hosts.yaml

@@ -38,6 +38,6 @@ all:
         services:
           hosts:
             service.bitlair.nl:
-        wiki:
+        www:
           hosts:
-            wiki.bitlair.nl:
+            cyber.bitlair.nl:

roles/common/tasks/main.yaml

@@ -76,18 +76,18 @@
     insertafter: '^PATH'
     line: 'MAILTO={{ notify_email }}'
 
-- name: Configure SSH
+- name: Turn off SSH password auth
   lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: "{{ item.regexp }}"
+    regexp: '^#?PasswordAuthentication'
-    line: "{{ item.line }}"
+    line: 'PasswordAuthentication no'
-  with_items:
+  notify: reload sshd
-    - regexp: '^#?Port'
+
-      line: 'Port {{ ssh_port }}'
+- name: Configure SSH port
-    - regexp: '^#?PasswordAuthentication'
+  lineinfile:
-      line: 'PasswordAuthentication no'
+    path: /etc/ssh/sshd_config
-    - regexp: '^#?DebianBanner'
+    regexp: '^#?Port'
-      line: 'DebianBanner no'
+    line: 'Port {{ ssh_port }}'
   notify: reload sshd
 
 - name: Allow SSH

roles/etherpad/templates/nginx-site.conf

@@ -13,6 +13,7 @@ server {
 	{% endif %}
 
 	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
+	add_header X-Frame-Options DENY;
 	add_header X-Content-Type-Options nosniff;
 
 	location / {

roles/etherpad/templates/settings.json

@@ -69,7 +69,7 @@
   "allowUnknownFileEnds": true,
   "requireAuthentication": false,
   "requireAuthorization": false,
-  "trustProxy": true,
+  "trustProxy": false,
   "cookie": {
     "sameSite": "Lax"
   },

roles/www/tasks/main.yaml

@@ -3,10 +3,10 @@
   import_tasks: calendar.yaml
 
 - tags: www_mediawiki
-  import_tasks: mediawiki.yaml
+  include_tasks: mediawiki.yaml
 
 - tags: www_mqtt
-  import_tasks: mqtt.yaml
+  include_tasks: mqtt.yaml
 
 - tags: www_spaceapi
-  import_tasks: spaceapi.yaml
+  include_tasks: spaceapi.yaml

roles/www/tasks/spaceapi.yaml

@@ -2,7 +2,7 @@
 - name: Clone spaceapi source
   git:
     repo: https://github.com/bitlair/spaceapi.git
-    version: main
+    version: master
     dest: /opt/spaceapi
     accept_hostkey: yes
   notify: restart spaceapi