main.yml

# Run locally like:
#   ansible-playbook -c local -i localhost, main.yml
########################################################################################################################
# Prepare the server by adding any files and configuration that are expected by later steps ############################
########################################################################################################################
-   name: "preparing the server"
    become: "yes"
    hosts: "all"
    tags:
        - "prepare_server"
    vars_files:
        - "host_vars/common.yml"
    tasks:
        -   name: "generate an OpenSSL private key"
            openssl_privatekey:
                path: "/etc/ssl/dev.pem"
        -   name: "generate an OpenSSL Certificate Signing Request"
            openssl_csr:
                common_name: "*.local"
                country_name: "CA"
                email_address: "root@dev.local"
                extended_key_usage: "serverAuth"
                key_usage: "digitalSignature"
                organization_name: "Dev"
                path: "/etc/ssl/dev.csr"
                privatekey_path: "/etc/ssl/dev.pem"
                subject_alt_name: "{{ item.value | map('regex_replace', '^', 'DNS:') | list }}"
            with_dict:
                dns_server:
                    - "*.*.local"
        -   name: "sign the CSR file as a CA to turn it into a certificate"
            openssl_certificate:
                csr_path: "/etc/ssl/dev.csr"
                path: "/etc/ssl/dev.crt"
                privatekey_path: "/etc/ssl/dev.pem"
                provider: "selfsigned"
                selfsigned_not_after: "+730d" # this is the maximum valid length
        -   name: "enable the dynamic CA configuration feature"
            command:
                cmd: "update-ca-certificates force-enable"
        -   name: "ensure that {{ server_document_root }} exists"
            file:
                path: "{{ server_document_root }}"
                recurse: "yes"
                state: "directory"
        -   name: "create server users and add them to the wheel group"
            user:
                append: "yes"
                createhome: "yes"
                groups:
                    - "sudo"
                name: "{{ item.user }}"
                password: "{{ item.pass | password_hash('sha512') }}"
                shell: "/bin/bash"
                state: "present"
                update_password: "on_create"
            loop: "{{ server_users }}"
        -   name: "add a ~/.ssh folder for each user"
            file:
                dest: "/home/{{ item.user }}/.ssh"
                state: "directory"
                owner: "{{ item.user }}"
                group: "{{ item.user }}"
            loop: "{{ server_users }}"
        -   name: "add the Vagrant insecure key to each user's ~/.ssh/authorized_keys file"
            get_url:
                url: "https://raw.githubusercontent.com/hashicorp/vagrant/master/keys/vagrant.pub"
                dest: "/home/{{ item.user }}/.ssh/authorized_keys"
                group: "{{ item.user }}"
                owner: "{{ item.user }}"
            loop: "{{ server_users }}"
        -   name: "enable passwordless sudo"
            copy:
                dest: "/etc/sudoers.d/99_{{ item.user }}"
                content: "{{ item.user }} ALL=(ALL) NOPASSWD:ALL"
            loop: "{{ server_users }}"
        -   name: "add dotfiles to each user's user directory"
            no_log: "true"
            synchronize:
                dest: "/home/{{ item.user }}"
                src: "files/dotfiles/"
            loop: "{{ server_users }}"
            register: "accounts_dotfiles"
            notify: "fix perms"
    handlers:
        -   name: "fix perms"
            command: "chown -R {{ item }}:{{ item }} /home/{{ item }}"
            args:
                warn: "false"
            loop: "{{ accounts_dotfiles.results | selectattr('item.user', '!=', 'root') | selectattr('changed', '==', true) | map(attribute='item.user') | list }}"
########################################################################################################################

########################################################################################################################
# Install packages that don't require configuration ####################################################################
########################################################################################################################
-   name: "installing packages"
    become: "yes"
    hosts: "all"
    tags:
        - "install_packages"
    vars_files:
        - "host_vars/common.yml"
    pre_tasks:
        -   name: "set postfix option type as no configuration"
            debconf:
                name: "postfix"
                question: "postfix/main_mailer_type"
                value: "'No configuration'"
                vtype: "string"
        -   name: "install Microsoft repo"
            shell: "wget https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb -O packages-microsoft-prod.deb && dpkg -i packages-microsoft-prod.deb && rm packages-microsoft-prod.deb"
            args:
                creates: "/etc/apt/sources.list.d/microsoft-prod.list"
        -   name: "install mongo repo"
            shell: 'curl --silent --location https://www.mongodb.org/static/pgp/server-5.0.asc | apt-key add - && echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/5.0 multiverse" | tee /etc/apt/sources.list.d/mongodb-org-5.0.list && apt update -y'
            args:
                creates: "/etc/apt/sources.list.d/mongodb-org-5.0.list"
    tasks:
        # See the default Ubuntu 20 package list at http://releases.ubuntu.com/20.04.1/ubuntu-20.04.1-live-server-amd64.manifest
        -   name: "installing packages from package manager"
            apt:
                name:
                    - "acl"
                    - "aspnetcore-runtime-5.0"
                    - "aptitude"
                    - "atop"
                    - "bind9-utils"
                    - "build-essential"
                    - "byobu"
                    - "clang"
                    - "dotnet-sdk-5.0"
                    - "dotnet-runtime-5.0"
                    - "firewalld"
                    - "golang"
                    - "imagemagick"
                    - "iotop"
                    - "libmcrypt-dev"
                    - "libssl-dev"
                    - "libsqlite3-dev"
                    - "maven"
                    - "mongodb-org"
                    - "net-tools"
                    - "pip"
                    - "policycoreutils-python-utils"
                    - "postfix"
                    - "python3"
                    - "python3-venv"
                    - "pv"
                    - "vim"
                    - "rustc"
                    - "sendmail-cf"
                    - "sqlite3"
                    - "subversion"
                    - "supervisor"
                    - "tree"
                    - "vim"
                    - "unzip"
                    - "zip"
        -   name: "installing packages via installers"
            shell: "{{ item.command }}"
            args:
                creates: "{{ item.creates }}"
                executable: "/bin/bash"
                warn: "false"
            loop:
                - { "command": "curl --silent --location https://get.symfony.com/cli/installer | bash - && mv $HOME/.symfony/bin/symfony /usr/local/bin/symfony && rm -fr $HOME/.symfony", creates: "/usr/local/bin/symfony" } # symfony
                - { "command": "curl --silent --output /usr/local/bin/wp https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar && chmod +x /usr/local/bin/wp", creates: "/usr/local/bin/wp" } # WordPress
        -   name: "installing NVM and NPM packages for all users"
            vars:
                local_users: "{{ server_users }}"
                local_commands:
                    - "cd ~"
                    - "curl --silent --location https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash"
                    - "bash -ilc '. ~/.bashrc && nvm install --lts'" # force bash interactive mode so .bashrc is read and the nvm and npm commands are recognized
                    - "bash -ilc '. ~/.bashrc && yes n | npm install --global --silent --unsafe-perm=true --allow-root {{ npm_packages | join(' ') }}'"
                    - "touch ~/.nvm/.installed"
            shell: "{{ item[1] }}"
            args:
                creates: "{{ '/home/' if 'root' != item[0].user else '/' }}{{ item[0].user }}/.nvm/.installed"
                executable: "/bin/bash"
                warn: "false"
            become: "true"
            become_user: "{{ item[0].user }}"
            loop: "{{ local_users | product(local_commands) | list }}"
        -   name: "installing rbenv and ruby gems for all users"
            vars:
                local_users: "{{ server_users }}"
                local_commands:
                    - "cd ~"
                    - "curl --silent --location https://github.com/rbenv/rbenv-installer/raw/HEAD/bin/rbenv-installer | bash"
                    - 'echo -e "\nPATH=~/.rbenv/bin:\$PATH\n" >> ~/.bash_profile'
                    - 'echo -e "eval \"\$(rbenv init - bash)\"" >> ~/.bash_profile'
                    - "bash -ilc '. ~/.bash_profile && rbenv install -f $(rbenv install -l | grep '^3' | head -n 1)'"
                    - "bash -ilc '. ~/.bash_profile && rbenv global $(rbenv install -l | grep '^3' | head -n 1)'"
                    - "bash -ilc '. ~/.bash_profile && gem install {{ ruby_packages | join(' ') }}'"
                    - "touch ~/.rbenv/.installed"
            shell: "{{ item[1] }}"
            args:
                creates: "{{ '/home/' if 'root' != item[0].user else '/' }}{{ item[0].user }}/.rbenv/.installed"
                executable: "/bin/bash"
                warn: "false"
            become: "true"
            become_user: "{{ item[0].user }}"
            loop: "{{ local_users | product(local_commands) | list }}"
        -   name: "installing per-user packages via installers"
            vars:
                local_users: "{{ server_users }}"
                local_commands:
                    - { "command": "curl --silent --location https://get.sdkman.io | bash", creates: "~/.sdkman/bin/sdkman-init.sh" } # SDKMAN
                    - { "command": "bash -ilc '. ~/.bashrc && sdk install springboot'", creates: "~/.sdkman/candidates/springboot/current/bin/spring" } # spring
                    - { "command": "bash -ilc '. ~/.bashrc && sdk install gradle'", creates: "~/.sdkman/candidates/gradle/current/bin/gradle" } # gradle
            shell: "{{ item[1].command }}"
            args:
                creates: "{{ item[1].creates }}"
                executable: "/bin/bash"
                warn: "false"
            become: "true"
            become_user: "{{ item[0].user }}"
            loop: "{{ local_users | product(local_commands) | list }}"
########################################################################################################################

########################################################################################################################
# Install roles (packages that do require configuration) ###############################################################
########################################################################################################################
-   name: "installing roles"
    become: "yes"
    hosts: "all"
    tags:
        - "install_roles"
    vars_files:
        - "host_vars/common.yml"
    pre_tasks:
        -   name: "get vagrant user's uid"
            getent:
                database: "passwd"
                key: "vagrant"
        -   name: "get vagrant group's uid"
            getent:
                database: "group"
                key: "vagrant"
        -   name: "add postgresql ubuntu repo key"
            apt_key:
                url: "https://www.postgresql.org/media/keys/ACCC4CF8.asc"
                state: "present"
        -   name: "install the postgresql ubuntu repo"
            apt_repository:
                repo: "deb https://apt.postgresql.org/pub/repos/apt focal-pgdg main"
                state: "present"
        -   include_role:
                name: "geerlingguy.postgresql"
            vars:
                __postgresql_version: "13"
                __postgresql_packages:
                    - "postgresql-13"
                    - "postgresql-contrib"
    roles:
        - "geerlingguy.apache"
        - "geerlingguy.php-versions"
        - "geerlingguy.php"
        - "geerlingguy.apache-php-fpm"
        - "geerlingguy.nginx"
        - "geerlingguy.docker"
        - "geerlingguy.varnish"
        - "geerlingguy.mysql"
        - "geerlingguy.php-mysql"
        - "geerlingguy.php-pgsql"
        - "geerlingguy.memcached"
        - "geerlingguy.php-memcached"
        - "geerlingguy.java"
        - "geerlingguy.composer"
        - "geerlingguy.nfs"
    tasks:
        -   name: "find java 11 full path"
            shell: "update-alternatives --list java | grep java-11-openjdk-amd64"
            register: "java_11_openjdk_binary"
            run_once: "true"
        -   set_fact:
                java_11_openjdk_binary: "{{ java_11_openjdk_binary.stdout }}"
        -   name: "Set Java 11 as default"
            alternatives:
                name: "java"
                path: "{{ java_11_openjdk_binary }}"
        -   name: "Set Javac 11 as default"
            alternatives:
                name: "javac"
                path: "{{ java_11_openjdk_binary }}c"
        -   name: "installing PostGIS (requires PostgreSQL to be installed first)"
            apt:
                name:
                    - "postgresql-13-postgis-3"
        -   name: "update default apache vhost"
            replace:
                path: "/etc/apache2/apache2.conf"
                regexp: '(.*)(\/var\/www\/html)(.*)'
                replace: '\1{{ server_document_root }}\3'
            notify: "restart apache"
        -   name: "install varnish devel"
            apt:
                name: "varnish-dev"
                state: "present"
            notify: "restart varnish"
        -   name: "install packages to compile Varnish VMODs"
            apt:
                name: [
                        'autoconf',
                        'automake',
                        'libjemalloc-dev',
                        'libtool',
                        'pkg-config',
                        'python3-docutils',
                        'python3-sphinx'
                ]
                state: "present"
        -   name: "check if we need to build the VMODs"
            command: "ls /usr/lib64/varnish/vmods/libvmod_xkey.so"
            ignore_errors: "yes"
            register: "result"
        -   name: "registering variable from last command"
            set_fact:
                varnish_build_vmods: "{{ result.failed }}"
            when: result is defined
        -   name: "get the VMODs repo"
            git:
                dest: "/tmp/vmods"
                repo: "https://github.com/varnish/varnish-modules.git"
                version: "6.6"
            when: "varnish_build_vmods"
        -   name: "bootstrap the source"
            args:
                chdir: "/tmp/vmods"
            command: "./bootstrap"
            when: "varnish_build_vmods"
        -   name: "configure the source"
            args:
                chdir: "/tmp/vmods"
            command: "./configure"
            when: "varnish_build_vmods"
        -   name: "switch to build directory"
            make:
                chdir: "/tmp/vmods"
            when: "varnish_build_vmods"
        -   name: "build varnish VMODs"
            make:
                chdir: "/tmp/vmods"
                target: "install"
            notify: "restart varnish"
            when: "varnish_build_vmods"
        -   name: "remove /tmp/vmods"
            file:
                path: "/tmp/vmods"
                state: "absent"
            when: "varnish_build_vmods"
        -   name: "install PIP packages"
            pip:
                name: "{{ item[0] }}"
                executable: "pip3"
                extra_args: "--user"
            become: "true"
            become_user: "{{ item[1].user }}"
            loop: "{{ pip_packages | product(server_users) | list }}"
        -   name: "add some environmental variables and update PATH"
            vars:
                local_paths:
                    - "export JAVA_HOME=/usr/lib/jvm/java/"
                    - "export PATH=$HOME/.composer/vendor/bin/:$PATH"
                    - "export PATH=$HOME/.local/bin/:$PATH"
                    - "export PATH=$JAVA_HOME/bin:$PATH"
            lineinfile:
                path: "~/.bash_profile"
                state: "present"
                line: "{{ item[1] }}"
            become: "true"
            become_user: "{{ item[0].user }}"
            loop: "{{ server_users | product(local_paths) | list }}"
########################################################################################################################

########################################################################################################################
# Configure projector #####################################################################################################
########################################################################################################################
-   name: "configuring projector"
    become: "yes"
    hosts: "all"
    tags:
        - "configure_projector"
    vars_files:
        - "host_vars/common.yml"
    tasks:
        -   name: "install jetbrains projector-installer"
            pip:
                name: "projector-installer"
                executable: "pip3"
        -   name: "install projector IDEs"
            command: "/usr/local/bin/projector --config-directory=/etc/projector --cache-directory=/etc/projector --accept-license autoinstall --config-name {{ item.config|quote }} --ide-name {{ item.ide|quote }}"
            args:
                creates: "{{projector_configs + item.config}}"
            loop: "{{ projector_ides }}"
        -   name: "install projector IDE certs for SSL"
            command: "/usr/local/bin/projector --config-directory=/etc/projector --cache-directory=/etc/projector --accept-license install-certificate {{ item.config|quote }}"
            args:
                creates: "{{ projector_configs + item.config + '/ssl.properties' }}"
            loop: "{{ projector_ides }}"
        -   name: "create service files for projector IDEs"
            template:
                src: "templates/projector/service.j2"
                dest: "/etc/systemd/system/projector_{{ item.config }}.service"
            vars: { config: "{{ item.config }}", ide: "{{ item.ide }}" }
            loop: "{{ projector_ides }}"
        -   name: "increase inotify max user watches"
            lineinfile:
                path: "/etc/sysctl.conf"
                state: "present"
                line: "fs.inotify.max_user_watches=524288"
        -   name: "find installer archives"
            find:
                paths: "/etc/projector"
                patterns: '*.gz'
            register: "installer_archives"
        -   name: "delete installer archives"
            file:
                path: "{{ item.path }}"
                state: "absent"
            loop: "{{ installer_archives.files }}"
########################################################################################################################

########################################################################################################################
# Configure apache #####################################################################################################
########################################################################################################################
-   name: "configuring apache"
    become: "yes"
    hosts: "all"
    tags:
        - "configure_apache"
    vars_files:
        - "host_vars/common.yml"
    tasks:
        -   name: "add the local users to the apache group"
            user:
                append: "yes"
                groups: "{{ apache_group }}"
                name: "{{ item.user }}"
            loop: "{{ server_users }}"
        -   name: "add the apache user to the local users' groups"
            user:
                append: "yes"
                groups: "{{ item.user }}"
                name: "{{ apache_group }}"
            loop: "{{ server_users }}"
        -   name: "give vagrant user and apache group recursive ownership of {{ server_document_root }} and set the group sticky bit"
            file:
                group: "{{ apache_group }}"
                mode: "u=rwX,g=srwX,o=rX"
                owner: "vagrant"
                path: "{{ server_document_root }}"
                recurse: "yes"
        -   name: "add an /etc/systemd/system/{{ php_webserver_daemon }}.service.d/ folder to set an apache umask override in"
            file:
                dest: "/etc/systemd/system/{{ php_webserver_daemon }}.service.d/"
                state: "directory"
        -   name: "set an apache umask override"
            copy:
                content: |
                    [Service]
                    UMask=0002
                dest: "/etc/systemd/system/{{ php_webserver_daemon }}.service.d/override.conf"
        -   name: "create an index.php for the default box"
            copy:
                content: |
                    <?php
                    phpinfo();
                    ?>
                dest: "{{ server_document_root }}/index.php"
                force: "no"
                group: "{{ apache_group }}"
                mode: "u+rw,g+rw,o+r"
                owner: "vagrant"
        -   name: "add logrotate entry for apache2"
            template:
                dest: "/etc/logrotate.d/apache2"
                mode: "0644"
                src: "templates/logrotate.d/apache2.j2"
        -   name: "remove the {{ server_cgi_root }} directory"
            file:
                path: "{{ server_cgi_root }}"
                state: "absent"
        -   name: "reload apache"
            systemd:
                daemon_reload: "true"
                name: "{{ php_webserver_daemon }}"
                state: "reloaded"
########################################################################################################################

########################################################################################################################
# Configure firewalld ##################################################################################################
########################################################################################################################
-   name: "configuring firewalld"
    become: "yes"
    hosts: "all"
    tags:
        - "configure_firewalld"
    vars_files:
        - "host_vars/common.yml"
    tasks:
        -   name: "force the NFS lock manager to use a consistent UDP port (36389) when building a local box"
            template:
                dest: "/etc/modprobe.d/lockd.conf"
                mode: "0644"
                src: "templates/modprobe.d/lockd.conf"
        -   name: "configure firewalld services"
            firewalld:
                permanent: "yes"
                service: "{{ item.name }}"
                state: "{{ item.state }}"
            loop:
                - { name: "http", state: "enabled" }
                - { name: "https", state: "enabled" }
                - { name: "mountd", state: "enabled" }
                - { name: "mysql", state: "enabled" }
                - { name: "nfs", state: "enabled" }
                - { name: "postgresql", state: "enabled" }
                - { name: "rpc-bind", state: "enabled" }
                - { name: "samba", state: "enabled" }
                - { name: "ssh", state: "enabled" }
        -   name: "configure firewalld ports"
            firewalld:
                permanent: "yes"
                port: "{{ item.port }}"
                state: "{{ item.state }}"
            loop:
                - { port: "1080/tcp", state: "enabled" } # mailcatcher
                - { port: "3000/tcp", state: "enabled" } # node / rails dev servers
                - { port: "4200/tcp", state: "enabled" } # ng
                - { port: "5000/tcp", state: "enabled" } # serve
                - { port: "5001/tcp", state: "enabled" } # dotnet
                - { port: "8000/tcp", state: "enabled" } # django / symfony
                - { port: "8080/tcp", state: "enabled" } # alt http
                - { port: "8443/tcp", state: "enabled" } # alt https
                - { port: "9999/tcp", state: "enabled" } # projector port
                - { port: "27017/tcp", state: "enabled" } # mongodb
                - { port: "27018/tcp", state: "enabled" } # mongodb
                - { port: "27019/tcp", state: "enabled" } # mongodb
                - { port: "36389/tcp", state: "enabled" } # lockd windows
                - { port: "36389/udp", state: "enabled" } # lockd mac
        -   name: "reload firewalld"
            systemd:
                daemon_reload: "true"
                name: "firewalld"
                state: "started"
########################################################################################################################

########################################################################################################################
# Configure postfix ####################################################################################################
########################################################################################################################
-   name: "configuring postfix"
    become: "yes"
    hosts: "all"
    tags:
        - "configure_postfix"
    vars_files:
        - "host_vars/common.yml"
    tasks:
        -   name: "ensure postfix is enabled and started"
            service:
                enabled: "yes"
                name: "postfix"
                state: "started"
########################################################################################################################

########################################################################################################################
# Disable select items #################################################################################################
########################################################################################################################
-   name: "disabling select items"
    become: "yes"
    hosts: "all"
    tags:
        - "disable_items"
    vars_files:
        - "host_vars/common.yml"
    tasks:
        -   name: "ensure apache is enabled and started"
            service:
                enabled: "yes"
                name: "apache2"
                state: "started"
        -   name: "ensure nginx is disabled and stopped"
            service:
                enabled: "no"
                name: "nginx"
                state: "stopped"
        -   name: "ensure varnish is disabled and stopped"
            service:
                enabled: "no"
                name: "varnish"
                state: "stopped"
        -   name: "ensure memcached is disabled and stopped"
            service:
                enabled: "no"
                name: "memcached"
                state: "stopped"
########################################################################################################################