folliehiyuki/sysconfig
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
This repository has been archived on 2024-02-16. You can view files and clone it, but cannot push or open issues or pull requests.
sysconfig/group_vars/all.yml

75 lines
2.1 KiB
YAML
Raw Normal View History

Getting started
2022-01-14 19:46:59 +01:00
---
Big chunk of changes - essential: - make polkit optional - move /etc/hosts file to unbound role - libvirt: - make libvirt daemons configurable - delete the firewall patch. Hardcode the rules by default (for now) so that the playbook is compatible with `ansible-core` - user: add pam_limits file (moved from dotfiles repository) - sysctl: role deleted. The task was moved to essential role - fstab: new role for /run, /tmp, /proc mounts - add seatd as a 'seat_manager' option - cron: use find command to restraint deleted files in /var/tmp
2022-02-11 18:39:35 +01:00
# Custom variables ────────────────────────────────────────────────────────────
Getting started
2022-01-14 19:46:59 +01:00
rootfs: btrfs
Big chunk of changes - essential: - make polkit optional - move /etc/hosts file to unbound role - libvirt: - make libvirt daemons configurable - delete the firewall patch. Hardcode the rules by default (for now) so that the playbook is compatible with `ansible-core` - user: add pam_limits file (moved from dotfiles repository) - sysctl: role deleted. The task was moved to essential role - fstab: new role for /run, /tmp, /proc mounts - add seatd as a 'seat_manager' option - cron: use find command to restraint deleted files in /var/tmp
2022-02-11 18:39:35 +01:00
Getting started
2022-01-14 19:46:59 +01:00
username: follie
Big chunk of changes - essential: - make polkit optional - move /etc/hosts file to unbound role - libvirt: - make libvirt daemons configurable - delete the firewall patch. Hardcode the rules by default (for now) so that the playbook is compatible with `ansible-core` - user: add pam_limits file (moved from dotfiles repository) - sysctl: role deleted. The task was moved to essential role - fstab: new role for /run, /tmp, /proc mounts - add seatd as a 'seat_manager' option - cron: use find command to restraint deleted files in /var/tmp
2022-02-11 18:39:35 +01:00
user: make shell configurable, update new realtime config
2022-05-16 11:24:58 +02:00
# See roles/user/defaults/main.yml for a list of accepted shells
usershell: fish
Big chunk of changes - essential: - make polkit optional - move /etc/hosts file to unbound role - libvirt: - make libvirt daemons configurable - delete the firewall patch. Hardcode the rules by default (for now) so that the playbook is compatible with `ansible-core` - user: add pam_limits file (moved from dotfiles repository) - sysctl: role deleted. The task was moved to essential role - fstab: new role for /run, /tmp, /proc mounts - add seatd as a 'seat_manager' option - cron: use find command to restraint deleted files in /var/tmp
2022-02-11 18:39:35 +01:00
repository: https://mirror.math.princeton.edu/pub/alpinelinux
# seatd or elogind
seat_manager: seatd
roles: add devd role Make device_manager configurable on setup (mdev, mdevd, udev) utilizing the new introduced 'setup-devd' script.
2022-05-20 18:55:40 +02:00
# busybox's mdev, skarnet's mdevd or eudev's udev
device_manager: mdevd
Big chunk of changes - essential: - make polkit optional - move /etc/hosts file to unbound role - libvirt: - make libvirt daemons configurable - delete the firewall patch. Hardcode the rules by default (for now) so that the playbook is compatible with `ansible-core` - user: add pam_limits file (moved from dotfiles repository) - sysctl: role deleted. The task was moved to essential role - fstab: new role for /run, /tmp, /proc mounts - add seatd as a 'seat_manager' option - cron: use find command to restraint deleted files in /var/tmp
2022-02-11 18:39:35 +01:00
# Have no effect when seat_manager == 'elogind'
# See use_polkit variable below
polkit: False
essential: make console font configurable
2022-02-17 17:33:22 +01:00
# Should be a file name in /usr/share/consolefonts/
console_font: ter-h22b.psf.gz
unbound: make upstream dns servers configurable
2022-01-28 17:43:31 +01:00
unbound_upstream_nameservers:
- 9.9.9.9@853#dns.quad9.net
- 149.112.112.112@853#dns.quad9.net
- 2620:fe::fe@853#dns.quad9.net
- 2620:fe::9@853#dns.quad9.net
Getting started
2022-01-14 19:46:59 +01:00
Big chunk of changes - essential: - make polkit optional - move /etc/hosts file to unbound role - libvirt: - make libvirt daemons configurable - delete the firewall patch. Hardcode the rules by default (for now) so that the playbook is compatible with `ansible-core` - user: add pam_limits file (moved from dotfiles repository) - sysctl: role deleted. The task was moved to essential role - fstab: new role for /run, /tmp, /proc mounts - add seatd as a 'seat_manager' option - cron: use find command to restraint deleted files in /var/tmp
2022-02-11 18:39:35 +01:00
# 'virtlockd' and 'virtlogd' will always be started. Don't list them here
libvirt_daemons:
- virtinterfaced
- virtnetworkd
- virtnodedevd
- virtqemud
- virtstoraged
Convert networking stuff to templates - unbound: add `network_interfaces` variable to control /etc/network/interfaces (check interfaces(5)) - nftables: add `libvirt_bridges` and `opened_ports` to dynamically generate firewall rules
2022-04-04 08:27:06 +02:00
# For libvirt's NAT firewall rules
# IPv6 is optional (https://wiki.gentoo.org/wiki/QEMU/KVM_IPv6_Support)
libvirt_bridges:
- name: virbr0
ip4: 192.168.122.0/24
# Public facing network interfaces
# https://wiki.alpinelinux.org/wiki/Configure_Networking
network_interfaces:
- name: eth0
ip4_type: dhcp
ip6_type: auto
roles: add waydroid; nftables: refactor firewall rules
2022-05-10 18:13:35 +02:00
# Punching holes on the machine
Convert networking stuff to templates - unbound: add `network_interfaces` variable to control /etc/network/interfaces (check interfaces(5)) - nftables: add `libvirt_bridges` and `opened_ports` to dynamically generate firewall rules
2022-04-04 08:27:06 +02:00
# 546/UDP (IPv6 link-local client) is hardcoded (opened) so don't specify it here
opened_ports:
tcp: []
udp: []
roles: add 'container' role with podman/nerdctl option Also enable cgroup v2 explicitly for openrc
2022-03-28 20:15:28 +02:00
# 'podman' or 'nerdctl'
rootless_container_cli: podman
roles: add waydroid; nftables: refactor firewall rules
2022-05-10 18:13:35 +02:00
# Configure waydroid base image
waydroid:
rom_type: lineage # lineage, bliss
system_type: FOSS # FOSS, GAPPS, VANILLA
Fix some regressions + tasks revision DETAILS: - consolefont: moved to essential role - unbound: copy the config only after everything is set up correctly (or else the validation will complain trusted-key.key and the root hints are not in the chroot) - essential: start dbus service before handling seat management (elogind and seatd services depend on dbus) - use full-path for commands (avoid potential polluted PATH attack) - apk: use '>-' for the package list. See NOTES NOTES: - '|' (literal) interprets new lines with a line break - '>' (folded) produces a single line with a '\n' at the end - '>-' (folded_strip) creates a single line without a line break in the end - '>' (folded scalars) joins all the lines with a space (doesn't preserve numeric, boolean and other non-string types) Check https://adminswerk.de/multi-line-string-yaml-ansible-II/ for some problems on using multiple lines variables
2022-02-14 06:55:43 +01:00
# Secrets encrypted with ansible-vault ────────────────────────────────────────
Big chunk of changes - essential: - make polkit optional - move /etc/hosts file to unbound role - libvirt: - make libvirt daemons configurable - delete the firewall patch. Hardcode the rules by default (for now) so that the playbook is compatible with `ansible-core` - user: add pam_limits file (moved from dotfiles repository) - sysctl: role deleted. The task was moved to essential role - fstab: new role for /run, /tmp, /proc mounts - add seatd as a 'seat_manager' option - cron: use find command to restraint deleted files in /var/tmp
2022-02-11 18:39:35 +01:00
password: '{{ vault_password }}'
# Do NOT change these variables ───────────────────────────────────────────────
# elogind needs polkit to function
use_polkit: '{{ (seat_manager == "elogind") | ternary("True", polkit) }}'
Reference in a new issue Copy permalink