-
Notifications
You must be signed in to change notification settings - Fork 0
/
playbook-install.yml
186 lines (158 loc) · 6.58 KB
/
playbook-install.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
---
- hosts: all
become: yes
gather_facts: yes
tasks:
- name: Packages | Install OS tools
when: ansible_os_family == 'RedHat'
shell: microdnf -y install --nodocs --noplugins --best {{ item }}
with_items:
- supervisor
- logrotate
- python3-pip
- cronie
- yum-utils
- name: Packages | Add hashicorp repo
shell: yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
- name: cloud-init | Create dirs
file: path={{ item }} state=directory
with_items:
- /var/lib/cloud/scripts/per-once
- /var/lib/cloud/scripts/per-boot
- name: Percona Server for MySQL | Install Python Modules
when: ansible_os_family == 'RedHat'
pip:
name:
- requests
- PyMySQL
extra_args: --user
executable: pip3
- name: Percona Server for MySQL | stat /root/.my.cnf
stat: path=/root/.my.cnf
register: root_mycnf_file
- name: Percona Server for MySQL | Add password generator script
when: not root_mycnf_file.stat.exists
copy:
content: |
#!/bin/sh
TEMP_PASS=$(grep 'temporary password' /var/log/mysqld.log | sed -e 's/.*localhost: //' | tail -1)
NEW_PASS=$(dd if=/dev/urandom bs=1 count=256 2>/dev/null | tr -cd '[:alnum:],.!@#$%^&*' | head -c32)
mysql "-p${TEMP_PASS}" --connect-expired-password -e "SET PASSWORD = PASSWORD('$NEW_PASS');"
echo "[client]
password = '$NEW_PASS'" > /root/.my.cnf
echo "
++++++++++++++++++++++++++ Percona Server for MySQL ++++++++++++++++++++++++++
Setting password for root@localhost user: $NEW_PASS
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
" | tee -a /var/log/mysqld.log
dest: /var/lib/cloud/scripts/per-once/init-mysql-password
mode: 0755
- name: SSM | Install RPMs
when: ansible_os_family == 'RedHat'
shell: microdnf -y --enablerepo ssm install --nodocs --noplugins --best {{ item }}
with_items:
- nginx
- consul
- grafana
- name: NGINX SSL Certificate | Add script
copy:
content: |
#!/bin/sh
set -o errexit
mkdir -p /srv/nginx
if [ ! -e /srv/nginx/dhparam.pem ]; then
openssl dhparam -out /srv/nginx/dhparam.pem 2048
fi
if [ ! -e /srv/nginx/ca-certs.pem ]; then
# Fetch letsencrypt chain
curl https://letsencrypt.org/certs/isrgrootx1.pem > /srv/nginx/ca-certs.pem
curl https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem >> /srv/nginx/ca-certs.pem
curl https://letsencrypt.org/certs/letsencryptauthorityx1.pem >> /srv/nginx/ca-certs.pem
curl https://www.identrust.com/certificates/trustid/root-download-x3.html >> /srv/nginx/ca-certs.pem
fi
if [ ! -e /srv/nginx/certificate.conf ]; then
echo "
[ req ]
distinguished_name = req_distinguished_name
prompt = no
[ req_distinguished_name ]
O = Main Org.
" > /srv/nginx/certificate.conf
fi
if [ ! -e /srv/nginx/certificate.key -o ! -e /srv/nginx/certificate.crt ]; then
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout /srv/nginx/certificate.key \
-out /srv/nginx/certificate.crt \
-config /srv/nginx/certificate.conf
fi
dest: /var/lib/cloud/scripts/per-boot/generate-ssl-certificate
mode: 0755
- name: NGINX SSL Certificate | Check certificate file
stat: path=/srv/nginx/certificate.crt
register: certificate_file
- name: NGINX SSL Certificate | Generate certificate
when: not certificate_file.stat.exists
command: /var/lib/cloud/scripts/per-boot/generate-ssl-certificate
- name: Grafana | Check data dir
stat: path=/srv/grafana/grafana.db
register: grafana_db
- name: Grafana | Enable Anonymous access
when: not grafana_db.stat.exists
community.general.ini_file:
path: /etc/grafana/grafana.ini
section: auth.anonymous
option: enabled
value: true
- name: Grafana | Enable Anonymous access
when: not grafana_db.stat.exists
community.general.ini_file:
path: /etc/grafana/grafana.ini
section: auth.anonymous
option: org_role
value: Editor
- name: Grafana | Set snapshot server
when: not grafana_db.stat.exists
community.general.ini_file:
path: /etc/grafana/grafana.ini
section: snapshots
option: external_enabled
value: false
- name: Grafana | Set snapshot server
when: not grafana_db.stat.exists
community.general.ini_file:
path: /etc/grafana/grafana.ini
section: snapshots
option: external_snapshot_url
value: http://127.0.0.1
- name: Grafana | Set snapshot server
when: not grafana_db.stat.exists
community.general.ini_file:
path: /etc/grafana/grafana.ini
section: snapshots
option: external_snapshot_name
value: Share with Shattered Silicon
- name: Grafana | Set plugins
when: not grafana_db.stat.exists
community.general.ini_file:
path: /etc/grafana/grafana.ini
section: plugins
option: allow_loading_unsigned_plugins
value: ssm-app,ssm-add-instance-app-panel,ssm-qan-app-panel,ssm-qan-settings-app-panel,ssm-remote-instances-panel,ssm-singlestat-panel,ssm-system-summary-app-panel,ssm-update-panel,ssm-filtertable-panel,ssm-blockmap-panel
- name: Grafana | Set DATA_DIR
when: not grafana_db.stat.exists
community.general.ini_file:
path: /etc/sysconfig/grafana-server
option: DATA_DIR
value: /srv/grafana
- name: supervisor | Fix credentials
community.general.ini_file:
path: /etc/supervisord.conf
section: supervisorctl
option: username
value: dummy
- name: supervisor | Fix credentials
community.general.ini_file:
path: /etc/supervisord.conf
section: supervisorctl
option: password
value: dummy