484 lines
12 KiB
YAML
484 lines
12 KiB
YAML
- name: configure system
|
|
hosts: localhost
|
|
connection: local
|
|
become: false
|
|
tasks:
|
|
- name: read machine-specific variables
|
|
include_vars:
|
|
file: _machines/{{ ansible_hostname }}.yml
|
|
name: machine
|
|
tags:
|
|
- always
|
|
|
|
- name: read variables
|
|
include_vars:
|
|
file: variables.yml
|
|
tags:
|
|
- always
|
|
|
|
- set_fact:
|
|
distro: "{{ ansible_distribution|lower }}"
|
|
tags:
|
|
- always
|
|
|
|
- name: check for valid distro
|
|
assert:
|
|
that: distro in ('archlinux')
|
|
|
|
- block:
|
|
- name: install ansible requirements
|
|
package:
|
|
name: "{{ packages[distro] }}"
|
|
state: present
|
|
become: true
|
|
vars:
|
|
packages:
|
|
archlinux:
|
|
- python-jmespath
|
|
|
|
- block:
|
|
- name: enable multilib repository
|
|
blockinfile:
|
|
path: /etc/pacman.conf
|
|
block: |
|
|
[multilib]
|
|
Include = /etc/pacman.d/mirrorlist
|
|
marker: "# {mark} ANSIBLE MANAGED multilib"
|
|
become: true
|
|
|
|
- name: enable parallel download
|
|
blockinfile:
|
|
path: /etc/pacman.conf
|
|
insertafter: '\[options\]'
|
|
block: |
|
|
ParallelDownloads = 5
|
|
marker: "# {mark} ANSIBLE MANAGED parallel_download"
|
|
become: true
|
|
|
|
- block:
|
|
- name: upgrade system
|
|
pacman:
|
|
upgrade: true
|
|
update_cache: true
|
|
become: true
|
|
changed_when: false
|
|
|
|
tags: [system-update]
|
|
|
|
- name: install pacman-contrib for paccache
|
|
package:
|
|
name: pacman-contrib
|
|
state: present
|
|
become: true
|
|
|
|
- block:
|
|
- name: install pacman cache clean service
|
|
copy:
|
|
dest: /etc/systemd/system/pacman-cache-cleanup.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
content: |
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/bin/sh -c '/usr/bin/paccache -rk1 && /usr/bin/paccache -ruk0'
|
|
RemainAfterExit=true
|
|
become: true
|
|
|
|
- name: install pacman cache clean timer
|
|
copy:
|
|
dest: /etc/systemd/system/pacman-cache-cleanup.timer
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
content: |
|
|
[Timer]
|
|
OnCalendar=daily
|
|
become: true
|
|
|
|
- name: enable pacman cache clean timer
|
|
systemd:
|
|
name: pacman-cache-cleanup.timer
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
become: true
|
|
tags: [pacman_cache_cleanup]
|
|
|
|
when: distro == 'archlinux'
|
|
|
|
- block:
|
|
- name: create dotfiles group
|
|
group:
|
|
name: dotfiles
|
|
state: present
|
|
become: true
|
|
become_user: root
|
|
|
|
- name: create dotfiles user
|
|
user:
|
|
name: dotfiles
|
|
group: dotfiles
|
|
home: /var/lib/dotfiles
|
|
create_home: false
|
|
shell: /bin/bash
|
|
system: true
|
|
become: true
|
|
become_user: root
|
|
|
|
- name: create dotfiles directory
|
|
file:
|
|
state: directory
|
|
path: /var/lib/dotfiles
|
|
owner: dotfiles
|
|
group: dotfiles
|
|
mode: '0775' # group needs write access!
|
|
become: true
|
|
become_user: root
|
|
|
|
- name: fix permissions for dotfiles directory
|
|
shell: |
|
|
cd /var/lib/dotfiles
|
|
if [[ -e .git ]] ; then
|
|
# There is no sane way to specify the global .gitconfig to use, so we
|
|
# actually have to override HOME so git looks into ~/.gitconfig
|
|
export HOME="$(mktemp -d)"
|
|
set -o pipefail
|
|
set -o errexit
|
|
git config --global --add safe.directory /var/lib/dotfiles
|
|
git ls-tree -z --name-only HEAD | xargs --null chown --changes --recursive dotfiles:dotfiles
|
|
git ls-tree -z --name-only HEAD | xargs --null chmod --changes --recursive g+wX
|
|
else
|
|
chown --changes --recursive dotfiles:dotfiles .
|
|
chmod --changes --recursive g+wX .
|
|
fi
|
|
args:
|
|
executable: /bin/bash
|
|
register: dotfiles_permission_change
|
|
become: true
|
|
become_user: root
|
|
changed_when: dotfiles_permission_change.stdout_lines|length > 0
|
|
tags: [dotfiles-directory]
|
|
|
|
- block:
|
|
- name: install sudo
|
|
package:
|
|
state: present
|
|
name: sudo
|
|
|
|
- name: install dependencies for paru
|
|
package:
|
|
state: present
|
|
name:
|
|
- base-devel
|
|
- git
|
|
become: true
|
|
|
|
- name: create build user on arch
|
|
user:
|
|
name: makepkg
|
|
home: /var/lib/makepkg
|
|
create_home: true
|
|
shell: /bin/bash
|
|
system: true
|
|
become: true
|
|
|
|
- name: create paru user on arch
|
|
user:
|
|
name: paru
|
|
home: /var/lib/paru
|
|
create_home: true
|
|
shell: /bin/bash
|
|
system: true
|
|
become: true
|
|
|
|
- name: configure passwordless sudo for paru user
|
|
copy:
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
dest: /etc/sudoers.d/paru
|
|
content: |
|
|
paru ALL=(ALL) NOPASSWD: /usr/bin/pacman
|
|
become: true
|
|
|
|
- name: check if paru is already installed
|
|
shell: |
|
|
set -o errexit
|
|
|
|
if pacman -Qi paru-bin >/dev/null 2>&1; then
|
|
exit 100
|
|
fi
|
|
exit 0
|
|
args:
|
|
executable: /bin/bash
|
|
changed_when: false
|
|
check_mode: false
|
|
failed_when: result.rc not in (0, 100)
|
|
register: result
|
|
|
|
- name: build paru on arch
|
|
shell: |
|
|
set -o errexit
|
|
|
|
mkdir -p /tmp/paru-build
|
|
cd /tmp/paru-build
|
|
|
|
curl -L -O https://aur.archlinux.org/cgit/aur.git/snapshot/paru-bin.tar.gz
|
|
tar xvf paru-bin.tar.gz
|
|
cd paru-bin
|
|
makepkg
|
|
args:
|
|
executable: /bin/bash
|
|
become: true # do not build as root!
|
|
become_user: makepkg
|
|
when: result.rc != 100
|
|
|
|
- name: install paru
|
|
shell: |
|
|
set -o errexit
|
|
|
|
pacman --noconfirm -U /tmp/paru-build/paru-bin/paru-bin-*.pkg.tar.zst
|
|
rm -rf /tmp/paru-build
|
|
args:
|
|
executable: /bin/bash
|
|
become: true
|
|
when: result.rc != 100
|
|
|
|
when: distro == 'archlinux'
|
|
|
|
|
|
- block:
|
|
- name: load package list
|
|
include_vars:
|
|
file: packages.yml
|
|
|
|
- name: force-update iptables to iptables-nft on arch
|
|
shell: pacman -Q iptables && yes | pacman -S iptables-nft
|
|
changed_when: false
|
|
become: true
|
|
when: distro == 'archlinux'
|
|
|
|
- set_fact:
|
|
defined_packages: "{{ packages|json_query('keys(list)') }}"
|
|
|
|
- set_fact:
|
|
distro_packages: "{{ packages|json_query('list.*.%s'|format(distro)) }}"
|
|
|
|
- name: check list
|
|
assert:
|
|
that: "defined_packages|length == distro_packages|length"
|
|
|
|
- set_fact:
|
|
defined_packages_remove: "{{ packages|json_query('keys(remove)') }}"
|
|
|
|
- set_fact:
|
|
distro_packages_remove: "{{ packages|json_query('remove.*.%s'|format(distro)) }}"
|
|
|
|
- name: check list
|
|
assert:
|
|
that: "defined_packages_remove|length == distro_packages_remove|length"
|
|
|
|
- name: remove packages
|
|
package:
|
|
name: "{{ packages|json_query(query) }}"
|
|
state: absent
|
|
become: true
|
|
vars:
|
|
query: "{{ 'remove.*.%s[]'|format(distro) }}"
|
|
|
|
- name: install packages
|
|
package:
|
|
name: "{{ packages|json_query(query) }}"
|
|
state: present
|
|
become: true
|
|
vars:
|
|
query: "{{ 'list.*.%s[]'|format(distro) }}"
|
|
|
|
- name: install machine-specific packages
|
|
package:
|
|
name: "{{ machine.packages }}"
|
|
state: present
|
|
when: machine.packages is defined
|
|
become: true
|
|
|
|
tags: [packages]
|
|
|
|
- block:
|
|
- name: configure timesyncd on arch
|
|
copy:
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
dest: /etc/systemd/timesyncd.conf
|
|
content: |
|
|
[Time]
|
|
NTP=0.arch.pool.ntp.org 1.arch.pool.ntp.org 2.arch.pool.ntp.org 3.arch.pool.ntp.org
|
|
FallbackNTP=0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org
|
|
become: true
|
|
|
|
- name: install lz4
|
|
package:
|
|
name: lz4
|
|
state: present
|
|
become: true
|
|
|
|
- name: use lz4 for mkinitcpio compression
|
|
lineinfile:
|
|
path: /etc/mkinitcpio.conf
|
|
regexp: '^#?COMPRESSION=.*$'
|
|
line: 'COMPRESSION="lz4"'
|
|
become: true
|
|
notify:
|
|
- rebuild initrd
|
|
when: distro == 'archlinux'
|
|
|
|
- set_fact:
|
|
disable_services:
|
|
- sshd
|
|
when: distro == 'archlinux'
|
|
|
|
- name: disable services
|
|
service:
|
|
state: stopped
|
|
enabled: false
|
|
name: "{{ item }}"
|
|
with_items: "{{ disable_services }}"
|
|
become: true
|
|
when: manage_services|default(true)|bool
|
|
|
|
- set_fact:
|
|
enable_services:
|
|
- NetworkManager
|
|
- docker
|
|
- libvirtd
|
|
- systemd-timesyncd
|
|
- pcscd
|
|
|
|
- name: enable services
|
|
service:
|
|
state: started
|
|
enabled: true
|
|
name: "{{ item }}"
|
|
with_items: "{{ enable_services }}"
|
|
become: true
|
|
when: manage_services|default(true)|bool
|
|
|
|
- name: get systemd boot target
|
|
command: systemctl get-default
|
|
register: systemd_target
|
|
changed_when: false
|
|
check_mode: false
|
|
|
|
- set_fact:
|
|
default_target: multi-user.target
|
|
|
|
- name: set systemd boot target
|
|
command: systemctl set-default {{ default_target }}
|
|
when: systemd_target.stdout != default_target
|
|
become: true
|
|
|
|
- name: handle lid switch
|
|
lineinfile:
|
|
path: /etc/systemd/logind.conf
|
|
regexp: '^HandleLidSwitch='
|
|
line: 'HandleLidSwitch=ignore'
|
|
become: true
|
|
|
|
- name: handle power key
|
|
lineinfile:
|
|
path: /etc/systemd/logind.conf
|
|
regexp: '^HandlePowerKey='
|
|
line: 'HandlePowerKey=suspend'
|
|
become: true
|
|
|
|
- name: create sudonopw group
|
|
group:
|
|
name: sudonopw
|
|
system: true
|
|
|
|
- name: configure passwordless sudo
|
|
copy:
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
dest: /etc/sudoers.d/sudonopw
|
|
content: |
|
|
%sudonopw ALL=(ALL) NOPASSWD: ALL
|
|
become: true
|
|
|
|
- block:
|
|
- name: install AMDGPU packages
|
|
package:
|
|
name:
|
|
- mesa
|
|
- lib32-mesa
|
|
- xf86-video-amdgpu
|
|
- vulkan-radeon
|
|
- lib32-vulkan-radeon
|
|
- libva-mesa-driver
|
|
- lib32-libva-mesa-driver
|
|
- mesa-vdpau
|
|
- lib32-mesa-vdpau
|
|
state: present
|
|
become: true
|
|
|
|
- name: set AMDGPU options
|
|
copy:
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
dest: /etc/X11/xorg.conf.d/20-amdgpu.conf
|
|
content: |
|
|
Section "Device"
|
|
Identifier "AMD"
|
|
Driver "amdgpu"
|
|
Option "VariableRefresh" "true"
|
|
Option "TearFree" "true"
|
|
EndSection
|
|
become: true
|
|
|
|
when:
|
|
- distro == 'archlinux'
|
|
- machine.gpu is defined and machine.gpu == 'amd'
|
|
|
|
- block:
|
|
- block:
|
|
- name: install spotify from AUR via paru
|
|
shell: |
|
|
curl -sS https://download.spotify.com/debian/pubkey_5E3C45D7B312C643.gpg | gpg --import
|
|
yes 1 | paru --skipreview --aur --batchinstall --noconfirm -S spotify
|
|
become: true
|
|
become_user: paru
|
|
args:
|
|
creates: /usr/bin/spotify
|
|
|
|
tags: [spotify]
|
|
|
|
- set_fact:
|
|
users: "{{ machine.users }}"
|
|
tags:
|
|
- always
|
|
|
|
- include_tasks: user.yml
|
|
args:
|
|
apply:
|
|
become: true
|
|
become_user: "{{ user.name }}"
|
|
with_items: "{{ users }}"
|
|
no_log: True # less spam
|
|
loop_control:
|
|
loop_var: user
|
|
tags:
|
|
- always
|
|
|
|
handlers:
|
|
- name: rebuild initrd
|
|
command: mkinitcpio -P
|
|
become: true
|
|
register: mkinitcpio_cmd
|
|
failed_when: >
|
|
mkinitcpio_cmd.rc != 0
|
|
and
|
|
not (mkinitcpio_cmd.rc == 1 and "file not found: `fsck.overlay'" in mkinitcpio_cmd.stderr)
|