<commit_before>---
- name: Ensure user's meza-ansible and alt-meza-ansible in group "wheel"
  user:
    name: "{{ item }}"
    # primary group
    group: wheel
    move_home: yes
    home: "{{ m_home }}/{{ item }}"
  with_items:
  - meza-ansible
  - alt-meza-ansible

- name: Ensure user alt-meza-ansible .ssh dir configured
  file:
    path: "{{ m_home }}/alt-meza-ansible/.ssh"
    owner: alt-meza-ansible
    group: wheel
    mode: 0700
    state: directory

- name: Copy meza-ansible authorized_keys to alt-meza-ansible
  shell: cp {{ m_home }}/meza-ansible/.ssh/authorized_keys {{ m_home }}/alt-meza-ansible/.ssh/authorized_keys

- name: Ensure user meza-ansible and alt-meza-ansible authorized_keys configured
  file:
    path: "{{ m_home }}/{{ item }}/.ssh/authorized_keys"
    owner: "{{ item }}"
    group: wheel
    mode: 0644
  with_items:
  - meza-ansible
  - alt-meza-ansible

- name: Set authorized key for alt-meza-ansible
  authorized_key:
    user: alt-meza-ansible
    state: present
    key: "{{ lookup('file', '{{ m_home }}/meza-ansible/.ssh/id_rsa.pub') }}"

- name: Ensure no password on alt-meza-ansible user
  shell: passwd --delete alt-meza-ansible
  ignore_errors: yes

- name: Ensure /etc/sudoers.d/meza-ansible in place
  template:
    src: "sudoers_meza-ansible.j2"
    dest: "{{ m_meza_sudeoers_file }}"
    owner: root
    group: root
    mode: "0644"

- name: "Ensure deltarpm is installed and latest (RedHat only)"
  yum: name=deltarpm state=latest
  when: ansible_os_family == "RedHat"
  tags:
  - latest

- name: Ensure apt cache updated (Debian only)
  apt:
    update_cache: yes
  when: ansible_os_family == "Debian"

- name: Ensure aptitude installed in order to use Ansible 'package' (Debian only)
  apt:
    name: aptitude
    state: installed
    force_apt_get: yes
  when: ansible_os_family == "Debian"

- name: upgrade all packages
  package: name=* state=latest
  environment:
    # If `install_ms_sql_driver: True` is set in config, MS SQL drivers will be
    # installed. When these drivers are updated they require accepting end user
    # license agreements.
    ACCEPT_EULA: 'y'
  tags:
  - latest

# FIXME #807: for RedHat may need to enable "Optional RPMs"
- name: Ensure EPEL installed via epel-release package (CentOS only)
  yum:
    name: epel-release
    state: installed
  when: ansible_distribution == "CentOS"
  tags:
  - latest

- name: Check if EPEL repo is already configured (RedHat only)
  stat:
    path: "/etc/yum.repos.d/epel.repo"
  register: epel_repofile_result
  when: ansible_distribution == "RedHat"
  tags:
  - latest

- name: Ensure EPEL installed via URL (RedHat only)
  yum:
    name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_distribution_major_version }}.noarch.rpm"
    state: present
  register: result
  until: '"failed" not in result'
  retries: 5
  delay: 10
  when: ansible_distribution == "RedHat" and not epel_repofile_result.stat.exists
  tags:
  - latest

- name: Import EPEL GPG key (RedHat only)
  rpm_key:
    key: "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-{{ ansible_distribution_major_version }}"
    state: present
  when: ansible_distribution == "RedHat" and not epel_repofile_result.stat.exists
  ignore_errors: "{{ ansible_check_mode }}"
  tags:
  - latest

- name: Ensure optional repos enabled (RedHat Only)
  shell: subscription-manager repos --enable rhel-7-server-optional-rpms
  when: ansible_distribution == "RedHat"
  tags:
  - latest

- name: ensure libselinux-python installed prior to SELinux (RedHat/CentOS only)
  yum: name=libselinux-python state=installed
  when: ansible_os_family == "RedHat"
  tags:
  - latest

- name: Ensure base packages installed
  package: name={{item}} state=installed
  with_items:
    - ntp
    - ntpdate
    - ntp-doc
    - openssh-server
    - "{{ package_openssh_client }}"
    - vim
    - git
    - net-tools
    - "{{ package_firewall }}"
    - rsyslog
    - jq
    - tree
    - "{{ package_cron }}"
    - rsync
  tags:
  - latest

- name: Ensure selinux-policy installed (RedHat/CentOS only)
  yum:
    name: selinux-policy
    state: latest
  when: ansible_os_family == "RedHat"
  tags:
  - latest

- name: put SELinux in permissive mode (RedHat/CentOS only)
  selinux:
    policy: targeted
    state: permissive # log actions that would be blocked if state=enforcing
  when: ansible_os_family == "RedHat"

- name: Ensure firewalld is running and enable it at boot (RedHat/CentOS only)
  service:
    name: firewalld
    state: started
    enabled: yes
  when:
    - docker_skip_tasks is not defined or not docker_skip_tasks
    - ansible_os_family == "RedHat"

- name: Ensure UFW is enabled and denying access by default (Debian only)
  ufw:
    state: enabled
    policy: deny
  when:
    - docker_skip_tasks is not defined or not docker_skip_tasks
    - ansible_os_family == "Debian"


#
# SSH config
#
- name: Ensure sshd is running and enabled
  service:
    name: sshd
    state: started
    enabled: yes
  when: docker_skip_tasks is not defined or not docker_skip_tasks

- name: Ensure SSH client and SSH Daemon configs in place
  template:
    src: "ssh_config.j2"
    dest: "/etc/ssh/ssh_config"
    owner: root
    group: root
    mode: "0644"<commit_msg>Don't block SSH on Debian<commit_after>---
- name: Ensure user's meza-ansible and alt-meza-ansible in group "wheel"
  user:
    name: "{{ item }}"
    # primary group
    group: wheel
    move_home: yes
    home: "{{ m_home }}/{{ item }}"
  with_items:
  - meza-ansible
  - alt-meza-ansible

- name: Ensure user alt-meza-ansible .ssh dir configured
  file:
    path: "{{ m_home }}/alt-meza-ansible/.ssh"
    owner: alt-meza-ansible
    group: wheel
    mode: 0700
    state: directory

- name: Copy meza-ansible authorized_keys to alt-meza-ansible
  shell: cp {{ m_home }}/meza-ansible/.ssh/authorized_keys {{ m_home }}/alt-meza-ansible/.ssh/authorized_keys

- name: Ensure user meza-ansible and alt-meza-ansible authorized_keys configured
  file:
    path: "{{ m_home }}/{{ item }}/.ssh/authorized_keys"
    owner: "{{ item }}"
    group: wheel
    mode: 0644
  with_items:
  - meza-ansible
  - alt-meza-ansible

- name: Set authorized key for alt-meza-ansible
  authorized_key:
    user: alt-meza-ansible
    state: present
    key: "{{ lookup('file', '{{ m_home }}/meza-ansible/.ssh/id_rsa.pub') }}"

- name: Ensure no password on alt-meza-ansible user
  shell: passwd --delete alt-meza-ansible
  ignore_errors: yes

- name: Ensure /etc/sudoers.d/meza-ansible in place
  template:
    src: "sudoers_meza-ansible.j2"
    dest: "{{ m_meza_sudeoers_file }}"
    owner: root
    group: root
    mode: "0644"

- name: "Ensure deltarpm is installed and latest (RedHat only)"
  yum: name=deltarpm state=latest
  when: ansible_os_family == "RedHat"
  tags:
  - latest

- name: Ensure apt cache updated (Debian only)
  apt:
    update_cache: yes
  when: ansible_os_family == "Debian"

- name: Ensure aptitude installed in order to use Ansible 'package' (Debian only)
  apt:
    name: aptitude
    state: installed
    force_apt_get: yes
  when: ansible_os_family == "Debian"

- name: upgrade all packages
  package: name=* state=latest
  environment:
    # If `install_ms_sql_driver: True` is set in config, MS SQL drivers will be
    # installed. When these drivers are updated they require accepting end user
    # license agreements.
    ACCEPT_EULA: 'y'
  tags:
  - latest

# FIXME #807: for RedHat may need to enable "Optional RPMs"
- name: Ensure EPEL installed via epel-release package (CentOS only)
  yum:
    name: epel-release
    state: installed
  when: ansible_distribution == "CentOS"
  tags:
  - latest

- name: Check if EPEL repo is already configured (RedHat only)
  stat:
    path: "/etc/yum.repos.d/epel.repo"
  register: epel_repofile_result
  when: ansible_distribution == "RedHat"
  tags:
  - latest

- name: Ensure EPEL installed via URL (RedHat only)
  yum:
    name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_distribution_major_version }}.noarch.rpm"
    state: present
  register: result
  until: '"failed" not in result'
  retries: 5
  delay: 10
  when: ansible_distribution == "RedHat" and not epel_repofile_result.stat.exists
  tags:
  - latest

- name: Import EPEL GPG key (RedHat only)
  rpm_key:
    key: "/<KEY>KEY-EPEL-{{ ansible_distribution_major_version }}"
    state: present
  when: ansible_distribution == "RedHat" and not epel_repofile_result.stat.exists
  ignore_errors: "{{ ansible_check_mode }}"
  tags:
  - latest

- name: Ensure optional repos enabled (RedHat Only)
  shell: subscription-manager repos --enable rhel-7-server-optional-rpms
  when: ansible_distribution == "RedHat"
  tags:
  - latest

- name: ensure libselinux-python installed prior to SELinux (RedHat/CentOS only)
  yum: name=libselinux-python state=installed
  when: ansible_os_family == "RedHat"
  tags:
  - latest

- name: Ensure base packages installed
  package: name={{item}} state=installed
  with_items:
    - ntp
    - ntpdate
    - ntp-doc
    - openssh-server
    - "{{ package_openssh_client }}"
    - vim
    - git
    - net-tools
    - "{{ package_firewall }}"
    - rsyslog
    - jq
    - tree
    - "{{ package_cron }}"
    - rsync
  tags:
  - latest

- name: Ensure selinux-policy installed (RedHat/CentOS only)
  yum:
    name: selinux-policy
    state: latest
  when: ansible_os_family == "RedHat"
  tags:
  - latest

- name: put SELinux in permissive mode (RedHat/CentOS only)
  selinux:
    policy: targeted
    state: permissive # log actions that would be blocked if state=enforcing
  when: ansible_os_family == "RedHat"

- name: Ensure firewalld is running and enable it at boot (RedHat/CentOS only)
  service:
    name: firewalld
    state: started
    enabled: yes
  when:
    - docker_skip_tasks is not defined or not docker_skip_tasks
    - ansible_os_family == "RedHat"

- name: Ensure UFW is enabled and denying access by default (Debian only)
  ufw:
    state: enabled
    policy: deny
  when:
    - docker_skip_tasks is not defined or not docker_skip_tasks
    - ansible_os_family == "Debian"

# Make sure we don't block SSH right away. Not sure why this isn't required for
# firewalld/centos...must be different defaults.
- ufw:
    rule: allow
    name: OpenSSH
  when:
    - docker_skip_tasks is not defined or not docker_skip_tasks
    - ansible_os_family == "Debian"


#
# SSH config
#
- name: Ensure sshd is running and enabled
  service:
    name: sshd
    state: started
    enabled: yes
  when: docker_skip_tasks is not defined or not docker_skip_tasks

- name: Ensure SSH client and SSH Daemon configs in place
  template:
    src: "ssh_config.j2"
    dest: "/etc/ssh/ssh_config"
    owner: root
    group: root
    mode: "0644"
{'fraction_non_alphanumeric': 0.10523374930154591, 'fraction_numerical': 0.004656360588563979, 'mean_word_length': 3.1575687185443284, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5874677', 'n_tokens_mistral': 3907, 'n_tokens_neox': 3790, 'n_words': 1071}