Initial commit

2019-06-28 02:28:50 +02:00
commit 21fcd86115
107 changed files with 8346 additions and 0 deletions
--- a/roles/common/vars/git-debian.yml
+++ b/roles/common/vars/git-debian.yml
@@ -0,0 +1,218 @@
+# vars file for git
+---
+
+# ---
+# all servers
+# ---
+git_default_repositories:
+
+  # script repositories (destination /root/bin/)
+  - name: admin-stuff
+    repo: https://git.oopen.de/script/admin-stuff
+    dest: /root/bin/admin-stuff
+
+  - name: postfix
+    repo: https://git.oopen.de/script/postfix
+    dest: /root/bin/postfix
+
+  # install repositories (destination: /usr/local/src/)
+  - name: mailsystem
+    repo: https://git.oopen.de/install/mailsystem
+    dest: /usr/local/src/mailsystem
+
+# ---
+# group [lxc_host]
+# ---
+git_lxc_host_repositories:
+
+  # Monitoring
+  - name: monitoring
+    repo: https://git.oopen.de/script/monitoring
+    dest: /root/bin/monitoring
+  
+  # LXC
+  - name: LXC
+    repo: https://git.oopen.de/script/LXC
+    dest: /root/bin/LXC
+
+  # firewall
+  - name: ipt-server
+    repo: https://git.oopen.de/firewall/ipt-server
+    dest: /usr/local/src/ipt-server
+
+# ---
+# group [lxc_guest]
+# ---
+git_lxc_guest_repositories:
+
+  # dehydrated-cron
+  - name: dehydrated-cron
+    repo: https://git.codecoop.org/so36intern/dehydrated-cron.git
+    dest: /usr/local/src/dehydrated-cron
+
+  # firewall
+  - name: ipt-server
+    repo: https://git.oopen.de/firewall/ipt-server
+    dest: /usr/local/src/ipt-server
+
+
+# ---
+# group [apache2_webserver]
+# ---
+git_apache2_repositories:
+  # script repositories (destination /root/bin/)
+  - name: apache2
+    repo: https://git.oopen.de/script/apache2
+    dest: /root/bin/apache2
+
+  # install repositories (destination: /usr/local/src/)
+  - name: apache2
+    repo: https://git.oopen.de/install/apache2
+    dest: /usr/local/src/apache2
+
+  - name: php
+    repo: https://git.oopen.de/install/php
+    dest: /usr/local/src/php
+
+
+# ---
+# group [nginx_webserver]
+# ---
+git_nginx_repositories: []
+
+
+# ---
+# group [mysql_server]
+# ---
+git_mysql_repositories:
+
+  # script repositories (destination /root/bin/)
+  - name: mysql
+    repo: https://git.oopen.de/script/mysql
+    dest: /root/bin/mysql
+
+  # install repositories (destination: /usr/local/src/)
+  - name: mysql
+    repo: https://git.oopen.de/install/mysql
+    dest: /usr/local/src/mysql
+    
+
+# ---
+# group [postgresql_server]
+# ---
+git_postgresql_repositories:
+
+  # script repositories (destination /root/bin/)
+  - name: postgres
+    repo: https://git.oopen.de/script/postgres
+    dest: /root/bin/postgres
+
+
+# ---
+# group [nextcloud_server]
+# ---
+git_nextcloud_repositories:
+
+  # script repositories (destination /root/bin/)
+  - name: nextcloud
+    repo: https://git.oopen.de/script/nextcloud
+    dest: /root/bin/nextcloud
+
+  # install repositories (destination: /usr/local/src/)
+  - name: nextcloud
+    repo: https://git.oopen.de/install/nextcloud
+    dest: /usr/local/src/nextcloud
+
+
+# ---
+# group [dns_server]
+# ---
+git_dns_repositories:
+
+  # script repositories (destination /root/bin/)
+  - name: bind
+    repo: https://git.oopen.de/script/bind
+    dest: /root/bin/bind
+
+
+# ---
+# group [backup_server]
+# ---
+git_backup_repositories:
+
+  # script repositories (destination /root/bin/)
+  - name: backup-rcopy
+    repo: https://git.oopen.de/backup/backup-rcopy
+    dest: /root/crontab/backup-rcopy
+
+
+# ---
+# group [samba_server]
+# ---
+git_samba_repositories:
+
+  # script repositories (destination /root/bin/)
+  - name: samba
+    repo: https://git.oopen.de/script/samba
+    dest: /root/bin/samba
+
+
+# ---
+# group  [mail_server]
+# ---
+git_mailserver_repositories:
+
+  # script repositories (destination /root/bin/)
+  - name: apache2
+    repo: https://git.oopen.de/script/apache2
+    dest: /root/bin/apache2
+
+  - name: postfix
+    repo: https://git.oopen.de/script/postfix
+    dest: /root/bin/postfix
+
+  - name: monitoring
+    repo: https://git.oopen.de/script/monitoring
+    dest: /root/bin/monitoring
+
+  # install repositories (destination: /usr/local/src/)
+  - name: apache2
+    repo: https://git.oopen.de/install/apache2
+    dest: /usr/local/src/apache2
+
+  - name: php
+    repo: https://git.oopen.de/install/php
+    dest: /usr/local/src/php
+
+  - name: mailsystem
+    repo: https://git.oopen.de/install/mailsystem
+    dest: /usr/local/src/mailsystem
+
+  # let's encrypt
+  - name: dehydrated-cron
+    repo: https://git.codecoop.org/so36intern/dehydrated-cron.git
+    dest: /usr/local/src/dehydrated-cron
+
+  # firewall
+  - name: ipt-server
+    repo: https://git.oopen.de/firewall/ipt-server
+    dest: /usr/local/src/ipt-server
+
+
+# ---
+# group [sympa_list_servers]
+# ---
+git_sympa_repositories:
+
+  # install repositories (destination: /usr/local/src/)
+  - name: sympa
+    repo: https://git.oopen.de/install/sympa
+    dest: /usr/local/src/sympa
+
+
+# ---
+# Use this for host specific repositories defined in  files git-<hostname>.yaml
+#
+# Leave empty here
+# ---
+git_other_repositories: []
--- a/roles/common/vars/sudoers-debian.yml
+++ b/roles/common/vars/sudoers-debian.yml
@@ -0,0 +1,87 @@
+# vars file for sudoers
+---
+
+# ---
+# /etc/sudoers
+# ---
+
+sudoers_defaults:
+  - env_reset
+  - mail_badpass
+  - 'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"'
+
+sudoers_host_aliases: []
+
+sudoers_user_aliases: []
+
+sudoers_cmnd_aliases: []
+
+sudoers_runas_aliases: []
+
+sudoers_user_privileges:
+  - name: root
+    entry: 'ALL=(ALL:ALL) ALL'
+
+sudoers_group_privileges: []
+
+sudoers_remove_user:
+  - back
+  - www-data
+
+
+# ---
+# /etc/sudoers.d/50-user
+# ---
+
+sudoers_file_defaults: []
+
+sudoers_file_host_aliases: []
+
+sudoers_file_user_aliases: []
+
+sudoers_file_cmnd_aliases: []
+
+sudoers_file_runas_aliases: []
+
+sudoers_file_user_back_privileges:
+  - 'ALL=(root) NOPASSWD: /usr/bin/rsync'
+  - 'ALL=(root) NOPASSWD: /usr/bin/find'
+  - 'ALL=(root) NOPASSWD: /usr/bin/realpath'
+
+sudoers_file_user_back_postgres_privileges:
+  - 'ALL=(postgres) NOPASSWD: /usr/bin/psql'
+  - 'ALL=(postgres) NOPASSWD: /usr/bin/pg_dump'
+  - 'ALL=(postgres) NOPASSWD: /usr/bin/pg_dumpall'
+
+sudoers_file_user_back_disk_privileges:
+  - 'ALL=(root) NOPASSWD: /usr/bin/which'
+  - 'ALL=(root) NOPASSWD: /sbin/hdparm -I /dev/*'
+  - 'ALL=(root) NOPASSWD: /sbin/fdisk'
+  - 'ALL=(root) NOPASSWD: /sbin/sgdisk'
+  - 'ALL=(root) NOPASSWD: /sbin/sfdisk -d /dev/*'
+  - 'ALL=(root) NOPASSWD: /bin/dd if=/dev/*'
+  - 'ALL=(root) NOPASSWD: /sbin/parted'
+  - 'ALL=(root) NOPASSWD: /sbin/gdisk'
+
+sudoers_file_user_webadmin_disk_privileges:
+  - 'ALL=(root) NOPASSWD: /usr/bin/mailq'
+  - 'ALL=(root) NOPASSWD: /usr/bin/tail'
+  - 'ALL=(root) NOPASSWD: /usr/bin/view'
+
+sudoers_file_dns_server_privileges:
+  - name: manage-bind
+    entry: 'ALL=(root) NOPASSWD: /usr/local/bin/bind_*'
+  - name: manage-bind
+    entry: 'ALL=(root) NOPASSWD: /root/bin/bind/bind_*'
+  - name: chris
+    entry: 'ALL=(root) NOPASSWD: /root/bin/bind/*'
+
+sudoers_file_postfixadmin_privileges:
+  - name: www-data
+    entry: 'ALL=(vmail)NOPASSWD: /usr/local/bin/postfixadmin-mailbox-postdeletion.sh'
+  - name: www-data
+    entry: 'ALL=(vmail)NOPASSWD: /usr/local/bin/postfixadmin-domain-postdeletion.sh'
+
+sudoers_file_user_privileges: []
+
+sudoers_file_group_privileges: []