main.yml (3300B)
1 --- 2 # Role: Install dependencies 3 4 - name: Disable password authentication and X11 forwarding in SSH 5 ansible.builtin.lineinfile: 6 path: /etc/ssh/sshd_config 7 regexp: "{{ item.regexp }}" 8 line: "{{ item.line }}" 9 state: present 10 loop: 11 - { regexp: '^#?PasswordAuthentication.*', line: 'PasswordAuthentication no' } 12 - { regexp: '^#?X11Forwarding.*', line: 'X11Forwarding no' } 13 notify: Restart SSH service 14 15 - name: Install packages required by Ansible 16 apt: 17 policy_rc_d: 101 18 update_cache: true 19 name: 20 - python3-debian 21 - python3-psycopg2 22 state: latest 23 when: ansible_facts["os_family"] == 'Debian' 24 25 - name: Deploy TSYS signing key 26 copy: 27 src: etc/apt/keyrings/taler-systems.gpg 28 dest: /etc/apt/keyrings/taler-systems.gpg 29 owner: root 30 group: root 31 mode: "0644" 32 33 - name: Add GNU Taler repo (Debian) 34 deb822_repository: 35 name: Taler 36 types: deb 37 uris: https://deb.taler.net/apt/debian 38 suites: "{{ taler_repo_suites }}" 39 components: 40 - main 41 architectures: amd64 42 signed_by: /etc/apt/keyrings/taler-systems.gpg 43 when: 'ansible_facts["distribution"] == "Debian"' 44 45 - name: Add GNU Taler repo (Ubuntu) 46 deb822_repository: 47 name: Taler 48 types: deb 49 uris: https://deb.taler.net/apt/ubuntu 50 suites: "{{ taler_repo_suites }}" 51 components: 52 - main 53 architectures: amd64 54 signed_by: /etc/apt/keyrings/taler-systems.gpg 55 when: 'ansible_facts["distribution"] == "Ubuntu"' 56 57 # The file is a no-op (priority 500 is the default); see the comment in 58 # it: we only keep deploying it because it is already on the hosts. 59 - name: Deploy the taler repo pinning file 60 copy: 61 src: etc/apt/preferences.d/limit-taler-repo 62 dest: /etc/apt/preferences.d/limit-taler-repo 63 owner: root 64 group: root 65 mode: "0644" 66 67 - name: Upgrade the base distribution while keeping applications stopped 68 ansible.builtin.include_tasks: upgrade.yml 69 when: ansible_facts["os_family"] == 'Debian' 70 71 - name: Install Taler dependencies on Debian/Ubuntu 72 apt: 73 policy_rc_d: 101 74 name: 75 - curl 76 - jq 77 - sudo 78 - uuid-runtime 79 - procps 80 - wget 81 - openssl 82 - libgnunet 83 state: latest 84 when: ansible_facts["os_family"] == 'Debian' 85 86 - name: Install robocop if sanction lists are in use 87 apt: 88 policy_rc_d: 101 89 name: 90 - robocop 91 state: latest 92 when: 93 - sanction_list is defined 94 - ansible_facts["os_family"] == 'Debian' 95 96 - name: Install setup-secret-fact helper 97 ansible.builtin.copy: 98 src: setup-secret-fact 99 dest: /bin/setup-secret-fact 100 owner: root 101 group: root 102 mode: "0744" 103 104 - name: Install setup-challenger-client-id-fact helper 105 ansible.builtin.copy: 106 src: setup-challenger-client-id-fact 107 dest: /bin/setup-challenger-client-id-fact 108 owner: root 109 group: root 110 mode: "0744" 111 112 - name: Generate dhparam.pem 113 command: openssl dhparam -out dhparam.pem 4096 114 args: 115 chdir: /etc/ssl/private/ 116 creates: /etc/ssl/private/dhparam.pem 117 when: not (use_pregenerated_dhparam | default(False)) 118 119 - name: Deploy pregenerated dhparam.pem 120 copy: 121 src: dhparam_pregenerated.pem 122 dest: /etc/ssl/private/dhparam.pem 123 owner: root 124 group: root 125 mode: "0644" 126 when: (use_pregenerated_dhparam | default(False))