mirror of
https://github.com/rocky-linux/infrastructure
synced 2024-11-22 05:01:27 +00:00
commit
55e851c012
@ -42,3 +42,16 @@
|
||||
state: "{{ ipa_presence }}"
|
||||
tags:
|
||||
- dns
|
||||
|
||||
# We try to do this just in case because if a certificate is being issued
|
||||
# that wants a CNAME, the host has to "manage" said host. However, if the
|
||||
# host doesn't exist, we'll ignore it.
|
||||
- name: "Creating host object for CNAME"
|
||||
freeipa.ansible_freeipa.ipahost:
|
||||
ipaadmin_principal: "{{ ipa_admin|default('admin') }}"
|
||||
ipaadmin_password: "{{ ipaadmin_password }}"
|
||||
name: "{{ ipa_name }}.{{ ipa_zone }}"
|
||||
force: true
|
||||
managedby:
|
||||
- "{{ ipa_name_value[:-1] }}"
|
||||
ignore_errors: true
|
||||
|
@ -37,3 +37,11 @@
|
||||
service:
|
||||
name: noggin
|
||||
state: restarted
|
||||
|
||||
- name: rehash_postfix_sasl
|
||||
command: "postmap /etc/postfix/sasl_passwd"
|
||||
|
||||
- name: restart_postfix
|
||||
service:
|
||||
name: postfix
|
||||
state: restarted
|
||||
|
36
ansible/playbooks/init-rocky-builder-postfix.yml
Normal file
36
ansible/playbooks/init-rocky-builder-postfix.yml
Normal file
@ -0,0 +1,36 @@
|
||||
---
|
||||
# Configures postfix on buildsystems
|
||||
- name: Configure Buildsys Relay
|
||||
hosts: "buildsys"
|
||||
become: true
|
||||
vars_files:
|
||||
- vars/buildsys.yml
|
||||
|
||||
handers:
|
||||
- import_tasks: handlers/main.yml
|
||||
|
||||
pre_tasks:
|
||||
- name: Check if ansible cannot be run here
|
||||
stat:
|
||||
path: /etc/no-ansible
|
||||
register: no_ansible
|
||||
|
||||
- name: Verify if we can run ansible
|
||||
assert:
|
||||
that:
|
||||
- "not no_ansible.stat.exists"
|
||||
success_msg: "We are not able to run on this node"
|
||||
fail_msg: "/etc/no-ansible exists - skipping run on this node"
|
||||
|
||||
tasks:
|
||||
- name: Deploy Postfix Relay
|
||||
import_tasks: tasks/postfix_relay.yml
|
||||
|
||||
post_tasks:
|
||||
- name: Touching run file that ansible has ran here
|
||||
file:
|
||||
path: /var/log/ansible.run
|
||||
state: touch
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
@ -50,6 +50,10 @@
|
||||
group: root
|
||||
state: link
|
||||
|
||||
- name: Symlink the hash
|
||||
command: "openssl rehash /etc/gitlab/trusted-certs"
|
||||
changed_when: "1 != 1"
|
||||
|
||||
- name: Turn on necessary SELinux booleans
|
||||
ansible.posix.seboolean:
|
||||
name: "{{ item }}"
|
||||
|
37
ansible/playbooks/tasks/postfix_relay.yml
Normal file
37
ansible/playbooks/tasks/postfix_relay.yml
Normal file
@ -0,0 +1,37 @@
|
||||
---
|
||||
# Configure relay
|
||||
- name: Ensure postfix is installed
|
||||
yum:
|
||||
name:
|
||||
- postfix
|
||||
- cyrus-sasl-plain
|
||||
state: present
|
||||
|
||||
- name: Add password map
|
||||
template:
|
||||
src: etc/postfix/sasl_passwd.j2
|
||||
dest: /etc/postfix/sasl_passwd
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
notify: rehash_postfix_sasl
|
||||
|
||||
- name: Add relay information to postfix
|
||||
blockinfile:
|
||||
path: /etc/postfix/main.cf
|
||||
marker: "## ANSIBLE MANAGED ##"
|
||||
block: |
|
||||
smtp_tls_note_starttls_offer = yes
|
||||
relayhost = [{{ smtp_relayhost }}]:587
|
||||
smtp_use_tls = yes
|
||||
smtp_sasl_auth_enable = yes
|
||||
smtp_sasl_security_options =
|
||||
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
|
||||
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
|
||||
notify: restart_postfix
|
||||
|
||||
- name: Ensure postfix is running and enabled
|
||||
service:
|
||||
name: postfix
|
||||
state: running
|
||||
enabled: true
|
@ -132,3 +132,7 @@ gitlab_rails['db_port'] = '{{ gitlab_external_db_port }}'
|
||||
gitlab_rails['db_username'] = '{{ gitlab_external_db_user }}'
|
||||
gitlab_rails['db_password'] = '{{ gitlab_external_db_password }}'
|
||||
{% endif %}
|
||||
|
||||
{% if gitlab_trusted_proxies %}
|
||||
gitlab_rails['trusted_proxies'] = '{{ gitlab_trusted_proxies | map("to_json") | join(", ") }}'
|
||||
{% endif %}
|
||||
|
1
ansible/playbooks/templates/etc/postfix/sasl_passwd.j2
Normal file
1
ansible/playbooks/templates/etc/postfix/sasl_passwd.j2
Normal file
@ -0,0 +1 @@
|
||||
[{{ smtp_relayhost }}]:587 {{ smtp_user_name }}:{{ smtp_user_pass }}
|
@ -29,7 +29,7 @@ gitlab_ldap_bind_dn: "{{ rocky_ldap_bind_dn }}"
|
||||
gitlab_ldap_password: "{{ rocky_ldap_bind_pw }}"
|
||||
gitlab_ldap_base: "{{ rocky_ldap_user_basedn }}"
|
||||
gitlab_ldap_group_dn: "{{ rocky_ldap_group_basedn }}"
|
||||
gitlab_ldap_admin_group: "cn=gitadm,cn=groups,cn=accounts,dc=rockylinux,dc=org"
|
||||
gitlab_ldap_admin_group: "gitadm"
|
||||
gitlab_ldap_user_filter: "(&(objectClass=posixAccount)(memberOf=cn=gitusers,cn=groups,cn=accounts,dc=rockylinux,dc=org))"
|
||||
|
||||
gitlab_time_zone: "UTC"
|
||||
@ -67,3 +67,6 @@ gitlab_external_db: true
|
||||
gitlab_external_db_host: db.rockylinux.org
|
||||
gitlab_external_db_user: gitlab
|
||||
gitlab_external_db_password: "{{ gitlab_db_pass }}"
|
||||
|
||||
gitlab_trusted_proxies:
|
||||
- 10.100.20.20/32
|
||||
|
Loading…
Reference in New Issue
Block a user