Upgrade auf Ubuntu 20.04 (#29)

* postgres-update für 2004

* Rolle Create USers entfernt, Nutzer wird jetzt durch nickjj.ansible_user erstellt

* Reihenfolge Tasks angepasst

* Rolle create_users angepasst

* wip

* linter

* github Actions Version angepasst

* Rolle geerlingguy.ansible hinzugefügt

* neue Ansible Version

* Version github actions

.ansible-lint

@@ -10,6 +10,8 @@ quiet: true
 skip_list:
   - '204'
   - '701'
+  - '208'
+  - '106'
 use_default_rules: true
 verbosity: 0
 # https://github.com/ansible/ansible-lint#false-positives-skipping-rules

.github/workflows/ansible-lint.yml

@@ -28,8 +28,8 @@ jobs:
         # Arguments to override a package and its version to be set explicitly.
         # Must follow the example syntax.
         override-deps: |
-          ansible==2.9
-          ansible-lint==4.2.0
+          ansible==2.10
+          ansible-lint==4.3.5
         # [optional]
         # Arguments to be passed to the ansible-lint
 

inventories/group_vars/all.yml

@@ -19,8 +19,9 @@
   ssh_user: mg
   ssh_pubkey: "{{ lookup('keepass', 'ssh_pubkey', 'password') }}"
   ### mgrote.create_users
-  base_users:
-    - { name: 'mg', password: 'hallowelt', groups: 'sudo, ssh'}
+  create_user_name: 'mg'
+  create_user_password: 'hallowelt'
+  create_user_groups: 'sudo, ssh'
   ### mgrote.tmux
   tmux_conf_destination: "/home/mg/.tmux.conf"
   tmux_bashrc_destination: "/home/mg/.bashrc"

inventories/group_vars/ansible.yml

@@ -1,5 +1,8 @@
 ---
   ### geerlingguy.pip
+  pip_package: python3-pip
   pip_install_packages:
     # Specify names and versions.
     - name: pykeepass
+  ### geerlingguy.ansible
+  ansible_install_method: pip

playbooks/base/1_bootstrap.yml

@@ -9,18 +9,18 @@
       - { role: nickjj.ansible-user, tags: "ansible-user" }
 
     vars:
+      ### reobertdebock.bootstrap
+      bootstrap_user: mg
+      bootstrap_wait_for_host: no
+      bootstrap_timeout: 3
+      bootstrap_retries: 3
       ### fuer rolle nickjj.ansible-user
       user_name: "ansible-user"
       user_generate_ssh_key: true
       user_local_ssh_key_path: "~/.ssh/id_rsa.pub"
       user_enable_passwordless_sudo: True
       ### ansible
-      ansible_user: "mg" # Hier ändern wenn ein anderer Nutzer für die Erstanmeldung verwendet werden soll.
-      ansible_password: "hallowelt"
-      ansible_become_password: "hallowelt"
+#     ansible_user: "ansible-user"
+#     ansible_password: "hallowelt"
+#     ansible_become_password: "hallowelt"
       ansible_ssh_common_args: "'-o StrictHostKeyChecking=no'"
-      ### reobertdebock.bootstrap
-      bootstrap_user: mg
-      bootstrap_wait_for_host: no
-      bootstrap_timeout: 3
-      bootstrap_retries: 3

playbooks/base/4_create_user.yml

@@ -1,5 +1,12 @@
 ---
-  - hosts: all
+  - hosts: docker
     roles:
+      - { role: mgrote.create_users, tags: "user", become: yes }
       - { role: mgrote.deploy_ssh_keys, tags: "ssh", become: yes }
-      - { role: mgrote.create_users, tags: "users" }
+
+    vars:
+      ### fuer rolle nickjj.ansible-user
+      user_name: "mg"
+      user_generate_ssh_key: true
+      user_local_ssh_key_path: "~/.ssh/id_rsa.pub"
+      user_enable_passwordless_sudo: True

playbooks/on-off/user.yml

@@ -0,0 +1,5 @@
+---
+- hosts: docker
+  become: yes
+  roles:
+    - { role: mgrote.create_users }

playbooks/service/ansible.yml

@@ -1,5 +1,5 @@
 ---
 - hosts: ansible
   roles:
-    - { role: mgrote.ansible, tags: "ansible_host" }
     - { role: geerlingguy.pip, tags: "pip", become: true }
+    - { role: geerlingguy.ansible, tags: "ansible" }

roles/geerlingguy.ansible/.ansible-lint

@@ -0,0 +1,2 @@
+skip_list:
+  - '106'

roles/geerlingguy.ansible/.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+---
+github: geerlingguy
+patreon: geerlingguy

roles/geerlingguy.ansible/.github/stale.yml

@@ -0,0 +1,56 @@
+# Configuration for probot-stale - https://github.com/probot/stale
+
+# Number of days of inactivity before an Issue or Pull Request becomes stale
+daysUntilStale: 90
+
+# Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
+# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
+daysUntilClose: 30
+
+# Only issues or pull requests with all of these labels are check if stale. Defaults to `[]` (disabled)
+onlyLabels: []
+
+# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable
+exemptLabels:
+  - pinned
+  - security
+  - planned
+
+# Set to true to ignore issues in a project (defaults to false)
+exemptProjects: false
+
+# Set to true to ignore issues in a milestone (defaults to false)
+exemptMilestones: false
+
+# Set to true to ignore issues with an assignee (defaults to false)
+exemptAssignees: false
+
+# Label to use when marking as stale
+staleLabel: stale
+
+# Limit the number of actions per hour, from 1-30. Default is 30
+limitPerRun: 30
+
+pulls:
+  markComment: |-
+    This pull request has been marked 'stale' due to lack of recent activity. If there is no further activity, the PR will be closed in another 30 days. Thank you for your contribution!
+
+    Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark pull requests as stale.
+
+  unmarkComment: >-
+    This pull request is no longer marked for closure.
+
+  closeComment: >-
+    This pull request has been closed due to inactivity. If you feel this is in error, please reopen the pull request or file a new PR with the relevant details.
+
+issues:
+  markComment: |-
+    This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!
+
+    Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark issues as stale.
+
+  unmarkComment: >-
+    This issue is no longer marked for closure.
+
+  closeComment: >-
+    This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.

roles/geerlingguy.ansible/.gitignore

@@ -0,0 +1,3 @@
+*.retry
+*/__pycache__
+*.pyc

roles/geerlingguy.ansible/.travis.yml

@@ -0,0 +1,38 @@
+---
+language: python
+services: docker
+
+env:
+  global:
+    - ROLE_NAME: ansible
+  matrix:
+    - MOLECULE_DISTRO: centos8
+    - MOLECULE_DISTRO: fedora32
+    # See: https://github.com/geerlingguy/ansible-role-ansible/issues/18
+    # - MOLECULE_DISTRO: ubuntu2004
+    - MOLECULE_DISTRO: ubuntu1804
+    - MOLECULE_DISTRO: debian10
+
+    - MOLECULE_DISTRO: centos8
+      MOLECULE_PLAYBOOK: playbook-pip.yml
+
+before_install:
+  # Upgrade Docker to work with docker-py.
+  - curl https://gist.githubusercontent.com/geerlingguy/ce883ad4aec6a5f1187ef93bd338511e/raw/36612d28981d92863f839c5aefe5b7dd7193d6c6/travis-ci-docker-upgrade.sh | sudo bash
+
+install:
+  # Install test dependencies.
+  - pip install molecule yamllint ansible-lint docker
+
+before_script:
+  # Use actual Ansible Galaxy role name for the project directory.
+  - cd ../
+  - mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
+  - cd geerlingguy.$ROLE_NAME
+
+script:
+  # Run tests.
+  - molecule test
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/geerlingguy.ansible/.yamllint

@@ -0,0 +1,10 @@
+---
+extends: default
+
+rules:
+  line-length:
+    max: 120
+    level: warning
+
+ignore: |
+  .github/stale.yml

roles/geerlingguy.ansible/LICENSE

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Jeff Geerling
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

roles/geerlingguy.ansible/README.md

@@ -0,0 +1,51 @@
+# Ansible Role: Ansible
+
+[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-ansible.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-ansible)
+
+An Ansible Role that installs Ansible on Linux servers.
+
+## Requirements
+
+If using on a RedHat/CentOS-based host, make sure you've added the EPEL repository (it can easily be installed by including the `geerlingguy.repo-epel` role on Ansible Galaxy).
+
+## Role Variables
+
+Available variables are listed below, along with default values (see `defaults/main.yml`):
+
+    ansible_install_method: package
+
+Whether to install Ansible via the system `package` manager (`apt`, `yum`, `dnf`, etc.), or via `pip`. If set to `pip`, you need to make sure Pip is installed prior to running this role. You can use the `geerlingguy.pip` module to install Pip easily.
+
+    ansible_install_version_pip: ''
+
+If `ansible_install_method` is set to `pip`, the specific Ansible version to be installed via Pip. If not set, the latest version of Ansible will be installed.
+
+## Dependencies
+
+None.
+
+## Example Playbook
+
+Install from the system package manager:
+
+    - hosts: servers
+      roles:
+        - role: geerlingguy.ansible
+
+Install from pip:
+
+    - hosts: servers
+      vars:
+        ansible_install_method: pip
+        ansible_install_version_pip: "2.7.0"
+      roles:
+        - role: geerlingguy.pip
+        - role: geerlingguy.ansible
+
+## License
+
+MIT / BSD
+
+## Author Information
+
+This role was created in 2014 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

roles/geerlingguy.ansible/defaults/main.yml

@@ -0,0 +1,8 @@
+---
+ansible_default_release: ""
+
+# Valid options include: 'package' or 'pip'.
+ansible_install_method: package
+
+# Used only if ansible_install_method is 'pip'. If empty, defaults to latest.
+ansible_install_version_pip: ''

roles/geerlingguy.ansible/meta/main.yml

@@ -0,0 +1,29 @@
+---
+dependencies: []
+
+galaxy_info:
+  author: geerlingguy
+  description: Ansible for RedHat/CentOS/Debian/Ubuntu.
+  company: "Midwestern Mac, LLC"
+  license: "license (BSD, MIT)"
+  min_ansible_version: 2.4
+  platforms:
+    - name: EL
+      versions:
+        - all
+    - name: Fedora
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
+  galaxy_tags:
+    - system
+    - packaging
+    - development
+    - cloud
+    - ansible
+    - automation

roles/geerlingguy.ansible/molecule/default/converge.yml

@@ -0,0 +1,12 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=true cache_valid_time=300
+      when: ansible_os_family == 'Debian'
+
+  roles:
+    - role: geerlingguy.ansible

roles/geerlingguy.ansible/molecule/default/molecule.yml

@@ -0,0 +1,21 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint: |
+  set -e
+  yamllint .
+  ansible-lint
+platforms:
+  - name: instance
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  playbooks:
+    converge: ${MOLECULE_PLAYBOOK:-converge.yml}

roles/geerlingguy.ansible/molecule/default/playbook-pip.yml

@@ -0,0 +1,12 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+
+  vars:
+    ansible_install_method: pip
+    ansible_install_version_pip: "2.6.2"
+
+  roles:
+    - role: geerlingguy.pip
+    - role: geerlingguy.ansible

roles/geerlingguy.ansible/molecule/default/requirements.yml

@@ -0,0 +1,2 @@
+---
+- role: geerlingguy.pip

roles/geerlingguy.ansible/tasks/main.yml

@@ -0,0 +1,34 @@
+---
+- name: Set the package state based on how Ansible is installed.
+  set_fact:
+    ansible_package_state: "{{ 'present' if ansible_install_method == 'package' else 'absent' }}"
+
+# Setup/install tasks.
+- name: Set up Ansible on RedHat.
+  include_tasks: setup-RedHat.yml
+  when:
+    - ansible_os_family == 'RedHat'
+    - ansible_distribution != 'Fedora'
+    - ansible_install_method == 'package'
+
+- name: Set up Ansible on Fedora.
+  include_tasks: setup-Fedora.yml
+  when:
+    - ansible_distribution == 'Fedora'
+    - ansible_install_method == 'package'
+
+- name: Set up Ansible on Ubuntu.
+  include_tasks: setup-Ubuntu.yml
+  when:
+    - ansible_distribution == 'Ubuntu'
+    - ansible_install_method == 'package'
+
+- name: Set up Ansible on Debian.
+  include_tasks: setup-Debian.yml
+  when:
+    - ansible_distribution == 'Debian'
+    - ansible_install_method == 'package'
+
+- name: Set up Ansible using Pip.
+  include_tasks: setup-pip.yml
+  when: ansible_install_method == 'pip'

roles/geerlingguy.ansible/tasks/setup-Debian.yml

@@ -0,0 +1,21 @@
+---
+- name: Enable Backports repository.
+  apt_repository:
+    repo: >-
+      deb http://ftp.debian.org/debian
+      {{ ansible_distribution_release }}-backports main'
+    state: present
+    filename: "{{ ansible_distribution_release }}_backports"
+    update_cache: true
+  when: ansible_distribution_version | int < 9
+
+- name: Set the default_release option for older Debian versions.
+  set_fact:
+    ansible_default_release: "{{ ansible_distribution_release }}-backports"
+  when: ansible_distribution_version | int < 9
+
+- name: Install Ansible.
+  apt:
+    name: ansible
+    state: "{{ ansible_package_state }}"
+    default_release: "{{ ansible_default_release }}"

roles/geerlingguy.ansible/tasks/setup-Fedora.yml

@@ -0,0 +1,5 @@
+---
+- name: Install Ansible.
+  package:
+    name: ansible
+    state: "{{ ansible_package_state }}"

roles/geerlingguy.ansible/tasks/setup-RedHat.yml

@@ -0,0 +1,6 @@
+---
+- name: Install Ansible.
+  package:
+    name: ansible
+    state: "{{ ansible_package_state }}"
+    enablerepo: epel

roles/geerlingguy.ansible/tasks/setup-Ubuntu.yml

@@ -0,0 +1,15 @@
+---
+- name: Ensure dirmngr is installed (gnupg dependency).
+  apt:
+    name: dirmngr
+    state: present
+
+- name: Add ansible repository.
+  apt_repository:
+    repo: 'ppa:ansible/ansible'
+    update_cache: true
+
+- name: Install Ansible.
+  apt:
+    name: ansible
+    state: "{{ ansible_package_state }}"

roles/geerlingguy.ansible/tasks/setup-pip.yml

@@ -0,0 +1,5 @@
+---
+- name: Install Ansible via Pip.
+  pip:
+    name: ansible
+    version: "{{ ansible_install_version_pip | default(omit) }}"

roles/mgrote.ansible/tasks/main.yml

@@ -1,18 +1,3 @@
-  - name: ansible installieren
-    become: yes
-    apt:
-      name:
-        - ansible
-        - yamllint
-      state: present
-
-  - name: ansible-lint und yaml-lint installieren
-    become: yes
-    pip:
-      name:
-        - ansible-lint
-      state: present
-
   # pykeepass wird durch geerlingguy.pip mit installiert
   # https://github.com/viczem/ansible-keepass#readme
   - name: create ~/.ansible/plugins/lookup

roles/mgrote.create_users/README.md

@@ -8,5 +8,6 @@ erstellt Nutzer.
 
 ### Variablen + Defaults
 ##### Nutzer anlegen
-base_users:
-    - { name: 'mg', password: 'hallowelt', groups: 'sudo, ssh'}
+  create_user_name: 'mg'
+  create_user_password: 'hallowelt'
+  create_user_groups: 'sudo, ssh'

roles/mgrote.create_users/defaults/main.yml

@@ -1,3 +1,4 @@
 ---
-  base_users:
-    - { name: 'mg', password: 'hallowelt', groups: 'sudo, ssh'}
+  create_user_name: 'mg'
+  create_user_password: 'hallowelt'
+  create_user_groups: 'sudo, ssh'

roles/mgrote.create_users/tasks/main.yml

@@ -1,37 +1,25 @@
   - name: Erstelle Nutzer
     become: yes
     user:
-      name: "{{ item.name }}"
-      groups: "{{ item.groups }}"
+      name: "{{ create_user_name }}"
+      groups: "{{ create_user_groups }}"
       state: present
       shell: /bin/bash
-      password: "{{ item.password | password_hash('sha512') }}"
+      password: "{{ create_user_password | password_hash('sha512') }}"
       update_password: on_create
-    loop: "{{ base_users }}"
-    no_log: true
-
-#  - name: check if sudo file exists
-#    become: yes
-#    stat:
-#      path: "/home/{{ item.name }}/.sudo_as_admin_successful"
-#    loop: "{{ base_users }}"
 #    no_log: true
-#    register: "sudo_as_admin_successful_existiert"
 
-#  - name: dbug
-#    debug:
-#      msg: "{{ sudo_as_admin_successful_existiert }}"
+
 
   - name: touch ".sudo_as_admin_successful"
     become: yes
 #    when: sudo_as_admin_successful_existiert.stat.exists == False
     file:
-      path: /home/{{ item.name }}/.sudo_as_admin_successful
+      path: /home/{{ create_user_name }}/.sudo_as_admin_successful
       state: touch
       access_time: preserve
       modification_time: preserve
-    loop: "{{ base_users }}"
-    no_log: true
+#    no_log: true
     # entfernt:
     # To run a command as administrator (user "root"), use "sudo <command>".
     # See "man sudo_root" for details.
@@ -41,6 +29,13 @@
     become: yes
     template:
       src: ".selected_editor"
-      dest: "/home/{{ item.name }}/.selected_editor"
-    loop: "{{ base_users }}"
-    no_log: true
+      dest: "/home/{{ create_user_name }}/.selected_editor"
+#    no_log: true
+
+  # Validate the sudoers file before saving
+  - name: set sudo without  password
+    become: yes
+    template:
+      src: sudoers
+      dest: /etc/sudoers.d/{{ create_user_name }}
+#    no_log: true

roles/mgrote.create_users/templates/sudoers

@@ -0,0 +1 @@
+%{{ create_user_name }} ALL=(ALL) NOPASSWD:ALL

roles/mgrote.postgresql/defaults/main.yml

@@ -2,12 +2,11 @@
 postgres_programme:
   - postgresql
   - libpq5
-  - postgresql-10
-  - postgresql-client-10
+  - postgresql-12
+  - postgresql-client-12
   - postgresql-client-common
   - postgresql-contrib
   - curl
   - gnupg
   - libpq-dev
-  - python-psycopg2
   - python3-psycopg2