Remove old manjaro playbook
Now that we've split into proper ansible roles, remove the old manjaro playbook.
This commit is contained in:
ducoterra
@@ -1,508 +0,0 @@
|
|||||||
- name: Setup Workstation
|
|
||||||
hosts: localhost
|
|
||||||
vars:
|
|
||||||
executable_temp_dir: /tmp
|
|
||||||
awscli_install_dir: /opt/aws-cli/
|
|
||||||
vault_version: 1.9.3
|
|
||||||
swap_file_path: /swap/swapfile
|
|
||||||
swap_file_size_mb: 4096
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
# Sync and update Pacman
|
|
||||||
- name: Sync and update Pacman
|
|
||||||
community.general.pacman:
|
|
||||||
update_cache: yes
|
|
||||||
upgrade: yes
|
|
||||||
become: yes
|
|
||||||
|
|
||||||
# SSH
|
|
||||||
- name: Ensure openssh installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: openssh
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Curl SSH trusted CA
|
|
||||||
get_url:
|
|
||||||
url: https://vault.ducoterra.net/v1/ssh-client-signer/public_key
|
|
||||||
dest: /etc/ssh/trusted-user-ca-keys.pem
|
|
||||||
mode: '0660'
|
|
||||||
become: yes
|
|
||||||
- name: Create sshd_config file
|
|
||||||
copy:
|
|
||||||
dest: "/etc/ssh/sshd_config"
|
|
||||||
content: |
|
|
||||||
AuthorizedKeysFile .ssh/authorized_keys
|
|
||||||
PasswordAuthentication no
|
|
||||||
KbdInteractiveAuthentication no
|
|
||||||
UsePAM yes
|
|
||||||
PrintMotd no # pam does that
|
|
||||||
Subsystem sftp /usr/lib/ssh/sftp-server
|
|
||||||
TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem
|
|
||||||
become: yes
|
|
||||||
- name: Ensure ssh service started
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: sshd
|
|
||||||
state: restarted
|
|
||||||
daemon_reload: yes
|
|
||||||
enabled: yes
|
|
||||||
become: yes
|
|
||||||
|
|
||||||
# UFW
|
|
||||||
- name: Ensure UFW installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: ufw
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Enable UFW
|
|
||||||
community.general.ufw:
|
|
||||||
state: enabled
|
|
||||||
become: yes
|
|
||||||
- name: Allow SSH
|
|
||||||
community.general.ufw:
|
|
||||||
rule: allow
|
|
||||||
name: ssh
|
|
||||||
become: yes
|
|
||||||
|
|
||||||
# System Tools
|
|
||||||
- name: Ensure grub installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: grub
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure bluez installed
|
|
||||||
community.general.pacman:
|
|
||||||
name:
|
|
||||||
- bluez
|
|
||||||
- bluez-utils
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure bluetooth service started
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: bluetooth
|
|
||||||
state: started
|
|
||||||
enabled: yes
|
|
||||||
become: yes
|
|
||||||
- name: Ensure glances installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: glances
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure htop installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: htop
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure curl and wget
|
|
||||||
community.general.pacman:
|
|
||||||
name:
|
|
||||||
- curl
|
|
||||||
- wget
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure dconf-editor
|
|
||||||
community.general.pacman:
|
|
||||||
name: dconf-editor
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure yay installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: yay
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
|
|
||||||
# Install DNET CA
|
|
||||||
- name: Download DNET CA
|
|
||||||
get_url:
|
|
||||||
url: https://vault.ducoterra.net/v1/dnet/ca
|
|
||||||
dest: /etc/ca-certificates/trust-source/anchors/dnet_ca.crt
|
|
||||||
mode: '0660'
|
|
||||||
become: yes
|
|
||||||
- name: Update trust store
|
|
||||||
command: trust extract-compat
|
|
||||||
become: yes
|
|
||||||
|
|
||||||
# dconf settings
|
|
||||||
- name: Turn off palm rejection
|
|
||||||
command: dconf write /org/gnome/desktop/peripherals/touchpad/disable-while-typing false
|
|
||||||
- name: Set flat mouse acceleration profile
|
|
||||||
command: dconf write /org/gnome/desktop/peripherals/mouse/accel-profile "'flat'"
|
|
||||||
- name: Center new windows
|
|
||||||
command: dconf write /org/gnome/mutter/center-new-windows true
|
|
||||||
|
|
||||||
# Gnome extensions
|
|
||||||
- name: Enable gnome extensions
|
|
||||||
command: 'gnome-extensions enable {{ item }}'
|
|
||||||
loop:
|
|
||||||
- bluetooth-quick-connect@bjarosze.gmail.com
|
|
||||||
- clipboard-indicator@tudmotu.com
|
|
||||||
- freon@UshakovVasilii_Github.yahoo.com
|
|
||||||
- sound-output-device-chooser@kgshank.net
|
|
||||||
- tactile@lundal.io
|
|
||||||
|
|
||||||
# Daily Driver Tools
|
|
||||||
- name: Ensure vim installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: vim
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure unzip installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: unzip
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure chromium installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: chromium
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure steam installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: steam-manjaro
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure discord installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: discord
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure geary installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: geary
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure appimagelauncher installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: appimagelauncher
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure Applications directory
|
|
||||||
file:
|
|
||||||
path: ~/Applications
|
|
||||||
state: directory
|
|
||||||
|
|
||||||
|
|
||||||
# Developer Tools
|
|
||||||
- name: Ensure wine installed
|
|
||||||
community.general.pacman:
|
|
||||||
name:
|
|
||||||
- wine
|
|
||||||
- winetricks
|
|
||||||
- wine-mono
|
|
||||||
- wine_gecko
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure wireguard installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: wireguard-tools
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure ping installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: iputils
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure nslookup installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: dnsutils
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure iperf3 installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: iperf3
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure remmina (RDP) installed
|
|
||||||
community.general.pacman:
|
|
||||||
name:
|
|
||||||
- remmina
|
|
||||||
- freerdp
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure docker installed
|
|
||||||
community.general.pacman:
|
|
||||||
name:
|
|
||||||
- docker
|
|
||||||
- docker-compose
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure ducoterra in the "docker" group
|
|
||||||
ansible.builtin.user:
|
|
||||||
name: ducoterra
|
|
||||||
groups: docker
|
|
||||||
append: yes
|
|
||||||
become: yes
|
|
||||||
- name: Ensure kubectl installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: kubectl
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure python and pip instaled
|
|
||||||
community.general.pacman:
|
|
||||||
name:
|
|
||||||
- python
|
|
||||||
- python-pip
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Install ansible
|
|
||||||
pip:
|
|
||||||
name: ansible
|
|
||||||
extra_args: --user
|
|
||||||
- name: Ensure qmk installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: qmk
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Run qmk setup
|
|
||||||
ansible.builtin.command: qmk setup -y
|
|
||||||
become: yes
|
|
||||||
- name: Copy qmk udev rules
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: ~/qmk_firmware/util/udev/50-qmk.rules
|
|
||||||
dest: /etc/udev/rules.d/50-qmk.rules
|
|
||||||
owner: ducoterra
|
|
||||||
group: root
|
|
||||||
mode: '0755'
|
|
||||||
become: yes
|
|
||||||
|
|
||||||
# AWS CLI
|
|
||||||
- name: Download awscli v2 installer - latest version
|
|
||||||
unarchive:
|
|
||||||
src: https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip
|
|
||||||
dest: '{{ executable_temp_dir }}'
|
|
||||||
remote_src: true
|
|
||||||
creates: '{{ executable_temp_dir }}/aws'
|
|
||||||
mode: 0755
|
|
||||||
when: awscli_version is not defined
|
|
||||||
tags: ["awscli", "awscliv2"]
|
|
||||||
- name: Download awscli v2 installer - specific version {{ awscli_version }}
|
|
||||||
unarchive:
|
|
||||||
src: 'https://awscli.amazonaws.com/awscli-exe-linux-x86_64-{{ awscli_version }}.zip'
|
|
||||||
dest: "{{ executable_temp_dir }}"
|
|
||||||
remote_src: true
|
|
||||||
creates: '{{ executable_temp_dir }}/aws'
|
|
||||||
mode: 0755
|
|
||||||
when: awscli_version is defined
|
|
||||||
tags: ["awscli", "awscliv2"]
|
|
||||||
- name: Run the installer for awscli v2
|
|
||||||
command:
|
|
||||||
args:
|
|
||||||
cmd: '{{ executable_temp_dir }}/aws/install -i {{ awscli_install_dir }} -b /usr/local/bin'
|
|
||||||
creates: /usr/local/bin/aws
|
|
||||||
become: yes
|
|
||||||
tags: ["awscli", "awscliv2"]
|
|
||||||
|
|
||||||
# Vault CLI
|
|
||||||
- name: Download vault binary
|
|
||||||
unarchive:
|
|
||||||
src: https://releases.hashicorp.com/vault/{{vault_version}}/vault_{{vault_version}}_linux_amd64.zip
|
|
||||||
dest: '{{ executable_temp_dir }}'
|
|
||||||
remote_src: true
|
|
||||||
creates: '{{ executable_temp_dir }}/vault'
|
|
||||||
mode: 0755
|
|
||||||
- name: Move vault binary to /usr/local/bin
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: '{{ executable_temp_dir }}/vault'
|
|
||||||
dest: /usr/local/bin/vault
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: '0755'
|
|
||||||
become: yes
|
|
||||||
|
|
||||||
# Snap Installs
|
|
||||||
- name: Ensure snap installed
|
|
||||||
community.general.pacman:
|
|
||||||
name: snapd
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
- name: Ensure snapd service running
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: snapd.socket
|
|
||||||
state: started
|
|
||||||
enabled: yes
|
|
||||||
become: yes
|
|
||||||
- name: Link /var/lib/snapd/snap /snap
|
|
||||||
ansible.builtin.file:
|
|
||||||
src: /var/lib/snapd/snap
|
|
||||||
dest: /snap
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
state: link
|
|
||||||
become: yes
|
|
||||||
- name: Install snap-store
|
|
||||||
community.general.snap:
|
|
||||||
name: snap-store
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
retries: 6
|
|
||||||
delay: 10
|
|
||||||
- name: Install vscode
|
|
||||||
community.general.snap:
|
|
||||||
name: code
|
|
||||||
state: present
|
|
||||||
classic: yes
|
|
||||||
become: yes
|
|
||||||
- name: Install spotify
|
|
||||||
community.general.snap:
|
|
||||||
name: spotify
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
|
|
||||||
# Create swap
|
|
||||||
- name: Turn off swap
|
|
||||||
command: "swapoff --all"
|
|
||||||
become: yes
|
|
||||||
- name: Remove old swap file
|
|
||||||
file:
|
|
||||||
state: absent
|
|
||||||
path: "{{ swap_file_path }}"
|
|
||||||
become: yes
|
|
||||||
- name: Create swap file
|
|
||||||
command: truncate -s 0 "{{ swap_file_path }}"
|
|
||||||
creates="{{ swap_file_path }}"
|
|
||||||
become: yes
|
|
||||||
- name: Set swap compression
|
|
||||||
command: chattr +C "{{ swap_file_path }}"
|
|
||||||
become: yes
|
|
||||||
- name: Allocate swap space
|
|
||||||
command: fallocate -l "{{ swap_file_size_mb }}M" "{{ swap_file_path }}"
|
|
||||||
become: yes
|
|
||||||
- name: Change swap file permissions
|
|
||||||
file: path="{{ swap_file_path }}"
|
|
||||||
owner=root
|
|
||||||
group=root
|
|
||||||
mode=0600
|
|
||||||
become: yes
|
|
||||||
- name: "Check swap file type"
|
|
||||||
command: file {{ swap_file_path }}
|
|
||||||
register: swapfile
|
|
||||||
become: yes
|
|
||||||
- name: Make swap file
|
|
||||||
command: "mkswap {{ swap_file_path }}"
|
|
||||||
become: yes
|
|
||||||
- name: Write swap entry in fstab
|
|
||||||
mount: name=none
|
|
||||||
src={{ swap_file_path }}
|
|
||||||
fstype=swap
|
|
||||||
opts=sw
|
|
||||||
passno=0
|
|
||||||
dump=0
|
|
||||||
state=present
|
|
||||||
become: yes
|
|
||||||
- name: Mount swap
|
|
||||||
command: "swapon {{ swap_file_path }}"
|
|
||||||
become: yes
|
|
||||||
- name: Set swappiness
|
|
||||||
command: sysctl -w vm.swappiness=1
|
|
||||||
become: yes
|
|
||||||
- name: Make swappiness permanent
|
|
||||||
copy:
|
|
||||||
dest: "/etc/sysctl.d/99-swappiness.conf"
|
|
||||||
content: |
|
|
||||||
vm.swappiness=1
|
|
||||||
become: yes
|
|
||||||
|
|
||||||
# Minecraft
|
|
||||||
- name: Clone minecraft-launcher repo
|
|
||||||
ansible.builtin.git:
|
|
||||||
repo: 'https://aur.archlinux.org/minecraft-launcher.git'
|
|
||||||
dest: '{{ executable_temp_dir }}/minecraft-launcher'
|
|
||||||
- name: Install minecraft-launcher with makepkg
|
|
||||||
command: makepkg -si --noconfirm
|
|
||||||
args:
|
|
||||||
chdir: '{{ executable_temp_dir }}/minecraft-launcher'
|
|
||||||
|
|
||||||
# Citrix ICA Client (Citrix Receiver)
|
|
||||||
- name: Clone citrix-receiver repo
|
|
||||||
ansible.builtin.git:
|
|
||||||
repo: 'https://aur.archlinux.org/icaclient.git'
|
|
||||||
dest: '{{ executable_temp_dir }}/citrix-receiver'
|
|
||||||
- name: Install citrix-receiver with makepkg
|
|
||||||
command: makepkg -si --noconfirm
|
|
||||||
args:
|
|
||||||
chdir: '{{ executable_temp_dir }}/citrix-receiver'
|
|
||||||
- name: Create INI client dir for citrix receiver
|
|
||||||
file:
|
|
||||||
state: directory
|
|
||||||
path: '~/.ICAClient/cache'
|
|
||||||
- name: Copy INI Files to ICAClient so citrix receiver works
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: '/opt/Citrix/ICAClient/config/{{ item }}.ini'
|
|
||||||
dest: '~/.ICAClient/{{ item }}.ini'
|
|
||||||
loop:
|
|
||||||
- All_Regions
|
|
||||||
- Trusted_Region
|
|
||||||
- Unknown_Region
|
|
||||||
- canonicalization
|
|
||||||
- regions
|
|
||||||
|
|
||||||
# Backup
|
|
||||||
- name: Create backup mount directory
|
|
||||||
file:
|
|
||||||
state: directory
|
|
||||||
path: '/mnt/backup0'
|
|
||||||
become: yes
|
|
||||||
tags: backup
|
|
||||||
- name: Ensure backup0 device exists in crypttab
|
|
||||||
community.general.crypttab:
|
|
||||||
name: backup0
|
|
||||||
backing_device: UUID=1d7ce570-e695-47a0-9dda-5f14b5b20e21
|
|
||||||
password: /home/ducoterra/.lukskeys/backup0
|
|
||||||
opts: luks
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
no_log: true
|
|
||||||
tags: backup
|
|
||||||
- name: Ensure backup0 mount exists in fstab
|
|
||||||
ansible.posix.mount:
|
|
||||||
path: /mnt/backup0
|
|
||||||
src: /dev/mapper/backup0
|
|
||||||
fstype: btrfs
|
|
||||||
opts: defaults,noatime,compress=zstd
|
|
||||||
state: present
|
|
||||||
become: yes
|
|
||||||
tags: backup
|
|
||||||
- name: Ensure /usr/local/scripts exists
|
|
||||||
file:
|
|
||||||
state: directory
|
|
||||||
path: '/usr/local/scripts'
|
|
||||||
become: yes
|
|
||||||
tags: backup
|
|
||||||
- name: Copy btrfs_backup.sh
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: scripts/btrfs_backup.sh
|
|
||||||
dest: /usr/local/scripts/btrfs_backup.sh
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: '0760'
|
|
||||||
become: yes
|
|
||||||
tags: backup
|
|
||||||
- name: Ensure hourly backups of /
|
|
||||||
ansible.builtin.cron:
|
|
||||||
name: "hourly backup of /"
|
|
||||||
minute: "0"
|
|
||||||
job: "export SOURCE_DIR=/; /usr/local/scripts/btrfs_backup.sh"
|
|
||||||
become: yes
|
|
||||||
tags: backup
|
|
||||||
- name: Ensure hourly backups of /home
|
|
||||||
ansible.builtin.cron:
|
|
||||||
name: "hourly backup of /home"
|
|
||||||
minute: "0"
|
|
||||||
job: "export SOURCE_DIR=/home; /usr/local/scripts/btrfs_backup.sh"
|
|
||||||
become: yes
|
|
||||||
tags: backup
|
|
||||||
- name: Ensure cronie service started
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: cronie
|
|
||||||
state: restarted
|
|
||||||
daemon_reload: yes
|
|
||||||
enabled: yes
|
|
||||||
become: yes
|
|
||||||
tags: backup
|
|
||||||
|
|
||||||
# Secure Boot
|
|
||||||
# https://gist.github.com/umbernhard/d1f4a44430d6d21b3881652c7a7c9ae5
|
|
||||||
|
|
||||||
# Reboot
|
|
||||||
# - name: Unconditionally reboot the machine with all defaults
|
|
||||||
# reboot:
|
|
||||||
# become: yes
|
|
||||||
Reference in New Issue
Block a user