rhel8.beta.yml

---
- name: Configure RHEL8 Beta host
  hosts: all
  become: yes
  vars:
    ansible_python_interpreter: /usr/libexec/platform-python
    USE_FIREWALL: 1
    MOUNT_REPOS_BASE: data/BaseOS
    MOUNT_REPOS_APPSTREAM: data/AppStream


  tasks:
    - name: Mount RHEL8 ISO for copying yum repo
      mount:
        path: /mnt
        src: /dev/cdrom
        fstype: iso9660
        opts: ro
        state: mounted

    - name: Create BaseOS and AppStream directory for copying into
      file:
        path: /data
        state: directory
        mode: 0755

    - name: Copy RHEL8 ISO AppStream
      command: cp -rp /mnt/AppStream /data/AppStream
      tags: copy

    - name: Copy RHEL8 ISO BaseOS
      command: cp -rp /mnt/BaseOS /data/BaseOS
      tags: copy

    - name:  Configure Composer Source Content for RHEL 8 base
      yum_repository:
        name: composer-rhel-8-BaseOS
        description: Red Hat Enterprise Linux 8 Server (RPMs)
        file: composer
        metadata_expire: 86400
        baseurl: file:///{{ MOUNT_REPOS_BASE }}
        gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
        enabled: 1
        gpgcheck: 0
        state: present

    - name:  Configure Composer Source Content for RHEL 8 appstream
      yum_repository:
        name: composer-rhel-8-AppStream
        description: Red Hat Enterprise Linux 8 AppStream
        file: composer
        metadata_expire: 86400
        baseurl: file:///{{ MOUNT_REPOS_APPSTREAM }}
        gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
        enabled: 1
        gpgcheck: 0
        state: present

    - name: Install Composer & Cockpit packages, Container tools, VDO, sos
      yum:
        name: cockpit, cockpit-dashboard, libvirt-dbus, cockpit-machines, cockpit-composer, composer-cli, lorax-composer, cockpit-pcp, cockpit-session-recording, subscription-manager-cockpit, cockpit-storaged, cockpit-system, policycoreutils-python-utils, tlog, buildah, podman, skopeo, tree, vdo, kmod-kvdo, python3-pyyaml, sos, pcp-zeroconf
        state: installed

    - name: Configure Firewall for Cockpit
      firewalld:
        service: "{{ item }}"
        permanent: true
        state: enabled
        immediate: yes
      with_items:
        - 'cockpit'

    - name: Set SELinux in permissive mode
      selinux:
        policy: targeted
        state: permissive

    - name: Enable and Start Composer service
      service:
        name: lorax-composer.service
        state: started
        enabled: yes

    - name: Enable and Start Cockpit service
      service:
        name: cockpit.socket
        state: started
        enabled: yes

    - name: Install packages needed for Composer repos
      yum:
        name: yum-utils, createrepo, httpd
        state: installed

    - name: Configure Firewall for httpd served repos
      firewalld:
        service: "{{ item }}"
        permanent: true
        state: enabled
        immediate: yes
      with_items:
        - 'http'

    - name: Enable and Start httpd service
      service:
        name: httpd.service
        state: started
        enabled: yes

    - name: Allow apache to modify files in /var/www/html/
      sefcontext:
        target: '/var/www/html/'
        setype: httpd_sys_content_t
        state: present

    - name: Apply new SELinux file context to filesystem
      command: restorecon -irv /var/www/html/

    - name: Add ansible user to host
      user:
        name: ansible
        shell: /bin/bash
        generate_ssh_key: yes 
        ssh_key_bits: 2048
        ssh_key_file: .ssh/id_rsa
        password: $6$tn2vIE9oCq.fjQ4r$tUKqkzanIl55aViCecXtOQaqbnKazTni4lDbkOAoSUYt6gjDSC4.XfjfJlHlC7939m88IuyRhCJJ3N7l5SKzD1
        state: present
    
    - name: Ensure /etc/sudoers.d/users file exists
      copy:
        content: ""
        dest: /etc/sudoers.d/ansible
        force: no
        group: sys 
        owner: root
        mode: 0555

    - name: Add untrusted tlog user to host
      user:
        name: untrusted
        shell: /usr/bin/tlog-rec-session
        password: $6$WuZGf6olMVyQmia.$hy3tF2m0GdpgCoHWlRbK3TGQI/Zj2LMmiuXQXureVMrTgcu/JSlBmY.0aQfgynH.WLXzFWbnkoCHvj.faiCY00
        state: present

    - name: Remove subscription manager and yum repo warnings
      lineinfile:
        path: /etc/yum/pluginconf.d/subscription-manager.conf
        regexp: '^enabled='
        line: 'enabled=0'

    - name: Remove subscription manager and yum repo warnings
      lineinfile:
        path: /etc/yum/pluginconf.d/product-id.conf
        regexp: '^enabled='
        line: 'enabled=0'
# 
# Azure cli isn't installable just yet, there's a dependency error in their RPM, "python" needs to specify a version, this
# is likely due to the python changes in RHEL8
#
#    - name: Allow ansible user to have passwordless sudo
#      lineinfile:
#        dest: /etc/sudoers.d/ansible
#        state: present
#        line: 'ansible   ALL=(ALL) NOPASSWD: ALL'
#        validate: 'visudo -cf %s'
#
#    - name: Import Microsoft Azure GPG key
#      rpm_key:
#        key: https://packages.microsoft.com/keys/microsoft.asc
#        state: present
#
#    - name: Create azure-cli yum repo
#      yum_repository:
#        name: azure-cli
#        description: Azure CLI
#        file: azure-cli
#        baseurl: https://packages.microsoft.com/yumrepos/azure-cli
#        gpgkey: https://packages.microsoft.com/keys/microsoft.asc
#        enabled: 1
#        gpgcheck: 1
#        state: present
# 
#    - name: Install azure-cli package
#      yum:
#        name: azure-cli
#        state: installed
#
#   - name: Install pip under user ansible (as to not break system python)
#      command: pip3 install --user ansible