Mercurial > code > home > repos > infra
annotate system.py @ 6:aa633eb49c63
have pi use bullseye for working netplan.io pkg
| author | drewp@bigasterisk.com |
|---|---|
| date | Wed, 10 Nov 2021 09:53:49 -0800 |
| parents | 61945df2a392 |
| children | 1fec9fe18a4e |
| rev | line source |
|---|---|
| 1 | 1 import os |
| 2 from pyinfra import host | |
| 3 from pyinfra.operations import server, files, apt, ssh, systemd | |
| 4 from pyinfra.facts.server import LinuxDistribution | |
| 5 | |
|
3
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
6 bang_is_old = True # remove after upgrade |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
7 is_pi = host.get_fact(LinuxDistribution)['name'] in ['Debian', 'Raspbian GNU/Linux'] |
| 1 | 8 is_wifi_pi = host.name in ['frontdoor', 'living'] |
| 9 | |
| 10 TZ = 'America/Los_Angeles' | |
| 11 | |
| 12 # | |
| 13 # system | |
| 14 # | |
| 15 | |
| 16 server.hostname(hostname=host.name) | |
| 17 files.link(path='/etc/localtime', target=f'/usr/share/zoneinfo/{TZ}') | |
| 18 files.replace(path='/etc/timezone', match='.*', replace=TZ) | |
| 19 apt.packages(update=True, | |
| 20 cache_time=86400, | |
| 21 packages=['tzdata'], | |
| 22 force=True, | |
| 23 env={ | |
| 24 'TZ': TZ, | |
| 25 'LANG': 'en_US.UTF-8', | |
| 26 'DEBIAN_FRONTEND': 'noninteractive' | |
| 27 }) | |
| 28 | |
| 29 # | |
| 30 # fstab | |
| 31 # | |
| 32 | |
| 33 fstab_file = f'files/{host.name}_fstab' | |
| 34 if os.path.exists(fstab_file): | |
| 35 files.put(src=fstab_file, dest='/etc/fstab') | |
| 36 if is_pi: | |
| 37 for line in [ | |
| 38 'tmpfs /var/log tmpfs defaults,noatime,mode=0755 0 0', | |
| 39 'tmpfs /tmp tmpfs defaults,noatime 0 0', | |
| 40 ]: | |
| 41 files.line(path="/etc/fstab", line=line, replace=line) | |
| 42 | |
| 43 # stop SD card corruption (along with some mounts in fstab) | |
| 44 apt.packages(packages=['dphys-swapfile'], present=False) | |
| 45 | |
| 46 # | |
| 47 # pkgs | |
| 48 # | |
| 49 | |
| 50 if not is_pi: | |
| 51 apt.key(keyserver='keyserver.ubuntu.com', keyid='8B48AD6246925553') | |
| 52 | |
| 53 if is_pi: | |
|
6
aa633eb49c63
have pi use bullseye for working netplan.io pkg
drewp@bigasterisk.com
parents:
3
diff
changeset
|
54 apt.packages(packages=['mandb', 'apt-listchanges'], present=False) |
|
aa633eb49c63
have pi use bullseye for working netplan.io pkg
drewp@bigasterisk.com
parents:
3
diff
changeset
|
55 files.template(src='templates/pi_sources.list.j2', dest='/etc/apt/sources.list', rel='bullseye') |
|
aa633eb49c63
have pi use bullseye for working netplan.io pkg
drewp@bigasterisk.com
parents:
3
diff
changeset
|
56 # 'apt upgrade'? |
|
aa633eb49c63
have pi use bullseye for working netplan.io pkg
drewp@bigasterisk.com
parents:
3
diff
changeset
|
57 apt.packages(update=True, packages=['dirmngr', 'gnupg2', 'apt-utils']) |
| 1 | 58 |
| 59 apt.key(src='https://ftp-master.debian.org/keys/archive-key-8.asc') | |
| 60 apt.key(src='https://ftp-master.debian.org/keys/archive-key-8-security.asc') | |
| 61 apt.key(src='https://ftp-master.debian.org/keys/archive-key-9-security.asc') | |
| 62 | |
| 63 files.file(path='/etc/apt/sources.list.d/raspi.list', present=False) | |
| 64 | |
| 65 if is_wifi_pi: | |
| 66 files.put(dest="/etc/network/interfaces.d/wlan0", src="files/pi_wlan0_powersave") | |
| 67 ssh.command(host.name, "iw wlan0 set power_save off") | |
| 68 | |
| 69 # see https://www.raspberrypi.org/documentation/configuration/config-txt/memory.md#:~:text=txt-,gpu_mem,-Specifies | |
| 70 # to port to pyinfra | |
| 71 #- name: unused display; give ram to OS | |
| 72 # lineinfile: dest=/boot/config.txt line="gpu_mem=16" regexp="^gpu_mem=" | |
| 73 # when: "'with_x11' not in group_names" | |
| 74 | |
| 75 # for beacon | |
| 76 #enable_uart=1 | |
| 77 #dtoverlay=pi3-miniuart-bt | |
| 78 #core_freq=250 | |
| 79 | |
| 80 # for tiny_screen | |
| 81 #to port to pyinfra | |
| 82 #- lineinfile: dest=/boot/config.txt line="dtparam=spi=on" regexp="^dtparam=spi=" | |
| 83 | |
| 84 # i hope this is deletable | |
| 85 # downgrade strictness so I can install from https://archive.raspberrypi.org/ | |
| 86 # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907788 | |
| 87 #- lineinfile: dest=/etc/ssl/openssl.cnf line="#CipherString = DEFAULT@SECLEVEL=2" regexp="CipherString ?=" | |
| 88 | |
| 89 # may be fixed in k3s, not sure | |
| 90 # raspbian defaults to `iptables -V` -> iptables v1.8.4 (nf_tables), which won't work with k3s | |
| 91 # - command: update-alternatives --set iptables /usr/sbin/iptables-legacy | |
| 92 if not is_pi: | |
| 93 apt.key(src='https://dl.google.com/linux/linux_signing_key.pub') | |
| 94 apt.repo(src='deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main') | |
| 95 | |
| 96 apt.key(src='https://packages.microsoft.com/keys/microsoft.asc') | |
| 97 apt.repo(src="deb [arch=amd64,arm64,armhf] http://packages.microsoft.com/repos/code stable main") | |
| 98 | |
| 99 apt.ppa(src="ppa:savoury1/blender") | |
| 100 | |
| 101 apt.key(keyserver='keyserver.ubuntu.com', keyid='F24AEA9FB05498B7') | |
| 102 apt.repo(src="deb [arch=amd64,i386] https://repo.steampowered.com/steam/ stable steam") | |
| 103 | |
|
3
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
104 if False and is_pi: |
| 1 | 105 apt.key(src="https://download.docker.com/linux/raspbian/gpg") |
| 106 apt.repo(src="deb [arch=armhf] https://download.docker.com/linux/raspbian stretch stable") | |
| 107 apt.repo(src='deb http://deb.debian.org/debian/ unstable main') # maybe for WG | |
| 108 | |
| 109 apt.packages(packages=[ | |
| 110 'build-essential', | |
|
3
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
111 # 'i2c-tools', |
| 1 | 112 'rsync', |
| 113 ]) | |
| 114 | |
| 2 | 115 if not is_pi: |
|
3
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
116 apt.packages(packages=[ |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
117 'keychain', |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
118 'python3-docker', |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
119 'python3-invoke', |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
120 'python3-pip', |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
121 'python3-virtualenv', |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
122 'sysstat', |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
123 ]) |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
124 |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
125 if not is_pi and not bang_is_old: |
| 2 | 126 apt.packages(packages='mlocate', present=False) |
| 127 apt.packages(packages='plocate') | |
| 128 | |
| 1 | 129 # |
| 130 # ssh | |
| 131 # | |
| 132 | |
| 133 systemd.service( | |
| 134 service='ssh', | |
| 135 running=True, | |
| 136 enabled=True, | |
| 137 ) | |
| 138 | |
| 139 files.line(path='/etc/ssh/ssh_config', line="HashKnownHosts", replace="HashKnownHosts no") | |
| 140 | |
| 141 if is_pi: | |
| 142 auth_keys = '/home/pi/.ssh/authorized_keys' | |
| 143 files.file(path=auth_keys, user='pi', group='pi', mode=600) | |
| 144 for pubkey in [ | |
| 145 'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNlR7hereUHqw/RHQau0F7+vQZKAxduM+SD4R76FhC+4Zi078Pv04ZLe9qdM/NBlB/grLGhG58vaGmnWPpJ3QJs= drewp@plus', | |
| 146 'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOR+iV8Qm/rAfmq0epXYfnp5ZTfBl8eidFzw1GmyZ3fPUFAshWn839fQ5DPj9xDPtMy9kTtrB5bK1SnynFzDqzQ= drewp@bang', | |
| 147 ]: | |
| 148 files.line(path=auth_keys, line=pubkey, replace=pubkey) | |
| 149 | |
| 150 # | |
| 151 # docker (delete this?) | |
| 152 # | |
| 153 | |
|
3
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
154 # don't try to get aufs-dkms on rpi-- https://github.com/docker/for-linux/issues/709 |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
155 if not is_pi: |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
156 apt.packages(packages=['docker.io'], no_recommends=True) |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
157 files.put(src='files/docker_daemon.json', dest='/etc/docker/daemon.json') |
|
61945df2a392
updates to work on recent raspbian installs
drewp@bigasterisk.com
parents:
2
diff
changeset
|
158 systemd.service(service='docker', running=True, enabled=True, restarted=True) |
| 1 | 159 |
| 160 if not is_pi: | |
| 161 files.line(path='/etc/update-manager/release-upgrades', line="^Prompt=", replace="Prompt=normal") | |
| 162 | |
| 163 files.line(path='/etc/ssh/sshd_config', line="^UseDNS\b", replace="UseDNS no") | |
| 164 systemd.service(service='sshd', reloaded=True) | |
| 165 | |
| 166 # | |
| 167 # special hosts | |
| 168 # | |
| 169 | |
| 170 if host.name == "bang": | |
| 171 apt.packages(packages=[ | |
| 172 'libzfs2linux', | |
| 173 'zfsutils-linux', | |
| 174 'zfs-zed', | |
| 175 'zfs-auto-snapshot', | |
| 176 ]) | |
| 177 | |
| 178 # This is usable on pi where we don't care when they reboot: | |
| 179 #- name: apt_upgrade | |
| 180 # apt: upgrade=full | |
| 181 #- name: Check if a reboot is required | |
| 182 # register: file | |
| 183 # stat: path=/var/run/reboot-required get_md5=no | |
| 184 #- name: Reboot the server | |
| 185 # command: /sbin/reboot | |
| 186 # when: file.stat.exists == true |