---
|
###### VARIABLES YOU SHOULD CONFIGURE FOR YOUR DEPLOYEMNT
|
###### OR PASS as "-e" args to ansible-playbook command
|
|
## Indicate the list of private workloads to deploy with
|
# this config. Takes a list of remote workloads as parameter
|
# private_workloads.
|
# Name will be used as part of a path name, so avoid spaces and
|
# other non-alphanumeric characters.
|
# - name: workload-name
|
# url: ssh://github.com:foo/bar.git
|
# path: /classroom/infrastructure/agnosticd-workload
|
# git_ssh_key: /home/provisioner/github-private.key
|
private_workloads: []
|
|
### Common Host settings
|
repo_method: file # Other Options are: file, satellite and rhn
|
#If using repo_method: satellite, you must set these values as well.
|
# satellite_url: satellite.example.com
|
# satellite_org: Sat_org_name
|
# satellite_activationkey: "rhel7basic"
|
|
# Do you want to run a full yum update
|
update_packages: false
|
|
install_bastion: false
|
install_common: true
|
install_courseware: true
|
|
# Indicate whether status will be reported to status API service on Bastion
|
# Also, indicates whether the status API will be installed on Bastion
|
report_status: true
|
|
# Defines the version of the Ansible Tower installer.
|
# The version should match a file available here:
|
# https://releases.ansible.com/ansible-tower/setup/
|
towerversion: "3.5.2-1"
|
tower_admin_password: changeme
|
|
## guid is the deployment unique identifier, it will be appended to all tags,
|
## files and anything that identifies this environment from another "just like it"
|
guid: defaultguid
|
course_name: default
|
platform: opentlc
|
project_tag: "{{ env_type }}-{{ guid }}"
|
|
### If you want a Key Pair name created and injected into the hosts,
|
# set `set_env_authorized_key` to true and set the keyname in `env_authorized_key`
|
# you can use the key used to create the environment or use your own self generated key
|
# if you set "use_own_key" to false your PRIVATE key will be copied to the bastion. (This is {{key_name}})
|
use_own_key: true
|
env_authorized_key: "{{guid}}key"
|
ansible_ssh_private_key_file: ~/.ssh/{{key_name}}
|
set_env_authorized_key: true
|
win_connect_method: psrp
|
|
### AWS EC2 Environment settings
|
|
### Route 53 Zone ID (AWS)
|
# This is the Route53 HostedZoneId where you will create your Public DNS entries
|
# This only needs to be defined if your CF template uses route53
|
HostedZoneId: Z3IHLWJZOU9SRT
|
# The region to be used, if not specified by -e in the command line
|
aws_region: us-east-1
|
# The key that is used to
|
key_name: "default_key_name"
|
|
## Networking (AWS)
|
subdomain_base_short: "{{ guid }}"
|
subdomain_base_suffix: ".{{ course_name }}.opentlc.com"
|
subdomain_base: "{{ subdomain_base_short }}{{ subdomain_base_suffix }}"
|
|
zone_internal_dns: "{{guid}}.{{course_name}}.internal."
|
chomped_zone_internal_dns: "{{guid}}.{{course_name}}.internal"
|
|
vpcid_cidr_block: "172.25.0.0/16"
|
vpcid_name_tag: "{{subdomain_base}}"
|
|
aws_availability_zone: "{{ aws_region }}a"
|
aws_private_subnet_cidr: "172.25.250.0/24"
|
aws_public_subnet_cidr: "172.25.251.0/24"
|
aws_vpc_name: "{{course_name}}-{{guid}}-vpc"
|
|
cf_template_description: "{{ env_type }}-{{ guid }} Ansible Agnostic Deployer "
|
|
## Environment Sizing
|
|
bastion_instance_type: "t2.medium"
|
tower_instance_type: "t2.medium"
|
gitlab_instance_type: "t2.medium"
|
|
windows_instance_count: 2
|
windows_instance_type: "t3.medium"
|
|
windows_workstation_instance_type: "t3.large"
|
|
activedirectory_instance_count: 1
|
activedirectory_instance_type: "t3.medium"
|
|
# Windows Domain Settings
|
dns_domain_name: "example.com"
|
dns_domain_name_short: "example"
|
ldap_basedn: "DC=example,DC=com"
|
ldap_search_base: "{{ ldap_basedn }}"
|
ldap_access_filter: "(&(objectClass=user)(memberOf=CN=Ansible Users,CN=Users,{{ ldap_search_base }}))"
|
tower_ldap_search_dn: "CN=Users,{{ ldap_search_base }}"
|
|
security_groups:
|
- name: BastionSG
|
rules:
|
- name: SSHBastion
|
description: "SSH public"
|
from_port: 22
|
to_port: 22
|
protocol: tcp
|
cidr: "0.0.0.0/0"
|
rule_type: Ingress
|
- name: HttpBastion
|
description: "Http public"
|
from_port: 80
|
to_port: 80
|
protocol: tcp
|
cidr: "0.0.0.0/0"
|
rule_type: Ingress
|
- name: NginxBastion
|
description: "Http public"
|
from_port: 30904
|
to_port: 30904
|
protocol: tcp
|
cidr: "0.0.0.0/0"
|
rule_type: Ingress
|
- name: TowerSG
|
rules:
|
- name: InternalNetworkTowerTcp
|
description: "All internal TCP traffic"
|
from_port: 0
|
to_port: 65535
|
protocol: tcp
|
cidr: "{{ vpcid_cidr_block }}"
|
rule_type: Ingress
|
- name: InternalNetworkTowerUdp
|
description: "All internal UDP traffic"
|
from_port: 0
|
to_port: 65535
|
protocol: udp
|
cidr: "{{ vpcid_cidr_block }}"
|
rule_type: Ingress
|
- name: GitlabSG
|
rules:
|
- name: InternalNetworkGitlabTcp
|
description: "All internal TCP traffic"
|
from_port: 0
|
to_port: 65535
|
protocol: tcp
|
cidr: "{{ vpcid_cidr_block }}"
|
rule_type: Ingress
|
- name: InternalNetworkGitlabUdp
|
description: "All internal UDP traffic"
|
from_port: 0
|
to_port: 65535
|
protocol: udp
|
cidr: "{{ vpcid_cidr_block }}"
|
rule_type: Ingress
|
- name: WinDCSG
|
rules:
|
- name: InternalNetworkWinTcp
|
description: "All internal TCP traffic"
|
from_port: 0
|
to_port: 65535
|
protocol: tcp
|
cidr: "{{ vpcid_cidr_block }}"
|
rule_type: Ingress
|
- name: InternalNetworkWinUdp
|
description: "All internal UDP traffic"
|
from_port: 0
|
to_port: 65535
|
protocol: udp
|
cidr: "{{ vpcid_cidr_block }}"
|
rule_type: Ingress
|
- name: WinSG
|
rules:
|
- name: InternalNetworkWinTcp
|
description: "All internal TCP traffic"
|
from_port: 0
|
to_port: 65535
|
protocol: tcp
|
cidr: "{{ vpcid_cidr_block }}"
|
rule_type: Ingress
|
- name: InternalNetworkWinUdp
|
description: "All internal UDP traffic"
|
from_port: 0
|
to_port: 65535
|
protocol: udp
|
cidr: "{{ vpcid_cidr_block }}"
|
rule_type: Ingress
|
- name: WorkstationSG
|
rules:
|
- name: HTTPWin
|
description: "HTTP public"
|
from_port: 80
|
to_port: 80
|
protocol: tcp
|
cidr: "0.0.0.0/0"
|
rule_type: Ingress
|
- name: HTTPSWin
|
description: "HTTPS public"
|
from_port: 443
|
to_port: 443
|
protocol: tcp
|
cidr: "0.0.0.0/0"
|
rule_type: Ingress
|
- name: WinRDP
|
description: "Win RDP public"
|
from_port: 3389
|
to_port: 3389
|
protocol: tcp
|
cidr: "0.0.0.0/0"
|
rule_type: Ingress
|
- name: InternalNetworkWinTcp
|
description: "All internal TCP traffic"
|
from_port: 0
|
to_port: 65535
|
protocol: tcp
|
cidr: "{{ vpcid_cidr_block }}"
|
rule_type: Ingress
|
- name: InternalNetworkWinUdp
|
description: "All internal UDP traffic"
|
from_port: 0
|
to_port: 65535
|
protocol: udp
|
cidr: "{{ vpcid_cidr_block }}"
|
rule_type: Ingress
|
|
instances:
|
- name: "bastion"
|
count: 1
|
unique: true
|
security_group: "BastionSG"
|
public_dns: true
|
flavor:
|
"ec2": "{{bastion_instance_type}}"
|
image_id: RHEL76GOLD
|
tags:
|
- key: "AnsibleGroup"
|
value: "bastions"
|
- key: "ostype"
|
value: "linux"
|
|
- name: "tower"
|
count: 1
|
unique: true
|
security_group: "TowerSG"
|
public_dns: false
|
flavor:
|
"ec2": "{{tower_instance_type}}"
|
image_id: RHEL76GOLD
|
tags:
|
- key: "AnsibleGroup"
|
value: "towers"
|
- key: "ostype"
|
value: "linux"
|
#TODO is this needed? it doesn't work like this
|
# UserData: |
|
# UserData:
|
# hostname: tower
|
# fqdn: "tower.{{dns_domain_name}}"
|
# manage_etc_hosts: true
|
# chpasswd: { expire: False }
|
# ssh_pwauth: True
|
|
- name: "gitlab"
|
count: 1
|
unique: true
|
security_group: "GitlabSG"
|
public_dns: false
|
flavor:
|
"ec2": "{{gitlab_instance_type}}"
|
image_id: RHEL76GOLD
|
tags:
|
- key: "AnsibleGroup"
|
value: "gitlab"
|
- key: "ostype"
|
value: "linux"
|
|
- name: "windc"
|
count: "{{activedirectory_instance_count}}"
|
public_dns: false
|
unique: "{{ true if activedirectory_instance_count | int <= 1 else false }}"
|
security_group: "WinDCSG"
|
flavor:
|
"ec2": "{{activedirectory_instance_type}}"
|
image_id: WIN2019FULL
|
UserData: "{{ lookup('template', '../configs/{{ env_type }}/templates/win_ec2_userdata.j2') }}"
|
tags:
|
- key: "AnsibleGroup"
|
value: "activedirectories"
|
- key: "ostype"
|
value: "windows"
|
|
- name: "win"
|
count: "{{windows_instance_count}}"
|
unique: "{{ true if windows_instance_count | int <= 1 else false }}"
|
public_dns: false
|
security_group: "WinSG"
|
flavor:
|
"ec2": "{{windows_instance_type}}"
|
image_id: WIN2019FULL
|
UserData: "{{ lookup('template', '../configs/{{ env_type }}/templates/win_ec2_userdata.j2') }}"
|
tags:
|
- key: "AnsibleGroup"
|
value: "windows_servers"
|
- key: "ostype"
|
value: "windows"
|
volumes:
|
- device_name: "/dev/xvdf"
|
size: 5
|
|
- name: "workstation"
|
count: 1
|
unique: true
|
public_dns: true
|
security_group: "WorkstationSG"
|
flavor:
|
"ec2": "{{windows_workstation_instance_type}}"
|
image_id: WIN2016FULL
|
UserData: "{{ lookup('template', '../configs/{{ env_type }}/templates/win_ec2_userdata.j2') }}"
|
tags:
|
- key: "AnsibleGroup"
|
value: "workstations"
|
- key: "ostype"
|
value: "windows"
|
|
install_win_ssh: false
|
|
###### VARIABLES YOU SHOULD ***NOT*** CONFIGURE FOR YOUR DEPLOYMENT
|
###### You can, but you usually wouldn't need to.
|
|
# The following interfere with Windows servers which use Administrator
|
#ansible_user: ec2-user
|
#remote_user: ec2-user
|
|
common_packages:
|
- python
|
- unzip
|
- bash-completion
|
- tmux
|
- bind-utils
|
- wget
|
- git
|
- vim-enhanced
|
- at
|
- python2-pip
|
- gcc
|
|
rhel_repos:
|
- rhel-7-server-rpms
|
- rhel-7-server-extras-rpms
|
|
disable_default_repos: true
|
|
enable_epel: true
|
|
# Needed for reverse lookup DNS setup
|
ptr_zone_name: "250.25.172.in-addr.arpa"
|
ptr_zone_cidr: "172.25.250.0/24"
|
|
# Windows Default account
|
user_prefix: student
|
workstation_user: training
|
|
###################### GITLAB INFO #######################
|
# Gitlab variables
|
gitlab_external_url: "https://gitlab.{{ dns_domain_name }}/"
|
gitlab_git_data_dir: "/var/opt/gitlab/git-data"
|
gitlab_backup_path: "/var/opt/gitlab/backups"
|
gitlab_edition: "gitlab-ce"
|
|
# SSL Config
|
gitlab_redirect_http_to_https: "true"
|
gitlab_ssl_certificate: "/etc/gitlab/ssl/gitlab.crt"
|
gitlab_ssl_certificate_key: "/etc/gitlab/ssl/gitlab.key"
|
|
# SSL Self-signed Certificate Configuration
|
gitlab_create_self_signed_cert: "true"
|
gitlab_self_signed_cert_subj: "/C=US/ST=North Carolina/L=Raleigh/O=Ansible/CN=gitlab.{{ dns_domain_name }}"
|
|
# LDAP Configuration
|
gitlab_ldap_enabled: "true"
|
gitlab_ldap_host: "windc.{{ dns_domain_name }}"
|
gitlab_ldap_port: "389"
|
gitlab_ldap_uid: "sAMAccountName"
|
gitlab_ldap_method: "plain"
|
gitlab_ldap_bind_dn: "CN=Admin,CN=Users,{{ ldap_basedn }}"
|
gitlab_ldap_password: "{{ windows_password }}"
|
gitlab_ldap_base: "{{ ldap_basedn }}"
|
|
# General Config
|
gitlab_time_zone: "UTC"
|
gitlab_backup_keep_time: "604800"
|
gitlab_download_validate_certs: yes
|
gitlab_version: "10.0.6-ce.0.el7"
|
|
# Email configuration.
|
gitlab_email_enabled: "false"
|
gitlab_smtp_enable: "false"
|
|
git_lab: false
|
advanced_lab: false
|
