mirror of
https://github.com/iiab/iiab.git
synced 2025-03-09 15:40:17 +00:00
initial checkin
This commit is contained in:
parent
6f50fb66aa
commit
c4d6597d74
8 changed files with 159 additions and 0 deletions
4
roles/remoteit/defaults/main.yml
Normal file
4
roles/remoteit/defaults/main.yml
Normal file
|
@ -0,0 +1,4 @@
|
||||||
|
# Remote.it allows you to make secure remote connections between two computers.
|
||||||
|
# See https://docs.remote.it/cli/overview for possible values for remoteit_url
|
||||||
|
remoteit_cli_url: https://downloads.remote.it/cli/latest/remoteit_linux_armv7
|
||||||
|
remoteit_device_url: https://downloads.remote.it/remoteit/v4.13.5/remoteit-4.13.5.armhf.rpi.deb
|
80
roles/remoteit/tasks/enable-or-disable.yml
Normal file
80
roles/remoteit/tasks/enable-or-disable.yml
Normal file
|
@ -0,0 +1,80 @@
|
||||||
|
# FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not
|
||||||
|
# been working with systemd service names that contained the "@" character.
|
||||||
|
|
||||||
|
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
|
||||||
|
# shell: systemctl enable openvpn@xscenet.service
|
||||||
|
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
|
||||||
|
|
||||||
|
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
|
||||||
|
# shell: update-rc.d openvpn enable
|
||||||
|
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
|
||||||
|
|
||||||
|
#- name: Start the OpenVPN tunnel now
|
||||||
|
# shell: systemctl start openvpn@xscenet.service
|
||||||
|
# when: openvpn_enabled and not stat.exists is defined and not installing
|
||||||
|
|
||||||
|
# AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY
|
||||||
|
# "lineinfile: ... state: absent" stanza to make openvpn_handle propagate
|
||||||
|
# properly to xscenet.net (monitoring ncat's erroneous handle parameter by
|
||||||
|
# observing "systemctl status openvpn@xscenet" helped trace the [primary?]
|
||||||
|
# bug to roles/openvpn/templates/announcer [far better now if not perfect?])
|
||||||
|
# Earlier "./runrole openvpn" had to be run twice to transmit
|
||||||
|
# /etc/iiab/openvpn_handle to xscenet.net -- and
|
||||||
|
# "systemctl restart openvpn@xscenet" was failing completely (no matter how
|
||||||
|
# many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net
|
||||||
|
|
||||||
|
# 2018-09-02: OpenVPN had been starting tunnels by accident after reboot,
|
||||||
|
# with new IIAB installs. Fix below (https://github.com/iiab/iiab/pull/1079)
|
||||||
|
# changes most all instances below from CHILD service "openvpn@xscenet" to
|
||||||
|
# PARENT service "openpvn". See these critical files to understand why:
|
||||||
|
#
|
||||||
|
# /etc/default/openvpn implies AUTOSTART="all"
|
||||||
|
# /etc/init.d/openvpn has AUTOSTART="all"
|
||||||
|
# /etc/openvpn/xscenet.conf our VPN connection
|
||||||
|
# /etc/network/if-up.d/openvpn appears to auto-start xscenet.conf
|
||||||
|
# /lib/systemd/systemd-sysv-install sets /etc/rc*.d/S|K01openvpn
|
||||||
|
# e.g. when "systemctl enable openvpn"
|
||||||
|
|
||||||
|
- name: Enable & (Re)Start PARENT 'openvpn' system service, which (re)starts CHILD service 'openvpn@xscenet' (& actual tunnel)
|
||||||
|
systemd:
|
||||||
|
name: openvpn
|
||||||
|
daemon_reload: yes
|
||||||
|
enabled: yes
|
||||||
|
state: restarted # 2018-09-02: Should we be concerned that "systemctl status openvpn" often shows "active (exited)" ? If so we might consider "state: started" or "state: reloaded" instead?
|
||||||
|
when: openvpn_enabled
|
||||||
|
|
||||||
|
- name: Enable hourly cron job for OpenVPN (starts CHILD service openvpn@xscenet, typically for CentOS only?)
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/crontab
|
||||||
|
# CONSIDER "restart" not just "start" if something stronger is confirmed needed?
|
||||||
|
line: "25 * * * * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null"
|
||||||
|
when: openvpn_enabled and openvpn_cron_enabled
|
||||||
|
|
||||||
|
- name: Remove hourly cron job for OpenVPN (typically for CentOS only?)
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/crontab
|
||||||
|
regexp: "openvpn@xscenet"
|
||||||
|
# Potentially DANGEROUS as others use systemctl too:
|
||||||
|
#regexp: ".*/usr/bin/systemctl*"
|
||||||
|
state: absent
|
||||||
|
when: not openvpn_enabled or not openvpn_cron_enabled
|
||||||
|
|
||||||
|
- name: Disable & Stop PARENT 'openvpn' system service, which stops CHILD service 'openvpn@xscenet' (& actual tunnel)
|
||||||
|
systemd:
|
||||||
|
name: openvpn
|
||||||
|
enabled: no
|
||||||
|
state: stopped
|
||||||
|
when: not openvpn_enabled
|
||||||
|
|
||||||
|
#- name: Stop starting the OpenVPN tunnel at boot time (not debuntu)
|
||||||
|
# shell: systemctl disable openvpn@xscenet.service
|
||||||
|
# when: not openvpn_enabled and not is_debuntu
|
||||||
|
|
||||||
|
#- name: Stop starting the OpenVPN tunnel at boot time (debuntu)
|
||||||
|
# shell: update-rc.d openvpn disable
|
||||||
|
# when: not openvpn_enabled and is_debuntu
|
||||||
|
|
||||||
|
#- name: Stop OpenVPN tunnel immediately
|
||||||
|
# shell: systemctl stop openvpn@xscenet.service
|
||||||
|
# ignore_errors: True
|
||||||
|
# when: not openvpn_enabled and not installing
|
22
roles/remoteit/tasks/install.yml
Normal file
22
roles/remoteit/tasks/install.yml
Normal file
|
@ -0,0 +1,22 @@
|
||||||
|
- name: Download the command line interface for this device
|
||||||
|
get_url:
|
||||||
|
url: '{{ remoteit_cli_url }}'
|
||||||
|
dest: /usr/bin/
|
||||||
|
mode: 0755
|
||||||
|
|
||||||
|
- name: Install the device package
|
||||||
|
apt:
|
||||||
|
deb: '{{ remoteit_device_url }}'
|
||||||
|
state: present
|
||||||
|
|
||||||
|
# RECORD remoteit AS INSTALLED
|
||||||
|
|
||||||
|
- name: "Set 'openvpn_installed: True'"
|
||||||
|
set_fact:
|
||||||
|
remoteit_installed: True
|
||||||
|
|
||||||
|
- name: "Add 'remoteit_installed: True' to {{ iiab_state_file }}"
|
||||||
|
lineinfile:
|
||||||
|
path: "{{ iiab_state_file }}" # /etc/iiab/iiab_state.yml
|
||||||
|
regexp: '^remoteit_installed'
|
||||||
|
line: 'remoteit_installed: True'
|
37
roles/remoteit/tasks/main.yml
Normal file
37
roles/remoteit/tasks/main.yml
Normal file
|
@ -0,0 +1,37 @@
|
||||||
|
- name: Assert that "remoteit_install is sameas true" (boolean not string etc)
|
||||||
|
assert:
|
||||||
|
that: remoteit_install is sameas true
|
||||||
|
fail_msg: "PLEASE SET 'remoteit_install: True' e.g. IN: /etc/iiab/local_vars.yml"
|
||||||
|
quiet: yes
|
||||||
|
|
||||||
|
- name: Assert that "remoteit_enabled | type_debug == 'bool'" (boolean not string etc)
|
||||||
|
assert:
|
||||||
|
that: remoteit_enabled | type_debug == 'bool'
|
||||||
|
fail_msg: "PLEASE GIVE VARIABLE 'remoteit_enabled' A PROPER (UNQUOTED) ANSIBLE BOOLEAN VALUE e.g. IN: /etc/iiab/local_vars.yml"
|
||||||
|
quiet: yes
|
||||||
|
|
||||||
|
|
||||||
|
- name: Install remoteit if 'remoteit_installed' not defined, e.g. in {{ iiab_state_file }} # /etc/iiab/iiab_state.yml
|
||||||
|
include_tasks: install.yml
|
||||||
|
when: remoteit_installed is undefined
|
||||||
|
|
||||||
|
|
||||||
|
- include_tasks: enable-or-disable.yml
|
||||||
|
|
||||||
|
|
||||||
|
- name: Add 'remoteit' variable values to {{ iiab_ini_file }}
|
||||||
|
ini_file:
|
||||||
|
path: "{{ iiab_ini_file }}" # /etc/iiab/iiab.ini
|
||||||
|
section: remoteit
|
||||||
|
option: "{{ item.option }}"
|
||||||
|
value: "{{ item.value | string }}"
|
||||||
|
with_items:
|
||||||
|
- option: name
|
||||||
|
value: Remote It
|
||||||
|
- option: description
|
||||||
|
value: '"remote.it allows you to make secure remote connections between two computers. Some of the benefits include:
|
||||||
|
Crossing multiple NATs/firewallsUsing a single TCP portportforwardless: without requiring port forwarding in the router, significantly reducing your network''s vulnerability."'
|
||||||
|
- option: remoteit_install
|
||||||
|
value: "{{ remoteit_install }}"
|
||||||
|
- option: remoteit_enabled
|
||||||
|
value: "{{ remoteit_enabled }}"
|
|
@ -109,6 +109,10 @@ dns_jail_enabled: False
|
||||||
sshd_install: True # Required by OpenVPN
|
sshd_install: True # Required by OpenVPN
|
||||||
sshd_enabled: True
|
sshd_enabled: True
|
||||||
|
|
||||||
|
# Remote.it allows you to make secure remote connections between two computers.
|
||||||
|
remoteit_install: True
|
||||||
|
remoteit_enabled: False
|
||||||
|
|
||||||
# SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
|
# SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
|
||||||
openvpn_install: True
|
openvpn_install: True
|
||||||
openvpn_enabled: False
|
openvpn_enabled: False
|
||||||
|
|
|
@ -109,6 +109,10 @@ dns_jail_enabled: False
|
||||||
sshd_install: True # Required by OpenVPN
|
sshd_install: True # Required by OpenVPN
|
||||||
sshd_enabled: True
|
sshd_enabled: True
|
||||||
|
|
||||||
|
# Remote.it allows you to make secure remote connections between two computers.
|
||||||
|
remoteit_install: True
|
||||||
|
remoteit_enabled: False
|
||||||
|
|
||||||
# SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
|
# SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
|
||||||
openvpn_install: True
|
openvpn_install: True
|
||||||
openvpn_enabled: False
|
openvpn_enabled: False
|
||||||
|
|
|
@ -109,6 +109,10 @@ dns_jail_enabled: False
|
||||||
sshd_install: True # Required by OpenVPN
|
sshd_install: True # Required by OpenVPN
|
||||||
sshd_enabled: True
|
sshd_enabled: True
|
||||||
|
|
||||||
|
# Remote.it allows you to make secure remote connections between two computers.
|
||||||
|
remoteit_install: True
|
||||||
|
remoteit_enabled: False
|
||||||
|
|
||||||
# SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
|
# SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
|
||||||
openvpn_install: True
|
openvpn_install: True
|
||||||
openvpn_enabled: False
|
openvpn_enabled: False
|
||||||
|
|
|
@ -109,6 +109,10 @@ dns_jail_enabled: False
|
||||||
sshd_install: True # Required by OpenVPN
|
sshd_install: True # Required by OpenVPN
|
||||||
sshd_enabled: True
|
sshd_enabled: True
|
||||||
|
|
||||||
|
# Remote.it allows you to make secure remote connections between two computers.
|
||||||
|
remoteit_install: True
|
||||||
|
remoteit_enabled: False
|
||||||
|
|
||||||
# SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
|
# SECURITY WARNING: See http://wiki.laptop.org/go/IIAB/Security
|
||||||
openvpn_install: True
|
openvpn_install: True
|
||||||
openvpn_enabled: True
|
openvpn_enabled: True
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue