temp0825f

# conditional_service_disable.yml
# 조건부 서비스 비활성화 태스크
---
# ========================================
# AUDITD 서비스 비활성화
# ========================================

- name: Check if auditd disable is requested and service is active
  set_fact:
    should_disable_auditd: "{{ disable_auditd and node_result.auditd.service_exists and node_result.auditd.running }}"

- block:
    - name: Create backup of auditd configuration
      copy:
        src: /etc/audit/auditd.conf
        dest: /etc/audit/auditd.conf.backup.{{ ansible_date_time.epoch }}
        remote_src: yes
        backup: yes
      when: backup_configs and node_result.auditd.service_exists
      
    - name: Log auditd disable action
      lineinfile:
        path: /var/log/ansible_service_changes.log
        create: yes
        line: "{{ ansible_date_time.iso8601 }} - {{ inventory_hostname }} - Disabling auditd service (was {{ node_result.auditd.status }})"
      when: log_changes
      
    - name: Stop auditd service
      systemd:
        name: auditd
        state: stopped
        enabled: no
      register: auditd_disable_result
      
    - name: Mask auditd service to prevent accidental restart
      systemd:
        name: auditd
        masked: yes
      when: auditd_disable_result is succeeded
      
    - name: Verify auditd is stopped
      systemd:
        name: auditd
      register: auditd_final_status
      
    - name: Display auditd disable result
      debug:
        msg: |
          ✅ AUDITD DISABLED SUCCESSFULLY on {{ inventory_hostname }}
          - Previous Status: {{ node_result.auditd.status }}
          - Current Status: {{ auditd_final_status.status.ActiveState }}
          - Service Masked: Yes
          {% if backup_configs %}
          - Config Backup: /etc/audit/auditd.conf.backup.{{ ansible_date_time.epoch }}
          {% endif %}
          
  when: should_disable_auditd
  
- name: Skip auditd disable - not requested or not running
  debug:
    msg: |
      ⏭️  SKIPPING AUDITD DISABLE on {{ inventory_hostname }}
      - Disable Requested: {{ disable_auditd }}
      - Service Exists: {{ node_result.auditd.service_exists }}
      - Currently Running: {{ node_result.auditd.running }}
      - Current Status: {{ node_result.auditd.status }}
  when: not should_disable_auditd

# ========================================
# MLOCATE 서비스 비활성화
# ========================================

- name: Check if mlocate disable is requested and timer is active
  set_fact:
    should_disable_mlocate: "{{ disable_mlocate and node_result.mlocate.timer_exists and node_result.mlocate.timer_running }}"

- block:
    - name: Log mlocate disable action
      lineinfile:
        path: /var/log/ansible_service_changes.log
        create: yes
        line: "{{ ansible_date_time.iso8601 }} - {{ inventory_hostname }} - Disabling mlocate timer (was {{ node_result.mlocate.timer_status }})"
      when: log_changes
      
    - name: Stop mlocate updatedb timer
      systemd:
        name: "{{ node_result.mlocate.timer_service }}"
        state: stopped
        enabled: no
      register: mlocate_disable_result
      
    - name: Mask mlocate timer to prevent accidental restart
      systemd:
        name: "{{ node_result.mlocate.timer_service }}"
        masked: yes
      when: mlocate_disable_result is succeeded
      
    - name: Remove mlocate database if requested
      file:
        path: "{{ node_result.mlocate.db_path }}"
        state: absent
      when: mlocate_disable_result is succeeded and node_result.mlocate.db_exists
      register: mlocate_db_removed
      
    - name: Verify mlocate timer is stopped
      systemd:
        name: "{{ node_result.mlocate.timer_service }}"
      register: mlocate_final_status
      
    - name: Display mlocate disable result
      debug:
        msg: |
          ✅ MLOCATE DISABLED SUCCESSFULLY on {{ inventory_hostname }}
          - Timer Service: {{ node_result.mlocate.timer_service }}
          - Previous Status: {{ node_result.mlocate.timer_status }}
          - Current Status: {{ mlocate_final_status.status.ActiveState }}
          - Service Masked: Yes
          {% if mlocate_db_removed is defined and mlocate_db_removed.changed %}
          - Database Removed: {{ node_result.mlocate.db_path }}
          {% endif %}
          
  when: should_disable_mlocate
  
- name: Skip mlocate disable - not requested or not running
  debug:
    msg: |
      ⏭️  SKIPPING MLOCATE DISABLE on {{ inventory_hostname }}
      - Disable Requested: {{ disable_mlocate }}
      - Timer Exists: {{ node_result.mlocate.timer_exists }}
      - Timer Running: {{ node_result.mlocate.timer_running }}
      - Timer Status: {{ node_result.mlocate.timer_status }}
  when: not should_disable_mlocate

# ========================================
# NTP 서비스 비활성화 (선택적)
# ========================================

- name: Check if NTP disable is requested and service is active
  set_fact:
    should_disable_ntp: "{{ disable_ntp_services and node_result.ntp.active_service != 'none' }}"

- block:
    - name: Create backup of time service configurations
      copy:
        src: "{{ item.src }}"
        dest: "{{ item.dest }}"
        remote_src: yes
        backup: yes
      loop:
        - { src: "/etc/chrony.conf", dest: "/etc/chrony.conf.backup.{{ ansible_date_time.epoch }}" }
        - { src: "/etc/ntp.conf", dest: "/etc/ntp.conf.backup.{{ ansible_date_time.epoch }}" }
      when: backup_configs
      failed_when: false  # 파일이 없을 수 있으므로 실패 무시
      
    - name: Log NTP disable action
      lineinfile:
        path: /var/log/ansible_service_changes.log
        create: yes
        line: "{{ ansible_date_time.iso8601 }} - {{ inventory_hostname }} - Disabling {{ node_result.ntp.active_service }} service"
      when: log_changes
      
    - name: Stop active NTP service
      systemd:
        name: "{{ node_result.ntp.active_service }}"
        state: stopped
        enabled: no
      register: ntp_disable_result
      
    - name: Mask NTP service to prevent accidental restart
      systemd:
        name: "{{ node_result.ntp.active_service }}"
        masked: yes
      when: ntp_disable_result is succeeded
      
    - name: Verify NTP service is stopped
      systemd:
        name: "{{ node_result.ntp.active_service }}"
      register: ntp_final_status
      
    - name: Display NTP disable result
      debug:
        msg: |
          ✅ NTP SERVICE DISABLED SUCCESSFULLY on {{ inventory_hostname }}
          - Service: {{ node_result.ntp.active_service }}
          - Current Status: {{ ntp_final_status.status.ActiveState }}
          - Service Masked: Yes
          ⚠️  WARNING: Time synchronization is now disabled!
          
  when: should_disable_ntp
  
- name: Skip NTP disable - not requested or no active service
  debug:
    msg: |
      ⏭️  SKIPPING NTP DISABLE on {{ inventory_hostname }}
      - Disable Requested: {{ disable_ntp_services }}
      - Active Service: {{ node_result.ntp.active_service }}
  when: not should_disable_ntp

# ========================================
# 서비스 비활성화 요약
# ========================================

- name: Create disable action summary
  set_fact:
    disable_summary:
      hostname: "{{ inventory_hostname }}"
      auditd_disabled: "{{ should_disable_auditd | default(false) }}"
      mlocate_disabled: "{{ should_disable_mlocate | default(false) }}"
      ntp_disabled: "{{ should_disable_ntp | default(false) }}"
      timestamp: "{{ ansible_date_time.iso8601 }}"
      actions_taken:
        - "{{ 'auditd stopped and masked' if should_disable_auditd else 'auditd unchanged' }}"
        - "{{ 'mlocate timer stopped and masked' if should_disable_mlocate else 'mlocate unchanged' }}"
        - "{{ node_result.ntp.active_service + ' stopped and masked' if should_disable_ntp else 'NTP unchanged' }}"

- name: Display per-node disable summary
  debug:
    msg: |
      
      ================================================
      🔧 SERVICE DISABLE SUMMARY - {{ inventory_hostname }}
      ================================================
      Timestamp: {{ disable_summary.timestamp }}
      
      📊 Actions Taken:
      {% for action in disable_summary.actions_taken %}
      - {{ action }}
      {% endfor %}
      
      📋 Current Service States:
      {% if disable_summary.auditd_disabled %}
      ✅ auditd: DISABLED AND MASKED
      {% else %}
      ⏭️  auditd: {{ node_result.auditd.status }} (unchanged)
      {% endif %}
      
      {% if disable_summary.mlocate_disabled %}
      ✅ mlocate: DISABLED AND MASKED
      {% else %}
      ⏭️  mlocate: {{ node_result.mlocate.timer_status }} (unchanged)
      {% endif %}
      
      {% if disable_summary.ntp_disabled %}
      ⚠️  {{ node_result.ntp.active_service }}: DISABLED AND MASKED
      {% else %}
      ⏭️  NTP: {{ node_result.ntp.active_service }} (unchanged)
      {% endif %}

- name: Save disable action log
  copy:
    content: "{{ disable_summary | to_nice_json }}"
    dest: "/tmp/disable_actions_{{ inventory_hostname }}.json"
  delegate_to: localhost