av
4bc7a19d88
Без потолка journald занимает до 10% файловой системы; на сервере он успел дорасти до 745M. Лимит выставляется drop-in файлом в journald.conf.d.
91 lines
2.6 KiB
YAML
91 lines
2.6 KiB
YAML
---
|
|
- name: "Configure base system parameters"
|
|
hosts: all
|
|
|
|
vars:
|
|
apt_packages:
|
|
- acl
|
|
- curl
|
|
- fuse
|
|
- git
|
|
- htop
|
|
- jq
|
|
- make
|
|
- python3-croniter
|
|
- python3-pip
|
|
- python3-requests
|
|
- sqlite3
|
|
- tree
|
|
|
|
tasks:
|
|
- name: "Install additional apt packages"
|
|
ansible.builtin.apt:
|
|
name: "{{ apt_packages }}"
|
|
update_cache: true
|
|
|
|
- name: "Configure security settings"
|
|
ansible.builtin.import_role:
|
|
name: geerlingguy.security
|
|
vars:
|
|
# Root по SSH не нужен: ansible ходит под непривилегированным major с
|
|
# become. Заодно defense-in-depth — если PasswordAuthentication когда-то
|
|
# вернётся в "yes", root не откроется по паролю.
|
|
security_ssh_permit_root_login: "no"
|
|
# unattended-upgrades: шаблон роли ограничен security-репозиториями,
|
|
# автоматическая перезагрузка выключена дефолтом роли.
|
|
security_autoupdate_enabled: true
|
|
security_fail2ban_enabled: true
|
|
|
|
- name: "Create systemd journald drop-in directory"
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/journald.conf.d
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: "Limit systemd journal size"
|
|
ansible.builtin.copy:
|
|
content: |
|
|
# Managed by ansible (playbook-system.yml)
|
|
# Без потолка journald занимает до 10% ФС.
|
|
[Journal]
|
|
SystemMaxUse=500M
|
|
dest: /etc/systemd/journald.conf.d/99-max-use.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: "Restart systemd-journald"
|
|
|
|
- name: "Copy keep files script"
|
|
ansible.builtin.copy:
|
|
src: "files/keep-files.py"
|
|
dest: "{{ bin_prefix }}/keep-files.py"
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: 'Create directory for applications'
|
|
ansible.builtin.file:
|
|
path: '{{ application_dir }}'
|
|
state: 'directory'
|
|
mode: '0755'
|
|
tags:
|
|
- mount-storage
|
|
|
|
- name: 'Mount external storages'
|
|
ansible.posix.mount:
|
|
path: '{{ application_dir }}'
|
|
src: 'UUID=3942bffd-8328-4536-8e88-07926fb17d17'
|
|
fstype: ext4
|
|
state: mounted
|
|
when: mount_external_storage | default(false) | bool
|
|
tags:
|
|
- mount-storage
|
|
|
|
handlers:
|
|
- name: "Restart systemd-journald"
|
|
ansible.builtin.systemd_service:
|
|
name: systemd-journald
|
|
state: restarted
|