mise au point solution abr

0Readme.md

@@ -1,19 +0,0 @@
-## Variables
-
-
-*Tâche*: Utiliser des variables pour assouplir l'utilisation d'un rôle
-
-*Condition*: quand on souhaite adapter un rôle ou un playbook à une situation différente, sans avoir à gérer une autre version du playbook.
-
-*Norme*: En utilisant les variables
-
-### Pratique:
-
-Reprendre le rôle récupéré depuis ansible-galaxy, constater ses lacunes
-
-Les corriger une fois qu'elles ont été identifiées.
-
-### Performance
-
-Il est désormais facile d'adapter le rôle pour qu'il traite un autre site que www.orsys.fr
-

Readme.md

@@ -0,0 +1,48 @@
+## Variables
+
+
+*Tâche*: Utiliser des variables pour assouplir l'utilisation d'un playbook
+
+*Condition*: quand on souhaite adapter un playbook ou un playbook à une situation différente, sans avoir à gérer une autre version du playbook.
+
+*Norme*: En utilisant les variables
+
+### Prérequis
+
+Avoir à disposition  le playbook
+### Atelier 1 - faciliter l'exploitation et la maintenance d'un playbook
+
+Identifier toutes les modifications à faire au playbook _setup.yml_ si on veut changer le nom du compte à créer.
+
+Comment simplifier une future modification de cet emplacement ?
+
+### Atelier 2 - variables de play
+
+Se mettre d'accord sur le nom de variable à utiliser.
+
+Remplacer toutes les occurences du nom d'utilisateur par la variable
+
+Rajouter une section _vars_ au playbook dans laquelle sera définie notre variable
+
+Voir fichier setup_2.yml
+
+### Atelier 3 - variables d'inventaire
+
+Comment faire pour que à chaque machine soit associé un compte différent ?
+
+Voir fichier setup_3.yml et host_vars/centos1.formation.opendoor.fr
+
+### Atelier 4 - variables de type liste
+
+Comment faire si je veux créer plusieurs comptes utilisateur sur chaque machine ?
+
+Voir fichier setup_4.yml et host_vars/centos1.formation.opendoor.fr
+
+### Atelier 5 - variables de type tableau associatif
+
+Comment faire si je veux que ces comptes utilisateurs aient des mots de passe et des groupes différents ?
+
+Voir fichier setup_5.yml et host_vars/centos1.formation.opendoor.fr
+
+⚠️ pour que la solution fonctionne, il faut que le fichier répertoire host_vars et son contenu (centos1.formation.opendoor.fr) soit dans le même répertoire que votre fichier d'inventaire.
+

ansible_apache_formation/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-apache_formation
-
-NOT FOR PRODUCTION USE
-
-This role has been designed for training purpose
-
-Requirements
-------------
-
-None
-
-Role Variables
---------------
-
-Dependencies
-------------
-
-None
-
-Example Playbook
-----------------
-
----
-- hosts: test
-  roles:
-  - apache_formation
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-Thomas Constans <thomas@opendoor.fr>

ansible_apache_formation/defaults/main.yml

@@ -1 +0,0 @@
----

ansible_apache_formation/handlers/main.yml

@@ -1,4 +0,0 @@
-- name: reload httpd
-  service:
-    name: "{{ apache_service_name }}"
-    state: reloaded

ansible_apache_formation/meta/main.yml

@@ -1,51 +0,0 @@
-galaxy_info:
-  role_name: apache_formation
-  author: Thomas Constans <thomas@opendoor.fr>
-  description: Simple apache role set up for training purpose
-  company: www.opendoor.fr
-
-  # If the issue tracker for your role is not on github, uncomment the
-  # next line and provide a value
-  # issue_tracker_url: http://example.com/issue/tracker
-
-  # Some suggested licenses:
-  # - BSD (default)
-  # - MIT
-  # - GPLv2
-  # - GPLv3
-  # - Apache
-  # - CC-BY
-  license: GPLv2
-
-  min_ansible_version: 1.2
-
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
-
-  # Optionally specify the branch Galaxy will use when accessing the GitHub
-  # repo for this role. During role install, if no tags are available,
-  # Galaxy will use this branch. During import Galaxy will access files on
-  # this branch. If Travis integration is configured, only notifications for this
-  # branch will be accepted. Otherwise, in all cases, the repo's default branch
-  # (usually master) will be used.
-  #github_branch:
-
-  #
-  # platforms is a list of platforms, and each platform has a name and a list of versions.
-  #
-  platforms:
-   - name: EL
-     versions:
-     - 7
-
-  galaxy_tags: [apache,training]
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
-
-  dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.

ansible_apache_formation/tasks/apache.yml

@@ -1,57 +0,0 @@
----
-- name: installation
-  package:
-    name: "{{ apache_package_name }}"
-    state: present
-
-- name: configuration
-  notify: reload httpd
-  template:
-    src: vhost.conf
-    dest: /etc/httpd/conf.d/vhost.conf
-    mode: 0640
-    owner: root
-    group: apache
-
-- name: enable service
-  service:
-    name: "{{ apache_service_name }}"
-    enabled: yes
-
-- name: open firewall port
-  firewalld:
-    service: http
-    permanent: yes
-    immediate: yes
-    state: enabled
-  ignore_errors: yes
-
-- name: create documentroot
-  file:
-    name: "{{ apache_documentroot }}"
-    state: directory
-
-- name: create index file
-  template:
-    src: index.html
-    dest: "{{ apache_documentroot }}/index.html"
-    mode: 0644
-
-- name: install python passlib package
-  package:
-    name: python-passlib
-    state: present
-
-- name: passwd file
-  htpasswd:
-    path: "/etc/httpd/passwd"
-    name: tom
-    password: "123Soleil"
-    mode: 0640
-    owner: root
-    group: "apache"
-
-- name: start service
-  service:
-    name: "{{ apache_service_name }}"
-    state: restarted

ansible_apache_formation/tasks/main.yml

@@ -1,3 +0,0 @@
----
-- import_tasks: apache.yml
-  tags: httpd

ansible_apache_formation/templates/index.html

@@ -1 +0,0 @@
-<h1>Welcome aboard {{ ansible_hostname }}</h1>

ansible_apache_formation/templates/vhost.conf

@@ -1,24 +0,0 @@
-<VirtualHost *:80>
-   ServerName {{ apache_server_name }}
-   ServerAlias www.{{ apache_server_name }}
-   ServerAlias {{ inventory_hostname }}
-   DocumentRoot /var/www/html/{{ apache_server_name }}
-   CustomLog   /var/log/httpd/{{ apache_server_name }}_access.log combined
-   ErrorLog    /var/log/httpd/{{ apache_server_name }}_error.log
-   <Directory />
-      Options none
-      Allowoverride none
-      Require all denied
-   </Directory>
-
-   <Directory {{ apache_documentroot }}>
-      Require all granted
-   </Directory>
-   <Directory {{ apache_documentroot }}/Private>
-      Options indexes
-      AuthName "stop"
-      AuthType Basic
-      AuthUserFile /etc/httpd/passwd
-      require valid-user
-   </Directory>
-</VirtualHost>

ansible_apache_formation/tests/inventory

@@ -1,2 +0,0 @@
-localhost
-

ansible_apache_formation/tests/test.yml

@@ -1,4 +0,0 @@
----
-- hosts: centos
-  roles:
-    - tconstans.ansible_apache_formation

ansible_apache_formation/vars/main.yml

@@ -1 +0,0 @@
----

host_vars/centos1.formation.opendoor.fr

@@ -0,0 +1,10 @@
+setup_user: toto
+
+setup_users:
+- tartempion
+- ansible
+- foobar
+
+setup_user_hash:
+  - { login: plop, password: "{{ '123Soleil!' | password_hash('sha512') }}", group: wheel }
+  - { login: plip, password: "{{ '123Soleil!' | password_hash('sha512') }}", group: users }

setup_2.yml

@@ -0,0 +1,48 @@
+
+---
+- name: setup target to be managed by ansible
+  hosts: cibles
+  vars:
+    setup_user: jabba
+  tasks:
+  - name: warn people
+    lineinfile:
+      path: /etc/motd
+      create: yes
+      line: "Host is managed by ansible, manual interaction not recommended"
+      state: present
+
+  - name: history
+    lineinfile:
+      path: /etc/history
+      line: "{{ '%Y-%m-%d' | strftime }} - {{ ansible_play_name }}"
+      state: present
+      create: true
+
+  - name: generate ssh keys
+    openssh_keypair:
+      path: "~/.ssh/id_rsa"
+      size: 2048
+    delegate_to: localhost
+    become: false
+
+  - name: create account
+    user:
+      name: "{{ setup_user }}"
+      password: "{{ '123Soleil%' | password_hash('sha512',65534|random(seed=inventory_hostname) | string) }}"
+      create_home: yes
+      home: /home/{{ setup_user }}
+
+  - name: configure sudo
+    copy:
+      content: "{{ setup_user }} ALL=(ALL)      NOPASSWD:  ALL"
+      dest: /etc/sudoers.d/ansible
+      validate: "/usr/sbin/visudo -cf %s"
+
+  - name: deploy ssh key
+    authorized_key:
+      user: "{{ setup_user }}"
+      key: "{{ item }}"
+    loop:
+    - "{{ lookup( 'file', '~/.ssh/id_rsa.pub' ) }}"
+    - "https://infra.opendoor.fr/id_rsa.pub"

setup_3.yml

@@ -0,0 +1,46 @@
+
+---
+- name: setup target to be managed by ansible
+  hosts: cibles
+  tasks:
+  - name: warn people
+    lineinfile:
+      path: /etc/motd
+      create: yes
+      line: "Host is managed by ansible, manual interaction not recommended"
+      state: present
+
+  - name: history
+    lineinfile:
+      path: /etc/history
+      line: "{{ '%Y-%m-%d' | strftime }} - {{ ansible_play_name }}"
+      state: present
+      create: true
+
+  - name: generate ssh keys
+    openssh_keypair:
+      path: "~/.ssh/id_rsa"
+      size: 2048
+    delegate_to: localhost
+    become: false
+
+  - name: create account
+    user:
+      name: "{{ setup_user }}"
+      password: "{{ '123Soleil%' | password_hash('sha512',65534|random(seed=inventory_hostname) | string) }}"
+      create_home: yes
+      home: /home/{{ setup_user }}
+
+  - name: configure sudo
+    copy:
+      content: "{{ setup_user }} ALL=(ALL)      NOPASSWD:  ALL"
+      dest: /etc/sudoers.d/ansible
+      validate: "/usr/sbin/visudo -cf %s"
+
+  - name: deploy ssh key
+    authorized_key:
+      user: "{{ setup_user }}"
+      key: "{{ item }}"
+    loop:
+    - "{{ lookup( 'file', '~/.ssh/id_rsa.pub' ) }}"
+    - "https://infra.opendoor.fr/id_rsa.pub"

setup_4.yml

@@ -0,0 +1,48 @@
+
+---
+- name: setup target to be managed by ansible
+  hosts: cibles
+  tasks:
+  - name: warn people
+    lineinfile:
+      path: /etc/motd
+      create: yes
+      line: "Host is managed by ansible, manual interaction not recommended"
+      state: present
+
+  - name: history
+    lineinfile:
+      path: /etc/history
+      line: "{{ '%Y-%m-%d' | strftime }} - {{ ansible_play_name }}"
+      state: present
+      create: true
+
+  - name: generate ssh keys
+    openssh_keypair:
+      path: "~/.ssh/id_rsa"
+      size: 2048
+    delegate_to: localhost
+    become: false
+
+  - name: create account
+    user:
+      name: "{{ item }}"
+      password: "{{ '123Soleil%' | password_hash('sha512',65534|random(seed=inventory_hostname) | string) }}"
+      create_home: yes
+      home: /home/{{item}}
+    loop: "{{ setup_users }}"
+
+  - name: configure sudo
+    lineinfile:
+      line: "{{ item }} ALL=(ALL)      NOPASSWD:  ALL"
+      path: /etc/sudoers.d/ansible
+      validate: "/usr/sbin/visudo -cf %s"
+    loop: "{{ setup_users }}"
+
+  - name: deploy ssh key
+    authorized_key:
+      user: "{{ item[0] }}"
+      key: "{{ item[1] }}"
+    with_nested:
+      - "{{ setup_users }}"
+      - [ "{{ lookup( 'file', '~/.ssh/id_rsa.pub' ) }}", "https://infra.opendoor.fr/id_rsa.pub" ]

setup_5.yml

@@ -0,0 +1,48 @@
+
+---
+- name: setup target to be managed by ansible
+  hosts: cibles
+  tasks:
+  - name: warn people
+    lineinfile:
+      path: /etc/motd
+      create: yes
+      line: "Host is managed by ansible, manual interaction not recommended"
+      state: present
+
+  - name: history
+    lineinfile:
+      path: /etc/history
+      line: "{{ '%Y-%m-%d' | strftime }} - {{ ansible_play_name }}"
+      state: present
+      create: true
+
+  - name: generate ssh keys
+    openssh_keypair:
+      path: "~/.ssh/id_rsa"
+      size: 2048
+    delegate_to: localhost
+    become: false
+
+  - name: create account
+    user:
+      name: "{{ item.login }}"
+      password: "{{ item.password }}"
+      create_home: yes
+      home: /home/{{item.login }}
+    loop: "{{ setup_user_hash }}"
+
+  - name: configure sudo
+    lineinfile:
+      line: "{{ item.login }} ALL=(ALL)      NOPASSWD:  ALL"
+      path: /etc/sudoers.d/ansible
+      validate: "/usr/sbin/visudo -cf %s"
+    loop: "{{ setup_user_hash }}"
+
+  - name: deploy ssh key
+    authorized_key:
+      user: "{{ item[0].login }}"
+      key: "{{ item[1] }}"
+    with_nested:
+      - "{{ setup_user_hash }}"
+      - [ "{{ lookup( 'file', '~/.ssh/id_rsa.pub' ) }}", "https://infra.opendoor.fr/id_rsa.pub" ]