Mercurial > code > home > repos > infra
annotate system.py @ 146:2065998876e4
add host 'ditto'
| author | drewp@bigasterisk.com |
|---|---|
| date | Sat, 11 Mar 2023 12:17:56 -0800 |
| parents | ee0384eebee5 |
| children | 522f26c8f691 |
| rev | line source |
|---|---|
| 1 | 1 import os |
|
10
1fec9fe18a4e
more system.py cleanup; add pi /boot/config.txt
drewp@bigasterisk.com
parents:
6
diff
changeset
|
2 |
| 1 | 3 from pyinfra import host |
| 4 from pyinfra.facts.server import LinuxDistribution | |
|
126
fe3ae7c95e65
collect all apt/sources.list into a central template
drewp@bigasterisk.com
parents:
118
diff
changeset
|
5 from pyinfra.facts.files import FindFiles |
|
130
168bc1c44e6f
stop telling arm machines to get i386 pkgs
drewp@bigasterisk.com
parents:
126
diff
changeset
|
6 from pyinfra.facts.server import Arch |
|
12
15c5ce7c74b5
refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents:
10
diff
changeset
|
7 from pyinfra.operations import apt, files, server, systemd |
| 1 | 8 |
|
3
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
9 is_pi = host.get_fact(LinuxDistribution)['name'] in ['Debian', 'Raspbian GNU/Linux'] |
| 1 | 10 |
| 11 TZ = 'America/Los_Angeles' | |
| 12 | |
|
12
15c5ce7c74b5
refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents:
10
diff
changeset
|
13 |
| 91 | 14 def timezone(): |
| 15 files.link(path='/etc/localtime', target=f'/usr/share/zoneinfo/{TZ}') | |
| 16 files.replace(path='/etc/timezone', text='.*', replace=TZ) | |
| 138 | 17 |
| 18 def pkg_keys(): | |
| 19 # apt.key(keyserver='keyserver.ubuntu.com', keyid='04EE7237B7D453EC') | |
| 20 # apt.key(keyserver='keyserver.ubuntu.com', keyid='648ACFD622F3D138') | |
| 21 # apt.key(keyserver='keyserver.ubuntu.com', keyid='8B48AD6246925553') | |
| 22 # apt.key(keyserver='keyserver.ubuntu.com', keyid='F24AEA9FB05498B7') | |
| 23 if host.name != 'prime': | |
| 24 apt.key(keyserver='keyserver.ubuntu.com', keyid='D0392EC59F9583BA') | |
| 25 apt.key(src='https://dl.google.com/linux/linux_signing_key.pub') | |
| 26 apt.key(src='https://ftp-master.debian.org/keys/archive-key-8-security.asc') | |
| 27 apt.key(src='https://ftp-master.debian.org/keys/archive-key-8.asc') | |
| 28 apt.key(src='https://ftp-master.debian.org/keys/archive-key-9-security.asc') | |
| 29 apt.key(src='https://packages.microsoft.com/keys/microsoft.asc') | |
| 30 apt.key(src='https://deb.nodesource.com/gpgkey/nodesource.gpg.key') | |
| 31 | |
| 145 | 32 # Failed to fetch https://repo.steampowered.com/steam/dists/stable/InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F24AEA9FB05498B7 |
| 138 | 33 |
|
126
fe3ae7c95e65
collect all apt/sources.list into a central template
drewp@bigasterisk.com
parents:
118
diff
changeset
|
34 def apt_sources(): |
|
130
168bc1c44e6f
stop telling arm machines to get i386 pkgs
drewp@bigasterisk.com
parents:
126
diff
changeset
|
35 if host.get_fact(Arch) == 'x86_64': |
|
168bc1c44e6f
stop telling arm machines to get i386 pkgs
drewp@bigasterisk.com
parents:
126
diff
changeset
|
36 server.shell(commands=['dpkg --add-architecture i386']) |
|
126
fe3ae7c95e65
collect all apt/sources.list into a central template
drewp@bigasterisk.com
parents:
118
diff
changeset
|
37 |
| 138 | 38 files.template(src='templates/sources.list.j2', dest='/etc/apt/sources.list') |
|
126
fe3ae7c95e65
collect all apt/sources.list into a central template
drewp@bigasterisk.com
parents:
118
diff
changeset
|
39 if host.get_fact(FindFiles, '/etc/apt/sources.list.d/', quote_path=True): |
|
fe3ae7c95e65
collect all apt/sources.list into a central template
drewp@bigasterisk.com
parents:
118
diff
changeset
|
40 raise SystemExit(f"new files in {host.name} /etc/apt/sources.list.d/ - please remove") |
| 91 | 41 apt.packages(update=True, |
| 42 cache_time=86400, | |
| 43 packages=['tzdata'], | |
| 44 force=True, | |
| 45 _env={ | |
| 46 'TZ': TZ, | |
| 47 'LANG': 'en_US.UTF-8', | |
| 48 'DEBIAN_FRONTEND': 'noninteractive' | |
| 49 }) | |
| 1 | 50 |
| 91 | 51 def fstab(): |
| 52 fstab_file = f'files/fstab/{host.name}' | |
| 53 if os.path.exists(fstab_file): | |
| 54 files.put(src=fstab_file, dest='/etc/fstab') | |
| 1 | 55 |
| 91 | 56 def pi_tmpfs(): |
| 1 | 57 for line in [ |
| 58 'tmpfs /var/log tmpfs defaults,noatime,mode=0755 0 0', | |
| 59 'tmpfs /tmp tmpfs defaults,noatime 0 0', | |
| 60 ]: | |
| 61 files.line(path="/etc/fstab", line=line, replace=line) | |
| 62 | |
| 63 # stop SD card corruption (along with some mounts in fstab) | |
| 64 apt.packages(packages=['dphys-swapfile'], present=False) | |
| 65 | |
| 66 | |
|
3
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
67 # don't try to get aufs-dkms on rpi-- https://github.com/docker/for-linux/issues/709 |
| 145 | 68 def podman_insecure_registry(): |
| 91 | 69 files.template(src='templates/kube/podman_registries.conf.j2', dest='/etc/containers/registries.conf.d/bang.conf') |
|
34
d4fb38f13c79
refactor dns and some other non-net setup
drewp@bigasterisk.com
parents:
12
diff
changeset
|
70 |
|
d4fb38f13c79
refactor dns and some other non-net setup
drewp@bigasterisk.com
parents:
12
diff
changeset
|
71 |
| 91 | 72 def no_sleep(): |
|
34
d4fb38f13c79
refactor dns and some other non-net setup
drewp@bigasterisk.com
parents:
12
diff
changeset
|
73 server.shell(commands=['systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target']) |
|
d4fb38f13c79
refactor dns and some other non-net setup
drewp@bigasterisk.com
parents:
12
diff
changeset
|
74 |
| 91 | 75 def nfs_server(): |
|
34
d4fb38f13c79
refactor dns and some other non-net setup
drewp@bigasterisk.com
parents:
12
diff
changeset
|
76 apt.packages(packages=['nfs-kernel-server']) |
|
d4fb38f13c79
refactor dns and some other non-net setup
drewp@bigasterisk.com
parents:
12
diff
changeset
|
77 files.template(src='templates/bang_exports.j2', dest='/etc/exports') |
|
37
fbd0849dfdbd
redo networking to be much simpler. Uses systemd-networkd
drewp@bigasterisk.com
parents:
34
diff
changeset
|
78 |
| 57 | 79 # sudo zfs set sharenfs="rw=10.5.0.0/16" stor6 |
| 80 | |
| 91 | 81 def smaller_journals(): |
|
37
fbd0849dfdbd
redo networking to be much simpler. Uses systemd-networkd
drewp@bigasterisk.com
parents:
34
diff
changeset
|
82 files.line(name='shorter systemctl log window, for disk space', |
|
fbd0849dfdbd
redo networking to be much simpler. Uses systemd-networkd
drewp@bigasterisk.com
parents:
34
diff
changeset
|
83 path='/etc/systemd/journald.conf', |
|
fbd0849dfdbd
redo networking to be much simpler. Uses systemd-networkd
drewp@bigasterisk.com
parents:
34
diff
changeset
|
84 line='MaxFileSec', |
|
fbd0849dfdbd
redo networking to be much simpler. Uses systemd-networkd
drewp@bigasterisk.com
parents:
34
diff
changeset
|
85 replace="MaxFileSec=7day") |
|
fbd0849dfdbd
redo networking to be much simpler. Uses systemd-networkd
drewp@bigasterisk.com
parents:
34
diff
changeset
|
86 |
|
fbd0849dfdbd
redo networking to be much simpler. Uses systemd-networkd
drewp@bigasterisk.com
parents:
34
diff
changeset
|
87 for port in [80, 443]: |
|
fbd0849dfdbd
redo networking to be much simpler. Uses systemd-networkd
drewp@bigasterisk.com
parents:
34
diff
changeset
|
88 files.template(src="templates/webforward.service.j2", dest=f"/etc/systemd/system/web_forward_{port}.service", port=port) |
|
fbd0849dfdbd
redo networking to be much simpler. Uses systemd-networkd
drewp@bigasterisk.com
parents:
34
diff
changeset
|
89 systemd.service(service=f'web_forward_{port}', enabled=True, restarted=True) |
| 91 | 90 |
|
118
69058ad170be
watch output from `zfs list -o space` as metrics
drewp@bigasterisk.com
parents:
91
diff
changeset
|
91 def zfs_metrics(): |
|
69058ad170be
watch output from `zfs list -o space` as metrics
drewp@bigasterisk.com
parents:
91
diff
changeset
|
92 files.put(src='files/zfs_metrics/zfs_space_metrics.sh', dest='/opt/zfs_metrics/zfs_space_metrics.sh') |
|
69058ad170be
watch output from `zfs list -o space` as metrics
drewp@bigasterisk.com
parents:
91
diff
changeset
|
93 files.put(src='files/zfs_metrics/zfs.mtail', dest='/opt/zfs_metrics/zfs.mtail') |
|
69058ad170be
watch output from `zfs list -o space` as metrics
drewp@bigasterisk.com
parents:
91
diff
changeset
|
94 files.put(src='files/zfs_metrics/zfs_space_metrics.service', |
|
69058ad170be
watch output from `zfs list -o space` as metrics
drewp@bigasterisk.com
parents:
91
diff
changeset
|
95 dest=f'/etc/systemd/system/zfs_space_metrics.service') |
|
69058ad170be
watch output from `zfs list -o space` as metrics
drewp@bigasterisk.com
parents:
91
diff
changeset
|
96 systemd.service(service=f'zfs_space_metrics', enabled=True, restarted=True, daemon_reload=True) |
|
69058ad170be
watch output from `zfs list -o space` as metrics
drewp@bigasterisk.com
parents:
91
diff
changeset
|
97 |
| 145 | 98 server.hostname(hostname=host.name) |
| 91 | 99 timezone() |
| 138 | 100 pkg_keys() |
|
126
fe3ae7c95e65
collect all apt/sources.list into a central template
drewp@bigasterisk.com
parents:
118
diff
changeset
|
101 apt_sources() |
| 91 | 102 fstab() |
| 103 | |
| 104 if not is_pi: | |
| 105 files.line(path='/etc/update-manager/release-upgrades', line="^Prompt=", replace="Prompt=normal") | |
| 106 | |
| 107 if is_pi and host.name != 'pipe': | |
| 108 pi_tmpfs() | |
| 133 | 109 files.template(src='templates/boot_config.txt.j2', dest='/boot/config.txt') |
| 91 | 110 |
| 138 | 111 if not is_pi: |
| 145 | 112 podman_insecure_registry() |
| 91 | 113 |
| 146 | 114 if host.name in ['bang', 'pipe', 'ditto']: |
| 91 | 115 no_sleep() |
| 116 | |
| 117 if host.name == 'bang': | |
| 118 nfs_server() | |
|
118
69058ad170be
watch output from `zfs list -o space` as metrics
drewp@bigasterisk.com
parents:
91
diff
changeset
|
119 zfs_metrics() |
| 91 | 120 |
| 121 if host.name == 'prime': | |
|
126
fe3ae7c95e65
collect all apt/sources.list into a central template
drewp@bigasterisk.com
parents:
118
diff
changeset
|
122 smaller_journals() |