simplify roles organization and renames

roles/msmonitor/meta/main.yml

+---
+
+dependencies:
+  - role: base
+  - role: nginx
+
+...

roles/monitor/tasks/main.yml → roles/msmonitor/tasks/main.yml

@@ -67,4 +67,6 @@
   include_role:
     name: ferm
 
+- meta: flush_handlers
+
 ...

roles/netcapture/defaults/main.yml

@@ -11,4 +11,10 @@ netcapture_hw_acceleration: false
 netcapture_miris_user_pwd: "{{ lookup('password', '/tmp/passwordfile length=12 chars=ascii_letters,digits') }}"
 netcapture_miris_auth: true
 
+netcapture_firewall_enabled: true
+netcapture_ferm_rules_filename: netcapture
+netcapture_ferm_input_rules: []
+netcapture_ferm_output_rules: []
+netcapture_ferm_global_settings:
+
 ...

roles/netcapture/meta/main.yml

+---
+
+dependencies:
+  - role: base
+
+...

roles/netcapture/tasks/main.yml

@@ -3,6 +3,7 @@
 - name: requirements install
   apt:
     force_apt_get: true
+    install_recommends: false
     name:
       - apt-transport-https
       - ca-certificates
@@ -10,7 +11,6 @@
       - gnupg-agent
       - lsb-release
       - software-properties-common
-    state: present
 
 - name: docker repo key
   apt_key:
@@ -26,8 +26,8 @@
 - name: docker install
   apt:
     force_apt_get: true
+    install_recommends: false
     name: docker-ce
-    state: present
 
 - name: docker service
   systemd:
@@ -38,8 +38,8 @@
 - name: netcapture install
   apt:
     force_apt_get: true
+    install_recommends: false
     name: python3-miris-netcapture
-    state: present
 
 - name: netcapture config
   template:
@@ -67,7 +67,18 @@
     recurse: true
     state: directory
 
-# TODO: add fail2ban ?
-# TODO: add firewall
+# FIREWALL
+
+- name: firewall
+  when: netcapture_firewall_enabled
+  vars:
+    ferm_rules_filename: "{{ netcapture_ferm_rules_filename }}"
+    ferm_input_rules: "{{ netcapture_ferm_input_rules }}"
+    ferm_output_rules: "{{ netcapture_ferm_output_rules }}"
+    ferm_global_settings: "{{ netcapture_ferm_global_settings }}"
+  include_role:
+    name: ferm
+
+- meta: flush_handlers
 
 ...

roles/network/defaults/main.yml

@@ -8,11 +8,11 @@ network_packages:
   - network-manager
   - python3-dbus
 
-network_ip: "{{ lookup('env', 'NETWORK_IP') | ipaddr }}"
-network_mask: "{{ lookup('env', 'NETWORK_MASK') }}"
+network_ip: "{{ envsetup_network_ip | d() }}"
+network_mask: "{{ envsetup_network_mask | d() }}"
 network_ip_mask: "{{ network_ip }}/{{ network_mask }}"
 network_ip_mask_cidr: "{{ network_ip_mask | ipaddr }}"
-network_gateway: "{{ lookup('env', 'NETWORK_GATEWAY') | ipaddr }}"
-network_dns: "{{ lookup('env', 'NETWORK_DNS').split(',') | ipaddr }}"
+network_gateway: "{{ envsetup_network_gateway | d() }}"
+network_dns: "{{ envsetup_network_dns.split(',') | d() }}"
 
 ...

roles/network/tasks/main.yml

@@ -9,20 +9,10 @@
     - network_dns | d(false)
   block:
 
-    # Was needed when using ifupdown but probably not with network-manager
-    # - name: prevent dhclient to erase dns config
-    #   copy:
-    #     dest: /etc/dhcp/dhclient-enter-hooks.d/nodnsupdate
-    #     mode: 0755
-    #     content: |
-    #       #!/bin/sh
-    #       make_resolv_conf() {
-    #           :
-    #       }
-
     - name: packages
       apt:
         force_apt_get: true
+        install_recommends: false
         name: "{{ network_packages }}"
         state: present
 

roles/nginx/defaults/main.yml

@@ -5,8 +5,6 @@ nginx_packages:
   - uwsgi
   - uwsgi-plugin-python3
 
-nginx_server_name:
-
 nginx_ssl_certificate: /etc/ssl/certs/ssl-cert-snakeoil.pem
 nginx_ssl_certificate_key: /etc/ssl/private/ssl-cert-snakeoil.key
 

roles/nginx/handlers/main.yml

 ---
 
 - name: restart nginx
-  service:
+  systemd:
     name: nginx
     state: restarted
 

roles/nginx/tasks/_certs.yml

----
-
-- name: nginx check old ssl conf exists
-  register: nginx_old_ssl_conf
-  stat:
-    path: /etc/nginx/conf.d/ssl.conf
-
-- name: nginx migrate old ssl certificate conf
-  when: nginx_old_ssl_conf.stat.exists
-  notify: restart nginx
-  loop:
-    - grep ssl_certificate /etc/nginx/conf.d/ssl.conf > /etc/nginx/conf.d/ssl_certificate.conf
-    - mv /etc/nginx/conf.d/ssl.conf /etc/nginx/conf.d/ssl.conf.old
-  command: "{{ item }}"
-
-- name: nginx check ssl cert conf exists
-  register: nginx_ssl_cert_conf
-  stat:
-    path: /etc/nginx/conf.d/ssl_certificate.conf
-
-- name: nginx update ssl certificate conf
-  when:
-    - nginx_ssl_cert_conf.stat.exists
-    - nginx_ssl_certificate != "/etc/ssl/certs/ssl-cert-snakeoil.pem"
-  notify: restart nginx
-  lineinfile:
-    path: /etc/nginx/conf.d/ssl_certificate.conf
-    regexp: 'ssl_certificate\s+([\w/\-\_\.]+);'
-    line: 'ssl_certificate {{ nginx_ssl_certificate }};'
-
-- name: nginx update ssl certificate key conf
-  when:
-    - nginx_ssl_cert_conf.stat.exists
-    - nginx_ssl_certificate_key != "/etc/ssl/private/ssl-cert-snakeoil.key"
-  notify: restart nginx
-  lineinfile:
-    path: /etc/nginx/conf.d/ssl_certificate.conf
-    regexp: 'ssl_certificate_key\s+([\w/\-\_\.]+);'
-    line: 'ssl_certificate_key {{ nginx_ssl_certificate_key }};'
-
-...

roles/nginx/tasks/_config.yml

----
-
-- name: nginx remove default vhost
-  notify: restart nginx
-  loop:
-    - /etc/nginx/sites-enabled/default
-    - /etc/nginx/sites-enabled/default.conf
-  file:
-    path: "{{ item }}"
-    state: absent
-
-...

roles/nginx/tasks/_install.yml

----
-
-- name: remove apache
-  apt:
-    force_apt_get: true
-    name: apache2
-    state: absent
-
-- name: nginx install
-  apt:
-    force_apt_get: true
-    install_recommends: false
-    name: "{{ nginx_packages }}"
-    state: present
-
-...

roles/nginx/tasks/main.yml

 ---
 
-- include_tasks: _install.yml
-- include_tasks: _config.yml
-- include_tasks: _certs.yml
-
-- name: ensure nginx is running
-  service:
-    name: nginx
-    enabled: true
-    state: started
+- name: nginx install
+  apt:
+    force_apt_get: true
+    install_recommends: false
+    name: "{{ nginx_packages }}"
+    state: present
+
+- name: nginx remove default vhost
+  notify: restart nginx
+  loop:
+    - /etc/nginx/sites-enabled/default
+    - /etc/nginx/sites-enabled/default.conf
+  file:
+    path: "{{ item }}"
+    state: absent
+
+- name: nginx check old ssl conf exists
+  register: nginx_old_ssl_conf
+  stat:
+    path: /etc/nginx/conf.d/ssl.conf
+
+- name: nginx migrate old ssl certificate conf
+  when: nginx_old_ssl_conf.stat.exists
+  notify: restart nginx
+  loop:
+    - grep ssl_certificate /etc/nginx/conf.d/ssl.conf > /etc/nginx/conf.d/ssl_certificate.conf
+    - mv /etc/nginx/conf.d/ssl.conf /etc/nginx/conf.d/ssl.conf.old
+  command:
+    cmd: "{{ item }}"
+
+- name: nginx check ssl cert conf exists
+  register: nginx_ssl_cert_conf
+  stat:
+    path: /etc/nginx/conf.d/ssl_certificate.conf
+
+- name: nginx update ssl certificate conf
+  when:
+    - nginx_ssl_cert_conf.stat.exists
+    - nginx_ssl_certificate != "/etc/ssl/certs/ssl-cert-snakeoil.pem"
+  notify: restart nginx
+  lineinfile:
+    path: /etc/nginx/conf.d/ssl_certificate.conf
+    regexp: 'ssl_certificate\s+([\w/\-\_\.]+);'
+    line: 'ssl_certificate {{ nginx_ssl_certificate }};'
+
+- name: nginx update ssl certificate key conf
+  when:
+    - nginx_ssl_cert_conf.stat.exists
+    - nginx_ssl_certificate_key != "/etc/ssl/private/ssl-cert-snakeoil.key"
+  notify: restart nginx
+  lineinfile:
+    path: /etc/nginx/conf.d/ssl_certificate.conf
+    regexp: 'ssl_certificate_key\s+([\w/\-\_\.]+);'
+    line: 'ssl_certificate_key {{ nginx_ssl_certificate_key }};'
 
 ...

roles/postgres/tasks/main.yml

 ---
 
 - name: ansible postgresql requirements install
-  when:
-    - postgres_host == "127.0.0.1" or postgres_host == "localhost"
-    - postgres_port == "5432"
   apt:
     force_apt_get: true
     install_recommends: false
     name: python3-psycopg2
-    state: present
 
 - name: postgresql install
-  when:
-    - postgres_host == "127.0.0.1" or postgres_host == "localhost"
-    - postgres_port == "5432"
   apt:
     force_apt_get: true
     install_recommends: false
     name: postgresql
-    state: present
 
 - name: ensure postgresql is running
-  when:
-    - postgres_host == "127.0.0.1" or postgres_host == "localhost"
-    - postgres_port == "5432"
   service:
     name: postgresql
     state: started
 
 - name: postgresql set superuser password
-  when:
-    - postgres_host == "127.0.0.1" or postgres_host == "localhost"
-    - postgres_port == "5432"
   become: true
   become_user: postgres
   postgresql_user:
@@ -50,4 +36,6 @@
   include_role:
     name: ferm
 
+- meta: flush_handlers
+
 ...

roles/proxy/tasks/main.yml

@@ -39,8 +39,8 @@
     - name: install git
       apt:
         force_apt_get: true
+        install_recommends: false
         name: git
-        state: present
 
     - name: git
       loop:

roles/python/tasks/main.yml

----
-
-- name: install python3
-  register: python_install
-  changed_when:
-    - "'doing' in python_install.stdout_lines"
-    - "'pass' not in python_install.stdout_lines"
-  loop:
-    - command -v python3 || ( command -v yum && echo doing && yum install -y epel-release && yum install -y python36 ) || echo pass
-    - command -v python3 || ( command -v apt && echo doing && apt update && apt install -y python3-minimal python3-apt ) || echo pass
-  raw: "{{ item }}"
-
-...

roles/wowza/meta/main.yml

+---
+
+dependencies:
+  - role: base
+
+...

roles/wowza/tasks/main.yml

@@ -3,8 +3,8 @@
 - name: install wowza requirements
   apt:
     force_apt_get: true
+    install_recommends: false
     name: "{{ wowza_requirements }}"
-    state: "present"
 
 - name: install wowza
   apt:
@@ -119,4 +119,6 @@
   include_role:
     name: ferm
 
+- meta: flush_handlers
+
 ...