blob: bc19dc72d5679021c03c4ee6a592413e03d2cc66 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
---
- name: Setup OpenBSD Laptop
hosts: localhost
vars:
ansible_connection: local
openbsd_staff:
- mitch
openbsd_sysctls:
- line: hw.smt=1
regexp: ^hw.smt
- line: kern.maxproc=32768
regexp: ^kern.maxproc
- line: kern.maxfiles=65535
regexp: ^kern.maxfiles
- line: kern.bufcachepercent=40
regexp: ^kern.bufcachepercent
- line: kern.audio.record=1
regexp: ^kern.audio.record
openbsd_doas: |
permit nopass :wheel as root
openbsd_packages:
- git
- ansible
- vim
- firefox
- neofetch
- evolution
- seahorse
- claws-mail
- gnome-keyring
- libgnome-keyring
- tango-icon-theme
- tango-icon-theme-extras
- i3
- xfce
- i3
- dmenu
- password-store
- pass-otp
- gpa
- htop
- slock
- bash
- feh
- rsync
- go
- xfce4-screenshooter
- okular
- shellcheck
- redshift
- postgresql-server
- vlc
- rtorrent
- mktorrent
- wget
- pwgen
- xdotool
- runit
- tree
- noto-emoji
- ncdu
- jq
- arandr
# Deve stuff
- gmake
# pidgin plugins
- gettext-tools
openbsd_pf_conf: |
# $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
dns_server="100.64.1.2"
set skip on lo
# For vm nat
match out on egress from 100.64.0.0/10 to any nat-to (egress)
pass out from 100.64.0.0/10
pass in proto { udp tcp } from 100.64.0.0/10 to any port domain
block return # block stateless traffic
pass # establish keep-state
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
# Port build user does not need network
block return out log proto {tcp udp} user _pbuild
tasks:
# TODO: login.conf staff group bumped limits
- name: Enable apmd
lineinfile:
dest: /etc/rc.conf.local
line: apmd_flags=-A
regexp: '^apmd_flags='
- name: Install packages
openbsd_pkg:
name: '{{openbsd_packages}}'
state: present
tags:
- packages
- name: Add specified users to staff
shell: |
#!/bin/sh
{% for user in openbsd_staff %}
usermod -G staff {{user}}
{% endfor %}
- name: Write doas configuration
copy:
content: '{{openbsd_doas}}'
dest: /etc/doas.conf
- name: Write pf configuration
copy:
content: '{{openbsd_pf_conf}}'
dest: /etc/pf.conf
mode: '0600'
- name: Tune sysctls
lineinfile:
dest: /etc/sysctl.conf
regexp: '{{item.regexp}}'
line: '{{item.line}}'
loop: '{{openbsd_sysctls}}'
tags:
- sysctls
|
