Updating the branch with master

This commit is contained in:
James Tombleson 2019-05-02 14:36:59 -07:00
commit ca3f9b5b68
266 changed files with 8538 additions and 129 deletions

View File

@ -0,0 +1 @@
1556550033

View File

@ -0,0 +1 @@
1001

View File

@ -0,0 +1 @@
96b95408-ffc7-44c3-919f-402645785ccd

View File

@ -0,0 +1 @@
3d922cc5783b466ab28a7ae61cc46639

View File

@ -0,0 +1 @@
/home/jamestombleson/Documents/github/ansible

View File

@ -0,0 +1,9 @@
# This file loads the proper rgloader/loader.rb file that comes packaged
# with Vagrant so that encoded files can properly run with Vagrant.
if ENV["VAGRANT_INSTALLER_EMBEDDED_DIR"]
require File.expand_path(
"rgloader/loader", ENV["VAGRANT_INSTALLER_EMBEDDED_DIR"])
else
raise "Encoded files can't be read outside of the Vagrant installer."
end

View File

@ -65,7 +65,7 @@ local_tmp = ~/.ansible/tmp
# inject_facts_as_vars = True
# additional paths to search for roles in, colon separated
#roles_path = /etc/ansible/roles
roles_path = ./roles/:/etc/ansible/roles
# uncomment this to disable SSH key host checking
#host_key_checking = False
@ -487,4 +487,4 @@ local_tmp = ~/.ansible/tmp
# always = no
# Set how many context lines to show in diff
# context = 3
# context = 3

View File

@ -0,0 +1,16 @@
---
- name: enable
hosts: linux
tasks:
- name: unattended-upgrades
become: true
include_role:
name: jnv.unattended-upgrades
vars:
#unattended_package_blacklist: []
unattended_automatic_reboot: true

View File

@ -0,0 +1,18 @@
-----BEGIN CERTIFICATE-----
MIIC3TCCAcWgAwIBAgIBAjANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDDAdTZW5z
dUNBMB4XDTE5MDQyODE3NTMwMloXDTI0MDQyNjE3NTMwMlowITEOMAwGA1UEAwwF
c2Vuc3UxDzANBgNVBAoMBmNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAMBFLZ/mgAOdKJ2YUkqzjZHKsRyvNxixX9I3LWXJCMfFnWuUOLau5UaE
rS6ZbtO1N4djsi6xSyBhPSu2hjPt9KgniTesaKZDwlLO2HLrOpUpmKPPpLxnBym9
m/nXWaeuTLAnnNtP/wU4Jwvp1u9qMu5tIYdy+hTd5LJSQcfjgrt5ydHzLbwn9UyE
2pcMawEgOaoywY9i6Ofhfsr5hwLkR3/3VS5PfJ2sVsO0Ks2vBW091BaQSwQAarpR
ExMHmTrcHoHtWFI0RiFxZ+MoakL5380VSmzhAs8QPxYWYc3PLndhYt4pH6TLcCOF
LpY8qk6S/acHuWHgdl+GIgyk5jKqnkECAwEAAaMvMC0wCQYDVR0TBAIwADALBgNV
HQ8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQEFBQADggEB
AG/MiB8QHvJlGrF1Xa5UHs/ykFJj1n+JzeniC5p3nApnRmpgi9KNlDZqRXjotuww
uvaDlsRpFp+X4NukUUR8aUUZpwYbIm/wgXJ376Su0nUmpFmCU2TrGkk/cMeqbAen
OYe5WZxsmJnmmkwhHLybrvha/vsCTNV6GY2JcHNhI8R7Uvwna48ueg7/WBQ5oXqZ
zdYXMaFD2ioBFaYZqVifWv+5d1av2VBveX1V5p7ZZ3LHsvNS8/eVWufu5I4mwJI9
GRPakzY0emL9ZBbtsZtsNA7IA6w4l4WeQtu1DHPc2iYO+JwfpeUNVX65ANSicqjC
ibyhYEZs3qI/rb3WPXy6l0I=
-----END CERTIFICATE-----

View File

@ -0,0 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAwEUtn+aAA50onZhSSrONkcqxHK83GLFf0jctZckIx8Wda5Q4
tq7lRoStLplu07U3h2OyLrFLIGE9K7aGM+30qCeJN6xopkPCUs7Ycus6lSmYo8+k
vGcHKb2b+ddZp65MsCec20//BTgnC+nW72oy7m0hh3L6FN3kslJBx+OCu3nJ0fMt
vCf1TITalwxrASA5qjLBj2Lo5+F+yvmHAuRHf/dVLk98naxWw7Qqza8FbT3UFpBL
BABqulETEweZOtwege1YUjRGIXFn4yhqQvnfzRVKbOECzxA/FhZhzc8ud2Fi3ikf
pMtwI4UuljyqTpL9pwe5YeB2X4YiDKTmMqqeQQIDAQABAoIBAFxnovLLa9DQ0jlT
gJFIVAyydoaLqxYiASRdwmK9yIuCbRLL7KnXyncmwri3ouz6lhJqlrMcIDgSo7yD
f2Irxb6fKbJpGO53eEgmAx7P8JrJoANygwDNH0MvTmw31G3jNhYfI6K/gpf2kcWG
//aWep3eMxQO7SPkNMqC//xaWnVQ0FLigNQjyFlgQrIZ3L4x7qFxcrkvTUIODGio
R6hs7fECwXZkvLB28//tiwLEuOHnWGkG64fDebXUBDHsFhY/ObtA9vJITGY2GlUi
1KFt9ZJd1JdMoV7EH5IwnA5YUN1NOtb5bwRaCddCMFH2lWsjzV1hNTZ9MzNyFqIF
eolkKKUCgYEA6xR0LR3/stMPOWvgdaiXACHsH2hLx7Yh1vOf97eBbdUgiqjeL7DW
mUmXIBLOQwrKMWNX0+DAqeuY80ESBmQ5KhRR/Sws2FMXGcqgyNPdJYAruif8y4z9
0fGdvES1Fe12lOzyfPJclJi6doglyTjoJS5KGXUz8womJH4eiWZd+98CgYEA0WFx
SPttK8Oi9zKxh/6YzpvOaABm6pCUslg79smhPGdhj4M0sO1sS4KzOBBolcplT9e6
T1awh7ML44dowIFuQ0FgySnz5ogZt6xnqGv6bbfSVbMNpU4B9O4tJ2z16uFOXDeM
f0tS55fcbspJ1Dylc+ndyAurd5E/8z/2BnU6qd8CgYADs6bAryA/qKMsvE4kjCsU
jXQyamoHEw8lW2DBfdpD6H9Cr7YP+jDm6QnAL4uf8qOMc4wGghuGkXcvHW8zOpDL
4NYJrpBmN6i9dztg7jUlSgdmPwr0CZxVmgBp3osbdUnQvopy/T4H+P+2rh4qNQMy
0q/IBthyk05WdMX2U+5W8QKBgFSBwqpVKBvYyyaAZFziKiSBiA47003q6skMia8y
dAwgIaU9rH+YY/QaHWGMZdnHJZrTFBQ/heJPJoY/ucywsKMeeQTYFOO/nLmgMPou
EpZD8fW63dARKwMDOmBGPv78zpazqNYbvatRhJuGs8OgcprVEjlSVHNewXPZJeA3
YmT7AoGAJuMaSA6oZqn0uKJD0FDwIl4j0RfVhPJHe9Um1G1K2FpZ3DV705kcwx1t
IUu9pHLFJubwpkQFiERX/6BRbjbp4oZhpPLcLRec5nXTT8LHoiCBMaQW2RtnDMeW
XKt2xyhGFp0Drw4vWV0Nr8fJbuBbAqviZTQnBtj7ZJ41KRV1mU4=
-----END RSA PRIVATE KEY-----

View File

@ -0,0 +1,17 @@
-----BEGIN CERTIFICATE-----
MIICxDCCAaygAwIBAgIJAPX7448uFrdyMA0GCSqGSIb3DQEBBQUAMBIxEDAOBgNV
BAMMB1NlbnN1Q0EwHhcNMTkwNDI4MTc1MjU3WhcNMjQwNDI2MTc1MjU3WjASMRAw
DgYDVQQDDAdTZW5zdUNBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
sI4ptnAIEJISxDYMVZIi6vF6GcnzXDyXl4Et9m86QF9+Zyfe4zomGDnfp7wfhddS
6asPHMxcgXi9itY6qr33lzdDL4SaMysS/VwWLBwhmdl2hEELPvUKHBF96iyfuq4A
lsQ3lAXr/3uqXdODNo38hGaxrK2n1ocKFEKZrGlmrFDvfYKJz1cYlDh5u0ghjJGQ
E/MCDeQzGNOjcbSbNUo5nMR8P6nzPcMDHjtA0OS4DXSijvjibHPhZ/NU9KgoTz9W
oL8FoePlL6Zq6cwiEKCOUsqivIPbM3nGGNkPBHmSE0dnYXn0le+LK3rkNX60ZdwE
fqisAIaHSVQWVlTw4J8xlQIDAQABox0wGzAMBgNVHRMEBTADAQH/MAsGA1UdDwQE
AwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAp1MPCS8tKdUGrT07yHosw7+Gxc++/ylM
cmS9GLiwAfU4VU4QEy97ipL4K8VLWbrGVvJSpgxAApLA0jX7R2UcYTYeTk9ikuto
BeQRxcj6QdR8BKD4N7Qtje6jBVMJ6Ssky3Kj1XXcEQu4iZx9uZCX2yeCeozXaLtS
+Tw3r9NjgIXGvhLCp64JTC+rL74S7cMwAIW5YBRy/K4uBdLKBcjYIi7VQnivsfGu
J2+28+kfNw7nNWBdVWtBf6MoJQNEDvpx+HGRBCJoSlgw+GTRgbgCqEPJrXBdbamU
SDJtCEdYonQqUCqqCI083ckx8c31YBg1COTZBQnWQiYVpcIfXG7j/A==
-----END CERTIFICATE-----

View File

@ -0,0 +1,18 @@
-----BEGIN CERTIFICATE-----
MIIC3TCCAcWgAwIBAgIBATANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDDAdTZW5z
dUNBMB4XDTE5MDQyODE3NTI1OVoXDTI0MDQyNjE3NTI1OVowITEOMAwGA1UEAwwF
c2Vuc3UxDzANBgNVBAoMBnNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBALEltlZMg7u1rqFbnljmD+IeiVeRt0zzRiCEpjvQ4t+bBjT5onPAOxYI
Q1d3MdPJqA+lyCRP/sXcEKa1l14UDj50WEruK0VqXKL+e2ETeJi4kJb8k8ansCAI
Ask5Ok2d8bTSQLzJBCkjwvR5kfG49R5wfJFDSA3WLfTHq1myRibJIMgbFGB2UP3Q
yyljZWn04IO72yWhK413CxwnwXKsIFT5/z0hVGZMr5wDWpfhBhtBi6uxqeKG3Zyy
CV/f3yUcOL+A9yoxPu155TNYfvmz1rqarTeuOJJJU7TtAiHmue8OhkfRFanBBYj9
hSOGPdLB9eKzoWsS8vLKLUTwaQwZ9IsCAwEAAaMvMC0wCQYDVR0TBAIwADALBgNV
HQ8EBAMCBSAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQEFBQADggEB
ABPZUxDIGJ6C8hu1aOj5sY/r8yphotSnPVkghBTGVJbjmGHSci+IGbHX6yemVYvH
mQWKI8qBdroiIpCOpMVvmG6oUR4s+h/vdKuDoy/x3lRZjJDQiReAGKwwyeiG++wJ
x6eSCDGqcIWvk72Zgd+OGym3JGrDpU7ofat+ncqtIunAOh7rhQlyRJ42wYZpWDIi
Aass4yn16aYhF/PppUIsBYrWk1UUlKbXOF/Z7WOG4Hg6h5HwwtJZq/PGsSzJqd/O
s6XI8Am1pU9PwLwWm9Vad44OhTNWGxsidboUCxNa7Yc7p5CkAqT+Z2Lf7RfvgmcX
SUCwSN9REpYGV3k9l47eljY=
-----END CERTIFICATE-----

View File

@ -0,0 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAsSW2VkyDu7WuoVueWOYP4h6JV5G3TPNGIISmO9Di35sGNPmi
c8A7FghDV3cx08moD6XIJE/+xdwQprWXXhQOPnRYSu4rRWpcov57YRN4mLiQlvyT
xqewIAgCyTk6TZ3xtNJAvMkEKSPC9HmR8bj1HnB8kUNIDdYt9MerWbJGJskgyBsU
YHZQ/dDLKWNlafTgg7vbJaErjXcLHCfBcqwgVPn/PSFUZkyvnANal+EGG0GLq7Gp
4obdnLIJX9/fJRw4v4D3KjE+7XnlM1h++bPWupqtN644kklTtO0CIea57w6GR9EV
qcEFiP2FI4Y90sH14rOhaxLy8sotRPBpDBn0iwIDAQABAoIBAFtnsiXlZTO+E1V/
CL2mOBvc1dExhvtVq6Gr0Hqc1fO68gDzrjc7wUElElpXToaRTv6D9DmIbVV6r7zV
hj0s7Aydy9EeA4XV0+bmmJMGkPt8gF7oBPhEHkTo3UcnGEZkcQt0UaMXteXkZfvv
nrazUQdb02rA5LT/Bsd/H5MwwbHQyipMXKQXpYyzALhoBUrXItc+aHfINHOELs0h
UPSoFnNSsQo1VGSd/TCZJYYw2cpmeTqWO4sM6z8vYXJnNQTCb2saW+vywfQoYTJ7
V6mSmX7EgYh512jNpNdzhQx8qN1hmWF/r5G9DC4QSnzVoN23fi4H+szB9CEfVlPy
pGj6qUECgYEA1zwPaLjz9XgeZiHrLYDCFeNRYE4Noa9mFuuplYxmiIJGsBiUNHNJ
bbMn8VpuBBptEUnSTCGJhAF39AGKfUHx+49hTKTUISmnTDOSHLeE1mKvZJWB3x4r
3ezfsUVwV4BvidYQEv0FWuE+lniDmx2BVQk7vIiF5VjUxMmyqnB8cEUCgYEA0rLw
LtSYod0VzFLs8NlMH9nhfQk7oSfyxqLVwpiAQVAtrI3xfQUaYP04BrV/XOI+YBcF
Svg4Ou4tqcuGFFYtqNPAaGYfih7UzEY8Z6wH2rkyznCq7VQZexKKtTbPQCNSkJ5h
fpNxfh4sXZSpYg/aIEr6OC8REuhcjRjhJBWJJo8CgYAsPN316j3KMBwfZc1Olu5N
TWGGZ8SJfOGAyIMch7TzTcN1ojej6CYpc+87vhhqo3vTV9bvat020o5zCnYKdKll
yPx4olAvWL5X/SmE2XtmDPZ7t/bvguYFQRBhASKr+Wvzapn3LSYSncUdbDuwgAn7
DmDGyVCr6OwiXkpomaIZ+QKBgCZIpSOdNW6TwVYy6yKIGTDgYfxaJR+PJqm5BKYr
F4LGksX7tJlGyBg/amKtr8qswTCsfiW1HGJ4zItBk8c2MW2vrBJMHAb4uymyyV78
/yBa7kRcbHJbCZY3NEThBJ9ey63DWWuqVsDXsq/+RxiuUK/1b6mtw6hv2AE7OA1a
bGU5AoGBANL+ssYI1JH1TFRwI8iTc/no2Loy2jZ2NGyZbU/gc3NhhVERNgtK8nmM
dcYrgmewKKS20+AqqbM7zITYdJea6RTKU6ELJul2iKMDSwA65cEwueqAT6WY7x57
z0fBzoaLRQp11SSuuPz9p0a096XGygQP1o2SabZCwY4b3+vtkbJM
-----END RSA PRIVATE KEY-----

View File

@ -1,44 +0,0 @@
# This will work on a new install.
# If any changes are needed to the cluster name on an existing install add another function
- name: Config - cluster.name 'elastic-DMI01'
become: true
lineinfile:
path: /etc/elasticsearch/elasticsearch.yml
regex: '^cluster.name'
insertafter: '#cluster.name: my-application'
line: 'cluster.name: elastic-DMI01'
backup: yes
# We define the name of the host we are working on
- name: Config - node.name
become: true
lineinfile:
path: /etc/elasticsearch/elasticsearch.yml
regex: '^node.name'
insertafter: '#node.name: node-1'
line: "node.name: {{ ansible_eno1.ipv4.address }}"
# Allow 9200 so we can access it over the network
- name: Allow port 9200 though UFW
become: true
ufw:
rule: allow
port: 9200
#name: ElasticSearch
- name: Service reload daemon
become: true
systemd:
daemon_reload: yes
- name: systemd - enable ElasticSearch on startup
become: true
systemd:
name: elasticsearch
enabled: yes
- name: systemd - restart ElasticSearch service
become: true
systemd:
name: elasticsearch
state: restarted

View File

@ -1,11 +1,4 @@
---
- name: define kibana host
become: true
lineinfile:
path: /etc/heartbeat/heartbeat.yml
regex: '^host: "dm-nagios.local:5601"'
insertafter: '#host: "localhost:5601"'
line: 'host: "dm-nagios.local:5601"'
- name: systemd - daemon reload
become: true

View File

@ -1,49 +0,0 @@
- name: Config - Server.Port 5601
become: true
lineinfile:
path: /etc/kibana/kibana.yml
regex: '^server.port'
insertafter: '#server.port: 5601'
line: 'server.port: 5601'
backup: yes
- name: Config - Server.host
become: true
lineinfile:
path: /etc/kibana/kibana.yml
regex: '^server.host'
insertafter: '#server.host'
line: 'server.host: {{ ansible_eno1.ipv4.address }}'
- name: Config - elasticsearch.hosts
become: true
lineinfile:
path: /etc/kibana/kibana.yml
regex: '^elasticsearch.hosts'
insertafter: '#elasticsearch.hosts:'
line: 'elasticsearch.hosts: ["http://localhost:9200"]'
- name: Allow port 5601
become: true
ufw:
rule: allow
port: 5601
- name: systemd - daemon reload
become: true
systemd:
daemon_reload: yes
- name: systemd - enable Kibana on startup
become: true
systemd:
name: kibana
enabled: yes
- name: systemd - restart Kibana
become: true
systemd:
name: kibana
state: restarted

View File

@ -1,31 +1,12 @@
# - name: enable modules
- name: define kibana host
- name: enable system module
become: true
lineinfile:
path: /etc/metricbeat/metricbeat.yml
regex: '^host: "dm-nagios.local:5601"'
insertafter: '#host: "localhost:5601"'
line: 'host: "dm-nagios.local:5601"'
#- name: config where to send information
#- name: Remove builtin elasticsearch host config
# become: true
# replace:
#dest: /etc/metricbeat/metricbeat.yml
#regexp: '^hosts: ["localhost:9200"]'
#replace: '#hosts: ["localhost:9200"]'
- name: define elasticsearch host
become: true
lineinfile:
path: /etc/metricbeat/metricbeat.yml
regex: '^hosts: ["localhost:9200"]'
insertafter: 'hosts: ["localhost:9200"]'
line: 'hosts: ["dm-nagios.local:9200"]'
shell: metricbeat modules enable system
#- name: start metricbeat service
# become: true
#shell: metricbeat service metricbeat start
- name: systemd - daemon reload
become: true

View File

@ -0,0 +1,56 @@
---
# This will install all the client parts needed for elastic to monitor client computers
- name: Install elastic client programs
hosts: windows
vars:
elastic_version: '7.0.0'
url_heartbeat: 'https://artifacts.elastic.co/downloads/beats/heartbeat/heartbeat-{{elastic_version}}-windows-x86_64.zip'
temp: 'c:\temp\'
program_files: 'c:\program files\'
kibana_host: '192.168.0.173:5601'
elasticsearch_hosts: '["192.168.0.173:9200"]'
tasks:
- name: make temp folder
win_file:
path: c:\temp\
state: directory
- name: download heartbeat
win_get_url:
url: '{{ url_heartbeat }}'
dest: 'C:\temp\heartbeat-{{ elastic_version }}.zip'
force: no
- name: unzip heartbeat
win_unzip:
src: c:\temp\heartbeat-{{ elastic_version }}.zip
dest: C:\temp\heartbeat-{{ elastic_version }}\
creates: C:\temp\heartbeat-{{ elastic_version }}\
- name: Copy heartbeat-{{ elastic_version }} folder
win_command: powershell.exe copy-item -Path 'c:\temp\heartbeat-{{ elastic_version }}\heartbeat-{{ elastic_version }}-windows-x86_64\' -Filter * -Recurse -Destination 'C:\Program Files\Heartbeat\'
args:
creates: C:\Program Files\Heartbeat\
- name: Update template
win_template:
src: heartbeat.j2
dest: C:\Program Files\Heartbeat\heartbeat.yml
- name: Install Heartbeat service
win_command: powershell.exe -ExecutionPolicy ByPass -File install-service-heartbeat.ps1
args:
chdir: C:\program files\heartbeat\
- name: stop heartbeat service
win_service:
name: heartbeat
state: stopped
- name: start heartbeat service
win_service:
name: heartbeat
state: started

View File

@ -0,0 +1,56 @@
---
# This will install all the client parts needed for elastic to monitor client computers
- name: download metricbeat
win_get_url:
url: '{{ url_metricbeat }}'
dest: 'C:\temp\metricbeat-{{ elastic_version }}.zip'
force: no
- name: unzip heartbeat
win_unzip:
src: c:\temp\metricbeat-{{ elastic_version }}.zip
dest: C:\temp\metricbeat-{{ elastic_version }}\
creates: C:\temp\metricbeat-{{ elastic_version }}\
- name: Copy metricbeat-{{ elastic_version }} folder
win_command: powershell.exe copy-item -Path 'c:\temp\metricbeat-{{ elastic_version }}\metricbeat-{{ elastic_version }}-windows-x86_64\' -Filter * -Recurse -Destination 'C:\Program Files\Metricbeat\'
args:
creates: C:\Program Files\Metricbeat\
- name: Update template
win_template:
src: metricbeat.j2
dest: C:\Program Files\Metricbeat\metricbeat.yml
- name: Check if metricbeat service is installed
register: service_metricbeat
win_service:
name: metricbeat
#- debug: var=service_metricbeat
- name: Install Metricbeat service
win_command: powershell.exe -ExecutionPolicy ByPass -File install-service-metricbeat.ps1
args:
chdir: C:\program files\metricbeat\
when: service_metricbeat.exists == false
- name: check status of metricbeat service
register: service_metricbeat
win_service:
name: metricbeat
#- debug: var=service_metricbeat
- name: restart service
win_service:
name: metricbeat
state: restarted
when: service_metricbeat.state == 'started'
- name: start service
win_service:
name: metricbeat
state: started
when: service_metricbeat.state == 'stopped'

View File

@ -0,0 +1,52 @@
---
# This will install all the client parts needed for elastic to monitor client computers
- name: download winlogbeat
win_get_url:
url: '{{ url_winlogbeat }}'
dest: 'C:\temp\winlogbeat-{{ elastic_version }}.zip'
force: no
- name: unzip winlogbeat
win_unzip:
src: c:\temp\winlogbeat-{{ elastic_version }}.zip
dest: C:\temp\winlogbeat-{{ elastic_version }}\
creates: C:\temp\winlogbeat-{{ elastic_version }}\
- name: Copy winlogbeat-{{ elastic_version }} folder
win_command: powershell.exe copy-item -Path 'c:\temp\winlogbeat-{{ elastic_version }}\winlogbeat-{{ elastic_version }}-windows-x86_64\' -Filter * -Recurse -Destination 'C:\Program Files\winlogbeat\'
args:
creates: C:\Program Files\winlogbeat\
- name: Update template
win_template:
src: winlogbeat.j2
dest: C:\Program Files\winlogbeat\winlogbeat.yml
- name: check for service
register: service
win_service:
name: winlogbeat
- name: Install winlogbeat service
win_command: powershell.exe -ExecutionPolicy ByPass -File install-service-winlogbeat.ps1
args:
chdir: C:\program files\winlogbeat\
when: service.exists == false
- name: check status of service
register: service
win_service:
name: winlogbeat
- name: restart service
win_service:
name: winlogbeat
state: restarted
when: service.state == 'started'
- name: start service
win_service:
name: winlogbeat
state: started
when: service.state == 'stopped'

View File

@ -0,0 +1,168 @@
################### Heartbeat Configuration Example #########################
# This file is an example configuration file highlighting only some common options.
# The heartbeat.reference.yml file in the same directory contains all the supported options
# with detailed comments. You can use it for reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/heartbeat/index.html
############################# Heartbeat ######################################
# Define a directory to load monitor definitions from. Definitions take the form
# of individual yaml files.
heartbeat.config.monitors:
# Directory + glob pattern to search for configuration files
path: ${path.config}/monitors.d/*.yml
# If enabled, heartbeat will periodically check the config.monitors path for changes
reload.enabled: true
# How often to check for changes
reload.period: 5s
# Configure monitors inline
heartbeat.monitors:
- type: http
# List or urls to query
urls: ["http://localhost:9200", "https://www.directorsmortgage.com", "https://www.usadirectfunding.com":]
# Configure task schedule
schedule: '@every 60s'
# Total test connection and data exchange timeout
#timeout: 16s
#==================== Elasticsearch template setting ==========================
setup.template.settings:
index.number_of_shards: 1
index.codec: best_compression
#_source.enabled: false
#================================ General =====================================
# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
name: {{ ansible_hostname }}
# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]
# Optional fields that you can specify to add additional information to the
# output.
#fields:
# env: staging
#============================== Dashboards =====================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here or by using the `setup` command.
setup.dashboards.enabled: true
# The URL from where to download the dashboards archive. By default this URL
# has a value which is computed based on the Beat name and version. For released
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
# website.
#setup.dashboards.url:
#============================== Kibana =====================================
# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:
# Kibana Host
# Scheme and port can be left out and will be set to the default (http and 5601)
# In case you specify and additional path, the scheme is required: http://localhost:5601/path
# IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
host: {{ kibana_host }}
# Kibana Space ID
# ID of the Kibana Space into which the dashboards should be loaded. By default,
# the Default Space will be used.
#space.id:
#============================= Elastic Cloud ==================================
# These settings simplify using heartbeat with the Elastic Cloud (https://cloud.elastic.co/).
# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
# `setup.kibana.host` options.
# You can find the `cloud.id` in the Elastic Cloud web UI.
#cloud.id:
# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
#cloud.auth:
#================================ Outputs =====================================
# Configure what output to use when sending the data collected by the beat.
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: {{ elasticsearch_hosts }}
# Optional protocol and basic auth credentials.
#protocol: "https"
#username: "elastic"
#password: "changeme"
#----------------------------- Logstash output --------------------------------
#output.logstash:
# The Logstash hosts
#hosts: ["localhost:5044"]
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
#================================ Processors =====================================
# Configure processors to enhance or manipulate events generated by the beat.
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
#================================ Logging =====================================
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]
#============================== Xpack Monitoring ===============================
# heartbeat can export internal metrics to a central Elasticsearch monitoring
# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
# reporting is disabled by default.
# Set to true to enable the monitoring reporter.
#xpack.monitoring.enabled: false
# Uncomment to send the metrics to Elasticsearch. Most settings from the
# Elasticsearch output are accepted here as well. Any setting that is not set is
# automatically inherited from the Elasticsearch output configuration, so if you
# have the Elasticsearch output configured, you can simply uncomment the
# following line.
#xpack.monitoring.elasticsearch:
#================================= Migration ==================================
# This allows to enable 6.7 migration aliases
#migration.6_to_7.enabled: true

View File

@ -2,7 +2,10 @@
# This will install all the client parts needed for elastic to monitor client computers
- name: Install elastic client programs
hosts: linux
hosts: elasticClients
vars:
kibana_host: '192.168.0.173:5601'
elasticsearch_hosts: '["192.168.0.173:9200"]'
tasks:
- name: Install elastic repo
@ -11,9 +14,15 @@
- name: Install elastic heartbeat
become: true
apt:
name: heartbeat-elastic
name: heartbeat-elastic
- name: Update Heatbeat config
become: true
template:
src: heartbeat.j2
dest: /etc/heartbeat/heartbeat.yml
- name: Configure elastic heartbeazt
- name: Configure elastic heartbeat
include: config-heartbeat.yml
- name: Install elastic metricbeat
@ -21,5 +30,11 @@
apt:
name: metricbeat
- name: Update Metricbeat config
become: true
template:
src: metricbeat.j2
dest: /etc/metricbeat/metricbeat.yml
- name: Configure elastic metricbeat
include: config-metricbeat.yml

View File

@ -0,0 +1,14 @@
- name: Install Filebeat
hosts: elasticClients
tasks:
- name: Install Filebeat
include_role:
name: luther38.filebeat
vars:
kibana_host: 172.20.0.142:5601
elasticsearch_hosts: "'172.20.0.142:9200'"
systemd_enabled: true
systemd_restart: true

View File

@ -0,0 +1,16 @@
---
- name: Install Metricbeat
hosts: elasticClients
tasks:
- name: Install Metricbeat
become: true
include_role:
name: luther38.metricbeat
vars:
kibana_host: 172.20.0.142
elasticsearch_hosts: '["172.20.0.142:9200"]'
systemd_enable_service: true
systemd_restart_service: true

View File

@ -5,6 +5,18 @@
- name: Install Elastic server programs
hosts: elastic
vars:
es_cluster_name: 'logging-dev'
es_node_name: 'dev-data-01'
es_node_master: 'true'
es_node_data: 'true'
es_path_data: '/var/lib/elasticsearch'
es_path_logs: '/var/log/elasticsearch'
es_http_port: '9200'
es_transport_host: 'localhost'
es_transport_port: '9300'
k_server_port: 5601
k_elasticsearch_hosts: 'http://192.168.0.173:9200'
tasks:
- name: Install Requrements
@ -15,6 +27,12 @@
apt:
name: elasticsearch
- name: Update ElasticSearch config
become: true
template:
src: elasticsearch.j2
dest: /etc/elasticsearch/elasticsearch.yml
- name: Configure ElasticSearch
include: config-elasticsearch.yml
@ -23,5 +41,22 @@
apt:
name: kibana
- name: Configure Kibana
become: true
template:
src: kibana.j2
dest: /etc/kibana/kibana.yml
- name: Configure Kibana
include: config-kibana.yml
- name: Install Heartbeat
become: true
apt:
name: heartbeat
#- name: Install Logstash
#become: true
#apt:
#name: logstash

View File

@ -0,0 +1,27 @@
---
# This will install all the client parts needed for elastic to monitor client computers
- name: Install elastic client programs
hosts: windows
vars:
elastic_version: '7.0.0'
url_heartbeat: 'https://artifacts.elastic.co/downloads/beats/heartbeat/heartbeat-{{elastic_version}}-windows-x86_64.zip'
url_metricbeat: 'https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-7.0.0-windows-x86_64.zip'
url_winlogbeat: 'https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-7.0.0-windows-x86_64.zip'
temp: 'c:\temp\'
program_files: 'c:\program files\'
kibana_host: '192.168.0.173:5601'
elasticsearch_hosts: '["192.168.0.173:9200"]'
tasks:
- name: make temp folder
win_file:
path: c:\temp\
state: directory
- name: Install Metricbeat
include: config-win-metricbeat.yml
- name: Install WinLogbeat
include: config-winlogbeat.yml

View File

@ -0,0 +1,16 @@
---
- name: Install WinLogBeat
hosts: elasticClients
tasks:
- name: Install WinLogBeat
become: true
include_role:
name: luther38.winlogbeat
vars:
version: 7.0.0
kibana_host: 172.20.0.142
elasticsearch_hosts: '["172.20.0.142:9200"]'

View File

@ -0,0 +1,35 @@
- name: testing elastic role
hosts: elastic
tasks:
- name: install/Update Java
become: true
import_role:
name: geerlingguy.java
- name: install elasticsearch
become: true
import_role:
name: elasticsearch
vars:
cluster_name: "loggin-dev"
ufw_http_port: true
ufw_transport_port: true
systemd_enabled: true
systemd_restart: true
node_name: "{{ ansible_hostname }}"
discovery_seed_hosts: "'127.0.0.1', '172.20.0.142', '192.168.0.173'"
cluster_initial_master_nodes: " '172.20.0.142', '192.168.0.173' "
- name: install kibana
become: true
import_role:
name: kibana
vars:
server_port: 5601
ufw_server_port: true
server_host: "{{ ansible_default_ipv4.address }}"
server_name: "{{ ansible_hostname }}"
elasticsearch_hosts: " 'http://localhost:9200', 'http://dm-nagios.local:9200', 'http://172.20.0.142:9200' "

View File

@ -0,0 +1,21 @@
---
- name: install Jenkins
hosts: jenkins
tasks:
- name: Install Java
become: yes
import_role:
name: geerlingguy.java
# https://galaxy.ansible.com/geerlingguy/jenkins
- name: Install Jenkins
become: yes
import_role:
name: geerlingguy.jenkins
vars:
jenkins_package_state: latest
jenkins_http_port: 8080

View File

@ -0,0 +1,19 @@
- name: testing sensu
hosts: linux
tasks:
- name: install sensu server
become: true
import_role:
name: sensu.sensu
vars:
# Sever vars
sensu_deploy_redis_server: true
sensu_deploy_rabbitmq_server: true
sensu_master: true
#sensu_include_plugins: true
sensu_include_dashboard: true
# Client Vars
#sensu_client: true

View File

@ -0,0 +1,44 @@
---
# This will install all the client parts needed for elastic to monitor client computers
- name: Install elastic client programs
hosts: windows
vars:
elastic_version: '7.0.0'
url_heartbeat: 'https://artifacts.elastic.co/downloads/beats/heartbeat/heartbeat-{{elastic_version}}-windows-x86_64.zip'
temp: 'c:\temp\'
program_files: 'c:\program files\'
kibana_host: '192.168.0.173:5601'
elasticsearch_hosts: '["192.168.0.173:9200"]'
tasks:
- name: make temp folder
win_file:
path: c:\temp\
state: directory
- name: download heartbeat
win_get_url:
url: '{{ url_heartbeat }}'
dest: 'C:\temp\heartbeat-{{ elastic_version }}.zip'
force: no
- name: unzip heartbeat
win_unzip:
src: c:\temp\heartbeat-{{ elastic_version }}.zip
dest: C:\temp\heartbeat-{{ elastic_version }}\
creates: C:\temp\heartbeat-{{ elastic_version }}\
- name: Copy heartbeat-{{ elastic_version }} folder
win_command: powershell.exe copy-item -Path 'c:\temp\heartbeat-{{ elastic_version }}\heartbeat-{{ elastic_version }}-windows-x86_64\' -Filter * -Recurse -Destination 'C:\Program Files\Heartbeat\'
args:
creates: C:\Program Files\Heartbeat\
- name: Update template
win_template:
src: heartbeat.j2
dest: C:\Program Files\Heartbeat\heartbeat.yml
- name: Install Heartbeat service
win_command: powershell.exe -ExecutionPolicy ByPass -File 'C:\Program Files\Heartbeat\install-service-heartbeat.ps1'

View File

@ -0,0 +1,96 @@
ElasticSearch
=========
This role will install and configure ElastiSearch on requested servers.
Requirements
------------
No requirements are needed for this role.
Role Variables
--------------
```yaml
cluster_name: 'cluster'
node_name: ''
# https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html
#
node_master: true
node_data: true
path_data: '/var/lib/elasticsearch'
path_logs: '/var/log/elastisearch'
http_port: 9200
### Transport ###
#
#https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-transport.html
#
# The host address to bind the transport service to. Defaults to transport.host (if set) or network.bind_host.
transport_host: 'localhost'
# A bind port range. Defaults to 9300-9400.
transport_port: 9300
#
# Firewall configuration
#
# Allow http_port though UFW
ufw_http_port: false
# Allow transport_port though UFW
ufw_transport_port: false
#
# systemd configuration
#
# Enable ElasticSearch on system startup
systemd_enabled: false
# Restart ElasticSearch after running though playbook
systemd_restart: false
```
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- name: testing elastic role
hosts: elastic
tasks:
- name: Install ElasticSearch
import_role:
name: elasticsearch
vars:
cluster_name: "cookies"
ufw_http_port: true
ufw_transport_port: true
systemd_enabled: true
systemd_restart: true
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

View File

@ -0,0 +1,60 @@
---
# This contains all the variables that can be used in the playbook
cluster_name: 'cluster'
node_name: 'nodeName'
# https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html
#
node_master: true
node_data: true
path_data: '/var/lib/elasticsearch'
path_logs: '/var/log/elastisearch'
http_port: 9200
### Transport ###
#
#https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-transport.html
#
# The host address to bind the transport service to. Defaults to transport.host (if set) or network.bind_host.
transport_host: 'localhost'
# A bind port range. Defaults to 9300-9400.
transport_port: 9300
#
# Discovery
#
# Format data like so " '172.0.0.1', '192.168.0.0' "
discovery_seed_host: "127.0.0.1"
#cluster_initial_master_nodes: ["node-1", "node-2"]
cluster_initial_master_nodes: "'node-1', 'node-2'"
#
# Firewall configuration
#
# Allow http_port though UFW
ufw_http_port: false
# Allow transport_port though UFW
ufw_transport_port: false
#
# systemd configuration
#
# Enable ElasticSearch on system startup
systemd_enabled: false
# Restart ElasticSearch after running though playbook
systemd_restart: false

View File

@ -0,0 +1,2 @@
---
# handlers file for elasticsearch

View File

@ -0,0 +1,60 @@
galaxy_info:
author: your name
description: your description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Some suggested licenses:
# - BSD (default)
# - MIT
# - GPLv2
# - GPLv3
# - Apache
# - CC-BY
license: license (GPLv2, CC-BY, etc)
min_ansible_version: 2.4
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
# Optionally specify the branch Galaxy will use when accessing the GitHub
# repo for this role. During role install, if no tags are available,
# Galaxy will use this branch. During import Galaxy will access files on
# this branch. If Travis integration is configured, only notifications for this
# branch will be accepted. Otherwise, in all cases, the repo's default branch
# (usually master) will be used.
#github_branch:
#
# Provide a list of supported platforms, and for each platform a list of versions.
# If you don't wish to enumerate all versions for a particular platform, use 'all'.
# To view available platforms and versions (or releases), visit:
# https://galaxy.ansible.com/api/v1/platforms/
#
# platforms:
# - name: Fedora
# versions:
# - all
# - 25
# - name: SomePlatform
# versions:
# - all
# - 1.0
# - 7
# - 99.99
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

View File

@ -0,0 +1,29 @@
---
- name: Install Elastic GPG Key
become: true
apt_key:
url: "https://artifacts.elastic.co/GPG-KEY-elasticsearch"
state: present
id: 46095ACC8548582C1A2699A9D27D666CD88E42B4
- name: Install apt-transport-https
become: true
apt:
name: apt-transport-https
- name: Add Elastic Repo
become: true
copy:
dest: '/etc/apt/sources.list.d/elastic-7.x.list'
content: "deb https://artifacts.elastic.co/packages/7.x/apt stable main"
# copy:
#src: elastic-7.x.list
# dest: /etc/apt/sources.list.d/
# backup: yes
- name: Update Packages
become: true
apt:
update_cache: true

View File

@ -0,0 +1,11 @@
---
# tasks file for elasticsearcih
#- name: Test role
#debug: var=cluster_name
- name: Running role - elasticsearch
include: ubuntu.yml
when: ansible_distribution == "Ubuntu"

View File

@ -0,0 +1,44 @@
- name: Add Elastic repo
include: install-repo.yml
- name: Install ElasticSearch from apt
become: true
apt:
name: elasticsearch
- name: Update config
become: true
template:
src: elasticsearch.j2
dest: /etc/elasticsearch/elasticsearch.yml
backup: yes
- name: UFW allow http_port
become: true
when: ufw_http_port == true
ufw:
rule: allow
port: "{{ http_port }}"
- name: UFW allow transport_port
become: true
when: ufw_transport_port == true
ufw:
rule: allow
port: "{{ transport_port }}"
- name: systemd enable elasticsearch
become: true
when: systemd_enabled == true
systemd:
name: elasticsearch
enabled: true
- name: systemd restart elasticsearch
become: true
when: systemd_restart == true
systemd:
name: elasticsearch
state: restarted

View File

@ -0,0 +1,96 @@
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
cluster.name: {{ cluster_name }}
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
node.name: {{ node_name }}
#node.master: {{ node_master }}
#node.data: {{ node_data }}
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: {{ path_data }}
#
# Path to log files:
#
path.logs: {{ path_logs }}
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: {{ ansible_default_ipv4.address }}
#
# Set a custom port for HTTP:
#
http.port: {{ http_port }}
#transport.host: {{ transport_host }}
transport.tcp.port: {{ transport_port }}
#
# For more information, consult the network module documentation.#
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
{{ discovery_seed_hosts_def }}
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1", "node-2"]
cluster.initial_master_nodes: [ {{ cluster_initial_master_nodes }} ]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true

View File

@ -0,0 +1,2 @@
localhost

View File

@ -0,0 +1,5 @@
---
- hosts: localhost
remote_user: root
roles:
- elasticsearch

View File

@ -0,0 +1,27 @@
---
# configuration for elasticsearch.yml
#
# Defines the name of the cluster we are going to deploy to
cluster_name: 'Elastic-Cluster'
# Defines the name of the node
node_name: 'hostname'
node_master: true
node_data: true
path_data: '/var/lib/elasticsearch'
path_logs: '/var/lib/elasticsearch'
http_port: 9200
transport_host: localhost
transport_tcp_port: 9300
discovery_seed_hosts: 172.0.0.1
discovery_seed_hosts_def: "discovery.seed_hosts: [ {{ discovery_seed_hosts }} ]"

3
roles/geerlingguy.java/.gitignore vendored Normal file
View File

@ -0,0 +1,3 @@
*.retry
*/__pycache__
*.pyc

View File

@ -0,0 +1,32 @@
---
language: python
services: docker
env:
global:
- ROLE_NAME: java
matrix:
- MOLECULE_DISTRO: centos7
- MOLECULE_DISTRO: centos6
- MOLECULE_DISTRO: fedora27
- MOLECULE_DISTRO: ubuntu1804
- MOLECULE_DISTRO: ubuntu1604
- MOLECULE_DISTRO: debian9
- MOLECULE_DISTRO: debian8
install:
# Install test dependencies.
- pip install molecule docker
before_script:
# Use actual Ansible Galaxy role name for the project directory.
- cd ../
- mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
- cd geerlingguy.$ROLE_NAME
script:
# Run tests.
- molecule test
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

View File

@ -0,0 +1,20 @@
The MIT License (MIT)
Copyright (c) 2017 Jeff Geerling
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

View File

@ -0,0 +1,67 @@
# Ansible Role: Java
[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-java.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-java)
Installs Java for RedHat/CentOS and Debian/Ubuntu linux servers.
## Requirements
None.
## Role Variables
Available variables are listed below, along with default values:
# The defaults provided by this role are specific to each distribution.
java_packages:
- java-1.7.0-openjdk
Set the version/development kit of Java to install, along with any other necessary Java packages. Some other options include are included in the distribution-specific files in this role's 'defaults' folder.
java_home: ""
If set, the role will set the global environment variable `JAVA_HOME` to this value.
## Dependencies
None.
## Example Playbook (using default package, usually OpenJDK 7)
- hosts: servers
roles:
- role: geerlingguy.java
become: yes
## Example Playbook (install OpenJDK 8)
For RHEL / CentOS:
- hosts: server
roles:
- role: geerlingguy.java
when: "ansible_os_family == 'RedHat'"
java_packages:
- java-1.8.0-openjdk
For Ubuntu < 16.04:
- hosts: server
tasks:
- name: installing repo for Java 8 in Ubuntu
apt_repository: repo='ppa:openjdk-r/ppa'
- hosts: server
roles:
- role: geerlingguy.java
when: "ansible_os_family == 'Debian'"
java_packages:
- openjdk-8-jdk
## License
MIT / BSD
## Author Information
This role was created in 2014 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

View File

@ -0,0 +1,6 @@
---
# Set java_packages if you would like to use a different version than the
# default (OpenJDK 1.7).
# java_packages: []
java_home: ""

View File

@ -0,0 +1,2 @@
install_date: Mon Apr 29 14:19:43 2019
version: 1.9.5

View File

@ -0,0 +1,39 @@
---
dependencies: []
galaxy_info:
author: geerlingguy
description: Java for Linux
company: "Midwestern Mac, LLC"
license: "license (BSD, MIT)"
min_ansible_version: 2.4
platforms:
- name: EL
versions:
- 6
- 7
- name: Fedora
versions:
- all
- name: Debian
versions:
- wheezy
- jessie
- stretch
- name: Ubuntu
versions:
- precise
- trusty
- xenial
- bionic
- name: FreeBSD
versions:
- 10.2
galaxy_tags:
- development
- system
- web
- java
- jdk
- openjdk
- oracle

View File

@ -0,0 +1,29 @@
---
dependency:
name: galaxy
driver:
name: docker
lint:
name: yamllint
options:
config-file: molecule/default/yaml-lint.yml
platforms:
- name: instance
image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
command: ${MOLECULE_DOCKER_COMMAND:-""}
volumes:
- /sys/fs/cgroup:/sys/fs/cgroup:ro
privileged: true
pre_build_image: true
provisioner:
name: ansible
lint:
name: ansible-lint
playbooks:
converge: ${MOLECULE_PLAYBOOK:-playbook.yml}
scenario:
name: default
verifier:
name: testinfra
lint:
name: flake8

View File

@ -0,0 +1,13 @@
---
- name: Converge
hosts: all
become: true
pre_tasks:
- name: Update apt cache.
apt: update_cache=true cache_valid_time=600
when: ansible_os_family == 'Debian'
changed_when: false
roles:
- role: geerlingguy.java

View File

@ -0,0 +1,14 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_hosts_file(host):
f = host.file('/etc/hosts')
assert f.exists
assert f.user == 'root'
assert f.group == 'root'

View File

@ -0,0 +1,6 @@
---
extends: default
rules:
line-length:
max: 120
level: warning

View File

@ -0,0 +1,41 @@
---
- name: Include OS-specific variables for Fedora or FreeBSD.
include_vars: "{{ ansible_distribution }}.yml"
when: ansible_distribution == 'FreeBSD' or ansible_distribution == 'Fedora'
- name: Include version-specific variables for CentOS/RHEL.
include_vars: "RedHat-{{ ansible_distribution_version.split('.')[0] }}.yml"
when: ansible_distribution == 'CentOS' or
ansible_distribution == 'Red Hat Enterprise Linux' or
ansible_distribution == 'RedHat'
- name: Include version-specific variables for Ubuntu.
include_vars: "{{ ansible_distribution }}-{{ ansible_distribution_version.split('.')[0] }}.yml"
when: ansible_distribution == 'Ubuntu'
- name: Include version-specific variables for Debian.
include_vars: "{{ ansible_distribution|title }}-{{ ansible_distribution_version.split('.')[0] }}.yml"
when: ansible_os_family == 'Debian'
- name: Define java_packages.
set_fact:
java_packages: "{{ __java_packages | list }}"
when: java_packages is not defined
# Setup/install tasks.
- include_tasks: setup-RedHat.yml
when: ansible_os_family == 'RedHat'
- include_tasks: setup-Debian.yml
when: ansible_os_family == 'Debian'
- include_tasks: setup-FreeBSD.yml
when: ansible_os_family == 'FreeBSD'
# Environment setup.
- name: Set JAVA_HOME if configured.
template:
src: java_home.sh.j2
dest: /etc/profile.d/java_home.sh
mode: 0644
when: java_home is defined and java_home

View File

@ -0,0 +1,16 @@
---
# See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863199 and
# https://github.com/geerlingguy/ansible-role-java/issues/64
- name: Ensure 'man' directory exists.
file:
path: /usr/share/man/man1
state: directory
recurse: true
when:
- ansible_distribution == 'Ubuntu'
- ansible_distribution_version == '18.04'
- name: Ensure Java is installed.
apt:
name: "{{ java_packages }}"
state: present

View File

@ -0,0 +1,11 @@
---
- name: Ensure Java is installed.
pkgng:
name: "{{ java_packages }}"
state: present
- name: ensure proc is mounted
mount: name=/proc fstype=procfs src=proc opts=rw state=mounted
- name: ensure fdesc is mounted
mount: name=/dev/fd fstype=fdescfs src=fdesc opts=rw state=mounted

View File

@ -0,0 +1,5 @@
---
- name: Ensure Java is installed.
package:
name: "{{ java_packages }}"
state: present

View File

@ -0,0 +1 @@
export JAVA_HOME={{ java_home }}

View File

@ -0,0 +1,7 @@
---
# JDK version options include:
# - java
# - openjdk-6-jdk
# - openjdk-7-jdk
__java_packages:
- openjdk-7-jdk

View File

@ -0,0 +1,6 @@
---
# JDK version options include:
# - java
# - openjdk-8-jdk
__java_packages:
- openjdk-8-jdk

View File

@ -0,0 +1,6 @@
---
# JDK version options include:
# - java
# - java-1.8.0-openjdk
__java_packages:
- java-1.8.0-openjdk

View File

@ -0,0 +1,7 @@
---
# JDK version options for FreeBSD include:
# - openjdk
# - openjdk6
# - openjdk8
__java_packages:
- openjdk

View File

@ -0,0 +1,7 @@
---
# JDK version options include:
# - java
# - java-1.6.0-openjdk
# - java-1.7.0-openjdk
__java_packages:
- java-1.7.0-openjdk

View File

@ -0,0 +1,8 @@
---
# JDK version options include:
# - java
# - java-1.6.0-openjdk
# - java-1.7.0-openjdk
# - java-1.8.0-openjdk
__java_packages:
- java-1.8.0-openjdk

View File

@ -0,0 +1,7 @@
---
# JDK version options include:
# - java
# - openjdk-6-jdk
# - openjdk-7-jdk
__java_packages:
- openjdk-7-jdk

View File

@ -0,0 +1,7 @@
---
# JDK version options include:
# - java
# - openjdk-6-jdk
# - openjdk-7-jdk
__java_packages:
- openjdk-7-jdk

View File

@ -0,0 +1,7 @@
---
# JDK version options include:
# - java
# - openjdk-8-jdk
# - openjdk-9-jdk
__java_packages:
- openjdk-8-jdk

View File

@ -0,0 +1,6 @@
---
# JDK version options include:
# - java
# - openjdk-11-jdk
__java_packages:
- openjdk-11-jdk

View File

@ -0,0 +1,2 @@
skip_list:
- '602'

3
roles/geerlingguy.jenkins/.gitignore vendored Normal file
View File

@ -0,0 +1,3 @@
*.retry
*/__pycache__
*.pyc

View File

@ -0,0 +1,43 @@
---
language: python
services: docker
env:
global:
- ROLE_NAME: jenkins
matrix:
# Test defaults.
- MOLECULE_DISTRO: centos7
- MOLECULE_DISTRO: ubuntu1804
- MOLECULE_DISTRO: ubuntu1604
- MOLECULE_DISTRO: debian9
# Test other role features.
- MOLECULE_DISTRO: ubuntu1804
MOLECULE_PLAYBOOK: playbook-http-port.yml
- MOLECULE_DISTRO: ubuntu1804
MOLECULE_PLAYBOOK: playbook-prefix.yml
- MOLECULE_DISTRO: centos7
MOLECULE_PLAYBOOK: playbook-jenkins-version.yml
- MOLECULE_DISTRO: ubuntu1804
MOLECULE_PLAYBOOK: playbook-plugins-with-home.yml
install:
# Install test dependencies.
- pip install molecule docker
before_script:
# Use actual Ansible Galaxy role name for the project directory.
- cd ../
- mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
- cd geerlingguy.$ROLE_NAME
script:
# Run tests.
- molecule test
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

View File

@ -0,0 +1,20 @@
The MIT License (MIT)
Copyright (c) 2017 Jeff Geerling
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

View File

@ -0,0 +1,135 @@
# Ansible Role: Jenkins CI
[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-jenkins.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-jenkins)
Installs Jenkins CI on RHEL/CentOS and Debian/Ubuntu servers.
## Requirements
Requires `curl` to be installed on the server. Also, newer versions of Jenkins require Java 8+ (see the test playbooks inside the `tests/` directory for an example of how to use newer versions of Java for your OS).
## Role Variables
Available variables are listed below, along with default values (see `defaults/main.yml`):
jenkins_package_state: present
The state of the `jenkins` package install. By default this role installs Jenkins but will not upgrade Jenkins (when using package-based installs). If you want to always update to the latest version, change this to `latest`.
jenkins_hostname: localhost
The system hostname; usually `localhost` works fine. This will be used during setup to communicate with the running Jenkins instance via HTTP requests.
jenkins_home: /var/lib/jenkins
The Jenkins home directory which, amongst others, is being used for storing artifacts, workspaces and plugins. This variable allows you to override the default `/var/lib/jenkins` location.
jenkins_http_port: 8080
The HTTP port for Jenkins' web interface.
jenkins_admin_username: admin
jenkins_admin_password: admin
Default admin account credentials which will be created the first time Jenkins is installed.
jenkins_admin_password_file: ""
Default admin password file which will be created the first time Jenkins is installed as /var/lib/jenkins/secrets/initialAdminPassword
jenkins_jar_location: /opt/jenkins-cli.jar
The location at which the `jenkins-cli.jar` jarfile will be kept. This is used for communicating with Jenkins via the CLI.
jenkins_plugins: []
Jenkins plugins to be installed automatically during provisioning.
jenkins_plugins_install_dependencies: true
Whether Jenkins plugins to be installed should also install any plugin dependencies.
jenkins_plugins_state: present
Use `latest` to ensure all plugins are running the most up-to-date version.
jenkins_plugin_updates_expiration: 86400
Number of seconds after which a new copy of the update-center.json file is downloaded. Set it to 0 if no cache file should be used.
jenkins_updates_url: "https://updates.jenkins.io"
The URL to use for Jenkins plugin updates and update-center information.
jenkins_plugin_timeout: 30
The server connection timeout, in seconds, when installing Jenkins plugins.
jenkins_version: "1.644"
jenkins_pkg_url: "http://www.example.com"
(Optional) Then Jenkins version can be pinned to any version available on `http://pkg.jenkins-ci.org/debian/` (Debian/Ubuntu) or `http://pkg.jenkins-ci.org/redhat/` (RHEL/CentOS). If the Jenkins version you need is not available in the default package URLs, you can override the URL with your own; set `jenkins_pkg_url` (_Note_: the role depends on the same naming convention that `http://pkg.jenkins-ci.org/` uses).
jenkins_url_prefix: ""
Used for setting a URL prefix for your Jenkins installation. The option is added as `--prefix={{ jenkins_url_prefix }}` to the Jenkins initialization `java` invocation, so you can access the installation at a path like `http://www.example.com{{ jenkins_url_prefix }}`. Make sure you start the prefix with a `/` (e.g. `/jenkins`).
jenkins_connection_delay: 5
jenkins_connection_retries: 60
Amount of time and number of times to wait when connecting to Jenkins after initial startup, to verify that Jenkins is running. Total time to wait = `delay` * `retries`, so by default this role will wait up to 300 seconds before timing out.
# For RedHat/CentOS (role default):
jenkins_repo_url: http://pkg.jenkins-ci.org/redhat/jenkins.repo
jenkins_repo_key_url: http://pkg.jenkins-ci.org/redhat/jenkins-ci.org.key
# For Debian (role default):
jenkins_repo_url: deb http://pkg.jenkins-ci.org/debian binary/
jenkins_repo_key_url: http://pkg.jenkins-ci.org/debian/jenkins-ci.org.key
This role will install the latest version of Jenkins by default (using the official repositories as listed above). You can override these variables (use the correct set for your platform) to install the current LTS version instead:
# For RedHat/CentOS LTS:
jenkins_repo_url: http://pkg.jenkins-ci.org/redhat-stable/jenkins.repo
jenkins_repo_key_url: http://pkg.jenkins-ci.org/redhat-stable/jenkins-ci.org.key
# For Debian/Ubuntu LTS:
jenkins_repo_url: deb http://pkg.jenkins-ci.org/debian-stable binary/
jenkins_repo_key_url: http://pkg.jenkins-ci.org/debian-stable/jenkins-ci.org.key
It is also possible stop the repo file being added by setting `jenkins_repo_url = ''`. This is useful if, for example, you sign your own packages or run internal package management (e.g. Spacewalk).
jenkins_java_options: "-Djenkins.install.runSetupWizard=false"
Extra Java options for the Jenkins launch command configured in the init file can be set with the var `jenkins_java_options`. For example, if you want to configure the timezone Jenkins uses, add `-Dorg.apache.commons.jelly.tags.fmt.timeZone=America/New_York`. By default, the option to disable the Jenkins 2.0 setup wizard is added.
jenkins_init_changes:
- option: "JENKINS_ARGS"
value: "--prefix={{ jenkins_url_prefix }}"
- option: "JENKINS_JAVA_OPTIONS"
value: "{{ jenkins_java_options }}"
Changes made to the Jenkins init script; the default set of changes set the configured URL prefix and add in configured Java options for Jenkins' startup. You can add other option/value pairs if you need to set other options for the Jenkins init file.
## Dependencies
- geerlingguy.java
## Example Playbook
```yaml
- hosts: jenkins
vars:
jenkins_hostname: jenkins.example.com
roles:
- role: geerlingguy.java
become: yes
- role: geerlingguy.jenkins
become: yes
```
## License
MIT (Expat) / BSD
## Author Information
This role was created in 2014 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

View File

@ -0,0 +1,37 @@
---
# Optional method of pinning a specific version of Jenkins and/or overriding the
# default Jenkins packaging URL.
# jenkins_version: "1.644"
# jenkins_pkg_url: "https://www.example.com"
# Change this to `latest` to update Jenkins if a newer version is available.
jenkins_package_state: present
jenkins_connection_delay: 5
jenkins_connection_retries: 60
jenkins_home: /var/lib/jenkins
jenkins_hostname: localhost
jenkins_http_port: 8080
jenkins_jar_location: /opt/jenkins-cli.jar
jenkins_url_prefix: ""
jenkins_java_options: "-Djenkins.install.runSetupWizard=false"
jenkins_plugins: []
jenkins_plugins_state: present
jenkins_plugin_updates_expiration: 86400
jenkins_plugin_timeout: 30
jenkins_plugins_install_dependencies: true
jenkins_updates_url: "https://updates.jenkins.io"
jenkins_admin_username: admin
jenkins_admin_password: admin
jenkins_admin_password_file: ""
jenkins_process_user: jenkins
jenkins_process_group: "{{ jenkins_process_user }}"
jenkins_init_changes:
- option: "JENKINS_ARGS"
value: "--prefix={{ jenkins_url_prefix }}"
- option: "{{ jenkins_java_options_env_var }}"
value: "{{ jenkins_java_options }}"

View File

@ -0,0 +1,12 @@
---
- name: restart jenkins
service: name=jenkins state=restarted
- name: configure default users
template:
src: basic-security.groovy.j2
dest: "{{ jenkins_home }}/init.groovy.d/basic-security.groovy"
owner: "{{ jenkins_process_user }}"
group: "{{ jenkins_process_group }}"
mode: 0775
register: jenkins_users_config

View File

@ -0,0 +1,2 @@
install_date: Mon Apr 29 14:19:40 2019
version: 3.7.0

View File

@ -0,0 +1,29 @@
---
dependencies:
- geerlingguy.java
galaxy_info:
author: geerlingguy
description: Jenkins CI
company: "Midwestern Mac, LLC"
license: "license (BSD, MIT)"
min_ansible_version: 2.4
platforms:
- name: EL
versions:
- 6
- 7
- name: Fedora
versions:
- all
- name: Debian
versions:
- all
- name: Ubuntu
versions:
- all
galaxy_tags:
- development
- packaging
- jenkins
- ci

View File

@ -0,0 +1,51 @@
---
# Ubuntu.
- name: Add repository for OpenJDK 8 (Ubuntu 14).
apt_repository: repo='ppa:openjdk-r/ppa'
when:
- ansible_distribution == "Ubuntu"
- ansible_distribution_version == "14.04"
# Debian.
- name: Enable Backports repository (Debian 8).
apt_repository:
repo: 'deb http://ftp.debian.org/debian {{ ansible_distribution_release }}-backports main'
state: present
filename: "{{ ansible_distribution_release }}_backports"
when: ansible_distribution == "Debian"
- name: Update apt cache.
apt: update_cache=yes cache_valid_time=600
when: ansible_os_family == 'Debian'
changed_when: false
# See: http://unix.stackexchange.com/a/342469
- name: Install dependencies.
apt:
default_release: "{{ ansible_distribution_release }}-backports"
name:
- openjdk-8-jre-headless
- ca-certificates-java
state: present
when: ansible_distribution == "Debian"
# Red Hat.
- name: Set the java_packages variable (RedHat).
set_fact:
java_packages:
- java-1.8.0-openjdk
when: ansible_os_family == 'RedHat'
# Ubuntu.
- name: Set the java_packages variable (Ubuntu).
set_fact:
java_packages:
- openjdk-8-jdk
when: ansible_distribution == 'Ubuntu'
# Debian.
- name: Set the java_packages variable (Debian).
set_fact:
java_packages:
- openjdk-8-jdk
when: ansible_distribution == 'Debian'

View File

@ -0,0 +1,29 @@
---
dependency:
name: galaxy
driver:
name: docker
lint:
name: yamllint
options:
config-file: molecule/default/yaml-lint.yml
platforms:
- name: instance
image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
command: ${MOLECULE_DOCKER_COMMAND:-""}
volumes:
- /sys/fs/cgroup:/sys/fs/cgroup:ro
privileged: true
pre_build_image: true
provisioner:
name: ansible
lint:
name: ansible-lint
playbooks:
converge: ${MOLECULE_PLAYBOOK:-playbook.yml}
scenario:
name: default
verifier:
name: testinfra
lint:
name: flake8

View File

@ -0,0 +1,24 @@
---
- name: Converge
hosts: all
become: true
vars:
jenkins_http_port: 8081
pre_tasks:
- include_tasks: java-8.yml
roles:
- geerlingguy.java
- geerlingguy.jenkins
post_tasks:
- name: Ensure Jenkins is running on the specified port.
uri:
url: "http://127.0.0.1:{{ jenkins_http_port }}"
status_code: 200
register: result
until: result.status == 200
retries: 60
delay: 1

View File

@ -0,0 +1,27 @@
---
- name: Converge
hosts: all
become: true
vars:
jenkins_version: "1.644"
roles:
- geerlingguy.java
- geerlingguy.jenkins
post_tasks:
- name: Check installed version of Jenkins.
command: rpm -q jenkins
args:
warn: false
changed_when: false
register: jenkins_rpm_version
tags: ['skip_ansible_lint']
- name: Print installed Jenkins package information.
debug: var=jenkins_rpm_version
- name: Fail if version doesn't match what we wanted.
fail:
when: "jenkins_version not in jenkins_rpm_version.stdout"

View File

@ -0,0 +1,52 @@
---
- name: Converge
hosts: all
become: true
vars:
jenkins_plugins:
- ghprb
- greenballs
jenkins_home: /tmp/jenkins
jenkins_plugin_timeout: 120
pre_tasks:
- include_tasks: java-8.yml
roles:
- geerlingguy.java
- geerlingguy.jenkins
post_tasks:
- name: Verify JENKINS_HOME is correct.
stat:
path: "{{ jenkins_home }}/config.xml"
register: jenkins_home_config
- name: Fail if Jenkins config file doesn't exist.
fail:
when: not jenkins_home_config.stat.exists
- name: List plugins directory contents.
command: "ls {{ jenkins_home }}/plugins"
register: plugins_contents
changed_when: false
tags: ['skip_ansible_lint']
- name: Verify greenballs plugin exists.
stat:
path: "{{ jenkins_home }}/plugins/greenballs.jpi"
register: greenballs_plugin
- name: Fail if greenballs plugin file doesn't exist.
fail:
when: not greenballs_plugin.stat.exists
- name: Ensure Jenkins is running.
uri:
url: "http://127.0.0.1:8080/"
status_code: 200
register: result
until: result.status == 200
retries: 60
delay: 1

View File

@ -0,0 +1,24 @@
---
- name: Converge
hosts: all
become: true
vars:
jenkins_url_prefix: /jenkins
pre_tasks:
- include_tasks: java-8.yml
roles:
- geerlingguy.java
- geerlingguy.jenkins
post_tasks:
- name: Ensure Jenkins is running with the specified prefix.
uri:
url: "http://127.0.0.1:8080{{ jenkins_url_prefix }}"
status_code: 200
register: result
until: result.status == 200
retries: 60
delay: 1

View File

@ -0,0 +1,16 @@
---
- name: Converge
hosts: all
become: true
pre_tasks:
- include_tasks: java-8.yml
roles:
- role: geerlingguy.java
- role: geerlingguy.jenkins
post_tasks:
- name: Check if Jenkins is running.
uri:
url: "http://127.0.0.1:8080/"

View File

@ -0,0 +1,2 @@
---
- src: geerlingguy.java

View File

@ -0,0 +1,6 @@
---
extends: default
rules:
line-length:
max: 150
level: warning

View File

@ -0,0 +1,66 @@
---
# Variable setup.
- name: Include OS-Specific variables
include_vars: "{{ ansible_os_family }}.yml"
- name: Define jenkins_repo_url
set_fact:
jenkins_repo_url: "{{ __jenkins_repo_url }}"
when: jenkins_repo_url is not defined
- name: Define jenkins_repo_key_url
set_fact:
jenkins_repo_key_url: "{{ __jenkins_repo_key_url }}"
when: jenkins_repo_key_url is not defined
- name: Define jenkins_pkg_url
set_fact:
jenkins_pkg_url: "{{ __jenkins_pkg_url }}"
when: jenkins_pkg_url is not defined
# Setup/install tasks.
- include_tasks: setup-RedHat.yml
when: ansible_os_family == 'RedHat'
- include_tasks: setup-Debian.yml
when: ansible_os_family == 'Debian'
# Configure Jenkins init settings.
- include_tasks: settings.yml
# Make sure Jenkins starts, then configure Jenkins.
- name: Ensure Jenkins is started and runs on startup.
service: name=jenkins state=started enabled=yes
- name: Wait for Jenkins to start up before proceeding.
command: >
curl -D - --silent --max-time 5 http://{{ jenkins_hostname }}:{{ jenkins_http_port }}{{ jenkins_url_prefix }}/cli/
args:
warn: false
register: result
until: >
(result.stdout.find("403 Forbidden") != -1)
or (result.stdout.find("200 OK") != -1)
and (result.stdout.find("Please wait while") == -1)
retries: "{{ jenkins_connection_retries }}"
delay: "{{ jenkins_connection_delay }}"
changed_when: false
check_mode: false
- name: Get the jenkins-cli jarfile from the Jenkins server.
get_url:
url: "http://{{ jenkins_hostname }}:{{ jenkins_http_port }}{{ jenkins_url_prefix }}/jnlpJars/jenkins-cli.jar"
dest: "{{ jenkins_jar_location }}"
register: jarfile_get
until: "'OK' in jarfile_get.msg or '304' in jarfile_get.msg or 'file already exists' in jarfile_get.msg"
retries: 5
delay: 10
check_mode: false
- name: Remove Jenkins security init scripts after first startup.
file:
path: "{{ jenkins_home }}/init.groovy.d/basic-security.groovy"
state: absent
# Update Jenkins and install configured plugins.
- include_tasks: plugins.yml

View File

@ -0,0 +1,61 @@
---
# jenkins_plugin module doesn't support password files.
- name: Get Jenkins admin password from file.
slurp:
src: "{{ jenkins_admin_password_file }}"
register: adminpasswordfile
no_log: true
when: jenkins_admin_password_file != ""
tags: ['skip_ansible_lint']
- name: Set Jenkins admin password fact.
set_fact:
jenkins_admin_password: "{{ adminpasswordfile['stdout'] | default(jenkins_admin_password) }}"
no_log: true
# Update Jenkins so that plugin updates don't fail.
- name: Create Jenkins updates directory.
file:
path: "{{ jenkins_home }}/updates"
state: directory
owner: jenkins
group: jenkins
- name: Download current plugin updates from Jenkins update site.
get_url:
url: "{{ jenkins_updates_url }}/update-center.json"
dest: "{{ jenkins_home }}/updates/default.json"
owner: jenkins
group: jenkins
mode: 0440
changed_when: false
register: get_result
until: get_result is success
retries: 3
delay: 2
- name: Remove first and last line from json file.
replace:
path: "{{ jenkins_home }}/updates/default.json"
regexp: "1d;$d"
- name: Install Jenkins plugins using password.
jenkins_plugin:
name: "{{ item }}"
jenkins_home: "{{ jenkins_home }}"
url_username: "{{ jenkins_admin_username }}"
url_password: "{{ jenkins_admin_password }}"
state: "{{ jenkins_plugins_state }}"
timeout: "{{ jenkins_plugin_timeout }}"
updates_expiration: "{{ jenkins_plugin_updates_expiration }}"
updates_url: "{{ jenkins_updates_url }}"
url: "http://{{ jenkins_hostname }}:{{ jenkins_http_port }}{{ jenkins_url_prefix }}"
with_dependencies: "{{ jenkins_plugins_install_dependencies }}"
with_items: "{{ jenkins_plugins }}"
when: jenkins_admin_password != ""
notify: restart jenkins
tags: ['skip_ansible_lint']
register: plugin_result
until: plugin_result is success
retries: 3
delay: 2

View File

@ -0,0 +1,69 @@
---
- name: Check if jenkins_init_file exists.
stat:
path: "{{ jenkins_init_file }}"
register: jenkins_init_file_stat
- name: Ensure jenkins_init_file exists.
file:
path: "{{ jenkins_init_file }}"
state: touch
when: not jenkins_init_file_stat.stat.exists
- name: Modify variables in init file.
lineinfile:
dest: "{{ jenkins_init_file }}"
insertafter: '^{{ item.option }}='
regexp: '^{{ item.option }}=\"\${{ item.option }} '
line: '{{ item.option }}="${{ item.option }} {{ item.value }}"'
state: present
with_items: "{{ jenkins_init_changes }}"
register: jenkins_init_prefix
- name: Set the Jenkins home directory.
lineinfile:
dest: "{{ jenkins_init_file }}"
regexp: '^JENKINS_HOME=.*'
line: 'JENKINS_HOME={{ jenkins_home }}'
register: jenkins_home_config
- name: Immediately restart Jenkins on init config changes.
service: name=jenkins state=restarted
when: jenkins_init_prefix.changed
tags: ['skip_ansible_lint']
- name: Set HTTP port in Jenkins config.
lineinfile:
backrefs: true
dest: "{{ jenkins_init_file }}"
regexp: '^{{ jenkins_http_port_param }}='
line: '{{ jenkins_http_port_param }}={{ jenkins_http_port }}'
register: jenkins_http_config
- name: Ensure jenkins_home {{ jenkins_home }} exists
file:
path: "{{ jenkins_home }}"
state: directory
owner: jenkins
group: jenkins
mode: u+rwx
follow: true
- name: Create custom init scripts directory.
file:
path: "{{ jenkins_home }}/init.groovy.d"
state: directory
owner: "{{ jenkins_process_user }}"
group: "{{ jenkins_process_group }}"
mode: 0775
- name: Trigger handlers immediately in case Jenkins was installed
meta: flush_handlers
- name: Immediately restart Jenkins on http or user changes.
service: name=jenkins state=restarted
when: >
(jenkins_users_config is defined and jenkins_users_config.changed)
or (jenkins_http_config is defined and jenkins_http_config.changed)
or (jenkins_home_config is defined and jenkins_home_config.changed)
tags: ['skip_ansible_lint']

View File

@ -0,0 +1,45 @@
---
- name: Ensure dependencies are installed.
apt:
name:
- curl
- apt-transport-https
state: present
- name: Add Jenkins apt repository key.
apt_key:
url: "{{ jenkins_repo_key_url }}"
state: present
- name: Add Jenkins apt repository.
apt_repository:
repo: "{{ jenkins_repo_url }}"
state: present
update_cache: true
when: jenkins_repo_url != ""
tags: ['skip_ansible_lint']
- name: Download specific Jenkins version.
get_url:
url: "{{ jenkins_pkg_url }}/jenkins_{{ jenkins_version }}_all.deb"
dest: "/tmp/jenkins_{{ jenkins_version }}_all.deb"
when: jenkins_version is defined
- name: Check if we downloaded a specific version of Jenkins.
stat:
path: "/tmp/jenkins_{{ jenkins_version }}_all.deb"
register: specific_version
when: jenkins_version is defined
- name: Install our specific version of Jenkins.
apt:
deb: "/tmp/jenkins_{{ jenkins_version }}_all.deb"
state: present
when: jenkins_version is defined and specific_version.stat.exists
notify: configure default users
- name: Ensure Jenkins is installed.
apt:
name: jenkins
state: "{{ jenkins_package_state }}"
notify: configure default users

View File

@ -0,0 +1,45 @@
---
- name: Ensure dependencies are installed.
package:
name:
- curl
- libselinux-python
- initscripts
state: present
- name: Ensure Jenkins repo is installed.
get_url:
url: "{{ jenkins_repo_url }}"
dest: /etc/yum.repos.d/jenkins.repo
when: jenkins_repo_url != ""
tags: ['skip_ansible_lint']
- name: Add Jenkins repo GPG key.
rpm_key:
state: present
key: "{{ jenkins_repo_key_url }}"
- name: Download specific Jenkins version.
get_url:
url: "{{ jenkins_pkg_url }}/jenkins-{{ jenkins_version }}-1.1.noarch.rpm"
dest: "/tmp/jenkins-{{ jenkins_version }}-1.1.noarch.rpm"
when: jenkins_version is defined
- name: Check if we downloaded a specific version of Jenkins.
stat:
path: "/tmp/jenkins-{{ jenkins_version }}-1.1.noarch.rpm"
register: specific_version
when: jenkins_version is defined
- name: Install our specific version of Jenkins.
package:
name: "/tmp/jenkins-{{ jenkins_version }}-1.1.noarch.rpm"
state: present
when: jenkins_version is defined and specific_version.stat.exists
notify: configure default users
- name: Ensure Jenkins is installed.
package:
name: jenkins
state: "{{ jenkins_package_state }}"
notify: configure default users

View File

@ -0,0 +1,28 @@
#!groovy
import hudson.security.*
import jenkins.model.*
def instance = Jenkins.getInstance()
def hudsonRealm = new HudsonPrivateSecurityRealm(false)
def users = hudsonRealm.getAllUsers()
users_s = users.collect { it.toString() }
// Create the admin user account if it doesn't already exist.
if ("{{ jenkins_admin_username }}" in users_s) {
println "Admin user already exists - updating password"
def user = hudson.model.User.get('{{ jenkins_admin_username }}');
def password = hudson.security.HudsonPrivateSecurityRealm.Details.fromPlainPassword('{{ jenkins_admin_password }}')
user.addProperty(password)
user.save()
}
else {
println "--> creating local admin user"
hudsonRealm.createAccount('{{ jenkins_admin_username }}', '{{ jenkins_admin_password }}')
instance.setSecurityRealm(hudsonRealm)
def strategy = new FullControlOnceLoggedInAuthorizationStrategy()
instance.setAuthorizationStrategy(strategy)
instance.save()
}

View File

@ -0,0 +1,7 @@
---
__jenkins_repo_url: deb https://pkg.jenkins.io/debian binary/
__jenkins_repo_key_url: https://pkg.jenkins.io/debian/jenkins.io.key
__jenkins_pkg_url: https://pkg.jenkins.io/debian/binary
jenkins_init_file: /etc/default/jenkins
jenkins_http_port_param: HTTP_PORT
jenkins_java_options_env_var: JAVA_ARGS

View File

@ -0,0 +1,7 @@
---
__jenkins_repo_url: https://pkg.jenkins.io/redhat/jenkins.repo
__jenkins_repo_key_url: https://pkg.jenkins.io/redhat/jenkins.io.key
__jenkins_pkg_url: https://pkg.jenkins.io/redhat
jenkins_init_file: /etc/sysconfig/jenkins
jenkins_http_port_param: JENKINS_PORT
jenkins_java_options_env_var: JENKINS_JAVA_OPTIONS

View File

@ -0,0 +1,9 @@
root = true
[*]
indent_style = space
indent_size = 2
end_of_line = lf
charset = utf-8
trim_trailing_whitespace = true
insert_final_newline = true

View File

@ -0,0 +1,3 @@
.vagrant/
*~
*.log

View File

@ -0,0 +1,16 @@
sudo: required
language: python
services: docker
cache: pip
install:
- pip install ansible docker
- ansible-galaxy install -r tests/requirements.yml -p tests/roles/
script:
- ansible --version
- tests/test.sh
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

View File

@ -0,0 +1,339 @@
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Lesser General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) year name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License.

View File

@ -0,0 +1,180 @@
# Unattended-Upgrades Role for Ansible
[![Build Status of branch master](https://img.shields.io/travis/jnv/ansible-role-unattended-upgrades/master.svg?style=flat-square)](https://travis-ci.org/jnv/ansible-role-unattended-upgrades)
[![Ansible Role: jnv.unattended-upgrades](https://img.shields.io/ansible/role/8068.svg?style=flat-square)](https://galaxy.ansible.com/jnv/unattended-upgrades/)
Install and setup [unattended-upgrades](https://launchpad.net/unattended-upgrades) for Ubuntu and Debian (since Wheezy), to periodically install security upgrades.
**NOTE:** If you have used version 0.0.1 of the role, you can delete the file `/etc/apt/apt.conf.d/10periodic` as it is not needed anymore. You can use the following one-shot command:
ansible -m file -a "state=absent path=/etc/apt/apt.conf.d/10periodic" <host-pattern>
## Requirements
The role uses [apt module](http://docs.ansible.com/apt_repository_module.html) which has additional dependencies.
If you set `unattended_mail` to an e-mail address, make sure `mailx` command is available and your system is able to send e-mails.
The role requires unattended-upgrades version 0.70 and newer, which is available since Debian Wheezy and Ubuntu 12.04 respectively. This is due to [Origins Patterns](#origins-patterns) usage; if this is not available on your system, you may use [the first version of the role](https://github.com/jnv/ansible-role-unattended-upgrades/tree/v0.1).
### Automatic Reboot
If you enable automatic reboot feature (`unattended_automatic_reboot`), the role will attempt to install `update-notifier-common` package, which is required on some systems for detecting and executing reboot after the upgrade. You may optionally define a specific time for rebooting (`unattended_automatic_reboot_time`).
This feature was broken in Debian Jessie, but eventually was rolled into the unattended-upgrades package; see [the discussion in #6](https://github.com/jnv/ansible-role-unattended-upgrades/issues/6) for more details.
## Disabled Cron Jobs
On some hosts you may find that the unattended-upgrade's cronfile `/etc/cron.daily/apt` file has been renamed to `apt.disabled`. This is possibly provider's decision, to save some CPU cycles. Use [enable-standard-cronjobs](https://github.com/Yannik/ansible-role-enable-standard-cronjobs) role to reenable unattended-upgrades. See also discussion in [#9](https://github.com/jnv/ansible-role-unattended-upgrades/issues/9).
## Role Variables
* `unattended_cache_valid_time`: Update the apt cache if its older than the given time in seconds; passed to the [apt module](https://docs.ansible.com/ansible/latest/apt_module.html) during package installation.
* Default: `3600`
* `unattended_origins_patterns`: array of origins patterns to determine whether the package can be automatically installed, for more details see [Origins Patterns](#origins-patterns) below.
* Default for Debian: `['origin=Debian,codename=${distro_codename},label=Debian-Security']`
* Default for Ubuntu: `['origin=Ubuntu,archive=${distro_codename}-security,label=Ubuntu']`
* `unattended_package_blacklist`: packages which won't be automatically upgraded
* Default: `[]`
* `unattended_autofix_interrupted_dpkg`: whether on unclean dpkg exit to run `dpkg --force-confold --configure -a`
* Default: `true`
* `unattended_minimal_steps`: split the upgrade into the smallest possible chunks so that they can be interrupted with SIGUSR1.
* Default: `false`
* `unattended_install_on_shutdown`: install all unattended-upgrades when the machine is shuting down.
* Default: `false`
* `unattended_mail`: e-mail address to send information about upgrades or problems with unattended upgrades
* Default: `false` (don't send any e-mail)
* `unattended_mail_only_on_error`: send e-mail only on errors, otherwise e-mail will be sent every time there's a package upgrade.
* Default: `false`
* `unattended_remove_unused_dependencies`: do automatic removal of new unused dependencies after the upgrade.
* Default: `false`
* `unattended_automatic_reboot`: Automatically reboot system if any upgraded package requires it, immediately after the upgrade.
* Default: `false`
* `unattended_automatic_reboot_time`: Automatically reboot system if any upgraded package requires it, at the specific time (_HH:MM_) instead of immediately after the upgrade.
* Default: `false`
* `unattended_update_days`: Set the days of the week that updates should be applied. The days can be specified as localized abbreviated or full names. Or as integers where "0" is Sunday, "1" is Monday etc. Example: `{"Mon";"Fri"};`
* Default: disabled
* `unattended_ignore_apps_require_restart`: unattended-upgrades won't automatically upgrade some critical packages requiring restart after an upgrade (i.e. there is `XB-Upgrade-Requires: app-restart` directive in their debian/control file). With this option set to `true`, unattended-upgrades will upgrade these packages regardless of the directive.
* Default: `false`
* `unattended_verbose`: Define verbosity level of APT for periodic runs. The output will be sent to root.
* Possible options:
* `0`: no report
* `1`: progress report
* `2`: + command outputs
* `3`: + trace on
* Default: `0` (no report)
* `unattended_update_package_list`: Do "apt-get update" automatically every n-days (0=disable)
* Default: `1`
* `unattended_download_upgradeable`: Do "apt-get upgrade --download-only" every n-days (0=disable)
* Default: `0`
* `unattended_autoclean_interval`: Do "apt-get autoclean" every n-days (0=disable)
* Default: `7`
* `unattended_clean_interval`: Do "apt-get clean" every n-days (0=disable)
* Default: `0`
* `unattended_random_sleep`: Define maximum for a random interval in seconds after which the apt job starts (only for systems without systemd)
* Default: `1800` (30 minutes)
* `unattended_dpkg_options`: Array of dpkg command-line options used during unattended-upgrades runs, e.g. `["--force-confdef"]`, `["--force-confold"]`
* Default: `[]`
* `unattended_dl_limit`: Limit the download speed in kb/sec using apt bandwidth limit feature.
* Default: disabled
## Origins Patterns
Origins Pattern is a more powerful alternative to the Allowed Origins option used in previous versions of unattended-upgrade.
Pattern is composed from specific keywords:
* `a`,`archive`,`suite` e.g. `stable`, `trusty-security` (`archive=stable`)
* `c`,`component` e.g. `main`, `crontrib`, `non-free` (`component=main`)
* `l`,`label` e.g. `Debian`, `Debian-Security`, `Ubuntu`
* `o`,`origin` e.g. `Debian`, `Unofficial Multimedia Packages`, `Ubuntu`
* `n`,`codename` e.g. `jessie`, `jessie-updates`, `trusty` (this is only supported with `unattended-upgrades` >= 0.80)
* `site` e.g. `http.debian.net`
You can review the available repositories using `apt-cache policy` and debug your choice using `unattended-upgrades -d` command on a target system.
Additionally unattended-upgrades support two macros (variables), derived from `/etc/debian_version`:
* `${distro_id}` Installed distribution name, e.g. `Debian` or `Ubuntu`.
* `${distro_codename}` Installed codename, e.g. `jessie` or `trusty`.
Using `${distro_codename}` should be preferred over using `stable` or `oldstable` as a selected, as once `stable` moves to `oldstable`, no security updates will be installed at all, or worse, package from a newer distro release will be installed by accident. The same goes for upgrading your installation from `oldstable` to `stable`, if you forget to change this in your origin patterns, you may not receive the security updates for your newer distro release. With `${distro_codename}`, both cases can never happen.
## Role Usage Example
Example for Ubuntu, with custom [origins patterns](#patterns-examples), blacklisted packages and e-mail notification:
```yaml
- hosts: all
roles:
- role: jnv.unattended-upgrades
unattended_origins_patterns:
- 'origin=Ubuntu,archive=${distro_codename}-security'
- 'o=Ubuntu,a=${distro_codename}-updates'
unattended_package_blacklist: [cowsay, vim]
unattended_mail: 'root@example.com'
```
_Note:_ You don't need to specify `unattended_origins_patterns`, the role will use distribution's default if the variable is not set.
### Patterns Examples
By default, only security updates are allowed for both Ubuntu and Debian. You can add more patterns to allow unattended-updates install more packages automatically, however be aware that automated major updates may potentially break your system.
#### For Debian
```yaml
unattended_origins_patterns:
- 'origin=Debian,codename=${distro_codename},label=Debian-Security' # security updates
- 'o=Debian,codename=${distro_codename},label=Debian' # updates including non-security updates
- 'o=Debian,codename=${distro_codename},a=proposed-updates'
```
On debian wheezy, due to `unattended-upgrades` being `0.79.5`, you cannot use the `codename` directive.
You will have to do archive based matching instead:
```yaml
unattended_origins_patterns:
- 'origin=Debian,a=stable,label=Debian-Security' # security updates
- 'o=Debian,a=stable,l=Debian' # updates including non-security updates
- 'o=Debian,a=proposed-updates'
```
Please be sure to read about the issues regarding this in the origin pattern documentation above.
#### For Ubuntu
In Ubuntu, archive always contains the distribution codename
```yaml
unattended_origins_patterns:
- 'origin=Ubuntu,archive=${distro_codename}-security'
- 'o=Ubuntu,a=${distro_codename}'
- 'o=Ubuntu,a=${distro_codename}-updates'
- 'o=Ubuntu,a=${distro_codename}-proposed-updates'
```
#### For Raspbian
In Raspbian, it is only possible to update all packages from the default repository, including non-security updates, or updating none.
Updating all, including non-security:
```yaml
unattended_origins_patterns:
- 'origin=Raspbian,codename=${distro_codename},label=Raspbian'
```
You can not use the `codename` directive on raspbian wheezy, the same as with debian wheezy above.
To not install any updates on a raspbian host, just set `unattended_origins_patterns` to an empty list:
```
unattended_origins_patterns: []
```
## License
GPLv2

View File

@ -0,0 +1,122 @@
---
# Cache update time for apt module
unattended_cache_valid_time: 3600
#Unattended-Upgrade::Origins-Pattern
# Automatically upgrade packages from these origin patterns
# e.g.: 'o=Debian,a=stable', 'o=Debian,a=stable-updates'
#
# Left unset, distribution-specific defaults will be used through
# __unattended_origins_patterns variable only if this variable
# is not provided externally
# REFS https://github.com/ansible/ansible/issues/8121
#unattended_origins_patterns: []
#Unattended-Upgrade::Package-Blacklist
# List of packages to not update
unattended_package_blacklist: []
#Unattended-Upgrade::AutoFixInterruptedDpkg
# On a unclean dpkg exit unattended-upgrades will run
# dpkg --force-confold --configure -a
# The default is true, to ensure updates keep getting installed
unattended_autofix_interrupted_dpkg: true
#Unattended-Upgrade::MinimalSteps
# Split the upgrade into the smallest possible chunks so that
# they can be interrupted with SIGUSR1. This makes the upgrade
# a bit slower but it has the benefit that shutdown while a upgrade
# is running is possible (with a small delay)
unattended_minimal_steps: false
#Unattended-Upgrade::InstallOnShutdown
# Install all unattended-upgrades when the machine is shuting down
# instead of doing it in the background while the machine is running
# This will (obviously) make shutdown slower
unattended_install_on_shutdown: false
#Unattended-Upgrade::Mail
# Send email to this address for problems or packages upgrades
# If empty or unset then no email is sent, make sure that you
# have a working mail setup on your system. A package that provides
# 'mailx' must be installed.
unattended_mail: false
#Unattended-Upgrade::MailOnlyOnError
# Set this value to "true" to get emails only on errors. Default
# is to always send a mail if Unattended-Upgrade::Mail is set
unattended_mail_only_on_error: false
#Unattended-Upgrade::Remove-Unused-Dependencies
# Do automatic removal of new unused dependencies after the upgrade
# (equivalent to apt-get autoremove)
unattended_remove_unused_dependencies: false
#Unattended-Upgrade::Automatic-Reboot
# Automatically reboot *WITHOUT CONFIRMATION* if a
# the file /var/run/reboot-required is found after the upgrade
unattended_automatic_reboot: false
#Unattended-Upgrade::Automatic-Reboot-Time
# If automatic reboot is enabled and needed, reboot at the specific
# time instead of immediately
unattended_automatic_reboot_time: false
#Unattended-Upgrade::IgnoreAppsRequireRestart
# Do upgrade application even if it requires restart after upgrade
# I.e. "XB-Upgrade-Requires: app-restart" is set in the debian/control file
unattended_ignore_apps_require_restart: false
### APT::Periodic configuration
# Snatched from /usr/lib/apt/apt.systemd.daily
#APT::Periodic::Update-Package-Lists "0";
# - Do "apt-get update" automatically every n-days (0=disable)
unattended_update_package_list: 1
#APT::Periodic::Download-Upgradeable-Packages "0";
# - Do "apt-get upgrade --download-only" every n-days (0=disable)
#unattended_download_upgradeable: 0
#APT::Periodic::AutocleanInterval "0";
# - Do "apt-get autoclean" every n-days (0=disable)
unattended_autoclean_interval: 7
#APT::Periodic::CleanInterval "0";
# - Do "apt-get clean" every n-days (0=disable)
#unattended_clean_interval: 0
#APT::Periodic::Verbose "0";
# - Send report mail to root
# 0: no report (or null string)
# 1: progress report (actually any string)
# 2: + command outputs (remove -qq, remove 2>/dev/null, add -d)
# 3: + trace on
#unattended_verbose: 0
## Cron systems only
#APT::Periodic::RandomSleep
# When the apt job starts, it will sleep for a random period between 0
# and APT::Periodic::RandomSleep seconds
# The default value is "1800" so that the script will stall for up to 30
# minutes (1800 seconds) so that the mirror servers are not crushed by
# everyone running their updates all at the same time
# Kept undefined to allow default (1800)
#unattended_random_sleep: 0
#Dpkg::Options
# Provide dpkg options that take effect during unattended upgrades.
# By default no flags are appended. Configuration file changes can
# block installation of certain packages. Passing the flags
# "--force-confdef" and "--force-confold" will ensure updates are applied
# and old configuration files are preserved.
unattended_dpkg_options: []
# unattended_dpkg_options:
# - "--force-confdef"
# - "--force-confold"
# Use apt bandwidth limit feature, this example limits the download speed to 70kb/sec
#unattended_dl_limit: 70

Some files were not shown because too many files have changed in this diff Show More