update..
This commit is contained in:
@@ -25,5 +25,3 @@ elif [ -f "/usr/share/mc/bin/mc.sh" ]; then
|
|||||||
elif [ -f "/usr/lib/mc/bin/mc.sh" ] ; then
|
elif [ -f "/usr/lib/mc/bin/mc.sh" ] ; then
|
||||||
source /usr/lib/mc/bin/mc.sh
|
source /usr/lib/mc/bin/mc.sh
|
||||||
fi
|
fi
|
||||||
|
|
||||||
mesg n
|
|
||||||
|
|||||||
@@ -103,7 +103,7 @@ resolved_fallback_nameserver:
|
|||||||
# vars used by roles/common/tasks/users.yml
|
# vars used by roles/common/tasks/users.yml
|
||||||
# ---
|
# ---
|
||||||
|
|
||||||
insert_root_ssh_keypair: true
|
insert_root_ssh_keypair: false
|
||||||
|
|
||||||
root_ssh_keypair:
|
root_ssh_keypair:
|
||||||
- name: id-rsa-dehydrated
|
- name: id-rsa-dehydrated
|
||||||
|
|||||||
@@ -285,7 +285,10 @@ default_user:
|
|||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMHxvK5kzKgypVi8ZvshveSpyo0eSXiBCnAC5Pcjdgv root@discourse'
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMHxvK5kzKgypVi8ZvshveSpyo0eSXiBCnAC5Pcjdgv root@discourse'
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDy5WM1qsLE2SRwWG1Y38WJcMYUpL8MuQiraqiXfHzaH root@e.mx'
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDy5WM1qsLE2SRwWG1Y38WJcMYUpL8MuQiraqiXfHzaH root@e.mx'
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvOkCWNKUJ5o9e+0NhY4IFZv8LA7tkkkEFjr8nqFKhe root@formbricks-nd'
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvOkCWNKUJ5o9e+0NhY4IFZv8LA7tkkkEFjr8nqFKhe root@formbricks-nd'
|
||||||
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAOOp76krTc0SuXDVAuU+L6Pd7XWR3V1XBKkXlEqQbEZ root@ga-al-gw'
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL7KbEZApiqEcU4aK3A2J8hy+r1uV7TZupwm4CHGqLPH root@ga-gh-gw'
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL7KbEZApiqEcU4aK3A2J8hy+r1uV7TZupwm4CHGqLPH root@ga-gh-gw'
|
||||||
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCXqgmGcJfUDROAk24pTkQqddRj1sh1BW3JrbHu7ZtE root@ga-nh-gw'
|
||||||
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaF9IsDzPo6nef47VbsLlqlmiwuLyFQ8Vawil/JPF9M root@ga-st-gw'
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPbony+4g4iFS32Cv/Bkmet4FsCAsrGTffwWm2eM16x root@git.warenform'
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPbony+4g4iFS32Cv/Bkmet4FsCAsrGTffwWm2eM16x root@git.warenform'
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqqmBWh3qmnx41NiLCn1LhVG0mn4++IUvRNC0OMh6h6 root@gitoea'
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqqmBWh3qmnx41NiLCn1LhVG0mn4++IUvRNC0OMh6h6 root@gitoea'
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICR9o0+6jnfmXKOedKP6IZgt5lRIPFSJJ4FbMjz2SPkH root@gw-campus'
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICR9o0+6jnfmXKOedKP6IZgt5lRIPFSJJ4FbMjz2SPkH root@gw-campus'
|
||||||
|
|||||||
@@ -20,6 +20,63 @@ network_interface_required_packages:
|
|||||||
|
|
||||||
network_interfaces:
|
network_interfaces:
|
||||||
|
|
||||||
|
- device: eth0
|
||||||
|
headline: eth0 - LAN - Uplink static line (radio) to Stockausen
|
||||||
|
auto: true
|
||||||
|
family: inet
|
||||||
|
method: static
|
||||||
|
address: 172.16.111.253
|
||||||
|
netmask: 24
|
||||||
|
post-up:
|
||||||
|
- /sbin/ip route add 172.16.211.0/24 via 172.16.111.254
|
||||||
|
# User Networks Stockhausen
|
||||||
|
- /sbin/ip route add 192.168.11.0/24 via 172.16.111.254
|
||||||
|
- /sbin/ip route add 192.168.78.0/24 via 172.16.111.254
|
||||||
|
# User Networks Campus
|
||||||
|
# - /sbin/ip route add 192.168.72.0/24 via 172.16.111.254
|
||||||
|
# - /sbin/ip route add 192.168.73.0/24 via 172.16.111.254
|
||||||
|
# User Network Novalishaus
|
||||||
|
- /sbin/ip route add 192.168.81.0/24 via 172.16.111.254
|
||||||
|
# User Network Georgshaus
|
||||||
|
- /sbin/ip route add 192.168.85.0/24 via 172.16.111.254
|
||||||
|
# Management Network Stockhausen
|
||||||
|
- /sbin/ip route add 10.10.11.0/24 via 172.16.111.254
|
||||||
|
# Depreated Management Network Stokhausen
|
||||||
|
- /sbin/ip route add 10.10.9.0/24 via 172.16.111.254
|
||||||
|
# IPMI Stockhausen
|
||||||
|
- /sbin/ip route add 10.11.11.0/24 via 172.16.111.254
|
||||||
|
# WLAN Gast Novalishaus
|
||||||
|
- /sbin/ip route add 10.21.0.0/20 via 172.16.111.254
|
||||||
|
# WLAN privat Novalishaus
|
||||||
|
- /sbin/ip route add 10.31.0.0/20 via 172.16.111.254
|
||||||
|
# Management Netork Campus
|
||||||
|
# - /sbin/ip route add 10.72.1.0/24 via 172.16.111.254
|
||||||
|
# WLan Router Stockhausen
|
||||||
|
- /sbin/ip route add 10.112.1.0/24 via 172.16.111.254
|
||||||
|
# WLan Netz
|
||||||
|
- /sbin/ip route add 10.113.0.0/16 via 172.16.111.254
|
||||||
|
# Unifi WLan Netz Stockhausen Gast
|
||||||
|
- /sbin/ip route add 10.121.0.0/20 via 172.16.111.254
|
||||||
|
# Unifi WLan Netz Stockhausen privat
|
||||||
|
- /sbin/ip route add 10.131.0.0/20 via 172.16.111.254
|
||||||
|
# Richtfunkantennen Stockhausen (2) / Schlechtenwegen / Kirschbaumhaus
|
||||||
|
- /sbin/ip route add 10.10.111.0/24 via 172.16.111.254
|
||||||
|
# VPN Netz Stockhausen - Novalishaus (Schlechtenwegen)
|
||||||
|
- /sbin/ip route add 10.2.81.0/24 via 172.16.111.254
|
||||||
|
# VPN Home Stockhausen
|
||||||
|
- /sbin/ip route add 10.0.11.0/24 via 172.16.111.254
|
||||||
|
# - FritzBoxen Stockhausen
|
||||||
|
- /sbin/ip route add 172.16.11.0/24 via 172.16.111.254
|
||||||
|
- /sbin/ip route add 172.16.12.0/24 via 172.16.111.254
|
||||||
|
- /sbin/ip route add 172.16.13.0/24 via 172.16.111.254
|
||||||
|
# - FritzBox Novalishaus
|
||||||
|
- /sbin/ip route add 172.16.80.0/24 via 172.16.111.254
|
||||||
|
# - DigitBox Novalishaus
|
||||||
|
- /sbin/ip route add 172.16.81.0/24 via 172.16.111.254
|
||||||
|
# - FritzBox georgshaus
|
||||||
|
- /sbin/ip route add 172.16.85.0/24 via 172.16.111.254
|
||||||
|
|
||||||
|
|
||||||
- device: eth1
|
- device: eth1
|
||||||
headline: eth1 - Uplink DSL Altenschlirf via (static) line to Fritz!Box 7590
|
headline: eth1 - Uplink DSL Altenschlirf via (static) line to Fritz!Box 7590
|
||||||
auto: true
|
auto: true
|
||||||
@@ -172,63 +229,6 @@ network_interfaces:
|
|||||||
post-down: [] # post-down script lines
|
post-down: [] # post-down script lines
|
||||||
|
|
||||||
|
|
||||||
- device: eth3
|
|
||||||
headline: eth3 - LAN - Uplink static line (radio) to Stockausen
|
|
||||||
auto: true
|
|
||||||
family: inet
|
|
||||||
method: static
|
|
||||||
address: 172.16.111.253
|
|
||||||
netmask: 24
|
|
||||||
post-up:
|
|
||||||
- /sbin/ip route add 172.16.211.0/24 via 172.16.111.254
|
|
||||||
# User Networks Stockhausen
|
|
||||||
- /sbin/ip route add 192.168.11.0/24 via 172.16.111.254
|
|
||||||
- /sbin/ip route add 192.168.78.0/24 via 172.16.111.254
|
|
||||||
# User Networks Campus
|
|
||||||
# - /sbin/ip route add 192.168.72.0/24 via 172.16.111.254
|
|
||||||
# - /sbin/ip route add 192.168.73.0/24 via 172.16.111.254
|
|
||||||
# User Network Novalishaus
|
|
||||||
- /sbin/ip route add 192.168.81.0/24 via 172.16.111.254
|
|
||||||
# User Network Georgshaus
|
|
||||||
- /sbin/ip route add 192.168.85.0/24 via 172.16.111.254
|
|
||||||
# Management Network Stockhausen
|
|
||||||
- /sbin/ip route add 10.10.11.0/24 via 172.16.111.254
|
|
||||||
# Depreated Management Network Stokhausen
|
|
||||||
- /sbin/ip route add 10.10.9.0/24 via 172.16.111.254
|
|
||||||
# IPMI Stockhausen
|
|
||||||
- /sbin/ip route add 10.11.11.0/24 via 172.16.111.254
|
|
||||||
# WLAN Gast Novalishaus
|
|
||||||
- /sbin/ip route add 10.21.0.0/20 via 172.16.111.254
|
|
||||||
# WLAN privat Novalishaus
|
|
||||||
- /sbin/ip route add 10.31.0.0/20 via 172.16.111.254
|
|
||||||
# Management Netork Campus
|
|
||||||
# - /sbin/ip route add 10.72.1.0/24 via 172.16.111.254
|
|
||||||
# WLan Router Stockhausen
|
|
||||||
- /sbin/ip route add 10.112.1.0/24 via 172.16.111.254
|
|
||||||
# WLan Netz
|
|
||||||
- /sbin/ip route add 10.113.0.0/16 via 172.16.111.254
|
|
||||||
# Unifi WLan Netz Stockhausen Gast
|
|
||||||
- /sbin/ip route add 10.121.0.0/20 via 172.16.111.254
|
|
||||||
# Unifi WLan Netz Stockhausen privat
|
|
||||||
- /sbin/ip route add 10.131.0.0/20 via 172.16.111.254
|
|
||||||
# Richtfunkantennen Stockhausen (2) / Schlechtenwegen / Kirschbaumhaus
|
|
||||||
- /sbin/ip route add 10.10.111.0/24 via 172.16.111.254
|
|
||||||
# VPN Netz Stockhausen - Novalishaus (Schlechtenwegen)
|
|
||||||
- /sbin/ip route add 10.2.81.0/24 via 172.16.111.254
|
|
||||||
# VPN Home Stockhausen
|
|
||||||
- /sbin/ip route add 10.0.11.0/24 via 172.16.111.254
|
|
||||||
# - FritzBoxen Stockhausen
|
|
||||||
- /sbin/ip route add 172.16.11.0/24 via 172.16.111.254
|
|
||||||
- /sbin/ip route add 172.16.12.0/24 via 172.16.111.254
|
|
||||||
- /sbin/ip route add 172.16.13.0/24 via 172.16.111.254
|
|
||||||
# - FritzBox Novalishaus
|
|
||||||
- /sbin/ip route add 172.16.80.0/24 via 172.16.111.254
|
|
||||||
# - DigitBox Novalishaus
|
|
||||||
- /sbin/ip route add 172.16.81.0/24 via 172.16.111.254
|
|
||||||
# - FritzBox georgshaus
|
|
||||||
- /sbin/ip route add 172.16.85.0/24 via 172.16.111.254
|
|
||||||
|
|
||||||
|
|
||||||
- device: eth4
|
- device: eth4
|
||||||
headline: eth4 - Management Network Altenschlirf
|
headline: eth4 - Management Network Altenschlirf
|
||||||
auto: true
|
auto: true
|
||||||
|
|||||||
@@ -22,17 +22,21 @@ network_interface_required_packages:
|
|||||||
network_interfaces:
|
network_interfaces:
|
||||||
|
|
||||||
- device: eno1
|
- device: eno1
|
||||||
headline: eno1 - Uplink DSL via Fritz!Box
|
headline: eno1 - Uplink MIA-Router Telekom
|
||||||
|
auto: true
|
||||||
|
family: inet
|
||||||
|
method: static
|
||||||
|
address: 100.64.254.2
|
||||||
|
netmask: 28
|
||||||
|
gateway: 100.64.254.1
|
||||||
|
|
||||||
|
- device: eno1:rescue
|
||||||
|
headline: eno1:rescue - Alias on eno1 - Uplink DSL via Fritz!Box
|
||||||
auto: true
|
auto: true
|
||||||
family: inet
|
family: inet
|
||||||
method: static
|
method: static
|
||||||
address: 172.16.192.1
|
address: 172.16.192.1
|
||||||
netmask: 24
|
netmask: 24
|
||||||
gateway: 172.16.192.254
|
|
||||||
# nameservers:
|
|
||||||
# - 127.0.0.1
|
|
||||||
# - 192.168.192.1
|
|
||||||
# search: ebs.netz kanzlei-kiel.netz elster.netz
|
|
||||||
|
|
||||||
|
|
||||||
- device: eno2
|
- device: eno2
|
||||||
|
|||||||
@@ -0,0 +1,253 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/ansible_dependencies
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/ansible_user
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/basic.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/sshd.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/apt.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
install_compiler_pkgs: true
|
||||||
|
|
||||||
|
install_postgresql_pkgs: true
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
systemd_resolved: true
|
||||||
|
|
||||||
|
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||||
|
# Primäre DNS-Adresse: 38.132.106.139
|
||||||
|
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||||
|
#
|
||||||
|
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||||
|
# primäre DNS-Adresse
|
||||||
|
# IPv4: 1.1.1.1
|
||||||
|
# IPv6: 2606:4700:4700::1111
|
||||||
|
# sekundäre DNS-Adresse
|
||||||
|
# IPv4: 1.0.0.1
|
||||||
|
# IPv6: 2606:4700:4700::1001
|
||||||
|
#
|
||||||
|
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||||
|
# primäre DNS-Adresse
|
||||||
|
# IPv4: 8.8.8.8
|
||||||
|
# IPv6: 2001:4860:4860::8888
|
||||||
|
# sekundäre DNS-Adresse
|
||||||
|
# IPv4: 8.8.4.4
|
||||||
|
# IPv6: 2001:4860:4860::8844
|
||||||
|
#
|
||||||
|
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||||
|
# primäre DNS-Adresse
|
||||||
|
# IPv4: 9.9.9.9
|
||||||
|
# IPv6: 2620:fe::fe
|
||||||
|
# sekundäre DNS-Adresse
|
||||||
|
# IPv4: 149.112.112.112
|
||||||
|
# IPv6: 2620:fe::9
|
||||||
|
#
|
||||||
|
# OpenNIC - https://www.opennic.org/
|
||||||
|
# IPv4: 195.10.195.195 - ns31.de
|
||||||
|
# IPv4: 94.16.114.254 - ns28.de
|
||||||
|
# IPv4: 51.254.162.59 - ns9.de
|
||||||
|
# IPv4: 194.36.144.87 - ns29.de
|
||||||
|
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||||
|
#
|
||||||
|
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||||
|
# IPv4: 5.1.66.255
|
||||||
|
# IPv6: 2001:678:e68:f000::
|
||||||
|
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||||
|
# IPv4: 185.150.99.255
|
||||||
|
# IPv6: 2001:678:ed0:f000::
|
||||||
|
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||||
|
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||||
|
resolved_nameserver:
|
||||||
|
- 127.0.0.1
|
||||||
|
|
||||||
|
# search domains
|
||||||
|
#
|
||||||
|
# If there are more than one search domains, then specify them here in the order in which
|
||||||
|
# the resolver should also search them
|
||||||
|
#
|
||||||
|
# resolved_domains: []
|
||||||
|
resolved_domains:
|
||||||
|
- ~.
|
||||||
|
- oopen.de
|
||||||
|
|
||||||
|
resolved_dnssec: false
|
||||||
|
|
||||||
|
# dns.as250.net: 194.150.168.168
|
||||||
|
#
|
||||||
|
resolved_fallback_nameserver:
|
||||||
|
- 185.12.64.2
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/users.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
insert_root_ssh_keypair: true
|
||||||
|
|
||||||
|
#root_ssh_keypair:
|
||||||
|
# - name: id-rsa-dehydrated
|
||||||
|
# priv_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-dehydrated
|
||||||
|
# priv_key_dest: /root/.ssh/id_rsa-dehydrated
|
||||||
|
# pub_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-dehydrated.pub
|
||||||
|
# pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
|
||||||
|
# - name: id-rsa-opendkim
|
||||||
|
# priv_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-opendkim
|
||||||
|
# priv_key_dest: /root/.ssh/id_rsa-opendkim
|
||||||
|
# pub_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-opendkim.pub
|
||||||
|
# pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/webadmin-user.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/sudoers.yml
|
||||||
|
# ---
|
||||||
|
#
|
||||||
|
# see: roles/common/tasks/vars
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/git.yml
|
||||||
|
# ---
|
||||||
|
#
|
||||||
|
# see: roles/common/tasks/vars
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/copy_files.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
hostname: h.mx.oopen.de
|
||||||
|
ipv4_address: 135.181.239.144
|
||||||
|
ipv6_address: 2a01:4f9:3080:3d2d::144
|
||||||
|
|
||||||
|
admin_email: argus@oopen.de
|
||||||
|
is_relay_host: !!str "false"
|
||||||
|
|
||||||
|
support_dmarc_reporting: !!str "true"
|
||||||
|
|
||||||
|
db_in_use: !!str "true"
|
||||||
|
# postfix_db_type
|
||||||
|
#
|
||||||
|
# possible values are 'PostgreSQL' and 'MySQL'
|
||||||
|
postfix_db_type: PostgreSQL
|
||||||
|
postfix_db_name: postfix
|
||||||
|
postfix_db_user: postfix
|
||||||
|
# postfix_db_host: /run/postgresql
|
||||||
|
postfix_db_pass: AIk-w5/2P--xd5FA
|
||||||
|
|
||||||
|
# install_amavis.conf
|
||||||
|
#
|
||||||
|
mp_receipt_number: 106015125438
|
||||||
|
si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07ed6db26621b11bca0e23d2a42b60aef3f7b7803a1466a964d90c7b1e82d67c7680c8f46b59a4e
|
||||||
|
|
||||||
|
# install_postfixadmin.conf
|
||||||
|
#
|
||||||
|
website_name_postfixadmin: adm.nd-online.de
|
||||||
|
|
||||||
|
email_welcome_message: |
|
||||||
|
|
||||||
|
Hallo,
|
||||||
|
|
||||||
|
Ihre/Deine neue E-Mail Adresse ist eingerichtet.
|
||||||
|
|
||||||
|
ND IT
|
||||||
|
|
||||||
|
--
|
||||||
|
nd.Genossenschaft eG | Phone: +49 30 /
|
||||||
|
Franz-Mehring-Platz 1 | Fax: +49 30 /
|
||||||
|
D-10243 Berlin | E-Mail: it@nd-online.de
|
||||||
|
|
||||||
|
# install_update_dovecot.conf
|
||||||
|
#
|
||||||
|
dovecot_from_address: "o.open <oo@oopen.de>"
|
||||||
|
dovecot_reply_to: "oo@oopen.de"
|
||||||
|
webmailer_address: "https://webmail.oopen.de"
|
||||||
|
salutation: |
|
||||||
|
ND IT
|
||||||
|
|
||||||
|
--
|
||||||
|
nd.Genossenschaft eG | Phone: +49 30 /
|
||||||
|
Franz-Mehring-Platz 1 | Fax: +49 30 /
|
||||||
|
D-10243 Berlin | E-Mail: it@nd-online.de
|
||||||
|
O.OPEN
|
||||||
|
|
||||||
|
# install_upgrade_roundcube-webmail.conf
|
||||||
|
#
|
||||||
|
# Webmailer
|
||||||
|
webmail_site_name: webmail.nd-online.de
|
||||||
|
autoreply_hostname: autoreply.nd-online.de
|
||||||
|
# possible values: 'pgsql' or 'mysql'
|
||||||
|
roundcube_db_type: pgsql
|
||||||
|
roundcube_db_name: roundcubemail
|
||||||
|
roundcube_db_user: roundcube
|
||||||
|
# roundcube_db_host: localhost
|
||||||
|
roundcube_db_pass: 'w9.cCS4/ZE.J-JEd'
|
||||||
|
|
||||||
|
roundcube_acl_plugin: true
|
||||||
|
|
||||||
|
roundcube_product_name: O.OPEN - Webmailer
|
||||||
|
roundcube_support_url: https://www.oopen.de
|
||||||
|
roundcube_skin_logo: "images/oopen-logo.png"
|
||||||
|
|
||||||
|
|
||||||
|
template_files_mailsystem_script:
|
||||||
|
|
||||||
|
- name: mailsystem_install_amavis.conf
|
||||||
|
src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
|
||||||
|
dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
|
||||||
|
|
||||||
|
- name: mailsystem__postfix_advanced.conf
|
||||||
|
src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2
|
||||||
|
dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf
|
||||||
|
|
||||||
|
- name: mailsystem_install_postfixadmin.conf
|
||||||
|
src_path: usr/local/src/mailsystem/conf/install_postfixadmin.conf.j2
|
||||||
|
dest_path: /usr/local/src/mailsystem/conf/install_postfixadmin.conf
|
||||||
|
|
||||||
|
- name: mailsystem_install_update_dovecot.conf
|
||||||
|
src_path: usr/local/src/mailsystem/conf/install_update_dovecot.conf.j2
|
||||||
|
dest_path: /usr/local/src/mailsystem/conf/install_update_dovecot.conf
|
||||||
|
|
||||||
|
- name: mailsystem_install_upgrade_roundcube-webmail.conf
|
||||||
|
src_path: usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf.j2
|
||||||
|
dest_path: /usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf
|
||||||
@@ -0,0 +1,43 @@
|
|||||||
|
---
|
||||||
|
# ipt-firewall configuration for h.mx.oopen.de
|
||||||
|
# Generated by extract-fw-host-vars.py - review before committing!
|
||||||
|
# Place in: host_vars/<hostname>/ipt_firewall.yml
|
||||||
|
|
||||||
|
fw_manage_config: true
|
||||||
|
|
||||||
|
# --- Network
|
||||||
|
fw_ext_interfaces:
|
||||||
|
- "eth0"
|
||||||
|
fw_ext_ips_v4:
|
||||||
|
- "135.181.239.144"
|
||||||
|
fw_ext_ips_v6:
|
||||||
|
- "2a01:4f9:3080:3d2d::144"
|
||||||
|
|
||||||
|
# --- Munin
|
||||||
|
munin_remote_ipv4: 37.27.121.227
|
||||||
|
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
|
||||||
|
|
||||||
|
# --- HTTP
|
||||||
|
fw_http_server_ips: $ext_1_ip
|
||||||
|
|
||||||
|
# --- Mail
|
||||||
|
fw_smtpd_ips: $ext_1_ip
|
||||||
|
fw_mail_server_ips: $ext_1_ip
|
||||||
|
fw_mail_client_ips: $ext_1_ip
|
||||||
|
fw_dovecot_auth_service: true
|
||||||
|
|
||||||
|
# - meet.oopen.de -> 159.69.74.155
|
||||||
|
# - meet.akweb.de -> 148.251.14.136
|
||||||
|
# - jo.oopen.de -> 94.16.115.62
|
||||||
|
# -
|
||||||
|
# - meet.akweb.de -> 2a01:4f8:201:7389::136
|
||||||
|
# - meet.oopen.de -> 2a01:4f8:231:19a7::155
|
||||||
|
|
||||||
|
# --- Jitsi
|
||||||
|
fw_jitsi_dovecot_auth: true
|
||||||
|
|
||||||
|
# --- Rsync
|
||||||
|
fw_rsync_out_ips: $ext_1_ip
|
||||||
|
|
||||||
|
# --- Protection / limits
|
||||||
|
fw_per_IP_connection_limit: 250 # noqa: var-naming[pattern]
|
||||||
@@ -141,11 +141,6 @@ cron_user_entries:
|
|||||||
hour: '*'
|
hour: '*'
|
||||||
job: /root/bin/monitoring/check_postfix.sh
|
job: /root/bin/monitoring/check_postfix.sh
|
||||||
|
|
||||||
- name: "Check if cert for Keycloak service is up-to-date"
|
|
||||||
minute: '51'
|
|
||||||
hour: '05'
|
|
||||||
job: /root/bin/monitoring/check_cert_for_keycloak.sh
|
|
||||||
|
|
||||||
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
|
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
|
||||||
minute: '23'
|
minute: '23'
|
||||||
hour: '05'
|
hour: '05'
|
||||||
@@ -157,6 +152,11 @@ cron_user_entries:
|
|||||||
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
|
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
|
||||||
|
|
||||||
|
|
||||||
|
# - name: "Check if cert for Keycloak service is up-to-date"
|
||||||
|
# minute: '51'
|
||||||
|
# hour: '05'
|
||||||
|
# job: /root/bin/monitoring/check_cert_for_keycloak.sh
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
# vars used by roles/common/tasks/users.yml
|
# vars used by roles/common/tasks/users.yml
|
||||||
# ---
|
# ---
|
||||||
|
|||||||
@@ -141,11 +141,6 @@ cron_user_entries:
|
|||||||
hour: '*'
|
hour: '*'
|
||||||
job: /root/bin/monitoring/check_postfix.sh
|
job: /root/bin/monitoring/check_postfix.sh
|
||||||
|
|
||||||
- name: "Check if cert for Keycloak service is up-to-date"
|
|
||||||
minute: '51'
|
|
||||||
hour: '05'
|
|
||||||
job: /root/bin/monitoring/check_cert_for_keycloak.sh
|
|
||||||
|
|
||||||
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
|
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
|
||||||
minute: '23'
|
minute: '23'
|
||||||
hour: '05'
|
hour: '05'
|
||||||
@@ -157,6 +152,12 @@ cron_user_entries:
|
|||||||
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
|
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
|
||||||
|
|
||||||
|
|
||||||
|
# - name: "Check if cert for Keycloak service is up-to-date"
|
||||||
|
# minute: '51'
|
||||||
|
# hour: '05'
|
||||||
|
# job: /root/bin/monitoring/check_cert_for_keycloak.sh
|
||||||
|
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
# vars used by roles/common/tasks/users.yml
|
# vars used by roles/common/tasks/users.yml
|
||||||
# ---
|
# ---
|
||||||
|
|||||||
@@ -0,0 +1,223 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/ansible_dependencies
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/ansible_user
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/basic.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/sshd.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/apt.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
systemd_resolved: true
|
||||||
|
|
||||||
|
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||||
|
# Primäre DNS-Adresse: 38.132.106.139
|
||||||
|
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||||
|
#
|
||||||
|
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||||
|
# primäre DNS-Adresse
|
||||||
|
# IPv4: 1.1.1.1
|
||||||
|
# IPv6: 2606:4700:4700::1111
|
||||||
|
# sekundäre DNS-Adresse
|
||||||
|
# IPv4: 1.0.0.1
|
||||||
|
# IPv6: 2606:4700:4700::1001
|
||||||
|
#
|
||||||
|
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||||
|
# primäre DNS-Adresse
|
||||||
|
# IPv4: 8.8.8.8
|
||||||
|
# IPv6: 2001:4860:4860::8888
|
||||||
|
# sekundäre DNS-Adresse
|
||||||
|
# IPv4: 8.8.4.4
|
||||||
|
# IPv6: 2001:4860:4860::8844
|
||||||
|
#
|
||||||
|
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||||
|
# primäre DNS-Adresse
|
||||||
|
# IPv4: 9.9.9.9
|
||||||
|
# IPv6: 2620:fe::fe
|
||||||
|
# sekundäre DNS-Adresse
|
||||||
|
# IPv4: 149.112.112.112
|
||||||
|
# IPv6: 2620:fe::9
|
||||||
|
#
|
||||||
|
# OpenNIC - https://www.opennic.org/
|
||||||
|
# IPv4: 195.10.195.195 - ns31.de
|
||||||
|
# IPv4: 94.16.114.254 - ns28.de
|
||||||
|
# IPv4: 51.254.162.59 - ns9.de
|
||||||
|
# IPv4: 194.36.144.87 - ns29.de
|
||||||
|
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||||
|
#
|
||||||
|
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||||
|
# IPv4: 5.1.66.255
|
||||||
|
# IPv6: 2001:678:e68:f000::
|
||||||
|
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||||
|
# IPv4: 185.150.99.255
|
||||||
|
# IPv6: 2001:678:ed0:f000::
|
||||||
|
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||||
|
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||||
|
resolved_nameserver:
|
||||||
|
- 185.12.64.2
|
||||||
|
- 2a01:4ff:ff00::add:1
|
||||||
|
- 185.12.64.1
|
||||||
|
- 2a01:4ff:ff00::add:2
|
||||||
|
|
||||||
|
# search domains
|
||||||
|
#
|
||||||
|
# If there are more than one search domains, then specify them here in the order in which
|
||||||
|
# the resolver should also search them
|
||||||
|
#
|
||||||
|
# resolved_domains: []
|
||||||
|
resolved_domains:
|
||||||
|
- ~.
|
||||||
|
- oopen.de
|
||||||
|
|
||||||
|
resolved_dnssec: false
|
||||||
|
|
||||||
|
# dns.as250.net: 194.150.168.168
|
||||||
|
#
|
||||||
|
resolved_fallback_nameserver:
|
||||||
|
- 194.150.168.168
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/cron.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
cron_env_entries:
|
||||||
|
- name: PATH
|
||||||
|
job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||||
|
|
||||||
|
- name: SHELL
|
||||||
|
job: /bin/bash
|
||||||
|
insertafter: PATH
|
||||||
|
|
||||||
|
|
||||||
|
cron_user_special_time_entries:
|
||||||
|
|
||||||
|
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||||
|
special_time: reboot
|
||||||
|
job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
|
||||||
|
insertafter: PATH
|
||||||
|
|
||||||
|
- name: "Check if postfix mailservice is running. Restart service if needed."
|
||||||
|
special_time: reboot
|
||||||
|
job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
|
||||||
|
insertafter: PATH
|
||||||
|
|
||||||
|
- name: "Check if mattermost service is running. Restart service if needed."
|
||||||
|
special_time: reboot
|
||||||
|
job: "sleep 10 ; /root/bin/monitoring/check_local_mattermost_service.sh > /dev/null 2>&1"
|
||||||
|
insertafter: PATH
|
||||||
|
|
||||||
|
|
||||||
|
cron_user_entries:
|
||||||
|
|
||||||
|
- name: "Check if mattermost service ist running - Restart Service if needed."
|
||||||
|
minute: '*/16'
|
||||||
|
hour: '*'
|
||||||
|
job: /root/bin/monitoring/check_local_mattermost_service.sh
|
||||||
|
|
||||||
|
- name: "Check if SSH service is running. Restart service if needed."
|
||||||
|
minute: '*/5'
|
||||||
|
hour: '*'
|
||||||
|
job: /root/bin/monitoring/check_ssh.sh
|
||||||
|
|
||||||
|
- name: "Check if Postfix Mailservice is up and running?"
|
||||||
|
minute: '*/15'
|
||||||
|
hour: '*'
|
||||||
|
job: /root/bin/monitoring/check_postfix.sh
|
||||||
|
|
||||||
|
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
|
||||||
|
minute: '01'
|
||||||
|
hour: '05'
|
||||||
|
job: /var/lib/dehydrated/cron/dehydrated_cron.sh
|
||||||
|
|
||||||
|
- name: "Check whether all certificates are included in the VHOST configurations"
|
||||||
|
minute: '33'
|
||||||
|
hour: '05'
|
||||||
|
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/users.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/webadmin-user.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
extra_user:
|
||||||
|
|
||||||
|
- name: nd-admin
|
||||||
|
user_id: 1045
|
||||||
|
group_id: 1045
|
||||||
|
group: nd-admin
|
||||||
|
password: $y$j9T$1YJwHY0qdLimgtdOKlTxR1$/O9QWTpr0Y41TduR2GZ0FMCiIxFqOaXWSM9hmHRnv80
|
||||||
|
shell: /bin/bash
|
||||||
|
ssh_keys:
|
||||||
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
||||||
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
|
||||||
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTjd4XFBdF/V9VdSZjy9G7nupBwaMqsrtQSP4Uctkrz org@rdsgn.de'
|
||||||
|
|
||||||
|
sudo_users:
|
||||||
|
- chris
|
||||||
|
- sysadm
|
||||||
|
- nd-admin
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/sudoers.yml
|
||||||
|
# ---
|
||||||
|
#
|
||||||
|
# see: roles/common/tasks/vars
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/common/tasks/git.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
git_firewall_repository:
|
||||||
|
name: ipt-server
|
||||||
|
repo: https://git.oopen.de/firewall/ipt-server
|
||||||
|
dest: /usr/local/src/ipt-server
|
||||||
|
|
||||||
|
# ==============================
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by scripts/reset_root_passwd.yml
|
||||||
|
# ---
|
||||||
|
|
||||||
|
root_user:
|
||||||
|
name: root
|
||||||
|
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
---
|
||||||
|
# ipt-firewall configuration for a.ns.oopen.de
|
||||||
|
# Generated by extract-fw-host-vars.py - review before committing!
|
||||||
|
# Place in: host_vars/<hostname>/ipt_firewall.yml
|
||||||
|
|
||||||
|
fw_manage_config: true
|
||||||
|
|
||||||
|
# --- Network
|
||||||
|
fw_ext_interfaces:
|
||||||
|
- "eth0"
|
||||||
|
fw_ext_ips_v4:
|
||||||
|
- "95.216.231.187"
|
||||||
|
fw_ext_ips_v6:
|
||||||
|
- "2a01:4f9:3080:3d2d::187"
|
||||||
|
|
||||||
|
# --- Munin
|
||||||
|
munin_remote_ipv4: 37.27.121.227
|
||||||
|
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
|
||||||
|
|
||||||
|
# --- HTTP
|
||||||
|
fw_http_server_ips: $ext_1_ip
|
||||||
|
|
||||||
|
# --- Mail
|
||||||
|
fw_mail_client_ips: $ext_1_ip
|
||||||
@@ -264,10 +264,10 @@ cron_user_entries:
|
|||||||
hour: '*'
|
hour: '*'
|
||||||
job: /root/bin/monitoring/check_ssh.sh
|
job: /root/bin/monitoring/check_ssh.sh
|
||||||
|
|
||||||
- name: "Check connectifity - reboot if needed"
|
# - name: "Check connectifity - reboot if needed"
|
||||||
minute: '*/10'
|
# minute: '*/10'
|
||||||
hour: '*'
|
# hour: '*'
|
||||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||||
|
|
||||||
- name: "Check if Postfix Mailservice is up and running?"
|
- name: "Check if Postfix Mailservice is up and running?"
|
||||||
minute: '*/15'
|
minute: '*/15'
|
||||||
|
|||||||
@@ -245,10 +245,10 @@ cron_user_entries:
|
|||||||
hour: '*'
|
hour: '*'
|
||||||
job: /root/bin/monitoring/check_ssh.sh
|
job: /root/bin/monitoring/check_ssh.sh
|
||||||
|
|
||||||
- name: "Check connectifity - reboot if needed"
|
# - name: "Check connectifity - reboot if needed"
|
||||||
minute: '*/10'
|
# minute: '*/10'
|
||||||
hour: '*'
|
# hour: '*'
|
||||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||||
|
|
||||||
- name: "Check if Postfix Mailservice is up and running?"
|
- name: "Check if Postfix Mailservice is up and running?"
|
||||||
minute: '*/15'
|
minute: '*/15'
|
||||||
|
|||||||
@@ -262,10 +262,10 @@ cron_user_entries:
|
|||||||
hour: '*'
|
hour: '*'
|
||||||
job: /root/bin/monitoring/check_ssh.sh
|
job: /root/bin/monitoring/check_ssh.sh
|
||||||
|
|
||||||
- name: "Check connectifity - reboot if needed"
|
# - name: "Check connectifity - reboot if needed"
|
||||||
minute: '*/10'
|
# minute: '*/10'
|
||||||
hour: '*'
|
# hour: '*'
|
||||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||||
|
|
||||||
- name: "Check if Postfix Mailservice is up and running?"
|
- name: "Check if Postfix Mailservice is up and running?"
|
||||||
minute: '*/15'
|
minute: '*/15'
|
||||||
|
|||||||
@@ -259,10 +259,10 @@ cron_user_entries:
|
|||||||
hour: '*'
|
hour: '*'
|
||||||
job: /root/bin/monitoring/check_ssh.sh
|
job: /root/bin/monitoring/check_ssh.sh
|
||||||
|
|
||||||
- name: "Check connectifity - reboot if needed"
|
# - name: "Check connectifity - reboot if needed"
|
||||||
minute: '*/10'
|
# minute: '*/10'
|
||||||
hour: '*'
|
# hour: '*'
|
||||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||||
|
|
||||||
- name: "Check if Postfix Mailservice is up and running?"
|
- name: "Check if Postfix Mailservice is up and running?"
|
||||||
minute: '*/15'
|
minute: '*/15'
|
||||||
|
|||||||
@@ -257,10 +257,10 @@ cron_user_entries:
|
|||||||
hour: '*'
|
hour: '*'
|
||||||
job: /root/bin/monitoring/check_ssh.sh
|
job: /root/bin/monitoring/check_ssh.sh
|
||||||
|
|
||||||
- name: "Check connectifity - reboot if needed"
|
# - name: "Check connectifity - reboot if needed"
|
||||||
minute: '*/10'
|
# minute: '*/10'
|
||||||
hour: '*'
|
# hour: '*'
|
||||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||||
|
|
||||||
- name: "Check if Postfix Mailservice is up and running?"
|
- name: "Check if Postfix Mailservice is up and running?"
|
||||||
minute: '*/15'
|
minute: '*/15'
|
||||||
|
|||||||
@@ -258,10 +258,10 @@ cron_user_entries:
|
|||||||
hour: '*'
|
hour: '*'
|
||||||
job: /root/bin/monitoring/check_ssh.sh
|
job: /root/bin/monitoring/check_ssh.sh
|
||||||
|
|
||||||
- name: "Check connectifity - reboot if needed"
|
# - name: "Check connectifity - reboot if needed"
|
||||||
minute: '*/10'
|
# minute: '*/10'
|
||||||
hour: '*'
|
# hour: '*'
|
||||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||||
|
|
||||||
- name: "Check if Postfix Mailservice is up and running?"
|
- name: "Check if Postfix Mailservice is up and running?"
|
||||||
minute: '*/15'
|
minute: '*/15'
|
||||||
|
|||||||
@@ -259,10 +259,10 @@ cron_user_entries:
|
|||||||
hour: '*'
|
hour: '*'
|
||||||
job: /root/bin/monitoring/check_ssh.sh
|
job: /root/bin/monitoring/check_ssh.sh
|
||||||
|
|
||||||
- name: "Check connectifity - reboot if needed"
|
# - name: "Check connectifity - reboot if needed"
|
||||||
minute: '*/10'
|
# minute: '*/10'
|
||||||
hour: '*'
|
# hour: '*'
|
||||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||||
|
|
||||||
- name: "Check if Postfix Mailservice is up and running?"
|
- name: "Check if Postfix Mailservice is up and running?"
|
||||||
minute: '*/15'
|
minute: '*/15'
|
||||||
|
|||||||
@@ -259,10 +259,10 @@ cron_user_entries:
|
|||||||
hour: '*'
|
hour: '*'
|
||||||
job: /root/bin/monitoring/check_ssh.sh
|
job: /root/bin/monitoring/check_ssh.sh
|
||||||
|
|
||||||
- name: "Check connectifity - reboot if needed"
|
# - name: "Check connectifity - reboot if needed"
|
||||||
minute: '*/10'
|
# minute: '*/10'
|
||||||
hour: '*'
|
# hour: '*'
|
||||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||||
|
|
||||||
- name: "Check if Postfix Mailservice is up and running?"
|
- name: "Check if Postfix Mailservice is up and running?"
|
||||||
minute: '*/15'
|
minute: '*/15'
|
||||||
|
|||||||
@@ -306,6 +306,8 @@ cl-nd.oopen.de
|
|||||||
# o45 - mm matomom h.mc
|
# o45 - mm matomom h.mc
|
||||||
o45.oopen.de
|
o45.oopen.de
|
||||||
mm-nd.oopen.de
|
mm-nd.oopen.de
|
||||||
|
mm-nd-test.oopen.de
|
||||||
|
h.mx.oopen.de
|
||||||
|
|
||||||
# Hetzner Cloud
|
# Hetzner Cloud
|
||||||
cl-nd-test.oopen.de
|
cl-nd-test.oopen.de
|
||||||
@@ -539,6 +541,8 @@ cl-nd.oopen.de
|
|||||||
# o45 - mm matomom h.mc
|
# o45 - mm matomom h.mc
|
||||||
o45.oopen.de
|
o45.oopen.de
|
||||||
mm-nd.oopen.de
|
mm-nd.oopen.de
|
||||||
|
mm-nd-test.oopen.de
|
||||||
|
h.mx.oopen.de
|
||||||
|
|
||||||
# Hetzner Cloud
|
# Hetzner Cloud
|
||||||
cl-nd-test.oopen.de
|
cl-nd-test.oopen.de
|
||||||
@@ -828,6 +832,9 @@ web-nd.oopen.de
|
|||||||
# o44 - ND cloud
|
# o44 - ND cloud
|
||||||
cl-nd.oopen.de
|
cl-nd.oopen.de
|
||||||
|
|
||||||
|
# o45 - mm mm-test h.mx
|
||||||
|
h.mx.oopen.de
|
||||||
|
|
||||||
# Hetzner Cloud
|
# Hetzner Cloud
|
||||||
cl-nd-test.oopen.de
|
cl-nd-test.oopen.de
|
||||||
|
|
||||||
@@ -994,6 +1001,7 @@ web-nd.oopen.de
|
|||||||
|
|
||||||
# o45 - ND
|
# o45 - ND
|
||||||
mm-nd.oopen.de
|
mm-nd.oopen.de
|
||||||
|
mm-nd-test.oopen.de
|
||||||
|
|
||||||
# GA - Gemeinschaft Altensclirf
|
# GA - Gemeinschaft Altensclirf
|
||||||
ga-st-services.ga.netz
|
ga-st-services.ga.netz
|
||||||
@@ -1043,6 +1051,9 @@ b.mx.oopen.de
|
|||||||
# o40 - g.mx
|
# o40 - g.mx
|
||||||
g.mx.oopen.de
|
g.mx.oopen.de
|
||||||
|
|
||||||
|
# o45 - h.mx
|
||||||
|
h.mx.oopen.de
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
# O.OPEN office network
|
# O.OPEN office network
|
||||||
# ---
|
# ---
|
||||||
@@ -1109,7 +1120,8 @@ web-03.oopen.de
|
|||||||
# o40 - g.mx
|
# o40 - g.mx
|
||||||
g.mx.oopen.de
|
g.mx.oopen.de
|
||||||
|
|
||||||
# o39.oopen.de
|
# o45 - h.mx
|
||||||
|
h.mx.oopen.de
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
# O.OPEN office network
|
# O.OPEN office network
|
||||||
@@ -1142,6 +1154,7 @@ prometheus-nd.oopen.de
|
|||||||
|
|
||||||
# o45 - ND
|
# o45 - ND
|
||||||
mm-nd.oopen.de
|
mm-nd.oopen.de
|
||||||
|
mm-nd-test.oopen.de
|
||||||
|
|
||||||
|
|
||||||
[mysql_server]
|
[mysql_server]
|
||||||
@@ -1420,6 +1433,9 @@ b.mx.oopen.de
|
|||||||
# o40 - g.mx
|
# o40 - g.mx
|
||||||
g.mx.oopen.de
|
g.mx.oopen.de
|
||||||
|
|
||||||
|
# o45 - h.mx
|
||||||
|
h.mx.oopen.de
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
# O.OPEN office network
|
# O.OPEN office network
|
||||||
# ---
|
# ---
|
||||||
@@ -1800,6 +1816,8 @@ cl-nd.oopen.de
|
|||||||
|
|
||||||
# o45 - ND
|
# o45 - ND
|
||||||
mm-nd.oopen.de
|
mm-nd.oopen.de
|
||||||
|
mm-nd-test.oopen.de
|
||||||
|
h.mx.oopen.de
|
||||||
|
|
||||||
# Hetzner Cloud
|
# Hetzner Cloud
|
||||||
cl-nd-test.oopen.de
|
cl-nd-test.oopen.de
|
||||||
@@ -2059,6 +2077,8 @@ cl-nd.oopen.de
|
|||||||
# o45 - mm matomom h.mc
|
# o45 - mm matomom h.mc
|
||||||
o45.oopen.de
|
o45.oopen.de
|
||||||
mm-nd.oopen.de
|
mm-nd.oopen.de
|
||||||
|
mm-nd-test.oopen.de
|
||||||
|
h.mx.oopen.de
|
||||||
|
|
||||||
# Hetzner Cloud
|
# Hetzner Cloud
|
||||||
cl-nd-test.oopen.de
|
cl-nd-test.oopen.de
|
||||||
|
|||||||
@@ -0,0 +1,19 @@
|
|||||||
|
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# Trusted networks whitelisted by postfwd
|
||||||
|
#
|
||||||
|
# Example:
|
||||||
|
#
|
||||||
|
# # web0.warenform.de
|
||||||
|
# #83.223.86.76
|
||||||
|
# #2a01:30:0:505:286:96ff:fe4a:6ee
|
||||||
|
# #2a01:30:0:13:286:96ff:fe4a:6eee
|
||||||
|
#
|
||||||
|
# ---
|
||||||
|
|
||||||
|
# give truested networrk adresses here
|
||||||
|
|
||||||
|
# d.mx.oopen.de (listen server)
|
||||||
|
95.217.204.227
|
||||||
|
2a01:4f9:4a:47e5::227
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
-----BEGIN OPENSSH PRIVATE KEY-----
|
||||||
|
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
||||||
|
QyNTUxOQAAACDTXB9m2b3Ez7Fhcq1ZTAx+Q84/1nD450ojalp9er82aQAAAJA2BTpdNgU6
|
||||||
|
XQAAAAtzc2gtZWQyNTUxOQAAACDTXB9m2b3Ez7Fhcq1ZTAx+Q84/1nD450ojalp9er82aQ
|
||||||
|
AAAEBo2N/3clJE7mgMTLLGS/pVqz5TNGL89spOn5BZ0UyzuNNcH2bZvcTPsWFyrVlMDH5D
|
||||||
|
zj/WcPjnSiNqWn16vzZpAAAACmNocmlzQGx1bmEBAgM=
|
||||||
|
-----END OPENSSH PRIVATE KEY-----
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNcH2bZvcTPsWFyrVlMDH5Dzj/WcPjnSiNqWn16vzZp root@h.mx-dehydrated
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
-----BEGIN OPENSSH PRIVATE KEY-----
|
||||||
|
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
||||||
|
QyNTUxOQAAACAZc/qkhVCyCMZK9/sTo2w08zSVx79SfQ9DTPP6Oop1PwAAAJDehrho3oa4
|
||||||
|
aAAAAAtzc2gtZWQyNTUxOQAAACAZc/qkhVCyCMZK9/sTo2w08zSVx79SfQ9DTPP6Oop1Pw
|
||||||
|
AAAECaXByIL6yHuFazBHLv/6QZM8V7F/Fv5o5mgKuoEcJ2Shlz+qSFULIIxkr3+xOjbDTz
|
||||||
|
NJXHv1J9D0NM8/o6inU/AAAACmNocmlzQGx1bmEBAgM=
|
||||||
|
-----END OPENSSH PRIVATE KEY-----
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlz+qSFULIIxkr3+xOjbDTzNJXHv1J9D0NM8/o6inU/ root@h.mx-opendkim
|
||||||
@@ -0,0 +1,177 @@
|
|||||||
|
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||||
|
|
||||||
|
# ---------------------------------------------------------
|
||||||
|
# - Parameter Settings for script 'create_opendkim_key.sh'.
|
||||||
|
# ---------------------------------------------------------
|
||||||
|
|
||||||
|
|
||||||
|
# ----------
|
||||||
|
# DNS Server
|
||||||
|
# ----------
|
||||||
|
|
||||||
|
# - dns_dkim_zone_master_server
|
||||||
|
# -
|
||||||
|
# - The DNS Server who is serving the update zone and is used
|
||||||
|
# - for the dynamic updates (nsupdate)
|
||||||
|
# -
|
||||||
|
#dns_dkim_zone_master_server=""
|
||||||
|
dns_dkim_zone_master_server="b.ns.oopen.de"
|
||||||
|
|
||||||
|
# - update_dns
|
||||||
|
# -
|
||||||
|
# - Possible Values are 'true' or 'false'
|
||||||
|
# -
|
||||||
|
#update_dns=true
|
||||||
|
|
||||||
|
# - update_zone
|
||||||
|
# -
|
||||||
|
# - Zone containing the DKIM TXT record.
|
||||||
|
# -
|
||||||
|
# - Defaults to '_domainkey.<dkim_domaini>'
|
||||||
|
# -
|
||||||
|
# - Note:
|
||||||
|
# - do NOT change/set this option unless you know what you do.
|
||||||
|
# -
|
||||||
|
#update_zone=""
|
||||||
|
|
||||||
|
# - TTL
|
||||||
|
# -
|
||||||
|
# - TTL for the DKIM TXT Record.
|
||||||
|
# -
|
||||||
|
# - Defaults to "" if update_dns=false
|
||||||
|
# - Defaults to "43200" if update_dns=true
|
||||||
|
# -
|
||||||
|
#TTL=
|
||||||
|
|
||||||
|
|
||||||
|
# ----------
|
||||||
|
# TSIG Key
|
||||||
|
# ----------
|
||||||
|
|
||||||
|
# - key_secret
|
||||||
|
# -
|
||||||
|
# - Sectret Key used by 'nsupdate' to create/update the
|
||||||
|
# - DKIM TXT record.
|
||||||
|
# -
|
||||||
|
# - Example:
|
||||||
|
# - key_secret="EtvvMdW0PXD4GMHP+onuHZ0dT/Z8OSJGlce/xH10OwI="
|
||||||
|
# -
|
||||||
|
#key_secret=""
|
||||||
|
key_secret="4woPu0jqf9Jp1IX+gduJ3BVW/1ZMeyCPTQMqEsMXLFw="
|
||||||
|
|
||||||
|
# - key_algo
|
||||||
|
# -
|
||||||
|
# - The key algorithm used for key creation. Available choices are: hmac-md5,
|
||||||
|
# - hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and hmac-sha512. The
|
||||||
|
# - default is hmac-sha256. Options are case-insensitive.
|
||||||
|
# -
|
||||||
|
# - Example:
|
||||||
|
# - key_algo="hmac-md5"
|
||||||
|
# -
|
||||||
|
# - Defaults to 'hmac-sha256'
|
||||||
|
# -
|
||||||
|
#key_algo="hmac-sha256"
|
||||||
|
key_algo="hmac-sha256"
|
||||||
|
|
||||||
|
# - key_name
|
||||||
|
# -
|
||||||
|
# - Name of the Key
|
||||||
|
# -
|
||||||
|
# - Defaults to "$update_zone"
|
||||||
|
# -
|
||||||
|
#key_name=""
|
||||||
|
key_name="update-dkim"
|
||||||
|
|
||||||
|
|
||||||
|
# ----------
|
||||||
|
# Access Credentials DNS Server
|
||||||
|
# ----------
|
||||||
|
|
||||||
|
# - dns_ssh_user
|
||||||
|
# -
|
||||||
|
# - Defaults to 'manage-bind'
|
||||||
|
# -
|
||||||
|
#dns_ssh_user="manage-bind"
|
||||||
|
|
||||||
|
# - dns_ssh_port
|
||||||
|
# -
|
||||||
|
# - Defaults to '22'
|
||||||
|
# -
|
||||||
|
#dns_ssh_port=22
|
||||||
|
|
||||||
|
# - dns_ssh_key
|
||||||
|
# -
|
||||||
|
# - Defaults to '/root/.ssh/id_rsa-opendkim'
|
||||||
|
# -
|
||||||
|
#dns_ssh_key="/root/.ssh/id_rsa-opendkim"
|
||||||
|
dns_ssh_key="/root/.ssh/id_ed25519-opendkim"
|
||||||
|
|
||||||
|
|
||||||
|
# ----------
|
||||||
|
# Scripts envoked at DNS Server
|
||||||
|
# ----------
|
||||||
|
|
||||||
|
# - set_new_serial_script
|
||||||
|
# -
|
||||||
|
# - Script increases the serial for a given domain or a given
|
||||||
|
# - hostname's concerning domain.
|
||||||
|
# -
|
||||||
|
# - Defaults to /root/bin/bind/bind_set_new_serial.sh
|
||||||
|
# -
|
||||||
|
#set_new_serial_script="/root/bin/bind/bind_set_new_serial.sh"
|
||||||
|
|
||||||
|
# - create_dkim_delegation_script
|
||||||
|
# -
|
||||||
|
# - Script adds DKIM subdomain delegation for a given domain
|
||||||
|
# -
|
||||||
|
# - Defaults to '/root/bin/bind/bind_create_dkim_delegation.sh'
|
||||||
|
# -
|
||||||
|
#create_dkim_delegation_script="/root/bin/bind/bind_create_dkim_delegation.sh"
|
||||||
|
|
||||||
|
# - add_dkim_zone_master_script
|
||||||
|
# -
|
||||||
|
# - Script adds zone _domainkey.<dkim domain> as master zone
|
||||||
|
# -
|
||||||
|
# - Defaults to '/root/bin/bind/bind_add_dkim_zone_master.sh'
|
||||||
|
# -
|
||||||
|
#add_dkim_zone_master_script="/root/bin/bind/bind_add_dkim_zone_master.sh"
|
||||||
|
|
||||||
|
# - add_dkim_zone_slave_script
|
||||||
|
# -
|
||||||
|
# - Script adds zone _domainkey.<dkim domain> as slave zone
|
||||||
|
# -
|
||||||
|
# - Defaults to '/root/bin/bind/bind_add_dkim_zone_slave.sh'
|
||||||
|
# -
|
||||||
|
#add_dkim_zone_slave_script="/root/bin/bind/bind_add_dkim_zone_slave.sh"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# ----------
|
||||||
|
# OpenDKIM Installation
|
||||||
|
# ----------
|
||||||
|
|
||||||
|
# - opendkim_dir
|
||||||
|
# -
|
||||||
|
# - OpenDKIM's etc-directory
|
||||||
|
# -
|
||||||
|
# - Defaults to opendkim_dir="/etc/opendkim"
|
||||||
|
# -
|
||||||
|
#opendkim_dir="/etc/opendkim"
|
||||||
|
|
||||||
|
# - key_base_dir
|
||||||
|
# -
|
||||||
|
# - Defaults to "${opendkim_dir}/keys"
|
||||||
|
# -
|
||||||
|
#key_base_dir=${opendkim_dir}/keys
|
||||||
|
|
||||||
|
# - signing_table_file
|
||||||
|
# -
|
||||||
|
# - Defaults to "${opendkim_dir}/signing.table"
|
||||||
|
# -
|
||||||
|
#signing_table_file="${opendkim_dir}/signing.table"
|
||||||
|
|
||||||
|
# - key_table_file
|
||||||
|
# -
|
||||||
|
# - Defaults to "${opendkim_dir}/key.table"
|
||||||
|
# -
|
||||||
|
#key_table_file="${opendkim_dir}/key.table"
|
||||||
@@ -0,0 +1,44 @@
|
|||||||
|
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||||
|
|
||||||
|
# ======================================================
|
||||||
|
# ---
|
||||||
|
# Parameter Settings for Script 'whitelist_mb_sigs.conf'
|
||||||
|
# ---
|
||||||
|
# ======================================================
|
||||||
|
|
||||||
|
# QUARANTINE_BASE_DIR
|
||||||
|
#
|
||||||
|
# Base directory where amavis stores quarantined e-mails, mostly in
|
||||||
|
#
|
||||||
|
# virus e-mails: $QUARANTINE_BASE_DIR/virus
|
||||||
|
# spam emails: $QUARANTINE_BASE_DIR/spam
|
||||||
|
# ..
|
||||||
|
#
|
||||||
|
# Defaults to:
|
||||||
|
# QUARANTINE_BASE_DIR="/var/QUARANTINE"
|
||||||
|
#
|
||||||
|
#QUARANTINE_BASE_DIR="/var/QUARANTINE"
|
||||||
|
|
||||||
|
|
||||||
|
# CLAMAV_VIRUS_WHITE_LIST
|
||||||
|
#
|
||||||
|
# Full path to clamav's (personal) white list file
|
||||||
|
#
|
||||||
|
# Defaults to:
|
||||||
|
# CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
|
||||||
|
#
|
||||||
|
#CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
|
||||||
|
|
||||||
|
|
||||||
|
# WHITE_LIST_STRINGS
|
||||||
|
#
|
||||||
|
# A blank separated list of strings to whitelist.
|
||||||
|
#
|
||||||
|
# Example:
|
||||||
|
# WHITE_LIST_STRINGS="google.com tinyurl.com"
|
||||||
|
#
|
||||||
|
# Defaults to:
|
||||||
|
# WHITE_LIST_STRINGS="google.com"
|
||||||
|
#
|
||||||
|
#WHITE_LIST_STRINGS="google.com"
|
||||||
|
WHITE_LIST_STRINGS="google.com tinyurl.com"
|
||||||
@@ -196,6 +196,16 @@
|
|||||||
# ----------
|
# ----------
|
||||||
# unattended upgrades
|
# unattended upgrades
|
||||||
# ----------
|
# ----------
|
||||||
|
#
|
||||||
|
|
||||||
|
- name: (basic.yml) update
|
||||||
|
ansible.builtin.command: apt-get update # noqa: command-instead-of-module
|
||||||
|
changed_when: false
|
||||||
|
environment:
|
||||||
|
DEBIAN_FRONTEND: noninteractive
|
||||||
|
when:
|
||||||
|
- ansible_facts['distribution'] == "Debian"
|
||||||
|
- apt_update|bool
|
||||||
|
|
||||||
- name: (basic.yml) install unattended-upgrades
|
- name: (basic.yml) install unattended-upgrades
|
||||||
ansible.builtin.apt:
|
ansible.builtin.apt:
|
||||||
|
|||||||
@@ -59,6 +59,20 @@
|
|||||||
- copy-files
|
- copy-files
|
||||||
- copy-template-files
|
- copy-template-files
|
||||||
|
|
||||||
|
- name: (copy_files.yml) Ensure directory /etc/postfix exists
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /etc/postfix
|
||||||
|
state: directory
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0755"
|
||||||
|
when:
|
||||||
|
- inventory_hostname in groups['mail_server']
|
||||||
|
tags:
|
||||||
|
- copy-files
|
||||||
|
- copy-plain-files
|
||||||
|
- copy-template-files
|
||||||
|
|
||||||
- name: (copy_files.yml) GLOBAL copy plain files Postfix (/etc/postfix)
|
- name: (copy_files.yml) GLOBAL copy plain files Postfix (/etc/postfix)
|
||||||
ansible.builtin.copy:
|
ansible.builtin.copy:
|
||||||
src: "{{ item.src_path }}"
|
src: "{{ item.src_path }}"
|
||||||
|
|||||||
Reference in New Issue
Block a user