112 lines
3.7 KiB
YAML
112 lines
3.7 KiB
YAML
---
|
|
- hosts: all
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Check if reboot is required
|
|
ansible.builtin.stat:
|
|
path: /var/run/reboot-required
|
|
register: reboot_required
|
|
- name: Reboot if required
|
|
ansible.builtin.reboot:
|
|
when: reboot_required.stat.exists
|
|
- name: Installing Crowdsec pre-reqs
|
|
ansible.builtin.apt:
|
|
pkg:
|
|
- gnupg
|
|
state: present
|
|
- name: Add crowdsec keyring
|
|
ansible.builtin.get_url:
|
|
url: https://packagecloud.io/crowdsec/crowdsec/gpgkey
|
|
dest: /etc/apt/trusted.gpg.d/crowdsec
|
|
checksum: sha512:5036042aff9d2700a39f64c3a6a70164a76162973e10dacb119aec98e9d60bd4a2f6d6ca4bc2c243a0751fd957baa51e0182fa0cd2f5798d7ec8a7893a1e219f
|
|
mode: '0644'
|
|
- name: Dearmor crowdsec gpg key
|
|
ansible.builtin.command:
|
|
cmd: gpg --dearmor /etc/apt/trusted.gpg.d/crowdsec
|
|
creates: /etc/apt/trusted.gpg.d/crowdsec.gpg
|
|
- name: Ensure keyring is removed
|
|
ansible.builtin.file:
|
|
path: /etc/apt/trusted.gpg.d/crowdsec
|
|
state: absent
|
|
- name: Add crowdsec repo
|
|
ansible.builtin.apt_repository:
|
|
repo: deb https://packagecloud.io/crowdsec/crowdsec/debian/ bookworm main
|
|
state: present
|
|
filename: crowdsec-install-repo
|
|
update_cache: true
|
|
- name: Add crowdsec source repo
|
|
ansible.builtin.apt_repository:
|
|
repo: deb-src https://packagecloud.io/crowdsec/crowdsec/debian/ bookworm main
|
|
state: present
|
|
filename: crowdsec-src-repo
|
|
update_cache: true
|
|
- name: Install firewalld and crowdsec packages
|
|
ansible.builtin.apt:
|
|
pkg:
|
|
- firewalld
|
|
- crowdsec
|
|
- crowdsec-firewall-bouncer-iptables
|
|
update_cache: true
|
|
- name: Add enp5s0 interface to public firewalld zone
|
|
ansible.posix.firewalld:
|
|
state: "enabled"
|
|
interface: "enp5s0"
|
|
zone: public
|
|
immediate: true
|
|
permanent: true
|
|
- name: Configure open ports with firewalld
|
|
ansible.posix.firewalld:
|
|
state: "{{ item.state }}"
|
|
port: "{{ item.port }}"
|
|
zone: public
|
|
immediate: true
|
|
permanent: true
|
|
with_items:
|
|
- { state: 'enabled', port: '22/tcp' }
|
|
- { state: 'enabled', port: '8006/tcp' }
|
|
- name: Enable firewalld masquerade
|
|
ansible.posix.firewalld:
|
|
state: "enabled"
|
|
masquerade: "true"
|
|
zone: public
|
|
immediate: true
|
|
permanent: true
|
|
- name: Enable masquerade rich rule for 192.168.20.0/24 network
|
|
ansible.posix.firewalld:
|
|
state: "enabled"
|
|
rich_rule: "rule family=ipv4 source address=192.168.20.0/24 masquerade"
|
|
permanent: true
|
|
immediate: true
|
|
- name: Enable ipv4 forwarding
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: 1
|
|
state: present
|
|
reload: true
|
|
- name: Enable ipv6 forwarding
|
|
ansible.posix.sysctl:
|
|
name: net.ipv6.conf.all.forwarding
|
|
value: 1
|
|
state: present
|
|
reload: true
|
|
- name: Add vfio modules to /etc/modules
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modules
|
|
line: "{{ item }}"
|
|
create: true
|
|
with_items:
|
|
- vfio
|
|
- vfio_iommu_type1
|
|
- vfio_pci
|
|
- vfio_virqfd
|
|
- name: Add intel_iommu=on iommu=pt to kernel start parameters
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/default/grub
|
|
regexp: '^GRUB_CMDLINE_LINUX_DEFAULT='
|
|
line: 'GRUB_CMDLINE_LINUX_DEFAULT="consoleblank=0 systemd.show_status=true intel_iommu=on iommu=pt"'
|
|
state: present
|
|
backup: true
|
|
## TODO: Find a way to only execute this ONLY when the kernel is installed.
|
|
- name: Update grub
|
|
ansible.builtin.command: update-grub
|