sysconfig/setup.yml

---
- name: Setup the system
  hosts: all
  gather_facts: true
  # vars:
  #   # Determine the fstype of root filesystem
  #   # PERF: a shorter version but requires `py3-jmespath`: '{{ ansible_mounts | json_query("[?mount == `/`].fstype") | first }}'
  #   rootfs: '{{ ansible_mounts | selectattr("mount", "equalto", "/") | map(attribute="fstype") | first }}'
  pre_tasks:
    # FIXME: ansible_mounts doesn't recognise ZFS dataset (yet???)
    # Ref: https://github.com/ansible/ansible/issues/24644
    - name: Guess fstype of the root filesystem
      shell:
        cmd: /bin/findmnt -M / -o FSTYPE -f | tail -n 1
      register: findmnt_result
    - name: Set rootfs variable
      set_fact:
        rootfs: findmnt_result.stdout
    - name: Sanity checks
      tags: always
      block:
        - name: Check user ID
          fail:
            msg: This playbook should be run as 'root'
          when: ansible_real_user_id != 0
        - name: Import list of accepted values for custom variables
          include_vars:
            name: accepted_values
            file: ./requirements/accepted_variables.yml
        - name: Check defined values of top-level variables
          fail:
            msg: 'Variable `{{ item }}` needs to be 1 of {{ accepted_values[item] }}'
          when: not vars[item] in accepted_values[item]
          loop: '{{ accepted_values | flatten }}'
  roles:
    - role: essential
      tags: essential
    - role: devd
      tags: devd
    - role: acpi
      tags: acpi
    - role: seat
      tags: seat
    - role: fstab
      tags: fstab
    - role: nftables
      tags: nftables
    - role: apparmor
      tags: apparmor
    - role: auditd
      tags: auditd
    - role: ntpd
      tags: ntpd
    - role: cron
      tags: cron
    - role: networking
      tags: networking
    - role: libvirt
      tags: libvirt
    - role: tlp
      tags: [laptop, tlp]
    - role: dns
      tags: dns
    - role: usbguard
      tags: usbguard
    - role: zram
      tags: zram
    - role: snapshot
      tags: snapshot
      when: snapshot_tool != 'none'
    - role: earlyoom
      tags: earlyoom
    - role: user
      tags: user
Getting started 2022-01-14 19:46:59 +01:00			`---`
			`- name: Setup the system`
			`hosts: all`
snapshot: add new role with 'snapper' option btrbk will be next \^*^/ Also: - detect the root filesystem in play with `ansible_mounts` instead of specifying it manually. - dnscrypt: hardcode some privacy settings 2023-06-15 19:00:00 +02:00			`gather_facts: true`
Update rootfs check zfs isn't recognizable by ansible_mounts fact. 2023-06-17 19:00:00 +02:00			`# vars:`
			`# # Determine the fstype of root filesystem`
			# # PERF: a shorter version but requires `py3-jmespath`: '{{ ansible_mounts \| json_query("[?mount == `/`].fstype") \| first }}'
			`# rootfs: '{{ ansible_mounts \| selectattr("mount", "equalto", "/") \| map(attribute="fstype") \| first }}'`
snapshot: add new role with 'snapper' option btrbk will be next \^*^/ Also: - detect the root filesystem in play with `ansible_mounts` instead of specifying it manually. - dnscrypt: hardcode some privacy settings 2023-06-15 19:00:00 +02:00			`pre_tasks:`
Update rootfs check zfs isn't recognizable by ansible_mounts fact. 2023-06-17 19:00:00 +02:00			`# FIXME: ansible_mounts doesn't recognise ZFS dataset (yet???)`
			`# Ref: https://github.com/ansible/ansible/issues/24644`
			`- name: Guess fstype of the root filesystem`
			`shell:`
			`cmd: /bin/findmnt -M / -o FSTYPE -f \| tail -n 1`
			`register: findmnt_result`
			`- name: Set rootfs variable`
			`set_fact:`
			`rootfs: findmnt_result.stdout`
snapshot: add new role with 'snapper' option btrbk will be next \^*^/ Also: - detect the root filesystem in play with `ansible_mounts` instead of specifying it manually. - dnscrypt: hardcode some privacy settings 2023-06-15 19:00:00 +02:00			`- name: Sanity checks`
			`tags: always`
			`block:`
			`- name: Check user ID`
			`fail:`
			`msg: This playbook should be run as 'root'`
			`when: ansible_real_user_id != 0`
			`- name: Import list of accepted values for custom variables`
			`include_vars:`
			`name: accepted_values`
			`file: ./requirements/accepted_variables.yml`
			`- name: Check defined values of top-level variables`
			`fail:`
			msg: 'Variable `{{ item }}` needs to be 1 of {{ accepted_values[item] }}'
			`when: not vars[item] in accepted_values[item]`
			`loop: '{{ accepted_values \| flatten }}'`
Getting started 2022-01-14 19:46:59 +01:00			`roles:`
			`- role: essential`
			`tags: essential`
roles: add devd role Make device_manager configurable on setup (mdev, mdevd, udev) utilizing the new introduced 'setup-devd' script. 2022-05-20 18:55:40 +02:00			`- role: devd`
			`tags: devd`
Add acpi events Also separate seat management into 'seat' role 2022-02-17 05:45:52 +01:00			`- role: acpi`
			`tags: acpi`
			`- role: seat`
			`tags: seat`
Big chunk of changes - essential: - make polkit optional - move /etc/hosts file to unbound role - libvirt: - make libvirt daemons configurable - delete the firewall patch. Hardcode the rules by default (for now) so that the playbook is compatible with `ansible-core` - user: add pam_limits file (moved from dotfiles repository) - sysctl: role deleted. The task was moved to essential role - fstab: new role for /run, /tmp, /proc mounts - add seatd as a 'seat_manager' option - cron: use find command to restraint deleted files in /var/tmp 2022-02-11 18:39:35 +01:00			`- role: fstab`
			`tags: fstab`
Getting started 2022-01-14 19:46:59 +01:00			`- role: nftables`
			`tags: nftables`
			`- role: apparmor`
			`tags: apparmor`
Add 'ntpd' and 'auditd' roles More changes: - Remove 'grub' role. We shouldn't touch anything related to the bootloader here, as it's dangerous. I'll write docs for myself on this. - Fix linting here and there, so ansible-lint won't complain - Refactor group_vars/all.yml to be more readable 2023-04-05 19:00:00 +02:00			`- role: auditd`
			`tags: auditd`
			`- role: ntpd`
			`tags: ntpd`
Getting started 2022-01-14 19:46:59 +01:00			`- role: cron`
			`tags: cron`
Some beginning works for component customization 2022-10-01 16:15:29 +02:00			`- role: networking`
			`tags: networking`
Getting started 2022-01-14 19:46:59 +01:00			`- role: libvirt`
			`tags: libvirt`
			`- role: tlp`
Tons of cool things - unbound: rename role to 'dns', add dnscrypt-proxy tasks - devd: add sample udev rules - apparmor: move kernel parameters to group_vars 2022-06-19 20:27:32 +02:00			`tags: [laptop, tlp]`
			`- role: dns`
			`tags: dns`
Add usbguard role + refactor apk packages 2022-02-27 17:00:01 +01:00			`- role: usbguard`
			`tags: usbguard`
Getting started 2022-01-14 19:46:59 +01:00			`- role: zram`
			`tags: zram`
snapshot: add new role with 'snapper' option btrbk will be next \^*^/ Also: - detect the root filesystem in play with `ansible_mounts` instead of specifying it manually. - dnscrypt: hardcode some privacy settings 2023-06-15 19:00:00 +02:00			`- role: snapshot`
			`tags: snapshot`
			`when: snapshot_tool != 'none'`
roles: add earlyoom role 2022-07-23 13:43:38 +02:00			`- role: earlyoom`
			`tags: earlyoom`
Getting started 2022-01-14 19:46:59 +01:00			`- role: user`
			`tags: user`