From 0261e875679f1bf63c8d689da7fc7e014597885d Mon Sep 17 00:00:00 2001 From: Stonewall Jackson Date: Sat, 4 Feb 2023 01:23:43 -0500 Subject: initial commit --- roles/linux_laptop/defaults/main.yml | 9 ++++ roles/linux_laptop/tasks/freeipa.yml | 33 ++++++++++++ roles/linux_laptop/tasks/main.yml | 58 ++++++++++++++++++++++ .../etc/sysconfig/network-scripts/ifcfg-ssid.j2 | 32 ++++++++++++ .../etc/sysconfig/network-scripts/keys-ssid.j2 | 1 + roles/linux_laptop/vars/main.yml | 6 +++ 6 files changed, 139 insertions(+) create mode 100644 roles/linux_laptop/defaults/main.yml create mode 100644 roles/linux_laptop/tasks/freeipa.yml create mode 100644 roles/linux_laptop/tasks/main.yml create mode 100644 roles/linux_laptop/templates/etc/sysconfig/network-scripts/ifcfg-ssid.j2 create mode 100644 roles/linux_laptop/templates/etc/sysconfig/network-scripts/keys-ssid.j2 create mode 100644 roles/linux_laptop/vars/main.yml (limited to 'roles/linux_laptop') diff --git a/roles/linux_laptop/defaults/main.yml b/roles/linux_laptop/defaults/main.yml new file mode 100644 index 0000000..adaa6b2 --- /dev/null +++ b/roles/linux_laptop/defaults/main.yml @@ -0,0 +1,9 @@ +linux_laptop_access_group: role-linux-desktop-access +linux_laptop_wifi_ssid: '{{ wifi_ssid }}' +linux_laptop_wifi_ip: '{{ ip }}' +linux_laptop_wifi_prefix: "{{ vlan.cidr | ansible.utils.ipaddr('prefix') }}" +linux_laptop_wifi_gateway: '{{ vlan.gateway }}' +linux_laptop_wifi_domain: '{{ ansible_domain }}' +linux_laptop_wifi_dns_servers: '{{ vlan.dns_servers }}' +linux_laptop_wlan_device: wlan0 +linux_laptop_dirty_writeback_centisecs: 6000 diff --git a/roles/linux_laptop/tasks/freeipa.yml b/roles/linux_laptop/tasks/freeipa.yml new file mode 100644 index 0000000..3c39bbf --- /dev/null +++ b/roles/linux_laptop/tasks/freeipa.yml @@ -0,0 +1,33 @@ +- name: create linux-laptops hostgroup + ipahostgroup: + ipaadmin_principal: '{{ ipa_user }}' + ipaadmin_password: '{{ ipa_pass }}' + name: '{{ linux_laptop_hbac_hostgroup}}' + description: Linux Laptops + host: "{{ groups[linux_laptop_hbac_hostgroup] | map('regex_replace', '$', '.' ~ ansible_domain) }}" + state: present + run_once: yes + +- name: create linux laptop access group + ipagroup: + ipaadmin_principal: '{{ ipa_user }}' + ipaadmin_password: '{{ ipa_pass }}' + name: '{{ linux_laptop_access_group }}' + nonposix: yes + state: present + run_once: yes + +- name: create HBAC rule for gdm + ipahbacrule: + ipaadmin_principal: '{{ ipa_user }}' + ipaadmin_password: '{{ ipa_pass }}' + name: allow_gdm_on_linux_laptops + description: Allow login to GDM on linux laptops + hostgroup: + - '{{ linux_laptop_hbac_hostgroup }}' + group: + - '{{ linux_laptop_access_group }}' + hbacsvc: + - gdm + - gdm-password + run_once: yes diff --git a/roles/linux_laptop/tasks/main.yml b/roles/linux_laptop/tasks/main.yml new file mode 100644 index 0000000..93f0862 --- /dev/null +++ b/roles/linux_laptop/tasks/main.yml @@ -0,0 +1,58 @@ +- import_tasks: freeipa.yml + +- name: request TLS certificate for wifi + include_role: + name: getcert_request + vars: + certificate_service: host + certificate_sans: ['{{ ansible_fqdn }}'] + certificate_path: '{{ linux_laptop_wifi_certificate_path }}' + certificate_key_path: '{{ linux_laptop_wifi_certificate_key_path }}' + certificate_key_passphrase: '{{ linux_laptop_wifi_certificate_key_passphrase }}' + +- name: get connection uuid + shell: nmcli --get-values connection.uuid connection show {{ linux_laptop_wifi_ssid }} || uuidgen + register: linux_laptop_wifi_networkmanager_uuid + changed_when: no + +- name: generate wifi network script + template: + src: etc/sysconfig/network-scripts/ifcfg-ssid.j2 + dest: /etc/sysconfig/network-scripts/ifcfg-{{ linux_laptop_wifi_ssid }} + register: linux_laptop_wifi_config + +- name: generate wifi keys file + template: + src: etc/sysconfig/network-scripts/keys-ssid.j2 + dest: /etc/sysconfig/network-scripts/keys-{{ linux_laptop_wifi_ssid }} + mode: 0600 + +- name: warn that wifi settings are not applied automatically + debug: + msg: >- + NOTE: WiFi has been configured in NetworkManager, but changes have not been + applied. Either restart NetworkManager or reboot the host. + when: linux_laptop_wifi_config.changed + +- name: disable nmi watchdog + sysctl: + name: kernel.nmi_watchdog + value: 0 + +- name: bump vm.dirty_writeback_centisecs + sysctl: + name: vm.dirty_writeback_centisecs + value: '{{ linux_laptop_dirty_writeback_centisecs }}' + +- name: enable wifi powersaving + copy: + content: | + options iwlwifi power_save=1 uapsd_disable=0 + options iwlmvm power_scheme=3 + dest: /etc/modprobe.d/iwlwifi.conf + +- name: enable audio powersaving + copy: + content: | + options snd_hda_intel power_save=1 + dest: /etc/modprobe.d/snd_hda_intel.conf diff --git a/roles/linux_laptop/templates/etc/sysconfig/network-scripts/ifcfg-ssid.j2 b/roles/linux_laptop/templates/etc/sysconfig/network-scripts/ifcfg-ssid.j2 new file mode 100644 index 0000000..3737699 --- /dev/null +++ b/roles/linux_laptop/templates/etc/sysconfig/network-scripts/ifcfg-ssid.j2 @@ -0,0 +1,32 @@ +ESSID={{ linux_laptop_wifi_ssid }} +MODE=Managed +KEY_MGMT=WPA-EAP +MAC_ADDRESS_RANDOMIZATION=never +TYPE=Wireless +IEEE_8021X_EAP_METHODS=TLS +IEEE_8021X_IDENTITY=anonymous +IEEE_8021X_CA_CERT={{ linux_laptop_wifi_certificate_ca_path }} +IEEE_8021X_PRIVATE_KEY={{ linux_laptop_wifi_certificate_key_path }} +IEEE_8021X_CLIENT_CERT={{ linux_laptop_wifi_certificate_path }} +PROXY_METHOD=none +BROWSER_ONLY=no +BOOTPROTO=none +IPADDR={{ linux_laptop_wifi_ip }} +PREFIX={{ linux_laptop_wifi_prefix }} +GATEWAY={{ linux_laptop_wifi_gateway }} +{% for server in linux_laptop_wifi_dns_servers %} +DNS{{ loop.index }}={{ server }} +{% endfor %} +DOMAIN={{ linux_laptop_wifi_domain }} +DEFROUTE=yes +IPV4_FAILURE_FATAL=yes +IPV6INIT=yes +IPV6_AUTOCONF=yes +IPV6_DEFROUTE=yes +IPV6_FAILURE_FATAL=no +IPV6_ADDR_GEN_MODE=stable-privacy +NAME={{ linux_laptop_wifi_ssid }} +UUID={{ linux_laptop_wifi_networkmanager_uuid.stdout }} +DEVICE={{ linux_laptop_wlan_device }} +ONBOOT=yes +MACADDR=permanent diff --git a/roles/linux_laptop/templates/etc/sysconfig/network-scripts/keys-ssid.j2 b/roles/linux_laptop/templates/etc/sysconfig/network-scripts/keys-ssid.j2 new file mode 100644 index 0000000..31c61a6 --- /dev/null +++ b/roles/linux_laptop/templates/etc/sysconfig/network-scripts/keys-ssid.j2 @@ -0,0 +1 @@ +IEEE_8021X_PRIVATE_KEY_PASSWORD={{ linux_laptop_wifi_certificate_key_passphrase }} diff --git a/roles/linux_laptop/vars/main.yml b/roles/linux_laptop/vars/main.yml new file mode 100644 index 0000000..d02e644 --- /dev/null +++ b/roles/linux_laptop/vars/main.yml @@ -0,0 +1,6 @@ +linux_laptop_wifi_certificate_path: /etc/pki/tls/certs/wifi-{{ ansible_fqdn }}.crt +linux_laptop_wifi_certificate_key_path: /etc/pki/tls/private/wifi-{{ ansible_fqdn }}.key +linux_laptop_wifi_certificate_ca_path: /etc/ipa/ca.crt +linux_laptop_wifi_certificate_key_passphrase: just_have_to_use_something_or_networkmanger_freaks_out + +linux_laptop_hbac_hostgroup: linux_laptops -- cgit