diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 0000000..c6123e8 --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,14 @@ +#warn_list: # or 'skip_list' to silence them completely +skip_list: + - experimental + - var-naming[no-role-prefix] + - name +warn_list: + - '204' # Lines should be no longer than 160 chars + - no-handler + - ignore-errors + - fqcn-builtins + - fqcn + - partial-become[task] + - template-instead-of-copy +offline: true diff --git a/.config/ansible-lint.yml b/.config/ansible-lint.yml new file mode 100644 index 0000000..658acbd --- /dev/null +++ b/.config/ansible-lint.yml @@ -0,0 +1,8 @@ +--- +skip_list: + - fqcn[action-core] + - name[casing] + - name[missing] + +exclude_paths: + - .forgejo diff --git a/.forgejo/workflows/test.yaml b/.forgejo/workflows/test.yaml new file mode 100644 index 0000000..52f8c18 --- /dev/null +++ b/.forgejo/workflows/test.yaml @@ -0,0 +1,19 @@ +name: Test + +on: + push: + branches: + - main + +jobs: + + build: + runs-on: docker + container: + image: alpine:latest + + steps: + - run: apk add nodejs ansible ansible-lint + - uses: actions/checkout@v4 + + - run: ansible-lint diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..781c027 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +.password-store +.gitignore +.envrc diff --git a/.yamllint.yaml b/.yamllint.yaml new file mode 100644 index 0000000..2d3284c --- /dev/null +++ b/.yamllint.yaml @@ -0,0 +1,22 @@ +--- + +extends: relaxed + +rules: + # 80 chars should be enough, but don't fail if a line is longer + line-length: + max: 200 + level: warning + empty-lines: + max: 2 + max-start: 1 + max-end: 1 + colons: + max-spaces-after: -1 + commas: + max-spaces-after: -1 + comments: + min-spaces-from-content: 1 + octal-values: + forbid-implicit-octal: true + forbid-explicit-octal: true diff --git a/authorized_keys/ak.keys b/authorized_keys/ak.keys index 75593c5..a257da2 100644 --- a/authorized_keys/ak.keys +++ b/authorized_keys/ak.keys @@ -1 +1,3 @@ ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDZ0ryG8LT5ryjc3tZggVP0cxjXoKOPzUIwmB9Yez+u3nDHc3RdLR0V/BdcVPCJl9vOQwsFaTE34ZEZ3A6qkcSaz2Npxqq0eFtcEAKTy9w41C6jE586jkwkednSK9ObFFZnlSA3ielYeB5bRuELHyvazHWSUGn+/nzuujAYpEABRGAlt0IV2eMugsb1aEs5v8/Hw3REGz6IeNBwlVOzDznGK4N0b1es270k2fpkD0XMRnga7x2eduD74gRYJHo41sKz6kqHFfXjvrH6Efrn5sNtTF7pIkPfeiX4ukDQYG6Ynxgkdbi1pMg5zGjjjRZ0iExKqNi+jtZhVewqFvj66vLX arjan@koopen.net +ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAgEAhA2rt1rIpqWG5BzwTFCCRCEZViWNk3GGIVyIpKg0A0+btJxPu66AKcudP88nsdzp8rPVES1qLBpIt6QsHnoioF+MjUjrkodc0gNescE+7frlf0+wCwN7/OQjSTDURa0THwQQGuGJm4cWaMf7w/sfkU89KmuRPvxZGNn4ahSRkRVyKP09B3xI14CDpRSP4Xg9bCz7QYxLixXfk0zBMOgbrSzsNs2eO4YUUsHFX1x0nX6CK7fauO0l8UC1nYeFGNofbmpn0mnqSj0u1i+ikjiCv+8ruXuI0ufLjfcIQjsYmkrMEfwuf0nyOAha5U2z4U05J2Je4do0cYVoC4/kCoAod3nrX7fVur0RVdD7XEAzvtxZh87dOhM3TrYYVFs37jeDtt4ZO9XYRSrV2l/TgPdWoST/h69/10QhdS8lYQXTJWY8AgQs+MtIHj6z1lCsVbRZN/JKYulhXpGuHmNt/gBlMscFVDezmdGwuqPB8XdYHBVcDqgpynbvlaBXMX+hHIjPKC6ExLxmUtJYGetTKyEPWeIVjp6D1zs/aMVVEOxvKfjtGDLyByzUEnHt0YL2v+tAp1+oqmWr0i5RWgnWOtTuzzEkFaa99Y6SMbskWx4p/3Of5VTrgFcADMG7TFHAwQ4vnv6Ca5P0pBTFjWCR1tX4v7qNgx9lqax7bbWlNjxLODM= arjan@koopen.net SL + diff --git a/authorized_keys/foobar.keys b/authorized_keys/foobar.keys index 6493dc3..057bbbf 100644 --- a/authorized_keys/foobar.keys +++ b/authorized_keys/foobar.keys @@ -1,2 +1,4 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUIAkaRsvb6cD1XIGF80JpMH1mYE9XhCgptOkt9AfloZQlO7Ds5XeCwJk5/TsoidTcb/0yFUov8SMwaIVtrFfkNUqqeAsfm3luJ4JwOXeCwrXD6W7c5Wqg/FGNH0eZr0kEnxpNS10L72+oNBQgnlSNjqWS29lEmXApKQ3IKy6aP9cMwEh25fsH/2G7mHsZX2UMPK0tZPC6MPxY5P9PWLIulUpsX96c6OcAvGYIvsCnecsVsTdhK36w4Z/t7XoLFz5X6k3eXT7gG4SMGuBixjroTUhumWzgJJ6T1Nn/eESe7Im8krlzO/0hG/F8uBy3s04TAJuXFmygvtC4YLyq91U5 -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyKprIcR81+RFSBxU3iyW4vd0ctr0q1Pqifzxbro+0C +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUIAkaRsvb6cD1XIGF80JpMH1mYE9XhCgptOkt9AfloZQlO7Ds5XeCwJk5/TsoidTcb/0yFUov8SMwaIVtrFfkNUqqeAsfm3luJ4JwOXeCwrXD6W7c5Wqg/FGNH0eZr0kEnxpNS10L72+oNBQgnlSNjqWS29lEmXApKQ3IKy6aP9cMwEh25fsH/2G7mHsZX2UMPK0tZPC6MPxY5P9PWLIulUpsX96c6OcAvGYIvsCnecsVsTdhK36w4Z/t7XoLFz5X6k3eXT7gG4SMGuBixjroTUhumWzgJJ6T1Nn/eESe7Im8krlzO/0hG/F8uBy3s04TAJuXFmygvtC4YLyq91U5 Sig-I/O Beheer key +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyKprIcR81+RFSBxU3iyW4vd0ctr0q1Pqifzxbro+0C mark@x240-ed25519 +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGc3py/K9wUSF86SIMv2AWtVAxEb1ZEy7BEz7VrGeZp/ sigio@t14 + diff --git a/bank.yaml b/bank.yaml index 43c92b7..c820bc3 100644 --- a/bank.yaml +++ b/bank.yaml @@ -1,8 +1,8 @@ --- - - hosts: bank roles: - - common - - bank - vars: - bank_revbank_git: https://github.com/bitlair/revbank.git + - { role: "common", tags: [ "common" ] } + - { role: "nft", tags: [ "nft" ] } + - { role: "nginx", tags: [ "nginx" ] } + - { role: "acme", tags: [ "acme" ] } + - { role: "bank", tags: [ "bank" ] } diff --git a/bar.yaml b/bar.yaml index 5752cc3..919a4d8 100644 --- a/bar.yaml +++ b/bar.yaml @@ -4,6 +4,6 @@ vars: raspi_rotate_display: "2" roles: - - raspi - - common - - bank-terminal + - { role: "raspi", tags: [ "raspi" ] } + - { role: "common", tags: [ "common" ] } + - { role: "bank-terminal", tags: [ "bank-terminal" ] } diff --git a/bitlair.yaml b/bitlair.yaml index ec019e7..d09757f 100644 --- a/bitlair.yaml +++ b/bitlair.yaml @@ -1,58 +1,80 @@ - --- -- hosts: all +- name: common + hosts: all gather_facts: true roles: - - { role: "common", tags: [ "common" ] } + - { role: "common", tags: ["common"] } + - { role: "nft", tags: ["nft"] } -- hosts: bank +- name: bank + hosts: bank roles: - - { role: "bank", tags: [ "bank" ] } + - { role: "bank", tags: ["bank"] } -- hosts: raspi +- name: homeassistant + hosts: homeassistant roles: - - { role: "raspi", tags: [ "raspi" ] } - - { role: "bank-terminal", tags: [ "bank-terminal" ] } + - { role: "acme", tags: ["acme"] } + - { role: "nginx", tags: ["nginx"] } -- hosts: fotos +- name: raspi + hosts: raspi roles: - - { role: "photos", tags: [ "photos" ] } + - { role: "raspi", tags: ["raspi"] } + - { role: "bank-terminal", tags: ["bank-terminal"] } -- hosts: git-ci +- name: fotos + hosts: fotos roles: - - { role: "git-ci", tags: [ "git-ci" ] } + - { role: "photos", tags: ["photos"] } -- hosts: git +- name: CI + hosts: git-ci roles: - - { role: "acme", tags: [ "acme" ] } - - { role: "git-server", tags: [ "git-server" ] } + - { role: "git-ci", tags: ["git-ci"] } -- hosts: monitoring +- name: git + hosts: git roles: - - { role: "acme", tags: [ "acme" ] } - - { role: "monitoring", tags: [ "monitoring" ] } + - { role: "acme", tags: ["acme"] } + - { role: "nginx", tags: ["nginx"] } + - { role: "git-server", tags: ["git-server"] } -- hosts: mqtt +- name: monitoring + hosts: monitoring roles: - - { role: "mqtt-internal", tags: [ "mqtt-internal" ] } + - { role: "acme", tags: ["acme"] } + - { role: "nginx", tags: ["nginx"] } + - { role: "monitoring", tags: ["monitoring"] } -- hosts: music +- name: mqtt + hosts: mqtt roles: - - { role: "acme", tags: [ "acme" ] } - - { role: "go", tags: [ "go" ] } - - { role: "music", tags: [ "music" ] } + - { role: "mqtt", tags: ["mqtt"] } -- hosts: pad +- name: music + hosts: music roles: - - { role: "acme", tags: [ "acme" ] } - - { role: "etherpad", tags: [ "etherpad" ] } + - { role: "acme", tags: ["acme"] } + - { role: "go", tags: ["go"] } + - { role: "music", tags: ["music"] } -- hosts: services +- name: pad + hosts: pad roles: - - { role: "services", tags: [ "services" ] } + - { role: "acme", tags: ["acme"] } + - { role: "nginx", tags: ["nginx"] } + - { role: "etherpad", tags: ["etherpad"] } -- hosts: wiki +- name: services + hosts: services roles: - - { role: "acme", tags: [ "acme" ] } - - { role: "www", tags: [ "www" ] } + - { role: "services", tags: ["services"] } + +- name: wiki + hosts: wiki + roles: + - { role: "acme", tags: ["acme"] } + - { role: "nginx", tags: ["nginx"] } + - { role: "www", tags: ["www"] } diff --git a/common.yaml b/common.yaml index 3e0cb27..dacc2ae 100644 --- a/common.yaml +++ b/common.yaml @@ -3,4 +3,5 @@ - hosts: debian gather_facts: true roles: - - common + - { role: "common", tags: [ "common" ] } + - { role: "nft", tags: [ "nft" ] } diff --git a/fotos.yaml b/fotos.yaml index f0edd7b..7357e31 100644 --- a/fotos.yaml +++ b/fotos.yaml @@ -2,5 +2,5 @@ - hosts: fotos roles: - - common - - photos + - { role: "common", tags: [ "common" ] } + - { role: "photos", tags: [ "photos" ] } diff --git a/git-ci.yaml b/git-ci.yaml index fa9f7b7..711dac4 100644 --- a/git-ci.yaml +++ b/git-ci.yaml @@ -2,5 +2,5 @@ - hosts: git-ci roles: - - common - - git-ci + - { role: "common", tags: [ "common" ] } + - { role: "git-ci", tags: [ "git-ci" ] } diff --git a/git.yaml b/git.yaml index 2161a4c..0ae1811 100644 --- a/git.yaml +++ b/git.yaml @@ -2,6 +2,7 @@ - hosts: git roles: - - common - - acme - - git-server + - { role: "common", tags: [ "common" ] } + - { role: "acme", tags: [ "acme" ] } + - { role: "nginx", tags: [ "nginx" ] } + - { role: "git-server", tags: [ "git-server" ] } diff --git a/group_vars/all.yaml b/group_vars/all.yaml index bdafa45..3deb227 100644 --- a/group_vars/all.yaml +++ b/group_vars/all.yaml @@ -3,25 +3,26 @@ ansible_user: root ansible_python_interpreter: auto_silent notify_email: bestuur@bitlair.nl -acme_bootstrap_certs: no trusted_ranges: - # localhost - - { v: ipv4, cidr: 127.0.0.1/8 } - - { v: ipv6, cidr: "::1" } - # rf1928 - - { v: ipv4, cidr: 10.0.0.0/8 } - - { v: ipv4, cidr: 172.16.0.0/12 } - - { v: ipv4, cidr: 192.168.0.0/16 } - # v6 local - - { v: ipv6, cidr: "fe80::/10" } - # vihamij - - { v: ipv4, cidr: 45.88.49.140 } - # eventinfra - - { v: ipv4, cidr: 204.2.64.0/20 } - - - { v: ipv4, cidr: 100.64.0.0/10 } - - { v: ipv4, cidr: 185.205.52.194/32 } - - { v: ipv6, cidr: "2a02:166b:92::/48" } + - { v: ipv4, cidr: "127.0.0.1/8", comment: "localhost" } + - { v: ipv4, cidr: "10.0.0.0/8", comment: "rfc1918" } + - { v: ipv4, cidr: "172.16.0.0/12", comment: "rfc1918" } + - { v: ipv4, cidr: "192.168.0.0/16", comment: "rfc1918" } + - { v: ipv4, cidr: "45.88.49.140", comment: "vihamij" } + - { v: ipv4, cidr: "204.2.64.0/20", comment: "eventinfra / bitlair" } + - { v: ipv4, cidr: "100.64.0.0/10", comment: "bitlair" } + - { v: ipv4, cidr: "185.205.52.194/32", comment: "bitlair A2B" } # kan weg ?? + - { v: ipv4, cidr: "31.187.251.213/32", comment: "foobar thuis" } + - { v: ipv4, cidr: "185.205.53.40/32", comment: "ak / koopen.net" } +# - { v: ipv6, cidr: "::/0", comment: "ipv6 localhost" } +# - { v: ipv6, cidr: "fe80::/10", comment: "ipv6 link-local" } +# - { v: ipv6, cidr: "2a02:166b:92::/48", comment: "bitlair" } # /48's kunnen niet in de ipset + - { v: ipv6, cidr: "2001:678:814:68::/64", comment: "bitlair wifi" } + - { v: ipv6, cidr: "2a05:2d01:0:4042::/64", comment: "bitlair servers" } + - { v: ipv6, cidr: "2a05:2d01:1337::/48", comment: "bitlair space v6-range" } + - { v: ipv6, cidr: "2a0e:5700:4:2::/64", comment: "foobar ipv6" } +trusted_ports: + - ssh root_access: - ak diff --git a/group_vars/bank.yaml b/group_vars/bank.yaml new file mode 100644 index 0000000..1684cfa --- /dev/null +++ b/group_vars/bank.yaml @@ -0,0 +1,17 @@ +--- +deposit_hostname: deposit.bitlair.nl + +acme_domains: + - "{{ deposit_hostname }}" + +nginx_sites: + - server_name: "{{ deposit_hostname }}" + config: + - |- + location / { + proxy_pass http://localhost:8000/; + include proxy_params; + } + +group_nft_input: + - "tcp dport { http, https } accept # Allow web-traffic from world" diff --git a/group_vars/fotos.yaml b/group_vars/fotos.yaml index 5a9ca68..94751d2 100644 --- a/group_vars/fotos.yaml +++ b/group_vars/fotos.yaml @@ -1,6 +1,15 @@ + root_access: - ak - foobar - linor - polyfloyd - wilco + +trusted_ports: + - ssh + - microsoft-ds + +group_nft_input: + - "ip saddr 204.2.64.19 tcp dport { 4567 } accept # Allow traffic from wiki" + diff --git a/group_vars/git-ci.yaml b/group_vars/git-ci.yaml index 18ed638..e0bdaab 100644 --- a/group_vars/git-ci.yaml +++ b/group_vars/git-ci.yaml @@ -1 +1,5 @@ +--- + forgejo_url: https://git.bitlair.nl + +nft: false # Docker wil nog niet zo met nft diff --git a/group_vars/git.yaml b/group_vars/git.yaml index ed549a9..b938f18 100644 --- a/group_vars/git.yaml +++ b/group_vars/git.yaml @@ -1,5 +1,18 @@ +--- + acme_domains: - "{{ git_server_domain }}" git_server_domain: git.bitlair.nl git_server_title: Gitlair git_server_bootstrap_cert: no + +group_nft_input: + - "tcp dport { ssh, http, https } accept # Allow ssh(git) + web-traffic from world" + +nginx_client_max_body_size: 4G + +nginx_sites: + - server_name: "git.bitlair.nl" + localproxy: "9001" + snippets: + - "forgejo-nginx.j2" diff --git a/group_vars/homeassistant.yaml b/group_vars/homeassistant.yaml new file mode 100644 index 0000000..53b604a --- /dev/null +++ b/group_vars/homeassistant.yaml @@ -0,0 +1,12 @@ +acme_san_domains: + - [ homeassistant.bitlair.nl ] + +group_nft_input: + - "tcp dport { http, https } accept # Allow web-traffic from world" + - "tcp dport { 1883 } accept # mqtt from world" + +nginx_sites: + - server_name: "homeassistant.bitlair.nl" + localproxy: "8123" + snippets: + - "homeassistant-nginx.j2" diff --git a/group_vars/kvm.yaml b/group_vars/kvm.yaml new file mode 100644 index 0000000..cd21505 --- /dev/null +++ b/group_vars/kvm.yaml @@ -0,0 +1,2 @@ +--- + diff --git a/group_vars/lights.yaml b/group_vars/lights.yaml new file mode 100644 index 0000000..cd21505 --- /dev/null +++ b/group_vars/lights.yaml @@ -0,0 +1,2 @@ +--- + diff --git a/group_vars/monitoring.yaml b/group_vars/monitoring.yaml index b692290..61c5cae 100644 --- a/group_vars/monitoring.yaml +++ b/group_vars/monitoring.yaml @@ -1,7 +1,10 @@ monitoring_domain: dashboard.bitlair.nl monitoring_bootstrap_cert: no acme_san_domains: - - ["{{ monitoring_domain }}", monitoring.bitlair.nl] + - ["{{ monitoring_domain }}"] + +group_nft_input: + - "tcp dport { http, https } accept # Allow web-traffic from world" prometheus_scrape_configs: - job_name: "node" @@ -17,6 +20,7 @@ prometheus_scrape_configs: - "lights.bitlair.nl:9100" - "music.bitlair.nl:9100" - "service.bitlair.nl:9100" + - "user.bitlair.nl:9100" - job_name: "mqtt" static_configs: - targets: [ "localhost:9883" ] @@ -30,6 +34,7 @@ prometheus_scrape_configs: - https://bitlair.nl - https://git.bitlair.nl - https://pad.bitlair.nl + - https://user.bitlair.nl # Legacy - https://wiki.bitlair.nl - https://portal.bitlair.nl @@ -40,3 +45,9 @@ prometheus_scrape_configs: target_label: instance - target_label: __address__ replacement: "{{ blackbox_exporter_web_listen_address }}" + +nginx_sites: + - server_name: "dashboard.bitlair.nl" + localproxy: "9000" + snippets: + - "prometheus-nginx.j2" diff --git a/group_vars/mqtt.yaml b/group_vars/mqtt.yaml new file mode 100644 index 0000000..af51b73 --- /dev/null +++ b/group_vars/mqtt.yaml @@ -0,0 +1,8 @@ +--- + +nft_group_rules: + - { version: "ip6", from: [ '2001:470:7f95::/48' ], port: "1883" } + +trusted_ports: + - ssh + - 1883 diff --git a/group_vars/music.yaml b/group_vars/music.yaml index ee9235b..8f0cc7c 100644 --- a/group_vars/music.yaml +++ b/group_vars/music.yaml @@ -1,3 +1,8 @@ +--- + +# Fixme, nog niet kunnen testen, was down +nft: false + root_access: - ak - bob @@ -5,6 +10,8 @@ root_access: - foobar - polyfloyd +nginx_client_max_body_size: 512M + music_domain: music.bitlair.nl acme_san_domains: - [ music.bitlair.nl ] diff --git a/group_vars/pad.yaml b/group_vars/pad.yaml index b498398..6f4babc 100644 --- a/group_vars/pad.yaml +++ b/group_vars/pad.yaml @@ -1 +1,28 @@ +--- + +acme_domains: + - pad.bitlair.nl + etherpad_domain: pad.bitlair.nl + +nginx_sites: + - server_name: "pad.bitlair.nl" +# localproxy: "9001" + pre_config: + - "# WebSocket proxying - from https://nginx.org/en/docs/http/websocket.html" + - "map $http_upgrade $connection_upgrade {" + - " default upgrade;" + - " '' close;" + - "}" + config: + - "location / {" + - " proxy_pass http://localhost:9001/;" + - " include proxy_params;" + - "" + - " # WebSocket proxying - from https://nginx.org/en/docs/http/websocket.html" + - " proxy_set_header Upgrade $http_upgrade;" + - " proxy_set_header Connection $connection_upgrade;" + - "}" + +group_nft_input: + - "tcp dport { http, https } accept # Allow web-traffic from world" diff --git a/group_vars/raspi.yaml b/group_vars/raspi.yaml new file mode 100644 index 0000000..4b0461c --- /dev/null +++ b/group_vars/raspi.yaml @@ -0,0 +1,4 @@ +--- + +# Nog niet kunnen testen / geen toegang +nft: false diff --git a/group_vars/services.yaml b/group_vars/services.yaml new file mode 100644 index 0000000..7ab4b9c --- /dev/null +++ b/group_vars/services.yaml @@ -0,0 +1,15 @@ +--- + +group_nft_input: [] + # test + +nft_group_rules: + - { from: [ '204.2.64.29' ], port: "3306", comment: "Mysql vanaf eventinfra, verzoek AK" } + - { from: [ '100.64.0.14' ], port: "4000", proto: "udp", comment: "siahsd"} + - { from: [ '204.2.64.86' ], port: "31337", proto: "tcp", comment: "irc-say vanaf home assistant" } + +power_mqtt_targets: + - net: space + ip: 100.64.0.21 + - net: unicorndept + ip: 100.64.0.187 diff --git a/group_vars/shell.yaml b/group_vars/shell.yaml new file mode 100644 index 0000000..3d7c4b8 --- /dev/null +++ b/group_vars/shell.yaml @@ -0,0 +1,6 @@ +--- + +manage_sshd_config: false + +group_nft_input: + - "tcp dport { ssh } accept # Allow SSH from world" diff --git a/group_vars/wiki.yaml b/group_vars/wiki.yaml new file mode 100644 index 0000000..19dda0b --- /dev/null +++ b/group_vars/wiki.yaml @@ -0,0 +1,24 @@ +acme_san_domains: + - [ bitlair.nl, wiki.bitlair.nl, www.bitlair.nl ] + - [ bitair.nl ] + - [ ravespace.nl ] + +group_nft_input: + - "tcp dport { http, https } accept # Allow web-traffic from world" + - "tcp dport { 1883 } accept # mqtt from world" + +nginx_sites: + - server_name: "bitlair.nl" + server_alias: "wiki.bitlair.nl www.bitlair.nl cyber.bitlair.nl" + snippets: + - "mqtt2web-nginx.j2" + - "spaceapi-nginx.j2" + - "www-nginx.j2" + - server_name: "bitair.nl" + server_alias: "www.bitair.nl" + snippets: + - "bitair-nginx.j2" + - server_name: "ravespace.nl" + server_alias: "www.ravespace.nl" + snippets: + - "ravespace-nginx.j2" diff --git a/group_vars/www.yaml b/group_vars/www.yaml deleted file mode 100644 index e1db9d5..0000000 --- a/group_vars/www.yaml +++ /dev/null @@ -1,5 +0,0 @@ -acme_bootstrap_certs: yes -acme_san_domains: - - [ bitlair.nl, wiki.bitlair.nl, www.bitlair.nl ] - - [ bitair.nl ] - - [ ravespace.nl ] diff --git a/inventory b/inventory index 7e430e1..c380b07 100644 --- a/inventory +++ b/inventory @@ -1,4 +1,5 @@ -# Inventory +# Bitlair inventory + [raspi] bank-pi.bitlair.nl @@ -39,6 +40,15 @@ service.bitlair.nl [wiki] wiki.bitlair.nl +[shell] +shell.bitlair.nl + +[homeassistant] +homeassistant.bitlair.nl + +[chat] +chat.bitlair.nl + [debian:children] bank fotos @@ -51,4 +61,6 @@ monitoring music services wiki - +shell +homeassistant +chat diff --git a/lint.sh b/lint.sh new file mode 100755 index 0000000..296c955 --- /dev/null +++ b/lint.sh @@ -0,0 +1,6 @@ +#!/bin/bash + +j2lint `find ./ -type f -name '*.j2'` +yamllint -c .yamllint.yaml . +ansible-lint bitlair.yaml + diff --git a/monitoring.yaml b/monitoring.yaml index 9ad8623..9e05df0 100644 --- a/monitoring.yaml +++ b/monitoring.yaml @@ -2,6 +2,7 @@ - hosts: monitoring roles: - - common - - acme - - monitoring + - { role: "common", tags: [ "common" ] } + - { role: "acme", tags: [ "acme" ] } + - { role: "nginx", tags: [ "nginx" ] } + - { role: "monitoring", tags: [ "monitoring" ] } diff --git a/mqtt-internal.yaml b/mqtt-internal.yaml deleted file mode 100644 index 1e941f8..0000000 --- a/mqtt-internal.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- - -- hosts: mqtt_internal - roles: - - common - - mqtt-internal diff --git a/mqtt.yaml b/mqtt.yaml new file mode 100644 index 0000000..7b691f3 --- /dev/null +++ b/mqtt.yaml @@ -0,0 +1,6 @@ +--- + +- hosts: mqtt + roles: + - { role: "common", tags: [ "common" ] } + - { role: "mqtt", tags: [ "mqtt", "mqtt" ] } diff --git a/music.yaml b/music.yaml index d12226c..e4ea70b 100644 --- a/music.yaml +++ b/music.yaml @@ -2,7 +2,8 @@ - hosts: music roles: - - common - - acme - - go - - music + - { role: "common", tags: [ "common" ] } + - { role: "acme", tags: [ "acme" ] } + - { role: "go", tags: [ "go" ] } +# - { role: "nginx", tags: [ "nginx" ] } + - { role: "music", tags: [ "music" ] } diff --git a/pad.yaml b/pad.yaml index 90d227e..380e790 100644 --- a/pad.yaml +++ b/pad.yaml @@ -5,6 +5,8 @@ acme_san_domains: - [ pad.bitlair.nl ] roles: - - common - - acme - - etherpad + - { role: "common", tags: [ "common" ] } + - { role: "nft", tags: [ "nft" ] } + - { role: "acme", tags: [ "acme" ] } + - { role: "nginx", tags: [ "nginx" ] } + - { role: "etherpad", tags: [ "etherpad" ] } diff --git a/roles/acme/handlers/main.yaml b/roles/acme/handlers/main.yaml index 508fc1a..7ff2509 100644 --- a/roles/acme/handlers/main.yaml +++ b/roles/acme/handlers/main.yaml @@ -1,7 +1,9 @@ +--- + - name: update_contact_info ansible.builtin.command: cmd: dehydrated --account -- name: query_certificates +- name: run dehydrated ansible.builtin.command: cmd: dehydrated --cron diff --git a/roles/acme/tasks/main.yaml b/roles/acme/tasks/main.yaml index 653f49c..01bf029 100644 --- a/roles/acme/tasks/main.yaml +++ b/roles/acme/tasks/main.yaml @@ -1,82 +1,46 @@ --- -- ansible.builtin.import_tasks: - file: remove_conflicting.yaml - tags: [ never, acme_remove_conflicting ] - name: Install Dehydrated - tags: [ acme, acme_install ] - block: - - name: Install dependencies - ansible.builtin.apt: - name: ssl-cert - state: present + ansible.builtin.apt: + state: present + pkg: + - dehydrated + tags: + - acme - - name: Install Dehydrated - ansible.builtin.apt: - name: dehydrated - state: present +- name: Create Nginx snippet snippets dir + ansible.builtin.file: + state: "directory" + path: "/etc/nginx/snippets" + owner: "root" + group: "root" + mode: "0755" - - name: Install config file - ansible.builtin.template: - src: config.sh - dest: /etc/dehydrated/conf.d/ansible.sh - owner: root - group: root - mode: 0755 - notify: update_contact_info +- name: Template dehydrated configfiles + ansible.builtin.template: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + owner: "{{ item.owner | default('root') }}" + group: "{{ item.group | default('root') }}" + mode: "{{ item.mode | default('0640') }}" + notify: "{{ item.notify | default([]) }}" + with_items: + - { src: "config.sh", dest: "/etc/dehydrated/conf.d/ansible.sh", mode: '0755' } + - { src: "deploy.sh", dest: "/etc/dehydrated/conf.d/deploy.sh", mode: '0755' } + - { src: "cron", dest: "/etc/cron.d/dehydrated" } + - { src: "nginx-snippet.conf", dest: "/etc/nginx/snippets/acme.conf" } + - { src: "domains.txt", dest: "/etc/dehydrated/domains.txt", notify: "run dehydrated" } - - name: Install deploy hook - ansible.builtin.template: - src: deploy.sh - dest: /etc/dehydrated/conf.d/deploy.sh - owner: root - group: root - mode: 0755 +- name: Register account + ansible.builtin.command: + args: + cmd: dehydrated --register --accept-terms + creates: /var/lib/dehydrated/accounts - - name: Install cronjob - ansible.builtin.template: - src: cron - dest: /etc/cron.d/dehydrated - owner: root - group: root - mode: 0644 +- name: Symlink SAN domains + ansible.builtin.include_tasks: + file: san_domains_loop.yaml + loop: "{{ acme_san_domains | default([]) }}" + loop_control: + loop_var: domains - - name: Create Nginx snippet snippets dir - ansible.builtin.file: - state: directory - path: /etc/nginx/snippets - owner: root - group: root - mode: 0755 - - - name: Install Nginx snippet - ansible.builtin.template: - src: nginx-snippet.conf - dest: /etc/nginx/snippets/acme.conf - owner: root - group: root - mode: 0644 - - - name: Register account - ansible.builtin.command: - cmd: dehydrated --register --accept-terms - args: - creates: /var/lib/dehydrated/accounts - -- tags: [ acme, acme_certs ] - block: - - name: Configure certificates - ansible.builtin.template: - src: domains.txt - dest: /etc/dehydrated/domains.txt - owner: root - group: root - mode: 0644 - notify: query_certificates - - - name: Symlink SAN domains - ansible.builtin.include_tasks: - file: san_domains_loop.yaml - loop: "{{ acme_san_domains|default([]) }}" - loop_control: - loop_var: domains diff --git a/roles/acme/tasks/remove_conflicting.yaml b/roles/acme/tasks/remove_conflicting.yaml index 9c88555..dcbb573 100644 --- a/roles/acme/tasks/remove_conflicting.yaml +++ b/roles/acme/tasks/remove_conflicting.yaml @@ -1,9 +1,4 @@ --- -- name: Remove certbot from apt - ansible.builtin.apt: - name: [ letsencrypt, certbot ] - state: absent - autoremove: yes - name: Remove variable directories ansible.builtin.file: diff --git a/roles/acme/tasks/san_domains_loop.yaml b/roles/acme/tasks/san_domains_loop.yaml index b878042..99d57b5 100644 --- a/roles/acme/tasks/san_domains_loop.yaml +++ b/roles/acme/tasks/san_domains_loop.yaml @@ -1,4 +1,5 @@ --- + - ansible.builtin.stat: path: "/var/lib/dehydrated/certs/{{ domains[0] }}" register: cert_stat diff --git a/roles/acme/templates/config.sh b/roles/acme/templates/config.sh index f51455d..2dae219 100644 --- a/roles/acme/templates/config.sh +++ b/roles/acme/templates/config.sh @@ -1,5 +1,5 @@ #!/bin/bash -# Managed by Ansible +# {{ ansible_managed }} CONTACT_EMAIL={{ notify_email }} diff --git a/roles/acme/templates/cron b/roles/acme/templates/cron index ecf8b99..c7d7c91 100644 --- a/roles/acme/templates/cron +++ b/roles/acme/templates/cron @@ -1,4 +1,4 @@ -# Managed by Ansible +# {{ ansible_managed }} SHELL=/bin/sh PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin diff --git a/roles/acme/templates/deploy.sh b/roles/acme/templates/deploy.sh index 3d962b6..cbcb1b1 100644 --- a/roles/acme/templates/deploy.sh +++ b/roles/acme/templates/deploy.sh @@ -1,5 +1,5 @@ #!/bin/bash -# Managed by Ansible +# {{ ansible_managed }} systemctl reload nginx.service diff --git a/roles/acme/templates/domains.txt b/roles/acme/templates/domains.txt index 632b12b..eba6ded 100644 --- a/roles/acme/templates/domains.txt +++ b/roles/acme/templates/domains.txt @@ -1,4 +1,4 @@ -# Managed by Ansible +# {{ ansible_managed }} {% for domain in acme_domains|default([]) %} {{ domain }} diff --git a/roles/acme/templates/nginx-snippet.conf b/roles/acme/templates/nginx-snippet.conf index c57ac6a..7425bc2 100644 --- a/roles/acme/templates/nginx-snippet.conf +++ b/roles/acme/templates/nginx-snippet.conf @@ -1,4 +1,4 @@ -# Managed by Ansible +# {{ ansible_managed }} location /.well-known/acme-challenge { allow all; diff --git a/roles/bank/defaults/main.yaml b/roles/bank/defaults/main.yaml index 136726e..b0fea92 100644 --- a/roles/bank/defaults/main.yaml +++ b/roles/bank/defaults/main.yaml @@ -1,3 +1,3 @@ bank_user: bank -bank_revbank_git: https://github.com/revspace/revbank.git +bank_revbank_git: https://git.bitlair.nl/bitlair/revbank.git bank_local_tty: no diff --git a/roles/bank/handlers/main.yaml b/roles/bank/handlers/main.yaml index e7a11ce..a06cd29 100644 --- a/roles/bank/handlers/main.yaml +++ b/roles/bank/handlers/main.yaml @@ -1,3 +1,9 @@ --- - ansible.builtin.import_tasks: file: ../../common/handlers/main.yaml + +- name: Restart revbank-deposit + ansible.builtin.systemd: + name: revbank-deposit + state: restarted + daemon_reload: true diff --git a/roles/bank/tasks/inflatinator.yaml b/roles/bank/tasks/inflatinator.yaml deleted file mode 100644 index dc687a3..0000000 --- a/roles/bank/tasks/inflatinator.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -- name: Install dependencies - ansible.builtin.apt: - name: [ links, python3-pyquery ] - state: present - -- name: Clone revbank-inflatinator source - ansible.builtin.git: - repo: https://github.com/bitlair/revbank-inflatinator.git - version: main - dest: /opt/revbank-inflatinator - accept_hostkey: yes diff --git a/roles/bank/tasks/login.yaml b/roles/bank/tasks/login.yaml index cd0f9ba..7ed568e 100644 --- a/roles/bank/tasks/login.yaml +++ b/roles/bank/tasks/login.yaml @@ -11,6 +11,7 @@ ansible.builtin.blockinfile: path: /etc/ssh/sshd_config insertafter: EOF + validate: "/usr/sbin/sshd -t -f %s" block: |- Match User bank PasswordAuthentication yes diff --git a/roles/bank/tasks/main.yaml b/roles/bank/tasks/main.yaml index 7ad90f6..fd9f58f 100644 --- a/roles/bank/tasks/main.yaml +++ b/roles/bank/tasks/main.yaml @@ -7,6 +7,6 @@ ansible.builtin.import_tasks: file: revbank.yaml -- tags: [ bank, bank_inflatinator ] +- tags: [ bank, bank_revbank_deposit ] ansible.builtin.import_tasks: - file: inflatinator.yaml + file: revbank-deposit.yaml diff --git a/roles/bank/tasks/revbank-deposit.yaml b/roles/bank/tasks/revbank-deposit.yaml new file mode 100644 index 0000000..1190a53 --- /dev/null +++ b/roles/bank/tasks/revbank-deposit.yaml @@ -0,0 +1,47 @@ +--- +- name: Clone source + ansible.builtin.git: + repo: https://git.bitlair.nl/bitlair/revbank-deposit.git + version: main + dest: /usr/local/lib/revbank-deposit + accept_hostkey: yes + notify: Restart revbank-deposit + +- name: Install apt dependencies + ansible.builtin.apt: + name: + - python3-pip + - python3-virtualenv + +- name: Install pip dependencies + ansible.builtin.pip: + chdir: /usr/local/lib/revbank-deposit + virtualenv: .venv + requirements: requirements.txt + +- name: Configure revbank-deposit + ansible.builtin.template: + src: revbank-deposit.conf + dest: /etc/revbank-deposit.conf + owner: root + group: root + mode: 0600 + notify: Restart revbank-deposit + +- name: Install revbank-deposit service + ansible.builtin.template: + src: revbank-deposit.service + dest: /etc/systemd/system/revbank-deposit.service + owner: root + group: root + mode: 0644 + notify: Restart revbank-deposit + +- name: Start revbank-deposit + ansible.builtin.systemd: + daemon_reload: true + name: revbank-deposit + state: started + enabled: true + +- meta: flush_handlers diff --git a/roles/bank/templates/git.cron b/roles/bank/templates/git.cron index 2290e43..b703657 100644 --- a/roles/bank/templates/git.cron +++ b/roles/bank/templates/git.cron @@ -1,4 +1,4 @@ SHELL=/bin/bash #m h dom mon dow user command - 0 * * * * {{ bank_user }} (cd /home/{{ bank_user }}/data.git && git push --mirror && git gc --auto) + 0 * * * * {{ bank_user }} (cd /home/{{ bank_user }}/data.git && git pull -r && git push && git gc --auto && cp revbank.products ../revbank.products) diff --git a/roles/bank/templates/revbank-deposit.conf b/roles/bank/templates/revbank-deposit.conf new file mode 100644 index 0000000..7e02359 --- /dev/null +++ b/roles/bank/templates/revbank-deposit.conf @@ -0,0 +1,4 @@ +# {{ ansible_managed }} + +PUBLIC_URL=https://{{ deposit_hostname }} +MOLLIE_API_KEY={{ lookup('passwordstore', 'mollie subkey=apikey') }} diff --git a/roles/bank/templates/revbank-deposit.service b/roles/bank/templates/revbank-deposit.service new file mode 100644 index 0000000..83a93f5 --- /dev/null +++ b/roles/bank/templates/revbank-deposit.service @@ -0,0 +1,18 @@ +# {{ ansible_managed }} + +[Unit] +Description=Revbank Deposit +After=network.target + +[Service] +Type=simple +Restart=on-failure +RestartSec=10s +ExecStart=/usr/local/lib/revbank-deposit/.venv/bin/fastapi run main.py --host 127.0.0.1 +WorkingDirectory=/usr/local/lib/revbank-deposit +EnvironmentFile=/etc/revbank-deposit.conf +DynamicUser=true + +[Install] +WantedBy=multi-user.target + diff --git a/roles/common/defaults/main.yaml b/roles/common/defaults/main.yaml index 5512d86..82c6bcf 100644 --- a/roles/common/defaults/main.yaml +++ b/roles/common/defaults/main.yaml @@ -17,3 +17,5 @@ node_exporter: true debian_packages_unwanted: - netcat-traditional + - letsencrypt + - certbot diff --git a/roles/common/handlers/main.yaml b/roles/common/handlers/main.yaml index b71cef9..3f6d5b8 100644 --- a/roles/common/handlers/main.yaml +++ b/roles/common/handlers/main.yaml @@ -1,31 +1,29 @@ --- -- name: update grub +- name: Update grub ansible.builtin.command: cmd: update-grub -- name: reboot - ansible.builtin.reboot: - -- name: apt update +- name: Apt update ansible.builtin.apt: update_cache: true -- name: daemon reload +- name: Daemon reload ansible.builtin.systemd: daemon_reload: true -- name: reload sshd +- name: Reload sshd ansible.builtin.systemd: name: ssh state: reloaded -- name: reload nginx +- name: Reload nginx ansible.builtin.systemd: name: nginx state: reloaded -- name: persist iptables +- name: Persist iptables ansible.builtin.shell: "{{ item.c }}-save > /etc/iptables/rules.{{ item.ip }}" with_items: - { c: iptables, ip: v4 } - { c: ip6tables, ip: v6 } + when: not nft | bool diff --git a/roles/common/tasks/debian-upgrade.yaml b/roles/common/tasks/debian-upgrade.yaml index 3ff5041..f986713 100644 --- a/roles/common/tasks/debian-upgrade.yaml +++ b/roles/common/tasks/debian-upgrade.yaml @@ -21,9 +21,6 @@ ansible.builtin.apt: upgrade: full -- name: Reboot - ansible.builtin.reboot: - - name: autoremove ansible.builtin.apt: autoremove: yes diff --git a/roles/common/tasks/main.yaml b/roles/common/tasks/main.yaml index b0b39cf..29f7744 100644 --- a/roles/common/tasks/main.yaml +++ b/roles/common/tasks/main.yaml @@ -15,9 +15,12 @@ group: "{{ item.group | default('root') }}" with_items: - { src: "apt.conf.j2", dest: "/etc/apt/apt.conf" } + - { src: "apt-defaultrelease.j2", dest: "/etc/apt/apt.conf.d/09defaultrelease" } + - { src: "apt-preferences-stable.j2", dest: "/etc/apt/preferences.d/stableonly" } - { src: "sources.list.j2", dest: "/etc/apt/sources.list" } - { src: "apt-auto-upgrades.j2", dest: "/etc/apt/apt.conf.d/20auto-upgrades" } - { src: "apt-unattended-upgrades.j2", dest: "/etc/apt/apt.conf.d/50unattended-upgrades" } + register: aptconfig when: - ansible_os_family == "Debian" tags: @@ -56,6 +59,8 @@ - name: Install standard packages ansible.builtin.apt: + cache_valid_time: 3600 + update_cache: "{{ aptconfig.changed | bool | default(false) }}" pkg: - curl - fzf @@ -63,8 +68,6 @@ - etckeeper - git - htop - - iptables - - iptables-persistent - jq - net-tools - netcat-openbsd @@ -75,6 +78,7 @@ - vim - unattended-upgrades - apt-listchanges + - sudo-ldap - name: Configure FZF for Bash ansible.builtin.lineinfile: @@ -95,7 +99,7 @@ path: /etc/default/grub regexp: '^GRUB_TIMEOUT=' line: "GRUB_TIMEOUT=1 # Managed by Ansible" - notify: update grub + notify: Update grub - name: Configure cron email ansible.builtin.lineinfile: @@ -108,6 +112,7 @@ path: /etc/ssh/sshd_config regexp: "{{ item.regexp }}" line: "{{ item.line }}" + validate: "/usr/sbin/sshd -t -f %s" with_items: - regexp: '^#?Port' line: 'Port {{ ssh_port }}' @@ -115,58 +120,6 @@ line: 'PasswordAuthentication no' - regexp: '^#?DebianBanner' line: 'DebianBanner no' - notify: reload sshd + when: manage_sshd_config | default(true) + notify: Reload sshd -- name: Allow SSH - ansible.builtin.iptables: - chain: INPUT - protocol: tcp - destination_port: "{{ ssh_port }}" - ctstate: NEW - jump: ACCEPT - ip_version: "{{ item }}" - with_items: - - ipv4 - - ipv6 - notify: persist iptables - -- name: Allow ICMP - ansible.builtin.iptables: - chain: INPUT - protocol: "{{ item.proto }}" - jump: ACCEPT - ip_version: "{{ item.ip }}" - with_items: - - { ip: ipv4, proto: icmp } - - { ip: ipv6, proto: ipv6-icmp } - notify: persist iptables - -- name: Allow related and established connections - ansible.builtin.iptables: - chain: INPUT - ctstate: ESTABLISHED,RELATED - jump: ACCEPT - ip_version: "{{ item }}" - with_items: - - ipv4 - - ipv6 - notify: persist iptables - -- name: Allow local connections - ansible.builtin.iptables: - chain: INPUT - source: "{{ item.cidr }}" - jump: ACCEPT - ip_version: "{{ item.v }}" - with_items: "{{ trusted_ranges }}" - notify: persist iptables - -- name: Deny inbound connections - ansible.builtin.iptables: - chain: INPUT - policy: DROP - ip_version: "{{ item }}" - with_items: - - ipv4 - - ipv6 - notify: persist iptables diff --git a/roles/common/tasks/network.yaml b/roles/common/tasks/network.yaml index 9d5e471..7e2a75b 100644 --- a/roles/common/tasks/network.yaml +++ b/roles/common/tasks/network.yaml @@ -13,7 +13,6 @@ with_items: - { k: net.ipv4.ip_forward, v: "1" } - { k: net.ipv6.conf.all.forwarding, v: "1" } - notify: reboot when: network_br - name: Make network interfaces really predictable @@ -22,8 +21,7 @@ regexp: ^GRUB_CMDLINE_LINUX line: 'GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0" # Managed by Ansible' notify: - - update grub - - reboot + - Update grub when: network_br or network_dhcp or network_static - name: Configure network interfaces @@ -33,7 +31,6 @@ owner: root group: root mode: 0644 - notify: reboot when: network_br or network_dhcp or network_static - ansible.builtin.meta: flush_handlers diff --git a/roles/common/tasks/vm.yaml b/roles/common/tasks/vm.yaml index 505c03f..f70850c 100644 --- a/roles/common/tasks/vm.yaml +++ b/roles/common/tasks/vm.yaml @@ -10,9 +10,8 @@ ansible.builtin.lineinfile: path: /etc/default/grub regexp: ^GRUB_CMDLINE_LINUX_DEFAULT - line: 'GRUB_CMDLINE_LINUX_DEFAULT="quiet console=ttyS0,115200n1 console=tty0"' + line: 'GRUB_CMDLINE_LINUX_DEFAULT="quiet net.ifnames=0 console=ttyS0,115200n1 console=tty0"' notify: - - update grub - - reboot + - Update grub tags: - questagent diff --git a/roles/common/templates/apt-defaultrelease.j2 b/roles/common/templates/apt-defaultrelease.j2 new file mode 100644 index 0000000..1bab7c5 --- /dev/null +++ b/roles/common/templates/apt-defaultrelease.j2 @@ -0,0 +1 @@ +APT::Default-Release "{{ ansible_distribution_release }}"; diff --git a/roles/common/templates/apt-preferences-stable.j2 b/roles/common/templates/apt-preferences-stable.j2 new file mode 100644 index 0000000..8fc3cd0 --- /dev/null +++ b/roles/common/templates/apt-preferences-stable.j2 @@ -0,0 +1,19 @@ +# Prefer packages from our release +# Prevent auto-installation from testing/unstable/sid/whatever + +Package: * +Pin: release n={{ ansible_distribution_release }} +Pin-Priority: 900 + +Package: * +Pin: release n=sid +Pin-Priority: -10 + +Package: * +Pin: release n=testing +Pin-Priority: -10 + +Package: * +Pin: release n=unstable +Pin-Priority: -10 + diff --git a/roles/common/templates/authorized_keys.j2 b/roles/common/templates/authorized_keys.j2 index 182dc36..9df7ff6 100644 --- a/roles/common/templates/authorized_keys.j2 +++ b/roles/common/templates/authorized_keys.j2 @@ -2,5 +2,5 @@ {% for name in root_access %} # {{ name }} -{{ lookup('file', 'authorized_keys/'+name+'.keys') }} +{{ lookup('file', 'authorized_keys/' + name + '.keys') }} {% endfor %} diff --git a/roles/common/templates/sources.list.j2 b/roles/common/templates/sources.list.j2 index 9aac632..2722b8f 100644 --- a/roles/common/templates/sources.list.j2 +++ b/roles/common/templates/sources.list.j2 @@ -1,9 +1,9 @@ # {{ ansible_managed }} -{% if debian_source_repos|default(false) %} -{% set SRC = "" %} +{% if debian_source_repos | default(false) %} +{% set SRC = "" %} {% else %} -{% set SRC = "# " %} +{% set SRC = "# " %} {% endif %} {% set components = "main contrib non-free-firmware" %} @@ -20,5 +20,8 @@ deb {{ debian_repourl }} {{ ansible_distribution_release }}-backports {{ compone # # Security patches deb {{ debian_securityurl }} {{ ansible_distribution_release }}-security {{ components }} -{{ SRC }}deb-src {{ debian_securityurl }} {{ ansible_distribution_release }}-security main contrib non- free +{{ SRC }}deb-src {{ debian_securityurl }} {{ ansible_distribution_release }}-security {{ components }} +# Testing/Unstable repos +deb {{ debian_repourl }} testing {{ components }} +deb {{ debian_repourl }} sid {{ components }} diff --git a/roles/etherpad/handlers/main.yaml b/roles/etherpad/handlers/main.yaml index 82924a6..7aea6eb 100644 --- a/roles/etherpad/handlers/main.yaml +++ b/roles/etherpad/handlers/main.yaml @@ -2,7 +2,7 @@ - ansible.builtin.import_tasks: file: ../../common/handlers/main.yaml -- name: restart etherpad +- name: Restart etherpad ansible.builtin.systemd: name: etherpad state: restarted diff --git a/roles/etherpad/tasks/main.yaml b/roles/etherpad/tasks/main.yaml index 2afe1f6..0f4beb5 100644 --- a/roles/etherpad/tasks/main.yaml +++ b/roles/etherpad/tasks/main.yaml @@ -1,140 +1,126 @@ --- -- tags: etherpad - block: - - ansible.builtin.import_tasks: - file: ../../../snippets/common-nginx.yaml - - name: Install dependencies - ansible.builtin.apt: - name: [ gpg, postgresql, python3-psycopg2, apt-transport-https ] +- name: Install dependencies + ansible.builtin.apt: + state: present + pkg: + - gpg + - postgresql + - python3-psycopg2 + - apt-transport-https - - name: Import nodesource signing key - ansible.builtin.shell: - cmd: curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor - -o /usr/share/keyrings/nodesource.gpg - args: - creates: /usr/share/keyrings/nodesource.gpg - notify: apt update +- name: Import nodesource signing key + ansible.builtin.shell: + cmd: curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor + -o /usr/share/keyrings/nodesource.gpg + args: + creates: /usr/share/keyrings/nodesource.gpg + notify: Apt update - - name: Install nodesource source list - ansible.builtin.template: - src: nodesource.list - dest: /etc/apt/sources.list.d/nodesource.list - owner: root - group: root - mode: 0644 - notify: apt update +- name: Install nodesource source list + ansible.builtin.template: + src: nodesource.list + dest: /etc/apt/sources.list.d/nodesource.list + owner: root + group: root + mode: 0644 + notify: Apt update - - name: Install nodejs apt preference - ansible.builtin.template: - src: nodejs-apt-pref - dest: /etc/apt/preferences.d/nodejs - owner: root - group: root - mode: 0644 - notify: apt update +- name: Install nodejs apt preference + ansible.builtin.template: + src: nodejs-apt-pref + dest: /etc/apt/preferences.d/nodejs + owner: root + group: root + mode: 0644 + notify: Apt update - - ansible.builtin.meta: flush_handlers +- ansible.builtin.meta: flush_handlers - - name: Install nodejs - ansible.builtin.apt: - name: nodejs +- name: Install nodejs + ansible.builtin.apt: + name: nodejs - - name: Add database user - become: true - become_method: su - become_user: postgres - no_log: yes - community.postgresql.postgresql_user: - name: etherpad - password: "{{ etherpad_db_password }}" +- name: Add database user + become: true + become_method: su + become_user: postgres + no_log: yes + community.postgresql.postgresql_user: + name: etherpad + password: "{{ etherpad_db_password }}" - - name: Add database - become: true - become_method: su - become_user: postgres - community.postgresql.postgresql_db: - name: "{{ etherpad_db_name }}" - owner: "{{ etherpad_db_user }}" +- name: Add database + become: true + become_method: su + become_user: postgres + community.postgresql.postgresql_db: + name: "{{ etherpad_db_name }}" + owner: "{{ etherpad_db_user }}" - - name: Add etherpad user - ansible.builtin.user: - name: etherpad - home: /var/lib/etherpad +- name: Add etherpad user + ansible.builtin.user: + name: etherpad + home: /var/lib/etherpad - - name: Create log file - ansible.builtin.file: - path: /var/log/etherpad.log - state: touch - owner: etherpad - group: etherpad - mode: 0644 +- name: Create log file + ansible.builtin.file: + path: /var/log/etherpad.log + state: touch + owner: etherpad + group: etherpad + mode: 0644 - - name: Create source directory - ansible.builtin.file: - path: /opt/etherpad - state: directory - owner: etherpad - group: etherpad - mode: 0755 +- name: Create source directory + ansible.builtin.file: + path: /opt/etherpad + state: directory + owner: etherpad + group: etherpad + mode: 0755 - - name: Clone etherpad source - become: yes - become_method: su - become_user: etherpad - ansible.builtin.git: - repo: https://github.com/ether/etherpad-lite.git - version: master - dest: /opt/etherpad - accept_hostkey: yes - notify: restart etherpad +- name: Clone etherpad source + become: yes + become_method: su + become_user: etherpad + ansible.builtin.git: + repo: https://github.com/ether/etherpad-lite.git + version: master + dest: /opt/etherpad + accept_hostkey: yes + notify: Restart etherpad - - name: Install etherpad config - ansible.builtin.template: - src: settings.json - dest: /opt/etherpad/settings.json - owner: root - group: root - mode: 0644 - notify: restart etherpad +- name: Install etherpad config + ansible.builtin.template: + src: settings.json + dest: /opt/etherpad/settings.json + owner: root + group: root + mode: 0644 + notify: Restart etherpad - - name: Install etherpad service - ansible.builtin.template: - src: etherpad.service - dest: /etc/systemd/system/etherpad.service - owner: root - group: root - mode: 0644 - notify: restart etherpad +- name: Install etherpad service + ansible.builtin.template: + src: etherpad.service + dest: /etc/systemd/system/etherpad.service + owner: root + group: root + mode: 0644 + notify: Restart etherpad - - name: Start etherpad - ansible.builtin.systemd: - daemon_reload: true - name: etherpad - state: started - enabled: yes +- name: Start etherpad + ansible.builtin.systemd: + daemon_reload: true + name: etherpad + state: started + enabled: true - - name: Install nginx config - ansible.builtin.template: - src: nginx-site.conf - dest: /etc/nginx/sites-enabled/etherpad - owner: root - group: root - mode: 0644 - notify: reload nginx +- name: Install nginx config + ansible.builtin.template: + src: nginx-site.conf + dest: /etc/nginx/sites-enabled/etherpad + owner: root + group: root + mode: 0644 + notify: Reload nginx - - name: Allow HTTP and HTTPS - ansible.builtin.iptables: - chain: INPUT - protocol: tcp - destination_port: "{{ item.port }}" - ctstate: NEW - jump: ACCEPT - ip_version: "{{ item.ip }}" - action: insert - with_items: - - { ip: ipv4, port: 80 } - - { ip: ipv4, port: 443 } - - { ip: ipv6, port: 80 } - - { ip: ipv6, port: 443 } - notify: persist iptables diff --git a/roles/etherpad/tasks/requirements.yml b/roles/etherpad/tasks/requirements.yml index 060cde3..0b8dbb8 100644 --- a/roles/etherpad/tasks/requirements.yml +++ b/roles/etherpad/tasks/requirements.yml @@ -1,3 +1,5 @@ +--- + collections: - name: community.postgresql version: 2.3.2 diff --git a/roles/git-ci/defaults/main.yaml b/roles/git-ci/defaults/main.yaml index 82807d7..2e805ee 100644 --- a/roles/git-ci/defaults/main.yaml +++ b/roles/git-ci/defaults/main.yaml @@ -1,2 +1,2 @@ runner_wd: /var/lib/forgejo-runner -runner_version: 3.4.1 +runner_version: 6.3.0 diff --git a/roles/git-ci/tasks/main.yaml b/roles/git-ci/tasks/main.yaml index a01a11a..d677a61 100644 --- a/roles/git-ci/tasks/main.yaml +++ b/roles/git-ci/tasks/main.yaml @@ -1,50 +1,50 @@ --- -- tags: forgejo_runner - block: - - name: Install dependencies - ansible.builtin.apt: - name: docker.io - - name: Download forgejo-runner - ansible.builtin.get_url: - url: "https://code.forgejo.org/forgejo/runner/releases/download/v{{ runner_version }}/forgejo-runner-{{ runner_version }}-linux-amd64" - dest: /usr/local/bin/forgejo-runner - mode: 0755 - notify: restart forgejo-runner +- name: Install dependencies + ansible.builtin.apt: + name: docker.io - - name: Create runner dir - ansible.builtin.file: - state: directory - path: "{{ runner_wd }}" - owner: root - group: root - mode: 0755 +- name: Download forgejo-runner + ansible.builtin.get_url: + url: "https://code.forgejo.org/forgejo/runner/releases/download/v{{ runner_version }}/forgejo-runner-{{ runner_version }}-linux-amd64" + dest: /usr/local/bin/forgejo-runner + mode: 0755 + notify: restart forgejo-runner - - name: Register runner - ansible.builtin.command: "forgejo-runner register --no-interactive --instance={{ forgejo_url }} --token={{ lookup('passwordstore', 'git/ci subkey=runner_token') }}" - args: - chdir: "{{ runner_wd }}" - creates: "{{ runner_wd }}/.runner" +- name: Create runner dir + ansible.builtin.file: + state: directory + path: "{{ runner_wd }}" + owner: root + group: root + mode: 0755 - - name: Install service file - ansible.builtin.template: - src: forgejo-runner.service - dest: /etc/systemd/system/forgejo-runner.service - owner: root - group: root - mode: 0644 - notify: restart forgejo-runner +- name: Register runner + ansible.builtin.command: "forgejo-runner register --no-interactive --instance={{ forgejo_url }} --token={{ lookup('passwordstore', 'git/ci subkey=runner_token') }}" + args: + chdir: "{{ runner_wd }}" + creates: "{{ runner_wd }}/.runner" - - name: Enable service - ansible.builtin.systemd: - name: forgejo-runner - enabled: yes - daemon_reload: true +- name: Install service file + ansible.builtin.template: + src: forgejo-runner.service + dest: /etc/systemd/system/forgejo-runner.service + owner: root + group: root + mode: 0644 + notify: restart forgejo-runner - - name: Start service - ansible.builtin.systemd: - name: forgejo-runner - state: started - daemon_reload: true +- name: Enable service + ansible.builtin.systemd: + name: forgejo-runner + enabled: true + daemon_reload: true - - ansible.builtin.meta: flush_handlers +- name: Start service + ansible.builtin.systemd: + name: forgejo-runner + state: started + daemon_reload: true + +- name: Flush handlers + ansible.builtin.meta: flush_handlers diff --git a/roles/git-server/tasks/main.yaml b/roles/git-server/tasks/main.yaml index 4a5bb3c..5104ef5 100644 --- a/roles/git-server/tasks/main.yaml +++ b/roles/git-server/tasks/main.yaml @@ -1,6 +1,4 @@ --- -- ansible.builtin.import_tasks: - file: ../../../snippets/common-nginx.yaml - name: Install dependencies ansible.builtin.apt: @@ -16,14 +14,14 @@ owner: root group: root mode: 0644 - notify: reload nginx + notify: Reload nginx - name: Enable nginx site ansible.builtin.file: src: /etc/nginx/sites-available/forgejo dest: /etc/nginx/sites-enabled/forgejo state: link - notify: reload nginx + notify: Reload nginx - name: Create user ansible.builtin.user: @@ -40,7 +38,6 @@ group: "{{ git_server_user }}" mode: 0755 - # TODO: Install initial config - name: Install service file @@ -50,7 +47,7 @@ owner: root group: root mode: 0644 - notify: reload forgejo + notify: Reload forgejo - name: Install update script ansible.builtin.template: @@ -64,12 +61,12 @@ ansible.builtin.command: "{{ git_server_working_dir }}/update.sh" args: creates: "{{ git_server_working_dir }}/forgejo" - notify: reload forgejo + notify: Reload forgejo - name: Enable service ansible.builtin.systemd: name: forgejo - enabled: yes + enabled: true daemon_reload: true - name: Start service @@ -83,23 +80,6 @@ src: cronjob dest: /etc/cron.d/forgejo -- name: Allow Git SSH, HTTP and HTTPS - ansible.builtin.iptables: - chain: INPUT - protocol: tcp - destination_port: "{{ item.port }}" - ctstate: NEW - jump: ACCEPT - ip_version: "{{ item.ip }}" - action: insert - with_items: - - { ip: ipv4, port: 80 } - - { ip: ipv4, port: 22 } - - { ip: ipv4, port: 443 } - - { ip: ipv6, port: 80 } - - { ip: ipv6, port: 22 } - - { ip: ipv6, port: 443 } - notify: persist iptables - -- ansible.builtin.debug: - msg: If Forgejo has not been setup yet, please do so manually. +- name: Debug + ansible.builtin.debug: + msg: "If Forgejo has not been setup yet, please do so manually." diff --git a/roles/go/tasks/main.yaml b/roles/go/tasks/main.yaml index b787d21..ab16901 100644 --- a/roles/go/tasks/main.yaml +++ b/roles/go/tasks/main.yaml @@ -19,11 +19,11 @@ register: go_latest_version_shell - name: Format Go latest version variable - set_fact: + ansible.builtin.set_fact: go_latest_version: "{{ go_latest_version_shell.stdout }}" - name: Detect installed Go version - shell: "go version | grep --color=never -Po '\\d\\.\\d+(\\.\\d+)?' || echo none" + ansible.builtin.shell: "go version | grep --color=never -Po '\\d\\.\\d+(\\.\\d+)?' || echo none" register: go_installed_version_shell changed_when: false @@ -31,19 +31,20 @@ set_fact: go_installed_version: "{{ go_installed_version_shell.stdout }}" - - debug: + - name: Debug + ansible.builtin.debug: msg: - "Latest Go version: {{ go_latest_version}}" - "Installed Go version: {{ go_installed_version }}" - name: Remove installed go - file: + ansible.builtin.file: state: absent path: /usr/local/go when: go_installed_version != go_latest_version - name: Install Go - unarchive: + ansible.builtin.unarchive: src: https://go.dev/dl/go{{ go_latest_version }}.linux-{{ go_arch }}.tar.gz dest: /usr/local remote_src: yes @@ -52,7 +53,7 @@ when: go_installed_version != go_latest_version - name: Configure Go environment - template: + ansible.builtin.template: src: go.profile dest: /etc/profile.d/go.sh owner: root @@ -60,7 +61,7 @@ mode: 0644 - name: Link go binary - file: + ansible.builtin.file: state: link src: /usr/local/go/bin/go dest: /usr/local/bin/go diff --git a/roles/monitoring/tasks/main.yaml b/roles/monitoring/tasks/main.yaml index a13313c..2017d5b 100644 --- a/roles/monitoring/tasks/main.yaml +++ b/roles/monitoring/tasks/main.yaml @@ -1,45 +1,26 @@ --- -- name: monitoring - tags: monitoring - block: - - ansible.builtin.import_tasks: - file: ../../../snippets/common-nginx.yaml - - name: Install nginx site - ansible.builtin.template: - src: nginx-site.conf - dest: /etc/nginx/sites-available/monitoring - owner: root - group: root - mode: 0644 - notify: reload nginx +- name: Install nginx site + ansible.builtin.template: + src: nginx-site.conf + dest: /etc/nginx/sites-available/monitoring + owner: root + group: root + mode: 0644 + notify: Reload nginx - - name: Enable nginx site - ansible.builtin.file: - src: /etc/nginx/sites-available/monitoring - dest: /etc/nginx/sites-enabled/monitoring - state: link - notify: reload nginx +- name: Enable nginx site + ansible.builtin.file: + src: /etc/nginx/sites-available/monitoring + dest: /etc/nginx/sites-enabled/monitoring + state: link + notify: Reload nginx - - name: Start nginx - ansible.builtin.systemd: - name: nginx - state: started - enabled: yes - - - name: Allow HTTP/HTTPS - ansible.builtin.iptables: - chain: INPUT - protocol: tcp - destination_port: "{{ item.port }}" - ctstate: NEW - jump: ACCEPT - ip_version: "{{ item.ip }}" - action: insert - with_items: - - { ip: ipv6, port: 80 } - - { ip: ipv6, port: 443 } - notify: persist iptables +- name: Start nginx + ansible.builtin.systemd: + name: nginx + state: started + enabled: true - name: mqtt_exporter tags: mqtt_exporter diff --git a/roles/monitoring/tasks/mqtt_exporter.yaml b/roles/monitoring/tasks/mqtt_exporter.yaml index 4fda9d9..0ae5d07 100644 --- a/roles/monitoring/tasks/mqtt_exporter.yaml +++ b/roles/monitoring/tasks/mqtt_exporter.yaml @@ -10,6 +10,7 @@ - name: Install apt dependencies ansible.builtin.apt: name: + - jq - python3-paho-mqtt - python3-prometheus-client - python3-yaml @@ -23,7 +24,7 @@ group: root mode: 0644 notify: - - daemon reload + - Daemon reload - restart mqtt_exporter - name: Install config file @@ -34,7 +35,7 @@ group: root mode: 0644 notify: - - daemon reload + - Daemon reload - restart mqtt_exporter - ansible.builtin.meta: flush_handlers diff --git a/roles/monitoring/templates/grafana.ini b/roles/monitoring/templates/grafana.ini index be8c995..a954c62 100644 --- a/roles/monitoring/templates/grafana.ini +++ b/roles/monitoring/templates/grafana.ini @@ -69,6 +69,9 @@ level = info [grafana_com] url = https://grafana.com +[auth] +oauth_allow_insecure_email_lookup=true + [auth.anonymous] enabled = true org_name = Bitlair diff --git a/roles/monitoring/templates/mqtt_exporter_config.yaml b/roles/monitoring/templates/mqtt_exporter_config.yaml index 62a9690..9767cdf 100644 --- a/roles/monitoring/templates/mqtt_exporter_config.yaml +++ b/roles/monitoring/templates/mqtt_exporter_config.yaml @@ -15,7 +15,8 @@ export: - subscribe: bitlair/# - subscribe: bitlair/climate/+location/# - subscribe: bitlair/climate/+location/dust_mass/+size - - subscribe: bitlair/power/+net/+group/# + - subscribe: bitlair/power/+net/+group/now_w + - subscribe: bitlair/power/+net/total_kwh - subscribe: bitlair/wifi/+ssid/# - subscribe: bitlair/state @@ -35,10 +36,10 @@ export: labels: product: payload - - subscribe: bitlair/collectd/bitlair-5406/snmp/if_octets-traffic.D15 + - subscribe: bitlair/collectd/bitlair4-sw-24p/snmp/if_octets-traffic.24 metric_name: bitlair_internet_rx value_regex: "^.+:(.+):" - - subscribe: bitlair/collectd/bitlair-5406/snmp/if_octets-traffic.D15 + - subscribe: bitlair/collectd/bitlair4-sw-24p/snmp/if_octets-traffic.24 metric_name: bitlair_internet_tx value_regex: "^.+:.+:([\\d\\.]+)" @@ -56,3 +57,29 @@ export: - subscribe: bitlair/power/shelly/+num/status/switch:0 metric_name: bitlair_power_shelly value_json: .apower + + - subscribe: bambulab/device/+serial/report + metric_name: bambulab_nozzle_temperature + value_json: .print.nozzle_temper + - subscribe: bambulab/device/+serial/report + metric_name: bambulab_nozzle_target_temperature + value_json: .print.nozzle_target_temper + - subscribe: bambulab/device/+serial/report + metric_name: bambulab_bed_temperature + value_json: .print.bed_temper + - subscribe: bambulab/device/+serial/report + metric_name: bambulab_bed_target_temperature + value_json: .print.bed_target_temper + - subscribe: bambulab/device/+serial/report + metric_name: bambulab_chamber_temperature + value_json: .print.chamber_temper + - subscribe: bambulab/device/+serial/report + metric_name: bambulab_ams_humidity + value_json: .print.ams.ams[0].humidity + - subscribe: bambulab/device/+serial/report + metric_name: bambulab_print_progress + value_json: .print.mc_percent + - subscribe: bambulab/device/+serial/report + metric_name: bambulab_print_status + metric_type: info + value_json: .print.gcode_state diff --git a/roles/mqtt-internal/tasks/main.yaml b/roles/mqtt-internal/tasks/main.yaml deleted file mode 100644 index e468d01..0000000 --- a/roles/mqtt-internal/tasks/main.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -- name: mqtt-internal - tags: mqtt_internal - block: - - name: Install dependencies - ansible.builtin.apt: - name: - - mosquitto - - avahi-daemon - - - name: Configure Mosquitto - ansible.builtin.template: - src: "{{ item }}" - dest: "/etc/mosquitto/conf.d/{{ item }}" - owner: root - group: root - mode: 0644 - notify: restart mosquitto - with_items: - - internal.conf - - public-bridge.conf - - - name: Start mosquitto - ansible.builtin.systemd: - name: mosquitto - state: started - enabled: yes diff --git a/roles/mqtt/defaults/main.yaml b/roles/mqtt/defaults/main.yaml new file mode 100644 index 0000000..8cf4403 --- /dev/null +++ b/roles/mqtt/defaults/main.yaml @@ -0,0 +1 @@ +mqtt_bambulab_cafile: /etc/mosquitto/ca_certificates/bambulab.pem diff --git a/roles/mqtt-internal/handlers/main.yaml b/roles/mqtt/handlers/main.yaml similarity index 100% rename from roles/mqtt-internal/handlers/main.yaml rename to roles/mqtt/handlers/main.yaml diff --git a/roles/mqtt/tasks/main.yaml b/roles/mqtt/tasks/main.yaml new file mode 100644 index 0000000..498f49c --- /dev/null +++ b/roles/mqtt/tasks/main.yaml @@ -0,0 +1,32 @@ +--- + +- name: Install dependencies + ansible.builtin.apt: + name: + - mosquitto + - avahi-daemon + +- name: Install bambulab cafile + # openssl s_client -showcerts -connect :8883