blob: effa8d59e0015e55495406538dd8d7ac5aa1ae1c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
- hosts: localhost
become: true
tasks:
- name: Create containers user
ansible.builtin.user:
name: containers
- name: Install systemd-container and podman
ansible.builtin.package:
name:
- systemd-container
- podman
state: present
- name: Confirm systemd-linger is set for containers user
ansible.builtin.stat:
path: "/var/lib/systemd/linger/containers"
register: linger
- name: Set systemd-linger for containers user (if necessary)
ansible.builtin.shell: "loginctl enable-linger containers"
when: not linger.stat.exists
- name: Unprivileged port block
block:
- name: Confirm port 80 and above is allowed for unprivileged use
ansible.builtin.shell: "sysctl net.ipv4.ip_unprivileged_port_start |grep 80"
rescue:
- name: Set sysctl parameter net.ipv4.ip_unprivileged_port_start=80
ansible.builtin.lineinfile:
path: "/etc/sysctl.conf"
regexp: "^net.ipv4.ip_unprivileged_port_start=80"
line: "net.ipv4.ip_unprivileged_port_start=80"
- name: Reload sysctl
ansible.builtin.shell: "sysctl -p /etc/sysctl.conf"
- name: Confirm port 80 and above is allowed for unprivileged use
ansible.builtin.shell: "sysctl net.ipv4.ip_unprivileged_port_start |grep 80"
tags:
- never
- unprivileged-ports
- name: cPanel DNS-only block
block:
- name: Confirm if cpsrvd is not listening on http ports
ansible.builtin.shell: "whmapi1 get_tweaksetting key='disable_cphttpd' |grep 'value: 1' || /bin/true"
register: cpsrv_listen
- name: Turn off cpsrvd listening on http ports (if necessary)
ansible.builtin.shell: "whmapi1 set_tweaksetting key='disable_cphttpd' value='1' ; /scripts/restartsrv_cpsrvd"
when: cpsrv_listen.stdout | length == 0
- name: Turn off firewalld
ansible.builtin.service:
name: "firewalld"
state: stopped
enabled: false
- name: Create new tmp directory for podman
ansible.builtin.file:
path: /var/containers/tmp
owner: containers
group: containers
state: directory
- name: Configure podman to use new tmp directory
ansible.builtin.blockinfile:
path: /etc/containers/containers.conf
create: true
block: |
[engine]
env = ["TMPDIR=/var/containers/tmp"]
tags:
- never
- cpanel-dnsonly
|
