add roles/toxcore

roles/toxcore/tasks/libvirt_whonix.yml

@@ -12,7 +12,7 @@
   shell: |
     base="hulahoop"
     URL="www.whonix.org/$base"
-    dir="{{HARDEN_VAR_LOCAL}}/net/Http/"
+    dir="{{TOXCORE_USR_LOCAL}}/net/Http/"
     [ -d $dir ] || mkdir $dir
     [ -f $dir/$URL.asc ] || wget {{BASE_WGET_ARGS}} -xc -P $dir https://$URL.asc || exit 3
     # FixMe:
@@ -21,32 +21,12 @@
     grep 'imported: 1' /tmp/V$$.out
     exit 0
   args:
-    creates: "{{HARDEN_VAR_LOCAL}}/net/Http/www.whonix.org/hulahoop.asc"
+    creates: "{{TOXCORE_USR_LOCAL}}/net/Http/www.whonix.org/hulahoop.asc"
   when:
     - not ansible_check_mode
     - BASE_ARE_CONNECTED|default('') != ''
   ignore_errors: true
 
-- block:
-
-  - name: "/etc/libvirt/virtlogd.conf"
-    lineinfile:
-      path: /etc/libvirt/virtlogd.conf
-      create: yes
-      mode: 0755
-      insertafter: BOF
-      line: '{{item.key}}="{{item.val}}"'
-      regexp: "^#{{item.key}}.*"
-    with_items:
-      - key: log_filters
-        val: "1:logging 4:object 4:json 4:event 1:util"
-      - key: log_outputs
-        val: "3:file:/var/log/libvirt/virtlogd.log"
-
-  when:
-    - "'libvirt' in BOX_HOSTVMS_FEATURES or BOX_WHONIX_PROXY_HOST != ''"
-    - "ansible_virtualization_role|replace('NA', 'host') == 'host'"
-
 - name: /etc/sysctl.d/70_testforge_libvirt.conf
   blockinfile:
     dest: /etc/sysctl.d/70_testforge_libvirt.conf
@@ -176,100 +156,3 @@
     - false # use xml instead
     - "ansible_virtualization_role|replace('NA', 'host') == 'host'"
 
-# console=tty0 console=ttyS0,115200n8 spectre_v2=on spec_store_bypass_disable=on tsx=off tsx_async_abort=full,nosmt mds=full,nosmt l1tf=full,force nosmt=force kvm.nx_huge_pages=force random.trust_cpu=off intel_iommu=on efi=disable_early_pci_dma slab_nomerge slub_debug=FZP page_poison=1 mce=0 pti=on vsyscall=none extra_latent_entropy
-# from Gateway
-
-- block:
-
-  # /usr/portage/app-emulation/libvirt/files/libvirtd.init-r19 after livirt-7.2.0a
-  - name: /usr/local/sbin/proxy_whonix-libvirt-install.bash
-    shell: |
-      cp -p /usr/local/etc/init.d/libvirtd.openrc /etc/init.d/livirtd
-      chmod 755 /etc/init.d/libvirtd
-    args:
-      creates: /etc/init.d/libvirtd
-
-  - name: "/etc/libvirt/qemu.conf"
-    blockinfile:
-      dest: "/etc/libvirt/qemu.conf"
-      create: false
-      marker: "# {mark} ANSIBLE MANAGED BLOCK hostvms vms {{item.name}}"
-      insertafter: '^#* *{{item.name}}.*'
-      block: |
-        {{ item.name }} = {{ item.val }}
-    with_items:
-      - { name: 'migration_address', val: '"0.0.0.0"' }
-      - { name: 'user', val: '"root"' }
-      #? why qemu - serverfault sez must be root for passthrough
-      # root is not enough for passthorugh mounting rw
-      - { name: 'group', val: '"root"' }
-      #? why
-      - { name: 'dynamic_ownership', val: '1' }
-      #??  why
-      # error : virGetUserID:1041 : invalid argument: Failed to parse user 'tss'
-      # - { name: 'swtpm_user', val: '"tss"' }
-      #??  why
-      # error : virGetGroupID:1124 : invalid argument: Failed to parse group 'tss'
-      # - { name: 'swtpm_group', val: '"tss"' }
-      # - { name: '', val: '' }
-    ignore_errors: true
-    # required
-    when: not ansible_check_mode
-
-  - name: "/etc/libvirt/libvirtd.conf"
-    blockinfile:
-      dest: /etc/libvirt/libvirtd.conf
-      create: yes
-      marker: "# {mark} ANSIBLE MANAGED BLOCK hostvms vms {{item.name}}"
-      insertafter: '^#* *{{item.name}}.*'
-      block: |
-        {{ item.name }} = "{{ item.val }}"
-    with_items:
-      #listen_addr = "192.168.0.1"
-      - { name: "listen_addr", val: "127.0.0.1" }
-      #_sock_group = "libvirt"
-      - { name: "unix_sock_group", val: "libvirt" }
-      - { name: "unix_sock_ro_perms", val: "0750" }
-      - { name: "unix_sock_rw_perms", val: "0770" }
-      #ca_file = "/etc/pki/CA/cacert.pem"
-      - { name: "ca_file", val: "{{ PLAY_CA_CERT }}" }
-      - { name: "auth_unix_ro", val: "none" }
-      - { name: "auth_unix_rw", val: "none" }
-      - { name: "log_filters", val: "1:qemu 1:libvirt 4:object 4:json 4:event 1:util" }
-      - { name: "log_outputs", val: "3:file:/var/log/libvirtd.log" }
-      #
-      # - { name: "", val: "" }
-    ignore_errors: true
-    # required
-    when: not ansible_check_mode
-    notify: restart libvirtd
-
-  - name: /etc/modprobe.d/nbd.conf"
-    shell: |
-      file="/etc/modprobe.d/nbd.conf"
-      [ -f $file ] || echo >$file options nbd max_part=16
-    args:
-      creates: /etc/modprobe.d/nbd.conf
-
-  - name: "/etc/default/libvirt-guests"
-    lineinfile:
-      path: /etc/default/libvirt-guests
-      create: yes
-      mode: 0755
-      insertafter: BOF
-      line: '{{item.key}}="{{item.val}}"'
-      regexp: "^#{{item.key}}.*"
-    with_items:
-      - key: ON_BOOT
-        val: ignore
-    when:
-      - "ansible_distribution == 'Debian'"
-
-  - name: /usr/local/sbin/proxy_whonix-libvirt-install.bash
-    shell: |
-      /usr/local/sbin/proxy_whonix-libvirt-install.bash
-    args:
-      creates: /etc/libvirt/qemu/Whonix-Gateway.xml
-
-  when:
-    - ansible_virtualization_role|replace('NA', 'host') == 'host'