From 411812edf2070fc57aa588662f0c848fab0ae801 Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 21 Jan 2025 16:55:07 +0100 Subject: [PATCH] update.. --- group_vars/akb.yml | 10 +- group_vars/flr.yml | 7 + group_vars/mbr.yml | 16 ++ host_vars/file-mbr-neu.mbr-bln.netz.yml | 210 ++++++++++++++++++ host_vars/file-mbr.mbr-bln.netz.yml | 7 + hosts | 5 + roles/common/tasks/ntp.yml | 2 +- roles/common/templates/etc/ntpsec/ntp.conf.j2 | 2 +- 8 files changed, 256 insertions(+), 3 deletions(-) create mode 100644 host_vars/file-mbr-neu.mbr-bln.netz.yml diff --git a/group_vars/akb.yml b/group_vars/akb.yml index 6fa2fa6..6687a19 100644 --- a/group_vars/akb.yml +++ b/group_vars/akb.yml @@ -261,6 +261,13 @@ nis_user: is_samba_user: true password: 'IbFiBdA' + - name: helene + groups: + - ab + - scans + is_samba_user: true + password: 'He.20_Lene25!' + - name: jibran groups: - intern @@ -283,8 +290,9 @@ nis_user: groups: - ab - scans + - verwaltung is_samba_user: true - password: '20-julia-16_!' + password: 'Ju.20_Lia25!' - name: kamera groups: diff --git a/group_vars/flr.yml b/group_vars/flr.yml index f0df51c..638dac5 100644 --- a/group_vars/flr.yml +++ b/group_vars/flr.yml @@ -345,6 +345,13 @@ nis_user: is_samba_user: true password: '20-ro-la%22!' + - name: sonkeng + groups: + - team + - esf-bleibnet + is_samba_user: true + password: '20_son+keng-25.%' + - name: vincent groups: - team diff --git a/group_vars/mbr.yml b/group_vars/mbr.yml index 686f16f..457be8c 100644 --- a/group_vars/mbr.yml +++ b/group_vars/mbr.yml @@ -565,6 +565,14 @@ nis_user: is_samba_user: true password: 'U_i5zAR5H+ti' + - name: florian.heuermann + groups: + - all-users + - buero-scan + - mbr-buero + is_samba_user: true + password: 'i4/x3S-TJk.P' + - name: franziska.schilling groups: - all-users @@ -729,6 +737,14 @@ nis_user: is_samba_user: true password: 'S4u3rkr4ut!' + - name: stefan.jung + groups: + - all-users + - buero-scan + - mbr-buero + is_samba_user: true + password: 'q9.mL5-a-aYA' + # --- # RIAS Berlin und Bund # --- diff --git a/host_vars/file-mbr-neu.mbr-bln.netz.yml b/host_vars/file-mbr-neu.mbr-bln.netz.yml new file mode 100644 index 0000000..0f99448 --- /dev/null +++ b/host_vars/file-mbr-neu.mbr-bln.netz.yml @@ -0,0 +1,210 @@ +--- + +# --- +# vars used by roles/network_interfaces +# --- + + +# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted +network_manage_devices: True + +# Should the interfaces be reloaded after config change? +network_interface_reload: False + +network_interface_path: /etc/network/interfaces.d +network_interface_required_packages: + - vlan + - bridge-utils + - ifmetric + - ifupdown + - ifenslave + + +network_interfaces: + + - device: br0 + # use only once per device (for the first device entry) + headline: br0 - bridge over device eno1np0 + + # auto & allow are only used for the first device entry + allow: [] # array of allow-[stanzas] eg. allow-hotplug + auto: true + + family: inet + method: static + hwaddress: 3c:ec:ef:a1:d2:6c + description: + address: 192.168.112.210 + netmask: 24 + gateway: 192.168.112.254 + + # optional dns settings nameservers: [] + # + # nameservers: + # - 194.150.168.168 # dns.as250.net + # - 91.239.100.100 # anycast.censurfridns.dk + # search: warenform.de + # + nameservers: + - 192.168.112.1 + search: mbr-bln.netz + + # optional bridge parameters bridge: {} + # bridge: + # ports: + # stp: + # fd: + # maxwait: + # waitport: + bridge: + ports: eno1np0 # for mor devices support a blank separated list + stp: !!str off + fd: 5 + hello: 2 + maxage: 12 + + # inline hook scripts + pre-up: + - !!str "ip link set dev eno1np0 up" # pre-up script lines + up: [] #up script lines + post-up: [] # post-up script lines (alias for up) + pre-down: [] # pre-down script lines (alias for down) + down: [] # down script lines + post-down: [] # post-down script lines + +# - device: br0:alt +# headline: br0:alt - Alias on br0 (file-mbr-alt) +# auto: true +# family: inet +# method: static +# address: 192.168.112.211 +# netmask: 32 + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + +set_default_limit_nofile: true + + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +resolved_nameserver: + - 192.168.112.1 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +#resolved_domains: [] +resolved_domains: + - oopen.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 172.16.112.254 + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + +sshd_max_auth_tries: 6 + +sshd_permit_root_login: !!str "yes" + +sshd_password_authentication: !!str "yes" + +#sshd_use_pam: !!str "no" + + +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_user_entries: + + - name: "Daily Backup " + minute: "03" + hour: "00" + job: /root/crontab/backup-rcopy/rcopy.sh + + - name: "Check if Postfix Mailservice is up and running. Restart service if needed." + minute: "*/15" + job: /root/bin/monitoring/check_postfix.sh + + - name: "Check if CUPS main daemon is up and running. Restart service if needed." + minute: "*/30" + hour: "7-22" + job: /root/bin/monitoring/check_cups.sh + + - name: "Check if CUPS Browse daemon is up and running. Restart service if needed." + minute: "*/30" + hour: "7-22" + job: /root/bin/monitoring/check_cups-browsed.sh + + - name: "cleanup camera files." + minute: "32" + hour: "23" + job: /root/bin/admin-stuff/cleanup_from_old_files.sh + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 10 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + diff --git a/host_vars/file-mbr.mbr-bln.netz.yml b/host_vars/file-mbr.mbr-bln.netz.yml index 5b0a74c..4a0c788 100644 --- a/host_vars/file-mbr.mbr-bln.netz.yml +++ b/host_vars/file-mbr.mbr-bln.netz.yml @@ -72,6 +72,13 @@ network_interfaces: down: [] # down script lines post-down: [] # post-down script lines + - device: br0:alt + headline: br0:alt - Alias on br0 (file-mbr-alt) + auto: true + family: inet + method: static + address: 192.168.112.211 + netmask: 32 # --- diff --git a/hosts b/hosts index 20477f2..68d1425 100644 --- a/hosts +++ b/hosts @@ -124,6 +124,7 @@ pc138.mbr-bln.netz [mbr_server] file-mbr.mbr-bln.netz ansible_user=root +file-mbr-neu.mbr-bln.netz ansible_user=root @@ -157,6 +158,7 @@ sprachenatelier_client file-akb.akb.netz file-flr.flr.netz file-mbr.mbr-bln.netz ansible_user=root +file-mbr-neu.mbr-bln.netz ansible_user=root file-spr.sprachenatelier.netz file-kb.anw-kb.netz @@ -165,6 +167,7 @@ file-kb.anw-kb.netz file-akb.akb.netz file-flr.flr.netz file-mbr.mbr-bln.netz ansible_user=root +file-mbr-neu.mbr-bln.netz ansible_user=root file-spr.sprachenatelier.netz file-kb.anw-kb.netz @@ -173,6 +176,7 @@ file-kb.anw-kb.netz file-akb.akb.netz file-flr.flr.netz file-mbr.mbr-bln.netz ansible_user=root +file-mbr-neu.mbr-bln.netz ansible_user=root file-spr.sprachenatelier.netz file-kb.anw-kb.netz @@ -181,6 +185,7 @@ file-kb.anw-kb.netz file-akb.akb.netz file-flr.flr.netz file-mbr.mbr-bln.netz ansible_user=root +file-mbr-neu.mbr-bln.netz ansible_user=root file-spr.sprachenatelier.netz file-kb.anw-kb.netz diff --git a/roles/common/tasks/ntp.yml b/roles/common/tasks/ntp.yml index 853022c..4ef4ec9 100644 --- a/roles/common/tasks/ntp.yml +++ b/roles/common/tasks/ntp.yml @@ -37,7 +37,7 @@ - name: (ntp.yml) Backup installation version of file '/etc/ntpsec/ntp.conf' - command: cp -a /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf.ORIG + command: cp /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf.ORIG when: - groups['file_server']|string is search(inventory_hostname) - etc_ntpsec_conf_ORIG.stat.exists == False diff --git a/roles/common/templates/etc/ntpsec/ntp.conf.j2 b/roles/common/templates/etc/ntpsec/ntp.conf.j2 index e9ebe72..bd82d6f 100644 --- a/roles/common/templates/etc/ntpsec/ntp.conf.j2 +++ b/roles/common/templates/etc/ntpsec/ntp.conf.j2 @@ -21,7 +21,7 @@ tos maxclock 11 # Comment this out if you have a refclock and want it to be able to discipline # the clock by itself (e.g. if the system is not connected to the network). -tos minclock 4 minsane 3 +#tos minclock 4 minsane 3 # Specify one or more NTP servers.