Ansible Linux System Roles

previous: replaced: Resets the firewalld configuration by removing all existing user-defined settings. previous is a string datatype and accepts value replaced.

service: ssh: Secure Shell (SSH) as the specific network traffic type to be managed. service is a string datatype and accepts values ssh,http,tftpetc.

state: enabled: Permanently opens the firewall for incoming SSH traffic. state is a string datatype and accepts values enabled or disabled.

service: tftp: Defines the Trivial File Transfer Protocol (TFTP) as the specific network service to be managed. service is a string datatype and accepts values ssh,httptftpetc.

state: disabled: Permanently block all incoming network traffic related to tftp. state is a string datatype and accepts values enabled or disabled

aide_db_fetch_dir: files: is a string datatype that specifies the directory on control node, where the AIDE database files are fetched and stored from the remote managed nodes. The default is files, which means the role expects a directory named files to exist in the same directory as the playbook being executed.

aide_init: true: is a Boolean datatype that controls whether a AIDE database should be initialized on a managed node. The default is false. When set to true, a AIDE database is created on the managed node, it is then fetched to the control node.

aide_check: false: is a Boolean datatype that controls whether an integrity check should be immediately run on the managed nodes. The default is false. When set to true, the AIDE check is run, data is compared with the current state of the file system with the trusted baseline database and a report is generated.

aide_update: false: is a Boolean datatype that controls the creation of a new AIDE database to replace the current trusted baseline. The default is false. When set to true, the AIDE update command is run on the managed system, which performs an integrity check, creates a new AIDE database reflecting the current system state and establishes this new file as the trusted baseline for future checks.

cockpit_enabled: true: controls the systemd service setting for the Cockpit Web Console. cockpit_enabled is a Boolean datatype and accepts values true and false. Default is true, which means the Cockpit service is configured to start automatically at system boot.

cockpit_started: true: controls the immediate runtime status of the Cockpit Web Console service. cockpit_started is a Boolean datatype and accepts values true and false. Default is true, which means the Cockpit service is running immediately on the managed host.

cockpit_manage_firewall: true: delegates the task of configuring the firewall to the role itself, ensuring the Cockpit web interface is network-accessible. cockpit_manage_firewall is a Boolean datatype and accepts values true and false. Default is false, which means the role installs and enables Cockpit but makes no changes to the firewall, leaving that task to be handled manually or by a separate dedicated firewall role.

ha_cluster_manage_firewall: true: It controls whether the role should automatically configure the system's firewall to permit necessary cluster communication. ha_cluster_manage_firewall is a Boolean datatype and accepts values true,false,yes,no, 0 and 1. When set to true, it automatically adds firewall rules to open the necessary ports for the cluster to function. Default is false.

ha_cluster_manage_selinux: true: Controls whether the HA cluster role will automatically configure the SELinux policy to allow cluster processes to function. ha_cluster_manage_selinux is a Boolean datatype and accepts values true,false,yes,no, 0 and 1. When set to true, it manages SELinux and performs actions like setting the correct SELinux contexts on necessary files and directories, enabling or setting SELinux booleans required for cluster services etc. Default is false.

ha_cluster_pcsd_certificates: is a list of dictionaries used to define TLS certificates for the pcsd service. The default is []. It uses the structure of the underlying certificate system role. The certificate specific keys are ca, common_name and cert_basename. These keys are all string data types.

suseconnect_base_product: defines the required parameters for registering the core operating system of a SUSE Linux machine. suseconnect_base_product is defined as a YAML Dictionary containing key-value pairs that map directly to the requirements of SCC or SMT servers. Accepted string values are key, product, version and arch.

suseconnect_subscriptions: is a crucial component for enterprise SUSE deployments, as it controls which features, for example, High Availability, containers, or web application platforms enabled on the registered base operating system. suseconnect_subscriptions is defined as a YAML Dictionary containing key-value pairs that map directly to the requirements of SCC or SMT servers. Accepted string values are name, state, version and key.

suseconnect_deregister: true: instructs the system to deactivate its base subscription and remove it from the the SCC or SMT servers. suseconnect_deregister is a Boolean datatype and accepts values false and true. When set to true, it executes the necessary SUSEConnect command to deregister the system's base product subscription. Default is false.

journald_persistent: true: instructs journald to create the /var/log/journal directory and store logs permanently. journald_persistent is a Boolean datatype and accepts values accepts values true andfalse. Default is false.

journald_max_disk_size: 1024: limits the total disk space the journal files may use up to 1 Gigabyte (1024 MB). journald_max_disk_size is an integer datatype and accepts an integer representing a size in megabytes (MB). No value is explicitly configured by this role; therefore, the default sizing logic from man 5 journald.conf applies.

journald_per_user: true: Enables per-user logging. Logs are kept separate for individual users, allowing unprivileged users to read logs related only to their own services. journald_per_user is a Boolean datatype and accepts values true,false,yes,no, 0 and 1. Default is false.

journald_sync_interval: 1: limits the total disk space the journal files may use up to 1 Gigabyte (1024 MB). journald_max_disk_size is an integer datatype and accepts an integer representing a time span in minutes. By default role does not alter currently used value.

journald_persistent: true: instructs journald to create the /var/log/journal directory and store logs permanently. service is a Boolean datatype and accepts values accepts values true,false,yes,no, 0 and 1. Default is false.

journald_max_disk_size: 1024: limits the total disk space the journal files may use up to 1 Gigabyte (1024 MB). journald_max_disk_size is an integer datatype and accepts an integer representing a size in megabytes (MB). No value is explicitly configured by this role; therefore, the default sizing logic from man 5 journald.conf applies.

podman_firewall: controls the necessary firewall configurations on the host to ensure container ports are accessible. It is a list of dictionaries, where each dictionary defines a single firewall rule for a container. The accepted values are specified as key-value pairs within these dictionaries. The most common and crucial keys accepted within each dictionary item are port, state, zone and masquerade. Default is an empty list [] or null.

podman_kube_specs: defines and manage Podman containers or pods based on Kubernetes YAML specifications. It is a list of dictionaries and each dictionary item defines one container or pod deployment and requires one of the following keys to specify the Kubernetes YAML source: kube_file_src or kube_file_content. Default is an empty list [] or null.

certificate_requests: defines the specific details of the certificates the role needs to issue, manage, or renew. It is a list of dictionaries and each item in the list is a dictionary specifies the properties of one unique certificate to be managed. The default is an empty list []. If this list is empty, the role performs no certificate management actions. Each dictionary within the certificate_requests list must define at least the certificate name and the issuing Certificate Authority. Other parameters specify the key size, subject, and domains. In this example, name, ca are string data types and required. dns can be either a list or string and is optional.

Certificates: /etc/ssl/certs

Keys: /etc/ssl/certs/private

crypto_policies_policy: "FUTURE": is used to system-wide cryptographic settings on compatible Linux distributions. crypto_policies_policyis a stringdatatype and accepts values DEFAULT, FUTURE, LEGACY and custom policies that Administrators can define. Default is null.

crypto_policies_reload: true: ensures that the new cryptographic policy takes effect immediately by attempting to restart or reload services that rely on the system's cryptographic libraries. crypto_policies_reloadis a Booleandatatype and accepts values true and false can define. Default is true.

crypto_policies_reboot_ok: false: dictates whether the playbook is permitted to automatically reboot the managed server after changing the cryptographic policy. crypto_policies_reboot_okis a Booleandatatype and accepts values true and false can define. Default is false.

crypto_policies_policy: "DEFAULT:NO-SHA1: is used to system-wide cryptographic settings on compatible Linux distributions. crypto_policies_policyis a stringdatatype and accepts values DEFAULT, FUTURE, LEGACY and custom policies that Administrators can define. Default is null. In this example, you are using the DEFAULT policy as a starting point and then modifying it with the built-in NO-SHA1 sub-policy.

crypto_policies_reload: false: ensures that the new cryptographic policy takes effect immediately by attempting to restart or reload services that rely on the system's cryptographic libraries. crypto_policies_reloadis a Booleandatatype and accepts values true and false can define. Default is true.

mssql_accept_microsoft_sql_server_standard_eula: explicitly confirms the user agrees to the Microsoft SQL Server End-User License Agreement (EULA). It is a mandatory Boolean datatype and accpets values trueor false. It must be set to true in your playbook or inventory for the role to proceed with the installation of SQL Server. If set to false, the installation tasks will fail or be skipped. The default is empty{}.

mssql_password: sets the password for the Administrator sa user. It is a mandatory string datatype. The password must have a minimum length of 8 characters, include uppercase and lowercase letters, base 10 digits or non-alphanumeric symbols. Default is null.

mssql_edition: defines the specific version of Microsoft SQL Server to be installed on the host. It is a mandatory string datatype and accepts values Enterprise, Standard, Web, Developer, Express, Evaluation and a product key in form of #####-#####-#####-#####-##### where # is a number or letter. Default is null.

selinux_restore_dirs: specifies file system paths on the managed node where the SELinux contexts should be immediately reapplied or corrected (using the equivalent of the restorecon utility). It is a list of strings, where each string is a file system tree where you want to run restorecon.

selinux_ports: manages the SELinux port labeling policy on a managed node. It is a list of dictionaries with each dictionary defining a specific port rule. ports are strings or a list and define port numbers to which you want to assign the SELinux label. Multiple values separated by a comma are accepted. proto is a string datatype and defines the network protocol. setype is a string datatype and defines the SELinux type (label) to assign to the port.

ssh_user: is a role specific variable used to determine the scope of the SSH client configuration being deployed. The default value is null or undefined, which means the role is configured to manage the global, system-wide SSH client configuration, which is located at /etc/ssh/ssh_config on the managed node.

ssh_ForwardX11: controls whether X11 forwarding should be automatically enabled when establishing an SSH connection to a remote host. It determines if the graphical interface environment (X Window System) of the remote host should be tunneled securely back to the local client machine, allowing the user to run remote graphical applications. It is a Boolean datatype with values yes and no.

systemd_unit_file_templates: specifies a list of Jinja2 template file names residing on the control node that should be rendered and deployed as full systemd unit files on the managed nodes. It is a list of strings or dictionaries. Each item specifies a Jinja2 template file located in the role's templates/ directory. Default is an empty list [] or null.

systemd_started_units: specifies which systemd units should be set to the started state on the managed nodes. It is a list of strings or dictionaries. Default is an empty list [].

systemd_enabled_units: specifies which systemd unit files should be enabled on the managed nodes, ensuring they start automatically at boot. It is a list of strings or dictionaries. Default is an empty list []

timesync_ntp_servers: is a primary mechanism for an administrator to specify which external network time sources (NTP servers) the managed Linux host should use for clock synchronization. It is a list of dictionaries.The default is an empty list[]. Each dictionary entry within the timesync_ntp_serverslist defines a single time source and its desired configuration options. In this example, hostname is a required string datatype and iburst is an optional Boolean datatype.

timesync_ptp_domains: configures Precision Time Protocol (PTP) synchronization It is a list of dictionaries. Default is an empty list []. In this example, number is a required string datatype and interfaces are optional list of strings data types.