tcbsd-provision-playbook.yaml

---
- hosts: "{{ target }}"

  tasks:
    - name: Verify connectivity with ping
      ansible.builtin.ping:

    - name: Run PLC mode command
      register: plc_mode
      changed_when: false
      ansible.builtin.command:
        cmd: TcSysExe.exe --mode

    - name: Assert that PLC is in CONFIG mode
      when: not ansible_check_mode
      ansible.builtin.assert:
        that: "{{ 'CONFIG' in plc_mode.stdout }}"
        fail_msg: "PLC is in RUN mode! Abort!"
        quiet: true

    - name: Enable FreeBSD packages
      when: enable_freebsd_packages
      ansible.builtin.file:
        # This file contains a setting to disable FreeBSD packages.
        # We remove it in order to enable access to upstream packages.
        path: /usr/local/etc/pkg/repos/FreeBSD.conf
        state: absent

    - name: Disable FreeBSD packages
      when: not enable_freebsd_packages
      ansible.builtin.template:
        # Put in the file that disables FreeBSD packages
        src: "./templates/usr/local/etc/pkg/repos/FreeBSD.conf"
        dest: "/usr/local/etc/pkg/repos/FreeBSD.conf"
        owner: root
        group: wheel
        mode: u=rw,g=r,o=r

    - name: Enable TcBSD packages
      when: enable_tcbsd_packages
      ansible.builtin.file:
        path: /usr/local/etc/pkg/repos/FreeBSD.conf
        state: absent

    - name: Disable TcBSD packages
      when: not enable_tcbsd_packages
      ansible.builtin.template:
        # Put in the file that disables TcBSD packages
        src: "./templates/usr/local/etc/pkg/repos/TCBSD.conf"
        dest: "/usr/local/etc/pkg/repos/TCBSD.conf"
        owner: root
        group: wheel
        mode: u=rw,g=r,o=r

    - name: Configure SLAC package mirror repo
      when: enable_slac_packages
      ansible.builtin.template:
        # Make sure we can access the local mirror with fixed xar versions
        src: "./templates/etc/pkg/SLAC.conf"
        dest: "/etc/pkg/SLAC.conf"
        owner: root
        group: wheel
        mode: u=rw,g=r,o=r

    - name: Enable SLAC package mirror
      when: enable_slac_packages
      ansible.builtin.file:
        path: /usr/local/etc/pkg/repos/SLAC.conf
        state: absent

    - name: Disable SLAC package mirror
      when: not enable_slac_packages
      ansible.builtin.template:
        # Put in the file that disables SLAC packages
        src: "./templates/usr/local/etc/pkg/repos/SLAC.conf"
        dest: "/usr/local/etc/pkg/repos/SLAC.conf"
        owner: root
        group: wheel
        mode: u=rw,g=r,o=r

    - name: Setup psproxy
      ansible.builtin.blockinfile:
        # Appending to this file lets us install packages from Beckhoff, etc.
        # By using psproxy as our http/https proxy
        state: "{{ use_psproxy | ternary('present', 'absent') }}"
        dest: /usr/local/etc/pkg.conf
        block: |
          PKG_ENV {
              http_proxy: "http://psproxy:3128",
              https_proxy: "http://psproxy:3128",
          }

    # We need NTP sync in order to install packages.
    # Use internal ntp servers
    - name: Setup psntp
      register: psntp_setup
      ansible.builtin.blockinfile:
        state: "{{ use_psntp | ternary('present', 'absent') }}"
        dest: /etc/ntp.conf
        block: |
          disable monitor

          # Permit time synchronization with our time source, but do not
          # permit the source to query or modify the service on this system.
          restrict default kod nomodify notrap nopeer noquery
          restrict 127.0.0.1

          server psntp1.pcdsn iburst
          server psntp2.pcdsn iburst
          server psntp3.pcdsn iburst

    - name: Set timezone
      when: set_plc_timezone
      ansible.builtin.copy:
        # Strangely, copying a file is the designated way to set timezones.
        remote_src: true
        src: "/usr/share/zoneinfo/{{ plc_timezone }}"
        dest: /etc/localtime

    # ntpd does not necessarily re-sync promptly after start or reconfig
    # stop the service, sync manually, then start it again
    # (cannot run sync manually if the service is running)
    - name: Stop NTP Service
      when: psntp_setup.changed
      ansible.builtin.service:
        name: ntpd
        enabled: yes
        state: stopped

    - name: Force NTP Sync Now
      when: psntp_setup.changed
      ansible.builtin.command: ntpd -g -q
      changed_when: true

    - name: (Re) Start NTP Service
      when: psntp_setup.changed
      ansible.builtin.service:
        name: ntpd
        enabled: yes
        state: started

    - name: Install helpful system packages
      ansible.builtin.package:
        name:
          # TCBSD 13 stable packages are listed here:
          # https://tcbsd.beckhoff.com/TCBSD/13/stable/packages/packagesite.html
          - bash
          - bash-completion
          - htop
          # Beyond bootstrapping, python39 is here to keep it up-to-date:
          - python39
          # Support for hostname -> IP -> ip_to_ams_net_id
          - py39-dnspython
          # py39-lxml may come from OpenBSD; Beckhoff removed it from theirs:
          - py39-lxml
          - rsync
        state: latest

    - name: Install pip
      # Packages only available via pip will be installed after this
      # As far as the security implications go: well, that's up to you!
      when: tc_install_pip_packages
      ansible.builtin.package:
        name:
          - py39-pip
        state: latest

    - name: Install pip dependencies if required
      when: tc_install_pip_packages
      ansible.builtin.pip:
        name: "{{ tc_install_pip_packages }}"

    - name: Uninstall pip
      # Packages only available via pip will be installed before this
      # As far as the security implications go: well, that's up to you!
      when: tc_uninstall_pip
      ansible.builtin.package:
        name:
          - py39-pip
        state: absent

    - name: Install user-specified system packages
      ansible.builtin.package:
        name: "{{ tc_packages_to_install }}"
        state: latest

    # Note: this job runs even in check mode, to help us figure out if the xar install will happen.
    - name: "Get available TwinCAT build"
      when: set_fixed_xar
      register: pkg_twincat_build
      changed_when: false
      check_mode: no
      ansible.builtin.shell:
        executable: /usr/local/bin/bash
        cmd: pkg search TC31-XAR-{{ fixed_xar_version }} | cut -f 1 -d " " | cut -f 2 -d "_"

    - name: "Set fixed TwinCAT Runtime version ({{ fixed_xar_version | default('N/A') }})"
      when: set_fixed_xar
      register: xar_install
      ansible.builtin.package:
        name: "TC31-XAR-{{ fixed_xar_version }}_{{ pkg_twincat_build.stdout }}"
        state: present

    - name: Install TwinCAT tools
      ansible.builtin.package:
        name: "{{ tc_tools_packages }}"
        state: latest

    - name: Install C/C++ development tools
      ansible.builtin.package:
        name:
          - os-generic-userland-devtools
          - llvm
          - gdb
        state: latest
      when: tc_install_cpp_dev_tools

    - name: Install user TwinCAT Libraries
      ansible.builtin.package:
        name: "{{ tc_libraries }}"
        state: latest

    - name: Set the AMS Net ID
      community.general.xml:
        path: /usr/local/etc/TwinCAT/3.1/TcRegistry.xml
        xpath: /TcRegistry/Key[@Name='HKLM']/Key[@Name='Software']/Key[@Name='Beckhoff']/Key[@Name='TwinCAT3']/Key[@Name='System']/Value[@Name='AmsNetId']
        value: >-
          {%- import 'ip_macros.j2' as ip_macros -%}
          {%- if dynamic_ams -%}
          {%- set tc_ams_net_id = ip_macros.ip_to_ams_net_id(ansible_host) -%}
          {%- endif -%}
          {{ ip_macros.ams_net_id_to_binary(tc_ams_net_id) }}
      register: ams_net_id

    - name: Adjust the locked memory size
      community.general.xml:
        path: /usr/local/etc/TwinCAT/3.1/TcRegistry.xml
        xpath: /TcRegistry/Key[@Name='HKLM']/Key[@Name='Software']/Key[@Name='Beckhoff']/Key[@Name='TwinCAT3']/Key[@Name='System']/Value[@Name='LockedMemSize']
        value: "{{ tc_locked_memory_size_bytes | string }}"
      register: locked_memory_size

    - name: Set the heap memory size
      community.general.xml:
        path: /usr/local/etc/TwinCAT/3.1/TcRegistry.xml
        xpath: /TcRegistry/Key[@Name='HKLM']/Key[@Name='Software']/Key[@Name='Beckhoff']/Key[@Name='TwinCAT3']/Key[@Name='System']/Value[@Name='HeapMemSizeMB']
        value: "{{ tc_heap_memory_size_mb | string }}"
      when: tc_heap_memory_size_mb > 0
      register: heap_memory_size

      # TODO: can this be combined in the step above?
    # Sets Type="DW" in <Value Name="HeapMemSizeMB" Type="DW">
    - name: Tweak the heap memory size to add Type attribute
      community.general.xml:
        path: /usr/local/etc/TwinCAT/3.1/TcRegistry.xml
        xpath: /TcRegistry/Key[@Name='HKLM']/Key[@Name='Software']/Key[@Name='Beckhoff']/Key[@Name='TwinCAT3']/Key[@Name='System']/Value[@Name='HeapMemSizeMB']
        attribute: Type
        value: DW
      when: tc_heap_memory_size_mb > 0

    - name: Set the startup hostname
      ansible.builtin.lineinfile:
        dest: /etc/rc.conf
        regexp: '^hostname='
        line: "hostname=\"{{ inventory_hostname }}\""
        owner: root
        group: wheel
        mode: u=rw,g=r,o=r

    - name: Set the live hostname
      ansible.builtin.hostname:
        name: "{{ inventory_hostname }}"

    - name: Change default shell for Administrator
      ansible.builtin.command: chsh -s /usr/local/bin/bash Administrator
      when: tc_use_bash
      changed_when: false

    - name: "Include our bash configuration files"
      ansible.builtin.template:
        src: "./templates/{{ item }}"
        dest: "/{{ item }}"
        owner: Administrator
        mode: u=rw,g=r,o=
      when: tc_use_bash
      loop:
        - home/Administrator/.bashrc
        - home/Administrator/.bash_profile

    - name: Include our firewall configuration
      ansible.builtin.template:
        src: ./templates/etc/pf.conf.d/siteconf
        dest: /etc/pf.conf.d/siteconf
        owner: root
        mode: u=rw,g=r,o=r
      register: siteconf

    - name: Include our firewall configuration in /etc/pf.conf
      ansible.builtin.blockinfile:
        dest: /etc/pf.conf
        block: |
          anchor siteconf
          load anchor siteconf from "/etc/pf.conf.d/siteconf"
      register: pf

    - name: Reload packet filter (pf)
      ansible.builtin.service:
        name: pf
        enabled: yes
        state: reloaded
      when: siteconf.changed or pf.changed

    - name: Configure a set of fixed static routes with a template
      ansible.builtin.template:
        src: "./templates/usr/local/etc/TwinCAT/3.1/Target/StaticRoutes.xml"
        dest: "/usr/local/etc/TwinCAT/3.1/Target/StaticRoutes.xml"
        owner: root
        group: wheel
        mode: u=rw,g=r,o=r
        backup: yes
      tags:
        - routes
      when: tc_set_fixed_static_routes

    - name: Add any missing static routes with our tcbsd_route module
      tcbsd_route:
        file: "/usr/local/etc/TwinCAT/3.1/Target/StaticRoutes.xml"
        state: present
        routes: "{{ tc_add_missing_static_routes }}"
        # owner: root
        # group: wheel
        # mode: u=rw,g=r,o=r
        # backup: yes
      tags:
        - routes
      when: tc_add_missing_static_routes

    - name: Restart the TwinCAT service
      ansible.builtin.service:
        name: TcSystemService
        enabled: yes
        state: restarted
      when: ams_net_id.changed or locked_memory_size.changed or heap_memory_size.changed or xar_install.changed

    # We use the second port as a LAN port with a known static IP
    # This makes it easy to use if we need it for e.g. doing service
    - name: Set static IP on X000
      when: x000_set_static_ip
      register: static_ip_x000_set
      community.general.sysrc:
        name: ifconfig_igb1
        value: "inet {{ x000_static_ip }} netmask 255.255.255.0"

    - name: Set DHCP on X000
      when: not x000_set_static_ip
      register: dhcp_x000_set
      community.general.sysrc:
        name: ifconfig_igb1
        state: absent

    - name: Reset X000
      when: static_ip_x000_set.changed or dhcp_x000_set.changed
      ansible.builtin.command: /etc/rc.d/netif restart igb1
      changed_when: true

    # We use the first port as a the main CDS port with a DNS-defined IP
    # Currently we use DHCP, but we could instead set a static IP using this
    - name: Get static IP details for X001
      when: x001_set_static_ip
      register: x001_ip_details
      ansible.builtin.shell:
        executable: /usr/local/bin/bash
        cmd: ifconfig igb0 inet | grep inet | cut -f 2 | cut -f 1-4 -d " "

    - name: Set static IP on X001
      when: x001_set_static_ip
      register: static_ip_x001_set
      community.general.sysrc:
        name: ifconfig_igb0
        value: "{{ x001_ip_details.stdout }}"

    - name: Set DHCP on X001
      when: not x001_set_static_ip
      register: dhcp_x001_set
      community.general.sysrc:
        name: ifconfig_igb0
        state: absent

    # Note: we have to reset X001 asynchronously
    # Otherwise, we just drop our connection and hang
    # because we are using X001 to access the plc
    - name: Reset X001 (async, static)
      when: static_ip_x001_set.changed
      ansible.builtin.shell:
        executable: /usr/local/bin/bash
        cmd: "sleep 1; /etc/rc.d/netif restart igb0 &"
      async: "{{ ansible_check_mode | ternary(0, 100) }}"
      poll: 0

    - name: Reset X001 (async, dhcp)
      when: dhcp_x001_set.changed
      ansible.builtin.shell:
        executable: /usr/local/bin/bash
        cmd: "sleep 1; dhclient igb0 &"
      async: "{{ ansible_check_mode | ternary(0, 100) }}"
      poll: 0

    - name: Wait for X001 network to resume
      when: static_ip_x001_set.changed or dhcp_x001_set.changed
      ansible.builtin.wait_for_connection:
        delay: 2

    # Useful for apps that need PLC access but not Admin-level config change access
    # We need to manually set the password ourselves later via "doas passwd username"
    - name: Create or Remove non-admin User
      ansible.builtin.user:
        name: "{{ create_username }}"
        state: "{{ create_user | ternary('present', 'absent') }}"
        shell: /usr/local/bin/bash

    # By default, only pubkey and keyboard interactive are enabled
    # Password access is useful for apps like pmpsdb_client
    - name: Configure sshd for password access
      register: sshd_configure
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        line: "PasswordAuthentication yes"
        insertafter: "^#PasswordAuthentication"

    - name: Reload sshd
      when: sshd_configure.changed
      ansible.builtin.service:
        name: sshd
        enabled: yes
        state: reloaded

    - name: Verify ssh still works
      when: sshd_configure.changed
      ansible.builtin.wait_for_connection:
        delay: 2