Compare commits

..

53 commits

Author SHA1 Message Date
167702d345 CI: Override submodule URI 2024-11-09 03:48:01 +01:00
d73003647b CI: Use correct image for git pull 2024-11-09 03:47:08 +01:00
ffb11979c2 CI: Override submodule clone URI 2024-11-09 03:46:19 +01:00
78a9b5db85 run ansible lint in ci 2024-11-09 03:44:13 +01:00
a60f6eb0a2 add brunn.ccchb.de 2024-11-02 21:09:24 +01:00
c9571efbb6 fix tls_high_cipherlist setting for postfix 2024-10-15 22:03:51 +02:00
acb6cb6418 Re-add vorstand@ and fritz@ mailboxes 2024-10-15 22:03:06 +02:00
Crest
ae3074789a Invoke ipmath by its full name.
Closes #33.
2024-10-02 15:17:26 +02:00
Crest
e882a4760b Install passlib module for default Python version.
Referencing the package to install by origin port
instead of resulting package name picks the default
flavor of the port thus avoids depending on a specific
Python version.

Updates #33.
2024-10-02 14:39:11 +02:00
Crest
c1c2e0c2c0 Use the default Python version on FreeBSD.
Change ansible_python_interpreter from
/usr/local/bin/python3.9 to /usr/local/bin/python.

Updates #33.
2024-10-02 14:25:39 +02:00
Crest
7c9d689845 Merge branch 'master' of ssh://dev.ccchb.de:2222/ccchb/ansible 2024-10-01 13:17:46 +02:00
Crest
168912e8ab Add stupid alias for stupid games 2024-10-01 13:17:37 +02:00
a4f5536f12 Stricter TLS ciphersuites for Postfix (SMTP) 2024-09-17 20:15:33 +02:00
7784501da5 Add tags to mail playbook 2024-09-17 19:28:49 +02:00
ca8217859d Fix hasty typos 2024-09-17 19:18:39 +02:00
6c41934194 Lint postfix role 2024-09-17 16:50:09 +00:00
f6ccbbf5eb Add debian_docker role 2024-09-17 16:34:45 +00:00
08ef92627e Add descriptions for playbook tasks 2024-09-17 16:15:28 +00:00
2140a1428c debian: Do not change shell and use debian-owned facilities for networking 2024-09-17 16:30:44 +02:00
ec110faf41 Unify file name extensions for group vars 2024-09-17 16:29:51 +02:00
4454b87c35 Add user account for fritz 2024-09-08 19:32:33 +00:00
97bbb55052 Add mail password for vorstand 2024-09-08 17:16:17 +00:00
2b25e7178a Add virtual machine `verein' 2024-08-09 19:27:45 +00:00
Crest
de3575a991 Merge branch 'master' of ssh://dev.ccchb.de:2222/ccchb/ansible 2024-08-06 16:59:17 +02:00
6784efe5da haproxy hinzugefügt 2024-08-06 02:38:07 +02:00
bf89318990 add virtual machines 2024-07-02 21:24:41 +02:00
Crest
954a51901e Merge branch 'master' of ssh://dev.ccchb.de:2222/ccchb/ansible 2024-06-03 11:48:41 +02:00
Crest
9190f1893d Add NetAddr python module by origin 2024-06-03 11:48:30 +02:00
ef539d8745 unbenutzte vms deaktiviert 2024-03-25 14:32:59 +00:00
9131854211 haproxy-redirects aufgeräumt 2024-03-25 14:20:17 +00:00
Crest
0cbb0fe140 Merge branch 'master' of ssh://dev.ccchb.de:2222/ccchb/ansible 2024-03-13 17:34:22 +01:00
Crest
38d98dc70d Disable VNC 2024-03-13 12:41:25 +01:00
a3610995f0 gives me acces 2024-02-06 22:21:57 +01:00
81803de24e Add reverse proxy for auth.ccchb.de 2024-02-06 22:21:24 +01:00
8b43765a27 Update Prosody config 2023-12-20 20:26:48 +00:00
01647698b2 roles/prosody: Current configuration 2022-12-31 04:29:35 +01:00
6a7110194d Foo 2022-12-29 19:13:28 +01:00
e53fbcb802 Add rudimentary README 2022-11-26 23:50:39 +00:00
3ad3372f84 Jabber stuff 2022-11-26 23:49:01 +00:00
f5a258b9a1 Changes 2022-11-26 22:38:59 +01:00
ca45f138f9 Define frab vm for blazr 2022-11-26 20:55:44 +01:00
597664f66e add my ssh key 2022-11-01 14:42:38 +00:00
Crest
27448d7da4 Expose "service s6-rc status" extra command 2022-10-26 17:45:18 +02:00
Crest
1b58f2cc9d Don't depend on a specific Python 3.x version 2022-10-26 15:27:17 +02:00
Crest
cb492e504a Upgrade bhyve.yml to Python 3.9 as well *sigh* 2022-10-26 15:05:10 +02:00
Crest
6c6167b677 Require py39-passlib instead of py38-passlib 2022-10-26 14:43:10 +02:00
Crest
81e83eedbb Merge branch 'master' of ssh://dev.ccchb.de:2222/ccchb/ansible 2022-10-26 14:41:51 +02:00
Crest
4540289fc6 Disable geno's playground as it's stuck in a bootloop. 2022-10-26 14:40:35 +02:00
Crest
5956195dde Update default Python from 3.8 to 3.9 2022-10-26 14:36:35 +02:00
08d0fc382c Add user account for humm 2022-08-28 04:59:44 -05:00
a1fd5f1f91 chore(gitea-ccchb): remove black navibar with black logo) 2022-08-21 13:18:56 +02:00
093eda76b6 chore(vars/group/all): update genofire's ssh-keys 2022-08-21 13:05:19 +02:00
5662be9478 fix(gitea): update to v1.17.1 - security 2022-08-21 13:02:50 +02:00
44 changed files with 375 additions and 518 deletions

20
.woodpecker.yaml Normal file
View file

@ -0,0 +1,20 @@
clone:
git:
image: woodpeckerci/plugin-git
settings:
submodule_override:
roles/gitea: https://dev.ccchb.de/ccchb/ansible-role-gitea.git
when:
- event: push
branch: main
- event: push
branch: master
steps:
- name: lint
image: alpine
commands:
- apk update
- apk add ansible-lint
- ansible-lint

View file

@ -1,3 +1,9 @@
# ansible
[![status-badge](https://ci.ccchb.de/api/badges/5/status.svg)](https://ci.ccchb.de/repos/5)
CCCHB Ansible
## Deployment
ansible-playbook -i hosts/ [-l HOSTS] [-t TAGS] sites.yml

View file

@ -1,19 +1,18 @@
---
- hosts:
- name: Install py-netaddr
hosts:
- localhost
become: yes
become: true
tasks:
- name: Install passlib
package:
name: py38-netaddr
- name: Install py-netaddr package
ansible.builtin.package:
name: net/py-netaddr
state: present
- hosts:
- name: Deploy bhyve to virtual machine hosts
hosts:
- emma
become: yes
become: true
tags: bhyve
roles:
- bhyve

View file

@ -1,6 +1,6 @@
---
- hosts: debian
become: yes
- name: Prepare debian hosts
hosts: debian
become: true
roles:
- debian
- { role: user_mgmt, tags: [user_mgmt]}

View file

@ -1,9 +1,8 @@
---
- hosts:
- name: Deploy DNS servers
hosts:
- mail
become: yes
become: true
roles:
- nsd
- unbound

View file

@ -1,6 +1,7 @@
---
- hosts: gitea
become: yes
- name: Deploy Forgejo
hosts: gitea
become: true
roles:
- gitea
- gitea-ccchb

View file

@ -10,14 +10,16 @@ user_mgmt_default:
genofire:
ssh_key:
present:
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZm0TZPBzgXrY1vrLoYviNRb/oGZQDQk9vrppPK84sN55ZPlr9VvP+JYE7Qkx8teRuH9ulxqX40+dxKaiAXMUl4HU57KPLjwCb7SnBNIFTv6ZHGxPS8ZgUzKJr4Agph51oenNEO3RziEqAo3EwK67SGnjeIYQQKcjpfwd08+PYMOjv42zSYQ9umooj5LooOvbxoogZ3VpboXv6DeyA4rev1M9RgnMWaWVF2LxJjQ3jVr7xh1vZktVGKuVk/XXKD6WVAuwmGMVEouQzjtG9kepWd8FUYe+fgj5mtdqfeQP9CypxvOcb7jT20wO1Abpp5udS9iPDQHg+lafklIAeKG3qgxxhBDH3otXtnWcoeXUmDpBI8HU/8d/yrGaLHYRfy3HHiSGFq3lBgoxi83QIOl9ELeKWMJC0fWKBApm0NU0flgwfy2j7GRyXmlM7tVFyuj5RTAZNQfgD9g054di9WbtUs7sm/9r3/rQe2+3neE3Jskt4xvZK0xbc4dZSZGn4E2JDWjENqPBvQ2dU5lsjpUKTZWAnxVGPe//BErsDxNLIHWz8emG71r3Q2yud4KPdAR9CgeC8g1bwlCI6JDFZutKBzIlE3QQ4ryKJEioiUL89xi6G+nNB7W5ABsQN0ZtWvZl8TG4Wh00B+oBXzgRER5Y9SdAYcrwWxlGVxxQyElUNrw== genofire-yubikey"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIOr9wE3i1+Cl/06WOf0/6OjxsOnN7veV3LZcWgtHkcS genofire@fireYubi"
absent:
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH8LdgjUiL/MFmA2wM98QAbUEyY/8ixnpettC6kQxKWu genofire@emma.ccchb.de"
absent: []
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZm0TZPBzgXrY1vrLoYviNRb/oGZQDQk9vrppPK84sN55ZPlr9VvP+JYE7Qkx8teRuH9ulxqX40+dxKaiAXMUl4HU57KPLjwCb7SnBNIFTv6ZHGxPS8ZgUzKJr4Agph51oenNEO3RziEqAo3EwK67SGnjeIYQQKcjpfwd08+PYMOjv42zSYQ9umooj5LooOvbxoogZ3VpboXv6DeyA4rev1M9RgnMWaWVF2LxJjQ3jVr7xh1vZktVGKuVk/XXKD6WVAuwmGMVEouQzjtG9kepWd8FUYe+fgj5mtdqfeQP9CypxvOcb7jT20wO1Abpp5udS9iPDQHg+lafklIAeKG3qgxxhBDH3otXtnWcoeXUmDpBI8HU/8d/yrGaLHYRfy3HHiSGFq3lBgoxi83QIOl9ELeKWMJC0fWKBApm0NU0flgwfy2j7GRyXmlM7tVFyuj5RTAZNQfgD9g054di9WbtUs7sm/9r3/rQe2+3neE3Jskt4xvZK0xbc4dZSZGn4E2JDWjENqPBvQ2dU5lsjpUKTZWAnxVGPe//BErsDxNLIHWz8emG71r3Q2yud4KPdAR9CgeC8g1bwlCI6JDFZutKBzIlE3QQ4ryKJEioiUL89xi6G+nNB7W5ABsQN0ZtWvZl8TG4Wh00B+oBXzgRER5Y9SdAYcrwWxlGVxxQyElUNrw== genofire-yubikey"
fritz:
ssh_key:
present:
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEay33koXmcBcrDuCQKkCBlw/gKiPtwLswATPqIR7udl fritz@fluorine.grimpen.net"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEyVVwh0cUPxZ/wwRsB8YRsQE/cxjEX6gomS7EPArXuX fritz@NaOH"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPSZUs/SgJRKK+NgmifBt8xehIbrpdQtpT9MeRkdwdHU fritz@m1air"
absent: []
deelkar:
ssh_key:
@ -29,3 +31,8 @@ user_mgmt_default:
present:
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDSHkU00aO4U98ikMiiiWiEeRj/597UzFcFctwY8iwLy humm@fluorine"
absent: []
blazr:
ssh_key:
present:
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDbxgesllBFfJUfwYX58rZln0ZpOq/Jyp361OmKohiQFHUyWK6wlPqDmfhqJuLPkAZQOjmK25gvLQXJ19+y1arjtGgbgf2nrjkCJ1l/2SHIa088DVYvZDLly+cSDMOUwgM1bzlKrHYK5asFihM+XJDV2oKUBIWaVNLHK99hpmiDXQ== jollyjinx@planetexpress.local"
absent: []

View file

@ -1,5 +1,5 @@
---
ansible_python_interpreter: /usr/bin/python3.7
ansible_python_interpreter: /usr/bin/python3
dns: 213.133.98.98 8.8.8.8
ipv6_subnet: '2a01:4f8:150:926f::'
@ -8,6 +8,6 @@ ipv4_subnet: 10.0.0.0
ipv6: '{{ ipv6_subnet | ipmath(2 * (vm_index +2)+1) }}/127'
ipv6route: '{{ ipv6_subnet | ipmath(2 * (vm_index +2)) }}'
ansible_ssh_host: '{{ ipv4_subnet | ipmath(2 * vm_index +1) }}'
#ansible_ssh_host: '{{ ipv4_subnet | ipmath(2 * vm_index +1) }}'
ipv4: '{{ ipv4_subnet | ipmath(2 * vm_index +1) }}/31'
ipv4route: '{{ ipv4_subnet | ipmath(2 * vm_index) }}'

View file

@ -1,5 +1,5 @@
---
ansible_python_interpreter: /usr/local/bin/python3.8
ansible_python_interpreter: /usr/local/bin/python
s6_etc_dir: /etc/s6-rc
s6_live_dir: /run/s6-rc
s6_scan_dir: /run/service

View file

@ -7,6 +7,8 @@ dovecot_users:
zeltophil: '{BLF-CRYPT}$2y$05$rct9cKgRnB/X7tZW7MXNUeIfadqCRc..dCMG4DB1fZdefH1Qx6FAq'
haecksen: '{BLF-CRYPT}$2y$05$e2R8ucHVPlZuI39Uy4iX3.EaRszPJ01itsPJfQa0FIeYzBuiGxUZW'
ari: '{BLF-CRYPT}$2y$05$HixjVZIVDVBKy40ReKRKh.ewnuyNV/t84ANsOSjOuxz5BIgk/J7k6'
vorstand: '{BLF-CRYPT}$2y$05$Cw.dfEg54gvRIhT9bDCx1O7xS4TtWf/c7Hh9Owzaf23imfwltMd4e'
fritz: '{BLF-CRYPT}$2y$05$NFh8LBoHfkazQDy3iNiuWODSP.rib.jIEDyf/JUbyBnQbJ03FglI6'
mlmmj_lists:
- name: 'vorstand'

View file

@ -1,8 +1,7 @@
---
- hosts:
- name: Deploy haproxy
hosts:
- emma
become: yes
become: true
roles:
- haproxy

View file

@ -0,0 +1,14 @@
user_mgmt:
crest:
state: present
groups: sudo
fritz:
state: present
groups: sudo
humm:
state: present
groups: sudo
genofire:
state: present
groups: sudo

View file

@ -6,6 +6,7 @@ postfix_my_networks:
- '2a01:4f8:150:926f::2'
- '176.9.59.104'
- '127.0.0.1'
- '10.0.0.0/24'
haproxy_v4: 176.9.59.104
haproxy_v6: 2a01:4f8:150:926f::2
@ -32,14 +33,14 @@ haproxy_http:
addr: '2a01:4f8:150:926f::11'
- host: 'kasse.z1.ccchb.de'
addr: '2a01:4f8:150:926f::11'
- host: 'kasse.zweigstelle.space'
addr: '2a01:4f8:150:926f::11'
- host: 'jabber.ccchb.de'
addr: '2a01:4f8:150:926f::13'
- host: 'matrix.ccchb.de'
addr: '2a01:4f8:150:926f::13'
- host: 'element.ccchb.de'
addr: '2a01:4f8:150:926f::13'
- host: 'auth.ccchb.de'
addr: '2a01:4f8:150:926f::11'
- host: 'kasse.ccchb.de'
addr: '2a01:4f8:150:926f::19'
haproxy_sni:
- host: 'ccchb.de'
@ -60,14 +61,12 @@ haproxy_sni:
addr: '2a01:4f8:150:926f::11'
- host: 'kasse.z1.ccchb.de'
addr: '2a01:4f8:150:926f::11'
- host: 'kasse.zweigstelle.space'
addr: '2a01:4f8:150:926f::11'
- host: 'jabber.ccchb.de'
addr: '2a01:4f8:150:926f::13'
- host: 'matrix.ccchb.de'
addr: '2a01:4f8:150:926f::13'
- host: 'element.ccchb.de'
addr: '2a01:4f8:150:926f::13'
- host: 'auth.ccchb.de'
addr: '2a01:4f8:150:926f::11'
- host: 'kasse.ccchb.de'
addr: '2a01:4f8:150:926f::19'
bhyve_ipv4: 10.0.0.0
bhyve_ipv6: 2a01:4f8:150:926f::4
@ -97,7 +96,7 @@ bhyve_guests:
- name: dn42
index: 1
enabled: true
enabled: false
ram: 1G
cpus: 1
image: debian-10.5.0-amd64-netinst.iso
@ -115,7 +114,6 @@ bhyve_guests:
enabled: true
ram: 1G
cpus: 1
password: foobar
image: debian-10.5.0-amd64-netinst.iso
order:
- DISKS
@ -128,10 +126,9 @@ bhyve_guests:
- name: geno-playground
index: 3
enabled: true
enabled: false
ram: 4G
cpus: 4
password: foobar
image: manjaro-architect-20.0.3-200607-linux56.iso
order:
- DISKS
@ -175,10 +172,9 @@ bhyve_guests:
- name: wiki
index: 6
enabled: true
ram: 1G
ram: 2G
cpus: 1
image: debian-10.5.0-amd64-netinst.iso
password: foobar
order:
- DISKS
disks:
@ -194,7 +190,6 @@ bhyve_guests:
ram: 1G
cpus: 1
image: debian-10.5.0-amd64-netinst.iso
password: foobar
order:
- DISKS
disks:
@ -210,6 +205,37 @@ bhyve_guests:
ram: 1G
cpus: 1
image: debian-10.5.0-amd64-netinst.iso
order:
- DISKS
disks:
- name: disk
properties:
volsize: 128g
volblocksize: 64k
primarycache: metadata
- name: frab
index: 9
enabled: false
ram: 1G
cpus: 1
image: ubuntu-22.04.1-live-server-amd64.iso
password: foobar
order:
- DISKS
disks:
- name: disk
properties:
volsize: 128g
volblocksize: 64k
primarycache: metadata
- name: verein
index: 10
enabled: true
ram: 2G
cpus: 2
image: debian-12.6.0-amd64-netinst.iso
password: foobar
order:
- DISKS

View file

@ -0,0 +1,15 @@
vm_index: 9
user_mgmt:
crest:
state: present
groups: sudo
fritz:
state: present
groups: sudo
humm:
state: present
groups: sudo
blazr:
state: present
groups: sudo

View file

@ -1,6 +1,6 @@
vm_index: 2
gitea_version: "1.13.0"
gitea_version: "1.21.2"
gitea_app_name: "dev.ccchb.de"
# technical:
@ -14,7 +14,7 @@ gitea_systemd_cap_net_bind_service: true
gitea_http_letsencrypt_mail: "webmaster@ccchb.de"
gitea_ssh_domain: "dev.ccchb.de"
gitea_ssh_listen: "[::]"
gitea_ssh_listen: "::"
gitea_ssh_port: 2222
gitea_start_ssh: true
@ -29,6 +29,9 @@ gitea_require_signin: false
gitea_register_email_confirm: true
gitea_enable_captcha: true
gitea_disable_registration: false
gitea_only_allow_external_registration: true
# privacy:
gitea_offline_mode: true
gitea_disable_gravatar: true
@ -45,3 +48,6 @@ user_mgmt:
humm:
state: present
groups: sudo
fritz:
state: present
groups: sudo

2
hosts/00_brunn Normal file
View file

@ -0,0 +1,2 @@
[brunn]
brunn.ccchb.de

2
hosts/10_frab Normal file
View file

@ -0,0 +1,2 @@
[frab]
frab.emma.ccchb.de

9
jabber.yml Normal file
View file

@ -0,0 +1,9 @@
---
- name: Deploy XMPP server
hosts:
- jabber
become: true
tags: [jabber]
roles:
- certbot
- prosody

View file

@ -1,4 +1,4 @@
#!/usr/local/bin/python3.7
#!/usr/local/bin/python3
# -*- coding: utf-8 -*-
#
# (c) 2014, David Lundgren <dlundgren@syberisle.net>

View file

@ -1,22 +1,24 @@
---
- hosts:
- name: Install passlib
hosts:
- localhost
become: yes
become: true
tasks:
- name: Install passlib
package:
name: py38-passlib
ansible.builtin.package:
name: security/py-passlib
state: present
- hosts:
- name: Deploy mail servers
hosts:
- mail
become: yes
become: true
roles:
- dovecot
- rspamd
- postfix
- mlmmj
- role: dovecot
tags: [dovecot]
- role: rspamd
tags: [rspamd]
- role: postfix
tags: [postfix]
- role: mlmmj
tags: [mlmmj]

View file

@ -1,5 +1,6 @@
---
- hosts: nextcloud
become: yes
- name: Deploy NextCloud
hosts: nextcloud
become: true
roles:
- nextcloud

View file

@ -1,8 +1,7 @@
---
- hosts:
- name: Deploy local NTP server
hosts:
- mail
become: yes
become: true
roles:
- openntpd

View file

@ -1,8 +1,7 @@
---
- hosts:
- name: Deploy restic
hosts:
- mail
become: yes
become: true
roles:
- restic

View file

@ -10,13 +10,13 @@
- name: Set host IPv4 addresses
sysrc:
name: 'ifconfig_vmnet{{ item.index }}'
value: 'inet {{ bhyve_ipv4 | ipmath(2 * item.index)}}/31'
value: 'inet {{ bhyve_ipv4 | ansible.utils.ipmath(2 * item.index)}}/31'
with_items: '{{ bhyve_guests }}'
- name: Set host IPv6 addresses
sysrc:
name: 'ifconfig_vmnet{{ item.index }}_ipv6'
value: 'inet6 {{ bhyve_ipv6 | ipmath(2 * item.index)}}/127'
value: 'inet6 {{ bhyve_ipv6 | ansible.utils.ipmath(2 * item.index)}}/127'
with_items: '{{ bhyve_guests }}'
- name: Add guest interfaces

View file

@ -1,39 +1,4 @@
---
- name: Install defaults
package:
name:
- zsh
- name: Download .zshrc from grml
get_url:
url: https://raw.githubusercontent.com/grml/grml-etc-core/v0.12.5/etc/zsh/zshrc
dest: /etc/zsh/zshrc
checksum: sha256:ad88c76951693c2f9c38773ed2602a9fd5c74431615c4a23aaff679b295919ce
validate_certs: false
- name: Update SSH configuration
notify: reload sshd
replace:
dest: /etc/ssh/sshd_config
regexp: '^([\#\s]*)?{{ item.key }}\s+([\w_-]+)'
replace: "{{item.key}} {{item.value}}"
with_items:
- key: PermitRootLogin
value: without-password
- key: PasswordAuthentication
value: 'no'
- key: ChallengeResponseAuthentication
value: 'no'
- key: PrintLastLog
value: 'yes'
- key: UseDNS
value: 'no'
- name: Change shell of user root
user:
name: root
shell: /usr/bin/zsh
- name: Enable sshd
systemd:
name: sshd
@ -44,32 +9,7 @@
notify: restart network
when: ipv4 is defined or ipv6 is defined
template:
src: systemd.network
dest: /etc/systemd/network/main.network
src: interfaces.j2
dest: /etc/network/interfaces
owner: root
mode: 644
- name: enable systemd-networkd
notify: restart network
systemd:
name: systemd-networkd
state: started
enabled: yes
- name: disable networking
systemd:
name: networking
enabled: no
- name: start systemd-resolved
systemd:
name: systemd-resolved
state: started
enabled: yes
- name: symling /etc/resolve
file:
src: /run/systemd/resolve/stub-resolv.conf
dest: /etc/resolv.conf
state: link
force: yes

View file

@ -0,0 +1,16 @@
# The primary network interface
allow-hotplug enp0s3
{% if ipv4 is defined %}
iface enp0s3 inet static
address {{ipv4}}/31
gateway {{ipv4route}}
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers {{ipv4route}}
dns-search emma.ccchb.de
{% endif %}
{% if ipv6 is defined %}
iface enp0s3 inet6 static
address {{ipv6}}/127
gateway {{ipv6route}}
{% endif %}

View file

View file

@ -0,0 +1,3 @@
{
"log-driver": "journald"
}

View file

@ -0,0 +1,5 @@
---
- name: Restart docker
ansible.builtin.service:
name: docker
state: restarted

View file

@ -0,0 +1,33 @@
---
- name: Install Docker's GPG key in apt's keyring
ansible.builtin.apt_key:
url: https://download.docker.com/linux/debian/gpg
state: present
tags: docker install
- name: Setup Docker's apt repository
ansible.builtin.apt_repository:
repo: deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable
state: present
filename: docker
tags: docker install
- name: Install Docker
ansible.builtin.package:
name:
- docker-ce
- docker-ce-cli
- containerd.io
- docker-compose-plugin
state: present
tags: docker install
notify:
- Restart docker
- name: Configure Docker daemon
ansible.builtin.file:
src: daemon.json
dest: /etc/docker/daemon.json
owner: root
group: root
mode: '0644'

@ -1 +1 @@
Subproject commit 1aa082a2101c69f8cfc13a31604991b0c3dfa8e5
Subproject commit 751d0d724ba63c6251fafad9e80a480d6bc5043f

View file

@ -1,172 +0,0 @@
<!DOCTYPE html>
<html lang="{{.Language}}" class="theme-{{.SignedUser.Theme}}">
<head data-suburl="{{AppSubUrl}}">
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="x-ua-compatible" content="ie=edge">
<title>{{if .Title}}{{.Title | RenderEmojiPlain}} - {{end}} {{if .Repository.Name}}{{.Repository.Name}} - {{end}}{{AppName}} </title>
<link rel="manifest" href="{{AppSubUrl}}/manifest.json" crossorigin="use-credentials">
<meta name="theme-color" content="{{ThemeColorMetaTag}}">
<meta name="author" content="{{if .Repository}}{{.Owner.Name}}{{else}}{{MetaAuthor}}{{end}}" />
<meta name="description" content="{{if .Repository}}{{.Repository.Name}}{{if .Repository.Description}} - {{.Repository.Description}}{{end}}{{else}}{{MetaDescription}}{{end}}" />
<meta name="keywords" content="{{MetaKeywords}}">
<meta name="referrer" content="no-referrer" />
<meta name="_csrf" content="{{.CsrfToken}}" />
{{if .IsSigned}}
<meta name="_uid" content="{{.SignedUser.ID}}" />
{{end}}
{{if .ContextUser}}
<meta name="_context_uid" content="{{.ContextUser.ID}}" />
{{end}}
{{if .SearchLimit}}
<meta name="_search_limit" content="{{.SearchLimit}}" />
{{end}}
{{if .GoGetImport}}
<meta name="go-import" content="{{.GoGetImport}} git {{.CloneLink.HTTPS}}">
<meta name="go-source" content="{{.GoGetImport}} _ {{.GoDocDirectory}} {{.GoDocFile}}">
{{end}}
<script>
{{SafeJS `/*
@licstart The following is the entire license notice for the
JavaScript code in this page.
Copyright (c) 2016 The Gitea Authors
Copyright (c) 2015 The Gogs Authors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
---
Licensing information for additional javascript libraries can be found at:
{{StaticUrlPrefix}}/vendor/librejs.html
@licend The above is the entire license notice
for the JavaScript code in this page.
*/`}}
</script>
<script>
window.config = {
AppVer: '{{AppVer}}',
AppSubUrl: '{{AppSubUrl}}',
StaticUrlPrefix: '{{StaticUrlPrefix}}',
UseServiceWorker: {{UseServiceWorker}},
csrf: '{{.CsrfToken}}',
HighlightJS: {{if .RequireHighlightJS}}true{{else}}false{{end}},
Minicolors: {{if .RequireMinicolors}}true{{else}}false{{end}},
SimpleMDE: {{if .RequireSimpleMDE}}true{{else}}false{{end}},
Tribute: {{if .RequireTribute}}true{{else}}false{{end}},
U2F: {{if .RequireU2F}}true{{else}}false{{end}},
Heatmap: {{if .EnableHeatmap}}true{{else}}false{{end}},
heatmapUser: {{if .HeatmapUser}}'{{.HeatmapUser}}'{{else}}null{{end}},
NotificationSettings: {
MinTimeout: {{NotificationSettings.MinTimeout}},
TimeoutStep: {{NotificationSettings.TimeoutStep}},
MaxTimeout: {{NotificationSettings.MaxTimeout}},
EventSourceUpdateTime: {{NotificationSettings.EventSourceUpdateTime}},
},
{{if .RequireTribute}}
tributeValues: [
{{ range .Assignees }}
{key: '{{.Name}} {{.FullName}}', value: '{{.Name}}',
name: '{{.Name}}', fullname: '{{.FullName}}', avatar: '{{.RelAvatarLink}}'},
{{ end }}
],
{{end}}
};
</script>
<link rel="shortcut icon" href="{{StaticUrlPrefix}}/img/favicon.png">
<link rel="mask-icon" href="{{StaticUrlPrefix}}/img/gitea-safari.svg" color="#609926">
<link rel="fluid-icon" href="{{StaticUrlPrefix}}/img/gitea-lg.png" title="{{AppName}}">
<link rel="stylesheet" href="{{StaticUrlPrefix}}/vendor/assets/font-awesome/css/font-awesome.min.css">
{{if .RequireSimpleMDE}}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/vendor/plugins/simplemde/simplemde.min.css">
{{end}}
{{if .RequireTribute}}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/vendor/plugins/tribute/tribute.css">
{{end}}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/fomantic/semantic.min.css?v={{MD5 AppVer}}">
<link rel="stylesheet" href="{{StaticUrlPrefix}}/css/index.css?v={{MD5 AppVer}}">
<noscript>
<style>
.dropdown:hover > .menu { display: block; }
.ui.secondary.menu .dropdown.item > .menu { margin-top: 0; }
</style>
</noscript>
{{if .RequireMinicolors}}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/vendor/plugins/jquery.minicolors/jquery.minicolors.css">
{{end}}
<style class="list-search-style"></style>
{{if .PageIsUserProfile}}
<meta property="og:title" content="{{.Owner.Name}}" />
<meta property="og:type" content="profile" />
<meta property="og:image" content="{{.Owner.AvatarLink}}" />
<meta property="og:url" content="{{.Owner.HTMLURL}}" />
{{if .Owner.Description}}
<meta property="og:description" content="{{.Owner.Description}}">
{{end}}
{{else if .Repository}}
{{if .Issue}}
<meta property="og:title" content="{{.Issue.Title}}" />
<meta property="og:url" content="{{.Issue.HTMLURL}}" />
{{if .Issue.Content}}
<meta property="og:description" content="{{.Issue.Content}}" />
{{end}}
{{else}}
<meta property="og:title" content="{{.Repository.Name}}" />
<meta property="og:url" content="{{.Repository.HTMLURL}}" />
{{if .Repository.Description}}
<meta property="og:description" content="{{.Repository.Description}}" />
{{end}}
{{end}}
<meta property="og:type" content="object" />
<meta property="og:image" content="{{.Repository.Owner.AvatarLink}}" />
{{else}}
<meta property="og:title" content="{{AppName}}">
<meta property="og:type" content="website" />
<meta property="og:image" content="{{StaticUrlPrefix}}/img/gitea-lg.png" />
<meta property="og:url" content="{{AppUrl}}" />
<meta property="og:description" content="{{MetaDescription}}">
{{end}}
<meta property="og:site_name" content="{{AppName}}" />
{{if .IsSigned }}
{{ if ne .SignedUser.Theme "gitea" }}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/css/theme-{{.SignedUser.Theme}}.css?v={{MD5 AppVer}}">
{{end}}
{{else if ne DefaultTheme "gitea"}}
<link rel="stylesheet" href="{{StaticUrlPrefix}}/css/theme-{{DefaultTheme}}.css?v={{MD5 AppVer}}">
{{end}}
{{template "custom/header" .}}
</head>
<body>
{{template "custom/body_outer_pre" .}}
<div class="full height">
<noscript>{{.i18n.Tr "enable_javascript"}}</noscript>
{{template "custom/body_inner_pre" .}}
{{if not .PageIsInstall}}
<div class="ui top secondary stackable main menu following bar light inverted">
{{template "base/head_navbar" .}}
</div><!-- end bar -->
{{end}}
{{/*
</div>
</body>
</html>
*/}}

View file

@ -1,20 +1,20 @@
---
- name: Reload s6-rc
service:
ansible.builtin.service:
name: s6-rc
state: reloaded
- name: Restart Postfix
command: s6-svc -wU -T 5000 -ru {{ s6_scan_dir }}/postfix
ansible.builtin.command: s6-svc -wU -T 5000 -ru {{ s6_scan_dir }}/postfix
- name: Restart Postfix log
command: s6-svc -wU -T 5000 -ru {{ s6_scan_dir }}/postfix-log
ansible.builtin.command: s6-svc -wU -T 5000 -ru {{ s6_scan_dir }}/postfix-log
- name: Reload Postfix
command: s6-svc -h {{ s6_scan_dir }}/postfix
ansible.builtin.command: s6-svc -h {{ s6_scan_dir }}/postfix
- name: Rebuild Postfix maps
command: 'postmap {{ item.type }}:{{ item.name }}'
ansible.builtin.command: 'postmap {{ item.type }}:{{ item.name }}'
args:
chdir: /usr/local/etc/postfix
when: item.type in postfix_rebuild_types

View file

@ -1,27 +1,27 @@
---
- name: Install Postfix
package:
ansible.builtin.package:
name: postfix
state: present
notify:
- Restart Postfix
- name: Create /usr/local/etc/mail
file:
ansible.builtin.file:
path: /usr/local/etc/mail
state: directory
owner: root
group: wheel
mode: 0755
mode: '0755'
- name: Install Postfix mailer.conf
copy:
ansible.builtin.copy:
dest: /usr/local/etc/mail/mailer.conf
src: /usr/local/share/postfix/mailer.conf.postfix
remote_src: yes
remote_src: true
owner: root
group: wheel
mode: 0644
mode: '0644'
- name: Disable sendmail
sysrc:
@ -29,22 +29,22 @@
value: NONE
- name: Make sure sendmail is stopped
service:
ansible.builtin.service:
name: sendmail
state: stopped
- name: Disable sendmail periodic tasks
lineinfile:
ansible.builtin.lineinfile:
path: /etc/periodic.conf
owner: root
group: wheel
mode: 0444
mode: '0444'
regexp: '^{{ item }}='
line: '{{ item }}="NO"'
with_items: '{{ sendmail_periodic }}'
- name: Add /var/log/postfix to fstab
mount:
ansible.posix.mount:
path: /var/log/postfix
src: tmpfs
fstype: tmpfs
@ -52,19 +52,19 @@
state: mounted
- name: Create Postfix service directories
file:
ansible.builtin.file:
path: '{{ s6_etc_dir }}/service/{{ item }}'
state: directory
owner: root
group: wheel
mode: 0755
mode: '0755'
with_items: '{{ postfix_service_dirs }}'
- name: Generate Postfix service scripts
template:
ansible.builtin.template:
dest: '{{ s6_etc_dir }}/service/{{ item }}'
src: '{{ item }}.j2'
mode: 0555
mode: '0555'
owner: root
group: wheel
with_items: '{{ postfix_service_scripts }}'
@ -73,24 +73,24 @@
- Restart Postfix
- name: Generate Postfix service configuration
copy:
ansible.builtin.copy:
dest: '{{ s6_etc_dir }}/service/{{ item.name }}'
content: '{{ item.content }}'
mode: 0444
mode: '0444'
owner: root
group: wheel
loop_control:
label: '{{ item.name }} = {{ item.content }}'
label: '{{ item.name }} = {{ item.content }}'
notify:
- Reload s6-rc
- Restart Postfix
with_items: '{{ postfix_service_config }}'
- name: Generate Postfix maps
template:
ansible.builtin.template:
dest: '/usr/local/etc/postfix/{{ item.name }}'
src: '{{ item.name }}.j2'
mode: 0444
mode: '0444'
owner: root
group: wheel
with_items: '{{ postfix_maps }}'
@ -108,7 +108,7 @@
- Reload Postfix
- name: Configure Postfix services
lineinfile:
ansible.builtin.lineinfile:
path: /usr/local/etc/postfix/master.cf
regexp: '^{{ item.name }} +{{ item.type }}'
value: '{{ item.value }}'
@ -126,15 +126,15 @@
- Restart Postfix
- name: Flush handlers
meta: flush_handlers
ansible.builtin.meta: flush_handlers
- name: Start Postfix
command: fdmove -c 2 1 s6-rc -l {{ s6_live_dir }} -u -v 2 change postfix
ansible.builtin.command: fdmove -c 2 1 s6-rc -l {{ s6_live_dir }} -u -v 2 change postfix
register: change
changed_when: change.stdout | length > 0
- name: Enable Postfix
lineinfile:
ansible.builtin.lineinfile:
path: '{{ s6_etc_dir }}/service/enabled/contents'
regexp: "^postfix$"
line: "postfix"
@ -142,4 +142,4 @@
- Reload s6-rc
- name: Flush handlers (again)
meta: flush_handlers
ansible.builtin.meta: flush_handlers

View file

@ -63,6 +63,7 @@ postfix_virtual_aliases:
- hostmaster@ccchb.de crest@ccchb.de
- thoddi@ccchb.de mail@thoddi.de
- docloc@ccchb.de docloc@posteo.net
- fritz@ccchb.de fritz@grimpen.net
- root@lists.ccchb.de crest@ccchb.de
- crest@lists.ccchb.de crest@ccchb.de
@ -72,6 +73,8 @@ postfix_virtual_aliases:
- postmaster@lists.ccchb.de crest@ccchb.de
- hostmaster@lists.ccchb.de crest@ccchb.de
- reddit@ccchb.de crest@ccchb.de
postfix_service_dirs:
- postfix
- postfix/env
@ -352,6 +355,14 @@ postfix_config:
value: 'aNULL'
state: present
- name: smtpd_tls_mandatory_protocols
value: 'TLSv1.2 TLSv1.3'
state: present
- name: smtpd_tls_protocols
value: 'TLSv1.2 TLSv1.3'
state: present
- name: smtpd_tls_received_header
value: 'yes'
state: present
@ -369,7 +380,8 @@ postfix_config:
state: present
- name: tls_high_cipherlist
value: 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA'
value: |-
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
state: present
- name: tls_ssl_options

View file

@ -1,44 +1,12 @@
---
prosody_domain: "jabber.ccchb.de"
prosody_ssl_cert: "/etc/letsencrypt/live/{{ prosody_domain }}/fullchain.pem"
prosody_ssl_key: "/etc/letsencrypt/live/{{ prosody_domain }}/privkey.pem"
prosody_ssl_cert: "/etc/prosody/certs/fullchain.pem"
prosody_ssl_key: "/etc/prosody/certs/privkey.pem"
prosody_allow_registration: false
prosody_modules:
- roster
- saslauth
- tls
- dialback
- disco
- private
- bookmarks
- vcard
- proxy65
- legacyauth
- version
- uptime
- time
- ping
- pep
- register
- adhoc
- admin_adhoc
- posix
- bosh
- websocket
- groups
- announce
- watchregistrations
- blocking
- smacks
- carbons
- cloud_notify
- csi
- mam
- filter_chatstates
- throttle_presence
- http_upload
- turncredentials
- vcard_legacy
prosody_http_url: "https://jabber.ccchb.de/"
prosody_turn_server: "einstein.cskreie.de"
prosody_turn_secret: "gabbagabbahey"
prosody_nginx_install: true
prosody_nginx_conf: |

View file

@ -16,6 +16,6 @@
- name: Configure prosody
template:
src: prosody.cfg.lua.j2
dest: /etc/prosody/prosody_test.cfg.lua
dest: /etc/prosody/prosody.cfg.lua
...

View file

@ -15,4 +15,8 @@ server {
proxy_set_header Host {{ prosody_domain }};
proxy_pass http://127.0.0.1:5280/upload;
}
location /file_share {
proxy_pass http://127.0.0.1:5280/file_share;
}
}

View file

@ -1,126 +1,73 @@
-- Prosody XMPP Server Configuration
-- {{ ansible_managed }}
---------- Server-wide settings ----------
-- Settings in this section apply to the whole server and are the default settings
-- for any virtual hosts
-- This is a (by default, empty) list of accounts that are admins
-- for the server. Note that you must create the accounts separately
-- (see http://prosody.im/doc/creating_accounts for info)
-- Example: admins = { "user1@example.com", "user2@example.net" }
admins = { "deelkar@jabber.ccchb.de", "freak@jabber.ccchb.de", "jali@jabber.ccchb.de" }
-- Enable use of libevent for better performance under high load
-- For more information see: http://prosody.im/doc/libevent
use_libevent = false;
plugin_paths = { "/opt/prosody-modules" }
-- This is the list of modules Prosody will load on startup.
-- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too.
-- Documentation on modules can be found at: http://prosody.im/doc/modules
use_libevent = true;
modules_enabled = {
{% for module in prosody_modules %}
"{{ module }}";
{% endfor %}
-- Generally required
"roster";
"saslauth";
"tls";
"dialback";
"disco";
"posix";
"private";
-- Nice to have
"version";
"uptime";
"time";
"ping";
"pep";
"register";
-- Admin interfaces
"admin_adhoc";
"admin_shell";
-- HTTP modules
"bosh";
"http_files";
"http_file_share";
-- Other specific functionality
"groups";
"watchregistrations";
"turn_external";
"carbons";
"blocklist";
"mam";
"csi_simple";
"vcard_legacy";
"proxy65";
};
-- These modules are auto-loaded, should you
-- (for some mad reason) want to disable
-- them then uncomment them below
modules_disabled = {
-- "presence"; -- Route user/contact status information
-- "message"; -- Route messages
-- "iq"; -- Route info queries
-- "offline"; -- Store offline messages
};
allow_registration = {% if prosody_allow_registration then "True" else "False" %};
-- Disable account creation by default, for security
-- For more information see http://prosody.im/doc/creating_accounts
allow_registration = {{ prosody_allow_registration }};
c2s_require_encryption = true
s2s_secure_auth = false
-- These are the SSL/TLS-related settings. If you don't want
-- to use SSL/TLS, you may comment or remove this
-- *** DUMMY CERT *** DO NOT CHANGE *** SET CERT IN HOST SECTION ***
ssl = {
protocol = "sslv23";
key = "{{ prosody_ssl_key }}";
certificate = "{{ prosody_ssl_cert }}";
dhparam = "/etc/prosody/certs/dh-2048.pem";
options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" };
ciphers = "ECDH:DH:HIGH+kEDH:HIGH+kEECDH:HIGH:!CAMELLIA128:!3DES:!MD5:!RC4:!aNULL:!NULL:!EXPORT:!LOW:!MEDIUM";
}
legacy_ssl_ports = { 5223 }
http_external_url = "https://{{ prosody_domain }}/"
-- Only allow encrypted streams? Encryption is already used when
-- available. These options will cause Prosody to deny connections that
-- are not encrypted. Note that some servers do not support s2s
-- encryption or have it disabled, including gmail.com and Google Apps
-- domains.
--c2s_require_encryption = false
--s2s_require_encryption = false
-- Select the authentication backend to use. The 'internal' providers
-- use Prosody's configured data storage to store the authentication data.
-- To allow Prosody to offer secure authentication mechanisms to clients, the
-- default provider stores passwords in plaintext. If you do not trust your
-- server please see http://prosody.im/doc/modules/mod_auth_internal_hashed
-- for information about using the hashed backend.
-- PID file, necessary for prosodyctl
pidfile = "/var/run/prosody/prosody.pid"
authentication = "internal_hashed"
-- Select the storage backend to use. By default Prosody uses flat files
-- in its configured data directory, but it also supports more backends
-- through modules. An "sql" backend is included by default, but requires
-- additional dependencies. See http://prosody.im/doc/storage for more info.
--storage = "sql" -- Default is "internal"
-- For the "sql" backend, you can uncomment *one* of the below to configure:
--sql = { driver = "SQLite3", database = "prosody.sqlite" } -- Default. 'database' is the filename.
--sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
--sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
-- STUN/TURN
--turncredentials_host = "jabber.emma.ccchb.de"
turncredentials_host = "einstein.cskreie.de"
turncredentials_secret = "gabbagabbahey"
-- HTTP-UPLOAD
http_upload_file_size_limit = 10485760 -- 10M
http_max_content_size = 20971520 -- 20M
http_upload_quota = 104857600 -- 100M
http_upload_expire_after = 2592000 -- 30d
-- Logging configuration
-- For advanced logging see http://prosody.im/doc/logging
-- Hint: If you create a new log file or rename them, don't forget
-- to update the logrotate config at /etc/logrotate.d/prosody
log = {
-- Log all error messages to prosody.err
error = "/var/log/prosody/prosody.err";
-- Log everything of level "info" and higher (that is, all except "debug" messages)
-- to prosody.log
-- info = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for more verbose logging
-- debug = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for more verbose logging
--"*syslog"; -- Uncomment this for logging to syslog
}
-- Pidfile, used by prosodyctl and the init.d script
pidfile = "/var/run/prosody/prosody.pid";
-- TODO: Fix escaping
http_external_url = "{{ prosody_http_url }}"
trusted_proxies = { "127.0.0.1", "::1", "192.168.1.1", }
-- TURN Server
turn_external_host = "{{ prosody_turn_server }}"
turn_external_secret = "{{ prosody_turn_secret }}"
----------- Virtual hosts -----------
-- You need to add a VirtualHost entry for each domain you wish Prosody to serve.
-- Settings under each VirtualHost entry apply *only* to that host.
VirtualHost "localhost"
VirtualHost "{{ prosody_domain }}"
VirtualHost "jabber.ccchb.de"
enabled = true -- Remove this line to enable this host
-- Assign this host a certificate for TLS, otherwise it would use the one
@ -128,33 +75,18 @@ VirtualHost "{{ prosody_domain }}"
-- Note that old-style SSL on port 5223 only supports one certificate, and will always
-- use the global one.
ssl = {
protocol = "sslv23";
protocol = "tlsv1_2+";
key = "{{ prosody_ssl_key }}";
certificate = "{{ prosody_ssl_cert }}";
dhparam = "/etc/prosody/certs/dh-2048.pem";
options = { "no_sslv2", "no_sslv3", "no_ticket", "no_compression", "cipher_server_preference", "single_dh_use", "single_ecdh_use" };
-- TODO: Evaluate allowed ciphers
ciphers = "ECDH:DH:HIGH+kEDH:HIGH+kEECDH:HIGH:!CAMELLIA128:!3DES:!MD5:!RC4:!aNULL:!NULL:!EXPORT:!LOW:!MEDIUM";
}
------ Components ------
-- You can specify components to add hosts that provide special services,
-- like multi-user conferences, and transports.
-- For more information on components, see http://prosody.im/doc/components
---Set up a MUC (multi-user chat) room server on conference.example.com:
Component "muc.{{ prosody_domain }}" "muc"
Component "muc.jabber.ccchb.de" "muc"
modules_enabled = {
"vcard_muc", "muc_mam",
"vcard_muc",
"muc_mam"
}
-- Set up a SOCKS5 bytestream proxy for server-proxied file transfers:
--Component "proxy.example.com" "proxy65"
---Set up an external component (default component port is 5347)
--
-- External components allow adding various services, such as gateways/
-- transports to other networks like ICQ, MSN and Yahoo. For more info
-- see: http://prosody.im/doc/components#adding_an_external_component
--
--Component "gateway.example.com"
-- component_secret = "password"
Component "upload.jabber.ccchb.de" "http_file_share"

View file

@ -16,9 +16,9 @@ EX_CONFIG=78
export PATH="$PATH:/usr/local/bin:/usr/local/sbin"
name=s6-rc
name=s6_rc
rcvar=s6_rc_enable
extra_commands="reload"
extra_commands="reload status"
start_cmd="s6_rc_start &"
stop_cmd="s6_rc_stop"

7
s6.yml
View file

@ -1,8 +1,7 @@
---
- hosts:
- name: Deploy s6 on FreeBSD
hosts:
- emma
become: yes
become: true
roles:
- s6-rc

View file

@ -7,3 +7,4 @@
- import_playbook: mail.yml
- import_playbook: restic.yml
- import_playbook: wiki.yml
- import_playbook: users.yml

7
users.yml Normal file
View file

@ -0,0 +1,7 @@
---
- name: Perform user management
hosts: debian frab brunn
become: true
tags: [user_mgmt]
roles:
- user_mgmt

View file

@ -1,7 +1,8 @@
---
- hosts:
- name: Deploy MediaWiki
hosts:
- wiki
become: yes
become: true
roles:
- mediawiki
- certbot