cups_server: Rename role

roles/cups_server/tasks/main.yml

@@ -0,0 +1,139 @@
+---
+- name: install cups packages
+  package:
+    name: cups
+    state: installed
+
+- name: create cups systemd override directory
+  file:
+    path: /etc/systemd/system/cups.service.d
+    state: directory
+    mode: 0755
+    owner: root
+    group: "{{ ansible_wheel }}"
+
+- name: configure cups keytab location
+  copy:
+    dest: /etc/systemd/system/cups.service.d/keytab.conf
+    content: "[Service]\nEnvironment=KRB5_KTNAME=FILE:/etc/cups/cups.keytab\n"
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+
+- name: enable gssapi authentication from cups
+  lineinfile:
+    path: /etc/cups/cupsd.conf
+    regexp: "^DefaultAuthType .*"
+    line: "DefaultAuthType Negotiate"
+  notify: restart cups
+
+- name: disable cups plain text port
+  lineinfile:
+    path: /etc/cups/cupsd.conf
+    regexp: "^#?Listen (.*:)?631"
+    line: "#Listen 631"
+  notify: restart cups
+
+- name: set ssl listen port
+  lineinfile:
+    path: /etc/cups/cupsd.conf
+    line: "SSLListen 631"
+    insertafter: "Listen /var/run/cups/cups.sock"
+  notify: restart cups
+
+- name: require tls 1.3
+  lineinfile:
+    path: /etc/cups/cupsd.conf
+    line: "SSLOptions MinTLS1.3"
+    insertafter: "SSLListen 631"
+  notify: restart cups
+
+- name: write all requests to cups access log
+  lineinfile:
+    path: /etc/cups/cupsd.conf
+    line: "AccessLogLevel all"
+    insertafter: "LogLevel warn"
+  notify: restart cups
+
+- name: disable printer advertisements
+  lineinfile:
+    path: /etc/cups/cupsd.conf
+    regexp: "^BrowseLocalProtocols .*"
+    line: "BrowseLocalProtocols none"
+  notify: restart cups
+
+- name: link private key
+  file:
+    dest: "/etc/cups/ssl/{{ inventory_hostname }}.key"
+    src: "{{ tls_private }}/{{ inventory_hostname }}.key"
+    state: link
+    owner: root
+    group: "{{ ansible_wheel }}"
+    follow: false
+    force: true
+  notify: restart cups
+
+- name: link certificate
+  file:
+    dest: "/etc/cups/ssl/{{ inventory_hostname }}.crt"
+    src: "{{ tls_certs }}/{{ inventory_hostname }}.crt"
+    state: link
+    owner: root
+    group: "{{ ansible_wheel }}"
+    follow: false
+    force: true
+  notify: restart cups
+
+- name: disable printer advertising
+  lineinfile:
+    path: /etc/cups/cupsd.conf
+    regexp: "^Browsing .*"
+    line: "Browsing No"
+  notify: restart cups
+
+- name: disable unauthenticated access from cups
+  blockinfile:
+    path: /etc/cups/cupsd.conf
+    insertafter: "^<Location />"
+    block: |
+      AuthType Default
+      Require user @foosh
+  notify: restart cups
+
+- name: configure cups admin group
+  lineinfile:
+    path: /etc/cups/cups-files.conf
+    regexp: "^SystemGroup .*"
+    line: "SystemGroup root sysadm"
+  notify: restart cups
+
+- name: add static files to cups web interface
+  copy:
+    dest: "/usr/share/cups/www/{{ item }}"
+    src: "{{ item }}"
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+  with_items:
+    - logo.png
+    - local.css
+
+- name: create custom header for cups web interface
+  copy:
+    dest: /usr/share/cups/templates/header.tmpl
+    src: header.tmpl
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+
+- name: disable cups socket service
+  systemd:
+    name: cups.socket
+    enabled: false
+    state: stopped
+
+- name: enable cups service
+  service:
+    name: cups
+    enabled: true
+    state: started