alpines.yml

@@ -3,10 +3,31 @@
   remote_user: "root"
   strategy: "free"
   vars:
-    alpine_version: "3.16"
+    alpine_version: 3.16
-    apk_version: "2.12.9-r3"
+    apk_version: 2.12.9-r3
-  vars_files:
+    log_server: "EKU:MEN:IP:ADD::RESS"
-  - "config.yml"
+    packages:
+    - alpine-base
+    - linux-virt
+    - syslinux
+    - cryptsetup
+    - btrfs-progs
+    - openssh-server
+    - docker
+    - docker-py
+    - syslog-ng
+    - syslog-ng-openrc
+    - ipset
+    - ipset-openrc
+    - iptables
+    - ip6tables
+    - iptables-openrc
+    - tinc
+    - prometheus-node-exporter
+    - prometheus-node-exporter-openrc
+    - htop
+    - rsync
+    - ntpsec
   tasks:
   - include_tasks: "tasks/partition.yml"
   - include_tasks: "tasks/encrypt.yml"

config.yml

@@ -1,83 +0,0 @@
----
-log_server: "syslog-ng.urras.sutty.nl"
-packages:
-- "alpine-base"
-- "linux-virt"
-- "syslinux"
-- "cryptsetup"
-- "btrfs-progs"
-- "openssh-server"
-- "docker"
-- "docker-py"
-- "syslog-ng"
-- "syslog-ng-openrc"
-- "ipset"
-- "ipset-openrc"
-- "iptables"
-- "ip6tables"
-- "iptables-openrc"
-- "tinc"
-- "prometheus-node-exporter"
-- "prometheus-node-exporter-openrc"
-- "htop"
-- "rsync"
-- "ntpsec"
-templates:
-- "/etc/conf.d/iptables"
-- "/etc/conf.d/ip6tables"
-- "/etc/conf.d/tinc.networks"
-- "/etc/conf.d/node-exporter"
-- "/etc/iptables/rules6-save"
-- "/etc/iptables/rules-save"
-- "/etc/ipset.d/blocklist4"
-- "/etc/ipset.d/blocklist6"
-- "/etc/syslog-ng/syslog-ng.conf"
-- "/etc/sysctl.d/congestion.conf"
-services:
-- runlevel: "sysinit"
-  service: "devfs"
-- runlevel: "sysinit"
-  service: "dmesg"
-- runlevel: "sysinit"
-  service: "mdev"
-- runlevel: "sysinit"
-  service: "hwdrivers"
-- runlevel: "sysinit"
-  service: "modloop"
-- runlevel: "boot"
-  service: "modules"
-- runlevel: "boot"
-  service: "sysctl"
-- runlevel: "boot"
-  service: "hostname"
-- runlevel: "boot"
-  service: "bootmisc"
-- runlevel: "boot"
-  service: "syslog-ng"
-- runlevel: "shutdown"
-  service: "mount-ro"
-- runlevel: "shutdown"
-  service: "killprocs"
-- runlevel: "shutdown"
-  service: "savecache"
-- runlevel: "default"
-  service: "networking"
-- runlevel: "default"
-  service: "ipset"
-- runlevel: "default"
-  service: "iptables"
-- runlevel: "default"
-  service: "ip6tables"
-- runlevel: "default"
-  service: "node-exporter"
-- runlevel: "default"
-  service: "sshd"
-- runlevel: "boot"
-  service: "hwclock"
-- runlevel: "boot"
-  service: "swclock"
-- runlevel: "default"
-  service: "ntpd"
-custom_services:
-- "/etc/init.d/ntpd"
-- "/etc/init.d/tincd"

dockers.yml

@@ -2,10 +2,7 @@
 - hosts: "dockers"
   remote_user: "root"
   strategy: "free"
-  vars_files:
-  - "config.yml"
   tasks:
-  - include_tasks: "tasks/update.yml"
-  - include_tasks: "tasks/ekumen.yml"
   - include_tasks: "tasks/encrypt.yml"
   - include_tasks: "tasks/docker.yml"
+  - include_tasks: "tasks/ekumen.yml"

tasks/post_install.yml

@@ -1,16 +1,79 @@
 ---
+- name: "Set a password for the root user."
+  shell: "PATH=/usr/bin:/usr/sbin:/bin:/sbin chroot /mnt /bin/sh -c 'echo root:{{ root }} | chpasswd -'"
+- name: "Enable default services."
+  shell: "PATH=/usr/bin:/usr/sbin:/bin:/sbin chroot /mnt rc-update add {{ item.service }} {{ item.runlevel }}"
+  args:
+    creates: "/mnt/etc/runlevels/{{ item.runlevel }}/{{ item.service }}"
+  loop:
+  - runlevel: "sysinit"
+    service: "devfs"
+  - runlevel: "sysinit"
+    service: "dmesg"
+  - runlevel: "sysinit"
+    service: "mdev"
+  - runlevel: "sysinit"
+    service: "hwdrivers"
+  - runlevel: "sysinit"
+    service: "modloop"
+  - runlevel: "boot"
+    service: "modules"
+  - runlevel: "boot"
+    service: "sysctl"
+  - runlevel: "boot"
+    service: "hostname"
+  - runlevel: "boot"
+    service: "bootmisc"
+  - runlevel: "boot"
+    service: "syslog-ng"
+  - runlevel: "shutdown"
+    service: "mount-ro"
+  - runlevel: "shutdown"
+    service: "killprocs"
+  - runlevel: "shutdown"
+    service: "savecache"
+  - runlevel: "default"
+    service: "networking"
+  - runlevel: "default"
+    service: "ipset"
+  - runlevel: "default"
+    service: "iptables"
+  - runlevel: "default"
+    service: "ip6tables"
+  - runlevel: "default"
+    service: "node-exporter"
+  - runlevel: "default"
+    service: "sshd"
+  - runlevel: "boot"
+    service: "hwclock"
+  - runlevel: "boot"
+    service: "swclock"
+  - runlevel: "default"
+    service: "ntpd"
 - name: "Install configuration files."
   template:
     src: "templates{{ item }}.j2"
     dest: "/mnt{{ item }}"
     mode: "640"
-  loop: "{{ templates }}"
+  loop:
+  - /etc/conf.d/iptables
+  - /etc/conf.d/ip6tables
+  - /etc/conf.d/tinc.networks
+  - /etc/conf.d/node-exporter
+  - /etc/iptables/rules6-save
+  - /etc/iptables/rules-save
+  - /etc/ipset.d/blocklist4
+  - /etc/ipset.d/blocklist6
+  - /etc/syslog-ng/syslog-ng.conf
+  - /etc/sysctl.d/congestion.conf
 - name: "And services."
   template:
     src: "templates{{ item }}.j2"
     dest: "/mnt{{ item }}"
     mode: "750"
-  loop: "{{ custom_services }}"
+  loop:
+  - /etc/init.d/ntpd
+  - /etc/init.d/tincd
 - name: "Create NTP directories."
   file:
     state: "directory"
@@ -18,12 +81,5 @@
   loop:
   - "/var/NTP"
   - "/var/lib/ntp"
-- name: "Set a password for the root user."
-  shell: "PATH=/usr/bin:/usr/sbin:/bin:/sbin chroot /mnt /bin/sh -c 'echo root:{{ root }} | chpasswd -'"
-- name: "Enable default services."
-  shell: "PATH=/usr/bin:/usr/sbin:/bin:/sbin chroot /mnt rc-update add {{ item.service }} {{ item.runlevel }}"
-  args:
-    creates: "/mnt/etc/runlevels/{{ item.runlevel }}/{{ item.service }}"
-  loop: "{{ services }}"
 - name: "Reboot!"
   reboot:

tasks/update.yml

@@ -1,20 +0,0 @@
----
-- name: "Upgrade system."
-  shell: "mount -o remount,rw /boot && apk update && apk upgrade && mount -o remount,ro /boot"
-- name: "Upgrade configuration files if needed."
-  template:
-    src: "templates{{ item }}.j2"
-    dest: "{{ item }}"
-    mode: "640"
-  loop: "{{ templates }}"
-- name: "And services."
-  template:
-    src: "templates{{ item }}.j2"
-    dest: "{{ item }}"
-    mode: "750"
-  loop: "{{ custom_services }}"
-- name: "Enable services."
-  shell: "rc-update add {{ item.service }} {{ item.runlevel }}"
-  args:
-    creates: "/etc/runlevels/{{ item.runlevel }}/{{ item.service }}"
-  loop: "{{ services }}"