ansible/roles/copr/base/tasks/main.yml

---
# tasklist for setting up copr
# This is the base set of files needed for copr


# again to late to do it here
# - import_tasks: "{{ tasks_path }}/cloud_setup_basic.yml"
# already included into the `base` role
# - import_tasks: "{{ tasks_path }}/postfix_basic.yml"

# To late to do it here (
# - name: Setup correct hostname for copr machine
#  hostname: name="{{ copr_hostbase }}.cloud.fedoraproject.org"
#  #  hostname: name="{{ hostbase|regex_replace('.*-$', '')}}.cloud.fedoraproject.org"
#  tags:
#  - config

- name: Enable epel for non-fedora hosts
  ansible.builtin.package: state=present pkg="epel-release"
  when: ansible_distribution != 'Fedora'

- name: Copy .forward file
  ansible.builtin.copy: src="{{ _forward_src }}" dest="/root/.forward" owner=root group=root
  tags:
  - config

- name: Deploy /etc/hosts file
  ansible.builtin.copy: src="hosts" dest=/etc/ owner=root group=root mode=644
  tags:
  - config

# https://bugzilla.redhat.com/show_bug.cgi?id=1941170
- name: Mask the systemd-oomd service
  systemd:
    name: systemd-oomd
    state: stopped
    enabled: no
    masked: yes
  when: ansible_distribution == 'Fedora'

- name: Configure crond
  ansible.builtin.copy: src=sysconfig.crond dest=/etc/sysconfig/crond
  notify: Restart crond

- name: Install base copr packages
  ansible.builtin.package:
    name:
      - acl  # useful for ansible acl module
      - bash-completion
      - cronie-anacron
      - ethtool
      - node-exporter
      - screen
      - tmux
    state: present
  tags:
    packages

- name: Install rsyslog-logrotate
  ansible.builtin.package: name=rsyslog-logrotate state=present
  when: ansible_distribution == 'Fedora'

- name: Configure anacrond to not send mails to root user
  lineinfile: dest=/etc/anacrontab
              backup=yes
              state=present
              line='MAILTO=copr-team@redhat.com'
              regexp="^MAILTO"
  notify: Restart crond

- name: Override the default rsyslog logrotate file
  ansible.builtin.copy: src=syslog-logrotate dest=/etc/logrotate.d/rsyslog
  tags:
  - logrotate
  when: ansible_distribution == 'Fedora'

- name: Install copr-selinux
  ansible.builtin.package:
    state: latest
    name: copr-selinux
  tags:
  - packages

- name: Start node exporter
  service: state=started enabled=yes name=node_exporter
  when:
    - "'pulp' not in inventory_hostname"

# - name: Check offloading
#   ansible.builtin.shell: "ethtool -k ens5 | egrep -q 'tcp-segmentation-offload: on|generic-receive-offload: on|generic-segmentation-offload: on'"
#   register: offloading
#   failed_when: offloading.rc == 2
#   changed_when: "1 != 1"
#   check_mode: no
#
# - name: Disable offloading
#   ansible.builtin.command: ethtool -K ens5 tso off gro off gso off
#   when:
#     - offloading.rc == 0
#     - ansible_distribution == 'Fedora'
#
# - name: Disable offloading (persitently)
#   ansible.builtin.shell: "nmcli con modify '{{ aws_ipv6_con }}' ethtool.feature-tso off ethtool.feature-gro off ethtool.feature-gso off"
#   when:
#     - offloading.rc == 0
#     - ansible_distribution == 'Fedora'
#   tags:
#   - config
#
# - name: Check we have the needed ipv6
#   ansible.builtin.shell: "nmcli con show '{{ aws_ipv6_con }}' | grep ipv6.addresses | grep {{ aws_ipv6_addr }}"
#   register: ipv6_config_check
#   failed_when: false
#   changed_when: ipv6_config_check.rc == 1
#   when:
#     - aws_ipv6_addr is defined
#   tags: ipv6_config
#
# - name: Setup ipv6 networking
#   ansible.builtin.shell: |
#     nmcli con modify '{{ aws_ipv6_con }}' ipv6.method auto ipv6.may-fail yes ipv6.never-default no ipv6.addresses '{{ aws_ipv6_addr }}'
#     nmcli con up '{{ aws_ipv6_con }}'
#   when:
#     - aws_ipv6_addr is defined
#     - ipv6_config_check.changed
#   tags: ipv6_config

- name: Install nrpe checks
  ansible.builtin.template: src=copr_nrpe.cfg
            dest=/etc/nrpe.d/copr_nrpe.cfg
  notify:
  - Restart nrpe
  tags:
  - nagios_client
  - copr_cdn
  - copr_ping

# - name: Enable and run logrotate service
#   service: name="logrotate" state=started

# https://github.com/fedora-copr/copr/issues/3439
- name: Install iptables-nft
  ansible.builtin.package: name=iptables-nft state=present
  register: iptables

- name: Remove iptables-legacy
  ansible.builtin.package: name=iptables-legacy state=absent

- name: Restart iptables
  service: name=iptables state=restarted
  when: iptables.changed