main.yml 1.95 KB
Newer Older
Hinrikus Wolf's avatar
Hinrikus Wolf committed
1
2
3
4
---
# file: roles/ad-server/tasks/main.yml

- name: ensure ad-server is installed
Lars Beckers's avatar
Lars Beckers committed
5
6
7
8
  apt:
    name: samba
    state: present
  tags:
Hinrikus Wolf's avatar
Hinrikus Wolf committed
9
10
11
    - ad-server

- name: ensure winbind is for some reasons installed
Lars Beckers's avatar
Lars Beckers committed
12
13
14
15
  apt:
    name: winbind
    state: present
  tags:
Hinrikus Wolf's avatar
Hinrikus Wolf committed
16
17
18
    - ad-server

- name: figure out if domain is provisioned
Lars Beckers's avatar
Lars Beckers committed
19
20
  stat:
    path: "/var/lib/samba/sysvol/{{ domain }}"
Hinrikus Wolf's avatar
Hinrikus Wolf committed
21
  register: domain_provisioned
Lars Beckers's avatar
Lars Beckers committed
22
  tags:
Hinrikus Wolf's avatar
Hinrikus Wolf committed
23
24
25
26
    - ad-server
    - domain-provision

- name: ensure smb.conf is absent for provision
Lars Beckers's avatar
Lars Beckers committed
27
28
29
  file:
    path: /etc/samba/smb.conf
    state: absent
Hinrikus Wolf's avatar
Hinrikus Wolf committed
30
31
32
33
34
  when: domain_provisioned.stat.exists == False
  tags:
    - ad-server
    - domain-provision

Lars Beckers's avatar
Lars Beckers committed
35
# passwords will be selected at random and safed to /root/smb-provision.log)
Hinrikus Wolf's avatar
Hinrikus Wolf committed
36
- name: ensure domain is provisioned
Lars Beckers's avatar
Lars Beckers committed
37
38
  # yamllint disable-line rule:line-length
  shell: samba-tool domain provision --use-rfc2307 --domain={{ smb_domain }} --server-role=dc --host-name={{ ansible_hostname }} --realm={{ REALM }} --dns-backend=NONE --adminpass={{ lookup('passwordstore', ad_admin_password) }} 2>/root/smb-provision.log
Hinrikus Wolf's avatar
Hinrikus Wolf committed
39
  when: domain_provisioned.stat.exists == False
Lars Beckers's avatar
Lars Beckers committed
40
41
  no_log: true
  tags:
Hinrikus Wolf's avatar
Hinrikus Wolf committed
42
43
44
45
    - ad-server
    - domain-provision

- name: ensure smb.conf is correct
Lars Beckers's avatar
Lars Beckers committed
46
47
48
49
50
51
  template:
    src: smb.conf.j2
    dest: /etc/samba/smb.conf
    owner: root
    group: root
    mode: '0644'
Hinrikus Wolf's avatar
Hinrikus Wolf committed
52
  notify: restart samba-ad-dc server
Lars Beckers's avatar
Lars Beckers committed
53
  tags:
Hinrikus Wolf's avatar
Hinrikus Wolf committed
54
55
56
    - ad-server

- name: ensure smbd is stopped and disabled
Lars Beckers's avatar
Lars Beckers committed
57
58
59
60
61
  service:
    name: smbd
    state: stopped
    enabled: false
  tags:
Hinrikus Wolf's avatar
Hinrikus Wolf committed
62
63
64
    - ad-server

- name: ensure nmbd is stopped and disabled
Lars Beckers's avatar
Lars Beckers committed
65
66
67
68
69
  service:
    name: nmbd
    state: stopped
    enabled: false
  tags:
Hinrikus Wolf's avatar
Hinrikus Wolf committed
70
71
    - ad-server

72
- name: ensure samba-ad-dc unit is running, enabled and not masked
Lars Beckers's avatar
Lars Beckers committed
73
74
75
76
77
78
  systemd:
    name: samba-ad-dc
    masked: false
    state: started
    enabled: true
  tags:
79
    - ad-server
Hinrikus Wolf's avatar
Hinrikus Wolf committed
80
81

- name: ensure samba-ad-dc is running and enabled
Lars Beckers's avatar
Lars Beckers committed
82
83
84
85
86
  service:
    name: samba-ad-dc
    state: started
    enabled: true
  tags:
Hinrikus Wolf's avatar
Hinrikus Wolf committed
87
88
89
    - ad-server

- meta: flush_handlers