added hawser config, better linux layout
This commit is contained in:
Bart Sjerps
@@ -0,0 +1,5 @@
|
||||
[defaults]
|
||||
inventory = ./inventory.ini
|
||||
host_key_checking = False
|
||||
remote_user = root
|
||||
|
||||
Executable
BIN
Binary file not shown.
@@ -0,0 +1,31 @@
|
||||
[Unit]
|
||||
Description=Hawser - Remote Docker Agent for Dockhand
|
||||
Documentation=https://github.com/Finsys/hawser
|
||||
After=network-online.target docker.service
|
||||
Wants=network-online.target
|
||||
Requires=docker.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/usr/local/bin/hawser
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
EnvironmentFile=/etc/hawser/config
|
||||
|
||||
# Logging
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=hawser
|
||||
|
||||
# Security hardening (relaxed for Docker access)
|
||||
# NoNewPrivileges=false
|
||||
# ProtectSystem=strict
|
||||
# ProtectHome=true
|
||||
# ReadWritePaths=/var/run/docker.sock /data/stacks
|
||||
|
||||
# Resource limits
|
||||
LimitNOFILE=65535
|
||||
LimitNPROC=4096
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -84,6 +84,7 @@
|
||||
ansible.builtin.systemd:
|
||||
name: autofs
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
handlers:
|
||||
- name: Restart sssd
|
||||
|
||||
+14
-2
@@ -8,6 +8,7 @@
|
||||
description: Docker CE Stable - x86_64
|
||||
baseurl: https://download.docker.com/linux/rhel/$releasever/$basearch/stable
|
||||
gpgkey: https://download.docker.com/linux/rhel/gpg
|
||||
when: ansible_facts['os_family'] == "RedHat"
|
||||
|
||||
- name: Docker Packages
|
||||
ansible.builtin.package:
|
||||
@@ -18,7 +19,11 @@
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
when: ansible_facts['os_family'] == "RedHat"
|
||||
|
||||
- name: Hawser
|
||||
include_tasks: tasks/hawser.yml
|
||||
|
||||
- name: Create systemd override directory
|
||||
file:
|
||||
path: /etc/systemd/system/docker.service.d
|
||||
@@ -48,16 +53,17 @@
|
||||
- name: Open Firewall port
|
||||
firewalld:
|
||||
# service: docker-registry
|
||||
port: 2375/tcp
|
||||
port: 2376/tcp
|
||||
permanent: true
|
||||
state: enabled
|
||||
immediate: yes
|
||||
when: ansible_facts['os_family'] == "RedHat"
|
||||
|
||||
- name: Create /volumes directory
|
||||
file:
|
||||
path: /volumes
|
||||
state: directory
|
||||
mode: '0755'
|
||||
# mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
@@ -69,6 +75,12 @@
|
||||
state: mounted
|
||||
fstype: none
|
||||
|
||||
- name: Enable Docker
|
||||
ansible.builtin.systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
handlers:
|
||||
- name: Restart docker
|
||||
service:
|
||||
|
||||
+32
-26
@@ -1,36 +1,42 @@
|
||||
[servers]
|
||||
atc-docker01.dell-atc.lan ansible_user=root
|
||||
atc-docker02.dell-atc.lan ansible_user=root
|
||||
atc-db01.dell-atc.lan ansible_user=root
|
||||
# atc-db02.dell-atc.lan ansible_user=root
|
||||
atc-lake01.dell-atc.lan ansible_user=root
|
||||
atc-elastic01.dell-atc.lan ansible_user=root
|
||||
atc-kafka01.dell-atc.lan ansible_user=root
|
||||
atc-portal01.dell-atc.lan ansible_user=root
|
||||
atc-grafana.dell-atc.lan ansible_user=root
|
||||
atc-test01.dell-atc.lan ansible_user=root
|
||||
atc-mgt01.dell-atc.lan ansible_user=root
|
||||
atc-gpu-bart.dell-atc.lan ansible_user=root
|
||||
atc-gpu-mo1.dell-atc.lan ansible_user=root
|
||||
atc-nas.dell-atc.lan ansible_user=root
|
||||
atc-docker01.dell-atc.lan
|
||||
atc-docker02.dell-atc.lan
|
||||
atc-db01.dell-atc.lan
|
||||
# atc-db02.dell-atc.lan
|
||||
atc-lake01.dell-atc.lan
|
||||
atc-elastic01.dell-atc.lan
|
||||
atc-kafka01.dell-atc.lan
|
||||
atc-portal01.dell-atc.lan
|
||||
atc-grafana.dell-atc.lan
|
||||
# atc-test01.dell-atc.lan
|
||||
atc-mgt01.dell-atc.lan
|
||||
atc-gpu-bart.dell-atc.lan
|
||||
atc-gpu-mo1.dell-atc.lan
|
||||
atc-nas.dell-atc.lan
|
||||
|
||||
[proxmox]
|
||||
dcp-pve01.dell-atc.lan ansible_user=root
|
||||
DSS-GPU.dell-atc.lan ansible_user=root
|
||||
pve2.dell-atc.lan ansible_user=root
|
||||
dcp-pve01.dell-atc.lan
|
||||
DSS-GPU.dell-atc.lan
|
||||
pve2.dell-atc.lan
|
||||
|
||||
[docker]
|
||||
atc-mgt01.dell-atc.lan ansible_user=root
|
||||
atc-docker01.dell-atc.lan ansible_user=root
|
||||
atc-docker02.dell-atc.lan ansible_user=root
|
||||
atc-gpu-bart.dell-atc.lan ansible_user=root
|
||||
atc-gpu-mo1.dell-atc.lan ansible_user=root
|
||||
atc-dns1.dell-atc.lan ansible_user=root
|
||||
atc-dns2.dell-atc.lan ansible_user=root
|
||||
atc-mgt01.dell-atc.lan
|
||||
atc-docker01.dell-atc.lan
|
||||
atc-docker02.dell-atc.lan
|
||||
atc-gpu-bart.dell-atc.lan
|
||||
atc-gpu-mo1.dell-atc.lan
|
||||
# atc-dns1.dell-atc.lan
|
||||
# atc-dns2.dell-atc.lan
|
||||
|
||||
[rhel]
|
||||
atc-mgt01.dell-atc.lan
|
||||
atc-gpu-bart.dell-atc.lan
|
||||
atc-nas.dell-atc.lan
|
||||
atc-gpu-bart.dell-atc.lan
|
||||
|
||||
[nvidia]
|
||||
atc-gpu-bart.dell-atc.lan ansible_user=root
|
||||
atc-gpu-mo1.dell-atc.lan ansible_user=root
|
||||
atc-gpu-bart.dell-atc.lan
|
||||
atc-gpu-mo1.dell-atc.lan
|
||||
|
||||
[rocky:children]
|
||||
servers
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
- name: Automatic updates
|
||||
hosts: rhel
|
||||
tasks:
|
||||
- name: dnf auto
|
||||
include_tasks: tasks/dnf-auto.yml
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
- name: Change DNF Automatic
|
||||
ansible.builtin.ini_file:
|
||||
path: /etc/dnf/automatic.conf
|
||||
section: "{{ item.section }}"
|
||||
option: "{{ item.option }}"
|
||||
value: "{{ item.value }}"
|
||||
no_extra_spaces: true
|
||||
backup: false
|
||||
loop:
|
||||
- { section: commands, option: apply_updates, value: "yes" }
|
||||
- { section: commands, option: upgrade_type, value: "default" }
|
||||
- { section: commands, option: download_updates, value: "yes" }
|
||||
- { section: commands, option: random_sleep, value: "300" }
|
||||
- { section: commands, option: reboot, value: "when-needed" }
|
||||
|
||||
- name: Enable DNF Timer
|
||||
ansible.builtin.systemd:
|
||||
name: dnf-automatic.timer
|
||||
state: started
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
---
|
||||
- name: Create hawser config dir
|
||||
file:
|
||||
path: /etc/hawser
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0700'
|
||||
|
||||
- name: Check if token file exists
|
||||
ansible.builtin.stat:
|
||||
path: /etc/hawser/token
|
||||
register: token_file
|
||||
|
||||
- name: Deploy hawser config
|
||||
when: not token_file.stat.exists
|
||||
block:
|
||||
- name: Generate token
|
||||
ansible.builtin.command: openssl rand -hex 32
|
||||
register: hawser_token
|
||||
changed_when: false
|
||||
- name: Save token
|
||||
copy:
|
||||
content: "{{ hawser_token.stdout }}"
|
||||
dest: /etc/hawser/token
|
||||
mode: '0600'
|
||||
|
||||
- name: Save config
|
||||
template:
|
||||
src: templates/hawser-config
|
||||
dest: /etc/hawser/config
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: Install hawser binary
|
||||
copy:
|
||||
src: bin/hawser
|
||||
dest: /usr/local/bin/hawser
|
||||
mode: '0755'
|
||||
|
||||
- name: Setup Hawser service
|
||||
template:
|
||||
src: bin/hawser.service
|
||||
dest: /etc/systemd/system/hawser.service
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable Hawser
|
||||
ansible.builtin.systemd:
|
||||
name: hawser
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
{
|
||||
"hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"]
|
||||
"hosts": ["unix:///var/run/docker.sock"]
|
||||
}
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
PORT=2376
|
||||
DOCKER_SOCKET=/var/run/docker.sock
|
||||
TOKEN={{ hawser_token.stdout }}
|
||||
|
||||
Reference in New Issue
Block a user