e167e56857
Depends-On: https://review.opendev.org/738903 Depends-On: https://review.opendev.org/735555 Depends-On: https://review.opendev.org/735781 Depends-On: https://review.opendev.org/735926 Depends-On: https://review.opendev.org/735971 Depends-On: https://review.opendev.org/736097 Depends-On: https://review.opendev.org/736095 Depends-On: https://review.opendev.org/736850 Depends-On: https://review.opendev.org/739026 Change-Id: Ibac278398ef533bc8fcf253c67cb983461bd145d
89 lines
2.7 KiB
YAML
89 lines
2.7 KiB
YAML
---
|
|
# Copyright 2015, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
- name: Bootstrap the All-In-One (AIO)
|
|
hosts: localhost
|
|
gather_facts: True
|
|
user: root
|
|
roles:
|
|
- role: "sshd"
|
|
- role: "bootstrap-host"
|
|
vars_files:
|
|
- "{{ playbook_dir }}/../playbooks/defaults/repo_packages/openstack_services.yml"
|
|
environment: "{{ deployment_environment_variables | default({}) }}"
|
|
vars:
|
|
sftp_subsystem:
|
|
'apt': 'sftp /usr/lib/openssh/sftp-server'
|
|
'yum': 'sftp /usr/libexec/openssh/sftp-server'
|
|
'dnf': 'sftp /usr/libexec/openssh/sftp-server'
|
|
'zypper': 'sftp /usr/lib/ssh/sftp-server'
|
|
sshd:
|
|
ListenAddress:
|
|
- 0.0.0.0
|
|
- '::'
|
|
Port: 22
|
|
Protocol: 2
|
|
HostKey:
|
|
- "/etc/ssh/ssh_host_rsa_key"
|
|
- "/etc/ssh/ssh_host_ecdsa_key"
|
|
- "/etc/ssh/ssh_host_ed25519_key"
|
|
UsePrivilegeSeparation: yes
|
|
KeyRegenerationInterval: 3600
|
|
ServerKeyBits: 1024
|
|
SyslogFacility: "AUTH"
|
|
LogLevel: "INFO"
|
|
LoginGraceTime: 120
|
|
StrictModes: yes
|
|
RSAAuthentication: yes
|
|
PubkeyAuthentication: yes
|
|
IgnoreRhosts: yes
|
|
RhostsRSAAuthentication: no
|
|
HostbasedAuthentication: no
|
|
PermitEmptyPasswords: no
|
|
PermitRootLogin: yes
|
|
ChallengeResponseAuthentication: no
|
|
PasswordAuthentication: no
|
|
X11DisplayOffset: 10
|
|
PrintMotd: no
|
|
PrintLastLog: no
|
|
TCPKeepAlive: yes
|
|
AcceptEnv: "LANG LC_*"
|
|
Subsystem: "{{ sftp_subsystem[ansible_pkg_mgr] }}"
|
|
UsePAM: yes
|
|
UseDNS: no
|
|
X11Forwarding: no
|
|
Compression: yes
|
|
CompressionLevel: 6
|
|
MaxSessions: 100
|
|
MaxStartups: "100:100:100"
|
|
GSSAPIAuthentication: no
|
|
GSSAPICleanupCredentials: no
|
|
pre_tasks:
|
|
- name: Run setup module
|
|
setup:
|
|
gather_subset:
|
|
- network
|
|
- hardware
|
|
- virtual
|
|
post_tasks:
|
|
- name: Check that new network interfaces are up
|
|
assert:
|
|
that:
|
|
- ansible_eth12['active'] == true
|
|
- ansible_eth13['active'] == true
|
|
- ansible_eth14['active'] == true
|
|
when:
|
|
- (bootstrap_host_container_tech | default('unknown')) != 'nspawn'
|