Initial ansible onboard

2024-09-24 15:19:51 +02:00
parent 7366659355
commit f445996797
492 changed files with 2214589 additions and 0 deletions
@@ -0,0 +1,222 @@
+---
+- name: Merge package lists
+  ansible.builtin.set_fact:
+    packages_merged: "{{ packages_debian + packages_redhat + packages_ubuntu }}"
+  tags:
+    - packages
+
+- name: Configure needrestart
+  tags:
+    - needrestart
+    - packages
+  block:
+    - name: Pre register needrestart configuration directory
+      become: true
+      ansible.builtin.stat:
+        path: /etc/needrestart/conf.d
+      register: needrestart_directory_created
+
+    - name: Create needrestart directory
+      become: true
+      ansible.builtin.file:
+        path: /etc/needrestart/conf.d
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+        recurse: true
+      when: ("needrestart" in packages_merged) and not needrestart_directory_created.stat.exists
+
+    - name: Stat needrestart configuration directory
+      become: true
+      ansible.builtin.stat:
+        path: /etc/needrestart/conf.d
+      register: needrestart_directory
+
+    - name: Get needrestart restart value
+      ansible.builtin.command:
+        cmd: grep -Rqo "$nrconf{restart} = 'l';" /etc/needrestart/conf.d/
+      register: needrestart_restart_set
+      when: needrestart_directory.stat.exists
+      changed_when: needrestart_restart_set.rc != 0
+      failed_when: needrestart_restart_set.rc > 1
+
+    - name: Configure needrestart
+      become: true
+      ansible.builtin.lineinfile:
+        path: /etc/needrestart/conf.d/00-restart.conf
+        line: "$nrconf{restart} = 'l';"
+        create: true
+        owner: root
+        group: root
+        mode: "0644"
+      when: needrestart_directory.stat.exists and needrestart_restart_set.rc != 0
+
+- name: Debian family package installation
+  become: true
+  ansible.builtin.apt:
+    name: "{{ packages_debian }}"
+    state: present
+    install_recommends: false
+  when: ansible_os_family == "Debian"
+  tags:
+    - packages
+    - CIS-UBUNTU2004-1.6.1.1
+    - CIS-UBUNTU2004-4.1.1.1
+    - CIS-UBUNTU2004-4.2.1.1
+    - M1049
+    - UBTU-20-010005
+
+- name: Ubuntu package installation
+  become: true
+  ansible.builtin.apt:
+    name: "{{ packages_ubuntu }}"
+    state: present
+    install_recommends: false
+  when: ansible_distribution == "Ubuntu"
+  tags:
+    - packages
+
+- name: Ubuntu update-notifier-common package installation
+  become: true
+  ansible.builtin.apt:
+    name: "update-notifier-common"
+    state: present
+    install_recommends: false
+  when: ansible_distribution == "Ubuntu"
+  tags:
+    - packages
+
+- name: RedHat family package installation
+  become: true
+  ansible.builtin.dnf:
+    name: "{{ packages_redhat }}"
+    state: present
+  when: ansible_os_family == "RedHat"
+  notify:
+    - Enable haveged
+  tags:
+    - packages
+    - CCE-80847-7
+    - CCE-81043-2
+    - CCE-82859-0
+    - CCE-83303-8
+    - M1049
+
+- name: Run apt purge
+  become: true
+  ansible.builtin.apt:
+    name: "{{ packages_blocklist }}"
+    state: absent
+    purge: true
+  when: ansible_os_family == "Debian"
+  register: apt_purge
+  failed_when: apt_purge is not success and not "No package" in apt_purge.msg
+  tags:
+    - packages
+    - M1042
+
+- name: Generic package removal
+  become: true
+  ansible.builtin.package:
+    name: "{{ packages_blocklist }}"
+    state: absent
+  register: package_removal
+  failed_when: package_removal is not success and not "No package" in package_removal.msg
+  tags:
+    - packages
+    - CCE-80873-3
+    - CCE-82182-7
+    - CCE-82184-3
+    - CCE-82436-7
+    - CIS-UBUNTU2004-1.1.23
+    - CIS-UBUNTU2004-1.5.3
+    - CIS-UBUNTU2004-2.1.3
+    - CIS-UBUNTU2004-2.1.16
+    - CIS-UBUNTU2004-2.2.2
+    - CIS-UBUNTU2004-2.2.3
+    - CIS-UBUNTU2004-2.2.4
+    - CIS-UBUNTU2004-2.2.6
+    - M1042
+
+- name: VirtualBox guest packages installation
+  become: true
+  ansible.builtin.apt:
+    name: "{{ packages }}"
+    state: present
+    install_recommends: false
+  vars:
+    packages:
+      - virtualbox-guest-dkms
+      - virtualbox-guest-utils
+  register: virtualbox_packages
+  when: ansible_virtualization_type == "VirtualBox" and
+    ansible_distribution == "Ubuntu"
+  failed_when: virtualbox_packages is not success and not "No package matching" in virtualbox_packages.msg
+  tags:
+    - packages
+    - virtualbox
+
+- name: VMWare package installation
+  become: true
+  ansible.builtin.package:
+    name: open-vm-tools
+    state: present
+  when: ansible_virtualization_type == "VMware"
+  tags:
+    - packages
+    - vmware
+
+- name: QEMU package installation
+  become: true
+  ansible.builtin.package:
+    name: qemu-guest-agent
+    state: present
+  when: ansible_system_vendor == "QEMU"
+  tags:
+    - packages
+    - qemu
+
+- name: Install rng-tools
+  become: true
+  ansible.builtin.package:
+    name: rng-tools
+    state: present
+  when: ansible_local.cpuinfo.rdrand
+  tags:
+    - rng-tools
+    - packages
+    - CCE-82968-9
+
+- name: Stat sysstat default
+  become: true
+  ansible.builtin.stat:
+    path: /etc/default/sysstat
+  register: default_sysstat
+  tags:
+    - packages
+    - sysstat
+
+- name: Enable sysstat
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: "^ENABLED"
+    line: 'ENABLED="true"'
+    dest: /etc/default/sysstat
+    mode: "0644"
+    state: present
+    create: false
+    backrefs: true
+  when: default_sysstat.stat.exists
+  tags:
+    - packages
+    - sysstat
+
+- name: Remove unneeded Debian dependencies
+  become: true
+  ansible.builtin.apt:
+    autoclean: true
+    autoremove: true
+  when: ansible_os_family == "Debian"
+  tags:
+    - packages