138 lines
3.2 KiB
YAML
138 lines
3.2 KiB
YAML
---
|
|
- name: Set up initial CORE interface with DHCP
|
|
community.general.nmcli:
|
|
conn_name: core
|
|
method4: "auto"
|
|
ifname: ens18
|
|
type: ethernet
|
|
state: present
|
|
|
|
- name: Set hostname to generic localhost
|
|
ansible.builtin.hostname:
|
|
name: localhost.localdomain
|
|
# use: systemd
|
|
|
|
- name: Ensure IPv4 localhost entry exists in /etc/hosts
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/hosts
|
|
line: "127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4"
|
|
state: present
|
|
create: yes
|
|
regexp: '^127\.0\.0\.1\s+localhost'
|
|
|
|
- name: Remove IPv6 localhost entry (::1) from /etc/hosts
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/hosts
|
|
regexp: '^::1\s+localhost'
|
|
state: absent
|
|
|
|
- name: Remove xbazzi user
|
|
ansible.builtin.user:
|
|
name: xbazzi
|
|
state: absent
|
|
remove: true
|
|
|
|
- name: Truncate machine-id
|
|
ansible.builtin.command: truncate -s 0 /etc/machine-id
|
|
|
|
- name: Remove DBus machine-id if exists
|
|
ansible.builtin.file:
|
|
path: /var/lib/dbus/machine-id
|
|
state: absent
|
|
|
|
- name: Remove root SSH folder
|
|
ansible.builtin.file:
|
|
path: /root/.ssh
|
|
state: absent
|
|
|
|
- name: Remove anaconda kickstart config
|
|
ansible.builtin.file:
|
|
path: /root/anaconda-ks.cfg
|
|
state: absent
|
|
|
|
- name: Clear logs
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- /var/log/boot.log
|
|
- /var/log/cron
|
|
- /var/log/dmesg
|
|
- /var/log/grubby
|
|
- /var/log/lastlog
|
|
- /var/log/maillog
|
|
- /var/log/messages
|
|
- /var/log/secure
|
|
- /var/log/spooler
|
|
- /var/log/tallylog
|
|
- /var/log/wtmp
|
|
- /var/log/yum.log
|
|
- /var/log/audit/audit.log
|
|
- /var/log/tuned/tuned.log
|
|
- /var/log/wpa_supplicant.log
|
|
- /var/log/ovirt-guest-agent/ovirt-guest-agent.log
|
|
|
|
- name: Rotate and vacuum journal logs
|
|
ansible.builtin.shell: |
|
|
journalctl --rotate
|
|
journalctl --vacuum-time=1s
|
|
when: ansible_facts['distribution_major_version'] is version('8', '>=')
|
|
|
|
- name: Clear shell history
|
|
ansible.builtin.copy:
|
|
content: ""
|
|
dest: /root/.bash_history
|
|
force: true
|
|
|
|
- name: Find all SSH keys
|
|
ansible.builtin.find:
|
|
# path: "{{ item }}"
|
|
paths:
|
|
- /etc/ssh
|
|
- /home/
|
|
patterns:
|
|
- "ssh_host*"
|
|
- "id_*"
|
|
- "authorized_keys"
|
|
- "known_hosts"
|
|
- "config"
|
|
use_regex: false
|
|
recurse: true
|
|
file_type: file
|
|
register: ssh_files
|
|
|
|
- name: Debug found SSH keys
|
|
debug:
|
|
msg: "{{ item.path }}"
|
|
loop: "{{ ssh_files.files }}"
|
|
|
|
- name: Remove SSH keys
|
|
ansible.builtin.file:
|
|
path: "{{ item.path }}"
|
|
state: absent
|
|
loop: "{{ ssh_files.files }}"
|
|
# loop: "{{ ssh_keys.results | map(attribute='files') | flatten }}"
|
|
|
|
- name: Add ansible user SSH public key
|
|
ansible.builtin.copy:
|
|
dest: /home/ansible/.ssh/authorized_keys
|
|
content: "{{ lookup('file', '~/.ssh/lan_id_ed25519.pub') }}"
|
|
mode: '0600'
|
|
owner: "ansible"
|
|
group: "ansible"
|
|
|
|
- name: Sync changes to disk
|
|
ansible.builtin.command: sync
|
|
|
|
- name: Shutdown the machine for templating
|
|
community.general.shutdown:
|
|
delay: 5
|
|
|
|
- name: Remove old local SSH known_hosts entry
|
|
become_user: xbazzi
|
|
local_action:
|
|
module: command
|
|
args:
|
|
cmd: ssh-keygen -R "{{ hostvars['staging-vm'].ansible_host }}"
|
|
|