system.yml

# This file is part of deployment-tool.
# Copyright (C) 2014-2016  Sequent Tech Inc <legal@sequentech.io>

# deployment-tool is free software: you can redistribute it and/or modify
# it under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation, either version 3 of the License.

# deployment-tool  is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Lesser General Public License for more details.

# You should have received a copy of the GNU Lesser General Public License
# along with deployment-tool.  If not, see <http://www.gnu.org/licenses/>.

---
- name: System, setting hostname
  become: true
  hostname:
    name: "{{ config.hostname }}"

- name: System, private ip in /etc/hosts
  become: true
  lineinfile:
    dest: /etc/hosts
    line: "{{ config.private_ipaddress }} {{ config.hostname }}" 
    state: present

- name: System, domain in /etc/hosts
  become: true
  lineinfile:
    dest: /etc/hosts
    line: "{{ config.private_ipaddress }} {{ config.ballot_box.domain }}"
    state: present

- name: System, Creating nginx group
  become: true
  group:
    name: nginx
    state: present

- name: Creating tlscert group
  become: true
  group:
    name: tlscert
    state: present

- name: System, Creating nginx user
  become: true
  user:
    name: nginx
    shell: /bin/false
    home: /nonexistent
    groups: nginx,tlscert
    append: true

- name: System, nginx log directory permissions
  become: true
  file:
    path: /var/log/nginx
    owner: nginx
    state: directory

- name: System, cert directories creation
  become: true
  file:
    path: /srv/certs/selfsigned
    recurse: yes
    state: directory
    owner: root
    group: users

- name: System, self-signed certificate creation
  become: true
  template:
    src: templates/cert.sh
    dest: /root/cert.sh
    owner: root
    mode: '0700'

- name: System, self-signed certificate creation
  become: true
  template:
    src: templates/cert.py
    dest: /root/cert.py
    owner: root
    mode: '0700'

- name: System, self-signed certificate creation
  become: true
  shell: /root/cert.sh

- name: System, self-signed certificate permissions (1)
  become: true
  file:
    path: /srv/certs/selfsigned/cert.pem
    state: file
    mode: '0640'
    group: tlscert

- name: System, self-signed certificate permissions (2)
  become: true
  file:
    path: /srv/certs/selfsigned/key-nopass.pem
    state: file
    mode: '0640'
    group: tlscert

- name: System, self-signed certificate permissions (3)
  become: true
  file:
    path: /srv/certs/selfsigned/calist
    state: file
    mode: '0640'
    group: tlscert

- name: System, populating /etc/hosts
  become: true
  lineinfile:
    dest: /etc/hosts
    line: "{{ item.ip }} {{ item.hostname }}"
    state: present
  with_items: "{{ config.hosts }}"


- name: System, updating /etc/screenrc
  become: true
  template:
    src: templates/screenrc
    dest: /etc/screenrc
    owner: root
    mode: '0600'

- name: System, configuring timezone to UTC
  become: true
  ansible.builtin.shell:
    warn: false
    cmd: |
      ln -sf /usr/share/zoneinfo/UTC /etc/localtime
      dpkg-reconfigure -f noninteractive tzdata
    executable: /bin/bash