tasklist debugging
This commit is contained in:
mustard
parent
49952e4195
commit
a42758a8be
4 changed files with 283 additions and 287 deletions
|
|
@ -1,162 +1,161 @@
|
|||
tasks:
|
||||
- name: Kill debug-shell service
|
||||
ansible.builtin.systemd_service:
|
||||
name: debug-shell.service
|
||||
masked: true
|
||||
- name: Kill kdump service
|
||||
ansible.builtin.systemd_service:
|
||||
name: kdump.service
|
||||
masked: true
|
||||
- name: Kill debug-shell service
|
||||
ansible.builtin.systemd_service:
|
||||
name: debug-shell.service
|
||||
masked: true
|
||||
- name: Kill kdump service
|
||||
ansible.builtin.systemd_service:
|
||||
name: kdump.service
|
||||
masked: true
|
||||
|
||||
- name: Set umask to 077
|
||||
shell: umask 077
|
||||
- name: Set umask to 077 in login.defs
|
||||
ansible.builtin.replace:
|
||||
path: /etc/login.defs
|
||||
regexp: '^UMASK.*'
|
||||
replace: 'UMASK 077'
|
||||
when: umask_changes == true
|
||||
- name: Set umask to 077
|
||||
shell: umask 077
|
||||
- name: Set umask to 077 in login.defs
|
||||
ansible.builtin.replace:
|
||||
path: /etc/login.defs
|
||||
regexp: '^UMASK.*'
|
||||
replace: 'UMASK 077'
|
||||
when: umask_changes == true
|
||||
|
||||
- name: Set umask to 077 in logins.defs
|
||||
ansible.builtin.replace:
|
||||
path: /etc/login.defs
|
||||
regexp: '^HOME_MODE'
|
||||
replace: '#HOME_MODE'
|
||||
when: umask_changes == true
|
||||
- name: Set umask to 077 in logins.defs
|
||||
ansible.builtin.replace:
|
||||
path: /etc/login.defs
|
||||
regexp: '^HOME_MODE'
|
||||
replace: '#HOME_MODE'
|
||||
when: umask_changes == true
|
||||
|
||||
- name: Set umask to 077 in bashrc
|
||||
ansible.builtin.replace:
|
||||
path: /etc/bashrc
|
||||
regexp: 'umask 022'
|
||||
replace: 'umask 077'
|
||||
when: umask_changes == true
|
||||
- name: Set umask to 077 in bashrc
|
||||
ansible.builtin.replace:
|
||||
path: /etc/bashrc
|
||||
regexp: 'umask 022'
|
||||
replace: 'umask 077'
|
||||
when: umask_changes == true
|
||||
|
||||
|
||||
- name: Make home directory private
|
||||
ansible.builtin.file:
|
||||
path: /home/*
|
||||
state: directory
|
||||
recurse: true
|
||||
mode: '0700'
|
||||
when: umask_changes == true
|
||||
|
||||
- name: Harden SSH, add kernel blacklist and hardening
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item }}'
|
||||
dest: '/{{ item }}'
|
||||
mode: '0644'
|
||||
loop:
|
||||
- 'etc/ssh/ssh_config.d/10-custom.conf'
|
||||
- 'etc/modprobe.d/workstation-blacklist.conf'
|
||||
- 'etc/sysctl.d/99-workstation.conf'
|
||||
|
||||
|
||||
- name: Reload sysctl
|
||||
shell: 'sysctl -p'
|
||||
|
||||
- name: Create coredump.conf.d
|
||||
ansible.builtin.file:
|
||||
path: '/etc/systemd/coredump.conf.d'
|
||||
state: 'directory'
|
||||
mode: '0755'
|
||||
- name: Make locks dir for dconf
|
||||
ansible.builtin.file:
|
||||
path: '/etc/dconf/db/local.d/locks'
|
||||
state: 'directory'
|
||||
mode: '0755'
|
||||
- name: Create XDG portals directory
|
||||
ansible.builtin.file:
|
||||
path: '/etc/xdg-desktop-portal'
|
||||
state: 'directory'
|
||||
mode: '0755'
|
||||
|
||||
- name: Create /etc/systemd/system/NetworkManager.service.d
|
||||
ansible.builtin.file:
|
||||
path: '/etc/systemd/system/NetworkManager.service.d'
|
||||
state: 'directory'
|
||||
mode: '0755'
|
||||
when: manage_network == true
|
||||
|
||||
- name: Copy dconf files + xdg-desktop-portals fix + Network manager
|
||||
ansible.builtin.copy:
|
||||
src: 'etc/systemd/system/NetworkManager.service.d/99-brace.conf'
|
||||
dest: '/etc/systemd/system/NetworkManager.service.d/99-brace.conf'
|
||||
mode: '0644'
|
||||
when: manage_network == true
|
||||
|
||||
- name: Copy dconf files + xdg-desktop-portals fix + Network manager
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item }}'
|
||||
dest: '/{{ item }}'
|
||||
mode: '0644'
|
||||
loop:
|
||||
- 'etc/security/limits.d/30-disable-coredump.conf'
|
||||
- 'etc/systemd/coredump.conf.d/disable.conf'
|
||||
- 'etc/dconf/db/local.d/locks/privacy'
|
||||
- 'etc/dconf/db/local.d/privacy'
|
||||
|
||||
- name: Update dconf
|
||||
shell: sudo dconf update
|
||||
|
||||
- name: Setup ZRAM, flatpak updater and environment variables to disable GJS + WebkitGTK JIT
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item }}'
|
||||
dest: '/{{ item }}'
|
||||
mode: '0644'
|
||||
loop:
|
||||
- 'etc/systemd/zram-generator.conf'
|
||||
- 'etc/systemd/user/update-user-flatpaks.service'
|
||||
- 'etc/systemd/user/update-user-flatpaks.timer'
|
||||
- 'etc/environment'
|
||||
|
||||
- name: Drop flathub script to homedir for any new appvms created based on this template
|
||||
ansible.builtin.copy:
|
||||
src: 'etc/skel/flathub.sh'
|
||||
dest: '/etc/skel/flathub.sh'
|
||||
- name: Make home directory private
|
||||
ansible.builtin.file:
|
||||
path: /home/*
|
||||
state: directory
|
||||
recurse: true
|
||||
mode: '0700'
|
||||
when: umask_changes == true
|
||||
|
||||
- name: Upgrade all packages
|
||||
ansible.builtin.dnf5:
|
||||
name: "*"
|
||||
state: latest
|
||||
- name: Harden SSH, add kernel blacklist and hardening
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item }}'
|
||||
dest: '/{{ item }}'
|
||||
mode: '0644'
|
||||
loop:
|
||||
- 'etc/ssh/ssh_config.d/10-custom.conf'
|
||||
- 'etc/modprobe.d/workstation-blacklist.conf'
|
||||
- 'etc/sysctl.d/99-workstation.conf'
|
||||
|
||||
- name: Mark packages as manually installed to avoid removal
|
||||
shell: 'sudo dnf mark user flatpak gnome-menus qubes-menus -y'
|
||||
|
||||
- name: Enable hardened_malloc COPR
|
||||
shell: 'sudo dnf copr enable secureblue/hardened_malloc -y'
|
||||
- name: Reload sysctl
|
||||
shell: 'sysctl -p'
|
||||
|
||||
- name: Install hardened_malloc
|
||||
ansible.builtin.dnf5:
|
||||
name: 'hardened_malloc'
|
||||
state: 'present'
|
||||
- name: Create coredump.conf.d
|
||||
ansible.builtin.file:
|
||||
path: '/etc/systemd/coredump.conf.d'
|
||||
state: 'directory'
|
||||
mode: '0755'
|
||||
- name: Make locks dir for dconf
|
||||
ansible.builtin.file:
|
||||
path: '/etc/dconf/db/local.d/locks'
|
||||
state: 'directory'
|
||||
mode: '0755'
|
||||
- name: Create XDG portals directory
|
||||
ansible.builtin.file:
|
||||
path: '/etc/xdg-desktop-portal'
|
||||
state: 'directory'
|
||||
mode: '0755'
|
||||
|
||||
- name: Enable hardened_malloc
|
||||
ansible.builtin.copy:
|
||||
src: 'etc/ld.so.preload'
|
||||
dest: '/etc/ld.so.preload'
|
||||
mode: '0644'
|
||||
- name: Enable hardened_malloc for system wide flatpak
|
||||
shell: 'sudo flatpak override --system --filesystem=host-os:ro --env=LD_PRELOAD=/var/run/host/usr/lib64/libhardened_malloc.so'
|
||||
- name: Enable hardened_malloc for user flatpak # has to be run per APP VM
|
||||
shell: 'flatpak override --user --filesystem=host-os:ro --env=LD_PRELOAD=/var/run/host/usr/lib64/libhardened_malloc.so'
|
||||
- name: Setup dnf repos
|
||||
ansible.builtin.copy:
|
||||
src: 'etc/dnf/dnf.conf'
|
||||
dest: '/etc/dnf/dnf.conf'
|
||||
mode: '0644'
|
||||
- name: Create /etc/systemd/system/NetworkManager.service.d
|
||||
ansible.builtin.file:
|
||||
path: '/etc/systemd/system/NetworkManager.service.d'
|
||||
state: 'directory'
|
||||
mode: '0755'
|
||||
when: manage_network == true
|
||||
|
||||
- name: Get list of files
|
||||
ansible.builtin.find:
|
||||
paths: /etc/yum.repos.d/
|
||||
recurse: true
|
||||
register: found_files
|
||||
- name: Copy dconf files + xdg-desktop-portals fix + Network manager
|
||||
ansible.builtin.copy:
|
||||
src: 'etc/systemd/system/NetworkManager.service.d/99-brace.conf'
|
||||
dest: '/etc/systemd/system/NetworkManager.service.d/99-brace.conf'
|
||||
mode: '0644'
|
||||
when: manage_network == true
|
||||
|
||||
- name: Replace text in those files
|
||||
ansible.builtin.lineinfile:
|
||||
backup: true
|
||||
backrefs: true
|
||||
path: '{{ item.path }}'
|
||||
regexp: '^(metalink=.*)$'
|
||||
line: '\1&protocol=https'
|
||||
loop: '{{ found_files.files }}'
|
||||
- name: Copy dconf files + xdg-desktop-portals fix + Network manager
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item }}'
|
||||
dest: '/{{ item }}'
|
||||
mode: '0644'
|
||||
loop:
|
||||
- 'etc/security/limits.d/30-disable-coredump.conf'
|
||||
- 'etc/systemd/coredump.conf.d/disable.conf'
|
||||
- 'etc/dconf/db/local.d/locks/privacy'
|
||||
- 'etc/dconf/db/local.d/privacy'
|
||||
|
||||
- name: Update dconf
|
||||
shell: sudo dconf update
|
||||
|
||||
- name: Setup ZRAM, flatpak updater and environment variables to disable GJS + WebkitGTK JIT
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item }}'
|
||||
dest: '/{{ item }}'
|
||||
mode: '0644'
|
||||
loop:
|
||||
- 'etc/systemd/zram-generator.conf'
|
||||
- 'etc/systemd/user/update-user-flatpaks.service'
|
||||
- 'etc/systemd/user/update-user-flatpaks.timer'
|
||||
- 'etc/environment'
|
||||
|
||||
- name: Drop flathub script to homedir for any new appvms created based on this template
|
||||
ansible.builtin.copy:
|
||||
src: 'etc/skel/flathub.sh'
|
||||
dest: '/etc/skel/flathub.sh'
|
||||
mode: '0700'
|
||||
|
||||
- name: Upgrade all packages
|
||||
ansible.builtin.dnf5:
|
||||
name: "*"
|
||||
state: latest
|
||||
|
||||
- name: Mark packages as manually installed to avoid removal
|
||||
shell: 'sudo dnf mark user flatpak gnome-menus qubes-menus -y'
|
||||
|
||||
- name: Enable hardened_malloc COPR
|
||||
shell: 'sudo dnf copr enable secureblue/hardened_malloc -y'
|
||||
|
||||
- name: Install hardened_malloc
|
||||
ansible.builtin.dnf5:
|
||||
name: 'hardened_malloc'
|
||||
state: 'present'
|
||||
|
||||
- name: Enable hardened_malloc
|
||||
ansible.builtin.copy:
|
||||
src: 'etc/ld.so.preload'
|
||||
dest: '/etc/ld.so.preload'
|
||||
mode: '0644'
|
||||
- name: Enable hardened_malloc for system wide flatpak
|
||||
shell: 'sudo flatpak override --system --filesystem=host-os:ro --env=LD_PRELOAD=/var/run/host/usr/lib64/libhardened_malloc.so'
|
||||
- name: Enable hardened_malloc for user flatpak # has to be run per APP VM
|
||||
shell: 'flatpak override --user --filesystem=host-os:ro --env=LD_PRELOAD=/var/run/host/usr/lib64/libhardened_malloc.so'
|
||||
- name: Setup dnf repos
|
||||
ansible.builtin.copy:
|
||||
src: 'etc/dnf/dnf.conf'
|
||||
dest: '/etc/dnf/dnf.conf'
|
||||
mode: '0644'
|
||||
|
||||
- name: Get list of files
|
||||
ansible.builtin.find:
|
||||
paths: /etc/yum.repos.d/
|
||||
recurse: true
|
||||
register: found_files
|
||||
|
||||
- name: Replace text in those files
|
||||
ansible.builtin.lineinfile:
|
||||
backup: true
|
||||
backrefs: true
|
||||
path: '{{ item.path }}'
|
||||
regexp: '^(metalink=.*)$'
|
||||
line: '\1&protocol=https'
|
||||
loop: '{{ found_files.files }}'
|
||||
Loading…
Add table
Add a link
Reference in a new issue