incoming.yml

---
- name: Incoming
  hosts: incoming
  become: true
  vars:
    hostname: incoming.galaxyproject.eu
    proftpd_modules_config_file: /etc/proftpd/modules.conf
  vars_files:
    - secret_group_vars/all.yml
  collections:
    - devsec.hardening
  pre_tasks:
    - name: Set timezone to Europe/Berlin
      community.general.timezone:
        name: Europe/Berlin
    - name: Install Dependencies
      package:
        name: ['postgresql', 'proftpd-utils']
    - name: Configure SELinux
      ansible.posix.seboolean:
        name: "{{ item }}"
        state: true
        persistent: true
      loop:
        - ftpd_full_access
        - ftpd_connect_db
        - ftpd_use_passive_mode
    - name: Disable firewalld service
      ansible.builtin.service:
        name: firewalld
        enabled: false
        state: stopped
  post_tasks:
    - name: Replace sql
      ansible.builtin.replace:
        path: /etc/proftpd.conf.d/10_galaxy_auth.conf
        regexp: 'galaxy_user'
        replace: "galaxy.galaxy_user"
      notify:
        - reload proftpd
    - name: Enable Dynamic ban lists
      ansible.builtin.lineinfile:
        path: /etc/sysconfig/proftpd
        regexp: '^PROFTPD_OPTIONS='
        line: PROFTPD_OPTIONS="-DDYNAMIC_BAN_LISTS"
      notify:
        - reload proftpd
  roles:
    ## Starting configuration of the operating system
    - role: usegalaxy_eu.handy.os_setup
      vars:
        enable_hostname: true
        enable_powertools: true        # geerlingguy.repo-epel role doesn't enable PowerTools repository
        enable_remap_user: true
        enable_install_software: true  # Some extra admin tools (*top, vim, etc)
    - geerlingguy.repo-epel     # Install EPEL repository
    - usegalaxy-eu.autoupdates  # keep all of our packages up to date
    - influxdata.chrony         # Keep our time in sync.
    - usegalaxy-eu.dynmotd
    ## Filesystems
    - usegalaxy-eu.autofs  # Setup the mount points which will be needed later
    # User
    - usegalaxy-eu.create-user
    # Services
    - galaxyproject.nginx
    - galaxyproject.proftpd

    - dj-wasabi.telegraf
    - os_hardening
    - ssh_hardening