forked from infra/ansible
112 lines
2.5 KiB
YAML
112 lines
2.5 KiB
YAML
---
|
|
- name: Check the selinux context of the git repo directory
|
|
ansible.builtin.command: matchpathcon /srv/git
|
|
register: distgitcontext
|
|
check_mode: no
|
|
changed_when: false
|
|
tags:
|
|
- config
|
|
- pagure
|
|
- selinux
|
|
|
|
- name: Show the output of distgitcontext
|
|
ansible.builtin.debug:
|
|
var: distgitcontext.stdout
|
|
tags:
|
|
- selinux
|
|
|
|
- name: Show if we find gitosis_var_lib_t in distgitcontext
|
|
ansible.builtin.debug:
|
|
var: distgitcontext.stdout.find('gitosis_var_lib_t')
|
|
tags:
|
|
- selinux
|
|
|
|
- name: Set the SELinux policy for the distgit root directory
|
|
ansible.builtin.command: semanage fcontext -a -t gitosis_var_lib_t "/srv/git(/.*)?"
|
|
when: distgitcontext.stdout.find('gitosis_var_lib_t') == -1
|
|
changed_when: false
|
|
tags:
|
|
- config
|
|
- pagure
|
|
- selinux
|
|
|
|
- name: Check the selinux context of the releases directory
|
|
ansible.builtin.command: matchpathcon /var/www/releases
|
|
register: distgitcontext
|
|
check_mode: no
|
|
changed_when: false
|
|
tags:
|
|
- config
|
|
- pagure
|
|
- selinux
|
|
|
|
# Note: On Fedora its httpd_sys_content_rw_t - Don't we love confusions?
|
|
- name: Set the SELinux policy for the releases directory
|
|
ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/releases(/.*)?"
|
|
when: distgitcontext.stdout.find('httpd_sys_rw_content_t') == -1
|
|
changed_when: false
|
|
tags:
|
|
- config
|
|
- pagure
|
|
- selinux
|
|
|
|
- name: Install the pagure SELinux policy
|
|
ansible.builtin.include_role:
|
|
name: selinux/module
|
|
vars:
|
|
policy_file: files/selinux/pagure.te
|
|
policy_name: pagure
|
|
tags:
|
|
- selinux
|
|
- config
|
|
- pagure
|
|
|
|
- name: Set sebooleans so pagure can talk to the network (db + redis)
|
|
ansible.posix.seboolean:
|
|
name: httpd_can_network_connect
|
|
state: true
|
|
persistent: true
|
|
tags:
|
|
- config
|
|
- selinux
|
|
- pagure
|
|
|
|
- name: Set sebooleans so apache can send emails
|
|
ansible.posix.seboolean:
|
|
name: httpd_can_sendmail
|
|
state: true
|
|
persistent: true
|
|
tags:
|
|
- config
|
|
- selinux
|
|
- pagure
|
|
|
|
- name: Set sebooleans so pygit2 can read the git repos
|
|
ansible.posix.seboolean:
|
|
name: httpd_execmem
|
|
state: true
|
|
persistent: true
|
|
tags:
|
|
- config
|
|
- selinux
|
|
- pagure
|
|
|
|
- name: Set sebooleans so ssh can retrieve access info from apache
|
|
ansible.posix.seboolean:
|
|
name: nis_enabled
|
|
state: true
|
|
persistent: true
|
|
tags:
|
|
- config
|
|
- selinux
|
|
- pagure
|
|
|
|
- name: Set sebooleans to deny nagios/nrpe to call sudo as it's gone
|
|
ansible.posix.seboolean:
|
|
name: nagios_run_sudo
|
|
state: false
|
|
persistent: true
|
|
tags:
|
|
- config
|
|
- selinux
|
|
- pagure
|