update..
This commit is contained in:
@@ -25,5 +25,3 @@ elif [ -f "/usr/share/mc/bin/mc.sh" ]; then
|
||||
elif [ -f "/usr/lib/mc/bin/mc.sh" ] ; then
|
||||
source /usr/lib/mc/bin/mc.sh
|
||||
fi
|
||||
|
||||
mesg n
|
||||
|
||||
@@ -103,7 +103,7 @@ resolved_fallback_nameserver:
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
insert_root_ssh_keypair: true
|
||||
insert_root_ssh_keypair: false
|
||||
|
||||
root_ssh_keypair:
|
||||
- name: id-rsa-dehydrated
|
||||
|
||||
@@ -285,7 +285,10 @@ default_user:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMHxvK5kzKgypVi8ZvshveSpyo0eSXiBCnAC5Pcjdgv root@discourse'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDy5WM1qsLE2SRwWG1Y38WJcMYUpL8MuQiraqiXfHzaH root@e.mx'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvOkCWNKUJ5o9e+0NhY4IFZv8LA7tkkkEFjr8nqFKhe root@formbricks-nd'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAOOp76krTc0SuXDVAuU+L6Pd7XWR3V1XBKkXlEqQbEZ root@ga-al-gw'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL7KbEZApiqEcU4aK3A2J8hy+r1uV7TZupwm4CHGqLPH root@ga-gh-gw'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCXqgmGcJfUDROAk24pTkQqddRj1sh1BW3JrbHu7ZtE root@ga-nh-gw'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaF9IsDzPo6nef47VbsLlqlmiwuLyFQ8Vawil/JPF9M root@ga-st-gw'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPbony+4g4iFS32Cv/Bkmet4FsCAsrGTffwWm2eM16x root@git.warenform'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqqmBWh3qmnx41NiLCn1LhVG0mn4++IUvRNC0OMh6h6 root@gitoea'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICR9o0+6jnfmXKOedKP6IZgt5lRIPFSJJ4FbMjz2SPkH root@gw-campus'
|
||||
|
||||
@@ -20,6 +20,63 @@ network_interface_required_packages:
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: eth0
|
||||
headline: eth0 - LAN - Uplink static line (radio) to Stockausen
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 172.16.111.253
|
||||
netmask: 24
|
||||
post-up:
|
||||
- /sbin/ip route add 172.16.211.0/24 via 172.16.111.254
|
||||
# User Networks Stockhausen
|
||||
- /sbin/ip route add 192.168.11.0/24 via 172.16.111.254
|
||||
- /sbin/ip route add 192.168.78.0/24 via 172.16.111.254
|
||||
# User Networks Campus
|
||||
# - /sbin/ip route add 192.168.72.0/24 via 172.16.111.254
|
||||
# - /sbin/ip route add 192.168.73.0/24 via 172.16.111.254
|
||||
# User Network Novalishaus
|
||||
- /sbin/ip route add 192.168.81.0/24 via 172.16.111.254
|
||||
# User Network Georgshaus
|
||||
- /sbin/ip route add 192.168.85.0/24 via 172.16.111.254
|
||||
# Management Network Stockhausen
|
||||
- /sbin/ip route add 10.10.11.0/24 via 172.16.111.254
|
||||
# Depreated Management Network Stokhausen
|
||||
- /sbin/ip route add 10.10.9.0/24 via 172.16.111.254
|
||||
# IPMI Stockhausen
|
||||
- /sbin/ip route add 10.11.11.0/24 via 172.16.111.254
|
||||
# WLAN Gast Novalishaus
|
||||
- /sbin/ip route add 10.21.0.0/20 via 172.16.111.254
|
||||
# WLAN privat Novalishaus
|
||||
- /sbin/ip route add 10.31.0.0/20 via 172.16.111.254
|
||||
# Management Netork Campus
|
||||
# - /sbin/ip route add 10.72.1.0/24 via 172.16.111.254
|
||||
# WLan Router Stockhausen
|
||||
- /sbin/ip route add 10.112.1.0/24 via 172.16.111.254
|
||||
# WLan Netz
|
||||
- /sbin/ip route add 10.113.0.0/16 via 172.16.111.254
|
||||
# Unifi WLan Netz Stockhausen Gast
|
||||
- /sbin/ip route add 10.121.0.0/20 via 172.16.111.254
|
||||
# Unifi WLan Netz Stockhausen privat
|
||||
- /sbin/ip route add 10.131.0.0/20 via 172.16.111.254
|
||||
# Richtfunkantennen Stockhausen (2) / Schlechtenwegen / Kirschbaumhaus
|
||||
- /sbin/ip route add 10.10.111.0/24 via 172.16.111.254
|
||||
# VPN Netz Stockhausen - Novalishaus (Schlechtenwegen)
|
||||
- /sbin/ip route add 10.2.81.0/24 via 172.16.111.254
|
||||
# VPN Home Stockhausen
|
||||
- /sbin/ip route add 10.0.11.0/24 via 172.16.111.254
|
||||
# - FritzBoxen Stockhausen
|
||||
- /sbin/ip route add 172.16.11.0/24 via 172.16.111.254
|
||||
- /sbin/ip route add 172.16.12.0/24 via 172.16.111.254
|
||||
- /sbin/ip route add 172.16.13.0/24 via 172.16.111.254
|
||||
# - FritzBox Novalishaus
|
||||
- /sbin/ip route add 172.16.80.0/24 via 172.16.111.254
|
||||
# - DigitBox Novalishaus
|
||||
- /sbin/ip route add 172.16.81.0/24 via 172.16.111.254
|
||||
# - FritzBox georgshaus
|
||||
- /sbin/ip route add 172.16.85.0/24 via 172.16.111.254
|
||||
|
||||
|
||||
- device: eth1
|
||||
headline: eth1 - Uplink DSL Altenschlirf via (static) line to Fritz!Box 7590
|
||||
auto: true
|
||||
@@ -172,63 +229,6 @@ network_interfaces:
|
||||
post-down: [] # post-down script lines
|
||||
|
||||
|
||||
- device: eth3
|
||||
headline: eth3 - LAN - Uplink static line (radio) to Stockausen
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 172.16.111.253
|
||||
netmask: 24
|
||||
post-up:
|
||||
- /sbin/ip route add 172.16.211.0/24 via 172.16.111.254
|
||||
# User Networks Stockhausen
|
||||
- /sbin/ip route add 192.168.11.0/24 via 172.16.111.254
|
||||
- /sbin/ip route add 192.168.78.0/24 via 172.16.111.254
|
||||
# User Networks Campus
|
||||
# - /sbin/ip route add 192.168.72.0/24 via 172.16.111.254
|
||||
# - /sbin/ip route add 192.168.73.0/24 via 172.16.111.254
|
||||
# User Network Novalishaus
|
||||
- /sbin/ip route add 192.168.81.0/24 via 172.16.111.254
|
||||
# User Network Georgshaus
|
||||
- /sbin/ip route add 192.168.85.0/24 via 172.16.111.254
|
||||
# Management Network Stockhausen
|
||||
- /sbin/ip route add 10.10.11.0/24 via 172.16.111.254
|
||||
# Depreated Management Network Stokhausen
|
||||
- /sbin/ip route add 10.10.9.0/24 via 172.16.111.254
|
||||
# IPMI Stockhausen
|
||||
- /sbin/ip route add 10.11.11.0/24 via 172.16.111.254
|
||||
# WLAN Gast Novalishaus
|
||||
- /sbin/ip route add 10.21.0.0/20 via 172.16.111.254
|
||||
# WLAN privat Novalishaus
|
||||
- /sbin/ip route add 10.31.0.0/20 via 172.16.111.254
|
||||
# Management Netork Campus
|
||||
# - /sbin/ip route add 10.72.1.0/24 via 172.16.111.254
|
||||
# WLan Router Stockhausen
|
||||
- /sbin/ip route add 10.112.1.0/24 via 172.16.111.254
|
||||
# WLan Netz
|
||||
- /sbin/ip route add 10.113.0.0/16 via 172.16.111.254
|
||||
# Unifi WLan Netz Stockhausen Gast
|
||||
- /sbin/ip route add 10.121.0.0/20 via 172.16.111.254
|
||||
# Unifi WLan Netz Stockhausen privat
|
||||
- /sbin/ip route add 10.131.0.0/20 via 172.16.111.254
|
||||
# Richtfunkantennen Stockhausen (2) / Schlechtenwegen / Kirschbaumhaus
|
||||
- /sbin/ip route add 10.10.111.0/24 via 172.16.111.254
|
||||
# VPN Netz Stockhausen - Novalishaus (Schlechtenwegen)
|
||||
- /sbin/ip route add 10.2.81.0/24 via 172.16.111.254
|
||||
# VPN Home Stockhausen
|
||||
- /sbin/ip route add 10.0.11.0/24 via 172.16.111.254
|
||||
# - FritzBoxen Stockhausen
|
||||
- /sbin/ip route add 172.16.11.0/24 via 172.16.111.254
|
||||
- /sbin/ip route add 172.16.12.0/24 via 172.16.111.254
|
||||
- /sbin/ip route add 172.16.13.0/24 via 172.16.111.254
|
||||
# - FritzBox Novalishaus
|
||||
- /sbin/ip route add 172.16.80.0/24 via 172.16.111.254
|
||||
# - DigitBox Novalishaus
|
||||
- /sbin/ip route add 172.16.81.0/24 via 172.16.111.254
|
||||
# - FritzBox georgshaus
|
||||
- /sbin/ip route add 172.16.85.0/24 via 172.16.111.254
|
||||
|
||||
|
||||
- device: eth4
|
||||
headline: eth4 - Management Network Altenschlirf
|
||||
auto: true
|
||||
|
||||
@@ -22,17 +22,21 @@ network_interface_required_packages:
|
||||
network_interfaces:
|
||||
|
||||
- device: eno1
|
||||
headline: eno1 - Uplink DSL via Fritz!Box
|
||||
headline: eno1 - Uplink MIA-Router Telekom
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 100.64.254.2
|
||||
netmask: 28
|
||||
gateway: 100.64.254.1
|
||||
|
||||
- device: eno1:rescue
|
||||
headline: eno1:rescue - Alias on eno1 - Uplink DSL via Fritz!Box
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 172.16.192.1
|
||||
netmask: 24
|
||||
gateway: 172.16.192.254
|
||||
# nameservers:
|
||||
# - 127.0.0.1
|
||||
# - 192.168.192.1
|
||||
# search: ebs.netz kanzlei-kiel.netz elster.netz
|
||||
|
||||
|
||||
- device: eno2
|
||||
|
||||
@@ -0,0 +1,253 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
install_compiler_pkgs: true
|
||||
|
||||
install_postgresql_pkgs: true
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 127.0.0.1
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- oopen.de
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 185.12.64.2
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
insert_root_ssh_keypair: true
|
||||
|
||||
#root_ssh_keypair:
|
||||
# - name: id-rsa-dehydrated
|
||||
# priv_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-dehydrated
|
||||
# priv_key_dest: /root/.ssh/id_rsa-dehydrated
|
||||
# pub_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-dehydrated.pub
|
||||
# pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
|
||||
# - name: id-rsa-opendkim
|
||||
# priv_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-opendkim
|
||||
# priv_key_dest: /root/.ssh/id_rsa-opendkim
|
||||
# pub_key_src: h.mx.oopen.de/root/.ssh/h.mx-id_rsa-opendkim.pub
|
||||
# pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/copy_files.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
|
||||
# ---
|
||||
|
||||
hostname: h.mx.oopen.de
|
||||
ipv4_address: 135.181.239.144
|
||||
ipv6_address: 2a01:4f9:3080:3d2d::144
|
||||
|
||||
admin_email: argus@oopen.de
|
||||
is_relay_host: !!str "false"
|
||||
|
||||
support_dmarc_reporting: !!str "true"
|
||||
|
||||
db_in_use: !!str "true"
|
||||
# postfix_db_type
|
||||
#
|
||||
# possible values are 'PostgreSQL' and 'MySQL'
|
||||
postfix_db_type: PostgreSQL
|
||||
postfix_db_name: postfix
|
||||
postfix_db_user: postfix
|
||||
# postfix_db_host: /run/postgresql
|
||||
postfix_db_pass: AIk-w5/2P--xd5FA
|
||||
|
||||
# install_amavis.conf
|
||||
#
|
||||
mp_receipt_number: 106015125438
|
||||
si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07ed6db26621b11bca0e23d2a42b60aef3f7b7803a1466a964d90c7b1e82d67c7680c8f46b59a4e
|
||||
|
||||
# install_postfixadmin.conf
|
||||
#
|
||||
website_name_postfixadmin: adm.nd-online.de
|
||||
|
||||
email_welcome_message: |
|
||||
|
||||
Hallo,
|
||||
|
||||
Ihre/Deine neue E-Mail Adresse ist eingerichtet.
|
||||
|
||||
ND IT
|
||||
|
||||
--
|
||||
nd.Genossenschaft eG | Phone: +49 30 /
|
||||
Franz-Mehring-Platz 1 | Fax: +49 30 /
|
||||
D-10243 Berlin | E-Mail: it@nd-online.de
|
||||
|
||||
# install_update_dovecot.conf
|
||||
#
|
||||
dovecot_from_address: "o.open <oo@oopen.de>"
|
||||
dovecot_reply_to: "oo@oopen.de"
|
||||
webmailer_address: "https://webmail.oopen.de"
|
||||
salutation: |
|
||||
ND IT
|
||||
|
||||
--
|
||||
nd.Genossenschaft eG | Phone: +49 30 /
|
||||
Franz-Mehring-Platz 1 | Fax: +49 30 /
|
||||
D-10243 Berlin | E-Mail: it@nd-online.de
|
||||
O.OPEN
|
||||
|
||||
# install_upgrade_roundcube-webmail.conf
|
||||
#
|
||||
# Webmailer
|
||||
webmail_site_name: webmail.nd-online.de
|
||||
autoreply_hostname: autoreply.nd-online.de
|
||||
# possible values: 'pgsql' or 'mysql'
|
||||
roundcube_db_type: pgsql
|
||||
roundcube_db_name: roundcubemail
|
||||
roundcube_db_user: roundcube
|
||||
# roundcube_db_host: localhost
|
||||
roundcube_db_pass: 'w9.cCS4/ZE.J-JEd'
|
||||
|
||||
roundcube_acl_plugin: true
|
||||
|
||||
roundcube_product_name: O.OPEN - Webmailer
|
||||
roundcube_support_url: https://www.oopen.de
|
||||
roundcube_skin_logo: "images/oopen-logo.png"
|
||||
|
||||
|
||||
template_files_mailsystem_script:
|
||||
|
||||
- name: mailsystem_install_amavis.conf
|
||||
src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
|
||||
dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
|
||||
|
||||
- name: mailsystem__postfix_advanced.conf
|
||||
src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2
|
||||
dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf
|
||||
|
||||
- name: mailsystem_install_postfixadmin.conf
|
||||
src_path: usr/local/src/mailsystem/conf/install_postfixadmin.conf.j2
|
||||
dest_path: /usr/local/src/mailsystem/conf/install_postfixadmin.conf
|
||||
|
||||
- name: mailsystem_install_update_dovecot.conf
|
||||
src_path: usr/local/src/mailsystem/conf/install_update_dovecot.conf.j2
|
||||
dest_path: /usr/local/src/mailsystem/conf/install_update_dovecot.conf
|
||||
|
||||
- name: mailsystem_install_upgrade_roundcube-webmail.conf
|
||||
src_path: usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf.j2
|
||||
dest_path: /usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf
|
||||
@@ -0,0 +1,43 @@
|
||||
---
|
||||
# ipt-firewall configuration for h.mx.oopen.de
|
||||
# Generated by extract-fw-host-vars.py - review before committing!
|
||||
# Place in: host_vars/<hostname>/ipt_firewall.yml
|
||||
|
||||
fw_manage_config: true
|
||||
|
||||
# --- Network
|
||||
fw_ext_interfaces:
|
||||
- "eth0"
|
||||
fw_ext_ips_v4:
|
||||
- "135.181.239.144"
|
||||
fw_ext_ips_v6:
|
||||
- "2a01:4f9:3080:3d2d::144"
|
||||
|
||||
# --- Munin
|
||||
munin_remote_ipv4: 37.27.121.227
|
||||
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
|
||||
|
||||
# --- HTTP
|
||||
fw_http_server_ips: $ext_1_ip
|
||||
|
||||
# --- Mail
|
||||
fw_smtpd_ips: $ext_1_ip
|
||||
fw_mail_server_ips: $ext_1_ip
|
||||
fw_mail_client_ips: $ext_1_ip
|
||||
fw_dovecot_auth_service: true
|
||||
|
||||
# - meet.oopen.de -> 159.69.74.155
|
||||
# - meet.akweb.de -> 148.251.14.136
|
||||
# - jo.oopen.de -> 94.16.115.62
|
||||
# -
|
||||
# - meet.akweb.de -> 2a01:4f8:201:7389::136
|
||||
# - meet.oopen.de -> 2a01:4f8:231:19a7::155
|
||||
|
||||
# --- Jitsi
|
||||
fw_jitsi_dovecot_auth: true
|
||||
|
||||
# --- Rsync
|
||||
fw_rsync_out_ips: $ext_1_ip
|
||||
|
||||
# --- Protection / limits
|
||||
fw_per_IP_connection_limit: 250 # noqa: var-naming[pattern]
|
||||
@@ -141,11 +141,6 @@ cron_user_entries:
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_postfix.sh
|
||||
|
||||
- name: "Check if cert for Keycloak service is up-to-date"
|
||||
minute: '51'
|
||||
hour: '05'
|
||||
job: /root/bin/monitoring/check_cert_for_keycloak.sh
|
||||
|
||||
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
|
||||
minute: '23'
|
||||
hour: '05'
|
||||
@@ -157,6 +152,11 @@ cron_user_entries:
|
||||
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
|
||||
|
||||
|
||||
# - name: "Check if cert for Keycloak service is up-to-date"
|
||||
# minute: '51'
|
||||
# hour: '05'
|
||||
# job: /root/bin/monitoring/check_cert_for_keycloak.sh
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
@@ -141,11 +141,6 @@ cron_user_entries:
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_postfix.sh
|
||||
|
||||
- name: "Check if cert for Keycloak service is up-to-date"
|
||||
minute: '51'
|
||||
hour: '05'
|
||||
job: /root/bin/monitoring/check_cert_for_keycloak.sh
|
||||
|
||||
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
|
||||
minute: '23'
|
||||
hour: '05'
|
||||
@@ -157,6 +152,12 @@ cron_user_entries:
|
||||
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
|
||||
|
||||
|
||||
# - name: "Check if cert for Keycloak service is up-to-date"
|
||||
# minute: '51'
|
||||
# hour: '05'
|
||||
# job: /root/bin/monitoring/check_cert_for_keycloak.sh
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
@@ -0,0 +1,223 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 185.12.64.2
|
||||
- 2a01:4ff:ff00::add:1
|
||||
- 185.12.64.1
|
||||
- 2a01:4ff:ff00::add:2
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- oopen.de
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
# ---
|
||||
|
||||
cron_env_entries:
|
||||
- name: PATH
|
||||
job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
|
||||
- name: SHELL
|
||||
job: /bin/bash
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
special_time: reboot
|
||||
job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
|
||||
insertafter: PATH
|
||||
|
||||
- name: "Check if postfix mailservice is running. Restart service if needed."
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
|
||||
insertafter: PATH
|
||||
|
||||
- name: "Check if mattermost service is running. Restart service if needed."
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /root/bin/monitoring/check_local_mattermost_service.sh > /dev/null 2>&1"
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
cron_user_entries:
|
||||
|
||||
- name: "Check if mattermost service ist running - Restart Service if needed."
|
||||
minute: '*/16'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_local_mattermost_service.sh
|
||||
|
||||
- name: "Check if SSH service is running. Restart service if needed."
|
||||
minute: '*/5'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_postfix.sh
|
||||
|
||||
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
|
||||
minute: '01'
|
||||
hour: '05'
|
||||
job: /var/lib/dehydrated/cron/dehydrated_cron.sh
|
||||
|
||||
- name: "Check whether all certificates are included in the VHOST configurations"
|
||||
minute: '33'
|
||||
hour: '05'
|
||||
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
extra_user:
|
||||
|
||||
- name: nd-admin
|
||||
user_id: 1045
|
||||
group_id: 1045
|
||||
group: nd-admin
|
||||
password: $y$j9T$1YJwHY0qdLimgtdOKlTxR1$/O9QWTpr0Y41TduR2GZ0FMCiIxFqOaXWSM9hmHRnv80
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTjd4XFBdF/V9VdSZjy9G7nupBwaMqsrtQSP4Uctkrz org@rdsgn.de'
|
||||
|
||||
sudo_users:
|
||||
- chris
|
||||
- sysadm
|
||||
- nd-admin
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
# ipt-firewall configuration for a.ns.oopen.de
|
||||
# Generated by extract-fw-host-vars.py - review before committing!
|
||||
# Place in: host_vars/<hostname>/ipt_firewall.yml
|
||||
|
||||
fw_manage_config: true
|
||||
|
||||
# --- Network
|
||||
fw_ext_interfaces:
|
||||
- "eth0"
|
||||
fw_ext_ips_v4:
|
||||
- "95.216.231.187"
|
||||
fw_ext_ips_v6:
|
||||
- "2a01:4f9:3080:3d2d::187"
|
||||
|
||||
# --- Munin
|
||||
munin_remote_ipv4: 37.27.121.227
|
||||
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
|
||||
|
||||
# --- HTTP
|
||||
fw_http_server_ips: $ext_1_ip
|
||||
|
||||
# --- Mail
|
||||
fw_mail_client_ips: $ext_1_ip
|
||||
@@ -264,10 +264,10 @@ cron_user_entries:
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check connectifity - reboot if needed"
|
||||
minute: '*/10'
|
||||
hour: '*'
|
||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
# - name: "Check connectifity - reboot if needed"
|
||||
# minute: '*/10'
|
||||
# hour: '*'
|
||||
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
|
||||
@@ -245,10 +245,10 @@ cron_user_entries:
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check connectifity - reboot if needed"
|
||||
minute: '*/10'
|
||||
hour: '*'
|
||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
# - name: "Check connectifity - reboot if needed"
|
||||
# minute: '*/10'
|
||||
# hour: '*'
|
||||
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
|
||||
@@ -262,10 +262,10 @@ cron_user_entries:
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check connectifity - reboot if needed"
|
||||
minute: '*/10'
|
||||
hour: '*'
|
||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
# - name: "Check connectifity - reboot if needed"
|
||||
# minute: '*/10'
|
||||
# hour: '*'
|
||||
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
|
||||
@@ -259,10 +259,10 @@ cron_user_entries:
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check connectifity - reboot if needed"
|
||||
minute: '*/10'
|
||||
hour: '*'
|
||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
# - name: "Check connectifity - reboot if needed"
|
||||
# minute: '*/10'
|
||||
# hour: '*'
|
||||
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
|
||||
@@ -257,10 +257,10 @@ cron_user_entries:
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check connectifity - reboot if needed"
|
||||
minute: '*/10'
|
||||
hour: '*'
|
||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
# - name: "Check connectifity - reboot if needed"
|
||||
# minute: '*/10'
|
||||
# hour: '*'
|
||||
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
|
||||
@@ -258,10 +258,10 @@ cron_user_entries:
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check connectifity - reboot if needed"
|
||||
minute: '*/10'
|
||||
hour: '*'
|
||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
# - name: "Check connectifity - reboot if needed"
|
||||
# minute: '*/10'
|
||||
# hour: '*'
|
||||
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
|
||||
@@ -259,10 +259,10 @@ cron_user_entries:
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check connectifity - reboot if needed"
|
||||
minute: '*/10'
|
||||
hour: '*'
|
||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
# - name: "Check connectifity - reboot if needed"
|
||||
# minute: '*/10'
|
||||
# hour: '*'
|
||||
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
|
||||
@@ -259,10 +259,10 @@ cron_user_entries:
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check connectifity - reboot if needed"
|
||||
minute: '*/10'
|
||||
hour: '*'
|
||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
# - name: "Check connectifity - reboot if needed"
|
||||
# minute: '*/10'
|
||||
# hour: '*'
|
||||
# job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
|
||||
@@ -306,6 +306,8 @@ cl-nd.oopen.de
|
||||
# o45 - mm matomom h.mc
|
||||
o45.oopen.de
|
||||
mm-nd.oopen.de
|
||||
mm-nd-test.oopen.de
|
||||
h.mx.oopen.de
|
||||
|
||||
# Hetzner Cloud
|
||||
cl-nd-test.oopen.de
|
||||
@@ -539,6 +541,8 @@ cl-nd.oopen.de
|
||||
# o45 - mm matomom h.mc
|
||||
o45.oopen.de
|
||||
mm-nd.oopen.de
|
||||
mm-nd-test.oopen.de
|
||||
h.mx.oopen.de
|
||||
|
||||
# Hetzner Cloud
|
||||
cl-nd-test.oopen.de
|
||||
@@ -828,6 +832,9 @@ web-nd.oopen.de
|
||||
# o44 - ND cloud
|
||||
cl-nd.oopen.de
|
||||
|
||||
# o45 - mm mm-test h.mx
|
||||
h.mx.oopen.de
|
||||
|
||||
# Hetzner Cloud
|
||||
cl-nd-test.oopen.de
|
||||
|
||||
@@ -994,6 +1001,7 @@ web-nd.oopen.de
|
||||
|
||||
# o45 - ND
|
||||
mm-nd.oopen.de
|
||||
mm-nd-test.oopen.de
|
||||
|
||||
# GA - Gemeinschaft Altensclirf
|
||||
ga-st-services.ga.netz
|
||||
@@ -1043,6 +1051,9 @@ b.mx.oopen.de
|
||||
# o40 - g.mx
|
||||
g.mx.oopen.de
|
||||
|
||||
# o45 - h.mx
|
||||
h.mx.oopen.de
|
||||
|
||||
# ---
|
||||
# O.OPEN office network
|
||||
# ---
|
||||
@@ -1109,7 +1120,8 @@ web-03.oopen.de
|
||||
# o40 - g.mx
|
||||
g.mx.oopen.de
|
||||
|
||||
# o39.oopen.de
|
||||
# o45 - h.mx
|
||||
h.mx.oopen.de
|
||||
|
||||
# ---
|
||||
# O.OPEN office network
|
||||
@@ -1142,6 +1154,7 @@ prometheus-nd.oopen.de
|
||||
|
||||
# o45 - ND
|
||||
mm-nd.oopen.de
|
||||
mm-nd-test.oopen.de
|
||||
|
||||
|
||||
[mysql_server]
|
||||
@@ -1420,6 +1433,9 @@ b.mx.oopen.de
|
||||
# o40 - g.mx
|
||||
g.mx.oopen.de
|
||||
|
||||
# o45 - h.mx
|
||||
h.mx.oopen.de
|
||||
|
||||
# ---
|
||||
# O.OPEN office network
|
||||
# ---
|
||||
@@ -1800,6 +1816,8 @@ cl-nd.oopen.de
|
||||
|
||||
# o45 - ND
|
||||
mm-nd.oopen.de
|
||||
mm-nd-test.oopen.de
|
||||
h.mx.oopen.de
|
||||
|
||||
# Hetzner Cloud
|
||||
cl-nd-test.oopen.de
|
||||
@@ -2059,6 +2077,8 @@ cl-nd.oopen.de
|
||||
# o45 - mm matomom h.mc
|
||||
o45.oopen.de
|
||||
mm-nd.oopen.de
|
||||
mm-nd-test.oopen.de
|
||||
h.mx.oopen.de
|
||||
|
||||
# Hetzner Cloud
|
||||
cl-nd-test.oopen.de
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ---
|
||||
# Trusted networks whitelisted by postfwd
|
||||
#
|
||||
# Example:
|
||||
#
|
||||
# # web0.warenform.de
|
||||
# #83.223.86.76
|
||||
# #2a01:30:0:505:286:96ff:fe4a:6ee
|
||||
# #2a01:30:0:13:286:96ff:fe4a:6eee
|
||||
#
|
||||
# ---
|
||||
|
||||
# give truested networrk adresses here
|
||||
|
||||
# d.mx.oopen.de (listen server)
|
||||
95.217.204.227
|
||||
2a01:4f9:4a:47e5::227
|
||||
@@ -0,0 +1,7 @@
|
||||
-----BEGIN OPENSSH PRIVATE KEY-----
|
||||
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
||||
QyNTUxOQAAACDTXB9m2b3Ez7Fhcq1ZTAx+Q84/1nD450ojalp9er82aQAAAJA2BTpdNgU6
|
||||
XQAAAAtzc2gtZWQyNTUxOQAAACDTXB9m2b3Ez7Fhcq1ZTAx+Q84/1nD450ojalp9er82aQ
|
||||
AAAEBo2N/3clJE7mgMTLLGS/pVqz5TNGL89spOn5BZ0UyzuNNcH2bZvcTPsWFyrVlMDH5D
|
||||
zj/WcPjnSiNqWn16vzZpAAAACmNocmlzQGx1bmEBAgM=
|
||||
-----END OPENSSH PRIVATE KEY-----
|
||||
@@ -0,0 +1 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNcH2bZvcTPsWFyrVlMDH5Dzj/WcPjnSiNqWn16vzZp root@h.mx-dehydrated
|
||||
@@ -0,0 +1,7 @@
|
||||
-----BEGIN OPENSSH PRIVATE KEY-----
|
||||
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
||||
QyNTUxOQAAACAZc/qkhVCyCMZK9/sTo2w08zSVx79SfQ9DTPP6Oop1PwAAAJDehrho3oa4
|
||||
aAAAAAtzc2gtZWQyNTUxOQAAACAZc/qkhVCyCMZK9/sTo2w08zSVx79SfQ9DTPP6Oop1Pw
|
||||
AAAECaXByIL6yHuFazBHLv/6QZM8V7F/Fv5o5mgKuoEcJ2Shlz+qSFULIIxkr3+xOjbDTz
|
||||
NJXHv1J9D0NM8/o6inU/AAAACmNocmlzQGx1bmEBAgM=
|
||||
-----END OPENSSH PRIVATE KEY-----
|
||||
@@ -0,0 +1 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlz+qSFULIIxkr3+xOjbDTzNJXHv1J9D0NM8/o6inU/ root@h.mx-opendkim
|
||||
@@ -0,0 +1,177 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ---------------------------------------------------------
|
||||
# - Parameter Settings for script 'create_opendkim_key.sh'.
|
||||
# ---------------------------------------------------------
|
||||
|
||||
|
||||
# ----------
|
||||
# DNS Server
|
||||
# ----------
|
||||
|
||||
# - dns_dkim_zone_master_server
|
||||
# -
|
||||
# - The DNS Server who is serving the update zone and is used
|
||||
# - for the dynamic updates (nsupdate)
|
||||
# -
|
||||
#dns_dkim_zone_master_server=""
|
||||
dns_dkim_zone_master_server="b.ns.oopen.de"
|
||||
|
||||
# - update_dns
|
||||
# -
|
||||
# - Possible Values are 'true' or 'false'
|
||||
# -
|
||||
#update_dns=true
|
||||
|
||||
# - update_zone
|
||||
# -
|
||||
# - Zone containing the DKIM TXT record.
|
||||
# -
|
||||
# - Defaults to '_domainkey.<dkim_domaini>'
|
||||
# -
|
||||
# - Note:
|
||||
# - do NOT change/set this option unless you know what you do.
|
||||
# -
|
||||
#update_zone=""
|
||||
|
||||
# - TTL
|
||||
# -
|
||||
# - TTL for the DKIM TXT Record.
|
||||
# -
|
||||
# - Defaults to "" if update_dns=false
|
||||
# - Defaults to "43200" if update_dns=true
|
||||
# -
|
||||
#TTL=
|
||||
|
||||
|
||||
# ----------
|
||||
# TSIG Key
|
||||
# ----------
|
||||
|
||||
# - key_secret
|
||||
# -
|
||||
# - Sectret Key used by 'nsupdate' to create/update the
|
||||
# - DKIM TXT record.
|
||||
# -
|
||||
# - Example:
|
||||
# - key_secret="EtvvMdW0PXD4GMHP+onuHZ0dT/Z8OSJGlce/xH10OwI="
|
||||
# -
|
||||
#key_secret=""
|
||||
key_secret="4woPu0jqf9Jp1IX+gduJ3BVW/1ZMeyCPTQMqEsMXLFw="
|
||||
|
||||
# - key_algo
|
||||
# -
|
||||
# - The key algorithm used for key creation. Available choices are: hmac-md5,
|
||||
# - hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and hmac-sha512. The
|
||||
# - default is hmac-sha256. Options are case-insensitive.
|
||||
# -
|
||||
# - Example:
|
||||
# - key_algo="hmac-md5"
|
||||
# -
|
||||
# - Defaults to 'hmac-sha256'
|
||||
# -
|
||||
#key_algo="hmac-sha256"
|
||||
key_algo="hmac-sha256"
|
||||
|
||||
# - key_name
|
||||
# -
|
||||
# - Name of the Key
|
||||
# -
|
||||
# - Defaults to "$update_zone"
|
||||
# -
|
||||
#key_name=""
|
||||
key_name="update-dkim"
|
||||
|
||||
|
||||
# ----------
|
||||
# Access Credentials DNS Server
|
||||
# ----------
|
||||
|
||||
# - dns_ssh_user
|
||||
# -
|
||||
# - Defaults to 'manage-bind'
|
||||
# -
|
||||
#dns_ssh_user="manage-bind"
|
||||
|
||||
# - dns_ssh_port
|
||||
# -
|
||||
# - Defaults to '22'
|
||||
# -
|
||||
#dns_ssh_port=22
|
||||
|
||||
# - dns_ssh_key
|
||||
# -
|
||||
# - Defaults to '/root/.ssh/id_rsa-opendkim'
|
||||
# -
|
||||
#dns_ssh_key="/root/.ssh/id_rsa-opendkim"
|
||||
dns_ssh_key="/root/.ssh/id_ed25519-opendkim"
|
||||
|
||||
|
||||
# ----------
|
||||
# Scripts envoked at DNS Server
|
||||
# ----------
|
||||
|
||||
# - set_new_serial_script
|
||||
# -
|
||||
# - Script increases the serial for a given domain or a given
|
||||
# - hostname's concerning domain.
|
||||
# -
|
||||
# - Defaults to /root/bin/bind/bind_set_new_serial.sh
|
||||
# -
|
||||
#set_new_serial_script="/root/bin/bind/bind_set_new_serial.sh"
|
||||
|
||||
# - create_dkim_delegation_script
|
||||
# -
|
||||
# - Script adds DKIM subdomain delegation for a given domain
|
||||
# -
|
||||
# - Defaults to '/root/bin/bind/bind_create_dkim_delegation.sh'
|
||||
# -
|
||||
#create_dkim_delegation_script="/root/bin/bind/bind_create_dkim_delegation.sh"
|
||||
|
||||
# - add_dkim_zone_master_script
|
||||
# -
|
||||
# - Script adds zone _domainkey.<dkim domain> as master zone
|
||||
# -
|
||||
# - Defaults to '/root/bin/bind/bind_add_dkim_zone_master.sh'
|
||||
# -
|
||||
#add_dkim_zone_master_script="/root/bin/bind/bind_add_dkim_zone_master.sh"
|
||||
|
||||
# - add_dkim_zone_slave_script
|
||||
# -
|
||||
# - Script adds zone _domainkey.<dkim domain> as slave zone
|
||||
# -
|
||||
# - Defaults to '/root/bin/bind/bind_add_dkim_zone_slave.sh'
|
||||
# -
|
||||
#add_dkim_zone_slave_script="/root/bin/bind/bind_add_dkim_zone_slave.sh"
|
||||
|
||||
|
||||
|
||||
# ----------
|
||||
# OpenDKIM Installation
|
||||
# ----------
|
||||
|
||||
# - opendkim_dir
|
||||
# -
|
||||
# - OpenDKIM's etc-directory
|
||||
# -
|
||||
# - Defaults to opendkim_dir="/etc/opendkim"
|
||||
# -
|
||||
#opendkim_dir="/etc/opendkim"
|
||||
|
||||
# - key_base_dir
|
||||
# -
|
||||
# - Defaults to "${opendkim_dir}/keys"
|
||||
# -
|
||||
#key_base_dir=${opendkim_dir}/keys
|
||||
|
||||
# - signing_table_file
|
||||
# -
|
||||
# - Defaults to "${opendkim_dir}/signing.table"
|
||||
# -
|
||||
#signing_table_file="${opendkim_dir}/signing.table"
|
||||
|
||||
# - key_table_file
|
||||
# -
|
||||
# - Defaults to "${opendkim_dir}/key.table"
|
||||
# -
|
||||
#key_table_file="${opendkim_dir}/key.table"
|
||||
@@ -0,0 +1,44 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ======================================================
|
||||
# ---
|
||||
# Parameter Settings for Script 'whitelist_mb_sigs.conf'
|
||||
# ---
|
||||
# ======================================================
|
||||
|
||||
# QUARANTINE_BASE_DIR
|
||||
#
|
||||
# Base directory where amavis stores quarantined e-mails, mostly in
|
||||
#
|
||||
# virus e-mails: $QUARANTINE_BASE_DIR/virus
|
||||
# spam emails: $QUARANTINE_BASE_DIR/spam
|
||||
# ..
|
||||
#
|
||||
# Defaults to:
|
||||
# QUARANTINE_BASE_DIR="/var/QUARANTINE"
|
||||
#
|
||||
#QUARANTINE_BASE_DIR="/var/QUARANTINE"
|
||||
|
||||
|
||||
# CLAMAV_VIRUS_WHITE_LIST
|
||||
#
|
||||
# Full path to clamav's (personal) white list file
|
||||
#
|
||||
# Defaults to:
|
||||
# CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
|
||||
#
|
||||
#CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
|
||||
|
||||
|
||||
# WHITE_LIST_STRINGS
|
||||
#
|
||||
# A blank separated list of strings to whitelist.
|
||||
#
|
||||
# Example:
|
||||
# WHITE_LIST_STRINGS="google.com tinyurl.com"
|
||||
#
|
||||
# Defaults to:
|
||||
# WHITE_LIST_STRINGS="google.com"
|
||||
#
|
||||
#WHITE_LIST_STRINGS="google.com"
|
||||
WHITE_LIST_STRINGS="google.com tinyurl.com"
|
||||
@@ -196,6 +196,16 @@
|
||||
# ----------
|
||||
# unattended upgrades
|
||||
# ----------
|
||||
#
|
||||
|
||||
- name: (basic.yml) update
|
||||
ansible.builtin.command: apt-get update # noqa: command-instead-of-module
|
||||
changed_when: false
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- apt_update|bool
|
||||
|
||||
- name: (basic.yml) install unattended-upgrades
|
||||
ansible.builtin.apt:
|
||||
|
||||
@@ -59,6 +59,20 @@
|
||||
- copy-files
|
||||
- copy-template-files
|
||||
|
||||
- name: (copy_files.yml) Ensure directory /etc/postfix exists
|
||||
ansible.builtin.file:
|
||||
path: /etc/postfix
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when:
|
||||
- inventory_hostname in groups['mail_server']
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-plain-files
|
||||
- copy-template-files
|
||||
|
||||
- name: (copy_files.yml) GLOBAL copy plain files Postfix (/etc/postfix)
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src_path }}"
|
||||
|
||||
Reference in New Issue
Block a user