91 lines
2.7 KiB
YAML
91 lines
2.7 KiB
YAML
---
|
|
- name: Create vmm_init directory
|
|
ansible.builtin.file:
|
|
path: "{{ node['data_path'] }}/{{ item }}"
|
|
state: "directory"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0750"
|
|
loop:
|
|
- "vmm_init"
|
|
- "vmm_init/grub.d"
|
|
- "vmm_init/modprobe.d"
|
|
- "vmm_init/networkd"
|
|
- "vmm_init/ssh"
|
|
- "vmm_init/ssh/sshd_config.d"
|
|
- "vmm_init/sysctl.d"
|
|
|
|
- name: Create nftables.conf
|
|
ansible.builtin.template:
|
|
src: "{{ node['config_path'] }}/node/vmm/nftables.conf.j2"
|
|
dest: "{{ node['data_path'] }}/vmm_init/nftables.conf"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0640"
|
|
|
|
- name: Create grub.d iommu config
|
|
ansible.builtin.copy:
|
|
content: |
|
|
GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on iommu=pt"
|
|
dest: "{{ node['data_path'] }}/vmm_init/grub.d/iommu.cfg"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0640"
|
|
|
|
- name: Create modprobe.d vfio config
|
|
ansible.builtin.copy:
|
|
content: |
|
|
options vfio-pci ids={{ hostvars['vmm']['hardware']['igpu']['id'] }}
|
|
softdep i915 pre: vfio-pci
|
|
# softdep ahci pre: vfio-pci # sata controller
|
|
dest: "{{ node['data_path'] }}/vmm_init/modprobe.d/vfio.conf"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0640"
|
|
|
|
- name: Create networkd network config
|
|
ansible.builtin.template:
|
|
src: "{{ item }}"
|
|
dest: "{{ node['data_path'] }}/vmm_init/networkd/{{ item | basename | replace('.j2', '') }}"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0640"
|
|
loop: "{{ query('fileglob', hostvars['console']['node']['config_path'] + '/node/vmm/networkd/*') | sort }}"
|
|
|
|
- name: Create ssh CA
|
|
ansible.builtin.copy:
|
|
content: |
|
|
{{ hostvars['console']['ssh']['ca']['pub'] }}
|
|
dest: "{{ node['data_path'] }}/vmm_init/ssh/local_ssh_ca.pub"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0640"
|
|
|
|
- name: Create ssh config
|
|
ansible.builtin.copy:
|
|
content: "{{ item.value }}"
|
|
dest: "{{ node['data_path'] }}/vmm_init/ssh/sshd_config.d/{{ item.name }}"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0640"
|
|
loop:
|
|
- name: "prohibit_root.conf"
|
|
value: |
|
|
PermitRootLogin no
|
|
- name: "ssh_ca.conf"
|
|
value: |
|
|
TrustedUserCAKeys /etc/ssh/local_ssh_ca.pub
|
|
loop_control:
|
|
label: "{{ item.name }}"
|
|
|
|
- name: Create sysctl.d bridge config
|
|
ansible.builtin.copy:
|
|
content: |
|
|
net.bridge.bridge-nf-call-ip6tables = 0
|
|
net.bridge.bridge-nf-call-iptables = 0
|
|
net.bridge.bridge-nf-call-arptables = 0
|
|
dest: "{{ node['data_path'] }}/vmm_init/sysctl.d/bridge.conf"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ node['group'] }}"
|
|
mode: "0640"
|