path: root/blackbird.yml

---
- hosts: blackbird
  remote_user: root
  tasks:
    - name: Téléchargement du dépôt RPMFusion Free
      get_url: dest=/tmp/rpmfusion-free-release-stable.noarch.rpm  url=http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-stable.noarch.rpm

    - name: Installation du dépôt RPMFusion Free
      yum: pkg=/tmp/rpmfusion-free-release-stable.noarch.rpm state=installed

    - name: Téléchargement du dépôt RPMFusion NonFree
      get_url: dest=/tmp/rpmfusion-nonfree-release-stable.noarch.rpm url=http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-stable.noarch.rpm

    - name: Installation du dépôt RPMFusion NonFree
      yum: pkg=/tmp/rpmfusion-nonfree-release-stable.noarch.rpm state=installed

    - name: Installation du miroir updates
      copy: src=files/updates-fantom.repo dest=/etc/yum.repos.d/updates-fantom.repo

    - name: Désactivation du dépôt Updates
      lineinfile: dest=/etc/yum.repos.d/fedora-updates.repo state=present backrefs=yes regexp="^enabled=1"
                  line="enabled=0"

    - name: Installation du miroir updates-testing
      copy: src=files/updates-testing-fantom.repo dest=/etc/yum.repos.d/updates-testing-fantom.repo

    - name: Installation de mon autorité de certification
      copy: src=files/root.pem dest=/etc/pki/ca-trust/source/anchors/root.pem mode=444

    - name: Installation de l'autorité de certification CACert
      copy: src=files/cacert.pem dest=/etc/pki/ca-trust/source/anchors/cacert.pem mode=444

    - name: Mise à jour de la base de confiance CA
      command: /usr/bin/update-ca-trust

    - name: Mise à jour des tous les paquets installés
      yum: name=* state=latest

    - name: Installation du groupe de paquets KDE
      yum: name="@KDE Plasma Workspaces" state=present

    - name: Installation des paquets de base
      yum: name={{ item }} state=present
      with_items:
        - yum-plugin-fastestmirror
        - yum-plugin-verify
        - elinks
        - mutt
        - irssi
        - fetchmail
        - procmail
        - glances
        - paman
        - msmtp
        - mplayer
        - gparted
        - gstreamer-ffmpeg
        - gstreamer-plugins-bad
        - rpm-sign
        - terminator
        - gstreamer-plugins-ugly
        - pavucontrol
        - pavumeter
        - tmux
        - pulseaudio-equalizer
        - pulsecaster
        - conky
        - livecd-tools
        - l10n-kickstarts
        - apg
        - i7z
        - dnf
        - ffmpeg
        - lm_sensors
        - hddtemp
        - dconf-editor
        - istanbul
        - htop
        - ntop
        - iotop
        - liferea
        - iftop
        - powertop
        - mcabber
        - arora
        - avidemux
        - bleachbit
        - bless
        - ghex
        - pitivi
        - epiphany
        - liveusb-creator
        - bvi
        - easybashgui
        - ftop
        - fedora-review
        - guake
        - gajim
        - mypaint
        - gnome-tweak-tool
        - quassel
        - thunderbird
        - vlc
        - btrfs-progs
        - zbar
        - screen
        - supybot-meetbot
        - memtest86+
        - systemd-analyze
        - pungi
        - gitg
        - gdisk
        - youtube-dl
        - gnome-shell-extension-user-theme
        - sparse
        - conglomerate
        - rfkill
        - ksysguardd
        - kdenlive
        - emacs
        - emacs-nox
        - xmined
        - xinput_calibrator
        - ldc-phobos-devel
        - gtk-recordmydesktop
        - cclive
        - stellarium
        - OpenStego
        - Xnee
        - cnee
        - kernel-tools
        - dnstracer
        - mock-rpmfusion-free
        - audacity-freeworld
        - openshot
        - asterisk-gui
        - ldc-phobos-geany-tags
        - vidalia
        - boinc-manager
        - rpmconf
        - geany-plugins-addons
        - geany-plugins-geniuspaste
        - colordiff
        - gnome-schedule
        - gshutdown
        - gstreamer1-libav
        - aspell-fr
        - gstreamer1-plugins-bad-free-extras
        - gstreamer1-plugins-bad-freeworld
        - gstreamer1-plugins-good-extras
        - gstreamer1-plugins-ugly
        - gimp-help-fr
        - hunspell-fr
        - libreoffice-langpack-fr
        - pbzip2
        - pxz
        - poezio
        - realcrypt
        - argus
        - dnsenum
        - dsniff
        - etherape
        - ettercap
        - aircrack-ng
        - firewalk
        - hping3
        - hunt
        - iptraf
        - lynis
        - nbtscan
        - nc
        - nc6
        - ncrack
        - ngrep
        - nmap
        - nmap-frontend
        - p0f
        - packETH
        - pcapdiff
        - scapy
        - sing
        - socat
        - ssldump
        - tcpdump
        - tcpjunk
        - tcpxtract
        - unicornscan
        - xprobe2
        - yersinia
        - afftools
        - dc3dd
        - ddrescue
        - examiner
        - foremost
        - hexedit
        - scanmem
        - sleuthkit
        - srm
        - testdisk
        - unhide
        - httping
        - lbd
        - nikto
        - ratproxy
        - skipfish
        - sqlninja
        - airsnort
        - kismet
        - wavemon
        - weplab
        - flawfinder
        - pscan
        - rats
        - splint
        - chkrootkit
        - labrea
        - nebula
        - pads
        - john
        - medusa
        - ophcrack
        - wireshark
        - wireshark-gnome
        - nessus-gui
        - arpwatch
        - tcpflow
        - sectool
        - unicornscan
        - net-tools
        - intrace
        - conntrack-tools
        - bind-utils
        - steghide
        - binutils
        - macchanger
        - cryptkeeper
        - ecryptfs-utils
        - ettercap-gtk
        - whois
        - postfix
        - aide
        - gstreamer-plugin-crystalhd
        - gstreamer1-vaapi
        - virt-manager

    - name: Configuration yum sans delta rpm
      lineinfile: dest=/etc/yum.conf create=yes state=present insertafter="installonly_limit"
                  line="deltarpm=0"

    - name: Configuration yum affichage historique
      lineinfile: dest=/etc/yum.conf create=yes state=present insertafter="deltarpm=0"
                  line="history_list_view=cmds"

    - name: Configuration yum clean on remove
      lineinfile: dest=/etc/yum.conf create=yes state=present insertafter="history_list_view=cmds"
                  line="clean_requirements_on_remove=1"

    - name: Configuration écran rabattu systemd
      lineinfile: dest=/etc/systemd/logind.conf create=yes state=present insertafter="#HandleLidSwitch"
                  line="HandleLidSwitch=ignore"
      notify: reload systemd

    - name: Squelette bashrc
      copy: src="files/bashrc" dest=/etc/skel/.bashrc mode=644

    - name: Root bashrc
      copy: src="files/bashrc" dest=/root/.bashrc mode=644

    - name: Squelette emacs rc
      copy: src="files/emacs.rc" dest=/etc/skel/.emacs mode=644

    - name: Root emacs rc
      copy: src="files/emacs.rc" dest=/root/.emacs mode=644

    - name: Télécharge le paquet linux_logo fedora pour F20
      get_url: dest=/tmp/linux_logo.rpm url=http://fantom.fedorapeople.org/linux_logo-5.11-6.fc20.x86_64.rpm
      when: ansible_distribution_version|int == 20 and ansible_architecture == "x86_64"

    - name: Télécharge le paquet linux_logo fedora pour F21
      get_url: dest=/tmp/linux_logo.rpm url=http://fantom.fedorapeople.org/linux_logo-5.11-6.fc21.x86_64.rpm
      when: ansible_distribution_version|int == 21 and ansible_architecture == "x86_64"

    - name: Installe le paquet linux_logo fedora
      yum: pkg=/tmp/linux_logo.rpm state=installed

    - name: Ajoute le paquet linux_logo fedora en Exclude
      lineinfile: dest=/etc/yum.conf create=yes state=present insertafter="history_list_view=cmds"
                  line="exclude=linux_logo"

    - name: Installation de la clé ssh pour l'utilisateur root
      authorized_key: user=root key="{{lookup('file', 'files/id_rsa.pub') }}" manage_dir=yes

    - name: Configuration du démon SSH
      lineinfile: dest=/etc/ssh/sshd_config state=present backrefs=yes regexp="^PasswordAuthentication yes"
                  line="PasswordAuthentication no"
      notify: restart sshd

    - name: Serveurs NTP 0.fedora.pool.ntp.org désactivé
      lineinfile: dest=/etc/chrony.conf state=present backrefs=yes regexp="^server 0.fedora.pool.ntp.org"
                  line="#server 0.fedora.pool.ntp.org"
      notify: restart chrony

    - name: Serveurs NTP 1.fedora.pool.ntp.org désactivé
      lineinfile: dest=/etc/chrony.conf state=present backrefs=yes regexp="^server 1.fedora.pool.ntp.org"
                  line="#server 1.fedora.pool.ntp.org"
      notify: restart chrony

    - name: Serveurs NTP 2.fedora.pool.ntp.org désactivé
      lineinfile: dest=/etc/chrony.conf state=present backrefs=yes regexp="^server 2.fedora.pool.ntp.org"
                  line="#server 2.fedora.pool.ntp.org"
      notify: restart chrony

    - name: Serveurs NTP 3.fedora.pool.ntp.org désactivé
      lineinfile: dest=/etc/chrony.conf state=present backrefs=yes regexp="^server 3.fedora.pool.ntp.org"
                  line="#server 3.fedora.pool.ntp.org"
      notify: restart chrony

    - name: Configuration serveur NTP actif
      lineinfile: dest=/etc/chrony.conf create=yes state=present insertafter="#server 3.fedora.pool.ntp.org"
                  line="server ntp1.casperlefantom.net iburst"
      notify: restart chrony

    - name: État du service postfix
      service: name=postfix state=started enabled=yes

    - name: Configuration cron rapport disques durs
      copy: src=files/diskreport.sh dest=/etc/cron.daily/diskreport.sh mode=755

    - name: Configuration cron rapport SELinux
      copy: src=files/eaureport.sh dest=/etc/cron.daily/eaureport.sh mode=755

    - name: Configuration cron rapport RPM Verify
      copy: src=files/rpmreport.sh dest=/etc/cron.daily/rpmreport.sh mode=755

    - name: Configuration cron relabel système de fichier
      copy: src=files/selinuxresto.sh dest=/etc/cron.monthly/selinuxresto.sh mode=755

    - name: Configuration cron tests disques durs
      copy: src=files/diskcheck.sh dest=/etc/cron.weekly/diskcheck.sh mode=755

    - name: Configuration cron utilisateur casper
      copy: src=files/crontab dest=/var/spool/cron/casper mode=600

    - name: Configuration sysctl de la swap
      copy: src=files/swapwait.conf dest=/etc/sysctl.d/swapwait.conf mode=644

    - name: Configuration sudo pour l'utilisateur casper
      copy: src=files/sudo dest=/etc/sudoers.d/blackbird mode=440

    - name: Installation du HIDS AIDE
      copy: src=files/z-aidereport.sh dest=/etc/cron.daily/z-aidereport.sh mode=755
      notify: initialize aide

    - name: Configuration de la variable EDITOR
      lineinfile: dest=/root/bin/setvars create=yes state=present
                  line="export EDITOR='emacs -nw'"

    - name: Ajout des points de montage des disques virtuels NFS
      file: name=/mnt/nfs1/ state=directory

    - name: Point de montage nfs2
      file: name=/mnt/nfs2/ state=directory

    - name: Point de montage nfs3
      file: name=/mnt/nfs3/ state=directory

    - name: Point de montage nfs4
      file: name=/mnt/nfs4/ state=directory

    - name: Point de montage lv1
      file: name=/mnt/lv1/ state=directory

    - name: Point de montage lv2
      file: name=/mnt/lv2/ state=directory

    - name: Point de montage lv3
      file: name=/mnt/lv3/ state=directory

    - name: Point de montage lv4
      file: name=/mnt/lv4/ state=directory

    - name: Point de montage usb1
      file: name=/mnt/usb1/ state=directory

    - name: Point de montage usb2
      file: name=/mnt/usb2/ state=directory

    - name: Point de montage usb3
      file: name=/mnt/usb3/ state=directory

    - name: Point de montage usb4
      file: name=/mnt/usb4/ state=directory

    - name: Configuration montage auto fstab
      lineinfile: dest=/etc/fstab create=yes state=present insertafter=EOF
                  line="lancaster.casperlefantom.net:/mnt/nfs1/ /mnt/nfs1/ nfs4 defaults,sync,_netdev 0 0"
      notify: mount all

    - name: État du service boinc-client
      service: name=boinc-client state=started enabled=yes

    - name: Désactivation de Prelink
      lineinfile: dest=/etc/sysconfig/prelink state=present backrefs=yes regexp="^PRELINKING=yes"
                  line="PRELINKING=no"
      notify: prelink undo

    - name: Redirection du courrier de root
      lineinfile: "dest=/etc/aliases create=yes state=present insertafter=EOF
                  line='root: casper'"
      notify: newaliases db

    - name: Configuration de Postfix
      lineinfile: dest=/etc/postfix/main.cf create=yes state=present insertafter='#mailbox_command'
                  line='mailbox_command = /usr/bin/procmail -a "$EXTENSION"'
      notify: reload postfix



  handlers:
    - name: restart sshd
      service: name=sshd state=restarted

    - name: initialize aide
      script: files/aideinit.sh

    - name: restart chrony
      service: name=chronyd state=restarted

    - name: reload systemd
      command: /usr/bin/systemctl --system daemon-reload

    - name: mount all
      command: /usr/bin/mount -a

    - name: prelink undo
      command: /usr/sbin/prelink -ua

    - name: newaliases db
      command: /usr/bin/newaliases

    - name: reload postfix
      service: name=postfix state=reloaded