Merge branch 'master' into bullseye

defaults/main.yml

@@ -15,7 +15,7 @@ install_docker: true
 upgrade: true
 reboot: true
 pip_executable_install: pip
-registry: https://registry.mycard.moe
+registry: https://registry.moecube.com
 china_mirror_docker: false
 china_mirror_pip: false
 china_mirror_omf: false
@@ -24,3 +24,9 @@ vm_agents_status: present
 customization: true
 nvidia_driver_version: null
 cloud_kernel: auto # or enabled / disabled
+xanmod: false
+railgun:
+  destination: oversea
+  remoteGatewayId: 31
+laptop: false
+extra_params: []

handlers/main.yml

@@ -15,3 +15,8 @@
   systemd:
     name: docker
     state: restarted
+- name: restart_logind
+  become: true
+  systemd:
+    name: systemd-logind
+    state: restarted

tasks/apt.yml

-- name: apt
+- name: install aptitude first
   become: true
   apt:
     update_cache: true
-    name: curl,wget,git,vim,sudo,byobu,iftop,iotop,build-essential,p7zip-full,p7zip-rar,xclip,astyle,tcpdump,rsync,htop,locales,mtr,dnsutils,net-tools,traceroute,tar,unzip,iperf,iperf3,nmap,mosh,subversion,nfs-common,fish,haveged,iptables,ipset,iproute2,python3-setuptools,python3-dev,python3-pip,wireguard-tools
+    name: aptitude
+- name: apt
+  become: true
+  apt:
+    # update_cache: true
+    name: curl,wget,git,vim,sudo,byobu,iftop,iotop,build-essential,p7zip-full,p7zip-rar,xclip,astyle,tcpdump,rsync,htop,locales,mtr,dnsutils,net-tools,traceroute,tar,unzip,iperf,iperf3,nmap,mosh,subversion,nfs-common,fish,haveged,iptables,ipset,iproute2,python3-setuptools,python3-dev,python3-pip,wireguard-tools,zstd
 - name: ctags in old Ubuntu
   become: true
   apt:
     name: exuberant-ctags
-  when: ansible_distribution == 'Ubuntu' and ansible_distribution_release != 'focal'
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version|int < 20
 - name: remove old ctags
   become: true
   apt:
@@ -15,22 +20,22 @@
     state: absent
     purge: true
     autoremove: true
-  when: ansible_distribution == 'Debian' or ansible_distribution_release == 'focal'
+  when: ansible_distribution == 'Debian' or ansible_distribution_major_version|int >= 20
 - name: ctags in new Ubuntu and Debian
   become: true
   apt:
     name: universal-ctags
-  when: ansible_distribution == 'Debian' or ansible_distribution_release == 'focal'
+  when: ansible_distribution == 'Debian' or ansible_distribution_major_version|int >= 20
 - name: non-focal packages
   become: true
   apt:
     name: python-setuptools,python-dev,python-pip
-  when: ansible_distribution_release != 'focal' and ansible_distribution_release != 'sid'
+  when: ansible_distribution_major_version|int < 20 and ansible_distribution_release != 'sid'
 - name: focal packages
   become: true
   apt:
     name: python-is-python3
-  when: ansible_distribution_release == 'focal'
+  when: ansible_distribution_major_version|int >= 20
 - name: pve kernel header
   become: true
   apt:

tasks/dnf.yml

@@ -15,7 +15,7 @@
 - name: dnf
   become: true
   dnf:
-    name: curl,wget,git,vim,sudo,byobu,iftop,iotop,gcc,gcc-c++,make,autoconf,p7zip,p7zip-plugins,python3-pip,python3-devel,tcpdump,rsync,htop,mtr,net-tools,ctags,astyle,xclip,traceroute,tar,unzip,nmap,python3-libselinux,mosh,subversion,haveged,nfs-utils,ipset,fish,wireguard-tools # nfs-common,fish
+    name: curl,wget,git,vim,sudo,byobu,iftop,iotop,gcc,gcc-c++,make,autoconf,p7zip,p7zip-plugins,python3-pip,python3-devel,tcpdump,rsync,htop,mtr,net-tools,ctags,astyle,xclip,traceroute,tar,unzip,nmap,python3-libselinux,mosh,subversion,haveged,nfs-utils,ipset,fish,wireguard-tools,zstd # nfs-common,fish
     update_cache: yes
 - name: Fedora packages
   become: true

tasks/docker.yml

@@ -44,14 +44,21 @@
   become: true
   apt:
     name: python-backports-shutil-get-terminal-size,python-backports.ssl-match-hostname
-  when: ansible_os_family == 'Debian' and ansible_distribution_release != 'sid' and ansible_distribution_release != 'focal'
+  when: ansible_os_family == 'Debian' and ansible_distribution_release != 'sid' and ansible_distribution_major_version|int < 20
 - name: clean yum Docker
   become: true
   yum:
     name: docker,docker-client,docker-client-latest,docker-common,docker-latest,docker-latest-logrotate,docker-logrotate,docker-engine
     state: absent
     autoremove: yes
-  when: ansible_os_family == "RedHat"
+  when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 7 and ansible_python.version.major == 2
+- name: clean dnf Docker
+  become: true
+  dnf:
+    name: docker,docker-client,docker-client-latest,docker-common,docker-latest,docker-latest-logrotate,docker-logrotate,docker-engine
+    state: absent
+    autoremove: yes
+  when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int >= 8 and ansible_distribution != 'Fedora'
 - name: docker yum 源
   become: true
   yum_repository:
@@ -60,27 +67,20 @@
     baseurl: '{{mirror_docker}}/linux/{{ ansible_distribution|lower }}/{{ansible_distribution_major_version}}/$basearch/stable'
     ip_resolve: 'IPv4'
     gpgkey: '{{mirror_docker}}/linux/{{ ansible_distribution|lower }}/gpg'
-  when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int <= 8
+  when: ansible_os_family == "RedHat"
 - name: 安装 Docker (yum)
   become: true
   yum:
     name: docker-ce,docker-ce-cli,containerd.io
     update_cache: yes
-  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int == 7
+  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int == 7 and ansible_python.version.major == 2
   notify: restart_docker
 - name: 安装 Docker (dnf)
   become: true
   dnf:
     name: docker-ce,docker-ce-cli,containerd.io
     update_cache: yes
-  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int >= 8 and ansible_distribution != 'Fedora'
-  notify: restart_docker
-- name: 安装 Docker (Fedora)
-  become: true
-  dnf:
-    name: moby-engine
-    update_cache: yes
-  when: ansible_distribution == 'Fedora'
+  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int >= 8
   notify: restart_docker
 - name: docker user group
   become: true

tasks/fish.yml

@@ -13,7 +13,7 @@
   args:
     creates: '~/.local/share/omf'
 - name: 终端环境 fish omf China
-  shell: curl -L https://minio.mycard.moe:9000/nanahira/install_fish | fish
+  shell: curl -L https://cdn01.moecube.com/init/install_fish | fish
   environment:
     NONINTERACTIVE: true
     ASSUME_YES: true
@@ -35,4 +35,4 @@
     src: /usr/share/fish/vendor_completions.d/docker.fish
     dest: '~/.config/fish/completions/docker.fish'
     remote_src: yes
-  when: install_docker and ansible_distribution_release != 'focal' and ansible_distribution != 'Fedora'
+  when: install_docker and ansible_distribution != 'Fedora'

tasks/kernel/CentOS.yml

@@ -46,12 +46,12 @@
     update_cache: yes
     name: epel-release,elrepo-release
   when: ansible_distribution_major_version|int >= 8
-- name: dnf plugin
-  become: true
-  dnf:
-    update_cache: yes
-    name: dnf-plugin-elrepo
-  when: ansible_distribution_major_version|int >= 8
+#- name: dnf plugin
+#  become: true
+#  dnf:
+#    update_cache: yes
+#    name: dnf-plugin-elrepo
+#  when: ansible_distribution_major_version|int >= 8
 - name: dnf install kernel
   become: true
   dnf:

tasks/kernel/Debian-after.yml

+- name: check RTL8111
+  shell: 'lspci | grep RTL8111'
+  register: check_rtl_result
+  changed_when: false
+  failed_when: 'check_rtl_result.rc > 1'
+- name: install RTL8111 driver
+  become: true
+  apt:
+    name: r8168-dkms
+    default_release: '{{ target_distribution }}-backports'
+  when: check_rtl_result.rc == 0 and ansible_distribution_release != 'sid'
+- name: install RTL8111 driver for sid
+  become: true
+  apt:
+    name: r8168-dkms
+  when: check_rtl_result.rc == 0 and ansible_distribution_release == 'sid'
+- name: check b43
+  shell: 'lspci | grep BCM4322'
+  register: check_b43_result
+  changed_when: false
+  failed_when: 'check_b43_result.rc > 1'
+- name: install b43 driver
+  become: true
+  apt:
+    name: firmware-b43-installer
+  when: check_b43_result.rc == 0
+- name: remove wireguard-dkms
+  become: true
+  apt:
+    name: wireguard-dkms
+    state: absent
+    purge: true

tasks/kernel/Debian.yml

@@ -22,35 +22,3 @@
     update_cache: true
     default_release: '{{ target_distribution }}-backports'
   when: ansible_distribution_release != 'sid'
-- name: check RTL8111
-  shell: 'lspci | grep RTL8111'
-  register: check_rtl_result
-  changed_when: false
-  failed_when: 'check_rtl_result.rc > 1'
-- name: install RTL8111 driver
-  become: true
-  apt:
-    name: r8168-dkms
-    default_release: '{{ target_distribution }}-backports'
-  when: check_rtl_result.rc == 0 and ansible_distribution_release != 'sid'
-- name: install RTL8111 driver for sid
-  become: true
-  apt:
-    name: r8168-dkms
-  when: check_rtl_result.rc == 0 and ansible_distribution_release == 'sid'
-- name: check b43
-  shell: 'lspci | grep BCM4322'
-  register: check_b43_result
-  changed_when: false
-  failed_when: 'check_b43_result.rc > 1'
-- name: install b43 driver
-  become: true
-  apt:
-    name: firmware-b43-installer
-  when: check_b43_result.rc == 0
-- name: remove wireguard-dkms
-  become: true
-  apt:
-    name: wireguard-dkms
-    state: absent
-    purge: true

tasks/kernel/entry.yml

+- name: install xanmod
+  include_tasks: 'xanmod.yml'
+  when: xanmod and ansible_os_family == 'Debian'
+- name: upgrade kernel
+  include_tasks: '{{ansible_distribution}}.yml'
+  when: (ansible_distribution == 'Debian' and not xanmod and not ansible_kernel.endswith("-pve")) or ansible_distribution == 'CentOS'
+- name: Debian after tasks
+  include_tasks: 'Debian-after.yml'
+  when: ansible_os_family == 'Debian'
+- name: make linux fast again
+  include_tasks: 'fast-again.yml'
+  when: ansible_os_family == 'Debian'

tasks/kernel/fast-again.yml

+- name: grub block
+  become: true
+  blockinfile:
+    path: /etc/default/grub
+    marker: '# {mark} MyCard Init block'
+    block: |
+      MYCARD_INIT_KERNEL_PARAMS=""
+      ## add make-linux-fast-again params
+      MAKE_LINUX_FAST_AGAIN_PARAMS="noibrs noibpb nopti nospectre_v2 nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off tsx=on tsx_async_abort=off mitigations=off"
+      MYCARD_INIT_KERNEL_PARAMS="$MYCARD_INIT_KERNEL_PARAMS $MAKE_LINUX_FAST_AGAIN_PARAMS"
+      {% for param in extra_params %}
+      ## add custom param {{param}}
+      MYCARD_INIT_KERNEL_PARAMS="$MYCARD_INIT_KERNEL_PARAMS {{param}}"
+      {% endfor %}
+      ## set params
+      GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT $MYCARD_INIT_KERNEL_PARAMS"
+  register: grub_block_result
+- name: update-grub
+  become: true
+  shell: update-grub
+  when: grub_block_result.changed

tasks/kernel/xanmod.yml

+- name: gnupg
+  become: true
+  apt:
+    name: gnupg2
+- name: xanmod apt key
+  become: true
+  apt_key:
+    url: 'https://dl.xanmod.org/gpg.key'
+- name: xanmod apt source
+  become: true
+  apt_repository:
+    repo: 'deb http://deb.xanmod.org releases main'
+    filename: xanmod-kernel
+- name: install xanmod kernel
+  become: true
+  apt:
+    name: linux-xanmod
+    state: latest
+    update_cache: true
+- name: install intel microcode
+  become: true
+  apt:
+    name: intel-microcode,iucode-tool
+    state: latest
+  when: '"GenuineIntel" in ansible_processor'
+- name: install amd microcode
+  become: true
+  apt:
+    name: amd64-microcode
+    state: latest
+  when: '"AuthenticAMD" in ansible_processor'

tasks/main.yml

@@ -12,6 +12,9 @@
 - name: add swap
   include_tasks: 'swapon.yml'
   when: 'ansible_memtotal_mb < 1024 and not swap_result.stdout'
+- name: railgun
+  include_tasks: 'railgun.yml'
+  when: railgun
 - name: upgrade
   include_tasks: 'upgrade.yml'
   when: upgrade
@@ -27,7 +30,7 @@
   when: ansible_os_family == 'Debian'
 - name: yum
   include_tasks: yum.yml
-  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int == 7
+  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int == 7 and ansible_python.version.major == 2
 - name: dnf
   include_tasks: dnf.yml
   when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int >= 8

tasks/nvidia.yml

@@ -5,11 +5,11 @@
 - name: set distribution string
   set_fact:
     container_runtime_distribution_string: '{{ ansible_distribution | lower }}{{ ansible_distribution_version }}'
-  when: ansible_distribution_release != 'focal'
+  when: ansible_distribution_major_version|int < 20
 - name: set distribution string for Ubuntu 20
   set_fact:
     container_runtime_distribution_string: 'ubuntu18.04'
-  when: ansible_distribution_release == 'focal'
+  when: ansible_distribution_major_version|int >= 20
 - name: container runtime apt repo
   become: true
   apt_repository:
@@ -46,14 +46,14 @@
   find:
     paths:
       - /usr/lib/x86_64-linux-gnu
-    patterns: 'libcudnn.so.7*'
+    patterns: 'libcudnn.so.8.0.5'
   register: cudnn_result
 - name: install cudnn
   become: true
   apt:
-    deb: 'https://minio.mycard.moe:9000/nanahira/cudnn/{{item}}.deb'
+    deb: 'https://cdn01.moecube.com/nanahira/cudnn/{{item}}'
   with_items:
-    - libcudnn7_7.6.5.32-1+cuda10.1_amd64
-    - libcudnn7-dev_7.6.5.32-1+cuda10.1_amd64
-    - libcudnn7-doc_7.6.5.32-1+cuda10.1_amd64
+    - libcudnn8_8.0.5.39-1+cuda10.1_amd64.deb
+    - libcudnn8-dev_8.0.5.39-1+cuda10.1_amd64.deb
+    - libcudnn8-samples_8.0.5.39-1+cuda10.1_amd64.deb
   when: not cudnn_result.files[0] is defined and ansible_distribution == "Ubuntu" and ansible_distribution_major_version|int >= 18

tasks/railgun.yml

+- name: railgun
+  uri:
+    url: https://m.lv5.ac/api/select
+    method: 'POST'
+    body_format: json
+    body: '{{railgun}}'
+    return_content: true
+    status_code:
+      - 200
+      - 201
+  changed_when: false
+  ignore_errors: true

tasks/swapon.yml

@@ -6,7 +6,7 @@
     creates: /swapfile
 - name: swap fstab
   become: true
-  lineinfile:
+  blockinfile:
     path: /etc/fstab
-    line: '/swapfile none swap defaults 0 0'
-    insertafter: 'EOF'
+    block: '/swapfile none swap defaults 0 0'
+    marker: '# {mark} MyCard Init block'

tasks/sysctl.yml

@@ -34,14 +34,21 @@
     name: net.core.default_qdisc
     value: fq
     sysctl_set: true
-  when: ansible_kernel.startswith("5.") or ansible_kernel.startswith("4.9.") or (ansible_kernel.startswith("4.1") and not ansible_kernel.startswith("4.1."))
+  when: ansible_kernel.startswith("5.") or ansible_kernel.startswith("4.9.") or (ansible_kernel.startswith("4.1") and not ansible_kernel.startswith("4.1.")) and ansible_kernel.find("xanmod") == -1
+- name: TCP BBR with xanmod
+  become: true
+  sysctl:
+    name: net.core.default_qdisc
+    value: fq_pie
+    sysctl_set: true
+  when: ansible_kernel.find("xanmod") != -1
 - name: TCP BBR
   become: true
   sysctl:
     name: net.ipv4.tcp_congestion_control
     value: bbr
     sysctl_set: true
-  when: ansible_kernel.startswith("5.") or ansible_kernel.startswith("4.9.") or (ansible_kernel.startswith("4.1") and not ansible_kernel.startswith("4.1."))
+  when: ansible_kernel.startswith("5.") or ansible_kernel.startswith("4.9.") or (ansible_kernel.startswith("4.1") and not ansible_kernel.startswith("4.1.")) or ansible_kernel.find("xanmod") != -1
 - name: limit
   become: true
   pam_limits:

tasks/upgrade.yml

@@ -10,7 +10,7 @@
     name: '*'
     update_cache: true
     state: latest
-  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int == 7
+  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int == 7 and ansible_python.version.major == 2
 - name: dnf update
   become: true
   dnf:
@@ -30,8 +30,8 @@
     install_recommends: false
   when: nvidia_driver_version
 - name: upgrade kernel
-  include_tasks: 'kernel/{{ansible_distribution}}.yml'
-  when: (ansible_distribution == 'Debian' or ansible_distribution == 'CentOS') and ansible_virtualization_type != "docker"
+  include_tasks: 'kernel/entry.yml'
+  when: ansible_virtualization_type != "docker"
 - name: redhat configures before reboot
   include_tasks: redhat_configures.yml
   when: ansible_os_family == 'RedHat'

tasks/utility.yml

@@ -19,10 +19,10 @@
   when: inventory_hostname_short != '10' and inventory_hostname_short != '172' and inventory_hostname_short != '192'
 - name: hostname hosts
   become: true
-  lineinfile:
-    dest: /etc/hosts
-    regexp: "^{{ ansible_default_ipv4.address }}"
-    line: "{{ ansible_default_ipv4.address }} {{ inventory_hostname }} {{ inventory_hostname_short }}"
+  blockinfile:
+    path: /etc/hosts
+    marker: '# {mark} MyCard Init block'
+    block: "{{ ansible_default_ipv4.address }} {{ inventory_hostname }} {{ inventory_hostname_short }}"
   when: inventory_hostname_short != '10' and inventory_hostname_short != '172' and inventory_hostname_short != '192'
 - name: clean aliyun
   become: true
@@ -100,10 +100,29 @@
     state: absent
     autoremove: yes
     purge: yes
-  when: ansible_distribution == 'Ubuntu' and upgrade and ansible_distribution_release != 'focal'
+  when: ansible_distribution == 'Ubuntu' and upgrade and ansible_distribution_major_version|int < 20
+- name: remove not proper installed wireguard
+  become: true
+  apt:
+    name: wireguard,wireguard-tools,wireguard-dkms
+    state: absent
+    autoremove: yes
+    purge: yes
+  when: ansible_distribution == 'Ubuntu' and upgrade and ansible_distribution_major_version|int < 20
 - name: remove not proper installed wireguard repo
   become: true
   file:
     path: '/etc/apt/sources.list.d/wireguard_ubuntu_wireguard_{{ ansible_distribution_release|lower }}.list'
     state: absent
-  when: ansible_distribution == 'Ubuntu' and (upgrade or ansible_distribution_release == 'focal')
+  when: ansible_distribution == 'Ubuntu' and (upgrade or ansible_distribution_major_version|int >= 20)
+- name: Debian laptop disable lid
+  become: true
+  blockinfile:
+    path: /etc/systemd/logind.conf
+    block: |
+      HandleLidSwitch=ignore
+      HandleLidSwitchExternalPower=ignore
+      HandleLidSwitchDocked=ignore
+    marker: '# {mark} MyCard Init block'
+  when: ansible_os_family == 'Debian' and laptop
+  notify: restart_logind

tasks/yum.yml

@@ -5,7 +5,7 @@
 - name: yum
   become: true
   yum:
-    name: curl,wget,git,vim,sudo,byobu,iftop,iotop,gcc,gcc-c++,make,autoconf,p7zip,p7zip-plugins,python-pip,python-devel,python3-pip,python3-devel,tcpdump,rsync,htop,mtr,net-tools,ctags,xclip,traceroute,tar,unzip,iperf,iperf3,nmap,libselinux-python,libselinux-python3,mosh,subversion,fish,haveged,mtr,rsync,nfs-utils,ipset,wireguard-tools # astyle
+    name: curl,wget,git,vim,sudo,byobu,iftop,iotop,gcc,gcc-c++,make,autoconf,p7zip,p7zip-plugins,python-pip,python-devel,python3-pip,python3-devel,tcpdump,rsync,htop,mtr,net-tools,ctags,xclip,traceroute,tar,unzip,iperf,iperf3,nmap,libselinux-python,libselinux-python3,mosh,subversion,fish,haveged,mtr,rsync,nfs-utils,ipset,wireguard-tools,zstd # astyle
     update_cache: yes
 - name: open-vm-tools
   become: true

templates/daemon.json.j2

@@ -15,11 +15,7 @@
     }
   },
 {% endif %}
-
-{% if ansible_distribution != "Fedora" %}
   "live-restore": true,
-{% endif %}
-
   "log-driver": "json-file",
   "log-opts": {
     "max-size": "1g",