Norman Ziegner
209ba1dabf
* ci: disable injecting facts as own vars in the main namespace Signed-off-by: Norman Ziegner <[email protected]> * Consistently access facts via the ansible_facts.* namespace Signed-off-by: Norman Ziegner <[email protected]> --------- Signed-off-by: Norman Ziegner <[email protected]>
37 lines
1.4 KiB
YAML
37 lines
1.4 KiB
YAML
---
|
|
- name: "Configure hardened options for mount {{ mount.path }}"
|
|
ansible.posix.mount:
|
|
path: "{{ mount.path }}"
|
|
src: "{{ mount.src | default(mountinfo.device, true) }}"
|
|
fstype: "{{ mount.fstype | default(mountinfo.fstype, true) }}"
|
|
opts: "{{ mount.opts }}"
|
|
dump: "{{ mount.dump | default('1' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
|
|
passno: "{{ mount.passno | default('2' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
|
|
state: present
|
|
register: mountpoint
|
|
when:
|
|
- mount.enabled | bool
|
|
- mount.path in mountpoints_list
|
|
vars:
|
|
mountinfo: "{{ ansible_facts.mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
|
|
notify: Remount filesystems
|
|
|
|
- name: "Check for existence of mount {{ mount.path }}"
|
|
ansible.builtin.stat:
|
|
path: "{{ mount.path }}"
|
|
register: mountpoint_exists
|
|
|
|
- name: "Harden permissions for directory of mount {{ mount.path }}"
|
|
ansible.builtin.file:
|
|
dest: "{{ mount.path }}"
|
|
owner: "{{ mount.owner }}"
|
|
group: "{{ mount.group }}"
|
|
mode: "{{ mount.mode }}"
|
|
when:
|
|
- mountpoint_exists.stat.exists | bool
|
|
|
|
- name: "Register changed mountpoints"
|
|
ansible.builtin.set_fact:
|
|
mountpoints_changed: "{{ mountpoints_changed | default([]) + [mount.path] }}"
|
|
when: mountpoint.changed # noqa no-handler
|