Compare commits

..

53 commits

Author SHA1 Message Date
167702d345 CI: Override submodule URI 2024-11-09 03:48:01 +01:00
d73003647b CI: Use correct image for git pull 2024-11-09 03:47:08 +01:00
ffb11979c2 CI: Override submodule clone URI 2024-11-09 03:46:19 +01:00
78a9b5db85 run ansible lint in ci 2024-11-09 03:44:13 +01:00
a60f6eb0a2 add brunn.ccchb.de 2024-11-02 21:09:24 +01:00
c9571efbb6 fix tls_high_cipherlist setting for postfix 2024-10-15 22:03:51 +02:00
acb6cb6418 Re-add vorstand@ and fritz@ mailboxes 2024-10-15 22:03:06 +02:00
Crest
ae3074789a Invoke ipmath by its full name.
Closes #33.
2024-10-02 15:17:26 +02:00
Crest
e882a4760b Install passlib module for default Python version.
Referencing the package to install by origin port
instead of resulting package name picks the default
flavor of the port thus avoids depending on a specific
Python version.

Updates #33.
2024-10-02 14:39:11 +02:00
Crest
c1c2e0c2c0 Use the default Python version on FreeBSD.
Change ansible_python_interpreter from
/usr/local/bin/python3.9 to /usr/local/bin/python.

Updates #33.
2024-10-02 14:25:39 +02:00
Crest
7c9d689845 Merge branch 'master' of ssh://dev.ccchb.de:2222/ccchb/ansible 2024-10-01 13:17:46 +02:00
Crest
168912e8ab Add stupid alias for stupid games 2024-10-01 13:17:37 +02:00
a4f5536f12 Stricter TLS ciphersuites for Postfix (SMTP) 2024-09-17 20:15:33 +02:00
7784501da5 Add tags to mail playbook 2024-09-17 19:28:49 +02:00
ca8217859d Fix hasty typos 2024-09-17 19:18:39 +02:00
6c41934194 Lint postfix role 2024-09-17 16:50:09 +00:00
f6ccbbf5eb Add debian_docker role 2024-09-17 16:34:45 +00:00
08ef92627e Add descriptions for playbook tasks 2024-09-17 16:15:28 +00:00
2140a1428c debian: Do not change shell and use debian-owned facilities for networking 2024-09-17 16:30:44 +02:00
ec110faf41 Unify file name extensions for group vars 2024-09-17 16:29:51 +02:00
4454b87c35 Add user account for fritz 2024-09-08 19:32:33 +00:00
97bbb55052 Add mail password for vorstand 2024-09-08 17:16:17 +00:00
2b25e7178a Add virtual machine `verein' 2024-08-09 19:27:45 +00:00
Crest
de3575a991 Merge branch 'master' of ssh://dev.ccchb.de:2222/ccchb/ansible 2024-08-06 16:59:17 +02:00
6784efe5da haproxy hinzugefügt 2024-08-06 02:38:07 +02:00
bf89318990 add virtual machines 2024-07-02 21:24:41 +02:00
Crest
954a51901e Merge branch 'master' of ssh://dev.ccchb.de:2222/ccchb/ansible 2024-06-03 11:48:41 +02:00
Crest
9190f1893d Add NetAddr python module by origin 2024-06-03 11:48:30 +02:00
ef539d8745 unbenutzte vms deaktiviert 2024-03-25 14:32:59 +00:00
9131854211 haproxy-redirects aufgeräumt 2024-03-25 14:20:17 +00:00
Crest
0cbb0fe140 Merge branch 'master' of ssh://dev.ccchb.de:2222/ccchb/ansible 2024-03-13 17:34:22 +01:00
Crest
38d98dc70d Disable VNC 2024-03-13 12:41:25 +01:00
a3610995f0 gives me acces 2024-02-06 22:21:57 +01:00
81803de24e Add reverse proxy for auth.ccchb.de 2024-02-06 22:21:24 +01:00
8b43765a27 Update Prosody config 2023-12-20 20:26:48 +00:00
01647698b2 roles/prosody: Current configuration 2022-12-31 04:29:35 +01:00
6a7110194d Foo 2022-12-29 19:13:28 +01:00
e53fbcb802 Add rudimentary README 2022-11-26 23:50:39 +00:00
3ad3372f84 Jabber stuff 2022-11-26 23:49:01 +00:00
f5a258b9a1 Changes 2022-11-26 22:38:59 +01:00
ca45f138f9 Define frab vm for blazr 2022-11-26 20:55:44 +01:00
597664f66e add my ssh key 2022-11-01 14:42:38 +00:00
Crest
27448d7da4 Expose "service s6-rc status" extra command 2022-10-26 17:45:18 +02:00
Crest
1b58f2cc9d Don't depend on a specific Python 3.x version 2022-10-26 15:27:17 +02:00
Crest
cb492e504a Upgrade bhyve.yml to Python 3.9 as well *sigh* 2022-10-26 15:05:10 +02:00
Crest
6c6167b677 Require py39-passlib instead of py38-passlib 2022-10-26 14:43:10 +02:00
Crest
81e83eedbb Merge branch 'master' of ssh://dev.ccchb.de:2222/ccchb/ansible 2022-10-26 14:41:51 +02:00
Crest
4540289fc6 Disable geno's playground as it's stuck in a bootloop. 2022-10-26 14:40:35 +02:00
Crest
5956195dde Update default Python from 3.8 to 3.9 2022-10-26 14:36:35 +02:00
08d0fc382c Add user account for humm 2022-08-28 04:59:44 -05:00
a1fd5f1f91 chore(gitea-ccchb): remove black navibar with black logo) 2022-08-21 13:18:56 +02:00
093eda76b6 chore(vars/group/all): update genofire's ssh-keys 2022-08-21 13:05:19 +02:00
5662be9478 fix(gitea): update to v1.17.1 - security 2022-08-21 13:02:50 +02:00
44 changed files with 375 additions and 518 deletions

20
.woodpecker.yaml Normal file
View file

@ -0,0 +1,20 @@
clone:
git:
image: woodpeckerci/plugin-git
settings:
submodule_override:
roles/gitea: https://dev.ccchb.de/ccchb/ansible-role-gitea.git
when:
- event: push
branch: main
- event: push
branch: master
steps:
- name: lint
image: alpine
commands:
- apk update
- apk add ansible-lint
- ansible-lint

View file

@ -1,3 +1,9 @@
# ansible # ansible
CCC HB Ansible [![status-badge](https://ci.ccchb.de/api/badges/5/status.svg)](https://ci.ccchb.de/repos/5)
CCCHB Ansible
## Deployment
ansible-playbook -i hosts/ [-l HOSTS] [-t TAGS] sites.yml

View file

@ -1,19 +1,18 @@
--- ---
- hosts: - name: Install py-netaddr
- localhost hosts:
- localhost
become: yes become: true
tasks: tasks:
- name: Install passlib - name: Install py-netaddr package
package: ansible.builtin.package:
name: py38-netaddr name: net/py-netaddr
state: present state: present
- hosts: - name: Deploy bhyve to virtual machine hosts
hosts:
- emma - emma
become: true
become: yes tags: bhyve
roles: roles:
- bhyve - bhyve

View file

@ -1,6 +1,6 @@
--- ---
- hosts: debian - name: Prepare debian hosts
become: yes hosts: debian
become: true
roles: roles:
- debian - debian
- { role: user_mgmt, tags: [user_mgmt]}

View file

@ -1,9 +1,8 @@
--- ---
- hosts: - name: Deploy DNS servers
hosts:
- mail - mail
become: true
become: yes
roles: roles:
- nsd - nsd
- unbound - unbound

View file

@ -1,6 +1,7 @@
--- ---
- hosts: gitea - name: Deploy Forgejo
become: yes hosts: gitea
become: true
roles: roles:
- gitea - gitea
- gitea-ccchb - gitea-ccchb

View file

@ -10,14 +10,16 @@ user_mgmt_default:
genofire: genofire:
ssh_key: ssh_key:
present: present:
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZm0TZPBzgXrY1vrLoYviNRb/oGZQDQk9vrppPK84sN55ZPlr9VvP+JYE7Qkx8teRuH9ulxqX40+dxKaiAXMUl4HU57KPLjwCb7SnBNIFTv6ZHGxPS8ZgUzKJr4Agph51oenNEO3RziEqAo3EwK67SGnjeIYQQKcjpfwd08+PYMOjv42zSYQ9umooj5LooOvbxoogZ3VpboXv6DeyA4rev1M9RgnMWaWVF2LxJjQ3jVr7xh1vZktVGKuVk/XXKD6WVAuwmGMVEouQzjtG9kepWd8FUYe+fgj5mtdqfeQP9CypxvOcb7jT20wO1Abpp5udS9iPDQHg+lafklIAeKG3qgxxhBDH3otXtnWcoeXUmDpBI8HU/8d/yrGaLHYRfy3HHiSGFq3lBgoxi83QIOl9ELeKWMJC0fWKBApm0NU0flgwfy2j7GRyXmlM7tVFyuj5RTAZNQfgD9g054di9WbtUs7sm/9r3/rQe2+3neE3Jskt4xvZK0xbc4dZSZGn4E2JDWjENqPBvQ2dU5lsjpUKTZWAnxVGPe//BErsDxNLIHWz8emG71r3Q2yud4KPdAR9CgeC8g1bwlCI6JDFZutKBzIlE3QQ4ryKJEioiUL89xi6G+nNB7W5ABsQN0ZtWvZl8TG4Wh00B+oBXzgRER5Y9SdAYcrwWxlGVxxQyElUNrw== genofire-yubikey" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIOr9wE3i1+Cl/06WOf0/6OjxsOnN7veV3LZcWgtHkcS genofire@fireYubi"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH8LdgjUiL/MFmA2wM98QAbUEyY/8ixnpettC6kQxKWu genofire@emma.ccchb.de" absent:
absent: [] - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH8LdgjUiL/MFmA2wM98QAbUEyY/8ixnpettC6kQxKWu genofire@emma.ccchb.de"
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZm0TZPBzgXrY1vrLoYviNRb/oGZQDQk9vrppPK84sN55ZPlr9VvP+JYE7Qkx8teRuH9ulxqX40+dxKaiAXMUl4HU57KPLjwCb7SnBNIFTv6ZHGxPS8ZgUzKJr4Agph51oenNEO3RziEqAo3EwK67SGnjeIYQQKcjpfwd08+PYMOjv42zSYQ9umooj5LooOvbxoogZ3VpboXv6DeyA4rev1M9RgnMWaWVF2LxJjQ3jVr7xh1vZktVGKuVk/XXKD6WVAuwmGMVEouQzjtG9kepWd8FUYe+fgj5mtdqfeQP9CypxvOcb7jT20wO1Abpp5udS9iPDQHg+lafklIAeKG3qgxxhBDH3otXtnWcoeXUmDpBI8HU/8d/yrGaLHYRfy3HHiSGFq3lBgoxi83QIOl9ELeKWMJC0fWKBApm0NU0flgwfy2j7GRyXmlM7tVFyuj5RTAZNQfgD9g054di9WbtUs7sm/9r3/rQe2+3neE3Jskt4xvZK0xbc4dZSZGn4E2JDWjENqPBvQ2dU5lsjpUKTZWAnxVGPe//BErsDxNLIHWz8emG71r3Q2yud4KPdAR9CgeC8g1bwlCI6JDFZutKBzIlE3QQ4ryKJEioiUL89xi6G+nNB7W5ABsQN0ZtWvZl8TG4Wh00B+oBXzgRER5Y9SdAYcrwWxlGVxxQyElUNrw== genofire-yubikey"
fritz: fritz:
ssh_key: ssh_key:
present: present:
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEay33koXmcBcrDuCQKkCBlw/gKiPtwLswATPqIR7udl fritz@fluorine.grimpen.net" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEay33koXmcBcrDuCQKkCBlw/gKiPtwLswATPqIR7udl fritz@fluorine.grimpen.net"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEyVVwh0cUPxZ/wwRsB8YRsQE/cxjEX6gomS7EPArXuX fritz@NaOH" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEyVVwh0cUPxZ/wwRsB8YRsQE/cxjEX6gomS7EPArXuX fritz@NaOH"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPSZUs/SgJRKK+NgmifBt8xehIbrpdQtpT9MeRkdwdHU fritz@m1air"
absent: [] absent: []
deelkar: deelkar:
ssh_key: ssh_key:
@ -29,3 +31,8 @@ user_mgmt_default:
present: present:
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDSHkU00aO4U98ikMiiiWiEeRj/597UzFcFctwY8iwLy humm@fluorine" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDSHkU00aO4U98ikMiiiWiEeRj/597UzFcFctwY8iwLy humm@fluorine"
absent: [] absent: []
blazr:
ssh_key:
present:
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDbxgesllBFfJUfwYX58rZln0ZpOq/Jyp361OmKohiQFHUyWK6wlPqDmfhqJuLPkAZQOjmK25gvLQXJ19+y1arjtGgbgf2nrjkCJ1l/2SHIa088DVYvZDLly+cSDMOUwgM1bzlKrHYK5asFihM+XJDV2oKUBIWaVNLHK99hpmiDXQ== jollyjinx@planetexpress.local"
absent: []

View file

@ -1,5 +1,5 @@
--- ---
ansible_python_interpreter: /usr/bin/python3.7 ansible_python_interpreter: /usr/bin/python3
dns: 213.133.98.98 8.8.8.8 dns: 213.133.98.98 8.8.8.8
ipv6_subnet: '2a01:4f8:150:926f::' ipv6_subnet: '2a01:4f8:150:926f::'
@ -8,6 +8,6 @@ ipv4_subnet: 10.0.0.0
ipv6: '{{ ipv6_subnet | ipmath(2 * (vm_index +2)+1) }}/127' ipv6: '{{ ipv6_subnet | ipmath(2 * (vm_index +2)+1) }}/127'
ipv6route: '{{ ipv6_subnet | ipmath(2 * (vm_index +2)) }}' ipv6route: '{{ ipv6_subnet | ipmath(2 * (vm_index +2)) }}'
ansible_ssh_host: '{{ ipv4_subnet | ipmath(2 * vm_index +1) }}' #ansible_ssh_host: '{{ ipv4_subnet | ipmath(2 * vm_index +1) }}'
ipv4: '{{ ipv4_subnet | ipmath(2 * vm_index +1) }}/31' ipv4: '{{ ipv4_subnet | ipmath(2 * vm_index +1) }}/31'
ipv4route: '{{ ipv4_subnet | ipmath(2 * vm_index) }}' ipv4route: '{{ ipv4_subnet | ipmath(2 * vm_index) }}'

View file

@ -1,5 +1,5 @@
--- ---
ansible_python_interpreter: /usr/local/bin/python3.8 ansible_python_interpreter: /usr/local/bin/python
s6_etc_dir: /etc/s6-rc s6_etc_dir: /etc/s6-rc
s6_live_dir: /run/s6-rc s6_live_dir: /run/s6-rc
s6_scan_dir: /run/service s6_scan_dir: /run/service

View file

@ -7,6 +7,8 @@ dovecot_users:
zeltophil: '{BLF-CRYPT}$2y$05$rct9cKgRnB/X7tZW7MXNUeIfadqCRc..dCMG4DB1fZdefH1Qx6FAq' zeltophil: '{BLF-CRYPT}$2y$05$rct9cKgRnB/X7tZW7MXNUeIfadqCRc..dCMG4DB1fZdefH1Qx6FAq'
haecksen: '{BLF-CRYPT}$2y$05$e2R8ucHVPlZuI39Uy4iX3.EaRszPJ01itsPJfQa0FIeYzBuiGxUZW' haecksen: '{BLF-CRYPT}$2y$05$e2R8ucHVPlZuI39Uy4iX3.EaRszPJ01itsPJfQa0FIeYzBuiGxUZW'
ari: '{BLF-CRYPT}$2y$05$HixjVZIVDVBKy40ReKRKh.ewnuyNV/t84ANsOSjOuxz5BIgk/J7k6' ari: '{BLF-CRYPT}$2y$05$HixjVZIVDVBKy40ReKRKh.ewnuyNV/t84ANsOSjOuxz5BIgk/J7k6'
vorstand: '{BLF-CRYPT}$2y$05$Cw.dfEg54gvRIhT9bDCx1O7xS4TtWf/c7Hh9Owzaf23imfwltMd4e'
fritz: '{BLF-CRYPT}$2y$05$NFh8LBoHfkazQDy3iNiuWODSP.rib.jIEDyf/JUbyBnQbJ03FglI6'
mlmmj_lists: mlmmj_lists:
- name: 'vorstand' - name: 'vorstand'

View file

@ -1,8 +1,7 @@
--- ---
- hosts: - name: Deploy haproxy
hosts:
- emma - emma
become: true
become: yes
roles: roles:
- haproxy - haproxy

View file

@ -0,0 +1,14 @@
user_mgmt:
crest:
state: present
groups: sudo
fritz:
state: present
groups: sudo
humm:
state: present
groups: sudo
genofire:
state: present
groups: sudo

View file

@ -6,6 +6,7 @@ postfix_my_networks:
- '2a01:4f8:150:926f::2' - '2a01:4f8:150:926f::2'
- '176.9.59.104' - '176.9.59.104'
- '127.0.0.1' - '127.0.0.1'
- '10.0.0.0/24'
haproxy_v4: 176.9.59.104 haproxy_v4: 176.9.59.104
haproxy_v6: 2a01:4f8:150:926f::2 haproxy_v6: 2a01:4f8:150:926f::2
@ -32,14 +33,14 @@ haproxy_http:
addr: '2a01:4f8:150:926f::11' addr: '2a01:4f8:150:926f::11'
- host: 'kasse.z1.ccchb.de' - host: 'kasse.z1.ccchb.de'
addr: '2a01:4f8:150:926f::11' addr: '2a01:4f8:150:926f::11'
- host: 'kasse.zweigstelle.space'
addr: '2a01:4f8:150:926f::11'
- host: 'jabber.ccchb.de' - host: 'jabber.ccchb.de'
addr: '2a01:4f8:150:926f::13' addr: '2a01:4f8:150:926f::13'
- host: 'matrix.ccchb.de' - host: 'matrix.ccchb.de'
addr: '2a01:4f8:150:926f::13' addr: '2a01:4f8:150:926f::13'
- host: 'element.ccchb.de' - host: 'auth.ccchb.de'
addr: '2a01:4f8:150:926f::13' addr: '2a01:4f8:150:926f::11'
- host: 'kasse.ccchb.de'
addr: '2a01:4f8:150:926f::19'
haproxy_sni: haproxy_sni:
- host: 'ccchb.de' - host: 'ccchb.de'
@ -60,14 +61,12 @@ haproxy_sni:
addr: '2a01:4f8:150:926f::11' addr: '2a01:4f8:150:926f::11'
- host: 'kasse.z1.ccchb.de' - host: 'kasse.z1.ccchb.de'
addr: '2a01:4f8:150:926f::11' addr: '2a01:4f8:150:926f::11'
- host: 'kasse.zweigstelle.space'
addr: '2a01:4f8:150:926f::11'
- host: 'jabber.ccchb.de' - host: 'jabber.ccchb.de'
addr: '2a01:4f8:150:926f::13' addr: '2a01:4f8:150:926f::13'
- host: 'matrix.ccchb.de' - host: 'auth.ccchb.de'
addr: '2a01:4f8:150:926f::13' addr: '2a01:4f8:150:926f::11'
- host: 'element.ccchb.de' - host: 'kasse.ccchb.de'
addr: '2a01:4f8:150:926f::13' addr: '2a01:4f8:150:926f::19'
bhyve_ipv4: 10.0.0.0 bhyve_ipv4: 10.0.0.0
bhyve_ipv6: 2a01:4f8:150:926f::4 bhyve_ipv6: 2a01:4f8:150:926f::4
@ -97,7 +96,7 @@ bhyve_guests:
- name: dn42 - name: dn42
index: 1 index: 1
enabled: true enabled: false
ram: 1G ram: 1G
cpus: 1 cpus: 1
image: debian-10.5.0-amd64-netinst.iso image: debian-10.5.0-amd64-netinst.iso
@ -115,7 +114,6 @@ bhyve_guests:
enabled: true enabled: true
ram: 1G ram: 1G
cpus: 1 cpus: 1
password: foobar
image: debian-10.5.0-amd64-netinst.iso image: debian-10.5.0-amd64-netinst.iso
order: order:
- DISKS - DISKS
@ -128,10 +126,9 @@ bhyve_guests:
- name: geno-playground - name: geno-playground
index: 3 index: 3
enabled: true enabled: false
ram: 4G ram: 4G
cpus: 4 cpus: 4
password: foobar
image: manjaro-architect-20.0.3-200607-linux56.iso image: manjaro-architect-20.0.3-200607-linux56.iso
order: order:
- DISKS - DISKS
@ -175,10 +172,9 @@ bhyve_guests:
- name: wiki - name: wiki
index: 6 index: 6
enabled: true enabled: true
ram: 1G ram: 2G
cpus: 1 cpus: 1
image: debian-10.5.0-amd64-netinst.iso image: debian-10.5.0-amd64-netinst.iso
password: foobar
order: order:
- DISKS - DISKS
disks: disks:
@ -194,7 +190,6 @@ bhyve_guests:
ram: 1G ram: 1G
cpus: 1 cpus: 1
image: debian-10.5.0-amd64-netinst.iso image: debian-10.5.0-amd64-netinst.iso
password: foobar
order: order:
- DISKS - DISKS
disks: disks:
@ -210,6 +205,37 @@ bhyve_guests:
ram: 1G ram: 1G
cpus: 1 cpus: 1
image: debian-10.5.0-amd64-netinst.iso image: debian-10.5.0-amd64-netinst.iso
order:
- DISKS
disks:
- name: disk
properties:
volsize: 128g
volblocksize: 64k
primarycache: metadata
- name: frab
index: 9
enabled: false
ram: 1G
cpus: 1
image: ubuntu-22.04.1-live-server-amd64.iso
password: foobar
order:
- DISKS
disks:
- name: disk
properties:
volsize: 128g
volblocksize: 64k
primarycache: metadata
- name: verein
index: 10
enabled: true
ram: 2G
cpus: 2
image: debian-12.6.0-amd64-netinst.iso
password: foobar password: foobar
order: order:
- DISKS - DISKS

View file

@ -0,0 +1,15 @@
vm_index: 9
user_mgmt:
crest:
state: present
groups: sudo
fritz:
state: present
groups: sudo
humm:
state: present
groups: sudo
blazr:
state: present
groups: sudo

View file

@ -1,6 +1,6 @@
vm_index: 2 vm_index: 2
gitea_version: "1.13.0" gitea_version: "1.21.2"
gitea_app_name: "dev.ccchb.de" gitea_app_name: "dev.ccchb.de"
# technical: # technical:
@ -14,7 +14,7 @@ gitea_systemd_cap_net_bind_service: true
gitea_http_letsencrypt_mail: "webmaster@ccchb.de" gitea_http_letsencrypt_mail: "webmaster@ccchb.de"
gitea_ssh_domain: "dev.ccchb.de" gitea_ssh_domain: "dev.ccchb.de"
gitea_ssh_listen: "[::]" gitea_ssh_listen: "::"
gitea_ssh_port: 2222 gitea_ssh_port: 2222
gitea_start_ssh: true gitea_start_ssh: true
@ -29,6 +29,9 @@ gitea_require_signin: false
gitea_register_email_confirm: true gitea_register_email_confirm: true
gitea_enable_captcha: true gitea_enable_captcha: true
gitea_disable_registration: false
gitea_only_allow_external_registration: true
# privacy: # privacy:
gitea_offline_mode: true gitea_offline_mode: true
gitea_disable_gravatar: true gitea_disable_gravatar: true
@ -45,3 +48,6 @@ user_mgmt:
humm: humm:
state: present state: present
groups: sudo groups: sudo
fritz:
state: present
groups: sudo

2
hosts/00_brunn Normal file
View file

@ -0,0 +1,2 @@
[brunn]
brunn.ccchb.de

2
hosts/10_frab Normal file
View file

@ -0,0 +1,2 @@
[frab]
frab.emma.ccchb.de

9
jabber.yml Normal file
View file

@ -0,0 +1,9 @@
---
- name: Deploy XMPP server
hosts:
- jabber
become: true
tags: [jabber]
roles:
- certbot
- prosody

View file

@ -1,4 +1,4 @@
#!/usr/local/bin/python3.7 #!/usr/local/bin/python3
# -*- coding: utf-8 -*- # -*- coding: utf-8 -*-
# #
# (c) 2014, David Lundgren <dlundgren@syberisle.net> # (c) 2014, David Lundgren <dlundgren@syberisle.net>

View file

@ -1,22 +1,24 @@
--- ---
- hosts: - name: Install passlib
hosts:
- localhost - localhost
become: true
become: yes
tasks: tasks:
- name: Install passlib - name: Install passlib
package: ansible.builtin.package:
name: py38-passlib name: security/py-passlib
state: present state: present
- hosts: - name: Deploy mail servers
hosts:
- mail - mail
become: true
become: yes
roles: roles:
- dovecot - role: dovecot
- rspamd tags: [dovecot]
- postfix - role: rspamd
- mlmmj tags: [rspamd]
- role: postfix
tags: [postfix]
- role: mlmmj
tags: [mlmmj]

View file

@ -1,5 +1,6 @@
--- ---
- hosts: nextcloud - name: Deploy NextCloud
become: yes hosts: nextcloud
become: true
roles: roles:
- nextcloud - nextcloud

View file

@ -1,8 +1,7 @@
--- ---
- hosts: - name: Deploy local NTP server
hosts:
- mail - mail
become: true
become: yes
roles: roles:
- openntpd - openntpd

View file

@ -1,8 +1,7 @@
--- ---
- hosts: - name: Deploy restic
hosts:
- mail - mail
become: true
become: yes
roles: roles:
- restic - restic

View file

@ -10,13 +10,13 @@
- name: Set host IPv4 addresses - name: Set host IPv4 addresses
sysrc: sysrc:
name: 'ifconfig_vmnet{{ item.index }}' name: 'ifconfig_vmnet{{ item.index }}'
value: 'inet {{ bhyve_ipv4 | ipmath(2 * item.index)}}/31' value: 'inet {{ bhyve_ipv4 | ansible.utils.ipmath(2 * item.index)}}/31'
with_items: '{{ bhyve_guests }}' with_items: '{{ bhyve_guests }}'
- name: Set host IPv6 addresses - name: Set host IPv6 addresses
sysrc: sysrc:
name: 'ifconfig_vmnet{{ item.index }}_ipv6' name: 'ifconfig_vmnet{{ item.index }}_ipv6'
value: 'inet6 {{ bhyve_ipv6 | ipmath(2 * item.index)}}/127' value: 'inet6 {{ bhyve_ipv6 | ansible.utils.ipmath(2 * item.index)}}/127'
with_items: '{{ bhyve_guests }}' with_items: '{{ bhyve_guests }}'
- name: Add guest interfaces - name: Add guest interfaces

View file

@ -1,39 +1,4 @@
--- ---
- name: Install defaults
package:
name:
- zsh
- name: Download .zshrc from grml
get_url:
url: https://raw.githubusercontent.com/grml/grml-etc-core/v0.12.5/etc/zsh/zshrc
dest: /etc/zsh/zshrc
checksum: sha256:ad88c76951693c2f9c38773ed2602a9fd5c74431615c4a23aaff679b295919ce
validate_certs: false
- name: Update SSH configuration
notify: reload sshd
replace:
dest: /etc/ssh/sshd_config
regexp: '^([\#\s]*)?{{ item.key }}\s+([\w_-]+)'
replace: "{{item.key}} {{item.value}}"
with_items:
- key: PermitRootLogin
value: without-password
- key: PasswordAuthentication
value: 'no'
- key: ChallengeResponseAuthentication
value: 'no'
- key: PrintLastLog
value: 'yes'
- key: UseDNS
value: 'no'
- name: Change shell of user root
user:
name: root
shell: /usr/bin/zsh
- name: Enable sshd - name: Enable sshd
systemd: systemd:
name: sshd name: sshd
@ -44,32 +9,7 @@
notify: restart network notify: restart network
when: ipv4 is defined or ipv6 is defined when: ipv4 is defined or ipv6 is defined
template: template:
src: systemd.network src: interfaces.j2
dest: /etc/systemd/network/main.network dest: /etc/network/interfaces
owner: root owner: root
mode: 644 mode: 644
- name: enable systemd-networkd
notify: restart network
systemd:
name: systemd-networkd
state: started
enabled: yes
- name: disable networking
systemd:
name: networking
enabled: no
- name: start systemd-resolved
systemd:
name: systemd-resolved
state: started
enabled: yes
- name: symling /etc/resolve
file:
src: /run/systemd/resolve/stub-resolv.conf
dest: /etc/resolv.conf
state: link
force: yes

View file

@ -0,0 +1,16 @@
# The primary network interface
allow-hotplug enp0s3
{% if ipv4 is defined %}
iface enp0s3 inet static
address {{ipv4}}/31
gateway {{ipv4route}}
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers {{ipv4route}}
dns-search emma.ccchb.de
{% endif %}
{% if ipv6 is defined %}
iface enp0s3 inet6 static
address {{ipv6}}/127
gateway {{ipv6route}}
{% endif %}

View file

View file

@ -0,0 +1,3 @@
{
"log-driver": "journald"
}

View file

@ -0,0 +1,5 @@
---
- name: Restart docker
ansible.builtin.service:
name: docker
state: restarted

View file

@ -0,0 +1,33 @@
---
- name: Install Docker's GPG key in apt's keyring
ansible.builtin.apt_key:
url: https://download.docker.com/linux/debian/gpg
state: present
tags: docker install
- name: Setup Docker's apt repository
ansible.builtin.apt_repository:
repo: deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable
state: present
filename: docker
tags: docker install
- name: Install Docker
ansible.builtin.package:
name:
- docker-ce
- docker-ce-cli
- containerd.io
- docker-compose-plugin
state: present
tags: docker install
notify:
- Restart docker
- name: Configure Docker daemon
ansible.builtin.file:
src: daemon.json
dest: /etc/docker/daemon.json
owner: root
group: root
mode: '0644'

@ -1 +1 @@
Subproject commit 1aa082a2101c69f8cfc13a31604991b0c3dfa8e5 Subproject commit 751d0d724ba63c6251fafad9e80a480d6bc5043f

View file

@ -1,172 +0,0 @@
<!DOCTYPE html>
<html lang="{{.Language}}" class="theme-{{.SignedUser.Theme}}">
<head data-suburl="{{AppSubUrl}}">
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="x-ua-compatible" content="ie=edge">
<title>{{if .Title}}{{.Title | RenderEmojiPlain}} - {{end}} {{if .Repository.Name}}{{.Repository.Name}} - {{end}}{{AppName}} </title>
<link rel="manifest" href="{{AppSubUrl}}/manifest.json" crossorigin="use-credentials">
<meta name="theme-color" content="{{ThemeColorMetaTag}}">
<meta name="author" content="{{if .Repository}}{{.Owner.Name}}{{else}}{{MetaAuthor}}{{end}}" />
<meta name="description" content="{{if .Repository}}{{.Repository.Name}}{{if .Repository.Description}} - {{.Repository.Description}}{{end}}{{else}}{{MetaDescription}}{{end}}" />
<meta name="keywords" content="{{MetaKeywords}}">
<meta name="referrer" content="no-referrer" />
<meta name="_csrf" content="{{.CsrfToken}}" />
{{if .IsSigned}}
<meta name="_uid" content="{{.SignedUser.ID}}" />
{{end}}
{{if .ContextUser}}
<meta name="_context_uid" content="{{.ContextUser.ID}}" />
{{end}}
{{if .SearchLimit}}
<meta name="_search_limit" content="{{.SearchLimit}}" />
{{end}}
{{if .GoGetImport}}
<meta name="go-import" content="{{.GoGetImport}} git {{.CloneLink.HTTPS}}">
<meta name="go-source" content="{{.GoGetImport}} _ {{.GoDocDirectory}} {{.GoDocFile}}">
{{end}}
<script>
{{SafeJS `/*
@licstart The following is the entire license notice for the
JavaScript code in this page.
Copyright (c) 2016 The Gitea Authors
Copyright (c) 2015 The Gogs Authors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
---
Licensing information for additional javascript libraries can be found at:
{{StaticUrlPrefix}}/vendor/librejs.html
@licend The above is the entire license notice
for the JavaScript code in this page.
*/`}}
</script>
<script>
window.config = {
AppVer: '{{AppVer}}',
AppSubUrl: '{{AppSubUrl}}',
StaticUrlPrefix: '{{StaticUrlPrefix}}',
UseServiceWorker: {{UseServiceWorker}},
csrf: '{{.CsrfToken}}',
HighlightJS: {{if .RequireHighlightJS}}true{{else}}false{{end}},
Minicolors: {{if .RequireMinicolors}}true{{else}}false{{end}},
SimpleMDE: {{if .RequireSimpleMDE}}true{{else}}false{{end}},
Tribute: {{if .RequireTribute}}true{{else}}false{{end}},
U2F: {{if .RequireU2F}}true{{else}}false{{end}},
Heatmap: {{if .EnableHeatmap}}true{{else}}false{{end}},
heatmapUser: {{if .HeatmapUser}}'{{.HeatmapUser}}'{{else}}null{{end}},
NotificationSettings: {
MinTimeout: {{NotificationSettings.MinTimeout}},
TimeoutStep: {{NotificationSettings.TimeoutStep}},
MaxTimeout: {{NotificationSettings.MaxTimeout}},
EventSourceUpdateTime: {{NotificationSettings.EventSourceUpdateTime}},
},
{{if .RequireTribute}}
tributeValues: [
{{ range .Assignees }}
{key: '{{.Name}} {{.FullName}}', value: '{{.Name}}',
name: '{{.Name}}', fullname: '{{.FullName}}', avatar: '{{.RelAvatarLink}}'},
{{ end }}
],
{{end}}
};
</script>
<link rel="shortcut icon" href="{{StaticUrlPrefix}}/img/favicon.png">
<link rel="mask-icon" href="{{StaticUrlPrefix}}/img/gitea-safari.svg" color="#609926">
<link rel="fluid-icon" href="{{StaticUrlPrefix}}/img/gitea-lg.png" title="{{AppName}}">
<link rel="stylesheet" href="{{StaticUrlPrefix}}/vendor/assets/font-awesome/css/font-awesome.min.css">
{{if .RequireSimpleMDE}}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/vendor/plugins/simplemde/simplemde.min.css">
{{end}}
{{if .RequireTribute}}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/vendor/plugins/tribute/tribute.css">
{{end}}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/fomantic/semantic.min.css?v={{MD5 AppVer}}">
<link rel="stylesheet" href="{{StaticUrlPrefix}}/css/index.css?v={{MD5 AppVer}}">
<noscript>
<style>
.dropdown:hover > .menu { display: block; }
.ui.secondary.menu .dropdown.item > .menu { margin-top: 0; }
</style>
</noscript>
{{if .RequireMinicolors}}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/vendor/plugins/jquery.minicolors/jquery.minicolors.css">
{{end}}
<style class="list-search-style"></style>
{{if .PageIsUserProfile}}
<meta property="og:title" content="{{.Owner.Name}}" />
<meta property="og:type" content="profile" />
<meta property="og:image" content="{{.Owner.AvatarLink}}" />
<meta property="og:url" content="{{.Owner.HTMLURL}}" />
{{if .Owner.Description}}
<meta property="og:description" content="{{.Owner.Description}}">
{{end}}
{{else if .Repository}}
{{if .Issue}}
<meta property="og:title" content="{{.Issue.Title}}" />
<meta property="og:url" content="{{.Issue.HTMLURL}}" />
{{if .Issue.Content}}
<meta property="og:description" content="{{.Issue.Content}}" />
{{end}}
{{else}}
<meta property="og:title" content="{{.Repository.Name}}" />
<meta property="og:url" content="{{.Repository.HTMLURL}}" />
{{if .Repository.Description}}
<meta property="og:description" content="{{.Repository.Description}}" />
{{end}}
{{end}}
<meta property="og:type" content="object" />
<meta property="og:image" content="{{.Repository.Owner.AvatarLink}}" />
{{else}}
<meta property="og:title" content="{{AppName}}">
<meta property="og:type" content="website" />
<meta property="og:image" content="{{StaticUrlPrefix}}/img/gitea-lg.png" />
<meta property="og:url" content="{{AppUrl}}" />
<meta property="og:description" content="{{MetaDescription}}">
{{end}}
<meta property="og:site_name" content="{{AppName}}" />
{{if .IsSigned }}
{{ if ne .SignedUser.Theme "gitea" }}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/css/theme-{{.SignedUser.Theme}}.css?v={{MD5 AppVer}}">
{{end}}
{{else if ne DefaultTheme "gitea"}}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/css/theme-{{DefaultTheme}}.css?v={{MD5 AppVer}}">
{{end}}
{{template "custom/header" .}}
</head>
<body>
{{template "custom/body_outer_pre" .}}
<div class="full height">
<noscript>{{.i18n.Tr "enable_javascript"}}</noscript>
{{template "custom/body_inner_pre" .}}
{{if not .PageIsInstall}}
<div class="ui top secondary stackable main menu following bar light inverted">
{{template "base/head_navbar" .}}
</div><!-- end bar -->
{{end}}
{{/*
</div>
</body>
</html>
*/}}

View file

@ -1,20 +1,20 @@
--- ---
- name: Reload s6-rc - name: Reload s6-rc
service: ansible.builtin.service:
name: s6-rc name: s6-rc
state: reloaded state: reloaded
- name: Restart Postfix - name: Restart Postfix
command: s6-svc -wU -T 5000 -ru {{ s6_scan_dir }}/postfix ansible.builtin.command: s6-svc -wU -T 5000 -ru {{ s6_scan_dir }}/postfix
- name: Restart Postfix log - name: Restart Postfix log
command: s6-svc -wU -T 5000 -ru {{ s6_scan_dir }}/postfix-log ansible.builtin.command: s6-svc -wU -T 5000 -ru {{ s6_scan_dir }}/postfix-log
- name: Reload Postfix - name: Reload Postfix
command: s6-svc -h {{ s6_scan_dir }}/postfix ansible.builtin.command: s6-svc -h {{ s6_scan_dir }}/postfix
- name: Rebuild Postfix maps - name: Rebuild Postfix maps
command: 'postmap {{ item.type }}:{{ item.name }}' ansible.builtin.command: 'postmap {{ item.type }}:{{ item.name }}'
args: args:
chdir: /usr/local/etc/postfix chdir: /usr/local/etc/postfix
when: item.type in postfix_rebuild_types when: item.type in postfix_rebuild_types

View file

@ -1,27 +1,27 @@
--- ---
- name: Install Postfix - name: Install Postfix
package: ansible.builtin.package:
name: postfix name: postfix
state: present state: present
notify: notify:
- Restart Postfix - Restart Postfix
- name: Create /usr/local/etc/mail - name: Create /usr/local/etc/mail
file: ansible.builtin.file:
path: /usr/local/etc/mail path: /usr/local/etc/mail
state: directory state: directory
owner: root owner: root
group: wheel group: wheel
mode: 0755 mode: '0755'
- name: Install Postfix mailer.conf - name: Install Postfix mailer.conf
copy: ansible.builtin.copy:
dest: /usr/local/etc/mail/mailer.conf dest: /usr/local/etc/mail/mailer.conf
src: /usr/local/share/postfix/mailer.conf.postfix src: /usr/local/share/postfix/mailer.conf.postfix
remote_src: yes remote_src: true
owner: root owner: root
group: wheel group: wheel
mode: 0644 mode: '0644'
- name: Disable sendmail - name: Disable sendmail
sysrc: sysrc:
@ -29,22 +29,22 @@
value: NONE value: NONE
- name: Make sure sendmail is stopped - name: Make sure sendmail is stopped
service: ansible.builtin.service:
name: sendmail name: sendmail
state: stopped state: stopped
- name: Disable sendmail periodic tasks - name: Disable sendmail periodic tasks
lineinfile: ansible.builtin.lineinfile:
path: /etc/periodic.conf path: /etc/periodic.conf
owner: root owner: root
group: wheel group: wheel
mode: 0444 mode: '0444'
regexp: '^{{ item }}=' regexp: '^{{ item }}='
line: '{{ item }}="NO"' line: '{{ item }}="NO"'
with_items: '{{ sendmail_periodic }}' with_items: '{{ sendmail_periodic }}'
- name: Add /var/log/postfix to fstab - name: Add /var/log/postfix to fstab
mount: ansible.posix.mount:
path: /var/log/postfix path: /var/log/postfix
src: tmpfs src: tmpfs
fstype: tmpfs fstype: tmpfs
@ -52,19 +52,19 @@
state: mounted state: mounted
- name: Create Postfix service directories - name: Create Postfix service directories
file: ansible.builtin.file:
path: '{{ s6_etc_dir }}/service/{{ item }}' path: '{{ s6_etc_dir }}/service/{{ item }}'
state: directory state: directory
owner: root owner: root
group: wheel group: wheel
mode: 0755 mode: '0755'
with_items: '{{ postfix_service_dirs }}' with_items: '{{ postfix_service_dirs }}'
- name: Generate Postfix service scripts - name: Generate Postfix service scripts
template: ansible.builtin.template:
dest: '{{ s6_etc_dir }}/service/{{ item }}' dest: '{{ s6_etc_dir }}/service/{{ item }}'
src: '{{ item }}.j2' src: '{{ item }}.j2'
mode: 0555 mode: '0555'
owner: root owner: root
group: wheel group: wheel
with_items: '{{ postfix_service_scripts }}' with_items: '{{ postfix_service_scripts }}'
@ -73,24 +73,24 @@
- Restart Postfix - Restart Postfix
- name: Generate Postfix service configuration - name: Generate Postfix service configuration
copy: ansible.builtin.copy:
dest: '{{ s6_etc_dir }}/service/{{ item.name }}' dest: '{{ s6_etc_dir }}/service/{{ item.name }}'
content: '{{ item.content }}' content: '{{ item.content }}'
mode: 0444 mode: '0444'
owner: root owner: root
group: wheel group: wheel
loop_control: loop_control:
label: '{{ item.name }} = {{ item.content }}' label: '{{ item.name }} = {{ item.content }}'
notify: notify:
- Reload s6-rc - Reload s6-rc
- Restart Postfix - Restart Postfix
with_items: '{{ postfix_service_config }}' with_items: '{{ postfix_service_config }}'
- name: Generate Postfix maps - name: Generate Postfix maps
template: ansible.builtin.template:
dest: '/usr/local/etc/postfix/{{ item.name }}' dest: '/usr/local/etc/postfix/{{ item.name }}'
src: '{{ item.name }}.j2' src: '{{ item.name }}.j2'
mode: 0444 mode: '0444'
owner: root owner: root
group: wheel group: wheel
with_items: '{{ postfix_maps }}' with_items: '{{ postfix_maps }}'
@ -108,7 +108,7 @@
- Reload Postfix - Reload Postfix
- name: Configure Postfix services - name: Configure Postfix services
lineinfile: ansible.builtin.lineinfile:
path: /usr/local/etc/postfix/master.cf path: /usr/local/etc/postfix/master.cf
regexp: '^{{ item.name }} +{{ item.type }}' regexp: '^{{ item.name }} +{{ item.type }}'
value: '{{ item.value }}' value: '{{ item.value }}'
@ -126,15 +126,15 @@
- Restart Postfix - Restart Postfix
- name: Flush handlers - name: Flush handlers
meta: flush_handlers ansible.builtin.meta: flush_handlers
- name: Start Postfix - name: Start Postfix
command: fdmove -c 2 1 s6-rc -l {{ s6_live_dir }} -u -v 2 change postfix ansible.builtin.command: fdmove -c 2 1 s6-rc -l {{ s6_live_dir }} -u -v 2 change postfix
register: change register: change
changed_when: change.stdout | length > 0 changed_when: change.stdout | length > 0
- name: Enable Postfix - name: Enable Postfix
lineinfile: ansible.builtin.lineinfile:
path: '{{ s6_etc_dir }}/service/enabled/contents' path: '{{ s6_etc_dir }}/service/enabled/contents'
regexp: "^postfix$" regexp: "^postfix$"
line: "postfix" line: "postfix"
@ -142,4 +142,4 @@
- Reload s6-rc - Reload s6-rc
- name: Flush handlers (again) - name: Flush handlers (again)
meta: flush_handlers ansible.builtin.meta: flush_handlers

View file

@ -63,6 +63,7 @@ postfix_virtual_aliases:
- hostmaster@ccchb.de crest@ccchb.de - hostmaster@ccchb.de crest@ccchb.de
- thoddi@ccchb.de mail@thoddi.de - thoddi@ccchb.de mail@thoddi.de
- docloc@ccchb.de docloc@posteo.net - docloc@ccchb.de docloc@posteo.net
- fritz@ccchb.de fritz@grimpen.net
- root@lists.ccchb.de crest@ccchb.de - root@lists.ccchb.de crest@ccchb.de
- crest@lists.ccchb.de crest@ccchb.de - crest@lists.ccchb.de crest@ccchb.de
@ -72,6 +73,8 @@ postfix_virtual_aliases:
- postmaster@lists.ccchb.de crest@ccchb.de - postmaster@lists.ccchb.de crest@ccchb.de
- hostmaster@lists.ccchb.de crest@ccchb.de - hostmaster@lists.ccchb.de crest@ccchb.de
- reddit@ccchb.de crest@ccchb.de
postfix_service_dirs: postfix_service_dirs:
- postfix - postfix
- postfix/env - postfix/env
@ -352,6 +355,14 @@ postfix_config:
value: 'aNULL' value: 'aNULL'
state: present state: present
- name: smtpd_tls_mandatory_protocols
value: 'TLSv1.2 TLSv1.3'
state: present
- name: smtpd_tls_protocols
value: 'TLSv1.2 TLSv1.3'
state: present
- name: smtpd_tls_received_header - name: smtpd_tls_received_header
value: 'yes' value: 'yes'
state: present state: present
@ -369,7 +380,8 @@ postfix_config:
state: present state: present
- name: tls_high_cipherlist - name: tls_high_cipherlist
value: 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA' value: |-
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
state: present state: present
- name: tls_ssl_options - name: tls_ssl_options

View file

@ -1,44 +1,12 @@
--- ---
prosody_domain: "jabber.ccchb.de" prosody_domain: "jabber.ccchb.de"
prosody_ssl_cert: "/etc/letsencrypt/live/{{ prosody_domain }}/fullchain.pem" prosody_ssl_cert: "/etc/prosody/certs/fullchain.pem"
prosody_ssl_key: "/etc/letsencrypt/live/{{ prosody_domain }}/privkey.pem" prosody_ssl_key: "/etc/prosody/certs/privkey.pem"
prosody_allow_registration: false prosody_allow_registration: false
prosody_modules:
- roster prosody_http_url: "https://jabber.ccchb.de/"
- saslauth prosody_turn_server: "einstein.cskreie.de"
- tls prosody_turn_secret: "gabbagabbahey"
- dialback
- disco
- private
- bookmarks
- vcard
- proxy65
- legacyauth
- version
- uptime
- time
- ping
- pep
- register
- adhoc
- admin_adhoc
- posix
- bosh
- websocket
- groups
- announce
- watchregistrations
- blocking
- smacks
- carbons
- cloud_notify
- csi
- mam
- filter_chatstates
- throttle_presence
- http_upload
- turncredentials
- vcard_legacy
prosody_nginx_install: true prosody_nginx_install: true
prosody_nginx_conf: | prosody_nginx_conf: |

View file

@ -16,6 +16,6 @@
- name: Configure prosody - name: Configure prosody
template: template:
src: prosody.cfg.lua.j2 src: prosody.cfg.lua.j2
dest: /etc/prosody/prosody_test.cfg.lua dest: /etc/prosody/prosody.cfg.lua
... ...

View file

@ -15,4 +15,8 @@ server {
proxy_set_header Host {{ prosody_domain }}; proxy_set_header Host {{ prosody_domain }};
proxy_pass http://127.0.0.1:5280/upload; proxy_pass http://127.0.0.1:5280/upload;
} }
location /file_share {
proxy_pass http://127.0.0.1:5280/file_share;
}
} }

View file

@ -1,126 +1,73 @@
-- Prosody XMPP Server Configuration
-- {{ ansible_managed }} -- {{ ansible_managed }}
---------- Server-wide settings ----------
-- Settings in this section apply to the whole server and are the default settings
-- for any virtual hosts
-- This is a (by default, empty) list of accounts that are admins
-- for the server. Note that you must create the accounts separately
-- (see http://prosody.im/doc/creating_accounts for info)
-- Example: admins = { "user1@example.com", "user2@example.net" }
admins = { "deelkar@jabber.ccchb.de", "freak@jabber.ccchb.de", "jali@jabber.ccchb.de" } admins = { "deelkar@jabber.ccchb.de", "freak@jabber.ccchb.de", "jali@jabber.ccchb.de" }
-- Enable use of libevent for better performance under high load use_libevent = true;
-- For more information see: http://prosody.im/doc/libevent
use_libevent = false;
plugin_paths = { "/opt/prosody-modules" }
-- This is the list of modules Prosody will load on startup.
-- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too.
-- Documentation on modules can be found at: http://prosody.im/doc/modules
modules_enabled = { modules_enabled = {
{% for module in prosody_modules %} -- Generally required
"{{ module }}"; "roster";
{% endfor %} "saslauth";
"tls";
"dialback";
"disco";
"posix";
"private";
-- Nice to have
"version";
"uptime";
"time";
"ping";
"pep";
"register";
-- Admin interfaces
"admin_adhoc";
"admin_shell";
-- HTTP modules
"bosh";
"http_files";
"http_file_share";
-- Other specific functionality
"groups";
"watchregistrations";
"turn_external";
"carbons";
"blocklist";
"mam";
"csi_simple";
"vcard_legacy";
"proxy65";
}; };
-- These modules are auto-loaded, should you allow_registration = {% if prosody_allow_registration then "True" else "False" %};
-- (for some mad reason) want to disable
-- them then uncomment them below
modules_disabled = {
-- "presence"; -- Route user/contact status information
-- "message"; -- Route messages
-- "iq"; -- Route info queries
-- "offline"; -- Store offline messages
};
-- Disable account creation by default, for security c2s_require_encryption = true
-- For more information see http://prosody.im/doc/creating_accounts s2s_secure_auth = false
allow_registration = {{ prosody_allow_registration }};
-- These are the SSL/TLS-related settings. If you don't want -- PID file, necessary for prosodyctl
-- to use SSL/TLS, you may comment or remove this pidfile = "/var/run/prosody/prosody.pid"
-- *** DUMMY CERT *** DO NOT CHANGE *** SET CERT IN HOST SECTION ***
ssl = {
protocol = "sslv23";
key = "{{ prosody_ssl_key }}";
certificate = "{{ prosody_ssl_cert }}";
dhparam = "/etc/prosody/certs/dh-2048.pem";
options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" };
ciphers = "ECDH:DH:HIGH+kEDH:HIGH+kEECDH:HIGH:!CAMELLIA128:!3DES:!MD5:!RC4:!aNULL:!NULL:!EXPORT:!LOW:!MEDIUM";
}
legacy_ssl_ports = { 5223 }
http_external_url = "https://{{ prosody_domain }}/"
-- Only allow encrypted streams? Encryption is already used when
-- available. These options will cause Prosody to deny connections that
-- are not encrypted. Note that some servers do not support s2s
-- encryption or have it disabled, including gmail.com and Google Apps
-- domains.
--c2s_require_encryption = false
--s2s_require_encryption = false
-- Select the authentication backend to use. The 'internal' providers
-- use Prosody's configured data storage to store the authentication data.
-- To allow Prosody to offer secure authentication mechanisms to clients, the
-- default provider stores passwords in plaintext. If you do not trust your
-- server please see http://prosody.im/doc/modules/mod_auth_internal_hashed
-- for information about using the hashed backend.
authentication = "internal_hashed" authentication = "internal_hashed"
-- Select the storage backend to use. By default Prosody uses flat files
-- in its configured data directory, but it also supports more backends
-- through modules. An "sql" backend is included by default, but requires
-- additional dependencies. See http://prosody.im/doc/storage for more info.
--storage = "sql" -- Default is "internal"
-- For the "sql" backend, you can uncomment *one* of the below to configure:
--sql = { driver = "SQLite3", database = "prosody.sqlite" } -- Default. 'database' is the filename.
--sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
--sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
-- STUN/TURN
--turncredentials_host = "jabber.emma.ccchb.de"
turncredentials_host = "einstein.cskreie.de"
turncredentials_secret = "gabbagabbahey"
-- HTTP-UPLOAD
http_upload_file_size_limit = 10485760 -- 10M
http_max_content_size = 20971520 -- 20M
http_upload_quota = 104857600 -- 100M
http_upload_expire_after = 2592000 -- 30d
-- Logging configuration
-- For advanced logging see http://prosody.im/doc/logging
-- Hint: If you create a new log file or rename them, don't forget
-- to update the logrotate config at /etc/logrotate.d/prosody
log = { log = {
-- Log all error messages to prosody.err
error = "/var/log/prosody/prosody.err"; error = "/var/log/prosody/prosody.err";
-- Log everything of level "info" and higher (that is, all except "debug" messages)
-- to prosody.log
-- info = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for more verbose logging
-- debug = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for more verbose logging
--"*syslog"; -- Uncomment this for logging to syslog
} }
-- Pidfile, used by prosodyctl and the init.d script -- TODO: Fix escaping
pidfile = "/var/run/prosody/prosody.pid"; http_external_url = "{{ prosody_http_url }}"
trusted_proxies = { "127.0.0.1", "::1", "192.168.1.1", }
-- TURN Server
turn_external_host = "{{ prosody_turn_server }}"
turn_external_secret = "{{ prosody_turn_secret }}"
----------- Virtual hosts -----------
-- You need to add a VirtualHost entry for each domain you wish Prosody to serve.
-- Settings under each VirtualHost entry apply *only* to that host.
VirtualHost "localhost" VirtualHost "localhost"
VirtualHost "{{ prosody_domain }}" VirtualHost "jabber.ccchb.de"
enabled = true -- Remove this line to enable this host enabled = true -- Remove this line to enable this host
-- Assign this host a certificate for TLS, otherwise it would use the one -- Assign this host a certificate for TLS, otherwise it would use the one
@ -128,33 +75,18 @@ VirtualHost "{{ prosody_domain }}"
-- Note that old-style SSL on port 5223 only supports one certificate, and will always -- Note that old-style SSL on port 5223 only supports one certificate, and will always
-- use the global one. -- use the global one.
ssl = { ssl = {
protocol = "sslv23"; protocol = "tlsv1_2+";
key = "{{ prosody_ssl_key }}"; key = "{{ prosody_ssl_key }}";
certificate = "{{ prosody_ssl_cert }}"; certificate = "{{ prosody_ssl_cert }}";
dhparam = "/etc/prosody/certs/dh-2048.pem"; dhparam = "/etc/prosody/certs/dh-2048.pem";
options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" }; -- TODO: Evaluate allowed ciphers
ciphers = "ECDH:DH:HIGH+kEDH:HIGH+kEECDH:HIGH:!CAMELLIA128:!3DES:!MD5:!RC4:!aNULL:!NULL:!EXPORT:!LOW:!MEDIUM"; ciphers = "ECDH:DH:HIGH+kEDH:HIGH+kEECDH:HIGH:!CAMELLIA128:!3DES:!MD5:!RC4:!aNULL:!NULL:!EXPORT:!LOW:!MEDIUM";
} }
------ Components ------ Component "muc.jabber.ccchb.de" "muc"
-- You can specify components to add hosts that provide special services, modules_enabled = {
-- like multi-user conferences, and transports. "vcard_muc",
-- For more information on components, see http://prosody.im/doc/components "muc_mam"
}
---Set up a MUC (multi-user chat) room server on conference.example.com:
Component "muc.{{ prosody_domain }}" "muc"
modules_enabled = {
"vcard_muc", "muc_mam",
}
-- Set up a SOCKS5 bytestream proxy for server-proxied file transfers:
--Component "proxy.example.com" "proxy65"
---Set up an external component (default component port is 5347)
--
-- External components allow adding various services, such as gateways/
-- transports to other networks like ICQ, MSN and Yahoo. For more info
-- see: http://prosody.im/doc/components#adding_an_external_component
--
--Component "gateway.example.com"
-- component_secret = "password"
Component "upload.jabber.ccchb.de" "http_file_share"

View file

@ -16,9 +16,9 @@ EX_CONFIG=78
export PATH="$PATH:/usr/local/bin:/usr/local/sbin" export PATH="$PATH:/usr/local/bin:/usr/local/sbin"
name=s6-rc name=s6_rc
rcvar=s6_rc_enable rcvar=s6_rc_enable
extra_commands="reload" extra_commands="reload status"
start_cmd="s6_rc_start &" start_cmd="s6_rc_start &"
stop_cmd="s6_rc_stop" stop_cmd="s6_rc_stop"

7
s6.yml
View file

@ -1,8 +1,7 @@
--- ---
- hosts: - name: Deploy s6 on FreeBSD
hosts:
- emma - emma
become: true
become: yes
roles: roles:
- s6-rc - s6-rc

View file

@ -7,3 +7,4 @@
- import_playbook: mail.yml - import_playbook: mail.yml
- import_playbook: restic.yml - import_playbook: restic.yml
- import_playbook: wiki.yml - import_playbook: wiki.yml
- import_playbook: users.yml

7
users.yml Normal file
View file

@ -0,0 +1,7 @@
---
- name: Perform user management
hosts: debian frab brunn
become: true
tags: [user_mgmt]
roles:
- user_mgmt

View file

@ -1,7 +1,8 @@
--- ---
- hosts: - name: Deploy MediaWiki
hosts:
- wiki - wiki
become: yes become: true
roles: roles:
- mediawiki - mediawiki
- certbot - certbot