rhel_8_init.yml

# Usage:
# 1) Copy the accompanying ansible.cfg as ~/.ansible.cfg
# 2) Install Ansible
# 3) Adjust and run the playbook
# 4) Set password for the new user and reboot
---
- name: Initialize RHEL 8
  hosts: all
  become: true
  gather_facts: true
  vars:
    console_keymap: fi
    console_font: eurlatgr
    langpacks: ['en', 'fi']
    system_locale: en_US.UTF-8
    system_timezone: Europe/Helsinki
    root_shell: /bin/zsh
    create_user: false
    user_uid: 1000
    user_name: mm
    user_group: users
    user_shell: /bin/zsh
    workstation: false
    enable_sshd: true
    disable_network_services: true
    use_epel: false
    use_powertools: false
  tasks:
    - name: Check target basics
      check_mode: false
      raw: rpm -q platform-python python3-dnf python3-libselinux
      register: basics
      failed_when: false
      changed_when: false

    - name: Prepare target basics
      raw: dnf -y install platform-python python3-dnf python3-libselinux
      changed_when: true
      when: basics.rc != 0

    - name: Create target remote_tmp
      file:
        path: "{{ ansible_facts.env.HOME }}/.ansible/tmp"
        state: directory
        mode: '0700'

    - name: Detect boot parameters
      check_mode: false
      command: grep -q TIMEOUT=5 /etc/default/grub
      register: adjust_boot_parameters
      failed_when: false
      changed_when: false

    - name: Install grubby
      dnf:
        name: grubby
        state: present
      when: adjust_boot_parameters.rc == 0

    - name: Adjust boot timeout
      replace:
        dest: /etc/default/grub
        regexp: '^GRUB_TIMEOUT=.*'
        replace: 'GRUB_TIMEOUT=1'
      when: adjust_boot_parameters.rc == 0

    - name: Adjust boot parameters
      command: grubby --remove-args="rhgb LANG" --args="quiet" --update-kernel=ALL
      changed_when: true
      when: adjust_boot_parameters.rc == 0

    - name: Detect rescue images
      find:
        paths:
          - /boot
          - /boot/loader/entries
        patterns:
          - '*rescue*'
      register: rescue_images

    - name: Remove rescue images
      file:
        path: "{{ item }}"
        state: absent
      loop: "{{ rescue_images.files | map(attribute='path') }}"

    - name: Check GRUB configuration path
      stat:
        path: /boot/efi/EFI/{{ ansible_facts.distribution | lower }}/grub.cfg
      register: efi_grub
      failed_when: false
      changed_when: false

    - name: Update GRUB configuration
      vars:
        boot_config: "{{ '/boot/efi/EFI/{{ ansible_facts.distribution | lower }}/grub.cfg' if efi_grub.stat.exists else '/boot/grub2/grub.cfg' }}"
      command: grub2-mkconfig -o {{ boot_config }}
      changed_when: true
      when: adjust_boot_parameters.rc == 0

    - name: Detect LUKS configuration
      check_mode: false
      command: grep -q mapper/luks /etc/fstab
      register: luks_in_use
      failed_when: false
      changed_when: false

    - name: Configure console
      copy:
        content: |
          KEYMAP="{{ console_keymap }}"
          FONT="{{ console_font }}"
        dest: /etc/vconsole.conf
        mode: '0644'

    - name: Configure locale
      copy:
        content: |
          LANG="{{ system_locale }}"
        dest: /etc/locale.conf
        mode: '0644'

    - name: Set timezone
      community.general.timezone:
        name: "{{ system_timezone }}"

    - name: Check EPEL repository
      # noqa: command-instead-of-module
      command: rpm -q epel-release-{{ ansible_facts.distribution_major_version }}
      register: epel_enabled
      failed_when: false
      changed_when: false
      when: use_epel | bool

    - name: Enable EPEL repository
      dnf:
        name:
          - https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_facts.distribution_major_version }}.noarch.rpm
        state: present
        disable_gpg_check: true
      when: use_epel | bool and epel_enabled.rc != 0

    - name: Check CentOS PowerTools repository
      stat:
        path: /etc/yum.repos.d/CentOS-PowerTools.repo
      register: powertools_repo
      failed_when: false
      changed_when: false
      when: use_powertools | bool

    - name: Get CentOS RPM GPG key
      get_url:
        url: https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official
        dest: /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-Official
        mode: '0644'
      when: use_powertools | bool

    - name: Enable CentOS PowerTools repository
      copy:
        content: |
          [PowerTools]
          name=CentOS-$releasever - PowerTools
          #baseurl=http://mirror.centos.org/$contentdir/$releasever/PowerTools/$basearch/os/
          mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=PowerTools&infra=$infra
          enabled=1
          gpgcheck=1
          gpgkey=/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-Official
        dest: /etc/yum.repos.d/CentOS-PowerTools.repo
        mode: '0644'
      when: use_powertools | bool and not powertools_repo.stat.exists

    - name: Check RPM Fusion repository
      # noqa: command-instead-of-module
      command: >
        rpm -q rpmfusion-free-release-{{ ansible_facts.distribution_major_version }} rpmfusion-nonfree-release-{{ ansible_facts.distribution_major_version }}
      register: fusion_enabled
      failed_when: false
      changed_when: false
      when: workstation | bool and use_epel | bool

    - name: Enable RPM Fusion repository
      dnf:
        name:
          - https://download1.rpmfusion.org/free/el/rpmfusion-free-release-{{ ansible_facts.distribution_major_version }}.noarch.rpm
          - https://download1.rpmfusion.org/nonfree/el/rpmfusion-nonfree-release-{{ ansible_facts.distribution_major_version }}.noarch.rpm
        state: present
        disable_gpg_check: true
      when: workstation | bool and use_epel | bool and fusion_enabled.rc != 0

    - name: Remove unneeded firmware packages
      dnf:
        name:
          - 'a*firmware*'
          - 'i*firmware*'
          - 'lib*firmware*'
          - 'n*firmware'
        state: absent
        cacheonly: true
        disablerepo: '*'
      when: ansible_facts.virtualization_role == "guest"

    - name: Remove all virtual guest packages
      dnf:
        name:
          - 'hyperv*'
          - open-vm-tools
          - qemu-guest-agent
          - spice-vdagent
          - WALinuxAgent
        state: absent
        cacheonly: true
        disablerepo: '*'
      when: ansible_facts.virtualization_role != "guest"

    - name: Remove unhelpful packages on VM
      dnf:
        name:
          - akmods
          - 'dmraid*'
          - 'libvirt*'
          - 'pcsc*'
          - thermald
        state: absent
        cacheonly: true
        disablerepo: '*'
      when: ansible_facts.virtualization_role == "guest"

    - name: Remove unneeded packages on Azure/Hyper-V
      dnf:
        name:
          - open-vm-tools
          - qemu-guest-agent
          - spice-vdagent
        state: absent
        cacheonly: true
        disablerepo: '*'
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type == "VirtualPC"

    - name: Remove unneeded packages on KVM
      dnf:
        name:
          - 'hyperv*'
          - open-vm-tools
          - WALinuxAgent
        state: absent
        cacheonly: true
        disablerepo: '*'
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type == "kvm"

    - name: Remove unneeded packages on VMware
      dnf:
        name:
          - 'hyperv*'
          - qemu-guest-agent
          - spice-vdagent
          - WALinuxAgent
        state: absent
        cacheonly: true
        disablerepo: '*'
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type == "VMware"

    - name: Remove unneeded packages on other VMs
      dnf:
        name:
          - 'hyperv*'
          - open-vm-tools
          - qemu-guest-agent
          - spice-vdagent
          - WALinuxAgent
        state: absent
        cacheonly: true
        disablerepo: '*'
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type not in ['kvm', 'VirtualPC', 'VMware']

    - name: Remove unneeded Plymouth packages
      dnf:
        name:
          - 'plymouth*'
        state: absent
        cacheonly: true
        disablerepo: '*'
      when: not luks_in_use.rc == 0

    - name: Remove unhelpful packages
      dnf:
        name:
          - NetworkManager-adsl
          - NetworkManager-openconnect
          - NetworkManager-openvpn
          - NetworkManager-pptp
          - NetworkManager-team
          - NetworkManager-tui
          - NetworkManager-vpnc
          - NetworkManager-wwan
          - 'PackageKit*'
          - 'abrt*'
          - anaconda
          - 'b43*'
          - dracut-config-rescue
          - dracut-live
          - evolution
          - 'foomatic*'
          - gnome-getting-started-docs
          - gnome-online-miners
          - gnome-user-docs
          - 'gutenprint*'
          - '*hangul*'
          - hplip
          - 'java*'
          - kernel-modules-extra
          - '*kkc*'
          - '*libreoffice*'
          - orca
          - ostree
          - pam_krb5
          #- 'perl*'
          - perl-Mozilla-CA
          - '*pinyin*'
          - realmd
          - teamd
          - trousers
          - '*zhuyin*'
        state: absent
        autoremove: true
        cacheonly: true
        disablerepo: '*'

    - name: Install helpful packages (common)
      dnf:
        name:
          - bash-completion
          - bc
          - bind-utils
          - ethtool
          - git-core
          - glibc-minimal-langpack
          - gpm
          - iotop
          - irqbalance
          - ltrace
          - man-pages
          - mlocate
          - nano
          - nmap-ncat
          - numactl
          - openssh-clients
          - pcp-doc
          - pcp-system-tools
          #- perf
          - policycoreutils-python-utils
          - psmisc
          - setools-console
          - strace
          - tar
          - tcpdump
          - telnet
          - tmux
          - tuned
          - unzip
          - util-linux-user
          - yum-utils
          - zsh
        state: present

    - name: Install helpful packages (guest agent)
      vars:
        agent_packages:
          kvm: qemu-guest-agent
          VirtualPC:
            - hyperv-daemons
            - WALinuxAgent
          VMware: open-vm-tools
      dnf:
        name: "{{ agent_packages[ansible_facts.virtualization_type] }}"
        state: present
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type in agent_packages

    - name: Enable virtual guest agent service
      vars:
        agent_services:
          kvm: qemu-guest-agent.service
          VirtualPC: waagent.service
          VMware: vmtoolsd.service
      service:
        name: "{{ agent_services[ansible_facts.virtualization_type] }}"
        state: started
        enabled: true
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type in agent_services
        - ansible_facts.virtualization_type in ['kvm', 'VirtualPC', 'VMware']

    - name: Install helpful packages (langpacks)
      dnf:
        name: glibc-langpack-{{ langpacks | join(',glibc-langpack-') }}
        state: present

    - name: Install helpful packages (common from EPEL)
      dnf:
        name:
          - epel-release
          - keychain
          - xclip
        state: present
      when: use_epel | bool

    - name: Install helpful packages (workstation)
      dnf:
        name:
          - dconf-editor
          - gnome-tweaks
          - gstreamer1-plugins-good-gtk
          - patch
          - powertop
          - seahorse
          - totem
          - totem-nautilus
          - wodim
          - xauth
          - xorg-x11-fonts-misc
        state: present
      when: workstation | bool

    - name: Install helpful packages (workstation langpacks)
      dnf:
        name: langpacks-{{ langpacks | join(',langpacks-') }}
        state: present
      when: workstation | bool

    - name: Install helpful packages (workstation from EPEL)
      dnf:
        name:
          - GraphicsMagick
          - ffmpeg
          - fuse-sshfs
          - gstreamer1-libav
          - ntfsprogs
          - vlc
          - x264
          - youtube-dl
        state: present
      when: workstation | bool and use_epel | bool

    - name: Remove unhelpful packages ('all' langpacks)
      dnf:
        name:
          - gawk-all-langpacks
          - glibc-all-langpacks
        state: absent
        cacheonly: true
        disablerepo: '*'

    - name: Update all packages
      # noqa: package-latest
      dnf:
        name: '*'
        state: latest
        update_cache: true

    - name: Check current boot parameters
      check_mode: false
      shell: set -o pipefail ; cat /proc/cmdline | grep -q rhgb
      register: rhgb_used
      failed_when: false
      changed_when: false

    - name: Ensure correct boot parameters
      command: grubby --remove-args="rhgb LANG" --args="quiet" --update-kernel=ALL
      changed_when: true
      when: rhgb_used.rc == 0

    - name: Disable unhelpful services
      service:
        name: "{{ item }}"
        enabled: false
      loop:
        - cups.service
        - dmraid-activation.service
        - dnf-makecache.timer
        - lvm2-monitor.service
        - mcelog.service
        - mdmonitor.service
        - multipathd.service
      failed_when: false

    - name: Disable unhelpful services on VMs
      service:
        name: "{{ item }}"
        enabled: false
      loop:
        - raid-check.timer
        - switcheroo-control
        - upower.service
      failed_when: false
      when: ansible_facts.virtualization_role == "guest"

    - name: Disable unhelpful network services
      service:
        name: "{{ item }}"
        enabled: false
      loop:
        - bluetooth.service
        - iscsi.service
        - iscsid.socket
        - iscsiuio.socket
        - nfs-client.target
        - nfs-convert.service
        - remote-fs.target
      failed_when: false
      when: disable_network_services | bool

    - name: Enable helpful services
      service:
        name: "{{ item }}"
        enabled: true
      loop:
        - gpm.service
        - irqbalance.service
        - pmcd.service
        - pmlogger.service
        - tuned.service

    - name: Install SSH daemon
      dnf:
        name: openssh-server
        state: present
      when: enable_sshd | bool

    - name: Configure SSH daemon
      replace:
        dest: /etc/ssh/sshd_config
        regexp: '^#MaxAuthTries 6'
        replace: 'MaxAuthTries 10'
      register: sshd_config
      when: enable_sshd | bool

    - name: Enable SSH daemon
      service:
        name: sshd
        state: "{{ 'restarted' if sshd_config is changed else 'started' }}"
        enabled: true
      when: enable_sshd | bool

    - name: Change root shell
      user:
        name: root
        shell: "{{ root_shell }}"

    - name: Disable pulseaudio for root, part I
      file:
        path: /root/.config/systemd/user
        state: directory
        mode: '0755'

    - name: Disable pulseaudio for root, part II
      file:
        state: link
        src: /dev/null
        dest: /root/.config/systemd/user/{{ item }}
      loop:
        - pulseaudio.service
        - pulseaudio.socket

    - name: Create user
      user:
        name: "{{ user_name }}"
        uid: "{{ user_uid }}"
        group: "{{ user_group }}"
        shell: "{{ user_shell }}"
      when: create_user | bool

    - name: Disable tracker for the user, part I
      file:
        path: /home/{{ user_name }}/.config/systemd/user
        state: directory
        owner: "{{ user_name }}"
        group: "{{ user_group }}"
        mode: '0755'
      when: create_user | bool

    - name: Disable tracker for the user, part II
      file:
        state: link
        src: /dev/null
        dest: /home/{{ user_name }}/.config/systemd/user/{{ item }}
        owner: "{{ user_name }}"
        group: "{{ user_group }}"
      loop:
        - tracker-extract.service
        - tracker-miner-apps.service
        - tracker-miner-fs.service
        - tracker-miner-rss.service
        - tracker-store.service
        - tracker-writeback.service
      when: create_user | bool

    - name: Disable tracker for the user, part III
      command: restorecon -Rv "/home/{{ user_name }}/.config/systemd"
      register: restorecon
      changed_when: "'Relabeled' in restorecon.stdout"
      when: create_user | bool

    - name: Configure sudoers
      lineinfile:
        path: /etc/sudoers.d/{{ user_name }}
        line: '{{ user_name }} ALL=(ALL) NOPASSWD: ALL'
        create: true
        mode: '0440'
        validate: /usr/sbin/visudo -csf %s
      when: create_user | bool

    - name: Clean up, part I
      file:
        path: "{{ item }}"
        state: absent
      loop:
        - /1
        - /root/.config/pulse
        - /root/.esd_auth
        - /root/.lesshst
        - /root/.local/share/ibus-typing-booster
        - /root/.rnd
        - /root/.wget-hsts
        - /root/anaconda-ks.cfg
        - /root/original-ks.cfg
        - /root/rhel-{{ ansible_facts.distribution_major_version }}-init.retry
        - /var/cache/PackageKit
        - /var/lib/abrt
        - /var/spool/abrt
        - /var/tmp/abrt

    - name: Clean up, part II
      find:
        paths:
          - /tmp
        patterns:
          - 'ks-script*'
      register: tmp_files

    - name: Clean up, part III
      file:
        path: "{{ item }}"
        state: absent
      loop: "{{ tmp_files.files | map(attribute='path') }}"