diff options
28 files changed, 90 insertions, 165 deletions
diff --git a/ansible/.env.proxmox.example b/ansible/.env.proxmox.example index d8c7a9b..5e712cc 100644 --- a/ansible/.env.proxmox.example +++ b/ansible/.env.proxmox.example @@ -21,7 +21,7 @@ export linux_server_template_name="ubuntu2404-tmpl" # domain details export main_domain_name="contoso.com" export tree_domain_name="labtree.com" -export child_domain_name="child.contoso.com" +export child_domain_name="child" export main_dc01_vmid="5000" export main_dc01_hostname="dc01" diff --git a/ansible/main.yaml b/ansible/main.yaml index f7d5afb..efbaf7f 100644 --- a/ansible/main.yaml +++ b/ansible/main.yaml @@ -60,34 +60,34 @@ ansible_winrm_server_cert_validation: ignore changed_when: false - - name: "deploy {{ child_dc03_hostname }}.{{ child_domain_name }} vm on {{ proxmox_hostname }}" - include_role: - name: proxmox_vm - vars: - os_type : "windows" - template : "{{ windows_server_template_name }}" - id : "{{ windows_server_template_id }}" - vm : "{{ child_dc03_hostname }}.{{ child_domain_name }}" - newid : "{{ child_dc03_vmid }}" - vmid : "{{ child_dc03_vmid }}" - ip : "{{ child_dc03_ip_address }}" - gateway : "{{ network_gateway }}" - dns : "{{ main_dc01_ip_address }}" - hostname : "{{ child_dc03_hostname }}" - domain : "{{ child_domain_name }}" - fqdn : "{{ child_dc03_hostname }}.{{ child_domain_name }}" + - name: "deploy {{ child_dc03_hostname }}.{{ child_domain_name }} vm on {{ proxmox_hostname }}" + include_role: + name: proxmox_vm + vars: + os_type : "windows" + template : "{{ windows_server_template_name }}" + id : "{{ windows_server_template_id }}" + vm : "{{ child_dc03_hostname }}.{{ child_domain_name }}" + newid : "{{ child_dc03_vmid }}" + vmid : "{{ child_dc03_vmid }}" + ip : "{{ child_dc03_ip_address }}" + gateway : "{{ network_gateway }}" + dns : "{{ main_dc01_ip_address }}" + hostname : "{{ child_dc03_hostname }}" + domain : "{{ child_domain_name }}" + fqdn : "{{ child_dc03_hostname }}.{{ child_domain_name }}" - - name: "add {{ child_dc03_hostname }}.{{ child_domain_name }} to in-memory inventory" - add_host: - name : "{{ child_dc03_hostname }}.{{ child_domain_name }}" - ansible_host : "{{ child_dc03_ip_address }}" - ansible_connection : "{{ win_connector }}" - ansible_user : "{{ default_win_username }}" - ansible_password : "{{ default_win_password }}" - ansible_port : "{{ win_port }}" - ansible_winrm_transport : basic - ansible_winrm_server_cert_validation: ignore - changed_when: false + - name: "add {{ child_dc03_hostname }}.{{ child_domain_name }} to in-memory inventory" + add_host: + name : "{{ child_dc03_hostname }}.{{ child_domain_name }}" + ansible_host : "{{ child_dc03_ip_address }}" + ansible_connection : "{{ win_connector }}" + ansible_user : "{{ default_win_username }}" + ansible_password : "{{ default_win_password }}" + ansible_port : "{{ win_port }}" + ansible_winrm_transport : basic + ansible_winrm_server_cert_validation: ignore + changed_when: false - name: "deploy {{ main_linux_srv01_hostname }}.{{ main_domain_name }} vm on {{ proxmox_hostname }}" include_role: diff --git a/ansible/roles/adcs01/tasks/setup_adcs.yaml b/ansible/roles/adcs01/tasks/setup_adcs.yaml index 9c6140e..b5fee4d 100644 --- a/ansible/roles/adcs01/tasks/setup_adcs.yaml +++ b/ansible/roles/adcs01/tasks/setup_adcs.yaml @@ -1,7 +1,7 @@ - name: setup adcs - ansible.windows.win_powershell: - script: C:\scripts\setup-adcs.ps1 - parameters: - DomainName: "{{ main_domain_name }}" - Username: "Administrator" - Password: "{{ default_win_password }}" + ansible.windows.win_shell: > + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\setup-adcs.ps1 + -DomainName "{{ main_domain_name }}" + -Username Administrator + -Password "{{ default_win_password }}" diff --git a/ansible/roles/adcs01/tasks/setup_mssql.yaml b/ansible/roles/adcs01/tasks/setup_mssql.yaml index 4ed0a86..325d946 100644 --- a/ansible/roles/adcs01/tasks/setup_mssql.yaml +++ b/ansible/roles/adcs01/tasks/setup_mssql.yaml @@ -1,8 +1,8 @@ - name: execute setup-mssql.ps1 - ansible.windows.win_powershell: - script: C:\scripts\setup-mssql.ps1 - parameters: - DomainName: "{{ main_domain_name }}" - IISSvcUsername: svc_iis01 - SQLSvcUsername: svc_mssql02 - SvcPassword: "{{ default_win_svc_password }}" + ansible.windows.win_shell: > + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\setup-mssql.ps1 + -DomainName "{{ main_domain_name }}" + -IISSvcUsername svc_iis01 + -SQLSvcUsername svc_mssql02 + -SvcPassword "{{ default_win_svc_password }}" diff --git a/ansible/roles/dc01/tasks/populate_ad.yaml b/ansible/roles/dc01/tasks/populate_ad.yaml index e65ab64..79cc715 100644 --- a/ansible/roles/dc01/tasks/populate_ad.yaml +++ b/ansible/roles/dc01/tasks/populate_ad.yaml @@ -1,7 +1,7 @@ - name: execute populate-ad.ps1 - ansible.windows.win_powershell: - script: C:\scripts\populate-ad.ps1 - parameters: - DomainName: "{{ main_domain_name }}" - UserPassword: "{{ default_win_user_password }}" - SvcPassword: "{{ default_win_svc_password }}" + ansible.windows.win_shell: > + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\populate-ad.ps1 + -DomainName "{{ main_domain_name }}" + -UserPassword "{{ default_win_user_password }}" + -SvcPassword "{{ default_win_svc_password }}" diff --git a/ansible/roles/dc01/tasks/setup_defender_gpo.yaml b/ansible/roles/dc01/tasks/setup_defender_gpo.yaml index 56e7809..2210129 100644 --- a/ansible/roles/dc01/tasks/setup_defender_gpo.yaml +++ b/ansible/roles/dc01/tasks/setup_defender_gpo.yaml @@ -1,5 +1,8 @@ - name: execute setup-defender-gpo.ps1 as domain admin - ansible.windows.win_command: powershell.exe -ExecutionPolicy Bypass -File C:\scripts\setup-defender-gpo.ps1 -DomainName "{{ main_domain_name }}" + ansible.windows.win_shell: > + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\setup-defender-gpo.ps1 + -DomainName "{{ main_domain_name }}" become: yes become_method: runas become_user: "{{ main_domain_name }}\\Administrator" diff --git a/ansible/roles/dc01/tasks/setup_domain.yaml b/ansible/roles/dc01/tasks/setup_domain.yaml index 95c2066..ba6cedb 100644 --- a/ansible/roles/dc01/tasks/setup_domain.yaml +++ b/ansible/roles/dc01/tasks/setup_domain.yaml @@ -1,6 +1,6 @@ - name: execute setup-main-domain.ps1 - ansible.windows.win_powershell: - script: C:\scripts\setup-main-domain.ps1 - parameters: - DomainName: "{{ main_domain_name }}" - SafeModePassword: "{{ default_win_safemode_password }}" + ansible.windows.win_shell: > + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\setup-main-domain.ps1 + -DomainName "{{ main_domain_name }}" + -SafeModePassword "{{ default_win_safemode_password }}" diff --git a/ansible/roles/dc01/tasks/setup_gpo.yaml b/ansible/roles/dc01/tasks/setup_gpo.yaml index fc44130..9b57d0e 100644 --- a/ansible/roles/dc01/tasks/setup_gpo.yaml +++ b/ansible/roles/dc01/tasks/setup_gpo.yaml @@ -1,5 +1,8 @@ - name: execute setup-gpo.ps1 as domain admin - ansible.windows.win_command: powershell.exe -ExecutionPolicy Bypass -File C:\scripts\setup-gpo.ps1 -DomainName "{{ main_domain_name }}" + ansible.windows.win_shell: + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\setup-gpo.ps1 + -DomainName "{{ main_domain_name }}" become: yes become_method: runas become_user: "{{ main_domain_name }}\\Administrator" diff --git a/ansible/roles/dc02/tasks/main.yaml b/ansible/roles/dc02/tasks/main.yaml index 8cdafa8..d0ae664 100644 --- a/ansible/roles/dc02/tasks/main.yaml +++ b/ansible/roles/dc02/tasks/main.yaml @@ -23,6 +23,9 @@ - name: execute dc-wait-for-ready.ps1 import_tasks: wait_for_ready.yaml +- name: execute setup-gpo.ps1 as domain admin + import_tasks: setup_gpo.yaml + - name: execute setup-defender-gpo.ps1 as domain admin import_tasks: setup_defender_gpo.yaml diff --git a/ansible/roles/dc02/tasks/populate_ad.yaml b/ansible/roles/dc02/tasks/populate_ad.yaml deleted file mode 100644 index e65ab64..0000000 --- a/ansible/roles/dc02/tasks/populate_ad.yaml +++ /dev/null @@ -1,7 +0,0 @@ -- name: execute populate-ad.ps1 - ansible.windows.win_powershell: - script: C:\scripts\populate-ad.ps1 - parameters: - DomainName: "{{ main_domain_name }}" - UserPassword: "{{ default_win_user_password }}" - SvcPassword: "{{ default_win_svc_password }}" diff --git a/ansible/roles/dc02/tasks/setup_defender_gpo.yaml b/ansible/roles/dc02/tasks/setup_defender_gpo.yaml index 18d8042..e871b81 100644 --- a/ansible/roles/dc02/tasks/setup_defender_gpo.yaml +++ b/ansible/roles/dc02/tasks/setup_defender_gpo.yaml @@ -1,5 +1,8 @@ - name: execute setup-defender-gpo.ps1 as domain admin - ansible.windows.win_command: powershell.exe -ExecutionPolicy Bypass -File C:\scripts\setup-defender-gpo.ps1 -DomainName "{{ tree_domain_name }}" + ansible.windows.win_shell: + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\setup-defender-gpo.ps1 + -DomainName "{{ tree_domain_name }}" become: yes become_method: runas become_user: "{{ tree_domain_name }}\\Administrator" diff --git a/ansible/roles/dc02/tasks/setup_domain.yaml b/ansible/roles/dc02/tasks/setup_domain.yaml deleted file mode 100644 index ef8a541..0000000 --- a/ansible/roles/dc02/tasks/setup_domain.yaml +++ /dev/null @@ -1,2 +0,0 @@ -- name: execute setup-main-domain.ps1 - ansible.windows.win_command: powershell.exe -ExecutionPolicy Bypass -File C:\scripts\setup-main-domain.ps1 -DomainName "{{ tree_domain_name }}" -SafeModePassword "P4ssw0rd1234!" diff --git a/ansible/roles/dc02/tasks/setup_tree_domain.yaml b/ansible/roles/dc02/tasks/setup_tree_domain.yaml index 2067844..4a41c28 100644 --- a/ansible/roles/dc02/tasks/setup_tree_domain.yaml +++ b/ansible/roles/dc02/tasks/setup_tree_domain.yaml @@ -4,6 +4,6 @@ -File C:\scripts\setup-tree-domain.ps1 -ParentForestRootDomain "{{ main_domain_name }}" -NewTreeDomainName "{{ tree_domain_name }}" - -SafeModePassword "P4ssw0rd1234!" + -SafeModePassword "{{ default_win_safemode_password }}" -Username Administrator -Password "{{ default_win_password }}" diff --git a/ansible/roles/dc03/tasks/main.yaml b/ansible/roles/dc03/tasks/main.yaml index e487caf..63485ba 100644 --- a/ansible/roles/dc03/tasks/main.yaml +++ b/ansible/roles/dc03/tasks/main.yaml @@ -23,6 +23,9 @@ - name: execute dc-wait-for-ready.ps1 import_tasks: wait_for_ready.yaml +- name: execute setup-gpo.ps1 as domain admin + import_tasks: setup_gpo.yaml + - name: execute setup-defender-gpo.ps1 as domain admin import_tasks: setup_defender_gpo.yaml diff --git a/ansible/roles/dc03/tasks/populate_ad.yaml b/ansible/roles/dc03/tasks/populate_ad.yaml deleted file mode 100644 index e65ab64..0000000 --- a/ansible/roles/dc03/tasks/populate_ad.yaml +++ /dev/null @@ -1,7 +0,0 @@ -- name: execute populate-ad.ps1 - ansible.windows.win_powershell: - script: C:\scripts\populate-ad.ps1 - parameters: - DomainName: "{{ main_domain_name }}" - UserPassword: "{{ default_win_user_password }}" - SvcPassword: "{{ default_win_svc_password }}" diff --git a/ansible/roles/dc03/tasks/setup_defender_gpo.yaml b/ansible/roles/dc03/tasks/setup_defender_gpo.yaml index 9813f7b..fe4d6de 100644 --- a/ansible/roles/dc03/tasks/setup_defender_gpo.yaml +++ b/ansible/roles/dc03/tasks/setup_defender_gpo.yaml @@ -1,5 +1,8 @@ - name: execute setup-defender-gpo.ps1 as domain admin - ansible.windows.win_command: powershell.exe -ExecutionPolicy Bypass -File C:\scripts\setup-defender-gpo.ps1 -DomainName "{{ child_domain_name }}" + ansible.windows.win_shell: > + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\setup-defender-gpo.ps1 + -DomainName "{{ child_domain_name }}" become: yes become_method: runas become_user: "{{ child_domain_name }}\\Administrator" diff --git a/ansible/roles/dc03/tasks/setup_domain.yaml b/ansible/roles/dc03/tasks/setup_domain.yaml deleted file mode 100644 index 64ab8c0..0000000 --- a/ansible/roles/dc03/tasks/setup_domain.yaml +++ /dev/null @@ -1,6 +0,0 @@ -- name: execute setup-main-domain.ps1 - ansible.windows.win_powershell: - script: C:\scripts\setup-main-domain.ps1 - parameters: - DomainName: "{{ child_domain_name }}" - SafeModePassword: "{{ default_win_safemode_password }}" diff --git a/ansible/roles/dc03/tasks/setup_gpo.yaml b/ansible/roles/dc03/tasks/setup_gpo.yaml index fc44130..0b25ef9 100644 --- a/ansible/roles/dc03/tasks/setup_gpo.yaml +++ b/ansible/roles/dc03/tasks/setup_gpo.yaml @@ -1,5 +1,8 @@ - name: execute setup-gpo.ps1 as domain admin - ansible.windows.win_command: powershell.exe -ExecutionPolicy Bypass -File C:\scripts\setup-gpo.ps1 -DomainName "{{ main_domain_name }}" + ansible.windows.win_shell: > + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\setup-gpo.ps1 + -DomainName "{{ main_domain_name }}" become: yes become_method: runas become_user: "{{ main_domain_name }}\\Administrator" diff --git a/ansible/roles/mssql02/tasks/cleanup.yaml b/ansible/roles/mssql02/tasks/cleanup.yaml deleted file mode 100644 index 0e59407..0000000 --- a/ansible/roles/mssql02/tasks/cleanup.yaml +++ /dev/null @@ -1,3 +0,0 @@ -- name: execute cleanup.ps1 - ansible.windows.win_powershell: - script: C:\scripts\cleanup.ps1 diff --git a/ansible/roles/mssql02/tasks/init.yaml b/ansible/roles/mssql02/tasks/init.yaml deleted file mode 100644 index a75d6cc..0000000 --- a/ansible/roles/mssql02/tasks/init.yaml +++ /dev/null @@ -1,9 +0,0 @@ -- name: execute init.ps1 - ansible.windows.win_powershell: - script: C:\scripts\init.ps1 - -- name: copy mssql installer - ansible.builtin.copy: - src: files/SQL2019-SSEI-Expr.exe - dest: C:\setup\SQL2019-SSEI-Expr.exe - diff --git a/ansible/roles/mssql02/tasks/install_software.yaml b/ansible/roles/mssql02/tasks/install_software.yaml deleted file mode 100644 index a5018a8..0000000 --- a/ansible/roles/mssql02/tasks/install_software.yaml +++ /dev/null @@ -1,3 +0,0 @@ -- name: execute install-software.ps1 - ansible.windows.win_powershell: - script: C:\scripts\install-software.ps1 diff --git a/ansible/roles/mssql02/tasks/join_domain.yaml b/ansible/roles/mssql02/tasks/join_domain.yaml deleted file mode 100644 index 6736ba2..0000000 --- a/ansible/roles/mssql02/tasks/join_domain.yaml +++ /dev/null @@ -1,13 +0,0 @@ -- name: join domain - ansible.windows.win_domain_membership: - dns_domain_name: "{{ main_domain_name }}" - domain_admin_user: "{{ main_domain_name }}\\Administrator" - domain_admin_password: "{{ default_win_password }}" - state: domain - register: domain_state - -- name: reboot - win_reboot: - reboot_timeout: 3600 - when: domain_state.reboot_required - diff --git a/ansible/roles/mssql02/tasks/main.yaml b/ansible/roles/mssql02/tasks/main.yaml deleted file mode 100644 index 3822369..0000000 --- a/ansible/roles/mssql02/tasks/main.yaml +++ /dev/null @@ -1,34 +0,0 @@ -- name: wait for winrm to be available - ansible.builtin.wait_for: - host: "{{ ansible_host }}" - port: "{{ ansible_port }}" - timeout: 300 - delegate_to: localhost - -- name: execute init.ps1 - import_tasks: init.yaml - -- name: set hostname - import_tasks: set_hostname.yaml - -- name: reboot after hostname change - import_tasks: reboot.yaml - -- name: join domain and reboot - import_tasks: join_domain.yaml - -- name: execute setup-mssql.ps1 - import_tasks: setup_mssql.yaml - -- name: reboot after mssql setup - import_tasks: reboot.yaml - -- name: pause 5 minutes for mssql setup to complete - pause: - minutes: 5 - -- name: execute install-software.ps1 - import_tasks: install_software.yaml - -- name: execute cleanup.ps1 - import_tasks: cleanup.yaml diff --git a/ansible/roles/mssql02/tasks/reboot.yaml b/ansible/roles/mssql02/tasks/reboot.yaml deleted file mode 100644 index a7266d0..0000000 --- a/ansible/roles/mssql02/tasks/reboot.yaml +++ /dev/null @@ -1,3 +0,0 @@ -- name: reboot - win_reboot: - reboot_timeout: 3600 diff --git a/ansible/roles/mssql02/tasks/set_hostname.yaml b/ansible/roles/mssql02/tasks/set_hostname.yaml deleted file mode 100644 index ffea2ae..0000000 --- a/ansible/roles/mssql02/tasks/set_hostname.yaml +++ /dev/null @@ -1,2 +0,0 @@ -- name: set hostname - win_shell: Rename-Computer -NewName "{{ main_mssql02_hostname }}" -Force diff --git a/ansible/roles/mssql02/tasks/setup_mssql.yaml b/ansible/roles/mssql02/tasks/setup_mssql.yaml deleted file mode 100644 index a219c82..0000000 --- a/ansible/roles/mssql02/tasks/setup_mssql.yaml +++ /dev/null @@ -1,7 +0,0 @@ -- name: execute setup-mssql.ps1 - ansible.windows.win_powershell: - script: C:\scripts\setup-mssql.ps1 - parameters: - DomainName: "{{ main_domain_name }}" - SvcUsername: svc_mssql02 - SvcPassword: "{{ default_win_svc_password }}" diff --git a/ansible/roles/websql01/tasks/setup_mssql_link.yaml b/ansible/roles/websql01/tasks/setup_mssql_link.yaml index 4320889..8e54ed8 100644 --- a/ansible/roles/websql01/tasks/setup_mssql_link.yaml +++ b/ansible/roles/websql01/tasks/setup_mssql_link.yaml @@ -1,5 +1,5 @@ - name: execute setup-mssql-link.ps1 - ansible.windows.win_powershell: - script: C:\scripts\setup-mssql-link.ps1 - parameters: - LinkServer: adcs01 + ansible.windows.win_shell: > + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\setup-mssql-link.ps1 + -LinkServer "{{ main_adcs01_hostname }}" diff --git a/ansible/roles/websql01/tasks/setup_websql.yaml b/ansible/roles/websql01/tasks/setup_websql.yaml index 7e535d8..bb624b7 100644 --- a/ansible/roles/websql01/tasks/setup_websql.yaml +++ b/ansible/roles/websql01/tasks/setup_websql.yaml @@ -1,8 +1,8 @@ - name: setup websql - ansible.windows.win_powershell: - script: C:\scripts\setup-websql.ps1 - parameters: - DomainName: "{{ main_domain_name }}" - IISSvcUsername: svc_iis01 - SQLSvcUsername: svc_mssql01 - SvcPassword: "{{ default_win_svc_password }}" + ansible.windows.win_shell: > + powershell.exe -ExecutionPolicy Bypass + -File C:\scripts\setup-websql.ps1 + -DomainName "{{ main_domain_name }}" + -IISSvcUsername svc_iis01 + -SQLSvcUsername svc_mssql01 + -SvcPassword "{{ default_win_svc_password }}" |