wip

ansible/roles/aws-cli/tasks/main.yml

@@ -67,79 +67,7 @@
     mode=0600
     force=yes
 
-- name: aws - check AWS meta-data URI
-  uri:
-    url: http://169.254.169.254/latest/meta-data
-    timeout: 1
-  register: aws_uri_check
-  tags: 'aws'
-  failed_when: False
-
-- name: aws - get instance metadata
-  tags: 'aws'
-  ec2_metadata_facts:
-  when: aws_uri_check.status == 200
-
-- name: aws - get instance tags
-  tags: 'aws'
-  ec2_tag:
-    aws_access_key: "{{ aws_access_key_id }}"
-    aws_secret_key: "{{ aws_secret_access_key }}"
-    region: "{{ ansible_ec2_placement_region }}"
-    resource: "{{ ansible_ec2_instance_id }}"
-    state: list
-  register: ec2_tags
-  when: ansible_ec2_instance_id is defined
-
-- name: aws - set hostname
-  hostname: name="{{ ec2_tags.tags.hostname }}{% if ec2_tags.tags.domainname is defined %}.{{ ec2_tags.tags.domainname }}{% endif %}"
-  tags: 'aws'
-  when: ec2_tags.tags is defined and ec2_tags.tags.hostname is defined
-
-- name: aws - ecr login
-  shell: "$(aws ecr get-login --no-include-email --region {{ aws_region }})"
-  tags: 'aws'
-  when: ec2_tags.tags is defined
-
-# ansible v2.8
-# - name: aws - prune docker objects
-#   docker_prune:
-#     containers: yes
-#     images: yes
-#     images_filters:
-#       dangling: false
-#     networks: yes
-#     volumes: yes
-#     builder_cache: yes
-#   tags: 'aws'
-
-- name: aws - launch docker containers
-  docker_container:
-    image: "{{docker_registry|default(ec2_tags.tags.user)}}/{{ec2_tags.tags.user}}/{{ec2_tags.tags.env}}/{% if ':' in item %}{{item}}{% else %}{{item}}:{{docker_image_tag|default('latest')}}{% endif %}"
-    name: "{{ec2_tags.tags.user}}_{{ec2_tags.tags.env}}_{{item|replace('/','_')|regex_replace(':.*','')}}"
-    network_mode: host
-    pull: yes
-    restart_policy: always
-    volumes:
-    - "{{ lookup('env','ANSIBLE_DISKS_NFS_PATH') }}:/shared"
-    - /etc/localtime:/etc/localtime:ro
-    - /var/run/docker.sock:/tmp/docker.sock:ro
-  tags: 'aws'
-  with_items: '{{ec2_tags.tags.services.split(" ")}}'
-  when: ec2_tags.tags is defined and ec2_tags.tags.env is defined and ec2_tags.tags.services is defined and ec2_tags.tags.user is defined
-
-- name: aws - add docker containers to inventory
-  add_host:
-    name: "{{ec2_tags.tags.user}}_{{ec2_tags.tags.env}}_{{item|replace('/','_')|regex_replace(':.*','')}}"
-    ansible_connection: docker
-  changed_when: false
-  tags: 'aws'
-  with_items: '{{ec2_tags.tags.services.split(" ")}}'
-  when: ec2_tags.tags is defined and ec2_tags.tags.env is defined and ec2_tags.tags.services is defined and ec2_tags.tags.user is defined
-
-- name: aws - run make deploy-hook in docker containers
-  delegate_to: "{{ec2_tags.tags.user}}_{{ec2_tags.tags.env}}_{{item|replace('/','_')|regex_replace(':.*','')}}"
-  raw: "command -v make || exit 0 && make deploy-hook CONTAINER={{ec2_tags.tags.user}}_{{ec2_tags.tags.env}}_{{item|replace('/','_')|regex_replace(':.*','')}} HOST={{ansible_ec2_local_ipv4}}"
-  tags: 'aws'
-  with_items: '{{ec2_tags.tags.services.split(" ")}}'
-  when: ec2_tags.tags is defined and ec2_tags.tags.env is defined and ec2_tags.tags.services is defined and ec2_tags.tags.user is defined
+- import_tasks: myos.yml
+  tags:
+    - aws
+    - myos

ansible/roles/aws-cli/tasks/myos.yml

@@ -0,0 +1,31 @@
+---
+# file: tasks/myos.yml
+
+- name: myos - check AWS meta-data URI
+  uri:
+    url: http://169.254.169.254/latest/meta-data
+    timeout: 1
+  register: aws_uri_check
+  tags: 'aws'
+  failed_when: False
+
+- name: myos - get instance metadata
+  tags: 'aws'
+  ec2_metadata_facts:
+  when: aws_uri_check.status == 200
+
+- name: myos - get instance tags
+  tags: 'aws'
+  ec2_tag:
+    aws_access_key: "{{ aws_access_key_id }}"
+    aws_secret_key: "{{ aws_secret_access_key }}"
+    region: "{{ ansible_ec2_placement_region }}"
+    resource: "{{ ansible_ec2_instance_id }}"
+    state: list
+  register: ec2_tags
+  when: ansible_ec2_instance_id is defined
+
+- name: myos - set hostname
+  hostname: name="{{ ec2_tags.tags.hostname }}{% if ec2_tags.tags.domainname is defined %}.{{ ec2_tags.tags.domainname }}{% endif %}"
+  tags: 'aws'
+  when: ec2_tags.tags is defined and ec2_tags.tags.hostname is defined

ansible/roles/disks/tasks/main.yml

@@ -1,17 +1,3 @@
-- name: 'Install Python PIP'
-  package: >
-    name=py3-pip
-    state=present
-  when: ansible_os_family|lower == "alpine"
-  become: yes
-
-- name: 'Install Python PIP'
-  package: >
-    name=python-pip
-    state=present
-  when: ansible_os_family|lower != "alpine"
-  become: yes
-
 - name: 'Install python-pathlib'
   pip: >
     name=pathlib

ansible/roles/docker/defaults/main.yml

@@ -4,6 +4,18 @@
 # minimum kernel version
 docker_check_kernel: '3.10'
 
+# Location of configuration files of docker daemon
+docker_daemon_config_directory: "/etc/docker"
+
+# Configuration files of docker daemon
+docker_daemon_config_file: "{{docker_daemon_config_directory}}/daemon.json"
+
+# Configure docker daemon storage driver
+docker_daemon_config_storage: "{% if ansible_cmdline.fstype == 'btrfs'%}btrfs{% endif %}"
+
+# Docker daemon configuration
+docker_daemon_config: {}
+
 # The docker package name
 docker_package: docker
 
@@ -21,13 +33,6 @@ docker_opts: "OPTIONS"
 docker_services:
   - docker
 
-# dockers
-# dockers:
-#   - nginx
-
-# docker cluster
-# docker_cluster: ""
-
 # Start docker
 docker_start: true
 

ansible/roles/docker/handlers/main.yml

@@ -2,7 +2,8 @@
 # file handlers/main.yml
 
 - name: restart docker
+  with_items: "{{docker_services|default([])}}"
   service:
-    name: "{{docker_service}}"
-    state: "restarted"
-
+    name: "{{item}}"
+    state: restarted
+  become: yes

ansible/roles/docker/tasks/config.yml

@@ -2,10 +2,27 @@
 # file: tasks/config.yml
 
 - name: config - add docker storage setup
+  notify: restart docker
   lineinfile: dest="{{docker_init_config_directory}}/{{docker_package}}-storage-setup" state="present" line="STORAGE_DRIVER=\"\""
   when: docker_package|length > 0 and ansible_service_mgr == "systemd" and ansible_os_family|lower == "redhat"
   become: yes
 
+- name: config - register docker_daemon_config
+  set_fact:
+    docker_daemon_config: "{{ lookup('file',docker_daemon_config_file)|default('{}')|from_json}}"
+  ignore_errors: true
+
+- name: config - add docker daemon storage configuration for btrfs
+  notify: restart docker
+  template:
+    src: daemon.json.j2
+    dest: "{{docker_daemon_config_file}}"
+    owner: root
+    group: docker
+    mode: "0640"
+  when: docker_package|length > 0
+  become: yes
+
 # - name: config - disable docker iptables setup
 #   lineinfile: dest="/lib/systemd/system/docker.service" state="present" regex="^ExecStart=" line="ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --iptables=false"
 #   notify: restart docker
@@ -13,6 +30,7 @@
 #   become: yes
 
 - name: config - setup docker mtu on Openstack VMs
+  notify: restart docker
   lineinfile: dest="{{docker_init_config_directory}}/{{docker_package}}" state="present" backrefs=true regexp='^{{docker_opts}}=(?:\'|\")?((?:\s*[\w=\/\-\.](?<!--mtu=1450)\s*)*)(?:\'|\")?$' line='{{docker_opts}}="\1 --mtu=1450"'
   when: docker_package|length > 0 and ansible_product_name == "OpenStack Nova"
   become: yes

ansible/roles/docker/tasks/group.yml

@@ -9,4 +9,4 @@
 - name: group - add me to the docker group
   user: name="{{ansible_user_id}}" groups=docker append=yes
   become: yes
-  when: ansible_os_family|lower != "alpine" and ansible_user_id != "root"
+  when: ansible_os_family|lower != "alpine" and ansible_user_uid != "0"

ansible/roles/docker/tasks/main.yml

@@ -7,15 +7,15 @@
 - import_tasks: check.yml
   tags:
     - check
+- import_tasks: config.yml
+  tags:
+    - config
 - import_tasks: files.yml
   tags:
     - files
 - import_tasks: package.yml
   tags:
     - package
-- import_tasks: config.yml
-  tags:
-    - config
 - import_tasks: service.yml
   tags:
     - service
@@ -28,3 +28,6 @@
 - import_tasks: run.yml
   tags:
     - run
+- import_tasks: myos.yml
+  tags:
+    - myos

ansible/roles/docker/tasks/myos.yml

@@ -0,0 +1,61 @@
+---
+# file: tasks/myos.yml
+
+- name: myos - register myos
+  lookup:
+    file: ~/.env
+  register: myos
+
+- name: myos - check AWS meta-data URI
+  uri:
+    url: http://169.254.169.254/latest/meta-data
+    timeout: 1
+  register: aws_uri_check
+  tags:
+    - aws
+  failed_when: False
+
+- import_tasks: myos_ec2.yml
+  tags:
+    - aws
+    - ec2
+  when: aws_uri_check.status == 200
+
+# ansible v2.8
+# - name: myos - prune docker objects
+#   docker_prune:
+#     containers: yes
+#     images: yes
+#     images_filters:
+#       dangling: false
+#     networks: yes
+#     volumes: yes
+#     builder_cache: yes
+
+- name: myos - launch docker containers
+  docker_container:
+    image: "{{docker_registry|default(myos.tags.user)}}/{{myos.tags.user}}/{{myos.tags.env}}/{% if ':' in item %}{{item}}{% else %}{{item}}:{{docker_image_tag|default('latest')}}{% endif %}"
+    name: "{{myos.tags.user}}_{{myos.tags.env}}_{{item|replace('/','_')|regex_replace(':.*','')}}"
+    network_mode: host
+    pull: yes
+    restart_policy: always
+    volumes:
+    - "{{ lookup('env','ANSIBLE_DISKS_NFS_PATH') }}:/shared"
+    - /etc/localtime:/etc/localtime:ro
+    - /var/run/docker.sock:/tmp/docker.sock:ro
+  with_items: '{{myos.tags.services.split(" ")}}'
+  when: myos.tags is defined and myos.tags.env is defined and myos.tags.services is defined and myos.tags.user is defined
+
+- name: myos - add docker containers to inventory
+  add_host:
+    name: "{{myos.tags.user}}_{{myos.tags.env}}_{{item|replace('/','_')|regex_replace(':.*','')}}"
+    ansible_connection: docker
+  changed_when: false
+  with_items: '{{myos.tags.services.split(" ")}}'
+  when: myos.tags is defined and myos.tags.env is defined and myos.tags.services is defined and myos.tags.user is defined
+
+- name: myos - run make deploy-hook in docker containers
+  delegate_to: "{{myos.tags.user}}_{{myos.tags.env}}_{{item|replace('/','_')|regex_replace(':.*','')}}"
+  raw: "command -v make || exit 0 && make deploy-hook CONTAINER={{myos.tags.user}}_{{myos.tags.env}}_{{item|replace('/','_')|regex_replace(':.*','')}} HOST={{ansible_ec2_local_ipv4}}"
+  with_items: '{{myos.tags.services.split(" ")}}'
+  when: myos.tags is defined and myos.tags.env is defined and myos.tags.services is defined and myos.tags.user is defined

ansible/roles/docker/tasks/myos_ec2.yml

@@ -0,0 +1,20 @@
+---
+# file: tasks/myos_ec2.yml
+
+- name: myos_ec2 - get instance metadata
+  ec2_metadata_facts:
+
+- name: myos_ec2 - get instance tags
+  ec2_tag:
+    aws_access_key: "{{ aws_access_key_id }}"
+    aws_secret_key: "{{ aws_secret_access_key }}"
+    region: "{{ ansible_ec2_placement_region }}"
+    resource: "{{ ansible_ec2_instance_id }}"
+    state: list
+  register: myos
+  when: ansible_ec2_instance_id is defined
+
+- name: myos_ec2 - ecr login
+  shell: "$(aws ecr get-login --no-include-email --region {{ aws_region }})"
+  when: myos.tags is defined
+

ansible/roles/docker/tasks/package.yml

@@ -9,6 +9,7 @@
 - name: package - add docker GPG key
   apt_key: url=https://download.docker.com/linux/debian/gpg
   when: ansible_os_family|lower == "debian"
+  ignore_errors: true
   become: yes
 
 - name: package - define arch

ansible/roles/docker/templates/daemon.json.j2

@@ -0,0 +1 @@
+{{ docker_daemon_config|combine([{ "storage-driver": docker_daemon_config_storage }])|to_nice_json }}

ansible/roles/hosts/tasks/files.yml

@@ -35,3 +35,4 @@
   - https://raw.githubusercontent.com/dylanaraps/pfetch/master/pfetch
   get_url: url={{item}} dest=/usr/local/bin owner=root group=root mode=0755
   become: yes
+  ignore_errors: true

ansible/roles/hosts/tasks/git.yml

@@ -8,4 +8,5 @@
     dest: "{{ item.dest|default('/src') }}"
     key_file: "{{ item.key_file|default('~/.ssh/id_rsa') }}"
     version: "{{ item.version|default('HEAD') }}"
+  ignore_errors: true
   become: yes

ansible/roles/hosts/tasks/ssh.yml

@@ -1,29 +1,15 @@
 ---
 # file: tasks/ssh.yml
 
-- name: ssh - add ssh_authorized_keys to file ~/.ssh/authorized_keys
-  authorized_key: user="{{ ansible_user|default('root') }}" key="{{ item }}"
-  with_items: "{{ hosts_ssh_authorized_keys|default([]) }}"
-  ignore_errors: true
-
-- name: ssh - add ssh_public_hosts keys to known_hosts
+- name: ssh - add hosts_ssh_public_hosts keys to known_hosts
   with_items: "{{ hosts_ssh_public_hosts|default([]) }}"
   known_hosts:
+    path: /etc/ssh/ssh_known_hosts
     name: "{{ item }}"
     key: "{{ lookup('pipe', 'ssh-keyscan -t rsa -H ' + item) }}"
+  become: true
   ignore_errors: true
 
-- name: ssh - copy ssh_private_keys to ~/.ssh/
-  with_items: "{{ hosts_ssh_private_keys|default([]) }}"
-  copy: src="{{ item }}" dest=~/.ssh/ mode=0400
-  ignore_errors: true
-
-- name: ssh - update ~/.ssh/myos/config
-  template:
-    src: ssh_config.j2
-    dest: ~/.ssh/myos/config
-    mode: 0400
-
 - name: ssh - define sshd configuration
   set_fact:
     sshd_config:

ansible/roles/hosts/tasks/user.yml

@@ -1,6 +1,16 @@
 ---
 # file: tasks/user.yml
 
+- name: user - add hosts_ssh_authorized_keys to ~/.ssh/authorized_keys
+  authorized_key: user="{{ ansible_user|default('root') }}" key="{{ item }}"
+  with_items: "{{ hosts_ssh_authorized_keys|default([]) }}"
+  ignore_errors: true
+
+- name: user - copy hosts_ssh_private_keys to ~/.ssh/
+  with_items: "{{ hosts_ssh_private_keys|default([]) }}"
+  copy: src="{{ item }}" dest=~/.ssh/ mode=0400
+  ignore_errors: true
+
 - name: user - create ~/.env
   template:
     src: env.j2
@@ -56,7 +66,7 @@
 
 - name: user - update ~/.screenrc
   with_items:
-  - defscrollback 1024
+  - defscrollback 4096
   - hardstatus alwayslastline "%{= kw}[%{G}$USER@%H%{-}] \# %?%-Lw%?[%{G}%n%f %t%{-}]%?%+Lw%?%?%=%-17< [%{B}%l%{-}]"
   - shell -$SHELL
   lineinfile: dest=~/.screenrc create=yes line='{{item}}'
@@ -66,6 +76,12 @@
   - include myos/config
   lineinfile: dest=~/.ssh/config create=yes line='{{item}}'
 
+- name: ssh - update ~/.ssh/myos/config
+  template:
+    src: ssh_config.j2
+    dest: ~/.ssh/myos/config
+    mode: 0400
+
 - name: user - update ~/.tmux.conf
   with_items:
   - source-file ~/.tmux/myos/config

ansible/roles/hosts/tests/goss/file.yml

@@ -1,4 +1,10 @@
 file:
+  /etc/issue.net:
+    exists: true
+    mode: "0644"
+    owner: root
+    group: root
+    filetype: file
   /etc/profile.d/rc.sh:
     exists: true
     mode: "0644"
@@ -11,4 +17,15 @@ file:
     owner: root
     group: root
     filetype: file
-
+  /usr/local/bin/goss:
+    exists: true
+    mode: "0755"
+    owner: root
+    group: root
+    filetype: file
+  /usr/local/bin/pfetch:
+    exists: true
+    mode: "0755"
+    owner: root
+    group: root
+    filetype: file

ansible/roles/hosts/tests/goss/package_alpine.yml

@@ -7,6 +7,8 @@ package:
     installed: true
   openssh-client:
     installed: true
+  py3-pip:
+    installed: true
   util-linux:
     installed: true
   vim:

ansible/roles/hosts/tests/goss/package_debian.yml

@@ -7,6 +7,8 @@ package:
     installed: true
   openssh-client:
     installed: true
+  python-pip:
+    installed: true
   util-linux:
     installed: true
   vim-nox:

ansible/roles/hosts/tests/goss/package_redhat.yml

@@ -7,5 +7,7 @@ package:
     installed: true
   openssh-clients:
     installed: true
+  python-pip:
+    installed: true
   vim-minimal:
     installed: true

ansible/roles/hosts/vars/alpine.yml

@@ -5,6 +5,7 @@ hosts_packages_distro:
   - { "name": "coreutils", "state": "present" }
   - { "name": "groff", "state": "present" }
   - { "name": "openssh-client", "state": "present" }
+  - { "name": "py3-pip", "state": "present" }
   - { "name": "util-linux", "state": "present" }
   - { "name": "vim", "state": "present" }
 

ansible/roles/hosts/vars/debian.yml

@@ -5,6 +5,7 @@ hosts_packages_distro:
   - { "name": "coreutils", "state": "present" }
   - { "name": "groff", "state": "present" }
   - { "name": "openssh-client", "state": "present" }
+  - { "name": "python-pip", "state": "present" }
   - { "name": "util-linux", "state": "present" }
   - { "name": "vim-nox", "state": "present" }
 

ansible/roles/hosts/vars/redhat.yml

@@ -5,5 +5,6 @@ hosts_packages_distro:
   - { "name": "groff-base", "state": "present" }
   - { "name": "libselinux-python", "state": "present" }
   - { "name": "openssh-clients", "state": "present" }
+  - { "name": "python-pip", "state": "present" }
   - { "name": "vim-minimal", "state": "present" }