Merge branch 'master' into fetlab
This commit is contained in:
Daniel A. Maierhofer
@@ -6,6 +6,39 @@
|
||||
|**H2**|01 /dev/sdb `6TB` <br> `WD-WX21D36PPLPH`|05 |09 |13 |
|
||||
|**H3**|02 /dev/sdc `6TB` <br> `WD-WX21D36PP0K1`|06 |10 |14 |
|
||||
|**H4**|03 /dev/sdd `6TB` <br> `WD-WXB1HB4MJCMM`|07 |11 |15 |
|
||||
## Debian setup install steps
|
||||
```
|
||||
Boot Image Debian Netinstall on USB stick, Advanced Options->Expert Install
|
||||
Language: English, Location: other->Europe->Austria
|
||||
Locale: en_US.UTF-8, Additional Locale: de_AT.UTF-8, System Locale: en_US.UTF-8
|
||||
Keyboard: German
|
||||
Detect and mount CD-ROM, Load installer components: no extra
|
||||
auf KISTL statische IP 192.168.86.7/24 für ariane.fet.htu.tuwien.ac.at einrichten
|
||||
Detect network hardware, Configure Network: enp8s0: Hostname: ariane, IP 192.168.86.7/24 domain fet.htu.tuwien.ac.at
|
||||
Setup Users and Passwords: shadow, user petra
|
||||
Configure the clock: NTP Server: tutimea.tuwien.ac.at
|
||||
Detect disks, partition disks: manual
|
||||
RAID1 md0 with both SSDs https://blog.sleeplessbeastie.eu/2013/10/04/how-to-configure-software-raid1-during-installation-process/
|
||||
/dev/nvmeXn1p1 32GB primary Volume für / in btrfs 32GB
|
||||
/dev/nvmeXn1p5 1.5 GB logical Volume
|
||||
/dev/nvmeXn1p6 1.5 GB logical Volume
|
||||
/dev/nvmeXn1p7 1.5 GB logical Volume
|
||||
/dev/nvmeXn1p8 1.5 GB logical Volume
|
||||
/dev/nvmeXn1p9 90 GB logical Volume
|
||||
ZFS RAIDZ-2 on is already on 4 x 6TB disks = 12TB 0 spares
|
||||
partition1 ariane-root btrfs noatime, discard
|
||||
Generic Kernel
|
||||
Mirror: gd.tuwien.ac.at, allow backported
|
||||
install with ssh server and standard sys utilities
|
||||
Install Grub on /dev/nvme0n1 (to removable media path)
|
||||
Install Grub on /dev/nvme1n1
|
||||
reboot, log in as root
|
||||
edit /etc/ssh/sshd_config set PermitRootlogin to yes
|
||||
service sshd reload
|
||||
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
|
||||
ssh-copy-id root@ariane from client
|
||||
edit /etc/ssh/sshd_config set PermitRootlogin to Prohibit-Password
|
||||
```
|
||||
## Install ZFS
|
||||
```shell
|
||||
apt-get install zfsutils-linux
|
||||
@@ -67,10 +100,14 @@ mv /var/log/* /ssd/var/log/
|
||||
zfs set mountpoint=/var/log ssd/var/log
|
||||
mv /var/lib/lxc/* /ssd/var/lxc/
|
||||
zfs set mountpoint=/var/lib/lxc ssd/var/lxc
|
||||
zfs create -o com.sun:auto-snapshot=false zv1/sojus
|
||||
zfs create -o com.sun:auto-snapshot=false zv1/daten/Scans
|
||||
```
|
||||
### Set dataset quota
|
||||
```shell
|
||||
zfs set quota=1T zv1/homes zv1/daten zv1/fotos
|
||||
zfs set quota=3T zv1/sojus
|
||||
zfs set quota=5G zv1/daten/Scans
|
||||
```
|
||||
### If intend using ACL someday
|
||||
```shell
|
||||
@@ -129,3 +166,9 @@ mdadm --misc --detail /dev/md0
|
||||
echo check > /sys/block/md0/md/sync_action
|
||||
watch -n 0.1 cat /proc/mdstat
|
||||
```
|
||||
## Shutdown System
|
||||
```shell
|
||||
# stop all LXC containers
|
||||
zfs_mount.sh unmount
|
||||
halt -p
|
||||
```
|
||||
|
||||
15
doc/configs/ariane_mbr_nvme0n1.txt
Normal file
15
doc/configs/ariane_mbr_nvme0n1.txt
Normal file
@@ -0,0 +1,15 @@
|
||||
Disk /dev/nvme0n1: 119.2 GiB, 128035676160 bytes, 250069680 sectors
|
||||
Units: sectors of 1 * 512 = 512 bytes
|
||||
Sector size (logical/physical): 512 bytes / 512 bytes
|
||||
I/O size (minimum/optimal): 512 bytes / 512 bytes
|
||||
Disklabel type: dos
|
||||
Disk identifier: 0x21183a98
|
||||
|
||||
Device Boot Start End Sectors Size Id Type
|
||||
/dev/nvme0n1p1 2048 62500863 62498816 29.8G fd Linux raid autodetect
|
||||
/dev/nvme0n1p2 62502910 250068991 187566082 89.4G 5 Extended
|
||||
/dev/nvme0n1p5 62504960 65435647 2930688 1.4G 83 Linux
|
||||
/dev/nvme0n1p6 65437696 68368383 2930688 1.4G 83 Linux
|
||||
/dev/nvme0n1p7 68370432 71301119 2930688 1.4G 83 Linux
|
||||
/dev/nvme0n1p8 71303168 74233855 2930688 1.4G 83 Linux
|
||||
/dev/nvme0n1p9 74235904 250068991 175833088 83.9G 83 Linux
|
||||
16
doc/configs/ariane_mbr_nvme1n1.txt
Normal file
16
doc/configs/ariane_mbr_nvme1n1.txt
Normal file
@@ -0,0 +1,16 @@
|
||||
Disk /dev/nvme1n1: 119.2 GiB, 128035676160 bytes, 250069680 sectors
|
||||
Units: sectors of 1 * 512 = 512 bytes
|
||||
Sector size (logical/physical): 512 bytes / 512 bytes
|
||||
I/O size (minimum/optimal): 512 bytes / 512 bytes
|
||||
Disklabel type: dos
|
||||
Disk identifier: 0x35c808a6
|
||||
|
||||
Device Boot Start End Sectors Size Id Type
|
||||
/dev/nvme1n1p1 2048 62500863 62498816 29.8G fd Linux raid autodetect
|
||||
/dev/nvme1n1p2 62502910 250068991 187566082 89.4G 5 Extended
|
||||
/dev/nvme1n1p5 62504960 65435647 2930688 1.4G 83 Linux
|
||||
/dev/nvme1n1p6 65437696 68368383 2930688 1.4G 83 Linux
|
||||
/dev/nvme1n1p7 68370432 71301119 2930688 1.4G 83 Linux
|
||||
/dev/nvme1n1p8 71303168 74233855 2930688 1.4G 83 Linux
|
||||
/dev/nvme1n1p9 74235904 250068991 175833088 83.9G 83 Linux
|
||||
|
||||
9
doc/configs/ariane_mbr_zv1.txt
Normal file
9
doc/configs/ariane_mbr_zv1.txt
Normal file
@@ -0,0 +1,9 @@
|
||||
Disk /dev/sdc: 5.5 TiB, 6001175126016 bytes, 11721045168 sectors
|
||||
Units: sectors of 1 * 512 = 512 bytes
|
||||
Sector size (logical/physical): 512 bytes / 4096 bytes
|
||||
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
|
||||
Disklabel type: gpt
|
||||
Disk identifier: D2B76C08-E0D8-42AC-A0D5-F3A14EA584DF
|
||||
|
||||
Device Start End Sectors Size Type
|
||||
/dev/sdc1 2048 11721045134 11721043087 5.5T Solaris /usr & Apple ZFS
|
||||
1394
doc/configs/kistl-pfSense-backup.xml
Normal file
1394
doc/configs/kistl-pfSense-backup.xml
Normal file
File diff suppressed because it is too large
Load Diff
1268
doc/configs/miruk-pfSense-backup.xml
Normal file
1268
doc/configs/miruk-pfSense-backup.xml
Normal file
File diff suppressed because it is too large
Load Diff
BIN
doc/configs/wlan-OpenWrt-backup.tar.gz
Normal file
BIN
doc/configs/wlan-OpenWrt-backup.tar.gz
Normal file
Binary file not shown.
3
doc/kistl.md
Normal file
3
doc/kistl.md
Normal file
@@ -0,0 +1,3 @@
|
||||
# kistl
|
||||
## Current config
|
||||
See [config file](configs/kistl-pfSense-backup.xml)
|
||||
11
doc/lxc.md
Normal file
11
doc/lxc.md
Normal file
@@ -0,0 +1,11 @@
|
||||
# LXC container
|
||||
## edit config
|
||||
```shell
|
||||
vi /var/lib/lxc/lxc-container-01/config
|
||||
```
|
||||
## manage container
|
||||
```shell
|
||||
lxc-start -n lxc-container-01
|
||||
lxc-attach -n lxc-container-01
|
||||
lxc-stop -n lxc-container-01
|
||||
```
|
||||
3
doc/miruk.md
Normal file
3
doc/miruk.md
Normal file
@@ -0,0 +1,3 @@
|
||||
# miruk
|
||||
## Current config
|
||||
See [config file](configs/miruk-pfSense-backup.xml)
|
||||
15
doc/sojus.md
Normal file
15
doc/sojus.md
Normal file
@@ -0,0 +1,15 @@
|
||||
# sojus
|
||||
## create big backup locally
|
||||
```shell
|
||||
cryptsetup luksOpen /dev/disk/by-id/ata-<ID>-part1 ata-<ID>-part1
|
||||
zpool import
|
||||
zpool import lab
|
||||
zfs create -o com.sun:auto-snapshot=false lab/backup
|
||||
borg init -e none /lab/backup/ariane.fet.htu.tuwien.ac.at
|
||||
./borg create --show-rc --verbose --stats backup@sojus:system::ariane-{now} /zv1/daten /zv1/fotos /zv1/homes
|
||||
zpool export lab
|
||||
cryptsetup luksClose ata-<ID>-part1
|
||||
sync
|
||||
hdparm -y /dev/disk/by-id/ata-
|
||||
hdparm -C /dev/disk/by-id/ata-
|
||||
```
|
||||
3
doc/wlan.md
Normal file
3
doc/wlan.md
Normal file
@@ -0,0 +1,3 @@
|
||||
# wlan
|
||||
## Current config
|
||||
See [config file](configs/wlan-OpenWrt-backup.tar.gz)
|
||||
@@ -29,9 +29,6 @@ common_locales:
|
||||
- name: 'de_AT.UTF-8'
|
||||
state: "present"
|
||||
|
||||
|
||||
# apt-get common config
|
||||
common_apt: True
|
||||
common_apt_repositories:
|
||||
- "deb http://cdn.debian.net/debian/ {{ ansible_distribution_release }} main contrib non-free"
|
||||
- "deb http://cdn.debian.net/debian/ {{ ansible_distribution_release }}-backports main contrib non-free"
|
||||
@@ -40,10 +37,10 @@ common_apt_repositories:
|
||||
common_vim_default: False
|
||||
|
||||
common_openssh_keys_root:
|
||||
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzkK6ENya4mKcoG9iuMaodMpifeCgZK56zVF1zxyZhLtUyBx//qsLCXEdBNiGJY57Yp4l0PJKk9B4hpCFKuz6H622l84SOHzXhmFQUXWe/L6x4kRfQJvhBCNMi9brfR0n6AwX59RNRsbUeUjb7RuhCrzpbW0iWYjv/H9rjeyfY5Ne9dUUeBQDcsM1O7XfZJWwA5nxEGjbDB7l4/K43DoqaqzHOEOoETmHGfugO7A5QwhRmblu90pLD4+DOPv/4LGBRNpS8FyRzYrEJm7yUyF7nDzR+0xlLCapU4pKhmIFfSv4afsuBFvLb6Rgln5wUt2KIPh/qnqSP9jZGovYOadC0yb70dec7nnfwXTmqwzdwXtBlo3UzbPwt0iJG9fhYCw83Bkt/GpOsIW2fcxZhJ8CUeBw3Ox71lkeozb49oRMeHzUpYckrFt1FGxUWuHHykCrOXcxso0MRfKjl9RPUc+O5oQDG1KAoTd9doB3jygVr68wYVc/4kTTsXUlMIBMOUiek8XygQ7sV6Et6FpzvLvdf/iL1FMXAluRgUWJvKqe4IBPyWu2KyDF+2ZDMse3WhQYlYgNRqGCwfxOJGWtkvVO0L4YGJrLXKhY4yw2H+pQOHaugfGO8IYPV/vbPi+dB9OV89Zonu2iVjjDFFXI0xE7WSXCV3RQyed26Bq9BBO9DDQ== damadmai@fet.at"
|
||||
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmv/aixvhRzeQiD3XABD448WHW2sHSX5wj5TkqKmHG3MekovCjacEDwAEdH+3MzXzbQXCD8NOHxlvRsqfzsaIZw6al+i7hd7xeYzRAITeXAod/eQNJY71Czh1xt/rtfjgVrwFKe6kUo+RqUUBxOXjKNtCROxvsa/gxTSJD4xz/TGOTM7EbRfkOGBh3j/xmdBinURTACwKwHCR4SUnpAA7usY/QQGW22Nqczvj9SW1Un0TnYpMm7jAghGo7pvwInTerbbA2OQ07QEp9T/mAbPUks5QGEw1lwMZgEtl0EZrKxDoWjssGPw5ZA6RzwIggjuEN1zzE+pn9jWL+9sd2Tihr pet@fet.at"
|
||||
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEer+2Q3/bSJv2SpaGo8tjkQdSw/Kqoyy3XZ2RrtEqwzGozfvjyrZ0jd2Vy6LJ37o3n34brfVOvzeBaiSzc+5ciNgRVohaMydM6ADSGvZ9S2BGod1KonKfTbultWA1+BzJAjn7ZTjLlPJmceITYlh5uAnHrWQgZNPipMHLbKnSMUUd7AbkBy/nhg/ad5dO6e9TOXmEY+cNMCcA20R1i/O9nA1LIgXfnx1WKtW40gOf5YioHnhOMo8rNP5WlzZ1Lf5SiMJgxeT0covc3pq+hAHa+Y6KKdeO5oQ36RMi5FJUk2txQHGQtAjLMg0dv+bJgepIakM5wxekk9oY0J8inZOMh0mRH86KMH3SDwXt2xPomXfkGKeHVkM5VO6qfv8CzX/FjMoTTFGVaKDEPngbA8BIrPD7++gicdcnkmYOJLXgBDuJhhpis/Yp8F+F1tMBDT9LRLNvM18BXpekoFJNwTWJOAR8gktsiYP3VMt6oN1Y5lStvzv6MkhaEa0WGqjQoOJsQuI1roVHwlQhyWM/igCeO0Egb7qz/qPJHRRCgNfVjDO/rtFK09EjmG1bQrgOP7dJv0E+3scxilnoIED6ocCpKNVpc/okehgHwC+QdIpWrn5fPrXJt/hifguCn7KziWfQne8eIxaQOWBaZLdcY7HmgtQmOi3KRlKy+ORXtj/+MQ== hans@fet.at"
|
||||
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZAVxkHZYqjgCBcfHy0yggdVALZKoQbJP1TJAEYgLIAWFQ0ZPMGDaidOQiTzFTE0i35MUlQB6Rc+pTYnW/+h9rzktWbU/8RNirQve2XR5TWiRIUa13p31Xgjyw05O0uF3LEL/SmZruMHy25ncDXGF+xC2VllIttC+fLHJWLXIbWVujHdOA69fBqOonQrcPTsg1l4QQv6ZAxwVgCsbeOccZkdpoT0BJk03nflW+SGsKthTYX2VMGJlc/4QjArfZ2hTykr0I/lSA6E9FkFSLl65ejovGxCp1oXn484DlyajoXqJY7IOD86izXqkQSq4w4bLKEdrfQOnfGKe1XmxzFdk92SNEW41RXokNQ16xOBZzO1ZHkXd6hx0Pj6aBvUbs3PlCn4q764LKIcjSk7ADgeC5OBA4xgRxyZt9vuP93o7jl3vvqLWevsFa0j8orxC0D3cO5SMPbowW9LqrtqHynC0WltrtLT5+Q2tBSavP615NOu+bfcakgiWN8otv41ST+2hWka8qNptOxTRj/h7+MMOyi9bh1vjgB1KkOZYotJtFdXKFiYz+buIKwguWZWEni9uTRMiEsu84x8aJwdptPO0UIgZGroyUZJcWlUkwrkdE5T4cg9zP14M6zmogAYEI7oRX56FyspRVlA7J6VF/mcZ1z6ufH+97cle613gPKUVkpw== andis@fet.at"
|
||||
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKrEdkD1Oecw++r77MVrga1e20FA+e/O37rhMc0etS5MvlbsAHd6Ftx2SIXVtwDnHDzyUAOJb8WlYPdG5r/QJYtXgVMGZrZ31UFdlAZq3K8ytczKkcMgnEEOWYSSyQRJlEW5LkZ9tD0hv1myIg5iw6Vpuqe6YFSkdDHtGxf0lnLAfi1XKwu7b7tARJz7teOAjaFzXumvsZlFx9BdufMW32uu7BSYWjSGcrEzMyyB/5C3kU/d5Q1ZTNK6tceopFr/K1lKBzvj85safD5BH8NpjvLe1QkzHu+C0AVxYNtqGHI5oWJbcR+UOwelBeEM/On+/Xq0ZIVmiLmFx03Qun8t1n berni@fet.at"
|
||||
- 'no-pty,no-agent-forwarding,no-X11-forwarding,command="shutdown -h +1" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCiI41+XkobMT0K8ZrHdCeomdGAIRMZbdX1VjGe5OWa72rcaDFmBtK7MxD5xPZEdSaDkn+Nrpwv5/j10MccvkAOI/tx6PIxcgDF52FnHLMMVrXRM3cnkm9CrBi4kCN0D2fpbDLhknJhiqftIcPdct/a9foZQwkWOzGUN2Rk0mCw2QzkGyWHNxOMzMjV0gpfAWPv6Jg+JKDl5EHf2xJTeJ/l0TG6O0lsc5YY/7cqjRJJzTVFDo1Gy+qNgff0mbPrhcbWepG5R1tjkdT++f8uuoVkBUamwkjwDpH2y57sdESEPB0C5ES2cglOp2X3MMN7EnUBHYU3mMiYU0wV+b7Q3oKmQuG86a2D+yEp+0+WFaUY/TMCNpslGOtTBrNLshMIX/bnrx/aF9DApl9L/kUIlSxwwBNiPIl4VVU1p5Zzj/YAPvRl0kAKjosOZgl108JeRUbhQSGVrcODyhaIMQv4BAzHnV0kii7jNACHhqBR36eo3N6HX7GkbnU1YadZRcrxrpE9z9mrXuqWxzl4Cmz1yHb1JTwsnQQ2Dy0trIklQjEmLxvG8zpxHLV3EQmtIMK/g2Mk6VTdz9HZnwYLU7Mj/uZk0DWhTZ5Eyj6QAbcw2gLPLEUmdQhkHSoQKxHY0at3OjGFGydyc/3n7B7d578uxVBrp04uhTbW7SDi6mYGCkvCRQ== nut ups shutdown'
|
||||
|
||||
- key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzkK6ENya4mKcoG9iuMaodMpifeCgZK56zVF1zxyZhLtUyBx//qsLCXEdBNiGJY57Yp4l0PJKk9B4hpCFKuz6H622l84SOHzXhmFQUXWe/L6x4kRfQJvhBCNMi9brfR0n6AwX59RNRsbUeUjb7RuhCrzpbW0iWYjv/H9rjeyfY5Ne9dUUeBQDcsM1O7XfZJWwA5nxEGjbDB7l4/K43DoqaqzHOEOoETmHGfugO7A5QwhRmblu90pLD4+DOPv/4LGBRNpS8FyRzYrEJm7yUyF7nDzR+0xlLCapU4pKhmIFfSv4afsuBFvLb6Rgln5wUt2KIPh/qnqSP9jZGovYOadC0yb70dec7nnfwXTmqwzdwXtBlo3UzbPwt0iJG9fhYCw83Bkt/GpOsIW2fcxZhJ8CUeBw3Ox71lkeozb49oRMeHzUpYckrFt1FGxUWuHHykCrOXcxso0MRfKjl9RPUc+O5oQDG1KAoTd9doB3jygVr68wYVc/4kTTsXUlMIBMOUiek8XygQ7sV6Et6FpzvLvdf/iL1FMXAluRgUWJvKqe4IBPyWu2KyDF+2ZDMse3WhQYlYgNRqGCwfxOJGWtkvVO0L4YGJrLXKhY4yw2H+pQOHaugfGO8IYPV/vbPi+dB9OV89Zonu2iVjjDFFXI0xE7WSXCV3RQyed26Bq9BBO9DDQ== damadmai@fet.at"
|
||||
- key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmv/aixvhRzeQiD3XABD448WHW2sHSX5wj5TkqKmHG3MekovCjacEDwAEdH+3MzXzbQXCD8NOHxlvRsqfzsaIZw6al+i7hd7xeYzRAITeXAod/eQNJY71Czh1xt/rtfjgVrwFKe6kUo+RqUUBxOXjKNtCROxvsa/gxTSJD4xz/TGOTM7EbRfkOGBh3j/xmdBinURTACwKwHCR4SUnpAA7usY/QQGW22Nqczvj9SW1Un0TnYpMm7jAghGo7pvwInTerbbA2OQ07QEp9T/mAbPUks5QGEw1lwMZgEtl0EZrKxDoWjssGPw5ZA6RzwIggjuEN1zzE+pn9jWL+9sd2Tihr pet@fet.at"
|
||||
- key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEer+2Q3/bSJv2SpaGo8tjkQdSw/Kqoyy3XZ2RrtEqwzGozfvjyrZ0jd2Vy6LJ37o3n34brfVOvzeBaiSzc+5ciNgRVohaMydM6ADSGvZ9S2BGod1KonKfTbultWA1+BzJAjn7ZTjLlPJmceITYlh5uAnHrWQgZNPipMHLbKnSMUUd7AbkBy/nhg/ad5dO6e9TOXmEY+cNMCcA20R1i/O9nA1LIgXfnx1WKtW40gOf5YioHnhOMo8rNP5WlzZ1Lf5SiMJgxeT0covc3pq+hAHa+Y6KKdeO5oQ36RMi5FJUk2txQHGQtAjLMg0dv+bJgepIakM5wxekk9oY0J8inZOMh0mRH86KMH3SDwXt2xPomXfkGKeHVkM5VO6qfv8CzX/FjMoTTFGVaKDEPngbA8BIrPD7++gicdcnkmYOJLXgBDuJhhpis/Yp8F+F1tMBDT9LRLNvM18BXpekoFJNwTWJOAR8gktsiYP3VMt6oN1Y5lStvzv6MkhaEa0WGqjQoOJsQuI1roVHwlQhyWM/igCeO0Egb7qz/qPJHRRCgNfVjDO/rtFK09EjmG1bQrgOP7dJv0E+3scxilnoIED6ocCpKNVpc/okehgHwC+QdIpWrn5fPrXJt/hifguCn7KziWfQne8eIxaQOWBaZLdcY7HmgtQmOi3KRlKy+ORXtj/+MQ== hans@fet.at"
|
||||
- key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZAVxkHZYqjgCBcfHy0yggdVALZKoQbJP1TJAEYgLIAWFQ0ZPMGDaidOQiTzFTE0i35MUlQB6Rc+pTYnW/+h9rzktWbU/8RNirQve2XR5TWiRIUa13p31Xgjyw05O0uF3LEL/SmZruMHy25ncDXGF+xC2VllIttC+fLHJWLXIbWVujHdOA69fBqOonQrcPTsg1l4QQv6ZAxwVgCsbeOccZkdpoT0BJk03nflW+SGsKthTYX2VMGJlc/4QjArfZ2hTykr0I/lSA6E9FkFSLl65ejovGxCp1oXn484DlyajoXqJY7IOD86izXqkQSq4w4bLKEdrfQOnfGKe1XmxzFdk92SNEW41RXokNQ16xOBZzO1ZHkXd6hx0Pj6aBvUbs3PlCn4q764LKIcjSk7ADgeC5OBA4xgRxyZt9vuP93o7jl3vvqLWevsFa0j8orxC0D3cO5SMPbowW9LqrtqHynC0WltrtLT5+Q2tBSavP615NOu+bfcakgiWN8otv41ST+2hWka8qNptOxTRj/h7+MMOyi9bh1vjgB1KkOZYotJtFdXKFiYz+buIKwguWZWEni9uTRMiEsu84x8aJwdptPO0UIgZGroyUZJcWlUkwrkdE5T4cg9zP14M6zmogAYEI7oRX56FyspRVlA7J6VF/mcZ1z6ufH+97cle613gPKUVkpw== andis@fet.at"
|
||||
- key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKrEdkD1Oecw++r77MVrga1e20FA+e/O37rhMc0etS5MvlbsAHd6Ftx2SIXVtwDnHDzyUAOJb8WlYPdG5r/QJYtXgVMGZrZ31UFdlAZq3K8ytczKkcMgnEEOWYSSyQRJlEW5LkZ9tD0hv1myIg5iw6Vpuqe6YFSkdDHtGxf0lnLAfi1XKwu7b7tARJz7teOAjaFzXumvsZlFx9BdufMW32uu7BSYWjSGcrEzMyyB/5C3kU/d5Q1ZTNK6tceopFr/K1lKBzvj85safD5BH8NpjvLe1QkzHu+C0AVxYNtqGHI5oWJbcR+UOwelBeEM/On+/Xq0ZIVmiLmFx03Qun8t1n berni@fet.at"
|
||||
- key: 'no-pty,no-agent-forwarding,no-X11-forwarding,command="shutdown -h +1" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCiI41+XkobMT0K8ZrHdCeomdGAIRMZbdX1VjGe5OWa72rcaDFmBtK7MxD5xPZEdSaDkn+Nrpwv5/j10MccvkAOI/tx6PIxcgDF52FnHLMMVrXRM3cnkm9CrBi4kCN0D2fpbDLhknJhiqftIcPdct/a9foZQwkWOzGUN2Rk0mCw2QzkGyWHNxOMzMjV0gpfAWPv6Jg+JKDl5EHf2xJTeJ/l0TG6O0lsc5YY/7cqjRJJzTVFDo1Gy+qNgff0mbPrhcbWepG5R1tjkdT++f8uuoVkBUamwkjwDpH2y57sdESEPB0C5ES2cglOp2X3MMN7EnUBHYU3mMiYU0wV+b7Q3oKmQuG86a2D+yEp+0+WFaUY/TMCNpslGOtTBrNLshMIX/bnrx/aF9DApl9L/kUIlSxwwBNiPIl4VVU1p5Zzj/YAPvRl0kAKjosOZgl108JeRUbhQSGVrcODyhaIMQv4BAzHnV0kii7jNACHhqBR36eo3N6HX7GkbnU1YadZRcrxrpE9z9mrXuqWxzl4Cmz1yHb1JTwsnQQ2Dy0trIklQjEmLxvG8zpxHLV3EQmtIMK/g2Mk6VTdz9HZnwYLU7Mj/uZk0DWhTZ5Eyj6QAbcw2gLPLEUmdQhkHSoQKxHY0at3OjGFGydyc/3n7B7d578uxVBrp04uhTbW7SDi6mYGCkvCRQ== nut ups shutdown'
|
||||
state: present
|
||||
|
||||
@@ -24,9 +24,11 @@ common_basic_packages:
|
||||
- python3-apt
|
||||
- python3-pycurl
|
||||
# extra
|
||||
- lshw
|
||||
- gdisk
|
||||
- cgroupfs-mount
|
||||
- cryptsetup
|
||||
- fuse
|
||||
- gdisk
|
||||
- lshw
|
||||
- nvme-cli
|
||||
|
||||
common_sysctl: True
|
||||
|
||||
@@ -1,2 +1,19 @@
|
||||
---
|
||||
common_apt: False
|
||||
common_xbps: True
|
||||
common_basic_packages:
|
||||
- curl
|
||||
- ncurses-term
|
||||
- etckeeper
|
||||
- git
|
||||
- htop
|
||||
- logrotate
|
||||
- ncdu
|
||||
- rsync
|
||||
- strace
|
||||
- sudo
|
||||
- screen
|
||||
- tmux
|
||||
- tree
|
||||
- vim
|
||||
- zsh
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
inventory_hostname: ariane.fet.htu.tuwien.ac.at
|
||||
inventory_hostname_short: ariane
|
||||
|
||||
common_interfaces: interfaces_ariane.j2
|
||||
common_iptables_v4: "iptables_ariane_v4.j2"
|
||||
common_iptables_v6: "iptables_ariane_v6.j2"
|
||||
|
||||
@@ -33,6 +34,28 @@ lxc:
|
||||
- lxc.network.hwaddr = 2e:6d:b6:07:15:01
|
||||
- lxc.pts = 6
|
||||
|
||||
- name: progress
|
||||
revision: "01"
|
||||
template: voidlinux
|
||||
config:
|
||||
- lxc.network.type = veth
|
||||
- lxc.network.hwaddr = 2e:6d:b6:07:19:01
|
||||
- lxc.network.link = br0
|
||||
- lxc.network.flags = up
|
||||
- lxc.pts = 6
|
||||
- lxc.mount.entry = /zv1/daten/Scans /var/lib/lxc/lxc-progress-01/rootfs/mnt/scans none bind,create=dir 0 0
|
||||
|
||||
- name: sojus
|
||||
revision: "01"
|
||||
template: voidlinux
|
||||
config:
|
||||
- lxc.network.type = veth
|
||||
- lxc.network.hwaddr = 2e:6d:b6:07:17:01
|
||||
- lxc.network.link = br0
|
||||
- lxc.network.flags = up
|
||||
- lxc.pts = 6
|
||||
- lxc.mount.entry = /zv1/sojus /var/lib/lxc/lxc-sojus-01/rootfs/home/backup/repos none bind,create=dir 0 0
|
||||
|
||||
- name: proteus
|
||||
revision: "01"
|
||||
template: debian
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
inventory_hostname_short: backup01
|
||||
42
host_vars/baroness
Normal file
42
host_vars/baroness
Normal file
@@ -0,0 +1,42 @@
|
||||
inventory_hostname: baroness.fet.htu.tuwien.ac.at
|
||||
inventory_hostname_short: baroness
|
||||
|
||||
borgbackup_binary_version: "1.1.6"
|
||||
borgbackup_binary_platform: "armv6"
|
||||
borgbackup_binary_uri: "https://borg.bauerj.eu/borg-{{ borgbackup_binary_version }}-{{ borgbackup_binary_platform }}"
|
||||
|
||||
borgbackup_encryption_mode: "none"
|
||||
|
||||
borgbackup_client_backup_server: sojus
|
||||
|
||||
borgbackup_create_jobs:
|
||||
- name: system
|
||||
options: "--lock-wait 1800"
|
||||
day: "*"
|
||||
hour: "*" # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
directories:
|
||||
- "/home/pi/baroness"
|
||||
excludes: []
|
||||
|
||||
borgbackup_prune_enabled: yes
|
||||
borgbackup_prune_jobs:
|
||||
- name: system
|
||||
prune_options: "--lock-wait 1800 --keep-daily=750 --keep-weekly=52 --keep-monthly=24 --keep-yearly=-1"
|
||||
day: "*"
|
||||
hour: 12 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
|
||||
borgbackup_check_enabled: yes
|
||||
borgbackup_check_jobs:
|
||||
- name: system
|
||||
check_options: "--lock-wait 28800"
|
||||
day: 1
|
||||
hour: 12 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
random_day: 27 # default value : ignore randomization
|
||||
44
host_vars/buran
Normal file
44
host_vars/buran
Normal file
@@ -0,0 +1,44 @@
|
||||
inventory_hostname: buran.fet.htu.tuwien.ac.at
|
||||
inventory_hostname_short: buran
|
||||
|
||||
borgbackup_install_from_repo: False
|
||||
borgbackup_binary_platform: "borg-linux32"
|
||||
|
||||
borgbackup_encryption_mode: "none"
|
||||
|
||||
borgbackup_client_backup_server: sojus
|
||||
|
||||
borgbackup_create_jobs:
|
||||
- name: system
|
||||
options: "--lock-wait 7200"
|
||||
day: "*"
|
||||
hour: 0 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
directories:
|
||||
- "/var/lib/cyrus"
|
||||
- "/var/spool/cyrus/mail"
|
||||
- "/var/spool/sieve"
|
||||
excludes: []
|
||||
|
||||
borgbackup_prune_enabled: yes
|
||||
borgbackup_prune_jobs:
|
||||
- name: system
|
||||
prune_options: "--lock-wait 7200 --keep-daily=7 --keep-weekly=4 --keep-monthly=12 --keep-yearly=-1"
|
||||
day: "*"
|
||||
hour: 12 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
|
||||
borgbackup_check_enabled: yes
|
||||
borgbackup_check_jobs:
|
||||
- name: system
|
||||
check_options: "--lock-wait 28800"
|
||||
day: 1
|
||||
hour: 12 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
random_day: 27 # default value : ignore randomization
|
||||
42
host_vars/maria-storage
Normal file
42
host_vars/maria-storage
Normal file
@@ -0,0 +1,42 @@
|
||||
inventory_hostname: maria-storage.fet.htu.tuwien.ac.at
|
||||
inventory_hostname_short: maria-storage
|
||||
|
||||
borgbackup_install_from_repo: False
|
||||
|
||||
borgbackup_encryption_mode: "none"
|
||||
|
||||
borgbackup_client_backup_server: sojus
|
||||
|
||||
borgbackup_create_jobs:
|
||||
- name: system
|
||||
options: "--lock-wait 7200"
|
||||
day: "*"
|
||||
hour: 0 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
directories:
|
||||
- "/var/lib/mysql"
|
||||
- "/srv/save"
|
||||
excludes: []
|
||||
|
||||
borgbackup_prune_enabled: yes
|
||||
borgbackup_prune_jobs:
|
||||
- name: system
|
||||
prune_options: "--lock-wait 7200 --keep-daily=7 --keep-weekly=4 --keep-monthly=12 --keep-yearly=-1"
|
||||
day: "*"
|
||||
hour: 12 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
|
||||
borgbackup_check_enabled: yes
|
||||
borgbackup_check_jobs:
|
||||
- name: system
|
||||
check_options: "--lock-wait 28800"
|
||||
day: 1
|
||||
hour: 12 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
random_day: 27 # default value : ignore randomization
|
||||
42
host_vars/nauka
Normal file
42
host_vars/nauka
Normal file
@@ -0,0 +1,42 @@
|
||||
inventory_hostname: nauka.fet.htu.tuwien.ac.at
|
||||
inventory_hostname_short: nauka
|
||||
|
||||
borgbackup_install_from_repo: False
|
||||
|
||||
borgbackup_encryption_mode: "none"
|
||||
|
||||
borgbackup_client_backup_server: sojus
|
||||
|
||||
borgbackup_create_jobs:
|
||||
- name: system
|
||||
options: "--lock-wait 7200"
|
||||
day: "*"
|
||||
hour: 0 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
directories:
|
||||
- "/var/lib/mysql"
|
||||
- "/var/www"
|
||||
excludes: []
|
||||
|
||||
borgbackup_prune_enabled: yes
|
||||
borgbackup_prune_jobs:
|
||||
- name: system
|
||||
prune_options: "--lock-wait 7200 --keep-daily=7 --keep-weekly=4 --keep-monthly=12 --keep-yearly=-1"
|
||||
day: "*"
|
||||
hour: 12 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
|
||||
borgbackup_check_enabled: yes
|
||||
borgbackup_check_jobs:
|
||||
- name: system
|
||||
check_options: "--lock-wait 28800"
|
||||
day: 1
|
||||
hour: 12 # default value = 1
|
||||
minute: 0 # default value = 0
|
||||
random_hour: 5 # default value : ignore randomization
|
||||
random_minute: 59 # default value : ignore randomization
|
||||
random_day: 27 # default value : ignore randomization
|
||||
6
host_vars/progress
Normal file
6
host_vars/progress
Normal file
@@ -0,0 +1,6 @@
|
||||
inventory_hostname: progress.fet.htu.tuwien.ac.at
|
||||
inventory_hostname_short: progress
|
||||
|
||||
common_iptables_v4: "iptables_progress_v4.j2"
|
||||
common_iptables_v6: "iptables_progress_v6.j2"
|
||||
printer_ip: 192.168.86.14
|
||||
7
host_vars/sojus
Normal file
7
host_vars/sojus
Normal file
@@ -0,0 +1,7 @@
|
||||
inventory_hostname: sojus.fet.htu.tuwien.ac.at
|
||||
inventory_hostname_short: sojus
|
||||
|
||||
borgbackup_install_from_repo: True
|
||||
borgbackup_binary: "/usr/bin/borg"
|
||||
|
||||
borgbackup_encryption_mode: "none"
|
||||
@@ -13,5 +13,15 @@ all:
|
||||
fet_lxc_void:
|
||||
hosts:
|
||||
zyklon:
|
||||
sojus:
|
||||
progress:
|
||||
fet_qemu:
|
||||
hosts:
|
||||
maria-storage:
|
||||
buran:
|
||||
nauka:
|
||||
fet_pi:
|
||||
hosts:
|
||||
baroness:
|
||||
vars:
|
||||
ansible_python_interpreter=/usr/bin/python3
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
---
|
||||
backup_borg: True
|
||||
@@ -1,21 +0,0 @@
|
||||
---
|
||||
- name: install borg
|
||||
package: name="borgbackup" state=present
|
||||
|
||||
- name: create repositories
|
||||
file:
|
||||
path: "{{item.path}}"
|
||||
state: directory
|
||||
with_items: "{{backup.repositories}}"
|
||||
|
||||
- name: init borg repositories
|
||||
command: "borg init {{item.path}} --encryption=none"
|
||||
args:
|
||||
creates: "{{item.path}}/README"
|
||||
with_items: "{{backup.repositories}}"
|
||||
|
||||
- name: create READMES
|
||||
template:
|
||||
src=borg_README.j2
|
||||
dest="{{item.path}}/README"
|
||||
with_items: "{{backup.repositories}}"
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
- import_tasks: borg.yml
|
||||
when: backup_borg
|
||||
tags: ['backup', 'borg']
|
||||
@@ -1,2 +0,0 @@
|
||||
This is a generate FET borg repository.
|
||||
Name: {{item.name}}
|
||||
@@ -1,2 +0,0 @@
|
||||
---
|
||||
backup_borg: True
|
||||
@@ -1,27 +0,0 @@
|
||||
---
|
||||
- name: install borg
|
||||
package: name="borgbackup" state=present
|
||||
|
||||
- name: create backup user
|
||||
user:
|
||||
name: borg_backup
|
||||
comment: "BackupUser für BORG Backup"
|
||||
group: root
|
||||
generate_ssh_key: yes
|
||||
ssh_key_bits: 4096
|
||||
ssh_key_file: .ssh/id_rsa
|
||||
|
||||
- name: fetch pubickey
|
||||
shell: "cat /home/borg_backup/.ssh/id_rsa.pub"
|
||||
register: id_rsa_pub
|
||||
changed_when: false
|
||||
|
||||
- name: Add authorized key to borg backup servers
|
||||
authorized_key:
|
||||
user: "root"
|
||||
key: "{{id_rsa_pub.stdout}}"
|
||||
key_options: 'command="borg serve --restrict-to-path /srv/rep1"'
|
||||
delegate_to: "{{item}}"
|
||||
with_items: "{{groups['backup']}}"
|
||||
when: id_rsa_pub.stdout is defined
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
- import_tasks: borg.yml
|
||||
when: backup_borg
|
||||
tags: ['backup', 'borg']
|
||||
29
roles/borg_client/.travis.yml
Normal file
29
roles/borg_client/.travis.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
---
|
||||
language: python
|
||||
python: "2.7"
|
||||
|
||||
# Use the new container infrastructure
|
||||
sudo: false
|
||||
|
||||
# Install ansible
|
||||
addons:
|
||||
apt:
|
||||
packages:
|
||||
- python-pip
|
||||
|
||||
install:
|
||||
# Install ansible
|
||||
- pip install ansible
|
||||
|
||||
# Check ansible version
|
||||
- ansible --version
|
||||
|
||||
# Create ansible.cfg with correct roles_path
|
||||
- printf '[defaults]\nroles_path=../' >ansible.cfg
|
||||
|
||||
script:
|
||||
# Basic role syntax check
|
||||
- ansible-playbook tests/test.yml -i tests/inventory --syntax-check
|
||||
|
||||
notifications:
|
||||
webhooks: https://galaxy.ansible.com/api/v1/notifications/
|
||||
201
roles/borg_client/LICENSE
Normal file
201
roles/borg_client/LICENSE
Normal file
@@ -0,0 +1,201 @@
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright {yyyy} {name of copyright owner}
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
59
roles/borg_client/README.md
Normal file
59
roles/borg_client/README.md
Normal file
@@ -0,0 +1,59 @@
|
||||
Borgbackup
|
||||
==========
|
||||
|
||||
Ansible [Borgbackup](https://borgbackup.readthedocs.io/en/stable/) role.
|
||||
|
||||
Features:
|
||||
* Repository or binary installation
|
||||
* Schedules regular backup jobs
|
||||
* Schedules regular prune jobs to keep backup windows clean
|
||||
* Flexible configuration to list backup targets
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
see `defaults/main.yml`
|
||||
|
||||
Example Playbook
|
||||
----------------
|
||||
|
||||
- hosts: all
|
||||
roles:
|
||||
- role: SphericalElephant.borgbackup
|
||||
borgbackup_client: True
|
||||
borgbackup_client_backup_server: backup01.example.com
|
||||
borgbackup_create_jobs:
|
||||
- name: system
|
||||
day: "*"
|
||||
hour: "0"
|
||||
minute: "{{ 59 | random }}"
|
||||
directories:
|
||||
- /etc
|
||||
- /home
|
||||
- /var
|
||||
excludes:
|
||||
- 're:^/var/lib/apt'
|
||||
- 're:^/var/[^/]+\/cache/'
|
||||
borgbackup_prune_jobs:
|
||||
- name: system
|
||||
prune_options: "--keep-daily=7 --keep-weekly=4"
|
||||
day: "*"
|
||||
hour: "8"
|
||||
minute: "0"
|
||||
borgbackup_check_jobs:
|
||||
- name: system
|
||||
check_options: "--lock-wait 28800"
|
||||
day: "1"
|
||||
hour: "12"
|
||||
minute: "0"
|
||||
|
||||
|
||||
You can easily assign client and server attributes from your inventory with something similar to the following:
|
||||
|
||||
borgbackup_client: "{{ (inventory_hostname in groups.borgbackup_server)|ternary(False, True) }}"
|
||||
borgbackup_client_backup_server: "{{ groups.borgbackup_server[0] }}"
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
Apache 2.0
|
||||
77
roles/borg_client/defaults/main.yml
Normal file
77
roles/borg_client/defaults/main.yml
Normal file
@@ -0,0 +1,77 @@
|
||||
---
|
||||
borgbackup_install_from_repo: False
|
||||
borgbackup_binary_version: "1.1.6"
|
||||
borgbackup_binary_platform: "borg-linux64"
|
||||
borgbackup_binary_uri: "https://github.com/borgbackup/borg/releases/download/{{ borgbackup_binary_version }}/{{ borgbackup_binary_platform }}"
|
||||
borgbackup_binary: "/usr/local/bin/borg"
|
||||
|
||||
borgbackup_encryption_mode: "none"
|
||||
borgbackup_passphrase: "yoursecret"
|
||||
|
||||
borgbackup_server_user: "backup"
|
||||
borgbackup_server_group: "backup"
|
||||
borgbackup_server_home: "/home/backup"
|
||||
borgbackup_server_pool: "{{ borgbackup_server_home }}/repos"
|
||||
|
||||
borgbackup_client_ssh_key_type: '{{ "ed25519"
|
||||
if ("ssh-ed25519" in borgbackup_register_key_types.stdout_lines)
|
||||
else "rsa" }}'
|
||||
|
||||
borgbackup_client_ssh_key_file: "/root/.ssh/id_{{ borgbackup_client_ssh_key_type }}-backup"
|
||||
borgbackup_client_ssh_key_comment: 'root@{{ ansible_hostname }} generated by Ansible'
|
||||
borgbackup_client_scripts_dir: "/etc/borg"
|
||||
|
||||
borgbackup_client_lastlog_dir: "/var/log/borg"
|
||||
|
||||
# backup server IP or FQDN used during ansible installation AND backup operation.
|
||||
borgbackup_client_backup_server:
|
||||
|
||||
# if defined, IP or FQDN used on backup operation. Usefull in case of LAN-free backup
|
||||
#borgbackup_client_backup_server_lanfreebackup:
|
||||
|
||||
# you have to set at least a "create" job.
|
||||
# "prune" and "checks" jobs are optionnal, but you should use it too.
|
||||
borgbackup_create_jobs:
|
||||
|
||||
# borgbackup jobs examples :
|
||||
#borgbackup_create_jobs:
|
||||
# - name: system
|
||||
# options: "--lock-wait 7200 --compression lzma"
|
||||
# day: "*"
|
||||
# hour: 0 # default value = 1
|
||||
# minute: 0 # default value = 0
|
||||
# random_hour: 5 # default value : ignore randomization
|
||||
# random_minute: 59 # default value : ignore randomization
|
||||
# directories:
|
||||
# - "/etc/"
|
||||
# - "/home"
|
||||
# excludes: []
|
||||
|
||||
borgbackup_prune_enabled: yes
|
||||
#borgbackup_prune_jobs:
|
||||
# - name: system
|
||||
# prune_options: "--lock-wait 7200 --keep-daily=7 --keep-weekly=4 --keep-monthly=12 --keep-yearly=-1"
|
||||
# day: "*"
|
||||
# hour: 12 # default value = 1
|
||||
# minute: 0 # default value = 0
|
||||
# random_hour: 5 # default value : ignore randomization
|
||||
# random_minute: 59 # default value : ignore randomization
|
||||
|
||||
borgbackup_check_enabled: yes
|
||||
#borgbackup_check_jobs:
|
||||
# - name: system
|
||||
# check_options: "--lock-wait 28800"
|
||||
# day: 1
|
||||
# hour: 12 # default value = 1
|
||||
# minute: 0 # default value = 0
|
||||
# random_hour: 5 # default value : ignore randomization
|
||||
# random_minute: 59 # default value : ignore randomization
|
||||
# random_day: 27 # default value : ignore randomization
|
||||
|
||||
# about random :
|
||||
# TL;DR : if 'random_hour' is set, then 'hour' will be set by a random value within range 'hour' up to 'hour+random_hour'
|
||||
# purpose is to set indempotent random crontab values. Usefull when many jobs are croned toward a small number of repository servers.
|
||||
# random_hour : if defined, a indempotent random value is computed between 0 and the value specified.
|
||||
# Then, the crontab hour will be addition of hour and random_hour.
|
||||
# a modulo 24 is applied in order to ensure valid hour are specified.
|
||||
# random_minute and random_day works the same way.
|
||||
20
roles/borg_client/meta/main.yml
Normal file
20
roles/borg_client/meta/main.yml
Normal file
@@ -0,0 +1,20 @@
|
||||
galaxy_info:
|
||||
author: Farhad Shahbazi
|
||||
description: Borgbackup
|
||||
company: Spherical Elephant GmbH
|
||||
license: Apache
|
||||
min_ansible_version: 2.1
|
||||
platforms:
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- all
|
||||
- name: Debian
|
||||
versions:
|
||||
- jessie
|
||||
- sid
|
||||
- stretch
|
||||
- name: Archlinux
|
||||
galaxy_tags:
|
||||
- backup
|
||||
|
||||
dependencies: []
|
||||
191
roles/borg_client/tasks/borgbackup_client.yml
Normal file
191
roles/borg_client/tasks/borgbackup_client.yml
Normal file
@@ -0,0 +1,191 @@
|
||||
---
|
||||
- name: check available SSH key types
|
||||
shell: ssh -Q key 2>/dev/null || echo "ssh-rsa"
|
||||
register: borgbackup_register_key_types
|
||||
changed_when: False
|
||||
check_mode: no
|
||||
|
||||
- name: generate backup ssh-key
|
||||
user:
|
||||
name: root
|
||||
ssh_key_file: "{{ borgbackup_client_ssh_key_file }}"
|
||||
ssh_key_type: "{{ borgbackup_client_ssh_key_type }}"
|
||||
ssh_key_comment: "{{ borgbackup_client_ssh_key_comment }}"
|
||||
ssh_key_bits: 4096
|
||||
generate_ssh_key: yes
|
||||
|
||||
- name: fetch backup ssh-pubkey
|
||||
command: "cat {{ borgbackup_client_ssh_key_file }}.pub"
|
||||
check_mode: no
|
||||
register: borgbackup_client_ssh_pubkey_file
|
||||
changed_when: False
|
||||
|
||||
- name: add ssh-pubkey to backup server
|
||||
delegate_to: "{{ borgbackup_client_backup_server }}"
|
||||
# Start the delegate from the ansible master to avoid distributing more keys
|
||||
connection: local
|
||||
authorized_key:
|
||||
user: "{{ borgbackup_server_user }}"
|
||||
key: "{{ borgbackup_client_ssh_pubkey_file.stdout }}"
|
||||
key_options: 'command="cd {{ borgbackup_server_pool }}/{{ inventory_hostname }};borg serve --restrict-to-path {{ borgbackup_server_pool }}/{{ inventory_hostname }}",restrict'
|
||||
|
||||
- name: create repo path for host
|
||||
delegate_to: "{{ borgbackup_client_backup_server }}"
|
||||
# Start the delegate from the ansible master to avoid distributing more keys
|
||||
connection: local
|
||||
file:
|
||||
path: "{{ borgbackup_server_pool }}/{{ inventory_hostname }}"
|
||||
owner: "{{ borgbackup_server_user }}"
|
||||
group: "{{ borgbackup_server_group }}"
|
||||
mode: 0700
|
||||
state: directory
|
||||
|
||||
- name: backup scripts dir
|
||||
file:
|
||||
path: "{{ borgbackup_client_scripts_dir }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0750
|
||||
state: directory
|
||||
|
||||
- name: backup supervision lastlog dir
|
||||
file:
|
||||
path: "{{ borgbackup_client_lastlog_dir }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
state: directory
|
||||
|
||||
- name: check if the repositories already exist
|
||||
command: "{{ borgbackup_binary }} list {{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}"
|
||||
environment:
|
||||
- BORG_RSH: "ssh -o StrictHostKeyChecking=no -i {{ borgbackup_client_ssh_key_file }}"
|
||||
- BORG_PASSPHRASE: "{{ borgbackup_passphrase }}"
|
||||
with_items: "{{ borgbackup_create_jobs }}"
|
||||
register: list_repos
|
||||
failed_when: False
|
||||
changed_when: False
|
||||
check_mode: no
|
||||
|
||||
- name: initialize empty list of initialized repositories
|
||||
set_fact:
|
||||
initialized_repos: []
|
||||
|
||||
- name: store only initialized repositories in the list
|
||||
set_fact:
|
||||
initialized_repos: "{{ initialized_repos }} + [ '{{ item.item.name }}' ]"
|
||||
with_items: "{{ list_repos.results }}"
|
||||
when: item.rc == 0
|
||||
|
||||
- name: initialize repositories
|
||||
command: "{{ borgbackup_binary }} init --encryption {{ borgbackup_encryption_mode }} {{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}"
|
||||
environment:
|
||||
- BORG_RSH: "ssh -o StrictHostKeyChecking=no -i {{ borgbackup_client_ssh_key_file }}"
|
||||
- BORG_PASSPHRASE: "{{ borgbackup_passphrase }}"
|
||||
with_items: "{{ borgbackup_create_jobs }}"
|
||||
register: borgbackup_initialize_result
|
||||
failed_when: (borgbackup_initialize_result.rc != 0) and (borgbackup_initialize_result.stderr != "") and ('already exists' not in borgbackup_initialize_result.stderr)
|
||||
when: item.name not in initialized_repos
|
||||
|
||||
- name: generate filename for create / prune / check scripts
|
||||
set_fact:
|
||||
create_suffix_script_filename: "create_{{ borgbackup_client_backup_server.split('.')[0] }}"
|
||||
prune_suffix_script_filename: "prune_{{ borgbackup_client_backup_server.split('.')[0] }}"
|
||||
check_suffix_script_filename: "check_{{ borgbackup_client_backup_server.split('.')[0] }}"
|
||||
|
||||
#
|
||||
# borg create scripts
|
||||
#
|
||||
- name: deploy borg create scripts
|
||||
template:
|
||||
dest: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.sh"
|
||||
src: create_job.sh.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0700
|
||||
with_items: "{{ borgbackup_create_jobs }}"
|
||||
|
||||
- name: schedule borg create scripts on cron
|
||||
cron:
|
||||
name: "borg backup {{ item.name }}"
|
||||
user: root
|
||||
job: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.sh 2>&1 | /usr/bin/logger -t borgbackup"
|
||||
day: "{{ (item.day | default(1)) + (item.random_day | random(seed=item.name + check_suffix_script_filename + ansible_host))%28 if item.random_day is defined else item.day | default('*') }}"
|
||||
hour: "{{ (item.hour | default(1)) + (item.random_hour | random(seed=item.name + create_suffix_script_filename + ansible_host))%24 if item.random_hour is defined else item.hour | default(1) }}"
|
||||
minute: "{{ (item.minute | default(0)) + (item.random_minute | random(seed=ansible_host + item.name + create_suffix_script_filename))%60 if item.random_minute is defined else item.minute | default(0) }}"
|
||||
state: present
|
||||
cron_file: "borgbackup_{{ item.name }}_{{ create_suffix_script_filename }}"
|
||||
with_items: "{{ borgbackup_create_jobs }}"
|
||||
|
||||
- name: deploy borg create fake logs, when no log yet
|
||||
shell: echo -ne "FAKE LOG\nterminating with success status, rc 0\n" | tee "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.lastlog"
|
||||
args:
|
||||
chdir: "{{ borgbackup_client_lastlog_dir }}"
|
||||
creates: "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.lastlog"
|
||||
with_items: "{{ borgbackup_create_jobs }}"
|
||||
|
||||
#
|
||||
# borg prune scripts
|
||||
#
|
||||
- name: deploy borg prune scripts
|
||||
template:
|
||||
dest: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.sh"
|
||||
src: prune_job.sh.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0700
|
||||
with_items: "{{ borgbackup_prune_jobs }}"
|
||||
when: borgbackup_prune_enabled
|
||||
|
||||
- name: schedule borg prune scripts on cron
|
||||
cron:
|
||||
name: "borg prune {{ item.name }}"
|
||||
user: root
|
||||
job: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.sh 2>&1 | /usr/bin/logger -t borgbackup"
|
||||
day: "{{ (item.day | default(1)) + (item.random_day | random(seed=item.name + check_suffix_script_filename + ansible_host))%28 if item.random_day is defined else item.day | default('*') }}"
|
||||
hour: "{{ (item.hour | default(1)) + (item.random_hour | random(seed=item.name + prune_suffix_script_filename + ansible_host))%24 if item.random_hour is defined else item.hour | default(2) }}"
|
||||
minute: "{{ (item.minute | default(0)) + (item.random_minute | random(seed=ansible_host + item.name + prune_suffix_script_filename))%60 if item.random_minute is defined else item.minute | default(0) }}"
|
||||
state: present
|
||||
cron_file: "borgbackup_{{ item.name }}_{{ prune_suffix_script_filename }}"
|
||||
with_items: "{{ borgbackup_prune_jobs }}"
|
||||
when: borgbackup_prune_enabled
|
||||
|
||||
- name: deploy borg prune fake logs, when no log yet
|
||||
shell: echo -ne "FAKE LOG\nterminating with success status, rc 0\n" | tee "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.lastlog"
|
||||
args:
|
||||
chdir: "{{ borgbackup_client_lastlog_dir }}"
|
||||
creates: "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.lastlog"
|
||||
with_items: "{{ borgbackup_prune_jobs }}"
|
||||
|
||||
#
|
||||
# borg check scripts
|
||||
#
|
||||
- name: deploy borg check scripts
|
||||
template:
|
||||
dest: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.sh"
|
||||
src: check_job.sh.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0700
|
||||
with_items: "{{ borgbackup_check_jobs }}"
|
||||
when: borgbackup_check_enabled
|
||||
|
||||
- name: schedule borg check scripts on cron
|
||||
cron:
|
||||
name: "borg check {{ item.name }}"
|
||||
user: root
|
||||
job: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.sh 2>&1 | /usr/bin/logger -t borgbackup"
|
||||
day: "{{ (item.day | default(1)) + (item.random_day | random(seed=item.name + check_suffix_script_filename + ansible_host))%28 if item.random_day is defined else item.day | default(1) }}"
|
||||
hour: "{{ (item.hour | default(1)) + (item.random_hour | random(seed=item.name + check_suffix_script_filename + ansible_host))%24 if item.random_hour is defined else item.hour | default(3) }}"
|
||||
minute: "{{ (item.minute | default(0)) + (item.random_minute | random(seed=ansible_host + item.name + check_suffix_script_filename))%60 if item.random_minute is defined else item.minute | default(0) }}"
|
||||
state: present
|
||||
cron_file: "borgbackup_{{ item.name }}_{{ check_suffix_script_filename }}"
|
||||
with_items: "{{ borgbackup_check_jobs }}"
|
||||
when: borgbackup_check_enabled
|
||||
|
||||
- name: deploy borg check fake logs, when no log yet
|
||||
shell: echo -ne "FAKE LOG\nterminating with success status, rc 0\n" | tee "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.lastlog"
|
||||
args:
|
||||
chdir: "{{ borgbackup_client_lastlog_dir }}"
|
||||
creates: "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.lastlog"
|
||||
with_items: "{{ borgbackup_check_jobs }}"
|
||||
21
roles/borg_client/tasks/borgbackup_install.yml
Normal file
21
roles/borg_client/tasks/borgbackup_install.yml
Normal file
@@ -0,0 +1,21 @@
|
||||
---
|
||||
- name: borgbackup - download borg binary
|
||||
get_url:
|
||||
url: "{{ borgbackup_binary_uri }}"
|
||||
dest: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
|
||||
mode: "755"
|
||||
when: not borgbackup_install_from_repo
|
||||
|
||||
- name: borgbackup - link install
|
||||
file:
|
||||
src: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
|
||||
dest: "{{ borgbackup_binary }}"
|
||||
state: link
|
||||
force: yes
|
||||
when: not borgbackup_install_from_repo
|
||||
|
||||
- name: borgbackup - install borgbackup
|
||||
package:
|
||||
name: borg
|
||||
state: latest
|
||||
when: borgbackup_install_from_repo
|
||||
6
roles/borg_client/tasks/main.yml
Normal file
6
roles/borg_client/tasks/main.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
---
|
||||
- import_tasks: borgbackup_install.yml
|
||||
tags: [ borg ]
|
||||
|
||||
- import_tasks: borgbackup_client.yml
|
||||
tags: [ borg ]
|
||||
14
roles/borg_client/templates/check_job.sh.j2
Normal file
14
roles/borg_client/templates/check_job.sh.j2
Normal file
@@ -0,0 +1,14 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
export BORG_RSH="ssh -i {{ borgbackup_client_ssh_key_file }}"
|
||||
export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"
|
||||
|
||||
REPOSITORY={{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}
|
||||
|
||||
{{ borgbackup_binary }} check --show-rc --verbose \
|
||||
{{ item.check_options }} \
|
||||
$REPOSITORY \
|
||||
2>&1 | tee {{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.lastlog \
|
||||
| /usr/bin/logger -t borgbackup_check_{{ item.name }}_{{ borgbackup_client_backup_server }}
|
||||
18
roles/borg_client/templates/create_job.sh.j2
Normal file
18
roles/borg_client/templates/create_job.sh.j2
Normal file
@@ -0,0 +1,18 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
export BORG_RSH="ssh -i {{ borgbackup_client_ssh_key_file }}"
|
||||
export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"
|
||||
|
||||
REPOSITORY={{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}
|
||||
|
||||
{{ borgbackup_binary }} create --show-rc --verbose --stats \
|
||||
{{ item.options | default('--compression zlib,6') }} \
|
||||
$REPOSITORY::{{ ansible_hostname }}-$(date +%Y-%m-%d_%H-%M) \
|
||||
{{ item.directories | join(' ') }} \
|
||||
{% for e in item.excludes %}
|
||||
--exclude '{{ e }}' \
|
||||
{% endfor %}
|
||||
2>&1 | tee {{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.lastlog \
|
||||
| /usr/bin/logger -t borgbackup_backup_{{ item.name }}_{{ borgbackup_client_backup_server }}
|
||||
14
roles/borg_client/templates/prune_job.sh.j2
Normal file
14
roles/borg_client/templates/prune_job.sh.j2
Normal file
@@ -0,0 +1,14 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
export BORG_RSH="ssh -i {{ borgbackup_client_ssh_key_file }}"
|
||||
export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"
|
||||
|
||||
REPOSITORY={{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}
|
||||
|
||||
{{ borgbackup_binary }} prune --show-rc --verbose --stats \
|
||||
{{ item.prune_options }} \
|
||||
$REPOSITORY \
|
||||
2>&1 | tee {{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.lastlog \
|
||||
| /usr/bin/logger -t borgbackup_prune_{{ item.name }}_{{ borgbackup_client_backup_server }}
|
||||
29
roles/borg_server/.travis.yml
Normal file
29
roles/borg_server/.travis.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
---
|
||||
language: python
|
||||
python: "2.7"
|
||||
|
||||
# Use the new container infrastructure
|
||||
sudo: false
|
||||
|
||||
# Install ansible
|
||||
addons:
|
||||
apt:
|
||||
packages:
|
||||
- python-pip
|
||||
|
||||
install:
|
||||
# Install ansible
|
||||
- pip install ansible
|
||||
|
||||
# Check ansible version
|
||||
- ansible --version
|
||||
|
||||
# Create ansible.cfg with correct roles_path
|
||||
- printf '[defaults]\nroles_path=../' >ansible.cfg
|
||||
|
||||
script:
|
||||
# Basic role syntax check
|
||||
- ansible-playbook tests/test.yml -i tests/inventory --syntax-check
|
||||
|
||||
notifications:
|
||||
webhooks: https://galaxy.ansible.com/api/v1/notifications/
|
||||
201
roles/borg_server/LICENSE
Normal file
201
roles/borg_server/LICENSE
Normal file
@@ -0,0 +1,201 @@
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright {yyyy} {name of copyright owner}
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
59
roles/borg_server/README.md
Normal file
59
roles/borg_server/README.md
Normal file
@@ -0,0 +1,59 @@
|
||||
Borgbackup
|
||||
==========
|
||||
|
||||
Ansible [Borgbackup](https://borgbackup.readthedocs.io/en/stable/) role.
|
||||
|
||||
Features:
|
||||
* Repository or binary installation
|
||||
* Schedules regular backup jobs
|
||||
* Schedules regular prune jobs to keep backup windows clean
|
||||
* Flexible configuration to list backup targets
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
see `defaults/main.yml`
|
||||
|
||||
Example Playbook
|
||||
----------------
|
||||
|
||||
- hosts: all
|
||||
roles:
|
||||
- role: SphericalElephant.borgbackup
|
||||
borgbackup_client: True
|
||||
borgbackup_client_backup_server: backup01.example.com
|
||||
borgbackup_create_jobs:
|
||||
- name: system
|
||||
day: "*"
|
||||
hour: "0"
|
||||
minute: "{{ 59 | random }}"
|
||||
directories:
|
||||
- /etc
|
||||
- /home
|
||||
- /var
|
||||
excludes:
|
||||
- 're:^/var/lib/apt'
|
||||
- 're:^/var/[^/]+\/cache/'
|
||||
borgbackup_prune_jobs:
|
||||
- name: system
|
||||
prune_options: "--keep-daily=7 --keep-weekly=4"
|
||||
day: "*"
|
||||
hour: "8"
|
||||
minute: "0"
|
||||
borgbackup_check_jobs:
|
||||
- name: system
|
||||
check_options: "--lock-wait 28800"
|
||||
day: "1"
|
||||
hour: "12"
|
||||
minute: "0"
|
||||
|
||||
|
||||
You can easily assign client and server attributes from your inventory with something similar to the following:
|
||||
|
||||
borgbackup_client: "{{ (inventory_hostname in groups.borgbackup_server)|ternary(False, True) }}"
|
||||
borgbackup_client_backup_server: "{{ groups.borgbackup_server[0] }}"
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
Apache 2.0
|
||||
14
roles/borg_server/defaults/main.yml
Normal file
14
roles/borg_server/defaults/main.yml
Normal file
@@ -0,0 +1,14 @@
|
||||
---
|
||||
borgbackup_install_from_repo: False
|
||||
borgbackup_binary_version: "1.1.6"
|
||||
borgbackup_binary_platform: "borg-linux64"
|
||||
borgbackup_binary_uri: "https://github.com/borgbackup/borg/releases/download/{{ borgbackup_binary_version }}/{{ borgbackup_binary_platform }}"
|
||||
borgbackup_binary: "/usr/local/bin/borg"
|
||||
|
||||
borgbackup_server_user: "backup"
|
||||
borgbackup_server_group: "backup"
|
||||
borgbackup_server_home: "/home/backup"
|
||||
borgbackup_server_pool: "{{ borgbackup_server_home }}/repos"
|
||||
|
||||
borgbackup_encryption_mode: "none"
|
||||
borgbackup_passphrase: "yoursecret"
|
||||
20
roles/borg_server/meta/main.yml
Normal file
20
roles/borg_server/meta/main.yml
Normal file
@@ -0,0 +1,20 @@
|
||||
galaxy_info:
|
||||
author: Farhad Shahbazi
|
||||
description: Borgbackup
|
||||
company: Spherical Elephant GmbH
|
||||
license: Apache
|
||||
min_ansible_version: 2.1
|
||||
platforms:
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- all
|
||||
- name: Debian
|
||||
versions:
|
||||
- jessie
|
||||
- sid
|
||||
- stretch
|
||||
- name: Archlinux
|
||||
galaxy_tags:
|
||||
- backup
|
||||
|
||||
dependencies: []
|
||||
21
roles/borg_server/tasks/borgbackup_install.yml
Normal file
21
roles/borg_server/tasks/borgbackup_install.yml
Normal file
@@ -0,0 +1,21 @@
|
||||
---
|
||||
- name: borgbackup - download borg binary
|
||||
get_url:
|
||||
url: "{{ borgbackup_binary_uri }}"
|
||||
dest: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
|
||||
mode: "755"
|
||||
when: not borgbackup_install_from_repo
|
||||
|
||||
- name: borgbackup - link install
|
||||
file:
|
||||
src: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
|
||||
dest: "{{ borgbackup_binary }}"
|
||||
state: link
|
||||
force: yes
|
||||
when: not borgbackup_install_from_repo
|
||||
|
||||
- name: borgbackup - install borgbackup
|
||||
package:
|
||||
name: borg
|
||||
state: latest
|
||||
when: borgbackup_install_from_repo
|
||||
40
roles/borg_server/tasks/borgbackup_server.yml
Normal file
40
roles/borg_server/tasks/borgbackup_server.yml
Normal file
@@ -0,0 +1,40 @@
|
||||
---
|
||||
- name: borg_server - create group
|
||||
group:
|
||||
name: "{{ borgbackup_server_group }}"
|
||||
state: present
|
||||
|
||||
- name: borg_server - create user
|
||||
user:
|
||||
name: "{{ borgbackup_server_user }}"
|
||||
group: "{{ borgbackup_server_group }}"
|
||||
groups:
|
||||
home: "{{ borgbackup_server_home }}"
|
||||
createhome: yes
|
||||
shell: /bin/bash
|
||||
state: present
|
||||
|
||||
- name: borg_server - manage permissions
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
owner: "{{ borgbackup_server_user }}"
|
||||
group: "{{ borgbackup_server_group }}"
|
||||
mode: 0700
|
||||
state: directory
|
||||
with_items:
|
||||
- "{{ borgbackup_server_home }}"
|
||||
- "{{ borgbackup_server_home }}/.ssh"
|
||||
- "{{ borgbackup_server_pool }}"
|
||||
|
||||
- name : borg_server - create authorized_keys
|
||||
stat:
|
||||
path: "{{ borgbackup_server_home }}/.ssh/authorized_keys"
|
||||
register: authorized_keys
|
||||
|
||||
- name: borg_server - manage permissions for authorized_keys
|
||||
file:
|
||||
path: "{{ borgbackup_server_home }}/.ssh/authorized_keys"
|
||||
owner: "{{ borgbackup_server_user }}"
|
||||
group: "{{ borgbackup_server_group }}"
|
||||
mode: 0600
|
||||
state: '{{ "file" if authorized_keys.stat.exists else "touch" }}'
|
||||
6
roles/borg_server/tasks/main.yml
Normal file
6
roles/borg_server/tasks/main.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
---
|
||||
- import_tasks: borgbackup_install.yml
|
||||
tags: [ borg ]
|
||||
|
||||
- import_tasks: borgbackup_server.yml
|
||||
tags: [ borg ]
|
||||
Submodule roles/common updated: e347803f62...32cb76a1d5
@@ -1,3 +1,5 @@
|
||||
# {{ ansible_managed }}
|
||||
|
||||
; App name that shows on every page title
|
||||
APP_NAME = FET-Gitea
|
||||
; Change it if you run locally
|
||||
|
||||
6
roles/maria-storage/handlers/main.yml
Normal file
6
roles/maria-storage/handlers/main.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
---
|
||||
- name: reload nfs
|
||||
service: name=nfs-kernel-server enabled=yes state=reloaded
|
||||
|
||||
- name: restart mariadb
|
||||
service: name=mysql enabled=yes state=restarted
|
||||
6
roles/maria-storage/tasks/main.yml
Normal file
6
roles/maria-storage/tasks/main.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
---
|
||||
- import_tasks: nfs.yml
|
||||
tags: [ maria-storage, nfs ]
|
||||
|
||||
- import_tasks: mariadb.yml
|
||||
tags: [ maria-storage, mariadb ]
|
||||
7
roles/maria-storage/tasks/mariadb.yml
Normal file
7
roles/maria-storage/tasks/mariadb.yml
Normal file
@@ -0,0 +1,7 @@
|
||||
---
|
||||
- name: mariadb - install mariadb-server
|
||||
package: name=mariadb-server
|
||||
|
||||
- name: mariadb - config /etc/mysql/my.cnf
|
||||
template: dest=/etc/mysql/my.cnf src=my.cnf.j2 owner=root group=root mode=0644
|
||||
notify: restart mariadb
|
||||
7
roles/maria-storage/tasks/nfs.yml
Normal file
7
roles/maria-storage/tasks/nfs.yml
Normal file
@@ -0,0 +1,7 @@
|
||||
---
|
||||
- name: mariadb - install nfs-kernel-server
|
||||
package: name=nfs-kernel-server
|
||||
|
||||
- name: mariadb - nfs /etc/exports
|
||||
template: dest=/etc/exports src=exports.j2 owner=root group=root mode=0644
|
||||
notify: reload nfs
|
||||
5
roles/maria-storage/templates/exports.j2
Normal file
5
roles/maria-storage/templates/exports.j2
Normal file
@@ -0,0 +1,5 @@
|
||||
# {{ ansible_managed }}
|
||||
|
||||
/srv/save/fetsite_production_1 192.168.95.0/24(rw,sync,acl,insecure,no_subtree_check)
|
||||
/srv/save/web_doc 192.168.95.0/24(rw,sync,acl,insecure,no_subtree_check)
|
||||
/srv/save/git_repo 192.168.95.0/24(rw,sync,acl,insecure,no_subtree_check)
|
||||
129
roles/maria-storage/templates/my.cnf.j2
Normal file
129
roles/maria-storage/templates/my.cnf.j2
Normal file
@@ -0,0 +1,129 @@
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
# The MySQL database server configuration file.
|
||||
#
|
||||
# You can copy this to one of:
|
||||
# - "/etc/mysql/my.cnf" to set global options,
|
||||
# - "~/.my.cnf" to set user-specific options.
|
||||
#
|
||||
# One can use all long options that the program supports.
|
||||
# Run program with --help to get a list of available options and with
|
||||
# --print-defaults to see which it would actually understand and use.
|
||||
#
|
||||
# For explanations see
|
||||
# http://dev.mysql.com/doc/mysql/en/server-system-variables.html
|
||||
|
||||
# This will be passed to all mysql clients
|
||||
# It has been reported that passwords should be enclosed with ticks/quotes
|
||||
# escpecially if they contain "#" chars...
|
||||
# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
|
||||
[client]
|
||||
port = 3306
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
|
||||
# Here is entries for some specific programs
|
||||
# The following values assume you have at least 32M ram
|
||||
|
||||
# This was formally known as [safe_mysqld]. Both versions are currently parsed.
|
||||
[mysqld_safe]
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
nice = 0
|
||||
|
||||
[mysqld]
|
||||
#
|
||||
# * Basic Settings
|
||||
#
|
||||
user = mysql
|
||||
pid-file = /var/run/mysqld/mysqld.pid
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
port = 3306
|
||||
basedir = /usr
|
||||
datadir = /var/lib/mysql
|
||||
tmpdir = /tmp
|
||||
lc-messages-dir = /usr/share/mysql
|
||||
skip-external-locking
|
||||
#
|
||||
# Instead of skip-networking the default is now to listen only on
|
||||
# localhost which is more compatible and is not less secure.
|
||||
bind-address = 0.0.0.0
|
||||
#
|
||||
# * Fine Tuning
|
||||
#
|
||||
key_buffer = 16M
|
||||
max_allowed_packet = 16M
|
||||
thread_stack = 192K
|
||||
thread_cache_size = 8
|
||||
# This replaces the startup script and checks MyISAM tables if needed
|
||||
# the first time they are touched
|
||||
myisam-recover = BACKUP
|
||||
#max_connections = 100
|
||||
#table_cache = 64
|
||||
#thread_concurrency = 10
|
||||
#
|
||||
# * Query Cache Configuration
|
||||
#
|
||||
query_cache_limit = 1M
|
||||
query_cache_size = 16M
|
||||
#
|
||||
# * Logging and Replication
|
||||
#
|
||||
# Both location gets rotated by the cronjob.
|
||||
# Be aware that this log type is a performance killer.
|
||||
# As of 5.1 you can enable the log at runtime!
|
||||
#general_log_file = /var/log/mysql/mysql.log
|
||||
#general_log = 1
|
||||
#
|
||||
# Error log - should be very few entries.
|
||||
#
|
||||
log_error = /var/log/mysql/error.log
|
||||
#
|
||||
# Here you can see queries with especially long duration
|
||||
#slow_query_log_file = /var/log/mysql/mysql-slow.log
|
||||
#slow_query_log = 1
|
||||
#long_query_time = 2
|
||||
#log_queries_not_using_indexes
|
||||
#
|
||||
# The following can be used as easy to replay backup logs or for replication.
|
||||
# note: if you are setting up a replication slave, see README.Debian about
|
||||
# other settings you may need to change.
|
||||
#server-id = 1
|
||||
#log_bin = /var/log/mysql/mysql-bin.log
|
||||
expire_logs_days = 10
|
||||
max_binlog_size = 100M
|
||||
#binlog_do_db = include_database_name
|
||||
#binlog_ignore_db = include_database_name
|
||||
#
|
||||
# * InnoDB
|
||||
#
|
||||
# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
|
||||
# Read the manual for more InnoDB related options. There are many!
|
||||
#
|
||||
# * Security Features
|
||||
#
|
||||
# Read the manual, too, if you want chroot!
|
||||
# chroot = /var/lib/mysql/
|
||||
#
|
||||
# For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
|
||||
#
|
||||
# ssl-ca=/etc/mysql/cacert.pem
|
||||
# ssl-cert=/etc/mysql/server-cert.pem
|
||||
# ssl-key=/etc/mysql/server-key.pem
|
||||
|
||||
|
||||
|
||||
[mysqldump]
|
||||
quick
|
||||
quote-names
|
||||
max_allowed_packet = 16M
|
||||
|
||||
[mysql]
|
||||
#no-auto-rehash # faster start of mysql but no tab completition
|
||||
|
||||
[isamchk]
|
||||
key_buffer = 16M
|
||||
|
||||
#
|
||||
# * IMPORTANT: Additional settings that can override those from this file!
|
||||
# The files must end with '.cnf', otherwise they'll be ignored.
|
||||
#
|
||||
!includedir /etc/mysql/conf.d/
|
||||
4
roles/scans/defaults/main.yml
Normal file
4
roles/scans/defaults/main.yml
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
samba_users:
|
||||
- name: dell
|
||||
smbpasswd: delloscanner
|
||||
3
roles/scans/handlers/main.yml
Normal file
3
roles/scans/handlers/main.yml
Normal file
@@ -0,0 +1,3 @@
|
||||
---
|
||||
- name: restart samba
|
||||
service: name=smbd enabled=yes state=restarted
|
||||
3
roles/scans/tasks/main.yml
Normal file
3
roles/scans/tasks/main.yml
Normal file
@@ -0,0 +1,3 @@
|
||||
---
|
||||
- import_tasks: samba.yml
|
||||
tags: [ samba ]
|
||||
20
roles/scans/tasks/samba.yml
Normal file
20
roles/scans/tasks/samba.yml
Normal file
@@ -0,0 +1,20 @@
|
||||
---
|
||||
- name: samba - install
|
||||
package: name={{ item }}
|
||||
with_items:
|
||||
- samba
|
||||
|
||||
- name: samba - /etc/smb.conf
|
||||
template: dest=/etc/smb.conf src=smb.conf.j2 owner=root group=root mode=0644
|
||||
notify: restart samba
|
||||
|
||||
- name: samba - create users group
|
||||
group: name=users gid=2000
|
||||
|
||||
- name: samba - add smb users
|
||||
user: "name={{ item['name'] }} shell=/bin/false group=users"
|
||||
with_items: '{{ samba_users }}'
|
||||
|
||||
- name: samba - set smbpasswds
|
||||
shell: "(echo {{ item['smbpasswd'] }}; echo {{ item['smbpasswd'] }}) | smbpasswd -s -a {{ item['name'] }}"
|
||||
with_items: '{{ samba_users }}'
|
||||
26
roles/scans/templates/smb.conf.j2
Normal file
26
roles/scans/templates/smb.conf.j2
Normal file
@@ -0,0 +1,26 @@
|
||||
# {{ ansible_managed }}
|
||||
|
||||
[global]
|
||||
|
||||
workgroup = WORKGROUP
|
||||
server string = PROGRESS
|
||||
|
||||
security = user
|
||||
hosts allow = 192.168.86.14
|
||||
|
||||
log file = /var/log/samba/%m.log
|
||||
max log size = 500
|
||||
|
||||
dns proxy = no
|
||||
load printers = no
|
||||
printing = bsd
|
||||
printcap name = /dev/null
|
||||
disable spoolss = yes
|
||||
|
||||
[scans]
|
||||
comment = scans
|
||||
path = /mnt/scans
|
||||
valid users = dell
|
||||
public = no
|
||||
browseable = yes
|
||||
writeable = yes
|
||||
34
site.yml
34
site.yml
@@ -34,22 +34,36 @@
|
||||
roles:
|
||||
- gitea
|
||||
|
||||
- hosts: backup
|
||||
- hosts: sojus
|
||||
roles:
|
||||
- backup
|
||||
- borg_server
|
||||
|
||||
- hosts: backupclient
|
||||
- hosts: maria-storage
|
||||
roles:
|
||||
- backupclient
|
||||
# - maria-storage
|
||||
- borg_client
|
||||
|
||||
- hosts: ruby
|
||||
become: True
|
||||
- hosts: baroness
|
||||
roles:
|
||||
- rvm1-ansible
|
||||
|
||||
- hosts: test_common
|
||||
become: True
|
||||
- borg_client
|
||||
|
||||
- hosts: fetlab
|
||||
roles:
|
||||
- fetlab
|
||||
|
||||
- hosts: buran
|
||||
roles:
|
||||
- borg_client
|
||||
|
||||
- hosts: nauka
|
||||
roles:
|
||||
- borg_client
|
||||
|
||||
- hosts: progress
|
||||
roles:
|
||||
- scans
|
||||
|
||||
#- hosts: ruby
|
||||
# become: True
|
||||
# roles:
|
||||
# - rvm1-ansible
|
||||
|
||||
19
templates/interfaces_ariane.j2
Normal file
19
templates/interfaces_ariane.j2
Normal file
@@ -0,0 +1,19 @@
|
||||
# {{ ansible_managed }}
|
||||
|
||||
source /etc/network/interfaces.d/*
|
||||
|
||||
auto lo
|
||||
iface lo inet loopback
|
||||
|
||||
allow-hotplug enp8s0
|
||||
iface enp8s0 inet dhcp
|
||||
|
||||
auto br0
|
||||
iface br0 inet dhcp
|
||||
bridge_ports enp9s0
|
||||
bridge_fd 0
|
||||
bridge_maxwait 0
|
||||
|
||||
dns-nameservers 192.168.86.1
|
||||
#dns-nameservers 192.168.86.1 10.0.3.1
|
||||
#dns-nameserver 10.0.3.1
|
||||
18
templates/iptables_progress_v4.j2
Normal file
18
templates/iptables_progress_v4.j2
Normal file
@@ -0,0 +1,18 @@
|
||||
# {{ ansible_managed }}
|
||||
|
||||
*filter
|
||||
:INPUT DROP [0:0]
|
||||
:FORWARD DROP [0:0]
|
||||
:OUTPUT ACCEPT [0:0]
|
||||
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
|
||||
-A INPUT -p icmp -j ACCEPT
|
||||
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
-A INPUT -i lo -j ACCEPT
|
||||
-A INPUT -p udp -m udp -s {{ printer_ip }}/32 --dport 137 -j ACCEPT
|
||||
-A INPUT -p udp -m udp -s {{ printer_ip }}/32 --dport 138 -j ACCEPT
|
||||
-A INPUT -m state --state NEW -m tcp -p tcp -s {{ printer_ip }}/32 --dport 139 -j ACCEPT
|
||||
-A INPUT -m state --state NEW -m tcp -p tcp -s {{ printer_ip }}/32 --dport 445 -j ACCEPT
|
||||
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
|
||||
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
|
||||
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
|
||||
COMMIT
|
||||
12
templates/iptables_progress_v6.j2
Normal file
12
templates/iptables_progress_v6.j2
Normal file
@@ -0,0 +1,12 @@
|
||||
# {{ ansible_managed }}
|
||||
|
||||
*filter
|
||||
:INPUT DROP [0:0]
|
||||
:FORWARD DROP [0:0]
|
||||
:OUTPUT ACCEPT [0:0]
|
||||
-A INPUT -p tcp --syn -j DROP
|
||||
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
|
||||
-A INPUT -p ipv6-icmp -j ACCEPT
|
||||
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
-A INPUT -i lo -j ACCEPT
|
||||
COMMIT
|
||||
Reference in New Issue
Block a user