mirror of
https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git
synced 2026-10-26 12:57:21 +00:00
Merge branch 'checkmk'
This commit is contained in:
abrown38 committed
commit
b414380cd5
16 files changed
+430
-152
No files matched your search
+108
-37
@@ -1,4 +1,91 @@
|
||||
---
|
||||
- name: CheckMK Hosts
|
||||
hosts: "meta-win_project_{{ win_project }}:&meta-os_windows"
|
||||
gather_facts: false
|
||||
vars_files:
|
||||
- ../vars/checkmk.yml
|
||||
- ../vars/common.yml
|
||||
tasks:
|
||||
- name: "Create folder for eidf project"
|
||||
checkmk.general.folder:
|
||||
server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
|
||||
site: "{{ checkmk_agent_site }}"
|
||||
automation_user: "{{ checkmk_agent_user }}"
|
||||
automation_secret: "{{ checkmk_password }}"
|
||||
path: "/{{ os_project }}-{{ win_project }}"
|
||||
name: "{{ os_project }}-{{ win_project }}"
|
||||
state: "{{ state }}" # might need to create hosts them move so teardown works??? or leave folder after teardown or add only teardown task after
|
||||
run_once: true
|
||||
delegate_to: "localhost"
|
||||
tags:
|
||||
- checkmk_folder
|
||||
- checkmk_host
|
||||
- checkmk_all
|
||||
|
||||
- name: Add Windows host into checkMK
|
||||
checkmk.general.host:
|
||||
server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
|
||||
site: "{{ checkmk_agent_site }}"
|
||||
validate_certs: "true"
|
||||
automation_user: "{{ checkmk_agent_user }}"
|
||||
automation_secret: "{{ checkmk_password }}"
|
||||
folder: "/{{ os_project }}-{{ win_project }}"
|
||||
name: "{{ inventory_hostname }}"
|
||||
attributes:
|
||||
ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}"
|
||||
tag_Variant: "{{ hostvars[inventory_hostname].openstack.metadata.variant }}"
|
||||
tag_project_zone: "{{ project_zone }}"
|
||||
state: "{{ state }}"
|
||||
delegate_to: "localhost"
|
||||
notify: "activate changes"
|
||||
tags:
|
||||
- checkmk_host
|
||||
- checkmk_all
|
||||
|
||||
- name: "Create folder for eidf project"
|
||||
checkmk.general.folder:
|
||||
server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
|
||||
site: "{{ checkmk_agent_site }}"
|
||||
automation_user: "{{ checkmk_agent_user }}"
|
||||
automation_secret: "{{ checkmk_password }}"
|
||||
path: "/{{ os_project }}-{{ win_project }}"
|
||||
name: "{{ os_project }}-{{ win_project }}"
|
||||
state: "{{ state }}" # might need to create hosts them move so teardown works??? or leave folder after teardown or add only teardown task after
|
||||
run_once: true
|
||||
notify: "activate changes"
|
||||
delegate_to: "localhost"
|
||||
tags:
|
||||
- teardown
|
||||
|
||||
- name: Move Proxy to project specific checkmk folder
|
||||
checkmk.general.host:
|
||||
server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
|
||||
site: "{{ checkmk_agent_site }}"
|
||||
validate_certs: "true"
|
||||
automation_user: "{{ checkmk_agent_user }}"
|
||||
automation_secret: "{{ checkmk_password }}"
|
||||
folder: "/{{ os_project }}-{{ win_project }}"
|
||||
name: "{{ os_project }}-{{ win_project }}-proxy"
|
||||
state: "present"
|
||||
run_once: true
|
||||
delegate_to: "localhost"
|
||||
notify: "activate changes"
|
||||
when: project_zone == 'protected'
|
||||
tags: checkmk_proxy
|
||||
|
||||
handlers:
|
||||
- name: "Activate Changes"
|
||||
listen: activate changes
|
||||
checkmk.general.activation:
|
||||
server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
|
||||
site: "{{ checkmk_agent_site }}"
|
||||
automation_user: "{{ checkmk_agent_user }}"
|
||||
automation_secret: "{{ checkmk_password }}"
|
||||
force_foreign_changes: "false"
|
||||
validate_certs: "true"
|
||||
delegate_to: "localhost"
|
||||
run_once: true
|
||||
|
||||
- name: CheckMK Agent
|
||||
hosts: "meta-win_project_{{ win_project }}:&meta-os_windows"
|
||||
gather_facts: false
|
||||
@@ -24,41 +111,25 @@
|
||||
- checkmk_all
|
||||
- checkmk_agent
|
||||
|
||||
- name: CheckMK Hosts
|
||||
hosts: "meta-win_project_{{ win_project }}:&meta-os_windows"
|
||||
gather_facts: false
|
||||
vars_files:
|
||||
- ../vars/checkmk.yml
|
||||
- ../vars/common.yml
|
||||
tasks:
|
||||
- name: Add Windows host into check
|
||||
checkmk.general.host:
|
||||
server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
|
||||
site: "{{ checkmk_agent_site }}"
|
||||
validate_certs: "true"
|
||||
automation_user: "{{ checkmk_agent_user }}"
|
||||
automation_secret: "{{ checkmk_password }}"
|
||||
folder: "/"
|
||||
name: "{{ inventory_hostname }}"
|
||||
attributes:
|
||||
ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}"
|
||||
state: "{{ state }}"
|
||||
delegate_to: "localhost"
|
||||
notify: "activate changes"
|
||||
tags:
|
||||
- checkmk_host
|
||||
- checkmk_all
|
||||
- teardown
|
||||
- name: TLS registrtion
|
||||
block:
|
||||
- name: register for TLS
|
||||
win_shell: |
|
||||
sl 'C:\Program Files (x86)\checkmk\service'
|
||||
.\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
|
||||
#when: project_zone == 'standard' or
|
||||
# inventory_hostname in groups['meta-type_server']
|
||||
|
||||
#- name: register TLS on client (Protected)
|
||||
# vars:
|
||||
# ansible_connection: local
|
||||
# shell: |
|
||||
# sudo cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
|
||||
# delegate_to: localhost
|
||||
# when: project_zone == 'protected' and
|
||||
# inventory_hostname in groups['meta-type_client']
|
||||
tags:
|
||||
- checkmk_host
|
||||
- checkmk_tls
|
||||
- checkmk_all
|
||||
|
||||
handlers:
|
||||
- name: "Activate Changes"
|
||||
listen: activate changes
|
||||
checkmk.general.activation:
|
||||
server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
|
||||
site: "{{ checkmk_agent_site }}"
|
||||
automation_user: "{{ checkmk_agent_user }}"
|
||||
automation_secret: "{{ checkmk_password }}"
|
||||
force_foreign_changes: "false"
|
||||
validate_certs: "true"
|
||||
delegate_to: "localhost"
|
||||
run_once: true
|
||||
@@ -1,9 +1,16 @@
|
||||
---
|
||||
- hosts: localhost
|
||||
vars:
|
||||
vm_status: "{{ lookup('file', '/deployments/{{ os_project }}-{{ win_project }}/VM_STATUS') }}"
|
||||
vars_files:
|
||||
- ../vars/common.yml
|
||||
- ../vars/{{ project_zone }}.yml
|
||||
tasks:
|
||||
- name: End early if VM already created
|
||||
block:
|
||||
- meta: end_play
|
||||
when: vm_status == 'created'
|
||||
|
||||
- name: Create workbench VMs (ASYNCHRONUS)
|
||||
tags: teardown
|
||||
os_server:
|
||||
@@ -299,3 +306,13 @@
|
||||
variant: web_proxy
|
||||
os: linux
|
||||
when: project_zone == 'protected'
|
||||
|
||||
- name: Set VM Status
|
||||
vars:
|
||||
ansible_connection: local
|
||||
replace:
|
||||
path: /deployments/{{ os_project }}-{{ win_project }}/VM_STATUS
|
||||
regexp: '^pending$'
|
||||
replace: 'created'
|
||||
delegate_to: localhost
|
||||
run_once: True
|
||||
@@ -9,6 +9,6 @@
|
||||
- ../vars/common.yml
|
||||
roles:
|
||||
- role: win_proxy
|
||||
become: yes
|
||||
become: true
|
||||
tags: win_proxy
|
||||
when: project_zone == 'protected'
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
- import_tasks: features.yml
|
||||
- import_tasks: chocolatey.yml
|
||||
- import_tasks: rd_gateway.yml
|
||||
- import_tasks: rdgw.yml
|
||||
- import_tasks: start_menu.yml
|
||||
File renamed without changes.
@@ -32,6 +32,7 @@
|
||||
|
||||
- name: Reboot VMs before continuing
|
||||
win_reboot:
|
||||
# Need a condition here for reruns
|
||||
|
||||
- name: Remove Local Admin
|
||||
tags:
|
||||
|
||||
@@ -4,3 +4,14 @@
|
||||
ansible.builtin.service:
|
||||
name: "{{ squid_service }}"
|
||||
state: restarted
|
||||
|
||||
- name: "Activate Changes"
|
||||
listen: activate changes
|
||||
checkmk.general.activation:
|
||||
server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
|
||||
site: "{{ checkmk_agent_site }}"
|
||||
automation_user: "{{ checkmk_agent_user }}"
|
||||
automation_secret: "{{ checkmk_password }}"
|
||||
force_foreign_changes: "false"
|
||||
validate_certs: "false"
|
||||
run_once: true
|
||||
@@ -0,0 +1,37 @@
|
||||
---
|
||||
|
||||
- name: Gather the package facts
|
||||
ansible.builtin.package_facts:
|
||||
manager: apt
|
||||
|
||||
- name: Setup CheckMK agent
|
||||
block:
|
||||
- name: Include CheckMK variables
|
||||
ansible.builtin.include_vars:
|
||||
file: ../vars/checkmk.yml
|
||||
|
||||
- name: Add proxy host into checkMK
|
||||
checkmk.general.host:
|
||||
server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
|
||||
site: "{{ checkmk_agent_site }}"
|
||||
validate_certs: "true"
|
||||
automation_user: "{{ checkmk_agent_user }}"
|
||||
automation_secret: "{{ checkmk_password }}"
|
||||
folder: "/"
|
||||
name: "{{ inventory_hostname }}"
|
||||
attributes:
|
||||
ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}"
|
||||
tag_Variant: "proxy"
|
||||
tag_project_zone: "{{ project_zone }}"
|
||||
state: "present"
|
||||
notify: "activate changes"
|
||||
|
||||
- name: Install CheckMK Agent
|
||||
import_role:
|
||||
name: checkmk.general.agent
|
||||
when: ansible_facts.packages['check-mk-agent'] | default('Missing') == 'Missing'
|
||||
|
||||
- name: register agent for TLS
|
||||
shell: |
|
||||
cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
|
||||
|
||||
@@ -70,3 +70,8 @@
|
||||
enabled: true
|
||||
when:
|
||||
- not ansible_check_mode
|
||||
|
||||
- name: Import checkmk.yml
|
||||
import_tasks:
|
||||
file: checkmk.yml
|
||||
tags: proxy_cmk
|
||||
@@ -1 +0,0 @@
|
||||
setup_wsus_v1.0.ps1
|
||||
Whitespace-only changes.
@@ -0,0 +1 @@
|
||||
wsus_setup_v1.0.ps1
|
||||
@@ -0,0 +1,216 @@
|
||||
###############
|
||||
## Variables ##
|
||||
###############
|
||||
|
||||
##//INSTALLATION//##
|
||||
|
||||
# Do you want to install .NET FRAMEWORK 3.5? If true, provide a location for the Windows OS media in the next variable
|
||||
$DotNet = $True
|
||||
# Do you want to download and install MS Report Viewer 2008 SP1 (required for WSUS Reports)?
|
||||
$RepViewer = $True
|
||||
# WSUS Installation Type. Enter "WID" (for WIndows Internal Database), "SQLExpress" (to download and install a local SQLExpress), or "SQLRemote" (for an existing SQL Instance).
|
||||
$WSUSType = "WID"
|
||||
# Location to store WSUS Updates (will be created if doesn't exist)
|
||||
$WSUSDir = "W:\WSUS"
|
||||
# Temporary location for installation files (will be created if doesn't exist)
|
||||
$TempDir = "W:\temp"
|
||||
|
||||
##//CONFIGURATION//##
|
||||
|
||||
# Do you want to configure WSUS (equivalent of WSUS Configuration Wizard, plus some additional options)? If $false, no further variables apply.
|
||||
# You can customise the configurations, such as Products and Classifications etc, in the "Begin Initial Configuration of WSUS" section of the script.
|
||||
$ConfigureWSUS = $True
|
||||
# Do you want to decline some unwanted updates?
|
||||
$DeclineUpdates = $True
|
||||
# Do you want to configure and enable the Default Approval Rule?
|
||||
$DefaultApproval = $True
|
||||
# Do you want to run the Default Approval Rule after configuring?
|
||||
$RunDefaultRule = $False
|
||||
|
||||
|
||||
# Install .Net Framework 3.5
|
||||
if($DotNet -eq $true)
|
||||
{
|
||||
write-host 'Installing .Net Framework 3.5'
|
||||
Install-WindowsFeature -name NET-Framework-Core
|
||||
}
|
||||
|
||||
if (Test-Path -Path $WSUSDir) {
|
||||
Write-Host 'Content Directory Exists'
|
||||
} else {
|
||||
sl "C:\Program Files\Update Services\Tools"
|
||||
.\wsusutil.exe postinstall CONTENT_DIR=$WSUSDir
|
||||
}
|
||||
|
||||
# Get WSUS Server Object
|
||||
$wsus = Get-WSUSServer
|
||||
|
||||
# Connect to WSUS server configuration
|
||||
$wsusConfig = $wsus.GetConfiguration()
|
||||
|
||||
# Set to download updates from Microsoft Updates
|
||||
Set-WsusServerSynchronization -SyncFromMU
|
||||
|
||||
# Set Update Languages to English and save configuration settings
|
||||
$wsusConfig.AllUpdateLanguagesEnabled = $false
|
||||
$wsusConfig.SetEnabledUpdateLanguages("en")
|
||||
$wsusConfig.Save()
|
||||
|
||||
|
||||
|
||||
|
||||
# Get WSUS Subscription and perform initial synchronization to get latest categories
|
||||
$subscription = $wsus.GetSubscription()
|
||||
$subscription.StartSynchronizationForCategoryOnly()
|
||||
write-host 'Beginning first WSUS Sync to get available Products etc' -ForegroundColor Magenta
|
||||
write-host 'Will take some time to complete'
|
||||
While ($subscription.GetSynchronizationStatus() -ne 'NotProcessing') {
|
||||
Write-Host "." -NoNewline
|
||||
Start-Sleep -Seconds 5
|
||||
}
|
||||
write-host ' '
|
||||
Write-Host "Sync is done." -ForegroundColor Green
|
||||
|
||||
|
||||
|
||||
|
||||
# Configure the Platforms that we want WSUS to receive updates
|
||||
write-host 'Setting WSUS Products'
|
||||
Get-WsusProduct | where-Object {
|
||||
$_.Product.Title -in (
|
||||
'.NET 5.0',
|
||||
'.NET 6.0',
|
||||
'.NET 7.0',
|
||||
'.NET 8.0',
|
||||
'.NET Core 2.1',
|
||||
'.NET Core 3.1',
|
||||
'Active Directory',
|
||||
'Microsoft 365 Apps/Office 2019/Office LTSC',
|
||||
'Microsoft Defender Antivirus',
|
||||
'Microsoft Security Essentials',
|
||||
'Microsoft Server operating system-21H2',
|
||||
'Microsoft Server Operating System-22H2',
|
||||
'Microsoft Server Operating System-23H2',
|
||||
'Microsoft Server Operating System-24H2',
|
||||
'Microsoft SQL Server 2012',
|
||||
'Microsoft SQL Server 2014',
|
||||
'Microsoft SQL Server 2016',
|
||||
'Microsoft SQL Server 2017',
|
||||
'Microsoft SQL Server 2019',
|
||||
'Microsoft SQL Server 2022',
|
||||
'Microsoft SQL Server Management Studio v17',
|
||||
'Microsoft SQL Server Management Studio v18',
|
||||
'Microsoft SQL Server Management Studio v19',
|
||||
'Microsoft SQL Server Management Studio v20',
|
||||
'MS Security Essentials',
|
||||
'PowerShell - x64',
|
||||
'PowerShell',
|
||||
'Security Essentials',
|
||||
'Server 2022 Hotpatch Category',
|
||||
'Silverlight',
|
||||
'Silverlight',
|
||||
'Visual Studio 2012',
|
||||
'Visual Studio 2013',
|
||||
'Visual Studio 2015 Update 3',
|
||||
'Visual Studio 2015',
|
||||
'Visual Studio 2017',
|
||||
'Visual Studio 2019',
|
||||
'Visual Studio 2022',
|
||||
'Windows Admin Center',
|
||||
'Windows - Server, version 21H2 and later, Servicing Drivers',
|
||||
'Windows - Server, version 21H2 and later, Upgrade & Servicing Drivers',
|
||||
'Windows - Server, version 24H2 and later, Upgrade & Servicing Drivers',
|
||||
'Windows Dictionary Updates',
|
||||
'Windows Security platform',
|
||||
'Windows Server 2019 and later, Servicing Drivers',
|
||||
'Windows Server 2019 and later, Upgrade & Servicing Drivers',
|
||||
'Windows Server 2019',
|
||||
'Windows Server 2019',
|
||||
'Windows Server Drivers',
|
||||
'Windows Server Manager Windows Server Update Services (WSUS) Dynamic Installer',
|
||||
'Windows Server Technical Preview Language Packs',
|
||||
'Windows Server, version 1903 and later')
|
||||
} | Set-WsusProduct
|
||||
|
||||
Get-WsusProduct | where-Object { $_.Product.Title -eq 'Windows' } | Set-WsusProduct -Disable
|
||||
Get-WsusProduct | where-Object { $_.Product.Title -eq 'Developer Tools, Runtimes, and Redistributables' } | Set-WsusProduct -Disable
|
||||
|
||||
# Configure the Classifications
|
||||
write-host 'Setting WSUS Classifications'
|
||||
Get-WsusClassification | Where-Object {
|
||||
$_.Classification.Title -in (
|
||||
'Critical Updates',
|
||||
'Definition Updates',
|
||||
'Security Updates')
|
||||
} | Set-WsusClassification
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
# Prompt to check products are set correctly
|
||||
write-host 'Before continuing, please open the WSUS Console, cancel the WSUS Configuration Wizard,' - -ForegroundColor Red
|
||||
write-host 'Go to Options > Products and Classifications, and check that the Products are set correctly.' - -ForegroundColor Red
|
||||
write-host 'Pausing script' -ForegroundColor Yellow
|
||||
$Shell = New-Object -ComObject "WScript.Shell"
|
||||
$Button = $Shell.Popup("Click OK to continue.", 0, "Script Paused", 0) # Using Pop-up in case script is running in ISE
|
||||
|
||||
|
||||
|
||||
|
||||
# Configure Synchronizations
|
||||
write-host 'Enabling WSUS Automatic Synchronisation'
|
||||
$subscription.SynchronizeAutomatically=$true
|
||||
|
||||
# Set synchronization scheduled for midnight each night
|
||||
$subscription.SynchronizeAutomaticallyTimeOfDay= (New-TimeSpan -Hours 0)
|
||||
$subscription.NumberOfSynchronizationsPerDay=1
|
||||
$subscription.Save()
|
||||
|
||||
# Kick off a synchronization
|
||||
$subscription.StartSynchronization()
|
||||
|
||||
|
||||
|
||||
# Monitor Progress of Synchronisation
|
||||
|
||||
write-host 'Starting WSUS Sync, will take some time' -ForegroundColor Magenta
|
||||
Start-Sleep -Seconds 60 # Wait for sync to start before monitoring
|
||||
while ($subscription.GetSynchronizationProgress().ProcessedItems -ne $subscription.GetSynchronizationProgress().TotalItems) {
|
||||
Write-Progress -PercentComplete (
|
||||
$subscription.GetSynchronizationProgress().ProcessedItems*100/($subscription.GetSynchronizationProgress().TotalItems)
|
||||
) -Activity "WSUS Sync Progress"
|
||||
}
|
||||
Write-Host "Sync is done." -ForegroundColor Green
|
||||
|
||||
|
||||
### DECLINE STUFF
|
||||
|
||||
|
||||
#NEED TO try set-wsusproduct -disable
|
||||
|
||||
# Configure Default Approval Rule
|
||||
|
||||
if ($DefaultApproval -eq $True)
|
||||
{
|
||||
write-host 'Configuring default automatic approval rule'
|
||||
[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")
|
||||
$rule = $wsus.GetInstallApprovalRules() | Where {
|
||||
$_.Name -eq "Default Automatic Approval Rule"}
|
||||
$class = $wsus.GetUpdateClassifications() | ? {$_.Title -In (
|
||||
'Critical Updates',
|
||||
'Definition Updates',
|
||||
'Feature Packs',
|
||||
'Security Updates',
|
||||
'Service Packs',
|
||||
'Update Rollups',
|
||||
'Updates')}
|
||||
$class_coll = New-Object Microsoft.UpdateServices.Administration.UpdateClassificationCollection
|
||||
$class_coll.AddRange($class)
|
||||
$rule.SetUpdateClassifications($class_coll)
|
||||
$rule.Enabled = $True
|
||||
$rule.Save()
|
||||
}
|
||||
|
||||
$Apply = $rule.ApplyRule()
|
||||
|
||||
@@ -2,16 +2,18 @@
|
||||
- name: Configure WSUS server
|
||||
tags: configure_wsus
|
||||
block:
|
||||
- name: Ensure Content directory exists
|
||||
win_file:
|
||||
path: "{{ wsus_content_directory }}"
|
||||
state: directory
|
||||
#- name: Check if Content directory already exists
|
||||
# win_stat:
|
||||
# path: "{{ wsus_content_directory }}"
|
||||
# register: folder
|
||||
# failed_when: folder.stat.exists
|
||||
|
||||
- name: Set WSUS Content Directory
|
||||
tags: set_wsus_content_dir
|
||||
win_shell: |
|
||||
CD "C:\Program Files\Update Services\Tools"
|
||||
.\wsusutil.exe postinstall CONTENT_DIR=W:\WSUS
|
||||
#- name: Set WSUS Content Directory
|
||||
# tags: set_wsus_content_dir
|
||||
# win_shell: |
|
||||
# CD "C:\Program Files\Update Services\Tools"
|
||||
# .\wsusutil.exe postinstall CONTENT_DIR={{ wsus_content_directory }}
|
||||
# when: not folder.stat.exists
|
||||
|
||||
- name: WSUS Script
|
||||
tags: wsus_script
|
||||
@@ -19,101 +21,11 @@
|
||||
- name: Copy WSUS script
|
||||
win_copy:
|
||||
src: "{{ wsus_script }}"
|
||||
dest: "powershell {{ script_dir }}\\{{ wsus_script }}"
|
||||
dest: "{{ script_dir }}\\{{ wsus_script }}"
|
||||
force: true
|
||||
tags: copy_wsus_script
|
||||
|
||||
- name: Apply WSUS script
|
||||
win_shell: "powershell {{ script_dir }}\\{{ wsus_script }}"
|
||||
tags: apply_wsus_script
|
||||
#- name: Apply WSUS script
|
||||
#win_shell: "powershell {{ script_dir }}\\{{ wsus_script }}"
|
||||
#tags: apply_wsus_script
|
||||
|
||||
|
||||
|
||||
#- name: Ensure WSUS server is deployed (UpdateServicesDSC) - Errors here :(
|
||||
# tags: testing
|
||||
# win_dsc:
|
||||
# resource_name: UpdateServicesServer
|
||||
# Ensure: Present
|
||||
# ContentDir: '{{ wsus_content_directory }}'
|
||||
# Languages: en
|
||||
# #Products: "{{ wsus_products }}"
|
||||
# Products: "Windows Admin Center"
|
||||
# PsDscRunAsCredential_username: Administrator
|
||||
# PsDscRunAsCredential_password: "{{ ansible_password }}"
|
||||
# #ErrorRecord: test
|
||||
# Classifications:
|
||||
# - "{{ CriticalUpdates }}"
|
||||
# #- "{{ DefinitionUpdates }}"
|
||||
# #- "{{ SecurityUpdates }}"
|
||||
# #- "{{ ServicePacks }}"
|
||||
# #- "{{ UpdateRollups }}"
|
||||
# #- "{{ Updates }}"
|
||||
# #Synchronize: True
|
||||
# SynchronizeAutomatically: True
|
||||
# SynchronizeAutomaticallyTimeOfDay: '15:30:00'
|
||||
# ClientTargetingMode: "{{ wsus_client_targeting_mode }}"
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
##- name: Configure WSUS server
|
||||
## block:
|
||||
## - name: Ensure Content directory exists
|
||||
## win_file:
|
||||
## path: '{{ wsus_content_dir }}'
|
||||
## state: directory
|
||||
## - name: Ensure WSUS server is deployed (UpdateServicesDSC) - Errors here :(
|
||||
## win_dsc:
|
||||
## resource_name: UpdateServicesServer
|
||||
## Ensure: Present
|
||||
## ContentDir: '{{ wsus_content_dir }}'
|
||||
## Languages: en
|
||||
## Products: "{{ wsus_products }}"
|
||||
## Classifications:
|
||||
## - "{{ wsus_category_names['CriticalUpdates'].id }}"
|
||||
## #- "{{ wsus_category_names['DefinitionUpdates'].id }}"
|
||||
## #- "{{ wsus_category_names['SecurityUpdates'].id }}"
|
||||
## #- "{{ wsus_category_names['ServicePacks'].id }}"
|
||||
## #- "{{ wsus_category_names['UpdateRollups'].id }}"
|
||||
## #- "{{ wsus_category_names['Updates'].id }}"
|
||||
## # Ignore upstream as we don't have one yet...
|
||||
## #UpstreamServerName: "{{ wsus_upstream_server_name | default(omit) }}"
|
||||
## #UpstreamServerPort: "{{ wsus_upstream_server_port | default(omit) }}"
|
||||
## #UpstreamServerSSL: "{{ wsus_upstream_server_ssl | default(omit) }}"
|
||||
## Synchronize: True
|
||||
## SynchronizeAutomatically: True
|
||||
## SynchronizeAutomaticallyTimeOfDay: '01:30:00'
|
||||
## ClientTargetingMode: "{{ wsus_client_targeting_mode }}"
|
||||
## ignore_errors: true
|
||||
## retries: 2
|
||||
## - name: Apply approval rules (UpdateServicesDSC)
|
||||
## win_dsc:
|
||||
## resource_name: UpdateServicesApprovalRule
|
||||
## Name: "{{ wsus_category_names[item].name }}"
|
||||
## Classifications: "{{ wsus_category_names[item].id }}"
|
||||
## Enabled: True
|
||||
## RunRuleNow: True
|
||||
## loop:
|
||||
## - CriticalUpdates
|
||||
## #- DefinitionUpdates
|
||||
## #- SecurityUpdates
|
||||
## #- ServicePacks
|
||||
## #- UpdateRollups
|
||||
## #- Updates
|
||||
## - name: Clean up updates (UpdateServicesDSC)
|
||||
## win_dsc:
|
||||
## resource_name: UpdateServicesCleanup
|
||||
## Ensure: Present
|
||||
## DeclineExpiredUpdates: True
|
||||
## DeclineSupersededUpdates: True
|
||||
## CleanupObsoleteUpdates: True
|
||||
## CleanupUnneededContentFiles: True
|
||||
## # Might be handy: https://github.com/slopez888/vsphere-ansible/blob/master/roles/wsus-server-configure/tasks/max_xml_per_request.yml
|
||||
## - name: obtain WSUS DB name
|
||||
## win_reg_stat:
|
||||
## path: HKLM:\SOFTWARE\Microsoft\Update Services\Server\Setup
|
||||
## name: SqlDatabaseName
|
||||
## register: wsus_db_name
|
||||
## when: inventory_hostname in groups['meta-Tags_wsus']
|
||||
@@ -75,12 +75,17 @@ remote_ip_rules:
|
||||
- { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "Allow ICMP"}
|
||||
- { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"}
|
||||
- { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent"}
|
||||
- { direction: "engress", protocol: "tcp", port_min: 8000, port_max: 8010, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent TLS Registration"}
|
||||
- { direction: "egress", protocol: "tcp", port_min: 8000, port_max: 8010, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent TLS Registration"}
|
||||
- { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "169.254.169.254", comment: "Openstack metadata"}
|
||||
- { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"}
|
||||
- { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"}
|
||||
- { direction: "egress", protocol: "tcp", port_min: 1514, port_max: 1515, group: "domain_member", remote_ip: "10.22.10.200/32", comment: "Wawzuh Agent"}
|
||||
- { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Wawzuh Agent"}
|
||||
# Proxy
|
||||
- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.4.71/32", comment: "SSH rundeck 1"}
|
||||
- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.172/32", comment: "SSH rundeck 2"}
|
||||
- { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.242/32", comment: "SSH rundeck 3"}
|
||||
- { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK"}
|
||||
- { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"}
|
||||
- { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"}
|
||||
|
||||
+11
-8
@@ -5,7 +5,8 @@ declare -gr OS_PROJECT=$1
|
||||
declare -gr WIN_PROJECT=$2
|
||||
declare -gr API_TOKEN=$3
|
||||
declare -g RD_JOB_ID=$4
|
||||
declare -g RD_EXEC_ID=$5
|
||||
#declare -g RD_EXEC_ID=$5
|
||||
declare -g RD_EXEC_ID=$(cat /deployments/$OS_PROJECT-$WIN_PROJECT/EXEC_ID)
|
||||
|
||||
export OS_CLIENT_CONFIG_FILE=/deployments/$OS_PROJECT-$WIN_PROJECT/clouds.yaml
|
||||
|
||||
@@ -26,10 +27,12 @@ initialize_json() {
|
||||
"job_id": "'$RD_JOB_ID'",
|
||||
"execution_id": "'$RD_EXEC_ID'",
|
||||
"status": "ok",
|
||||
"DC": {},
|
||||
"WB": {"load_balancer": true, VM: []},
|
||||
"APP": {"load_balancer": false, VM: []},
|
||||
"GPU": {"load_balancer": false, VM: []}
|
||||
"data": {
|
||||
"DC": {},
|
||||
"WB": {"load_balancer": true, VM: []},
|
||||
"APP": {"load_balancer": false, VM: []},
|
||||
"GPU": {"load_balancer": false, VM: []}
|
||||
}
|
||||
}' > $OUTPUT_FILE
|
||||
declare -g -r VM_JSON="/deployments/$OS_PROJECT-$WIN_PROJECT/data.json"
|
||||
}
|
||||
@@ -42,16 +45,16 @@ add_vm() {
|
||||
declare -r TYPE=$4
|
||||
|
||||
if [[ $TYPE == "DC" ]]; then
|
||||
jq ".${TYPE} += {\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}" $VM_JSON > temp.json
|
||||
jq ".data.${TYPE} += {\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}" $VM_JSON > temp.json
|
||||
mv -f temp.json $VM_JSON
|
||||
else
|
||||
jq ".${TYPE}.VM += [{\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}]" $VM_JSON > temp.json
|
||||
jq ".data.${TYPE}.VM += [{\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}]" $VM_JSON > temp.json
|
||||
mv -f temp.json $VM_JSON
|
||||
fi
|
||||
}
|
||||
|
||||
post_request() {
|
||||
declare -r API_ENDPOINT='https://projects.eidf.ac.uk/testportal/job/api/notification'
|
||||
declare -r API_ENDPOINT='https://portal.eidf.ac.uk/job/api/notification'
|
||||
jq -c . $VM_JSON
|
||||
curl \
|
||||
-X POST \
|
||||
|
||||
Reference in new issue
Block a user