style: Add ansible-lint

Signed-off-by: Julien Riou <julien@riou.xyz>

.ansible-lint

@@ -0,0 +1,9 @@
+---
+exclude_paths:
+  - .cache/
+  - .github/
+  - .pre-commit-config.yaml
+  - group_vars/pilote.yml
+
+skip_list:
+  - latest

.github/workflows/pre-commit.yml

@@ -10,6 +10,6 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v3
-    - uses: pre-commit/action@v3.0.1
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v3
+      - uses: pre-commit/action@v3.0.1

.pre-commit-config.yaml

@@ -1,9 +1,14 @@
 ---
 repos:
-- repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.6.0
-  hooks:
-  - id: check-yaml
-  - id: detect-private-key
-  - id: end-of-file-fixer
-  - id: trailing-whitespace
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: check-yaml
+      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  - repo: https://github.com/ansible/ansible-lint
+    rev: v24.2.3
+    hooks:
+      - id: ansible-lint

TODO.md

@@ -2,6 +2,3 @@
 
 * EasyRSA tasks
 * Variables documentation
-* Github actions
-    * pre-commit
-    * ansible-lint

main.yml

@@ -1,23 +1,55 @@
 ---
-- hosts: pilote
+- name: Configure pilote
+  hosts: pilote
   gather_facts: true
   tasks:
-    - ansible.builtin.include_tasks: tasks/sysctl.yml
-    - ansible.builtin.include_tasks: tasks/apt.yml
-    - ansible.builtin.include_tasks: tasks/users.yml
-    - ansible.builtin.include_tasks: tasks/profile.yml
-    - ansible.builtin.include_tasks: tasks/hostname.yml
-    - ansible.builtin.include_tasks: tasks/motd.yml
-    - ansible.builtin.include_tasks: tasks/time.yml
-    - ansible.builtin.include_tasks: tasks/ssh.yml
-    - ansible.builtin.include_tasks: tasks/openvpn.yml
-    - ansible.builtin.include_tasks: tasks/nagios.yml
-    - ansible.builtin.include_tasks: tasks/nrpe.yml
-    - ansible.builtin.include_tasks: tasks/mosquitto.yml
-    - ansible.builtin.include_tasks: tasks/serial2mqtt.yml
-    - ansible.builtin.include_tasks: tasks/telegraf.yml
-    - ansible.builtin.include_tasks: tasks/bacula.yml
-    - ansible.builtin.include_tasks: tasks/iptables.yml
-    # TODO
-    #- ansible.builtin.include_tasks: tasks/easyrsa.yml
-    - ansible.builtin.include_tasks: tasks/vim.yml
+    - name: Configure sysctl
+      ansible.builtin.include_tasks: tasks/sysctl.yml
+
+    - name: Configure apt
+      ansible.builtin.include_tasks: tasks/apt.yml
+
+    - name: Configure users
+      ansible.builtin.include_tasks: tasks/users.yml
+
+    - name: Configure profile
+      ansible.builtin.include_tasks: tasks/profile.yml
+
+    - name: Configure hostname
+      ansible.builtin.include_tasks: tasks/hostname.yml
+
+    - name: Configure motd
+      ansible.builtin.include_tasks: tasks/motd.yml
+
+    - name: Configure time
+      ansible.builtin.include_tasks: tasks/time.yml
+
+    - name: Configure SSH
+      ansible.builtin.include_tasks: tasks/ssh.yml
+
+    - name: Configure OpenVPN
+      ansible.builtin.include_tasks: tasks/openvpn.yml
+
+    - name: Configure Nagios
+      ansible.builtin.include_tasks: tasks/nagios.yml
+
+    - name: Configure NRPE
+      ansible.builtin.include_tasks: tasks/nrpe.yml
+
+    - name: Configure Mosquitto
+      ansible.builtin.include_tasks: tasks/mosquitto.yml
+
+    - name: Configure serial2mqtt
+      ansible.builtin.include_tasks: tasks/serial2mqtt.yml
+
+    - name: Configure telegraf
+      ansible.builtin.include_tasks: tasks/telegraf.yml
+
+    - name: Configure bacula
+      ansible.builtin.include_tasks: tasks/bacula.yml
+
+    - name: Configure iptables
+      ansible.builtin.include_tasks: tasks/iptables.yml
+
+    - name: Configure vim
+      ansible.builtin.include_tasks: tasks/vim.yml

tasks/apt.yml

@@ -10,6 +10,7 @@
   ansible.builtin.template:
     src: apt/raspi.list.j2
     dest: /etc/apt/sources.list.d/raspi.list
+    mode: "0644"
 
 - name: Update system
   ansible.builtin.apt:

tasks/bacula.yml

@@ -7,7 +7,6 @@
       - bacula-fd
       - bacula-sd
       - bacula-console
-    state: latest
 
 - name: Configure database
   ansible.builtin.copy:
@@ -61,6 +60,7 @@
   ansible.builtin.template:
     src: "bacula/conf.d/{{ item }}.conf.j2"
     dest: "/etc/bacula/conf.d/{{ item }}.conf"
+    mode: "0644"
   loop:
     - clients
     - filesets

tasks/easyrsa.yml

@@ -1,13 +1,13 @@
 ---
 # TODO
-- name: copy easyrsa sources to /root
-  copy:
+- name: Copy easyrsa sources to /root
+  ansible.builtin.copy:
     src: files/easyrsa/EasyRSA-v3.0.6
     dest: /root/
     mode: preserve
 
-- name: add easyrsa binary to path
-  file:
+- name: Add easyrsa binary to path
+  ansible.builtin.file:
     src: /root/EasyRSA-v3.0.6/easyrsa
     dest: /usr/local/sbin/easyrsa
     state: link

tasks/hostname.yml

@@ -1,9 +1,10 @@
 ---
 - name: Setup hostname
-  hostname:
+  ansible.builtin.hostname:
     name: "{{ hostname }}"
 
 - name: Manage /etc/hosts
   ansible.builtin.template:
     src: hostname/hosts.j2
     dest: /etc/hosts
+    mode: "0644"

tasks/iptables.yml

@@ -57,7 +57,7 @@
     name:
       - netfilter-persistent
       - iptables-persistent
-    state: latest
 
 - name: Save iptables
   ansible.builtin.command: netfilter-persistent save
+  changed_when: true

tasks/mosquitto.yml

@@ -3,12 +3,12 @@
   ansible.builtin.apt:
     name:
       - mosquitto
-    state: latest
 
 - name: Configure mosquitto
   ansible.builtin.copy:
     src: files/mosquitto/conf.d
     dest: /etc/mosquitto
+    mode: "0644"
 
 - name: Copy mosquitto password
   ansible.builtin.template:

tasks/motd.yml

@@ -6,10 +6,16 @@
 
 - name: Run figlet
   ansible.builtin.shell:
-    cmd: "hostname | figlet -f /usr/share/figlet/smslant.flf"
+    cmd: >-
+      set -o pipefail
+      hostname | figlet -f /usr/share/figlet/smslant.flf"
+    args:
+      executable: /bin/bash
   register: _motd
+  changed_when: true
 
 - name: Create motd
   ansible.builtin.copy:
     dest: /etc/motd
     content: "{{ _motd.stdout }}\n"
+    mode: "0644"

tasks/nagios.yml

@@ -9,12 +9,12 @@
       - python3-requests
       - python3-jsonschema
       - python-pexpect
-    state: latest
 
 - name: Generate nagios configurations
   ansible.builtin.template:
     src: "nagios/conf.d/{{ item }}.cfg.j2"
     dest: "/etc/nagios4/conf.d/{{ item }}.cfg"
+    mode: "0644"
   loop:
     - commands
     - hosts
@@ -26,6 +26,7 @@
   ansible.builtin.template:
     src: nagios/contacts.cfg.j2
     dest: /etc/nagios4/objects/contacts.cfg
+    mode: "0644"
 
 - name: Copy check_timesyncd
   ansible.builtin.copy:
@@ -47,7 +48,7 @@
 
 - name: Configure notify-by-telegram
   ansible.builtin.copy:
-    content: "{{ {'auth_key': nagios_telegram_auth_key, 'chat_id': nagios_telegram_chat_id } | to_json }}"
+    content: "{{ {'auth_key': nagios_telegram_auth_key, 'chat_id': nagios_telegram_chat_id} | to_json }}"
     dest: /etc/nagios4/telegram.json
     owner: root
     group: nagios
@@ -62,11 +63,13 @@
   ansible.builtin.copy:
     src: files/nagios/nagios.cfg
     dest: /etc/nagios4/nagios.cfg
+    mode: "0644"
 
 - name: Copy CGI configuration
   ansible.builtin.copy:
     src: files/nagios/cgi.cfg
     dest: /etc/nagios4/cgi.cfg
+  mode: "0644"
 
 - name: Reload nagios
   ansible.builtin.service:
@@ -77,16 +80,19 @@
   ansible.builtin.template:
     src: nagios/htdigest.users.j2
     dest: /etc/nagios4/htdigest.users
+    mode: "0644"
 
 - name: Secure Apache
-  copy:
+  ansible.builtin.copy:
     src: files/nagios/security.conf
     dest: /etc/apache2/conf-available/security.conf
+    mode: "0644"
 
 - name: Configure vhost for the web interface
   ansible.builtin.copy:
     src: files/nagios/apache2.conf
     dest: /etc/nagios4/apache2.conf
+    mode: "0644"
 
 - name: Enable Apache modules
   ansible.builtin.command:
@@ -94,6 +100,7 @@
   loop:
     - auth_digest
     - headers
+  changed_when: true
 
 - name: Restart apache
   ansible.builtin.service:
@@ -101,7 +108,7 @@
     state: restarted
 
 - name: Allow HTTP from vpn
-  iptables:
+  ansible.builtin.iptables:
     chain: INPUT
     protocol: tcp
     source: "{{ openvpn_subnet }}"

tasks/nrpe.yml

@@ -10,16 +10,19 @@
   ansible.builtin.template:
     src: nrpe/nrpe.cfg.j2
     dest: /etc/nagios/nrpe.cfg
+    mode: "0644"
 
 - name: Generate NRPE local configuration
   ansible.builtin.template:
     src: nrpe/nrpe_local.cfg.j2
     dest: /etc/nagios/nrpe_local.cfg
+    mode: "0644"
 
 - name: Manage daemon settings
   ansible.builtin.template:
     src: nrpe/nagios-nrpe-server.j2
     dest: /etc/default/nagios-nrpe-server
+    mode: "0644"
 
 - name: Clone check-mqtt source code
   ansible.builtin.git:

tasks/openvpn.yml

@@ -2,22 +2,24 @@
 - name: Install OpenVPN
   ansible.builtin.apt:
     name: openvpn
-    state: latest
 
 - name: Deploy OpenVPN configuration
   ansible.builtin.template:
     src: openvpn/client.conf.j2
     dest: /etc/openvpn/client.conf
+    mode: '0644'
 
 - name: Deploy OpenVPN CA cert
   ansible.builtin.copy:
     content: "{{ openvpn_ca }}"
     dest: /etc/openvpn/ca.crt
+    mode: '0644'
 
 - name: Deploy OpenVPN TLS auth
   ansible.builtin.copy:
     content: "{{ openvpn_ta }}"
     dest: /etc/openvpn/ta.key
+    mode: '0600'
 
 - name: Deploy OpenVPN client cert
   ansible.builtin.copy:

tasks/serial2mqtt.yml

@@ -4,7 +4,6 @@
     name:
       - python3-serial
       - python3-paho-mqtt
-    state: latest
 
 - name: Clone arduino-sensors-toolkit sources
   ansible.builtin.git:
@@ -14,11 +13,11 @@
 - name: Add serial2mqtt user
   ansible.builtin.user:
     name: serial2mqtt
-    system: yes
+    system: true
     password: '!'
     home: /var/lib/serial2mqtt
-    create_home: no
-    append: yes
+    create_home: false
+    append: true
     groups:
       - dialout
 
@@ -34,15 +33,17 @@
   ansible.builtin.copy:
     src: files/serial2mqtt/serial2mqtt.default
     dest: /etc/default/serial2mqtt
+    mode: '0644'
 
 - name: Copy serial2mqtt service unit
   ansible.builtin.copy:
     src: files/serial2mqtt/serial2mqtt.service
     dest: /etc/systemd/system/serial2mqtt.service
+    mode: '0644'
 
 - name: Start serial2mqtt service
   ansible.builtin.systemd:
     name: serial2mqtt.service
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
-    enabled: yes
+    enabled: true

tasks/ssh.yml

@@ -2,7 +2,6 @@
 - name: Install OpenSSH
   ansible.builtin.apt:
     name: openssh-server
-    state: latest
 
 - name: Allow authorized keys
   ansible.posix.authorized_key:
@@ -20,7 +19,7 @@
     mode: '0644'
 
 - name: Reload and enable SSH service
-  service:
+  ansible.builtin.service:
     name: ssh
     state: reloaded
     enabled: true

tasks/sysctl.yml

@@ -5,4 +5,4 @@
     value: '1'
     state: present
     sysctl_file: /etc/sysctl.d/70-disable-ipv6.conf
-    reload: yes
+    reload: true

tasks/telegraf.yml

@@ -3,6 +3,7 @@
   ansible.builtin.template:
     src: telegraf/influxdata.list.j2
     dest: /etc/apt/sources.list.d/influxdata.list
+    mode: '0644'
 
 - name: Download influxdata APT key
   ansible.builtin.apt_key:
@@ -15,12 +16,14 @@
       - telegraf
       - lm-sensors
     update_cache: true
-    state: latest
 
 - name: Generate telegraf configurations
   ansible.builtin.template:
     src: "telegraf/{{ item }}.conf.j2"
     dest: "/etc/telegraf/telegraf.d/{{ item }}.conf"
+    mode: '0640'
+    owner: root
+    group: telegraf
   loop:
     - inputs
     - output

tasks/time.yml

@@ -2,3 +2,4 @@
 - name: Manage time zone
   ansible.builtin.command:
     cmd: "timedatectl set-timezone {{ timezone }}"
+  changed_when: true

tasks/users.yml

@@ -11,4 +11,5 @@
     src: files/users/bashrc
     owner: "{{ item['name'] }}"
     group: "{{ item['name'] }}"
+    mode: '0644'
   loop: "{{ users }}"

tasks/vim.yml

@@ -8,6 +8,7 @@
   ansible.builtin.copy:
     src: files/vim/vimrc
     dest: "{{ '/root/.vimrc' if item['name'] == 'root' else '/home/' + item['name'] + '/.vimrc' }}"
+    mode: '0644'
   loop: "{{ users }}"
   loop_control:
     label: "{{ item['name'] }}"

upgrade.yml

@@ -2,4 +2,5 @@
 - name: Upgrade systems
   hosts: all
   tasks:
-    - include_tasks: tasks/apt-upgrade.yml
+    - name: Run apt upgrade
+      ansible.builtin.include_tasks: tasks/apt-upgrade.yml