Commit 5c9b9193 authored by Clément Igonet's avatar Clément Igonet

setup enhancement

parent ccc065e5
......@@ -5,6 +5,6 @@
tasks:
- include: bootstrap.yml
- include: iptables.yml
# - include: iptables.yml
- include: sshd.yml
- include: oevUser.yml
......@@ -14,6 +14,7 @@
- "screen"
- "cifs-utils"
- "nfs-common"
- "apt-utils"
register: packages
become: yes
- debug: var=packages.stdout_lines
---
- name: caddy
hosts: all
tasks:
- name: download caddy_linux_mad64_custom.tar.gz
get_url:
url: https://caddyserver.com/download/build?os=linux&arch=amd64&features=
dest: /tmp/caddy_linux_mad64_custom.tar.gz
become: yes
register: downloadCaddy
- debug: var=downloadCaddy
- file: path=/tmp/caddy state=directory mode=0755
become: yes
- name: extract caddy
shell: |
set -xe
tar -zxvf /tmp/caddy_linux_mad64_custom.tar.gz -C /tmp/caddy
chown -R root:root /tmp/caddy
become: yes
register: extractCaddy
- debug: var=extractCaddy
- name: deploy caddy
shell: |
set -xe
mv -f /tmp/caddy/caddy /usr/local/bin/caddy
mv -f /tmp/caddy/init/linux-sysvinit/caddy /etc/init.d/caddy
mkdir -p /etc/caddy
become: yes
register: deployCaddy
- debug: var=deployCaddy
- name: Set properties for nexus service
lineinfile:
dest: /etc/init.d/caddy
regexp: '^DAEMONUSER=.*'
line: 'DAEMONUSER=oev'
owner: root
group: root
mode: 0755
become: yes
- name: configure caddy
copy:
src: ../resources/caddy/etc/caddy/Caddyfile
dest: /etc/caddy/Caddyfile
become: yes
register: setupCaddy
- debug: var=setupCaddy
- name: Start caddy as a daemon
shell: |
# service caddy restart
/etc/init.d/caddy restart
become: yes
register: startCaddyService
- debug: var=startCaddyService
# https://caddyserver.com/download/build?os=linux&arch=amd64&features=
# * Download the appropriate Caddy binary in `/usr/local/bin/caddy` or use `curl https://getcaddy.com | bash`.
# * Save the SysVinit config file in `/etc/init.d/caddy`.
# * Ensure that the folder `/etc/caddy` exists and that the subfolder `ssl` is owned by `www-data`.
# * Create a Caddyfile in `/etc/caddy/Caddyfile`
# * Now you can use `service caddy start|stop|restart|reload|status` as `root`.
---
- name: docker
hosts: all
become: yes
tasks:
- name: Prepare docker install
apt: name={{ item }} state=present update_cache=yes
with_items:
- apt-transport-https
- ca-certificates
- name: install python-pip
easy_install: name=pip
- name: install docker-py
pip: name=docker-py version=1.2.3
- name: register apt docker key
apt_key:
keyserver: p80.pool.sks-keyservers.net
id: 58118E89F3A912897C070ADBF76221572C52609D
- name: add docker repo
apt_repository: repo='deb https://apt.dockerproject.org/repo debian-jessie main' state=present
- name: Install docker packages
apt: name={{ item }} state=latest update_cache=yes
with_items:
- docker-engine
- name: Stop docker service
service:
name: docker
state: stopped
- name: Setup docker daemon options
lineinfile:
dest: /etc/default/docker
state: present
regexp: '^DOCKER_OPTS'
line: 'DOCKER_OPTS="--iptalbes=true"'
- name: Set oev user properties
shell: |
usermod -a -G docker oev
- name: Kill SSH
shell: sleep 1; pkill -u {{ ansible_ssh_user }} sshd
async: 3
poll: 2
- name: Start docker service
service:
name: docker
state: started
enabled: yes
---
- name: Set up iptables
hosts: all
become: yes
tasks:
......@@ -10,13 +9,18 @@
with_items:
- "iptables"
- "iptables-persistent"
become: yes
register: packages
- debug: var=packages.stdout_lines
- name: set iptables
copy:
src: ../resources/iptables/etc/iptables.up.rules
src: ../../resources/iptables/etc/iptables.up.rules
dest: /etc/iptables.test.rules
become: yes
- name: apply iptables
shell: |
iptables-restore < /etc/iptables.test.rules
iptables-save > /etc/iptables.up.rules
become: yes
---
- name: jenkins4OEV
- name: jenkins
hosts: all
tasks:
- name: Copy jenkins4OEV plugins file
copy:
src: "{{ item.source}}"
dest: "{{ item.dest }}"
with_items:
- { source: '../jenkins/jenkins4OEV_home/plugins.txt', dest: '/home/oev/Projects/OpenEarthView/ci/becky.framasoft.org/docker/oev-jenkins/' }
register: copyJenkins4OEVPlugins
- debug: var=copyJenkins4OEVPlugins
- name: OEV Jenkins4OEV docker image
shell: |
groups
docker build -t 'oev-jenkins:jenkins4OEV' /home/oev/Projects/OpenEarthView/ci/becky.framasoft.org/docker/oev-jenkins/
register: jenkins4OEVImage
- debug: var=jenkins4OEVImage
- file: path=/home/oev/jenkins4FTP state=directory
- name: jenkins container for OEV
shell: |
# Remove old docker if any
docker ps -a | grep jenkins4OEV && docker rm -f jenkins4OEV
docker run \
-d \
--network="host" \
-v /home/oev/jenkins4FTP:/var/jenkins_home \
--name "jenkins4OEV" \
-e JAVA_OPTS="-Dhudson.diyChunking=false" \
'oev-jenkins:jenkins4OEV'
register: jenkins4OEVContainer
- debug: var=jenkins4OEVContainer
- name: Setup hosts in jenkins4OEV
shell: docker exec -u root jenkins4OEV /usr/local/bin/hosts.sh
- name: Generate new ssh keys for jenkins4OEV
shell: docker exec -u jenkins jenkins4OEV /usr/local/bin/ssh-keygen.sh "jenkins@jenkins4OEV"
- name: Get jenkins@jenkins4OEV public key
shell: docker exec jenkins4OEV cat /var/jenkins_home/.ssh/id_rsa.pub
register: jenkins4OEVPubKey
- name: Insert jenkins4OEVPubKey in hakan authorized_key
authorized_key: user=gexprod key="{{ jenkins4OEVPubKey.stdout }}"
# This is the Debian package repository of Jenkins to automate installation and upgrade. To use this repository, first add the key to your system:
# wget -q -O - http://pkg.jenkins.io/debian-stable/jenkins.io.key | sudo apt-key add -
- name: Add apt key to the system
apt_key: url=http://pkg.jenkins.io/debian-stable/jenkins.io.key state=present
become: yes
register: addAptKey
- debug: var=addAptKey
# Then add the following entry in your /etc/apt/sources.list:
# deb http://pkg.jenkins.io/debian-stable binary/
- name: Add deb entry to /etc/apt/sources.list
apt_repository: repo='deb http://pkg.jenkins.io/debian-stable binary/' state=present
become: yes
register: addDebEntry
- debug: var=addDebEntry
# Update your local package index, then finally install Jenkins:
# sudo apt-get update
# sudo apt-get install jenkins
- name: Install Jenkins
apt: name=jenkins update_cache=yes
become: yes
register: installJenkins
- debug: var=installJenkins
---
- name: jenkins4OEV
hosts: all
tasks:
- name: Copy jenkins4OEV plugins file
copy:
src: "{{ item.source}}"
dest: "{{ item.dest }}"
with_items:
- { source: '../jenkins/jenkins4OEV_home/plugins.txt', dest: '/home/oev/Projects/OpenEarthView/ci/becky.framasoft.org/docker/oev-jenkins/' }
register: copyJenkins4OEVPlugins
- debug: var=copyJenkins4OEVPlugins
- name: OEV Jenkins4OEV docker image
shell: |
groups
docker build -t 'oev-jenkins:jenkins4OEV' /home/oev/Projects/OpenEarthView/ci/becky.framasoft.org/docker/oev-jenkins/
register: jenkins4OEVImage
- debug: var=jenkins4OEVImage
- file: path=/home/oev/jenkins4FTP state=directory
- name: jenkins container for OEV
shell: |
# Remove old docker if any
docker ps -a | grep jenkins4OEV && docker rm -f jenkins4OEV
docker run \
-d \
--network="host" \
-v /home/oev/jenkins4FTP:/var/jenkins_home \
--name "jenkins4OEV" \
-e JAVA_OPTS="-Dhudson.diyChunking=false" \
'oev-jenkins:jenkins4OEV'
register: jenkins4OEVContainer
- debug: var=jenkins4OEVContainer
- name: Setup hosts in jenkins4OEV
shell: docker exec -u root jenkins4OEV /usr/local/bin/hosts.sh
- name: Generate new ssh keys for jenkins4OEV
shell: docker exec -u jenkins jenkins4OEV /usr/local/bin/ssh-keygen.sh "jenkins@jenkins4OEV"
- name: Get jenkins@jenkins4OEV public key
shell: docker exec jenkins4OEV cat /var/jenkins_home/.ssh/id_rsa.pub
register: jenkins4OEVPubKey
- name: Insert jenkins4OEVPubKey in hakan authorized_key
authorized_key: user=gexprod key="{{ jenkins4OEVPubKey.stdout }}"
......@@ -4,6 +4,8 @@
tasks:
- include: bootstrap.yml
- include: docker.yml
# - include: docker.yml
- include: iptables.yml
- include: gitRepo.yml
- include: jenkins.yml
- include: caddy.yml
integration.openearthview.net {
tls contact@openearthview.net
root /home/oev/Projects/OpenEarthView/viewer-earth-api-integration
gzip
log /home/oev/Projects/OpenEarthView/viewer-earth-api-integration/access.log
}
......@@ -8,6 +8,7 @@
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 11166 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment