jetstream2-admin/configure-manager.yaml at trunk · glotzerlab/jetstream2-admin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
- name: Configure action runner manager.
  hosts: action_runner_managers
  vars:
    miniforge_path: /home/exouser/miniforge3
    home: /home/exouser
    python_version: "3.11"

  tasks:
    - name: Check if miniforge exists
      ansible.builtin.stat:
        path: "{{ miniforge_path }}"
      register: check_path

    - name: Install miniforge
      when: not check_path.stat.exists
      block:
        - name: Download miniforge
          ansible.builtin.get_url:
            url: https://github.com/conda-forge/miniforge/releases/latest/download/Miniforge3-Linux-x86_64.sh
            dest: "{{ home }}"
        - name: Install miniforge
          ansible.builtin.command: "bash {{ home }}/Miniforge3-Linux-x86_64.sh -b -p {{ miniforge_path }}"
        - name: Removing miniforge download
          ansible.builtin.file:
            path: "{{ home }}/Miniforge3-Linux-x86_64.sh"
            state: absent
      rescue:
        - name: Error, removing miniforge directory
          ansible.builtin.file:
            path: "{{ miniforge_path }}"
            state: absent
        - name: Error, removing miniforge file
          ansible.builtin.file:
            path: "{{ home }}/Miniforge3-Linux-x86_64.sh"
            state: absent

    - name: Install the latest python
      ansible.builtin.command: "{{ miniforge_path }}/bin/mamba install python={{ python_version }} -y"

    - name: Install openstack
      ansible.builtin.command: "{{ miniforge_path }}/bin/mamba install openstacksdk -y"

    - name: Clone jetstream2-admin
      ansible.builtin.git:
        repo: "https://github.com/glotzerlab/jetstream2-admin.git"
        dest: "{{ home }}/jetstream2-admin"
        version: trunk

    - name: Configure shelve action runners job
      ansible.builtin.cron:
        name: shelve-action-runners
        minute: "10"
        hour: "*"
        job: '/usr/bin/bash -c "date && source {{ home }}/openrc-credentials.sh && {{ miniforge_path }}/bin/python3 {{ home }}/jetstream2-admin/shelve-action-runners.py && echo" 2>&1 >> {{ home }}/shelve-action-runners.log'
        user: exouser

    - name: Configure start action runners job
      ansible.builtin.cron:
        name: start-action-runners
        minute: "0"
        hour: "1"
        weekday: "1"
        job: '/usr/bin/bash -c "date && source {{ home }}/openrc-credentials.sh && {{ miniforge_path }}/bin/python3 {{ home }}/jetstream2-admin/start/start-action-runners.py && echo" 2>&1 >> {{ home }}/start-action-runners.log'
        user: exouser

    - name: Prevent Copy.Fail exploit
      block:
        - name: Disable algif
          become: yes
          ansible.builtin.copy:
            src: disable-algif.conf
            dest: /etc/modprobe.d/disable-algif.conf
            owner: root
            mode: '0644'

    - name: Prevent Dirty Frag exploit
      block:
        - name: Disable dirty frag modules
          become: yes
          ansible.builtin.copy:
            src: dirtyfrag.conf
            dest: /etc/modprobe.d/dirtyfrag.conf
            owner: root
            mode: '0644'