Merge pull request #5 from luther38/elastic

Elastic services moved to roles

.gitignore

@@ -4,3 +4,4 @@
 
 .DS_Store
 hosts
+win_hosts

.vagrant/machines/default/virtualbox/action_set_name

@@ -0,0 +1 @@
+1556550033

.vagrant/machines/default/virtualbox/creator_uid

@@ -0,0 +1 @@
+1001

.vagrant/machines/default/virtualbox/id

@@ -0,0 +1 @@
+96b95408-ffc7-44c3-919f-402645785ccd

.vagrant/machines/default/virtualbox/index_uuid

@@ -0,0 +1 @@
+3d922cc5783b466ab28a7ae61cc46639

.vagrant/machines/default/virtualbox/vagrant_cwd

@@ -0,0 +1 @@
+/home/jamestombleson/Documents/github/ansible

.vagrant/rgloader/loader.rb

@@ -0,0 +1,9 @@
+# This file loads the proper rgloader/loader.rb file that comes packaged
+# with Vagrant so that encoded files can properly run with Vagrant.
+
+if ENV["VAGRANT_INSTALLER_EMBEDDED_DIR"]
+  require File.expand_path(
+    "rgloader/loader", ENV["VAGRANT_INSTALLER_EMBEDDED_DIR"])
+else
+  raise "Encoded files can't be read outside of the Vagrant installer."
+end

ansible.cfg

@@ -65,7 +65,7 @@ local_tmp      = ~/.ansible/tmp
 # inject_facts_as_vars = True
 
 # additional paths to search for roles in, colon separated
-#roles_path    = /etc/ansible/roles
+roles_path    = ./roles/:/etc/ansible/roles
 
 # uncomment this to disable SSH key host checking
 #host_key_checking = False

playbook/linux/auto-securityupdates.yml

@@ -0,0 +1,16 @@
+
+---
+
+- name: enable 
+  hosts: linux
+
+  tasks:
+        - name: unattended-upgrades
+          become: true
+          include_role:
+                  name: jnv.unattended-upgrades
+          vars:
+                  #unattended_package_blacklist: []
+                  unattended_automatic_reboot: true
+
+

playbook/linux/data/store/192.168.0.60/etc/sensu/ssl_generation/sensu_ssl_tool/client/cert.pem

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC3TCCAcWgAwIBAgIBAjANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDDAdTZW5z
+dUNBMB4XDTE5MDQyODE3NTMwMloXDTI0MDQyNjE3NTMwMlowITEOMAwGA1UEAwwF
+c2Vuc3UxDzANBgNVBAoMBmNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAMBFLZ/mgAOdKJ2YUkqzjZHKsRyvNxixX9I3LWXJCMfFnWuUOLau5UaE
+rS6ZbtO1N4djsi6xSyBhPSu2hjPt9KgniTesaKZDwlLO2HLrOpUpmKPPpLxnBym9
+m/nXWaeuTLAnnNtP/wU4Jwvp1u9qMu5tIYdy+hTd5LJSQcfjgrt5ydHzLbwn9UyE
+2pcMawEgOaoywY9i6Ofhfsr5hwLkR3/3VS5PfJ2sVsO0Ks2vBW091BaQSwQAarpR
+ExMHmTrcHoHtWFI0RiFxZ+MoakL5380VSmzhAs8QPxYWYc3PLndhYt4pH6TLcCOF
+LpY8qk6S/acHuWHgdl+GIgyk5jKqnkECAwEAAaMvMC0wCQYDVR0TBAIwADALBgNV
+HQ8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQEFBQADggEB
+AG/MiB8QHvJlGrF1Xa5UHs/ykFJj1n+JzeniC5p3nApnRmpgi9KNlDZqRXjotuww
+uvaDlsRpFp+X4NukUUR8aUUZpwYbIm/wgXJ376Su0nUmpFmCU2TrGkk/cMeqbAen
+OYe5WZxsmJnmmkwhHLybrvha/vsCTNV6GY2JcHNhI8R7Uvwna48ueg7/WBQ5oXqZ
+zdYXMaFD2ioBFaYZqVifWv+5d1av2VBveX1V5p7ZZ3LHsvNS8/eVWufu5I4mwJI9
+GRPakzY0emL9ZBbtsZtsNA7IA6w4l4WeQtu1DHPc2iYO+JwfpeUNVX65ANSicqjC
+ibyhYEZs3qI/rb3WPXy6l0I=
+-----END CERTIFICATE-----

playbook/linux/data/store/192.168.0.60/etc/sensu/ssl_generation/sensu_ssl_tool/client/key.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAwEUtn+aAA50onZhSSrONkcqxHK83GLFf0jctZckIx8Wda5Q4
+tq7lRoStLplu07U3h2OyLrFLIGE9K7aGM+30qCeJN6xopkPCUs7Ycus6lSmYo8+k
+vGcHKb2b+ddZp65MsCec20//BTgnC+nW72oy7m0hh3L6FN3kslJBx+OCu3nJ0fMt
+vCf1TITalwxrASA5qjLBj2Lo5+F+yvmHAuRHf/dVLk98naxWw7Qqza8FbT3UFpBL
+BABqulETEweZOtwege1YUjRGIXFn4yhqQvnfzRVKbOECzxA/FhZhzc8ud2Fi3ikf
+pMtwI4UuljyqTpL9pwe5YeB2X4YiDKTmMqqeQQIDAQABAoIBAFxnovLLa9DQ0jlT
+gJFIVAyydoaLqxYiASRdwmK9yIuCbRLL7KnXyncmwri3ouz6lhJqlrMcIDgSo7yD
+f2Irxb6fKbJpGO53eEgmAx7P8JrJoANygwDNH0MvTmw31G3jNhYfI6K/gpf2kcWG
+//aWep3eMxQO7SPkNMqC//xaWnVQ0FLigNQjyFlgQrIZ3L4x7qFxcrkvTUIODGio
+R6hs7fECwXZkvLB28//tiwLEuOHnWGkG64fDebXUBDHsFhY/ObtA9vJITGY2GlUi
+1KFt9ZJd1JdMoV7EH5IwnA5YUN1NOtb5bwRaCddCMFH2lWsjzV1hNTZ9MzNyFqIF
+eolkKKUCgYEA6xR0LR3/stMPOWvgdaiXACHsH2hLx7Yh1vOf97eBbdUgiqjeL7DW
+mUmXIBLOQwrKMWNX0+DAqeuY80ESBmQ5KhRR/Sws2FMXGcqgyNPdJYAruif8y4z9
+0fGdvES1Fe12lOzyfPJclJi6doglyTjoJS5KGXUz8womJH4eiWZd+98CgYEA0WFx
+SPttK8Oi9zKxh/6YzpvOaABm6pCUslg79smhPGdhj4M0sO1sS4KzOBBolcplT9e6
+T1awh7ML44dowIFuQ0FgySnz5ogZt6xnqGv6bbfSVbMNpU4B9O4tJ2z16uFOXDeM
+f0tS55fcbspJ1Dylc+ndyAurd5E/8z/2BnU6qd8CgYADs6bAryA/qKMsvE4kjCsU
+jXQyamoHEw8lW2DBfdpD6H9Cr7YP+jDm6QnAL4uf8qOMc4wGghuGkXcvHW8zOpDL
+4NYJrpBmN6i9dztg7jUlSgdmPwr0CZxVmgBp3osbdUnQvopy/T4H+P+2rh4qNQMy
+0q/IBthyk05WdMX2U+5W8QKBgFSBwqpVKBvYyyaAZFziKiSBiA47003q6skMia8y
+dAwgIaU9rH+YY/QaHWGMZdnHJZrTFBQ/heJPJoY/ucywsKMeeQTYFOO/nLmgMPou
+EpZD8fW63dARKwMDOmBGPv78zpazqNYbvatRhJuGs8OgcprVEjlSVHNewXPZJeA3
+YmT7AoGAJuMaSA6oZqn0uKJD0FDwIl4j0RfVhPJHe9Um1G1K2FpZ3DV705kcwx1t
+IUu9pHLFJubwpkQFiERX/6BRbjbp4oZhpPLcLRec5nXTT8LHoiCBMaQW2RtnDMeW
+XKt2xyhGFp0Drw4vWV0Nr8fJbuBbAqviZTQnBtj7ZJ41KRV1mU4=
+-----END RSA PRIVATE KEY-----

playbook/linux/data/store/192.168.0.60/etc/sensu/ssl_generation/sensu_ssl_tool/sensu_ca/cacert.pem

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICxDCCAaygAwIBAgIJAPX7448uFrdyMA0GCSqGSIb3DQEBBQUAMBIxEDAOBgNV
+BAMMB1NlbnN1Q0EwHhcNMTkwNDI4MTc1MjU3WhcNMjQwNDI2MTc1MjU3WjASMRAw
+DgYDVQQDDAdTZW5zdUNBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+sI4ptnAIEJISxDYMVZIi6vF6GcnzXDyXl4Et9m86QF9+Zyfe4zomGDnfp7wfhddS
+6asPHMxcgXi9itY6qr33lzdDL4SaMysS/VwWLBwhmdl2hEELPvUKHBF96iyfuq4A
+lsQ3lAXr/3uqXdODNo38hGaxrK2n1ocKFEKZrGlmrFDvfYKJz1cYlDh5u0ghjJGQ
+E/MCDeQzGNOjcbSbNUo5nMR8P6nzPcMDHjtA0OS4DXSijvjibHPhZ/NU9KgoTz9W
+oL8FoePlL6Zq6cwiEKCOUsqivIPbM3nGGNkPBHmSE0dnYXn0le+LK3rkNX60ZdwE
+fqisAIaHSVQWVlTw4J8xlQIDAQABox0wGzAMBgNVHRMEBTADAQH/MAsGA1UdDwQE
+AwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAp1MPCS8tKdUGrT07yHosw7+Gxc++/ylM
+cmS9GLiwAfU4VU4QEy97ipL4K8VLWbrGVvJSpgxAApLA0jX7R2UcYTYeTk9ikuto
+BeQRxcj6QdR8BKD4N7Qtje6jBVMJ6Ssky3Kj1XXcEQu4iZx9uZCX2yeCeozXaLtS
++Tw3r9NjgIXGvhLCp64JTC+rL74S7cMwAIW5YBRy/K4uBdLKBcjYIi7VQnivsfGu
+J2+28+kfNw7nNWBdVWtBf6MoJQNEDvpx+HGRBCJoSlgw+GTRgbgCqEPJrXBdbamU
+SDJtCEdYonQqUCqqCI083ckx8c31YBg1COTZBQnWQiYVpcIfXG7j/A==
+-----END CERTIFICATE-----

playbook/linux/data/store/192.168.0.60/etc/sensu/ssl_generation/sensu_ssl_tool/server/cert.pem

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC3TCCAcWgAwIBAgIBATANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDDAdTZW5z
+dUNBMB4XDTE5MDQyODE3NTI1OVoXDTI0MDQyNjE3NTI1OVowITEOMAwGA1UEAwwF
+c2Vuc3UxDzANBgNVBAoMBnNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBALEltlZMg7u1rqFbnljmD+IeiVeRt0zzRiCEpjvQ4t+bBjT5onPAOxYI
+Q1d3MdPJqA+lyCRP/sXcEKa1l14UDj50WEruK0VqXKL+e2ETeJi4kJb8k8ansCAI
+Ask5Ok2d8bTSQLzJBCkjwvR5kfG49R5wfJFDSA3WLfTHq1myRibJIMgbFGB2UP3Q
+yyljZWn04IO72yWhK413CxwnwXKsIFT5/z0hVGZMr5wDWpfhBhtBi6uxqeKG3Zyy
+CV/f3yUcOL+A9yoxPu155TNYfvmz1rqarTeuOJJJU7TtAiHmue8OhkfRFanBBYj9
+hSOGPdLB9eKzoWsS8vLKLUTwaQwZ9IsCAwEAAaMvMC0wCQYDVR0TBAIwADALBgNV
+HQ8EBAMCBSAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQEFBQADggEB
+ABPZUxDIGJ6C8hu1aOj5sY/r8yphotSnPVkghBTGVJbjmGHSci+IGbHX6yemVYvH
+mQWKI8qBdroiIpCOpMVvmG6oUR4s+h/vdKuDoy/x3lRZjJDQiReAGKwwyeiG++wJ
+x6eSCDGqcIWvk72Zgd+OGym3JGrDpU7ofat+ncqtIunAOh7rhQlyRJ42wYZpWDIi
+Aass4yn16aYhF/PppUIsBYrWk1UUlKbXOF/Z7WOG4Hg6h5HwwtJZq/PGsSzJqd/O
+s6XI8Am1pU9PwLwWm9Vad44OhTNWGxsidboUCxNa7Yc7p5CkAqT+Z2Lf7RfvgmcX
+SUCwSN9REpYGV3k9l47eljY=
+-----END CERTIFICATE-----

playbook/linux/data/store/192.168.0.60/etc/sensu/ssl_generation/sensu_ssl_tool/server/key.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAsSW2VkyDu7WuoVueWOYP4h6JV5G3TPNGIISmO9Di35sGNPmi
+c8A7FghDV3cx08moD6XIJE/+xdwQprWXXhQOPnRYSu4rRWpcov57YRN4mLiQlvyT
+xqewIAgCyTk6TZ3xtNJAvMkEKSPC9HmR8bj1HnB8kUNIDdYt9MerWbJGJskgyBsU
+YHZQ/dDLKWNlafTgg7vbJaErjXcLHCfBcqwgVPn/PSFUZkyvnANal+EGG0GLq7Gp
+4obdnLIJX9/fJRw4v4D3KjE+7XnlM1h++bPWupqtN644kklTtO0CIea57w6GR9EV
+qcEFiP2FI4Y90sH14rOhaxLy8sotRPBpDBn0iwIDAQABAoIBAFtnsiXlZTO+E1V/
+CL2mOBvc1dExhvtVq6Gr0Hqc1fO68gDzrjc7wUElElpXToaRTv6D9DmIbVV6r7zV
+hj0s7Aydy9EeA4XV0+bmmJMGkPt8gF7oBPhEHkTo3UcnGEZkcQt0UaMXteXkZfvv
+nrazUQdb02rA5LT/Bsd/H5MwwbHQyipMXKQXpYyzALhoBUrXItc+aHfINHOELs0h
+UPSoFnNSsQo1VGSd/TCZJYYw2cpmeTqWO4sM6z8vYXJnNQTCb2saW+vywfQoYTJ7
+V6mSmX7EgYh512jNpNdzhQx8qN1hmWF/r5G9DC4QSnzVoN23fi4H+szB9CEfVlPy
+pGj6qUECgYEA1zwPaLjz9XgeZiHrLYDCFeNRYE4Noa9mFuuplYxmiIJGsBiUNHNJ
+bbMn8VpuBBptEUnSTCGJhAF39AGKfUHx+49hTKTUISmnTDOSHLeE1mKvZJWB3x4r
+3ezfsUVwV4BvidYQEv0FWuE+lniDmx2BVQk7vIiF5VjUxMmyqnB8cEUCgYEA0rLw
+LtSYod0VzFLs8NlMH9nhfQk7oSfyxqLVwpiAQVAtrI3xfQUaYP04BrV/XOI+YBcF
+Svg4Ou4tqcuGFFYtqNPAaGYfih7UzEY8Z6wH2rkyznCq7VQZexKKtTbPQCNSkJ5h
+fpNxfh4sXZSpYg/aIEr6OC8REuhcjRjhJBWJJo8CgYAsPN316j3KMBwfZc1Olu5N
+TWGGZ8SJfOGAyIMch7TzTcN1ojej6CYpc+87vhhqo3vTV9bvat020o5zCnYKdKll
+yPx4olAvWL5X/SmE2XtmDPZ7t/bvguYFQRBhASKr+Wvzapn3LSYSncUdbDuwgAn7
+DmDGyVCr6OwiXkpomaIZ+QKBgCZIpSOdNW6TwVYy6yKIGTDgYfxaJR+PJqm5BKYr
+F4LGksX7tJlGyBg/amKtr8qswTCsfiW1HGJ4zItBk8c2MW2vrBJMHAb4uymyyV78
+/yBa7kRcbHJbCZY3NEThBJ9ey63DWWuqVsDXsq/+RxiuUK/1b6mtw6hv2AE7OA1a
+bGU5AoGBANL+ssYI1JH1TFRwI8iTc/no2Loy2jZ2NGyZbU/gc3NhhVERNgtK8nmM
+dcYrgmewKKS20+AqqbM7zITYdJea6RTKU6ELJul2iKMDSwA65cEwueqAT6WY7x57
+z0fBzoaLRQp11SSuuPz9p0a096XGygQP1o2SabZCwY4b3+vtkbJM
+-----END RSA PRIVATE KEY-----

playbook/linux/elastic/config-elasticsearch.yml

@@ -1,44 +0,0 @@
-# This will work on a new install.
-# If any changes are needed to the cluster name on an existing install add another function
-- name: Config - cluster.name 'elastic-DMI01'
-become: true
-lineinfile:
-        path: /etc/elasticsearch/elasticsearch.yml
-        regex: '^cluster.name'
-        insertafter: '#cluster.name: my-application'
-        line: 'cluster.name: elastic-DMI01'
-        backup: yes
-
-# We define the name of the host we are working on
-- name: Config - node.name
-become: true
-lineinfile:
-        path: /etc/elasticsearch/elasticsearch.yml
-        regex: '^node.name'
-        insertafter: '#node.name: node-1'
-        line: "node.name: {{ ansible_eno1.ipv4.address  }}"
-
-# Allow 9200 so we can access it over the network
-- name: Allow port 9200 though UFW
-become: true
-ufw:
-        rule: allow
-        port: 9200
-        #name: ElasticSearch
-
-- name: Service reload daemon
-become: true
-systemd:
-        daemon_reload: yes
-
-- name: systemd - enable ElasticSearch on startup
-become: true
-systemd:
-        name: elasticsearch
-        enabled: yes
-
-- name: systemd - restart ElasticSearch service
-become: true
-systemd:
-        name: elasticsearch
-        state: restarted

playbook/linux/elastic/config-heartbeat.yml

@@ -1,11 +1,4 @@
 ---
-- name: define kibana host
-  become: true
-  lineinfile:
-        path: /etc/heartbeat/heartbeat.yml
-        regex: '^host: "dm-nagios.local:5601"'
-        insertafter: '#host: "localhost:5601"'
-        line: 'host: "dm-nagios.local:5601"'
 
 - name: systemd - daemon reload
   become: true

playbook/linux/elastic/config-kibana.yml

@@ -1,49 +0,0 @@
-         
-- name: Config - Server.Port 5601
-  become: true
-  lineinfile:
-          path: /etc/kibana/kibana.yml
-          regex: '^server.port'
-          insertafter: '#server.port: 5601'
-          line: 'server.port: 5601'
-          backup: yes
-
-
-- name: Config - Server.host 
-  become: true
-  lineinfile:
-          path: /etc/kibana/kibana.yml
-          regex: '^server.host'
-          insertafter: '#server.host'
-          line: 'server.host: {{ ansible_eno1.ipv4.address  }}'
-
-- name: Config - elasticsearch.hosts
-  become: true
-  lineinfile:
-          path: /etc/kibana/kibana.yml
-          regex: '^elasticsearch.hosts'
-          insertafter: '#elasticsearch.hosts:'
-          line: 'elasticsearch.hosts: ["http://localhost:9200"]'
-
-- name: Allow port 5601
-  become: true
-  ufw:
-          rule: allow
-          port: 5601
-
-- name: systemd - daemon reload
-  become: true
-  systemd:
-          daemon_reload: yes
-
-- name: systemd - enable Kibana on startup
-  become: true
-  systemd:
-          name: kibana
-          enabled: yes
-
-- name: systemd - restart Kibana 
-  become: true
-  systemd:
-          name: kibana
-          state: restarted

playbook/linux/elastic/config-metricbeat.yml

@@ -1,31 +1,12 @@
 
 # - name: enable modules
-
-- name: define kibana host
+- name: enable system module
   become: true
-  lineinfile:
-        path: /etc/metricbeat/metricbeat.yml
-        regex: '^host: "dm-nagios.local:5601"'
-        insertafter: '#host: "localhost:5601"'
-        line: 'host: "dm-nagios.local:5601"'
-
-#- name: config where to send information
-
-        #- name: Remove builtin elasticsearch host config
-        #  become: true
-        #  replace:
-        #dest: /etc/metricbeat/metricbeat.yml
-        #regexp: '^hosts: ["localhost:9200"]'
-        #replace: '#hosts: ["localhost:9200"]'
-  
-- name: define elasticsearch host
-  become: true
-  lineinfile:
-        path: /etc/metricbeat/metricbeat.yml
-        regex: '^hosts: ["localhost:9200"]'
-        insertafter: 'hosts: ["localhost:9200"]'
-        line: 'hosts: ["dm-nagios.local:9200"]'
+  shell: metricbeat modules enable system
 
+  #- name: start metricbeat service
+  #  become: true
+  #shell: metricbeat service metricbeat start
 
 - name: systemd - daemon reload
   become: true

playbook/linux/elastic/config-win-heartbeat.yml

@@ -0,0 +1,56 @@
+---
+# This will install all the client parts needed for elastic to monitor client computers
+
+- name: Install elastic client programs
+  hosts: windows
+  vars:
+          elastic_version: '7.0.0'
+          url_heartbeat: 'https://artifacts.elastic.co/downloads/beats/heartbeat/heartbeat-{{elastic_version}}-windows-x86_64.zip'
+          temp: 'c:\temp\'
+          program_files: 'c:\program files\'
+          kibana_host: '192.168.0.173:5601'
+          elasticsearch_hosts: '["192.168.0.173:9200"]'
+
+
+  tasks:
+        - name:  make temp folder
+          win_file:
+                  path: c:\temp\
+                  state: directory
+
+        - name: download heartbeat
+          win_get_url:
+                  url: '{{ url_heartbeat }}'
+                  dest: 'C:\temp\heartbeat-{{ elastic_version }}.zip'
+                  force: no
+
+        - name: unzip heartbeat
+          win_unzip:
+                  src: c:\temp\heartbeat-{{ elastic_version }}.zip
+                  dest: C:\temp\heartbeat-{{ elastic_version }}\
+                  creates: C:\temp\heartbeat-{{ elastic_version }}\
+
+        - name: Copy heartbeat-{{ elastic_version }} folder
+          win_command: powershell.exe copy-item -Path 'c:\temp\heartbeat-{{ elastic_version }}\heartbeat-{{ elastic_version }}-windows-x86_64\' -Filter * -Recurse -Destination 'C:\Program Files\Heartbeat\'
+          args:
+                  creates: C:\Program Files\Heartbeat\
+
+        - name: Update template
+          win_template:
+                  src: heartbeat.j2
+                  dest: C:\Program Files\Heartbeat\heartbeat.yml
+
+        - name: Install Heartbeat service
+          win_command: powershell.exe -ExecutionPolicy ByPass -File install-service-heartbeat.ps1
+          args:
+                  chdir: C:\program files\heartbeat\
+
+        - name: stop heartbeat service
+          win_service:
+                  name: heartbeat
+                  state: stopped
+                        
+        - name: start heartbeat service
+          win_service:
+                  name: heartbeat
+                  state: started

playbook/linux/elastic/config-win-metricbeat.yml

@@ -0,0 +1,56 @@
+---
+# This will install all the client parts needed for elastic to monitor client computers
+
+- name: download metricbeat
+  win_get_url:
+        url: '{{ url_metricbeat }}'
+        dest: 'C:\temp\metricbeat-{{ elastic_version }}.zip'
+        force: no
+
+- name: unzip heartbeat
+  win_unzip:
+        src: c:\temp\metricbeat-{{ elastic_version }}.zip
+        dest: C:\temp\metricbeat-{{ elastic_version }}\
+        creates: C:\temp\metricbeat-{{ elastic_version }}\
+
+- name: Copy metricbeat-{{ elastic_version }} folder
+  win_command: powershell.exe copy-item -Path 'c:\temp\metricbeat-{{ elastic_version }}\metricbeat-{{ elastic_version }}-windows-x86_64\' -Filter * -Recurse -Destination 'C:\Program Files\Metricbeat\'
+  args:
+        creates: C:\Program Files\Metricbeat\
+
+- name: Update template
+  win_template:
+        src: metricbeat.j2
+        dest: C:\Program Files\Metricbeat\metricbeat.yml
+
+- name: Check if metricbeat service is installed
+  register: service_metricbeat
+  win_service:
+          name: metricbeat
+
+#- debug: var=service_metricbeat
+
+- name: Install Metricbeat service
+  win_command: powershell.exe -ExecutionPolicy ByPass -File install-service-metricbeat.ps1
+  args:
+        chdir: C:\program files\metricbeat\
+  when: service_metricbeat.exists == false
+
+- name: check status of metricbeat service
+  register: service_metricbeat
+  win_service:
+          name: metricbeat
+
+#- debug: var=service_metricbeat
+
+- name: restart service
+  win_service:
+        name: metricbeat
+        state: restarted
+  when: service_metricbeat.state == 'started'
+                        
+- name: start service
+  win_service:
+        name: metricbeat
+        state: started
+  when: service_metricbeat.state == 'stopped'

playbook/linux/elastic/config-winlogbeat.yml

@@ -0,0 +1,52 @@
+---
+# This will install all the client parts needed for elastic to monitor client computers
+
+- name: download winlogbeat
+  win_get_url:
+        url: '{{ url_winlogbeat }}'
+        dest: 'C:\temp\winlogbeat-{{ elastic_version }}.zip'
+        force: no
+
+- name: unzip winlogbeat
+  win_unzip:
+        src: c:\temp\winlogbeat-{{ elastic_version }}.zip
+        dest: C:\temp\winlogbeat-{{ elastic_version }}\
+        creates: C:\temp\winlogbeat-{{ elastic_version }}\
+
+- name: Copy winlogbeat-{{ elastic_version }} folder
+  win_command: powershell.exe copy-item -Path 'c:\temp\winlogbeat-{{ elastic_version }}\winlogbeat-{{ elastic_version }}-windows-x86_64\' -Filter * -Recurse -Destination 'C:\Program Files\winlogbeat\'
+  args:
+        creates: C:\Program Files\winlogbeat\
+
+- name: Update template
+  win_template:
+        src: winlogbeat.j2
+        dest: C:\Program Files\winlogbeat\winlogbeat.yml
+
+- name: check for service
+  register: service
+  win_service:
+          name: winlogbeat
+
+- name: Install winlogbeat service
+  win_command: powershell.exe -ExecutionPolicy ByPass -File install-service-winlogbeat.ps1
+  args:
+        chdir: C:\program files\winlogbeat\
+  when: service.exists == false
+
+- name: check status of service
+  register: service
+  win_service:
+          name: winlogbeat
+
+- name: restart service
+  win_service:
+        name: winlogbeat
+        state: restarted
+  when: service.state == 'started'
+                        
+- name: start service
+  win_service:
+        name: winlogbeat
+        state: started
+  when: service.state == 'stopped'

playbook/linux/elastic/heartbeat.j2

@@ -0,0 +1,168 @@
+################### Heartbeat Configuration Example #########################
+
+# This file is an example configuration file highlighting only some common options.
+# The heartbeat.reference.yml file in the same directory contains all the supported options
+# with detailed comments. You can use it for reference.
+#
+# You can find the full configuration reference here:
+# https://www.elastic.co/guide/en/beats/heartbeat/index.html
+
+############################# Heartbeat ######################################
+
+# Define a directory to load monitor definitions from. Definitions take the form
+# of individual yaml files.
+heartbeat.config.monitors:
+  # Directory + glob pattern to search for configuration files
+  path: ${path.config}/monitors.d/*.yml
+  # If enabled, heartbeat will periodically check the config.monitors path for changes
+  reload.enabled: true
+  # How often to check for changes
+  reload.period: 5s
+
+# Configure monitors inline
+heartbeat.monitors:
+- type: http
+
+  # List or urls to query
+  urls: ["http://localhost:9200", "https://www.directorsmortgage.com", "https://www.usadirectfunding.com":]
+
+  # Configure task schedule
+  schedule: '@every 60s'
+
+  # Total test connection and data exchange timeout
+  #timeout: 16s
+
+#==================== Elasticsearch template setting ==========================
+
+setup.template.settings:
+  index.number_of_shards: 1
+  index.codec: best_compression
+  #_source.enabled: false
+
+#================================ General =====================================
+
+# The name of the shipper that publishes the network data. It can be used to group
+# all the transactions sent by a single shipper in the web interface.
+name: {{ ansible_hostname }}
+
+# The tags of the shipper are included in their own field with each
+# transaction published.
+#tags: ["service-X", "web-tier"]
+
+# Optional fields that you can specify to add additional information to the
+# output.
+#fields:
+#  env: staging
+
+
+#============================== Dashboards =====================================
+# These settings control loading the sample dashboards to the Kibana index. Loading
+# the dashboards is disabled by default and can be enabled either by setting the
+# options here or by using the `setup` command.
+
+setup.dashboards.enabled: true
+
+# The URL from where to download the dashboards archive. By default this URL
+# has a value which is computed based on the Beat name and version. For released
+# versions, this URL points to the dashboard archive on the artifacts.elastic.co
+# website.
+#setup.dashboards.url:
+
+#============================== Kibana =====================================
+
+# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
+# This requires a Kibana endpoint configuration.
+setup.kibana:
+
+  # Kibana Host
+  # Scheme and port can be left out and will be set to the default (http and 5601)
+  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
+  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
+  
+  host: {{ kibana_host }}
+
+  # Kibana Space ID
+  # ID of the Kibana Space into which the dashboards should be loaded. By default,
+  # the Default Space will be used.
+  #space.id:
+
+#============================= Elastic Cloud ==================================
+
+# These settings simplify using heartbeat with the Elastic Cloud (https://cloud.elastic.co/).
+
+# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
+# `setup.kibana.host` options.
+# You can find the `cloud.id` in the Elastic Cloud web UI.
+#cloud.id:
+
+# The cloud.auth setting overwrites the `output.elasticsearch.username` and
+# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
+#cloud.auth:
+
+#================================ Outputs =====================================
+
+# Configure what output to use when sending the data collected by the beat.
+
+#-------------------------- Elasticsearch output ------------------------------
+output.elasticsearch:
+  # Array of hosts to connect to.
+  hosts: {{ elasticsearch_hosts }}
+
+  # Optional protocol and basic auth credentials.
+  #protocol: "https"
+  #username: "elastic"
+  #password: "changeme"
+
+#----------------------------- Logstash output --------------------------------
+#output.logstash:
+  # The Logstash hosts
+  #hosts: ["localhost:5044"]
+
+  # Optional SSL. By default is off.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+#================================ Processors =====================================
+
+# Configure processors to enhance or manipulate events generated by the beat.
+
+processors:
+  - add_host_metadata: ~
+  - add_cloud_metadata: ~
+
+#================================ Logging =====================================
+
+# Sets log level. The default log level is info.
+# Available log levels are: error, warning, info, debug
+#logging.level: debug
+
+# At debug level, you can selectively enable logging only for some components.
+# To enable all selectors use ["*"]. Examples of other selectors are "beat",
+# "publish", "service".
+#logging.selectors: ["*"]
+
+#============================== Xpack Monitoring ===============================
+# heartbeat can export internal metrics to a central Elasticsearch monitoring
+# cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The
+# reporting is disabled by default.
+
+# Set to true to enable the monitoring reporter.
+#xpack.monitoring.enabled: false
+
+# Uncomment to send the metrics to Elasticsearch. Most settings from the
+# Elasticsearch output are accepted here as well. Any setting that is not set is
+# automatically inherited from the Elasticsearch output configuration, so if you
+# have the Elasticsearch output configured, you can simply uncomment the
+# following line.
+#xpack.monitoring.elasticsearch:
+
+#================================= Migration ==================================
+
+# This allows to enable 6.7 migration aliases
+#migration.6_to_7.enabled: true

playbook/linux/elastic/install-client.yml

@@ -2,7 +2,10 @@
 # This will install all the client parts needed for elastic to monitor client computers
 
 - name: Install elastic client programs
-  hosts: linux
+  hosts: elasticClients
+  vars:
+          kibana_host: '192.168.0.173:5601'
+          elasticsearch_hosts: '["192.168.0.173:9200"]'
 
   tasks:
         - name: Install elastic repo
@@ -11,9 +14,15 @@
         - name: Install elastic heartbeat
           become: true
           apt:
-                name: heartbeat-elastic
+          name: heartbeat-elastic
 
-        - name: Configure elastic heartbeazt
+        - name: Update Heatbeat config
+          become: true
+          template:
+                  src: heartbeat.j2
+                  dest: /etc/heartbeat/heartbeat.yml
+        
+        - name: Configure elastic heartbeat
           include: config-heartbeat.yml
 
         - name: Install elastic metricbeat
@@ -21,5 +30,11 @@
           apt:
                 name: metricbeat
 
+        - name: Update Metricbeat config
+          become: true
+          template:
+                  src: metricbeat.j2
+                  dest: /etc/metricbeat/metricbeat.yml
+
         - name: Configure elastic metricbeat
           include: config-metricbeat.yml

playbook/linux/elastic/install-filebeat.yml

@@ -0,0 +1,14 @@
+
+- name: Install Filebeat
+  hosts: elasticClients
+
+  tasks:
+        - name: Install Filebeat
+          include_role:
+                  name: luther38.filebeat
+          vars:
+                  kibana_host: 172.20.0.142:5601
+                  elasticsearch_hosts: "'172.20.0.142:9200'"
+                  systemd_enabled: true
+                  systemd_restart: true
+

playbook/linux/elastic/install-metricbeat.yml

@@ -0,0 +1,16 @@
+---
+
+- name: Install Metricbeat
+  hosts: elasticClients
+
+  tasks:
+          - name: Install Metricbeat
+            become: true
+            include_role:
+                    name: luther38.metricbeat
+            vars:
+                    kibana_host: 172.20.0.142
+                    elasticsearch_hosts: '["172.20.0.142:9200"]' 
+                    systemd_enable_service: true
+                    systemd_restart_service: true
+

playbook/linux/elastic/install-server.yml

@@ -5,6 +5,18 @@
 
 - name: Install Elastic server programs
   hosts: elastic
+  vars:
+          es_cluster_name: 'logging-dev'
+          es_node_name: 'dev-data-01'
+          es_node_master: 'true'
+          es_node_data: 'true'
+          es_path_data: '/var/lib/elasticsearch'
+          es_path_logs: '/var/log/elasticsearch'
+          es_http_port: '9200'
+          es_transport_host: 'localhost'
+          es_transport_port: '9300'
+          k_server_port: 5601
+          k_elasticsearch_hosts: 'http://192.168.0.173:9200'
 
   tasks:
         - name: Install Requrements
@@ -15,6 +27,12 @@
           apt:
                 name: elasticsearch
 
+        - name: Update ElasticSearch config
+          become: true
+          template:
+                  src: elasticsearch.j2
+                  dest: /etc/elasticsearch/elasticsearch.yml
+
         - name: Configure ElasticSearch
           include: config-elasticsearch.yml
 
@@ -23,5 +41,22 @@
           apt: 
                 name: kibana
 
+        - name: Configure Kibana
+          become: true
+          template:
+                  src: kibana.j2
+                  dest: /etc/kibana/kibana.yml
+
         - name: Configure Kibana
           include: config-kibana.yml
+
+        - name: Install Heartbeat
+          become: true
+          apt:
+                  name: heartbeat
+
+          #- name: Install Logstash
+          #become: true
+          #apt:
+                  #name: logstash
+                                    

playbook/linux/elastic/install-win-client.yml

@@ -0,0 +1,27 @@
+---
+# This will install all the client parts needed for elastic to monitor client computers
+
+- name: Install elastic client programs
+  hosts: windows
+  vars:
+          elastic_version: '7.0.0'
+          url_heartbeat: 'https://artifacts.elastic.co/downloads/beats/heartbeat/heartbeat-{{elastic_version}}-windows-x86_64.zip'
+          url_metricbeat: 'https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-7.0.0-windows-x86_64.zip'
+          url_winlogbeat: 'https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-7.0.0-windows-x86_64.zip'
+          temp: 'c:\temp\'
+          program_files: 'c:\program files\'
+          kibana_host: '192.168.0.173:5601'
+          elasticsearch_hosts: '["192.168.0.173:9200"]'
+
+
+  tasks:
+        - name:  make temp folder
+          win_file:
+                  path: c:\temp\
+                  state: directory
+
+        - name: Install Metricbeat
+          include: config-win-metricbeat.yml
+
+        - name: Install WinLogbeat
+          include: config-winlogbeat.yml

playbook/linux/elastic/install-winlogbeat.yml

@@ -0,0 +1,16 @@
+---
+
+- name: Install WinLogBeat
+  hosts: elasticClients
+
+  tasks:
+        - name: Install WinLogBeat
+          become: true
+          include_role:
+                  name: luther38.winlogbeat
+          vars:
+                  version: 7.0.0
+                  kibana_host: 172.20.0.142
+                  elasticsearch_hosts: '["172.20.0.142:9200"]' 
+ 
+

playbook/linux/elastic/role-test.yml

@@ -0,0 +1,35 @@
+
+- name: testing elastic role
+  hosts: elastic
+
+  tasks:
+        - name: install/Update Java
+          become: true
+          import_role: 
+                name: geerlingguy.java
+
+        - name: install elasticsearch
+          become: true
+          import_role: 
+                name: elasticsearch
+          vars:
+                cluster_name: "loggin-dev"
+                ufw_http_port: true
+                ufw_transport_port: true
+                systemd_enabled: true
+                systemd_restart: true
+                node_name: "{{ ansible_hostname }}"
+                discovery_seed_hosts: "'127.0.0.1', '172.20.0.142', '192.168.0.173'"
+                cluster_initial_master_nodes: " '172.20.0.142', '192.168.0.173' "
+
+        - name: install kibana
+          become: true
+          import_role:
+                name: kibana
+          vars:
+                server_port: 5601
+                ufw_server_port: true
+                server_host: "{{ ansible_default_ipv4.address }}"
+                server_name: "{{ ansible_hostname }}"
+                elasticsearch_hosts: " 'http://localhost:9200', 'http://dm-nagios.local:9200', 'http://172.20.0.142:9200' "
+

playbook/linux/install-jenkins.yml

@@ -0,0 +1,21 @@
+
+---
+
+- name: install Jenkins
+  hosts: jenkins
+
+  tasks:
+        - name: Install Java
+          become: yes
+          import_role:
+                  name: geerlingguy.java
+
+         # https://galaxy.ansible.com/geerlingguy/jenkins
+         - name: Install Jenkins
+           become: yes
+           import_role:
+                   name: geerlingguy.jenkins
+           vars:
+                   jenkins_package_state: latest
+                   jenkins_http_port: 8080
+

playbook/linux/sensu-test.yml

@@ -0,0 +1,19 @@
+
+- name: testing sensu
+  hosts: linux
+
+  tasks:
+        - name: install sensu server
+          become: true
+          import_role:
+                  name: sensu.sensu
+          vars:
+                  # Sever vars
+                  sensu_deploy_redis_server: true
+                  sensu_deploy_rabbitmq_server: true
+                  sensu_master: true
+                  #sensu_include_plugins: true
+                  sensu_include_dashboard: true
+                  # Client Vars
+                  #sensu_client: true
+                  

playbook/windows/install-elastic-client.yml

@@ -0,0 +1,44 @@
+---
+# This will install all the client parts needed for elastic to monitor client computers
+
+- name: Install elastic client programs
+  hosts: windows
+  vars:
+          elastic_version: '7.0.0'
+          url_heartbeat: 'https://artifacts.elastic.co/downloads/beats/heartbeat/heartbeat-{{elastic_version}}-windows-x86_64.zip'
+          temp: 'c:\temp\'
+          program_files: 'c:\program files\'
+          kibana_host: '192.168.0.173:5601'
+          elasticsearch_hosts: '["192.168.0.173:9200"]'
+
+
+  tasks:
+        - name:  make temp folder
+          win_file:
+                  path: c:\temp\
+                  state: directory
+
+        - name: download heartbeat
+          win_get_url:
+                  url: '{{ url_heartbeat }}'
+                  dest: 'C:\temp\heartbeat-{{ elastic_version }}.zip'
+                  force: no
+
+        - name: unzip heartbeat
+          win_unzip:
+                  src: c:\temp\heartbeat-{{ elastic_version }}.zip
+                  dest: C:\temp\heartbeat-{{ elastic_version }}\
+                  creates: C:\temp\heartbeat-{{ elastic_version }}\
+
+        - name: Copy heartbeat-{{ elastic_version }} folder
+          win_command: powershell.exe copy-item -Path 'c:\temp\heartbeat-{{ elastic_version }}\heartbeat-{{ elastic_version }}-windows-x86_64\' -Filter * -Recurse -Destination 'C:\Program Files\Heartbeat\'
+          args:
+                  creates: C:\Program Files\Heartbeat\
+
+        - name: Update template
+          win_template:
+                  src: heartbeat.j2
+                  dest: C:\Program Files\Heartbeat\heartbeat.yml
+
+        - name: Install Heartbeat service
+          win_command: powershell.exe -ExecutionPolicy ByPass -File 'C:\Program Files\Heartbeat\install-service-heartbeat.ps1'

roles/elasticsearch/README.md

@@ -0,0 +1,96 @@
+ElasticSearch
+=========
+
+This role will install and configure ElastiSearch on requested servers.
+
+Requirements
+------------
+
+No requirements are needed for this role.
+
+Role Variables
+--------------
+
+```yaml
+cluster_name: 'cluster'
+
+node_name: ''
+
+# https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html
+#
+node_master: true
+
+node_data: true
+
+path_data: '/var/lib/elasticsearch'
+
+path_logs: '/var/log/elastisearch'
+
+http_port: 9200
+
+### Transport ###
+#
+#https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-transport.html
+#
+
+# The host address to bind the transport service to. Defaults to transport.host (if set) or network.bind_host.
+transport_host: 'localhost'
+
+# A bind port range. Defaults to 9300-9400.
+transport_port: 9300
+
+#
+# Firewall configuration
+#
+
+# Allow http_port though UFW
+ufw_http_port: false
+
+# Allow transport_port though UFW
+ufw_transport_port: false
+
+#
+# systemd configuration
+#
+
+# Enable ElasticSearch on system startup
+systemd_enabled: false
+
+# Restart ElasticSearch after running though playbook
+systemd_restart: false
+```
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+- name: testing elastic role
+  hosts: elastic
+
+  tasks:
+        - name: Install ElasticSearch
+          import_role: 
+                name: elasticsearch
+          vars:
+                cluster_name: "cookies"
+                ufw_http_port: true
+                ufw_transport_port: true
+                systemd_enabled: true
+                systemd_restart: true
+
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/elasticsearch/defaults/main.yml

@@ -0,0 +1,60 @@
+---
+# This contains all the variables that can be used in the playbook
+
+cluster_name: 'cluster'
+
+node_name: 'nodeName'
+
+# https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html
+#
+node_master: true
+
+node_data: true
+
+path_data: '/var/lib/elasticsearch'
+
+path_logs: '/var/log/elastisearch'
+
+http_port: 9200
+
+### Transport ###
+#
+#https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-transport.html
+#
+
+# The host address to bind the transport service to. Defaults to transport.host (if set) or network.bind_host.
+transport_host: 'localhost'
+
+# A bind port range. Defaults to 9300-9400.
+transport_port: 9300
+
+#
+# Discovery
+#
+
+# Format data like so " '172.0.0.1', '192.168.0.0' "
+discovery_seed_host: "127.0.0.1"
+
+#cluster_initial_master_nodes: ["node-1", "node-2"]
+cluster_initial_master_nodes: "'node-1', 'node-2'"
+
+#
+# Firewall configuration
+#
+
+# Allow http_port though UFW
+ufw_http_port: false
+
+# Allow transport_port though UFW
+ufw_transport_port: false
+
+#
+# systemd configuration
+#
+
+# Enable ElasticSearch on system startup
+systemd_enabled: false
+
+# Restart ElasticSearch after running though playbook
+systemd_restart: false
+

roles/elasticsearch/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for elasticsearch

roles/elasticsearch/meta/main.yml

@@ -0,0 +1,60 @@
+galaxy_info:
+  author: your name
+  description: your description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Some suggested licenses:
+  # - BSD (default)
+  # - MIT
+  # - GPLv2
+  # - GPLv3
+  # - Apache
+  # - CC-BY
+  license: license (GPLv2, CC-BY, etc)
+
+  min_ansible_version: 2.4
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  # Optionally specify the branch Galaxy will use when accessing the GitHub
+  # repo for this role. During role install, if no tags are available,
+  # Galaxy will use this branch. During import Galaxy will access files on
+  # this branch. If Travis integration is configured, only notifications for this
+  # branch will be accepted. Otherwise, in all cases, the repo's default branch
+  # (usually master) will be used.
+  #github_branch:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/elasticsearch/tasks/install-repo.yml

@@ -0,0 +1,29 @@
+---
+
+- name: Install Elastic GPG Key
+  become: true
+  apt_key:
+        url: "https://artifacts.elastic.co/GPG-KEY-elasticsearch"
+        state: present
+        id: 46095ACC8548582C1A2699A9D27D666CD88E42B4
+
+- name: Install apt-transport-https
+  become: true
+  apt:
+        name: apt-transport-https
+
+- name: Add Elastic Repo
+  become: true
+  copy:
+        dest: '/etc/apt/sources.list.d/elastic-7.x.list'
+        content: "deb https://artifacts.elastic.co/packages/7.x/apt stable main"
+  # copy:
+  #src: elastic-7.x.list
+  #     dest: /etc/apt/sources.list.d/
+  #     backup: yes
+
+- name: Update Packages
+  become: true
+  apt:
+        update_cache: true
+

roles/elasticsearch/tasks/main.yml

@@ -0,0 +1,11 @@
+---
+# tasks file for elasticsearcih
+
+#- name: Test role
+#debug: var=cluster_name
+
+- name: Running role - elasticsearch
+  include: ubuntu.yml
+  when: ansible_distribution == "Ubuntu"
+
+ 

roles/elasticsearch/tasks/ubuntu.yml

@@ -0,0 +1,44 @@
+
+
+- name: Add Elastic repo
+  include: install-repo.yml
+
+- name: Install ElasticSearch from apt
+  become: true
+  apt:
+    name: elasticsearch
+
+- name: Update config
+  become: true
+  template:
+    src: elasticsearch.j2
+    dest: /etc/elasticsearch/elasticsearch.yml
+    backup: yes
+
+- name: UFW allow http_port 
+  become: true
+  when: ufw_http_port == true
+  ufw:
+    rule: allow
+    port: "{{ http_port }}"
+
+- name: UFW allow transport_port
+  become: true
+  when: ufw_transport_port == true
+  ufw:
+    rule: allow
+    port: "{{ transport_port }}"
+
+- name: systemd enable elasticsearch
+  become: true
+  when: systemd_enabled == true
+  systemd:
+    name: elasticsearch
+    enabled: true
+
+- name: systemd restart elasticsearch
+  become: true
+  when: systemd_restart == true
+  systemd:
+    name: elasticsearch
+    state: restarted

roles/elasticsearch/templates/elasticsearch.j2

@@ -0,0 +1,96 @@
+# ======================== Elasticsearch Configuration =========================
+#
+# NOTE: Elasticsearch comes with reasonable defaults for most settings.
+#       Before you set out to tweak and tune the configuration, make sure you
+#       understand what are you trying to accomplish and the consequences.
+#
+# The primary way of configuring a node is via this file. This template lists
+# the most important settings you may want to configure for a production cluster.
+#
+# Please consult the documentation for further information on configuration options:
+# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
+#
+# ---------------------------------- Cluster -----------------------------------
+#
+# Use a descriptive name for your cluster:
+#
+#cluster.name: my-application
+cluster.name: {{ cluster_name }}
+#
+# ------------------------------------ Node ------------------------------------
+#
+# Use a descriptive name for the node:
+#
+#node.name: node-1
+node.name: {{ node_name }}
+#node.master: {{ node_master }}
+#node.data: {{ node_data }}
+#
+# Add custom attributes to the node:
+#
+#node.attr.rack: r1
+#
+# ----------------------------------- Paths ------------------------------------
+#
+# Path to directory where to store the data (separate multiple locations by comma):
+#
+path.data: {{ path_data }}
+#
+# Path to log files:
+#
+path.logs: {{ path_logs }}
+#
+# ----------------------------------- Memory -----------------------------------
+#
+# Lock the memory on startup:
+#
+#bootstrap.memory_lock: true
+#
+# Make sure that the heap size is set to about half the memory available
+# on the system and that the owner of the process is allowed to use this
+# limit.
+#
+# Elasticsearch performs poorly when the system is swapping the memory.
+#
+# ---------------------------------- Network -----------------------------------
+#
+# Set the bind address to a specific IP (IPv4 or IPv6):
+#
+network.host: {{ ansible_default_ipv4.address }}
+#
+# Set a custom port for HTTP:
+#
+http.port: {{ http_port }}
+#transport.host: {{ transport_host }}
+transport.tcp.port: {{ transport_port }}
+#
+# For more information, consult the network module documentation.#
+#
+# --------------------------------- Discovery ----------------------------------
+#
+# Pass an initial list of hosts to perform discovery when this node is started:
+# The default list of hosts is ["127.0.0.1", "[::1]"]
+#
+#discovery.seed_hosts: ["host1", "host2"]
+{{ discovery_seed_hosts_def }}
+#
+# Bootstrap the cluster using an initial set of master-eligible nodes:
+#
+#cluster.initial_master_nodes: ["node-1", "node-2"]
+cluster.initial_master_nodes: [ {{ cluster_initial_master_nodes }}  ]
+#
+# For more information, consult the discovery and cluster formation module documentation.
+#
+# ---------------------------------- Gateway -----------------------------------
+#
+# Block initial recovery after a full cluster restart until N nodes are started:
+#
+#gateway.recover_after_nodes: 3
+#
+# For more information, consult the gateway module documentation.
+#
+# ---------------------------------- Various -----------------------------------
+#
+# Require explicit names when deleting indices:
+#
+#action.destructive_requires_name: true

roles/elasticsearch/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/elasticsearch/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - elasticsearch

roles/elasticsearch/vars/main.yml

@@ -0,0 +1,27 @@
+---
+
+# configuration for elasticsearch.yml
+#
+# Defines the name of the cluster we are going to deploy to
+cluster_name: 'Elastic-Cluster'
+
+# Defines the name of the node
+node_name: 'hostname'
+
+node_master: true
+
+node_data: true
+
+path_data: '/var/lib/elasticsearch'
+
+path_logs: '/var/lib/elasticsearch'
+
+http_port: 9200
+
+transport_host: localhost
+
+transport_tcp_port: 9300
+
+discovery_seed_hosts: 172.0.0.1
+
+discovery_seed_hosts_def: "discovery.seed_hosts: [ {{ discovery_seed_hosts }} ]"

roles/geerlingguy.java/.gitignore

@@ -0,0 +1,3 @@
+*.retry
+*/__pycache__
+*.pyc

roles/geerlingguy.java/.travis.yml

@@ -0,0 +1,32 @@
+---
+language: python
+services: docker
+
+env:
+  global:
+    - ROLE_NAME: java
+  matrix:
+    - MOLECULE_DISTRO: centos7
+    - MOLECULE_DISTRO: centos6
+    - MOLECULE_DISTRO: fedora27
+    - MOLECULE_DISTRO: ubuntu1804
+    - MOLECULE_DISTRO: ubuntu1604
+    - MOLECULE_DISTRO: debian9
+    - MOLECULE_DISTRO: debian8
+
+install:
+  # Install test dependencies.
+  - pip install molecule docker
+
+before_script:
+  # Use actual Ansible Galaxy role name for the project directory.
+  - cd ../
+  - mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
+  - cd geerlingguy.$ROLE_NAME
+
+script:
+  # Run tests.
+  - molecule test
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/geerlingguy.java/LICENSE

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Jeff Geerling
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

roles/geerlingguy.java/README.md

@@ -0,0 +1,67 @@
+# Ansible Role: Java
+
+[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-java.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-java)
+
+Installs Java for RedHat/CentOS and Debian/Ubuntu linux servers.
+
+## Requirements
+
+None.
+
+## Role Variables
+
+Available variables are listed below, along with default values:
+
+    # The defaults provided by this role are specific to each distribution.
+    java_packages:
+      - java-1.7.0-openjdk
+
+Set the version/development kit of Java to install, along with any other necessary Java packages. Some other options include are included in the distribution-specific files in this role's 'defaults' folder.
+
+    java_home: ""
+
+If set, the role will set the global environment variable `JAVA_HOME` to this value.
+
+## Dependencies
+
+None.
+
+## Example Playbook (using default package, usually OpenJDK 7)
+
+    - hosts: servers
+      roles:
+        - role: geerlingguy.java
+          become: yes
+
+## Example Playbook (install OpenJDK 8)
+
+For RHEL / CentOS:
+
+    - hosts: server
+      roles:
+        - role: geerlingguy.java
+          when: "ansible_os_family == 'RedHat'"
+          java_packages:
+            - java-1.8.0-openjdk
+
+For Ubuntu < 16.04:
+
+    - hosts: server
+      tasks:
+        - name: installing repo for Java 8 in Ubuntu
+  	      apt_repository: repo='ppa:openjdk-r/ppa'
+    
+    - hosts: server
+      roles:
+        - role: geerlingguy.java
+          when: "ansible_os_family == 'Debian'"
+          java_packages:
+            - openjdk-8-jdk
+
+## License
+
+MIT / BSD
+
+## Author Information
+
+This role was created in 2014 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

roles/geerlingguy.java/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+# Set java_packages if you would like to use a different version than the
+# default (OpenJDK 1.7).
+# java_packages: []
+
+java_home: ""

roles/geerlingguy.java/meta/.galaxy_install_info

@@ -0,0 +1,2 @@
+install_date: Mon Apr 29 14:19:43 2019
+version: 1.9.5

roles/geerlingguy.java/meta/main.yml

@@ -0,0 +1,39 @@
+---
+dependencies: []
+
+galaxy_info:
+  author: geerlingguy
+  description: Java for Linux
+  company: "Midwestern Mac, LLC"
+  license: "license (BSD, MIT)"
+  min_ansible_version: 2.4
+  platforms:
+    - name: EL
+      versions:
+        - 6
+        - 7
+    - name: Fedora
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - wheezy
+        - jessie
+        - stretch
+    - name: Ubuntu
+      versions:
+        - precise
+        - trusty
+        - xenial
+        - bionic
+    - name: FreeBSD
+      versions:
+        - 10.2
+  galaxy_tags:
+    - development
+    - system
+    - web
+    - java
+    - jdk
+    - openjdk
+    - oracle

roles/geerlingguy.java/molecule/default/molecule.yml

@@ -0,0 +1,29 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+  options:
+    config-file: molecule/default/yaml-lint.yml
+platforms:
+  - name: instance
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  lint:
+    name: ansible-lint
+  playbooks:
+    converge: ${MOLECULE_PLAYBOOK:-playbook.yml}
+scenario:
+  name: default
+verifier:
+  name: testinfra
+  lint:
+    name: flake8

roles/geerlingguy.java/molecule/default/playbook.yml

@@ -0,0 +1,13 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=true cache_valid_time=600
+      when: ansible_os_family == 'Debian'
+      changed_when: false
+
+  roles:
+    - role: geerlingguy.java

roles/geerlingguy.java/molecule/default/tests/test_default.py

@@ -0,0 +1,14 @@
+import os
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_hosts_file(host):
+    f = host.file('/etc/hosts')
+
+    assert f.exists
+    assert f.user == 'root'
+    assert f.group == 'root'

roles/geerlingguy.java/molecule/default/yaml-lint.yml

@@ -0,0 +1,6 @@
+---
+extends: default
+rules:
+  line-length:
+    max: 120
+    level: warning

roles/geerlingguy.java/tasks/main.yml

@@ -0,0 +1,41 @@
+---
+- name: Include OS-specific variables for Fedora or FreeBSD.
+  include_vars: "{{ ansible_distribution }}.yml"
+  when: ansible_distribution == 'FreeBSD' or ansible_distribution == 'Fedora'
+
+- name: Include version-specific variables for CentOS/RHEL.
+  include_vars: "RedHat-{{ ansible_distribution_version.split('.')[0] }}.yml"
+  when: ansible_distribution == 'CentOS' or
+        ansible_distribution == 'Red Hat Enterprise Linux' or
+        ansible_distribution == 'RedHat'
+
+- name: Include version-specific variables for Ubuntu.
+  include_vars: "{{ ansible_distribution }}-{{ ansible_distribution_version.split('.')[0] }}.yml"
+  when: ansible_distribution == 'Ubuntu'
+
+- name: Include version-specific variables for Debian.
+  include_vars: "{{ ansible_distribution|title }}-{{ ansible_distribution_version.split('.')[0] }}.yml"
+  when: ansible_os_family == 'Debian'
+
+- name: Define java_packages.
+  set_fact:
+    java_packages: "{{ __java_packages | list }}"
+  when: java_packages is not defined
+
+# Setup/install tasks.
+- include_tasks: setup-RedHat.yml
+  when: ansible_os_family == 'RedHat'
+
+- include_tasks: setup-Debian.yml
+  when: ansible_os_family == 'Debian'
+
+- include_tasks: setup-FreeBSD.yml
+  when: ansible_os_family == 'FreeBSD'
+
+# Environment setup.
+- name: Set JAVA_HOME if configured.
+  template:
+    src: java_home.sh.j2
+    dest: /etc/profile.d/java_home.sh
+    mode: 0644
+  when: java_home is defined and java_home

roles/geerlingguy.java/tasks/setup-Debian.yml

@@ -0,0 +1,16 @@
+---
+# See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863199 and
+# https://github.com/geerlingguy/ansible-role-java/issues/64
+- name: Ensure 'man' directory exists.
+  file:
+    path: /usr/share/man/man1
+    state: directory
+    recurse: true
+  when:
+    - ansible_distribution == 'Ubuntu'
+    - ansible_distribution_version == '18.04'
+
+- name: Ensure Java is installed.
+  apt:
+    name: "{{ java_packages }}"
+    state: present

roles/geerlingguy.java/tasks/setup-FreeBSD.yml

@@ -0,0 +1,11 @@
+---
+- name: Ensure Java is installed.
+  pkgng:
+    name: "{{ java_packages }}"
+    state: present
+
+- name: ensure proc is mounted
+  mount: name=/proc fstype=procfs src=proc opts=rw state=mounted
+
+- name: ensure fdesc is mounted
+  mount: name=/dev/fd fstype=fdescfs src=fdesc opts=rw state=mounted

roles/geerlingguy.java/tasks/setup-RedHat.yml

@@ -0,0 +1,5 @@
+---
+- name: Ensure Java is installed.
+  package:
+    name: "{{ java_packages }}"
+    state: present

roles/geerlingguy.java/templates/java_home.sh.j2

@@ -0,0 +1 @@
+export JAVA_HOME={{ java_home }}

roles/geerlingguy.java/vars/Debian-8.yml

@@ -0,0 +1,7 @@
+---
+# JDK version options include:
+#   - java
+#   - openjdk-6-jdk
+#   - openjdk-7-jdk
+__java_packages:
+  - openjdk-7-jdk

roles/geerlingguy.java/vars/Debian-9.yml

@@ -0,0 +1,6 @@
+---
+# JDK version options include:
+#   - java
+#   - openjdk-8-jdk
+__java_packages:
+  - openjdk-8-jdk

roles/geerlingguy.java/vars/Fedora.yml

@@ -0,0 +1,6 @@
+---
+# JDK version options include:
+#   - java
+#   - java-1.8.0-openjdk
+__java_packages:
+  - java-1.8.0-openjdk

roles/geerlingguy.java/vars/FreeBSD.yml

@@ -0,0 +1,7 @@
+---
+# JDK version options for FreeBSD include:
+#   - openjdk
+#   - openjdk6
+#   - openjdk8
+__java_packages:
+  - openjdk

roles/geerlingguy.java/vars/RedHat-6.yml

@@ -0,0 +1,7 @@
+---
+# JDK version options include:
+#   - java
+#   - java-1.6.0-openjdk
+#   - java-1.7.0-openjdk
+__java_packages:
+  - java-1.7.0-openjdk

roles/geerlingguy.java/vars/RedHat-7.yml

@@ -0,0 +1,8 @@
+---
+# JDK version options include:
+#   - java
+#   - java-1.6.0-openjdk
+#   - java-1.7.0-openjdk
+#   - java-1.8.0-openjdk
+__java_packages:
+  - java-1.8.0-openjdk

roles/geerlingguy.java/vars/Ubuntu-12.yml

@@ -0,0 +1,7 @@
+---
+# JDK version options include:
+#   - java
+#   - openjdk-6-jdk
+#   - openjdk-7-jdk
+__java_packages:
+  - openjdk-7-jdk

roles/geerlingguy.java/vars/Ubuntu-14.yml

@@ -0,0 +1,7 @@
+---
+# JDK version options include:
+#   - java
+#   - openjdk-6-jdk
+#   - openjdk-7-jdk
+__java_packages:
+  - openjdk-7-jdk

roles/geerlingguy.java/vars/Ubuntu-16.yml

@@ -0,0 +1,7 @@
+---
+# JDK version options include:
+#   - java
+#   - openjdk-8-jdk
+#   - openjdk-9-jdk
+__java_packages:
+  - openjdk-8-jdk

roles/geerlingguy.java/vars/Ubuntu-18.yml

@@ -0,0 +1,6 @@
+---
+# JDK version options include:
+#   - java
+#   - openjdk-11-jdk
+__java_packages:
+  - openjdk-11-jdk

roles/geerlingguy.jenkins/.ansible-lint

@@ -0,0 +1,2 @@
+skip_list:
+  - '602'

roles/geerlingguy.jenkins/.gitignore

@@ -0,0 +1,3 @@
+*.retry
+*/__pycache__
+*.pyc

roles/geerlingguy.jenkins/.travis.yml

@@ -0,0 +1,43 @@
+---
+language: python
+services: docker
+
+env:
+  global:
+    - ROLE_NAME: jenkins
+  matrix:
+    # Test defaults.
+    - MOLECULE_DISTRO: centos7
+    - MOLECULE_DISTRO: ubuntu1804
+    - MOLECULE_DISTRO: ubuntu1604
+    - MOLECULE_DISTRO: debian9
+
+    # Test other role features.
+    - MOLECULE_DISTRO: ubuntu1804
+      MOLECULE_PLAYBOOK: playbook-http-port.yml
+
+    - MOLECULE_DISTRO: ubuntu1804
+      MOLECULE_PLAYBOOK: playbook-prefix.yml
+
+    - MOLECULE_DISTRO: centos7
+      MOLECULE_PLAYBOOK: playbook-jenkins-version.yml
+
+    - MOLECULE_DISTRO: ubuntu1804
+      MOLECULE_PLAYBOOK: playbook-plugins-with-home.yml
+
+install:
+  # Install test dependencies.
+  - pip install molecule docker
+
+before_script:
+  # Use actual Ansible Galaxy role name for the project directory.
+  - cd ../
+  - mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
+  - cd geerlingguy.$ROLE_NAME
+
+script:
+  # Run tests.
+  - molecule test
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/geerlingguy.jenkins/LICENSE

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Jeff Geerling
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

roles/geerlingguy.jenkins/README.md

@@ -0,0 +1,135 @@
+# Ansible Role: Jenkins CI
+
+[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-jenkins.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-jenkins)
+
+Installs Jenkins CI on RHEL/CentOS and Debian/Ubuntu servers.
+
+## Requirements
+
+Requires `curl` to be installed on the server. Also, newer versions of Jenkins require Java 8+ (see the test playbooks inside the `tests/` directory for an example of how to use newer versions of Java for your OS).
+
+## Role Variables
+
+Available variables are listed below, along with default values (see `defaults/main.yml`):
+
+    jenkins_package_state: present
+
+The state of the `jenkins` package install. By default this role installs Jenkins but will not upgrade Jenkins (when using package-based installs). If you want to always update to the latest version, change this to `latest`.
+
+    jenkins_hostname: localhost
+
+The system hostname; usually `localhost` works fine. This will be used during setup to communicate with the running Jenkins instance via HTTP requests.
+
+    jenkins_home: /var/lib/jenkins
+
+The Jenkins home directory which, amongst others, is being used for storing artifacts, workspaces and plugins. This variable allows you to override the default `/var/lib/jenkins` location.
+
+    jenkins_http_port: 8080
+
+The HTTP port for Jenkins' web interface.
+
+    jenkins_admin_username: admin
+    jenkins_admin_password: admin
+
+Default admin account credentials which will be created the first time Jenkins is installed.
+
+    jenkins_admin_password_file: ""
+
+Default admin password file which will be created the first time Jenkins is installed as /var/lib/jenkins/secrets/initialAdminPassword
+
+    jenkins_jar_location: /opt/jenkins-cli.jar
+
+The location at which the `jenkins-cli.jar` jarfile will be kept. This is used for communicating with Jenkins via the CLI.
+
+    jenkins_plugins: []
+
+Jenkins plugins to be installed automatically during provisioning.
+
+    jenkins_plugins_install_dependencies: true
+
+Whether Jenkins plugins to be installed should also install any plugin dependencies.
+
+    jenkins_plugins_state: present
+
+Use `latest` to ensure all plugins are running the most up-to-date version.
+
+    jenkins_plugin_updates_expiration: 86400
+
+Number of seconds after which a new copy of the update-center.json file is downloaded. Set it to 0 if no cache file should be used.
+
+    jenkins_updates_url: "https://updates.jenkins.io"
+
+The URL to use for Jenkins plugin updates and update-center information.
+
+    jenkins_plugin_timeout: 30
+
+The server connection timeout, in seconds, when installing Jenkins plugins.
+
+    jenkins_version: "1.644"
+    jenkins_pkg_url: "http://www.example.com"
+
+(Optional) Then Jenkins version can be pinned to any version available on `http://pkg.jenkins-ci.org/debian/` (Debian/Ubuntu) or `http://pkg.jenkins-ci.org/redhat/` (RHEL/CentOS). If the Jenkins version you need is not available in the default package URLs, you can override the URL with your own; set `jenkins_pkg_url` (_Note_: the role depends on the same naming convention that `http://pkg.jenkins-ci.org/` uses).
+
+    jenkins_url_prefix: ""
+
+Used for setting a URL prefix for your Jenkins installation. The option is added as `--prefix={{ jenkins_url_prefix }}` to the Jenkins initialization `java` invocation, so you can access the installation at a path like `http://www.example.com{{ jenkins_url_prefix }}`. Make sure you start the prefix with a `/` (e.g. `/jenkins`).
+
+    jenkins_connection_delay: 5
+    jenkins_connection_retries: 60
+
+Amount of time and number of times to wait when connecting to Jenkins after initial startup, to verify that Jenkins is running. Total time to wait = `delay` * `retries`, so by default this role will wait up to 300 seconds before timing out.
+
+    # For RedHat/CentOS (role default):
+    jenkins_repo_url: http://pkg.jenkins-ci.org/redhat/jenkins.repo
+    jenkins_repo_key_url: http://pkg.jenkins-ci.org/redhat/jenkins-ci.org.key
+    # For Debian (role default):
+    jenkins_repo_url: deb http://pkg.jenkins-ci.org/debian binary/
+    jenkins_repo_key_url: http://pkg.jenkins-ci.org/debian/jenkins-ci.org.key
+
+This role will install the latest version of Jenkins by default (using the official repositories as listed above). You can override these variables (use the correct set for your platform) to install the current LTS version instead:
+
+    # For RedHat/CentOS LTS:
+    jenkins_repo_url: http://pkg.jenkins-ci.org/redhat-stable/jenkins.repo
+    jenkins_repo_key_url: http://pkg.jenkins-ci.org/redhat-stable/jenkins-ci.org.key
+    # For Debian/Ubuntu LTS:
+    jenkins_repo_url: deb http://pkg.jenkins-ci.org/debian-stable binary/
+    jenkins_repo_key_url: http://pkg.jenkins-ci.org/debian-stable/jenkins-ci.org.key
+
+It is also possible stop the repo file being added by setting  `jenkins_repo_url = ''`. This is useful if, for example, you sign your own packages or run internal package management (e.g. Spacewalk).
+
+    jenkins_java_options: "-Djenkins.install.runSetupWizard=false"
+
+Extra Java options for the Jenkins launch command configured in the init file can be set with the var `jenkins_java_options`. For example, if you want to configure the timezone Jenkins uses, add `-Dorg.apache.commons.jelly.tags.fmt.timeZone=America/New_York`. By default, the option to disable the Jenkins 2.0 setup wizard is added.
+
+    jenkins_init_changes:
+      - option: "JENKINS_ARGS"
+        value: "--prefix={{ jenkins_url_prefix }}"
+      - option: "JENKINS_JAVA_OPTIONS"
+        value: "{{ jenkins_java_options }}"
+
+Changes made to the Jenkins init script; the default set of changes set the configured URL prefix and add in configured Java options for Jenkins' startup. You can add other option/value pairs if you need to set other options for the Jenkins init file.
+
+## Dependencies
+
+  - geerlingguy.java
+
+## Example Playbook
+
+```yaml
+- hosts: jenkins
+  vars:
+    jenkins_hostname: jenkins.example.com
+  roles:
+    - role: geerlingguy.java
+      become: yes
+    - role: geerlingguy.jenkins
+      become: yes
+```
+
+## License
+
+MIT (Expat) / BSD
+
+## Author Information
+
+This role was created in 2014 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

roles/geerlingguy.jenkins/defaults/main.yml

@@ -0,0 +1,37 @@
+---
+# Optional method of pinning a specific version of Jenkins and/or overriding the
+# default Jenkins packaging URL.
+# jenkins_version: "1.644"
+# jenkins_pkg_url: "https://www.example.com"
+
+# Change this to `latest` to update Jenkins if a newer version is available.
+jenkins_package_state: present
+
+jenkins_connection_delay: 5
+jenkins_connection_retries: 60
+jenkins_home: /var/lib/jenkins
+jenkins_hostname: localhost
+jenkins_http_port: 8080
+jenkins_jar_location: /opt/jenkins-cli.jar
+jenkins_url_prefix: ""
+jenkins_java_options: "-Djenkins.install.runSetupWizard=false"
+
+jenkins_plugins: []
+jenkins_plugins_state: present
+jenkins_plugin_updates_expiration: 86400
+jenkins_plugin_timeout: 30
+jenkins_plugins_install_dependencies: true
+jenkins_updates_url: "https://updates.jenkins.io"
+
+jenkins_admin_username: admin
+jenkins_admin_password: admin
+jenkins_admin_password_file: ""
+
+jenkins_process_user: jenkins
+jenkins_process_group: "{{ jenkins_process_user }}"
+
+jenkins_init_changes:
+  - option: "JENKINS_ARGS"
+    value: "--prefix={{ jenkins_url_prefix }}"
+  - option: "{{ jenkins_java_options_env_var }}"
+    value: "{{ jenkins_java_options }}"

roles/geerlingguy.jenkins/handlers/main.yml

@@ -0,0 +1,12 @@
+---
+- name: restart jenkins
+  service: name=jenkins state=restarted
+
+- name: configure default users
+  template:
+    src: basic-security.groovy.j2
+    dest: "{{ jenkins_home }}/init.groovy.d/basic-security.groovy"
+    owner: "{{ jenkins_process_user }}"
+    group: "{{ jenkins_process_group }}"
+    mode: 0775
+  register: jenkins_users_config

roles/geerlingguy.jenkins/meta/.galaxy_install_info

@@ -0,0 +1,2 @@
+install_date: Mon Apr 29 14:19:40 2019
+version: 3.7.0

roles/geerlingguy.jenkins/meta/main.yml

@@ -0,0 +1,29 @@
+---
+dependencies:
+  - geerlingguy.java
+
+galaxy_info:
+  author: geerlingguy
+  description: Jenkins CI
+  company: "Midwestern Mac, LLC"
+  license: "license (BSD, MIT)"
+  min_ansible_version: 2.4
+  platforms:
+    - name: EL
+      versions:
+        - 6
+        - 7
+    - name: Fedora
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
+  galaxy_tags:
+    - development
+    - packaging
+    - jenkins
+    - ci

roles/geerlingguy.jenkins/molecule/default/java-8.yml

@@ -0,0 +1,51 @@
+---
+# Ubuntu.
+- name: Add repository for OpenJDK 8 (Ubuntu 14).
+  apt_repository: repo='ppa:openjdk-r/ppa'
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_version == "14.04"
+
+# Debian.
+- name: Enable Backports repository (Debian 8).
+  apt_repository:
+    repo: 'deb http://ftp.debian.org/debian {{ ansible_distribution_release }}-backports main'
+    state: present
+    filename: "{{ ansible_distribution_release }}_backports"
+  when: ansible_distribution == "Debian"
+
+- name: Update apt cache.
+  apt: update_cache=yes cache_valid_time=600
+  when: ansible_os_family == 'Debian'
+  changed_when: false
+
+# See: http://unix.stackexchange.com/a/342469
+- name: Install dependencies.
+  apt:
+    default_release: "{{ ansible_distribution_release }}-backports"
+    name:
+      - openjdk-8-jre-headless
+      - ca-certificates-java
+    state: present
+  when: ansible_distribution == "Debian"
+
+# Red Hat.
+- name: Set the java_packages variable (RedHat).
+  set_fact:
+    java_packages:
+      - java-1.8.0-openjdk
+  when: ansible_os_family == 'RedHat'
+
+# Ubuntu.
+- name: Set the java_packages variable (Ubuntu).
+  set_fact:
+    java_packages:
+      - openjdk-8-jdk
+  when: ansible_distribution == 'Ubuntu'
+
+# Debian.
+- name: Set the java_packages variable (Debian).
+  set_fact:
+    java_packages:
+      - openjdk-8-jdk
+  when: ansible_distribution == 'Debian'

roles/geerlingguy.jenkins/molecule/default/molecule.yml

@@ -0,0 +1,29 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+  options:
+    config-file: molecule/default/yaml-lint.yml
+platforms:
+  - name: instance
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  lint:
+    name: ansible-lint
+  playbooks:
+    converge: ${MOLECULE_PLAYBOOK:-playbook.yml}
+scenario:
+  name: default
+verifier:
+  name: testinfra
+  lint:
+    name: flake8

roles/geerlingguy.jenkins/molecule/default/playbook-http-port.yml

@@ -0,0 +1,24 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+
+  vars:
+    jenkins_http_port: 8081
+
+  pre_tasks:
+    - include_tasks: java-8.yml
+
+  roles:
+    - geerlingguy.java
+    - geerlingguy.jenkins
+
+  post_tasks:
+    - name: Ensure Jenkins is running on the specified port.
+      uri:
+        url: "http://127.0.0.1:{{ jenkins_http_port }}"
+        status_code: 200
+      register: result
+      until: result.status == 200
+      retries: 60
+      delay: 1

roles/geerlingguy.jenkins/molecule/default/playbook-jenkins-version.yml

@@ -0,0 +1,27 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+
+  vars:
+    jenkins_version: "1.644"
+
+  roles:
+    - geerlingguy.java
+    - geerlingguy.jenkins
+
+  post_tasks:
+    - name: Check installed version of Jenkins.
+      command: rpm -q jenkins
+      args:
+        warn: false
+      changed_when: false
+      register: jenkins_rpm_version
+      tags: ['skip_ansible_lint']
+
+    - name: Print installed Jenkins package information.
+      debug: var=jenkins_rpm_version
+
+    - name: Fail if version doesn't match what we wanted.
+      fail:
+      when: "jenkins_version not in jenkins_rpm_version.stdout"

roles/geerlingguy.jenkins/molecule/default/playbook-plugins-with-home.yml

@@ -0,0 +1,52 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+
+  vars:
+    jenkins_plugins:
+      - ghprb
+      - greenballs
+    jenkins_home: /tmp/jenkins
+    jenkins_plugin_timeout: 120
+
+  pre_tasks:
+    - include_tasks: java-8.yml
+
+  roles:
+    - geerlingguy.java
+    - geerlingguy.jenkins
+
+  post_tasks:
+    - name: Verify JENKINS_HOME is correct.
+      stat:
+        path: "{{ jenkins_home }}/config.xml"
+      register: jenkins_home_config
+
+    - name: Fail if Jenkins config file doesn't exist.
+      fail:
+      when: not jenkins_home_config.stat.exists
+
+    - name: List plugins directory contents.
+      command: "ls {{ jenkins_home }}/plugins"
+      register: plugins_contents
+      changed_when: false
+      tags: ['skip_ansible_lint']
+
+    - name: Verify greenballs plugin exists.
+      stat:
+        path: "{{ jenkins_home }}/plugins/greenballs.jpi"
+      register: greenballs_plugin
+
+    - name: Fail if greenballs plugin file doesn't exist.
+      fail:
+      when: not greenballs_plugin.stat.exists
+
+    - name: Ensure Jenkins is running.
+      uri:
+        url: "http://127.0.0.1:8080/"
+        status_code: 200
+      register: result
+      until: result.status == 200
+      retries: 60
+      delay: 1

roles/geerlingguy.jenkins/molecule/default/playbook-prefix.yml

@@ -0,0 +1,24 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+
+  vars:
+    jenkins_url_prefix: /jenkins
+
+  pre_tasks:
+    - include_tasks: java-8.yml
+
+  roles:
+    - geerlingguy.java
+    - geerlingguy.jenkins
+
+  post_tasks:
+    - name: Ensure Jenkins is running with the specified prefix.
+      uri:
+        url: "http://127.0.0.1:8080{{ jenkins_url_prefix }}"
+        status_code: 200
+      register: result
+      until: result.status == 200
+      retries: 60
+      delay: 1

roles/geerlingguy.jenkins/molecule/default/playbook.yml

@@ -0,0 +1,16 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+
+  pre_tasks:
+    - include_tasks: java-8.yml
+
+  roles:
+    - role: geerlingguy.java
+    - role: geerlingguy.jenkins
+
+  post_tasks:
+    - name: Check if Jenkins is running.
+      uri:
+        url: "http://127.0.0.1:8080/"

roles/geerlingguy.jenkins/molecule/default/requirements.yml

@@ -0,0 +1,2 @@
+---
+- src: geerlingguy.java

roles/geerlingguy.jenkins/molecule/default/yaml-lint.yml

@@ -0,0 +1,6 @@
+---
+extends: default
+rules:
+  line-length:
+    max: 150
+    level: warning

roles/geerlingguy.jenkins/tasks/main.yml

@@ -0,0 +1,66 @@
+---
+# Variable setup.
+- name: Include OS-Specific variables
+  include_vars: "{{ ansible_os_family }}.yml"
+
+- name: Define jenkins_repo_url
+  set_fact:
+    jenkins_repo_url: "{{ __jenkins_repo_url }}"
+  when: jenkins_repo_url is not defined
+
+- name: Define jenkins_repo_key_url
+  set_fact:
+    jenkins_repo_key_url: "{{ __jenkins_repo_key_url }}"
+  when: jenkins_repo_key_url is not defined
+
+- name: Define jenkins_pkg_url
+  set_fact:
+    jenkins_pkg_url: "{{ __jenkins_pkg_url }}"
+  when: jenkins_pkg_url is not defined
+
+# Setup/install tasks.
+- include_tasks: setup-RedHat.yml
+  when: ansible_os_family == 'RedHat'
+
+- include_tasks: setup-Debian.yml
+  when: ansible_os_family == 'Debian'
+
+# Configure Jenkins init settings.
+- include_tasks: settings.yml
+
+# Make sure Jenkins starts, then configure Jenkins.
+- name: Ensure Jenkins is started and runs on startup.
+  service: name=jenkins state=started enabled=yes
+
+- name: Wait for Jenkins to start up before proceeding.
+  command: >
+    curl -D - --silent --max-time 5 http://{{ jenkins_hostname }}:{{ jenkins_http_port }}{{ jenkins_url_prefix }}/cli/
+  args:
+    warn: false
+  register: result
+  until: >
+    (result.stdout.find("403 Forbidden") != -1)
+    or (result.stdout.find("200 OK") != -1)
+    and (result.stdout.find("Please wait while") == -1)
+  retries: "{{ jenkins_connection_retries }}"
+  delay: "{{ jenkins_connection_delay }}"
+  changed_when: false
+  check_mode: false
+
+- name: Get the jenkins-cli jarfile from the Jenkins server.
+  get_url:
+    url: "http://{{ jenkins_hostname }}:{{ jenkins_http_port }}{{ jenkins_url_prefix }}/jnlpJars/jenkins-cli.jar"
+    dest: "{{ jenkins_jar_location }}"
+  register: jarfile_get
+  until: "'OK' in jarfile_get.msg or '304' in jarfile_get.msg or 'file already exists' in jarfile_get.msg"
+  retries: 5
+  delay: 10
+  check_mode: false
+
+- name: Remove Jenkins security init scripts after first startup.
+  file:
+    path: "{{ jenkins_home }}/init.groovy.d/basic-security.groovy"
+    state: absent
+
+# Update Jenkins and install configured plugins.
+- include_tasks: plugins.yml

roles/geerlingguy.jenkins/tasks/plugins.yml

@@ -0,0 +1,61 @@
+---
+# jenkins_plugin module doesn't support password files.
+- name: Get Jenkins admin password from file.
+  slurp:
+    src: "{{ jenkins_admin_password_file }}"
+  register: adminpasswordfile
+  no_log: true
+  when: jenkins_admin_password_file != ""
+  tags: ['skip_ansible_lint']
+
+- name: Set Jenkins admin password fact.
+  set_fact:
+    jenkins_admin_password: "{{ adminpasswordfile['stdout'] | default(jenkins_admin_password) }}"
+  no_log: true
+
+# Update Jenkins so that plugin updates don't fail.
+- name: Create Jenkins updates directory.
+  file:
+    path: "{{ jenkins_home }}/updates"
+    state: directory
+    owner: jenkins
+    group: jenkins
+
+- name: Download current plugin updates from Jenkins update site.
+  get_url:
+    url: "{{ jenkins_updates_url }}/update-center.json"
+    dest: "{{ jenkins_home }}/updates/default.json"
+    owner: jenkins
+    group: jenkins
+    mode: 0440
+  changed_when: false
+  register: get_result
+  until: get_result is success
+  retries: 3
+  delay: 2
+
+- name: Remove first and last line from json file.
+  replace:
+    path: "{{ jenkins_home }}/updates/default.json"
+    regexp: "1d;$d"
+
+- name: Install Jenkins plugins using password.
+  jenkins_plugin:
+    name: "{{ item }}"
+    jenkins_home: "{{ jenkins_home }}"
+    url_username: "{{ jenkins_admin_username }}"
+    url_password: "{{ jenkins_admin_password }}"
+    state: "{{ jenkins_plugins_state }}"
+    timeout: "{{ jenkins_plugin_timeout }}"
+    updates_expiration: "{{ jenkins_plugin_updates_expiration }}"
+    updates_url: "{{ jenkins_updates_url }}"
+    url: "http://{{ jenkins_hostname }}:{{ jenkins_http_port }}{{ jenkins_url_prefix }}"
+    with_dependencies: "{{ jenkins_plugins_install_dependencies }}"
+  with_items: "{{ jenkins_plugins }}"
+  when: jenkins_admin_password != ""
+  notify: restart jenkins
+  tags: ['skip_ansible_lint']
+  register: plugin_result
+  until: plugin_result is success
+  retries: 3
+  delay: 2

roles/geerlingguy.jenkins/tasks/settings.yml

@@ -0,0 +1,69 @@
+---
+- name: Check if jenkins_init_file exists.
+  stat:
+    path: "{{ jenkins_init_file }}"
+  register: jenkins_init_file_stat
+
+- name: Ensure jenkins_init_file exists.
+  file:
+    path: "{{ jenkins_init_file }}"
+    state: touch
+  when: not jenkins_init_file_stat.stat.exists
+
+- name: Modify variables in init file.
+  lineinfile:
+    dest: "{{ jenkins_init_file }}"
+    insertafter: '^{{ item.option }}='
+    regexp: '^{{ item.option }}=\"\${{ item.option }} '
+    line: '{{ item.option }}="${{ item.option }} {{ item.value }}"'
+    state: present
+  with_items: "{{ jenkins_init_changes }}"
+  register: jenkins_init_prefix
+
+- name: Set the Jenkins home directory.
+  lineinfile:
+    dest: "{{ jenkins_init_file }}"
+    regexp: '^JENKINS_HOME=.*'
+    line: 'JENKINS_HOME={{ jenkins_home }}'
+  register: jenkins_home_config
+
+- name: Immediately restart Jenkins on init config changes.
+  service: name=jenkins state=restarted
+  when: jenkins_init_prefix.changed
+  tags: ['skip_ansible_lint']
+
+- name: Set HTTP port in Jenkins config.
+  lineinfile:
+    backrefs: true
+    dest: "{{ jenkins_init_file }}"
+    regexp: '^{{ jenkins_http_port_param }}='
+    line: '{{ jenkins_http_port_param }}={{ jenkins_http_port }}'
+  register: jenkins_http_config
+
+- name: Ensure jenkins_home {{ jenkins_home }} exists
+  file:
+    path: "{{ jenkins_home }}"
+    state: directory
+    owner: jenkins
+    group: jenkins
+    mode: u+rwx
+    follow: true
+
+- name: Create custom init scripts directory.
+  file:
+    path: "{{ jenkins_home }}/init.groovy.d"
+    state: directory
+    owner: "{{ jenkins_process_user }}"
+    group: "{{ jenkins_process_group }}"
+    mode: 0775
+
+- name: Trigger handlers immediately in case Jenkins was installed
+  meta: flush_handlers
+
+- name: Immediately restart Jenkins on http or user changes.
+  service: name=jenkins state=restarted
+  when: >
+    (jenkins_users_config is defined and jenkins_users_config.changed)
+    or (jenkins_http_config is defined and jenkins_http_config.changed)
+    or (jenkins_home_config is defined and jenkins_home_config.changed)
+  tags: ['skip_ansible_lint']

roles/geerlingguy.jenkins/tasks/setup-Debian.yml

@@ -0,0 +1,45 @@
+---
+- name: Ensure dependencies are installed.
+  apt:
+    name:
+      - curl
+      - apt-transport-https
+    state: present
+
+- name: Add Jenkins apt repository key.
+  apt_key:
+    url: "{{ jenkins_repo_key_url }}"
+    state: present
+
+- name: Add Jenkins apt repository.
+  apt_repository:
+    repo: "{{ jenkins_repo_url }}"
+    state: present
+    update_cache: true
+  when: jenkins_repo_url != ""
+  tags: ['skip_ansible_lint']
+
+- name: Download specific Jenkins version.
+  get_url:
+    url: "{{ jenkins_pkg_url }}/jenkins_{{ jenkins_version }}_all.deb"
+    dest: "/tmp/jenkins_{{ jenkins_version }}_all.deb"
+  when: jenkins_version is defined
+
+- name: Check if we downloaded a specific version of Jenkins.
+  stat:
+    path: "/tmp/jenkins_{{ jenkins_version }}_all.deb"
+  register: specific_version
+  when: jenkins_version is defined
+
+- name: Install our specific version of Jenkins.
+  apt:
+    deb: "/tmp/jenkins_{{ jenkins_version }}_all.deb"
+    state: present
+  when: jenkins_version is defined and specific_version.stat.exists
+  notify: configure default users
+
+- name: Ensure Jenkins is installed.
+  apt:
+    name: jenkins
+    state: "{{ jenkins_package_state }}"
+  notify: configure default users

roles/geerlingguy.jenkins/tasks/setup-RedHat.yml

@@ -0,0 +1,45 @@
+---
+- name: Ensure dependencies are installed.
+  package:
+    name:
+      - curl
+      - libselinux-python
+      - initscripts
+    state: present
+
+- name: Ensure Jenkins repo is installed.
+  get_url:
+    url: "{{ jenkins_repo_url }}"
+    dest: /etc/yum.repos.d/jenkins.repo
+  when: jenkins_repo_url != ""
+  tags: ['skip_ansible_lint']
+
+- name: Add Jenkins repo GPG key.
+  rpm_key:
+    state: present
+    key: "{{ jenkins_repo_key_url }}"
+
+- name: Download specific Jenkins version.
+  get_url:
+    url: "{{ jenkins_pkg_url }}/jenkins-{{ jenkins_version }}-1.1.noarch.rpm"
+    dest: "/tmp/jenkins-{{ jenkins_version }}-1.1.noarch.rpm"
+  when: jenkins_version is defined
+
+- name: Check if we downloaded a specific version of Jenkins.
+  stat:
+    path: "/tmp/jenkins-{{ jenkins_version }}-1.1.noarch.rpm"
+  register: specific_version
+  when: jenkins_version is defined
+
+- name: Install our specific version of Jenkins.
+  package:
+    name: "/tmp/jenkins-{{ jenkins_version }}-1.1.noarch.rpm"
+    state: present
+  when: jenkins_version is defined and specific_version.stat.exists
+  notify: configure default users
+
+- name: Ensure Jenkins is installed.
+  package:
+    name: jenkins
+    state: "{{ jenkins_package_state }}"
+  notify: configure default users

roles/geerlingguy.jenkins/templates/basic-security.groovy.j2

@@ -0,0 +1,28 @@
+#!groovy
+import hudson.security.*
+import jenkins.model.*
+
+def instance = Jenkins.getInstance()
+def hudsonRealm = new HudsonPrivateSecurityRealm(false)
+def users = hudsonRealm.getAllUsers()
+users_s = users.collect { it.toString() }
+
+// Create the admin user account if it doesn't already exist.
+if ("{{ jenkins_admin_username }}" in users_s) {
+    println "Admin user already exists - updating password"
+
+    def user = hudson.model.User.get('{{ jenkins_admin_username }}');
+    def password = hudson.security.HudsonPrivateSecurityRealm.Details.fromPlainPassword('{{ jenkins_admin_password }}')
+    user.addProperty(password)
+    user.save()
+}
+else {
+    println "--> creating local admin user"
+
+    hudsonRealm.createAccount('{{ jenkins_admin_username }}', '{{ jenkins_admin_password }}')
+    instance.setSecurityRealm(hudsonRealm)
+
+    def strategy = new FullControlOnceLoggedInAuthorizationStrategy()
+    instance.setAuthorizationStrategy(strategy)
+    instance.save()
+}

roles/geerlingguy.jenkins/vars/Debian.yml

@@ -0,0 +1,7 @@
+---
+__jenkins_repo_url: deb https://pkg.jenkins.io/debian binary/
+__jenkins_repo_key_url: https://pkg.jenkins.io/debian/jenkins.io.key
+__jenkins_pkg_url: https://pkg.jenkins.io/debian/binary
+jenkins_init_file: /etc/default/jenkins
+jenkins_http_port_param: HTTP_PORT
+jenkins_java_options_env_var: JAVA_ARGS

roles/geerlingguy.jenkins/vars/RedHat.yml

@@ -0,0 +1,7 @@
+---
+__jenkins_repo_url: https://pkg.jenkins.io/redhat/jenkins.repo
+__jenkins_repo_key_url: https://pkg.jenkins.io/redhat/jenkins.io.key
+__jenkins_pkg_url: https://pkg.jenkins.io/redhat
+jenkins_init_file: /etc/sysconfig/jenkins
+jenkins_http_port_param: JENKINS_PORT
+jenkins_java_options_env_var: JENKINS_JAVA_OPTIONS

roles/jnv.unattended-upgrades/.editorconfig

@@ -0,0 +1,9 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

roles/jnv.unattended-upgrades/.gitignore

@@ -0,0 +1,3 @@
+.vagrant/
+*~
+*.log

roles/jnv.unattended-upgrades/.travis.yml

@@ -0,0 +1,16 @@
+sudo: required
+language: python
+services: docker
+
+cache: pip
+
+install:
+  - pip install ansible docker
+  - ansible-galaxy install -r tests/requirements.yml -p tests/roles/
+
+script:
+  - ansible --version
+  - tests/test.sh
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/jnv.unattended-upgrades/LICENSE

@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

roles/jnv.unattended-upgrades/README.md

@@ -0,0 +1,180 @@
+# Unattended-Upgrades Role for Ansible
+
+[![Build Status of branch master](https://img.shields.io/travis/jnv/ansible-role-unattended-upgrades/master.svg?style=flat-square)](https://travis-ci.org/jnv/ansible-role-unattended-upgrades)
+[![Ansible Role: jnv.unattended-upgrades](https://img.shields.io/ansible/role/8068.svg?style=flat-square)](https://galaxy.ansible.com/jnv/unattended-upgrades/)
+
+Install and setup [unattended-upgrades](https://launchpad.net/unattended-upgrades) for Ubuntu and Debian (since Wheezy), to periodically install security upgrades.
+
+**NOTE:** If you have used version 0.0.1 of the role, you can delete the file `/etc/apt/apt.conf.d/10periodic` as it is not needed anymore. You can use the following one-shot command:
+
+    ansible -m file -a "state=absent path=/etc/apt/apt.conf.d/10periodic" <host-pattern>
+
+## Requirements
+
+The role uses [apt module](http://docs.ansible.com/apt_repository_module.html) which has additional dependencies.
+
+If you set `unattended_mail` to an e-mail address, make sure `mailx` command is available and your system is able to send e-mails.
+
+The role requires unattended-upgrades version 0.70 and newer, which is available since Debian Wheezy and Ubuntu 12.04 respectively. This is due to [Origins Patterns](#origins-patterns) usage; if this is not available on your system, you may use [the first version of the role](https://github.com/jnv/ansible-role-unattended-upgrades/tree/v0.1).
+
+### Automatic Reboot
+
+If you enable automatic reboot feature (`unattended_automatic_reboot`), the role will attempt to install `update-notifier-common` package, which is required on some systems for detecting and executing reboot after the upgrade. You may optionally define a specific time for rebooting (`unattended_automatic_reboot_time`).
+
+This feature was broken in Debian Jessie, but eventually was rolled into the unattended-upgrades package; see [the discussion in #6](https://github.com/jnv/ansible-role-unattended-upgrades/issues/6) for more details.
+
+## Disabled Cron Jobs
+
+On some hosts you may find that the unattended-upgrade's cronfile `/etc/cron.daily/apt` file has been renamed to `apt.disabled`. This is possibly provider's decision, to save some CPU cycles. Use [enable-standard-cronjobs](https://github.com/Yannik/ansible-role-enable-standard-cronjobs) role to reenable unattended-upgrades. See also discussion in [#9](https://github.com/jnv/ansible-role-unattended-upgrades/issues/9).
+
+## Role Variables
+
+* `unattended_cache_valid_time`: Update the apt cache if its older than the given time in seconds; passed to the [apt module](https://docs.ansible.com/ansible/latest/apt_module.html) during package installation.
+    * Default: `3600`
+* `unattended_origins_patterns`: array of origins patterns to determine whether the package can be automatically installed, for more details see [Origins Patterns](#origins-patterns) below.
+    * Default for Debian: `['origin=Debian,codename=${distro_codename},label=Debian-Security']`
+    * Default for Ubuntu: `['origin=Ubuntu,archive=${distro_codename}-security,label=Ubuntu']`
+* `unattended_package_blacklist`: packages which won't be automatically upgraded
+    * Default: `[]`
+* `unattended_autofix_interrupted_dpkg`: whether on unclean dpkg exit to run `dpkg --force-confold --configure -a`
+    * Default: `true`
+* `unattended_minimal_steps`: split the upgrade into the smallest possible chunks so that they can be interrupted with SIGUSR1.
+    * Default: `false`
+* `unattended_install_on_shutdown`: install all unattended-upgrades when the machine is shuting down.
+    * Default: `false`
+* `unattended_mail`: e-mail address to send information about upgrades or problems with unattended upgrades
+    * Default: `false` (don't send any e-mail)
+* `unattended_mail_only_on_error`: send e-mail only on errors, otherwise e-mail will be sent every time there's a package upgrade.
+    * Default: `false`
+* `unattended_remove_unused_dependencies`: do automatic removal of new unused dependencies after the upgrade.
+    * Default: `false`
+* `unattended_automatic_reboot`: Automatically reboot system if any upgraded package requires it, immediately after the upgrade.
+    * Default: `false`
+* `unattended_automatic_reboot_time`: Automatically reboot system if any upgraded package requires it, at the specific time (_HH:MM_) instead of immediately after the upgrade.
+    * Default: `false`
+* `unattended_update_days`: Set the days of the week that updates should be applied. The days can be specified as localized abbreviated or full names. Or as integers where "0" is Sunday, "1" is Monday etc. Example: `{"Mon";"Fri"};`
+    * Default: disabled
+* `unattended_ignore_apps_require_restart`: unattended-upgrades won't automatically upgrade some critical packages requiring restart after an upgrade (i.e. there is `XB-Upgrade-Requires: app-restart` directive in their debian/control file). With this option set to `true`, unattended-upgrades will upgrade these packages regardless of the directive.
+    * Default: `false`
+* `unattended_verbose`: Define verbosity level of APT for periodic runs. The output will be sent to root.
+    * Possible options:
+      * `0`: no report
+      * `1`: progress report
+      * `2`: + command outputs
+      * `3`: + trace on
+    * Default: `0` (no report)
+* `unattended_update_package_list`: Do "apt-get update" automatically every n-days (0=disable)
+    * Default: `1`
+* `unattended_download_upgradeable`: Do "apt-get upgrade --download-only" every n-days (0=disable)
+    * Default: `0`
+* `unattended_autoclean_interval`: Do "apt-get autoclean" every n-days (0=disable)
+    * Default: `7`
+* `unattended_clean_interval`: Do "apt-get clean" every n-days (0=disable)
+    * Default: `0`
+* `unattended_random_sleep`: Define maximum for a random interval in seconds after which the apt job starts (only for systems without systemd)
+    * Default: `1800` (30 minutes)
+* `unattended_dpkg_options`: Array of dpkg command-line options used during unattended-upgrades runs, e.g. `["--force-confdef"]`, `["--force-confold"]`
+    * Default: `[]`
+* `unattended_dl_limit`: Limit the download speed in kb/sec using apt bandwidth limit feature.
+    * Default: disabled
+
+## Origins Patterns
+
+Origins Pattern is a more powerful alternative to the Allowed Origins option used in previous versions of unattended-upgrade.
+
+Pattern is composed from specific keywords:
+
+* `a`,`archive`,`suite` – e.g. `stable`, `trusty-security` (`archive=stable`)
+* `c`,`component`   – e.g. `main`, `crontrib`, `non-free` (`component=main`)
+* `l`,`label` – e.g. `Debian`, `Debian-Security`, `Ubuntu`
+* `o`,`origin` – e.g. `Debian`, `Unofficial Multimedia Packages`, `Ubuntu`
+* `n`,`codename` – e.g. `jessie`, `jessie-updates`, `trusty` (this is only supported with `unattended-upgrades` >= 0.80)
+* `site` – e.g. `http.debian.net`
+
+You can review the available repositories using `apt-cache policy` and debug your choice using `unattended-upgrades -d` command on a target system.
+
+Additionally unattended-upgrades support two macros (variables), derived from `/etc/debian_version`:
+
+* `${distro_id}` – Installed distribution name, e.g. `Debian` or `Ubuntu`.
+* `${distro_codename}` – Installed codename, e.g. `jessie` or `trusty`.
+
+Using `${distro_codename}` should be preferred over using `stable` or `oldstable` as a selected, as once `stable` moves to `oldstable`, no security updates will be installed at all, or worse, package from a newer distro release will be installed by accident. The same goes for upgrading your installation from `oldstable` to `stable`, if you forget to change this in your origin patterns, you may not receive the security updates for your newer distro release. With `${distro_codename}`, both cases can never happen.
+
+## Role Usage Example
+
+Example for Ubuntu, with custom [origins patterns](#patterns-examples), blacklisted packages and e-mail notification:
+
+```yaml
+- hosts: all
+  roles:
+  - role: jnv.unattended-upgrades
+    unattended_origins_patterns:
+    - 'origin=Ubuntu,archive=${distro_codename}-security'
+    - 'o=Ubuntu,a=${distro_codename}-updates'
+    unattended_package_blacklist: [cowsay, vim]
+    unattended_mail: 'root@example.com'
+```
+
+_Note:_ You don't need to specify `unattended_origins_patterns`, the role will use distribution's default if the variable is not set.
+
+### Patterns Examples
+
+By default, only security updates are allowed for both Ubuntu and Debian. You can add more patterns to allow unattended-updates install more packages automatically, however be aware that automated major updates may potentially break your system.
+
+#### For Debian
+
+```yaml
+unattended_origins_patterns:
+  - 'origin=Debian,codename=${distro_codename},label=Debian-Security' # security updates
+  - 'o=Debian,codename=${distro_codename},label=Debian' # updates including non-security updates
+  - 'o=Debian,codename=${distro_codename},a=proposed-updates'
+```
+
+On debian wheezy, due to `unattended-upgrades` being `0.79.5`, you cannot use the `codename` directive.
+
+You will have to do archive based matching instead:
+
+```yaml
+unattended_origins_patterns:
+  - 'origin=Debian,a=stable,label=Debian-Security' # security updates
+  - 'o=Debian,a=stable,l=Debian' # updates including non-security updates
+  - 'o=Debian,a=proposed-updates'
+```
+
+Please be sure to read about the issues regarding this in the origin pattern documentation above.
+
+#### For Ubuntu
+
+In Ubuntu, archive always contains the distribution codename
+
+```yaml
+unattended_origins_patterns:
+  - 'origin=Ubuntu,archive=${distro_codename}-security'
+  - 'o=Ubuntu,a=${distro_codename}'
+  - 'o=Ubuntu,a=${distro_codename}-updates'
+  - 'o=Ubuntu,a=${distro_codename}-proposed-updates'
+```
+
+
+#### For Raspbian
+
+In Raspbian, it is only possible to update all packages from the default repository, including non-security updates, or updating none.
+
+Updating all, including non-security:
+
+```yaml
+unattended_origins_patterns:
+  - 'origin=Raspbian,codename=${distro_codename},label=Raspbian'
+```
+
+You can not use the `codename` directive on raspbian wheezy, the same as with debian wheezy above.
+
+To not install any updates on a raspbian host, just set `unattended_origins_patterns` to an empty list:
+```
+unattended_origins_patterns: []
+```
+
+
+## License
+
+GPLv2