Allowing multiple clamscan wrapper scripts and timers per server.

docs/roles/debian/clamav.md

@@ -11,19 +11,25 @@ This role optionally provides systemd timers for routine scanning if you are not
 ```yaml
 ---
 clamav:
-  create_timer: false
+  # wrapper scripts for clamav
+  scripts:
+    - location: /usr/local/clamav/script
+      name: clamscan_daily
+      exclude_directories:
+        - /sys/
+      scan_location: /
+      log_name: clamav_daily.log
+  # scheduled scans, set to an empty dictionary for no timers
+  timers:
+    clamav_scan:
+      timer_command: /usr/local/clamav/script/clamscan_daily # path to clamscan wrapper script, ensure it is defined in clamav.scripts
+      timer_OnCalendar: "*-*-* 02:30:00" # see systemd.time documentation - https://www.freedesktop.org/software/systemd/man/latest/systemd.time.html#Calendar%20Events
   server_name: "{{ inventory_hostname }}" # for identification via email, defaults to Ansible inventory name.
-  on_calendar: "*-*-* 02:30:00" # see systemd.time documentation - https://www.freedesktop.org/software/systemd/man/latest/systemd.time.html#Calendar%20Events
-  scripts_location: /usr/local/clamav/script
   log_location: /var/log/clamav
-  log_name: clamav.log
   send_mail: false # Important: will not send any emails by default.
   send_on_fail: true # Only sends emails on scan failure, will not email for successful scans.
   report_recipient_email: mail@example.com
   report_sender_email: admin@server.example.com
-  scan_location: /
-  exclude_directories:
-    - /sys/
   install_clamdscan: false # flag to install additional 'clamdscan' package
 
 ```

docs/roles/debian/mysql_server_oracle_ce.md

@@ -11,6 +11,7 @@ Installs MySQL Server 5.7.
 mysql_long_query_time: 4
 mysql_server_oracle_ce_key: "8C718D3B5072E1F5" # archive key - see https://dev.mysql.com/doc/refman/8.0/en/gpg-key-archived-packages.html
 mysql_server_oracle_ce_key_server: keyserver.ubuntu.com
+
 ```
 
 <!--ENDROLEVARS-->

roles/debian/clamav/README.md

@@ -11,19 +11,25 @@ This role optionally provides systemd timers for routine scanning if you are not
 ```yaml
 ---
 clamav:
-  create_timer: false
+  # wrapper scripts for clamav
+  scripts:
+    - location: /usr/local/clamav/script
+      name: clamscan_daily
+      exclude_directories:
+        - /sys/
+      scan_location: /
+      log_name: clamav_daily.log
+  # scheduled scans, set to an empty dictionary for no timers
+  timers:
+    clamav_scan:
+      timer_command: /usr/local/clamav/script/clamscan_daily # path to clamscan wrapper script, ensure it is defined in clamav.scripts
+      timer_OnCalendar: "*-*-* 02:30:00" # see systemd.time documentation - https://www.freedesktop.org/software/systemd/man/latest/systemd.time.html#Calendar%20Events
   server_name: "{{ inventory_hostname }}" # for identification via email, defaults to Ansible inventory name.
-  on_calendar: "*-*-* 02:30:00" # see systemd.time documentation - https://www.freedesktop.org/software/systemd/man/latest/systemd.time.html#Calendar%20Events
-  scripts_location: /usr/local/clamav/script
   log_location: /var/log/clamav
-  log_name: clamav.log
   send_mail: false # Important: will not send any emails by default.
   send_on_fail: true # Only sends emails on scan failure, will not email for successful scans.
   report_recipient_email: mail@example.com
   report_sender_email: admin@server.example.com
-  scan_location: /
-  exclude_directories:
-    - /sys/
   install_clamdscan: false # flag to install additional 'clamdscan' package
 
 ```

roles/debian/clamav/defaults/main.yml

@@ -1,16 +1,22 @@
 ---
 clamav:
-  create_timer: false
+  # wrapper scripts for clamav
+  scripts:
+    - location: /usr/local/clamav/script
+      name: clamscan_daily
+      exclude_directories:
+        - /sys/
+      scan_location: /
+      log_name: clamav_daily.log
+  # scheduled scans, set to an empty dictionary for no timers
+  timers:
+    clamscan_daily:
+      timer_command: /usr/local/clamav/script/clamscan_daily # path to clamscan wrapper script, ensure it is defined in clamav.scripts
+      timer_OnCalendar: "*-*-* 02:30:00" # see systemd.time documentation - https://www.freedesktop.org/software/systemd/man/latest/systemd.time.html#Calendar%20Events
   server_name: "{{ inventory_hostname }}" # for identification via email, defaults to Ansible inventory name.
-  on_calendar: "*-*-* 02:30:00" # see systemd.time documentation - https://www.freedesktop.org/software/systemd/man/latest/systemd.time.html#Calendar%20Events
-  scripts_location: /usr/local/clamav/script
   log_location: /var/log/clamav
-  log_name: clamav.log
   send_mail: false # Important: will not send any emails by default.
   send_on_fail: true # Only sends emails on scan failure, will not email for successful scans.
   report_recipient_email: mail@example.com
   report_sender_email: admin@server.example.com
-  scan_location: /
-  exclude_directories:
-    - /sys/
   install_clamdscan: false # flag to install additional 'clamdscan' package

roles/debian/clamav/tasks/main.yml

@@ -1,34 +1,34 @@
 ---
-- name: Ensure the ClamAV scripts directory exists.
+- name: Ensure the ClamAV scripts directories exists.
   ansible.builtin.file:
-    path: "{{ clamav.scripts_location }}"
+    path: "{{ item.location }}"
     state: directory
     mode: '0755'
+  with_items: "{{ clamav.scripts }}"
+  when: clamav.scripts | length > 0
 
-- name: Copy clamscan script to server.
+- name: Copy clamscan scripts to server.
   ansible.builtin.template:
     src: "clamscan.j2"
-    dest: "{{ clamav.scripts_location }}/clamscan"
+    dest: "{{ item.location }}/{{ item.name }}"
     owner: root
     group: root
     mode: "0755"
+  with_items: "{{ clamav.scripts }}"
+  when: clamav.scripts | length > 0
 
 - name: Ensure the ClamAV log directory exists.
   ansible.builtin.file:
     path: "{{ clamav.log_location }}"
     state: directory
     mode: '0755'
-  when: clamav.create_timer
 
-- name: Set up a ClamAV systemd timer.
+- name: Set up a ClamAV systemd timers.
   ansible.builtin.include_role:
     name: contrib/systemd_timers
   vars:
-    timers:
-      clamav_scan:
-        timer_command: "{{ clamav.scripts_location }}/clamscan"
-        timer_OnCalendar: "{{ clamav.on_calendar }}"
-  when: clamav.create_timer
+    timers: "{{ clamav.timers }}"
+  when: clamav.timers | length > 0
 
 - name: Install clamdscan.
   ansible.builtin.apt:

roles/debian/clamav/templates/clamscan.j2

@@ -1,7 +1,7 @@
 #!/bin/bash
 SUBJECT="{{ clamav.server_name }} PASSED SCAN"
 EMAIL="{{ clamav.report_recipient_email }}"
-LOG={{ clamav.log_location }}/{{ clamav.log_name }}
+LOG={{ clamav.log_location }}/{{ item.log_name }}
 TMP_LOG=/tmp/clam.daily
 
 rm -rf ${TMP_LOG}
@@ -38,9 +38,10 @@ av_report() {
 }
 
 av_scan() {
+    {% if item.exclude_directories | length > 0 %}
     # build bash array of directories to exclude
     EXCLUSIONS=()
-    {% for directory in clamav.exclude_directories %}
+    {% for directory in item.exclude_directories %}
     EXCLUSIONS+=("{{ directory }}")
     {% endfor %}
 
@@ -49,9 +50,10 @@ av_scan() {
     for directory in ${EXCLUSIONS[@]}; do
       EXCLUSIONS_STRING+=" --exclude-dir=$directory"
     done
+    {% endif %}
 
 	touch ${TMP_LOG}
-	clamscan -r {{ clamav.scan_location }} --quiet --infected --log=${TMP_LOG}$EXCLUSIONS_STRING
+	clamscan -r {{ item.scan_location }} --quiet --infected --log=${TMP_LOG}$EXCLUSIONS_STRING
 
 	cat ${TMP_LOG} >> ${LOG}
 }

roles/debian/mysql_server_oracle_ce/README.md

@@ -11,6 +11,7 @@ Installs MySQL Server 5.7.
 mysql_long_query_time: 4
 mysql_server_oracle_ce_key: "8C718D3B5072E1F5" # archive key - see https://dev.mysql.com/doc/refman/8.0/en/gpg-key-archived-packages.html
 mysql_server_oracle_ce_key_server: keyserver.ubuntu.com
+
 ```
 
 <!--ENDROLEVARS-->