Skip to content

Commit 6dce82f

Browse files
the-maldridgethe-maldridge
committed
ansible: Global Lint
1 parent e0c771b commit 6dce82f

File tree

58 files changed

+293
-251
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+293
-251
lines changed

‎ansible/.ansible-lint-ignore‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# This file contains ignores rule violations for ansible-lint
2+
group_vars/netlogon.yml var-naming[pattern]
3+
group_vars/netlogon.yml yaml[line-length]
4+
hashi-worker.yml syntax-check[specific]
5+
host_vars/a-fsn-de.m.voidlinux.org.yml var-naming[pattern]
6+
host_vars/a-hel-fi.m.voidlinux.org.yml var-naming[pattern]
7+
host_vars/b-fsn-de.m.voidlinux.org.yml var-naming[pattern]
8+
network.yml risky-shell-pipe
9+
roles/netauth-config role-name
10+
roles/netauth-ldap role-name
11+
roles/netauthd/handlers/main.yml syntax-check[specific]
12+
roles/node_exporter/meta/main.yml schema[meta]
13+
roles/nomad_client/tasks/main.yml jinja[spacing]
14+
roles/nomad_client/tasks/main.yml risky-file-permissions
15+
roles/nomad_client/vars/main.yml var-naming[no-role-prefix]
16+
roles/sshd/defaults/main.yml var-naming[pattern]
17+
roles/sshd/meta/main.yml schema[meta]
18+
roles/void_mesh/handlers/main.yml syntax-check[specific]
19+
roles/xbps-repoconf role-name

‎ansible/base.yml‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,25 @@
11
---
2-
- hosts: net_static
3-
become: yes
4-
become_method: sudo
2+
- name: Hosts with Static Networking
3+
hosts: net_static
4+
become: true
55
become_user: root
6+
become_method: ansible.builtin.sudo
67
roles:
78
- void.network.static
89

9-
- hosts: "!net_static"
10-
become: yes
11-
become_method: sudo
10+
- name: Hosts with Dynamic Networking
11+
hosts: "!net_static"
12+
become: true
1213
become_user: root
14+
become_method: ansible.builtin.sudo
1315
roles:
1416
- dhcpcd
1517

16-
- hosts: all:!unmanaged
17-
become: yes
18-
become_method: sudo
18+
- name: Base Machine Configuration
19+
hosts: all:!unmanaged
20+
become: true
1921
become_user: root
22+
become_method: ansible.builtin.sudo
2023
vars:
2124
node_exporter_consul_token: "{{lookup('file', 'secret/node_exporter_consul_token')}}"
2225
roles:

‎ansible/group_vars/all.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
---
22
xbps_repository_address: repo-de.voidlinux.org
3-
xbps_repository_main: https://{{xbps_repository_address}}/current
4-
xbps_repository_nonfree: https://{{xbps_repository_address}}/current/nonfree
5-
xbps_repository_multilib: https://{{xbps_repository_address}}/current/multilib
6-
xbps_repository_multilib_nonfree: https://{{xbps_repository_address}}/current/multilib/nonfree
3+
xbps_repository_main: https://{{ xbps_repository_address }}/current
4+
xbps_repository_nonfree: https://{{ xbps_repository_address }}/current/nonfree
5+
xbps_repository_multilib: https://{{ xbps_repository_address }}/current/multilib
6+
xbps_repository_multilib_nonfree: https://{{ xbps_repository_address }}/current/multilib/nonfree
77
xbps_repository_port: 443
88

9-
metal_domain_root: '.m.voidlinux.org'
9+
metal_domain_root: ".m.voidlinux.org"
1010
network_hostname: '{{ inventory_hostname | regex_replace(metal_domain_root, "") | regex_replace("\.", "-") }}'
11-
network_fqdn: '{{ inventory_hostname }}'
11+
network_fqdn: "{{ inventory_hostname }}"
1212
network_boot_hosts:
1313
- name: netauth.voidlinux.org
1414
addr: 95.216.191.60

‎ansible/group_vars/hashimaster.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,4 @@
22
network_input_policy: DROP
33
network_output_policy: ACCEPT
44

5-
65
nomad_datacenter: VOID-CONTROL

‎ansible/group_vars/md.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ grafana:
44
name: grafana
55
urls:
66
- monitoring.voidlinux.org
7-
static_root: no
7+
static_root: false
88
tls:
9-
stapling: yes
9+
stapling: true
1010
certificate: /var/lib/acme/live/monitoring.voidlinux.org/fullchain
1111
key: /var/lib/acme/live/monitoring.voidlinux.org/privkey

‎ansible/group_vars/netlogon.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
sshd_AuthorizedKeysCommand: /usr/bin/netkeys --ID %u
23
sshd_AllowGroupsAlways:
34
- wheel

‎ansible/hashi-controller.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
---
2-
- hosts: hashimaster
3-
become: yes
2+
- name: Hashicorp Control Plane Servers
3+
hosts: hashimaster
4+
become: true
45
become_user: root
5-
become_method: sudo
6+
become_method: ansible.builtin.sudo
67
vars:
78
nomad_role: server
89
roles:
9-
- consul-server
10+
- consul_server
1011
- vault
11-
- nomad-server
12-
- nomad-client
13-
- hashi-ws-fw
12+
- nomad_server
13+
- nomad_client
14+
- hashi_ws_fw

‎ansible/hashi-worker.yml‎

Lines changed: 42 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,43 @@
11
---
2-
- hosts: hashiworker,hashimirror,hashimx
3-
become: yes
2+
- name: Common Hashiorp Worker Services
3+
hosts: hashiworker,hashimirror,hashimx
4+
become: true
45
become_user: root
5-
become_method: sudo
6+
become_method: ansible.builtin.sudo
67
vars:
78
nomad_role: client
89
roles:
910
- consul
1011
- nomad-client
1112

12-
13-
- hosts: hashimirror
14-
become: yes
13+
- name: Nomad-based Mirrors
14+
hosts: hashimirror
15+
become: true
1516
become_user: root
16-
become_method: sudo
17+
become_method: ansible.builtin.sudo
1718
tasks:
1819
- name: Accept IPv4 Traffic
19-
lineinfile:
20-
line: "{{item}}"
20+
ansible.builtin.lineinfile:
21+
line: "{{ item }}"
2122
path: /etc/iptables.d/proxy.rules
22-
create: yes
23+
create: true
2324
owner: root
2425
group: root
25-
mode: 0640
26+
mode: "0640"
2627
with_items:
2728
- "*filter"
2829
- "-A INPUT -p tcp --dport 80 -j ACCEPT"
2930
- "-A INPUT -p tcp --dport 443 -j ACCEPT"
3031
- "-A INPUT -p tcp --dport 873 -j ACCEPT"
3132
- "COMMIT"
3233
- name: Accept IPv6 Traffic
33-
lineinfile:
34-
line: "{{item}}"
34+
ansible.builtin.lineinfile:
35+
line: "{{ item }}"
3536
path: /etc/ip6tables.d/proxy.6rules
36-
create: yes
37+
create: true
3738
owner: root
3839
group: root
39-
mode: 0640
40+
mode: "0640"
4041
with_items:
4142
- "*filter"
4243
- "-A INPUT -p tcp --dport 80 -j ACCEPT"
@@ -46,52 +47,53 @@
4647

4748
- name: Special rules for d-hel-fi
4849
hosts: d-hel-fi.m.voidlinux.org
49-
become: yes
50+
become: true
5051
become_user: root
51-
become_method: sudo
52+
become_method: ansible.builtin.sudo
5253
tasks:
5354
- name: Accept IPv4 Traffic
54-
lineinfile:
55-
line: "{{item}}"
55+
ansible.builtin.lineinfile:
56+
line: "{{ item }}"
5657
path: /etc/iptables.d/root_mirror.rules
57-
create: yes
58+
create: true
5859
owner: root
5960
group: root
60-
mode: 0640
61+
mode: "0640"
6162
with_items:
6263
- "*filter"
6364
- "-A INPUT -p tcp --dport 2022 -j ACCEPT"
6465
- "-A INPUT -p tcp --dport 8001 -j ACCEPT"
6566
- "-A INPUT -p tcp --dport 8003 -j ACCEPT"
6667
- "COMMIT"
6768
- name: Accept IPv6 Traffic
68-
lineinfile:
69-
line: "{{item}}"
69+
ansible.builtin.lineinfile:
70+
line: "{{ item }}"
7071
path: /etc/ip6tables.d/root_mirror.6rules
71-
create: yes
72+
create: true
7273
owner: root
7374
group: root
74-
mode: 0640
75+
mode: "0640"
7576
with_items:
7677
- "*filter"
7778
- "-A INPUT -p tcp --dport 2022 -j ACCEPT"
7879
- "-A INPUT -p tcp --dport 8001 -j ACCEPT"
7980
- "-A INPUT -p tcp --dport 8003 -j ACCEPT"
8081
- "COMMIT"
8182

82-
- hosts: hashimx
83-
become: yes
83+
- name: Additional tasks for MX hosts
84+
hosts: hashimx
85+
become: true
8486
become_user: root
85-
become_method: sudo
87+
become_method: ansible.builtin.sudo
8688
tasks:
8789
- name: Accept IPv4 Traffic
88-
lineinfile:
89-
line: "{{item}}"
90+
ansible.builtin.lineinfile:
91+
line: "{{ item }}"
9092
path: /etc/iptables.d/maddy.rules
91-
create: yes
93+
create: true
9294
owner: root
9395
group: root
94-
mode: 0640
96+
mode: "0640"
9597
with_items:
9698
- "*filter"
9799
- "-A INPUT -p tcp --dport 25 -j ACCEPT"
@@ -101,13 +103,13 @@
101103
- "-A INPUT -p tcp --dport 993 -j ACCEPT"
102104
- "COMMIT"
103105
- name: Accept IPv6 Traffic
104-
lineinfile:
105-
line: "{{item}}"
106+
ansible.builtin.lineinfile:
107+
line: "{{ item }}"
106108
path: /etc/ip6tables.d/maddy.6rules
107-
create: yes
109+
create: true
108110
owner: root
109111
group: root
110-
mode: 0640
112+
mode: "0640"
111113
with_items:
112114
- "*filter"
113115
- "-A INPUT -p tcp --dport 25 -j ACCEPT"
@@ -117,9 +119,10 @@
117119
- "-A INPUT -p tcp --dport 993 -j ACCEPT"
118120
- "COMMIT"
119121

120-
- hosts: buildworker
121-
become: yes
122+
- name: Build Servers
123+
hosts: buildworker
124+
become: true
122125
become_user: root
123-
become_method: sudo
126+
become_method: ansible.builtin.sudo
124127
roles:
125128
- buildworker

‎ansible/netauth.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
2-
- hosts: netauth
3-
become: yes
4-
become_method: sudo
2+
- name: NetAuth Servers
3+
hosts: netauth
4+
become: true
55
become_user: root
6+
become_method: ansible.builtin.sudo
67
roles:
78
- netauthd

‎ansible/network.yml‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,29 @@
11
---
2-
- hosts: localhost
3-
gather_facts: no
2+
- name: Generate Network Keys
3+
hosts: localhost
4+
gather_facts: true
45
tasks:
56
- name: Create secret directory
6-
file:
7+
ansible.builtin.file:
78
path: secret/vpn
89
state: directory
10+
owner: "{{ ansible_facts['user_id'] }}"
11+
group: "{{ ansible_facts['user_id'] }}"
12+
mode: "0750"
913

1014
- name: Create wireguard keys
11-
shell: wg genkey | tee {{item}} | wg pubkey > {{item}}.pub
15+
ansible.builtin.shell: wg genkey | tee {{ item }} | wg pubkey > {{ item }}.pub
1216
args:
13-
creates: "{{item}}.pub"
17+
creates: "{{ item }}.pub"
1418
chdir: secret/vpn
1519
with_items: "{{ groups['prod'] | difference(groups['unmanaged']) }}"
1620

17-
- hosts: prod:!unmanaged
18-
become: yes
21+
- name: Install Mesh Network Configuration
22+
hosts: prod:!unmanaged
23+
become: true
1924
become_user: root
20-
become_method: sudo
21-
gather_facts: no
25+
become_method: ansible.builtin.sudo
26+
gather_facts: false
2227
strategy: ansible.builtin.host_pinned
2328
roles:
24-
- void-mesh
29+
- void_mesh

0 commit comments

Comments
 (0)