playbook.yaml

- name: KRG Waiter
  hosts: localhost
  vars_files:
    - waiter_users.yaml
  tasks:
  - name: Set timezone to America/Los_Angeles
    become: true
    community.general.timezone:
      name: America/Los_Angeles
  - name: Install netplan config
    become: true
    ansible.builtin.copy:
      src: netplan/01-waiter.yml
      dest: /etc/netplan/01-waiter.yaml
      owner: root
      group: root
      mode: '0600'
  - name: Netplan Apply
    become: true
    ansible.builtin.command:
      cmd: netplan apply

  - name: Ensure that system is up to date
    become: true
    apt:
      name: "*"
      state: latest
      autoremove: yes
      update_cache: yes
  - name: Install/update system packages
    tags: [test]
    become: true
    ansible.builtin.apt:
      pkg:
        - ca-certificates
        - curl
        - build-essential
        - python3
        - xrdp
        - unattended-upgrades
        - snapper
        - git-lfs
        - git
        - firefox
        - fail2ban
        - freeipmi-tools
        - cifs-utils
        # Python dependencies
        # - build-essential
        - libssl-dev
        - zlib1g-dev
        - libbz2-dev
        - libreadline-dev
        - libsqlite3-dev
        # - curl
        # - git
        - libncursesw5-dev
        - xz-utils
        - tk-dev
        - libxml2-dev
        - libxmlsec1-dev
        - libffi-dev
        - liblzma-dev
        # Verilator/gtkwave
        - help2man
        - perl
        - make
        - g++
        - libfl-dev
        - zlib1g
        - ccache
        - mold
        - libgoogle-perftools-dev
        - numactl
        - perl-doc
        - flex
        - bison
        - autoconf
        - gperf
        - libgtk2.0-dev
  - name: Ensure these packages are not installed
    become: true
    ansible.builtin.apt:
      state: absent
      pkg:
        - cups-browsed
        - cups-filters
        - cups-filters-core-drivers
        - libcupsfilters2t64
  - import_tasks: vivado.yml
  - name: Update unix-chkpwd for xrdp
    become: true
    ansible.builtin.file:
      path: /sbin/unix_chkpwd
      mode: u+s
  - name: Create rdp_users group
    become: true
    ansible.builtin.group:
      name: rdp_users
      state: present
  - name: Deploy sesman.ini
    become: true
    ansible.builtin.copy:
      src: xrdp/sesman.ini
      dest: /etc/xrdp/sesman.ini
      owner: root
      group: root
      mode: '0644'
  - name: Start xRDP
    become: true
    ansible.builtin.systemd_service:
      name: xrdp
      daemon_reload: true
      enabled: true
      masked: false
      state: started

  - import_tasks: cuda_12_6_1_ubuntu_22.yaml
  - import_tasks: nvidia-container-toolkit_ubuntu.yaml

  # Install after nvidia container runtime.  We are going to register it as a Docker runtime.
  - import_tasks: docker_ubuntu_22.yaml
  - include_tasks: create_users.yaml
    name: Create Users
    loop: "{{users}}"
  - name: Install nvm
    ansible.builtin.shell: >
      curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
    args:
      creates: "{{ ansible_env.HOME }}/.nvm/nvm.sh"
  - name: Install npm
    ansible.builtin.shell: "source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm install v22.9.0"
    args:
      executable: /bin/bash
      creates: "{{ ansible_env.HOME }}/.nvm/versions/node/v22.9.0/bin/npm"
  - name: Install BitWarden CLI
    # community.general.npm:
    #   name: '@bitwarden/cli'
    #   executable: /home/waiter-admin/.nvm/versions/node/v22.9.0/bin/npm
    #   global: true
    ansible.builtin.command:
      cmd: >
        bash -c "source $HOME/.nvm/nvm.sh && nvm exec v22.9.0 && npm install -g @bitwarden/cli"
      creates: "/home/waiter-admin/.nvm/versions/node/v22.9.0/bin/bw"
  - name: Sync BW Client
    ansible.builtin.shell:
      cmd: '{{ansible_env.HOME}}/.nvm/versions/node/v22.9.0/bin/node {{ansible_env.HOME}}/.nvm/versions/node/v22.9.0/lib/node_modules/@bitwarden/cli/build/bw.js sync --session `cat .bw_session`'
      chdir: '{{ansible_env.HOME}}/waiter'

  - name: Configure fail2ban
    become: true
    ansible.builtin.copy:
      src: fail2ban/jail.local
      dest: /etc/fail2ban/jail.local

  - name: Enable fail2ban
    become: true
    ansible.builtin.systemd_service:
      enabled: true
      masked: false
      name: fail2ban
      state: started

  - import_tasks: ufw.yml

  - import_tasks: oec_qualys_trellix.yaml
    vars:
      installer: /home/waiter-admin/installers/qualys_trellix/oec-qualystrellixinstallers-linux.tgz

# Enable unattended upgrades
  - import_tasks: unattended-upgrades.yml

# Enable monitoring tools
  - import_tasks: monitoring.yaml

# Install XFCE Desktop
  - name: XFCE Desktop
    become: true
    ansible.builtin.apt:
      pkg:
        - xfce4-goodies
        - xfce4

# Install Verilator/GTKWave
  - name: Install Verilator/GTKWave
    import_tasks: verilator.yml
# Snapper Configuration for BTRFS
  - name: Install snapper config
    become: true
    ansible.builtin.copy:
      src: snapper/root
      dest: /etc/snapper/configs/root
      owner: root
      group: root
      mode: '0620' # user read/write, group read
  - name: Start snapper timer
    become: true
    ansible.builtin.systemd_service:
      name: snapper-timeline.timer
      daemon_reload: true
      enabled: true
      masked: false
      state: started
  - name: Start snapper cleanup
    become: true
    ansible.builtin.systemd_service:
      name: snapper-cleanup.timer
      daemon_reload: true
      enabled: true
      masked: false
      state: started
    
  - name: Setup Label Studio
    import_tasks: label_studio.yaml

# Auto deploy
  - name: Ensure systemd user dir exists
    ansible.builtin.file:
      path: .config/systemd/user/
      state: directory
  - name: Set up ansible_deploy_service.service
    ansible.builtin.template:
      src: ansible_deploy_service.service
      dest: .config/systemd/user/ansible_deploy_service.service
  - name: Enable ansible_deploy_service
    ansible.builtin.systemd_service:
      enabled: true
      name: ansible_deploy_service
      state: started
      scope: user
  - name: enable login linger
    ansible.builtin.command:
      cmd: loginctl enable-linger {{ ansible_user_id }}

# This always at the end
  - name: Deploy Docker Secrets
    import_tasks: docker/docker_secrets.yml

  - name: Docker compose
    community.docker.docker_compose_v2:
      project_src: '{{ansible_env.HOME}}/waiter/'
      pull: 'always'

  handlers:
  # Restart Docker if necessary.  This happens after ALL tasks are executed, including the docker-compose task.
  - name: Restart Docker
    become: true
    service:
      name: docker
      state: restarted