79 lines
2.2 KiB
YAML
79 lines
2.2 KiB
YAML
---
|
|
# Deploy common Crans configuration and tools
|
|
- hosts: server
|
|
vars:
|
|
# Debian mirror on adm
|
|
debian_mirror: http://mirror.adm.crans.org/debian
|
|
debian_components: |
|
|
main{% if ansible_system_vendor != 'QEMU' %} non-free{% endif %}
|
|
# TODO: non free should only be for SMTP and microcode on non VM/LXC
|
|
|
|
# Backup password
|
|
backuppc_rsyncd_passwd: "{{ vault_backuppc_rsyncd_passwd }}"
|
|
|
|
# NTP servers
|
|
# TODO get this list with re2o
|
|
ntp_servers:
|
|
- fy.adm.crans.org
|
|
- charybde.adm.crans.org
|
|
- silice.adm.crans.org
|
|
roles:
|
|
- debian-apt-sources
|
|
- common-security
|
|
- common-tools
|
|
- rsync-client
|
|
- ntp-client
|
|
- nfs-common
|
|
|
|
# Plug LDAP on all servers
|
|
- hosts: server
|
|
vars:
|
|
# LDAP binding
|
|
ldap_base: 'dc=crans,dc=org'
|
|
ldap_master_ipv4: '10.231.136.19'
|
|
ldap_local_replica_uri:
|
|
- "ldap://10.231.136.38"
|
|
- "ldap://10.231.136.4"
|
|
ldap_master_uri: "ldap://{{ ldap_master_ipv4 }}"
|
|
ldap_user_tree: "cn=Utilisateurs,{{ ldap_base }}"
|
|
ldap_nslcd_bind_dn: "cn=nslcd,ou=service-users,{{ ldap_base }}"
|
|
ldap_nslcd_passwd: "{{ vault_ldap_nslcd_passwd }}"
|
|
|
|
# Group permissions
|
|
ssh_allow_groups: ssh nounou apprenti cableur root
|
|
|
|
# Scripts will tell users to go there to manage their account
|
|
intranet_url: 'https://intranet.crans.org/'
|
|
|
|
# SSH keys for root account to use when LDAP is broken
|
|
ssh_pub_keys: "{{ vault_ssh_pub_keys }}"
|
|
roles:
|
|
- ldap-client
|
|
|
|
# Document servers
|
|
- hosts: voyager.adm.crans.org # test only on voyager for now
|
|
vars:
|
|
moinmoin_user: "{{ vault_moinmoin_user }}"
|
|
moinmoin_password: "{{ vault_moinmoin_password }}"
|
|
moinmoin_base_url: https://wiki.crans.org/CransTechnique/LesServeurs
|
|
roles:
|
|
- moinmoin-server
|
|
|
|
# Deploy LDAP replica
|
|
- hosts: odlyd.adm.crans.org,soyouz.adm.crans.org,fy.adm.crans.org,thot.adm.crans.org
|
|
roles: [] # TODO
|
|
|
|
# Playbook to deploy autofs NFS
|
|
- hosts: crans_physical,crans_vm,!odlyd.adm.crans.org,!zamok.adm.crans.org
|
|
roles:
|
|
- nfs-autofs
|
|
|
|
# Redirect local mail to mailserver
|
|
# Should be on server,!redisdead.adm.crans.org
|
|
- hosts: prometheus.adm.crans.org
|
|
vars:
|
|
mail_root: root@crans.org
|
|
mail_snmp_server: smtp.adm.crans.org
|
|
roles:
|
|
- nullmailer
|