added hawser config, better linux layout

ansible.cfg

@@ -0,0 +1,5 @@
+[defaults]
+inventory = ./inventory.ini
+host_key_checking = False
+remote_user = root
+

bin/hawser.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=Hawser - Remote Docker Agent for Dockhand
+Documentation=https://github.com/Finsys/hawser
+After=network-online.target docker.service
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/hawser
+Restart=always
+RestartSec=10
+EnvironmentFile=/etc/hawser/config
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=hawser
+
+# Security hardening (relaxed for Docker access)
+# NoNewPrivileges=false
+# ProtectSystem=strict
+# ProtectHome=true
+# ReadWritePaths=/var/run/docker.sock /data/stacks
+
+# Resource limits
+LimitNOFILE=65535
+LimitNPROC=4096
+
+[Install]
+WantedBy=multi-user.target

config.yml

@@ -84,6 +84,7 @@
       ansible.builtin.systemd:
         name: autofs
         state: started
+        enabled: yes
 
   handlers:
     - name: Restart sssd

docker.yml

@@ -8,6 +8,7 @@
         description: Docker CE Stable - x86_64
         baseurl: https://download.docker.com/linux/rhel/$releasever/$basearch/stable
         gpgkey: https://download.docker.com/linux/rhel/gpg
+      when: ansible_facts['os_family'] == "RedHat"
 
     - name: Docker Packages
       ansible.builtin.package:
@@ -18,6 +19,10 @@
           - docker-buildx-plugin 
           - docker-compose-plugin
         state: present
+      when: ansible_facts['os_family'] == "RedHat"
+        
+    - name: Hawser
+      include_tasks: tasks/hawser.yml
 
     - name: Create systemd override directory
       file:
@@ -48,16 +53,17 @@
     - name: Open Firewall port
       firewalld:
         # service: docker-registry
-        port: 2375/tcp
+        port: 2376/tcp
         permanent: true
         state: enabled
         immediate: yes
+      when: ansible_facts['os_family'] == "RedHat"
 
     - name: Create /volumes directory
       file:
         path: /volumes
         state: directory
-        mode: '0755'
+        # mode: '0755'
         owner: root
         group: root
 
@@ -69,6 +75,12 @@
         state: mounted
         fstype: none
 
+    - name: Enable Docker
+      ansible.builtin.systemd:
+        name: docker
+        state: started
+        enabled: yes
+
   handlers:
     - name: Restart docker
       service:

inventory.ini

@@ -1,36 +1,42 @@
 [servers]
-atc-docker01.dell-atc.lan ansible_user=root
+atc-docker01.dell-atc.lan
-atc-docker02.dell-atc.lan ansible_user=root
+atc-docker02.dell-atc.lan
-atc-db01.dell-atc.lan ansible_user=root
+atc-db01.dell-atc.lan
-# atc-db02.dell-atc.lan ansible_user=root
+# atc-db02.dell-atc.lan
-atc-lake01.dell-atc.lan ansible_user=root
+atc-lake01.dell-atc.lan
-atc-elastic01.dell-atc.lan ansible_user=root
+atc-elastic01.dell-atc.lan
-atc-kafka01.dell-atc.lan ansible_user=root
+atc-kafka01.dell-atc.lan
-atc-portal01.dell-atc.lan ansible_user=root
+atc-portal01.dell-atc.lan
-atc-grafana.dell-atc.lan ansible_user=root
+atc-grafana.dell-atc.lan
-atc-test01.dell-atc.lan ansible_user=root
+# atc-test01.dell-atc.lan
-atc-mgt01.dell-atc.lan ansible_user=root
+atc-mgt01.dell-atc.lan
-atc-gpu-bart.dell-atc.lan ansible_user=root
+atc-gpu-bart.dell-atc.lan
-atc-gpu-mo1.dell-atc.lan ansible_user=root
+atc-gpu-mo1.dell-atc.lan
-atc-nas.dell-atc.lan ansible_user=root
+atc-nas.dell-atc.lan
 
 [proxmox]
-dcp-pve01.dell-atc.lan ansible_user=root
+dcp-pve01.dell-atc.lan
-DSS-GPU.dell-atc.lan ansible_user=root
+DSS-GPU.dell-atc.lan
-pve2.dell-atc.lan ansible_user=root
+pve2.dell-atc.lan
 
 [docker]
-atc-mgt01.dell-atc.lan ansible_user=root
+atc-mgt01.dell-atc.lan
-atc-docker01.dell-atc.lan ansible_user=root
+atc-docker01.dell-atc.lan
-atc-docker02.dell-atc.lan ansible_user=root
+atc-docker02.dell-atc.lan
-atc-gpu-bart.dell-atc.lan ansible_user=root
+atc-gpu-bart.dell-atc.lan
-atc-gpu-mo1.dell-atc.lan ansible_user=root
+atc-gpu-mo1.dell-atc.lan
-atc-dns1.dell-atc.lan ansible_user=root
+# atc-dns1.dell-atc.lan
-atc-dns2.dell-atc.lan ansible_user=root
+# atc-dns2.dell-atc.lan
+
+[rhel]
+atc-mgt01.dell-atc.lan
+atc-gpu-bart.dell-atc.lan
+atc-nas.dell-atc.lan
+atc-gpu-bart.dell-atc.lan
 
 [nvidia]
-atc-gpu-bart.dell-atc.lan ansible_user=root
+atc-gpu-bart.dell-atc.lan
-atc-gpu-mo1.dell-atc.lan ansible_user=root
+atc-gpu-mo1.dell-atc.lan
 
 [rocky:children]
 servers

rhel.yml

@@ -0,0 +1,7 @@
+---
+- name: Automatic updates
+  hosts: rhel
+  tasks:
+    - name: dnf auto
+      include_tasks: tasks/dnf-auto.yml
+

tasks/dnf-auto.yml

@@ -0,0 +1,21 @@
+---
+- name: Change DNF Automatic
+  ansible.builtin.ini_file:
+    path: /etc/dnf/automatic.conf
+    section: "{{ item.section }}"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+    no_extra_spaces: true
+    backup: false
+  loop:
+    - { section: commands, option: apply_updates, value: "yes" }
+    - { section: commands, option: upgrade_type, value: "default" }
+    - { section: commands, option: download_updates, value: "yes" }
+    - { section: commands, option: random_sleep, value: "300" }
+    - { section: commands, option: reboot, value: "when-needed" }
+
+- name: Enable DNF Timer
+  ansible.builtin.systemd:
+    name: dnf-automatic.timer
+    state: started
+

tasks/hawser.yml

@@ -0,0 +1,53 @@
+---
+- name: Create hawser config dir
+  file:
+    path: /etc/hawser
+    state: directory
+    owner: root
+    group: root
+    mode: '0700'
+
+- name: Check if token file exists
+  ansible.builtin.stat:
+    path: /etc/hawser/token
+  register: token_file
+
+- name: Deploy hawser config
+  when: not token_file.stat.exists
+  block:
+    - name: Generate token
+      ansible.builtin.command: openssl rand -hex 32
+      register: hawser_token
+      changed_when: false
+    - name: Save token
+      copy:
+        content: "{{ hawser_token.stdout }}"
+        dest: /etc/hawser/token
+        mode: '0600'
+
+    - name: Save config
+      template:
+        src: templates/hawser-config
+        dest: /etc/hawser/config
+        owner: root
+        group: root
+        mode: '0600'
+  
+- name: Install hawser binary
+  copy:
+    src: bin/hawser
+    dest: /usr/local/bin/hawser
+    mode: '0755'
+
+- name: Setup Hawser service
+  template:
+    src: bin/hawser.service
+    dest: /etc/systemd/system/hawser.service
+    mode: '0644'
+
+- name: Enable Hawser
+  ansible.builtin.systemd:
+    name: hawser
+    state: started
+    enabled: yes
+

templates/docker-daemon.json

@@ -1,3 +1,3 @@
 {
-  "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"]
+  "hosts": ["unix:///var/run/docker.sock"]
 }

templates/hawser-config

@@ -0,0 +1,4 @@
+PORT=2376
+DOCKER_SOCKET=/var/run/docker.sock
+TOKEN={{ hawser_token.stdout }}
+