This commit is contained in:
2023-07-07 12:15:10 -04:00
parent c4804673ab
commit 9ed822eaec
6 changed files with 108 additions and 97 deletions

View File

@@ -1,61 +1,65 @@
---
- name: get package facts
- name: Get package facts
ansible.builtin.package_facts:
- name: get service facts
service_facts:
- name: Get service facts
ansible.builtin.service_facts:
- name: add default ssh keys
authorized_key:
- name: Add default ssh keys
ansible.posix.authorized_key:
key: "{{ lookup('file', '{{ ssh_keyfile }}') }}"
user: "{{ remote_user }}"
state: present
exclusive: True
exclusive: true
when: "'mothershipbu.lyon' not in inventory_hostname"
- name: add default ssh keys - mothershipbu
authorized_key:
- name: Add default ssh keys - mothershipbu
ansible.posix.authorized_key:
key: "{{ lookup('file', 'keys-mothershipbu') }}"
user: "{{ remote_user }}"
state: present
exclusive: True
exclusive: true
when: "'mothershipbu.lyon' in inventory_hostname"
- name: disable password ssh auth
- name: Disable password ssh auth
ansible.builtin.lineinfile:
path: "/etc/ssh/sshd_config"
regexp: '^PasswordAuthentication'
line: 'PasswordAuthentication no'
backrefs: yes
backrefs: true
notify: restart ssh service - {{ ansible_distribution_file_variety }}
- name: automatic security updates - debian
package: name=unattended-upgrades state=latest
- name: Automatic security updates - debian
ansible.builtin.package:
name: unattended-upgrades
state: present
when: ansible_distribution_file_variety == "Debian"
- name: automatic security updates - redhat
package: name=dnf-automatic state=latest
- name: Automatic security updates - redhat
ansible.builtin.package:
name: dnf-automatic
state: present
when: ansible_distribution_file_variety == "RedHat"
- name: configure automatic security updates step 01 - redhat
- name: Configure automatic security updates step 01 - redhat
ansible.builtin.lineinfile:
path: "/etc/dnf/automatic.conf"
regexp: '^upgrade_type ='
line: 'upgrade_type = security'
backrefs: yes
backrefs: true
when: ansible_distribution_file_variety == "RedHat"
- name: configure automatic security updates step 02 - redhat
- name: Configure automatic security updates step 02 - redhat
ansible.builtin.lineinfile:
path: "/etc/dnf/automatic.conf"
regexp: '^apply_updates ='
line: 'apply_updates = yes'
backrefs: yes
backrefs: true
when: ansible_distribution_file_variety == "RedHat"
- name: enable and start dnf-automatic.timer - redhat
- name: Enable and start dnf-automatic.timer - redhat
ansible.builtin.systemd:
state: started
enabled: yes
enabled: true
name: dnf-automatic.timer
when: ansible_distribution_file_variety == "RedHat"