infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 7 Projects Releases Packages Wiki Activity Actions

update ansible_distribution_major_version conditionals

Browse source 
Signed-off-by: Karsten Hopp <karsten@redhat.com>
This commit is contained in:
Karsten Hopp 2019-09-02 12:14:18 +02:00 • committed by Pierre-Yves Chibon
parent d982c06fde
commit c9ed62ac32
45 changed files with 460 additions and 175 deletions
Download patch file Download diff file Expand all files Collapse all files

4
handlers/restart_services.yml
View file

@ -77,8 +77,8 @@
#notify:
#- fix openvpn routing
- name: restart openvpn (RHEL7)
when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 7
- name: restart openvpn (RHEL7+)
when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int >= 7
action: service name=openvpn-client@openvpn state=restarted
#notify:
#- fix openvpn routing

26
playbooks/check-host.yml
View file

@ -17,7 +17,16 @@
- name: Get list of active loaded services with systemctl
shell: '/bin/systemctl -t service --no-legend | egrep "loaded active" | tr -s " " | cut -d " " -f1'
changed_when: False
when: ansible_distribution_major_version|int > 6
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
register: loaded_active_services_systemctl
tags:
- check
- services
- name: Get list of active loaded services with systemctl
shell: '/bin/systemctl -t service --no-legend | egrep "loaded active" | tr -s " " | cut -d " " -f1'
changed_when: False
when: ansible_distribution_major_version|int > 6 and ansible_distribution is 'RedHat'
register: loaded_active_services_systemctl
tags:
- check
@ -26,7 +35,16 @@
- name: Get list of inactive loaded services with systemctl
shell: '/bin/systemctl -t service --no-legend | egrep -v "loaded active" | tr -s " " | cut -d " " -f1'
changed_when: False
when: ansible_distribution_major_version|int > 6
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
register: loaded_inactive_services_systemctl
tags:
- check
- services
- name: Get list of inactive loaded services with systemctl
shell: '/bin/systemctl -t service --no-legend | egrep -v "loaded active" | tr -s " " | cut -d " " -f1'
changed_when: False
when: ansible_distribution_major_version|int > 6 and ansible_distribution is 'RedHat'
register: loaded_inactive_services_systemctl
tags:
- check
@ -36,7 +54,7 @@
- name: Get list of enabled services with chkconfig at current runlevel
shell: "chkconfig | grep \"`runlevel | cut -d ' ' -f 2`:on\" | awk '{print $1}'"
changed_when: False
when: ansible_distribution_major_version|int <= 6
when: ansible_distribution_major_version|int <= 6 and ansible_distribution is 'RedHat'
register: enabled_services_chkconfig
tags:
- check
@ -45,7 +63,7 @@
- name: Get list of disabled services with chkconfig at current runlevel
shell: "chkconfig | grep \"`runlevel | cut -d ' ' -f 2`:off\" | awk '{print $1}'"
changed_when: False
when: ansible_distribution_major_version|int <= 6
when: ansible_distribution_major_version|int <= 6 and ansible_distribution is 'RedHat'
register: disabled_services_chkconfig
tags:
- check

3
playbooks/groups/download.yml
View file

@ -26,6 +26,7 @@
- "/srv/private/ansible/vars.yml"
- "/srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml"
# FIXME: is checking for RedHat correct here ?
roles:
- base
- rkhunter
@ -35,7 +36,7 @@
- collectd/base
- apache
- download
- { role: mod_limitipconn, when: ansible_distribution_major_version|int != '7'}
- { role: mod_limitipconn, when: ansible_distribution_major_version|int != '7' and ansible_distribution is 'RedHat'}
- rsyncd
- { role: nfs/client, when: datacenter == "phx2", mnt_dir: '/srv/pub', nfs_src_dir: 'fedora_ftp/fedora.redhat.com/pub' }
- { role: nfs/client, when: datacenter == "rdu", mnt_dir: '/srv/pub', nfs_src_dir: 'fedora_ftp/fedora.redhat.com/pub' }

2
playbooks/groups/maintainer-test.yml
View file

@ -65,7 +65,7 @@
dnf: state=present pkg={{ item }}
with_items:
- fedora-packager
when: ansible_distribution_major_version|int > 21
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
tags:
- packages

12
playbooks/manual/update-packages.yml
View file

@ -17,25 +17,25 @@
- name: yum update {{ package }} from main repo
yum: name="{{ package }}" state=latest update_cache=yes
when: not testing and ansible_distribution_major_version|int < 22
when: not testing and ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: yum update {{ package }} from testing repo
yum: name="{{ package }}" state=latest enablerepo=infrastructure-tags-stg update_cache=yes
when: testing and ansible_distribution_major_version|int < 22
when: testing and ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: dnf clean all (since we can't do it when updating)
command: dnf clean all
when: not testing and ansible_distribution_major_version|int > 21
when: not testing and ansible_distribution_major_version|int > 21 and ansible_distribution is 'Fedora'
- name: dnf update {{ package }} from main repo
dnf: name="{{ package }}" state=latest
when: not testing and ansible_distribution_major_version|int > 21
when: not testing and ansible_distribution_major_version|int > 21 and ansible_distribution is 'Fedora'
- name: dnf clean all (since we can't do it when updating)
command: dnf clean all --enablerepo=infrastructure-tags-stg
when: testing and ansible_distribution_major_version|int > 21
when: testing and ansible_distribution_major_version|int > 21 and ansible_distribution is 'Fedora'
- name: dnf update {{ package }} from testing repo
dnf: name="{{ package }}" state=latest enablerepo=infrastructure-tags-stg
when: testing and ansible_distribution_major_version|int > 21
when: testing and ansible_distribution_major_version|int > 21 and ansible_distribution is 'Fedora'

5
playbooks/transient_cloud_instance.yml
View file

@ -69,11 +69,12 @@
tasks:
- name: install cloud-utils (yum)
package: name=cloud-utils state=present
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
# FIXME no Fedora ?
- name: install cloud-utils (dnf)
command: dnf install -y cloud-utils
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int > 7 and ansible_cmdline.ostree is not defined
- import_tasks: "{{ tasks_path }}/cloud_setup_basic.yml"

5
playbooks/transient_newcloud_instance.yml
View file

@ -76,11 +76,12 @@
tasks:
- name: install cloud-utils (yum)
package: name=cloud-utils state=present
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
# FIXME no Fedora ?
- name: install cloud-utils (dnf)
command: dnf install -y cloud-utils
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int > 7 and ansible_cmdline.ostree is not defined
- import_tasks: "{{ tasks_path }}/cloud_setup_basic.yml"

18
roles/apache/tasks/main.yml
View file

@ -24,7 +24,19 @@
- name: hotfix - copy over new httpd init script
copy: src="{{ files }}/hotfix/httpd/httpd.init" dest=/etc/init.d/httpd
owner=root group=root mode=0755
when: ansible_distribution_major_version|int < 30
when: ansible_distribution_major_version|int < 30 and ansible_distribution is 'Fedora'
notify:
- reload apache
tags:
- config
- hotfix
- apache
# install hash randomization hotfix
- name: hotfix - copy over new httpd init script
copy: src="{{ files }}/hotfix/httpd/httpd.init" dest=/etc/init.d/httpd
owner=root group=root mode=0755
when: ansible_distribution_major_version|int <= 8 and ansible_distribution is 'RedHat'
notify:
- reload apache
tags:
@ -34,7 +46,7 @@
- name: hotfix - copy over new httpd sysconfig (el6)
copy: src="{{ files }}/hotfix/httpd/httpd.sysconfig" dest=/etc/sysconfig/httpd
when: ansible_distribution_major_version|int == 6
when: ansible_distribution_major_version|int == 6 and ansible_distribution is 'RedHat'
notify:
- reload apache
tags:
@ -44,7 +56,7 @@
- name: hotfix - copy over new httpd sysconfig (el7)
copy: src="{{ files }}/hotfix/httpd/httpd.sysconfig" dest=/etc/sysconfig/httpd
when: ansible_distribution_major_version|int == 7
when: ansible_distribution_major_version|int == 7 and ansible_distribution is 'RedHat'
notify:
- reload apache
tags:

89
roles/base/tasks/main.yml
View file

@ -11,11 +11,11 @@
- policycoreutils-python
tags:
- selinux
when: ansible_distribution_major_version|int < 8
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: ensure packages required for semanage are installed (dnf)
package: name=policycoreutils-python-utils state=present
when: ansible_distribution_major_version|int > 27 and ansible_cmdline.ostree is not defined
when: (ansible_distribution_major_version|int > 27 and ansible_distribution is 'Fedora') or (ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat') and ansible_cmdline.ostree is not defined
tags:
- selinux
@ -52,7 +52,18 @@
ini_file: dest=/etc/NetworkManager/NetworkManager.conf section=main option=dns value=none
notify:
- restart NetworkManager
when: ansible_distribution_major_version|int >=7 and nmclitest is success and ( not ansible_ifcfg_blacklist) and not nm_controlled_resolv
when: ansible_distribution_major_version|int >=7 and ansible_distribution is 'RedHat' and nmclitest is success and ( not ansible_ifcfg_blacklist) and not nm_controlled_resolv
tags:
- config
- resolvconf
- base
- ifcfg
- name: disable resolv.conf control from NM
ini_file: dest=/etc/NetworkManager/NetworkManager.conf section=main option=dns value=none
notify:
- restart NetworkManager
when: ansible_distribution_major_version|int >=29 and ansible_distribution is 'Fedora' and nmclitest is success and ( not ansible_ifcfg_blacklist) and not nm_controlled_resolv
tags:
- config
- resolvconf
@ -65,7 +76,19 @@
changed_when: false
failed_when: 'if_uuid.stdout == ""'
check_mode: no
when: ansible_distribution_major_version|int >=7 and nmclitest is success and ( not ansible_ifcfg_blacklist )
when: ansible_distribution_major_version|int >=7 and ansible_distribution is 'RedHat' and nmclitest is success and ( not ansible_ifcfg_blacklist )
tags:
- config
- ifcfg
- base
- name: get interface uuid
shell: nmcli -f "DEVICE,UUID" c show --active | grep -E '^eth|^br|^em'
register: if_uuid
changed_when: false
failed_when: 'if_uuid.stdout == ""'
check_mode: no
when: ansible_distribution_major_version|int >=29 and ansible_distribution is 'Fedora' and nmclitest is success and ( not ansible_ifcfg_blacklist )
tags:
- config
- ifcfg
@ -92,17 +115,25 @@
tags:
- packages
- base
when: ansible_distribution_major_version|int < 22 and ansible_distribution_major_version|int != 8
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: global default packages to install (dnf)
dnf: state=present name="{{ global_pkgs_inst }}"
tags:
- packages
- base
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
- name: global default packages to install (dnf)
dnf: state=present name="{{ global_pkgs_inst }}"
tags:
- packages
- base
when: ansible_distribution_major_version|int > 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: make sure hostname is set right on rhel7 hosts
hostname: name="{{inventory_hostname}}"
when: ansible_distribution_major_version|int == 7 and ansible_distribution is 'RedHat'
#
# We set builders root password in the koji_builder role, so do not set those here
@ -137,7 +168,7 @@
tags:
- packages
- base
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: dist pkgs to install (yum)
package: state=present name={{ item }}
@ -146,21 +177,35 @@
tags:
- packages
- base
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: dist pkgs to remove (dnf)
dnf: state=absent name="{{ base_pkgs_erase }}"
tags:
- packages
- base
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int > 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: dist pkgs to remove (dnf)
dnf: state=absent name="{{ base_pkgs_erase }}"
tags:
- packages
- base
when: ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
- name: dist pkgs to install (dnf)
dnf: state=present name="{{ base_pkgs_inst }}"
tags:
- packages
- base
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int > 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: dist pkgs to install (dnf)
dnf: state=present name="{{ base_pkgs_inst }}"
tags:
- packages
- base
when: ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
- name: dist disabled services
service: state=stopped enabled=false name={{ item }}
@ -234,7 +279,18 @@
- name: enable journald persistence
file: path=/var/log/journal state=directory
owner=root group=systemd-journal mode=2755
when: ansible_distribution_major_version|int >= 7
when: ansible_distribution_major_version|int >= 7 and ansible_distribution is 'RedHat'
tags:
- journald
- config
- base
notify:
- flush journald tmpfiles to persistent store
- name: enable journald persistence
file: path=/var/log/journal state=directory
owner=root group=systemd-journal mode=2755
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
tags:
- journald
- config
@ -346,7 +402,16 @@
- name: copy over our custom selinux module
copy: src=selinux/mapchkpwd.pp dest=/usr/local/share/mapchkpwd.pp
register: selinux_module
when: ansible_distribution_major_version|int >= 27
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
tags:
- config
- selinux
# Custom selinux policy to allow unix_chkpwd to map PAM database
- name: copy over our custom selinux module
copy: src=selinux/mapchkpwd.pp dest=/usr/local/share/mapchkpwd.pp
register: selinux_module
when: ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat'
tags:
- config
- selinux

2
roles/base/templates/krb5.conf.j2
View file

@ -15,7 +15,7 @@
[realms]
{{ ipa_realm }} = {
{% if ansible_distribution_major_version|default(0)|int == 6 %}
{% if ansible_distribution_major_version|default(0)|int == 6 and and ansible_distribution is "RedHat" %}
kdc = ipa01{{ env_suffix }}.phx2.fedoraproject.org
{% else %}
kdc = https://id{{ env_suffix }}.fedoraproject.org/KdcProxy

24
roles/basessh/tasks/main.yml
View file

@ -33,7 +33,17 @@
- config
- sshd
- selinux
when: ansible_distribution_major_version|int < 30 and ansible_distribution_major_version|int != 8
when: ansible_distribution_major_version|int < 30 and ansible_distribution is 'Fedora'
- name: make sure libselinux-python is installed
package: name=libselinux-python state=present
tags:
- basessh
- sshd_config
- config
- sshd
- selinux
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: make sure python3-libselinux is installed
package: name=python3-libselinux state=present
@ -43,7 +53,17 @@
- config
- sshd
- selinux
when: ansible_distribution_major_version|int >= 30 or ansible_distribution_major_version|int == 8
when: ansible_distribution_major_version|int >= 30 and ansible_distribution is 'Fedora'
- name: make sure python3-libselinux is installed
package: name=python3-libselinux state=present
tags:
- basessh
- sshd_config
- config
- sshd
- selinux
when: ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat'
- name: check if sshd port is already known by selinux
shell: semanage port -l | grep ssh

7
roles/basessh/templates/sshd_config
View file

@ -2,7 +2,7 @@ Protocol 2
Port {{ sshd_port }}
{% if ansible_distribution_major_version == "6" %}
{% if ansible_distribution_major_version == "6" and ansible_distribution is 'RedHat' %}
KexAlgorithms diffie-hellman-group-exchange-sha256
MACs hmac-sha2-512,hmac-sha2-256
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
@ -31,9 +31,10 @@ AllowAgentForwarding no
X11Forwarding no
PermitTunnel no
{% if ansible_distribution_major_version == "6" %}
{% if ansible_distribution_major_version == "6" and ansible_distribution is 'RedHat' %}
UsePrivilegeSeparation yes
{% elif ansible_distribution_major_version == "7" %}
#FIXME: How about RHEL8 and Fedora ? sandbox as well ?
{% elif ansible_distribution_major_version == "7" and ansible_distribution is 'RedHat' %}
UsePrivilegeSeparation sandbox
{% endif %}

1
roles/chrony/tasks/main.yml
View file

@ -26,3 +26,4 @@
- chrony
- service
- base
when: ansible_distribution_major_version|int != 8

34
roles/collectd/base/tasks/main.yml
View file

@ -6,21 +6,35 @@
package: name=collectd state=present
tags:
- collectd
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int <= 7 and ansible_distribution is 'RedHat'
# install pkg
- name: install collectd
dnf: name=collectd state=present
tags:
- collectd
when: ansible_distribution_major_version|int > 21
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat'
# install pkg
- name: install collectd
dnf: name=collectd state=present
tags:
- collectd
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
# install collectd-disk (it was split out)
- name: install collectd-disk
dnf: name=collectd-disk state=present
tags:
- collectd
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat'
# install collectd-disk on F25+ (it was split out)
- name: install collectd-disk
dnf: name=collectd-disk state=present
tags:
- collectd
when: ansible_distribution_major_version|int > 24
when: ansible_distribution_major_version|int > 24 and ansible_distribution is 'Fedora'
# install collected.conf
- name: /etc/collectd.conf
@ -55,7 +69,7 @@
- collectd
notify:
- restart collectd
when: collectd_apache and ansible_distribution_major_version|int < 22
when: collectd_apache and ansible_distribution_major_version|int <= 7 and ansible_distribution is 'RedHat'
- name: install collectd-apache (dnf)
dnf: state=present name=collectd-apache
@ -63,7 +77,15 @@
- collectd
notify:
- restart collectd
when: collectd_apache and ansible_distribution_major_version|int > 21
when: collectd_apache and ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat'
- name: install collectd-apache (dnf)
dnf: state=present name=collectd-apache
tags:
- collectd
notify:
- restart collectd
when: collectd_apache and ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
- name: /etc/collectd/apache.conf
copy: src=apache.conf dest=/etc/collectd.d/apache.conf
@ -77,7 +99,7 @@
package: name=libsemanage-python state=present
tags:
- collectd
when: collectd_apache is defined and ansible_distribution_major_version|int < 22
when: collectd_apache is defined and ansible_distribution_major_version|int <= 7 and ansible_distribution is 'RedHat'
- name: Let collectd talk to things over tcp
seboolean: name=collectd_tcp_network_connect state=yes persistent=yes

32
roles/dnf-automatic/tasks/main.yml
View file

@ -23,7 +23,7 @@
- name: enable and start dnf-automatic
command: systemctl enable dnf-automatic.timer
when: ansible_distribution_major_version|int < 26
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
args:
creates: /etc/systemd/system/basic.target.wants/dnf-automatic.timer
tags:
@ -35,15 +35,23 @@
check_mode: no
changed_when: 1 != 1
ignore_errors: true
when: ansible_distribution_major_version|int < 26
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: start dnf-automatic.timer if it is not active
command: systemctl start dnf-automatic.timer
when: automaticative is failed and ansible_distribution_major_version|int < 26
when: automaticative is failed and ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: enable and start dnf-automatic f26+
command: systemctl enable dnf-automatic-install.timer
when: ansible_distribution_major_version|int >= 26
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
register: dnfautomaticenable
changed_when: dnfautomaticenable.rc != 0
tags:
- config
- name: enable and start dnf-automatic RHEL8+
command: systemctl enable dnf-automatic-install.timer
when: ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat'
register: dnfautomaticenable
changed_when: dnfautomaticenable.rc != 0
tags:
@ -55,11 +63,23 @@
check_mode: no
changed_when: 1 != 1
ignore_errors: true
when: ansible_distribution_major_version|int >= 26
when: ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat'
- name: check if dnf-automatic-install.timer is active
command: systemctl is-active dnf-automatic-install.timer
register: automaticative
check_mode: no
changed_when: 1 != 1
ignore_errors: true
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
- name: start dnf-automatic-install.timer if it is not active
command: systemctl start dnf-automatic-install.timer
when: automaticative is failed and ansible_distribution_major_version|int >= 26
when: automaticative is failed and ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat'
- name: start dnf-automatic-install.timer if it is not active
command: systemctl start dnf-automatic-install.timer
when: automaticative is failed and ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
- name: disable silly makecache timer
systemd: name=dnf-makecache masked=yes

2
roles/fas_client/tasks/main.yml
View file

@ -21,7 +21,7 @@
- name: install nss_db on rhel or fedora 25 or greater hosts only
package: state=present name=nss_db
when: ansible_distribution_major_version|int == 6 or ansible_distribution_major_version|int > 24
when: ansible_distribution is 'RedHat' or ansible_distribution is 'Fedora'
tags:
- packages
- fas_client

21
roles/git/server/tasks/main.yml
View file

@ -8,7 +8,12 @@
# If NOT using xinetd
- name: delete stock git daemon config
file: path="/usr/lib/systemd/system/git.service" state=absent
when: ansible_distribution_major_version|int == 7
when: ansible_distribution_major_version|int >= 7 and ansible_distribution is 'RedHat'
tags: git/server
- name: delete stock git daemon config
file: path="/usr/lib/systemd/system/git.service" state=absent
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
tags: git/server
- name: configure git daemon
@ -16,13 +21,21 @@
src="git@.service.j2"
dest="/usr/lib/systemd/system/git@.service"
mode=0644
when: ansible_distribution_major_version|int == 7
when: ansible_distribution_major_version|int >= 7 and ansible_distribution is 'RedHat'
tags: git/server
- name: configure git daemon
template: >
src="git@.service.j2"
dest="/usr/lib/systemd/system/git@.service"
mode=0644
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
tags: git/server
# If using xinetd
- name: install xinetd
package: name=xinetd state=present
when: ansible_distribution_major_version|int == 6
when: ansible_distribution_major_version|int == 6 and ansible_distribution is 'RedHat'
tags: git/server
- name: install the xinetd config file
@ -30,7 +43,7 @@
src="git.j2"
dest="/etc/xinetd.d/git"
mode=0644
when: ansible_distribution_major_version|int == 6
when: ansible_distribution_major_version|int == 6 and ansible_distribution is 'RedHat'
tags: git/server
notify:
- restart xinetd

14
roles/iscsi_client/tasks/main.yml
View file

@ -11,7 +11,7 @@
- device-mapper-multipath
tags:
- packages
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution == "RedHat"
- name: install packages needed for iscsi_client (dnf)
package:
@ -21,7 +21,17 @@
- device-mapper-multipath
tags:
- packages
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 29 and ansible_distribution == "Fedora" and ansible_cmdline.ostree is not defined
- name: install packages needed for iscsi_client (dnf)
package:
state: present
name:
- iscsi-initiator-utils
- device-mapper-multipath
tags:
- packages
when: ansible_distribution_major_version|int >= 8 and ansible_distribution == "RedHat" and ansible_cmdline.ostree is not defined
- name: enable iscsi service
service: state=started enabled=yes name=iscsi

2
roles/kerneltest/templates/kerneltest.conf
View file

@ -1,5 +1,5 @@
{% if ansible_distribution_major_version == '6' %}
{% if ansible_distribution_major_version == '6 and ansible_distribution is 'RedHat' %}
Alias /kerneltest/static /usr/lib/python2.6/site-packages/kerneltest/static/
{% else %}
Alias /kerneltest/static /usr/lib/python2.7/site-packages/kerneltest/static/

1
roles/koji_hub/tasks/main.yml
View file

@ -363,6 +363,7 @@
- selinux
- koji_hub
when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 7
# FIXME wht about RHEL8+ ?
- name: Set httpd to run on boot
service: name=httpd enabled=yes

10
roles/mariadb_server/tasks/main.yml
View file

@ -1,18 +1,10 @@
- name: ensure packages required for mariadb are installed
package:
state: present
name:
- mariadb-server
- MySQL-python
when: ansible_distribution_major_version|int < 22
- name: ensure packages required for mariadb are installed
package:
state: present
name:
- mariadb-server
- MySQL-python
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_cmdline.ostree is not defined
- name: copy my.cnf
copy: src={{ item }} dest=/etc/my.cnf owner=root group=root mode=0644

2
roles/nagios_client/tasks/main.yml
View file

@ -77,7 +77,7 @@
- name: install our custom selinux module
command: semodule -i /usr/share/nrpe/fi-nrpe.pp
when: ansible_distribution_major_version|int == 7 and selinux_module is changed
when: ansible_distribution_major_version|int == 7 and ansible_distribution is 'RedHat' and selinux_module is changed
tags:
- config
- nagios_client

8
roles/nfs/client/tasks/main.yml
View file

@ -1,6 +1,6 @@
- name: install network-scripts package
package: name=network-scripts state=installed
when: ansible_distribution_major_version|int >= 29
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
tags:
- nfs/client
@ -51,12 +51,12 @@
tags:
- nfs/client
- name: enable nfs-related services and run them (rhel 7 and Fedora)
- name: enable nfs-related services and run them (rhel 7+ and Fedora)
service: name={{ item }} enabled=true state=started
with_items:
- rpcbind
- nfs-lock
when: ansible_distribution_major_version|int == 7
when: ansible_distribution_major_version|int >= 7 and ansible_distribution is 'RedHat'
tags:
- nfs/client
@ -67,7 +67,7 @@
- rpcbind
- nfs
- nfslock
when: ansible_distribution_major_version|int == 6
when: ansible_distribution_major_version|int == 6 and ansible_distribution is 'RedHat'
tags:
- nfs/client

2
roles/nginx/templates/etc/nginx/nginx.conf.j2
View file

@ -2,7 +2,7 @@ user nginx;
worker_processes {{ nginx_worker_processes }};
error_log /var/log/nginx/error.log {{ nginx_error_level }};
{% if ansible_distribution_major_version == "7" %}
{% if ansible_distribution_major_version == "7" and ansible_distribution is "RedHat" %}
pid /run/nginx.pid;
{% else %}
pid /var/run/nginx.pid;

2
roles/openqa/worker/tasks/tap-setup.yml
View file

@ -11,7 +11,7 @@
state: present
tags:
- packages
when: ansible_distribution_major_version|int >= 29
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
- name: Enable ipv4_forward in sysctl
sysctl: name=net.ipv4.ip_forward value=1 state=present sysctl_set=yes reload=yes

49
roles/openvpn/base/tasks/main.yml
View file

@ -1,6 +1,8 @@
---
# OpenVpn basic configuration
# FIXME lots of changes, please review carefully:
#
- name: Install needed package
package:
state: present
@ -9,7 +11,7 @@
tags:
- openvpn
- packages
when: ansible_distribution_major_version|int < 8
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: Install needed package (dnf)
package:
@ -21,7 +23,7 @@
- packages
when: ansible_distribution_major_version|int > 7 and ansible_cmdline.ostree is not defined
- name: Install certificate and key (rhel6 and fedora24 and older)
- name: Install certificate and key (rhel6)
copy: src={{ private }}/files/vpn/pki/ca.crt
dest=/etc/openvpn/ca.crt
owner=root group=root mode=0600
@ -29,12 +31,21 @@
- install
- openvpn
#notify:
#- restart openvpn (Fedora)
#- restart openvpn (RHEL7)
#- restart openvpn (RHEL6)
when: ansible_distribution_major_version|int < 25
when: ansible_distribution_major_version|int == 6 and ansible_distribution is 'RedHat'
- name: Install certificate and key (rhel7 or fedora) for client
- name: Install certificate and key (rhel7+) for client
copy: src={{ private }}/files/vpn/pki/ca.crt
dest=/etc/openvpn/client/ca.crt
owner=root group=root mode=0600
tags:
- install
- openvpn
#notify:
#- restart openvpn (RHEL7+)
when: ( ansible_distribution_major_version|int >= 7 and ansible_distribution is 'RedHat' ) and ansible_cmdline.ostree is not defined
- name: Install certificate and key (Fedora) for client
copy: src={{ private }}/files/vpn/pki/ca.crt
dest=/etc/openvpn/client/ca.crt
owner=root group=root mode=0600
@ -43,9 +54,29 @@
- openvpn
#notify:
#- restart openvpn (Fedora)
#- restart openvpn (RHEL7)
#- restart openvpn (RHEL6)
when: ( ansible_distribution_major_version|int != 6 and ansible_distribution_major_version|int != 24 ) and ansible_cmdline.ostree is not defined
when: ( ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' ) and ansible_cmdline.ostree is not defined
- name: Install certificate and key (fedora) for server
copy: src={{ private }}/files/vpn/pki/ca.crt
dest=/etc/openvpn/server/ca.crt
owner=root group=root mode=0600
tags:
- install
- openvpn
#notify:
#- restart openvpn (Fedora)
when: ( ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' ) and ansible_cmdline.ostree is not defined
- name: Install certificate and key (rhel7+) for server
copy: src={{ private }}/files/vpn/pki/ca.crt
dest=/etc/openvpn/server/ca.crt
owner=root group=root mode=0600
tags:
- install
- openvpn
#notify:
#- restart openvpn (RHEL7+)
when: ( ansible_distribution_major_version|int >= 7 and ansible_distribution is 'RedHat' ) and ansible_cmdline.ostree is not defined
- name: Install certificate and key (rhel7 or fedora) for server
copy: src={{ private }}/files/vpn/pki/ca.crt

45
roles/openvpn/client/tasks/main.yml
View file

@ -9,7 +9,7 @@
tags:
- packages
- openvpn
when: ansible_distribution_major_version|int < 8
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: Install needed packages
package:
@ -19,7 +19,17 @@
tags:
- packages
- openvpn
when: ansible_distribution_major_version|int > 7 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
- name: Install needed packages
package:
state: present
name:
- openvpn
tags:
- packages
- openvpn
when: ansible_distribution_major_version|int > 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: Install main config file (rhel7 and fedora)
template: src=client.conf
@ -30,9 +40,8 @@
- openvpn
# notify:
# - restart openvpn (Fedora)
# - restart openvpn (RHEL7)
# - restart openvpn (RHEL6)
when: ( ansible_distribution_major_version|int != 6 and ansible_distribution_major_version|int != 24) and ansible_cmdline.ostree is not defined
# - restart openvpn (RHEL6+)
when: (ansible_distribution is 'RedHat' or ansible_distribution is 'Fedora') and ansible_cmdline.ostree is not defined
- name: Install configuration files (rhel7 and fedora)
copy: src={{ item.file }}
@ -51,8 +60,7 @@
# notify:
# - restart openvpn (Fedora)
# - restart openvpn (RHEL7)
# - restart openvpn (RHEL6)
when: ( ansible_distribution_major_version|int != 6 and ansible_distribution_major_version|int != 24) and ansible_cmdline.ostree is not defined
when: (ansible_distribution_major_version|int >= 7 and ansible_distribution is 'RedHat') or (ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora') and ansible_cmdline.ostree is not defined
- name: Install configuration files (rhel6)
copy: src={{ item.file }}
@ -72,35 +80,26 @@
- install
- openvpn
# notify:
# - restart openvpn (Fedora)
# - restart openvpn (RHEL7)
# - restart openvpn (RHEL6)
when: ( ansible_distribution_major_version|int == 6 or ansible_distribution_major_version|int == 24) and ansible_cmdline.ostree is not defined
when: (ansible_distribution_major_version|int == 6 and ansible_distribution is 'RedHat') and ansible_cmdline.ostree is not defined
- name: enable openvpn service for rhel 6
service: name=openvpn state=started enabled=true
when: ansible_distribution_major_version|int == 6
tags:
- service
- openvpn
- name: enable openvpn service for fedora 24
service: name=openvpn@openvpn state=started enabled=true
when: ansible_distribution_major_version|int == 24
when: ansible_distribution_major_version|int == 6 and ansible_distribution is 'RedHat'
tags:
- service
- openvpn
- name: Make sure old openvpn is not running in rhel 7
service: name=openvpn@openvpn state=stopped enabled=false
when: ansible_distribution_major_version|int == 7
when: ansible_distribution_major_version|int == 7 and ansible_distribution is 'RedHat'
tags:
- service
- openvpn
- name: Make sure openvpn is running in rhel 7
- name: Make sure openvpn is running in rhel 7+
service: name=openvpn-client@openvpn state=started enabled=true
when: ansible_distribution_major_version|int == 7
when: ansible_distribution_major_version|int >= 7 and ansible_distribution is 'RedHat'
tags:
- service
- openvpn
@ -115,7 +114,7 @@
- name: Create directories for post-vpn service configs
file: path="/etc/systemd/system/{{item}}.service.d" state=directory
with_items: "{{postvpnservices}}"
when: is_fedora is defined or ansible_distribution_major_version|int == 7
when: is_fedora is defined or (ansible_distribution_major_version|int >= 7 and ansible_distribution is 'RedHat')
tags:
- service
- openvpn
@ -123,7 +122,7 @@
- name: Deploy postvpn.conf for post-vpn services
copy: src=postvpn.conf dest="/etc/systemd/system/{{item}}.service.d/postvpn.conf"
with_items: "{{postvpnservices}}"
when: is_fedora is defined or ansible_distribution_major_version|int == 7
when: is_fedora is defined or (ansible_distribution_major_version|int >= 7 and ansible_distribution is 'RedHat')
tags:
- service
- openvpn

8
roles/packages3/web/tasks/main.yml
View file

@ -1,4 +1,6 @@
---
# FIXME: Are these hosts really running RHEL or do we need to check for CentOS ?
#
# Configuration for the fedora-packages webapp
- name: install needed packages
package: name={{ item }} state=present
@ -91,7 +93,7 @@
tags:
- packages
- packages/web
when: ansible_distribution_major_version|int < 7
when: ansible_distribution_major_version|int < 7 and ansible_distribution is 'RedHat'
# Here's the indexer stuff
- name: Create cache structure
@ -134,7 +136,7 @@
- packages
- packages/web
- hotfix
when: ansible_distribution_major_version|int < 7
when: ansible_distribution_major_version|int < 7 and ansible_distribution is 'RedHat'
# Lastly, here's some selinux stuff.
- name: set some selinux booleans
@ -163,4 +165,4 @@
- packages
- packages/web
- selinux
when: ansible_distribution_major_version|int > 6
when: ansible_distribution_major_version|int > 6 and (ansible_distribution is 'RedHat' or ansible_distribution is 'Fedora')

18
roles/postgresql_server/tasks/main.yml
View file

@ -11,7 +11,7 @@
- postgresql-plpython
- python-psycopg2
- pxz
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
tags:
- packages
- postgresql
@ -25,7 +25,21 @@
- postgresql-plpython
- python-psycopg2
- pxz
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
tags:
- packages
- postgresql
- name: install postgresql server packages (dnf)
package:
state: present
name:
- postgresql-server
- postgresql-contrib
- postgresql-plpython
- python-psycopg2
- pxz
when: ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
tags:
- packages
- postgresql

3
roles/postgresql_server_bdr/tasks/main.yml
View file

@ -11,6 +11,7 @@
- packages
- postgresql-bdr
# No Fedora packages available for F25+
- name: install postgresql server packages (yum)
package: name={{ item }} state=present
with_items:
@ -20,7 +21,7 @@
- postgresql-bdr94-bdr
- postgresql-bdr94-plpython
- python-psycopg2
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
tags:
- packages
- postgresql-bdr

11
roles/rkhunter/tasks/main.yml
View file

@ -1,13 +1,4 @@
---
- name: install rkhunter (yum)
package: name=rkhunter state=present
notify:
- run rkhunter
tags:
- rkhunter
- packages
when: ansible_distribution_major_version|int < 22
- name: install rkhunter (dnf)
package: name=rkhunter state=present
notify:
@ -15,7 +6,7 @@
tags:
- rkhunter
- packages
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: rkhunter.conf

5
roles/rkhunter/templates/rkhunter.conf.j2
View file

@ -165,13 +165,8 @@ ALLOW_SSH_ROOT_USER=without-password
# configuration file, then a value of '2' may be set here in order to
# suppress a warning message. This option has a default value of '0'.
#
{% if ansible_distribution == 'Fedora' and ansible_distribution_major_version|int < 22 %}
# Fedora 21 doesn't set protocol in ssh config
ALLOW_SSH_PROT_V1=2
{% else %}
# For RHEL and Fedora 22+ we set proto to v2 only
ALLOW_SSH_PROT_V1=0
{% endif %}
#
# This setting tells rkhunter the directory containing the SSH configuration

20
roles/rsyncd/tasks/main.yml
View file

@ -3,7 +3,7 @@
# This role sets up rsyncd on a server
#
- name: install rnecessary packages
- name: install necessary packages
package:
state: present
name:
@ -13,9 +13,9 @@
tags:
- packages
- rsyncd
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: install rnecessary packages
- name: install necessary packages
package:
state: present
name:
@ -25,7 +25,19 @@
tags:
- packages
- rsyncd
when: ansible_distribution_major_version|int > 21
when: ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat'
- name: install necessary packages
package:
state: present
name:
- rsync
- xinetd
- libsemanage-python
tags:
- packages
- rsyncd
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
- name: rsyncd.conf file
copy: src={{ item }} dest=/etc/rsyncd.conf mode=0644

16
roles/sigul/server/tasks/main.yml
View file

@ -30,15 +30,23 @@
package: state=present name={{ item }}
with_items:
- gnupg1
when: ansible_distribution_major_version|int == 7
when: ansible_distribution_major_version|int == 7 and ansible_distribution is 'RedHat'
tags:
- packages
- name: install fedora only packages
- name: install gnupg packages
package: state=present name={{ item }}
with_items:
- gnupg
when: ansible_distribution_major_version|int > 23
when: ansible_distribution_major_version|int >= 8 and ansible_distribution is 'RedHat'
tags:
- packages
- name: install gnupg packages
package: state=present name={{ item }}
with_items:
- gnupg
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
tags:
- packages
@ -50,7 +58,7 @@
- name: Setup gpg link on rhel7
file: state=link src=/usr/bin/gpg1 dest=/usr/bin/gpg
when: ansible_distribution_major_version|int == 7
when: ansible_distribution_major_version|int == 7 and ansible_distribution is 'RedHat'
- name: add polkit rules to allow sigul user to access the smartcard/yubikey
copy: src=00-sigul.rules dest=/etc/polkit-1/rules.d/00-sigul.rules

11
roles/taskotron/grokmirror/tasks/main.yml
View file

@ -5,14 +5,21 @@
name:
- git
- python-grokmirror
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int <= 7 and ansible_distribution is 'RedHat'
- name: ensure grokmirror packages are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- git
- python-grokmirror
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: ensure grokmirror packages are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- git
- python-grokmirror
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
- name: create grokmirror user
user: name={{ grokmirror_user }}

13
roles/taskotron/resultsdb-backend/tasks/main.yml
View file

@ -10,7 +10,7 @@
- mod_wsgi
- python-psycopg2
- libsemanage-python
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int <= 7 and ansible_distribution is 'RedHat'
- name: ensure packages required for resultsdb are installed (dnf)
dnf: name={{ item }} state=present
@ -19,7 +19,16 @@
- python3-mod_wsgi
- python3-psycopg2
- python2-libsemanage
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: ensure packages required for resultsdb are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- resultsdb
- python3-mod_wsgi
- python3-psycopg2
- python2-libsemanage
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
- name: ensure database is created
delegate_to: "{{ resultsdb_db_host_machine }}"

11
roles/taskotron/resultsdb-frontend/tasks/main.yml
View file

@ -8,14 +8,21 @@
name:
- resultsdb_frontend
- mod_wsgi
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int <= 7 and ansible_distribution is 'RedHat'
- name: ensure packages required for resultsdb_frontend are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- resultsdb_frontend
- python3-mod_wsgi
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: ensure packages required for resultsdb_frontend are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- resultsdb_frontend
- python3-mod_wsgi
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
- name: ensure selinux lets httpd talk to the network
seboolean: name=httpd_can_network_connect persistent=yes state=yes

10
roles/taskotron/ssl-taskotron/tasks/main.yml
View file

@ -4,13 +4,19 @@
state: present
name:
- mod_ssl
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int <= 7 and ansible_distribution is 'RedHat'
- name: ensure ssl related packages are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- mod_ssl
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: ensure ssl related packages are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- mod_ssl
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
#- name: copy ssl key
# copy: src={{ private }}/files/taskotron/certs/{{ inventory_hostname }}/{{ inventory_hostname }}.key dest=/etc/pki/tls/private/{{ inventory_hostname }}.key

10
roles/taskotron/taskotron-frontend/tasks/main.yml
View file

@ -4,13 +4,19 @@
state: present
name:
- httpd
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int <= 7 and ansible_distribution is 'RedHat'
- name: ensure packages required for taskotron-frontend are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- httpd
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: ensure packages required for taskotron-frontend are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- httpd
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
- name: create dirs for static files
file: path=/var/www/html/{{ item }} state=directory owner=apache group=apache mode=1755

8
roles/taskotron/taskotron-master/tasks/main.yml
View file

@ -6,7 +6,13 @@
dnf: name={{ item }} state=present
with_items:
- tmpwatch
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: ensure packages required for buildmaster are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- tmpwatch
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
- name: create artifacts directory
file: path={{ item }} state=directory owner=buildmaster group=buildmaster mode=0775 setype=httpd_sys_content_t

10
roles/taskotron/taskotron-proxy/tasks/main.yml
View file

@ -11,13 +11,19 @@
state: present
name:
- libsemanage-python
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int <= 7 and ansible_distribution is 'RedHat'
- name: ensure packages required for proxying are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- libsemanage-python
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
- name: ensure packages required for proxying are installed (dnf)
dnf: name={{ item }} state=present
with_items:
- libsemanage-python
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
- name: allow httpd tcp connections with selinux
seboolean: name=httpd_can_network_connect state=true persistent=yes

13
roles/varnish/tasks/main.yml
View file

@ -22,15 +22,8 @@
- restart varnish
tags:
- varnish
when: ansible_distribution_major_version|int == 7
- name: install varnish /etc/sysconfig/varnish file (fedora 25-28)
template: src=varnish.f25.j2 dest=/etc/varnish/varnish.params owner=root group=root
notify:
- restart varnish
tags:
- varnish
when: ansible_distribution_major_version|int >= 25 and ansible_distribution_major_version|int < 29
when: ansible_distribution_major_version|int == 7 and ansible_distribution is 'RedHat'
#FIXME: RHEL8+ ?
- name: install varnish /etc/systemd/system/varnish.service file (fedora 29+)
template: src=varnish.f29.j2 dest=/etc/systemd/system/varnish.service owner=root group=root
@ -39,7 +32,7 @@
- restart varnish
tags:
- varnish
when: ansible_distribution_major_version|int >= 29
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora'
- name: install /etc/varnish/default.vcl (proxies)
template: src={{ varnish_group }}.vcl.j2 dest=/etc/varnish/default.vcl owner=root group=root

10
tasks/2fa_client.yml
View file

@ -3,13 +3,19 @@
package: name=pam_url state=present
tags:
- packages
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
- name: install pam_url
dnf: name=pam_url state=present
tags:
- packages
when: ansible_distribution_major_version|int > 21
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat'
- name: install pam_url
dnf: name=pam_url state=present
tags:
- packages
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'RedHat'
- name: /etc/pki/tls/private/totpcgi.pem
copy: src="{{ private }}/files/2fa-certs/keys/{{ inventory_hostname }}.pem" dest=/etc/pki/tls/private/totpcgi.pem mode=0400

24
tasks/cloud_setup_basic.yml
View file

@ -6,7 +6,7 @@
- ntp
- libsemanage-python
- libselinux-python
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
tags:
- packages
@ -15,7 +15,16 @@
with_items:
- ntpdate
- libselinux-python
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
tags:
- packages
- name: Install desired extra packages (dnf)
dnf: state=present pkg={{ item }}
with_items:
- ntpdate
- libselinux-python
when: ansible_distribution_major_version|int >=29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
tags:
- packages
@ -57,14 +66,21 @@
- name: update all
command: yum -y update creates=/etc/sysconfig/global-update-applied
register: updated
when: ansible_distribution_major_version|int < 22
when: ansible_distribution_major_version|int < 8 and ansible_distribution is 'RedHat'
tags:
- packages
- name: update all
command: dnf -y update creates=/etc/sysconfig/global-update-applied
register: updated
when: ansible_distribution_major_version|int > 21 and ansible_cmdline.ostree is not defined
when: ansible_distribution_major_version|int > 7 and ansible_distribution is 'RedHat' and ansible_cmdline.ostree is not defined
tags:
- packages
- name: update all
command: dnf -y update creates=/etc/sysconfig/global-update-applied
register: updated
when: ansible_distribution_major_version|int >= 29 and ansible_distribution is 'Fedora' and ansible_cmdline.ostree is not defined
tags:
- packages

12
tasks/yumrepos.yml
View file

@ -88,16 +88,8 @@
- yumrepos
- name: add aarch64 server rpms repo
copy: src="{{ files }}/common/rhel-7-aarch64-server-rpms.repo" dest="/etc/yum.repos.d/rhel-7-aarch64-server-rpms.repo"
when: (ansible_distribution == 'RedHat' or ansible_distribution == 'CentOS') and inventory_hostname.startswith('aarch64-c') and ansible_distribution_major_version == 7
tags:
- config
- packages
- yumrepos
- name: add aarch64 server rpms repo
copy: src="{{ files }}/common/rhel-8-aarch64-server-rpms.repo" dest="/etc/yum.repos.d/rhel-8-aarch64-server-rpms.repo"
when: (ansible_distribution == 'RedHat' or ansible_distribution == 'CentOS') and inventory_hostname.startswith('aarch64-c') and ansible_distribution_major_version == 8
copy: src="{{ files }}/common/rhel-{{ ansible_distribution_major_version }}-aarch64-server-rpms.repo" dest="/etc/yum.repos.d/rhel-{{ ansible_distribution_major_version }}-aarch64-server-rpms.repo"
when: (ansible_distribution == 'RedHat' or ansible_distribution == 'CentOS') and inventory_hostname.startswith('aarch64-c') and ansible_distribution_major_version >= 7
tags:
- config
- packages