initial commit

roles/common/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart chronyd
+  ansible.builtin.systemd:
+    name: chronyd
+    state: restarted

roles/common/tasks/main.yml

@@ -0,0 +1,75 @@
+---
+- name: Install base packages
+  ansible.builtin.dnf:
+    name:
+      - curl
+      - vim-enhanced
+      - chrony
+      - firewalld
+      - sudo
+      - tar
+      - policycoreutils-python-utils
+    state: present
+  tags: [common]
+
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ timezone }}"
+  tags: [common]
+
+- name: Deploy chrony configuration
+  ansible.builtin.template:
+    src: chrony.conf.j2
+    dest: /etc/chrony.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart chronyd
+  tags: [common]
+
+- name: Enable and start chronyd
+  ansible.builtin.systemd:
+    name: chronyd
+    enabled: true
+    state: started
+  tags: [common]
+
+- name: Set hostname from inventory
+  ansible.builtin.hostname:
+    name: "{{ inventory_hostname }}"
+  tags: [common]
+
+- name: Enable and start firewalld
+  ansible.builtin.systemd:
+    name: firewalld
+    enabled: true
+    state: started
+  tags: [common]
+
+- name: Set default firewalld zone
+  ansible.builtin.command: "firewall-cmd --set-default-zone={{ firewall_default_zone }}"
+  changed_when: true
+  tags: [common]
+
+- name: Allow SSH from the administration subnet
+  ansible.posix.firewalld:
+    zone: "{{ firewall_default_zone }}"
+    rich_rule: >-
+      rule family="ipv4" source address="{{ firewall_admin_subnet }}"
+      port protocol="tcp" port="22" accept
+    permanent: true
+    immediate: true
+    state: enabled
+  tags: [common]
+
+- name: Check available memory meets the minimum requirement
+  ansible.builtin.assert:
+    that:
+      - ansible_facts['memtotal_mb'] >= common_min_memory_mb
+    fail_msg: >-
+      {{ inventory_hostname }} has {{ ansible_facts['memtotal_mb'] }} MB RAM,
+      below the configured minimum of {{ common_min_memory_mb }} MB
+      (common_min_memory_mb). Both AWX/k3s and GitLab are memory-hungry;
+      review sizing before continuing.
+    success_msg: "Memory check passed ({{ ansible_facts['memtotal_mb'] }} MB available)."
+  tags: [common]

roles/common/templates/chrony.conf.j2

@@ -0,0 +1,9 @@
+# {{ ansible_managed }}
+{% for server in ntp_servers %}
+server {{ server }} iburst
+{% endfor %}
+
+driftfile /var/lib/chrony/drift
+makestep 1.0 3
+rtcsync
+logdir /var/log/chrony