From 056038c780e309c991e73c34f457108b7d1e7850 Mon Sep 17 00:00:00 2001 From: Christoph Date: Mon, 12 Oct 2026 18:51:07 +0200 Subject: [PATCH] update.. --- files/homedirs/root/_bash_profile | 2 - host_vars/a.mx.oopen.de/a.mx-common.yml | 2 +- host_vars/backup.oopen.de/backup-common.yml | 3 + .../ga-al-gw.oopen.de/ga-al-gw-common.yml | 114 ++++---- host_vars/gw-fhxb.oopen.de/gw-fhxb-common.yml | 16 +- host_vars/h.mx.oopen.de/h.mx-common.yml | 253 ++++++++++++++++++ host_vars/h.mx.oopen.de/h.mx-ipt-server.yml | 43 +++ host_vars/iam-nd.oopen.de/iam-nd-common.yml | 10 +- .../keycloak-nd-common.yml | 11 +- .../mm-nd-test.oopen.de/mm-nd-common.yml | 223 +++++++++++++++ .../mm-nd-test.oopen.de/mm-nd-ipt-server.yml | 24 ++ host_vars/o27.oopen.de/o27-common.yml | 8 +- host_vars/o30.oopen.de/o30-common.yml | 8 +- host_vars/o31.oopen.de/o31-common.yml | 8 +- host_vars/o35.oopen.de/o35-common.yml | 8 +- host_vars/o36.oopen.de/o36-common.yml | 8 +- host_vars/o38.oopen.de/o38-common.yml | 8 +- host_vars/o39.oopen.de/o39-common.yml | 8 +- host_vars/o40.oopen.de/o40-common.yml | 8 +- hosts | 22 +- .../h.mx.oopen.de/etc/postfix/postfwd.wl-nets | 19 ++ .../root/.ssh/id_ed25519-dehydrated | 7 + .../root/.ssh/id_ed25519-dehydrated.pub | 1 + .../root/.ssh/id_ed25519-opendkim | 7 + .../root/.ssh/id_ed25519-opendkim.pub | 1 + .../bin/postfix/conf/create_opendkim_key.conf | 177 ++++++++++++ .../bin/postfix/conf/whitelist_mb_sigs.conf | 44 +++ roles/common/tasks/basic.yml | 10 + roles/common/tasks/copy_files.yml | 14 + 29 files changed, 958 insertions(+), 109 deletions(-) create mode 100644 host_vars/h.mx.oopen.de/h.mx-common.yml create mode 100644 host_vars/h.mx.oopen.de/h.mx-ipt-server.yml create mode 100644 host_vars/mm-nd-test.oopen.de/mm-nd-common.yml create mode 100644 host_vars/mm-nd-test.oopen.de/mm-nd-ipt-server.yml create mode 100644 roles/common/files/h.mx.oopen.de/etc/postfix/postfwd.wl-nets create mode 100644 roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-dehydrated create mode 100644 roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-dehydrated.pub create mode 100644 roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-opendkim create mode 100644 roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-opendkim.pub create mode 100644 roles/common/files/h.mx.oopen.de/root/bin/postfix/conf/create_opendkim_key.conf create mode 100644 roles/common/files/h.mx.oopen.de/root/bin/postfix/conf/whitelist_mb_sigs.conf diff --git a/files/homedirs/root/_bash_profile b/files/homedirs/root/_bash_profile index fcc09cb..9ae1778 100644 --- a/files/homedirs/root/_bash_profile +++ b/files/homedirs/root/_bash_profile @@ -25,5 +25,3 @@ elif [ -f "/usr/share/mc/bin/mc.sh" ]; then elif [ -f "/usr/lib/mc/bin/mc.sh" ] ; then source /usr/lib/mc/bin/mc.sh fi - -mesg n diff --git a/host_vars/a.mx.oopen.de/a.mx-common.yml b/host_vars/a.mx.oopen.de/a.mx-common.yml index 98c12c8..1672d49 100644 --- a/host_vars/a.mx.oopen.de/a.mx-common.yml +++ b/host_vars/a.mx.oopen.de/a.mx-common.yml @@ -103,7 +103,7 @@ resolved_fallback_nameserver: # vars used by roles/common/tasks/users.yml # --- -insert_root_ssh_keypair: true +insert_root_ssh_keypair: false root_ssh_keypair: - name: id-rsa-dehydrated diff --git a/host_vars/backup.oopen.de/backup-common.yml b/host_vars/backup.oopen.de/backup-common.yml index 6b13b9c..626aada 100644 --- a/host_vars/backup.oopen.de/backup-common.yml +++ b/host_vars/backup.oopen.de/backup-common.yml @@ -285,7 +285,10 @@ default_user: - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMHxvK5kzKgypVi8ZvshveSpyo0eSXiBCnAC5Pcjdgv root@discourse' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDy5WM1qsLE2SRwWG1Y38WJcMYUpL8MuQiraqiXfHzaH root@e.mx' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvOkCWNKUJ5o9e+0NhY4IFZv8LA7tkkkEFjr8nqFKhe root@formbricks-nd' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAOOp76krTc0SuXDVAuU+L6Pd7XWR3V1XBKkXlEqQbEZ root@ga-al-gw' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL7KbEZApiqEcU4aK3A2J8hy+r1uV7TZupwm4CHGqLPH root@ga-gh-gw' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCXqgmGcJfUDROAk24pTkQqddRj1sh1BW3JrbHu7ZtE root@ga-nh-gw' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaF9IsDzPo6nef47VbsLlqlmiwuLyFQ8Vawil/JPF9M root@ga-st-gw' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPbony+4g4iFS32Cv/Bkmet4FsCAsrGTffwWm2eM16x root@git.warenform' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqqmBWh3qmnx41NiLCn1LhVG0mn4++IUvRNC0OMh6h6 root@gitoea' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICR9o0+6jnfmXKOedKP6IZgt5lRIPFSJJ4FbMjz2SPkH root@gw-campus' diff --git a/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml b/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml index be718a0..3802442 100644 --- a/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml +++ b/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml @@ -20,6 +20,63 @@ network_interface_required_packages: network_interfaces: + - device: eth0 + headline: eth0 - LAN - Uplink static line (radio) to Stockausen + auto: true + family: inet + method: static + address: 172.16.111.253 + netmask: 24 + post-up: + - /sbin/ip route add 172.16.211.0/24 via 172.16.111.254 + # User Networks Stockhausen + - /sbin/ip route add 192.168.11.0/24 via 172.16.111.254 + - /sbin/ip route add 192.168.78.0/24 via 172.16.111.254 + # User Networks Campus + # - /sbin/ip route add 192.168.72.0/24 via 172.16.111.254 + # - /sbin/ip route add 192.168.73.0/24 via 172.16.111.254 + # User Network Novalishaus + - /sbin/ip route add 192.168.81.0/24 via 172.16.111.254 + # User Network Georgshaus + - /sbin/ip route add 192.168.85.0/24 via 172.16.111.254 + # Management Network Stockhausen + - /sbin/ip route add 10.10.11.0/24 via 172.16.111.254 + # Depreated Management Network Stokhausen + - /sbin/ip route add 10.10.9.0/24 via 172.16.111.254 + # IPMI Stockhausen + - /sbin/ip route add 10.11.11.0/24 via 172.16.111.254 + # WLAN Gast Novalishaus + - /sbin/ip route add 10.21.0.0/20 via 172.16.111.254 + # WLAN privat Novalishaus + - /sbin/ip route add 10.31.0.0/20 via 172.16.111.254 + # Management Netork Campus + # - /sbin/ip route add 10.72.1.0/24 via 172.16.111.254 + # WLan Router Stockhausen + - /sbin/ip route add 10.112.1.0/24 via 172.16.111.254 + # WLan Netz + - /sbin/ip route add 10.113.0.0/16 via 172.16.111.254 + # Unifi WLan Netz Stockhausen Gast + - /sbin/ip route add 10.121.0.0/20 via 172.16.111.254 + # Unifi WLan Netz Stockhausen privat + - /sbin/ip route add 10.131.0.0/20 via 172.16.111.254 + # Richtfunkantennen Stockhausen (2) / Schlechtenwegen / Kirschbaumhaus + - /sbin/ip route add 10.10.111.0/24 via 172.16.111.254 + # VPN Netz Stockhausen - Novalishaus (Schlechtenwegen) + - /sbin/ip route add 10.2.81.0/24 via 172.16.111.254 + # VPN Home Stockhausen + - /sbin/ip route add 10.0.11.0/24 via 172.16.111.254 + # - FritzBoxen Stockhausen + - /sbin/ip route add 172.16.11.0/24 via 172.16.111.254 + - /sbin/ip route add 172.16.12.0/24 via 172.16.111.254 + - /sbin/ip route add 172.16.13.0/24 via 172.16.111.254 + # - FritzBox Novalishaus + - /sbin/ip route add 172.16.80.0/24 via 172.16.111.254 + # - DigitBox Novalishaus + - /sbin/ip route add 172.16.81.0/24 via 172.16.111.254 + # - FritzBox georgshaus + - /sbin/ip route add 172.16.85.0/24 via 172.16.111.254 + + - device: eth1 headline: eth1 - Uplink DSL Altenschlirf via (static) line to Fritz!Box 7590 auto: true @@ -172,63 +229,6 @@ network_interfaces: post-down: [] # post-down script lines - - device: eth3 - headline: eth3 - LAN - Uplink static line (radio) to Stockausen - auto: true - family: inet - method: static - address: 172.16.111.253 - netmask: 24 - post-up: - - /sbin/ip route add 172.16.211.0/24 via 172.16.111.254 - # User Networks Stockhausen - - /sbin/ip route add 192.168.11.0/24 via 172.16.111.254 - - /sbin/ip route add 192.168.78.0/24 via 172.16.111.254 - # User Networks Campus - # - /sbin/ip route add 192.168.72.0/24 via 172.16.111.254 - # - /sbin/ip route add 192.168.73.0/24 via 172.16.111.254 - # User Network Novalishaus - - /sbin/ip route add 192.168.81.0/24 via 172.16.111.254 - # User Network Georgshaus - - /sbin/ip route add 192.168.85.0/24 via 172.16.111.254 - # Management Network Stockhausen - - /sbin/ip route add 10.10.11.0/24 via 172.16.111.254 - # Depreated Management Network Stokhausen - - /sbin/ip route add 10.10.9.0/24 via 172.16.111.254 - # IPMI Stockhausen - - /sbin/ip route add 10.11.11.0/24 via 172.16.111.254 - # WLAN Gast Novalishaus - - /sbin/ip route add 10.21.0.0/20 via 172.16.111.254 - # WLAN privat Novalishaus - - /sbin/ip route add 10.31.0.0/20 via 172.16.111.254 - # Management Netork Campus - # - /sbin/ip route add 10.72.1.0/24 via 172.16.111.254 - # WLan Router Stockhausen - - /sbin/ip route add 10.112.1.0/24 via 172.16.111.254 - # WLan Netz - - /sbin/ip route add 10.113.0.0/16 via 172.16.111.254 - # Unifi WLan Netz Stockhausen Gast - - /sbin/ip route add 10.121.0.0/20 via 172.16.111.254 - # Unifi WLan Netz Stockhausen privat - - /sbin/ip route add 10.131.0.0/20 via 172.16.111.254 - # Richtfunkantennen Stockhausen (2) / Schlechtenwegen / Kirschbaumhaus - - /sbin/ip route add 10.10.111.0/24 via 172.16.111.254 - # VPN Netz Stockhausen - Novalishaus (Schlechtenwegen) - - /sbin/ip route add 10.2.81.0/24 via 172.16.111.254 - # VPN Home Stockhausen - - /sbin/ip route add 10.0.11.0/24 via 172.16.111.254 - # - FritzBoxen Stockhausen - - /sbin/ip route add 172.16.11.0/24 via 172.16.111.254 - - /sbin/ip route add 172.16.12.0/24 via 172.16.111.254 - - /sbin/ip route add 172.16.13.0/24 via 172.16.111.254 - # - FritzBox Novalishaus - - /sbin/ip route add 172.16.80.0/24 via 172.16.111.254 - # - DigitBox Novalishaus - - /sbin/ip route add 172.16.81.0/24 via 172.16.111.254 - # - FritzBox georgshaus - - /sbin/ip route add 172.16.85.0/24 via 172.16.111.254 - - - device: eth4 headline: eth4 - Management Network Altenschlirf auto: true diff --git a/host_vars/gw-fhxb.oopen.de/gw-fhxb-common.yml b/host_vars/gw-fhxb.oopen.de/gw-fhxb-common.yml index a8fcc34..a66456e 100644 --- a/host_vars/gw-fhxb.oopen.de/gw-fhxb-common.yml +++ b/host_vars/gw-fhxb.oopen.de/gw-fhxb-common.yml @@ -22,17 +22,21 @@ network_interface_required_packages: network_interfaces: - device: eno1 - headline: eno1 - Uplink DSL via Fritz!Box + headline: eno1 - Uplink MIA-Router Telekom + auto: true + family: inet + method: static + address: 100.64.254.2 + netmask: 28 + gateway: 100.64.254.1 + + - device: eno1:rescue + headline: eno1:rescue - Alias on eno1 - Uplink DSL via Fritz!Box auto: true family: inet method: static address: 172.16.192.1 netmask: 24 - gateway: 172.16.192.254 - # nameservers: - # - 127.0.0.1 - # - 192.168.192.1 - # search: ebs.netz kanzlei-kiel.netz elster.netz - device: eno2 diff --git a/host_vars/h.mx.oopen.de/h.mx-common.yml b/host_vars/h.mx.oopen.de/h.mx-common.yml new file mode 100644 index 0000000..6700f5c --- /dev/null +++ b/host_vars/h.mx.oopen.de/h.mx-common.yml @@ -0,0 +1,253 @@ +--- + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + + +# --- +# vars used by roles/common/tasks/apt.yml +# --- + +install_compiler_pkgs: true + +install_postgresql_pkgs: true + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 127.0.0.1 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +# resolved_domains: [] +resolved_domains: + - ~. + - oopen.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 185.12.64.2 + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + +insert_root_ssh_keypair: true + +#root_ssh_keypair: +# - name: id-rsa-dehydrated +# priv_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-dehydrated +# priv_key_dest: /root/.ssh/id_rsa-dehydrated +# pub_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-dehydrated.pub +# pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub +# - name: id-rsa-opendkim +# priv_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-opendkim +# priv_key_dest: /root/.ssh/id_rsa-opendkim +# pub_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-opendkim.pub +# pub_key_dest: /root/.ssh/id_rsa-opendkim.pub + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/copy_files.yml +# --- + + +# --- +# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml +# --- + +hostname: h.mx.oopen.de +ipv4_address: 135.181.239.144 +ipv6_address: 2a01:4f9:3080:3d2d::144 + +admin_email: argus@oopen.de +is_relay_host: !!str "false" + +support_dmarc_reporting: !!str "true" + +db_in_use: !!str "true" +# postfix_db_type +# +# possible values are 'PostgreSQL' and 'MySQL' +postfix_db_type: PostgreSQL +postfix_db_name: postfix +postfix_db_user: postfix +# postfix_db_host: /run/postgresql +postfix_db_pass: AIk-w5/2P--xd5FA + +# install_amavis.conf +# +mp_receipt_number: 106015125438 +si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07ed6db26621b11bca0e23d2a42b60aef3f7b7803a1466a964d90c7b1e82d67c7680c8f46b59a4e + +# install_postfixadmin.conf +# +website_name_postfixadmin: adm.nd-online.de + +email_welcome_message: | + + Hallo, + + Ihre/Deine neue E-Mail Adresse ist eingerichtet. + + ND IT + + -- + nd.Genossenschaft eG | Phone: +49 30 / + Franz-Mehring-Platz 1 | Fax: +49 30 / + D-10243 Berlin | E-Mail: it@nd-online.de + +# install_update_dovecot.conf +# +dovecot_from_address: "o.open " +dovecot_reply_to: "oo@oopen.de" +webmailer_address: "https://webmail.oopen.de" +salutation: | + ND IT + + -- + nd.Genossenschaft eG | Phone: +49 30 / + Franz-Mehring-Platz 1 | Fax: +49 30 / + D-10243 Berlin | E-Mail: it@nd-online.de + O.OPEN + +# install_upgrade_roundcube-webmail.conf +# +# Webmailer +webmail_site_name: webmail.nd-online.de +autoreply_hostname: autoreply.nd-online.de +# possible values: 'pgsql' or 'mysql' +roundcube_db_type: pgsql +roundcube_db_name: roundcubemail +roundcube_db_user: roundcube +# roundcube_db_host: localhost +roundcube_db_pass: 'w9.cCS4/ZE.J-JEd' + +roundcube_acl_plugin: true + +roundcube_product_name: O.OPEN - Webmailer +roundcube_support_url: https://www.oopen.de +roundcube_skin_logo: "images/oopen-logo.png" + + +template_files_mailsystem_script: + + - name: mailsystem_install_amavis.conf + src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2 + dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf + + - name: mailsystem__postfix_advanced.conf + src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2 + dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf + + - name: mailsystem_install_postfixadmin.conf + src_path: usr/local/src/mailsystem/conf/install_postfixadmin.conf.j2 + dest_path: /usr/local/src/mailsystem/conf/install_postfixadmin.conf + + - name: mailsystem_install_update_dovecot.conf + src_path: usr/local/src/mailsystem/conf/install_update_dovecot.conf.j2 + dest_path: /usr/local/src/mailsystem/conf/install_update_dovecot.conf + + - name: mailsystem_install_upgrade_roundcube-webmail.conf + src_path: usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf.j2 + dest_path: /usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf diff --git a/host_vars/h.mx.oopen.de/h.mx-ipt-server.yml b/host_vars/h.mx.oopen.de/h.mx-ipt-server.yml new file mode 100644 index 0000000..a7bda4f --- /dev/null +++ b/host_vars/h.mx.oopen.de/h.mx-ipt-server.yml @@ -0,0 +1,43 @@ +--- +# ipt-firewall configuration for h.mx.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//ipt_firewall.yml + +fw_manage_config: true + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "135.181.239.144" +fw_ext_ips_v6: + - "2a01:4f9:3080:3d2d::144" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_server_ips: $ext_1_ip +fw_mail_client_ips: $ext_1_ip +fw_dovecot_auth_service: true + +# - meet.oopen.de -> 159.69.74.155 +# - meet.akweb.de -> 148.251.14.136 +# - jo.oopen.de -> 94.16.115.62 +# - +# - meet.akweb.de -> 2a01:4f8:201:7389::136 +# - meet.oopen.de -> 2a01:4f8:231:19a7::155 + +# --- Jitsi +fw_jitsi_dovecot_auth: true + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Protection / limits +fw_per_IP_connection_limit: 250 # noqa: var-naming[pattern] diff --git a/host_vars/iam-nd.oopen.de/iam-nd-common.yml b/host_vars/iam-nd.oopen.de/iam-nd-common.yml index 550ed5e..ab4a9f2 100644 --- a/host_vars/iam-nd.oopen.de/iam-nd-common.yml +++ b/host_vars/iam-nd.oopen.de/iam-nd-common.yml @@ -141,11 +141,6 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_postfix.sh - - name: "Check if cert for Keycloak service is up-to-date" - minute: '51' - hour: '05' - job: /root/bin/monitoring/check_cert_for_keycloak.sh - - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)" minute: '23' hour: '05' @@ -157,6 +152,11 @@ cron_user_entries: job: /var/lib/dehydrated/tools/update_ssl_directives.sh +# - name: "Check if cert for Keycloak service is up-to-date" +# minute: '51' +# hour: '05' +# job: /root/bin/monitoring/check_cert_for_keycloak.sh + # --- # vars used by roles/common/tasks/users.yml # --- diff --git a/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml b/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml index 550ed5e..8385a09 100644 --- a/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml +++ b/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml @@ -141,11 +141,6 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_postfix.sh - - name: "Check if cert for Keycloak service is up-to-date" - minute: '51' - hour: '05' - job: /root/bin/monitoring/check_cert_for_keycloak.sh - - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)" minute: '23' hour: '05' @@ -157,6 +152,12 @@ cron_user_entries: job: /var/lib/dehydrated/tools/update_ssl_directives.sh +# - name: "Check if cert for Keycloak service is up-to-date" +# minute: '51' +# hour: '05' +# job: /root/bin/monitoring/check_cert_for_keycloak.sh + + # --- # vars used by roles/common/tasks/users.yml # --- diff --git a/host_vars/mm-nd-test.oopen.de/mm-nd-common.yml b/host_vars/mm-nd-test.oopen.de/mm-nd-common.yml new file mode 100644 index 0000000..1152d33 --- /dev/null +++ b/host_vars/mm-nd-test.oopen.de/mm-nd-common.yml @@ -0,0 +1,223 @@ +--- + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + + +# --- +# vars used by roles/common/tasks/apt.yml +# --- + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 185.12.64.2 + - 2a01:4ff:ff00::add:1 + - 185.12.64.1 + - 2a01:4ff:ff00::add:2 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +# resolved_domains: [] +resolved_domains: + - ~. + - oopen.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 194.150.168.168 + + +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + - name: "Check if postfix mailservice is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" + insertafter: PATH + + - name: "Check if mattermost service is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_local_mattermost_service.sh > /dev/null 2>&1" + insertafter: PATH + + +cron_user_entries: + + - name: "Check if mattermost service ist running - Restart Service if needed." + minute: '*/16' + hour: '*' + job: /root/bin/monitoring/check_local_mattermost_service.sh + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_ssh.sh + + - name: "Check if Postfix Mailservice is up and running?" + minute: '*/15' + hour: '*' + job: /root/bin/monitoring/check_postfix.sh + + - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)" + minute: '01' + hour: '05' + job: /var/lib/dehydrated/cron/dehydrated_cron.sh + + - name: "Check whether all certificates are included in the VHOST configurations" + minute: '33' + hour: '05' + job: /var/lib/dehydrated/tools/update_ssl_directives.sh + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + +extra_user: + + - name: nd-admin + user_id: 1045 + group_id: 1045 + group: nd-admin + password: $y$j9T$1YJwHY0qdLimgtdOKlTxR1$/O9QWTpr0Y41TduR2GZ0FMCiIxFqOaXWSM9hmHRnv80 + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTjd4XFBdF/V9VdSZjy9G7nupBwaMqsrtQSP4Uctkrz org@rdsgn.de' + +sudo_users: + - chris + - sysadm + - nd-admin + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- + +git_firewall_repository: + name: ipt-server + repo: https://git.oopen.de/firewall/ipt-server + dest: /usr/local/src/ipt-server + +# ============================== + + +# --- +# vars used by scripts/reset_root_passwd.yml +# --- + +root_user: + name: root + password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. diff --git a/host_vars/mm-nd-test.oopen.de/mm-nd-ipt-server.yml b/host_vars/mm-nd-test.oopen.de/mm-nd-ipt-server.yml new file mode 100644 index 0000000..a933a5b --- /dev/null +++ b/host_vars/mm-nd-test.oopen.de/mm-nd-ipt-server.yml @@ -0,0 +1,24 @@ +--- +# ipt-firewall configuration for a.ns.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//ipt_firewall.yml + +fw_manage_config: true + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "95.216.231.187" +fw_ext_ips_v6: + - "2a01:4f9:3080:3d2d::187" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip diff --git a/host_vars/o27.oopen.de/o27-common.yml b/host_vars/o27.oopen.de/o27-common.yml index 91445ae..fc44268 100644 --- a/host_vars/o27.oopen.de/o27-common.yml +++ b/host_vars/o27.oopen.de/o27-common.yml @@ -264,10 +264,10 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_ssh.sh - - name: "Check connectifity - reboot if needed" - minute: '*/10' - hour: '*' - job: /root/bin/admin-stuff/check-connectivity.sh +# - name: "Check connectifity - reboot if needed" +# minute: '*/10' +# hour: '*' +# job: /root/bin/admin-stuff/check-connectivity.sh - name: "Check if Postfix Mailservice is up and running?" minute: '*/15' diff --git a/host_vars/o30.oopen.de/o30-common.yml b/host_vars/o30.oopen.de/o30-common.yml index cf53834..805a8df 100644 --- a/host_vars/o30.oopen.de/o30-common.yml +++ b/host_vars/o30.oopen.de/o30-common.yml @@ -245,10 +245,10 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_ssh.sh - - name: "Check connectifity - reboot if needed" - minute: '*/10' - hour: '*' - job: /root/bin/admin-stuff/check-connectivity.sh +# - name: "Check connectifity - reboot if needed" +# minute: '*/10' +# hour: '*' +# job: /root/bin/admin-stuff/check-connectivity.sh - name: "Check if Postfix Mailservice is up and running?" minute: '*/15' diff --git a/host_vars/o31.oopen.de/o31-common.yml b/host_vars/o31.oopen.de/o31-common.yml index 41b9922..5846758 100644 --- a/host_vars/o31.oopen.de/o31-common.yml +++ b/host_vars/o31.oopen.de/o31-common.yml @@ -262,10 +262,10 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_ssh.sh - - name: "Check connectifity - reboot if needed" - minute: '*/10' - hour: '*' - job: /root/bin/admin-stuff/check-connectivity.sh +# - name: "Check connectifity - reboot if needed" +# minute: '*/10' +# hour: '*' +# job: /root/bin/admin-stuff/check-connectivity.sh - name: "Check if Postfix Mailservice is up and running?" minute: '*/15' diff --git a/host_vars/o35.oopen.de/o35-common.yml b/host_vars/o35.oopen.de/o35-common.yml index 369862c..856223d 100644 --- a/host_vars/o35.oopen.de/o35-common.yml +++ b/host_vars/o35.oopen.de/o35-common.yml @@ -259,10 +259,10 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_ssh.sh - - name: "Check connectifity - reboot if needed" - minute: '*/10' - hour: '*' - job: /root/bin/admin-stuff/check-connectivity.sh +# - name: "Check connectifity - reboot if needed" +# minute: '*/10' +# hour: '*' +# job: /root/bin/admin-stuff/check-connectivity.sh - name: "Check if Postfix Mailservice is up and running?" minute: '*/15' diff --git a/host_vars/o36.oopen.de/o36-common.yml b/host_vars/o36.oopen.de/o36-common.yml index 44086ff..358109c 100644 --- a/host_vars/o36.oopen.de/o36-common.yml +++ b/host_vars/o36.oopen.de/o36-common.yml @@ -257,10 +257,10 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_ssh.sh - - name: "Check connectifity - reboot if needed" - minute: '*/10' - hour: '*' - job: /root/bin/admin-stuff/check-connectivity.sh +# - name: "Check connectifity - reboot if needed" +# minute: '*/10' +# hour: '*' +# job: /root/bin/admin-stuff/check-connectivity.sh - name: "Check if Postfix Mailservice is up and running?" minute: '*/15' diff --git a/host_vars/o38.oopen.de/o38-common.yml b/host_vars/o38.oopen.de/o38-common.yml index 61e032b..2eedb3b 100644 --- a/host_vars/o38.oopen.de/o38-common.yml +++ b/host_vars/o38.oopen.de/o38-common.yml @@ -258,10 +258,10 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_ssh.sh - - name: "Check connectifity - reboot if needed" - minute: '*/10' - hour: '*' - job: /root/bin/admin-stuff/check-connectivity.sh +# - name: "Check connectifity - reboot if needed" +# minute: '*/10' +# hour: '*' +# job: /root/bin/admin-stuff/check-connectivity.sh - name: "Check if Postfix Mailservice is up and running?" minute: '*/15' diff --git a/host_vars/o39.oopen.de/o39-common.yml b/host_vars/o39.oopen.de/o39-common.yml index 615295c..029db5c 100644 --- a/host_vars/o39.oopen.de/o39-common.yml +++ b/host_vars/o39.oopen.de/o39-common.yml @@ -259,10 +259,10 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_ssh.sh - - name: "Check connectifity - reboot if needed" - minute: '*/10' - hour: '*' - job: /root/bin/admin-stuff/check-connectivity.sh +# - name: "Check connectifity - reboot if needed" +# minute: '*/10' +# hour: '*' +# job: /root/bin/admin-stuff/check-connectivity.sh - name: "Check if Postfix Mailservice is up and running?" minute: '*/15' diff --git a/host_vars/o40.oopen.de/o40-common.yml b/host_vars/o40.oopen.de/o40-common.yml index ce35889..75914f2 100644 --- a/host_vars/o40.oopen.de/o40-common.yml +++ b/host_vars/o40.oopen.de/o40-common.yml @@ -259,10 +259,10 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_ssh.sh - - name: "Check connectifity - reboot if needed" - minute: '*/10' - hour: '*' - job: /root/bin/admin-stuff/check-connectivity.sh +# - name: "Check connectifity - reboot if needed" +# minute: '*/10' +# hour: '*' +# job: /root/bin/admin-stuff/check-connectivity.sh - name: "Check if Postfix Mailservice is up and running?" minute: '*/15' diff --git a/hosts b/hosts index 569b6f8..5ae25fd 100644 --- a/hosts +++ b/hosts @@ -306,6 +306,8 @@ cl-nd.oopen.de # o45 - mm matomom h.mc o45.oopen.de mm-nd.oopen.de +mm-nd-test.oopen.de +h.mx.oopen.de # Hetzner Cloud cl-nd-test.oopen.de @@ -539,6 +541,8 @@ cl-nd.oopen.de # o45 - mm matomom h.mc o45.oopen.de mm-nd.oopen.de +mm-nd-test.oopen.de +h.mx.oopen.de # Hetzner Cloud cl-nd-test.oopen.de @@ -828,6 +832,9 @@ web-nd.oopen.de # o44 - ND cloud cl-nd.oopen.de +# o45 - mm mm-test h.mx +h.mx.oopen.de + # Hetzner Cloud cl-nd-test.oopen.de @@ -994,6 +1001,7 @@ web-nd.oopen.de # o45 - ND mm-nd.oopen.de +mm-nd-test.oopen.de # GA - Gemeinschaft Altensclirf ga-st-services.ga.netz @@ -1043,6 +1051,9 @@ b.mx.oopen.de # o40 - g.mx g.mx.oopen.de +# o45 - h.mx +h.mx.oopen.de + # --- # O.OPEN office network # --- @@ -1109,7 +1120,8 @@ web-03.oopen.de # o40 - g.mx g.mx.oopen.de -# o39.oopen.de +# o45 - h.mx +h.mx.oopen.de # --- # O.OPEN office network @@ -1142,6 +1154,7 @@ prometheus-nd.oopen.de # o45 - ND mm-nd.oopen.de +mm-nd-test.oopen.de [mysql_server] @@ -1420,6 +1433,9 @@ b.mx.oopen.de # o40 - g.mx g.mx.oopen.de +# o45 - h.mx +h.mx.oopen.de + # --- # O.OPEN office network # --- @@ -1800,6 +1816,8 @@ cl-nd.oopen.de # o45 - ND mm-nd.oopen.de +mm-nd-test.oopen.de +h.mx.oopen.de # Hetzner Cloud cl-nd-test.oopen.de @@ -2059,6 +2077,8 @@ cl-nd.oopen.de # o45 - mm matomom h.mc o45.oopen.de mm-nd.oopen.de +mm-nd-test.oopen.de +h.mx.oopen.de # Hetzner Cloud cl-nd-test.oopen.de diff --git a/roles/common/files/h.mx.oopen.de/etc/postfix/postfwd.wl-nets b/roles/common/files/h.mx.oopen.de/etc/postfix/postfwd.wl-nets new file mode 100644 index 0000000..7ed94f9 --- /dev/null +++ b/roles/common/files/h.mx.oopen.de/etc/postfix/postfwd.wl-nets @@ -0,0 +1,19 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --- +# Trusted networks whitelisted by postfwd +# +# Example: +# +# # web0.warenform.de +# #83.223.86.76 +# #2a01:30:0:505:286:96ff:fe4a:6ee +# #2a01:30:0:13:286:96ff:fe4a:6eee +# +# --- + +# give truested networrk adresses here + +# d.mx.oopen.de (listen server) +95.217.204.227 +2a01:4f9:4a:47e5::227 diff --git a/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-dehydrated b/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-dehydrated new file mode 100644 index 0000000..9917da9 --- /dev/null +++ b/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-dehydrated @@ -0,0 +1,7 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACDTXB9m2b3Ez7Fhcq1ZTAx+Q84/1nD450ojalp9er82aQAAAJA2BTpdNgU6 +XQAAAAtzc2gtZWQyNTUxOQAAACDTXB9m2b3Ez7Fhcq1ZTAx+Q84/1nD450ojalp9er82aQ +AAAEBo2N/3clJE7mgMTLLGS/pVqz5TNGL89spOn5BZ0UyzuNNcH2bZvcTPsWFyrVlMDH5D +zj/WcPjnSiNqWn16vzZpAAAACmNocmlzQGx1bmEBAgM= +-----END OPENSSH PRIVATE KEY----- diff --git a/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-dehydrated.pub b/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-dehydrated.pub new file mode 100644 index 0000000..5c1d6f6 --- /dev/null +++ b/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-dehydrated.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNcH2bZvcTPsWFyrVlMDH5Dzj/WcPjnSiNqWn16vzZp root@h.mx-dehydrated diff --git a/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-opendkim b/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-opendkim new file mode 100644 index 0000000..8b5f36e --- /dev/null +++ b/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-opendkim @@ -0,0 +1,7 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACAZc/qkhVCyCMZK9/sTo2w08zSVx79SfQ9DTPP6Oop1PwAAAJDehrho3oa4 +aAAAAAtzc2gtZWQyNTUxOQAAACAZc/qkhVCyCMZK9/sTo2w08zSVx79SfQ9DTPP6Oop1Pw +AAAECaXByIL6yHuFazBHLv/6QZM8V7F/Fv5o5mgKuoEcJ2Shlz+qSFULIIxkr3+xOjbDTz +NJXHv1J9D0NM8/o6inU/AAAACmNocmlzQGx1bmEBAgM= +-----END OPENSSH PRIVATE KEY----- diff --git a/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-opendkim.pub b/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-opendkim.pub new file mode 100644 index 0000000..62c2213 --- /dev/null +++ b/roles/common/files/h.mx.oopen.de/root/.ssh/id_ed25519-opendkim.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlz+qSFULIIxkr3+xOjbDTzNJXHv1J9D0NM8/o6inU/ root@h.mx-opendkim diff --git a/roles/common/files/h.mx.oopen.de/root/bin/postfix/conf/create_opendkim_key.conf b/roles/common/files/h.mx.oopen.de/root/bin/postfix/conf/create_opendkim_key.conf new file mode 100644 index 0000000..4508720 --- /dev/null +++ b/roles/common/files/h.mx.oopen.de/root/bin/postfix/conf/create_opendkim_key.conf @@ -0,0 +1,177 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# --------------------------------------------------------- +# - Parameter Settings for script 'create_opendkim_key.sh'. +# --------------------------------------------------------- + + +# ---------- +# DNS Server +# ---------- + +# - dns_dkim_zone_master_server +# - +# - The DNS Server who is serving the update zone and is used +# - for the dynamic updates (nsupdate) +# - +#dns_dkim_zone_master_server="" +dns_dkim_zone_master_server="b.ns.oopen.de" + +# - update_dns +# - +# - Possible Values are 'true' or 'false' +# - +#update_dns=true + +# - update_zone +# - +# - Zone containing the DKIM TXT record. +# - +# - Defaults to '_domainkey.' +# - +# - Note: +# - do NOT change/set this option unless you know what you do. +# - +#update_zone="" + +# - TTL +# - +# - TTL for the DKIM TXT Record. +# - +# - Defaults to "" if update_dns=false +# - Defaults to "43200" if update_dns=true +# - +#TTL= + + +# ---------- +# TSIG Key +# ---------- + +# - key_secret +# - +# - Sectret Key used by 'nsupdate' to create/update the +# - DKIM TXT record. +# - +# - Example: +# - key_secret="EtvvMdW0PXD4GMHP+onuHZ0dT/Z8OSJGlce/xH10OwI=" +# - +#key_secret="" +key_secret="4woPu0jqf9Jp1IX+gduJ3BVW/1ZMeyCPTQMqEsMXLFw=" + +# - key_algo +# - +# - The key algorithm used for key creation. Available choices are: hmac-md5, +# - hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and hmac-sha512. The +# - default is hmac-sha256. Options are case-insensitive. +# - +# - Example: +# - key_algo="hmac-md5" +# - +# - Defaults to 'hmac-sha256' +# - +#key_algo="hmac-sha256" +key_algo="hmac-sha256" + +# - key_name +# - +# - Name of the Key +# - +# - Defaults to "$update_zone" +# - +#key_name="" +key_name="update-dkim" + + +# ---------- +# Access Credentials DNS Server +# ---------- + +# - dns_ssh_user +# - +# - Defaults to 'manage-bind' +# - +#dns_ssh_user="manage-bind" + +# - dns_ssh_port +# - +# - Defaults to '22' +# - +#dns_ssh_port=22 + +# - dns_ssh_key +# - +# - Defaults to '/root/.ssh/id_rsa-opendkim' +# - +#dns_ssh_key="/root/.ssh/id_rsa-opendkim" +dns_ssh_key="/root/.ssh/id_ed25519-opendkim" + + +# ---------- +# Scripts envoked at DNS Server +# ---------- + +# - set_new_serial_script +# - +# - Script increases the serial for a given domain or a given +# - hostname's concerning domain. +# - +# - Defaults to /root/bin/bind/bind_set_new_serial.sh +# - +#set_new_serial_script="/root/bin/bind/bind_set_new_serial.sh" + +# - create_dkim_delegation_script +# - +# - Script adds DKIM subdomain delegation for a given domain +# - +# - Defaults to '/root/bin/bind/bind_create_dkim_delegation.sh' +# - +#create_dkim_delegation_script="/root/bin/bind/bind_create_dkim_delegation.sh" + +# - add_dkim_zone_master_script +# - +# - Script adds zone _domainkey. as master zone +# - +# - Defaults to '/root/bin/bind/bind_add_dkim_zone_master.sh' +# - +#add_dkim_zone_master_script="/root/bin/bind/bind_add_dkim_zone_master.sh" + +# - add_dkim_zone_slave_script +# - +# - Script adds zone _domainkey. as slave zone +# - +# - Defaults to '/root/bin/bind/bind_add_dkim_zone_slave.sh' +# - +#add_dkim_zone_slave_script="/root/bin/bind/bind_add_dkim_zone_slave.sh" + + + +# ---------- +# OpenDKIM Installation +# ---------- + +# - opendkim_dir +# - +# - OpenDKIM's etc-directory +# - +# - Defaults to opendkim_dir="/etc/opendkim" +# - +#opendkim_dir="/etc/opendkim" + +# - key_base_dir +# - +# - Defaults to "${opendkim_dir}/keys" +# - +#key_base_dir=${opendkim_dir}/keys + +# - signing_table_file +# - +# - Defaults to "${opendkim_dir}/signing.table" +# - +#signing_table_file="${opendkim_dir}/signing.table" + +# - key_table_file +# - +# - Defaults to "${opendkim_dir}/key.table" +# - +#key_table_file="${opendkim_dir}/key.table" diff --git a/roles/common/files/h.mx.oopen.de/root/bin/postfix/conf/whitelist_mb_sigs.conf b/roles/common/files/h.mx.oopen.de/root/bin/postfix/conf/whitelist_mb_sigs.conf new file mode 100644 index 0000000..11c60fa --- /dev/null +++ b/roles/common/files/h.mx.oopen.de/root/bin/postfix/conf/whitelist_mb_sigs.conf @@ -0,0 +1,44 @@ +# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] *** + +# ====================================================== +# --- +# Parameter Settings for Script 'whitelist_mb_sigs.conf' +# --- +# ====================================================== + +# QUARANTINE_BASE_DIR +# +# Base directory where amavis stores quarantined e-mails, mostly in +# +# virus e-mails: $QUARANTINE_BASE_DIR/virus +# spam emails: $QUARANTINE_BASE_DIR/spam +# .. +# +# Defaults to: +# QUARANTINE_BASE_DIR="/var/QUARANTINE" +# +#QUARANTINE_BASE_DIR="/var/QUARANTINE" + + +# CLAMAV_VIRUS_WHITE_LIST +# +# Full path to clamav's (personal) white list file +# +# Defaults to: +# CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2" +# +#CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2" + + +# WHITE_LIST_STRINGS +# +# A blank separated list of strings to whitelist. +# +# Example: +# WHITE_LIST_STRINGS="google.com tinyurl.com" +# +# Defaults to: +# WHITE_LIST_STRINGS="google.com" +# +#WHITE_LIST_STRINGS="google.com" +WHITE_LIST_STRINGS="google.com tinyurl.com" diff --git a/roles/common/tasks/basic.yml b/roles/common/tasks/basic.yml index 4bc94fc..de2a4c3 100644 --- a/roles/common/tasks/basic.yml +++ b/roles/common/tasks/basic.yml @@ -196,6 +196,16 @@ # ---------- # unattended upgrades # ---------- +# + +- name: (basic.yml) update + ansible.builtin.command: apt-get update # noqa: command-instead-of-module + changed_when: false + environment: + DEBIAN_FRONTEND: noninteractive + when: + - ansible_facts['distribution'] == "Debian" + - apt_update|bool - name: (basic.yml) install unattended-upgrades ansible.builtin.apt: diff --git a/roles/common/tasks/copy_files.yml b/roles/common/tasks/copy_files.yml index dfbf1a1..c3d40d0 100644 --- a/roles/common/tasks/copy_files.yml +++ b/roles/common/tasks/copy_files.yml @@ -59,6 +59,20 @@ - copy-files - copy-template-files +- name: (copy_files.yml) Ensure directory /etc/postfix exists + ansible.builtin.file: + path: /etc/postfix + state: directory + owner: root + group: root + mode: "0755" + when: + - inventory_hostname in groups['mail_server'] + tags: + - copy-files + - copy-plain-files + - copy-template-files + - name: (copy_files.yml) GLOBAL copy plain files Postfix (/etc/postfix) ansible.builtin.copy: src: "{{ item.src_path }}"