update/tests/test.yml @@ -0,0 +1,7 @@ +--- +- hosts: localhost + gather_facts: False + connection: local + become: no + roles: + - ../. \ No newline at end of file diff --git a/roles/oatakan.windows_virtio/meta/.galaxy_install_info b/roles/oatakan.windows_virtio/meta/.galaxy_install_info index 9486f98..2653d99 100644 --- a/roles/oatakan.windows_virtio/meta/.galaxy_install_info +++ b/roles/oatakan.windows_virtio/meta/.galaxy_install_info @@ -1,2 +1,2 @@ -install_date: Tue Apr 20 16:13:53 2021 +install_date: Wed Apr 21 16:48:40 2021 version: master diff --git a/roles/requirements.yml b/roles/requirements.yml new file mode 100644 index 0000000..afde9d2 --- /dev/null +++ b/roles/requirements.yml @@ -0,0 +1,25 @@ +# Java +- name: geerlingguy.java +# Node.js (Using this repo temporarily, as it fixes a package naming bug (See #95)) +# - src: https://github.com/halkeye/ansible-role-nodejs +# version: halkeye-patch-1 +# Gitlab +- name: geerlingguy.gitlab +# Windows Ovirt Template +- name: oatakan.windows_ovirt_template + src: git+https://github.com/oatakan/ansible-role-windows_ovirt_template.git +- name: oatakan.windows_template_build +- name: oatakan.ansible-role-windows-ad-controller + src: git+https://github.com/oatakan/ansible-role-windows-ad-controller.git +- name: oatakan.windows_ovirt_guest_agent +- name: oatakan.windows_virtio +- name: oatakan.windows_update +- name: oatakan.ansible-role-ovirt + src: git+https://github.com/oatakan/ansible-role-ovirt.git +- name: ikke_t.podman_container_systemd +- name: ikke_t.container_image_cleanup + +# Infra +#- name: bertvv.bind +#- name: bertvv.dhcp +- name: linux-system-roles.network diff --git a/roles/systemli.apt_repositories/.editorconfig b/roles/systemli.apt_repositories/.editorconfig new file mode 100644 index 0000000..73c5657 --- /dev/null +++ b/roles/systemli.apt_repositories/.editorconfig @@ -0,0 +1,17 @@ +# http://editorconfig.org + +root = true + +[*] +charset = utf-8 +end_of_line = lf +insert_final_newline = true +trim_trailing_whitespace = true + +[*.{py,rst,ini}] +indent_style = space +indent_size = 4 + +[*.{yml,yaml}] +indent_style = space +indent_size = 2 diff --git a/roles/systemli.apt_repositories/.github/dependabot.yml b/roles/systemli.apt_repositories/.github/dependabot.yml new file mode 100644 index 0000000..900df32 --- /dev/null +++ b/roles/systemli.apt_repositories/.github/dependabot.yml @@ -0,0 +1,7 @@ +--- +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" diff --git a/roles/systemli.apt_repositories/.github/workflows/main.yml b/roles/systemli.apt_repositories/.github/workflows/main.yml new file mode 100644 index 0000000..0fef583 --- /dev/null +++ b/roles/systemli.apt_repositories/.github/workflows/main.yml @@ -0,0 +1,53 @@ +--- +name: Integration +on: + pull_request: + push: + schedule: + # * is a special character in YAML so you have to quote this string + # first of each month + - cron: '0 0 1 * *' + +jobs: + + test: + name: Molecule + runs-on: ubuntu-latest + strategy: + matrix: + distro: + - debian10 + - debian9 + - ubuntu2004 + - ubuntu1804 + + steps: + - name: Check out the codebase. + uses: actions/checkout@v2 + + - name: Set up Python 3. + uses: actions/setup-python@v2 + with: + python-version: '3.x' + + - name: Install test dependencies. + run: pip3 install ansible-lint==4.3.7 molecule[docker] molecule-goss yamllint + + - name: Run Molecule tests. + run: molecule test -s docker + env: + PY_COLORS: '1' + ANSIBLE_FORCE_COLOR: '1' + MOLECULE_DISTRO: ${{ matrix.distro }} + + release: + name: Ansible Galaxy + needs: + - test + runs-on: ubuntu-latest + steps: + - name: Publish to Ansible Galaxy + uses: robertdebock/galaxy-action@1.1.1 + with: + galaxy_api_key: ${{ secrets.galaxy_api_key }} + if: github.ref == 'refs/heads/master' diff --git a/roles/systemli.apt_repositories/.yamllint b/roles/systemli.apt_repositories/.yamllint new file mode 100644 index 0000000..8827676 --- /dev/null +++ b/roles/systemli.apt_repositories/.yamllint @@ -0,0 +1,33 @@ +--- +# Based on ansible-lint config +extends: default + +rules: + braces: + max-spaces-inside: 1 + level: error + brackets: + max-spaces-inside: 1 + level: error + colons: + max-spaces-after: -1 + level: error + commas: + max-spaces-after: -1 + level: error + comments: disable + comments-indentation: disable + document-start: disable + empty-lines: + max: 3 + level: error + hyphens: + level: error + indentation: disable + key-duplicates: enable + line-length: disable + new-line-at-end-of-file: disable + new-lines: + type: unix + trailing-spaces: disable + truthy: disable diff --git a/roles/systemli.apt_repositories/LICENSE b/roles/systemli.apt_repositories/LICENSE new file mode 100644 index 0000000..733c072 --- /dev/null +++ b/roles/systemli.apt_repositories/LICENSE @@ -0,0 +1,675 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/> + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + {one line to give the program's name and a brief idea of what it does.} + Copyright (C) {year} {name of author} + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + {project} Copyright (C) {year} {fullname} + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +<http://www.gnu.org/licenses/>. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +<http://www.gnu.org/philosophy/why-not-lgpl.html>. + diff --git a/roles/systemli.apt_repositories/README.md b/roles/systemli.apt_repositories/README.md new file mode 100644 index 0000000..6ca73db --- /dev/null +++ b/roles/systemli.apt_repositories/README.md @@ -0,0 +1,107 @@ +apt_repositories +================ + +[![Build Status](https://github.com/systemli/ansible-role-apt_repositories/workflows/Integration/badge.svg?branch=master)](https://github.com/systemli/ansible-role-apt_repositories/actions?query=workflow%3AIntegration) + +Add third-party repositories in Debian and derivates and pin their packages. +Follows guide from [Debian wiki](https://wiki.debian.org/DebianRepository/UseThirdParty). + +It defaults to deb822, but also allows single line style ([manpage](https://manpages.debian.org/buster/apt/sources.list.5.en.html#THE_DEB_AND_DEB-SRC_TYPES:_GENERAL_FORMAT)). + +Requirements +------------ + +Debian 9+ or Ubuntu 18.04+. Other versions of Debian/Ubuntu might be supported as well, but aren't tested. + +Role Variables +-------------- + +``` +apt_repositories: + - url: https://... + key: | + -----BEGIN PGP PUBLIC KEY BLOCK----- + MY_ARMORED_KEY + ... +``` + +Further possible variables (and their defaults) are: + +``` +apt_repositories: + - url: https://... + name: "{{ item.url|urlsplit('hostname') }}" + types: deb + suites: "{{ ansible_distribution_release }}" + components: main + packages: [] + key_path: # a file path in the role `files` dir instead of `key` +``` + +Furthermore, it supports `preset` values. For an example see `vars/gitlab.yml`. +Presets can be partially overridden. + +Current presets: + + - gitlab + - grafana + - jitsi + - kubic + - prosody + - sury + +PRs welcome! + +Example Playbook +---------------- + +``` +- hosts: server + roles: + - systemli.apt_repositories + vars: + apt_repositories: + - name: packages.gitlab.com + url: https://packages.gitlab.com/gitlab/gitlab-ce/debian/ + key: "{{ gitlab_ce_key }}" + packages: + - gitlab-ce +``` + +or + +``` +- hosts: server + roles: + - systemli.apt_repositories + vars: + apt_repositories: + - preset: gitlab +``` + +or just add it as a dependency for `ansible-galaxy`: + +``` +# meta/main.yml +... +dependencies: + - role: systemli.apt_repositories + vars: + apt_repositories: + - name: download.jitsi.org + url: https://download.jitsi.org/ + key_path: jitsi-archive-keyring.gpg + suites: stable/ + components: '' + packages: "{{ jitsi_meet_packages }}" +``` + +License +------- + +GPLv3 + +Author Information +------------------ + +systemli.org diff --git a/roles/systemli.apt_repositories/defaults/main.yml b/roles/systemli.apt_repositories/defaults/main.yml new file mode 100644 index 0000000..74e0ea6 --- /dev/null +++ b/roles/systemli.apt_repositories/defaults/main.yml @@ -0,0 +1,8 @@ +--- + +apt_repositories_dependencies: + - ca-certificates + - file + - gnupg + +apt_repositories_absent: [] diff --git a/roles/systemli.apt_repositories/files/gitlab.asc b/roles/systemli.apt_repositories/files/gitlab.asc new file mode 100644 index 0000000..d7b27ff --- /dev/null +++ b/roles/systemli.apt_repositories/files/gitlab.asc @@ -0,0 +1,52 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBF5dI2sBEACyGx5isuXqEV2zJGIx8rlJFCGw6A9g5Zk/9Hj50UpXNuOXlvQl +7vq91m2CAh88Jad7OiMHIJJhX3ZJEOf/pUx/16QKumsaEyBk9CegxUG9jAQXsjL3 +WLyP0/l27UzNrOAFB+IUGjsoP+32gsSPiF5P485mirIJNojIAFzDQl3Uo4FbvqYU +9AIRk5kV4nEYz1aKXAovIUsyqrztMtwlAG2xqdwVpGD2A4/w8I143qPGjjhEQmf4 +/EeS4CP9ztyLAx+01t2Acwa7Bygsb5KQPuT25UlevuxdDy/Rd5Zn/Lzwr2GQqjUs +6GbM0t1HYjh57e4V+p0qMf6jxXfrDCbehgzFvGS0cx/d7hWHm5sXZIt3gxpjBQU2 +8MQWtrR8Y3nTBkCHwOKsXdsdD+YHxTq/yuvxl1Bcyshp29cGWv1es3wn2Z6i9tWe +asGfVewJZiXFSEqSBGguEmLyCAZcWgXvHOV2kc66wG4d4TGIxmoo9GBqEtBftCVH +MGDHt7zeg2hg6EIsx8/nj1duO5nBnbnik5iG8Xv46e/aw2p4DfTdfxHpjvyJudyN ++UI5eSuuuXhyTZWedd5K1Q3+0CmACJ39t/NA6g7cZaw3boFKw3fTWIgOVTvC3y5v +d7wsuyGUk9xNhHLcu6HjB4VPGzcTwQWMFf6+I4qGAUykU5mjTJchQeqmQwARAQAB +tEJHaXRMYWIgQi5WLiAocGFja2FnZSByZXBvc2l0b3J5IHNpZ25pbmcga2V5KSA8 +cGFja2FnZXNAZ2l0bGFiLmNvbT6JAlQEEwEKAD4WIQT2QD9lRKOIY9qgtuA/AWGK +UTEvPwUCXl0jawIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRA/ +AWGKUTEvP3/+EACEpR4JwFz7fAZxKoTzq1xkv7JiVC1jDnfZ6U6tumMDSIBLqlZX +Jv/lixuXC/GCnyiduqqpO14RCkHrCECzNeu7+lt+eiBUpOKvDgkNid6FLMoulu1w +hDhQWss6+40dIWwa5i8maIFg6WOwIiI24PW9T+ywrf2Gfv9mB1YP3ob+8Cx1EVb/ +sf5mu1SGHvq2PqNvPeyY3W5vU7rB0Ax5Kcn3e0Z+tUSC8fV7TCg9hm9o2Ou928K4 +hmvdFfR0t47cXt1wmZ/pjrWcezVqeIrMJyWtje4hgcO3TSXsfvedEdYn8Q/BgVRw +9KL4DkR1HSemSsPB4YyOwLscjV6p5OCPm0PhPPXUGIdImcQH7jYuEXNi5nnN5dX4 +197ooTB2UCk8r0QtnhcQUE2ph46mylcksbR0nKhGh5bYW3jfd0X+MP36reo+EFQ7 +Sw35f7P7QvZqnEE8rd5fX3GImKm38xJi+9bGb4IH8WuslUZUMapgQqqBfw1k5+mP +BBqKWSdEsP1i7LBv9jVOaauMYQPLZcodx5prgjrB89V1hCKu+ZQl/hzoCwmeSruD +LUqX/RFeleZO2VeKXh1a/VQ69ThqZ7gyXcrvHopPPGTr9IESoV9/qcZWplEccP9b +FuY9t6HuSpcL7SlbsRVQ0NBQrsQeZR2J0YgvRc3JWgZAfcE5MK2jcoWKCLkCDQRe +XSNrARAApHc0R4tfPntr5bhTuXU/iVLyxlAlzdEv1XsdDC8YBYehT72Jpvpphtq7 +sKVsuC59l8szojgO/gW//yKSuc3Gm5h58+HpIthjviGcvZXf/JcN7Pps0UGkLeQN +2+IRZgbA6CAAPh2njE60v5iXgS91bxlSJi8GVHq1h28kbKQeqUYthu9yA2+8J4Fz +ivYV2VImKLSxbQlc86tl6rMKKIIOph+N4WujJgd5HZ80n2qp1608X3+9CXvtBasX +VCI2ZqCuWjffVCOQzsqRbJ6LQyMbgti/23F4Yqjqp+8eyiDNL6MyWJCBbtkW3Imi +FHfR0sQIM6I7fk0hvt9ljx9SG6az/s3qWK5ceQ7XbJgCAVS4yVixfgIjWvNE5ggE +QNOmeF9r76t0+0xsdMYJR6lxdaQI8AAYaoMXTkCXX2DrASOjjEP65Oq/d42xpSf9 +tG6XIq+xtRQyFWSMc+HfTlEHbfGReAEBlJBZhNoAwpuDckOC08vw7v2ybS5PYjJ4 +5Kzdwej0ga03Wg9hrAFd/lVa5eO4pzMLuexLplhpIbJjYwCUGS4cc/LQ2jq4fue5 +oxDpWPN+JrBH8oyqy91b10e70ohHppN8dQoCa79ySgMxDim92oHCkGnaVyULYDqJ +zy0zqbi3tJu639c4pbcggxtAAr0I3ot8HPhKiNJRA6u8HTm//xEAEQEAAYkCPAQY +AQoAJhYhBPZAP2VEo4hj2qC24D8BYYpRMS8/BQJeXSNrAhsMBQkDwmcAAAoJED8B +YYpRMS8/vzQP/iO0poRR9ZYjonP5GGIARRnF+xpWCRTZVSHLcAfS0ujZ7ekXoeeS +JNMJ/7T4Yk1EJ9MTFZ83Jj4UybKO3Rw+/iPmcPpqUQGaEReYLlx7SyxmsOBXf+Q9 +PtyUmGO47tL+eAPInYyxsWGib/EeOw4KQrfByAIPWu0aeNeXadzxBLIkqD863H5q +nTDrXOw6SLprlGt2zlc+XQKDv3DZez6wTcp205xdaNs55Bfk9pmKUS/ey3ZP7GvC +CDEGxuWulVSKL2DYtq0sEZD7pQYSy8gBTqXLQAyfmPDcxe9Lczhk3UYrUUomN1/w ++VE09q75yNqkaHdckVt+aYAHMgQ0ilmwTg6+OlEK+ZQkUT94viB6YW7B0M4uzols +9FSDxXea/uKn75jTSkA3GAXf7O5hqbkDDctJbtO2pPdLDxbXN95iZ9xpgRE3exGl +ucjgV5XGpLO4XXf0GTzug/TJAtNljJ/44+6meO0WwOwLMMhAJVxcp1fpbtgRmrcJ +8bAsCkV5EO8SeQZDu2C8I9tMGlJ1VLTAfv6Lv2Z89B1AOOweGz4I48i9lux+HdXd +HewnA37zx0XNjNQmqiG85UWUusnDxF0Je2jEhGIpHK/KdyI1BfNzX3d5HVoM1VE3 +THtRZHnetoMek8L5x/ciYQNIt40rQ6MHtPEo1ZC4346DP6eJmeX1DGGI +=91uZ +-----END PGP PUBLIC KEY BLOCK----- diff --git a/roles/systemli.apt_repositories/files/gitlab.gpg b/roles/systemli.apt_repositories/files/gitlab.gpg new file mode 100644 index 0000000000000000000000000000000000000000..e38045da6a70e2f05eb0eef657aace13faed88f9 GIT binary patch literal 2298 zcmajfc{~%01IO_lX69bG!ZhT19uXacW}%dOJqt0%=A6mo+V-qx8gk58DOB?0n1>?A z%6*2!L*kJzM?#LdvgFA8?$_`4-|zqL=fCgkodc2(^7K$A0i^*|N-Bh^xh1$q^)Z6M z*SgCxsuc@T-g7zTeCp178<#VmvmWp@R(G2|T#o@AHPa}jo2WyPcky0Pm!-cP6xl_O z6pGf96b~bP`C7kso^MJKlCLuS?%J3>v=g;r*Y|uH0-cdjG}Sg=*^22%PxN&B-0#n- zf}Kh12H;*>c>GnsbZ=(M@Iml<IkGc16y7<raH9IEwuYsRD~4PR!1c-!u56+A7C3!< zJ(W6H(3NIvWf8Fb!}{*D`hGt*8GMxUVd7S}a066ZmwYz^HM=!;*|VAFA*KJG@*v<x z<N6DHM(JtY1^+(>C#(s^w3Sua-Q1rH1O=UxWpT~Pc=66gUrzYZiB;KzM~~!vlPR%^ zJ`l*6^$xjLoSQzhAz^ev>&$bHafH-7w9}-eXL%#b3D?t293K&O+xM)#sWti}e{1+j zP+Q(r9?V~(^ODV7p+LPugs&pPI5)_e@?6xN{`%Gs#3zHqt{`o`chI2$FOG)w3GX*G zjgzr~-U}AGZ{B@LcL_1gY0IsfxtATkLEm0n8+#o@mEccA!xz(jB-L?KcP!4*elD-0 zhS}eL5;<uzEFl=sxh0ajU$co`lH~e5Hwt0eyrvAfCQ4p4ZJ*L3QyO&}R5R~!?c>6@ z4NpHqZ#ya(9d3i9$O@X(S@A%-!e4R<?6OqPFR?8Fa3BE4v9Kma*x?CC3q5B&q;@FY zhlCICLx%Z<lEaA+<S-gCoEQ*73<*Gz{AfBzvwsi5(E-GWU_3$3hkPBC1i}g(28seu za;idGXmdZSf<&LO-(O9e1Mw`3fxbBe^pD4Zl)w-exIF*>5rc_9LBg`4FcC43kQ@jM z1gQW)^0xq@FzNp!(E@2eT#*W_6}NX&_{L9ho6m5*EmZ{UaUV&_=%Pbey$|@(E!$FO z7tMpYWTh;zjhH;`-1^cIQ%|_)`DGDw_37n?U3bQ>NNnNE3rUzn(&TO39=!)Ep>f7e zZoMXZsR-3z#d&?rK&JPiPlcM=ndxs$j=YMp{dmTKKh#-jGG4H*8wqzls1*1&VB=MG zU!e-f=Xlu@A>?1`+XlpGI&Z(zFEU<Q#cX_|+i9PRCkK99ZW?c|jVDdW@*`@}xSkWC zIeCj|FCWuS2T@snYH5_EuBtL$*Vt?D7~gZ@AG9{4+L+i-e*U(kRU|@-ZS%VAQ%YKE zgL0~8$?SCcBg;=_-~LiaxRlcYT|J`*4=2pi`sRkWM<y4Zo``bNF?(Tk{E57@lYL1- z8oS5kSS2Uo@gElx9(;7CPEjrhPVDcNEuo~brnVA0(banvTS1S{o0Uy^dEH3NE~(i( zMA-Y#MUH`Pke=Vah&3qnwkTyrOZa|SOczpQUDL9v*eCER$Xll!h|f~+;9kET#G8kt z7?ZZm;mA0(@|{c#f%1YF?1@c7>~Wi{eYofSd52LKmM6k(A8Yc>I4Gdj(4%Kfh2?1G zyUb@Edg>Kj(&fy?D2E=n%gvvwdAe$oCAOmDUMcG|FyK_)q2h-~dY`C&q3^AmF#5N) zvnR?5!fvxf>i$brA?1{HvKNX@nydY#F48>d%GWL@jlTE#!*qnWz5*oSsbf<TdzTnL z)=*ItT&wq6R`1DtV@Uy|<v{IjU0>IuY})3hMYWGU&8m-^?oa*5lHlzIzdv7id{$z7 z2JSE1x_|_r5XC7DoR;h?rhX*($Q4a}VeGFj6UfJc3sp)k9*<uO1CtxInBlA~+0iSS z+MLSkFx=)dzolwX?HEb+(bP|*0!=6lk#{ODsAQzf%qzMHMqhzElgFx^@&CQt&1ed% zp3&cPC-_OSrMgng$CmLMRKg!i#cL`($Ugl7L)Q#u$fz7QDPM;2ey~I2WWFiGUbT73 zFa78hC3dx-Z^^YBN0S^0&ISRowQpT386b7HO{;kkA@mTN>P1?67O`g+9MJ`{F1Zm| zD6$Sv2#S?=KxcV*F9X#JQY?38ms%*Pl|@?noRBQF7nLt%3}t;&!aq$pV4&AG?offi z%#3SsV}SNYv0;`mL%r*(`&HNV90`Wh+2<2&3w&mok((6$InYCJ)ot!`ZShI5I-V`t zm8e?f;{(V%qNg1Gbzsb-mhq*oKzh-2lc8B*{WYbucfx(dx?wQUntktPq$r5g5@rK7 zkkn}!W431y$6PeTyiJnc9Y0x8Tf=!&KQ&@pRD+CFLW7z_CX;U}Z`&jeV!+QD5ocQt z;Qyp531lXu@ONf3{|__b|6=BUIcYg1B~a(E<1pVIsON|8C=dV_j&$xRI>Tf}ud4Qj zLI(#IMpqW)pMJS}YzTJ1*(TUqX$>8g%`?(O$-J#fn@~mx)aOHYgD}8{aQSRK9Nkve zzhc@YdiETOo0;uXyE-VKg1d85Dl75%<P8;5Nl}ZMwr-G=+lnG}B#X%15UM)%hq(!t z5tMsk8OJlZR8PtzMfJO&JV3E6p`&zEg?&%d&|{Cl@w2n?vs*bVjQ(VAlp~MSE@B|u zHCKKg%hLD$_^M17p0QUXe5kh@=up&)7SGFG=XS2yh8z1%T>KehqiN)|zJocnRld_b zRv1XZ-En6SZ$S-(PO+|4I7l{|U_^H^k73NI&B$NzA#DTwdi_bkd~9qd<)L7vcrAO# z25qDOnc}VDOX|Q9y_Z9VUKM_~m697Vnj{2piA=Z=9bQz|J?(P8tFXG(gTg;zwi?TS z3mWoE$=m+C%BHT!werMHbfYzJxMG*ZkdN?(HL#5eUC|3P>9s>NVao>ZM)h$!#Ve6m zPAfx@+~R+ek3bvqRFqI6pSznL@EC~U2?S3I%-DQ$p)chx%~I9IxeJ-~Z(nzK!03S; zaReRZ7d;fU(~!+@FA5FeCO(WYvZG^sX_K#FRqnO#y!oz%2Vbg5{n@er%GuB!&ZwPA Pi#0D!%9;Bnj!*m>V^c&i literal 0 HcmV?d00001 diff --git a/roles/systemli.apt_repositories/files/grafana.gpg b/roles/systemli.apt_repositories/files/grafana.gpg new file mode 100644 index 0000000..c74f292 --- /dev/null +++ b/roles/systemli.apt_repositories/files/grafana.gpg @@ -0,0 +1,30 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1 + +mQENBFiHXVIBCADr3VDEAGpq9Sg/xrPVu1GGqWGXdbnTbbNKeveCtFHZz7/GSATW +iwiY1skvlAOBiIKCqJEji0rZZgd8WxuhdfugiCBk1hDTMWCpjI0P+YymV77jHjYB +jHrKNlhb+aLjEd9Gf2EtbKUT1fvGUkzlVrcRGSX/XR9MBZlgja7NIyuVbn3uwZQ4 +jflWSNSlvMpohNxTFkrBFTRrCJXhbDLfCS46+so22CP3+1VQyqJ7/6RWK9v9KYdS +AVNgILXMggSrMqha4WA1a/ktczVQXNtP8IuPxTdp9pNYsklOTmrFVeq3mXsvWh9Q +lIhpYHIZlTZ5wVBq4wTRchsXC5MubIhz+ASDABEBAAG0GkdyYWZhbmEgPGluZm9A +Z3JhZmFuYS5jb20+iQE4BBMBAgAiBQJYh11SAhsDBgsJCAcDAgYVCAIJCgsEFgID +AQIeAQIXgAAKCRCMjDTFJAmMthxJB/9Id6JrwqRkJW+eSBb71FGQmRsJvNFR8J+3 +NPVhJNkTFFOM7TnjAMUIv+LYEURqGcceTNAN1aHq/7n/8ybXucCS0CnDYyNYpyVs +tWJ3FOQK3jPrmziDCWPQATqMM/Z2auXVFWrDFqfh2xKZNjuix0w2nyuWB8U0CG2U +89w+ksPJblGGU5xLPPzDQoAqyZXY3gpGGTkCuohMq2RWYbp/QJSQagYhQkKZoJhr +XJlnw4At6R1A5UUPzDw6WJqMRkGrkieE6ApIgf1vZSmnLRpXkqquRTAEyGT8Pugg +ee6YkD19/LK6ED6gn32StY770U9ti560U7oRjrOPK/Kjp4+qBtkQuQENBFiHXVIB +CACz4hO1g/4fKO9QWLcbSWpB75lbNgt1kHXP0UcW8TE0DIgqrifod09lC85adIz0 +zdhs+00lLqckM5wNbp2r+pd5rRaxOsMw2V+c/y1Pt3qZxupmPc5l5lL6jzbEVR9g +ygPaE+iabTk9Np2OZQ7Qv5gIDzivqK2mRHXaHTzoQn2dA/3xpFcxnen9dvu7LCpA +CdScSj9/UIRKk9PHIgr2RJhcjzLx0u1PxN9MEqfIsIJUUgZOoDsr8oCs44PGGIMm +cK1CKALLLiC4ZM58B56jRyXo18MqB6VYsC1X9wkcIs72thL3tThXO70oDGcoXzoo +ywAHBH63EzEyduInOhecDIKlABEBAAGJAR8EGAECAAkFAliHXVICGwwACgkQjIw0 +xSQJjLbWSwf/VIM5wEFBY4QLGUAfqfjDyfGXpcha58Y24Vv3n6MwJqnCIbTAaeWf +30CZ/wHg3NNIMB7I31vgmMOEbHQdv0LPTi9TG205VQeehcpNtZRZQ0D8TIetbxyi +Emmn9osig9U3/7jaAWBabE/9bGx4TF3eLlEH9wmFrNYeXvgRqmyqVoqhIMCNAAOY +REYyHyy9mzr9ywkwl0aroBqhzKIPyFlatZy9oRKllY/CCKO9RJy4DZidLphuwzqU +ymdQ1sqe5nKvwG5GvcncPc3O7LMevDBWnpNNkgERnVxCqpm90TuE3ONbirnU4+/S +tUsVU1DERc1fjOCnAm4pKIlNYphISIE7OQ== +=0pMC +-----END PGP PUBLIC KEY BLOCK----- diff --git a/roles/systemli.apt_repositories/files/jitsi-archive-keyring.gpg b/roles/systemli.apt_repositories/files/jitsi-archive-keyring.gpg new file mode 100644 index 0000000000000000000000000000000000000000..cf70caa5e350ab2de735558b1b6e5dd49eaf4b2d GIT binary patch literal 2203 zcmV;M2xRw}0u2OLYgPjR5CF4Q0klpWo>(3drC~?de>4!3wo_LiJ^C-g`wip@{|@zp z((n%9IJu4TleBJMM8S2&^v~8%dkpEJzT+}ikJ->IzC5-$2<U%PPm<kYtx@RR(%Llm zj(q`8C~ML8XPGB3O}7@o*y8jBWBbJrHC4T_L_}GpJhbBeZNU3pa%fFqAp4tBnuEqb zizQom64b*+s{Xrp$X3#NS`=MB-3RJ;qwhLpi`%FX=gxmslXYInkk#m+Zp?Ep9L6RI z_Qan=-R9hIrMdH=$q<|1F%NwtUC+P~(dSVm=jh2(ARLdPpWn0x%`;%gM635wPVA`v zOsiXH)89TEN91!m-)@i%8s0sepYygLy9DF_`63PBYG|(A4WO1+m^oQN6SL{<UR*T8 z;l{!@tcai1MyG6QGluGQSSF%&icP1(9#;yg(Za(gQYcb^0q9;ibQ1mwv0T$&2YLLT zV>woL8>~SeZ%KO$<;T-fMryUu{2O?k5mYUrPckC1or<%BhGzaSiYfBCGS92Tlmr`k zL|(L`>}{<~%xC&pCB7DQZdHgoydV7XWv%J>re0m#pM0nWH$y`865Q%}nT%@V8lU~> z*XAKedC9(SmjQbcYdPxAkGdOcR~L1S>$~1hoyBHe3@!)b1QvVxtboD;buO6-;~X~M z40t&A>{_Jhw50$M0RREC6-sGzb7>$vWMy_hYH4(HX)bSaXFiDnHv|&_3IHJm0#|ER z0|FZZ1q%rX2LlBa3JC}c1r`GW0RRFX0Rk6*0162Z?~6yCEx|aPx9$)ADEvD%s03dK zxyA$u6l6fxBA_x#9=#(nft<Ug8@K@NY|G*ZMHEUjH+wsPuRz=3Dw3ZYv8BiSkkR<t z&)>bu^0p~6Iqffe8{T>5yOITG-eKx{)w=$vSApa=>Gejn>n8NvhJs^fh7r-b2!uP| z*0g=u?Q=~g9VBhXvZx>hx=T(|6JkVV9!)Ansot{tru)^C9Quog68|0**DJFU7mlXT zS+o)1<$8|PDC~JegBSgHd_*#O?!K>Mchq%q<Ak=u0>`!iB%PXy<H%?E;?Pbdefd~6 zGS@%XIj0K~p_);}7dgtzE{$EKdi@nLexD1y-A9qXrb{F~Y97Nb&luu1jw;cM<j+hK zM?gs9C*~Wc^}4E>R!?-UT)~pyG)T*j!1A+^0Z7-!qt(Z5loun@J0y;{T|AW=QD^{q zZrpsEuou?X#ck_%Ee$(kzdYtA>7Wi_ZT8I^!<EpZSdUP|ps=06gkSdetzP@xt>%M3 zEaFXyjee8}m{KF<@n!%u35B%04Iwf7D)kJ2MmutEQqD1JSq6BYe?CDmv)rFaCQvr| z)~u+>VoJTNXX>fhUK5T;(d&-vqL&=UM|S)g+xFNV7&>I*7Z(p@Ja|xrEc(L2>^DKD zPb@BT+uFeYNAdRlf{Mk@$&x04>InOHGS*629>I>TJ$S*tumS)BxdIIYS8G-S0T2N1 zSlW@vj@kjBf7nJ*Sq>yL`9x!`h}yJ^4M^7Zw1t`m=k=seZ@}u(qe&$Wa)E7SrB6Eg zDAQ0lH_k+50>OMEsqoC1us4(~0ae4pSOa{wz3I1J1YRRD(KE4&HkGHI>d{0PCoz2% z$12i#u=4>bk%cisSw|QcgoG!s)Q}8~?F4N6`X236x_&hAy+G-C{CWo%mPs!Ksc6Ak zHkl%nFbYJmdX=I5Cl<^#vGseCynNqCu86y#@S1md6zV~aH#)N}Dul$r6imkyiwdde zGp*Fi4DL6ZoU-8<Wjw}+Mc+S<v~Ve-K;@D36s=Os6{LNx$wCw_8`7fPmCuf5$w3mV z=#!olwEcnZD8zytLhkl+yQxPbDtQ!mJ7I3RXdBF#tu}DJCEYb4#TFL5Nh|6Ne(?TT z^(*t<LhIn7YC4FcD>MoNdd0sW>KNXE6m?85>5n`x&}ST3E@14U;YT*1ADTb{D!jhE zlwo;M0SW01B+UxOryYKE9-OK`1j<#etrb6o>O{g<n>P?o!1Cgq#?Mb&bYDYxGB?-t zchbi(nxcqEiIr-5vB+9Vi7&)e)i&bJK6co1HZ6?8z{W^k#r*oU-J17}+r05raC+Y- zx7KOHdDGJKnHn{izHw7%QB%kK2)FGk5Z=X19#n5>I=E+n&BL6qHNQ;&5di=Ji2@%4 z7y$|Z2?YXIYgPjS8w>yn2@vm#N1iRgIGm4r5B(Gi6&;b<xX*^ExkWUb`8a}wqQo~+ z#avu|1btN&zbfwDP}}LAL|Ff%cPYALhOrZh72%)Ou_gm;k2FmM-03s4b_o-c&A*(} zQQ(<bM_n}!L?%1#6C1mT`i1|ppkFSmhs$<i*Fm0WUB2e7JT+GRj79XP*XBO9hU6k@ z4{c9tnhr*>1MwWBu&(Uzso^!%H(b~u)OxJ3%i;>H*ZE{?Fs0M|X*U}_IlwZ2=GKSy zCK=-<$uS!n5?xa}X0N1hBIuTZ$iBX)viCWbkv>C5M&u(V{4AWF2oAtYgF%~8;TbX~ zqkEOQu)EAM3qHpzoYX12=brY(SiwW0;_8iwt2ndM*<z*!^~Qvr-OCr0AX~Ns+sa$n zi(busyC?q{Jky)L_}4%%qO*wcClN7~?7_0e{QqCGi;U79qf$7Q7@1kBn)G>^*sIXI zb78u1*T5*=UUa;91}<00wmG-xx7=H8(Qe!e=xJMRxJg>xUhB5A><uW4qMvItEpE&9 zP8{T_apYK0|CZWkaDQXI4efD9Q4@oHYuWS?=>4k@z4^9QJX>r~A~omGy~%_OV}zzj zn3jH{g<w^rnC9d=glMl*1?{)nWX`v$aMHgT6y&!-wS+p6JCDlntwlMOIlOM8J61#m dzOr9&(&5$v0dc(81}*+{C0H}iWeBhW00WMIGwuKY literal 0 HcmV?d00001 diff --git a/roles/systemli.apt_repositories/files/kubic.asc b/roles/systemli.apt_repositories/files/kubic.asc new file mode 100644 index 0000000..704c04b --- /dev/null +++ b/roles/systemli.apt_repositories/files/kubic.asc @@ -0,0 +1,21 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.5 (GNU/Linux) + +mQENBFtkV0cBCADStSTCG5qgYtzmWfymHZqxxhfwfS6fdHJcbGUeXsI5dxjeCWhs +XarZm6rWZOd5WfSmpXhbKOyM6Ll+6bpSl5ICHLa6fcpizYWEPa8fpg9EGl0cF12G +GgVLnnOZ6NIbsoW0LHt2YN0jn8xKVwyPp7KLHB2paZh+KuURERG406GXY/DgCxUx +Ffgdelym/gfmt3DSq6GAQRRGHyucMvPYm53r+jVcKsf2Bp6E1XAfqBrD5r0maaCU +Wvd7bi0B2Q0hIX0rfDCBpl4rFqvyaMPgn+Bkl6IW37zCkWIXqf1E5eDm/XzP881s ++yAvi+JfDwt7AE+Hd2dSf273o3WUdYJGRwyZABEBAAG0OGRldmVsOmt1YmljIE9C +UyBQcm9qZWN0IDxkZXZlbDprdWJpY0BidWlsZC5vcGVuc3VzZS5vcmc+iQE+BBMB +CAAoBQJfcJJOAhsDBQkIKusHBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRBN +ZDkDdQYKpB0xCACmtCT6ruPiQa4l0DEptZ+u3NNbZfSVGH4fE4hyTjLbzrCxqcoh +xJvDKxspuJ85wWFWMtl57+lFFE1KP0AX2XTT+/v2vN1PIfwgOSw3yp2sgWuIXFAi +89YSjSh8G0SGAH90A9YFMnTbllzGoGURjSX03iasW3A408ljbDehA6rpS3t3FD7P +PnUF6204orYu00Qvc54an/xVJzxupb69MKW5EeK7x8MJnIToT8hIdOdGVD6axsis +x+1U71oMK1gBke7p4QPUdhJFpSUd6kT8bcO+7rYouoljFNYkUfwnqtUn7525fkfg +uDqqXvOJMpJ/sK1ajHOeehp5T4Q45L/qUCb3iEYEExECAAYFAltkV0cACgkQOzAR +t2udZSOoswCdF44NTN09DwhPFbNYhEMb9juP5ykAn0bcELvuKmgDwEwZMrPQkG8t +Pu9n +=42uC +-----END PGP PUBLIC KEY BLOCK----- diff --git a/roles/systemli.apt_repositories/files/prosody-debian-packages.gpg b/roles/systemli.apt_repositories/files/prosody-debian-packages.gpg new file mode 100644 index 0000000000000000000000000000000000000000..117d429b10a36e6b3c965953622226f42e1a004b GIT binary patch literal 1686 zcmV;H25I@30ipy-7dkN!1OWER36gdytVU|nsY;w0g{DnUbPl+rX@>Xyyf88prJ;2F zsM~{R=Sgq!&3_1DNwS6Cl1G7sc=-|?z%uXS18SPY2i2AiQZ3{EQ@O)p)$&oi*QNF~ z(Wi^&#sa%c>%hHd7f25WsM%gd<ts-Z*9t%Inr}}mQar1yDsVgYdB*^t^nVLJ!C0Qo zk#ci8f1o<YlSdI-1OUHLU?^dc=P&>2r))V&9O6^)G!x-3Dd`q1X_3TT9{0Zc<Iw;5 zFC0F!rb(#@m88~-Upq@k)we0|5%`?=NU%wvBlx*;c~Mdno~G#>B^lfq!x`c3PMLAG zwicT?#NUF9lFqA%dK3bcKay%ZOj@Dwq{OFDe`ViOcDRspNP+|YHb@yv+zfPaxVE+t z(h?OF>7bjl)O{ah=8^3SvkFu(H}O$D`)|v6p~l&WdIoewNDFpK*-I|ygt@vFINOe5 z5GJ23MffaUE@NKE9zONoBZp_i{kLMk7+bxg6FU$}1IbdnCJi4(e(bCezo)Yu1U+QI zR**V!BdR#6e|NpGv@%d~Z*y;Cc_2wmAVg(iX<=?4P+?<hVP|D?AUtGcc4cgDaAk6H zKyY$zb8lpME@^E(h+qU05dr`p1p-PJIxzwp0|pBT2nPcK1Qh}Z0|XWV0|5da0Rk6* z0162ZbCcKRblKar)WiUt8!G33xDQ!Bvq-c~4mF2T!)yU<0HC&mox@;F*YY#fB~Vip z;q0DF?R>ce4FpOTI{*+60Kwl*BWq@<Edxh(e7_oEqeqqhPln**n_x`itAd`Q96Y;< zhE{;i;IqM}D;_la`X}eE_+5@QtvD}NjtuY^ro7|DPM{VGeqU?5k}(m<u|r%LRUJb^ zK!ps3s#P8vB`jbh*3!w*smNCe`z{_Ix3U?lZ_BI(`AHpYN@;kjt@+wKD$5%UX8!d@ z>_?4P<KZfV*i<^*icmodN{I3t{_i{LZCk`GI4b0IZs8*XLZv)#5sYQMbZ7rdF*4v* z9JsuVJxGy6eSjzC{KAJGewF8JqMshmvoA>YC<;KmD56_K4c@EQiFJ8t>iZ2_n_isj zOSM3F5_-!x>OnOYZHQ)rV+x<5V#R_z%Zxn`(V>uc3a7+lItNes7jvT`kToGW*DX!X z=+Fu0?DLRXT&l>KOUWf%;#f-)0xYzxK6&~(gL-(tm}x?oDGdoQbbYmm+;R6mrJYZA z?fN!kR_sSvHu9nYm18Ax-RpMrdC2&pc>CT3ZEM|G(GCM)!_-EPZbdCOQg`(F57Hp< z(Oq6B8p|4^23}y)0f^TJFKiH;_6m~l&mGdjEXaXN`G$xKAhxWqT{&PKJPy*slTiWe zKa)y8RvY2B-oAsDH00(Q<5-Y{)H1j^{05T+eJ8$V4K4b4IVTc+A;#T}NHefpKkm?{ zgetnm7#3~!UjPFI5C4A)c|a_4?#Fovu2_p%y*R*m2Yb{&qR?;RAn%-TW(B;0gfPV` zC6pQ%np)l;Bh*X0y1@kdbrddsmY0?(h$=`1kutK}XPT+@Zx)KQH$}8QH-vS6d7zNG z;>tJLrpKjhrP_x|qkh*G?T{LX2NR71vu?4c!O3MT*N_y%R?A|fxpe$DJlZH6V$r<2 zYTla8&|RYhvZA^=O-W(DL#w|5yhxvVjfsP$+f7?26e3_h@d=R-WCzJfV7?OdG=7ll zOx(UO3fZ0@2A0qf;Y^_=%97m>EC;6b*_vRj<Ed>h3EmMC>9!^#1y4coKRNOdk&`Bl zS7+lq(TvIc9wK9N`EOX4oSEF&)YFO-D4@^DZa8*cNpO<igvW+1A03c$NT<UTmCl;3 z{i5O1V@PtnSuB(LW8MzV&w3jbfZK1*mzV`*KKmwFF;4Sv#Y<`-1E!*u_R)ni4iG*v z<VSgFv0Q$<;t4#DwU{Q<>RvV`>pGt~4`MSgd1_@bzeQ<zF4a`PRI9&3r4v1|57ct5 zQXuut0Z@~2Y)aSGhIH^%RzcaIeg1u1(@Vd$&pdVt3U-8|?veqGPk2ZsY~xWUrxEGY zl_0?Ym&(NmhYRjJ|LHCQjLMQvfc-L{&U%2|mu6<75|xP8OBdtzIu^QiFjK@x^VX<e za_-JnF`9@;1Q-zl00{*GN*6l-0vikf3JDN%lh@{S+1s_IO#q<ZW$jg+MD(H$4wor1 gxK;a%DYu;fo-~-WI0G7mn@1Q%4AQq!tR6hoi&+5)^Z)<= literal 0 HcmV?d00001 diff --git a/roles/systemli.apt_repositories/files/sury.gpg b/roles/systemli.apt_repositories/files/sury.gpg new file mode 100644 index 0000000000000000000000000000000000000000..d244923b5587d3c264b1f98e7d7da83532bb9d5a GIT binary patch literal 1769 zcmaje_d6R50>JSkLI`hDiqxoCgw`lEUMo?nYP~^>qDDgGtcp;1y;1a4Ge%J}inEfc zR!Lj?YL-K-k|2jtI#8=lBlOmD&)skDAMpL@`+Q1(RIpD@<RhR6VET-UePbYw=|7J) z)09lZ!ex63y6#80tFP)%_FW|vbXr4xmlB1~1W7VZGk;tTADFz3>&{FzXq!uO&#+RX z%FyVjG1w_>x%gg#={7RU7r{|t0vUe1*$k%({YmTRp)of);2zSAO)~{Ybl%qUAc5lL z{ehdOC&~863gt!>1!XdJ^@^Os*}n}4ZxmwqH{R)=YB)Sjd&qbkuz#5K{C*Ip%rEM# zNtUSh#SA&r8?V+`oRZUD=N=X-7S3XW_aIuC5NfJ<q~%}UQi|}!%hrRxL3_}U;;<_X z6{@cp&t_}{Ax+noWM24HZCZcnIk68l#-vWY|J5DCGq`R!O;PYoZ&nE-EZ+G{@#=n1 z%`L4_{y=OKPCT;ULrxxy_w&N{$?R$|8HukW7Vy~Z`cD(?I~b<lSX&?2uzC$R?7F-) zkbo`;^;=gN@u#}eo$Dj8mgByoOZJb$Hp*kcj^dO|4~o>g^7x2_kGuzU0*f4*=5P2h zDIKPMlHNIhC=dW_y<%m3P0JPI;-%&6Vyj>gLy8O!AQ7+%t^|ApAp);pA4FC##RUbT zqGO0;tw<u?JRLX#J_m#X%q11U68tHEN@d@oZ<7FQbK3hCg<ZCm{Gfjg2FdX83-R^h z0sO*3f)J2^1XM^+7zCCC@c}_{KoC3;02Mm>-^A*J2w)1UiLUvi%fdD0MZaeIDT|h! zA(vl-w`lWS_{5cO(Za<xdo0M$PR2xuz$#9LBt1=Nxz;VFdE|)A#g=mORS$cPSbnLA zXM3Tph55_u>Z_AYN}NsabDY3BqqgPxU!wZOb*qYm?8;epj#V6qT52BK4~mSXpIzTu z`(eN>dtXiany!x8^MsSu!Pe3xbAlvy4e~wsPm1hrr`oiuISE@x-X@+se%C12n=?UJ zqMDZ))?9m*$fxi*9UVE1G~tXas`!p0g1I%TEe8RsQ=ibj-;Li`MQxU3-F9>x%er_R zH_8R>YMQmOF9e!ZekkCw600G3+m6JarPS`OENarww4L4I5O6A&LJm!eo2b-uOJNRz zR1e&CR&HDIc#!tZrDN=qx-WTtN|-9SG*w&!_a;5>SBp9We6T9c-n!XR=82DR_zre; ztJf}v)Z`XYm^(~eZ?B5SdPUCxX42O|Udr<+;S@=JVtlN6D8+WDw?iZMZv1ptwqx7> zWG)X$>+xRrf>R4}T>|9x=w-Hk-=+3o1ezx!R}lb1!VwxD&zZ1h1s*cx8X{Qpk4LPh z&OloM?Hfme#tV?H5W}B`Lyh#-e3qJx#_VfjZ9M2Y`S0h9JIh*+FhN@bFLp+~EhU0h zSeaiC_)J$68A>gL0b|2BrBYAu{U46wRy#mL`lmT(cX~Z8<}ykSU$bCV?{>3q_K?B` zRgzwAAc*qHJuqgm0crI7sL3E2*0<gH!_A?RYLwnu5{Y6D$k*8+Ux^^r&(`;))l#+f zdDZvzj%8nu-x#WT>GdZ-<gj!$M?ySu$DhNX9&u9QeLG^K0w*|GKNXzEc_*V9pMDgD zlJYY)wY7B$ahFd#7ui%xg^$h7tc)SrMx6TMD-GQcE^H^RI%Ht4A@9*imyLQ~e(_KY z*v`)I&F!(no?+qN?bJf8=IL_Dpx^$Evy+j4@;VKFyn2JGt2H5ASuhZ1+%DG9_BR(7 zkYAzXgXvN}G84Kf&JCgm$9MiMGac9oKL1Z<s(-*t<Uh>*pVPd%2%w_qnJcmQgr4k_ z>p+R)x1DLDAxj~Ef{K+x3B_^ON3{oPH+{3e7N{P(+1KWFwEGeJO_Xd#e0?fIVJvex zveo&k3PxIx5Dl!gHR)`_jmeUXn~a4TP9$%!u^34SE7RoFx1Y;PC{CEQ{(?)d(&fJk znjxZsgGt__HkWQ_uZC}MUG`NbDMB6uhg*#uy9=#~y?Jx8Xll}PQzzt}5GtvCHd3Tk z_PEr{Qx(#^v~ai9M?X7fW87|fIc0W7mx41xTuz4P(hIG^uI@vDY}lVWMr@iG-AV*< z$naS78o=-!?a2KAs}?%=HglY+N_Eb~%giLJ^%JNzgkHw{b5oB50J?^?5+PQ9udn%O zmRvNfjM<rL%L%w@xqL7rwiGHBKTEG_)0?a)WF+8G^XzT$^#mt5i1pzfUot|qYi7qg z#iwLAHW8cpl&(@Q_|4{$Vjs~sjj5dAFSi?lsF-;<cT0aND~_`OlxM0SFw7aJao`hk J<bsapKLCz6MmGQe literal 0 HcmV?d00001 diff --git a/roles/systemli.apt_repositories/meta/.galaxy_install_info b/roles/systemli.apt_repositories/meta/.galaxy_install_info new file mode 100644 index 0000000..9abccc9 --- /dev/null +++ b/roles/systemli.apt_repositories/meta/.galaxy_install_info @@ -0,0 +1,2 @@ +install_date: Tue Apr 20 16:13:57 2021 +version: master diff --git a/roles/systemli.apt_repositories/meta/main.yml b/roles/systemli.apt_repositories/meta/main.yml new file mode 100644 index 0000000..3f8011f --- /dev/null +++ b/roles/systemli.apt_repositories/meta/main.yml @@ -0,0 +1,23 @@ +galaxy_info: + role_name: apt_repositories + author: systemli.org + description: Add third-party repositories on Debian in a secure way + license: + - GPL-3.0-only + min_ansible_version: 2.4 + platforms: + - name: Debian + versions: + - stretch + - buster + - name: Ubuntu + versions: + - bionic + - focal + + galaxy_tags: + - apt + - https + - secure + +dependencies: [] diff --git a/roles/systemli.apt_repositories/molecule/default/INSTALL.rst b/roles/systemli.apt_repositories/molecule/default/INSTALL.rst new file mode 100644 index 0000000..6a44bde --- /dev/null +++ b/roles/systemli.apt_repositories/molecule/default/INSTALL.rst @@ -0,0 +1,22 @@ +******* +Docker driver installation guide +******* + +Requirements +============ + +* Docker Engine + +Install +======= + +Please refer to the `Virtual environment`_ documentation for installation best +practices. If not using a virtual environment, please consider passing the +widely recommended `'--user' flag`_ when invoking ``pip``. + +.. _Virtual environment: https://virtualenv.pypa.io/en/latest/ +.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site + +.. code-block:: bash + + $ pip install 'molecule[docker]' diff --git a/roles/systemli.apt_repositories/molecule/default/converge.yml b/roles/systemli.apt_repositories/molecule/default/converge.yml new file mode 100644 index 0000000..b605da4 --- /dev/null +++ b/roles/systemli.apt_repositories/molecule/default/converge.yml @@ -0,0 +1,71 @@ +--- +- name: Converge + hosts: all + become: true + roles: + - ansible-role-apt_repositories + vars: + apt_repositories: + # all vars given + - name: packages.gitlab.com + url: https://packages.gitlab.com/gitlab/gitlab-ce/{{ ansible_distribution | lower }}/ + key: | + -----BEGIN PGP PUBLIC KEY BLOCK----- + + mQINBF5dI2sBEACyGx5isuXqEV2zJGIx8rlJFCGw6A9g5Zk/9Hj50UpXNuOXlvQl + 7vq91m2CAh88Jad7OiMHIJJhX3ZJEOf/pUx/16QKumsaEyBk9CegxUG9jAQXsjL3 + WLyP0/l27UzNrOAFB+IUGjsoP+32gsSPiF5P485mirIJNojIAFzDQl3Uo4FbvqYU + 9AIRk5kV4nEYz1aKXAovIUsyqrztMtwlAG2xqdwVpGD2A4/w8I143qPGjjhEQmf4 + /EeS4CP9ztyLAx+01t2Acwa7Bygsb5KQPuT25UlevuxdDy/Rd5Zn/Lzwr2GQqjUs + 6GbM0t1HYjh57e4V+p0qMf6jxXfrDCbehgzFvGS0cx/d7hWHm5sXZIt3gxpjBQU2 + 8MQWtrR8Y3nTBkCHwOKsXdsdD+YHxTq/yuvxl1Bcyshp29cGWv1es3wn2Z6i9tWe + asGfVewJZiXFSEqSBGguEmLyCAZcWgXvHOV2kc66wG4d4TGIxmoo9GBqEtBftCVH + MGDHt7zeg2hg6EIsx8/nj1duO5nBnbnik5iG8Xv46e/aw2p4DfTdfxHpjvyJudyN + +UI5eSuuuXhyTZWedd5K1Q3+0CmACJ39t/NA6g7cZaw3boFKw3fTWIgOVTvC3y5v + d7wsuyGUk9xNhHLcu6HjB4VPGzcTwQWMFf6+I4qGAUykU5mjTJchQeqmQwARAQAB + tEJHaXRMYWIgQi5WLiAocGFja2FnZSByZXBvc2l0b3J5IHNpZ25pbmcga2V5KSA8 + cGFja2FnZXNAZ2l0bGFiLmNvbT6JAlQEEwEKAD4WIQT2QD9lRKOIY9qgtuA/AWGK + UTEvPwUCXl0jawIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRA/ + AWGKUTEvP3/+EACEpR4JwFz7fAZxKoTzq1xkv7JiVC1jDnfZ6U6tumMDSIBLqlZX + Jv/lixuXC/GCnyiduqqpO14RCkHrCECzNeu7+lt+eiBUpOKvDgkNid6FLMoulu1w + hDhQWss6+40dIWwa5i8maIFg6WOwIiI24PW9T+ywrf2Gfv9mB1YP3ob+8Cx1EVb/ + sf5mu1SGHvq2PqNvPeyY3W5vU7rB0Ax5Kcn3e0Z+tUSC8fV7TCg9hm9o2Ou928K4 + hmvdFfR0t47cXt1wmZ/pjrWcezVqeIrMJyWtje4hgcO3TSXsfvedEdYn8Q/BgVRw + 9KL4DkR1HSemSsPB4YyOwLscjV6p5OCPm0PhPPXUGIdImcQH7jYuEXNi5nnN5dX4 + 197ooTB2UCk8r0QtnhcQUE2ph46mylcksbR0nKhGh5bYW3jfd0X+MP36reo+EFQ7 + Sw35f7P7QvZqnEE8rd5fX3GImKm38xJi+9bGb4IH8WuslUZUMapgQqqBfw1k5+mP + BBqKWSdEsP1i7LBv9jVOaauMYQPLZcodx5prgjrB89V1hCKu+ZQl/hzoCwmeSruD + LUqX/RFeleZO2VeKXh1a/VQ69ThqZ7gyXcrvHopPPGTr9IESoV9/qcZWplEccP9b + FuY9t6HuSpcL7SlbsRVQ0NBQrsQeZR2J0YgvRc3JWgZAfcE5MK2jcoWKCLkCDQRe + XSNrARAApHc0R4tfPntr5bhTuXU/iVLyxlAlzdEv1XsdDC8YBYehT72Jpvpphtq7 + sKVsuC59l8szojgO/gW//yKSuc3Gm5h58+HpIthjviGcvZXf/JcN7Pps0UGkLeQN + 2+IRZgbA6CAAPh2njE60v5iXgS91bxlSJi8GVHq1h28kbKQeqUYthu9yA2+8J4Fz + ivYV2VImKLSxbQlc86tl6rMKKIIOph+N4WujJgd5HZ80n2qp1608X3+9CXvtBasX + VCI2ZqCuWjffVCOQzsqRbJ6LQyMbgti/23F4Yqjqp+8eyiDNL6MyWJCBbtkW3Imi + FHfR0sQIM6I7fk0hvt9ljx9SG6az/s3qWK5ceQ7XbJgCAVS4yVixfgIjWvNE5ggE + QNOmeF9r76t0+0xsdMYJR6lxdaQI8AAYaoMXTkCXX2DrASOjjEP65Oq/d42xpSf9 + tG6XIq+xtRQyFWSMc+HfTlEHbfGReAEBlJBZhNoAwpuDckOC08vw7v2ybS5PYjJ4 + 5Kzdwej0ga03Wg9hrAFd/lVa5eO4pzMLuexLplhpIbJjYwCUGS4cc/LQ2jq4fue5 + oxDpWPN+JrBH8oyqy91b10e70ohHppN8dQoCa79ySgMxDim92oHCkGnaVyULYDqJ + zy0zqbi3tJu639c4pbcggxtAAr0I3ot8HPhKiNJRA6u8HTm//xEAEQEAAYkCPAQY + AQoAJhYhBPZAP2VEo4hj2qC24D8BYYpRMS8/BQJeXSNrAhsMBQkDwmcAAAoJED8B + YYpRMS8/vzQP/iO0poRR9ZYjonP5GGIARRnF+xpWCRTZVSHLcAfS0ujZ7ekXoeeS + JNMJ/7T4Yk1EJ9MTFZ83Jj4UybKO3Rw+/iPmcPpqUQGaEReYLlx7SyxmsOBXf+Q9 + PtyUmGO47tL+eAPInYyxsWGib/EeOw4KQrfByAIPWu0aeNeXadzxBLIkqD863H5q + nTDrXOw6SLprlGt2zlc+XQKDv3DZez6wTcp205xdaNs55Bfk9pmKUS/ey3ZP7GvC + CDEGxuWulVSKL2DYtq0sEZD7pQYSy8gBTqXLQAyfmPDcxe9Lczhk3UYrUUomN1/w + +VE09q75yNqkaHdckVt+aYAHMgQ0ilmwTg6+OlEK+ZQkUT94viB6YW7B0M4uzols + 9FSDxXea/uKn75jTSkA3GAXf7O5hqbkDDctJbtO2pPdLDxbXN95iZ9xpgRE3exGl + ucjgV5XGpLO4XXf0GTzug/TJAtNljJ/44+6meO0WwOwLMMhAJVxcp1fpbtgRmrcJ + 8bAsCkV5EO8SeQZDu2C8I9tMGlJ1VLTAfv6Lv2Z89B1AOOweGz4I48i9lux+HdXd + HewnA37zx0XNjNQmqiG85UWUusnDxF0Je2jEhGIpHK/KdyI1BfNzX3d5HVoM1VE3 + THtRZHnetoMek8L5x/ciYQNIt40rQ6MHtPEo1ZC4346DP6eJmeX1DGGI + =91uZ + -----END PGP PUBLIC KEY BLOCK----- + packages: + - gitlab-ce + # full preset + - preset: gitlab + # override preset partially (binary key) + - preset: gitlab + key_path: gitlab.gpg diff --git a/roles/systemli.apt_repositories/molecule/default/molecule.yml b/roles/systemli.apt_repositories/molecule/default/molecule.yml new file mode 100644 index 0000000..98254ca --- /dev/null +++ b/roles/systemli.apt_repositories/molecule/default/molecule.yml @@ -0,0 +1,15 @@ +--- +driver: + name: vagrant + provider: + name: virtualbox +platforms: + - name: bionic64-repo + box: ubuntu/bionic64 +lint: | + set -e + yamllint . + ansible-lint +provisioner: + name: ansible + become: True diff --git a/roles/systemli.apt_repositories/molecule/default/prepare.yml b/roles/systemli.apt_repositories/molecule/default/prepare.yml new file mode 100644 index 0000000..4b18d48 --- /dev/null +++ b/roles/systemli.apt_repositories/molecule/default/prepare.yml @@ -0,0 +1,9 @@ +--- +- name: Prepare + hosts: all + gather_facts: false + tasks: + - name: Install python for Ansible + raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal) + become: true + changed_when: false diff --git a/roles/systemli.apt_repositories/molecule/default/roles/ansible-role-apt_repositories b/roles/systemli.apt_repositories/molecule/default/roles/ansible-role-apt_repositories new file mode 120000 index 0000000..a8a4f8c --- /dev/null +++ b/roles/systemli.apt_repositories/molecule/default/roles/ansible-role-apt_repositories @@ -0,0 +1 @@ +../../.. \ No newline at end of file diff --git a/roles/systemli.apt_repositories/molecule/default/tests/test_default.py b/roles/systemli.apt_repositories/molecule/default/tests/test_default.py new file mode 100644 index 0000000..9e0e189 --- /dev/null +++ b/roles/systemli.apt_repositories/molecule/default/tests/test_default.py @@ -0,0 +1,15 @@ +import os + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE'] +).get_hosts('all') + + +def test_hosts_file(host): + f = host.file('/etc/hosts') + + assert f.exists + assert f.user == 'root' + assert f.group == 'root' diff --git a/roles/systemli.apt_repositories/molecule/default/tests/test_default.yml b/roles/systemli.apt_repositories/molecule/default/tests/test_default.yml new file mode 100644 index 0000000..7f40386 --- /dev/null +++ b/roles/systemli.apt_repositories/molecule/default/tests/test_default.yml @@ -0,0 +1,8 @@ +# Molecule managed + +--- +file: + /etc/hosts: + exists: true + owner: root + group: root diff --git a/roles/systemli.apt_repositories/molecule/default/verify.yml b/roles/systemli.apt_repositories/molecule/default/verify.yml new file mode 100644 index 0000000..a82dd6f --- /dev/null +++ b/roles/systemli.apt_repositories/molecule/default/verify.yml @@ -0,0 +1,9 @@ +--- +# This is an example playbook to execute Ansible tests. + +- name: Verify + hosts: all + tasks: + - name: Example assertion + assert: + that: true diff --git a/roles/systemli.apt_repositories/molecule/docker/INSTALL.rst b/roles/systemli.apt_repositories/molecule/docker/INSTALL.rst new file mode 100644 index 0000000..1a063f0 --- /dev/null +++ b/roles/systemli.apt_repositories/molecule/docker/INSTALL.rst @@ -0,0 +1,39 @@ +******* +Install +******* + +This set of playbooks have specific dependencies on Ansible due to the modules +being used. + +Requirements +============ + +* Ansible 2.2 or higher +* Docker Engine +* docker-py + +Install OS dependencies on Debian 9 (Stretch) + +.. code-block:: bash + + # apt-get update + # apt-get install -y python-pip libssl-dev python-docker + ## If installing Molecule from source. + # apt-get install -y libffi-dev git + +Install OS dependencies on Ubuntu 16.x + +.. code-block:: bash + + $ sudo apt-get update + $ sudo apt-get install -y python-pip libssl-dev docker-engine + # If installing Molecule from source. + $ sudo apt-get install -y libffi-dev git + +Install using pip: + +.. code-block:: bash + + $ sudo pip install ansible + $ sudo pip install docker-py + $ sudo pip install molecule --pre diff --git a/roles/systemli.apt_repositories/molecule/docker/molecule.yml b/roles/systemli.apt_repositories/molecule/docker/molecule.yml new file mode 100644 index 0000000..4ce557b --- /dev/null +++ b/roles/systemli.apt_repositories/molecule/docker/molecule.yml @@ -0,0 +1,19 @@ +--- +driver: + name: docker +platforms: + - name: instance + image: "geerlingguy/docker-${MOLECULE_DISTRO:-debian10}-ansible:latest" + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + privileged: true + pre_build_image: true +lint: | + set -e + yamllint . + ansible-lint +provisioner: + name: ansible + playbooks: + converge: ../default/converge.yml diff --git a/roles/systemli.apt_repositories/tasks/key_path.yml b/roles/systemli.apt_repositories/tasks/key_path.yml new file mode 100644 index 0000000..6b3ccab --- /dev/null +++ b/roles/systemli.apt_repositories/tasks/key_path.yml @@ -0,0 +1,31 @@ +--- + +- name: Copy key to remote machine + copy: + src: "{{ _config.key_path }}" + dest: /tmp/{{ _name }}.gpg + owner: root + group: root + mode: 0644 + check_mode: false + changed_when: false + +- name: Find out whether {{ _config.key_path }} is armored + stat: + path: /tmp/{{ _name }}.gpg + register: _file + +- name: Add armored key for {{ _name }} by path + apt_key: + file: /tmp/{{ _name }}.gpg + keyring: /usr/share/keyrings/{{ _name }}.gpg + when: "'ascii' in _file.stat.charset" + +- name: Add binary key for {{ _name }} by path + copy: + src: "{{ _config.key_path }}" + dest: /usr/share/keyrings/{{ _name }}.gpg + owner: root + group: root + mode: 0644 + when: _file.stat.charset == 'binary' diff --git a/roles/systemli.apt_repositories/tasks/main.yml b/roles/systemli.apt_repositories/tasks/main.yml new file mode 100644 index 0000000..dad3d3d --- /dev/null +++ b/roles/systemli.apt_repositories/tasks/main.yml @@ -0,0 +1,30 @@ +--- + +- name: Remove old repositories + file: + path: "/etc/apt/sources.list.d/{{ item }}" + state: absent + with_items: "{{ apt_repositories_absent }}" + +- name: Update cache + apt: + update_cache: true + changed_when: false + +- name: Install dependecies + apt: + pkg: "{{ apt_repositories_dependencies }}" + +- name: Ensure we can transport via https + apt: + pkg: apt-transport-https + when: ((ansible_distribution == 'Debian' and ansible_distribution_major_version|int < 10) or + (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version|int < 18)) + +- include_tasks: repo.yml + loop: "{{ apt_repositories }}" + +- name: Update cache + apt: + update_cache: true + changed_when: false diff --git a/roles/systemli.apt_repositories/tasks/repo.yml b/roles/systemli.apt_repositories/tasks/repo.yml new file mode 100644 index 0000000..9374ac2 --- /dev/null +++ b/roles/systemli.apt_repositories/tasks/repo.yml @@ -0,0 +1,83 @@ +--- + +- name: Clear preset + include_vars: null.yml + +- name: Read in preset + include_vars: + file: "{{ item.preset }}.yml" + name: _preset + when: item.preset is defined + +# - debug: +# var: _preset + +- name: combine preset with given config + set_fact: + _config: "{{ _preset|default({})|combine(item) }}" + +# - debug: +# var: _config + +- name: ensure we have a repo name 1 + set_fact: + _name: "{{ _config.name }}" + when: _config.name is defined and _config.name + +- name: ensure we have a repo name 2 + set_fact: + _name: "{{ _config.url|urlsplit('hostname') }}" + when: _config.name is undefined or not _config.name + +- name: Add key for {{ _name }} by content + apt_key: + data: "{{ _config.key }}" + keyring: /usr/share/keyrings/{{ _name }}.gpg + when: _config.key is defined and _config.key + +- import_tasks: key_path.yml + when: _config.key is undefined or not _config.key + +- name: Register final keyring stats + stat: + path: /usr/share/keyrings/{{ _name }}.gpg + register: _f + +# - debug: +# var: _f + +- name: Ensure we have binary key + assert: + that: + - _f.stat.exists + - _f.stat.charset == 'binary' + when: not ansible_check_mode + +- name: Add repository {{ _name }} + template: + src: repo.sources.j2 + dest: /etc/apt/sources.list.d/{{ _name }}.sources + owner: root + group: root + mode: 0644 + when: _config.style is undefined or _config.style == "deb822" + +- name: Add repository {{ _name }} in single line style + template: + src: repo.list.j2 + dest: /etc/apt/sources.list.d/{{ _name }}.list + owner: root + group: root + mode: 0644 + when: _config.style is defined and _config.style == "line" + +# apt currently only support meaningful pinning by hostname +# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858406 + +- name: Add pinning preferences for {{ _name }} + template: + src: pref.j2 + dest: /etc/apt/preferences.d/{{ _name }}.pref + owner: root + group: root + mode: 0644 diff --git a/roles/systemli.apt_repositories/templates/pref.j2 b/roles/systemli.apt_repositories/templates/pref.j2 new file mode 100644 index 0000000..64e33cf --- /dev/null +++ b/roles/systemli.apt_repositories/templates/pref.j2 @@ -0,0 +1,16 @@ +# Packages with pin priority = 100 +# causes a version to be installed unless there is a version available +# belonging to some other distribution or the installed version is more +# recent + +Package: * +Pin: origin "{{ _config.url|urlsplit('hostname') }}" +Pin-Priority: 100 +{% if _config.packages is defined %} +{% for pkg in _config.packages %} + +Package: {{ pkg }} +Pin: origin "{{ _config.url|urlsplit('hostname') }}" +Pin-Priority: 500 +{% endfor %} +{% endif %} diff --git a/roles/systemli.apt_repositories/templates/repo.list.j2 b/roles/systemli.apt_repositories/templates/repo.list.j2 new file mode 100644 index 0000000..d8deb33 --- /dev/null +++ b/roles/systemli.apt_repositories/templates/repo.list.j2 @@ -0,0 +1 @@ +deb [signed-by=/usr/share/keyrings/{{ _name }}.gpg] {{ _config.url }} {{ _config.suites }} diff --git a/roles/systemli.apt_repositories/templates/repo.sources.j2 b/roles/systemli.apt_repositories/templates/repo.sources.j2 new file mode 100644 index 0000000..059e186 --- /dev/null +++ b/roles/systemli.apt_repositories/templates/repo.sources.j2 @@ -0,0 +1,8 @@ +Types: {{ _config.types|default('deb') }} +URIs: {{ _config.url }} +Suites: {{ _config.suites|default(ansible_distribution_release) }} +Components: {{ _config.components|default('main') }} +Signed-by: /usr/share/keyrings/{{ _name }}.gpg +{% if _config.arch is defined %} +Architecture: {{ _config.arch }} +{% endif %} diff --git a/roles/systemli.apt_repositories/vars/gitlab.yml b/roles/systemli.apt_repositories/vars/gitlab.yml new file mode 100644 index 0000000..362828c --- /dev/null +++ b/roles/systemli.apt_repositories/vars/gitlab.yml @@ -0,0 +1,6 @@ +--- +name: packages.gitlab.com +url: https://packages.gitlab.com/gitlab/gitlab-ce/{{ ansible_distribution|lower }}/ +key_path: gitlab.asc +packages: + - gitlab-ce diff --git a/roles/systemli.apt_repositories/vars/grafana.yml b/roles/systemli.apt_repositories/vars/grafana.yml new file mode 100644 index 0000000..e6dad99 --- /dev/null +++ b/roles/systemli.apt_repositories/vars/grafana.yml @@ -0,0 +1,11 @@ +--- +# Name of the sources file +name: packages.grafana.com +# Url of the Debian Repo +url: https://packages.grafana.com/oss/deb +# Name of the key file under files +key_path: grafana.gpg +# Name of the suite +suites: stable +# List of the components +components: 'main' diff --git a/roles/systemli.apt_repositories/vars/jitsi.yml b/roles/systemli.apt_repositories/vars/jitsi.yml new file mode 100644 index 0000000..56f1efc --- /dev/null +++ b/roles/systemli.apt_repositories/vars/jitsi.yml @@ -0,0 +1,6 @@ +--- +name: download.jitsi.org +url: https://download.jitsi.org/ +key_path: jitsi-archive-keyring.gpg +suites: stable/ +components: '' diff --git a/roles/systemli.apt_repositories/vars/kubic.yml b/roles/systemli.apt_repositories/vars/kubic.yml new file mode 100644 index 0000000..2e7f66e --- /dev/null +++ b/roles/systemli.apt_repositories/vars/kubic.yml @@ -0,0 +1,11 @@ +--- +name: kubic +style: line +url: https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/{{ 'x' if ansible_distribution == 'Ubuntu' else ''}}{{ ansible_distribution }}_{{ ansible_distribution_version }}/ +suites: / +key_path: kubic.asc +packages: + - fuse-overlayfs + - podman + - slirp4netns + - libseccomp2 diff --git a/roles/systemli.apt_repositories/vars/null.yml b/roles/systemli.apt_repositories/vars/null.yml new file mode 100644 index 0000000..b96b380 --- /dev/null +++ b/roles/systemli.apt_repositories/vars/null.yml @@ -0,0 +1 @@ +_preset: {} diff --git a/roles/systemli.apt_repositories/vars/prosody.yml b/roles/systemli.apt_repositories/vars/prosody.yml new file mode 100644 index 0000000..12e802f --- /dev/null +++ b/roles/systemli.apt_repositories/vars/prosody.yml @@ -0,0 +1,6 @@ +--- +url: https://packages.prosody.im/debian +key_path: prosody-debian-packages.gpg +packages: + - prosody + - "lua-*" diff --git a/roles/systemli.apt_repositories/vars/sury.yml b/roles/systemli.apt_repositories/vars/sury.yml new file mode 100644 index 0000000..2bbae96 --- /dev/null +++ b/roles/systemli.apt_repositories/vars/sury.yml @@ -0,0 +1,3 @@ +--- +url: https://packages.sury.org/php/ +key_path: sury.asc diff --git a/simple_env/bindep.txt b/simple_env/bindep.txt new file mode 100644 index 0000000..e69de29 diff --git a/simple_env/context/Containerfile b/simple_env/context/Containerfile new file mode 100644 index 0000000..f9918ee --- /dev/null +++ b/simple_env/context/Containerfile @@ -0,0 +1,11 @@ +ARG ANSIBLE_RUNNER_IMAGE=quay.io/ansible/ansible-runner:devel +ARG PYTHON_BUILDER_IMAGE=quay.io/ansible/python-builder:latest + +FROM $ANSIBLE_RUNNER_IMAGE as galaxy + +ARG ANSIBLE_GALAXY_CLI_COLLECTION_OPTS= +ADD _build /build + +WORKDIR /build +RUN ansible-galaxy role install -r requirements.yml --roles-path /usr/share/ansible/roles +RUN ansible-galaxy collection install $ANSIBLE_GALAXY_CLI_COLLECTION_OPTS -r requirements.yml --collections-path /usr/share/ansible/collections diff --git a/simple_env/context/_build/requirements.yml b/simple_env/context/_build/requirements.yml new file mode 100644 index 0000000..a40ad78 --- /dev/null +++ b/simple_env/context/_build/requirements.yml @@ -0,0 +1,28 @@ +--- +collections: + - name: davidban77.gns3 + source: https://galaxy.ansible.com + + - name: netbox.netbox + source: https://galaxy.ansible.com + + - name: freeipa.ansible_freeipa + source: https://hub.mgmt.toal.ca/api/galaxy/content/published/ + + - name: redhat.rhv + source: https://cloud.redhat.com/api/automation-hub/ + + - name: redhat.satellite + source: https://cloud.redhat.com/api/automation-hub/ + + - name: community.general + source: https://galaxy.ansible.com + + - name: jjaswanson4.install_satellite + source: https://galaxy.ansible.com + + - name: jjaswanson4.configure_satellite + source: https://galaxy.ansible.com + + - name: redhat.satellite + source: https://cloud.redhat.com/api/automation-hub/ diff --git a/simple_env/execution-environment.yml b/simple_env/execution-environment.yml new file mode 100644 index 0000000..e078a8b --- /dev/null +++ b/simple_env/execution-environment.yml @@ -0,0 +1,12 @@ +--- +version: 1 +dependencies: + galaxy: requirements.yml + python: requirements.txt + system: bindep.txt + +additional_build_steps: + prepend: | + RUN pip3 install --upgrade pip setuptools + append: + - RUN ls -la /etc diff --git a/simple_env/requirements.txt b/simple_env/requirements.txt new file mode 100644 index 0000000..a7297f0 --- /dev/null +++ b/simple_env/requirements.txt @@ -0,0 +1 @@ +pynetbox diff --git a/simple_env/requirements.yml b/simple_env/requirements.yml new file mode 100644 index 0000000..a40ad78 --- /dev/null +++ b/simple_env/requirements.yml @@ -0,0 +1,28 @@ +--- +collections: + - name: davidban77.gns3 + source: https://galaxy.ansible.com + + - name: netbox.netbox + source: https://galaxy.ansible.com + + - name: freeipa.ansible_freeipa + source: https://hub.mgmt.toal.ca/api/galaxy/content/published/ + + - name: redhat.rhv + source: https://cloud.redhat.com/api/automation-hub/ + + - name: redhat.satellite + source: https://cloud.redhat.com/api/automation-hub/ + + - name: community.general + source: https://galaxy.ansible.com + + - name: jjaswanson4.install_satellite + source: https://galaxy.ansible.com + + - name: jjaswanson4.configure_satellite + source: https://galaxy.ansible.com + + - name: redhat.satellite + source: https://cloud.redhat.com/api/automation-hub/ diff --git a/windows.yml b/windows.yml deleted file mode 100644 index b5734b3..0000000 --- a/windows.yml +++ /dev/null @@ -1,58 +0,0 @@ -- name: create an ovirt rhel template - hosts: localhost - gather_facts: False - connection: local - become: no - - vars: - ansible_python_interpreter: "{{ ansible_playbook_python }}" - local_account_password: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 61613832333566373533336138376664326363663461316161363437336364346164633661393964 - 3639373438663437656335646263323033343962336362380a393538363837306339356336646665 - 35336463346435633263633437346236656664306561656333383236633362393062393437663233 - 6539366264353433650a653065316239643333313539613330306534643361636535336564366430 - 39336361313035393436383538313737383535363665383236636164353434336138 - local_administrator_password: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 61613832333566373533336138376664326363663461316161363437336364346164633661393964 - 3639373438663437656335646263323033343962336362380a393538363837306339356336646665 - 35336463346435633263633437346236656664306561656333383236633362393062393437663233 - 6539366264353433650a653065316239643333313539613330306534643361636535336564366430 - 39336361313035393436383538313737383535363665383236636164353434336138 - windows_distro_name: 2019_standard # this needs to be one of the standard values see 'os_short_names' var - template_vm_name: win2019_template_apr6 - template_vm_root_disk_size: 30 - template_vm_guest_id: windows_2019x64 - template_vm_memory: 4096 - template_timezone: 'GMT Standard Time' - template_vm_cpu: 4 - template_vm_efi: false # you need to install efi file to use this, false should be fine in most cases - iso_file_name: '17763.737.190906-2324.rs5_release_svc_refresh_SERVER_EVAL_x64FRE_en-us_1.iso' # name of the iso file - iso_image_index: '1' # put index number here from the order inside the iso, for example 1 - standard, 2 - core etc - iso_product_key: '' - instance_wait_connection_timeout: 1800 - - virtio_iso_url: http://webserver.toal.ca/images/virtio-win.iso - vm_ansible_port: 5986 - vm_ansible_winrm_transport: credssp - vm_upgrade_powershell: false # only needed for 2008 R2 - install_updates: False - - ovirt_datacenter: ToalLab - ovirt_cluster: Lab - ovirt_datastore: ssdvdo0 - ovirt_export_domain: ssdvdo0 - ovirt_data_domain: ssdvdo0 - ovirt_iso_domain: NAS_ISO - - template_vm_network_name: sandbox - template_vm_ip_address: 192.168.18.41 - template_vm_netmask: 255.255.240.0 - template_vm_gateway: 192.168.16.1 - template_vm_domain: sandbox.toal.ca - template_vm_dns_servers: - - 192.168.16.1 - - roles: - - oatakan.windows_ovirt_template diff --git a/windows_ad.yml b/windows_ad.yml new file mode 100644 index 0000000..6e9b231 --- /dev/null +++ b/windows_ad.yml @@ -0,0 +1,16 @@ +- name: Create Windows AD Server + hosts: WinAD + gather_facts: False + connection: local + become: no + + vars: + ansible_python_interpreter: "{{ ansible_playbook_python }}" + + roles: + - oatakan.ansible-role-ovirt + +- name: Configure AD Controller + hosts: WinAD + become: yes + - oatakan.ansible-role-windows-ad-controller