k8s.yaml

---
- name: Basic setup and NFS common
  hosts: allnodes
  become: true
  tasks:
    - name: Add SSH keys
      authorized_key:
        user: egi
        state: present
        key: '{{ item }}'
      with_file:
        - public_keys/andrea-manzi
        - public_keys/enolfc
        - public_keys/jhradil
        - public_keys/pospisilp
        - public_keys/sustr
        - public_keys/valtri
    - name: Install nfs-common
      apt:
        name: nfs-common
        update_cache: true
    - name: Site install packages
      package:
        name:
          - atop
          - cron-apt
          - fail2ban
          - git
          - mc
          - vim
          - postfix
    - name: Site remove packages
      package:
        name:
          - unattended-upgrades
        state: absent
    - name: Site cron-apt config
      copy:
        dest: /etc/cron-apt/config
        content: |
          MAILTO=valtri@civ.zcu.cz
          MAILON=upgrade
          RUNSLEEP=600
        mode: 0644
    - name: Site cron-apt action
      copy:
        dest: /etc/cron-apt/action.d/9-upgrade
        content: -q -q dist-upgrade
        mode: 0644
    - name: Mails settings
      vars:
        main_global:
          # disable everything except TLSv1.2
          smtpd_tls_mandatory_protocols: "!SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
          smtpd_tls_protocols: "!SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
          smtp_tls_mandatory_protocols: "!SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
          smtp_tls_protocols: "!SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
        fromdomain: "{{ lookup('dig', groups['fip'][0] + '/PTR') | regex_replace('\\.$', '') }}"
      block:
        - name: Site-specific postfix settings
          set_fact:
            main_cesnet:
              myhostname: "{{ fromdomain }}"
              relayhost: relay.muni.cz
              inet_protocols: ipv4
          when: site_name == "cesnet" or site_name == "cesnet-mcc"
        - name: Setup postfix
          vars:
            main: "{{ main_global | combine(main_cesnet | default({})) }}"
          lineinfile: