roles/base/ansible/autoselfheal/tasks/main.yml

   1 #####################################
   2 ### someone's ansible provisioner ###
   3 #####################################
   4 # Part of: https://git.somenet.org/root/pub/somesible.git
   5 # 2017-2025 by someone <someone@somenet.org>
   6 #
   7 # automatic/periodic self healing.
   8 #
   9 ---
  10 - name: install ansible
  11   apt:
  12     pkg:
  13     - ansible
  14     state: present
  15     policy_rc_d: 101
  16   tags: "online"
  17   ignore_errors: "{{ignore_online_errors | bool}}"
  18
  19
  20 - name: copy ssh config
  21   copy:
  22     src: "{{ansible_setup_autoselfheal_ssh_dir_location}}/.ssh/config"
  23     dest: "/var/ansible/.ssh/config"
  24     mode: 0600
  25     owner: "ansible"
  26     group: "root"
  27
  28
  29 - name: copy somesibleupdater private key
  30   copy:
  31     src: "{{ansible_setup_autoselfheal_ssh_dir_location}}/.ssh/key"
  32     dest: "/var/ansible/.ssh/somesible_autoupdater_key"
  33     mode: 0600
  34     owner: "ansible"
  35     group: "root"
  36
  37
  38 - name: ensure ansible_autoselfheal.log exists
  39   copy:
  40     content: ""
  41     dest: "/var/log/ansible_autoselfheal.log"
  42     force: no
  43     mode: 0640
  44     owner: "ansible"
  45     group: "root"
  46
  47
  48 - name: create logrotate entry for ansible_autoselfheal.log
  49   copy:
  50     src: "{{item}}"
  51     dest: "/etc/logrotate.d/ansible_autoselfheal"
  52     mode: 0644
  53     owner: "root"
  54     group: "root"
  55   with_first_found:
  56     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/ansible_autoselfheal.logrotate"
  57     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/ansible_autoselfheal.logrotate"
  58     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/ansible_autoselfheal.logrotate"
  59     - "default/ansible_autoselfheal.logrotate"
  60
  61
  62 - name: remove "ansible_autoselfheal" workdir to force re-creation.
  63   file:
  64     path: "/var/ansible/ansible"
  65     state: absent
  66   when: ansible_setup_reset | bool
  67
  68
  69 - name: create "ansible_autoselfheal" workdir and set permissions
  70   file:
  71     path: "/var/ansible/ansible"
  72     state: directory
  73     mode: "u+rwX,go-rwx"
  74     owner: "ansible"
  75     group: "root"
  76
  77
  78 - name: copy run_somesible.sh script from "{{lookup('env','PWD')}}"
  79   copy:
  80     src: "{{lookup('env','PWD')}}/run_somesible.sh"
  81     dest: "/var/ansible/ansible/run_somesible.sh"
  82     mode: 0700
  83     owner: "ansible"
  84     group: "root"
  85
  86
  87 - name: create group_vars-dir
  88   file:
  89     path: "/var/ansible/ansible/group_vars"
  90     state: directory
  91     mode: "u+rwX,go-rwx"
  92     owner: "ansible"
  93     group: "root"
  94   tags: "ansible-sync"
  95
  96
  97 - name: copy the group vars of groups the host is in
  98   copy:
  99     src: "{{lookup('env','PWD')}}/group_vars/{{item}}.yml"
 100     dest: "/var/ansible/ansible/group_vars/{{item}}.yml"
 101     mode: 0600
 102     owner: "ansible"
 103     group: "root"
 104   with_items: "{{group_names + ['all']}}"
 105   ignore_errors: yes
 106   tags: "ansible-sync"
 107
 108
 109 - name: list files in /var/ansible/ansible/group_vars
 110   shell: "ls -1 /var/ansible/ansible/group_vars"
 111   register: contents
 112   tags: "ansible-sync"
 113   changed_when: False
 114
 115
 116 - name: remove unmanaged files in /var/ansible/ansible/group_vars
 117   file:
 118     path: "/var/ansible/ansible/group_vars/{{item}}"
 119     state: absent
 120   with_items: "{{contents.stdout_lines}}"
 121   when: item|regex_replace('^(.*)\\.yml$', '\\1') not in (group_names+['all'])
 122   tags: "ansible-sync"
 123
 124
 125 - name: create group_files/all-dir
 126   file:
 127     path: "/var/ansible/ansible/group_files/all"
 128     state: directory
 129     mode: "u+rwX,go-rwx"
 130     owner: "ansible"
 131     group: "root"
 132   tags: "ansible-sync"
 133
 134
 135 - name: synchronize group_files/all-dir
 136   synchronize:
 137     src: "{{lookup('env','PWD')}}/group_files/all/"
 138     dest: "/var/ansible/ansible/group_files/all/"
 139     delete: yes
 140     checksum: yes
 141     recursive: yes
 142     archive: no
 143   ignore_errors: yes
 144   tags: "ansible-sync"
 145
 146
 147 - name: synchronize group_files/{{group_files_group}}-dir
 148   synchronize:
 149     src: "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/"
 150     dest: "/var/ansible/ansible/group_files/{{group_files_group}}/"
 151     delete: yes
 152     checksum: yes
 153     recursive: yes
 154     archive: no
 155   when: group_files_group != "all"
 156   ignore_errors: yes
 157   tags: "ansible-sync"
 158
 159
 160 - name: list dirs in /var/ansible/ansible/group_files
 161   shell: "ls -1 /var/ansible/ansible/group_files"
 162   register: contents
 163   tags: "ansible-sync"
 164   changed_when: False
 165
 166
 167 - name: remove unmanaged dirs in /var/ansible/ansible/group_files
 168   file:
 169     path: "/var/ansible/ansible/group_files/{{item}}"
 170     state: absent
 171   with_items: "{{contents.stdout_lines}}"
 172   when: item != "all" and item != group_files_group
 173   tags: "ansible-sync"
 174
 175
 176 - name: create ansible host_files-dir
 177   file:
 178     path: "/var/ansible/ansible/host_files"
 179     state: directory
 180     mode: "u+rwX,go-rwx"
 181     owner: "ansible"
 182     group: "root"
 183   tags: "ansible-sync"
 184
 185
 186 - name: synchronize host's host_files-dir
 187   synchronize:
 188     src: "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/"
 189     dest: "/var/ansible/ansible/host_files/{{inventory_hostname}}/"
 190     delete: yes
 191     checksum: yes
 192     recursive: yes
 193     archive: no
 194   ignore_errors: yes
 195   tags: "ansible-sync"
 196
 197
 198 - name: create ansible host_playbooks-dir
 199   file:
 200     path: "/var/ansible/ansible/host_playbooks"
 201     state: directory
 202     mode: "u+rwX,go-rwx"
 203     owner: "ansible"
 204     group: "root"
 205   tags: "ansible-sync"
 206
 207
 208 - name: copy host's playbook
 209   copy:
 210     src: "{{lookup('env','PWD')}}/host_playbooks/{{inventory_hostname}}.yml"
 211     dest: "/var/ansible/ansible/host_playbooks/{{inventory_hostname}}.yml"
 212     mode: 0600
 213     owner: "ansible"
 214     group: "root"
 215   tags: "ansible-sync"
 216
 217
 218 - name: create ansible host_vars-dir
 219   file:
 220     path: "/var/ansible/ansible/host_vars"
 221     state: directory
 222     mode: "u+rwX,go-rwx"
 223     owner: "ansible"
 224     group: "root"
 225   tags: "ansible-sync"
 226
 227
 228 - name: synchronize host's host_vars dir
 229   synchronize:
 230     src: "{{lookup('env','PWD')}}/host_vars/{{inventory_hostname}}"
 231     dest: "/var/ansible/ansible/host_vars/{{inventory_hostname}}"
 232     delete: yes
 233     checksum: yes
 234     recursive: yes
 235     archive: no
 236   ignore_errors: yes
 237   tags: "ansible-sync"
 238
 239
 240 # Make the site consist of only the host's playbook
 241 - name: ensure ansible.inventory exists
 242   copy:
 243     content: "#AUTOGENERATED\n---\n- import_playbook: host_playbooks/{{inventory_hostname}}.yml\n"
 244     dest: "/var/ansible/ansible/site.yml"
 245     force: yes
 246     mode: 0600
 247     owner: "ansible"
 248     group: "root"
 249   tags: "ansible-sync"
 250
 251
 252 # Make the loopback connection run as "local"
 253 - name: ensure ansible.inventory exists
 254   copy:
 255     content: "#AUTOGENERATED\n\n{% for grp in group_names %}[{{grp}}]\n{{inventory_hostname}} ansible_connection=\"local\" ansible_setup=\"False\" run_is_ansible_autoselfheal=\"True\" group_files_group=\"{{group_files_group}}\"\n\n{% endfor %}"
 256     dest: "/var/ansible/ansible/ansible.inventory"
 257     mode: 0600
 258     owner: "ansible"
 259     group: "root"
 260   tags: "ansible-sync"
 261
 262
 263 - name: fix "ansible_autoselfheal" workdir permissions.
 264   file:
 265     path: "/var/ansible/ansible"
 266     state: directory
 267     recurse: yes
 268     mode: "u+rwX,go-rwx"
 269     owner: "ansible"
 270     group: "root"
 271   tags: "ansible-sync"
 272
 273
 274 - name: copy ansible_autoselfheal.service to /etc/systemd/system/
 275   copy:
 276     src: "{{item}}"
 277     dest: "/etc/systemd/system/ansible_autoselfheal.service"
 278     mode: 0644
 279     owner: "root"
 280     group: "root"
 281   with_first_found:
 282     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/ansible_autoselfheal.service"
 283     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/ansible_autoselfheal.service"
 284     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/ansible_autoselfheal.service"
 285     - "default/ansible_autoselfheal.service"
 286
 287
 288 - name: copy ansible_autoselfheal.timer to /etc/systemd/system/
 289   copy:
 290     src: "{{item}}"
 291     dest: "/etc/systemd/system/ansible_autoselfheal.timer"
 292     mode: 0644
 293     owner: "root"
 294     group: "root"
 295   with_first_found:
 296     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/ansible_autoselfheal.timer"
 297     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/ansible_autoselfheal.timer"
 298     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/ansible_autoselfheal.timer"
 299     - "default/ansible_autoselfheal.timer"
 300
 301
 302 - name: enable and start ansible_autoselfheal.timer
 303   include_role: name="base/systemd/enable-and-start"
 304   vars:
 305     service_name: ansible_autoselfheal.timer
 306
 307
 308
 309 #############################################
 310 # update "ansible_autoselfheal" known_hosts #
 311 #############################################
 312 # TODO: maybe useless
 313 - name: copy known_hosts
 314   copy:
 315     src: "{{item}}"
 316     dest: "/var/ansible/.ssh/known_hosts"
 317     mode: 0600
 318     owner: "ansible"
 319     group: "root"
 320   with_first_found:
 321     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/known_hosts"
 322     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/known_hosts"
 323     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/known_hosts"
 324     - "default/known_hosts"
 325   when: ansible_setup_autoselfheal_update_known_hosts | bool