You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

149 lines
3.6 KiB

---
- name: Remove old kernels
ansible.builtin.shell: dnf remove -y $(dnf repoquery --installonly --latest-limit=-1 -q)
- name: Delete DNF cache
ansible.builtin.command: dnf clean all
- name: Find DNF history files
ansible.builtin.find:
paths: /var/lib/dnf
patterns: "history*"
register: dnf_history
- name: Reset DNF history
ansible.builtin.file:
path: "{{ item.path }}"
state: absent
loop: "{{ dnf_history.files }}"
- name: Find temporary files
ansible.builtin.find:
file_type: any
paths:
- /tmp
- /var/tmp
patterns: '*'
register: tmp_files
- name: Remove temporary files
ansible.builtin.file:
path: "{{ item.path }}"
state: absent
loop: "{{ tmp_files.files }}"
- name: Find SSH host keys
ansible.builtin.find:
paths: /etc/ssh
patterns: '*host*key*'
register: host_keys
- name: Remove SSH host keys
ansible.builtin.file:
path: "{{ item.path }}"
state: absent
loop: "{{ host_keys.files }}"
- name: Remove kickstart files
ansible.builtin.file:
path: "{{ item }}"
state: absent
loop:
- /root/anaconda-ks.cfg
- /root/original-ks.cfg
- name: Truncate files
ansible.builtin.command: "truncate -s 0 {{ item }}"
loop:
- /etc/machine-id
- /etc/resolv.conf
- /var/log/audit/audit.log
- /var/log/wtmp
- /var/log/lastlog
- /var/log/btmp
- /var/log/cron
- /var/log/maillog
- /var/log/messages
- /var/log/secure
- /var/log/spooler
- name: Remove log folders.
ansible.builtin.file:
path: "{{ item }}"
state: absent
loop:
- /var/log/anaconda
- /var/log/qemu-ga
- /var/log/tuned
- /var/lib/cloud
- /etc/hostname
- /etc/machine-info
- /var/lib/systemd/credential.secret
- name: Find log files.
ansible.builtin.find:
paths:
- /var/log
- /var/log/sssd
patterns: '*log,*.old,*.log.gz,*.[0-9],*.gz,*-????????'
register: log_files
- name: Remove log files
ansible.builtin.file:
path: "{{ item.path }}"
state: absent
loop: "{{ log_files.files }}"
- name: Remove random-seed
ansible.builtin.file:
path: /var/lib/systemd/random-seed
state: absent
- name: Disable root SSH login via password
ansible.builtin.file:
path: /etc/ssh/sshd_config.d/01-permitrootlogin.conf
state: absent
when: ansible_facts['distribution_major_version'] == '9'
- name: Fill free space with zeroes
ansible.builtin.shell: dd if=/dev/zero of=/zeroed_file bs=1M oflag=direct || rm -f /zeroed_file
- name: Detect swap partition
ansible.builtin.command: grep -oP '^/dev/[\w-]+' /proc/swaps
register: swaps
ignore_errors: true
- name: Wipe out swap data
block:
- name: Get swap partition UUID
ansible.builtin.command: "blkid {{ swaps.stdout }} -s UUID -o value"
register: swap_blkid
- name: Unmount swap partition
ansible.builtin.command: "swapoff {{ swaps.stdout }}"
- name: Fill swap partition with zeroes
ansible.builtin.shell: "dd if=/dev/zero of={{ swaps.stdout }} bs=1M oflag=direct || /bin/true"
- name: Format swap partition
ansible.builtin.command: "mkswap -U {{ swap_blkid.stdout }} -f {{ swaps.stdout }}"
- name: Mount swap partition
ansible.builtin.command: "swapon {{ swaps.stdout }}"
when: swaps.rc == 0
- name: Sync disc
ansible.builtin.command: sync
- name: Clear shell history
ansible.builtin.shell: history -c
- name: Check if WALinuxAgent is installed
ansible.builtin.stat:
path: /usr/sbin/waagent
register: cleanup_vm_waagent
- name: Deprovision WALinuxAgent
ansible.builtin.command: waagent -deprovision+user -force
when: cleanup_vm_waagent.stat.exists