Cleanup apt_common

Add ask_vault_pass in ansible.cfg
Remove copy-keys.sh
2022-02-26 19:24:31 +01:00 · 2022-02-26 19:13:02 +01:00 · 2022-02-26 19:12:30 +01:00 · 2022-02-08 09:38:21 +01:00 · 2021-12-13 02:53:00 +01:00 · 2021-12-13 02:19:11 +01:00
61 changed files with 586 additions and 5724 deletions
--- a/ansible.cfg
+++ b/ansible.cfg
@ -1,16 +1,32 @@
+# Ansible configuration
+
 [defaults]
 ask_vault_pass = True
 roles_path = ./roles
+
+# Do not create .retry files
 retry_files_enabled = False
+
+# Use inventory
 inventory = ./hosts
-filter_plugins = ./filter_plugins
+
+# Custom header in templates
 ansible_managed = Ansible managed, modified on %Y-%m-%d %H:%M:%S
+
+# Do not use cows (with cowsay)
 nocows = 1
+
+# Do more parallelism
 forks = 15
+
+# Some SSH connection will take time
 timeout = 60
+
 remote_user = root

 [diff]
+
+# TO know what changed
 always = yes

 [ssh_connection]
--- a/filter_plugins/net_utils.py
+++ b/filter_plugins/net_utils.py
@ -1,40 +0,0 @@
-import ipaddress
-from operator import attrgetter
-
-import dns.name
-
-
-class FilterModule:
-    def filters(self):
-        return {
-            "remove_domain_suffix": remove_domain_suffix,
-            "ipaddr_sort": ipaddr_sort,
-        }
-
-
-def remove_domain_suffix(name):
-    parent = dns.name.from_text(name).parent()
-    return parent.to_text()
-
-
-def ipaddr_sort(addrs, types, unknown_after=True):
-    check_types = {
-        "global": attrgetter("is_global"),
-        "link-local": attrgetter("is_link_local"),
-        "loopback": attrgetter("is_loopback"),
-        "multicast": attrgetter("is_multicast"),
-        "private": attrgetter("is_private"),
-        "reserved": attrgetter("is_reserved"),
-        "site_local": attrgetter("is_site_local"),
-        "unspecified": attrgetter("is_unspecified"),
-    }
-
-    def addr_weight(addr):
-        if isinstance(addr, str):
-            addr = ipaddress.ip_address(addr.split("/")[0])
-        for index, ty in enumerate(types):
-            if check_types[ty](ipaddress.ip_address(addr)):
-                return index
-        return len(types) if unknown_after else -1
-
-    return sorted(addrs, key=addr_weight)
--- a/group_vars/all/vault.yml
+++ b/group_vars/all/vault.yml
@ -1,246 +1,224 @@
 $ANSIBLE_VAULT;1.1;AES256
-64313161633263303464663933363265373935633862653634643862343232643432343966376438
-6134633764383937373966346538306530316539303966320a363035303038616435383366656532
-39346463396563626166333362306464343836386365303836356461323663633831636562393039
-3832636432626238350a666566323435623834396166656233306639333830343130326265616234
-61666365663963643437386530363261306438376665386463376366363662656161316263303831
-61393136363934316462616131326463333736656136643038623061313363386538393833663637
-36373565333566306632313865646538633532393731313430633462666334323762653337383338
-63313433333835653366363061343839326131666139346563306366656365316663333438363837
-33323165353936343165646464306434303161313139653561346461653537616164623434376534
-33666662343734633766356230383761353239333632613031396365346536373432363433633564
-61633762393033343336373864653438336436613630366539333731383336346665313732396265
-32356138666135383562656366353131366436363464643630656130303437623131333239386363
-66373866393064306565306565386230373638633733326661333065633136633130323963323765
-30353262323835313365383562326363343965636634376133613331363133313030346561653931
-39363636636235646131353034663861336362383263613165323230366439383561653165363764
-65366130623362623539393461363832353435616266393036386439303834316635366438393936
-33383933366262636232383066663130383965306137356363363539633661373664613738336539
-31363131616135623039346465623530376533386263343836376662316562386530336266303062
-64386531303938623939653635313163633261336339366139666135323130653862346132646636
-30363065303235346331333434653331646333616337623562643564366435613938643235333664
-30626164373030303237656366623631396138333265383566333664663061613536666363623630
-61623362383439636239336234333161366635306432363230366630383836326330343932303863
-39393232373831363863333332636362396639663831656266336430313837666463336439353332
-63303036633433323439613535326663633332346565646338353761363733643766363132666365
-34303865656262303563323665363730663062626537363461646363636461633762663237366366
-64393133656464643065633634313261336662646435313735306266316132636530393631353830
-61303939373363323131316463333136326365333430626266376636356130396239323464353937
-64616232373532396334343433636332353530386662633164353235626361623164313039336666
-31636434666437393839393133633961373139313663616366373239386163623064373836376164
-62316638366366376134386231306435616138656461373633393339653532363434393834393430
-37363335623934306661333135343266663464623438353665613330356236323036363139643064
-62383934363465316338393065383935646134353230376131613935613431656333383565353134
-34643866353131653061623236306536363163373639396564336434653839346263303930633663
-39393935636235313431303032336361313730373238333732626465346662363038636361383631
-65393433346363366337383233646166306339653533646632623262376630383265393438326135
-31643039333835666338383762336163336337343532393063323165636531353361613731363065
-65303637396332613432663636326334646635346237396461636366356133303333306239393739
-34353966653662346230383865643231313239626533643761366162613164333132373636623237
-32356335643766646266646266633366363165373861306433316561363166363865303133633939
-34633132343438363034323638376666313061383965323566646463653163313235373364386666
-62393865373137343237306637363536383939303833663532396333313931336162333837613935
-66383266343735396337663936333162323738383264376533316536376563396333343263643931
-65646535363337373865353265306434356432353066656665366638353331366334366339613538
-32373637633564613861626538373365336362313434633137613966353861393462623862663330
-64386431373066306334383863366133333564373163386433313231363366393830343230323734
-61633962356637326538336663386330653563353763663236623539363630626363323237333237
-30656139626561313064323330373032323031343137366638303966313832646365666238326337
-63306363613361653933306234386163383837666430616663383664386563323839326232383761
-35373539626438356539393266653864353066633365383437623437356464383335383039343137
-61373539343631373932373033656233323964353666626162386537616333366562346265656238
-35396130356166303564303036383664656435626534303064653363316464616335303965376330
-61646638383138323265313631613037396561626162306661653231646230343139656135333236
-63303838316266333665636335663361656262353066666430656162323236633564313337353665
-35363565303736633564356632346632343832363934343962313030646132663566346664313632
-38393061613163356265643434626166393366366634343032626637333332316361663639623534
-62323239373639393337373537646232663531653835356165313264663561623633633830373734
-31336234613633666538373961626430316530346462343061323661353564323938353338373961
-64616637303734303333626166306330613238646265636136653939363936356165356232396436
-65353731633836363433616534636330663565643561363233396538386430393964353433616437
-36343936313936303165396236393463646363383338366238363961666530623335653234656139
-65346337663437623134376137326166323933613861663032623965643538343638376234316232
-36333065323234663263343630353739313661373536316162366532336438373263303730626464
-38613136393166626663636631363064303736666235333036616435373063363762666565363136
-38333966303831313333613831313132633062616235353365313533386236613338373130303836
-61326262313833306437366364316433393931353265326131653563656131333436376338613266
-39326632613366666136643137303635336631353230396435313537656366326239626362313833
-62653039343261613265306362323234623264366664306561663839306631663465303962386462
-39353934643562383762623937643034383534393962333466613636346637323235346438666636
-31613838313535666166663063373333653439313035346266666463623666613837313933623837
-63343565663739393764353761316432626237346234663032316131306262356233333439323961
-38646664383030303832646563393836643135303731306435383338623633626638306165386637
-65393238653464623032336437643838333932366131656332333165376261383539386466343139
-65613733383837323832303738363664653138613830376333363038383839623463623631666237
-63363263396533353763373934373034643763376665316638353435663635346135333265363235
-62663432343935343964626432353563313036303761393039386231343530663737633466643035
-65343835353037643539316439666666633866356530363237373230373439373133313337653237
-66613631373637313534353862653437393234363365323032393035376438616264336661616262
-37336435326135373065353564383637626637343532396331623334643139386364316431376435
-36356566363033636539363430356565373039363863396565643730656531346364626334393436
-33343839303538383530363231366166623233333730323163323432373831313639626337346230
-30333930333064393337616564386163623436613933623466353933393733346339383534633239
-30633365313364666566643533326163336330323232353533316633313739343035383465376330
-65356139386463633565366132383832643032333234633964373437633836343435393631396166
-34633439643764623936366536353931646132373539326238303761383339643661616266646130
-30393166393465326365393130636136336433623262346435353936306133616135653734383635
-65393530633836613937346430366337626365363361663533313837363063396538663766646566
-63373639653732353135343562353266316164303863336365303635653464393232613939396131
-30636361343932663233663566656131363938656161623966316366656561343166336532613666
-65613534663762353662353262623634616264373964316336626166353330303539356130646166
-63643435353765633766626165643465386331333637366562393861613834323464363932306430
-32643836646266643031396262626136313363623663366430376432373036643835653863323631
-30613164326430633664306630333632363931656135643465363439376263386561383534633666
-64323763656466343064396639313264386239356664663461333166626332326536623132333434
-62303261643164643330333662623935383037353338306135613737306563326336336162633138
-33623066373265663362303133363032343933306336396466383034636131333837313333326531
-39336163313633623639303462313763656632633030336236643030343262653366633939643536
-31636535393864663363353930363761623264343630396336396431663330323436613462633136
-37336464353730643566393432343762333336653932333366636265343663323462626232623635
-34346136333630363539633666316561376266373032373961313437653564636537656630303261
-37313639333233333365383763333061373730623939303530303832646365323739356564626137
-35633366393636376463393961333830343232363266633931613332643134643234303733373466
-35323831623931633436626636346431303965663639666566623433383736633834626330303265
-37353337656233663938663839373931623137666662623266336537383631626631306235363064
-33313564316438633139336261623736336336326239376630316335313631376132646563333430
-33656432643130643832343065353834633366363339353964623762666564633835633636313731
-63353637636165663136623736343234393038313235333363643237643566623766393838386635
-33646233623032653233336266636335666233353032303837663162303939383262373761623261
-35366661363966346233633739663635353361303264356534366235616164316138623730623632
-62316362623736396264366632373661373835393434343364353431316362666235616635633566
-64353530633334393737346663653562346335323065356665643132353738363132623031353664
-66666639326238386634363664356664343161386435323736316636343536326435303066353035
-37363731613138393333636562386363333932386362303139643262386237353863363764643139
-64616561373239346464623165616332623434303433626638376232333733646136376431626438
-66613134343639656331626630303030366133356636663735353466353834613430356265386162
-66613332663232623438636661306332613162666561353537313336643134663664306630636639
-61613363353264373831393962333631383236666130646333336431303735333165656438363432
-38396530333631636135653534393531326434306362396237366430383166323832336434376364
-38393431646338316232373431613930326532646333386435303034356564336665346133393866
-61643533643361646265313334633463616437393437653935613261366635616430313064346532
-32363831613565313836376338646466323130373032613863323037323566643164653132633735
-65636562653535626461396666643330386333663137613333643165656336633038323036373162
-31376338613862333334643561313332326237646565633934323032626662633631633033623063
-63306664656437663732323339383735306132616531373865323835633264333639336163366466
-33373433653839393638323034623835643531393266306331313563613265616633353763653438
-65363532653163303861383531356639316331343531666666636336373634636134633331366364
-62366230366435323435613964636533353236373935626632623536396664313264653031623062
-33366166343630313839366262313234346262343336386538336335393835646138666330656361
-61313936323838653832633130346539636363613838343363663431623063333933383466353938
-65383361333561383631643938613862343236346233363466333237316339616362366565306639
-39356563656132303463346138356435303038303165363935343266396462326365363262393336
-37396235366639623761366239386165613065626431633733306234343866663266633631656237
-63643430383433393835663635356265636635363137613064353066313338346436356632346265
-38393730336465396263373137383238653337396364643061303234666266663064663265383434
-36636138643432373633313038393737663735363838396164366234643533633762383062353831
-66326231363337323666386263373438656630346336663239643030386434636264666634393631
-39313364333761343532346165396365306463393037643935666363323630326664616638313338
-39396336653738353333343835363861643166376565346463303135376439336134666235623230
-32363031303732666133386164313437366164326539373564623236356432303132633436323563
-36323634373538376133613736633133356638323861636434646465643432636366376138636232
-63633830613462613831313938326339343632393038376639623131366364623536353338363439
-32613331623863336165636364616634303264356630303665383638663737343836663831363263
-63366562393734323030306436346534626530656465396535323835316139633562363830373437
-63626530326530383538623165356532303862353763326432373966626436303465373431373762
-38613539623164353732623636376630643465343839666531306438326633343362306665366132
-39396537366266353864656232616334336130333337306463313932393832653661343036396261
-64613461633433356334623631643861303133383963336635623138326139613564343838366565
-36343130353462333162313736636139306233366466626231306561626335396262663531333839
-61336437343137356335633764373730306466326133356331333530353537616661373062656438
-35356235666464656466323937353837623535643937383866666133383633396563333338633034
-38366531613164363966323137646237393135383164643230663331306335636432656565633636
-34343031633632346533353666353034666266666561346464306665386634313263323333653330
-66323033393531343633356466613837346164393332613037636465343230623731616361336338
-61373332373636646435353734386366613334323161626437396232613534613330613532323534
-65653065386432313733663165616333663666363733623162306536303833663136353334656466
-64353931363838613761663561666639373865393438396565626661343934353662363834636535
-65363664393433313036383438643864663339626331343230343337316437336634636363303563
-35373539383535353235633730386232363539616632336566376264393832383637663330613133
-37643261363966633138373935333438393536373938383265373261363232343030373539366335
-61633162663137643061363366653135323639363838626266386262666133306461333432313738
-30313332626166303630363839396663396564633961383863326663356230343938643833303933
-34333032353935323565346633363537656639613663356130383264373739636231363364613066
-36653664346434393933383337313630623131396461343930383537633536643365306564396665
-31353861643335353538623838393335326364393738376239623431306231363739656438626265
-37666532336661306262303761616238666239623265663231386165353437366631376234343035
-33393037316563373534373765616238616639303031346430623561663430393536303163613338
-65353062336164626335376235656235343637366438353334356436653266333062663838316263
-32623732306462356162623437393035626433336631643833626463656634366332613936346465
-34653331363133373635633330363564333264623566613432383439396537343963653239336265
-33326132663434363065646265646130333935303662623037363938313464366564323734333437
-36336335303738643634653164306332636130316161393335656536386131396662616366383139
-36663863343736666665363337663537326330323437346565346465326231366563643136366365
-37636361343961326261336437616266373962643765346438333766306537303137353764396330
-39626635373631353635313935363834363730386132376363663462653330623130663266373432
-65343237326535613535386363396236336536366165306463643162346638623638373433646163
-62613935363636353639623839396231393838303135346536383037353636613563323234626131
-64373666303436393861373164376564646235366131343433623733663832653039393738343537
-65323534343464613230346532623966616462353532373064623566626563336464326336393364
-39626237646431313135323036303065343138616632343237396136366332636132303037376132
-33623031623635653162616265316366663262373666636638386130643336383130643232643662
-34326663343562613962343033396332303261636230353331313730336630633461333736626333
-66636430643330383032646634396133626339623036333963396662313234623466366634636334
-33373762386662613966353664346239666133656435353365653536356331613632666132376264
-62613433366633663065306166396166633836306139376533396165393966323465303638373563
-63326330323161303065643365343363313338326238363137663139613463613434643834613662
-64663365633965653363633165653038333335333232633434323037643936646561376431626230
-66356138373136366134373533386634373061666330663364376336383433306331386162393633
-33636330643531396464313736363061303466393861613730323563626363643731333633366532
-64646130636234653566346533323962353332653335336239353630633535623935396638663366
-37383661343636613261623833653032373764653164346634663431653664636233323734666166
-36373664306566663930353338366431623563396166356638626166333165623263636336613138
-34343936393964666564306637346561393538383137663162663630336462656663316338376236
-63633666333263663734353861633164653132663334306664643133663736663766626639393236
-32653430333163313363343731666135656662363838366132383732346130313130363365656263
-32643533393163376264653632663262353966306630333064313932616262323134326361633764
-63383837303936616434616630653833653833623263623532306363373836323431393335623530
-34316562343035326265333164643163356230643639373431326431303538346363376332373434
-31313666313663343363353130306561646136393732663164393232636330663635346434343134
-33663138663336636430373763396435323138373633666438623234363631336232366635366532
-62616239663934653462656163326134303261376635323864633435383666363065656665303538
-62626538343638366236646136363232373437336630383739656438636465326531646664366462
-36353663626634386538336239623734323234393463313034303837363164363263623065613061
-38333162646232366339333662313965663336613238386530393162346266636532353433656136
-66326436323836376432313238613165373565643233333435393361636637653361616435393438
-32383763393561343734643438346635613663393736613839623263663866336165343235663933
-66623137616561313462653631613830363666653635336534643935373739353138363934656134
-35663063396162623432373534333463376231666466393963336231653939326663396336383735
-34633763336163313432616163313638623963306666643432306661393632346339373963633265
-32303862643661376433356661383335313365306534663534396638313531373538326236636363
-37626138333437393363323261336663653163643565303063313231346131376261653763356631
-62306262336337366134626632333663363139393131306666303235303761623665356431646234
-33666461663035303066353137623762653565353533613435663839396238336337333463636465
-38353135356634626137376232613330393235383432356436393030313564306537616363383136
-66356463373138313661373565326565343066643133633630313031303132313031663739316631
-66666631386163313034306532393862393930653931363235396662366262636466363464396466
-61303962303066633764393831396632626233343633313061323838623134373036393164633139
-30303861636335636131376334376239636235653233323435623262366132663934613661333135
-61386136326435363337316363666330363431613135663661303438383664663930656564373730
-32373731393666333364633835646431646662313232383136616238303264383438663766356462
-32346664376430663934626661663039656461383738626265346162393861346163656161323333
-39323666643031376530303230626166613233383731363766373634623430633635303963313466
-34646331363539636133373134353535356265393265393635323532323134643034343663636362
-38633261613433393634396234396265623063346138363133646532366638306632396464646432
-61373961383438386535336131393633303430346162613738343839653038303035303033626535
-37343030623530333332306265373539633735616634663666356437303862636338363866613861
-38346130336338373865343866306665616530313938616366346131376262346135323537663137
-39383366313766666234323234363937623264353532323033363966313135653163343036666262
-34393832613034383239393930383063336131356364303231323966303633333331633666373764
-65383137333965663234663933303231356165376233326233303035316536666563656363343933
-36633039666432643135636331353932633164633964623661373739633665313433306561303637
-62373534346562363132643063643732343462653838393635343266626535353864656437313434
-34376538303965616539626534613431623834376337643936613137323031323139393762636463
-66346664666361623636666533663037613434353135393862376633636233656330366136646434
-30653735323961383130393763333630306131376430363436623238646632363462383739653636
-37346566663039383866323639633565366338353438386461616239313639343766333661346435
-33316538366463383733346663316564656566656165396465393461363061613239666165346661
-62346639623163363762366431313831663135643062336363323336303737393437653863303665
-36643466336566336236353166333063633830646461626262333937316162353365353130353535
-30383164363532363532306364393236303537383139643431393962333063633162313033613561
-32323434336364343061386666616639336566373461633462393130336461303531353436623065
-65663430623066336533373662306566396263376562343936666166626666323964373334613835
-64633535303365643564626562643562636363363834353865353765356665643965663861366436
-63333736613232353130616466316637613966646139323565356537666331666564623832333439
-36376131663431616430616265323039646432393166613631313762613264313765323231663961
-65616636306362386534626130636261636566626365643630616135323634343935653033653433
-3061
+66666438656133326638326138663066643238626366633137646134376233336639326365653163
+3737613361383538663934626164356535313133643730610a663634653164623665336136326430
+63383735653262393538383663653966623462326332653163316138313832346532326535336263
+6638373331343838610a323166393664633431323461396135653464396236333235333134613834
+37333866663935653832613036643131306333653565623261346134396534316163366636363134
+34653939363835303037666333623230643339333165613265653638376234646438393630383165
+38376162626538383263626664373634343063623630326334313265323330656465343865306361
+37643835366461353335626639646430633135616130646638376461316434306537346532353630
+31373039303862613264653836313763333566663065383361343261343462633934343139326135
+66393363393962636438383362613162303931316337626665336362633030653430346436326530
+62326664396534626664383834613936356462393163666431333731613339353038336634623532
+33633432363730616439386536626163383563333265386134356231376665336332376439333232
+31336466633135646461373364363534636439356137616632616431363638386234303637626537
+37653332366234386562656365333533326539353837343631636662666236643761323463376137
+35343834636562646339316139613265393736376265636564386639646537323136616464306630
+66333065323533663536336238356537373030333630626464363731313533313537346138616664
+34313635636664636135633035356666613261373065636462306438386461663361326132363439
+34396162373635313732653039326639366362653962376135613636396639656634313234396136
+65363639393532653237613237313563343865613833373562643764333930326539303138636166
+39313565653462613337616263663739333136393966663664653335333237626565636462663261
+62313831663732616133396662343332353365356162353436333135393738323761363164653161
+64393137343738393939316532613639373430656630386532366136393235383063626433396338
+66373337343232343964326435653039386338623166616537383466653030613361396462323038
+33623637323135313664306538323137333763653263326533323039373139396633313135333166
+38356236653731373132353063643038623866653330623537356230306563646262343531333830
+38626161393330303161313932616531326331633938656236313166313035613163323539353535
+63343136643361333431353762643631643262633266346139353165393962326634363764373930
+30363463623434633032366338316332313736656465366461633864373236653863393637636330
+34313936666432363562633531666466356633616664663063363263356632343931333766663466
+64633438333436623639333036636633366337383065313162666231613337306532653335363739
+36356139303461336139323963383465376366633064343031303864373735656430666261643565
+61323236623330636561653962323738323332383331303335663036626638383334333730303965
+33383063323438393532306330393366326561323632623238613836396635656631373430343662
+39333464643037666233373565633132386233353333313135306133343765373565393937656163
+38316238383832343063666334663733313162303337313262666430363538626134313065373336
+32393763633530326161333861333137363066366332613963393734663130613735393764653334
+39613439643364333665383465633765363063313536383835303964363731376165383830616265
+39663762306232646533353963353663343832353739333132366662306335313435663434383431
+36323032333731373032313263396565643561656531643462613931313435616438366132393135
+34303334383662386261386537373438373334623235643037613136653639353164353763613965
+62346231613333353331376433633633353537646639393739356137316131313536343736366532
+62313438326264303638323832653232643266626561303032666432353935396262316538333361
+39323138313234363764303036656631323636626633316436626637333863383230613132353563
+30623161643535643431663535386130643662616263343535326433353764626264343937383730
+66616433623234316262343531643531396662356135336336356233393438656263316138613138
+62323432306563313462366464653965663137383536633437653135343739393839343335366634
+30333834656335383763643637366565633339386330386237313236373463353663363463616636
+61326539363461343639366534643363353038663539366565653234646332626661613333336563
+63663939343465366565653665376237313366376162363833366666373264383131386531396436
+36383430613036633734346561633366613731373133373261626331336266383133653735646638
+64353266653531613264373864353631626331343166656263303165326665326163313539336230
+33656438613833306538643737663763343836393234633630633665393631373736353963343431
+63666366303230386336363933613935313636316361346632626561376562386264666464333639
+65396136623735326462316565356337363537343764653562653731386136366537306137666438
+63646364646138316264336334363437363638393561343138323762626666643039633130623537
+62363938323136326134633039646464353262393731313962373032623966343264333661393934
+38336435346161306238373963396265376263336632646436663837356331663138366561316433
+36623139336231366632323133623639356633393035333761363630633563306436326361306662
+31383261343035636164313463333532373064393765363332336465663430326164373538333530
+62393131666539343933393339306466336235396430326265656661643865663362616332343065
+66613561326162313235613131336130333565363263343665373565386164376165646136386136
+65656361316138303865636462326331353934376365613665316538616164646433356262663931
+65363166386139383736643664353266613133353263313336613361616237633066356562616534
+61303038666338313063383431313239393062653661393336333938663937306536383431646632
+63623031323034643664663134626433323466376133636330316533663462383736623463633332
+32373166313562613461643163366563656638346464343064636632373835393236336438633061
+63363363353437356339643333356531633033376230313330393365626164666335623262313533
+65373234346666663264373238663430373262313435316134313832303964656330386431663833
+33313363366566303535326365353135303863363534646439626664323032346664656530396530
+37633666383162343231333464633439643637356437383866303235616462346664316363336132
+62376661323764323936666165366566636531363736306561663934653533653433666466343438
+35306130323336613764633438626339636531626135373530373066363839313132346538613836
+65623635346233363331633261303761393466636137346331383038613739636366616164306265
+35646333653666373930303535643961343832653062303736613436666661323965373433363537
+35626533386162333364333538653166663838613433353138396661303930613838623635636366
+37626662303434303331666437363138336261303031343964383364313239623739343233353636
+34373433343539613664313164653364353835346263643031626434333037353766376233663236
+61313735303437393230663766323262383130623039393637633039316335383032346261323534
+35656666306262353638623638366339353364383939306330343430366631386161343061346462
+31623431626239376538663463393265366430626565396266393063646532353563663630623363
+36663436346161303066633435353863663163376231303732363563313263326637346234666231
+37656331623838366535303863376233356336613237353966653334343835613738343435646630
+31353731613934653462356630313164313262363966356336323437653037386234303531636465
+39393433373931393234633363383864336465346434333436643139643437656238623737363630
+35656334396438623132373164366464646462353033623965663963633437356337346636633563
+30376236303661323764643536353230373333316237323065616366363262643765666433623735
+64323663666434653761313431333131343536626537393161373063363163393563343465633664
+61356637636161386362363065313730366362373833633830353466356435323533356335636138
+64346266316530376437663336663161376330326331663664653634633537613835366233356132
+62636337613966306439613666336539313866323465366235396630353461613339623830336332
+31653865663734616462356637303332303339393937313031326330373639643934326336366431
+61383465373564393337333137616432626233306631623463316131633331346465646632326231
+32616261666531613265383536653139653335616130333030363433646561336634643464646164
+61383536336139376134336662353931623365353238333835353731373031323535373764303235
+39656362383665366463363730356264313564313035393332353136323763373538643864663966
+35313364323863643063353261613036346533326336633562623730363661333336336266626562
+35373037366166323363343362616562346264626564356631303463636432343635383965633136
+35663632306465353533383166666230363635326637656561333137366263376261383562386538
+63613563663463643737333537646335353137333434313363656531333465623562653864306665
+34313736346131636261663035326361613036393433346233373963333134616235393532333763
+62313136623031393364316361663536353063383065613334663239353932646230306461333764
+62306532653130353032306530636164363730323538613965323661393439613161356237656335
+30343330336131393636646639306532333864646563303363313331613630313430303834653864
+38313465303332303530326466373939343161633534353064333731343431336334303133343531
+64336534623066333863666636326364353839613565643132643266333861636663313930363434
+37656338356566646632393831613237613936663934333766633365373636643234346136633264
+64643865613938366530613365326163376566616562383032633636393234373439656538343130
+63666535646163346166396538386631373532626133643530326532353066313139656266313135
+38633131613364306165646630346361303136636434653234633164333235666166613061626337
+66396461636264616562666337343831303335373835386265666265616366393934323265333235
+30346332373635633935616539323331326165666362316462633432353666633135653136373662
+66306138633738653266336164346566616266626434356665386137313631646565646331303961
+30383961373962333133396665333339333230356666636636643235373236346666333239353763
+62653737313566376461336230623962353136666263656239373138353162666464633239386265
+39646336313932306236346534643431373562636265306166653433636565353037363633653530
+36393638663965613337646633363664663432303231366662646435626233303538346537366130
+65336232353162323337303234633734356236373131626339316363666537666538623438313833
+65383535636234303036346661373630303731663839323663336236643739303836333030343136
+62326539356535323731373938393238613133636432323166326133336362313465326262353530
+32613765633035616431656632366264633134626335356133363561383163396334313738376437
+66383266396365336338383338646465616438386234353635303565326365396432383431616636
+39346566306535306534383965313861343336326462316566643962346465333764653131383031
+32306533313137346166653863386134623062653637346535383130643936656331613866346337
+61366632316332316664613031323033626235326461336133343335323531633639363465306438
+66616262353066363637616530396362626161396439613134373537643266666562386436346638
+63623033353734373062373365663733666161366262303030306162386366653933326234646333
+61633337326265326334346261343663633539373533613963636438663638306130646234386434
+38346537623566313763383064666639376237656662383865653162336234303232386439373962
+31383961616333623736626534333536356136613137636662353664396135623134343663646638
+64376366346534663132616265356263356638303162306233383230363636323962333963353262
+64343232373063313036616634613939623433373262386134633233643635306137373630316334
+65336466646532343633663739626336393730383836653065356632333533633162646437366665
+31376531383262373566323664323161346563626366623133643462636363393835373834313862
+61323533306137356330666531366466303230653864386566613535363465313063363962653666
+62333639636332366537363631623430376163396333333663396430393334343732626361306439
+31623862663736633362373466626333663964356162653337633039323138353035656562396132
+33333837396164646564623735366266376562623835656566393361633730616130373931663461
+62376537613661616135346562393539346632343530363335373965323664653463383637656336
+31383835363931393537646132656164653730323639373835336334653561363835373663363730
+32376435626431356336633939326636313834346666656237376264633162323062663238353537
+34376336616234373165313064396361356263383239393036643761613630666230346361336666
+32333462313161656563323534393936373535316236393865636630366263373765323632643065
+66396465306234623565663139613830356139376135336230373364646465343562373361646337
+63363937663461636334366630303530343065323065633965643561366264613865356235636337
+65616564636635376635623937303330386537323966353034363331316363653136653939376439
+33323262396138316665383163306131383331623338343263353638343033323638323462303439
+33333631623638616430356666663161636534313038373130663030356537653265363232386530
+31646637333263613937646330363139353531373361376466396331386266393264366239356237
+66336333663665393035626639376163623435666530656563336434626238373736336335613036
+37303038646534363161343735633330343734616339633039376539343438373264393938663463
+32356562353161396230373239653631323038383661383037393761323131323038643064656665
+65346362373430656162346438653533306638303364386438383436333232363033383933666562
+32336630303932303636653438336462313466393463343363633662383237643837323363353765
+31666537643665343431613462616663303732666535363536613534656236356237336564363134
+33633266396630393837363364303963663435646166363566356530313835316236346332633164
+62656636643930363235636162646166626337326535643565616139363738396631613665626536
+66303238363335656538353265383864663436363834633664653433333163643537333433383766
+66613437366632346263623233646338316239316430303336323465656531326637323263343162
+31346632363464313637373766303765323435663939353063313236373632393866363562346335
+33386334653833663832396536663031613432656665306662396135363632333961663663386635
+62653631623636623963616431613131393734396365333131386433613561646266623739353330
+35336234653334653030356261353438363232366230316366313661626261646633333365393563
+66636532326239623463303662386536313461376464633738633038346664373032373364336166
+65306433316365613261383534326530376430323938306265313838626536373530636533336462
+33323034393765613737666237303233333439656463306633343237633634396331306338336139
+30336637633064373033363333353838646365313733646461663763373661366237366433363638
+31303565396133313932636665663261393136623730663535396337663961393363626435663062
+34343536383864323231653632393839616539333438353039633764336535653962393135333035
+39343332396130643239633639353661623565323861303137303764633266613130323431636164
+65653235386661333363653665626231356331333666363133343830326431396366373064653063
+61316233633635663866356261383766666430663130636166656330356639666233386131313737
+62333637366430636362316166356464643361363165616630393461356661396263316234346562
+61653032333639383762353335643036616566666230666465646338663834666161626263623862
+36383166623766623730333337313932363337356430373165666537346637316438313133656362
+65303936363730356131316232346433376261656661353533613265343065356539343366383538
+32366561663366656562356666303936336663353964623263336435653964626133383332373436
+30346236633266613363626632636464366435383430323365383436626361336531353363313439
+65663664623531363039303431303137623164633332616436353631633361383536616330363737
+39656535666131333863363832353664326534646233346435623937646566623466646131383335
+37643038306363336638393132666464393636623331306366636435633335333064383630393763
+62346366613238366532343761323663633137393133306564386533643132323661323938643933
+37316165346536393465613233666166633935666361376131613762383933363935353034653662
+30393138633665366336373038326436353932613138396462383163376361356435376462333237
+66363535616639356336323838653633323064643635373630653639613834386465363536306664
+34303831366364346361643564616435396661373765323530396635376161316334356137656664
+61333762366365633038653934653436613637636132353062373134316162336539653239613333
+34383666643136373337303466346165363137306563643964303839626264323231343262303836
+36643664633535326166313832666230656532353538363765316362336136323430636666356339
+30656635343038646131663837313232316262393863613863393031386336663730613761393466
+65343331346435393764343565326531653263336463346633653231643937323237383134626462
+32383362633666303131376164353261353232393036353636626566633862383063356136333036
+64346239363633393065633631343061343639323437303163343565646661366265643133386465
+30616235653231623263353736636231356136653236366531316131323635333137643666373437
+61336435613237306430343966383839663261386335616234363864353632653433393033656433
+39613835326130383864373832663536383261363135303664383131636164316634383831363233
+34386639616233373731306537633962383565336565343434663361343062326435343565666632
+64303830326436613932333161333930656666306165316333386237633161366161303537383465
+63326265626662376136636131323261643234656239316131383235636336303733386632633436
+65636663626434303637616366626463346533616237306130666365366564333735383032346635
+31623663363164316362343933663530663038616137633235656466366565306331343961343362
+65333935653664323266356637616532393538653231383935643432363838343335656165633832
+65626531316161646233626337626165656133643362626263363261326363306439353863353633
+38323161383739336631373266303633363964663833643130643235366137383637663134623664
+37363363306632646433376133383964643965623833373436663436393164666430363663363036
+62346538353538356566623562666166383162666537656335346337643132303339326333363933
+31396461346434623362353863303335623866316562316234386538343364343561333937326166
+33613237386239613533653036613636666662616461613031623065323630333766653265666439
+37653936303438333235366232343436346463643330373038646330306236643737386330663266
+33323631303836363239663731623435666630626335663134393532306235343033663365613237
+61643233356264306465623062303231643335643737366434306663393035613365616139646538
+34613338346633326432353064336233343765633638626639643430333233353235616639626239
+61663361643636653930666437633865386537383163643832326665316465616232636266366539
+62653061396265393831396431626462663033383637363565313531343764383931663665613064
+39383461353133306434323562393136313536623739353235346565376134306636613465633630
+34633737633536353338663061373738336337633134636639663730366537343463373635653833
+62393937393232316161366135353638666466373639613363653032666530633634306639333366
+38386432636639386435306638383035353134373261663038616137336164396235356131323038
+61333031316666353336343638623963616266643432613533616466353362353565363237636630
+38343662623838666134356537353434383564616335363032663436333133613762383063353562
+66646138383064636463623939643834396165633164333038373938636631306439356436373561
+64663835393863353131343334633137346162373838353738323938313162396165393632316566
+65326462613361643964386564376464353666386133616666623039366638383236653832393665
+623466653930303838323161316265323031
--- a/host_vars/proxy-ovh.adm.auro.re.yml
+++ b/host_vars/proxy-ovh.adm.auro.re.yml
@ -13,8 +13,6 @@ loc_reverseproxy:
      to: auro.re
    - from: 92.222.211.195
      to: auro.re
-    - from: codimd.auro.re
-      to: hedgedoc.auro.re

  reverseproxy_sites:
    - from: phabricator.auro.re
@ -29,9 +27,6 @@ loc_reverseproxy:
    - from: passbolt.auro.re
      to: 10.128.0.53

-    - from: auth.auro.re
-      to: 10.128.0.150:8089
-
    - from: riot.auro.re
      to: "10.128.0.150:8080"
    - from: element.auro.re
@ -39,6 +34,8 @@ loc_reverseproxy:
    - from: chat.auro.re
      to: "10.128.0.150:8080"

+    - from: codimd.auro.re
+      to: "10.128.0.150:8081"
    - from: hedgedoc.auro.re
      to: "10.128.0.150:8081"

@ -59,8 +56,6 @@ loc_reverseproxy:

    - from: cas.auro.re
      to: "10.128.0.150:8085"
-    - from: rss.auro.re
-      to: 10.128.0.150:8090
    - from: status.auro.re
      to: "10.128.0.150:8086"
    - from: "kanboard.auro.re"
--- a/31
+++ b/31
@ -42,15 +42,9 @@ litl.adm.auro.re
 log.adm.auro.re
 netbox.adm.auro.re
 grafana.adm.auro.re
-dolibarr.adm.auro.re
-infra-1.router.auro.re ansible_host=10.129.0.245
-infra-2.router.auro.re ansible_host=10.129.0.246

 [aurore_testing_vm]

-[aurore_ilo]
-escalope-ilo.adm.auro.re
-
 ###############################################################################
 # OVH

@ -64,6 +58,7 @@ proxy-ovh.adm.auro.re

 [ovh_vm]
 serge.adm.auro.re
+passbolt.adm.auro.re
 docker-ovh.adm.auro.re
 switchs-manager.adm.auro.re
 ldap-replica-ovh.adm.auro.re
@ -89,23 +84,14 @@ dhcp-fleming.adm.auro.re
 dhcp-fleming-backup.adm.auro.re
 dns-fleming.adm.auro.re
 dns-fleming-backup.adm.auro.re
-ntp-1.int.infra.auro.re
 prometheus-fleming.adm.auro.re
 #prometheus-fleming-fo.adm.auro.re
 radius-fleming.adm.auro.re
-dns-1.int.infra.auro.re
-isp-1.rtr.infra.auro.re
-isp-2.rtr.infra.auro.re
-dhcp-1.isp.auro.re
-dhcp-2.isp.auro.re
 radius-fleming-backup.adm.auro.re
 unifi-fleming.adm.auro.re
 routeur-fleming.adm.auro.re
 routeur-fleming-backup.adm.auro.re

-[fleming_ilo]
-marki-ilo.adm.auro.re
-
 [fleming_unifi]
 fa-0-1.borne.auro.re
 fa-1-1.borne.auro.re
@ -222,10 +208,6 @@ unifi-pacaterie.adm.auro.re
 routeur-pacaterie.adm.auro.re
 routeur-pacaterie-backup.adm.auro.re

-[pacaterie_ilo]
-mordred-ilo.adm.auro.re
-titan-ilo.adm.auro.re
-
 [pacaterie_unifi]
 pc-1-1.borne.auro.re
 pn-0-1.borne.auro.re
@ -281,10 +263,6 @@ radius-edc-backup.adm.auro.re
 ldap-replica-edc.adm.auro.re
 prometheus-edc.adm.auro.re

-[edc_ilo]
-caradoc-ilo.adm.auro.re
-chapalux-ilo.adm.auro.re
-
 [edc_unifi]
 ee-2-1.borne.auro.re
 ee-2-2.borne.auro.re
@ -316,10 +294,6 @@ radius-gs-backup.adm.auro.re
 prometheus-gs.adm.auro.re
 ldap-replica-gs.adm.auro.re

-[gs_ilo]
-lancelot-ilo.adm.auro.re
-odin-ilo.adm.auro.re
-
 [gs_unifi]
 ga-0-1.borne.auro.re
 ga-1-1.borne.auro.re
@ -389,9 +363,6 @@ dns-rives.adm.auro.re
 radius-rives.adm.auro.re
 routeur-rives.adm.auro.re

-[rives_ilo]
-loki-ilo.adm.auro.re
-
 [rives_unifi]
 r1-1-1.borne.auro.re
 r1-1-2.borne.auro.re
--- a/playbooks/base.yml
+++ b/playbooks/base.yml
@ -1,10 +1,16 @@
 #!/usr/bin/env ansible-playbook
 ---
-# Put a common configuration on all servers
 - hosts: all,!unifi
+  vars:
+    locales_default: en_US.UTF-8
+    locales_additional:
+      - fr_FR.UTF-8
+    apt_upgrade_email_address: monitoring.aurore@lists.crans.org
  roles:
-    - baseconfig
+    - debian_common
+    - apt_common
+    - locales
    - basesecurity
-    - ldap_client
    - logrotate
    - update_motd
+...
--- a/playbooks/chronyd.yml
+++ b/playbooks/chronyd.yml
@ -1,27 +0,0 @@
-#!/usr/bin/env ansible-playbook
---
- hosts:
-    - ntp-1.int.infra.auro.re
-  vars:
-    chronyd__allow_networks:
-      - 10.128.0.0/16
-      - 2a09:6840:128::/48
-    chronyd__pools:
-      - 0.pool.ntp.org
-      - 1.pool.ntp.org
-      - 2.pool.ntp.org
-      - 3.pool.ntp.org
-    chronyd__local_stratum: 10
-  roles:
-    - chronyd
-
- hosts:
-    - all
-    - "!ntp-1.int.infra.auro.re"
-    - "!unifi"
-  vars:
-    chronyd__pools:
-      - ntp-1.int.infra.auro.re
-  roles:
-    - chronyd
-...
--- a/playbooks/ifupdown2.yml
+++ b/playbooks/ifupdown2.yml
@ -1,213 +0,0 @@
-#!/usr/bin/env ansible-playbook
---
- hosts:
-    - ntp-1.int.infra.auro.re
-    - dns-1.int.infra.auro.re
-    - dhcp-1.isp.auro.re
-    - dhcp-2.isp.auro.re
-    - isp-1.rtr.infra.auro.re
-    - isp-2.rtr.infra.auro.re
-  vars:
-    # TODO: netbox
-    ifupdown2__hosts:
-      ntp-1.int.infra.auro.re:
-        ens18:
-          gateways:
-            - 2a09:6840:128::254
-            - 10.128.0.254
-          addresses:
-            - 2a09:6840:128::203/56
-            - 10.128.0.203/16
-      dns-1.int.infra.auro.re:
-        ens18:
-          gateways:
-            - 2a09:6840:128::254
-            - 10.128.0.254
-          addresses:
-            - 2a09:6840:128::127/56
-            - 10.128.0.127/16
-      dhcp-1.isp.auro.re:
-        ens18:
-          gateways:
-            - 2a09:6840:128::254
-            - 10.128.0.254
-          addresses:
-            - 2a09:6840:128::204/56
-            - 10.128.0.204/16
-        ens19: null
-        clients:
-          bridge_vlan_aware: true
-          bridge_ports:
-            - ens19
-          bridge_vids:
-            - 1000-1004
-        client-0:
-          addresses:
-            - 100.64.0.2/27
-          vlan_id: 1000
-          vlan_raw_device: clients
-        client-1:
-          addresses:
-            - 100.64.0.34/27
-          vlan_id: 1001
-          vlan_raw_device: clients
-        client-2:
-          addresses:
-            - 100.64.0.66/27
-          vlan_id: 1002
-          vlan_raw_device: clients
-        client-3:
-          addresses:
-            - 100.64.0.98/27
-          vlan_id: 1003
-          vlan_raw_device: clients
-        client-4:
-          addresses:
-            - 100.64.0.130/27
-          vlan_id: 1004
-          vlan_raw_device: clients
-      dhcp-2.isp.auro.re:
-        ens18:
-          gateways:
-            - 2a09:6840:128::254
-            - 10.128.0.254
-          addresses:
-            - 2a09:6840:128::91/56
-            - 10.128.0.91/16
-        ens19: null
-        clients:
-          bridge_vlan_aware: true
-          bridge_ports:
-            - ens19
-          bridge_vids:
-            - 1000-1004
-        client-0:
-          addresses:
-            - 100.64.0.3/27
-          vlan_id: 1000
-          vlan_raw_device: clients
-        client-1:
-          addresses:
-            - 100.64.0.35/27
-          vlan_id: 1001
-          vlan_raw_device: clients
-        client-2:
-          addresses:
-            - 100.64.0.67/27
-          vlan_id: 1002
-          vlan_raw_device: clients
-        client-3:
-          addresses:
-            - 100.64.0.99/27
-          vlan_id: 1003
-          vlan_raw_device: clients
-        client-4:
-          addresses:
-            - 100.64.0.131/27
-          vlan_id: 1004
-          vlan_raw_device: clients
-      isp-1.rtr.infra.auro.re:
-        ens18:
-          gateways:
-            - 2a09:6840:128::254
-            - 10.128.0.254
-          addresses:
-            - 2a09:6840:128::255/56
-            - 10.128.0.255/16
-        ens19: null
-        clients:
-          bridge_vlan_aware: true
-          bridge_ports:
-            - ens19
-          bridge_vids:
-            - 1000-1004
-          bridge_disable_pvid: true
-          forward: true
-          ipv6_addrgen: false
-        client-0:
-          forward: true
-          vlan_id: 1000
-          vlan_raw_device: clients
-          ipv6_addrgen: false
-        client-1:
-          forward: true
-          vlan_id: 1001
-          vlan_raw_device: clients
-          ipv6_addrgen: false
-        client-2:
-          forward: true
-          vlan_id: 1002
-          vlan_raw_device: clients
-          ipv6_addrgen: false
-        client-3:
-          forward: true
-          vlan_id: 1003
-          vlan_raw_device: clients
-          ipv6_addrgen: false
-        client-4:
-          forward: true
-          vlan_id: 1004
-          vlan_raw_device: clients
-          ipv6_addrgen: false
-      isp-2.rtr.infra.auro.re:
-        ens18:
-          gateways:
-            - 2a09:6840:128::254
-            - 10.128.0.254
-          addresses:
-            - 2a09:6840:128::158/56
-            - 10.128.0.158/16
-        ens19: null
-        clients:
-          bridge_vlan_aware: true
-          bridge_ports:
-            - ens19
-          bridge_vids:
-            - 1000-1004
-        client-0:
-          forward: true
-          vlan_id: 1000
-          vlan_raw_device: clients
-          ipv6_addrgen: false
-        client-1:
-          forward: true
-          vlan_id: 1001
-          vlan_raw_device: clients
-          ipv6_addrgen: false
-        client-2:
-          forward: true
-          vlan_id: 1002
-          vlan_raw_device: clients
-          ipv6_addrgen: false
-        client-3:
-          forward: true
-          vlan_id: 1003
-          vlan_raw_device: clients
-          ipv6_addrgen: false
-        client-4:
-          forward: true
-          vlan_id: 1004
-          vlan_raw_device: clients
-          ipv6_addrgen: false
-    ifupdown2__interfaces: "{{ ifupdown2__hosts[inventory_hostname] }}"
-  roles:
-    - ifupdown2
-
- hosts:
-    - ntp-1.int.infra.auro.re
-    - dns-1.int.infra.auro.re
-    - dhcp-1.isp.auro.re
-    - dhcp-2.isp.auro.re
-    - isp-1.rtr.infra.auro.re
-    - isp-2.rtr.infra.auro.re
-  vars:
-    resolvconf__nameservers:
-      - 2a09:6840:128::127
-      - 10.128.0.127
-    resolvconf__domain: auro.re
-    resolvconf__search:
-      - "{{ inventory_hostname | remove_domain_suffix }}"
-      - auro.re
-  roles:
-    - resolvconf
-...
--- a/playbooks/keepalived.yml
+++ b/playbooks/keepalived.yml
@ -1,32 +0,0 @@
-#!/usr/bin/env ansible-playbook
---
- hosts:
-    - isp-1.rtr.infra.auro.re
-    - isp-2.rtr.infra.auro.re
-  vars:
-    keepalived__virtual_router_id: 80
-    keepalived__interface: ens18
-    keepalived__virtual_addresses:
-      client-0:
-        - 100.64.0.1/27
-        - 2a09:6841::/56
-        - fe80::1/10
-      client-1:
-        - 100.64.0.33/27
-        - 2a09:6841:0:100::/56
-        - fe80::1/10
-      client-2:
-        - 100.64.0.65/27
-        - 2a09:6841:0:100::/56
-        - fe80::1/10
-      client-3:
-        - 100.64.0.97/27
-        - 2a09:6841:0:200::/56
-        - fe80::1/10
-      client-4:
-        - 100.64.0.129/27
-        - 2a09:6841:0:300::/56
-        - fe80::1/10
-  roles:
-    - keepalived
-...
--- a/playbooks/postgresql.yml
+++ b/playbooks/postgresql.yml
@ -30,14 +30,6 @@
          user: grafana
          net: 10.128.0.98/32
          method: md5
-        - database: dolibarr
-          user: dolibarr
-          net: 10.128.0.236/32
-          method: md5
-        - database: rt5
-          user: rt5
-          net: 10.128.0.123/32
-          method: md5
      databases:
        - nextcloud
        - gitea
@ -45,8 +37,6 @@
        - drone
        - netbox
        - grafana
-        - dolibarr
-        - rt5
      users:
        - name: nextcloud
          database: nextcloud
@ -78,16 +68,6 @@
          password: "{{ vault_postgresql_grafana_passwd }}"
          privs:
            - ALL
-        - name: dolibarr
-          database: dolibarr
-          password: "{{ vault_postgresql_dolibarr_passwd }}"
-          privs:
-            - ALL
-        - name: rt5
-          database: rt5
-          password: "{{ vault_postgresql_rt5_passwd }}"
-          privs:
-            - ALL
    update_motd:
      postgresql: PostgreSQL est déployé.
  roles:
@ -120,17 +100,12 @@
          user: cas
          net: 10.128.0.150/32
          method: md5
-        - database: appservice-discord
-          user: appservice-discord
-          net: 10.128.0.150/32
-          method: md5
      databases:
        - synapse
        - codimd
        - etherpad
        - kanboard
        - cas
-        - appservice-discord
      users:
        - name: synapse
          database: synapse
@ -157,11 +132,6 @@
          password: "{{ vault_postgresql_cas_passwd }}"
          privs:
            - ALL
-        - name: appservice-discord
-          database: appservice-discord
-          password: "{{ vault_postgresql_appservice_discord_passwd }}"
-          privs:
-            - ALL
    update_motd:
      postgresql: PostgreSQL est déployé.
  roles:
--- a/playbooks/prometheus.yml
+++ b/playbooks/prometheus.yml
@ -7,17 +7,13 @@
    snmp_switch_community: "{{ vault_snmp_switch_community }}"
    snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
    snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
-    snmp_ilo_user: aurore
-    snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
-    snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"
-
-    prometheus_servers_targets: |
-      {{ groups['fleming_pve'] + groups['fleming_vm'] | list | sort }}
-    prometheus_unifi_snmp_targets: |
-      {{ groups['fleming_unifi'] | list | sort }}
-    prometheus_ilo_snmp_targets: |
-      {{ groups['fleming_ilo'] | list | sort }}

+    # Prometheus targets.json
+    prometheus_targets:
+      - targets: |
+          {{ groups['fleming_pve'] + groups['fleming_vm'] | list | sort }}
+    prometheus_unifi_snmp_targets:
+      - targets: "{{ groups['fleming_unifi'] | list | sort }}"
    update_motd:
      prometheus: >-
        Prometheus (en configuration fleming) est déployé (/etc/prometheus).
@ -32,20 +28,16 @@
    snmp_switch_community: "{{ vault_snmp_switch_community }}"
    snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
    snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
-    snmp_ilo_user: aurore
-    snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
-    snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"

-    prometheus_servers_targets: |
-      {{ groups['pacaterie_pve'] + groups['pacaterie_vm'] | list | sort }}
-    prometheus_unifi_snmp_targets: |
-      {{ groups['pacaterie_unifi'] | list | sort }}
+    # Prometheus targets.json
+    prometheus_targets:
+      - targets: |
+          {{ groups['pacaterie_pve'] + groups['pacaterie_vm'] | list | sort }}
+    prometheus_unifi_snmp_targets:
+      - targets: "{{ groups['pacaterie_unifi'] | list | sort }}"
    prometheus_ups_snmp_targets:
      - ups-pn-1.ups.auro.re
      - ups-ps-1.ups.auro.re
-    prometheus_ilo_snmp_targets: |
-      {{ groups['pacaterie_ilo'] | list | sort }}
-
    update_motd:
      prometheus: >-
        Prometheus (en configuration pacaterie) est déployé (/etc/prometheus).
@ -60,21 +52,18 @@
    snmp_switch_community: "{{ vault_snmp_switch_community }}"
    snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
    snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
-    snmp_ilo_user: aurore
-    snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
-    snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"

+    # Prometheus targets.json
    prometheus_ups_snmp_targets:
      - ups-ec-1.ups.auro.re
-      # - ups-ec-2.ups.auro.re
+      - ups-ec-2.ups.auro.re
      - ups-ec-3.ups.auro.re
-    prometheus_servers_targets: |
-      {{ groups['edc_pve'] + groups['edc_vm'] + groups['edc_server'] | list | sort }}
-    prometheus_unifi_snmp_targets: |
-      {{ groups['edc_unifi'] | list | sort }}
-    prometheus_ilo_snmp_targets: |
-      {{ groups['edc_ilo'] | list | sort }}

+    prometheus_targets:
+      - targets: |
+          {{ groups['edc_pve'] + groups['edc_vm'] + groups['edc_server'] | list | sort }}
+    prometheus_unifi_snmp_targets:
+      - targets: "{{ groups['edc_unifi'] | list | sort }}"
    update_motd:
      prometheus: >-
        Prometheus (en configuration edc) est déployé (/etc/prometheus).
@ -89,21 +78,17 @@
    snmp_switch_community: "{{ vault_snmp_switch_community }}"
    snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
    snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
-    snmp_ilo_user: aurore
-    snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
-    snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"

-    prometheus_servers_targets: |
-      {{ groups['gs_pve'] + groups['gs_vm'] | list | sort }}
-    prometheus_unifi_snmp_targets: |
-      {{ groups['gs_unifi'] | list | sort }}
+    # Prometheus targets.json
+    prometheus_targets:
+      - targets: |
+          {{ groups['gs_pve'] + groups['gs_vm'] | list | sort }}
+    prometheus_unifi_snmp_targets:
+      - targets: "{{ groups['gs_unifi'] | list | sort }}"
    prometheus_ups_snmp_targets:
      - ups-gk-1.ups.auro.re
-    prometheus_apc_pdu_snmp_targets:
+    prometheus_pdu_snmp_targets:
      - pdu-ga-1.ups.auro.re
-    prometheus_ilo_snmp_targets: |
-      {{ groups['gs_ilo'] | list | sort }}
-
    update_motd:
      prometheus: >-
        Prometheus (en configuration gs) est déployé (/etc/prometheus).
@ -118,20 +103,17 @@
    snmp_switch_community: "{{ vault_snmp_switch_community }}"
    snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
    snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
-    snmp_ilo_user: aurore
-    snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
-    snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"

+    # Prometheus targets.json
    prometheus_ups_snmp_targets:
      - ups-r3-1.ups.auro.re
      - ups-r1-1.ups.auro.re
-    prometheus_servers_targets: |
-      {{ groups['rives_pve'] + groups['rives_vm'] | list | sort }}
-    prometheus_unifi_snmp_targets: |
-      {{ groups['rives_unifi'] | list | sort }}
-    prometheus_ilo_snmp_targets: |
-      {{ groups['rives_ilo'] | list | sort }}

+    prometheus_targets:
+      - targets: |
+          {{ groups['rives_pve'] + groups['rives_vm'] | list | sort }}
+    prometheus_unifi_snmp_targets:
+      - targets: "{{ groups['rives_unifi'] | list | sort }}"
    update_motd:
      prometheus: >-
        Prometheus (en configuration rives) est déployé (/etc/prometheus).
@ -146,32 +128,30 @@
    snmp_switch_community: "{{ vault_snmp_switch_community }}"
    snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
    snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
-    snmp_ilo_user: aurore
-    snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
-    snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"

-    prometheus_servers_targets: |
-      {{ groups['aurore_pve'] + groups['aurore_vm'] | list | sort }}
-    prometheus_postgresql_targets: |
-      {{ groups['bdd'] + groups['radius'] | list | sort }}
+    # Prometheus targets.json
+    prometheus_targets:
+      - targets: |
+          {{ groups['aurore_pve'] + groups['aurore_vm'] | list | sort }}
+    prometheus_postgres_targets:
+      - targets: |
+          {{ groups['bdd'] + groups['radius'] | list | sort }}
    prometheus_switch_snmp_targets:
-      - yggdrasil.switch.auro.re
-      - sw-pn-serveurs.switch.auro.re
-      - sw-ec-serveurs.switch.auro.re
-      - sw-gk-serveurs.switch.auro.re
-      - sw-fl-serveurs.switch.auro.re
-      - sw-ff-uplink.switch.auro.re
-      - sw-fl-core.switch.auro.re
-      - sw-fd-vcore.switch.auro.re
-      - sw-fl-vcore.switch.auro.re
-      - sw-ff-vcore.switch.auro.re
-      - sw-pn-core.switch.auro.re
-      - sw-ec-core.switch.auro.re
-      - sw-gk-core.switch.auro.re
-      - sw-r3-core.switch.auro.re
-    prometheus_ilo_snmp_targets: |
-      {{ groups['aurore_ilo'] | list | sort }}
-
+      - targets:
+          - yggdrasil.switch.auro.re
+          - sw-pn-serveurs.switch.auro.re
+          - sw-ec-serveurs.switch.auro.re
+          - sw-gk-serveurs.switch.auro.re
+          - sw-fl-serveurs.switch.auro.re
+          - sw-ff-uplink.switch.auro.re
+          - sw-fl-core.switch.auro.re
+          - sw-fd-vcore.switch.auro.re
+          - sw-fl-vcore.switch.auro.re
+          - sw-ff-vcore.switch.auro.re
+          - sw-pn-core.switch.auro.re
+          - sw-ec-core.switch.auro.re
+          - sw-gk-core.switch.auro.re
+          - sw-r3-core.switch.auro.re
    update_motd:
      prometheus: >-
        Prometheus (en configuration aurore) est déployé (/etc/prometheus).
@ -186,17 +166,16 @@
    snmp_switch_community: "{{ vault_snmp_switch_community }}"
    snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
    snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
-    snmp_ilo_user: aurore
-    snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
-    snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"

-    prometheus_servers_targets: |
-      {{ groups['ovh_pve'] + groups['ovh_vm'] | list | sort }}
-    prometheus_postgresql_targets:
-      - bdd-ovh.adm.auro.re
+    # Prometheus targets.json
+    prometheus_targets:
+      - targets: |
+          {{ groups['ovh_pve'] + groups['ovh_vm'] | list | sort }}
+    prometheus_postgres_targets:
+      - targets:
+          - bdd-ovh.adm.auro.re
    prometheus_docker_targets:
      - docker-ovh.adm.auro.re
-
    update_motd:
      prometheus: >-
        Prometheus (en configuration ovh) est déployé (/etc/prometheus).
@ -210,11 +189,9 @@
    snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
    snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
    snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
-    snmp_ilo_user: aurore
-    snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
-    snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"

-    prometheus_servers_targets:
+    # Prometheus targets.json
+    prometheus_targets:
      - prometheus-edc.adm.auro.re
      - prometheus-gs.adm.auro.re
      - prometheus-fleming.adm.auro.re
@ -222,7 +199,6 @@
      - prometheus-rives.adm.auro.re
      - prometheus-aurore.adm.auro.re
      - prometheus-ovh.adm.auro.re
-
    update_motd:
      prometheus_federate: >-
        Prometheus (en configuration fédération) est déployé (/etc/prometheus).
--- a/playbooks/root.yml
+++ b/playbooks/root.yml
@ -1,9 +0,0 @@
-#!/usr/bin/env ansible-playbook
---
- hosts: all,!unifi
-  vars:
-    root_shell: /bin/bash
-    root_password: "{{ vault_root_password }}"
-  roles:
-    - root_account
-...
--- a/playbooks/ssh.yml
+++ b/playbooks/ssh.yml
@ -9,6 +9,10 @@
    openssh_authorized_principals:
      - any
      - "{{ inventory_hostname }}"
+    openssh_whitelist_groups: "{{ ['adherent']
+                                  if inventory_hostname == 'camelot.adm.auro.re'
+                                  else [] }}"
+    openssh_allow_passwords: "{{ inventory_hostname == 'camelot.adm.auro.re' }}"
  roles:
    - openssh_server
 ...
--- a/roles/baseconfig/tasks/apt-unattended.yml
+++ b/roles/baseconfig/tasks/apt-unattended.yml
@ -1,21 +1,19 @@
 ---
 - name: Install unattended-upgrades
-  when: ansible_os_family == "Debian"
  apt:
    name: unattended-upgrades
-    state: present
-    update_cache: true
-  register: apt_result
-  retries: 3
-  until: apt_result is succeeded

 - name: Configure unattended-upgrades
  template:
-    src: "apt/{{ item }}.j2"
+    src: "{{ item }}.j2"
    dest: "/etc/apt/apt.conf.d/{{ item }}"
    owner: root
    mode: u=rw,g=r,o=r
  loop:
-    - 50unattended-upgrades
    - 20auto-upgrades
+    - 50unattended-upgrades
+
+- name: Install debsums
+  apt:
+    name: debsums
 ...
--- a/roles/baseconfig/templates/apt/20auto-upgrades.j2
+++ b/roles/baseconfig/templates/apt/20auto-upgrades.j2
@ -1,4 +1,4 @@
-// {{ ansible_managed }}
+{{ ansible_managed | comment("c") }}

 APT::Periodic::Update-Package-Lists "1";
 APT::Periodic::Unattended-Upgrade "1";
--- a/roles/baseconfig/templates/apt/50unattended-upgrades.j2
+++ b/roles/baseconfig/templates/apt/50unattended-upgrades.j2
@ -1,4 +1,4 @@
-// {{ ansible_managed }}
+{{ ansible_managed | comment("c") }}

 Unattended-Upgrade::Origins-Pattern {
        "origin=Debian,codename=${distro_codename},label=Debian-Security";
@ -9,8 +9,10 @@ Unattended-Upgrade::Package-Blacklist {};
 Unattended-Upgrade::MinimalSteps "true";
 Unattended-Upgrade::InstallOnShutdown "false";

-Unattended-Upgrade::Mail "{{ monitoring_mail }}";
-// Unattended-Upgrade::MailOnlyOnError "false";
+{% if apt_upgrade_email_address | default(False) %}
+Unattended-Upgrade::Mail "{{ apt_upgrade_email_address }}";
+Unattended-Upgrade::MailOnlyOnError "false";
+{% endif %}

 Unattended-Upgrade::Remove-Unused-Kernel-Packages "false";
 Unattended-Upgrade::Remove-New-Unused-Dependencies "false";
--- a/roles/baseconfig/files/skel/dot_zshrc
+++ b/roles/baseconfig/files/skel/dot_zshrc
--- a/roles/baseconfig/files/skel/dot_zshrc.local
+++ b/roles/baseconfig/files/skel/dot_zshrc.local
@ -1,326 +0,0 @@
-# Filename:      /etc/skel/.zshrc
-# Purpose:       config file for zsh (z shell)
-# Authors:       (c) grml-team (grml.org)
-# Bug-Reports:   see http://grml.org/bugs/
-# License:       This file is licensed under the GPL v2 or any later version.
-################################################################################
-# Nowadays, grml's zsh setup lives in only *one* zshrc file.
-# That is the global one: /etc/zsh/zshrc (from grml-etc-core).
-# It is best to leave *this* file untouched and do personal changes to
-# your zsh setup via ${HOME}/.zshrc.local which is loaded at the end of
-# the global zshrc.
-#
-# That way, we enable people on other operating systems to use our
-# setup, too, just by copying our global zshrc to their ${HOME}/.zshrc.
-# Adjustments would still go to the .zshrc.local file.
-################################################################################
-
-## Aurore host color and white user
-zstyle ':prompt:grml:left:items:host' pre '%B%F{red}'
-zstyle ':prompt:grml:left:items:host' post '%f%b'
-zstyle ':prompt:grml:left:items:user' pre '%B'
-zstyle ':prompt:grml:left:items:user' post '%b'
-
-## Settings for umask
-#if (( EUID == 0 )); then
-#    umask 002
-#else
-#    umask 022
-#fi
-
-## Now, we'll give a few examples of what you might want to use in your
-## .zshrc.local file (just copy'n'paste and uncomment it there):
-
-## Prompt theme extension ##
-
-# Virtualenv support
-
-#function virtual_env_prompt () {
-#    REPLY=${VIRTUAL_ENV+(${VIRTUAL_ENV:t}) }
-#}
-#grml_theme_add_token  virtual-env -f virtual_env_prompt '%F{magenta}' '%f'
-#zstyle ':prompt:grml:left:setup' items rc virtual-env change-root user at host path vcs percent
-
-## ZLE tweaks ##
-
-## use the vi navigation keys (hjkl) besides cursor keys in menu completion
-#bindkey -M menuselect 'h' vi-backward-char        # left
-#bindkey -M menuselect 'k' vi-up-line-or-history   # up
-#bindkey -M menuselect 'l' vi-forward-char         # right
-#bindkey -M menuselect 'j' vi-down-line-or-history # bottom
-
-## set command prediction from history, see 'man 1 zshcontrib'
-#is4 && zrcautoload predict-on && \
-#zle -N predict-on         && \
-#zle -N predict-off        && \
-#bindkey "^X^Z" predict-on && \
-#bindkey "^Z" predict-off
-
-## press ctrl-q to quote line:
-#mquote () {
-#      zle beginning-of-line
-#      zle forward-word
-#      # RBUFFER="'$RBUFFER'"
-#      RBUFFER=${(q)RBUFFER}
-#      zle end-of-line
-#}
-#zle -N mquote && bindkey '^q' mquote
-
-## define word separators (for stuff like backward-word, forward-word, backward-kill-word,..)
-#WORDCHARS='*?_-.[]~=/&;!#$%^(){}<>' # the default
-#WORDCHARS=.
-#WORDCHARS='*?_[]~=&;!#$%^(){}'
-#WORDCHARS='${WORDCHARS:s@/@}'
-
-# just type '...' to get '../..'
-#rationalise-dot() {
-#local MATCH
-#if [[ $LBUFFER =~ '(^|/| |	|'$'\n''|\||;|&)\.\.$' ]]; then
-#  LBUFFER+=/
-#  zle self-insert
-#  zle self-insert
-#else
-#  zle self-insert
-#fi
-#}
-#zle -N rationalise-dot
-#bindkey . rationalise-dot
-## without this, typing a . aborts incremental history search
-#bindkey -M isearch . self-insert
-
-#bindkey '\eq' push-line-or-edit
-
-## some popular options ##
-
-## add `|' to output redirections in the history
-#setopt histallowclobber
-
-## try to avoid the 'zsh: no matches found...'
-#setopt nonomatch
-
-## warning if file exists ('cat /dev/null > ~/.zshrc')
-#setopt NO_clobber
-
-## don't warn me about bg processes when exiting
-#setopt nocheckjobs
-
-## alert me if something failed
-#setopt printexitvalue
-
-## with spelling correction, assume dvorak kb
-#setopt dvorak
-
-## Allow comments even in interactive shells
-#setopt interactivecomments
-
-
-## compsys related snippets ##
-
-## changed completer settings
-#zstyle ':completion:*' completer _complete _correct _approximate
-#zstyle ':completion:*' expand prefix suffix
-
-## another different completer setting: expand shell aliases
-#zstyle ':completion:*' completer _expand_alias _complete _approximate
-
-## to have more convenient account completion, specify your logins:
-#my_accounts=(
-# {grml,grml1}@foo.invalid
-# grml-devel@bar.invalid
-#)
-#other_accounts=(
-# {fred,root}@foo.invalid
-# vera@bar.invalid
-#)
-#zstyle ':completion:*:my-accounts' users-hosts $my_accounts
-#zstyle ':completion:*:other-accounts' users-hosts $other_accounts
-
-## add grml.org to your list of hosts
-#hosts+=(grml.org)
-#zstyle ':completion:*:hosts' hosts $hosts
-
-## telnet on non-default ports? ...well:
-## specify specific port/service settings:
-#telnet_users_hosts_ports=(
-#  user1@host1:
-#  user2@host2:
-#  @mail-server:{smtp,pop3}
-#  @news-server:nntp
-#  @proxy-server:8000
-#)
-#zstyle ':completion:*:*:telnet:*' users-hosts-ports $telnet_users_hosts_ports
-
-## the default grml setup provides '..' as a completion. it does not provide
-## '.' though. If you want that too, use the following line:
-#zstyle ':completion:*' special-dirs true
-
-## aliases ##
-
-## translate
-#alias u='translate -i'
-
-## ignore ~/.ssh/known_hosts entries
-#alias insecssh='ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" -o "PreferredAuthentications=keyboard-interactive"'
-
-
-## global aliases (for those who like them) ##
-
-#alias -g '...'='../..'
-#alias -g '....'='../../..'
-#alias -g BG='& exit'
-#alias -g C='|wc -l'
-#alias -g G='|grep'
-#alias -g H='|head'
-#alias -g Hl=' --help |& less -r'
-#alias -g K='|keep'
-#alias -g L='|less'
-#alias -g LL='|& less -r'
-#alias -g M='|most'
-#alias -g N='&>/dev/null'
-#alias -g R='| tr A-z N-za-m'
-#alias -g SL='| sort | less'
-#alias -g S='| sort'
-#alias -g T='|tail'
-#alias -g V='| vim -'
-
-## instead of global aliase it might be better to use grmls $abk assoc array, whose contents are expanded after pressing ,.
-#$abk[SnL]="| sort -n | less"
-
-## get top 10 shell commands:
-#alias top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10'
-
-## Execute \kbd{./configure}
-#alias CO="./configure"
-
-## Execute \kbd{./configure --help}
-#alias CH="./configure --help"
-
-## miscellaneous code ##
-
-## Use a default width of 80 for manpages for more convenient reading
-#export MANWIDTH=${MANWIDTH:-80}
-
-## Set a search path for the cd builtin
-#cdpath=(.. ~)
-
-## variation of our manzsh() function; pick you poison:
-#manzsh()  { /usr/bin/man zshall |  most +/"$1" ; }
-
-## Switching shell safely and efficiently? http://www.zsh.org/mla/workers/2001/msg02410.html
-#bash() {
-#    NO_SWITCH="yes" command bash "$@"
-#}
-#restart () {
-#    exec $SHELL $SHELL_ARGS "$@"
-#}
-
-## Handy functions for use with the (e::) globbing qualifier (like nt)
-#contains() { grep -q "$*" $REPLY }
-#sameas() { diff -q "$*" $REPLY &>/dev/null }
-#ot () { [[ $REPLY -ot ${~1} ]] }
-
-## get_ic() - queries imap servers for capabilities; real simple. no imaps
-#ic_get() {
-#    emulate -L zsh
-#    local port
-#    if [[ ! -z $1 ]] ; then
-#        port=${2:-143}
-#        print "querying imap server on $1:${port}...\n";
-#        print "a1 capability\na2 logout\n" | nc $1 ${port}
-#    else
-#        print "usage:\n  $0 <imap-server> [port]"
-#    fi
-#}
-
-## List all occurrences of programm in current PATH
-#plap() {
-#    emulate -L zsh
-#    if [[ $# = 0 ]] ; then
-#        echo "Usage:    $0 program"
-#        echo "Example:  $0 zsh"
-#        echo "Lists all occurrences of program in the current PATH."
-#    else
-#        ls -l ${^path}/*$1*(*N)
-#    fi
-#}
-
-## Find out which libs define a symbol
-#lcheck() {
-#    if [[ -n "$1" ]] ; then
-#        nm -go /usr/lib/lib*.a 2>/dev/null | grep ":[[:xdigit:]]\{8\} . .*$1"
-#    else
-#        echo "Usage: lcheck <function>" >&2
-#    fi
-#}
-
-## Download a file and display it locally
-#uopen() {
-#    emulate -L zsh
-#    if ! [[ -n "$1" ]] ; then
-#        print "Usage: uopen \$URL/\$file">&2
-#        return 1
-#    else
-#        FILE=$1
-#        MIME=$(curl --head $FILE | \
-#               grep Content-Type | \
-#               cut -d ' ' -f 2 | \
-#               cut -d\; -f 1)
-#        MIME=${MIME%$'\r'}
-#        curl $FILE | see ${MIME}:-
-#    fi
-#}
-
-## Memory overview
-#memusage() {
-#    ps aux | awk '{if (NR > 1) print $5;
-#                   if (NR > 2) print "+"}
-#                   END { print "p" }' | dc
-#}
-
-## print hex value of a number
-#hex() {
-#    emulate -L zsh
-#    if [[ -n "$1" ]]; then
-#        printf "%x\n" $1
-#    else
-#        print 'Usage: hex <number-to-convert>'
-#        return 1
-#    fi
-#}
-
-## log out? set timeout in seconds...
-## ...and do not log out in some specific terminals:
-#if [[ "${TERM}" == ([Exa]term*|rxvt|dtterm|screen*) ]] ; then
-#    unset TMOUT
-#else
-#    TMOUT=1800
-#fi
-
-## associate types and extensions (be aware with perl scripts and anwanted behaviour!)
-#check_com zsh-mime-setup || { autoload zsh-mime-setup && zsh-mime-setup }
-#alias -s pl='perl -S'
-
-## ctrl-s will no longer freeze the terminal.
-#stty erase "^?"
-
-## you want to automatically use a bigger font on big terminals?
-#if [[ "$TERM" == "xterm" ]] && [[ "$LINES" -ge 50 ]] && [[ "$COLUMNS" -ge 100 ]] && [[ -z "$SSH_CONNECTION" ]] ; then
-#    large
-#fi
-
-## Some quick Perl-hacks aka /useful/ oneliner
-#bew() { perl -le 'print unpack "B*","'$1'"' }
-#web() { perl -le 'print pack "B*","'$1'"' }
-#hew() { perl -le 'print unpack "H*","'$1'"' }
-#weh() { perl -le 'print pack "H*","'$1'"' }
-#pversion()    { perl -M$1 -le "print $1->VERSION" } # i. e."pversion LWP -> 5.79"
-#getlinks ()   { perl -ne 'while ( m/"((www|ftp|http):\/\/.*?)"/gc ) { print $1, "\n"; }' $* }
-#gethrefs ()   { perl -ne 'while ( m/href="([^"]*)"/gc ) { print $1, "\n"; }' $* }
-#getanames ()  { perl -ne 'while ( m/a name="([^"]*)"/gc ) { print $1, "\n"; }' $* }
-#getforms ()   { perl -ne 'while ( m:(\</?(input|form|select|option).*?\>):gic ) { print $1, "\n"; }' $* }
-#getstrings () { perl -ne 'while ( m/"(.*?)"/gc ) { print $1, "\n"; }' $*}
-#showINC ()    { perl -e 'for (@INC) { printf "%d %s\n", $i++, $_ }' }
-#vimpm ()      { vim `perldoc -l $1 | sed -e 's/pod$/pm/'` }
-#vimhelp ()    { vim -c "help $1" -c on -c "au! VimEnter *" }
-
-## END OF FILE #################################################################
--- a/roles/baseconfig/tasks/apt-listchanges.yml
+++ b/roles/baseconfig/tasks/apt-listchanges.yml
@ -1,32 +0,0 @@
---
-# Install apt-listchanges
- name: Install apt-listchanges
-  when: ansible_os_family == "Debian"
-  apt:
-    name: apt-listchanges
-    state: present
-    update_cache: true
-  register: apt_result
-  retries: 3
-  until: apt_result is succeeded
-
-# Send email when there is something new
- name: Configure apt-listchanges
-  ini_file:
-    path: /etc/apt/listchanges.conf
-    no_extra_spaces: true
-    section: apt
-    option: "{{ item.option }}"
-    value: "{{ item.value }}"
-    state: present
-    mode: 0644
-  loop:
-    - option: confirm
-      value: "true"
-
-    - option: email_address
-      value: "{{ monitoring_mail }}"
-
-    - option: which
-      value: both
-...
--- a/roles/basesecurity/handlers/main.yml
+++ b/roles/basesecurity/handlers/main.yml
@ -1,10 +0,0 @@
---
- name: Restart sshd service
-  service:
-    name: sshd
-    state: restarted
-
- name: Restart fail2ban service
-  service:
-    name: fail2ban
-    state: restarted
--- a/roles/basesecurity/tasks/main.yml
+++ b/roles/basesecurity/tasks/main.yml
@ -23,65 +23,4 @@
    - /bin/mount  # Only root should mount
    - /bin/umount  # Only root should umount
  ignore_errors: true  # Sometimes file won't exist
-
-# Only SSH keys to log on root
- name: Prohibit root SSH with password
-  lineinfile:
-    dest: /etc/ssh/sshd_config
-    regexp: '^{{ item.0 }}'
-    insertafter: '^#{{ item.0 }}'
-    line: '{{ item.0 }} {{ item.1 }}'
-  loop:
-    - ["PermitRootLogin", "prohibit-password"]
-    - ["AllowAgentForwarding", "no"]
-    - ["X11Forwarding", "no"]
-    - ["TCPKeepAlive", "yes"]
-  notify: Restart sshd service
-
-# See banned client with `fail2ban-client status sshd`
- name: Install fail2ban
-  apt:
-    name: fail2ban
-    state: present
-  register: apt_result
-  retries: 3
-  until: apt_result is succeeded
-
- name: Configure fail2ban
-  ini_file:
-    path: /etc/fail2ban/jail.d/local.conf
-    section: "{{ item.section }}"
-    option: "{{ item.option }}"
-    value: "{{ item.value }}"
-    state: present
-    mode: 0644
-  notify: Restart fail2ban service
-  loop:
-    - section: sshd
-      option: ignoreip
-      value: 10.128.0.254  # Whitelist bastion
-
-    - section: sshd
-      option: enabled
-      value: "true"
-
-    - section: sshd
-      option: bantime
-      value: 600
-
-    - section: sshd
-      option: findtime
-      value: 600
-
-    - section: sshd
-      option: maxretry
-      value: 5
-
-# See altered packages and configurations with `debsums -ca`
- name: Install debsums
-  apt:
-    name: debsums
-    state: present
-  register: apt_result
-  retries: 3
-  until: apt_result is succeeded
+...
--- a/roles/borgbackup_client/templates/borgmatic.timer.j2
+++ b/roles/borgbackup_client/templates/borgmatic.timer.j2
@ -4,13 +4,8 @@
 Description=Timer for borgmatic backup

 [Timer]
-{% if borg_keep_hourly > 0 %}
 OnCalendar=hourly
 RandomizedDelaySec=60m
-{% else %}
-OnCalendar=daily
-RandomizedDelaySec=24h
-{% endif %}
 FixedRandomDelay=true

 [Install]
--- a/roles/chronyd/defaults/main.yml
+++ b/roles/chronyd/defaults/main.yml
@ -1,11 +0,0 @@
---
-chronyd__pools: []
-chronyd__key_file: /etc/chrony/chrony.keys
-chronyd__drift_file: /var/lib/chrony/chrony.drift
-chronyd__nts_dump_dir: /var/lib/chrony
-chronyd__log_dir: /var/log/chrony
-chronyd__max_update_skew: 100.0
-chronyd__rtcsync: true
-chronyd__allow_networks: []
-chronyd__log_change_seconds: 0.5
-...
--- a/roles/chronyd/handlers/main.yml
+++ b/roles/chronyd/handlers/main.yml
@ -1,6 +0,0 @@
---
- name: Restart chronyd
-  systemd:
-    name: chrony.service
-    state: restarted
-...
--- a/roles/chronyd/tasks/main.yml
+++ b/roles/chronyd/tasks/main.yml
@ -1,32 +0,0 @@
---
- name: Uninstall ntp and sntp
-  apt:
-    name:
-      - sntp
-      - ntp
-      - systemd-timesyncd
-    state: absent
-
- name: Install chronyd
-  apt:
-    name: chrony
-
- name: Configure chronyd
-  template:
-    src: "{{ item }}.j2"
-    dest: "/etc/chrony/{{ item }}"
-    owner: root
-    group: root
-    mode: u=rw,g=r,o=
-  loop:
-    - chrony.conf
-    - chrony.keys
-  notify:
-    - Restart chronyd
-
- name: Enable and start chronyd
-  systemd:
-    name: chrony.service
-    enabled: true
-    state: started
-...
--- a/roles/chronyd/templates/chrony.conf.j2
+++ b/roles/chronyd/templates/chrony.conf.j2
@ -1,30 +0,0 @@
-{{ ansible_managed | comment }}
-
-{% for pool in chronyd__pools %}
-pool {{ pool }} iburst
-{% endfor %}
-
-keyfile {{ chronyd__key_file }}
-driftfile {{ chronyd__drift_file }}
-ntsdumpdir {{ chronyd__nts_dump_dir }}
-logdir {{ chronyd__log_dir }}
-
-log tracking measurements statistics
-
-maxupdateskew {{ chronyd__max_update_skew | float }}
-
-{% if chronyd__rtcsync %}
-rtcsync
-{% endif %}
-
-{% if chronyd__local_stratum is defined %}
-local stratum {{ chronyd__local_stratum | int }}
-{% endif %}
-
-logchange {{ chronyd__log_change_seconds | float }}
-
-leapsectz right/UTC
-
-{% for network in chronyd__allow_networks %}
-allow {{ network | ipaddr }}
-{% endfor %}
--- a/roles/chronyd/templates/chrony.keys.j2
+++ b/roles/chronyd/templates/chrony.keys.j2
@ -1 +0,0 @@
-{{ ansible_managed | comment }}
--- a/roles/debian_common/tasks/main.yml
+++ b/roles/debian_common/tasks/main.yml
@ -39,37 +39,6 @@
    dest: /etc/apt/sources.list
    mode: 0644

-# Patriotisme
- name: Ensure French UTF-8 locale exists
-  locale_gen:
-    name: fr_FR.UTF-8
-    state: present
-
-# Fix LC_CTYPE="C"
- name: Select default locale
-  debconf:
-    name: locales
-    question: locales/default_environment_locale
-    value: fr_FR.UTF-8
-    vtype: select
-  notify: Reconfigure locales
-
-# APT-List Changes : send email with changelog
- include_tasks: apt-listchanges.yml
-
-# APT Unattended upgrades
- include_tasks: apt-unattended.yml
-
-# User skeleton
- name: Configure user skeleton
-  copy:
-    src: "skel/dot_{{ item }}"
-    dest: "/etc/skel/.{{ item }}"
-    mode: 0644
-  loop:
-    - zshrc
-    - zshrc.local
-
 - name: Configure resolvconf
  template:
    src: resolv.conf
@ -90,3 +59,4 @@
 - name: Remove dependencies that are no longer required
  apt:
    autoremove: true
+...
--- a/roles/debian_common/templates/apt/sources.list.j2
+++ b/roles/debian_common/templates/apt/sources.list.j2
--- a/roles/debian_common/templates/resolv.conf
+++ b/roles/debian_common/templates/resolv.conf
--- a/roles/ifupdown2/defaults/main.yml
+++ b/roles/ifupdown2/defaults/main.yml
@ -1,3 +0,0 @@
---
-ifupdown2__interfaces: {}
-...
--- a/roles/ifupdown2/handlers/main.yml
+++ b/roles/ifupdown2/handlers/main.yml
@ -1,9 +0,0 @@
---
- name: Restart networking
-  systemd:
-    name: networking.service
-    state: restarted
-
- name: Bring all interfaces up
-  shell: /usr/sbin/ifup -a
-...
--- a/roles/ifupdown2/tasks/main.yml
+++ b/roles/ifupdown2/tasks/main.yml
@ -1,42 +0,0 @@
---
- name: Gather package facts
-  package_facts:
-    manager: apt
-
- name: Check if ifupdown2 is installed
-  set_fact:
-    must_mask: "{{ 'ifupdown2' not in ansible_facts.packages }}"
-
- name: Mask networking before installing ifupdown2
-  systemd:
-    name: networking.service
-    masked: true
-  when: must_mask
-
- name: Install ifupdown2
-  apt:
-    name: ifupdown2
-
- name: Unmask networking now that ifupdown2 is installed
-  systemd:
-    name: networking.service
-    masked: false
-  when: must_mask
-
- name: Configure ifupdown2
-  template:
-    src: interfaces.j2
-    dest: /etc/network/interfaces
-    owner: root
-    group: root
-    mode: u=rw,g=r,o=
-  notify:
-    - Restart networking
-    - Bring all interfaces up
-
- name: Enable and start networking
-  systemd:
-    name: networking.service
-    state: started
-    enabled: true
-...
--- a/roles/ifupdown2/templates/interfaces.j2
+++ b/roles/ifupdown2/templates/interfaces.j2
@ -1,41 +0,0 @@
-{{ ansible_managed | comment }}
-
-{% for name, iface in ifupdown2__interfaces.items() %}
-auto {{ name }}
-iface {{ name }}
-{% for address in iface.addresses | default([]) %}
-    address {{ address | ipaddr }}
-{% endfor %}
-{% for gateway in iface.gateways | default([]) %}
-    gateway {{ gateway | ipaddr }}
-{% endfor %}
-{% if iface.bridge_ports is defined %}
-    bridge-ports {{ iface.bridge_ports | join(" ") }}
-{% endif %}
-{% if iface.bridge_vlan_aware is defined %}
-    bridge-vlan-aware {{ iface.bridge_vlan_aware
-                         | ternary("yes", "no") }}
-{% endif %}
-{% if iface.bridge_vids is defined %}
-    bridge-vids {{ iface.bridge_vids | join(",") }}
-{% endif %}
-{% if iface.vlan_id is defined %}
-    vlan-id {{ iface.vlan_id | int }}
-{% endif %}
-{% if iface.vlan_raw_device is defined %}
-    vlan-raw-device {{ iface.vlan_raw_device }}
-{% endif %}
-{% if iface.bridge_disable_pvid | default(false) %}
-    bridge-pvid 0
-    post-up bridge vlan del dev {{ name }} vid 1 self
-{% endif %}
-{% if iface.forward | default(false) %}
-    ip-forward yes
-    ip6-forward yes
-{% endif %}
-{% if iface.ipv6_addrgen is defined %}
-    ipv6-addrgen {{ iface.ipv6_addrgen
-                    | ternary("yes", "no") }}
-{% endif %}
-
-{% endfor %}
--- a/roles/keepalived/defaults/main.yml
+++ b/roles/keepalived/defaults/main.yml
@ -1,7 +0,0 @@
---
-keepalived__virtual_addresses: {}
-keepalived__notify_master: []
-keepalived__notify_backup: []
-keepalived__notify_fault: []
-keepalived__max_auto_priority: -1
-...
--- a/roles/keepalived/handlers/main.yml
+++ b/roles/keepalived/handlers/main.yml
@ -1,6 +0,0 @@
---
- name: Reload keepalived
-  systemd:
-    name: keepalived.service
-    state: reloaded
-...
--- a/roles/keepalived/tasks/main.yml
+++ b/roles/keepalived/tasks/main.yml
@ -1,28 +0,0 @@
---
- name: Install keepalived
-  apt:
-    name: keepalived
-
- name: Configure keepalived
-  template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    owner: root
-    group: root
-    mode: "{{ item.mode }}"
-  loop:
-    - src: keepalived.conf.j2
-      dest: /etc/keepalived/keepalived.conf
-      mode: u=rw,g=,o=
-    - src: notify.sh.j2
-      dest: /etc/keepalived/notify.sh
-      mode: u=rwx,g=,o=
-  notify:
-    - Reload keepalived
-
- name: Enable and start keepalived
-  systemd:
-    name: keepalived
-    enabled: true
-    state: started
-...
--- a/roles/keepalived/templates/keepalived.conf.j2
+++ b/roles/keepalived/templates/keepalived.conf.j2
@ -1,92 +0,0 @@
-{{ ansible_managed | comment }}
-
-global_defs {
-    dynamic_interfaces
-    script_user root
-    enable_script_security
-    vrrp_version 3
-{% if keepalived__max_auto_priority is defined %}
-    max_auto_priority {{ keepalived__max_auto_priority | int }}
-{% endif %}
-}
-
-{%
-set ipv4_enabled =
-    keepalived__ipv4_enabled
-    | default(keepalived__virtual_addresses.values()
-              | flatten | ansible.utils.ipv4)
-%}
-{%
-set ipv6_enabled =
-    keepalived__ipv6_enabled
-    | default(keepalived__virtual_addresses.values()
-              | flatten | ansible.utils.ipv6)
-%}
-
-{% if ipv4_enabled and ipv6_enabled %}
-vrrp_sync_group group {
-    group {
-{% if ipv4_enabled %}
-        instance_v4
-{% endif %}
-{% if ipv6_enabled %}
-        instance_v6
-{% endif %}
-    }
-    notify_master "/etc/keepalived/notify.sh master"
-    notify_backup "/etc/keepalived/notify.sh backup"
-    notify_fault "/etc/keepalived/notify.sh fault"
-}
-{% endif %}
-
-{% if ipv4_enabled %}
-vrrp_instance instance_v4 {
-    virtual_router_id {{ keepalived__virtual_router_id | int }}
-    interface {{ keepalived__interface }}
-    state BACKUP
-    priority 250
-    nopreempt
-    advert_int 1
-    accept
-    virtual_ipaddress {
-{% for dev, addresses in keepalived__virtual_addresses.items() %}
-{% for address in addresses %}
-{% if address | ansible.utils.ipv4 %}
-        {{ address }} dev {{ dev }}
-{% endif %}
-{% endfor %}
-{% endfor %}
-    }
-{% if not (ipv4_enabled and ipv6_enabled) %}
-    notify_master "/etc/keepalived/notify.sh master"
-    notify_backup "/etc/keepalived/notify.sh backup"
-    notify_fault "/etc/keepalived/notify.sh fault"
-{% endif %}
-}
-{% endif %}
-
-{% if ipv6_enabled %}
-vrrp_instance instance_v6 {
-    virtual_router_id {{ keepalived__virtual_router_id | int }}
-    interface {{ keepalived__interface }}
-    state BACKUP
-    priority 250
-    nopreempt
-    advert_int 1
-    accept
-    virtual_ipaddress {
-{% for dev, addresses in keepalived__virtual_addresses.items() %}
-{% for address in addresses | ipaddr_sort(["link-local"]) %}
-{% if address | ansible.utils.ipv6 %}
-        {{ address }} dev {{ dev }}
-{% endif %}
-{% endfor %}
-{% endfor %}
-    }
-{% if not (ipv4_enabled and ipv6_enabled) %}
-    notify_master "/etc/keepalived/notify.sh master"
-    notify_backup "/etc/keepalived/notify.sh backup"
-    notify_fault "/etc/keepalived/notify.sh fault"
-{% endif %}
-}
-{% endif %}
--- a/roles/keepalived/templates/notify.sh.j2
+++ b/roles/keepalived/templates/notify.sh.j2
@ -1,33 +0,0 @@
-#!/bin/bash
-
-master=(
-{% for notify in keepalived__notify_master %}
-    {{ notify | quote }}
-{% endfor %}
-)
-
-backup=(
-{% for notify in keepalived__notify_backup %}
-    {{ notify | quote }}
-{% endfor %}
-)
-
-fault=(
-{% for notify in keepalived__notify_fault %}
-    {{ notify | quote }}
-{% endfor %}
-)
-
-case "$1" in
-    master | backup | fault)
-        scripts="$1[@]"
-        ;;
-    *)
-        echo "Usage: $0 (master|backup|fault)" >&2
-        exit 1
-esac
-
-for script in "${!scripts}"
-do
-      eval "${script}"
-done
--- a/roles/ldap_client/tasks/1_group_security.yml
+++ b/roles/ldap_client/tasks/1_group_security.yml
@ -1,13 +1,4 @@
 ---
-# Filter SSH on groups
- name: Filter SSH on groups
-  when: ansible_facts['hostname'] != "camelot"  # Camelot is accessible for everyone
-  lineinfile:
-    dest: /etc/ssh/sshd_config
-    regexp: ^AllowGroups
-    line: AllowGroups root sudoldap aurore ssh
-    state: present
-
 # To gain root access with ldap rights
 - name: Install SUDO package
  package:
--- a/roles/ldap_client/tasks/main.yml
+++ b/roles/ldap_client/tasks/main.yml
@ -2,9 +2,6 @@
 # Install and configure main LDAP tools
 - include_tasks: install_ldap.yml

-# Filter who can access server and sudo on groups
- include_tasks: 1_group_security.yml
-
 # Some userland scripts specific to LDAP install
 - include_tasks: 2_userland_scripts.yml

@ -14,11 +11,3 @@
    dest: /etc/pam.d/common-account
    regexp: 'pam_mkhomedir\.so'
    line: "session required pam_mkhomedir.so skel=/etc/skel/ umask=0077"
-
-# If LDAP crashes
- name: Install SSH keys for root account
-  authorized_key:
-    user: root
-    key: "{{ ssh_pub_keys }}"
-    state: present
-    exclusive: true
--- a/roles/locales/defaults/main.yml
+++ b/roles/locales/defaults/main.yml
@ -0,0 +1,4 @@
+---
+locales_default: en_US.UTF-8
+locales_additional: []
+...
--- a/roles/baseconfig/handlers/main.yml
+++ b/roles/baseconfig/handlers/main.yml
@ -1,4 +1,4 @@
 ---
-# Reconfigure locales when conf changes
 - name: Reconfigure locales
  command: dpkg-reconfigure locales -f noninteractive
+...
--- a/roles/locales/tasks/main.yml
+++ b/roles/locales/tasks/main.yml
@ -0,0 +1,15 @@
+---
+- name: Install locales
+  locale_gen:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ [locales_default] + locales_additional }}"
+
+- name: Select default locale
+  debconf:
+    name: locales
+    question: locales/default_environment_locale
+    value: "{{ locales_default }}"
+    vtype: select
+  notify: Reconfigure locales
+...
--- a/roles/openssh_server/defaults/main.yml
+++ b/roles/openssh_server/defaults/main.yml
@ -1,4 +1,7 @@
 ---
 openssh_authorized_principals:
  - any
+openssh_allow_passwords: false
+openssh_whitelist_users: []
+openssh_whitelist_groups: []
 ...
--- a/roles/openssh_server/tasks/main.yml
+++ b/roles/openssh_server/tasks/main.yml
@ -5,7 +5,7 @@

 - name: Enable OpenSSH Server
  systemd:
-    name: ssh.service
+    name: sshd.service
    enabled: true
    state: started

--- a/roles/openssh_server/templates/sshd_config.j2
+++ b/roles/openssh_server/templates/sshd_config.j2
@ -20,14 +20,19 @@ KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
 MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

+{% if openssh_allow_passwords %}
+AuthenticationMethods password publickey
+UsePAM yes
+{% else %}
 AuthenticationMethods publickey
+UsePAM no
+{% endif %}

 TrustedUserCAKeys /etc/ssh/users_ca.pub
 AuthorizedPrincipalsFile /etc/ssh/authorized_principals

 StrictModes yes
-UsePAM no
-PermitRootLogin yes
+PermitRootLogin without-password
 PermitUserRC no
 PermitUserEnvironment no
 AllowAgentForwarding no
@ -43,3 +48,10 @@ UseDNS no
 AcceptEnv LANG LC_*

 Subsystem sftp /usr/lib/openssh/sftp-server -f AUTHPRIV -l INFO
+
+AllowUsers {{ openssh_whitelist_users | default(['root'], true) | join(' ') }}
+
+{% for group in openssh_whitelist_groups %}
+Match group {{ group }}
+	AllowUsers *
+{% endfor %}
--- a/roles/prometheus/tasks/main.yml
+++ b/roles/prometheus/tasks/main.yml
@ -38,10 +38,10 @@
  loop:
    - server.rules.yml
    - docker.rules.yml
+    - django.rules.yml
    - ups.rules.yml
    - postgres.rules.yml
    - environmental.rules.yml
-    - ilo.rules.yml
  notify: Restart Prometheus

 - name: Make Prometheus snmp-exporter listen on localhost only
@ -63,6 +63,56 @@
    - snmp.yml
  notify: Restart prometheus-snmp-exporter

+# We don't need to restart Prometheus when updating nodes
+- name: Configure Prometheus nodes
+  copy:
+    content: "{{ prometheus_targets | to_nice_json }}"
+    dest: /etc/prometheus/targets.json
+    mode: 0644
+
+# We don't need to restart Prometheus when updating nodes
+- name: Configure Prometheus Ubiquity Unifi SNMP devices
+  copy:
+    content: "{{ prometheus_unifi_snmp_targets | to_nice_json }}"
+    dest: /etc/prometheus/targets_unifi_snmp.json
+    mode: 0644
+  when: prometheus_unifi_snmp_targets is defined
+
+- name: Configure Prometheus Switchs
+  copy:
+    content: "{{ prometheus_switch_snmp_targets | to_nice_json }}"
+    dest: /etc/prometheus/targets_switch_snmp.json
+    mode: 0644
+  when: prometheus_switch_snmp_targets is defined
+
+- name: Configure Prometheus UPS SNMP devices
+  copy:
+    content: "{{ [{'targets': prometheus_ups_snmp_targets }] | to_nice_json }}\n"
+    dest: /etc/prometheus/targets_ups_snmp.json
+    mode: 0644
+  when: prometheus_ups_snmp_targets is defined
+
+- name: Configure Prometheus docker monitoring
+  copy:
+    content: "{{ [{'targets': prometheus_docker_targets }] | to_nice_json }}\n"
+    dest: /etc/prometheus/targets_docker.json
+    mode: 0644
+  when: prometheus_docker_targets is defined
+
+- name: Configure Prometheus postgres monitoring
+  copy:
+    content: "{{ prometheus_postgres_targets | to_nice_json }}\n"
+    dest: /etc/prometheus/targets_postgres.json
+    mode: 0644
+  when: prometheus_postgres_targets is defined
+
+- name: Configure Prometheus apc_pdu monitoring
+  copy:
+    content: "{{ [{'targets': prometheus_pdu_snmp_targets }] | to_nice_json }}\n"
+    dest: /etc/prometheus/targets_apc_pdu_snmp.json
+    mode: 0644
+  when: prometheus_pdu_snmp_targets is defined
+
 - name: Activate prometheus service
  systemd:
    name: prometheus
--- a/roles/prometheus/templates/django.rules.yml.j2
+++ b/roles/prometheus/templates/django.rules.yml.j2
@ -0,0 +1,106 @@
+# {{ ansible_managed }}
+{# As this is also Jinja2 it will conflict without a raw block #}
+{% raw %}
+groups:
+- name: django.rules
+  rules:
+  - record: job:django_http_requests_before_middlewares_total:sum_rate30s
+    expr: sum(rate(django_http_requests_before_middlewares_total[30s])) BY (job)
+  - record: job:django_http_requests_unknown_latency_total:sum_rate30s
+    expr: sum(rate(django_http_requests_unknown_latency_total[30s])) BY (job)
+  - record: job:django_http_ajax_requests_total:sum_rate30s
+    expr: sum(rate(django_http_ajax_requests_total[30s])) BY (job)
+  - record: job:django_http_responses_before_middlewares_total:sum_rate30s
+    expr: sum(rate(django_http_responses_before_middlewares_total[30s])) BY (job)
+  - record: job:django_http_requests_unknown_latency_including_middlewares_total:sum_rate30s
+    expr: sum(rate(django_http_requests_unknown_latency_including_middlewares_total[30s]))
+      BY (job)
+  - record: job:django_http_requests_body_total_bytes:sum_rate30s
+    expr: sum(rate(django_http_requests_body_total_bytes[30s])) BY (job)
+  - record: job:django_http_responses_streaming_total:sum_rate30s
+    expr: sum(rate(django_http_responses_streaming_total[30s])) BY (job)
+  - record: job:django_http_responses_body_total_bytes:sum_rate30s
+    expr: sum(rate(django_http_responses_body_total_bytes[30s])) BY (job)
+  - record: job:django_http_requests_total:sum_rate30s
+    expr: sum(rate(django_http_requests_total_by_method[30s])) BY (job)
+  - record: job:django_http_requests_total_by_method:sum_rate30s
+    expr: sum(rate(django_http_requests_total_by_method[30s])) BY (job, method)
+  - record: job:django_http_requests_total_by_transport:sum_rate30s
+    expr: sum(rate(django_http_requests_total_by_transport[30s])) BY (job, transport)
+  - record: job:django_http_requests_total_by_view:sum_rate30s
+    expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) BY (job,
+      view)
+  - record: job:django_http_requests_total_by_view_transport_method:sum_rate30s
+    expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) BY (job,
+      view, transport, method)
+  - record: job:django_http_responses_total_by_templatename:sum_rate30s
+    expr: sum(rate(django_http_responses_total_by_templatename[30s])) BY (job, templatename)
+  - record: job:django_http_responses_total_by_status:sum_rate30s
+    expr: sum(rate(django_http_responses_total_by_status[30s])) BY (job, status)
+  - record: job:django_http_responses_total_by_charset:sum_rate30s
+    expr: sum(rate(django_http_responses_total_by_charset[30s])) BY (job, charset)
+  - record: job:django_http_exceptions_total_by_type:sum_rate30s
+    expr: sum(rate(django_http_exceptions_total_by_type[30s])) BY (job, type)
+  - record: job:django_http_exceptions_total_by_view:sum_rate30s
+    expr: sum(rate(django_http_exceptions_total_by_view[30s])) BY (job, view)
+  - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+    expr: histogram_quantile(0.5, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s]))
+      BY (job, le))
+    labels:
+      quantile: "50"
+  - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+    expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s]))
+      BY (job, le))
+    labels:
+      quantile: "95"
+  - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+    expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s]))
+      BY (job, le))
+    labels:
+      quantile: "99"
+  - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+    expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s]))
+      BY (job, le))
+    labels:
+      quantile: "99.9"
+  - record: job:django_http_requests_latency_seconds:quantile_rate30s
+    expr: histogram_quantile(0.5, sum(rate(django_http_requests_latency_seconds_bucket[30s]))
+      BY (job, le))
+    labels:
+      quantile: "50"
+  - record: job:django_http_requests_latency_seconds:quantile_rate30s
+    expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_seconds_bucket[30s]))
+      BY (job, le))
+    labels:
+      quantile: "95"
+  - record: job:django_http_requests_latency_seconds:quantile_rate30s
+    expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_seconds_bucket[30s]))
+      BY (job, le))
+    labels:
+      quantile: "99"
+  - record: job:django_http_requests_latency_seconds:quantile_rate30s
+    expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_seconds_bucket[30s]))
+      BY (job, le))
+    labels:
+      quantile: "99.9"
+  - record: job:django_model_inserts_total:sum_rate1m
+    expr: sum(rate(django_model_inserts_total[1m])) BY (job, model)
+  - record: job:django_model_updates_total:sum_rate1m
+    expr: sum(rate(django_model_updates_total[1m])) BY (job, model)
+  - record: job:django_model_deletes_total:sum_rate1m
+    expr: sum(rate(django_model_deletes_total[1m])) BY (job, model)
+  - record: job:django_db_new_connections_total:sum_rate30s
+    expr: sum(rate(django_db_new_connections_total[30s])) BY (alias, vendor)
+  - record: job:django_db_new_connection_errors_total:sum_rate30s
+    expr: sum(rate(django_db_new_connection_errors_total[30s])) BY (alias, vendor)
+  - record: job:django_db_execute_total:sum_rate30s
+    expr: sum(rate(django_db_execute_total[30s])) BY (alias, vendor)
+  - record: job:django_db_execute_many_total:sum_rate30s
+    expr: sum(rate(django_db_execute_many_total[30s])) BY (alias, vendor)
+  - record: job:django_db_errors_total:sum_rate30s
+    expr: sum(rate(django_db_errors_total[30s])) BY (alias, vendor, type)
+  - record: job:django_migrations_applied_total:max
+    expr: max(django_migrations_applied_total) BY (job, connection)
+  - record: job:django_migrations_unapplied_total:max
+    expr: max(django_migrations_unapplied_total) BY (job, connection)
+{% endraw %}
--- a/roles/prometheus/templates/ilo.rules.yml.j2
+++ b/roles/prometheus/templates/ilo.rules.yml.j2
@ -1,83 +0,0 @@
---
-{{ ansible_managed | comment }}
-
-{% macro raw(string) -%}
-{{ "{{" }} {{ string }} {{ "}}" }}
-{%- endmacro %}
-
-groups:
-
-  - name: ilo.rules
-    rules:
-
-      - alert: IloResilientMemoryDegraded
-        expr: cpqHeResilientMemCondition{cpqHeResilientMemCondition!~"ok|other"} == 1
-        for: 3m
-        labels:
-          severity: warning
-        annotations:
-          summary: >-
-            La mémoire vive n'est plus résiliente
-            ({{ raw('$labels.cpqHeResilientMemCondition') }})
-
-      - alert: IloBiosSelfTestDegraded
-        expr: cpqHeHWBiosCondition{cpqHeHWBiosCondition!~"ok|other"} == 1
-        for: 3m
-        labels:
-          severity: critical
-        annotations:
-          summary: >-
-            Une erreur a été détectée lors du POST du serveur
-            ({{ raw('$labels.cpqHeHWBiosCondition') }})
-
-      - alert: IloBatteryDegraded
-        expr: cpqHeSysBatteryCondition{cpqHeSysBatteryCondition!~"ok|other"} == 1
-        for: 3m
-        labels:
-          severity: warning
-        annotations:
-          summary: >-
-            La batterie est dégradée
-            ({{ raw('$labels.cpqHeSysBatteryCondition') }})
-
-      - alert: IloTemperatureSensorDegraded
-        expr: cpqHeTemperatureCondition{cpqHeTemperatureCondition!~"ok|other"} == 1
-        for: 3m
-        labels:
-          severity: critical
-        annotations:
-          summary: >-
-            Le capteur de température est dégradé
-            ({{ raw('$labels.cpqHeTemperatureCondition') }})
-
-      - alert: IloFanDegraded
-        expr: cpqHeFltTolFanCondition{cpqHeFltTolFanCondition!~"ok|other"} == 1
-        for: 3m
-        labels:
-          severity: critical
-        annotations:
-          summary: >-
-            Le ventilateur est dégradé
-            ({{ raw('$labels.cpqHeFltTolFanCondition') }})
-
-      - alert: IloPowerSupplyDegraded
-        expr: cpqHeFltTolPowerSupplyStatus{cpqHeFltTolPowerSupplyStatus!="noError"} == 1
-        for: 3m
-        labels:
-          severity: critical
-        annotations:
-          summary: >-
-            L'alimentation est dégradée
-            ({{ raw('$labels.cpqHeFltTolPowerSupplyStatus') }})
-
-      - alert: IloOverrideSwitchState
-        expr: cpqSm2CntlriLOSecurityOverrideSwitchState{cpqSm2CntlriLOSecurityOverrideSwitchState="set"} == 1
-        for: 3m
-        labels:
-          severity: critical
-        annotations:
-          summary: >-
-            Le switch de réinitialisation n'est pas à l'état d'origine,
-            l'authentification est bypassée
-
-...
--- a/roles/prometheus/templates/postgres.rules.yml.j2
+++ b/roles/prometheus/templates/postgres.rules.yml.j2
@ -112,7 +112,7 @@ groups:
            rate(pg_stat_database_xact_rollback{datname!~"template.*"}[3m]) /
            rate(pg_stat_database_xact_commit{datname!~"template.*"}[3m])
          ) * 100 
-          > 20
+          > 7
        for: 0m
        labels:
          severity: warning
--- a/roles/prometheus/templates/prometheus.yml.j2
+++ b/roles/prometheus/templates/prometheus.yml.j2
@ -25,15 +25,17 @@ rule_files:
 # A scrape configuration containing exactly one endpoint to scrape:
 # Here it's Prometheus itself.
 scrape_configs:
+  # The .json in file_sd_configs is dynamically reloaded
+
  - job_name: prometheus
    static_configs:
      - targets:
        - localhost:9090

-{% if prometheus_servers_targets is defined %}
  - job_name: servers
-    static_configs:
-      - targets: {{ prometheus_servers_targets | to_json }}
+    file_sd_configs:
+      - files:
+        - '/etc/prometheus/targets.json'
    relabel_configs:
      # Do not put :9100 in instance name, rather here
      - source_labels: [__address__]
@ -43,12 +45,11 @@ scrape_configs:
      - source_labels: [__param_target]
        target_label: __address__
        replacement: '$1:9100'
-{% endif %}

-{% if prometheus_unifi_snmp_targets is defined %}
  - job_name: unifi_snmp
-    static_configs:
-      - targets: {{ prometheus_unifi_snmp_targets | to_json }}
+    file_sd_configs:
+      - files:
+        - '/etc/prometheus/targets_unifi_snmp.json'
    metrics_path: /snmp
    params:
      module: [ubiquiti_unifi]
@ -59,12 +60,16 @@ scrape_configs:
        target_label: instance
      - target_label: __address__
        replacement: 127.0.0.1:9116
-{% endif %}

-{% if prometheus_ups_snmp_targets is defined %}
-  - job_name: ups_snmp
+  - job_name: django
+    scheme: https
    static_configs:
-      - targets: {{ prometheus_ups_snmp_targets | to_json }}
+    - targets: []
+
+  - job_name: ups_snmp
+    file_sd_configs:
+      - files:
+        - '/etc/prometheus/targets_ups_snmp.json'
    metrics_path: /snmp
    params:
      module: [eatonups]
@ -75,12 +80,11 @@ scrape_configs:
        target_label: instance
      - target_label: __address__
        replacement: 127.0.0.1:9116
-{% endif %}

-{% if prometheus_switch_snmp_targets is defined %}
  - job_name: switch_snmp
-    static_configs:
-      - targets: {{ prometheus_switch_snmp_targets | to_json }}
+    file_sd_configs:
+      - files:
+        - "/etc/prometheus/targets_switch_snmp.json"
    metrics_path: /snmp
    params:
      module: [procurve_switch]
@ -91,12 +95,11 @@ scrape_configs:
        target_label: instance
      - target_label: __address__
        replacement: 127.0.0.1:9116
-{% endif %}

-{% if prometheus_docker_targets is defined %}
  - job_name: docker
-    static_configs:
-      - targets: {{ prometheus_docker_targets | to_json }}
+    file_sd_configs:
+      - files:
+        - '/etc/prometheus/targets_docker.json'
    relabel_configs:
      # Do not put :8087 in instance name, rather here
      - source_labels: [__address__]
@ -106,12 +109,11 @@ scrape_configs:
      - source_labels: [__param_target]
        target_label: __address__
        replacement: '$1:8087'
-{% endif %}

-{% if prometheus_postgresql_targets is defined %}
  - job_name: postgresql
-    static_configs:
-      - targets: {{ prometheus_postgresql_targets | to_json }}
+    file_sd_configs:
+      - files:
+        - '/etc/prometheus/targets_postgres.json'
    relabel_configs:
      # Do not put :9187 in instance name, rather here
      - source_labels: [__address__]
@ -121,12 +123,11 @@ scrape_configs:
      - source_labels: [__param_target]
        target_label: __address__
        replacement: '$1:9187'
-{% endif %}

-{% if prometheus_apc_pdu_snmp_targets is defined %}
  - job_name: apc_pdu_snmp
-    static_configs:
-      - targets: {{ prometheus_apc_pdu_snmp_targets | to_json }}
+    file_sd_configs:
+      - files:
+        - '/etc/prometheus/targets_apc_pdu_snmp.json'
    metrics_path: /snmp
    params:
      module:
@ -138,23 +139,5 @@ scrape_configs:
        target_label: instance
      - target_label: __address__
        replacement: 127.0.0.1:9116
-{% endif %}
-
-{% if prometheus_ilo_snmp_targets is defined %}
-  - job_name: ilo_snmp
-    static_configs:
-      - targets: {{ prometheus_ilo_snmp_targets | to_json }}
-    metrics_path: /snmp
-    params:
-      module:
-      - ilo
-    relabel_configs:
-      - source_labels: [__address__]
-        target_label: __param_target
-      - source_labels: [__param_target]
-        target_label: instance
-      - target_label: __address__
-        replacement: 127.0.0.1:9116
-{% endif %}

 ...
--- a/roles/prometheus/templates/server.rules.yml.j2
+++ b/roles/prometheus/templates/server.rules.yml.j2
@ -10,20 +10,23 @@ groups:
  - name: server.rules
    rules:

-      - alert: MachineDown
+      - alert: InstanceDown
        expr: up{instance!~".*.borne.auro.re$"} == 0
        for: 3m
        labels:
          severity: critical
        annotations:
          summary: >-
-            Le collecteur {{ raw('$labels.job') }} ne marche plus
+            Invisible depuis plus de 3 minutes

      - alert: AccessPointDown
        expr: up{instance=~".*.borne.auro.re$"} == 0
        for: 3m
        labels:
          severity: warning
+        annotations:
+          summary: >-
+            Invisible depuis plus de 3 minutes

      - alert: OutOfMemory
        expr: >-
@ -47,7 +50,7 @@ groups:
              node_memory_SwapFree_bytes
              / node_memory_SwapTotal_bytes
            )
-          ) * 100 >= 50
+          ) * 100 >= 20
        for: 3m
        labels:
          severity: warning
--- a/roles/prometheus/templates/snmp.yml.j2
+++ b/roles/prometheus/templates/snmp.yml.j2
@ -482,227 +482,4 @@ apc_pdu:
    priv_protocol: AES
    priv_password: {{ snmp_pdu_password }}

-ilo:
-  walk:
-  - 1.3.6.1.4.1.232.6.2.14.4 # Resilient memory
-  - 1.3.6.1.4.1.232.6.2.15.3 # Power meter
-  - 1.3.6.1.4.1.232.6.2.16.1 # POST tests
-  - 1.3.6.1.4.1.232.6.2.17.1 # Battery
-  - 1.3.6.1.4.1.232.6.2.6.8.1.3 # Temperature sensors location
-  - 1.3.6.1.4.1.232.6.2.6.8.1.4 # Temperature sensors value
-  - 1.3.6.1.4.1.232.6.2.6.8.1.5 # Temperature sensors limit
-  - 1.3.6.1.4.1.232.6.2.6.8.1.6 # Temperature sensors condition
-  - 1.3.6.1.4.1.232.6.2.6.7.1.3 # Fans location
-  - 1.3.6.1.4.1.232.6.2.6.7.1.9 # Fans condition
-  - 1.3.6.1.4.1.232.6.2.9.3.1.5 # Power supply
-  - 1.3.6.1.4.1.232.9.2.2 # iLO
-  metrics:
-  - name: cpqHeResilientMemCondition
-    oid: 1.3.6.1.4.1.232.6.2.14.4
-    type: EnumAsStateSet
-    help: The resilient memory condition - 1.3.6.1.4.1.232.6.2.14.4
-    enum_values:
-      1: other
-      2: ok
-      3: degraded
-      4: failed
-  - name: cpqHePowerMeterCurrReading
-    oid: 1.3.6.1.4.1.232.6.2.15.3
-    type: gauge
-    help: This is the current Power Meter reading in Watts - 1.3.6.1.4.1.232.6.2.15.3
-  - name: cpqHeHWBiosCondition
-    oid: 1.3.6.1.4.1.232.6.2.16.1
-    type: EnumAsStateSet
-    help: This value indicates an error has been detected during Pre-OS Test (POST)
-      or during initial hardware initialization - 1.3.6.1.4.1.232.6.2.16.1
-    enum_values:
-      1: other
-      2: ok
-      3: degraded
-      4: failed
-  - name: cpqHeSysBatteryCondition
-    oid: 1.3.6.1.4.1.232.6.2.17.1
-    type: EnumAsStateSet
-    help: The battery condition - 1.3.6.1.4.1.232.6.2.17.1
-    indexes:
-    - labelname: cpqHeSysBatteryChassis
-      type: gauge
-    - labelname: cpqHeSysBatteryIndex
-      type: gauge
-    enum_values:
-      1: other
-      2: ok
-      3: degraded
-      4: failed
-  - name: cpqHeTemperatureLocale
-    oid: 1.3.6.1.4.1.232.6.2.6.8.1.3
-    type: EnumAsInfo
-    help: This specifies the location of the temperature sensor present in the system.
-      - 1.3.6.1.4.1.232.6.2.6.8.1.3
-    indexes:
-    - labelname: cpqHeTemperatureChassis
-      type: gauge
-    - labelname: cpqHeTemperatureIndex
-      type: gauge
-    enum_values:
-      1: other
-      2: unknown
-      3: system
-      4: systemBoard
-      5: ioBoard
-      6: cpu
-      7: memory
-      8: storage
-      9: removableMedia
-      10: powerSupply
-      11: ambient
-      12: chassis
-      13: bridgeCard
-  - name: cpqHeTemperatureCelsius
-    oid: 1.3.6.1.4.1.232.6.2.6.8.1.4
-    type: gauge
-    help: This is the current temperature sensor reading in degrees celsius - 1.3.6.1.4.1.232.6.2.6.8.1.4
-    indexes:
-    - labelname: cpqHeTemperatureChassis
-      type: gauge
-    - labelname: cpqHeTemperatureIndex
-      type: gauge
-  - name: cpqHeTemperatureThreshold
-    oid: 1.3.6.1.4.1.232.6.2.6.8.1.5
-    type: gauge
-    help: This is the shutdown threshold temperature sensor setting in degrees celsius
-      - 1.3.6.1.4.1.232.6.2.6.8.1.5
-    indexes:
-    - labelname: cpqHeTemperatureChassis
-      type: gauge
-    - labelname: cpqHeTemperatureIndex
-      type: gauge
-  - name: cpqHeTemperatureCondition
-    oid: 1.3.6.1.4.1.232.6.2.6.8.1.6
-    type: EnumAsStateSet
-    help: The Temperature sensor condition - 1.3.6.1.4.1.232.6.2.6.8.1.6
-    indexes:
-    - labelname: cpqHeTemperatureChassis
-      type: gauge
-    - labelname: cpqHeTemperatureIndex
-      type: gauge
-    enum_values:
-      1: other
-      2: ok
-      3: degraded
-      4: failed
-  - name: cpqHeFltTolFanLocale
-    oid: 1.3.6.1.4.1.232.6.2.6.7.1.3
-    type: EnumAsInfo
-    help: This specifies the location of the fan present in the system.
-      - 1.3.6.1.4.1.232.6.2.6.7.1.3
-    indexes:
-    - labelname: cpqHeFltTolFanChassis
-      type: gauge
-    - labelname: cpqHeFltTolFanIndex
-      type: gauge
-    enum_values:
-      1: other
-      2: unknown
-      3: system
-      4: systemBoard
-      5: ioBoard
-      6: cpu
-      7: memory
-      8: storage
-      9: removableMedia
-      10: powerSupply
-      11: ambient
-      12: chassis
-      13: bridgeCard
-  - name: cpqHeFltTolFanCondition
-    oid: 1.3.6.1.4.1.232.6.2.6.7.1.9
-    type: EnumAsStateSet
-    help: The fan condition - 1.3.6.1.4.1.232.6.2.6.7.1.9
-    indexes:
-    - labelname: cpqHeFltTolFanChassis
-      type: gauge
-    - labelname: cpqHeFltTolFanIndex
-      type: gauge
-    enum_values:
-      1: other
-      2: ok
-      3: degraded
-      4: failed
-  - name: cpqHeFltTolPowerSupplyStatus
-    oid: 1.3.6.1.4.1.232.6.2.9.3.1.5
-    type: EnumAsStateSet
-    help: The status of the power supply. - 1.3.6.1.4.1.232.6.2.9.3.1.5
-    indexes:
-    - labelname: cpqHeFltTolPowerSupplyChassis
-      type: gauge
-    - labelname: cpqHeFltTolPowerSupplyBay
-      type: gauge
-    enum_values:
-      1: noError
-      2: generalFailure
-      3: bistFailure
-      4: fanFailure
-      5: tempFailure
-      6: interlockOpen
-      7: epromFailed
-      8: vrefFailed
-      9: dacFailed
-      10: ramTestFailed
-      11: voltageChannelFailed
-      12: orringdiodeFailed
-      13: brownOut
-      14: giveupOnStartup
-      15: nvramInvalid
-      16: calibrationTableInvalid
-      17: noPowerInput
-  - name: cpqSm2CntlrInterfaceStatus
-    oid: 1.3.6.1.4.1.232.9.2.2.17
-    type: EnumAsStateSet
-    help: Remote Insight/ Integrated Lights-Out Interface Status - 1.3.6.1.4.1.232.9.2.2.17
-    enum_values:
-      1: other
-      2: ok
-      3: notResponding
-  - name: cpqSm2CntlriLOSecurityOverrideSwitchState
-    oid: 1.3.6.1.4.1.232.9.2.2.27
-    type: EnumAsStateSet
-    help: Integrated Lights-Out Security Override Switch State - 1.3.6.1.4.1.232.9.2.2.27
-    enum_values:
-      1: notSupported
-      2: set
-      3: notSet
-  - name: cpqSm2CntlrLicenseActive
-    oid: 1.3.6.1.4.1.232.9.2.2.30
-    type: EnumAsStateSet
-    help: Remote Insight License State - 1.3.6.1.4.1.232.9.2.2.30
-    enum_values:
-      1: none
-      2: iloAdvanced
-      3: iloLight
-      4: iloAdvancedBlade
-      5: iloStandard
-      6: iloEssentials
-      7: iloScaleOut
-      8: iloAdvancedPremiumSecurity
-  - name: cpqSm2CntlrServerPowerState
-    oid: 1.3.6.1.4.1.232.9.2.2.32
-    type: EnumAsStateSet
-    help: The current power state for the server - 1.3.6.1.4.1.232.9.2.2.32
-    enum_values:
-      1: unknown
-      2: poweredOff
-      3: poweredOn
-      4: insufficientPowerOrPowerOnDenied
-  version: 3
-  # Reduce timeout to retry faster
-  timeout: 1s
-  auth:
-    security_level: authPriv
-    username: {{ snmp_ilo_user }}
-    password: {{ snmp_ilo_auth }}
-    auth_protocol: SHA
-    priv_protocol: AES
-    priv_password: {{ snmp_ilo_priv }}
-
 ...
--- a/roles/prometheus_federate/templates/prometheus.yml.j2
+++ b/roles/prometheus_federate/templates/prometheus.yml.j2
@ -34,9 +34,9 @@ scrape_configs:
        - '{job="postgresql"}'
        - '{job="prometheus"}'
        - '{job="unifi_snmp"}'
+        - '{job="django"}'
        - '{job="ups_snmp"}'
        - '{job="apc_pdu_snmp"}'
        - '{job="docker"}'
        - '{job="switch_snmp"}'
-        - '{job="ilo_snmp"}'
 ...
--- a/roles/qemu_guest_agent/tasks/main.yml
+++ b/roles/qemu_guest_agent/tasks/main.yml
@ -0,0 +1,5 @@
+---
+- name: Install qemu-guest-agent
+  apt:
+    name: qemu-guest-agent
+...
--- a/roles/resolvconf/tasks/main.yml
+++ b/roles/resolvconf/tasks/main.yml
@ -1,9 +0,0 @@
---
- name: Install resolv.conf
-  template:
-    src: resolv.conf.j2
-    dest: /etc/resolv.conf
-    owner: root
-    group: root
-    mode: u=rw,g=r,o=r
-...
--- a/roles/resolvconf/templates/resolv.conf.j2
+++ b/roles/resolvconf/templates/resolv.conf.j2
@ -1,11 +0,0 @@
-{{ ansible_managed | comment }}
-
-{% for nameserver in resolvconf__nameservers %}
-nameserver {{ nameserver | ipaddr }}
-{% endfor %}
-{% if resolvconf__domain is defined %}
-domain {{ resolvconf__domain }}
-{% endif %}
-{% if resolvconf__search is defined %}
-search {{ resolvconf__search | join(" ") }}
-{% endif %}
--- a/roles/root_account/tasks/main.yml
+++ b/roles/root_account/tasks/main.yml
@ -1,15 +0,0 @@
---
- name: Set root password
-  user:
-    name: root
-    shell: "{{ root_shell }}"
-    password: "{{ root_password }}"
-
- name: Setup bashrc for root
-  template:
-    src: bashrc.j2
-    dest: /root/.bashrc
-    owner: root
-    group: root
-    mode: u=r,g=,o=
-...
--- a/roles/root_account/templates/bashrc.j2
+++ b/roles/root_account/templates/bashrc.j2
@ -1,9 +0,0 @@
-{{ ansible_managed | comment }}
-
-PS1='\[\e[1;31m\]$(hostname -f)\[\e[0m\] \w \[\e[1;36m\]\$\[\e[0m\] '
-
-export LS_OPTIONS='--color=auto'
-eval "$(dircolors)"
-alias ls='ls $LS_OPTIONS'
-alias ll='ls $LS_OPTIONS -l'
-alias l='ls $LS_OPTIONS -lA'
--- a/roles/ulogd2/templates/ulogd.conf.j2
+++ b/roles/ulogd2/templates/ulogd.conf.j2
@ -0,0 +1,17 @@
+{{ ansible_managed | comment }}
+
+[global]
+logfile="syslog"
+loglevel=3
+plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inpflow_NFCT.so"
+plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_IP2STR.so"
+plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_PRINTFLOW.so"
+plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_SYSLOG.so"
+stack=ct:NFCT,ip2str:IP2STR,print:PRINTFLOW,sys:SYSLOG
+
+[ct]
+#reliable=1
+hash_enable=0
+
+[sys]
+facility=LOG_LOCAL2
Author	SHA1	Message	Date
Jeltz	f596071f49	Cleanup apt_common Some checks failed continuous-integration/drone/push Build is failing Details continuous-integration/drone/pr Build is failing Details	2022-02-26 19:24:31 +01:00
Jeltz	2411cb32b0	Add ask_vault_pass in ansible.cfg Some checks failed continuous-integration/drone/push Build is failing Details continuous-integration/drone/pr Build is failing Details	2022-02-26 19:13:02 +01:00
Jeltz	0b28ae5c29	Remove copy-keys.sh	2022-02-26 19:12:30 +01:00
Jeltz	859a84f69c	Fix ssh.yml to handle the case of camelot All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details	2022-02-08 09:38:21 +01:00
Jeltz	373cd1b868	Move parts of debian_common → apt_common All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details Also: disable apt-listchanges	2021-12-13 02:53:00 +01:00
Jeltz	c2657224a6	Create qemu_guest_agent role	2021-12-13 02:19:11 +01:00
Jeltz	7f6c36daaf	Create a separate 'locales' roles (+ en_US)	2021-12-13 02:16:13 +01:00
Jeltz	ccb1f90c79	Uninstall fail2ban	2021-12-13 01:58:53 +01:00
Jeltz	dc7f868ed2	Cleanup some "LDAP for admin auth"-related config	2021-12-13 01:55:56 +01:00