Commit 670479b0 authored by Clément Igonet's avatar Clément Igonet

Add C.I. files

parent 65a0d3c1
[defaults]
transport = ssh
[ssh_connection]
ssh_args = -o ForwardAgent=yes
---
- name: bootstrap
hosts: all
tasks:
- name: install basic packages
apt: name={{ item }} state=present update_cache=yes
with_items:
- "sudo"
- "aptitude"
- "sshpass"
- "file"
- "screen"
register: packages
become: yes
- debug: var=packages.stdout_lines
---
- name: docker
hosts: all
tasks:
- name: Prepare docker install
apt: name={{ item }} state=present update_cache=yes
with_items:
- apt-transport-https
- ca-certificates
sudo: yes
- name: install python-pip
easy_install: name=pip
sudo: yes
- name: install docker-py
pip: name=docker-py version=1.2.3
sudo: yes
- name: register apt docker key
apt_key:
keyserver: p80.pool.sks-keyservers.net
id: 58118E89F3A912897C070ADBF76221572C52609D
sudo: yes
- name: add docker repo
apt_repository: repo='deb https://apt.dockerproject.org/repo debian-wheezy main' state=present
sudo: yes
- name: Install docker packages
apt: name={{ item }} state=present update_cache=yes
with_items:
- docker-engine
sudo: yes
- name: Stop docker service
service:
name: docker
state: stopped
sudo: yes
- name: Set oev user properties
shell: |
usermod -a -G docker oev
sudo: yes
- name: Kill SSH
shell: sleep 1; pkill -u {{ ansible_ssh_user }} sshd
async: 3
poll: 2
- name: Start docker service
service:
name: docker
state: started
enabled: yes
sudo: yes
---
- name: gitRepo
hosts: all
tasks:
- name: fetching oev repo
git: repo=git@framagit.org:pizaninja/OpenEarthView.git
dest="Project/OpenEarthView"
accept_hostkey=yes
force=yes
# recursive=no
[becky.framasoft.org]
becky.framasoft.org:11166
[becky.framasoft.org:vars]
ansible_port=11166
ansible_host=becky.framasoft.org
ansible_user=oev
ansible_ssh_private_key_file=~/.ssh/id_rsa_becky
#!/bin/sh
PYTHONUNBUFFERED=1 ANSIBLE_FORCE_COLOR=true \
ANSIBLE_HOST_KEY_CHECKING=false \
ANSIBLE_SSH_ARGS='-o UserKnownHostsFile=/dev/null -o ControlMaster=auto -o ControlPersist=60s' \
ansible-playbook \
--private-key=~/.ssh/id_rsa_becky \
--user=oev \
--connection=ssh \
--inventory-file=./inventory \
--limit='becky.framasoft.org' \
./playbook.yml \
-vvvv \
--extra-vars "ansible_sudo_pass=$1"
---
- name: this is a play at the top level of a file
hosts: all
tasks:
- include: bootstrap.yml
- include: docker.yml
- include: gitRepo.yml
[defaults]
transport = ssh
[ssh_connection]
ssh_args = -o ForwardAgent=yes
---
- name: bootstrap
hosts: all
tasks:
- name: install basic packages
apt: name={{ item }} state=present update_cache=yes
with_items:
- "sudo"
- "aptitude"
- "sshpass"
- "file"
- "screen"
register: packages
become: yes
- debug: var=packages.stdout_lines
[becky.framasoft.org]
becky.framasoft.org
[becky.framasoft.org:vars]
ansible_port=22
ansible_host=becky.framasoft.org
ansible_user=piz
ansible_ssh_private_key_file=~/.ssh/id_rsa_becky
---
- name: Set up iptables
hosts: all
become: yes
tasks:
- name: Install iptables tools
apt: name={{ item }} state=present update_cache=yes
with_items:
- "iptables"
- "iptables-persistent"
register: packages
- debug: var=packages.stdout_lines
- name: set iptables
copy:
src: ../resources/iptables/etc/iptables.up.rules
dest: /etc/iptables.test.rules
- name: apply iptables
shell: |
iptables-restore < /etc/iptables.test.rules
iptables-save > /etc/iptables.up.rules
---
- name: oevUser
hosts: all
tasks:
- name: create oev group
group: name=oev state=present
become: yes
- name: create oev user
user:
name: oev
password: $6$FsKHyvbkdAt1dFKP$XKhvQ1M6M6MhnDIOTonEtk1zUWStMC2qZg5vEMciVTUU/D4dSdb/Dm2YQGcCiPnTdOxF6vmPBc6nHjcPJ2xZB0
shell: /bin/bash
group: oev
groups: sudo
become: yes
- name: create oev dir
shell: |
chown -R oev:oev /home/oev
become: yes
- name: Set up authorized_keys for the oev user
authorized_key: user=oev key="{{ item }}"
with_file:
- ../resources/public_keys/cigone.pub
- ../resources/public_keys/cbigon.pub
become: yes
#!/bin/sh
PYTHONUNBUFFERED=1 ANSIBLE_FORCE_COLOR=true \
ANSIBLE_HOST_KEY_CHECKING=false \
ANSIBLE_SSH_ARGS='-o UserKnownHostsFile=/dev/null -o ControlMaster=auto -o ControlPersist=60s' \
ansible-playbook \
--private-key=~/.ssh/id_rsa_becky \
--user=piz \
--connection=ssh \
--inventory-file=./inventory \
--limit='becky.framasoft.org' \
./playbook.yml \
-vvvv \
--extra-vars "ansible_sudo_pass=$1"
---
- name: this is a play at the top level of a file
hosts: all
remote_user: piz
tasks:
- include: bootstrap.yml
- include: iptables.yml
- include: sshd.yml
- include: oevUser.yml
---
- name: ssh daemon
hosts: all
remote_user: piz
become: yes
vars:
# This is the certificate admins email - make sure to set it to yours!
ssh_port: 11166
tasks:
- name: Change ssh port
lineinfile:
dest: /etc/ssh/sshd_config
regexp: "^Port\\s"
line: "Port {{ssh_port}}"
state: present
- name: Restart ssh
service: name=ssh state=restarted
*filter
#:INPUT ACCEPT [0:0]
#:FORWARD ACCEPT [0:0]
#:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 11166 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
COMMIT
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChKK4/0Py/GlQ5ZxAFQVHBWCJBcbckt/o5UbTJJ15eD3VAFk0eKo6XrIlzZuSjA6dVfpcoN65y2iMZi5zJvRrQP8o0tbEfGUmVlpRUyFwXaTlojS6LzpYbP7acp1Og1k8Qbjvc8co5c1sbmUI+tenhEDNXD+nGFI2hb4x18mov65DMVq+zOOF+rEPnbDp2jo+UxRw2GiZ7JdrOCWsw+1kD3JSlneAS5KJ6gi0fJ6UzVSd5uYiRzG/aDJGYx4vshpI5WHv0fHhcLpibK8CdQeVxgTwwOgqENlOYg/QfnImAbcyaalWx91/C5oHA80v7Fq7QEMhdupla51fUOhf3Q6u1FExwXiLfflBtYZuyO8cXjm9xC0y1OKxpXBXOBDTDPbLA9+aR13o5Xa7iv0VGWR6tWn+DIfxhBdYuhjX6tNTikmcJBI+R3RdlJvqO5SpvQAyPMSBxIqP1hKGj5tlfYYPwiWOVvsX5bVRNqcZBkopGpWT2aMRo9qMYFg2xeBKGakmvUPaY+9GEkQipmaKRBtpG1+Gx/buy+3it5zzepYniypKexAJdM3iubLtpqPQFIVcKJ4CaTUUIGpBprNfM2JT2qzyDwX7BMl1xJSThbnBt16NfnvvEPd7mxX5GfUaoOYBpliVO2a8p72dwm4brH6OI1bdf85dvycyoQzzbystqtw== piz@openearthview.net
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment