diff --git a/group_vars/all/main.yml b/group_vars/all/main.yml index 8247d9f..9c87031 100644 --- a/group_vars/all/main.yml +++ b/group_vars/all/main.yml @@ -2603,6 +2603,8 @@ git_other_repositories: [] nfs_server: {} +nfs_start_servers: 16 + # Set 'fs_encrypted' to true if filesystem lives on an encrypted # partition. # diff --git a/host_vars/nd-archiv.warenform.de.yml b/host_vars/nd-archiv.warenform.de.yml new file mode 100644 index 0000000..6a232bd --- /dev/null +++ b/host_vars/nd-archiv.warenform.de.yml @@ -0,0 +1,226 @@ +--- + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + + +# --- +# vars used by roles/common/tasks/apt.yml +# --- + +apt_install_extra_pkgs: true +apt_extra_pkgs: + - wkhtmltopdf + - pdftk + - subversion + - subversion-tools + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 212.42.230.1 + - 83.223.66.51 + - 83.223.90.90 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +#resolved_domains: [] +resolved_domains: + - ~. + - warenform.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 194.150.168.168 + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + +create_sftp_group: false + +insert_ssh_keypair_backup_server: false +ssh_keypair_backup_server: + - name: backup + backup_user: back + priv_key_src: root/.ssh/id_rsa.backup.warenform.de + priv_key_dest: /root/.ssh/id_rsa + pub_key_src: root/.ssh/id_rsa.backup.warenform.de.pub + pub_key_dest: /root/.ssh/id_rsa.pub + +insert_keypair_backup_client: true +ssh_keypair_backup_client: + - name: backup + priv_key_src: root/.ssh/id_ed25519.warenform-server + priv_key_dest: /root/.ssh/id_ed25519 + pub_key_src: root/.ssh/id_ed25519.warenform-server.pub + pub_key_dest: /root/.ssh/id_ed25519.pub + target: backup.warenform.de + + +default_user: + + - name: chris + password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL. + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: axel + password: $6$zUWC465e$XblctxwnBIOa7mPcN6foEQrwChjpwoY7lLtacXJrSsvjZS3I6Ox1mYUtN3/gzkvpbzOPx/9PlRJV.mbl939mD. + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICOPnP788dlfeFi9oo8UkS0Chi/jcxUGjsOuQnxW/GR+ axel@wf.netz' + + - name: sysadm + user_id: 1050 + group_id: 1050 + password: $6$vvccwrTc$Sz1HaSb3ujObprltiG7D6U1Rr3fpgfjkKuDDWYdHzPkPx/0pEofCWC.vyTn78hcemkntl.6wVUOnJnNloKt/E/ + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICOPnP788dlfeFi9oo8UkS0Chi/jcxUGjsOuQnxW/GR+ axel@wf.netz' + + - name: localadmin + user_id: 1051 + group_id: 1051 + password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90 + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: back + user_id: 1060 + group_id: 1060 + password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n. + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + +sudo_users: + - chris + - axel + - sysadm + - localadmin + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- + +git_firewall_repository: + name: ipt-server + repo: https://git.oopen.de/firewall/ipt-server + dest: /usr/local/src/ipt-server + + +# ============================== + + +# --- +# vars used by scripts/reset_root_passwd.yml +# --- + +root_user: + name: root + password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. + diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml index 93b3cba..5733ad0 100644 --- a/roles/common/handlers/main.yml +++ b/roles/common/handlers/main.yml @@ -88,3 +88,8 @@ service: name: systemd-resolved state: restarted + +- name: Restart nfs-kernel-server + service: + name: nfs-kernel-server + state: restarted diff --git a/roles/common/tasks/nfs.yml b/roles/common/tasks/nfs.yml index 0960de8..24b6403 100644 --- a/roles/common/tasks/nfs.yml +++ b/roles/common/tasks/nfs.yml @@ -61,6 +61,68 @@ tags: - nfs-server +# --- +# /etc/default/nfs-kernel-server (Server) +# --- + +- name: (nfs.yml) Check if file '/etc/default/nfs-kernel-server.ORIG' exists + stat: + path: /etc/default/nfs-kernel-server + register: default_nfs_kernel_server_exists + when: + - "groups['nfs_server']|string is search(inventory_hostname)" + tags: + - nfs-server + +- name: (nfs.yml) Backup existing file /etc/default/nfs-kernel-server + command: cp -a /etc/default/nfs-kernel-server /etc/default/nfs-kernel-server.ORIG + when: + - "groups['nfs_server']|string is search(inventory_hostname)" + - default_nfs_kernel_server_exists.stat.exists == False + tags: + - nfs-server + +- name: (nfs.yml) Adjust file /etc/default/nfs-kernel-server - set 'RPCNFSDCOUNT' (server) + replace: + path: /etc/default/nfs-kernel-server + regexp: '^RPCNFSDCOUNT=.*' + replace: "RPCNFSDCOUNT={{ nfs_start_servers | default('16') }}" + when: + - "groups['nfs_server']|string is search(inventory_hostname)" + tags: + - nfs-server + +# --- +# Configuration Server +# --- + +- name: (nfs.yml) Ensure directory '/etc/nfs.conf.d' exists + file: + path: /etc/nfs.conf.d + state: directory + mode: 0755 + group: root + owner: root + when: + - inventory_hostname in groups['nfs_server'] + tags: + - nfs-server + + +- name: (nfs.yml) Create/Update file '/etc/nfs.conf.d/20-start_servers.conf' from template '20-start_servers.conf.j2' + template: + src: etc/nfs.conf.d/20-start_servers.conf.j2 + dest: /etc/nfs.conf.d/20-start_servers.conf + owner: root + group: root + mode: 0644 + notify: "Restart nfs-kernel-server" + when: + - inventory_hostname in groups['nfs_server'] + tags: + - nfs-server + + # --- # NFS clients # --- diff --git a/roles/common/templates/etc/nfs.conf.d/20-start_servers.conf.j2 b/roles/common/templates/etc/nfs.conf.d/20-start_servers.conf.j2 new file mode 100644 index 0000000..d704895 --- /dev/null +++ b/roles/common/templates/etc/nfs.conf.d/20-start_servers.conf.j2 @@ -0,0 +1,4 @@ +# {{ ansible_managed }} + +[nfsd] +threads={{ nfs_start_servers | default('16') }}