Use simpler file structure

.gitlab-ci.yml

@@ -3,40 +3,24 @@ stages:
   - test
 
 cache:
-  key: "$CI_COMMIT_REF_SLUG"
+  key: $CI_COMMIT_REF_SLUG
   paths:
     - .cache/pip
     - node_modules/
 
 lint:
-  stage: lint
-  image: python:3.7
-  before_script:
-    - pip install ansible ansible-lint --quiet
-  script:
-    - ansible-lint playbook.yml
-  only:
-    refs:
-      - development
-      - merge_requests
-
-pretty-lint:
   stage: lint
   image: node:12
   before_script:
-    - npm install
+    - npm install prettier --no-save
   script:
-    - npx prettier "**/*.yml" --check
-  only:
-    refs:
-      - development
-      - merge_requests
+    - npx prettier '**/*.yml' --check
 
 syntax-test:
   stage: test
   image: python:3.7
   before_script:
-    - pip install ansible ansible-lint --quiet
+    - pip install ansible --quiet
     - ansible-galaxy install -r roles/requirements.yml
   script:
     - ansible-playbook playbook.yml --syntax-check

.prettierrc.yml

@@ -0,0 +1,5 @@
+singleQuote: true
+printWidth: 90
+tabWidth: 2
+useTabs: false
+bracketSpacing: true

playbook.yml

@@ -1,3 +1,31 @@
 - hosts: localhost
+  pre_tasks:
+    - name: install shared packages
+      become: yes
+      pacman:
+        name: '{{ packages }}'
+    - name: detecting platform
+      import_tasks: 'tasks/platform.yml'
+    - name: install platform specific packages
+      become: yes
+      pacman:
+        name: '{{ platform_packages }}'
   roles:
-    - arch
+    - common
+  tasks:
+    - import_tasks: 'tasks/setup.yml'
+    - import_tasks: 'tasks/network.yml'
+    - import_tasks: 'tasks/systemd.yml'
+    - import_tasks: 'tasks/openvpn.yml'
+    - import_tasks: 'tasks/git.yml'
+    - import_tasks: 'tasks/mpv.yml'
+    - import_tasks: 'tasks/mpd.yml'
+    - import_tasks: 'tasks/syncthing.yml'
+    - import_tasks: 'tasks/timer.yml'
+  handlers:
+    - import_tasks: 'handlers.yml'
+  vars_files:
+    - 'vars/main.yml'
+    - 'vars/gpg.yml'
+    - 'vars/vpn.yml'
+    - 'vars/mpd.yml'

roles/.gitignore

@@ -1,6 +0,0 @@
-# ignore all external roles and files in the roles dir
-/*
-
-!.gitignore
-!requirements.yml
-!arch*/

roles/arch/meta/main.yml

@@ -1,13 +0,0 @@
-dependencies:
-  - common
-
-galaxy_info:
-  author: sonny
-  description: "Sets up an arch environment"
-  license: "license GPLv3"
-  min_ansible_version: 2.7
-  issue_tracker_url: "https://git.fudiggity.nl/ansible/arch-setup/issues"
-  platforms:
-    - name: Archlinux
-  galaxy_tags:
-    - system

roles/arch/tasks/git.yml

@@ -1,30 +0,0 @@
-- name: copy git configuration
-  template:
-    src: "gitconfig.j2"
-    dest: "{{ ansible_env.HOME }}/.gitconfig"
-
-- name: copy keys
-  copy:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-  loop:
-    - {
-      src: "gpg_key", dest: "{{ ansible_env.HOME }}/gpg.key"
-    }
-    - {
-      src: "gpg_pub", dest: "{{ ansible_env.HOME }}/gpg.pub"
-    }
-
-- name: import secret key
-  command: "gpg --passphrase {{ gpg_passphrase }} --import ~/gpg.key"
-
-- name: import public key
-  command: "gpg --import ~/gpg.pub"
-
-- name: remove temp keys
-  file:
-    path: "{{ item }}"
-    state: absent
-  loop:
-    - "{{ ansible_env.HOME }}/gpg.key"
-    - "{{ ansible_env.HOME }}/gpg.pub"

roles/arch/tasks/main.yml

@@ -1,69 +0,0 @@
-- name: install shared packages
-  become: yes
-  pacman:
-    name: "{{ packages }}"
-
-- name: detecting platform
-  import_tasks: platform.yml
-
-- name: install platform specific packages
-  become: yes
-  pacman:
-    name: "{{ platform_packages }}"
-
-- name: configuring network
-  import_tasks: network.yml
-
-- name: copy reflector configuration
-  become: yes
-  template:
-    src: "reflector.j2"
-    dest: "/etc/xdg/reflector/reflector.conf"
-    owner: root
-    group: root
-    mode: "0600"
-
-# started by weekly timer
-- name: disable reflector
-  become: true
-  systemd:
-    name: reflector
-    state: stopped
-    enabled: false
-
-- name: copy pacman configuration
-  become: yes
-  template:
-    src: "pacman.j2"
-    dest: "/etc/pacman.conf"
-    owner: root
-    group: root
-    mode: "0644"
-
-- name: create extra conf
-  become: yes
-  file:
-    path: "/etc/pacman.d/extra.conf"
-    owner: root
-    group: root
-    state: touch
-    mode: "0644"
-
-- name: copy powertop service
-  become: yes
-  template:
-    src: "{{ platform }}/powertop.j2"
-    dest: "/etc/systemd/system/powertop.service"
-    owner: root
-    group: root
-    mode: "0644"
-  notify: restart powertop
-  when: platform == "laptop"
-
-- import_tasks: systemd.yml
-- import_tasks: openvpn.yml
-- import_tasks: git.yml
-- import_tasks: mpv.yml
-- import_tasks: mpd.yml
-- import_tasks: syncthing.yml
-- import_tasks: timer.yml

roles/arch/tasks/mpd.yml

@@ -1,88 +0,0 @@
-- name: set up sudoers configuration
-  become: yes
-  template:
-    src: "sudoers.j2"
-    dest: "/etc/sudoers.d/10-sonny"
-    owner: root
-    group: root
-    mode: "0644"
-
-- name: copy systemd configuration files
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-  loop:
-    - {
-        src: "mpd/service.j2",
-        dest: "{{ xdg_config_dir }}/systemd/user/mpd.service",
-      }
-    - {
-        src: "mpd/socket.j2",
-        dest: "{{ xdg_config_dir }}/systemd/user/mpd.socket",
-      }
-
-- name: create mpd files
-  file:
-    path: "{{ item.path }}"
-    state: "{{ item.state }}"
-  loop:
-    - {
-        path: "{{ mpd_configuration_dir }}",
-        state: "directory",
-      }
-    - {
-        path: "{{ mpd_configuration_dir }}/playlists",
-        state: "directory",
-      }
-    - {
-        path: "{{ mpd_configuration_dir }}/log",
-        state: "touch",
-      }
-    - {
-        path: "{{ mpd_configuration_dir }}/database",
-        state: "touch",
-      }
-    - {
-        path: "{{ mpd_configuration_dir }}/sticker.sql",
-        state: "touch",
-      }
-    - {
-        path: "{{ mpd_configuration_dir }}/state",
-        state: "touch",
-      }
-
-- name: copy configuration file
-  template:
-    src: "mpd/mpd.j2"
-    dest: "{{ mpd_configuration_dir }}/mpd.conf"
-
-- name: copy nfs connection scripts
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    mode: "0755"
-  loop:
-    - {
-        src: "mpd/music_mount.j2",
-        dest: "{{ xdg_script_dir }}/music_mount",
-      }
-    - {
-        src: "mpd/music_umount.j2",
-        dest: "{{ xdg_script_dir }}/music_umount",
-      }
-
-- name: restart mpd service
-  systemd:
-    name: mpd.service
-    state: restarted
-    enabled: no
-    scope: user
-  when: platform == "desktop"
-
-- name: enable mpd socket
-  systemd:
-    name: mpd.socket
-    state: started
-    enabled: yes
-    scope: user
-  when: platform == "desktop"

roles/arch/tasks/mpv.yml

@@ -1,20 +0,0 @@
-- name: create configuration directory
-  file:
-    path: "{{ ansible_env.HOME }}/.config/mpv"
-    state: directory
-    mode: "0700"
-
-- name: copy configuration files
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    mode: "0644"
-  loop:
-    - {
-        src: "mpv/input.j2",
-        dest: "{{ ansible_env.HOME }}/.config/mpv/input.conf",
-      }
-    - {
-        src: "mpv/config.j2",
-        dest: "{{ ansible_env.HOME }}/.config/mpv/mpv.conf",
-      }

roles/arch/tasks/openvpn.yml

@@ -1,82 +0,0 @@
-- name: create configuration directories
-  become: yes
-  file:
-    path: "{{ item }}"
-    state: directory
-    owner: openvpn
-    group: openvpn
-    mode: "0750"
-  loop:
-    - "/etc/openvpn/client"
-    - "/etc/openvpn/client/zeus"
-    - "/etc/openvpn/server"
-
-- name: copy configuration
-  become: yes
-  template:
-    src: "{{ platform }}/openvpn.j2"
-    dest: "/etc/openvpn/client/zeus.conf"
-    owner: openvpn
-    group: openvpn
-    mode: "0644"
-
-- name: copy desktop credentials
-  become: yes
-  copy:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    owner: openvpn
-    group: openvpn
-    mode: "0600"
-  loop:
-    - {
-        src: "{{ platform }}/openvpn/ca.crt",
-        dest: "/etc/openvpn/client/zeus/ca.crt",
-      }
-    - {
-        src: "{{ platform }}/openvpn/desktop.crt",
-        dest: "/etc/openvpn/client/zeus/desktop.crt",
-      }
-    - {
-        src: "{{ platform }}/openvpn/desktop.key",
-        dest: "/etc/openvpn/client/zeus/desktop.key",
-      }
-    - {
-        src: "{{ platform }}/openvpn/ta.key",
-        dest: "/etc/openvpn/client/zeus/ta.key",
-      }
-  when: platform == "desktop"
-
-- name: copy laptop credentials
-  become: yes
-  copy:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    owner: openvpn
-    group: openvpn
-    mode: "0600"
-  loop:
-    - {
-        src: "{{ platform }}/openvpn/ca.crt",
-        dest: "/etc/openvpn/client/zeus/ca.crt",
-      }
-    - {
-        src: "{{ platform }}/openvpn/laptop.crt",
-        dest: "/etc/openvpn/client/zeus/laptop.crt",
-      }
-    - {
-        src: "{{ platform }}/openvpn/laptop.key",
-        dest: "/etc/openvpn/client/zeus/laptop.key",
-      }
-    - {
-        src: "{{ platform }}/openvpn/ta.key",
-        dest: "/etc/openvpn/client/zeus/ta.key",
-      }
-  when: platform == "laptop"
-
-- name: restart vpn
-  become: true
-  systemd:
-    name: openvpn-client@zeus
-    state: restarted
-    enabled: true

roles/arch/tasks/syncthing.yml

@@ -1,11 +0,0 @@
-- name: create configuration dir
-  file:
-    path: "{{ xdg_config_dir }}/syncthing"
-    state: directory
-
-- name: copy configuration file
-  template:
-    src: "{{ platform }}/syncthing.j2"
-    dest: "{{ xdg_config_dir }}/syncthing/config.xml"
-    mode: "0600"
-  notify: restart syncthing

roles/arch/tasks/systemd.yml

@@ -1,25 +0,0 @@
-- name: setup systemd user service folder
-  file:
-    path: "{{ xdg_config_dir }}/systemd/user"
-    state: directory
-    mode: "0755"
-
-- name: add ssh-agent service
-  template:
-    src: "ssh-agent.j2"
-    dest: "{{ xdg_config_dir }}/systemd/user/ssh-agent.service"
-    mode: "0644"
-  notify: restart user ssh-agent
-
-- name: copy tmux service
-  template:
-    src: "tmux.j2"
-    dest: "{{ xdg_config_dir }}/systemd/user/tmux.service"
-    mode: "0644"
-
-- name: copy tmux startup script
-  copy:
-    src: "tmux_start"
-    dest: "{{ ansible_env.HOME }}/.local/bin/tmux_start"
-    mode: "0740"
-    force: false

roles/arch/tasks/timer.yml

@@ -1,54 +0,0 @@
-- name: copy timer files
-  become: yes
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    owner: root
-    mode: "0644"
-  loop:
-    - {
-        src: "timer/daily_timer.j2",
-        dest: "/etc/systemd/system/daily.timer",
-      }
-    - {
-        src: "timer/weekly_timer.j2",
-        dest: "/etc/systemd/system/weekly.timer",
-      }
-  notify:
-    - enable daily timer
-    - enable weekly timer
-
-- name: copy target files
-  become: yes
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    owner: root
-    mode: "0644"
-  loop:
-    - {
-        src: "timer/daily_target.j2",
-        dest: "/etc/systemd/system/daily.target",
-      }
-    - {
-        src: "timer/weekly_target.j2",
-        dest: "/etc/systemd/system/weekly.target",
-      }
-
-- name: create target directories
-  become: yes
-  file:
-    path: "{{ item }}"
-    state: directory
-    owner: root
-    mode: "0755"
-  loop:
-    - "/etc/systemd/system/daily.target.wants"
-    - "/etc/systemd/system/weekly.target.wants"
-
-- name: add reflector to weekly timer
-  become: yes
-  file:
-    src: "/usr/lib/systemd/system/reflector.service"
-    dest: "/etc/systemd/system/weekly.target.wants/reflector.service"
-    state: link

roles/common/.gitignore

@@ -0,0 +1,14 @@
+*.retry
+*.swp
+
+.venv
+.env
+env
+venv
+
+node_modules/
+
+.vault
+.vaults/
+vault
+vaults/

roles/common/.gitlab-ci.yml

@@ -0,0 +1,33 @@
+stages:
+  - lint
+  - test
+
+cache:
+  key: "$CI_COMMIT_REF_SLUG"
+  paths:
+    - .cache/pip
+    - node_modules/
+
+lint:
+  stage: lint
+  image: python:3.7
+  before_script:
+    - pip install ansible ansible-lint --quiet
+  script:
+    - ansible-lint playbook.yml
+  only:
+    refs:
+      - development
+      - merge_requests
+
+pretty-lint:
+  stage: lint
+  image: node:12
+  before_script:
+    - npm install
+  script:
+    - npx prettier "**/*.yml" --check
+  only:
+    refs:
+      - development
+      - merge_requests

roles/common/defaults/main.yml

@@ -0,0 +1,3 @@
+poetry_url: "https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py"
+poetry_user: "{{ ansible_user | default(lookup('env', 'USER'), True) }}"
+poetry_dir: "{{ ansible_env.HOME }}/.poetry"

roles/common/handlers/main.yml

@@ -0,0 +1,81 @@
+- name: reload ssh
+  become: yes
+  systemd:
+    name: ssh
+    state: restarted
+    enabled: yes
+    daemon-reload: yes
+
+- name: restart nftables
+  become: yes
+  systemd:
+    name: nftables
+    state: restarted
+    enabled: yes
+    daemon-reload: yes
+
+- name: restart nginx
+  become: yes
+  systemd:
+    name: nginx
+    state: restarted
+    enabled: yes
+    daemon-reload: yes
+
+- name: restart docker
+  become: yes
+  systemd:
+    name: docker
+    state: restarted
+    enabled: yes
+    daemon-reload: yes
+
+- name: restart rabbitmq
+  become: yes
+  systemd:
+    name: rabbitmq-server
+    state: restarted
+    enabled: yes
+    daemon-reload: yes
+
+- name: restart memcached
+  become: yes
+  systemd:
+    name: memcached
+    state: restarted
+    enabled: yes
+    daemon-reload: yes
+
+- name: restart postfix
+  become: yes
+  systemd:
+    name: postfix
+    state: restarted
+    enabled: yes
+    daemon-reload: yes
+
+- name: restart postgres
+  become: yes
+  systemd:
+    name: postgresql@11-main
+    state: restarted
+    enabled: yes
+    daemon-reload: yes
+
+- name: restart systemd-networkd
+  become: yes
+  systemd:
+    name: systemd-networkd
+    state: restarted
+    enabled: yes
+    daemon-reload: yes
+
+- name: restart systemd-resolved
+  become: yes
+  systemd:
+    name: systemd-resolved
+    state: restarted
+    enabled: yes
+    daemon-reload: yes
+
+- include: user.yml

roles/common/handlers/user.yml

@@ -0,0 +1,19 @@
+- name: start user tmux service
+  become_user: "{{ default_user }}"
+  become: yes
+  systemd:
+    daemon-reload: yes
+    name: tmux
+    state: started
+    enabled: yes
+    scope: user
+
+- name: restart user tmux service
+  become_user: "{{ default_user }}"
+  become: yes
+  systemd:
+    daemon-reload: yes
+    name: tmux
+    state: restarted
+    enabled: yes
+    scope: user

roles/common/meta/.galaxy_install_info

@@ -0,0 +1,2 @@
+install_date: Fri Jan 29 19:51:44 2021
+version: master

roles/common/meta/main.yml

@@ -0,0 +1,15 @@
+dependencies: []
+
+galaxy_info:
+  author: sonny
+  description: "Common tasks"
+  license: "license GPLv3"
+  min_ansible_version: 2.7
+  issue_tracker_url: "https://git.fudiggity.nl/ansible/common/-/issues"
+  platforms:
+    - name: Debian
+      versions:
+        - buster
+  galaxy_tags:
+    - development
+    - system

roles/common/tasks/host.yml

@@ -0,0 +1,15 @@
+- name: copy hostname
+  template:
+    src: "hostname.j2"
+    dest: "/etc/hostname"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: copy hosts
+  template:
+    src: "hosts.j2"
+    dest: "/etc/hosts"
+    owner: root
+    group: root
+    mode: "0644"

roles/common/tasks/known_hosts.yml

@@ -0,0 +1,39 @@
+- name: load OS specific vars
+  include_vars: "{{ item }}"
+  with_first_found:
+    - files:
+        - "{{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}.yml"
+        - "{{ ansible_distribution|lower }}.yml"
+        - "{{ ansible_os_family|lower }}.yml"
+      paths:
+        - "{{ role_path }}/vars"
+
+- name: install packages
+  become: yes
+  package:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ known_hosts_packages }}"
+
+- name: retrieve user $HOME
+  shell: "echo $HOME" # noqa 301
+  become_user: "{{ user }}"
+  register: home_stats
+
+- name: set user $HOME
+  set_fact:
+    user_home: "{{ home_stats.stdout }}"
+
+- name: create local ssh directory
+  become_user: "{{ user }}"
+  file:
+    path: "{{ user_home }}/.ssh"
+    state: directory
+    mode: "0755"
+
+- name: add items to known hosts
+  become_user: "{{ user }}"
+  known_hosts:
+    name: "{{ item.domain }}"
+    key: "{{ item.key }}"
+  loop: "{{ items }}"

roles/common/tasks/main.yml

@@ -0,0 +1,2 @@
+- include_tasks: "setup.yml"
+  when: skip_common_setup is not defined or not skip_common_setup

roles/common/tasks/network.yml

@@ -0,0 +1,27 @@
+- name: check old network configuration
+  stat: path=/etc/network/interfaces
+  register: old_config
+
+- name: move old network configuration
+  command: mv /etc/network/interfaces /etc/network/interfaces.save
+  when: old_config.stat.exists
+
+- name: copy network configuration
+  template:
+    src: "network.j2"
+    dest: "/etc/systemd/network/50-default.network"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart systemd-networkd
+
+- name: copy dns configuration
+  file:
+    src: "/run/systemd/resolve/resolv.conf"
+    dest: "/etc/resolv.conf"
+    owner: root
+    group: root
+    state: link
+    force: yes
+    mode: "0644"
+  notify: restart systemd-resolved

roles/common/tasks/nginx.yml

@@ -0,0 +1,18 @@
+- name: install nginx
+  apt:
+    name: nginx
+    state: present
+
+- name: copy nginx config
+  template:
+    src: "nginx.conf.j2"
+    dest: "/etc/nginx/nginx.conf"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: remove default site
+  file:
+    path: "/etc/nginx/sites-enabled/default"
+    state: absent
+  notify: restart nginx

roles/common/tasks/poetry.yml

@@ -0,0 +1,73 @@
+- name: retrieve user $HOME # noqa 301
+  shell: "echo $HOME"
+  become_user: "{{ poetry_user }}"
+  register: home_stats
+
+- name: retrieve user $PATH # noqa 301
+  shell: "echo $PATH"
+  become_user: "{{ poetry_user }}"
+  register: path_stats
+
+- name: set poetry user variables
+  set_fact:
+    poetry_user_home: "{{ home_stats.stdout }}"
+    poetry_user_path: "{{ path_stats.stdout }}"
+
+- name: create user folder for binaries
+  become_user: "{{ poetry_user }}"
+  file:
+    state: directory
+    mode: "0755"
+    path: "{{ poetry_user_home }}/.local/bin"
+
+- name: set default python binary # noqa 208
+  become: true
+  file:
+    state: link
+    src: "/usr/bin/python3"
+    dest: "/usr/bin/python"
+  when: ansible_distribution == "Ubuntu"
+
+- name: setup poetry for Ubuntu/Debian derived distro's
+  block:
+    - name: check poetry existence
+      become_user: "{{ poetry_user }}"
+      stat:
+        path: "{{ poetry_dir }}"
+      register: poetry_stats
+
+    - name: download poetry installer
+      become_user: "{{ poetry_user }}"
+      get_url:
+        url: "{{ poetry_url }}"
+        dest: /tmp/
+        mode: "0750"
+      when: poetry_stats.stat.isdir is not defined
+
+    - name: install poetry
+      become_user: "{{ poetry_user }}"
+      command: "python /tmp/get-poetry.py --yes" # noqa 305
+      environment:
+        POETRY_HOME: "{{ poetry_dir }}"
+      when: poetry_stats.stat.isdir is not defined
+
+    - name: add poetry to user binaries # noqa 208
+      become_user: "{{ poetry_user }}"
+      file:
+        state: link
+        src: "{{ poetry_dir }}/bin/poetry"
+        dest: "{{ poetry_user_home }}/.local/bin/poetry"
+  when: ansible_distribution == "Debian" or ansible_distribution == "Ubuntu"
+
+- name: setup poetry for Archlinux
+  become: true
+  pacman:
+    name: poetry
+    state: present
+  when: ansible_facts['os_family'] == "Archlinux"
+
+- name: update poetry config
+  become_user: "{{ poetry_user }}"
+  command: "poetry config virtualenvs.in-project true" # noqa 301
+  environment:
+    PATH: "{{ poetry_user_home }}/.local/bin:{{ poetry_user_path }}"

roles/common/tasks/setup.yml

@@ -0,0 +1,51 @@
+- include_tasks: "sudoers.yml"
+  loop:
+    - { src: "sudoers.j2", dest: "/etc/sudoers.d/20-ansible-extra" }
+
+- name: copy ssh template
+  template:
+    src: "sshd_config.j2"
+    dest: "/etc/ssh/sshd_config"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload ssh
+
+- name: viva la hollande
+  locale_gen:
+    name: nl_NL.UTF-8
+    state: present
+
+- name: ensure basic tooling is installed
+  apt:
+    name:
+      - acl
+      - man
+      - apt-transport-https
+      - ca-certificates
+      - software-properties-common
+      - policykit-1
+      - libpolkit-agent-1-0
+      - nftables
+      - openssh-client
+      - bash-completion
+      - git
+      - vim
+      - curl
+      - tree
+      - haveged
+      - rsync
+    state: present
+
+- name: copy firewall template
+  template:
+    src: "nftables.j2"
+    dest: "/etc/nftables.conf"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: restart nftables
+
+# see https://wiki.debian.org/systemd#Orphaned_processes
+- name: enable loginctl user-linger
+  command: "loginctl enable-linger {{ default_user|quote }}" # noqa 301

roles/common/tasks/ssl.yml

@@ -0,0 +1,39 @@
+- name: install SSL packages
+  apt:
+    name:
+      - python3-openssl
+      - python3-crypto
+      - python3-cryptography
+      - python-openssl
+      - python-crypto
+      - python-cryptography
+    state: present
+
+- name: create ssl directory
+  file:
+    path: "/etc/ssl/{{ app_name }}"
+    state: directory
+    owner: "{{ app_user }}"
+    group: "{{ app_user }}"
+    mode: 0750
+
+- name: generate an OpenSSL private key with the default values (4096 bits, RSA)
+  become_user: "{{ app_user }}"
+  openssl_privatekey:
+    path: "/etc/ssl/{{ app_name }}/local.pem"
+
+- name: generate an OpenSSL certificate signing request
+  become_user: "{{ app_user }}"
+  openssl_csr:
+    path: "/etc/ssl/{{ app_name }}/local.csr"
+    privatekey_path: "/etc/ssl/{{ app_name }}/local.pem"
+    common_name: fudiggity.nl
+
+- name: generate a self signed OpenSSL certificate
+  become_user: "{{ app_user }}"
+  openssl_certificate:
+    force: yes
+    path: "/etc/ssl/{{ app_name }}/{{ app_name }}.crt"
+    privatekey_path: "/etc/ssl/{{ app_name }}/local.pem"
+    csr_path: "/etc/ssl/{{ app_name }}/local.csr"
+    provider: selfsigned

roles/common/tasks/sudoers.yml

@@ -0,0 +1,7 @@
+- name: copy extra sudoers file
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: root
+    group: root
+    mode: "0644"

roles/common/templates/hostname.j2

@@ -0,0 +1,3 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+#
+{{ hostname }}

roles/common/templates/hosts.j2

@@ -0,0 +1,9 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+#
+127.0.0.1       localhost
+127.0.1.1       {{ hostname }}
+
+# The following lines are desirable for IPv6 capable hosts
+# ::1     localhost ip6-localhost ip6-loopback
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters

roles/common/templates/network.j2

@@ -0,0 +1,9 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+#
+[Match]
+Name={{ host_interface }}
+
+[Network]
+Address={{ host_ip }}/{{ host_subnet }}
+Gateway={{ host_gateway }}
+DNS={{ host_dns }}

roles/common/templates/nftables.j2

@@ -0,0 +1,19 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+#
+# vim:set ts=2 sw=2 et:
+
+flush ruleset
+
+table inet filter {
+	chain input {
+		type filter hook input priority 0; policy drop;
+
+		# accept any localhost traffic
+		iif lo accept
+
+		# accept traffic originated from us
+		ct state { established, related } accept
+
+		tcp dport 22 accept
+	}
+}

roles/common/templates/nginx.conf.j2

@@ -0,0 +1,51 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+#
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+	worker_connections 768;
+}
+
+http {
+	##
+	# Basic Settings
+	##
+	sendfile on;
+	tcp_nopush on;
+	tcp_nodelay on;
+	keepalive_timeout 65;
+	types_hash_max_size 2048;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	##
+	# SSL Settings
+	##
+	ssl_protocols TLSv1.2;
+	ssl_prefer_server_ciphers on;
+	ssl_ciphers HIGH:!aNULL:!MD5;
+
+	ssl_session_cache   shared:SSL:20m;
+	ssl_session_timeout 1d;
+
+	##
+	# Logging Settings
+	##
+	access_log /var/log/nginx/access.log;
+	error_log /var/log/nginx/error.log;
+
+	##
+	# Gzip Settings
+	##
+	gzip off;
+
+	##
+	# Virtual Host Configs
+	##
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+}

roles/common/templates/sshd_config.j2

@@ -0,0 +1,123 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+#
+#	$OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin no
+#StrictModes yes
+MaxAuthTries 6
+#MaxSessions 10
+
+PubkeyAuthentication yes
+
+# Expect .ssh/authorized_keys2 to be disregarded by default in future.
+AuthorizedKeysFile	.ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication no
+#PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding yes
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+PrintMotd no
+#PrintLastLog yes
+#TCPKeepAlive yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+# override default of no subsystems
+Subsystem	sftp	/usr/lib/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server

roles/common/templates/sudoers.j2

@@ -0,0 +1,3 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+#
+ansible ALL = ({{ default_user }}:{{ default_user }}) NOPASSWD: ALL

roles/common/vars/archlinux.yml

@@ -0,0 +1,2 @@
+known_hosts_packages:
+  - openssh

roles/common/vars/debian-buster.yml

@@ -0,0 +1 @@
+known_hosts_packages: []

roles/common/vars/ubuntu-focal.yml

@@ -0,0 +1 @@
+known_hosts_packages: []

roles/requirements.yml

@@ -2,7 +2,3 @@
   name: common
   version: master
   scm: git
-- src: git+https://git.fudiggity.nl/ansible/npm.git
-  name: npm
-  version: master
-  scm: git

tasks/git.yml

@@ -0,0 +1,26 @@
+- name: copy git configuration
+  template:
+    src: 'templates/gitconfig.j2'
+    dest: '{{ ansible_env.HOME }}/.gitconfig'
+
+- name: copy keys
+  copy:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+  loop:
+    - { src: 'files/gpg_key', dest: '{{ ansible_env.HOME }}/gpg.key' }
+    - { src: 'files/gpg_pub', dest: '{{ ansible_env.HOME }}/gpg.pub' }
+
+- name: import secret key
+  command: 'gpg --passphrase {{ gpg_passphrase }} --import ~/gpg.key'
+
+- name: import public key
+  command: 'gpg --import ~/gpg.pub'
+
+- name: remove temp keys
+  file:
+    path: '{{ item }}'
+    state: absent
+  loop:
+    - '{{ ansible_env.HOME }}/gpg.key'
+    - '{{ ansible_env.HOME }}/gpg.pub'

tasks/mpd.yml

@@ -0,0 +1,58 @@
+- name: set up sudoers configuration
+  become: yes
+  template:
+    src: 'templates/sudoers.j2'
+    dest: '/etc/sudoers.d/10-sonny'
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: copy systemd configuration files
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+  loop:
+    - { src: 'templates/mpd/service.j2', dest: '{{ xdg_config_dir }}/systemd/user/mpd.service' }
+    - { src: 'templates/mpd/socket.j2', dest: '{{ xdg_config_dir }}/systemd/user/mpd.socket' }
+
+- name: create mpd files
+  file:
+    path: '{{ item.path }}'
+    state: '{{ item.state }}'
+  loop:
+    - { path: '{{ mpd_configuration_dir }}', state: 'directory' }
+    - { path: '{{ mpd_configuration_dir }}/playlists', state: 'directory' }
+    - { path: '{{ mpd_configuration_dir }}/log', state: 'touch' }
+    - { path: '{{ mpd_configuration_dir }}/database', state: 'touch' }
+    - { path: '{{ mpd_configuration_dir }}/sticker.sql', state: 'touch' }
+    - { path: '{{ mpd_configuration_dir }}/state', state: 'touch' }
+
+- name: copy configuration file
+  template:
+    src: 'templates/mpd/mpd.j2'
+    dest: '{{ mpd_configuration_dir }}/mpd.conf'
+
+- name: copy nfs connection scripts
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    mode: '0755'
+  loop:
+    - { src: 'templates/mpd/music_mount.j2', dest: '{{ xdg_script_dir }}/music_mount' }
+    - { src: 'templates/mpd/music_umount.j2', dest: '{{ xdg_script_dir }}/music_umount' }
+
+- name: restart mpd service
+  systemd:
+    name: mpd.service
+    state: restarted
+    enabled: no
+    scope: user
+  when: platform == "desktop"
+
+- name: enable mpd socket
+  systemd:
+    name: mpd.socket
+    state: started
+    enabled: yes
+    scope: user
+  when: platform == "desktop"

tasks/mpv.yml

@@ -0,0 +1,14 @@
+- name: create configuration directory
+  file:
+    path: '{{ ansible_env.HOME }}/.config/mpv'
+    state: directory
+    mode: '0700'
+
+- name: copy configuration files
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    mode: '0644'
+  loop:
+    - { src: 'templates/mpv/input.j2', dest: '{{ ansible_env.HOME }}/.config/mpv/input.conf' }
+    - { src: 'templates/mpv/config.j2', dest: '{{ ansible_env.HOME }}/.config/mpv/mpv.conf' }

tasks/network.yml

@@ -1,22 +1,22 @@
 - name: setup desktop systemd networkd
   become: yes
   template:
-    src: "desktop/network.j2"
-    dest:  "/etc/systemd/network/20-wired.network"
+    src: 'templates/desktop/network.j2'
+    dest: '/etc/systemd/network/20-wired.network'
     owner: root
     group: root
-    mode: "0644"
+    mode: '0644'
   notify: restart systemd-networkd
   when: platform == "desktop"
 
 - name: setup laptop systemd networkd
   become: yes
   template:
-    src: "laptop/network.j2"
-    dest:  "/etc/systemd/network/20-wireless.network"
+    src: 'templates/laptop/network.j2'
+    dest: '/etc/systemd/network/20-wireless.network'
     owner: root
     group: root
-    mode: "0644"
+    mode: '0644'
   notify: restart systemd-networkd
   when: platform == "laptop"
 
@@ -38,9 +38,9 @@
 - name: copy firewall template
   become: yes
   template:
-    src: "{{ platform }}/nftables.j2"
-    dest: "/etc/nftables.conf"
+    src: 'templates/{{ platform }}/nftables.j2'
+    dest: '/etc/nftables.conf'
     owner: root
     group: root
-    mode: "0600"
+    mode: '0600'
   notify: restart nftables

tasks/openvpn.yml

@@ -0,0 +1,70 @@
+- name: create configuration directories
+  become: yes
+  file:
+    path: '{{ item }}'
+    state: directory
+    owner: openvpn
+    group: openvpn
+    mode: '0750'
+  loop:
+    - '/etc/openvpn/client'
+    - '/etc/openvpn/client/zeus'
+    - '/etc/openvpn/server'
+
+- name: copy configuration
+  become: yes
+  template:
+    src: 'templates/{{ platform }}/openvpn.j2'
+    dest: '/etc/openvpn/client/zeus.conf'
+    owner: openvpn
+    group: openvpn
+    mode: '0644'
+
+- name: copy desktop credentials
+  become: yes
+  copy:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: openvpn
+    group: openvpn
+    mode: '0600'
+  loop:
+    - { src: 'files/{{ platform }}/openvpn/ca.crt', dest: '/etc/openvpn/client/zeus/ca.crt' }
+    - {
+        src: 'files/{{ platform }}/openvpn/desktop.crt',
+        dest: '/etc/openvpn/client/zeus/desktop.crt',
+      }
+    - {
+        src: 'files/{{ platform }}/openvpn/desktop.key',
+        dest: '/etc/openvpn/client/zeus/desktop.key',
+      }
+    - { src: 'files/{{ platform }}/openvpn/ta.key', dest: '/etc/openvpn/client/zeus/ta.key' }
+  when: platform == "desktop"
+
+- name: copy laptop credentials
+  become: yes
+  copy:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: openvpn
+    group: openvpn
+    mode: '0600'
+  loop:
+    - { src: 'files/{{ platform }}/openvpn/ca.crt', dest: '/etc/openvpn/client/zeus/ca.crt' }
+    - {
+        src: 'files/{{ platform }}/openvpn/laptop.crt',
+        dest: '/etc/openvpn/client/zeus/laptop.crt',
+      }
+    - {
+        src: 'files/{{ platform }}/openvpn/laptop.key',
+        dest: '/etc/openvpn/client/zeus/laptop.key',
+      }
+    - { src: 'files/{{ platform }}/openvpn/ta.key', dest: '/etc/openvpn/client/zeus/ta.key' }
+  when: platform == "laptop"
+
+- name: restart vpn
+  become: true
+  systemd:
+    name: openvpn-client@zeus
+    state: restarted
+    enabled: true

tasks/platform.yml

@@ -5,18 +5,18 @@
 
 - name: set platform (desktop)
   set_fact:
-    platform: "desktop"
+    platform: 'desktop'
   when: is_laptop.rc == 1
 
 - name: set platform (laptop)
   set_fact:
-    platform: "laptop"
+    platform: 'laptop'
   when: is_laptop.rc == 0
 
 - name: load desktop specific vars
-  include_vars: desktop.yml
+  include_vars: 'vars/desktop.yml'
   when: platform == "desktop"
 
 - name: load laptop specific vars
-  include_vars: laptop.yml
+  include_vars: 'vars/laptop.yml'
   when: platform == "laptop"

tasks/setup.yml

@@ -0,0 +1,45 @@
+- name: copy reflector configuration
+  become: yes
+  template:
+    src: 'templates/reflector.j2'
+    dest: '/etc/xdg/reflector/reflector.conf'
+    owner: root
+    group: root
+    mode: '0600'
+
+# started by weekly timer
+- name: disable reflector
+  become: true
+  systemd:
+    name: reflector
+    state: stopped
+    enabled: false
+
+- name: copy pacman configuration
+  become: yes
+  template:
+    src: 'templates/pacman.j2'
+    dest: '/etc/pacman.conf'
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: create extra conf
+  become: yes
+  file:
+    path: '/etc/pacman.d/extra.conf'
+    owner: root
+    group: root
+    state: touch
+    mode: '0644'
+
+- name: copy powertop service
+  become: yes
+  template:
+    src: 'templates/{{ platform }}/powertop.j2'
+    dest: '/etc/systemd/system/powertop.service'
+    owner: root
+    group: root
+    mode: '0644'
+  notify: restart powertop
+  when: platform == "laptop"

tasks/syncthing.yml

@@ -0,0 +1,11 @@
+- name: create configuration dir
+  file:
+    path: '{{ xdg_config_dir }}/syncthing'
+    state: directory
+
+- name: copy configuration file
+  template:
+    src: 'templates/{{ platform }}/syncthing.j2'
+    dest: '{{ xdg_config_dir }}/syncthing/config.xml'
+    mode: '0600'
+  notify: restart syncthing

tasks/systemd.yml

@@ -0,0 +1,25 @@
+- name: setup systemd user service folder
+  file:
+    path: '{{ xdg_config_dir }}/systemd/user'
+    state: directory
+    mode: '0755'
+
+- name: add ssh-agent service
+  template:
+    src: 'templates/ssh-agent.j2'
+    dest: '{{ xdg_config_dir }}/systemd/user/ssh-agent.service'
+    mode: '0644'
+  notify: restart user ssh-agent
+
+- name: copy tmux service
+  template:
+    src: 'templates/tmux.j2'
+    dest: '{{ xdg_config_dir }}/systemd/user/tmux.service'
+    mode: '0644'
+
+- name: copy tmux startup script
+  copy:
+    src: 'files/tmux_start'
+    dest: '{{ ansible_env.HOME }}/.local/bin/tmux_start'
+    mode: '0740'
+    force: false

tasks/timer.yml

@@ -0,0 +1,42 @@
+- name: copy timer files
+  become: yes
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: root
+    mode: '0644'
+  loop:
+    - { src: 'templates/timer/daily_timer.j2', dest: '/etc/systemd/system/daily.timer' }
+    - { src: 'templates/timer/weekly_timer.j2', dest: '/etc/systemd/system/weekly.timer' }
+  notify:
+    - enable daily timer
+    - enable weekly timer
+
+- name: copy target files
+  become: yes
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: root
+    mode: '0644'
+  loop:
+    - { src: 'templates/timer/daily_target.j2', dest: '/etc/systemd/system/daily.target' }
+    - { src: 'templates/timer/weekly_target.j2', dest: '/etc/systemd/system/weekly.target' }
+
+- name: create target directories
+  become: yes
+  file:
+    path: '{{ item }}'
+    state: directory
+    owner: root
+    mode: '0755'
+  loop:
+    - '/etc/systemd/system/daily.target.wants'
+    - '/etc/systemd/system/weekly.target.wants'
+
+- name: add reflector to weekly timer
+  become: yes
+  file:
+    src: '/usr/lib/systemd/system/reflector.service'
+    dest: '/etc/systemd/system/weekly.target.wants/reflector.service'
+    state: link