refactor(environment): split main.yml into focused sub-task files
This commit is contained in:
@@ -2,278 +2,14 @@
|
||||
- name: Configure work environment
|
||||
become: "{{ hypervisor_type != 'vmware' }}"
|
||||
block:
|
||||
- name: Wait for connection
|
||||
ansible.builtin.wait_for_connection:
|
||||
timeout: 180
|
||||
delay: 5
|
||||
- name: Detect and validate live environment
|
||||
ansible.builtin.include_tasks: _detect_live.yml
|
||||
|
||||
- name: Gather facts
|
||||
ansible.builtin.setup:
|
||||
|
||||
- name: Check for live environment markers
|
||||
ansible.builtin.stat:
|
||||
path: "{{ item }}"
|
||||
loop:
|
||||
- /run/archiso
|
||||
- /run/live
|
||||
- /run/initramfs
|
||||
- /run/initramfs/live
|
||||
register: environment_live_marker_stat
|
||||
changed_when: false
|
||||
|
||||
- name: Determine root filesystem type
|
||||
ansible.builtin.set_fact:
|
||||
environment_root_fstype: >-
|
||||
{{
|
||||
ansible_mounts
|
||||
| selectattr('mount', 'equalto', '/')
|
||||
| map(attribute='fstype')
|
||||
| list
|
||||
| first
|
||||
| default('')
|
||||
| lower
|
||||
}}
|
||||
environment_archiso_present: >-
|
||||
{{
|
||||
(
|
||||
environment_live_marker_stat.results
|
||||
| selectattr('item', 'equalto', '/run/archiso')
|
||||
| selectattr('stat.exists')
|
||||
| list
|
||||
| length
|
||||
) > 0
|
||||
}}
|
||||
changed_when: false
|
||||
|
||||
- name: Identify live environment indicators
|
||||
ansible.builtin.set_fact:
|
||||
environment_is_live_environment: >-
|
||||
{{
|
||||
(
|
||||
environment_live_marker_stat.results
|
||||
| selectattr('stat.exists')
|
||||
| list
|
||||
| length
|
||||
) > 0
|
||||
or environment_root_fstype in ['overlay', 'overlayfs', 'squashfs', 'aufs']
|
||||
or (ansible_hostname | default('') | lower is search('live'))
|
||||
}}
|
||||
changed_when: false
|
||||
|
||||
- name: Abort if target is not a live environment
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- environment_is_live_environment | bool
|
||||
fail_msg: |
|
||||
PRODUCTION SYSTEM DETECTED - ABORTING
|
||||
|
||||
The target system does not appear to be a live installer environment.
|
||||
This playbook must run from a live ISO to avoid wiping production data.
|
||||
|
||||
Boot from a live installer (Arch, Debian, Ubuntu, etc.) and retry.
|
||||
quiet: true
|
||||
|
||||
- name: Abort if the host is not booted from the Arch install media
|
||||
when:
|
||||
- not (custom_iso | bool)
|
||||
- not environment_archiso_present | bool
|
||||
ansible.builtin.fail:
|
||||
msg: This host is not booted from the Arch install media!
|
||||
|
||||
- name: Select primary Network Interface
|
||||
when: hypervisor_type == "vmware"
|
||||
ansible.builtin.set_fact:
|
||||
environment_interface_name: >-
|
||||
{{
|
||||
(
|
||||
(ansible_facts.interfaces | default(ansible_facts['ansible_interfaces'] | default([])))
|
||||
| reject('equalto', 'lo')
|
||||
| list
|
||||
| first
|
||||
)
|
||||
| default('')
|
||||
}}
|
||||
changed_when: false
|
||||
|
||||
- name: Set IP-Address
|
||||
when:
|
||||
- hypervisor_type == "vmware"
|
||||
- system_cfg.network.ip is defined and system_cfg.network.ip | string | length > 0
|
||||
ansible.builtin.command: >-
|
||||
ip addr replace {{ system_cfg.network.ip }}/{{ system_cfg.network.prefix }}
|
||||
dev {{ environment_interface_name }}
|
||||
register: environment_ip_result
|
||||
changed_when: environment_ip_result.rc == 0
|
||||
|
||||
- name: Set Default Gateway
|
||||
when:
|
||||
- hypervisor_type == "vmware"
|
||||
- system_cfg.network.gateway is defined and system_cfg.network.gateway | string | length > 0
|
||||
- system_cfg.network.ip is defined and system_cfg.network.ip | string | length > 0
|
||||
ansible.builtin.command: "ip route replace default via {{ system_cfg.network.gateway }}"
|
||||
register: environment_gateway_result
|
||||
changed_when: environment_gateway_result.rc == 0
|
||||
|
||||
- name: Synchronize clock via NTP
|
||||
ansible.builtin.command: timedatectl set-ntp true
|
||||
register: environment_ntp_result
|
||||
changed_when: environment_ntp_result.rc == 0
|
||||
|
||||
- name: Configure SSH for root login
|
||||
when: hypervisor_type == "vmware" and hypervisor_cfg.ssh | bool
|
||||
block:
|
||||
- name: Allow login
|
||||
ansible.builtin.replace:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "{{ item.regexp }}"
|
||||
replace: "{{ item.replace }}"
|
||||
loop:
|
||||
- regexp: "^#?PermitEmptyPasswords.*"
|
||||
replace: "PermitEmptyPasswords yes"
|
||||
- regexp: "^#?PermitRootLogin.*"
|
||||
replace: "PermitRootLogin yes"
|
||||
loop_control:
|
||||
label: "{{ item.replace }}"
|
||||
|
||||
- name: Reload SSH service to apply changes
|
||||
ansible.builtin.service:
|
||||
name: sshd
|
||||
state: reloaded
|
||||
|
||||
- name: Set SSH connection for VMware
|
||||
ansible.builtin.set_fact:
|
||||
ansible_connection: ssh
|
||||
ansible_user: root
|
||||
- name: Configure network and connectivity
|
||||
ansible.builtin.include_tasks: _configure_network.yml
|
||||
|
||||
- name: Prepare installer environment
|
||||
block:
|
||||
- name: Speed-up Bootstrap process
|
||||
when: not (custom_iso | bool)
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pacman.conf
|
||||
regexp: ^#ParallelDownloads =
|
||||
line: ParallelDownloads = 20
|
||||
|
||||
- name: Wait for pacman lock to be released
|
||||
when: not (custom_iso | bool)
|
||||
ansible.builtin.wait_for:
|
||||
path: /var/lib/pacman/db.lck
|
||||
state: absent
|
||||
timeout: 120
|
||||
changed_when: false
|
||||
|
||||
- name: Setup Pacman
|
||||
when:
|
||||
- not (custom_iso | bool)
|
||||
- item.os is not defined or os in item.os
|
||||
community.general.pacman:
|
||||
update_cache: true
|
||||
force: true
|
||||
name: "{{ item.name }}"
|
||||
state: latest
|
||||
loop:
|
||||
- { name: glibc }
|
||||
- { name: dnf, os: [almalinux, fedora, rhel, rocky] }
|
||||
- { name: debootstrap, os: [debian, ubuntu, ubuntu-lts] }
|
||||
- { name: debian-archive-keyring, os: [debian] }
|
||||
- { name: ubuntu-keyring, os: [ubuntu, ubuntu-lts] }
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
retries: 4
|
||||
delay: 15
|
||||
|
||||
- name: Prepare /iso mount and repository for RHEL-based systems
|
||||
when: os == "rhel"
|
||||
block:
|
||||
- name: Create /iso directory
|
||||
ansible.builtin.file:
|
||||
path: /usr/local/install/redhat/dvd
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Detect RHEL ISO device
|
||||
ansible.builtin.command: lsblk -rno NAME,TYPE
|
||||
register: environment_lsblk_result
|
||||
changed_when: false
|
||||
|
||||
- name: Select RHEL ISO device
|
||||
vars:
|
||||
_rom_devices: >-
|
||||
{{
|
||||
environment_lsblk_result.stdout_lines
|
||||
| map('split', ' ')
|
||||
| selectattr('1', 'equalto', 'rom')
|
||||
| map('first')
|
||||
| map('regex_replace', '^', '/dev/')
|
||||
| list
|
||||
}}
|
||||
ansible.builtin.set_fact:
|
||||
environment_rhel_iso_device: >-
|
||||
{{
|
||||
_rom_devices[-1]
|
||||
if _rom_devices | length > 1
|
||||
else (_rom_devices[0] | default('/dev/sr1'))
|
||||
}}
|
||||
|
||||
- name: Mount RHEL ISO
|
||||
ansible.posix.mount:
|
||||
src: "{{ environment_rhel_iso_device }}"
|
||||
path: /usr/local/install/redhat/dvd
|
||||
fstype: iso9660
|
||||
opts: "ro,loop"
|
||||
state: mounted
|
||||
|
||||
# Security note: RPM Sequoia signature policy is relaxed to allow
|
||||
# bootstrapping RHEL-family distros from the Arch ISO, where the
|
||||
# host rpm/dnf does not trust target distro GPG keys. Package
|
||||
# integrity is verified by the target system's own rpm after reboot.
|
||||
- name: Relax RPM Sequoia signature policy for RHEL bootstrap
|
||||
when: is_rhel | bool
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/rpm/macros
|
||||
content: "%_pkgverify_level none\n"
|
||||
mode: "0644"
|
||||
|
||||
- name: Configure RHEL Repos for installation
|
||||
when: is_rhel | bool
|
||||
block:
|
||||
- name: Create directories for repository files and RPM GPG keys
|
||||
ansible.builtin.file:
|
||||
path: /etc/yum.repos.d
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Create RHEL repository file
|
||||
ansible.builtin.template:
|
||||
src: "{{ os }}.repo.j2"
|
||||
dest: /etc/yum.repos.d/{{ os }}.repo
|
||||
mode: "0644"
|
||||
|
||||
- name: Check for third-party preparation tasks
|
||||
run_once: true
|
||||
become: false
|
||||
delegate_to: localhost
|
||||
vars:
|
||||
ansible_connection: local
|
||||
block:
|
||||
- name: Resolve third-party preparation task path
|
||||
ansible.builtin.set_fact:
|
||||
environment_thirdparty_tasks_path: >-
|
||||
{{
|
||||
thirdparty_tasks
|
||||
if thirdparty_tasks | regex_search('^/')
|
||||
else playbook_dir + '/' + thirdparty_tasks
|
||||
}}
|
||||
changed_when: false
|
||||
|
||||
- name: Stat third-party preparation tasks
|
||||
ansible.builtin.stat:
|
||||
path: "{{ environment_thirdparty_tasks_path }}"
|
||||
register: environment_thirdparty_tasks_stat
|
||||
changed_when: false
|
||||
ansible.builtin.include_tasks: _prepare_installer.yml
|
||||
|
||||
- name: Run third-party preparation tasks
|
||||
when:
|
||||
- thirdparty_tasks | length > 0
|
||||
- environment_thirdparty_tasks_stat.stat.exists
|
||||
ansible.builtin.include_tasks: "{{ environment_thirdparty_tasks_path }}"
|
||||
ansible.builtin.include_tasks: _thirdparty.yml
|
||||
|
||||
Reference in New Issue
Block a user