---

  - stat: path=/proc/sys/kernel/unprivileged_userns_clone
    register: unprivileged_userns_clone
  - name: Allow unprivileged CLONE_NEWUSER
    sysctl: name="kernel.unprivileged_userns_clone" value=1 sysctl_set=yes reload=no
    when: unprivileged_userns_clone.stat.exists

  - name: Set kernel.panic for force reboot after kernel panic
    sysctl: name="kernel.panic" value=120 sysctl_set=yes state=present reload=yes

  - name: Set fs.aio-max-nr for increase default aio-max-nr for sql servers
    sysctl: name="fs.aio-max-nr" value=16777216 sysctl_set=yes state=present reload=yes

  - name: Set kernel.sem for increase semaphore limits
    sysctl: name="kernel.sem" value="1250 256000 100 1024" sysctl_set=yes state=present reload=yes

  - sysctl: name="net.ipv4.neigh.default.gc_thresh1" value=512 sysctl_set=yes state=present reload=yes
  - sysctl: name="net.ipv4.neigh.default.gc_thresh2" value=1024 sysctl_set=yes state=present reload=yes
  - sysctl: name="net.ipv4.neigh.default.gc_thresh3" value=2048 sysctl_set=yes state=present reload=yes
  - sysctl: name="net.ipv6.neigh.default.gc_thresh1" value=512 sysctl_set=yes state=present reload=yes
  - sysctl: name="net.ipv6.neigh.default.gc_thresh2" value=1024 sysctl_set=yes state=present reload=yes
  - sysctl: name="net.ipv6.neigh.default.gc_thresh3" value=2048 sysctl_set=yes state=present reload=yes
  - sysctl: name="net.ipv6.conf.all.accept_ra" value=0 sysctl_set=yes state=present reload=yes
  - sysctl: name="net.ipv6.conf.default.accept_ra" value=0 sysctl_set=yes state=present reload=yes
  - sysctl: name="net.ipv6.conf.all.forwarding" value=1 sysctl_set=yes state=present reload=yes
  - sysctl: name="net.ipv6.conf.default.forwarding" value=1 sysctl_set=yes state=present reload=yes
  - sysctl: name="net.ipv6.route.max_size" value=262144 sysctl_set=yes state=present reload=yes

  - name: Allow ping for all users (no need for SUID binary)
    sysctl: name="net.ipv4.ping_group_range" value="0 2147483647" sysctl_set=yes state=present reload=yes

  - include: kvm.yml
  - include: shuttle-modprobe.yml

  - name: Increase ulimit
    copy: src="slapos_limit.conf" dest="/etc/security/limits.d/slapos.conf" mode=0644 owner=root group=root

  - name: Set Cron
    cron: name="Launch Startup with ansible" special_time=reboot job='flock /opt/upgrader/ansible.lock -c "cd /opt/upgrader/playbook && ansible-playbook vifib-startup.yml -i hosts 2>>/opt/upgrader/startup.log >> /opt/upgrader/startup.log"'

  - name: Get systemd version
    shell: systemd --version | head -n 1 | cut -d " " -f 2
    register: systemd_version

  - file: state=directory path="/etc/systemd/system/cron.service.d/"
    when: systemd_version.stdout | int > 228

  - name: Increase limits for cron
    copy: src="etc_systemd_system_cron_service_d_override.conf" dest="/etc/systemd/system/cron.service.d/override.conf" mode=0644 owner=root group=root
    when: systemd_version.stdout | int > 228

  - stat: path=/etc/opt/slapcache.cfg
    register: slapcache_cfg

  - name: Add missing download-dir-url entry in slapcache.cfg
    lineinfile:
      dest: /etc/opt/slapcache.cfg
      regexp: "^download-dir-url"
      line: "download-dir-url = http://shadir.nxdcdn.com"
      insertafter: "^download-binary-dir-url"
      state: present
    when: slapcache_cfg.stat.exists == True

  - name: Prevent mei_me module from being loaded
    lineinfile:
      dest: /etc/modprobe.d/blacklist.conf
      line: "blacklist mei_me"
      state: present
      create: yes

  - name: Prevent mei module from being loaded
    lineinfile:
      dest: /etc/modprobe.d/blacklist.conf
      line: "blacklist mei"
      state: present
      create: yes
