|
|
@@ -3,5 +3,264 @@ format: markdown
|
|
|
title: Ansible ff@home aufsetzen
|
|
|
toc: yes
|
|
|
...
|
|
|
+# Description
|
|
|
+# Software
|
|
|
+- Debian 12 (bookworm) oder Ubuntu 22.04
|
|
|
+- python3 und ansible
|
|
|
+
|
|
|
+ ***** Es empfiehlt sich, eine python virtuelle Umgebung zu verwenden *****
|
|
|
+ Die folgenden Pakete installieren:
|
|
|
+ sudo apt install python3-pip python3-venv
|
|
|
+
|
|
|
+Dazu in das Basisverzeichnis gehen (bei mir /datadisk), dann die virtuelle Umgebung anlegen
|
|
|
+python3 -m venv ffhome
|
|
|
+In das Verzeichnis ffhome wechseln und die Umgebung aktivieren
|
|
|
+source bin/activate
|
|
|
+Dadurch ändert sich der prompt:
|
|
|
+(ffhome) 18:16:41[frankb@berglap /datadisk/ffhome 0]
|
|
|
+
|
|
|
+Zum Verlassen der Umgebung:
|
|
|
+deactivate oder Terminal Fenster schliessen
|
|
|
+
|
|
|
+Jetzt kann ansible in der ffhome Umgebung installiert werden:
|
|
|
+pip3 install ansible
|
|
|
+
|
|
|
+
|
|
|
+18:11:20[frankb@berglap /datadisk/ffhome 0]
|
|
|
+Die Verzeichnistruktur der Testumgebung
|
|
|
+tree -L 4
|
|
|
+ .
|
|
|
+ ├── ansible.cfg
|
|
|
+ ├── bin
|
|
|
+ │ ├── activate
|
|
|
+ │ ├── activate.csh
|
|
|
+ │ ├── activate.fish
|
|
|
+ │ ├── Activate.ps1
|
|
|
+ │ ├── ansible
|
|
|
+ │ ├── ansible-community
|
|
|
+ ...
|
|
|
+ │ └── yamllint
|
|
|
+ ├── include
|
|
|
+ ├── inventory
|
|
|
+ │ ├── hosts.yaml
|
|
|
+ │ └── host_vars
|
|
|
+ │ ├── bergdesk
|
|
|
+ │ │ ├── vars
|
|
|
+ │ │ └── vault
|
|
|
+ │ ├── berghofen
|
|
|
+ │ │ ├── vars
|
|
|
+ │ │ └── vault
|
|
|
+ │ ├── berglap
|
|
|
+ │ │ ├── vars
|
|
|
+ │ │ └── vault
|
|
|
+ │ └── luna
|
|
|
+ │ ├── vars
|
|
|
+ │ └── vault
|
|
|
+ ├── lib
|
|
|
+ │ └── python3.10
|
|
|
+ ├── lib64 -> lib
|
|
|
+ ...
|
|
|
+ ├── playbooks
|
|
|
+ │ └── update.yaml
|
|
|
+ └── pyvenv.cfg
|
|
|
+
|
|
|
+Bei den ... sind Zeilen der Übersichtlichkeit halber weggelassen.
|
|
|
+
|
|
|
+Datei mit den beteiligten Hosts inventory/hosts.yaml
|
|
|
+
|
|
|
+ ---
|
|
|
+ all:
|
|
|
+ vars:
|
|
|
+ ansible_port: 24
|
|
|
+ ansible_user: frankb
|
|
|
+ ansible_become: true
|
|
|
+
|
|
|
+ apus:
|
|
|
+ hosts:
|
|
|
+ berghofen:
|
|
|
+ ansible_host: 192.168.178.51
|
|
|
+ ansible_user: fb
|
|
|
+ ansible_become_password: "{{ berghofen_password }}"
|
|
|
+
|
|
|
+ desktops:
|
|
|
+ hosts:
|
|
|
+ bergdesk:
|
|
|
+ ansible_host: 192.168.178.201
|
|
|
+ ansible_become_pass: '{{ bergdesk_password }}'
|
|
|
+
|
|
|
+ berglap:
|
|
|
+ ansible_host: 192.168.178.52
|
|
|
+ ansible_become_pass: '{{ berglap_password }}'
|
|
|
+
|
|
|
+ luna:
|
|
|
+ ansible_host: 192.168.178.224
|
|
|
+ ansible_become_pass: '{{ luna_password }}'
|
|
|
+
|
|
|
+ altlast:
|
|
|
+ hosts:
|
|
|
+ hoerde:
|
|
|
+ ansible_host: 193.43.220.136
|
|
|
+ ansible_become: true
|
|
|
+ ansible_become_method: su
|
|
|
+
|
|
|
+ supernodes:
|
|
|
+ hosts:
|
|
|
+ 31.172.33.20:
|
|
|
+ ansible_port: 22
|
|
|
+ snng-dus01.ffdo.de:
|
|
|
+ ansible_port: 22
|
|
|
+ snng-dtm01.ffdo.de:
|
|
|
+ ansible_port: 22
|
|
|
+
|
|
|
+Die Gruppen apus und desktops enthalten die testhosts, die Gruppen altlast und supernodes sind nicht komplett einbezogen.
|
|
|
+
|
|
|
+
|
|
|
+Im Verzeichnis inventory/host_vars sind Variablen für die einzelnen hosts, also hier die passwords, in vars unverschlüsselt, in vault aes256 geschützt. Beispielhaft mal für bergdesk
|
|
|
+
|
|
|
+bergdesk/vars
|
|
|
+ ---
|
|
|
+ bergdesk_password: "{{ vault_bergdesk_password }}"
|
|
|
+
|
|
|
+bergdesk/vault
|
|
|
+ $ANSIBLE_VAULT;1.2;AES256;xx
|
|
|
+ 35656536383233636434636533613830303439316263636436363932333636626462616461636537
|
|
|
+ 3838626266396332363236643361626134393238636133640a646333333866643161356333626564
|
|
|
+ 32373735343033633666353763376230646137663639373438393537663031643562376365396337
|
|
|
+ 3161646534666236350a303366373433373833373066353030363766616166666361376637393464
|
|
|
+ 30613139313661643932373239333865616338653132613530393161656466326561633537383535
|
|
|
+ 3631356664643139383037636565346630643036353364333866
|
|
|
+
|
|
|
+Zur Erzeugung der Verschlüsselung in der vault Datei
|
|
|
+ ---
|
|
|
+ vault_bergdesk_password: hier das echte PW eintragen
|
|
|
+dann mit
|
|
|
+ansible-vault encrypt vault --vault-id xxxxx@prompt
|
|
|
+die verschlüsselte vault datei erzeugen
|
|
|
+anzeigen kann man die Datei mit ansible-vault view vault
|
|
|
+und entschlüsseln mit ansible-vault decrypt vault
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+playbooks/update.yaml
|
|
|
+ ---
|
|
|
+ # name: update yaml
|
|
|
+ - hosts: [desktops,apus,altlast]
|
|
|
+
|
|
|
+ tasks:
|
|
|
+ - name: Testausgabe
|
|
|
+ debug: msg="Hallo von {{ ansible_hostname }} Ansible managed!"
|
|
|
+
|
|
|
+ - name: df -h Aufruf
|
|
|
+ command: df -h /
|
|
|
+ changed_when: false
|
|
|
+ register: df_cmd
|
|
|
+
|
|
|
+ - debug:
|
|
|
+ msg: '{{df_cmd.stdout_lines}} {{ansible_distribution }}'
|
|
|
+
|
|
|
+ - name: ping meine hosts
|
|
|
+ ansible.builtin.ping:
|
|
|
+ changed_when: false
|
|
|
+
|
|
|
+ # - name: Warte auf enter Taste
|
|
|
+ # ansible.builtin.pause:
|
|
|
+
|
|
|
+ - name: apt update mit upgrade und autoremove
|
|
|
+ ansible.builtin.apt:
|
|
|
+ update_cache: yes
|
|
|
+ cache_valid_time: 3600
|
|
|
+ autoremove: yes
|
|
|
+ upgrade: 'yes'
|
|
|
+ when: ansible_os_family == "Debian"
|
|
|
+
|
|
|
+ - stat:
|
|
|
+ path: /var/run/needrestart
|
|
|
+ register: needrestart_file
|
|
|
+
|
|
|
+ - name: reboot falls erforderlich
|
|
|
+ ansible.builtin.reboot:
|
|
|
+ when:
|
|
|
+ - needrestart_file.stat.exists == True
|
|
|
+
|
|
|
+
|
|
|
+Ausgabe von playbook update.yaml (die letzten beiden tasks stat und reboot sind nicht in der Ausgabe, weil sie später hinzugefügt wurden)
|
|
|
+
|
|
|
+luna ist ausgeschaltet und nicht erreichbar.
|
|
|
+
|
|
|
+(ffhome) 20:55:59[frankb@berglap /datadisk/ffhome 4] ansible-playbook -b playbooks/update.yaml -i inventory/hosts.yaml --ask-vault-pass
|
|
|
+Vault password:
|
|
|
+
|
|
|
+PLAY [desktops,apus,altlast] ***************************************************************
|
|
|
+
|
|
|
+TASK [Gathering Facts] *********************************************************************
|
|
|
+[WARNING]: Platform linux on host berglap is using the discovered Python interpreter at
|
|
|
+/usr/bin/python3.10, but future installation of another Python interpreter could change the
|
|
|
+meaning of that path. See https://docs.ansible.com/ansible-
|
|
|
+core/2.17/reference_appendices/interpreter_discovery.html for more information.
|
|
|
+ok: [berglap]
|
|
|
+[WARNING]: Platform linux on host bergdesk is using the discovered Python interpreter at
|
|
|
+/usr/bin/python3.11, but future installation of another Python interpreter could change the
|
|
|
+meaning of that path. See https://docs.ansible.com/ansible-
|
|
|
+core/2.17/reference_appendices/interpreter_discovery.html for more information.
|
|
|
+ok: [bergdesk]
|
|
|
+fatal: [luna]: UNREACHABLE! => changed=false
|
|
|
+ msg: 'Failed to connect to the host via ssh: ssh: connect to host 192.168.178.224 port 24: No route to host'
|
|
|
+ unreachable: true
|
|
|
+[WARNING]: Platform linux on host berghofen is using the discovered Python interpreter at
|
|
|
+/usr/bin/python3.11, but future installation of another Python interpreter could change the
|
|
|
+meaning of that path. See https://docs.ansible.com/ansible-
|
|
|
+core/2.17/reference_appendices/interpreter_discovery.html for more information.
|
|
|
+ok: [berghofen]
|
|
|
+[WARNING]: Platform freebsd on host hoerde is using the discovered Python interpreter at
|
|
|
+/usr/local/bin/python3.9, but future installation of another Python interpreter could
|
|
|
+change the meaning of that path. See https://docs.ansible.com/ansible-
|
|
|
+core/2.17/reference_appendices/interpreter_discovery.html for more information.
|
|
|
+ok: [hoerde]
|
|
|
+
|
|
|
+TASK [Testausgabe] *************************************************************************
|
|
|
+ok: [bergdesk] =>
|
|
|
+ msg: Hallo von bergdesk Ansible managed!
|
|
|
+ok: [berglap] =>
|
|
|
+ msg: Hallo von berglap Ansible managed!
|
|
|
+ok: [berghofen] =>
|
|
|
+ msg: Hallo von berghofen Ansible managed!
|
|
|
+ok: [hoerde] =>
|
|
|
+ msg: Hallo von hoerde Ansible managed!
|
|
|
+
|
|
|
+TASK [df -h Aufruf] ************************************************************************
|
|
|
+ok: [berglap]
|
|
|
+ok: [bergdesk]
|
|
|
+ok: [berghofen]
|
|
|
+ok: [hoerde]
|
|
|
+
|
|
|
+TASK [debug] *******************************************************************************
|
|
|
+ok: [bergdesk] =>
|
|
|
+ msg: '[''Dateisystem Größe Benutzt Verf. Verw% Eingehängt auf'', ''/dev/sdb1 439G 98G 319G 24% /''] Debian'
|
|
|
+ok: [berglap] =>
|
|
|
+ msg: '[''Dateisystem Größe Benutzt Verf. Verw% Eingehängt auf'', ''/dev/mapper/system-root 444G 298G 124G 71% /''] Ubuntu'
|
|
|
+ok: [berghofen] =>
|
|
|
+ msg: '[''Dateisystem Größe Benutzt Verf. Verw% Eingehängt auf'', ''/dev/sda6 18G 5,1G 12G 30% /''] Debian'
|
|
|
+ok: [hoerde] =>
|
|
|
+ msg: '[''Filesystem Size Used Avail Capacity Mounted on'', ''s3pool25/jail/hoerde.ffdo.net 3.9G 891M 3.0G 22% /''] FreeBSD'
|
|
|
+
|
|
|
+TASK [ping meine hosts] ********************************************************************
|
|
|
+ok: [berglap]
|
|
|
+ok: [bergdesk]
|
|
|
+ok: [berghofen]
|
|
|
+ok: [hoerde]
|
|
|
+
|
|
|
+TASK [apt update mit upgrade und autoremove] ***********************************************
|
|
|
+skipping: [hoerde]
|
|
|
+ok: [bergdesk]
|
|
|
+ok: [berglap]
|
|
|
+ok: [berghofen]
|
|
|
+
|
|
|
+PLAY RECAP *********************************************************************************
|
|
|
+bergdesk : ok=6 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
|
|
|
+berghofen : ok=6 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
|
|
|
+berglap : ok=6 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
|
|
|
+hoerde : ok=5 changed=0 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0
|
|
|
+luna : ok=0 changed=0 unreachable=1 failed=0 skipped=0 rescued=0 ignored=0
|
|
|
+
|
|
|
+
|
|
|
|
|
|
-# Freifunk Dortmund und Ansible
|
