Merge branch 'master' into fetlab

roles/backup/defaults/main.yml

@@ -1,2 +0,0 @@
----
-backup_borg: True

roles/backup/tasks/borg.yml

@@ -1,21 +0,0 @@
----
-- name: install borg
-  package: name="borgbackup" state=present
-
-- name: create repositories
-  file:
-    path: "{{item.path}}"
-    state: directory
-  with_items: "{{backup.repositories}}"
-
-- name: init borg repositories
-  command: "borg init {{item.path}} --encryption=none"
-  args:
-    creates: "{{item.path}}/README"
-  with_items: "{{backup.repositories}}"
-
-- name: create READMES
-  template:
-    src=borg_README.j2
-    dest="{{item.path}}/README"
-  with_items: "{{backup.repositories}}"

roles/backup/tasks/main.yml

@@ -1,4 +0,0 @@
----
-- import_tasks: borg.yml
-  when: backup_borg
-  tags: ['backup', 'borg']

roles/backup/templates/borg_README.j2

@@ -1,2 +0,0 @@
-This is a generate FET borg repository.
-Name: {{item.name}}

roles/backupclient/defaults/main.yml

@@ -1,2 +0,0 @@
----
-backup_borg: True

roles/backupclient/tasks/borg.yml

@@ -1,27 +0,0 @@
----
-- name: install borg
-  package: name="borgbackup" state=present
-
-- name: create backup user
-  user:
-    name: borg_backup
-    comment: "BackupUser für BORG Backup"
-    group: root
-    generate_ssh_key: yes
-    ssh_key_bits: 4096
-    ssh_key_file: .ssh/id_rsa
-
-- name: fetch pubickey
-  shell: "cat /home/borg_backup/.ssh/id_rsa.pub"
-  register: id_rsa_pub
-  changed_when: false
-
-- name: Add authorized key to borg backup servers
-  authorized_key:
-    user: "root"
-    key: "{{id_rsa_pub.stdout}}"
-    key_options: 'command="borg serve --restrict-to-path /srv/rep1"'
-  delegate_to: "{{item}}"
-  with_items: "{{groups['backup']}}"
-  when: id_rsa_pub.stdout is defined
-

roles/backupclient/tasks/main.yml

@@ -1,4 +0,0 @@
----
-- import_tasks: borg.yml
-  when: backup_borg
-  tags: ['backup', 'borg']

roles/borg_client/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/borg_client/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

roles/borg_client/README.md

@@ -0,0 +1,59 @@
+Borgbackup
+==========
+
+Ansible [Borgbackup](https://borgbackup.readthedocs.io/en/stable/) role.
+
+Features:
+ * Repository or binary installation
+ * Schedules regular backup jobs
+ * Schedules regular prune jobs to keep backup windows clean
+ * Flexible configuration to list backup targets
+
+Role Variables
+--------------
+
+see `defaults/main.yml`
+
+Example Playbook
+----------------
+
+    - hosts: all
+      roles:
+        - role: SphericalElephant.borgbackup
+          borgbackup_client: True
+          borgbackup_client_backup_server: backup01.example.com
+          borgbackup_create_jobs:
+            - name: system
+              day: "*"
+              hour: "0"
+              minute: "{{ 59 | random }}"
+              directories:
+                - /etc
+                - /home
+                - /var
+              excludes:
+                - 're:^/var/lib/apt'
+                - 're:^/var/[^/]+\/cache/'
+          borgbackup_prune_jobs:
+            - name: system
+              prune_options: "--keep-daily=7 --keep-weekly=4"
+              day: "*"
+              hour: "8"
+              minute: "0"
+          borgbackup_check_jobs:
+            - name: system
+              check_options: "--lock-wait 28800"
+              day: "1"
+              hour: "12"
+              minute: "0"
+
+
+You can easily assign client and server attributes from your inventory with something similar to the following:
+
+    borgbackup_client: "{{ (inventory_hostname in groups.borgbackup_server)|ternary(False, True) }}"
+    borgbackup_client_backup_server: "{{ groups.borgbackup_server[0] }}"
+
+License
+-------
+
+Apache 2.0

roles/borg_client/defaults/main.yml

@@ -0,0 +1,77 @@
+---
+borgbackup_install_from_repo: False
+borgbackup_binary_version: "1.1.6"
+borgbackup_binary_platform: "borg-linux64"
+borgbackup_binary_uri: "https://github.com/borgbackup/borg/releases/download/{{ borgbackup_binary_version }}/{{ borgbackup_binary_platform }}"
+borgbackup_binary: "/usr/local/bin/borg"
+
+borgbackup_encryption_mode: "none"
+borgbackup_passphrase: "yoursecret"
+
+borgbackup_server_user: "backup"
+borgbackup_server_group: "backup"
+borgbackup_server_home: "/home/backup"
+borgbackup_server_pool: "{{ borgbackup_server_home }}/repos"
+
+borgbackup_client_ssh_key_type: '{{ "ed25519"
+                            if ("ssh-ed25519" in borgbackup_register_key_types.stdout_lines)
+                            else "rsa" }}'
+
+borgbackup_client_ssh_key_file: "/root/.ssh/id_{{ borgbackup_client_ssh_key_type }}-backup"
+borgbackup_client_ssh_key_comment: 'root@{{ ansible_hostname }} generated by Ansible'
+borgbackup_client_scripts_dir: "/etc/borg"
+
+borgbackup_client_lastlog_dir: "/var/log/borg"
+
+# backup server IP or FQDN used during ansible installation AND backup operation.
+borgbackup_client_backup_server:
+
+# if defined, IP or FQDN used on backup operation. Usefull in case of LAN-free backup
+#borgbackup_client_backup_server_lanfreebackup:
+
+# you have to set at least a "create" job.
+# "prune" and "checks" jobs are optionnal, but you should use it too.
+borgbackup_create_jobs:
+
+# borgbackup jobs examples :
+#borgbackup_create_jobs:
+#  - name: system
+#    options: "--lock-wait 7200 --compression lzma"
+#    day: "*"
+#    hour: 0                                                     # default value = 1
+#    minute: 0                                                   # default value = 0
+#    random_hour: 5                                              # default value : ignore randomization
+#    random_minute: 59                                           # default value : ignore randomization
+#    directories:
+#      - "/etc/"
+#      - "/home"
+#    excludes: []
+
+borgbackup_prune_enabled: yes
+#borgbackup_prune_jobs:
+#  - name: system
+#    prune_options: "--lock-wait 7200 --keep-daily=7 --keep-weekly=4 --keep-monthly=12 --keep-yearly=-1"
+#    day: "*"
+#    hour: 12                                                     # default value = 1
+#    minute: 0                                                    # default value = 0
+#    random_hour: 5                                               # default value : ignore randomization
+#    random_minute: 59                                            # default value : ignore randomization
+
+borgbackup_check_enabled: yes
+#borgbackup_check_jobs:
+#  - name: system
+#    check_options: "--lock-wait 28800"
+#    day: 1
+#    hour: 12                                                     # default value = 1
+#    minute: 0                                                    # default value = 0
+#    random_hour: 5                                               # default value : ignore randomization
+#    random_minute: 59                                            # default value : ignore randomization
+#    random_day: 27                                               # default value : ignore randomization
+
+# about random :
+# TL;DR : if 'random_hour' is set, then 'hour' will be set by a random value within range 'hour' up to 'hour+random_hour'
+# purpose is to set indempotent random crontab values. Usefull when many jobs are croned toward a small number of repository servers.
+# random_hour : if defined, a indempotent random value is computed between 0 and the value specified.
+# Then, the crontab hour will be addition of hour and random_hour.
+# a modulo 24 is applied in order to ensure valid hour are specified.
+# random_minute and random_day works the same way.

roles/borg_client/meta/main.yml

@@ -0,0 +1,20 @@
+galaxy_info:
+  author: Farhad Shahbazi
+  description: Borgbackup
+  company: Spherical Elephant GmbH
+  license: Apache
+  min_ansible_version: 2.1
+  platforms:
+  - name: Ubuntu
+    versions:
+    - all
+  - name: Debian
+    versions:
+    - jessie
+    - sid
+    - stretch
+  - name: Archlinux
+  galaxy_tags:
+  - backup
+
+dependencies: []

roles/borg_client/tasks/borgbackup_client.yml

@@ -0,0 +1,191 @@
+---
+- name: check available SSH key types
+  shell: ssh -Q key 2>/dev/null || echo "ssh-rsa"
+  register: borgbackup_register_key_types
+  changed_when: False
+  check_mode: no
+
+- name: generate backup ssh-key
+  user:
+    name: root
+    ssh_key_file: "{{ borgbackup_client_ssh_key_file }}"
+    ssh_key_type: "{{ borgbackup_client_ssh_key_type }}"
+    ssh_key_comment: "{{ borgbackup_client_ssh_key_comment }}"
+    ssh_key_bits: 4096
+    generate_ssh_key: yes
+
+- name: fetch backup ssh-pubkey
+  command: "cat {{ borgbackup_client_ssh_key_file }}.pub"
+  check_mode: no
+  register: borgbackup_client_ssh_pubkey_file
+  changed_when: False
+
+- name: add ssh-pubkey to backup server
+  delegate_to: "{{ borgbackup_client_backup_server }}"
+  # Start the delegate from the ansible master to avoid distributing more keys
+  connection: local
+  authorized_key:
+    user: "{{ borgbackup_server_user }}"
+    key: "{{ borgbackup_client_ssh_pubkey_file.stdout }}"
+    key_options: 'command="cd {{ borgbackup_server_pool }}/{{ inventory_hostname }};borg serve --restrict-to-path {{ borgbackup_server_pool }}/{{ inventory_hostname }}",restrict'
+
+- name: create repo path for host
+  delegate_to: "{{ borgbackup_client_backup_server }}"
+  # Start the delegate from the ansible master to avoid distributing more keys
+  connection: local
+  file:
+    path: "{{ borgbackup_server_pool }}/{{ inventory_hostname }}"
+    owner: "{{ borgbackup_server_user }}"
+    group: "{{ borgbackup_server_group }}"
+    mode: 0700
+    state: directory
+
+- name: backup scripts dir
+  file:
+    path: "{{ borgbackup_client_scripts_dir }}"
+    owner: root
+    group: root
+    mode: 0750
+    state: directory
+
+- name: backup supervision lastlog dir
+  file:
+    path: "{{ borgbackup_client_lastlog_dir }}"
+    owner: root
+    group: root
+    mode: 0755
+    state: directory
+
+- name: check if the repositories already exist
+  command: "{{ borgbackup_binary }} list {{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}"
+  environment:
+    - BORG_RSH: "ssh -o StrictHostKeyChecking=no -i {{ borgbackup_client_ssh_key_file }}"
+    - BORG_PASSPHRASE: "{{ borgbackup_passphrase }}"
+  with_items: "{{ borgbackup_create_jobs }}"
+  register: list_repos
+  failed_when: False
+  changed_when: False
+  check_mode: no
+
+- name: initialize empty list of initialized repositories
+  set_fact:
+    initialized_repos: []
+
+- name: store only initialized repositories in the list
+  set_fact:
+    initialized_repos: "{{ initialized_repos }} + [ '{{ item.item.name }}' ]"
+  with_items: "{{ list_repos.results }}"
+  when: item.rc == 0
+
+- name: initialize repositories
+  command: "{{ borgbackup_binary }} init --encryption {{ borgbackup_encryption_mode }} {{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}"
+  environment:
+    - BORG_RSH: "ssh -o StrictHostKeyChecking=no -i {{ borgbackup_client_ssh_key_file }}"
+    - BORG_PASSPHRASE: "{{ borgbackup_passphrase }}"
+  with_items: "{{ borgbackup_create_jobs }}"
+  register: borgbackup_initialize_result
+  failed_when: (borgbackup_initialize_result.rc != 0) and (borgbackup_initialize_result.stderr != "") and ('already exists' not in borgbackup_initialize_result.stderr)
+  when: item.name not in initialized_repos
+
+- name: generate filename for create / prune / check scripts
+  set_fact:
+    create_suffix_script_filename: "create_{{ borgbackup_client_backup_server.split('.')[0] }}"
+    prune_suffix_script_filename: "prune_{{ borgbackup_client_backup_server.split('.')[0] }}"
+    check_suffix_script_filename: "check_{{ borgbackup_client_backup_server.split('.')[0] }}"
+
+#
+# borg create scripts
+#
+- name: deploy borg create scripts
+  template:
+    dest: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.sh"
+    src: create_job.sh.j2
+    owner: root
+    group: root
+    mode: 0700
+  with_items: "{{ borgbackup_create_jobs }}"
+
+- name: schedule borg create scripts on cron
+  cron:
+    name: "borg backup {{ item.name }}"
+    user: root
+    job: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.sh 2>&1 | /usr/bin/logger -t borgbackup"
+    day: "{{ (item.day | default(1)) + (item.random_day | random(seed=item.name + check_suffix_script_filename + ansible_host))%28 if item.random_day is defined else item.day | default('*') }}"
+    hour: "{{ (item.hour | default(1)) + (item.random_hour | random(seed=item.name + create_suffix_script_filename + ansible_host))%24 if item.random_hour is defined else item.hour | default(1) }}"
+    minute: "{{ (item.minute | default(0)) + (item.random_minute | random(seed=ansible_host + item.name + create_suffix_script_filename))%60 if item.random_minute is defined else item.minute | default(0) }}"
+    state: present
+    cron_file: "borgbackup_{{ item.name }}_{{ create_suffix_script_filename }}"
+  with_items: "{{ borgbackup_create_jobs }}"
+
+- name: deploy borg create fake logs, when no log yet
+  shell: echo -ne "FAKE LOG\nterminating with success status, rc 0\n" | tee "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.lastlog"
+  args:
+    chdir: "{{ borgbackup_client_lastlog_dir }}"
+    creates: "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.lastlog"
+  with_items: "{{ borgbackup_create_jobs }}"
+
+#
+# borg prune scripts
+#
+- name: deploy borg prune scripts
+  template:
+    dest: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.sh"
+    src: prune_job.sh.j2
+    owner: root
+    group: root
+    mode: 0700
+  with_items: "{{ borgbackup_prune_jobs }}"
+  when: borgbackup_prune_enabled
+
+- name: schedule borg prune scripts on cron
+  cron:
+    name: "borg prune {{ item.name }}"
+    user: root
+    job: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.sh 2>&1 | /usr/bin/logger -t borgbackup"
+    day: "{{ (item.day | default(1)) + (item.random_day | random(seed=item.name + check_suffix_script_filename + ansible_host))%28 if item.random_day is defined else item.day | default('*') }}"
+    hour: "{{ (item.hour | default(1)) + (item.random_hour | random(seed=item.name + prune_suffix_script_filename + ansible_host))%24 if item.random_hour is defined else item.hour | default(2) }}"
+    minute: "{{ (item.minute | default(0)) + (item.random_minute | random(seed=ansible_host + item.name + prune_suffix_script_filename))%60 if item.random_minute is defined else item.minute | default(0) }}"
+    state: present
+    cron_file: "borgbackup_{{ item.name }}_{{ prune_suffix_script_filename }}"
+  with_items: "{{ borgbackup_prune_jobs }}"
+  when: borgbackup_prune_enabled
+
+- name: deploy borg prune fake logs, when no log yet
+  shell: echo -ne "FAKE LOG\nterminating with success status, rc 0\n" | tee "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.lastlog"
+  args:
+    chdir: "{{ borgbackup_client_lastlog_dir }}"
+    creates: "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.lastlog"
+  with_items: "{{ borgbackup_prune_jobs }}"
+
+#
+# borg check scripts
+#
+- name: deploy borg check scripts
+  template:
+    dest: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.sh"
+    src: check_job.sh.j2
+    owner: root
+    group: root
+    mode: 0700
+  with_items: "{{ borgbackup_check_jobs }}"
+  when: borgbackup_check_enabled
+
+- name: schedule borg check scripts on cron
+  cron:
+    name: "borg check {{ item.name }}"
+    user: root
+    job: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.sh 2>&1 | /usr/bin/logger -t borgbackup"
+    day: "{{ (item.day | default(1)) + (item.random_day | random(seed=item.name + check_suffix_script_filename + ansible_host))%28 if item.random_day is defined else item.day | default(1) }}"
+    hour: "{{ (item.hour | default(1)) + (item.random_hour | random(seed=item.name + check_suffix_script_filename + ansible_host))%24 if item.random_hour is defined else item.hour | default(3) }}"
+    minute: "{{ (item.minute | default(0)) + (item.random_minute | random(seed=ansible_host + item.name + check_suffix_script_filename))%60 if item.random_minute is defined else item.minute | default(0) }}"
+    state: present
+    cron_file: "borgbackup_{{ item.name }}_{{ check_suffix_script_filename }}"
+  with_items: "{{ borgbackup_check_jobs }}"
+  when: borgbackup_check_enabled
+
+- name: deploy borg check fake logs, when no log yet
+  shell: echo -ne "FAKE LOG\nterminating with success status, rc 0\n" | tee "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.lastlog"
+  args:
+    chdir: "{{ borgbackup_client_lastlog_dir }}"
+    creates: "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.lastlog"
+  with_items: "{{ borgbackup_check_jobs }}"

roles/borg_client/tasks/borgbackup_install.yml

@@ -0,0 +1,21 @@
+---
+- name: borgbackup - download borg binary
+  get_url:
+    url: "{{ borgbackup_binary_uri }}"
+    dest: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
+    mode: "755"
+  when: not borgbackup_install_from_repo
+
+- name: borgbackup - link install
+  file:
+    src: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
+    dest: "{{ borgbackup_binary }}"
+    state: link
+    force: yes
+  when: not borgbackup_install_from_repo
+
+- name: borgbackup - install borgbackup
+  package:
+    name: borg
+    state: latest
+  when: borgbackup_install_from_repo

roles/borg_client/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- import_tasks: borgbackup_install.yml
+  tags: [ borg ]
+
+- import_tasks: borgbackup_client.yml
+  tags: [ borg ]

roles/borg_client/templates/check_job.sh.j2

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+set -e
+
+export BORG_RSH="ssh -i {{ borgbackup_client_ssh_key_file }}"
+export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"
+
+REPOSITORY={{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}
+
+{{ borgbackup_binary }} check --show-rc --verbose \
+  {{ item.check_options }} \
+  $REPOSITORY \
+  2>&1 | tee {{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.lastlog \
+  | /usr/bin/logger -t borgbackup_check_{{ item.name }}_{{ borgbackup_client_backup_server }}

roles/borg_client/templates/create_job.sh.j2

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+set -e
+
+export BORG_RSH="ssh -i {{ borgbackup_client_ssh_key_file }}"
+export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"
+
+REPOSITORY={{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}
+
+{{ borgbackup_binary }} create --show-rc --verbose --stats \
+  {{ item.options | default('--compression zlib,6') }} \
+  $REPOSITORY::{{ ansible_hostname }}-$(date +%Y-%m-%d_%H-%M) \
+  {{ item.directories | join(' ') }} \
+  {% for e in item.excludes %}
+  --exclude '{{ e }}' \
+  {% endfor %}
+  2>&1 | tee {{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.lastlog \
+  | /usr/bin/logger -t borgbackup_backup_{{ item.name }}_{{ borgbackup_client_backup_server }}

roles/borg_client/templates/prune_job.sh.j2

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+set -e
+
+export BORG_RSH="ssh -i {{ borgbackup_client_ssh_key_file }}"
+export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"
+
+REPOSITORY={{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}
+
+{{ borgbackup_binary }} prune --show-rc --verbose --stats \
+  {{ item.prune_options }} \
+  $REPOSITORY \
+  2>&1 | tee {{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.lastlog \
+  | /usr/bin/logger -t borgbackup_prune_{{ item.name }}_{{ borgbackup_client_backup_server }}

roles/borg_server/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/borg_server/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

roles/borg_server/README.md

@@ -0,0 +1,59 @@
+Borgbackup
+==========
+
+Ansible [Borgbackup](https://borgbackup.readthedocs.io/en/stable/) role.
+
+Features:
+ * Repository or binary installation
+ * Schedules regular backup jobs
+ * Schedules regular prune jobs to keep backup windows clean
+ * Flexible configuration to list backup targets
+
+Role Variables
+--------------
+
+see `defaults/main.yml`
+
+Example Playbook
+----------------
+
+    - hosts: all
+      roles:
+        - role: SphericalElephant.borgbackup
+          borgbackup_client: True
+          borgbackup_client_backup_server: backup01.example.com
+          borgbackup_create_jobs:
+            - name: system
+              day: "*"
+              hour: "0"
+              minute: "{{ 59 | random }}"
+              directories:
+                - /etc
+                - /home
+                - /var
+              excludes:
+                - 're:^/var/lib/apt'
+                - 're:^/var/[^/]+\/cache/'
+          borgbackup_prune_jobs:
+            - name: system
+              prune_options: "--keep-daily=7 --keep-weekly=4"
+              day: "*"
+              hour: "8"
+              minute: "0"
+          borgbackup_check_jobs:
+            - name: system
+              check_options: "--lock-wait 28800"
+              day: "1"
+              hour: "12"
+              minute: "0"
+
+
+You can easily assign client and server attributes from your inventory with something similar to the following:
+
+    borgbackup_client: "{{ (inventory_hostname in groups.borgbackup_server)|ternary(False, True) }}"
+    borgbackup_client_backup_server: "{{ groups.borgbackup_server[0] }}"
+
+License
+-------
+
+Apache 2.0

roles/borg_server/defaults/main.yml

@@ -0,0 +1,14 @@
+---
+borgbackup_install_from_repo: False
+borgbackup_binary_version: "1.1.6"
+borgbackup_binary_platform: "borg-linux64"
+borgbackup_binary_uri: "https://github.com/borgbackup/borg/releases/download/{{ borgbackup_binary_version }}/{{ borgbackup_binary_platform }}"
+borgbackup_binary: "/usr/local/bin/borg"
+
+borgbackup_server_user: "backup"
+borgbackup_server_group: "backup"
+borgbackup_server_home: "/home/backup"
+borgbackup_server_pool: "{{ borgbackup_server_home }}/repos"
+
+borgbackup_encryption_mode: "none"
+borgbackup_passphrase: "yoursecret"

roles/borg_server/meta/main.yml

@@ -0,0 +1,20 @@
+galaxy_info:
+  author: Farhad Shahbazi
+  description: Borgbackup
+  company: Spherical Elephant GmbH
+  license: Apache
+  min_ansible_version: 2.1
+  platforms:
+  - name: Ubuntu
+    versions:
+    - all
+  - name: Debian
+    versions:
+    - jessie
+    - sid
+    - stretch
+  - name: Archlinux
+  galaxy_tags:
+  - backup
+
+dependencies: []

roles/borg_server/tasks/borgbackup_install.yml

@@ -0,0 +1,21 @@
+---
+- name: borgbackup - download borg binary
+  get_url:
+    url: "{{ borgbackup_binary_uri }}"
+    dest: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
+    mode: "755"
+  when: not borgbackup_install_from_repo
+
+- name: borgbackup - link install
+  file:
+    src: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
+    dest: "{{ borgbackup_binary }}"
+    state: link
+    force: yes
+  when: not borgbackup_install_from_repo
+
+- name: borgbackup - install borgbackup
+  package:
+    name: borg
+    state: latest
+  when: borgbackup_install_from_repo

roles/borg_server/tasks/borgbackup_server.yml

@@ -0,0 +1,40 @@
+---
+- name: borg_server - create group
+  group:
+    name: "{{ borgbackup_server_group }}"
+    state: present
+
+- name: borg_server - create user
+  user:
+    name: "{{ borgbackup_server_user }}"
+    group: "{{ borgbackup_server_group }}"
+    groups:
+    home: "{{ borgbackup_server_home }}"
+    createhome: yes
+    shell: /bin/bash
+    state: present
+
+- name: borg_server - manage permissions
+  file:
+    path: "{{ item }}"
+    owner: "{{ borgbackup_server_user }}"
+    group: "{{ borgbackup_server_group }}"
+    mode: 0700
+    state: directory
+  with_items:
+    - "{{ borgbackup_server_home }}"
+    - "{{ borgbackup_server_home }}/.ssh"
+    - "{{ borgbackup_server_pool }}"
+
+- name : borg_server - create authorized_keys
+  stat:
+    path: "{{ borgbackup_server_home }}/.ssh/authorized_keys"
+  register: authorized_keys
+
+- name: borg_server - manage permissions for authorized_keys
+  file:
+    path: "{{ borgbackup_server_home }}/.ssh/authorized_keys"
+    owner: "{{ borgbackup_server_user }}"
+    group: "{{ borgbackup_server_group }}"
+    mode: 0600
+    state: '{{ "file" if  authorized_keys.stat.exists else "touch" }}'

roles/borg_server/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- import_tasks: borgbackup_install.yml
+  tags: [ borg ]
+
+- import_tasks: borgbackup_server.yml
+  tags: [ borg ]

roles/gitea/templates/gitea.conf.j2

@@ -1,3 +1,5 @@
+# {{ ansible_managed }}
+
 ; App name that shows on every page title
 APP_NAME = FET-Gitea
 ; Change it if you run locally

roles/maria-storage/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: reload nfs
+  service: name=nfs-kernel-server enabled=yes state=reloaded
+
+- name: restart mariadb
+  service: name=mysql enabled=yes state=restarted

roles/maria-storage/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- import_tasks: nfs.yml
+  tags: [ maria-storage, nfs ]
+
+- import_tasks: mariadb.yml
+  tags: [ maria-storage, mariadb ]

roles/maria-storage/tasks/mariadb.yml

@@ -0,0 +1,7 @@
+---
+- name: mariadb - install mariadb-server
+  package: name=mariadb-server
+
+- name: mariadb - config /etc/mysql/my.cnf
+  template: dest=/etc/mysql/my.cnf src=my.cnf.j2 owner=root group=root mode=0644
+  notify: restart mariadb

roles/maria-storage/tasks/nfs.yml

@@ -0,0 +1,7 @@
+---
+- name: mariadb - install nfs-kernel-server
+  package: name=nfs-kernel-server
+
+- name: mariadb - nfs /etc/exports
+  template: dest=/etc/exports src=exports.j2 owner=root group=root mode=0644
+  notify: reload nfs

roles/maria-storage/templates/exports.j2

@@ -0,0 +1,5 @@
+# {{ ansible_managed }}
+
+/srv/save/fetsite_production_1  192.168.95.0/24(rw,sync,acl,insecure,no_subtree_check)
+/srv/save/web_doc       192.168.95.0/24(rw,sync,acl,insecure,no_subtree_check)
+/srv/save/git_repo      192.168.95.0/24(rw,sync,acl,insecure,no_subtree_check)

roles/maria-storage/templates/my.cnf.j2

@@ -0,0 +1,129 @@
+# {{ ansible_managed }}
+#
+# The MySQL database server configuration file.
+#
+# You can copy this to one of:
+# - "/etc/mysql/my.cnf" to set global options,
+# - "~/.my.cnf" to set user-specific options.
+#
+# One can use all long options that the program supports.
+# Run program with --help to get a list of available options and with
+# --print-defaults to see which it would actually understand and use.
+#
+# For explanations see
+# http://dev.mysql.com/doc/mysql/en/server-system-variables.html
+
+# This will be passed to all mysql clients
+# It has been reported that passwords should be enclosed with ticks/quotes
+# escpecially if they contain "#" chars...
+# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
+[client]
+port		= 3306
+socket		= /var/run/mysqld/mysqld.sock
+
+# Here is entries for some specific programs
+# The following values assume you have at least 32M ram
+
+# This was formally known as [safe_mysqld]. Both versions are currently parsed.
+[mysqld_safe]
+socket		= /var/run/mysqld/mysqld.sock
+nice		= 0
+
+[mysqld]
+#
+# * Basic Settings
+#
+user		= mysql
+pid-file	= /var/run/mysqld/mysqld.pid
+socket		= /var/run/mysqld/mysqld.sock
+port		= 3306
+basedir		= /usr
+datadir		= /var/lib/mysql
+tmpdir		= /tmp
+lc-messages-dir	= /usr/share/mysql
+skip-external-locking
+#
+# Instead of skip-networking the default is now to listen only on
+# localhost which is more compatible and is not less secure.
+bind-address		= 0.0.0.0
+#
+# * Fine Tuning
+#
+key_buffer		= 16M
+max_allowed_packet	= 16M
+thread_stack		= 192K
+thread_cache_size       = 8
+# This replaces the startup script and checks MyISAM tables if needed
+# the first time they are touched
+myisam-recover         = BACKUP
+#max_connections        = 100
+#table_cache            = 64
+#thread_concurrency     = 10
+#
+# * Query Cache Configuration
+#
+query_cache_limit	= 1M
+query_cache_size        = 16M
+#
+# * Logging and Replication
+#
+# Both location gets rotated by the cronjob.
+# Be aware that this log type is a performance killer.
+# As of 5.1 you can enable the log at runtime!
+#general_log_file        = /var/log/mysql/mysql.log
+#general_log             = 1
+#
+# Error log - should be very few entries.
+#
+log_error = /var/log/mysql/error.log
+#
+# Here you can see queries with especially long duration
+#slow_query_log_file = /var/log/mysql/mysql-slow.log
+#slow_query_log      = 1
+#long_query_time = 2
+#log_queries_not_using_indexes
+#
+# The following can be used as easy to replay backup logs or for replication.
+# note: if you are setting up a replication slave, see README.Debian about
+#       other settings you may need to change.
+#server-id		= 1
+#log_bin			= /var/log/mysql/mysql-bin.log
+expire_logs_days	= 10
+max_binlog_size         = 100M
+#binlog_do_db		= include_database_name
+#binlog_ignore_db	= include_database_name
+#
+# * InnoDB
+#
+# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
+# Read the manual for more InnoDB related options. There are many!
+#
+# * Security Features
+#
+# Read the manual, too, if you want chroot!
+# chroot = /var/lib/mysql/
+#
+# For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
+#
+# ssl-ca=/etc/mysql/cacert.pem
+# ssl-cert=/etc/mysql/server-cert.pem
+# ssl-key=/etc/mysql/server-key.pem
+
+
+
+[mysqldump]
+quick
+quote-names
+max_allowed_packet	= 16M
+
+[mysql]
+#no-auto-rehash	# faster start of mysql but no tab completition
+
+[isamchk]
+key_buffer		= 16M
+
+#
+# * IMPORTANT: Additional settings that can override those from this file!
+#   The files must end with '.cnf', otherwise they'll be ignored.
+#
+!includedir /etc/mysql/conf.d/

roles/scans/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+samba_users:
+  - name: dell
+    smbpasswd: delloscanner

roles/scans/handlers/main.yml

@@ -0,0 +1,3 @@
+---
+ - name: restart samba
+   service: name=smbd enabled=yes state=restarted

roles/scans/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- import_tasks: samba.yml
+  tags: [ samba ]

roles/scans/tasks/samba.yml

@@ -0,0 +1,20 @@
+---
+- name: samba - install
+  package: name={{ item }}
+  with_items:
+  - samba
+
+- name: samba - /etc/smb.conf
+  template: dest=/etc/smb.conf src=smb.conf.j2 owner=root group=root mode=0644
+  notify: restart samba
+
+- name: samba - create users group
+  group: name=users gid=2000
+
+- name: samba - add smb users
+  user: "name={{ item['name'] }} shell=/bin/false group=users"
+  with_items: '{{ samba_users }}'
+
+- name: samba - set smbpasswds
+  shell: "(echo {{ item['smbpasswd'] }}; echo {{ item['smbpasswd'] }}) | smbpasswd -s -a {{ item['name'] }}"
+  with_items: '{{ samba_users }}'

roles/scans/templates/smb.conf.j2

@@ -0,0 +1,26 @@
+# {{ ansible_managed }}
+
+[global]
+
+   workgroup = WORKGROUP
+   server string = PROGRESS
+
+   security = user
+   hosts allow = 192.168.86.14
+
+   log file = /var/log/samba/%m.log
+   max log size = 500
+
+   dns proxy = no
+   load printers = no
+   printing = bsd
+   printcap name = /dev/null
+   disable spoolss = yes
+
+[scans]
+   comment = scans
+   path = /mnt/scans
+   valid users = dell
+   public = no
+   browseable = yes
+   writeable = yes