el7_ansible_vm.cfg

# Basic EL 7 Kickstart configuration 
# Load form a webserver / GitHub after (network) boot 
# Retrieves software directly from CentOS mirror
#
# No hardening, not much modifications 
#
# 201612 Joachim la Poutre'

################################################################################
# Command Section
################################################################################
# Perform the installation in a completely non-interactive command 
# The recommended use is in conjunction with RUNKS=1 and ks=  cmdline

# (Required) We want to "install" as opposed to "upgrade" an existing system
#optional since Fedora 18 #
install
#cdrom
url --url http://mirror.centos.org/centos/7/os/x86_64/

# Use text mode install
text

# Reboot the machine after the installation is complete
# and attempt to eject the CD/DVD/Bootdisk
reboot

# X is not configured except for Desktops
skipx

# Skip EULA (include this for non-interactive install of subcription based EL)
eula --agreed

# System keyboard
keyboard us

# System language
lang en_US.UTF-8

# Setup agent should not start the first time the system boots:
firstboot --disable

# Include created here for the moment not working or required (CD boot)
%include /tmp/network

# (Required) Sets the root password so there is no prompt during installation
rootpw --iscrypted $6$rounds=1000000$Vk3DpNkIQEsP5dsy$4D6K/2L48u1CMJk.l8f8LftXbMP/NVvi2F5xEns7kShS1dhr0CROeecgjj8e1dvUptY0AajecNl/FZVQUkbmq0

# Enable the firewall
firewall --enabled --ssh --port=80:tcp

# shadow configuration:
authconfig --enableshadow --passalgo=sha512

# System timezone
timezone --utc Europe/Amsterdam

# CIS 1.4.1 Enable SELinux (default), 1.4.2 Enforcing, 1.4.3 Targeted Policy
selinux --enforcing

# Clear the Master Boot Record
zerombr

# Partition clearing information
# The --initlabel option has been deprecated. To initialize disks with invalid partition tables and clear their contents, use the zerombr command. 
clearpart --all

# System bootloader configuration and auto-partitioning
#bootloader --location=mbr --boot-drive=sda
#autopart --type=lvm
# or use explicit partitioning below
# Include generated partition layout
%include /tmp/partitions

################################################################################
# Packages
# see output from 'yum group info Core'' (and 'Base')
################################################################################
%packages # obsolete # --nobase
@core
# add some basic software
acl
authconfig
bash-completion
bc
bind-libs
bind-utils
bridge-utils
bzip2
chrony
cpio
crontabs
ed
ethtool
file
firewalld
gnupg2
krb5-workstation
logrotate
lsof
lvm2
man-db
man-pages
nc
net-tools
openldap-clients
openssh-clients
pam_krb5
pam_ldap
perl
plymouth
prelink
rsync
samba-common
samba-winbind
sssd
strace
tcpdump
tcp_wrappers
telnet
tmux
traceroute
virt-what
wget
which
xfsdump
xz
yum-utils
zip
git

# Remove from Core (rpm -qa|grep -i firmware|grep -v linux|sed -e 's/^/-/;s/-[0-9][0-9]..*//;s/-[0-9]..*//'|sort)
-aic94xx-firmware
-alsa-firmware
-alsa-tools-firmware
-ivtv-firmware
-iwl100-firmware
-iwl1000-firmware
-iwl105-firmware
-iwl135-firmware
-iwl2000-firmware
-iwl2030-firmware
-iwl3160-firmware
-iwl3945-firmware
-iwl4965-firmware
-iwl5000-firmware
-iwl5150-firmware
-iwl6000-firmware
-iwl6000g2a-firmware
-iwl6000g2b-firmware
-iwl6050-firmware
-iwl7260-firmware
-libertas-sd8686-firmware
-libertas-sd8787-firmware
-libertas-usb8388-firmware
# more
-microcode_ctl

%end

################################################################################
# Pre section
################################################################################
%pre --log=/tmp/ks-pre.log
#!/bin/bash
#
# First read the cmdline:
# on installation edit the PXE boot line and add: hostname=<hostname> 
#
set -- `cat /proc/cmdline`
for I in $*;
do
case "$I" in
*=*) eval $I
;;
esac;
done

################################################################################
# Configure the network
################################################################################
touch /tmp/routing
# just use DHCP + eth0 (no fancy routing for straight forward VM installation)
if [ "${hostname}" != "" ]; then
  echo "network --device=eth0 --bootproto=dhcp --onboot=yes --noipv6" \
        --hostname=${hostname} >/tmp/network
else
  echo "network --device=eth0 --bootproto=dhcp --onboot=yes --noipv6" \
         >/tmp/network
fi

################################################################################
# Configure the boot disk
# NB: VM should be provisioned with minimum size or bigger!
################################################################################
# get the first hard drive from 'list-harddrives'
# e.g. output for one disk:
# 	sda 61440.0
#

# minimum size of hard drive needed specified in GIGABYTES, 4Gb < VBox default
MINSIZE=4
INSTDISK=""

# /sys/block/*/size is in 512 byte chunks: GBs = blocks / 2^21
#  DEVI=/sys/block/${DEV}
#  SIZE=`cat ${DEVI}/size`
#  GB=$(($SIZE/2**21))
#list-harddrives >/tmp/list-harddrives.out

# make first drive >= ${MINSIZE} INSTDISK
# WARNING: if your disk is not big enough, Kickstart faile without providing
# very helpful information!!
list-harddrives | while read DEV MSIZE
do
  echo "Disk device:		${DEV}"
  GBDS=$((${MSIZE%.*}/1024))
  echo "Disk size in GB:	${GBDS}"
  #if [ `echo $((${GBDS}/${MINSIZE}))` -ge 1 ]; then
  if [ ${GBDS} -ge ${MINSIZE} ]; then
	echo ${DEV} > /tmp/installdisk
	break 1
  fi
done
INSTDISK=${DEV}
echo "variable disk:		${INSTDISK}"
INSTDISK=`cat /tmp/installdisk`
echo "Install disk:		 ${INSTDISK}"

#
# Generate partition and volume layout
# CIS Benchmark 1.1: skip this for non-production
#
if [ "${hostname}" == "" -o "${hostname}"  == "localhost" ]; then
	vgname=vg_system
else
	vgname=vg_${hostname%%.*}
fi
# RAM in GB:
MemTotal=`awk '/MemTotal:/ {print ($2/(1024^2))}' /proc/meminfo`
echo "RAM in GB:		${MemTotal}"

# use recommended swapsize below 32Gb RAM, above make a new decision about disks & swap
# EL 6 "--recommended" should translate to:
# 	RAM Gb		swap space Gb
#	=< 2		2 times RAM
#	2 < RAM =< 8	equal to RAM
#	8 < RAM =< 64	0.5 times RAM
#	> 64		???
#				(same in EL 7?) 
# We tested for a disk >= 60 Gb, with 27.5 Gb file systems that leaves about 32 Gb for paging
# ==> Up to 64 Gb RAM --recommended should work:
if [ ${MemTotal%.*} -lt 65 ]; then 
	swapsize=recommended
	# for large memory systems just use 32Gb and add swap devices if needed:
else 
	swapsize="size=32768"
	# or set swapzize=grow for bigger disks?
fi

# KISS: just /boot, / and swap:
echo "part /boot --fstype ext4 --size=512 --asprimary --ondisk ${INSTDISK}
part pv.3 --size=100 --grow --maxsize=5120
volgroup ${vgname} pv.3
logvol swap           --fstype swap --name=lv_swap          --vgname=${vgname} --${swapsize}
logvol /              --fstype xfs --name=lv_root          --vgname=${vgname} --size=100 --grow --maxsize=3072" >/tmp/partitions

%end

################################################################################
# Post sections follow here
# 
# Feel free to re-implement everything using your configuration management
################################################################################
%post --log=/root/ks-post.log

# CIS 4.4.2 only disable assigning IPv6 addresses (recommended)
# No IPv6 when we don't absolutely need it!
# enable SELinux 
sed -i '/vmlinuz/ s/$/ ipv6.disable_ipv6=1 selinux=1 enforcing=1/' /boot/grub2/grub.cfg
# Make the same change to the defaults
sed -i '/GRUB_CMDLINE_LINUX/ s/$/ ipv6.disable_ipv6=1 selinux=1 enforcing=1/' /etc/default/grub

# If you prefer Emacs, remove these:
echo "set -o vi" >> /etc/profile
echo "set -o vi" >> /etc/bashrc

# Vagrant:
useradd  -m -d /home/vagrant -s /bin/bash -p '$6$rounds=1000000$KKaL8Z6CY+YxSbNh$CfE6VGt92n6ESZOhYPRO7hMwBhoFpYCPwc7qqjPPEdJzp8kpkPCUA46zLDyuLgcnMaF32mFuaiukmCC3jSmQk/' -c "Vagrant Administrator" vagrant
mkdir /home/vagrant/.ssh
chmod 700 /home/vagrant/.ssh
echo "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key" > /home/vagrant/.ssh/authorized_keys
chmod 600 /home/vagrant/.ssh/authorized_keys

################################################################################
# Post-install Ansible
################################################################################
echo "#!/bin/bash

# chkconfig: 345 80 20
# description: Run once, instal Ansible from EPEL
# processname: ansibleinstall

yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
EXITE=\$?
case \${EXITE} in
  0) yum -y install ansible
     EXITA=\$?
     if [ \${EXITA} -eq 0 ]; then
	mv /etc/init.d/ansible /root/
	rm -f /etc/rc3.d/S80ansible
	cd /etc/ansible/roles
	ansible-galaxy install geerlingguy.gitlab
	GLOK=\$?
	[[ \${GLOK} -ne 0 ]] && echo \"GitLab role not installed!\" >> /etc/motd
     fi
     ;;
  *) echo \"Ansible installion failed!\" >> /etc/motd ;;
esac

if [ -d /etc/ansible ]; then
  mv -i /etc/ansible/hosts /etc/ansible/hosts.sample
  echo \"[gitlab]
gitlab
\" > /etc/ansible/hosts
  echo \"- Add gitlab host to DNS or /etc/hosts and
- copy the SSH public key
- and run the playbook!\" >> /etc/motd
  echo \"---
- name: deploy GitLab role
  hosts: gitlab

  roles:
    - geerlingguy.gitlab

\" > /etc/ansible/site.yml
else
  echo "Ansible is not installed!" >> /etc/motd
fi

" > /etc/init.d/ansible
chmod a+x /etc/init.d/ansible
cd /etc/rc3.d/ /etc/init.d/ansible /root/
ln -s ../init.d/ansible S80ansible

# Have the private key at hand for Ansible 
mkdir /root/.ssh
chmod 700 /root/.ssh
ssh-keygen -C root@ansible -t rsa -b 2048 -N "" -f /root/.ssh/ansiblekey
echo "eval \`ssh-agent -s\`
ssh-add ~/.ssh/ansiblekey" >> /root/.bashrc



################################################################################
# End post install configurations
################################################################################
###passwd -e root # <-- if you want to type in a complicated password ;-)
touch /.autorelabel

%end

%post --nochroot
cp /tmp/* /mnt/sysimage/tmp/
%end

# Reboot machine after installation
reboot