From a4ade843355d3d876c2f2f501443d7fcad6b4e94 Mon Sep 17 00:00:00 2001 From: Alexander Karpov Date: Mon, 9 Oct 2023 01:42:20 +0400 Subject: [PATCH 1/3] Restarting Docker service and Support RedHat 9 were added --- handlers/main.yml | 6 ++++++ vars/RedHat-9.yml | 21 +++++++++++++++++++++ 2 files changed, 27 insertions(+) create mode 100644 vars/RedHat-9.yml diff --git a/handlers/main.yml b/handlers/main.yml index a31876b..9ca4e7a 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -38,3 +38,9 @@ not (ansible_virtualization_type is defined and (ansible_virtualization_type == "lxc" or ansible_virtualization_type == "docker") ) + +- name: Restart docker.service + ansible.builtin.systemd: + name: docker.service + state: restarted + when: ansible_facts.services['docker.service'] is defined \ No newline at end of file diff --git a/vars/RedHat-9.yml b/vars/RedHat-9.yml new file mode 100644 index 0000000..a396038 --- /dev/null +++ b/vars/RedHat-9.yml @@ -0,0 +1,21 @@ +--- + +ipv6_harden_settings: + - { n: 'net.ipv6.conf.all.forwarding', v: 0 } + # - { n: 'net.ipv6.conf.all.send_redirects', v: 0 } + - { n: 'net.ipv6.conf.all.accept_redirects', v: 0 } + - { n: 'net.ipv6.conf.all.accept_source_route', v: 0 } + - { n: 'net.ipv6.conf.default.accept_redirects', v: 0 } + - { n: 'net.ipv6.conf.default.accept_source_route', v: 0 } + - { n: 'net.ipv6.conf.default.router_solicitations', v: 0 } + - { n: 'net.ipv6.conf.default.accept_ra_rtr_pref', v: 0 } + - { n: 'net.ipv6.conf.default.accept_ra_pinfo', v: 0 } + - { n: 'net.ipv6.conf.default.accept_ra_defrtr', v: 0 } + - { n: 'net.ipv6.conf.all.accept_ra', v: 0 } + - { n: 'net.ipv6.conf.default.accept_ra', v: 0 } + - { n: 'net.ipv6.conf.default.autoconf', v: 0 } + - { n: 'net.ipv6.conf.default.dad_transmits', v: 0 } + - { n: 'net.ipv6.conf.default.max_addresses', v: 1 } + - { n: 'net.ipv6.conf.all.max_addresses', v: 1 } + +ipv6_grub_mkconfig: grub2-mkconfig From 01a2336af3d1c967ab24f1ad5c4a4f656a46296b Mon Sep 17 00:00:00 2001 From: Alexander Karpov Date: Mon, 9 Oct 2023 02:01:27 +0400 Subject: [PATCH 2/3] 'Populate service facts' was added --- tasks/main.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tasks/main.yml b/tasks/main.yml index c5d6632..594f4c8 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,5 +1,7 @@ --- - +- name: Populate service facts + ansible.builtin.service_facts: + - name: Debug | ansible_distribution ansible.builtin.debug: var: ansible_distribution From 43ef04c485384f6a048f0319a7d7d08d4f9291da Mon Sep 17 00:00:00 2001 From: Alexander Karpov Date: Fri, 13 Oct 2023 21:44:34 +0400 Subject: [PATCH 3/3] Added Notify (Restart docker.service) --- tasks/ipv6-disable.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/tasks/ipv6-disable.yml b/tasks/ipv6-disable.yml index fc8fc9a..1b79147 100644 --- a/tasks/ipv6-disable.yml +++ b/tasks/ipv6-disable.yml @@ -46,6 +46,7 @@ notify: - Restart network - Restart NetworkManager + - Restart docker.service when: ansible_os_family == 'RedHat' - name: Import ipv6-grub-disable