myConfig.yml

- hosts: all

  ###
  # Tasks
  ###
  tasks:


    ###
    # Vars
    ###
    - name: Load vars from vars directory
      include_vars: vars/myConfig.yml
      sudo: true


    ###################
    # Hostname
    ###################
    - name: Update Hosts file with hostname
      lineinfile: dest=/etc/hosts line="{{ publicIpAddress }} {{ hostname }}" backup=yes
      sudo: true
    - name: Update hostname to {{ hostname }}
      hostname: name={{ hostname }}
      sudo: true


    ###
    # Update APT
    ###
    - name: Update APT
      apt: update_cache=yes
      sudo: true


    ###
    # Time management
    ###
    - name: Install NTP (and update apt cache for the first install)
      apt: name={{ item }} state=latest
           update_cache=yes
      with_items:
        - ntp
        - tzdata
      sudo: true
    - name: Set local timezone
      copy: content={{ timezone }}
            dest=/etc/timezone
      sudo: true
    - name: Start the ntp service
      service: name=ntp state=started enabled=true
      sudo: true
    - name: Update time
      command: dpkg-reconfigure --frontend noninteractive tzdata
      sudo: true


    ###
    # Add skel for all users
    ###
    - name: Add zshrc
      template: src={{ rootPath }}/skel/etc/skel/.zshrc.j2 dest=/etc/skel/.zshrc owner=root group=root
      sudo: true


    ###
    # MISC Tools
    ###
    - name: Install MISC tools
      apt: name={{ item }} state=latest
      with_items:
        - language-pack-fr
        - dnsutils
        - iftop
        - smartmontools
        - iptraf
        - sysstat
        - vim
        - htop
        - git-core
        - curl
        - acl
        - htop
        - tig
        - tmux
        - screen
        - zsh
        - ncdu
        - ifstat
        - build-essential
        - openssh-client
        - imagemagick
        - tree
        - unzip
      sudo: true


    ###
    # Create SSH user group
    ###
    - name: Create group sshuser
      group: name=sshuser state=present
      sudo: true
    - name: Create group sshuserpwd
      group: name=sshuserpwd state=present
      sudo: true
    - name: Create group sshuserkey
      group: name=sshuserkey state=present
      sudo: true


    ###
    # User Management
    ###
    - name: Add /usr/local/scripts directory
      file: path=/usr/local/scripts state=directory owner=root group=root
      sudo: true
    - name: Add login script
      template: src={{ rootPath }}/skel/usr/local/scripts/loginNotification.sh.j2 dest=/usr/local/scripts/loginNotification.sh owner=root group=root
      sudo: true
    - name: Add login script for root account
      lineinfile: dest=/root/.bashrc line="/usr/local/scripts/loginNotification.sh" backup=yes
      sudo: true
    - name: Change shell for current user
      shell: chsh -s /bin/zsh
      sudo: true
    - name: Create group {{ user }}
      group: name={{ user }} state=present
      sudo: true
    - name: Create user {{ user }}
      user: name={{ user }}
            comment="{{ user }} user"
            shell=/bin/zsh
            groups=sudo,adm,sshuser,sshuserpwd,{{ user }}
      sudo: true
    - name: Set up authorized_keys for {{ user }}
      authorized_key: user={{ user }}
                      key="{{ lookup('file', 'vars/mySSHPublicKey.pub') }}"
      sudo: true
    - name: Add SSH directory
      file: path=/home/{{ user }}/.ssh/ state=directory owner={{ user }} group={{ user }} mode=0755
      sudo: true
    - name: Add GitHub SSH private key for {{ user }}
      copy: src={{ rootPath }}/vars/myGitUserMachineUserKey dest=/home/{{ user }}/.ssh/myGitUserMachineUserKey owner={{ user }} group={{ user }} mode=0600
      sudo: true
    - name: Add GitHub SSH public key for {{ user }}
      copy: src={{ rootPath }}/vars/myGitUserMachineUserKey.pub dest=/home/{{ user }}/.ssh/myGitUserMachineUserKey.pub owner={{ user }} group={{ user }} mode=0644
      sudo: true
    - name: Add GitHub SSH config for {{ user }}
      copy: src={{ rootPath }}/skel/home/myuser/.ssh/config dest=/home/{{ user }}/.ssh/config owner={{ user }} group={{ user }} mode=0644 backup=yes
      sudo: true
    - name: Add github to ssh known hosts
      shell: ssh-keyscan -H github.com >> /etc/ssh/ssh_known_hosts
      sudo: true
    - name: Add bitbucket.org to ssh known hosts
      shell: ssh-keyscan -H bitbucket.org >> /etc/ssh/ssh_known_hosts
      sudo: true


    ###
    # Security Tools
    ###
    - name: Install Iptables
      apt: name=iptables state=latest
      sudo: true
    - name: Exec cmd {{ sudo }}
      shell: "{{ item.rule }}"
      with_items: "{{ securityRules }}"
      sudo: true
    - name: Install Iptables-persistent
      apt: name=iptables-persistent state=latest
      sudo: true
    - name: Install Fail2ban
      apt: name={{ item }} state=latest
      with_items:
        - fail2ban
      sudo: true
    - name: Add Fail2ban conf
      template: src={{ rootPath }}/skel/etc/fail2ban/jail.local.j2 dest=/etc/fail2ban/jail.local owner=root group=root backup=yes
      sudo: true
    #- name: Disable Root login (useless on Ubuntu but just in case ;-)
    #  lineinfile: dest=/etc/ssh/sshd_config regexp='^PermitRootLogin' line='PermitRootLogin no' backup=yes
    #  sudo: true
    - name: Some security optim
      lineinfile: dest=/etc/ssh/sshd_config line="Match User {{ user }}" backup=yes
      sudo: true
    - name: Some security optim
      lineinfile: dest=/etc/ssh/sshd_config line="    PasswordAuthentication no" backup=yes
      sudo: true
    #- name: Some security optim
    #  lineinfile: dest=/etc/ssh/sshd_config line="Match User {{ defaultUser }}" backup=yes
    #  sudo: true
    #- name: Some security optim
    #  lineinfile: dest=/etc/ssh/sshd_config line="    PasswordAuthentication no" backup=yes
    #  sudo: true
    - name: Restart SSHd
      service: name=ssh state=reloaded
      sudo: true


    ###
    # Supervisor
    ###
    - name: Install Supervisor
      apt: name=supervisor state=latest
      sudo: true
    - name: Start supervisor service
      service: name=supervisor state=started enabled=true
      sudo: true


    ###
    # Install Python+PIP
    ###
    - name: Install Python+PIP
      apt: name={{ item }} state=latest
      with_items:
        - python
        - python-pip
      sudo: true
    - name: Install Gem packages
      pip: name={{ item }} state=latest
      with_items:
        - awscli
      sudo: true


    ###
    # Install Ruby+Gem
    ###
    - name: Install Ruby
      apt: name={{ item }} state=latest
      with_items:
        - ruby
        - ruby-dev
        - gem
      sudo: true
    - name: Install Gem packages
      gem: name={{ item }} user_install=no state=latest
      with_items:
        - jekyll
      sudo: true


    ###
    # Install Node+NPM
    ###
    - name: Install Node+NPM
      apt: name={{ item }} state=latest
      with_items:
        - nodejs
        - npm
      sudo: true
    - name: Install Node packages
      npm: name={{ item }} global=yes state=latest
      with_items:
        - coffee-script
        - bower
        - uglify-js
        - uglifycss
      sudo: true
    - name: Add Node to the PATH
      file: src=/usr/bin/nodejs dest=/usr/bin/node state=link
      sudo: true


    ###
    # Install PHP
    ###
    - name: Install PHP
      apt: name={{ item }} state=latest
      with_items:
        - php5
        - php5-cli
        - php5-dev
        - php5-gd
        - php5-curl
        - php5-intl
        - php5-apcu
        - php5-sqlite
      sudo: true


    ##
    # Install Composer
    ##
    - name: Download composer
      shell: /usr/bin/curl -s http://getcomposer.org/installer -o /tmp/composer_installer
      sudo: true
    - name: Install composer
      shell: /usr/bin/php /tmp/composer_installer --install-dir=/usr/bin --filename=composer
      sudo: true


    ###
    # Install Apache
    ###
    - name: Install Apache
      apt: name={{ item }} state=latest
      with_items:
        - apache2
        - apache2-utils
      sudo: true
    - name: Update apache2 conf
      lineinfile: dest=/etc/apache2/apache2.conf line="" backup=yes
      sudo: true
    - name: Update apache2 conf
      lineinfile: dest=/etc/apache2/apache2.conf line="ServerTokens ProductOnly" backup=yes
      sudo: true
    - name: Update apache2 conf
      lineinfile: dest=/etc/apache2/apache2.conf line="ServerSignature Off" backup=yes
      sudo: true


    ###
    # Install mySQL
    ###
    - name: Install mySQL
      apt: name={{ item }} state=latest
      with_items:
        - mysql-server
        - php5-mysql
        - python-mysqldb
      sudo: true
    - name: Add remote connection
      lineinfile: dest=/etc/mysql/my.cnf regexp='^bind-address' line='#bind-address = 127.0.0.1' backup=yes
      sudo: true
    - name: Update mysql root password for all root accounts
      mysql_user: name=root password={{ mySqlRootPwd }} priv=*.*:ALL,GRANT host={{ item }} state=present check_implicit_admin=yes login_user=root login_password={{ mySqlRootPwd }}
      with_items:
        - "{{ hostname }}"
        - 127.0.0.1
        - ::1
        - localhost
      sudo: true
      # 'localhost' needs to be the last item for idempotency, see http://docs.ansible.com/mysql_user_module.html
    - name: Update mysql {{ mySqlUser }} password for all accounts
      mysql_user: name={{ mySqlUser }} password={{ mySqlUserPwd }} priv=*.*:ALL state=present login_user=root login_password={{ mySqlRootPwd }} host=%
      sudo: true
    #- name : Create DB
    #  mysql_db: name=website-sample state=present login_user=root login_password={{ mySqlRootPwd }}
    #  sudo: true
    #- name: Update mysql website-sample password
    #  mysql_user: name={{ mySqlSampleUser }} password={{ mySqlSamplePwd }} priv=website-sample.*:ALL state=present login_user=root login_password={{ mySqlRootPwd }} host=%
    #  sudo: true
    - name: Ensure mysql anonymous users are not in the database
      mysql_user: name='' state=absent login_user=root login_password={{ mySqlRootPwd }}
      sudo: true
    - name: Disable mySQL public port
      lineinfile: dest=/etc/mysql/my.cnf regexp='^#bind-address = 127.0.0.1' line='bind-address = 127.0.0.1' backup=yes
      sudo: true

    - name: Restart mySQL
      service: name=mysql state=restarted
      sudo: true


    ###
    # Install Postfix
    ###
    - name: Install postfix
      apt: name=postfix state=latest
      sudo: true


    ###
    # Group Website
    ###
    - name: Create group website
      group: name=website state=present
      sudo: true


    ###
    # Install FTP ^^ (no prod EVT!!!)
    ###
    #- name: Install proftpd
    #  apt: name=proftpd state=latest
    #  sudo: true
    #- name: Create ftpgroup
    #  group: name=ftpgroup-{{ user }} state=present
    #  sudo: true
    #- name: Create FTP user ftpuser-{{ user }}
    #  user: name=ftpuser-{{ user }}
    #        comment="ftpuser-{{ user }} user"
    #        group={{ item }}
    #  with_items:
    #    - ftpgroup-{{ user }}
    #  sudo: true
    #- name: Add proftpd conf
    #  template: src={{ rootPath }}/skel/etc/proftpd/proftpd.conf.j2 dest=/etc/proftpd/proftpd.conf owner=root group=root backup=yes
    #  sudo: true
    #- name: Restart proFTPd
    #  service: name=proftpd state=restarted
    #  sudo: true


    ###
    # Copy skell home
    ###
    - name: Add gitconfig
      template: src={{ rootPath }}/skel/home/myuser/.gitconfig.j2 dest=/home/{{ user }}/.gitconfig
      become: yes
      become_user: "{{ user }}"
    - name: Add documents/website folder
      file: path=/home/{{ user }}/documents/website/ state=directory
      become: yes
      become_user: "{{ user }}"
    - name: Add tmp folder
      file: path=/home/{{ user }}/tmp/ state=directory
      become: yes
      become_user: "{{ user }}"
    - name: Add documents/backup folder
      file: path=/home/{{ user }}/documents/backup/ state=directory
      become: yes
      become_user: "{{ user }}"
    - name: Add README.md file
      template: src={{ rootPath }}/skel/home/myuser/README.md.j2 dest=/home/{{ user }}/README.md
      become: yes
      become_user: "{{ user }}"
    #- name: Add documents/website/website-sample/web/ folder
    #  file: path=/home/{{ user }}/documents/website/website-sample/web/ state=directory
    #  become: yes
    #  become_user: "{{ user }}"
    #- name: Add Apache index file
    #  template: src={{ rootPath }}/skel/home/myuser/documents/website/website-sample/web/index.php.j2 dest=/home/{{ user }}/documents/website/website-sample/web/index.php
    #  become: yes
    #  become_user: "{{ user }}"


    ###
    # Base config Apache vHost (default, website-sample)
    ###
    - name: Disable default
      shell: a2dissite 000-default
      sudo: true
    #- name: Add website-sample config
    #  template: src={{ rootPath }}/skel/etc/apache2/sites-available/website-sample.conf.j2 dest=/etc/apache2/sites-available/website-sample.conf owner=root group=root backup=yes
    #  sudo: true
    #- name: Enable website-sample
    #  shell: a2ensite website-sample
    #  sudo: true


    ###
    # Add Apache vHost
    ###
    - name: Git clone {{ item.name }}
      git:
        repo={{ item.git }} dest=/home/{{ user }}/documents/website/{{ item.name }}
        key_file=/home/{{ user }}/.ssh/myGitUserMachineUserKey
        accept_hostkey=yes
      become: yes
      become_user: "{{ user }}"
      with_items: "{{ apacheVhosts }}"
    - name: Exec cmd {{ item.user }}
      shell: "{{ item.shell }}"
      args:
        chdir: /home/{{ user }}/documents/website/{{ item.name }}
      become: yes
      become_user: "{{ user }}"
      with_items: "{{ apacheVhosts }}"
    - name: Exec cmd {{ sudo }}
      shell: "{{ item.shellSudo }}"
      args:
        chdir: /home/{{ user }}/documents/website/{{ item.name }}
      with_items: "{{ apacheVhosts }}"
      sudo: true
    - name: Setup Apache vHosts
      template: src={{ rootPath }}/skel/etc/apache2/sites-available/vhosts-sample.conf.j2 dest=/etc/apache2/sites-available/{{ item.name }}.conf owner=root group=root backup=yes
      with_items: "{{ apacheVhosts }}"
      sudo: true
    - name: Enable Apache vHost
      shell: a2ensite {{ item.name }}
      with_items: "{{ apacheVhosts }}"
      sudo: true



    ###
    # Add phpMyAdmin
    ###
    - name: Install phpMyAdmin
      apt: name=phpmyadmin state=latest
      sudo: true
    - name: Add phpmyadmin config
      template: src={{ rootPath }}/skel/etc/apache2/sites-available/phpmyadmin.conf.j2 dest=/etc/apache2/sites-available/phpmyadmin.conf owner=root group=root backup=yes
      sudo: true
    - name: Add folder
      file: path=/home/{{ user }}/documents/website/phpmyadmin/ state=directory
      become: yes
      become_user: "{{ user }}"
      #sudo: true
    - name: Add link to www folder
      file: src=/usr/share/phpmyadmin dest=/home/{{ user }}/documents/website/phpmyadmin/web state=link
      become: yes
      become_user: "{{ user }}"
      #sudo: true
    - name: Enable phpmyadmin
      shell: a2ensite phpmyadmin
      sudo: true
    # TODO Manually
    #- name: Reconfig phpmyadmin
    #  shell: dpkg-reconfigure phpmyadmin
    #  sudo: true


    ###
    # PHP config (CLI + Apache2)
    ###
    - name: PHP Apache2 config unexpose php version
      lineinfile: dest=/etc/php5/apache2/php.ini regexp='^expose_php = On' line='expose_php = Off' backup=yes
      sudo: true
    - name: PHP Apache2 config for TimeZone
      lineinfile: dest=/etc/php5/apache2/php.ini regexp='^;date.timezone' line='date.timezone = Europe/Paris' backup=yes
      sudo: true
    - name: PHP CLI config for TimeZone
      lineinfile: dest=/etc/php5/cli/php.ini regexp='^;date.timezone' line='date.timezone = Europe/Paris' backup=yes
      sudo: true
    - name: PHP Apache2 config for Memory
      lineinfile: dest=/etc/php5/apache2/php.ini regexp='^memory_limit = 128M' line='memory_limit = 256M' backup=yes
      sudo: true
    - name: PHP Apache2 config for max upload file size
      lineinfile: dest=/etc/php5/apache2/php.ini regexp='^upload_max_filesize = 2M' line='upload_max_filesize = 128M' backup=yes
      sudo: true
    - name: PHP Apache2 config for max upload file size
      lineinfile: dest=/etc/php5/apache2/php.ini regexp='^post_max_size = 8M' line='post_max_size = 128M' backup=yes
      sudo: true
    - name: PHP Apache2 enable opCache
      lineinfile: dest=/etc/php5/apache2/php.ini regexp='^;opcache.enable=0' line='opcache.enable=1' backup=yes
      sudo: true
    - name: PHP Apache2 config memory for opCache
      lineinfile: dest=/etc/php5/apache2/php.ini regexp='^;opcache.memory_consumption=64' line='opcache.memory_consumption=128' backup=yes
      sudo: true
    - name: PHP Apache2 config memory for opCache
      lineinfile: dest=/etc/php5/apache2/php.ini regexp='^;opcache.max_accelerated_files=2000' line='opcache.max_accelerated_files=4000' backup=yes
      sudo: true
    #- name: PHP Apache2 config memory for opCache
    #  lineinfile: dest=/etc/php5/apache2/php.ini regexp='^;opcache_revalidate_freq = 2' line='opcache_revalidate_freq = 5' backup=yes
    #  sudo: true


    ###
    # Apache2 config
    ###
    - name: Apache2 module
      apache2_module: state=present name={{ item }}
      with_items:
        - headers
        - rewrite
      sudo: true


    ###
    # Cron service
    ###
    - name: Add cron
      cron: name="{{ item.name }}" minute="{{ item.minute }}" hour="{{ item.hour }}" job="{{ item.job }}" user="{{ item.user }}" backup=yes
      with_items: "{{ cronJobs }}"
      sudo: true


    ###
    # Restart Service
    ###
    - name: Restart Apache
      service: name=apache2 state=restarted
      sudo: true
    - name: Restart SSHd
      service: name=ssh state=restarted
      sudo: true
    - name: Restart mySQL
      service: name=mysql state=restarted
      sudo: true
    - name: Restart Fail2ban
      service: name=fail2ban state=restarted
      sudo: true
    #- name: Restart proFTPd
    #  service: name=proftpd state=restarted
    #  sudo: true


    ###
    # CUSTOM for your Server
    ###
    # TBD


    ###
    # Alert
    ###
    #- name: Alert on IRC
    #  irc: server={{ ircServer }} channel="#{{ ircChannel }}" msg="Ansible: deploy ubuntu simple Symfony App"