ilia
e897b1a027
Some checks failed
CI / lint-and-test (push) Successful in 1m16s
CI / ansible-validation (push) Successful in 5m49s
CI / secret-scanning (push) Successful in 1m33s
CI / dependency-scan (push) Successful in 2m48s
CI / sast-scan (push) Successful in 5m46s
CI / license-check (push) Successful in 1m11s
CI / vault-check (push) Failing after 5m25s
CI / playbook-test (push) Successful in 5m32s
CI / container-scan (push) Successful in 4m32s
CI / sonar-analysis (push) Successful in 6m53s
CI / workflow-summary (push) Successful in 1m6s
- Fix UFW firewall to allow outbound traffic (was blocking all outbound) - Add HOST parameter support to shell Makefile target - Fix all ansible-lint errors (trailing spaces, missing newlines, document starts) - Add changed_when: false to check commands - Fix variable naming (vault_devGPU -> vault_devgpu) - Update .ansible-lint config to exclude .gitea/ and allow strategy: free - Fix NodeSource repository GPG key handling in shell playbook - Add missing document starts to host_vars files - Clean up empty lines in datascience role files Reviewed-on: #2
89 lines
2.1 KiB
YAML
89 lines
2.1 KiB
YAML
---
|
|
- name: Ensure Ansible remote_tmp directory exists with correct permissions
|
|
ansible.builtin.file:
|
|
path: /root/.ansible/tmp
|
|
state: directory
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
become: true
|
|
|
|
- name: Install base system packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
# Base utilities
|
|
- curl
|
|
- wget
|
|
- unzip
|
|
- xclip
|
|
- tree
|
|
- copyq
|
|
# Network and admin tools
|
|
- net-tools
|
|
- ufw
|
|
- mailutils
|
|
# Modern CLI tools
|
|
- jq
|
|
- ripgrep
|
|
- fd-find
|
|
# Power management (TLP for laptops)
|
|
- tlp
|
|
- tlp-rdw
|
|
state: present
|
|
|
|
- name: Install yq YAML processor
|
|
ansible.builtin.apt:
|
|
name: yq
|
|
state: present
|
|
update_cache: false
|
|
failed_when: false
|
|
register: yq_apt_install
|
|
|
|
- name: Install yq from binary if apt fails
|
|
when: yq_apt_install.failed or yq_apt_install is not succeeded
|
|
block:
|
|
- name: Download yq binary
|
|
ansible.builtin.get_url:
|
|
url: https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
|
|
dest: /usr/local/bin/yq
|
|
mode: '0755'
|
|
register: yq_download
|
|
|
|
- name: Verify yq installation
|
|
ansible.builtin.command: yq --version
|
|
changed_when: false
|
|
|
|
- name: Create fd symlink (Ubuntu uses fd-find)
|
|
ansible.builtin.file:
|
|
src: /usr/bin/fdfind
|
|
dest: /usr/local/bin/fd
|
|
state: link
|
|
when: ansible_distribution == "Ubuntu"
|
|
|
|
# fail2ban configuration moved to monitoring role
|
|
|
|
# UFW enablement moved to ssh role to avoid lockout
|
|
|
|
- name: Set timezone
|
|
community.general.timezone:
|
|
name: "{{ timezone | default('UTC') }}"
|
|
|
|
- name: Configure locale
|
|
community.general.locale_gen:
|
|
name: "{{ locale | default('en_US.UTF-8') }}"
|
|
state: present
|
|
|
|
- name: Gather package facts to check for TLP
|
|
ansible.builtin.package_facts:
|
|
manager: apt
|
|
when: ansible_facts.packages is not defined
|
|
|
|
- name: Enable and start TLP service
|
|
ansible.builtin.systemd:
|
|
name: tlp
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
become: true
|
|
when: ansible_facts.packages is defined and 'tlp' in ansible_facts.packages
|