From 3a73ed9583935a7b4c44f222c96276155d05d01b Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 3 Nov 2026 23:08:58 +0100 Subject: [PATCH] Inventory cleanup; add ipt-server host_vars for all ipt hosts. - hosts: remove unreachable/decommissioned hosts (file-ah-neu, file-ah-alt, file-km-neu, ga-al-gw-neu, gw-opp-neu, zapata-neu, zapata-alt, bbb-server, ki-fm, server28, ...) and duplicate aliases (etherpad = b.ns, cl-irights-neu = cl-irights, oolm-db = o21, devel-ruby = devel-todo). - host_vars: add -ipt-server.yml (fw_manage_config: false) for all hosts running the ipt-server firewall, generated by extract-fw-host-vars.py. - host_vars: move/remove obsolete host directories, replace alias directories by symlinks (cl-lubax -> o32, cl-vbrg -> o34, oolm-db -> o21). Co-Authored-By: Claude Opus 5.5 --- .../bbb-server-common.yml | 0 .../cl-vbrg.oopen.de/cl-vbrg-common.yml} | 118 ++-- .../cl-vbrg.oopen.de/cl-vbrg-ipt-server.yml | 33 + host_vars/backup.oopen.de/backup-common.yml | 1 + .../backup.so36.net/backup-ipt-server.yml | 21 + host_vars/c.mx.oopen.de/c.mx-ipt-server.yml | 38 ++ .../cl-exil-ipt-server.yml} | 10 +- host_vars/cl-lubax.oopen.de | 1 + .../cl-lubax.oopen.de/cl-lubax-common.yml | 151 ----- host_vars/cl-nd.oopen.de/cl-nd-ipt-server.yml | 24 + .../cl-opp.oopen.de/cl-opp-ipt-server.yml | 27 + host_vars/cl-vbrg.oopen.de | 1 + host_vars/cl-vbrg.oopen.de/cl-vbrg-common.yml | 72 --- .../cloud-giz-common.yml | 72 --- host_vars/cloud.akweb.de/cloud-ipt-server.yml | 27 + host_vars/comm.so36.net/comm-ipt-server.yml | 41 ++ host_vars/cp-01.oopen.de/cp-01-ipt-server.yml | 24 + .../cp-flr.oopen.de/cp-flr-ipt-server.yml | 24 + host_vars/d.mx.oopen.de/d.mx-ipt-server.yml | 35 + .../devnull.so36.net/devnull-ipt-server.yml | 39 ++ .../dns0.warenform.de/dns0-ipt-server.yml | 25 + .../dns1.warenform.de/dns1-ipt-server.yml | 25 + host_vars/e.mx.oopen.de/e.mx-ipt-server.yml | 35 + host_vars/g.mx.oopen.de/g.mx-ipt-server.yml | 27 + .../ga-al-gw.oopen.de/ga-al-gw-common.yml | 599 ------------------ .../ga-al-gw-neu-common.yml | 42 +- host_vars/git.oopen.de/git-ipt-server.yml | 24 + host_vars/git.warenform.de/git-ipt-server.yml | 29 + .../gw-opp-neu.opp.netz/gw-opp-neu-common.yml | 235 ------- .../iam-nd.oopen.de/iam-nd-ipt-server.yml | 24 + .../initiativenserver-ipt-server.yml | 30 + .../keycloak-nd-ipt-server.yml | 30 + host_vars/ki-fm.oopen.de/ki-fm-common.yml | 180 ------ .../lists.mx-ipt-server.yml | 37 ++ .../mail-neu.cadus.org/mail-neu-common.yml | 241 ------- host_vars/mail.cadus.org/mail-ipt-server.yml | 32 + .../mail-ipt-server.yml | 32 + .../matomo-01-ipt-server.yml | 27 + host_vars/meet.akweb.de/meet-ipt-server.yml | 32 + host_vars/meet.oopen.de/meet-ipt-server.yml | 29 + .../mm-migration-common.yml | 140 ---- ...mm-nd-common.yml => mm-nd-test-common.yml} | 0 ...t-server.yml => mm-nd-test-ipt-server.yml} | 0 host_vars/munin.oopen.de/munin-ipt-server.yml | 25 + host_vars/mx.warenform.de/mx-ipt-server.yml | 35 + .../nd-archiv-ipt-server.yml | 30 + .../nd-epaper-ipt-server.yml | 30 + .../nd-live-ipt-server.yml | 27 + host_vars/ns.so36net.de/ns-ipt-server.yml | 41 ++ host_vars/o12.oopen.de/o12-ipt-server.yml | 36 ++ .../o13-cryptpad-ipt-server.yml | 29 + .../o13-git.oopen.de/o13-git-ipt-server.yml | 21 + .../o13-mail.oopen.de/o13-mail-ipt-server.yml | 41 ++ .../o13-mumble-ipt-server.yml | 29 + .../o13-pad.oopen.de/o13-pad-ipt-server.yml | 29 + host_vars/o13.oopen.de/o13-ipt-server.yml | 27 + host_vars/o14.oopen.de/o14-ipt-server.yml | 30 + host_vars/o17.oopen.de/o17-ipt-server.yml | 39 ++ host_vars/o18.oopen.de/o18-ipt-server.yml | 26 + host_vars/o19.oopen.de/o19-ipt-server.yml | 29 + host_vars/o20.oopen.de/o20-ipt-server.yml | 30 + host_vars/o21.oopen.de/o21-ipt-server.yml | 39 ++ host_vars/o22.oopen.de/o22-ipt-server.yml | 40 ++ host_vars/o23.oopen.de/o23-ipt-server.yml | 46 ++ host_vars/o24.oopen.de/o24-ipt-server.yml | 26 + host_vars/o26.oopen.de/o26-ipt-server.yml | 28 + host_vars/o27.oopen.de/o27-ipt-server.yml | 34 + host_vars/o28.oopen.de/o28-ipt-server.yml | 29 + host_vars/o29.oopen.de/o29-ipt-server.yml | 30 + host_vars/o30.oopen.de/o30-ipt-server.yml | 35 + host_vars/o31.oopen.de/o31-ipt-server.yml | 36 ++ host_vars/o32.oopen.de/o32-common.yml | 13 +- .../o32-ipt-server.yml} | 9 +- host_vars/o33-neu.oopen.de/o33-neu-common.yml | 78 --- host_vars/o35.oopen.de/o35-ipt-server.yml | 46 ++ host_vars/o36.oopen.de/o36-ipt-server.yml | 46 ++ host_vars/o38.oopen.de/o38-ipt-server.yml | 38 ++ host_vars/o39.oopen.de/o39-ipt-server.yml | 40 ++ host_vars/o40.oopen.de/o40-ipt-server.yml | 34 + host_vars/o42.oopen.de/o42-ipt-server.yml | 29 + host_vars/o43.oopen.de/o43-ipt-server.yml | 42 ++ host_vars/o44.oopen.de/o44-ipt-server.yml | 35 + host_vars/oolm-db.oopen.de | 1 + host_vars/oolm-db.oopen.de/oolm-db-common.yml | 72 --- .../oolm-shop-dev-ipt-server.yml | 40 ++ .../oolm-web.oopen.de/oolm-web-ipt-server.yml | 39 ++ .../piwik.warenform.de/piwik-ipt-server.yml | 24 + .../prometheus-nd-ipt-server.yml | 30 + host_vars/rage.so36.net/rage-ipt-server.yml | 54 ++ .../resolver-a-ipt-server.yml | 38 ++ .../resolver-b-ipt-server.yml | 38 ++ .../schleuder3-ipt-server.yml | 34 + .../server18-ipt-server.yml | 29 + .../server22-ipt-server.yml | 41 ++ .../server23-ipt-server.yml | 33 + .../server24-ipt-server.yml | 31 + .../server25-ipt-server.yml | 33 + .../server26-ipt-server.yml | 34 + .../server27-ipt-server.yml | 34 + host_vars/shell.so36.net/shell-ipt-server.yml | 40 ++ .../shop-dev-common.yml | 205 ------ .../site36.net/site36.net-ipt-server.yml | 27 + .../stolpersteine-ipt-server.yml | 25 + host_vars/sympa.so36.net/sympa-ipt-server.yml | 41 ++ .../test.mariadb-ipt-server.yml | 27 + .../verdi-django-ipt-server.yml | 39 ++ .../verdi-es-ipt-server.yml | 40 ++ .../vvn-shop-ipt-server.yml | 30 + .../vvn-www-ipt-server.yml | 33 + .../web-02.oopen.de/web-02-ipt-server.yml | 35 + .../web-03.oopen.de/web-03-ipt-server.yml | 33 + .../web-04.oopen.de/web-04-ipt-server.yml | 34 + .../web-05.oopen.de/web-05-ipt-server.yml | 32 + .../web-06.oopen.de/web-06-ipt-server.yml | 30 + .../web-07.oopen.de/web-07-ipt-server.yml | 30 + .../web-08.oopen.de/web-08-ipt-server.yml | 30 + .../web-09.oopen.de/web-09-ipt-server.yml | 32 + .../web-nd.oopen.de/web-nd-ipt-server.yml | 30 + host_vars/web.cadus.org/web-ipt-server.yml | 30 + host_vars/web.so36.net/web-ipt-server.yml | 44 ++ .../web1.warenform.de/web1-ipt-server.yml | 30 + .../web2.warenform.de/web2-ipt-server.yml | 30 + host_vars/wiki.cadus.org/wiki-common.yml | 152 ----- host_vars/www.oopen.de/www-common.yml | 75 --- .../zapata-alt.opp.netz/zapata-alt-common.yml | 487 -------------- hosts | 133 +--- 126 files changed, 3350 insertions(+), 2970 deletions(-) rename host_vars/{ => DELETED}/bbb-server.b3-bornim.netz/bbb-server-common.yml (100%) rename host_vars/{server28.warenform.de/server28-common.yml => DELETED/cl-vbrg.oopen.de/cl-vbrg-common.yml} (79%) create mode 100644 host_vars/DELETED/cl-vbrg.oopen.de/cl-vbrg-ipt-server.yml create mode 100644 host_vars/backup.so36.net/backup-ipt-server.yml create mode 100644 host_vars/c.mx.oopen.de/c.mx-ipt-server.yml rename host_vars/{ki-fm.oopen.de/ki-fm-ipt-server.yml => cl-exil.oopen.de/cl-exil-ipt-server.yml} (63%) create mode 120000 host_vars/cl-lubax.oopen.de delete mode 100644 host_vars/cl-lubax.oopen.de/cl-lubax-common.yml create mode 100644 host_vars/cl-nd.oopen.de/cl-nd-ipt-server.yml create mode 100644 host_vars/cl-opp.oopen.de/cl-opp-ipt-server.yml create mode 120000 host_vars/cl-vbrg.oopen.de delete mode 100644 host_vars/cl-vbrg.oopen.de/cl-vbrg-common.yml delete mode 100644 host_vars/cloud-giz.warenform.de/cloud-giz-common.yml create mode 100644 host_vars/cloud.akweb.de/cloud-ipt-server.yml create mode 100644 host_vars/comm.so36.net/comm-ipt-server.yml create mode 100644 host_vars/cp-01.oopen.de/cp-01-ipt-server.yml create mode 100644 host_vars/cp-flr.oopen.de/cp-flr-ipt-server.yml create mode 100644 host_vars/d.mx.oopen.de/d.mx-ipt-server.yml create mode 100644 host_vars/devnull.so36.net/devnull-ipt-server.yml create mode 100644 host_vars/dns0.warenform.de/dns0-ipt-server.yml create mode 100644 host_vars/dns1.warenform.de/dns1-ipt-server.yml create mode 100644 host_vars/e.mx.oopen.de/e.mx-ipt-server.yml create mode 100644 host_vars/g.mx.oopen.de/g.mx-ipt-server.yml delete mode 100644 host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml rename host_vars/{ga-al-gw-neu.ga.netz => ga-al-gw.oopen.de}/ga-al-gw-neu-common.yml (94%) create mode 100644 host_vars/git.oopen.de/git-ipt-server.yml create mode 100644 host_vars/git.warenform.de/git-ipt-server.yml delete mode 100644 host_vars/gw-opp-neu.opp.netz/gw-opp-neu-common.yml create mode 100644 host_vars/iam-nd.oopen.de/iam-nd-ipt-server.yml create mode 100644 host_vars/initiativenserver.oopen.de/initiativenserver-ipt-server.yml create mode 100644 host_vars/keycloak-nd.oopen.de/keycloak-nd-ipt-server.yml delete mode 100644 host_vars/ki-fm.oopen.de/ki-fm-common.yml create mode 100644 host_vars/lists.mx.warenform.de/lists.mx-ipt-server.yml delete mode 100644 host_vars/mail-neu.cadus.org/mail-neu-common.yml create mode 100644 host_vars/mail.cadus.org/mail-ipt-server.yml create mode 100644 host_vars/mail.faire-mobilitaet.de/mail-ipt-server.yml create mode 100644 host_vars/matomo-01.oopen.de/matomo-01-ipt-server.yml create mode 100644 host_vars/meet.akweb.de/meet-ipt-server.yml create mode 100644 host_vars/meet.oopen.de/meet-ipt-server.yml delete mode 100644 host_vars/mm-migration.oopen.de/mm-migration-common.yml rename host_vars/mm-nd-test.oopen.de/{mm-nd-common.yml => mm-nd-test-common.yml} (100%) rename host_vars/mm-nd-test.oopen.de/{mm-nd-ipt-server.yml => mm-nd-test-ipt-server.yml} (100%) create mode 100644 host_vars/munin.oopen.de/munin-ipt-server.yml create mode 100644 host_vars/mx.warenform.de/mx-ipt-server.yml create mode 100644 host_vars/nd-archiv.warenform.de/nd-archiv-ipt-server.yml create mode 100644 host_vars/nd-epaper.warenform.de/nd-epaper-ipt-server.yml create mode 100644 host_vars/nd-live.warenform.de/nd-live-ipt-server.yml create mode 100644 host_vars/ns.so36net.de/ns-ipt-server.yml create mode 100644 host_vars/o12.oopen.de/o12-ipt-server.yml create mode 100644 host_vars/o13-cryptpad.oopen.de/o13-cryptpad-ipt-server.yml create mode 100644 host_vars/o13-git.oopen.de/o13-git-ipt-server.yml create mode 100644 host_vars/o13-mail.oopen.de/o13-mail-ipt-server.yml create mode 100644 host_vars/o13-mumble.oopen.de/o13-mumble-ipt-server.yml create mode 100644 host_vars/o13-pad.oopen.de/o13-pad-ipt-server.yml create mode 100644 host_vars/o13.oopen.de/o13-ipt-server.yml create mode 100644 host_vars/o14.oopen.de/o14-ipt-server.yml create mode 100644 host_vars/o17.oopen.de/o17-ipt-server.yml create mode 100644 host_vars/o18.oopen.de/o18-ipt-server.yml create mode 100644 host_vars/o19.oopen.de/o19-ipt-server.yml create mode 100644 host_vars/o20.oopen.de/o20-ipt-server.yml create mode 100644 host_vars/o21.oopen.de/o21-ipt-server.yml create mode 100644 host_vars/o22.oopen.de/o22-ipt-server.yml create mode 100644 host_vars/o23.oopen.de/o23-ipt-server.yml create mode 100644 host_vars/o24.oopen.de/o24-ipt-server.yml create mode 100644 host_vars/o26.oopen.de/o26-ipt-server.yml create mode 100644 host_vars/o27.oopen.de/o27-ipt-server.yml create mode 100644 host_vars/o28.oopen.de/o28-ipt-server.yml create mode 100644 host_vars/o29.oopen.de/o29-ipt-server.yml create mode 100644 host_vars/o30.oopen.de/o30-ipt-server.yml create mode 100644 host_vars/o31.oopen.de/o31-ipt-server.yml rename host_vars/{cl-lubax.oopen.de/cl-lubax-ipt-server.yml => o32.oopen.de/o32-ipt-server.yml} (65%) delete mode 100644 host_vars/o33-neu.oopen.de/o33-neu-common.yml create mode 100644 host_vars/o35.oopen.de/o35-ipt-server.yml create mode 100644 host_vars/o36.oopen.de/o36-ipt-server.yml create mode 100644 host_vars/o38.oopen.de/o38-ipt-server.yml create mode 100644 host_vars/o39.oopen.de/o39-ipt-server.yml create mode 100644 host_vars/o40.oopen.de/o40-ipt-server.yml create mode 100644 host_vars/o42.oopen.de/o42-ipt-server.yml create mode 100644 host_vars/o43.oopen.de/o43-ipt-server.yml create mode 100644 host_vars/o44.oopen.de/o44-ipt-server.yml create mode 120000 host_vars/oolm-db.oopen.de delete mode 100644 host_vars/oolm-db.oopen.de/oolm-db-common.yml create mode 100644 host_vars/oolm-shop-dev.oopen.de/oolm-shop-dev-ipt-server.yml create mode 100644 host_vars/oolm-web.oopen.de/oolm-web-ipt-server.yml create mode 100644 host_vars/piwik.warenform.de/piwik-ipt-server.yml create mode 100644 host_vars/prometheus-nd.oopen.de/prometheus-nd-ipt-server.yml create mode 100644 host_vars/rage.so36.net/rage-ipt-server.yml create mode 100644 host_vars/resolver-a.so36.net/resolver-a-ipt-server.yml create mode 100644 host_vars/resolver-b.so36.net/resolver-b-ipt-server.yml create mode 100644 host_vars/schleuder3.so36.net/schleuder3-ipt-server.yml create mode 100644 host_vars/server18.warenform.de/server18-ipt-server.yml create mode 100644 host_vars/server22.warenform.de/server22-ipt-server.yml create mode 100644 host_vars/server23.warenform.de/server23-ipt-server.yml create mode 100644 host_vars/server24.warenform.de/server24-ipt-server.yml create mode 100644 host_vars/server25.warenform.de/server25-ipt-server.yml create mode 100644 host_vars/server26.warenform.de/server26-ipt-server.yml create mode 100644 host_vars/server27.warenform.de/server27-ipt-server.yml create mode 100644 host_vars/shell.so36.net/shell-ipt-server.yml delete mode 100644 host_vars/shop-dev.aufstehen-gegen-rassismus.de/shop-dev-common.yml create mode 100644 host_vars/site36.net/site36.net-ipt-server.yml create mode 100644 host_vars/stolpersteine.oopen.de/stolpersteine-ipt-server.yml create mode 100644 host_vars/sympa.so36.net/sympa-ipt-server.yml create mode 100644 host_vars/test.mariadb.oopen.de/test.mariadb-ipt-server.yml create mode 100644 host_vars/verdi-django.warenform.de/verdi-django-ipt-server.yml create mode 100644 host_vars/verdi-es.warenform.de/verdi-es-ipt-server.yml create mode 100644 host_vars/vvn-shop.warenform.de/vvn-shop-ipt-server.yml create mode 100644 host_vars/vvn-www.warenform.de/vvn-www-ipt-server.yml create mode 100644 host_vars/web-02.oopen.de/web-02-ipt-server.yml create mode 100644 host_vars/web-03.oopen.de/web-03-ipt-server.yml create mode 100644 host_vars/web-04.oopen.de/web-04-ipt-server.yml create mode 100644 host_vars/web-05.oopen.de/web-05-ipt-server.yml create mode 100644 host_vars/web-06.oopen.de/web-06-ipt-server.yml create mode 100644 host_vars/web-07.oopen.de/web-07-ipt-server.yml create mode 100644 host_vars/web-08.oopen.de/web-08-ipt-server.yml create mode 100644 host_vars/web-09.oopen.de/web-09-ipt-server.yml create mode 100644 host_vars/web-nd.oopen.de/web-nd-ipt-server.yml create mode 100644 host_vars/web.cadus.org/web-ipt-server.yml create mode 100644 host_vars/web.so36.net/web-ipt-server.yml create mode 100644 host_vars/web1.warenform.de/web1-ipt-server.yml create mode 100644 host_vars/web2.warenform.de/web2-ipt-server.yml delete mode 100644 host_vars/wiki.cadus.org/wiki-common.yml delete mode 100644 host_vars/www.oopen.de/www-common.yml delete mode 100644 host_vars/zapata-alt.opp.netz/zapata-alt-common.yml diff --git a/host_vars/bbb-server.b3-bornim.netz/bbb-server-common.yml b/host_vars/DELETED/bbb-server.b3-bornim.netz/bbb-server-common.yml similarity index 100% rename from host_vars/bbb-server.b3-bornim.netz/bbb-server-common.yml rename to host_vars/DELETED/bbb-server.b3-bornim.netz/bbb-server-common.yml diff --git a/host_vars/server28.warenform.de/server28-common.yml b/host_vars/DELETED/cl-vbrg.oopen.de/cl-vbrg-common.yml similarity index 79% rename from host_vars/server28.warenform.de/server28-common.yml rename to host_vars/DELETED/cl-vbrg.oopen.de/cl-vbrg-common.yml index 21ac025..10adf7f 100644 --- a/host_vars/server28.warenform.de/server28-common.yml +++ b/host_vars/DELETED/cl-vbrg.oopen.de/cl-vbrg-common.yml @@ -4,7 +4,6 @@ # vars used by roles/network_interfaces # --- - # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted network_manage_devices: true @@ -22,9 +21,9 @@ network_interface_required_packages: network_interfaces: - - device: enp9s0 + - device: enp6s0 # use only once per device (for the first device entry) - headline: enp9s0 - primary network interface + headline: enp6s0 - primary network interface # auto & allow are only used for the first device entry allow: [] # array of allow-[stanzas] eg. allow-hotplug @@ -34,9 +33,9 @@ network_interfaces: method: static hwaddress: description: - address: 116.202.161.37 + address: 65.109.158.101 netmask: 26 - gateway: 116.202.161.1 + gateway: 65.109.158.65 metric: pointopoint: mtu: @@ -64,9 +63,9 @@ network_interfaces: # search: warenform.de # # nameservers: - # - 213.133.99.99 - # - 213.133.98.98 - # - 213.133.100.100 + # - 127.0.0.1 + # - 185.12.64.2 + # - 2a01:4ff:ff00::add:1 # search: # optional additional subnets/ips subnets: [] @@ -98,23 +97,23 @@ network_interfaces: # optional vlan settings | vlan: {} # vlan: {} - # raw-device: 'eth0' + # raw-device: 'enp6s0' vlan: {} # inline hook scripts pre-up: [] # pre-up script lines up: - - !!str "route add -net 116.202.161.0 netmask 255.255.255.192 gw 116.202.161.1 dev enp9s0" # up script lines + - route add -net 65.109.158.64 netmask 255.255.255.192 gw 65.109.158.65 dev enp6s0 post-up: [] # post-up script lines (alias for up) pre-down: [] # pre-down script lines (alias for down) down: [] # down script lines post-down: [] # post-down script lines - - device: enp9s0 + - device: enp6s0 family: inet6 method: static - address: 2a01:4f8:241:15a::2 + address: 2a01:4f9:3080:155d::2 netmask: 64 gateway: fe80::1 @@ -143,11 +142,6 @@ network_interfaces: # vars used by roles/common/tasks/apt.yml # --- -apt_install_extra_pkgs: true -apt_extra_pkgs: - - subversion - - subversion-tools - # --- # vars used by roles/common/tasks/systemd-resolved.yml @@ -200,11 +194,9 @@ systemd_resolved: true # für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) resolved_nameserver: - 213.133.100.100 - - 2a01:4f8:0:1::add:9898 - - 213.133.99.99 - - 2a01:4f8:0:1::add:1010 + - 195.201.179.131 + - 95.217.204.204 - 213.133.98.98 - - 2a01:4f8:0:1::add:9999 # search domains # @@ -214,7 +206,7 @@ resolved_nameserver: # resolved_domains: [] resolved_domains: - ~. - - warenform.de + - oopen.de resolved_dnssec: false @@ -223,6 +215,11 @@ resolved_dnssec: false resolved_fallback_nameserver: - 194.150.168.168 + +# --- +# vars used by roles/common/tasks/cron.yml +# --- + cron_env_entries: - name: PATH job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin @@ -244,17 +241,17 @@ cron_user_special_time_entries: job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" insertafter: PATH - - name: "Restart prosody Service." - special_time: reboot - job: "sleep 120 ; systemctl stop prosody ; sleep 10 ; systemctl start prosody" - insertafter: PATH - cron_user_entries: - - name: "Check if SSH service is running. Restart service if needed." + - name: "Check if webservices sre running. Restart if necessary" minute: '*/5' hour: '*' + job: /root/bin/monitoring/check_webservice_load.sh + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/10' + hour: '*' job: /root/bin/monitoring/check_ssh.sh - name: "Check connectifity - reboot if needed" @@ -267,25 +264,45 @@ cron_user_entries: hour: '*' job: /root/bin/monitoring/check_postfix.sh + - name: "Check Postfix E-Mail LOG file for 'fatal' errors.." + minute: '*/5' + hour: '*' + job: /root/bin/postfix/check-postfix-fatal-errors.sh + - name: "Check if NTP service 'ntpsec' is up and running?" minute: '*/30' hour: '*' job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1 - - name: "Check hard disc usage." - minute: '43' - hour: '6' - job: /root/bin/admin-stuff/check-disc-usage.sh -c 85 + - name: "Optimize mysql tables" + minute: '53' + hour: '04' + job: /root/bin/mysql/optimize_mysql_tables.sh - - name: "Check if cert(s) for Prosody service are up-zp-date" - minute: '13' - hour: '05' - job: /root/bin/monitoring/check_cert_for_prosody.sh + - name: "Flush query cache for mysql tables" + minute: '27' + hour: '04' + job: /root/bin/mysql/flush_query_cache.sh - - name: "Check if cert for coTURN service is up-to-date" - minute: '39' + - name: "Flush Host cache" + minute: '17' hour: '05' - job: /root/bin/monitoring/check_cert_for_service.sh + job: /root/bin/mysql/flush_host_cache.sh + + - name: "Run occ file:scan for each cloud account" + minute: '03' + hour: '23' + job: /root/bin/nextcloud/occ_maintenance.sh -s cloud.verband-brg.de + + - name: "Background job for nextcloud instance 'cloud.verband-brg.de" + minute: '*/15' + hour: '*' + job: sudo -u "www-data" /usr/local/php/bin/php -f /var/www/cloud.verband-brg.de/htdocs/cron.php + + - name: "Check if certificates for coolwsd service are up to date" + minute: '17' + hour: '05' + job: /root/bin/nextcloud/check_cert_coolwsd.sh - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)" minute: '23' @@ -297,6 +314,11 @@ cron_user_entries: hour: '05' job: /var/lib/dehydrated/tools/update_ssl_directives.sh + - name: "Check hard disc usage." + minute: '43' + hour: '6' + job: /root/bin/admin-stuff/check-disc-usage.sh -c 85 + # --- # vars used by roles/common/tasks/users.yml @@ -319,18 +341,11 @@ cron_user_entries: # # see: roles/common/tasks/vars - -# --- -# vars used by roles/common/tasks/copy_files.yml -# --- - -copy_plain_files: - - # /root/bin/monitoring - # - - name: admin_stuff_check_disc_usage - src_path: server28.warenform.de/root/bin/admin-stuff/conf/check-disc-usage.conf - dest_path: /root/bin/admin-stuff/conf/check-disc-usage.conf +sudoers_file_user_privileges: + - name: back + entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php' + - name: www-data + entry: 'ALL=(root) NOPASSWD: /root/bin/nextcloud/add-new-account.sh' # --- @@ -347,7 +362,6 @@ git_firewall_repository: repo: https://git.oopen.de/firewall/ipt-server dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/DELETED/cl-vbrg.oopen.de/cl-vbrg-ipt-server.yml b/host_vars/DELETED/cl-vbrg.oopen.de/cl-vbrg-ipt-server.yml new file mode 100644 index 0000000..4a3723a --- /dev/null +++ b/host_vars/DELETED/cl-vbrg.oopen.de/cl-vbrg-ipt-server.yml @@ -0,0 +1,33 @@ +--- +# ipt-firewall configuration for o34.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: true + +# --- Network +fw_ext_interfaces: + - "enp6s0" +fw_ext_ips_v4: + - "65.109.158.101" +fw_ext_ips_v6: + - "2a01:4f9:3080:155d::2" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/backup.oopen.de/backup-common.yml b/host_vars/backup.oopen.de/backup-common.yml index 626aada..bb73256 100644 --- a/host_vars/backup.oopen.de/backup-common.yml +++ b/host_vars/backup.oopen.de/backup-common.yml @@ -289,6 +289,7 @@ default_user: - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL7KbEZApiqEcU4aK3A2J8hy+r1uV7TZupwm4CHGqLPH root@ga-gh-gw' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCXqgmGcJfUDROAk24pTkQqddRj1sh1BW3JrbHu7ZtE root@ga-nh-gw' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaF9IsDzPo6nef47VbsLlqlmiwuLyFQ8Vawil/JPF9M root@ga-st-gw' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0kp3X3Qa/TD5XnVD9pkVj03F1EuG8g2SuhFceUKVk0 root@ga-st-mail' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPbony+4g4iFS32Cv/Bkmet4FsCAsrGTffwWm2eM16x root@git.warenform' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqqmBWh3qmnx41NiLCn1LhVG0mn4++IUvRNC0OMh6h6 root@gitoea' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICR9o0+6jnfmXKOedKP6IZgt5lRIPFSJJ4FbMjz2SPkH root@gw-campus' diff --git a/host_vars/backup.so36.net/backup-ipt-server.yml b/host_vars/backup.so36.net/backup-ipt-server.yml new file mode 100644 index 0000000..dc1957a --- /dev/null +++ b/host_vars/backup.so36.net/backup-ipt-server.yml @@ -0,0 +1,21 @@ +--- +# ipt-firewall configuration for backup.so36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "enp2s0" +fw_ext_ips_v4: + - "194.150.169.138" +fw_ext_ips_v6: + - "2001:4ce8:b134:8680::2" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- SSH +fw_ssh_ports: 1036 diff --git a/host_vars/c.mx.oopen.de/c.mx-ipt-server.yml b/host_vars/c.mx.oopen.de/c.mx-ipt-server.yml new file mode 100644 index 0000000..aca9877 --- /dev/null +++ b/host_vars/c.mx.oopen.de/c.mx-ipt-server.yml @@ -0,0 +1,38 @@ +--- +# ipt-firewall configuration for c.mx.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" + - "eth1" +fw_ext_ips_v4: + - "83.223.86.116" + - "83.223.86.117" +fw_ext_ips_v6: + - "2a01:30:0:13:2c5:48ff:feee:f21c 2a01:30:0:505:2c5:48ff:feee:f21c" + - "2a01:30:0:13:2c5:48ff:feee:f21d 2a01:30:0:505:2c5:48ff:feee:f21d" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip $ext_2_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_server_ips: $ext_1_ip +fw_mail_client_ips: $ext_1_ip +fw_dovecot_auth_service: true +fw_dovecot_auth_allowed_networks_v4: 83.223.85.204 +fw_dovecot_auth_allowed_networks_v6: "2a01:30:0:13::/64" + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/ki-fm.oopen.de/ki-fm-ipt-server.yml b/host_vars/cl-exil.oopen.de/cl-exil-ipt-server.yml similarity index 63% rename from host_vars/ki-fm.oopen.de/ki-fm-ipt-server.yml rename to host_vars/cl-exil.oopen.de/cl-exil-ipt-server.yml index 60bcf91..62ea251 100644 --- a/host_vars/ki-fm.oopen.de/ki-fm-ipt-server.yml +++ b/host_vars/cl-exil.oopen.de/cl-exil-ipt-server.yml @@ -1,17 +1,17 @@ --- -# ipt-firewall configuration for cl-fm.oopen.de +# ipt-firewall configuration for cl-exil.oopen.de # Generated by extract-fw-host-vars.py - review before committing! -# Place in: host_vars//ipt_firewall.yml +# Place in: host_vars//-ipt-server.yml -fw_manage_config: true +fw_manage_config: false # --- Network fw_ext_interfaces: - "eth0" fw_ext_ips_v4: - - "5.75.224.214" + - "5.9.97.99" fw_ext_ips_v6: - - "2a01:4f8:c015:c4b7::1" + - "2a01:4f8:162:2477::99" # --- Munin munin_remote_ipv4: 37.27.121.227 diff --git a/host_vars/cl-lubax.oopen.de b/host_vars/cl-lubax.oopen.de new file mode 120000 index 0000000..ab8b39f --- /dev/null +++ b/host_vars/cl-lubax.oopen.de @@ -0,0 +1 @@ +o32.oopen.de \ No newline at end of file diff --git a/host_vars/cl-lubax.oopen.de/cl-lubax-common.yml b/host_vars/cl-lubax.oopen.de/cl-lubax-common.yml deleted file mode 100644 index 05255dd..0000000 --- a/host_vars/cl-lubax.oopen.de/cl-lubax-common.yml +++ /dev/null @@ -1,151 +0,0 @@ ---- - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - -# sshd_permit_root_login: !!str "prohibit-password" -sshd_permit_root_login: !!str "no" - -# --- -# vars used by apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/systemd-resolved.yml -# --- - -systemd_resolved: false - -# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie -# Primäre DNS-Adresse: 38.132.106.139 -# Sekundäre DNS-Adresse: 194.187.251.67 -# -# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen -# primäre DNS-Adresse -# IPv4: 1.1.1.1 -# IPv6: 2606:4700:4700::1111 -# sekundäre DNS-Adresse -# IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# -# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit -# primäre DNS-Adresse -# IPv4: 8.8.8.8 -# IPv6: 2001:4860:4860::8888 -# sekundäre DNS-Adresse -# IPv4: 8.8.4.4 -# IPv6: 2001:4860:4860::8844 -# -# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug -# primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe -# sekundäre DNS-Adresse -# IPv4: 149.112.112.112 -# IPv6: 2620:fe::9 -# -# OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de -# IPv4: 194.36.144.87 - ns29.de -# IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) -# IPv4: 5.1.66.255 -# IPv6: 2001:678:e68:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# IPv4: 185.150.99.255 -# IPv6: 2001:678:ed0:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) -resolved_nameserver: - - 185.12.64.2 - - 2a01:4ff:ff00::add:1 - - 185.12.64.1 - - 2a01:4ff:ff00::add:2 - -# search domains -# -# If there are more than one search domains, then specify them here in the order in which -# the resolver should also search them -# -# resolved_domains: [] -resolved_domains: - - ~. - - oopen.de - -resolved_dnssec: false - -# dns.as250.net: 194.150.168.168 -# -resolved_fallback_nameserver: - - 194.150.168.168 - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - -sudo_users: - - chris - - sysadm - - localadmin - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - -sudoers_file_user_privileges: - - name: back - entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php' - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- -# -# see: roles/common/tasks/vars - - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- diff --git a/host_vars/cl-nd.oopen.de/cl-nd-ipt-server.yml b/host_vars/cl-nd.oopen.de/cl-nd-ipt-server.yml new file mode 100644 index 0000000..bb097ef --- /dev/null +++ b/host_vars/cl-nd.oopen.de/cl-nd-ipt-server.yml @@ -0,0 +1,24 @@ +--- +# ipt-firewall configuration for cl-nd.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "148.251.194.56" +fw_ext_ips_v6: + - "2a01:4f8:211:f89::56" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip diff --git a/host_vars/cl-opp.oopen.de/cl-opp-ipt-server.yml b/host_vars/cl-opp.oopen.de/cl-opp-ipt-server.yml new file mode 100644 index 0000000..d913b7b --- /dev/null +++ b/host_vars/cl-opp.oopen.de/cl-opp-ipt-server.yml @@ -0,0 +1,27 @@ +--- +# ipt-firewall configuration for cl-opp.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "213.239.199.45" +fw_ext_ips_v6: + - "2a01:4f8:222:161c::45" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/cl-vbrg.oopen.de b/host_vars/cl-vbrg.oopen.de new file mode 120000 index 0000000..baaf2f4 --- /dev/null +++ b/host_vars/cl-vbrg.oopen.de @@ -0,0 +1 @@ +o34.oopen.de \ No newline at end of file diff --git a/host_vars/cl-vbrg.oopen.de/cl-vbrg-common.yml b/host_vars/cl-vbrg.oopen.de/cl-vbrg-common.yml deleted file mode 100644 index 04a442e..0000000 --- a/host_vars/cl-vbrg.oopen.de/cl-vbrg-common.yml +++ /dev/null @@ -1,72 +0,0 @@ ---- - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - -sshd_permit_root_login: !!str "prohibit-password" - -# --- -# vars used by apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - -sudoers_file_user_privileges: - - name: back - entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php' - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- -# -# see: roles/common/tasks/vars - - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- diff --git a/host_vars/cloud-giz.warenform.de/cloud-giz-common.yml b/host_vars/cloud-giz.warenform.de/cloud-giz-common.yml deleted file mode 100644 index 04a442e..0000000 --- a/host_vars/cloud-giz.warenform.de/cloud-giz-common.yml +++ /dev/null @@ -1,72 +0,0 @@ ---- - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - -sshd_permit_root_login: !!str "prohibit-password" - -# --- -# vars used by apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - -sudoers_file_user_privileges: - - name: back - entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php' - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- -# -# see: roles/common/tasks/vars - - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- diff --git a/host_vars/cloud.akweb.de/cloud-ipt-server.yml b/host_vars/cloud.akweb.de/cloud-ipt-server.yml new file mode 100644 index 0000000..80a3733 --- /dev/null +++ b/host_vars/cloud.akweb.de/cloud-ipt-server.yml @@ -0,0 +1,27 @@ +--- +# ipt-firewall configuration for cloud.akweb.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "148.251.14.141" +fw_ext_ips_v6: + - "2a01:4f8:201:7389::141" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/comm.so36.net/comm-ipt-server.yml b/host_vars/comm.so36.net/comm-ipt-server.yml new file mode 100644 index 0000000..18568e4 --- /dev/null +++ b/host_vars/comm.so36.net/comm-ipt-server.yml @@ -0,0 +1,41 @@ +--- +# ipt-firewall configuration for comm.so36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "192.68.11.79" +fw_ext_ips_v6: + - "2001:678:a40:3000::79" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "138.201.23.195:1036:tcp" + +# --- Access control IPv6 +fw_allow_ext_service_v6: "2a01:4f8:171:2895::195,1036,tcp" + +# --- SSH +fw_ssh_ports: 1036 + +# --- HTTP +fw_http_server_ips: $ext_ips + +# --- Mail +fw_mail_client_ips: $ext_ips +fw_dovecot_auth_port: 44444 + +# --- XMPP +fw_xmpp_server_ips: $ext_1_ip +fw_xmmp_remote_out_services_v4: "192.68.11.81:44444" + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/cp-01.oopen.de/cp-01-ipt-server.yml b/host_vars/cp-01.oopen.de/cp-01-ipt-server.yml new file mode 100644 index 0000000..adb7eda --- /dev/null +++ b/host_vars/cp-01.oopen.de/cp-01-ipt-server.yml @@ -0,0 +1,24 @@ +--- +# ipt-firewall configuration for cp-01.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "159.69.74.144" +fw_ext_ips_v6: + - "2a01:4f8:231:19a7::144" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip diff --git a/host_vars/cp-flr.oopen.de/cp-flr-ipt-server.yml b/host_vars/cp-flr.oopen.de/cp-flr-ipt-server.yml new file mode 100644 index 0000000..63dce88 --- /dev/null +++ b/host_vars/cp-flr.oopen.de/cp-flr-ipt-server.yml @@ -0,0 +1,24 @@ +--- +# ipt-firewall configuration for cp-flr.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "176.9.125.39" +fw_ext_ips_v6: + - "2a01:4f8:151:8415::39" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip diff --git a/host_vars/d.mx.oopen.de/d.mx-ipt-server.yml b/host_vars/d.mx.oopen.de/d.mx-ipt-server.yml new file mode 100644 index 0000000..20b9264 --- /dev/null +++ b/host_vars/d.mx.oopen.de/d.mx-ipt-server.yml @@ -0,0 +1,35 @@ +--- +# ipt-firewall configuration for d.mx.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "95.217.204.227" +fw_ext_ips_v6: + - "2a01:4f9:4a:47e5::227" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_client_ips: $ext_1_ip + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Portforwarding +fw_portforward_tcp_v4: "$ext_if_1:83.223.86.92:8443:83.223.86.117:443" +fw_portforward_tcp_v6: "$ext_if_1,2a01:30:0:13:254:9eff:fed5:e7fd,8443,2a01:30:0:13:2c5:48ff:feee:f21d,443" + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/devnull.so36.net/devnull-ipt-server.yml b/host_vars/devnull.so36.net/devnull-ipt-server.yml new file mode 100644 index 0000000..0cc4d48 --- /dev/null +++ b/host_vars/devnull.so36.net/devnull-ipt-server.yml @@ -0,0 +1,39 @@ +--- +# ipt-firewall configuration for devnull.so36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" + - "br1" +fw_ext_ips_v4: + - "83.223.73.200" + - "192.68.11.70" +fw_ext_ips_v6: + - "2a01:30:1fff:fd00::200" + - "2001:678:a40:3000::70" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true + +# --- Access control IPv4 +fw_allow_ext_service_v4: "138.201.23.195:1036:tcp" + +# --- Access control IPv6 +fw_allow_ext_service_v6: "2a01:4f8:171:2895::195,1036,tcp" + +# --- SSH +fw_ssh_ports: 1036 + +# --- Mail +fw_dovecot_auth_port: 44444 + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/dns0.warenform.de/dns0-ipt-server.yml b/host_vars/dns0.warenform.de/dns0-ipt-server.yml new file mode 100644 index 0000000..86b161c --- /dev/null +++ b/host_vars/dns0.warenform.de/dns0-ipt-server.yml @@ -0,0 +1,25 @@ +--- +# ipt-firewall configuration for dns0.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.113" +fw_ext_ips_v6: + - "2a01:30:0:13:2fe:f9ff:fe23:24c4 2a01:30:0:505:2fe:f9ff:fe23:24c4" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- SSH +fw_ssh_server_ips: $ext_1_ip + +# --- DNS +fw_dns_server_ips: $ext_1_ip + diff --git a/host_vars/dns1.warenform.de/dns1-ipt-server.yml b/host_vars/dns1.warenform.de/dns1-ipt-server.yml new file mode 100644 index 0000000..2949fb6 --- /dev/null +++ b/host_vars/dns1.warenform.de/dns1-ipt-server.yml @@ -0,0 +1,25 @@ +--- +# ipt-firewall configuration for dns1.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.84.20" +fw_ext_ips_v6: + - "2a01:30:d000:6::11" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- SSH +fw_ssh_server_ips: $ext_1_ip +fw_ssh_server_ips_v6: $ext_ips + +# --- DNS +fw_dns_server_ips: $ext_1_ip diff --git a/host_vars/e.mx.oopen.de/e.mx-ipt-server.yml b/host_vars/e.mx.oopen.de/e.mx-ipt-server.yml new file mode 100644 index 0000000..3a7e586 --- /dev/null +++ b/host_vars/e.mx.oopen.de/e.mx-ipt-server.yml @@ -0,0 +1,35 @@ +--- +# ipt-firewall configuration for e.mx.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "95.217.204.205" +fw_ext_ips_v6: + - "2a01:4f9:4a:47e5::205" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_server_ips: $ext_1_ip +fw_mail_client_ips: $ext_1_ip +fw_dovecot_auth_service: true +fw_dovecot_auth_allowed_networks_v4: meet.oopen.de +fw_dovecot_auth_allowed_networks_v6: meet.oopen.de + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/g.mx.oopen.de/g.mx-ipt-server.yml b/host_vars/g.mx.oopen.de/g.mx-ipt-server.yml new file mode 100644 index 0000000..87faa85 --- /dev/null +++ b/host_vars/g.mx.oopen.de/g.mx-ipt-server.yml @@ -0,0 +1,27 @@ +--- +# ipt-firewall configuration for g.mx.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "176.9.125.42" +fw_ext_ips_v6: + - "2a01:4f8:151:8415::42" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip diff --git a/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml b/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml deleted file mode 100644 index 67d5e8e..0000000 --- a/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml +++ /dev/null @@ -1,599 +0,0 @@ ---- -# --- -# vars used by roles/network_interfaces -# --- - - -# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted -network_manage_devices: true - -# Should the interfaces be reloaded after config change? -network_interface_reload: false - -network_interface_path: /etc/network/interfaces.d -network_interface_required_packages: - - vlan - - bridge-utils - - ifmetric - - ifupdown - - ifenslave - -network_interfaces: - - - device: eth0 - headline: eth0 - LAN - Uplink static line (radio) to Stockausen - auto: true - family: inet - method: static - address: 172.16.111.253 - netmask: 24 - post-up: - # - /sbin/ip route add 172.16.211.0/24 via 172.16.111.254 - # User Networks Stockhausen - - /sbin/ip route add 192.168.11.0/24 via 172.16.111.254 - - /sbin/ip route add 192.168.78.0/24 via 172.16.111.254 - # User Networks Campus - # - /sbin/ip route add 192.168.72.0/24 via 172.16.111.254 - # - /sbin/ip route add 192.168.73.0/24 via 172.16.111.254 - # User Network Novalishaus - # - /sbin/ip route add 192.168.81.0/24 via 172.16.111.254 - # User Network Georgshaus - # - /sbin/ip route add 192.168.85.0/24 via 172.16.111.254 - # Management Network Stockhausen - - /sbin/ip route add 10.10.11.0/24 via 172.16.111.254 - # Depreated Management Network Stokhausen - - /sbin/ip route add 10.10.9.0/24 via 172.16.111.254 - # IPMI Stockhausen - - /sbin/ip route add 10.11.11.0/24 via 172.16.111.254 - # WLAN Gast Novalishaus - - /sbin/ip route add 10.21.0.0/20 via 172.16.111.254 - # WLAN privat Novalishaus - - /sbin/ip route add 10.31.0.0/20 via 172.16.111.254 - # Management Netork Campus - # - /sbin/ip route add 10.72.1.0/24 via 172.16.111.254 - # WLan Router Stockhausen - - /sbin/ip route add 10.112.1.0/24 via 172.16.111.254 - # WLan Netz - - /sbin/ip route add 10.113.0.0/16 via 172.16.111.254 - # Unifi WLan Netz Stockhausen Gast - - /sbin/ip route add 10.121.0.0/20 via 172.16.111.254 - # Unifi WLan Netz Stockhausen privat - - /sbin/ip route add 10.131.0.0/20 via 172.16.111.254 - # Richtfunkantennen Stockhausen (2) / Schlechtenwegen / Kirschbaumhaus - - /sbin/ip route add 10.10.111.0/24 via 172.16.111.254 - # VPN Netz Stockhausen - Novalishaus (Schlechtenwegen) - - /sbin/ip route add 10.2.81.0/24 via 172.16.111.254 - # VPN Home Stockhausen - - /sbin/ip route add 10.0.11.0/24 via 172.16.111.254 - # - FritzBoxen Stockhausen - - /sbin/ip route add 172.16.11.0/24 via 172.16.111.254 - - /sbin/ip route add 172.16.12.0/24 via 172.16.111.254 - - /sbin/ip route add 172.16.13.0/24 via 172.16.111.254 - # - FritzBox Novalishaus - - /sbin/ip route add 172.16.80.0/24 via 172.16.111.254 - # - DigitBox Novalishaus - - /sbin/ip route add 172.16.81.0/24 via 172.16.111.254 - # - FritzBox georgshaus - - /sbin/ip route add 172.16.85.0/24 via 172.16.111.254 - - - - device: eth1 - headline: eth1 - Uplink DSL Altenschlirf via (static) line to Fritz!Box 7590 - auto: true - family: inet - method: static - address: 172.16.10.1 - netmask: 24 - gateway: 172.16.10.254 - # nameservers: - # - 192.168.10.1 - # - 192.168.10.3 - # search: ga.netz - - - - device: eth2 - headline: eth2 - LAN main network Altenschlirf - auto: true - family: inet - method: static - address: 192.168.10.254 - netmask: 24 - post-up: - # - VLAN 221 (Ubiquiti UniFi Accesspoints) - - /sbin/ip link add link eth2 name eth2.221 type vlan id 221 - - /sbin/ip link add link eth2 name eth2.231 type vlan id 231 - - - device: eth2:ns - headline: eth2:ns - Alias on eth2 (Nameserver) - auto: true - family: inet - method: static - address: 192.168.10.1 - netmask: 32 - - - device: eth2:ap - headline: eth2:ap - Alias on eth2 (Network Accesspoints) - auto: true - family: inet - method: static - address: 10.122.1.254 - netmask: 24 - post-up: - # - Wireless Networks routed through appropriate Accesspoints - # - - - /sbin/ip route add 10.123.1.0/24 via 10.122.1.1 - - /sbin/ip route add 10.123.2.0/24 via 10.122.1.2 - - /sbin/ip route add 10.123.3.0/24 via 10.122.1.3 - - /sbin/ip route add 10.123.4.0/24 via 10.122.1.4 - - /sbin/ip route add 10.123.5.0/24 via 10.122.1.5 - - /sbin/ip route add 10.123.6.0/24 via 10.122.1.6 - - /sbin/ip route add 10.123.7.0/24 via 10.122.1.7 - - /sbin/ip route add 10.123.8.0/24 via 10.122.1.8 - - /sbin/ip route add 10.123.9.0/24 via 10.122.1.9 - - /sbin/ip route add 10.123.10.0/24 via 10.122.1.10 - - /sbin/ip route add 10.123.11.0/24 via 10.122.1.11 - - /sbin/ip route add 10.123.12.0/24 via 10.122.1.12 - - /sbin/ip route add 10.123.13.0/24 via 10.122.1.13 - - /sbin/ip route add 10.123.14.0/24 via 10.122.1.14 - - /sbin/ip route add 10.123.15.0/24 via 10.122.1.15 - - - device: eth2.221 - # use only once per device (for the first device entry) - headline: eth2 - VLAN 221 (Ubiquiti UniFi Accesspoints Guest NET) - - # auto & allow are only used for the first device entry - allow: [] # array of allow-[stanzas] eg. allow-hotplug - auto: true - - family: inet - method: static - # hwaddress: 0c:c4:7a:7d:51:46 - description: - address: 10.221.15.254 - netmask: 20 - gateway: - metric: - pointopoint: - mtu: - scope: - - - device: eth2.231 - headline: eth2 - VLAN 231 (Ubiquiti UniFi Accesspoints private NET) - auto: true - family: inet - method: static - address: 10.231.15.254 - netmask: 20 - - # additional user by dhcp method - # - hostname: - leasehours: - leasetime: - vendor: - client: - - # additional used by bootp method - # - bootfile: - server: - hwaddr: - - # optional dns settings nameservers: [] - # - # nameservers: - # - 194.150.168.168 # dns.as250.net - # - 91.239.100.100 # anycast.censurfridns.dk - # search: warenform.de - # - nameservers: [] - - # optional additional subnets/ips subnets: [] - # subnets: - # - '192.168.123.0/24' - # - '192.168.124.11/32' - - # optional bridge parameters bridge: {} - # bridge: - # ports: - # stp: - # fd: - # maxwait: - # waitport: - bridge: {} - - # optional bonding parameters bond: {} - # bond: - # master - # primary - # slave - # method: - # miimon: - # lacp-rate: - # ad-select-rate: - # master: - # slaves: - bond: {} - - # optional vlan settings | vlan: {} - # vlan: {} - # raw-device: 'eth0' - vlan: {} - - # inline hook scripts - pre-up: [] # pre-up script lines - up: [] - post-up: [] # post-up script lines (alias for up) - pre-down: [] # pre-down script lines (alias for down) - down: [] # down script lines - post-down: [] # post-down script lines - - - - device: eth4 - headline: eth4 - Management Network Altenschlirf - auto: true - family: inet - method: static - address: 10.10.10.254 - netmask: 24 - - - - device: eth5 - headline: eth5 - Network Telefons Altenschlirf - auto: true - family: inet - method: static - address: 172.16.210.254 - netmask: 24 - - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - - -# --- -# vars used by roles/common/tasks/apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/systemd-resolved.yml -# --- - -systemd_resolved: true - -# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie -# Primäre DNS-Adresse: 38.132.106.139 -# Sekundäre DNS-Adresse: 194.187.251.67 -# -# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen -# primäre DNS-Adresse -# IPv4: 1.1.1.1 -# IPv6: 2606:4700:4700::1111 -# sekundäre DNS-Adresse -# IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# -# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit -# primäre DNS-Adresse -# IPv4: 8.8.8.8 -# IPv6: 2001:4860:4860::8888 -# sekundäre DNS-Adresse -# IPv4: 8.8.4.4 -# IPv6: 2001:4860:4860::8844 -# -# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug -# primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe -# sekundäre DNS-Adresse -# IPv4: 149.112.112.112 -# IPv6: 2620:fe::9 -# -# OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de -# IPv4: 194.36.144.87 - ns29.de -# IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) -# IPv4: 5.1.66.255 -# IPv6: 2001:678:e68:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# IPv4: 185.150.99.255 -# IPv6: 2001:678:ed0:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) -# Note: systemd-resolved uses 'FallbackDNS' only if no 'DNS' is configured at all. So -# the other (internal) nameserver gateways are listed here as additional DNS servers. -resolved_nameserver: - - 127.0.0.1 - - 192.168.11.1 - - 192.168.81.1 - -# search domains -# -# If there are more than one search domains, then specify them here in the order in which -# the resolver should also search them -# -# resolved_domains: [] -resolved_domains: - - ~. - - ga.netz - - ga.intra - -resolved_dnssec: false - -# dns.as250.net: 194.150.168.168 -# -resolved_fallback_nameserver: - - 192.168.11.1 - - 192.168.81.1 - - -# --- -# vars used by roles/common/tasks/cron.yml -# --- - -cron_user_entries: - - - name: "Check forwarding ( /proc/sys/net/ipv4/ip_forward contains \"1\" )" - minute: '0-59/3' - hour: '*' - job: /root/bin/monitoring/check_forwarding.sh - - - name: "Check if nameservice (bind) is running?" - minute: '*/23' - hour: '*' - job: /root/bin/monitoring/check_dns.sh - - - name: "Check if Resolver (systemd-resolved) is up and running?" - minute: '*/23' - hour: '*' - job: bin/monitoring/check_systemd_resolved.sh - - - name: "Check if Postfix Mailservice is up and running?" - minute: '*/17' - hour: '*' - job: /root/bin/monitoring/check_postfix.sh - - - name: "Check if SSH service is up and running?" - minute: '*/13' - hour: '*' - job: /root/bin/monitoring/check_ssh.sh - - - name: "Check if OpenVPN service is up and running?" - minute: '*/29' - hour: '*' - job: /root/bin/monitoring/check_vpn.sh - - - name: "Copy gateway configuration" - minute: '09' - hour: '3' - job: /root/bin/manage-gw-config/copy_gateway-config.sh GA-AL - - - name: "Speedtest" - minute: 13 - hour: 0-8 - job: /root/bin/admin-stuff/speedtest.sh - - -cron_user_special_time_entries: - - - name: "Restart NTP service 'ntpsec'" - special_time: reboot - job: "sleep 15 ; /bin/systemctl restart ntpsec" - insertafter: PATH - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - -insert_ssh_keypair_backup_server: false -ssh_keypair_backup_server: - - name: backup - backup_user: back - priv_key_src: root/.ssh/id_rsa.backup.oopen.de - priv_key_dest: /root/.ssh/id_rsa - pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub - pub_key_dest: /root/.ssh/id_rsa.pub - -insert_keypair_backup_client: true -ssh_keypair_backup_client: - - name: backup - priv_key_src: root/.ssh/id_ed25519.oopen-server - priv_key_dest: /root/.ssh/id_ed25519 - pub_key_src: root/.ssh/id_ed25519.oopen-server.pub - pub_key_dest: /root/.ssh/id_ed25519.pub - target: backup.oopen.de - -default_user: - - - name: chris - password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3 - shell: /bin/bash - ssh_keys: - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' - - - name: maadmin - password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51 - shell: /bin/bash - ssh_keys: - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1' - - - name: wadmin - password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1 - shell: /bin/bash - ssh_keys: - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1' - - - name: sysadm - user_id: 1050 - group_id: 1050 - group: sysadm - password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC - shell: /bin/bash - ssh_keys: - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1' - - - name: back - user_id: 1060 - group_id: 1060 - group: back - password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74 - shell: /bin/bash - ssh_keys: - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' - -sudo_users: - - chris - - sysadm - - maadmin - - wadmin - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - -install_bind_packages: true - - -bind9_gateway_acl: - - local-net: - name: local-net - entries: - - 127.0.0.0/8 - - 172.16.0.0/12 - - 192.168.0.0/16 - - 10.0.0.0/8 - - fc00::/7 - - fe80::/10 - - ::1/128 - - internaldns: - name: internaldns - entries: - - '# Nameserver Gateway Stockhausen' - - 192.168.11.1 - - '# Domain Controller Stockhausen' - - 192.168.11.3 - - '# Nameserver Gateway Altenschlirf' - - 192.168.10.1 - - '# Domain Controller Altenschlirf' - - 192.168.10.3 - - 192.168.10.6 - - 172.16.0.1 - - '# Nameserver Gateway Novalishaus' - - 192.168.81.1 - - 10.2.11.2 - - '# Nameserver Gateway Georgshaus' - - 192.168.85.1 - - '# Nameserver wolle' - - 10.113.12.3 - - '# Postfix Mailserver' - - 192.168.11.2 - - '# Mail Relay System' - - 192.168.10.2 - - -bind9_gateway_listen_on_v6: - - none - -bind9_gateway_listen_on: - - any - -# bind9_gateway_allow_transfer: {} -bind9_gateway_allow_transfer: - - none - -bind9_transfer_source: !!str "192.168.10.1" -bind9_notify_source: !!str "192.168.10.1" - -# bind9_gateway_allow_query: {} -bind9_gateway_allow_query: - - local-net - -# bind9_gateway_allow_query_cache: {} -bind9_gateway_allow_query_cache: - - local-net - -bind9_gateway_recursion: !!str "yes" -# bind9_gateway_allow_recursion: {} -bind9_gateway_allow_recursion: - - local-net - - -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-gateway - repo: https://git.oopen.de/firewall/ipt-gateway - dest: /usr/local/src/ipt-gateway - -git_other_repositories: - - name: check_net - repo: https://git.oopen.de/routing/check_net - dest: /usr/local/src/check_net - - - name: borg2-binaries - repo: https://git.oopen.de/backup/borg2-binaries - dest: /usr/local/src/borg2-binaries - - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- - -root_user: - name: root - password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. diff --git a/host_vars/ga-al-gw-neu.ga.netz/ga-al-gw-neu-common.yml b/host_vars/ga-al-gw.oopen.de/ga-al-gw-neu-common.yml similarity index 94% rename from host_vars/ga-al-gw-neu.ga.netz/ga-al-gw-neu-common.yml rename to host_vars/ga-al-gw.oopen.de/ga-al-gw-neu-common.yml index 0bcb818..837fb6a 100644 --- a/host_vars/ga-al-gw-neu.ga.netz/ga-al-gw-neu-common.yml +++ b/host_vars/ga-al-gw.oopen.de/ga-al-gw-neu-common.yml @@ -20,8 +20,8 @@ network_interface_required_packages: network_interfaces: - - device: enp1s0f0 - headline: enp1s0f0 - LAN - Uplink static line (radio) to Stockausen + - device: lan2 + headline: lan2 - LAN - Uplink static line (radio) to Stockausen auto: true family: inet method: static @@ -80,8 +80,8 @@ network_interfaces: - /sbin/ip route add 172.16.85.0/24 via 172.16.111.254 - - device: enp6s0f0 - headline: enp6s0f0 - Uplink DSL Altenschlirf via (static) line to Fritz!Box 7590 + - device: lan0 + headline: lan0 - Uplink DSL Altenschlirf via (static) line to Fritz!Box 7590 auto: true family: inet method: static @@ -94,8 +94,8 @@ network_interfaces: # search: ga.netz - - device: enp6s0f1 - headline: enp6s0f1 - LAN main network Altenschlirf + - device: lan1 + headline: lan1 - LAN main network Altenschlirf auto: true family: inet method: static @@ -103,19 +103,19 @@ network_interfaces: netmask: 24 post-up: # - VLAN 221 (Ubiquiti UniFi Accesspoints) - - /sbin/ip link add link enp6s0f1 name enp6s0f1.221 type vlan id 221 - - /sbin/ip link add link enp6s0f1 name enp6s0f1.231 type vlan id 231 + - /sbin/ip link add link lan1 name lan1.221 type vlan id 221 + - /sbin/ip link add link lan1 name lan1.231 type vlan id 231 - - device: enp6s0f1:ns - headline: enp6s0f1:ns - Alias on enp6s0f1 (Nameserver) + - device: lan1:ns + headline: lan1:ns - Alias on lan1 (Nameserver) auto: true family: inet method: static address: 192.168.10.1 netmask: 32 - - device: enp6s0f1:ap - headline: enp6s0f1:ap - Alias on enp6s0f1 (Network Accesspoints) + - device: lan1:ap + headline: lan1:ap - Alias on lan1 (Network Accesspoints) auto: true family: inet method: static @@ -140,9 +140,9 @@ network_interfaces: - /sbin/ip route add 10.123.14.0/24 via 10.122.1.14 - /sbin/ip route add 10.123.15.0/24 via 10.122.1.15 - - device: enp6s0f1.221 + - device: lan1.221 # use only once per device (for the first device entry) - headline: enp6s0f1 - VLAN 221 (Ubiquiti UniFi Accesspoints Guest NET) + headline: lan1 - VLAN 221 (Ubiquiti UniFi Accesspoints Guest NET) # auto & allow are only used for the first device entry allow: [] # array of allow-[stanzas] eg. allow-hotplug @@ -160,8 +160,8 @@ network_interfaces: mtu: scope: - - device: enp6s0f1.231 - headline: enp6s0f1 - VLAN 231 (Ubiquiti UniFi Accesspoints private NET) + - device: lan1.231 + headline: lan1 - VLAN 231 (Ubiquiti UniFi Accesspoints private NET) auto: true family: inet method: static @@ -220,7 +220,7 @@ network_interfaces: # optional vlan settings | vlan: {} # vlan: {} - # raw-device: 'enp1s0f0' + # raw-device: 'lan2' vlan: {} # inline hook scripts @@ -232,8 +232,8 @@ network_interfaces: post-down: [] # post-down script lines - - device: enp1s0f2 - headline: enp1s0f2 - Management Network Altenschlirf + - device: lan4 + headline: lan4 - Management Network Altenschlirf auto: true family: inet method: static @@ -241,8 +241,8 @@ network_interfaces: netmask: 24 - - device: enp1s0f3 - headline: enp1s0f3 - Network Telefons Altenschlirf + - device: lan5 + headline: lan5 - Network Telefons Altenschlirf auto: true family: inet method: static diff --git a/host_vars/git.oopen.de/git-ipt-server.yml b/host_vars/git.oopen.de/git-ipt-server.yml new file mode 100644 index 0000000..c7e9763 --- /dev/null +++ b/host_vars/git.oopen.de/git-ipt-server.yml @@ -0,0 +1,24 @@ +--- +# ipt-firewall configuration for git.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "37.27.121.221" +fw_ext_ips_v6: + - "2a01:4f9:3070:2bda::221" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_ips + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/git.warenform.de/git-ipt-server.yml b/host_vars/git.warenform.de/git-ipt-server.yml new file mode 100644 index 0000000..3c23c5e --- /dev/null +++ b/host_vars/git.warenform.de/git-ipt-server.yml @@ -0,0 +1,29 @@ +--- +# ipt-firewall configuration for git.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "78.46.47.82" +fw_ext_ips_v6: + - "2a01:4f8:110:401b::82" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_ips + +# --- Mail +fw_mail_server_ips_v6: $ext_ips +fw_mail_client_ips: $ext_ips +fw_mail_client_ips_v6: "" + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/gw-opp-neu.opp.netz/gw-opp-neu-common.yml b/host_vars/gw-opp-neu.opp.netz/gw-opp-neu-common.yml deleted file mode 100644 index 42e96d3..0000000 --- a/host_vars/gw-opp-neu.opp.netz/gw-opp-neu-common.yml +++ /dev/null @@ -1,235 +0,0 @@ ---- - -# --- -# vars used by roles/network_interfaces -# --- - - -# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted -network_manage_devices: true - -# Should the interfaces be reloaded after config change? -network_interface_reload: false - -network_interface_path: /etc/network/interfaces.d -network_interface_required_packages: - - vlan - - bridge-utils - - ifmetric - - ifupdown - - ifenslave - -network_interfaces: - - - device: eno1 - headline: eno1 - Uplink DSL via Fritz!Box - auto: true - family: inet - method: static - address: 172.16.62.2 - netmask: 24 - gateway: 172.16.62.254 - # nameservers: - # - 127.0.0.1 - # - 192.168.62.1 - # search: ebs.netz kanzlei-kiel.netz elster.netz - - - - device: eno2 - headline: eno2 - LAN - auto: true - family: inet - method: static - address: 192.168.62.253 - netmask: 24 - - - - device: eno3:ns - headline: eno2:ns - Alias on eno2 (Nameserver) - auto: true - family: inet - method: static - address: 192.168.62.1 - netmask: 32 - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - -sshd_hostkeyalgorithms: - - ssh-ed25519 - - ssh-ed25519-cert-v01@openssh.com - - rsa-sha2-256 - - rsa-sha2-512 - - ecdsa-sha2-nistp256 - - rsa-sha2-256-cert-v01@openssh.com - - rsa-sha2-512-cert-v01@openssh.com - - -# --- -# vars used by roles/common/tasks/apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/systemd-resolved.yml -# --- - -systemd_resolved: true - -# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie -# Primäre DNS-Adresse: 38.132.106.139 -# Sekundäre DNS-Adresse: 194.187.251.67 -# -# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen -# primäre DNS-Adresse -# IPv4: 1.1.1.1 -# IPv6: 2606:4700:4700::1111 -# sekundäre DNS-Adresse -# IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# -# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit -# primäre DNS-Adresse -# IPv4: 8.8.8.8 -# IPv6: 2001:4860:4860::8888 -# sekundäre DNS-Adresse -# IPv4: 8.8.4.4 -# IPv6: 2001:4860:4860::8844 -# -# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug -# primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe -# sekundäre DNS-Adresse -# IPv4: 149.112.112.112 -# IPv6: 2620:fe::9 -# -# OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de -# IPv4: 194.36.144.87 - ns29.de -# IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) -# IPv4: 5.1.66.255 -# IPv6: 2001:678:e68:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# IPv4: 185.150.99.255 -# IPv6: 2001:678:ed0:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) -resolved_nameserver: - - 127.0.0.1 - -# search domains -# -# If there are more than one search domains, then specify them here in the order in which -# the resolver should also search them -# -# resolved_domains: [] -resolved_domains: - - ~. - - opp.netz - -resolved_dnssec: false - -# dns.as250.net: 194.150.168.168 -# -resolved_fallback_nameserver: - - 194.150.168.168 - - -# --- -# vars used by roles/common/tasks/cron.yml -# --- - -cron_user_special_time_entries: - - - name: "Restart NTP service 'ntpsec'" - special_time: reboot - job: "sleep 15 ; /bin/systemctl restart ntpsec" - insertafter: PATH - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - -insert_ssh_keypair_backup_server: false -ssh_keypair_backup_server: - - name: backup - backup_user: back - priv_key_src: root/.ssh/id_rsa.backup.oopen.de - priv_key_dest: /root/.ssh/id_rsa - pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub - pub_key_dest: /root/.ssh/id_rsa.pub - -insert_keypair_backup_client: true -ssh_keypair_backup_client: - - name: backup - priv_key_src: root/.ssh/id_ed25519.oopen-server - priv_key_dest: /root/.ssh/id_ed25519 - pub_key_src: root/.ssh/id_ed25519.oopen-server.pub - pub_key_dest: /root/.ssh/id_ed25519.pub - target: backup.oopen.de - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - -install_bind_packages: true - -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-gateway - repo: https://git.oopen.de/firewall/ipt-gateway - dest: /usr/local/src/ipt-gateway - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- - -root_user: - name: root - password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. diff --git a/host_vars/iam-nd.oopen.de/iam-nd-ipt-server.yml b/host_vars/iam-nd.oopen.de/iam-nd-ipt-server.yml new file mode 100644 index 0000000..71de35d --- /dev/null +++ b/host_vars/iam-nd.oopen.de/iam-nd-ipt-server.yml @@ -0,0 +1,24 @@ +--- +# ipt-firewall configuration for iam-nd.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "176.9.62.67" +fw_ext_ips_v6: + - "2a01:4f8:150:805b::67" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip diff --git a/host_vars/initiativenserver.oopen.de/initiativenserver-ipt-server.yml b/host_vars/initiativenserver.oopen.de/initiativenserver-ipt-server.yml new file mode 100644 index 0000000..650fdb4 --- /dev/null +++ b/host_vars/initiativenserver.oopen.de/initiativenserver-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for initiativenserver.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.118" +fw_ext_ips_v6: + - "2a01:30:0:505:2c7:5bff:fe44:bd50 2a01:30:0:13:2c7:5bff:fe44:bd50" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip +fw_http_server_ips_v6: $ext_ips + +# --- Mail +fw_mail_client_ips: $ext_1_ip +fw_mail_client_ips_v6: $ext_ips + +# --- FTP +fw_ftp_server_ips: $ext_1_ip +fw_ftp_server_ips_v6: $ext_ips diff --git a/host_vars/keycloak-nd.oopen.de/keycloak-nd-ipt-server.yml b/host_vars/keycloak-nd.oopen.de/keycloak-nd-ipt-server.yml new file mode 100644 index 0000000..a0b5a27 --- /dev/null +++ b/host_vars/keycloak-nd.oopen.de/keycloak-nd-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for keycloak-nd.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "176.9.62.94" +fw_ext_ips_v6: + - "2a01:4f8:150:805b::94" +fw_local_interfaces: + - "eth1" +fw_local_interfaces_v6: [] + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "49.13.0.25:3890:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip diff --git a/host_vars/ki-fm.oopen.de/ki-fm-common.yml b/host_vars/ki-fm.oopen.de/ki-fm-common.yml deleted file mode 100644 index 1529a53..0000000 --- a/host_vars/ki-fm.oopen.de/ki-fm-common.yml +++ /dev/null @@ -1,180 +0,0 @@ ---- - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - -sshd_permit_root_login: !!str "prohibit-password" - -# --- -# vars used by apt.yml -# --- - -apt_install_extra_pkgs: true -apt_extra_pkgs: - - python3 - - python3-venv - - python3-pip - - build-essential - - libxml2-dev - - libxslt1-dev - - -# --- -# vars used by roles/common/tasks/systemd-resolved.yml -# --- - -systemd_resolved: true - -# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie -# Primäre DNS-Adresse: 38.132.106.139 -# Sekundäre DNS-Adresse: 194.187.251.67 -# -# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen -# primäre DNS-Adresse -# IPv4: 1.1.1.1 -# IPv6: 2606:4700:4700::1111 -# sekundäre DNS-Adresse -# IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# -# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit -# primäre DNS-Adresse -# IPv4: 8.8.8.8 -# IPv6: 2001:4860:4860::8888 -# sekundäre DNS-Adresse -# IPv4: 8.8.4.4 -# IPv6: 2001:4860:4860::8844 -# -# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug -# primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe -# sekundäre DNS-Adresse -# IPv4: 149.112.112.112 -# IPv6: 2620:fe::9 -# -# OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de -# IPv4: 194.36.144.87 - ns29.de -# IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) -# IPv4: 5.1.66.255 -# IPv6: 2001:678:e68:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# IPv4: 185.150.99.255 -# IPv6: 2001:678:ed0:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) -resolved_nameserver: - - 185.12.64.2 - - 185.12.64.1 - - 2a01:4ff:ff00::add:2 - - 2a01:4ff:ff00::add:1 - -# search domains -# -# If there are more than one search domains, then specify them here in the order in which -# the resolver should also search them -# -# resolved_domains: [] -resolved_domains: - - ~. - - oopen.de - -resolved_dnssec: false - -# dns.as250.net: 194.150.168.168 -# -resolved_fallback_nameserver: - - 194.150.168.168 - - -# --- -# vars used by roles/common/tasks/cron.yml -# --- - -cron_env_entries: - - name: PATH - job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin - - - name: SHELL - job: /bin/bash - insertafter: PATH - - -cron_user_special_time_entries: - - - name: "Restart DNS Cache service 'systemd-resolved'" - special_time: reboot - job: "sleep 5 ; /bin/systemctl restart systemd-resolved" - insertafter: PATH - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - -sudo_users: - - chris - - sysadm - - localadmin - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - -sudoers_file_user_privileges: - - name: back - entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php' - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- -# -# see: roles/common/tasks/vars - - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- diff --git a/host_vars/lists.mx.warenform.de/lists.mx-ipt-server.yml b/host_vars/lists.mx.warenform.de/lists.mx-ipt-server.yml new file mode 100644 index 0000000..37b2481 --- /dev/null +++ b/host_vars/lists.mx.warenform.de/lists.mx-ipt-server.yml @@ -0,0 +1,37 @@ +--- +# ipt-firewall configuration for lists.mx.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" + - "eth1" +fw_ext_ips_v4: + - "83.223.86.78" + - "83.223.86.77" +fw_ext_ips_v6: + - "2a01:30:0:13:223:35ff:fef5:84b6 2a01:30:0:505:223:35ff:fef5:84b6" + - "2a01:30:0:13:26e:a5ff:fe01:1bd8 2a01:30:0:505:26e:a5ff:fe01:1bd8" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Portforwarding +fw_portforward_tcp_v4: "$ext_if_2:83.223.86.77:80:83.223.86.76:80 $ext_if_2:83.223.86.77:443:83.223.86.76:443" +fw_portforward_tcp_v6: "$ext_if_2,2a01:30:0:13:26e:a5ff:fe01:1bd8,80,2a01:30:0:13:231:32ff:fe8b:7763,80 $ext_if_2,2a01:30:0:13:26e:a5ff:fe01:1bd8,443,2a01:30:0:13:231:32ff:fe8b:7763,443" + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/mail-neu.cadus.org/mail-neu-common.yml b/host_vars/mail-neu.cadus.org/mail-neu-common.yml deleted file mode 100644 index fc0b334..0000000 --- a/host_vars/mail-neu.cadus.org/mail-neu-common.yml +++ /dev/null @@ -1,241 +0,0 @@ ---- - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - - -# --- -# vars used by roles/common/tasks/apt.yml -# --- - -install_compiler_pkgs: true - -install_postgresql_pkgs: false - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - -insert_root_ssh_keypair: true - -root_ssh_keypair: - - name: id-rsa-dehydrated - priv_key_src: mail.cadus/root/.ssh/mail.cadus-id_rsa-dehydrated - priv_key_dest: /root/.ssh/id_rsa-dehydrated - pub_key_src: mail.cadus/root/.ssh/mail.cadus-id_rsa-dehydrated.pub - pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub - - name: id-rsa-opendkim - priv_key_src: mail.cadus/root/.ssh/mail.cadus-id_rsa-opendkim - priv_key_dest: /root/.ssh/id_rsa-opendkim - pub_key_src: mail.cadus/root/.ssh/mail.cadus-id_rsa-opendkim.pub - pub_key_dest: /root/.ssh/id_rsa-opendkim.pub - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/copy_files.yml -# --- - -copy_plain_files: - - # /root/bin/monitoring - # - - name: monitoring_check_cert_for_dovecot.conf - src_path: mail.cadus/root/bin/monitoring/conf/check_cert_for_dovecot.conf - dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf - - # /root/bin/postfix - # - - name: postfix_create_opendkim_key.conf - src_path: mail.cadus/root/bin/postfix/conf/create_opendkim_key.conf - dest_path: /root/bin/postfix/conf/create_opendkim_key.conf - - - name: postfix_postfix_add_mailboxes.conf - src_path: mail.cadus/root/bin/postfix/conf/postfix_add_mailboxes.conf - dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf - - - name: postfix_sent_userinfo_postfix.conf - src_path: mail.cadus/root/bin/postfix/conf/sent_userinfo_postfix.conf - dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf - - - name: postfix_whitelist_mb_sigs.conf - src_path: mail.cadus/root/bin/postfix/conf/whitelist_mb_sigs.conf - dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf - - -copy_plain_files_postfwd_host_specific: - - - name: postfwd.wl-hosts - src_path: mail.cadus/etc/postfix/postfwd.wl-hosts - dest_path: /etc/postfix/postfwd.wl-hosts - - - name: postfwd.wl-nets - src_path: mail.cadus/etc/postfix/postfwd.wl-nets - dest_path: /etc/postfix/postfwd.wl-nets - - - name: postfwd.wl-sender - src_path: mail.cadus/etc/postfix/postfwd.wl-sender - dest_path: /etc/postfix/postfwd.wl-sender - - - name: postfwd.wl-user - src_path: mail.cadus/etc/postfix/postfwd.wl-user - dest_path: /etc/postfix/postfwd.wl-user - - # Postfix Firewall postfwd - # - # - name: postfwd.wl-user - # src_path: mail.cadus/etc/postfix/postfwd.wl-user - # dest_path: /etc/postfix/postfwd.wl-user - - -# copy_template_files: [] -# -# - name: mailsystem_install_amavis.conf -# src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2 -# dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf - - -# --- -# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml -# --- - -hostname: mail.cadus.org -ipv4_address: 135.181.22.161 -ipv6_address: 2a01:4f9:4b:46d1::161 - -admin_email: it@cadus.org -is_relay_host: !!str "false" - -db_in_use: !!str "true" -# postfix_db_type -# -# possible values are 'PostgreSQL' and 'MySQL' -postfix_db_type: MySQL -postfix_db_name: postfix -postfix_db_user: postfix -# postfix_db_host: -postfix_db_pass: T3CJnFMJNX9wmhNs -mysql_credentials: !!str "-u root -S /run/mysqld/mysqld.sock" - -# install_amavis.conf -# -mp_receipt_number: 106015125438 -si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07ed6db26621b11bca0e23d2a42b60aef3f7b7803a1466a964d90c7b1e82d67c7680c8f46b59a4e - -# install_postfixadmin.conf -# -website_name_postfixadmin: adm.cadus.org - -email_welcome_message: "\n -Hallo,\n - -Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n - -Cadus e.V. - Redefine Global Solidarity\n - ---\n -Cadus e.V.\n -Am Sudhaus 2\n -D-12053 Berlin\n -admin@cadus.org\n -" - -# install_update_dovecot.conf -# -dovecot_from_address: "Administrator E-Mail " -dovecot_reply_to: "admin@cadus.org" -webmailer_address: "https://webmail.cadus.org" -salutation: "Cadus e.V. - Redefine Global Solidarity\n - ---\n -Cadus e.V.\n -Am Sudhaus 2\n -D-12053 Berlin\n -admin@cadus.org\n -" - -# install_upgrade_roundcube-webmail.conf -# -# Webmailer -webmail_site_name: webmail.cadus.org -autoreply_hostname: autoreply.cadus.org -# possible values: 'pgsql' or 'mysql' -roundcube_db_type: mysql -roundcube_db_name: roundcubemail -roundcube_db_user: roundcube -# roundcube_db_host: -roundcube_db_pass: 'j3vqsK7Ldm7MxNjH' - -roundcube_acl_plugin: false - -roundcube_product_name: O.OPEN - Webmailer -roundcube_support_url: https://www.cadus.org -roundcube_skin_logo: "images/cadu_logo_webmail.png" - - -template_files_mailsystem_script: - - - name: mailsystem_install_amavis.conf - src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2 - dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf - - - name: mailsystem_install_postfixadmin.conf - src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2 - dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf - - - name: mailsystem_install_postfixadmin.conf - src_path: usr/local/src/mailsystem/conf/install_postfixadmin.conf.j2 - dest_path: /usr/local/src/mailsystem/conf/install_postfixadmin.conf - - - name: mailsystem_install_update_dovecot.conf - src_path: usr/local/src/mailsystem/conf/install_update_dovecot.conf.j2 - dest_path: /usr/local/src/mailsystem/conf/install_update_dovecot.conf - - - name: mailsystem_install_upgrade_roundcube-webmail.conf - src_path: usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf.j2 - dest_path: /usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf diff --git a/host_vars/mail.cadus.org/mail-ipt-server.yml b/host_vars/mail.cadus.org/mail-ipt-server.yml new file mode 100644 index 0000000..576a170 --- /dev/null +++ b/host_vars/mail.cadus.org/mail-ipt-server.yml @@ -0,0 +1,32 @@ +--- +# ipt-firewall configuration for mail.cadus.org +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "135.181.22.161" +fw_ext_ips_v6: + - "2a01:4f9:4b:46d1::161" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_server_ips: $ext_1_ip +fw_mail_client_ips: $ext_1_ip + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Protection / limits +fw_limit_connections_per_source_IP: false diff --git a/host_vars/mail.faire-mobilitaet.de/mail-ipt-server.yml b/host_vars/mail.faire-mobilitaet.de/mail-ipt-server.yml new file mode 100644 index 0000000..a395c98 --- /dev/null +++ b/host_vars/mail.faire-mobilitaet.de/mail-ipt-server.yml @@ -0,0 +1,32 @@ +--- +# ipt-firewall configuration for mail.faire-mobilitaet.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "142.132.147.169" +fw_ext_ips_v6: + - "2a01:4f8:261:1994::169" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_server_ips: $ext_1_ip +fw_mail_client_ips: $ext_1_ip + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/matomo-01.oopen.de/matomo-01-ipt-server.yml b/host_vars/matomo-01.oopen.de/matomo-01-ipt-server.yml new file mode 100644 index 0000000..7e848ef --- /dev/null +++ b/host_vars/matomo-01.oopen.de/matomo-01-ipt-server.yml @@ -0,0 +1,27 @@ +--- +# ipt-firewall configuration for matomo-01.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "162.55.82.77" +fw_ext_ips_v6: + - "2a01:4f8:271:1266::77" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/meet.akweb.de/meet-ipt-server.yml b/host_vars/meet.akweb.de/meet-ipt-server.yml new file mode 100644 index 0000000..d3479d2 --- /dev/null +++ b/host_vars/meet.akweb.de/meet-ipt-server.yml @@ -0,0 +1,32 @@ +--- +# ipt-firewall configuration for meet.akweb.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "148.251.14.136" +fw_ext_ips_v6: + - "2a01:4f8:201:7389::136" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Jitsi +fw_jitsi_server_ips: $ext_1_ip +fw_jitsi_dovecot_auth: true +fw_jitsi_dovecot_host: a.mx.oopen.de + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/meet.oopen.de/meet-ipt-server.yml b/host_vars/meet.oopen.de/meet-ipt-server.yml new file mode 100644 index 0000000..718820d --- /dev/null +++ b/host_vars/meet.oopen.de/meet-ipt-server.yml @@ -0,0 +1,29 @@ +--- +# ipt-firewall configuration for meet.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "159.69.74.155" +fw_ext_ips_v6: + - "2a01:4f8:231:19a7::155" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Jitsi +fw_jitsi_server_ips: $ext_1_ip +fw_jitsi_dovecot_auth: true +fw_jitsi_dovecot_host: a.mx.oopen.de diff --git a/host_vars/mm-migration.oopen.de/mm-migration-common.yml b/host_vars/mm-migration.oopen.de/mm-migration-common.yml deleted file mode 100644 index 508cfaf..0000000 --- a/host_vars/mm-migration.oopen.de/mm-migration-common.yml +++ /dev/null @@ -1,140 +0,0 @@ ---- - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - -sshd_permit_root_login: !!str "prohibit-password" - -# --- -# vars used by apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/systemd-resolved.yml -# --- - -systemd_resolved: true - -# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie -# Primäre DNS-Adresse: 38.132.106.139 -# Sekundäre DNS-Adresse: 194.187.251.67 -# -# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen -# primäre DNS-Adresse -# IPv4: 1.1.1.1 -# IPv6: 2606:4700:4700::1111 -# sekundäre DNS-Adresse -# IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# -# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit -# primäre DNS-Adresse -# IPv4: 8.8.8.8 -# IPv6: 2001:4860:4860::8888 -# sekundäre DNS-Adresse -# IPv4: 8.8.4.4 -# IPv6: 2001:4860:4860::8844 -# -# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug -# primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe -# sekundäre DNS-Adresse -# IPv4: 149.112.112.112 -# IPv6: 2620:fe::9 -# -# OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de -# IPv4: 194.36.144.87 - ns29.de -# IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) -# IPv4: 5.1.66.255 -# IPv6: 2001:678:e68:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# IPv4: 185.150.99.255 -# IPv6: 2001:678:ed0:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) -resolved_nameserver: - - 185.12.64.1 - - 2a01:4ff:ff00::add:2 - - 195.201.179.131 - - 95.217.204.204 - -# search domains -# -# If there are more than one search domains, then specify them here in the order in which -# the resolver should also search them -# -# resolved_domains: [] -resolved_domains: - - oopen.de - -resolved_dnssec: false - -# dns.as250.net: 194.150.168.168 -# -resolved_fallback_nameserver: - - 194.150.168.168 - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- -# -# see: roles/common/tasks/vars - - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- diff --git a/host_vars/mm-nd-test.oopen.de/mm-nd-common.yml b/host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml similarity index 100% rename from host_vars/mm-nd-test.oopen.de/mm-nd-common.yml rename to host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml diff --git a/host_vars/mm-nd-test.oopen.de/mm-nd-ipt-server.yml b/host_vars/mm-nd-test.oopen.de/mm-nd-test-ipt-server.yml similarity index 100% rename from host_vars/mm-nd-test.oopen.de/mm-nd-ipt-server.yml rename to host_vars/mm-nd-test.oopen.de/mm-nd-test-ipt-server.yml diff --git a/host_vars/munin.oopen.de/munin-ipt-server.yml b/host_vars/munin.oopen.de/munin-ipt-server.yml new file mode 100644 index 0000000..979b180 --- /dev/null +++ b/host_vars/munin.oopen.de/munin-ipt-server.yml @@ -0,0 +1,25 @@ +--- +# ipt-firewall configuration for munin.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "37.27.121.227" +fw_ext_ips_v6: + - "2a01:4f9:3070:2bda::227" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" +fw_munin_server_ips: $ext_1_ip + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/mx.warenform.de/mx-ipt-server.yml b/host_vars/mx.warenform.de/mx-ipt-server.yml new file mode 100644 index 0000000..2e6f11b --- /dev/null +++ b/host_vars/mx.warenform.de/mx-ipt-server.yml @@ -0,0 +1,35 @@ +--- +# ipt-firewall configuration for mx.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.76" +fw_ext_ips_v6: + - "2a01:30:0:13:231:32ff:fe8b:7763 2a01:30:0:505:231:32ff:fe8b:7763" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip $ext_2_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_server_ips: $ext_1_ip +fw_mail_client_ips: $ext_1_ip +fw_dovecot_auth_service: true +fw_dovecot_auth_allowed_networks_v4: "meet.faire-integration.de" +fw_dovecot_auth_allowed_networks_v6: "meet.faire-integration.de" + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/nd-archiv.warenform.de/nd-archiv-ipt-server.yml b/host_vars/nd-archiv.warenform.de/nd-archiv-ipt-server.yml new file mode 100644 index 0000000..bd2f1f0 --- /dev/null +++ b/host_vars/nd-archiv.warenform.de/nd-archiv-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for nd-archiv.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.51" +fw_ext_ips_v6: + - "2a01:30:0:13:243:ff:feab:2b92 2a01:30:0:505:243:ff:feab:2b92" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "wf.oopen.de:9998:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/nd-epaper.warenform.de/nd-epaper-ipt-server.yml b/host_vars/nd-epaper.warenform.de/nd-epaper-ipt-server.yml new file mode 100644 index 0000000..0e27da2 --- /dev/null +++ b/host_vars/nd-epaper.warenform.de/nd-epaper-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for nd-epaper.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.90" +fw_ext_ips_v6: + - "2a01:30:0:505:2f4:30ff:fead:f4f 2a01:30:0:13:2f4:30ff:fead:f4f" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "wf.oopen.de:9998:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/nd-live.warenform.de/nd-live-ipt-server.yml b/host_vars/nd-live.warenform.de/nd-live-ipt-server.yml new file mode 100644 index 0000000..65dbb52 --- /dev/null +++ b/host_vars/nd-live.warenform.de/nd-live-ipt-server.yml @@ -0,0 +1,27 @@ +--- +# ipt-firewall configuration for nd-live.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.52" +fw_ext_ips_v6: + - "2a01:30:0:13:218:d3ff:fed6:74a2 2a01:30:0:505:218:d3ff:fed6:74a2" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "80.152.216.128:9998:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/ns.so36net.de/ns-ipt-server.yml b/host_vars/ns.so36net.de/ns-ipt-server.yml new file mode 100644 index 0000000..e015a59 --- /dev/null +++ b/host_vars/ns.so36net.de/ns-ipt-server.yml @@ -0,0 +1,41 @@ +--- +# ipt-firewall configuration for ns.so36net.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" + - "eth1" +fw_ext_ips_v4: + - "192.68.11.77" +fw_ext_ips_v6: + - "2001:678:a40:3000::77" + - "2a01:30:1fff:fd00::207" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- Forwarding +fw_forward_private_ips_v4: 192.168.63.0/24 10.0.202.0/24 + +# --- Access control IPv4 +fw_allow_ext_service_v4: "138.201.23.195:1036:tcp" + +# --- Access control IPv6 +fw_allow_ext_service_v6: "2a01:4f8:171:2895::195,1036,tcp" + +# --- SSH +fw_ssh_ports: 1036 + +# --- Mail +fw_dovecot_auth_port: 44444 + +# --- DNS +fw_dns_server_ips: $ext_ips + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o12.oopen.de/o12-ipt-server.yml b/host_vars/o12.oopen.de/o12-ipt-server.yml new file mode 100644 index 0000000..4e539a5 --- /dev/null +++ b/host_vars/o12.oopen.de/o12-ipt-server.yml @@ -0,0 +1,36 @@ +--- +# ipt-firewall configuration for o12.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "83.223.86.115" +fw_ext_ips_v6: + - "2a01:30:0:13:5054:ff:fe2a:b776 2a01:30:0:505:5054:ff:fe2a:b776" +fw_lxc_guest_ips_v4: + - "83.223.86.116 83.223.86.117" + - "83.223.86.118" + - "83.223.86.119" +fw_lxc_guest_ips_v6: + - "2a01:30:0:13:2c5:48ff:feee:f21c 2a01:30:0:505:2c5:48ff:feee:f21c 2a01:30:0:13:2c5:48ff:feee:f21d 2a01:30:0:505:2c5:48ff:feee:f21d" + - "2a01:30:0:13:2c7:5bff:fe44:bd50 2a01:30:0:505:2c7:5bff:fe44:bd50" + - "2a01:30:0:13:218:f2ff:fe28:77ca 2a01:30:0:505:218:f2ff:fe28:77ca" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- VPN / WireGuard +fw_wireguard_server_ips: $ext_ips + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-ipt-server.yml b/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-ipt-server.yml new file mode 100644 index 0000000..75b6edc --- /dev/null +++ b/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-ipt-server.yml @@ -0,0 +1,29 @@ +--- +# ipt-firewall configuration for o13-cryptpad.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_interfaces_v6: + - "eth1" +fw_ext_ips_v4: + - "83.223.90.238" +fw_ext_ips_v6: + - "2a01:31:0:2::ad52:a238" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o13-git.oopen.de/o13-git-ipt-server.yml b/host_vars/o13-git.oopen.de/o13-git-ipt-server.yml new file mode 100644 index 0000000..d7c0440 --- /dev/null +++ b/host_vars/o13-git.oopen.de/o13-git-ipt-server.yml @@ -0,0 +1,21 @@ +--- +# ipt-firewall configuration for o13-git.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.90.235" +fw_ext_ips_v6: + - "2a01:31:0:2::ad52:a235" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_ips diff --git a/host_vars/o13-mail.oopen.de/o13-mail-ipt-server.yml b/host_vars/o13-mail.oopen.de/o13-mail-ipt-server.yml new file mode 100644 index 0000000..cd67a8b --- /dev/null +++ b/host_vars/o13-mail.oopen.de/o13-mail-ipt-server.yml @@ -0,0 +1,41 @@ +--- +# ipt-firewall configuration for o13-mail.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" + - "eth1" +fw_ext_interfaces_v6: + - "eth2" + - "eth3" +fw_ext_ips_v4: + - "83.223.90.231" + - "83.223.90.232" +fw_ext_ips_v6: + - "2a01:31:0:2::ad52:a231" + - "2a01:31:0:2::ad52:a232" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "192.68.11.77:1036:tcp" + +# --- Access control IPv6 +fw_allow_ext_service_v6: "2001:678:a40:3000::77,1036,tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip $ext_2_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_server_ips: $ext_1_ip +fw_mail_client_ips: $ext_1_ip $ext_2_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o13-mumble.oopen.de/o13-mumble-ipt-server.yml b/host_vars/o13-mumble.oopen.de/o13-mumble-ipt-server.yml new file mode 100644 index 0000000..e08e83f --- /dev/null +++ b/host_vars/o13-mumble.oopen.de/o13-mumble-ipt-server.yml @@ -0,0 +1,29 @@ +--- +# ipt-firewall configuration for o13-mumble.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_interfaces_v6: + - "eth1" +fw_ext_ips_v4: + - "83.223.90.234" +fw_ext_ips_v6: + - "2a01:31:0:2::ad52:a234" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mumble +fw_mumble_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o13-pad.oopen.de/o13-pad-ipt-server.yml b/host_vars/o13-pad.oopen.de/o13-pad-ipt-server.yml new file mode 100644 index 0000000..a66eefd --- /dev/null +++ b/host_vars/o13-pad.oopen.de/o13-pad-ipt-server.yml @@ -0,0 +1,29 @@ +--- +# ipt-firewall configuration for o13-pad.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_interfaces_v6: + - "eth1" +fw_ext_ips_v4: + - "83.223.90.236" +fw_ext_ips_v6: + - "2a01:31:0:2::ad52:a236" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o13.oopen.de/o13-ipt-server.yml b/host_vars/o13.oopen.de/o13-ipt-server.yml new file mode 100644 index 0000000..51deb53 --- /dev/null +++ b/host_vars/o13.oopen.de/o13-ipt-server.yml @@ -0,0 +1,27 @@ +--- +# ipt-firewall configuration for o13.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_interfaces_v6: + - "brv6" +fw_ext_ips_v4: + - "83.223.90.230" +fw_ext_ips_v6: + - "2a01:31:0:2::ad52:a668" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o14.oopen.de/o14-ipt-server.yml b/host_vars/o14.oopen.de/o14-ipt-server.yml new file mode 100644 index 0000000..bc09a85 --- /dev/null +++ b/host_vars/o14.oopen.de/o14-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for o14.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "194.36.145.189" +fw_ext_ips_v6: + - "2a03:4000:4d:2cd:3466:79ff:fe58:9bd8" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip diff --git a/host_vars/o17.oopen.de/o17-ipt-server.yml b/host_vars/o17.oopen.de/o17-ipt-server.yml new file mode 100644 index 0000000..a0c7376 --- /dev/null +++ b/host_vars/o17.oopen.de/o17-ipt-server.yml @@ -0,0 +1,39 @@ +--- +# ipt-firewall configuration for o17.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "83.223.85.203" +fw_ext_ips_v6: + - "2a01:30:0:13:5054:ff:fe48:cedc 2a01:30:0:505:5054:ff:fe48:cedc" +fw_lxc_guest_ips_v4: + - "83.223.85.207" + - "83.223.85.205 83.223.85.206" +fw_lxc_guest_ips_v6: + - "2a01:30:0:13:243:c1ff:fea8:c906 2a01:30:0:505:243:c1ff:fea8:c906" + - "2a01:30:0:13:2eb:f4ff:feaa:d996 2a01:30:0:505:2eb:f4ff:feaa:d996 2a01:30:0:13:2eb:f4ff:feaa:d997 2a01:30:0:505:2eb:f4ff:feaa:d997" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true + +# --- VPN / WireGuard +fw_vpn_server_ips: $ext_ips +fw_vpn_server_ips_v6: "" +fw_wireguard_server_ips: $ext_ips + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o18.oopen.de/o18-ipt-server.yml b/host_vars/o18.oopen.de/o18-ipt-server.yml new file mode 100644 index 0000000..9f15bd9 --- /dev/null +++ b/host_vars/o18.oopen.de/o18-ipt-server.yml @@ -0,0 +1,26 @@ +--- +# ipt-firewall configuration for o18.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "5.9.97.103" +fw_ext_ips_v6: + - "2a01:4f8:162:2477::2" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true diff --git a/host_vars/o19.oopen.de/o19-ipt-server.yml b/host_vars/o19.oopen.de/o19-ipt-server.yml new file mode 100644 index 0000000..9272ef7 --- /dev/null +++ b/host_vars/o19.oopen.de/o19-ipt-server.yml @@ -0,0 +1,29 @@ +--- +# ipt-firewall configuration for o19.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "37.27.121.254" +fw_ext_ips_v6: + - "2a01:4f9:3070:2bda::2" +fw_lxc_guest_ips_v6: + - "2a01:4f9:3070:2bda::218" + - "2a01:4f9:3070:2bda::221" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true diff --git a/host_vars/o20.oopen.de/o20-ipt-server.yml b/host_vars/o20.oopen.de/o20-ipt-server.yml new file mode 100644 index 0000000..b40f609 --- /dev/null +++ b/host_vars/o20.oopen.de/o20-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for o20.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "enp0s31f6" +fw_ext_ips_v4: + - "78.46.100.9" +fw_ext_ips_v6: + - "2a01:4f8:120:9353::2" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o21.oopen.de/o21-ipt-server.yml b/host_vars/o21.oopen.de/o21-ipt-server.yml new file mode 100644 index 0000000..b4bda55 --- /dev/null +++ b/host_vars/o21.oopen.de/o21-ipt-server.yml @@ -0,0 +1,39 @@ +--- +# ipt-firewall configuration for o21.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "enp1s0" +fw_ext_interfaces_v6: + - "enp7s0" +fw_ext_ips_v4: + - "83.223.90.20" +fw_ext_ips_v6: + - "2a01:31:0:2::f851:1" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_restrict_local_service_to_net_v4: "83.223.86.121/32:83.223.90.20:3306:tcp 83.223.86.122/32:83.223.90.20:3306:tcp 83.223.86.124/32:83.223.90.20:3306:tcp" + +# --- Access control IPv6 +fw_restrict_local_service_to_net_v6: "2a01:30:0:505:263:20ff:feaa:7783,2a01:31:0:2::f851:1,3306,tcp 2a01:30:0:13:263:20ff:feaa:7783,2a01:31:0:2::f851:1,3306,tcp 2a01:30:0:505:230:54ff:fe71:e8a8,2a01:31:0:2::f851:1,3306,tcp 2a01:30:0:13:230:54ff:fe71:e8a8,2a01:31:0:2::f851:1,3306,tcp" + +# --- HTTP +fw_http_server_ips: $ext_ips + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 + +# --- Protection / limits +fw_limit_connections_per_source_IP: false +fw_limit_connections_per_source_IP_v6: true +fw_per_IP_connection_limit: 2048 +fw_per_IP_connection_limit_v6: 1024 +fw_limit_new_tcp_connections_per_seconds_per_source_IP: false diff --git a/host_vars/o22.oopen.de/o22-ipt-server.yml b/host_vars/o22.oopen.de/o22-ipt-server.yml new file mode 100644 index 0000000..c9658fa --- /dev/null +++ b/host_vars/o22.oopen.de/o22-ipt-server.yml @@ -0,0 +1,40 @@ +--- +# ipt-firewall configuration for o22.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "83.223.86.120" +fw_ext_ips_v6: + - "2a01:30:0:13:5054:ff:fe9f:422f 2a01:30:0:505:5054:ff:fe9f:422f" +fw_lxc_guest_ips_v4: + - "83.223.86.121" + - "83.223.86.123" + - "83.223.86.122" + - "83.223.86.124" + - "83.223.86.125" +fw_lxc_guest_ips_v6: + - "2a01:30:0:13:2e0:7bff:fe9a:b18a 2a01:30:0:505:2e0:7bff:fe9a:b18a" + - "2a01:30:0:13:281:fdff:fe3f:3ada 2a01:30:0:505:281:fdff:fe3f:3ada" + - "2a01:30:0:13:230:54ff:fe71:e8a8 2a01:30:0:505:230:54ff:fe71:e8a8" + - "2a01:30:0:505:263:20ff:feaa:7783 2a01:30:0:13:263:20ff:feaa:7783" + - "2a01:30:0:13:2e2:5bff:fe28:8cb8 2a01:30:0:505:2e2:5bff:fe28:8cb8" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_forward_private_ips_v4: 192.168.3.121 192.168.3.122 192.168.3.123 192.168.3.124 192.168.3.125 + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o23.oopen.de/o23-ipt-server.yml b/host_vars/o23.oopen.de/o23-ipt-server.yml new file mode 100644 index 0000000..cd38468 --- /dev/null +++ b/host_vars/o23.oopen.de/o23-ipt-server.yml @@ -0,0 +1,46 @@ +--- +# ipt-firewall configuration for o23.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "159.69.74.150" +fw_ext_ips_v6: + - "2a01:4f8:231:19a7::2" +fw_lxc_guest_ips_v4: + - "195.201.179.131" + - "159.69.74.143" + - "159.69.74.144" + - "159.69.74.155" + - "159.69.74.147" + - "159.69.74.156" +fw_lxc_guest_ips_v6: + - "2a01:4f8:231:19a7::131" + - "2a01:4f8:231:19a7::143" + - "2a01:4f8:231:19a7::144" + - "2a01:4f8:231:19a7::155" + - "2a01:4f8:231:19a7::147" + - "2a01:4f8:231:19a7::156" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_forward_between_interfaces: true + +# --- Out ports +fw_tcp_out_ports: 1036 +fw_tcp_out_ports_v6: "" + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o24.oopen.de/o24-ipt-server.yml b/host_vars/o24.oopen.de/o24-ipt-server.yml new file mode 100644 index 0000000..1530e06 --- /dev/null +++ b/host_vars/o24.oopen.de/o24-ipt-server.yml @@ -0,0 +1,26 @@ +--- +# ipt-firewall configuration for o24.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "157.90.140.173" +fw_ext_ips_v6: + - "2a01:4f8:2220:37c3::2" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true diff --git a/host_vars/o26.oopen.de/o26-ipt-server.yml b/host_vars/o26.oopen.de/o26-ipt-server.yml new file mode 100644 index 0000000..958581a --- /dev/null +++ b/host_vars/o26.oopen.de/o26-ipt-server.yml @@ -0,0 +1,28 @@ +--- +# ipt-firewall configuration for o26.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "enp6s0" +fw_ext_ips_v4: + - "37.27.129.85" +fw_ext_ips_v6: + - "2a01:4f9:3071:1141::2" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- SSH +fw_ssh_server_ips_v6: $ext_1_ip + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip +fw_mail_client_ips_v6: "" diff --git a/host_vars/o27.oopen.de/o27-ipt-server.yml b/host_vars/o27.oopen.de/o27-ipt-server.yml new file mode 100644 index 0000000..2dfb4ad --- /dev/null +++ b/host_vars/o27.oopen.de/o27-ipt-server.yml @@ -0,0 +1,34 @@ +--- +# ipt-firewall configuration for o27.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "142.132.147.171" +fw_ext_ips_v6: + - "2a01:4f8:261:1994::2" +fw_lxc_guest_ips_v4: + - "142.132.147.170" + - "142.132.147.169" +fw_lxc_guest_ips_v6: + - "2a01:4f8:261:1994::170" + - "2a01:4f8:261:1994::169" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_forward_between_interfaces: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o28.oopen.de/o28-ipt-server.yml b/host_vars/o28.oopen.de/o28-ipt-server.yml new file mode 100644 index 0000000..4304afa --- /dev/null +++ b/host_vars/o28.oopen.de/o28-ipt-server.yml @@ -0,0 +1,29 @@ +--- +# ipt-firewall configuration for o28.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "88.198.56.204" +fw_ext_ips_v6: + - "2a01:4f8:222:2c2::2" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true + +# --- Mail +fw_smtpd_additional_outgoing_ports: 2525 diff --git a/host_vars/o29.oopen.de/o29-ipt-server.yml b/host_vars/o29.oopen.de/o29-ipt-server.yml new file mode 100644 index 0000000..208e755 --- /dev/null +++ b/host_vars/o29.oopen.de/o29-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for o29.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "65.21.220.154" +fw_ext_ips_v6: + - "2a01:4f9:3080:318c::2" +fw_lxc_guest_ips_v4: + - "65.21.220.152" +fw_lxc_guest_ips_v6: + - "2a01:4f9:3080:318c::152" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true diff --git a/host_vars/o30.oopen.de/o30-ipt-server.yml b/host_vars/o30.oopen.de/o30-ipt-server.yml new file mode 100644 index 0000000..5f174df --- /dev/null +++ b/host_vars/o30.oopen.de/o30-ipt-server.yml @@ -0,0 +1,35 @@ +--- +# ipt-firewall configuration for o30.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "148.251.14.157" +fw_ext_ips_v6: + - "2a01:4f8:201:7389::2" +fw_local_ips_v6: + - "2a01:4f8:201:7389::141" + - "2a01:4f8:201:7389::136" +fw_lxc_guest_ips_v4: + - "148.251.14.141" + - "148.251.14.136" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o31.oopen.de/o31-ipt-server.yml b/host_vars/o31.oopen.de/o31-ipt-server.yml new file mode 100644 index 0000000..b714b19 --- /dev/null +++ b/host_vars/o31.oopen.de/o31-ipt-server.yml @@ -0,0 +1,36 @@ +--- +# ipt-firewall configuration for o31.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "135.181.22.166" +fw_ext_ips_v6: + - "2a01:4f9:4b:46d1::2" +fw_lxc_guest_ips_v4: + - "135.181.22.153" + - "135.181.22.159" + - "135.181.22.161" +fw_lxc_guest_ips_v6: + - "2a01:4f9:4b:46d1::153" + - "2a01:4f9:4b:46d1::159" + - "2a01:4f9:4b:46d1::161" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_forward_between_interfaces: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o32.oopen.de/o32-common.yml b/host_vars/o32.oopen.de/o32-common.yml index 7c67beb..a4beeac 100644 --- a/host_vars/o32.oopen.de/o32-common.yml +++ b/host_vars/o32.oopen.de/o32-common.yml @@ -139,6 +139,8 @@ network_interfaces: sshd_login_grace_time: 0 +sshd_permit_root_login: !!str "no" + # --- # vars used by roles/common/tasks/apt.yml @@ -151,7 +153,7 @@ sshd_login_grace_time: 0 # vars used by roles/common/tasks/systemd-resolved.yml # --- -systemd_resolved: true +systemd_resolved: false # CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie # Primäre DNS-Adresse: 38.132.106.139 @@ -293,6 +295,11 @@ cron_user_entries: hour: '05' job: /root/bin/mysql/flush_host_cache.sh + - name: "Background job for nextcloud instance 'cloud.lubax.de'" + minute: '*/15' + hour: '*' + job: sudo -u "www-data" /usr/local/php/bin/php -f /var/www/cloud.lubax.de/htdocs/cron.php + - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)" minute: '23' hour: '05' @@ -345,6 +352,10 @@ sudo_users: # # see: roles/common/tasks/vars +sudoers_file_user_privileges: + - name: back + entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php' + # --- # vars used by roles/common/tasks/caching-nameserver.yml diff --git a/host_vars/cl-lubax.oopen.de/cl-lubax-ipt-server.yml b/host_vars/o32.oopen.de/o32-ipt-server.yml similarity index 65% rename from host_vars/cl-lubax.oopen.de/cl-lubax-ipt-server.yml rename to host_vars/o32.oopen.de/o32-ipt-server.yml index e7f0578..b947265 100644 --- a/host_vars/cl-lubax.oopen.de/cl-lubax-ipt-server.yml +++ b/host_vars/o32.oopen.de/o32-ipt-server.yml @@ -1,9 +1,9 @@ --- -# ipt-firewall configuration for cl-fm.oopen.de +# ipt-firewall configuration for o32.oopen.de # Generated by extract-fw-host-vars.py - review before committing! -# Place in: host_vars//ipt_firewall.yml +# Place in: host_vars//-ipt-server.yml -fw_manage_config: true +fw_manage_config: false # --- Network fw_ext_interfaces: @@ -22,6 +22,3 @@ fw_http_server_ips: $ext_1_ip # --- Mail fw_mail_client_ips: $ext_1_ip - -# --- Block -# fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o33-neu.oopen.de/o33-neu-common.yml b/host_vars/o33-neu.oopen.de/o33-neu-common.yml deleted file mode 100644 index 1225bba..0000000 --- a/host_vars/o33-neu.oopen.de/o33-neu-common.yml +++ /dev/null @@ -1,78 +0,0 @@ ---- - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - - -sshd_hostkeyalgorithms: [] - - -# --- -# vars used by roles/common/tasks/apt.yml -# --- - -# apt_manage_sources_list: false - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- - -root_user: - name: root - password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. diff --git a/host_vars/o35.oopen.de/o35-ipt-server.yml b/host_vars/o35.oopen.de/o35-ipt-server.yml new file mode 100644 index 0000000..f94ad31 --- /dev/null +++ b/host_vars/o35.oopen.de/o35-ipt-server.yml @@ -0,0 +1,46 @@ +--- +# ipt-firewall configuration for o35.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "95.217.204.218" +fw_ext_ips_v6: + - "2a01:4f9:4a:47e5::2" +fw_lxc_guest_ips_v4: + - "95.217.204.247" + - "95.217.204.204" + - "95.217.204.203" + - "95.217.204.227" + - "95.217.204.205" + - "95.217.204.206" +fw_lxc_guest_ips_v6: + - "2a01:4f9:4a:47e5::247" + - "2a01:4f9:4a:47e5::204" + - "2a01:4f9:4a:47e5::203" + - "2a01:4f9:4a:47e5::227" + - "2a01:4f9:4a:47e5::205" + - "2a01:4f9:4a:47e5::206" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 + +# --- Protection / limits +fw_limit_connections_per_source_IP_v6: false diff --git a/host_vars/o36.oopen.de/o36-ipt-server.yml b/host_vars/o36.oopen.de/o36-ipt-server.yml new file mode 100644 index 0000000..dc66f5e --- /dev/null +++ b/host_vars/o36.oopen.de/o36-ipt-server.yml @@ -0,0 +1,46 @@ +--- +# ipt-firewall configuration for o36.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "162.55.82.89" +fw_ext_ips_v6: + - "2a01:4f8:271:1266::2" +fw_lxc_guest_ips_v4: + - "162.55.82.73" + - "162.55.82.74" + - "162.55.82.77" + - "162.55.82.78" + - "162.55.82.76" + - "162.55.82.75" +fw_lxc_guest_ips_v6: + - "2a01:4f8:271:1266::73" + - "2a01:4f8:271:1266::74" + - "2a01:4f8:271:1266::77" + - "2a01:4f8:271:1266::78" + - "2a01:4f8:271:1266::76" + - "2a01:4f8:271:1266::75" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 + +# --- Kernel IPv4 +fw_kernel_support_dynaddr: true diff --git a/host_vars/o38.oopen.de/o38-ipt-server.yml b/host_vars/o38.oopen.de/o38-ipt-server.yml new file mode 100644 index 0000000..e0fbe65 --- /dev/null +++ b/host_vars/o38.oopen.de/o38-ipt-server.yml @@ -0,0 +1,38 @@ +--- +# ipt-firewall configuration for o38.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "213.133.111.115" +fw_ext_ips_v6: + - "2a01:4f8:222:161c::115" +fw_lxc_guest_ips_v4: + - "213.239.199.45" + - "213.239.199.46" +fw_lxc_guest_ips_v6: + - "2a01:4f8:222:161c::45" + - "2a01:4f8:222:161c::46" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true + +# --- SSH +fw_ssh_server_ips_v6: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/o39.oopen.de/o39-ipt-server.yml b/host_vars/o39.oopen.de/o39-ipt-server.yml new file mode 100644 index 0000000..b9d6e91 --- /dev/null +++ b/host_vars/o39.oopen.de/o39-ipt-server.yml @@ -0,0 +1,40 @@ +--- +# ipt-firewall configuration for o39.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "37.27.67.126" +fw_ext_ips_v6: + - "2a01:4f9:3081:34d1::126" +fw_lxc_guest_ips_v4: + - "37.27.67.114" + - "37.27.67.115" + - "37.27.67.116" + - "37.27.67.117" + - "37.27.67.118" + - "37.27.67.119" +fw_lxc_guest_ips_v6: + - "2a01:4f9:3081:34d1::114" + - "2a01:4f9:3081:34d1::115" + - "2a01:4f9:3081:34d1::116" + - "2a01:4f9:3081:34d1::117" + - "2a01:4f9:3081:34d1::118" + - "2a01:4f9:3081:34d1::119" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true diff --git a/host_vars/o40.oopen.de/o40-ipt-server.yml b/host_vars/o40.oopen.de/o40-ipt-server.yml new file mode 100644 index 0000000..08ff010 --- /dev/null +++ b/host_vars/o40.oopen.de/o40-ipt-server.yml @@ -0,0 +1,34 @@ +--- +# ipt-firewall configuration for o40.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "176.9.125.12" +fw_ext_ips_v6: + - "2a01:4f8:151:8415::2" +fw_lxc_guest_ips_v4: + - "176.9.125.42" + - "176.9.125.5" + - "176.9.125.39" +fw_lxc_guest_ips_v6: + - "2a01:4f8:151:8415::42" + - "2a01:4f8:151:8415::5" + - "2a01:4f8:151:8415::39" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true diff --git a/host_vars/o42.oopen.de/o42-ipt-server.yml b/host_vars/o42.oopen.de/o42-ipt-server.yml new file mode 100644 index 0000000..c4e8369 --- /dev/null +++ b/host_vars/o42.oopen.de/o42-ipt-server.yml @@ -0,0 +1,29 @@ +--- +# ipt-firewall configuration for o42.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "95.217.194.43" +fw_ext_ips_v6: + - "2a01:4f9:4a:5114::2" +fw_lxc_guest_ips_v4: + - "95.217.194.17" +fw_lxc_guest_ips_v6: + - "2a01:4f9:4a:5114::17" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_forward_between_interfaces: true diff --git a/host_vars/o43.oopen.de/o43-ipt-server.yml b/host_vars/o43.oopen.de/o43-ipt-server.yml new file mode 100644 index 0000000..3054ec0 --- /dev/null +++ b/host_vars/o43.oopen.de/o43-ipt-server.yml @@ -0,0 +1,42 @@ +--- +# ipt-firewall configuration for o43.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "176.9.62.77" +fw_ext_ips_v6: + - "2a01:4f8:150:805b::2" +fw_local_interfaces: + - "br1" +fw_local_interfaces_v6: [] +fw_lxc_guest_ips_v4: + - "176.9.62.69" + - "176.9.62.106" +fw_lxc_guest_ips_v6: + - "2a01:4f8:150:805b::69" + - "2a01:4f8:150:805b::106" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Outgoing / interfaces +fw_unprotected_ifs: $local_if_1 +fw_unprotected_ifs_v6: "" + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true + +# --- Kernel IPv4 +fw_dynaddr_flag: 1 diff --git a/host_vars/o44.oopen.de/o44-ipt-server.yml b/host_vars/o44.oopen.de/o44-ipt-server.yml new file mode 100644 index 0000000..051969b --- /dev/null +++ b/host_vars/o44.oopen.de/o44-ipt-server.yml @@ -0,0 +1,35 @@ +--- +# ipt-firewall configuration for o44.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "148.251.194.59" +fw_ext_ips_v6: + - "2a01:4f8:211:f89::2" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_activate_forwarding: true +fw_kernel_forward_between_interfaces: true + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Kernel IPv4 +fw_dynaddr_flag: 1 diff --git a/host_vars/oolm-db.oopen.de b/host_vars/oolm-db.oopen.de new file mode 120000 index 0000000..ec075f0 --- /dev/null +++ b/host_vars/oolm-db.oopen.de @@ -0,0 +1 @@ +o21.oopen.de \ No newline at end of file diff --git a/host_vars/oolm-db.oopen.de/oolm-db-common.yml b/host_vars/oolm-db.oopen.de/oolm-db-common.yml deleted file mode 100644 index 816a417..0000000 --- a/host_vars/oolm-db.oopen.de/oolm-db-common.yml +++ /dev/null @@ -1,72 +0,0 @@ ---- - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - -# sshd_pasword_auth_user: -# - chris - -# sshd_pasword_auth_ip: -# - 2003:ec:df0c:e7fe:ebb:d93b:1d33:3918 -# - 2003:ec:df0c:e7fe:4b3a:a5ba:c661:f7f6 - -# --- -# vars used by apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- -# -# see: roles/common/tasks/vars - - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- diff --git a/host_vars/oolm-shop-dev.oopen.de/oolm-shop-dev-ipt-server.yml b/host_vars/oolm-shop-dev.oopen.de/oolm-shop-dev-ipt-server.yml new file mode 100644 index 0000000..1ba696f --- /dev/null +++ b/host_vars/oolm-shop-dev.oopen.de/oolm-shop-dev-ipt-server.yml @@ -0,0 +1,40 @@ +--- +# ipt-firewall configuration for oolm-shop-dev.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.122" +fw_ext_ips_v6: + - "2a01:30:0:505:230:54ff:fe71:e8a8 2a01:30:0:13:230:54ff:fe71:e8a8" +fw_local_interfaces: + - "eth1" +fw_local_interfaces_v6: [] +fw_local_ips_v4: + - "192.168.3.122" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Outgoing / interfaces +fw_unprotected_ifs: eth1 +fw_unprotected_ifs_v6: "" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 + +# --- Protection / limits +fw_per_IP_connection_limit: 300 +fw_limit_new_tcp_connections_per_seconds_per_source_IP: false diff --git a/host_vars/oolm-web.oopen.de/oolm-web-ipt-server.yml b/host_vars/oolm-web.oopen.de/oolm-web-ipt-server.yml new file mode 100644 index 0000000..c095927 --- /dev/null +++ b/host_vars/oolm-web.oopen.de/oolm-web-ipt-server.yml @@ -0,0 +1,39 @@ +--- +# ipt-firewall configuration for oolm-web.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.125" +fw_ext_ips_v6: + - "2a01:30:0:13:2e2:5bff:fe28:8cb8 2a01:30:0:505:2e2:5bff:fe28:8cb8" +fw_local_interfaces: + - "eth1" +fw_local_interfaces_v6: [] +fw_local_ips_v4: + - "192.168.3.125" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Outgoing / interfaces +fw_unprotected_ifs: eth1 +fw_unprotected_ifs_v6: "" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/piwik.warenform.de/piwik-ipt-server.yml b/host_vars/piwik.warenform.de/piwik-ipt-server.yml new file mode 100644 index 0000000..bb87519 --- /dev/null +++ b/host_vars/piwik.warenform.de/piwik-ipt-server.yml @@ -0,0 +1,24 @@ +--- +# ipt-firewall configuration for piwik.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.84" +fw_ext_ips_v6: + - "2a01:30:0:13:25c:c8ff:fe1b:ea0c 2a01:30:0:505:25c:c8ff:fe1b:ea0c" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/prometheus-nd.oopen.de/prometheus-nd-ipt-server.yml b/host_vars/prometheus-nd.oopen.de/prometheus-nd-ipt-server.yml new file mode 100644 index 0000000..d35c3bd --- /dev/null +++ b/host_vars/prometheus-nd.oopen.de/prometheus-nd-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for prometheus-nd.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "176.9.62.69" +fw_ext_ips_v6: + - "2a01:4f8:150:805b::69" +fw_local_interfaces: + - "eth1" +fw_local_interfaces_v6: [] + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Prometheus +fw_prometheus_local_server_ips: $ext_1_ip diff --git a/host_vars/rage.so36.net/rage-ipt-server.yml b/host_vars/rage.so36.net/rage-ipt-server.yml new file mode 100644 index 0000000..c7ac3a6 --- /dev/null +++ b/host_vars/rage.so36.net/rage-ipt-server.yml @@ -0,0 +1,54 @@ +--- +# ipt-firewall configuration for rage.so36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "192.68.11.81" + - "192.68.11.90" + - "192.68.11.91" +fw_ext_ips_v6: + - "2001:678:a40:3000::81" + - "2001:678:a40:3000::90" + - "2001:678:a40:3000::91" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "192.68.11.77:1036:tcp 138.201.23.195:1036:tcp" + +# --- Access control IPv6 +fw_restrict_local_service_to_net_v6: "2001:678:a40:3000::79,$ext_1_ip,44444,tcp" +fw_allow_ext_service_v6: "2001:678:a40:3000::77,1036,tcp 2a01:4f8:171:2895::195,1036,tcp" + +# --- SSH +fw_ssh_ports: 1036 + +# --- HTTP +fw_http_server_ips: $ext_ips + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_server_ips: $ext_1_ip +fw_mail_client_ips: $ext_ips +fw_dovecot_auth_service: true +fw_dovecot_auth_service_v6: false +fw_dovecot_auth_port: 44444 +fw_dovecot_auth_allowed_networks_v4: 192.68.11.79 83.223.85.204 + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Out ports +fw_tcp_out_ports: 1036 +fw_tcp_out_ports_v6: "" + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/resolver-a.so36.net/resolver-a-ipt-server.yml b/host_vars/resolver-a.so36.net/resolver-a-ipt-server.yml new file mode 100644 index 0000000..87ef799 --- /dev/null +++ b/host_vars/resolver-a.so36.net/resolver-a-ipt-server.yml @@ -0,0 +1,38 @@ +--- +# ipt-firewall configuration for resolver-a.so36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "192.68.11.71" +fw_ext_ips_v6: + - "2001:678:a40:3000::71" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "138.201.23.195:1036:tcp" + +# --- Access control IPv6 +fw_allow_ext_service_v6: "2a01:4f8:171:2895::195,1036,tcp" + +# --- SSH +fw_ssh_ports: 1036 + +# --- Mail +fw_dovecot_auth_port: 44444 + +# --- DNS +fw_local_resolver_service: true +fw_resolver_allowed_networks_v4: 192.68.11.64/27 194.150.169.136/29 138.201.23.195 138.201.23.196 +fw_resolver_allowed_networks_v6: "2001:678:a40:3000::/64 2a01:4f8:171:2895::195 2a01:4f8:171:2895::196" + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/resolver-b.so36.net/resolver-b-ipt-server.yml b/host_vars/resolver-b.so36.net/resolver-b-ipt-server.yml new file mode 100644 index 0000000..958222a --- /dev/null +++ b/host_vars/resolver-b.so36.net/resolver-b-ipt-server.yml @@ -0,0 +1,38 @@ +--- +# ipt-firewall configuration for resolver-b.so36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "192.68.11.78" +fw_ext_ips_v6: + - "2001:678:a40:3000::78" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "138.201.23.195:1036:tcp" + +# --- Access control IPv6 +fw_allow_ext_service_v6: "2a01:4f8:171:2895::195,1036,tcp" + +# --- SSH +fw_ssh_ports: 1036 + +# --- Mail +fw_dovecot_auth_port: 44444 + +# --- DNS +fw_local_resolver_service: true +fw_resolver_allowed_networks_v4: 192.68.11.64/27 194.150.169.136/29 138.201.23.195 138.201.23.196 +fw_resolver_allowed_networks_v6: "2001:678:a40:3000::/64 2a01:4f8:171:2895::195 2a01:4f8:171:2895::196" + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/schleuder3.so36.net/schleuder3-ipt-server.yml b/host_vars/schleuder3.so36.net/schleuder3-ipt-server.yml new file mode 100644 index 0000000..a4d470f --- /dev/null +++ b/host_vars/schleuder3.so36.net/schleuder3-ipt-server.yml @@ -0,0 +1,34 @@ +--- +# ipt-firewall configuration for schleuder3.so36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "192.68.11.84" +fw_ext_ips_v6: + - "2001:678:a40:3000::84" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "192.68.11.77:1036:tcp 138.201.23.195:1036:tcp" + +# --- Access control IPv6 +fw_allow_ext_service_v6: "2001:678:a40:3000::77,1036,tcp 2a01:4f8:171:2895::195,1036,tcp" + +# --- SSH +fw_ssh_ports: 1036 + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_dovecot_auth_port_v6: 44444 diff --git a/host_vars/server18.warenform.de/server18-ipt-server.yml b/host_vars/server18.warenform.de/server18-ipt-server.yml new file mode 100644 index 0000000..f14b40b --- /dev/null +++ b/host_vars/server18.warenform.de/server18-ipt-server.yml @@ -0,0 +1,29 @@ +--- +# ipt-firewall configuration for server18.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "83.223.86.80" +fw_ext_ips_v6: + - "2a01:30:0:13:5054:ff:fea0:aa34 2a01:30:0:505:5054:ff:fea0:aa34" +fw_lxc_guest_ips_v4: + - "83.223.86.84" +fw_lxc_guest_ips_v6: + - "2a01:30:0:13:25c:c8ff:fe1b:ea0c 2a01:30:0:505:25c:c8ff:fe1b:ea0c" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/server22.warenform.de/server22-ipt-server.yml b/host_vars/server22.warenform.de/server22-ipt-server.yml new file mode 100644 index 0000000..3eab2b8 --- /dev/null +++ b/host_vars/server22.warenform.de/server22-ipt-server.yml @@ -0,0 +1,41 @@ +--- +# ipt-firewall configuration for server22.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" + - "eth2" + - "eth3" +fw_ext_interfaces_v6: + - "br0" +fw_ext_ips_v4: + - "83.223.83.20" + - "83.223.89.50" + - "83.223.85.70" +fw_ext_ips_v6: + - "2a01:30:0:13:5054:ff:fe21:682f/128 2a01:30:0:505:5054:ff:fe21:682f/128" +fw_lxc_guest_ips_v4: + - "83.223.86.50 83.223.86.53" + - "83.223.86.51" + - "83.223.86.90" + - "83.223.86.52" +fw_lxc_guest_ips_v6: + - "2a01:30:0:13:201:82ff:fedf:737a 2a01:30:0:505:201:82ff:fedf:737a 2a01:30:0:13:2f4:75ff:fe1e:376f 2a01:30:0:505:2f4:75ff:fe1e:376f" + - "2a01:30:0:13:243:ff:feab:2b92 2a01:30:0:505:243:ff:feab:2b92" + - "2a01:30:0:13:2f4:30ff:fead:f4f 2a01:30:0:505:2f4:30ff:fead:f4f" + - "2a01:30:0:13:218:d3ff:fed6:74a2 2a01:30:0:505:218:d3ff:fed6:74a2" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/server23.warenform.de/server23-ipt-server.yml b/host_vars/server23.warenform.de/server23-ipt-server.yml new file mode 100644 index 0000000..ef09c9e --- /dev/null +++ b/host_vars/server23.warenform.de/server23-ipt-server.yml @@ -0,0 +1,33 @@ +--- +# ipt-firewall configuration for server23.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "83.223.86.110" +fw_ext_ips_v6: + - "2a01:30:0:13:5054:ff:fe41:af9b 2a01:30:0:505:5054:ff:fe41:af9b" +fw_lxc_guest_ips_v4: + - "83.223.86.113" + - "83.223.86.112" + - "83.223.86.111" +fw_lxc_guest_ips_v6: + - "2a01:30:0:13:2fe:f9ff:fe23:24c4 2a01:30:0:505:2fe:f9ff:fe23:24c4" + - "2a01:30:0:13:2e7:f7ff:fec3:19bc 2a01:30:0:505:2e7:f7ff:fec3:19bc" + - "2a01:30:0:13:2db:b2ff:fef7:9647 2a01:30:0:505:2db:b2ff:fef7:9647" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/server24.warenform.de/server24-ipt-server.yml b/host_vars/server24.warenform.de/server24-ipt-server.yml new file mode 100644 index 0000000..8311367 --- /dev/null +++ b/host_vars/server24.warenform.de/server24-ipt-server.yml @@ -0,0 +1,31 @@ +--- +# ipt-firewall configuration for server24.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "83.223.86.75" +fw_ext_ips_v6: + - "2a01:30:0:13:5054:ff:fe6a:7f8d 2a01:30:0:505:5054:ff:fe6a:7f8d" +fw_lxc_guest_ips_v4: + - "83.223.86.78" + - "83.223.86.76" +fw_lxc_guest_ips_v6: + - "2a01:30:0:13:223:35ff:fef5:84b6 2a01:30:0:505:223:35ff:fef5:84b6" + - "2a01:30:0:13:231:32ff:fe8b:7763 2a01:30:0:505:231:32ff:fe8b:7763" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/server25.warenform.de/server25-ipt-server.yml b/host_vars/server25.warenform.de/server25-ipt-server.yml new file mode 100644 index 0000000..179c79c --- /dev/null +++ b/host_vars/server25.warenform.de/server25-ipt-server.yml @@ -0,0 +1,33 @@ +--- +# ipt-firewall configuration for server25.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "83.223.85.163" +fw_ext_ips_v6: + - "2a01:30:0:13:5054:ff:fef7:c0fb 2a01:30:0:505:5054:ff:fef7:c0fb" +fw_lxc_guest_ips_v4: + - "83.223.85.164" + - "83.223.85.165" + - "83.223.85.166" +fw_lxc_guest_ips_v6: + - "2a01:30:0:13:286:96ff:fe4a:6eee 2a01:30:0:505:286:96ff:fe4a:6eee" + - "2a01:30:0:13:234:5fff:fed7:5d81 2a01:30:0:505:234:5fff:fed7:5d81" + - "2a01:30:0:13:234:5fff:fed7:5d82 2a01:30:0:505:234:5fff:fed7:5d82" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/server26.warenform.de/server26-ipt-server.yml b/host_vars/server26.warenform.de/server26-ipt-server.yml new file mode 100644 index 0000000..a5ce7e7 --- /dev/null +++ b/host_vars/server26.warenform.de/server26-ipt-server.yml @@ -0,0 +1,34 @@ +--- +# ipt-firewall configuration for server26.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "178.63.33.18" +fw_ext_ips_v6: + - "2a01:4f8:110:401b::2" +fw_lxc_guest_ips_v4: + - "78.46.47.84" + - "78.46.47.82" +fw_lxc_guest_ips_v6: + - "2a01:4f8:110:401b::84" + - "2a01:4f8:110:401b::82" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_forward_between_interfaces: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/server27.warenform.de/server27-ipt-server.yml b/host_vars/server27.warenform.de/server27-ipt-server.yml new file mode 100644 index 0000000..cfcce31 --- /dev/null +++ b/host_vars/server27.warenform.de/server27-ipt-server.yml @@ -0,0 +1,34 @@ +--- +# ipt-firewall configuration for server27.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "br0" +fw_ext_ips_v4: + - "95.217.44.220" +fw_ext_ips_v6: + - "2a01:4f9:2a:3163::2" +fw_lxc_guest_ips_v4: + - "95.217.48.77" + - "95.217.54.30" +fw_lxc_guest_ips_v6: + - "2a01:4f9:2a:3163::77" + - "2a01:4f9:2a:3163::30" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Bridged / LXC +fw_do_not_firewall_bridged_traffic: true +fw_do_not_firewall_lx_guest_systems: true + +# --- Forwarding +fw_kernel_forward_between_interfaces: true + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/shell.so36.net/shell-ipt-server.yml b/host_vars/shell.so36.net/shell-ipt-server.yml new file mode 100644 index 0000000..2cf2bb5 --- /dev/null +++ b/host_vars/shell.so36.net/shell-ipt-server.yml @@ -0,0 +1,40 @@ +--- +# ipt-firewall configuration for shell.so36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "192.68.11.80" +fw_ext_ips_v6: + - "2001:678:a40:3000::80" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "192.68.11.64/27:1036:tcp 138.201.23.195:1036:tcp" + +# --- Access control IPv6 +fw_allow_ext_service_v6: "2001:678:a40:3000::/64,1036,tcp 2a01:4f8:171:2895::195,1036,tcp" + +# --- SSH +fw_ssh_ports: 1036 + +# --- Mail +fw_dovecot_auth_port: 44444 + +# --- VPN / WireGuard +fw_vpn_server_ips: 192.68.11.80 +fw_vpn_server_ips_v6: "2001:678:a40:3000::80" + +# --- Out ports +fw_tcp_out_ports: 5222 6667 6697 7000 + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/shop-dev.aufstehen-gegen-rassismus.de/shop-dev-common.yml b/host_vars/shop-dev.aufstehen-gegen-rassismus.de/shop-dev-common.yml deleted file mode 100644 index 5cf4cd8..0000000 --- a/host_vars/shop-dev.aufstehen-gegen-rassismus.de/shop-dev-common.yml +++ /dev/null @@ -1,205 +0,0 @@ ---- - -# --- -# vars used by roles/network_interfaces -# --- - - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - - -# --- -# vars used by roles/common/tasks/apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/systemd-resolved.yml -# --- - -systemd_resolved: false - -# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie -# Primäre DNS-Adresse: 38.132.106.139 -# Sekundäre DNS-Adresse: 194.187.251.67 -# -# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen -# primäre DNS-Adresse -# IPv4: 1.1.1.1 -# IPv6: 2606:4700:4700::1111 -# sekundäre DNS-Adresse -# IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# -# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit -# primäre DNS-Adresse -# IPv4: 8.8.8.8 -# IPv6: 2001:4860:4860::8888 -# sekundäre DNS-Adresse -# IPv4: 8.8.4.4 -# IPv6: 2001:4860:4860::8844 -# -# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug -# primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe -# sekundäre DNS-Adresse -# IPv4: 149.112.112.112 -# IPv6: 2620:fe::9 -# -# OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de -# IPv4: 194.36.144.87 - ns29.de -# IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) -# IPv4: 5.1.66.255 -# IPv6: 2001:678:e68:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# IPv4: 185.150.99.255 -# IPv6: 2001:678:ed0:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) -resolved_nameserver: - - 2a01:4ff:ff00::add:2 - - 185.12.64.2 - - 2a01:4ff:ff00::add:1 - - 185.12.64.1 - -# search domains -# -# If there are more than one search domains, then specify them here in the order in which -# the resolver should also search them -# -# resolved_domains: [] -resolved_domains: - - ~. - - oopen.de - -resolved_dnssec: false - -# dns.as250.net: 194.150.168.168 -# -resolved_fallback_nameserver: - - 194.150.168.168 - - -# --- -# vars used by roles/common/tasks/cron.yml -# --- - -cron_env_entries: - - name: PATH - job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin - - - name: SHELL - job: /bin/bash - insertafter: PATH - - -# cron_user_special_time_entries: -# -# - name: "Restart DNS Cache service 'systemd-resolved'" -# special_time: reboot -# job: "sleep 5 ; /bin/systemctl restart systemd-resolved" -# insertafter: PATH -# -# - name: "Check if postfix mailservice is running. Restart service if needed." -# special_time: reboot -# job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" -# insertafter: PATH -# -# - name: "Check if Check if all autostart LX-Container are running." -# special_time: reboot -# job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh" -# insertafter: PATH - - -cron_user_entries: - - - name: "Check if SSH service is running. Restart service if needed." - minute: '*/5' - hour: '*' - job: /root/bin/monitoring/check_ssh.sh - -# - name: "Check connectifity - reboot if needed" -# minute: '*/10' -# hour: '*' -# job: /root/bin/admin-stuff/check-connectivity.sh -# -# - name: "Check if Postfix Mailservice is up and running?" -# minute: '*/15' -# hour: '*' -# job: /root/bin/monitoring/check_postfix.sh -# -# - name: "Check if NTP service 'ntpsec' is up and running?" -# minute: '*/30' -# hour: '*' -# job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1 - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- - -root_user: - name: root - password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. diff --git a/host_vars/site36.net/site36.net-ipt-server.yml b/host_vars/site36.net/site36.net-ipt-server.yml new file mode 100644 index 0000000..9947638 --- /dev/null +++ b/host_vars/site36.net/site36.net-ipt-server.yml @@ -0,0 +1,27 @@ +--- +# ipt-firewall configuration for site36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "enp1s0" +fw_ext_ips_v4: + - "192.68.11.75" +fw_ext_ips_v6: + - "2001:678:a40:3000::75" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- SSH +fw_ssh_ports: 1036 + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip diff --git a/host_vars/stolpersteine.oopen.de/stolpersteine-ipt-server.yml b/host_vars/stolpersteine.oopen.de/stolpersteine-ipt-server.yml new file mode 100644 index 0000000..445ae6e --- /dev/null +++ b/host_vars/stolpersteine.oopen.de/stolpersteine-ipt-server.yml @@ -0,0 +1,25 @@ +--- +# ipt-firewall configuration for stolpersteine.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v6: + - "2a01:30:0:13:218:f2ff:fe28:77ca" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/sympa.so36.net/sympa-ipt-server.yml b/host_vars/sympa.so36.net/sympa-ipt-server.yml new file mode 100644 index 0000000..9f614f1 --- /dev/null +++ b/host_vars/sympa.so36.net/sympa-ipt-server.yml @@ -0,0 +1,41 @@ +--- +# ipt-firewall configuration for sympa.so36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "192.68.11.82" +fw_ext_ips_v6: + - "2001:678:a40:3000::82" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "192.68.11.77:1036:tcp 138.201.23.195:1036:tcp" + +# --- Access control IPv6 +fw_allow_ext_service_v6: "2001:678:a40:3000::77,1036,tcp 2a01:4f8:171:2895::195,1036,tcp" + +# --- SSH +fw_ssh_ports: 1036 + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_client_ips: $ext_1_ip +fw_dovecot_auth_port: 44444 + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/test.mariadb.oopen.de/test.mariadb-ipt-server.yml b/host_vars/test.mariadb.oopen.de/test.mariadb-ipt-server.yml new file mode 100644 index 0000000..28096e4 --- /dev/null +++ b/host_vars/test.mariadb.oopen.de/test.mariadb-ipt-server.yml @@ -0,0 +1,27 @@ +--- +# ipt-firewall configuration for test.mariadb.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.85.207" +fw_ext_ips_v6: + - "2a01:30:0:505:243:c1ff:fea8:c906 2a01:30:0:13:243:c1ff:fea8:c906" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/verdi-django.warenform.de/verdi-django-ipt-server.yml b/host_vars/verdi-django.warenform.de/verdi-django-ipt-server.yml new file mode 100644 index 0000000..748c661 --- /dev/null +++ b/host_vars/verdi-django.warenform.de/verdi-django-ipt-server.yml @@ -0,0 +1,39 @@ +--- +# ipt-firewall configuration for verdi-django.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "95.217.48.77" +fw_ext_ips_v6: + - "2a01:4f9:2a:3163::77" +fw_local_interfaces: + - "eth1" +fw_local_interfaces_v6: [] + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Outgoing / interfaces +fw_unprotected_ifs: $local_if_1 +fw_unprotected_ifs_v6: "" + +# --- Access control IPv4 +fw_allow_local_service_v4: "8080:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip +fw_http_ports: "$standard_http_ports,8000" +fw_http_ports_v6: $standard_http_ports + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/verdi-es.warenform.de/verdi-es-ipt-server.yml b/host_vars/verdi-es.warenform.de/verdi-es-ipt-server.yml new file mode 100644 index 0000000..db07f99 --- /dev/null +++ b/host_vars/verdi-es.warenform.de/verdi-es-ipt-server.yml @@ -0,0 +1,40 @@ +--- +# ipt-firewall configuration for verdi-es.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "95.217.54.30" +fw_ext_ips_v6: + - "2a01:4f9:2a:3163::30" +fw_local_interfaces: + - "eth1" +fw_local_interfaces_v6: [] + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Outgoing / interfaces +fw_unprotected_ifs: $local_if_1 +fw_unprotected_ifs_v6: "" + +# --- Access control IPv4 +fw_restrict_local_service_to_net_v4: "80.152.216.128:95.217.54.30:9200:tcp 84.140.144.81:95.217.54.30:9200:tcp" + +# --- Access control IPv6 +fw_restrict_local_service_to_net_v6: "2003:ec:df49:9100::/56,2a01:4f9:2a:3163::30,9200,tcp" + +# --- HTTP +fw_http_server_ips: $ext_ips + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/vvn-shop.warenform.de/vvn-shop-ipt-server.yml b/host_vars/vvn-shop.warenform.de/vvn-shop-ipt-server.yml new file mode 100644 index 0000000..371371e --- /dev/null +++ b/host_vars/vvn-shop.warenform.de/vvn-shop-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for vvn-shop.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.112" +fw_ext_ips_v6: + - "2a01:30:0:13:2e7:f7ff:fec3:19bc 2a01:30:0:505:2e7:f7ff:fec3:19bc" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "80.152.216.128:9998:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/vvn-www.warenform.de/vvn-www-ipt-server.yml b/host_vars/vvn-www.warenform.de/vvn-www-ipt-server.yml new file mode 100644 index 0000000..d3e5bb1 --- /dev/null +++ b/host_vars/vvn-www.warenform.de/vvn-www-ipt-server.yml @@ -0,0 +1,33 @@ +--- +# ipt-firewall configuration for vvn-www.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.86.111" +fw_ext_ips_v6: + - "2a01:30:0:13:2db:b2ff:fef7:9647 2a01:30:0:505:2db:b2ff:fef7:9647" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "wf.oopen.de:9998:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web-02.oopen.de/web-02-ipt-server.yml b/host_vars/web-02.oopen.de/web-02-ipt-server.yml new file mode 100644 index 0000000..00613e9 --- /dev/null +++ b/host_vars/web-02.oopen.de/web-02-ipt-server.yml @@ -0,0 +1,35 @@ +--- +# ipt-firewall configuration for web-02.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "95.217.204.206" +fw_ext_ips_v6: + - "2a01:4f9:4a:47e5::206" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "wf.oopen.de:9998:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip +fw_log_cgi_traffic_out: true +fw_cgi_script_users: "koma-elektronik agberatung-berlin anwalt-elberling community.koma-elektronik gemeinschaft-altenschlirf gruppe-freital-nebenklage komsukeller mahalle mossestrasse op-presse.opferperspektive opferperspektive opp-intern.opferperspektive antidiskriminierungsberatung-brb togoactionplus toolbox-gegen-rechts vielfalt-einfach-machen koop-flr-brb zahlenkollektiv nein-zur-bezahlkarte" + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web-03.oopen.de/web-03-ipt-server.yml b/host_vars/web-03.oopen.de/web-03-ipt-server.yml new file mode 100644 index 0000000..f65be12 --- /dev/null +++ b/host_vars/web-03.oopen.de/web-03-ipt-server.yml @@ -0,0 +1,33 @@ +--- +# ipt-firewall configuration for web-03.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "162.55.82.76" +fw_ext_ips_v6: + - "2a01:4f8:271:1266::76" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- TURN / STUN +fw_nc_turn_server_ips_v6: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web-04.oopen.de/web-04-ipt-server.yml b/host_vars/web-04.oopen.de/web-04-ipt-server.yml new file mode 100644 index 0000000..e136b76 --- /dev/null +++ b/host_vars/web-04.oopen.de/web-04-ipt-server.yml @@ -0,0 +1,34 @@ +--- +# ipt-firewall configuration for web-04.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "162.55.82.75" +fw_ext_ips_v6: + - "2a01:4f8:271:1266::75" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_smtpd_ips: $ext_1_ip +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Rsync +fw_rsync_out_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web-05.oopen.de/web-05-ipt-server.yml b/host_vars/web-05.oopen.de/web-05-ipt-server.yml new file mode 100644 index 0000000..70682ae --- /dev/null +++ b/host_vars/web-05.oopen.de/web-05-ipt-server.yml @@ -0,0 +1,32 @@ +--- +# ipt-firewall configuration for web-05.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "37.27.67.114" +fw_ext_ips_v6: + - "2a01:4f9:3081:34d1::114" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip +fw_log_cgi_traffic_out: true +fw_cgi_script_users: "tkpml-prozess-129b anwalthoffmann mbr-berlin b3-bornim lubax halle-prozess-report presserecht-bundesweit text-arbeit rightsatwork prosys-beratungskollektiv faire-mobilitaet wiki.pankow-hilft pankow-nazifrei pankow-hilft opfer-rechter-gewalt hgs-musikprojekte afa-ost" + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web-06.oopen.de/web-06-ipt-server.yml b/host_vars/web-06.oopen.de/web-06-ipt-server.yml new file mode 100644 index 0000000..365750b --- /dev/null +++ b/host_vars/web-06.oopen.de/web-06-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for web-06.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "37.27.67.115" +fw_ext_ips_v6: + - "2a01:4f9:3081:34d1::115" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web-07.oopen.de/web-07-ipt-server.yml b/host_vars/web-07.oopen.de/web-07-ipt-server.yml new file mode 100644 index 0000000..86378e9 --- /dev/null +++ b/host_vars/web-07.oopen.de/web-07-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for web-07.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "37.27.67.116" +fw_ext_ips_v6: + - "2a01:4f9:3081:34d1::116" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web-08.oopen.de/web-08-ipt-server.yml b/host_vars/web-08.oopen.de/web-08-ipt-server.yml new file mode 100644 index 0000000..16b63ab --- /dev/null +++ b/host_vars/web-08.oopen.de/web-08-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for web-08.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "37.27.67.117" +fw_ext_ips_v6: + - "2a01:4f9:3081:34d1::117" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web-09.oopen.de/web-09-ipt-server.yml b/host_vars/web-09.oopen.de/web-09-ipt-server.yml new file mode 100644 index 0000000..17ac1a8 --- /dev/null +++ b/host_vars/web-09.oopen.de/web-09-ipt-server.yml @@ -0,0 +1,32 @@ +--- +# ipt-firewall configuration for web-09.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "37.27.67.118" +fw_ext_ips_v6: + - "2a01:4f9:3081:34d1::118" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip +fw_throttle_tcp6_mss_for_https: true +fw_tcp6_mss_for_https_val: 1360 + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web-nd.oopen.de/web-nd-ipt-server.yml b/host_vars/web-nd.oopen.de/web-nd-ipt-server.yml new file mode 100644 index 0000000..3565d75 --- /dev/null +++ b/host_vars/web-nd.oopen.de/web-nd-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for web-nd.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "176.9.62.106" +fw_ext_ips_v6: + - "2a01:4f8:150:805b::106" +fw_local_interfaces: + - "eth1" +fw_local_interfaces_v6: [] + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip diff --git a/host_vars/web.cadus.org/web-ipt-server.yml b/host_vars/web.cadus.org/web-ipt-server.yml new file mode 100644 index 0000000..3c64b09 --- /dev/null +++ b/host_vars/web.cadus.org/web-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for web.cadus.org +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "135.181.22.159" +fw_ext_ips_v6: + - "2a01:4f9:4b:46d1::159" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web.so36.net/web-ipt-server.yml b/host_vars/web.so36.net/web-ipt-server.yml new file mode 100644 index 0000000..0c61773 --- /dev/null +++ b/host_vars/web.so36.net/web-ipt-server.yml @@ -0,0 +1,44 @@ +--- +# ipt-firewall configuration for web.so36.net +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "192.68.11.74" +fw_ext_ips_v6: + - "2001:678:a40:3000::74" + +# --- Munin +munin_remote_ipv4: 192.68.11.73 +munin_remote_ipv6: "2001:678:a40:3000::73" +fw_munin_server_ips_v6: "2001:678:a40:3000::73" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "192.68.11.72:3306:tcp 192.68.11.77:1036:tcp 192.68.11.79:1036:tcp 138.201.23.195:1036:tcp" + +# --- Access control IPv6 +fw_allow_ext_service_v6: "2001:678:a40:3000::72,3306,tcp 2001:678:a40:3000::77,1036,tcp 2001:678:a40:3000::79,1036,tcp 2a01:4f8:171:2895::195,1036,tcp" + +# --- SSH +fw_ssh_ports: 1036 22 + +# --- HTTP +fw_http_server_ips: $ext_ips + +# --- Mail +fw_mail_client_ips: $ext_ips +fw_dovecot_auth_port: 44444 + +# --- FTP +fw_ftp_server_ips: $ext_1_ip + +# --- Out ports +fw_tcp_out_ports: 1036 + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web1.warenform.de/web1-ipt-server.yml b/host_vars/web1.warenform.de/web1-ipt-server.yml new file mode 100644 index 0000000..ce35df3 --- /dev/null +++ b/host_vars/web1.warenform.de/web1-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for web1.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.85.165" +fw_ext_ips_v6: + - "2a01:30:0:13:234:5fff:fed7:5d81 2a01:30:0:505:234:5fff:fed7:5d81" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "wf.oopen.de:9998:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/web2.warenform.de/web2-ipt-server.yml b/host_vars/web2.warenform.de/web2-ipt-server.yml new file mode 100644 index 0000000..2fc50eb --- /dev/null +++ b/host_vars/web2.warenform.de/web2-ipt-server.yml @@ -0,0 +1,30 @@ +--- +# ipt-firewall configuration for web2.warenform.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//-ipt-server.yml + +fw_manage_config: false + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "83.223.85.166" +fw_ext_ips_v6: + - "2a01:30:0:505:234:5fff:fed7:5d82 2a01:30:0:13:234:5fff:fed7:5d82" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- Access control IPv4 +fw_allow_ext_service_v4: "wf.oopen.de:9998:tcp" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip + +# --- Block +fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14 diff --git a/host_vars/wiki.cadus.org/wiki-common.yml b/host_vars/wiki.cadus.org/wiki-common.yml deleted file mode 100644 index 5df1b97..0000000 --- a/host_vars/wiki.cadus.org/wiki-common.yml +++ /dev/null @@ -1,152 +0,0 @@ ---- - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - - -# --- -# vars used by roles/common/tasks/apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/systemd-resolved.yml -# --- - -systemd_resolved: true - -# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie -# Primäre DNS-Adresse: 38.132.106.139 -# Sekundäre DNS-Adresse: 194.187.251.67 -# -# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen -# primäre DNS-Adresse -# IPv4: 1.1.1.1 -# IPv6: 2606:4700:4700::1111 -# sekundäre DNS-Adresse -# IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# -# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit -# primäre DNS-Adresse -# IPv4: 8.8.8.8 -# IPv6: 2001:4860:4860::8888 -# sekundäre DNS-Adresse -# IPv4: 8.8.4.4 -# IPv6: 2001:4860:4860::8844 -# -# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug -# primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe -# sekundäre DNS-Adresse -# IPv4: 149.112.112.112 -# IPv6: 2620:fe::9 -# -# OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de -# IPv4: 194.36.144.87 - ns29.de -# IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) -# IPv4: 5.1.66.255 -# IPv6: 2001:678:e68:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# IPv4: 185.150.99.255 -# IPv6: 2001:678:ed0:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) -resolved_nameserver: - - 185.12.64.2 - - 2a01:4ff:ff00::add:1 - -# search domains -# -# If there are more than one search domains, then specify them here in the order in which -# the resolver should also search them -# -# resolved_domains: [] -resolved_domains: - - ~. - - oopen.de - -resolved_dnssec: false - -# dns.as250.net: 194.150.168.168 -# -resolved_fallback_nameserver: - - 185.12.64.1 - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- -# -# see: roles/common/tasks/vars - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - - -# --- -# vars used by roles/common/tasks/copy_files.yml -# --- - - -# copy_template_files: [] -# -# - name: mailsystem_install_amavis.conf -# src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2 -# dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf - - -# --- -# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml -# --- diff --git a/host_vars/www.oopen.de/www-common.yml b/host_vars/www.oopen.de/www-common.yml deleted file mode 100644 index 7ecdad1..0000000 --- a/host_vars/www.oopen.de/www-common.yml +++ /dev/null @@ -1,75 +0,0 @@ ---- - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - -create_sftp_group: true - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - - -# --- -# vars used by roles/common/tasks/apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- - -root_user: - name: root - password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. diff --git a/host_vars/zapata-alt.opp.netz/zapata-alt-common.yml b/host_vars/zapata-alt.opp.netz/zapata-alt-common.yml deleted file mode 100644 index 775092c..0000000 --- a/host_vars/zapata-alt.opp.netz/zapata-alt-common.yml +++ /dev/null @@ -1,487 +0,0 @@ ---- - -# --- -# vars used by roles/network_interfaces -# --- - - -# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted -network_manage_devices: true - -# Should the interfaces be reloaded after config change? -network_interface_reload: false - -network_interface_path: /etc/network/interfaces.d -network_interface_required_packages: - - vlan - - bridge-utils - - ifmetric - - ifupdown - - ifenslave - - -network_interfaces: - - - device: eno1 - # use only once per device (for the first device entry) - headline: eno1 - The primary network interface - - # auto & allow are only used for the first device entry - allow: [] # array of allow-[stanzas] eg. allow-hotplug - auto: true - - family: inet - method: static - description: - address: 192.168.62.21 - netmask: 24 - gateway: 192.168.62.254 - - # optional dns settings nameservers: [] - # - # nameservers: - # - 194.150.168.168 # dns.as250.net - # - 91.239.100.100 # anycast.censurfridns.dk - # search: warenform.de - # - # nameservers: - # - 192.168.62.1 - # search: opp.netz - - -# --- -# vars used by roles/ansible_dependencies -# --- - - -# --- -# vars used by roles/ansible_user -# --- - - -# --- -# vars used by roles/common/tasks/basic.yml -# --- - - -# --- -# vars used by roles/common/tasks/sshd.yml -# --- - - -# --- -# vars used by roles/common/tasks/apt.yml -# --- - - -# --- -# vars used by roles/common/tasks/systemd-resolved.yml -# --- - -systemd_resolved: true - -# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie -# Primäre DNS-Adresse: 38.132.106.139 -# Sekundäre DNS-Adresse: 194.187.251.67 -# -# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen -# primäre DNS-Adresse -# IPv4: 1.1.1.1 -# IPv6: 2606:4700:4700::1111 -# sekundäre DNS-Adresse -# IPv4: 1.0.0.1 -# IPv6: 2606:4700:4700::1001 -# -# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit -# primäre DNS-Adresse -# IPv4: 8.8.8.8 -# IPv6: 2001:4860:4860::8888 -# sekundäre DNS-Adresse -# IPv4: 8.8.4.4 -# IPv6: 2001:4860:4860::8844 -# -# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug -# primäre DNS-Adresse -# IPv4: 9.9.9.9 -# IPv6: 2620:fe::fe -# sekundäre DNS-Adresse -# IPv4: 149.112.112.112 -# IPv6: 2620:fe::9 -# -# OpenNIC - https://www.opennic.org/ -# IPv4: 195.10.195.195 - ns31.de -# IPv4: 94.16.114.254 - ns28.de -# IPv4: 51.254.162.59 - ns9.de -# IPv4: 194.36.144.87 - ns29.de -# IPv6: 2a00:f826:8:2::195 - ns31.de -# -# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) -# IPv4: 5.1.66.255 -# IPv6: 2001:678:e68:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# IPv4: 185.150.99.255 -# IPv6: 2001:678:ed0:f000:: -# Servername für DNS-over-TLS: dot.ffmuc.net -# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) -resolved_nameserver: - - 192.168.62.1 - -# search domains -# -# If there are more than one search domains, then specify them here in the order in which -# the resolver should also search them -# -# resolved_domains: [] -resolved_domains: - - ~. - - opp.netz - -resolved_dnssec: false - -# dns.as250.net: 194.150.168.168 -# -resolved_fallback_nameserver: - - 172.16.62.254 - - -# --- -# vars used by roles/common/tasks/cron.yml -# --- - -cron_user_special_time_entries: - - - name: "Restart DNS Cache service 'systemd-resolved'" - special_time: reboot - job: "sleep 10 ; /bin/systemctl restart systemd-resolved" - insertafter: PATH - - -# --- -# vars used by roles/common/tasks/users.yml -# --- - -extra_user: - - - name: caracola - user_id: 1075 - group_id: 1075 - group: carola - # hS-a-6UC5.spCgNS - password: $y$j9T$TKCuCPZsnS.g3M8sPPFvo0$lxoGMooCH.Jyo5tXYEVAXNAlDV73Cj2haNFnrhjmAo6 - shell: /bin/bash - ssh_keys: - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' - - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMnap6I+g8xQvSZReP3CjwQ+O7okDhgCkrHaUCveOH8I marcus@caracola' - - -# --- -# vars used by roles/common/tasks/users-systemfiles.yml -# --- - - -# --- -# vars used by roles/common/tasks/webadmin-user.yml -# --- - - -# --- -# vars used by roles/common/tasks/sudoers.yml -# --- -# -# see: roles/common/tasks/vars - - -# --- -# vars used by roles/common/tasks/caching-nameserver.yml -# --- - - -# --- -# vars used by roles/common/tasks/git.yml -# --- - - -# --- -# vars used by roles/common/tasks/samba-config-server.yml -# vars used by roles/common/tasks/samba-user.yml -# --- - -samba_server_ip: 192.168.62.21 -samba_server_cidr_prefix: 24 - -samba_workgroup: OPP-ALT - -samba_netbios_name: ZAPATA-ALT - -samba_server_min_protocol: !!str NT1 - -samba_allow_insecure_wide_links: !!str yes - -samba_groups: - - name: buero - group_id: 1100 - - name: beratung - group_id: 1110 - - name: verwaltung - group_id: 1120 - - -samba_user: - - - name: alba - groups: - - buero - - beratung - password: '4l#3a=behandlg' - - - name: almut - groups: - - buero - - beratung - - verwaltung - password: 'Tax!ko11ekt!v' - - - name: anika - groups: - - buero - - beratung - password: '4n1k4*adb_23' - - - name: anne - groups: - - buero - - beratung - password: 'antilottka110' - - - name: birgit - groups: - - buero - - beratung - password: '6/shd9c2.cHE' - # passwort unbekannt - - - name: chris - groups: - - buero - - verwaltung - password: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 63643330373231636537366333326630333265303265653933613835656262323863363038653234 - 3462653135633266373439626263356636646637643035340a653466356235346663626163306363 - 61313164643061306433643738643563303036646334376536626531383965303036386162393832 - 6631333038306462610a356535633265633563633962333137326533633834636331343562633765 - 3631 - - - name: carlotta - groups: - - buero - - beratung - password: '20_car-lotta.25%' - - - name: cristina - groups: - - buero - - beratung - password: '20_cristina_18!' - - - name: dori - groups: - - buero - - beratung - password: 'K4lt3r_hUnD' - - - name: drucker - groups: - - buero - password: '20-printer-18' - - - name: hanna - groups: - - buero - - beratung - password: '6UR9+#anna-25' - - - name: hannes - groups: - - buero - - beratung - password: 'U24Pdm-2' - - - name: joschka - groups: - - buero - - beratung - password: '20_joschka_15' - - - name: judith - groups: - - buero - - beratung - - verwaltung - password: '20judith14' - - - name: julian - groups: - - buero - - beratung - password: 'Jul14n_2018' - - - name: juliana - groups: - - buero - - beratung - password: '24-Jul!ana#OPP' - - - name: lavinia - groups: - - buero - - beratung - password: '20!lavinia*20' - - - name: luise - groups: - - buero - - beratung - password: '24_s.l.h._adb' - - - name: magdalena - groups: - - buero - - beratung - password: 'magdalena_23' - - - name: marcus - groups: - - buero - - beratung - - verwaltung - password: '' - - - name: maria - groups: - - buero - - beratung - password: 'm4ri4+adb22' - - - name: martin - groups: - - buero - - beratung - password: '20_martin_18' - - - name: opp - groups: - - buero - - beratung - - verwaltung - password: 'DaWirdIhnenGeholfen!' - - - name: opp7 - groups: - - buero - - beratung - - verwaltung - password: '20_opp6_19!' - - - name: paul - groups: - - buero - - beratung - password: '#polsfuss*adb24' - - - name: praktikum - groups: - - buero - password: 'praktikant*in_00p' - - - name: robin - groups: - - buero - - beratung - password: 'Schattenber!cht#53' - - - name: samantha - groups: - - buero - - beratung - password: 'art_12*lvbbg+adb' - - - name: simon - groups: - - buero - - beratung - - verwaltung - password: '20_simon_18!' - - - name: ute - groups: - - buero - - beratung - password: '23_ut3*obs' - -base_home: /home - -# remove_samba_users: -# - name: name1 -# - name: name2 -# -# remove_samba_users: [] -remove_samba_users: - - name: unknown - -samba_shares: - - - name: buero - comment: Büro auf Fileserver - path: /data/samba/OPP/buero - group_valid_users: buero - group_write_list: buero - file_create_mask: !!str 660 - dir_create_mask: !!str 2770 - wide_links: !!str yes - vfs_object_recycle: true - recycle_path: '@Recycle' - - - name: beratung - comment: Beratung auf Fileserver - path: /data/samba/OPP/beratung - group_valid_users: beratung - group_write_list: beratung - file_create_mask: !!str 660 - dir_create_mask: !!str 2770 - vfs_object_recycle: true - recycle_path: '@Recycle' - - - name: verwaltung - comment: Verwaltung auf Fileserver - path: /data/samba/OPP/verwaltung - group_valid_users: verwaltung - group_write_list: verwaltung - file_create_mask: !!str 0660 - dir_create_mask: !!str 2770 - vfs_object_recycle: true - recycle_path: '@Recycle' - - - name: backup - comment: Sicherungen User - path: /data/backup - browseable: !!str yes - read_only: !!str yes - writeable: !!str no - guest_ok: !!str no - file_create_mask: !!str 0664 - dir_create_mask: !!str 0755 - vfs_object_recycle: false - - -# ============================== - - -# --- -# vars used by scripts/reset_root_passwd.yml -# --- - -root_user: - name: root - password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. diff --git a/hosts b/hosts index 86321c6..e4e113c 100644 --- a/hosts +++ b/hosts @@ -36,7 +36,7 @@ ak-plan.oopen.de discourse.oopen.de test-nd.oopen.de formbricks-nd.oopen.de -#cl-lubax.oopen.de +#o32.oopen.de [dns_sinma] @@ -65,26 +65,19 @@ gw-irights.oopen.de gw-km.oopen.de gw-mbr.oopen.de gw-opp.oopen.de -gw-opp-neu.opp.netz gw-spr.oopen.de gw-kb.oopen.de -bbb-server.b3-bornim.netz file-ah.kanzlei-kiel.netz -file-ah-neu.kanzlei-kiel.netz -file-ah-alt.kanzlei-kiel.netz file-ebs.ebs.netz file-fm.fm.netz file-fhxb.fhxb.netz file-km.anw-km.netz file-km-alt.anw-km.netz -file-km-neu.anw-km.netz file-kb.anw-kb.netz file-blkr.blkr.netz file-dissens.dissens.netz zapata.opp.netz -zapata-neu.opp.netz -zapata-alt.opp.netz gw-replacement.local.netz gw-replacement2.local.netz @@ -95,9 +88,7 @@ at-10-neu.ak.netz ga-st-gw-ersatz.ga.netz ga-st-gw.ga.netz -ga-st-gw-neu.ga.netz ga-al-gw.oopen.de -ga-al-gw-neu.ga.netz ga-nh-gw.oopen.de ga-gh-gw.oopen.de gw-campus.oopen.de @@ -140,9 +131,6 @@ web2.warenform.de # server26.warenform.de git.warenform.de -# Jitsi Meet - Faire Integration -server28.warenform.de - o12.oopen.de initiativenserver.oopen.de @@ -184,7 +172,6 @@ o20.oopen.de o21.oopen.de o22.oopen.de -oolm-db.oopen.de oolm-shop.oopen.de oolm-shop-dev.oopen.de oolm-web.oopen.de @@ -196,11 +183,9 @@ cp-01.oopen.de meet.oopen.de mm.oopen.de discourse.oopen.de -mm-migration.oopen.de o24.oopen.de cl-irights.oopen.de -cl-irights-neu.oopen.de mm-irights.oopen.de # IL - PAD @@ -216,8 +201,6 @@ o27.oopen.de cl-fm.oopen.de mail.faire-mobilitaet.de -# Hetzner cloud (CPX22) -ki-fm.oopen.de # - o28 NDM - neue deutsche Medienmacher*innen o28.oopen.de @@ -240,7 +223,7 @@ mail.cadus.org web.cadus.org # o32.oopen.de / cl-lubax.oopen.de -cl-lubax.oopen.de +o32.oopen.de # BigBlueButton - O.OPEN @@ -251,7 +234,6 @@ o35.oopen.de b.ns.oopen.de cl-02.oopen.de e.mx.oopen.de -etherpad.oopen.de web-02.oopen.de d.mx.oopen.de a.mx.oopen.de @@ -361,9 +343,6 @@ server27.warenform.de verdi-django.warenform.de verdi-es.warenform.de -# Jitsi Meet - Faire Integration -server28.warenform.de - # VServer Sinma dns1.warenform.de @@ -417,7 +396,6 @@ o21.oopen.de # - o22.oopen.de o22.oopen.de -oolm-db.oopen.de oolm-shop.oopen.de oolm-shop-dev.oopen.de oolm-web.oopen.de @@ -430,12 +408,10 @@ cp-01.oopen.de meet.oopen.de mm.oopen.de discourse.oopen.de -mm-migration.oopen.de # - o24.oopen.de o24.oopen.de cl-irights.oopen.de -cl-irights-neu.oopen.de # IL - PAD o25.oopen.de @@ -450,9 +426,6 @@ o27.oopen.de cl-fm.oopen.de mail.faire-mobilitaet.de -# Hetzner cloud (CPX22) -ki-fm.oopen.de - # - o28 NDM - neue deutsche Medienmacher*innen o28.oopen.de cl-ndm.oopen.de @@ -474,7 +447,7 @@ mail.cadus.org web.cadus.org # o32.oopen.de / cl-lubax.oopen.de -cl-lubax.oopen.de +o32.oopen.de # BigBlueButton - O.OPEN @@ -486,7 +459,6 @@ o35.oopen.de b.ns.oopen.de cl-02.oopen.de e.mx.oopen.de -etherpad.oopen.de web-02.oopen.de d.mx.oopen.de a.mx.oopen.de @@ -578,7 +550,6 @@ gw-dissens.oopen.de # B3 Bornim gw-b3.oopen.de -bbb-server.b3-bornim.netz # - FHXB Museum Friedrichshain Kreuzberg gw-fhxb.oopen.de @@ -594,7 +565,6 @@ gw-irights.oopen.de gw-km.oopen.de file-km.anw-km.netz file-km-alt.anw-km.netz -file-km-neu.anw-km.netz file-kb.anw-kb.netz # - Kanzlei BLKR @@ -619,8 +589,6 @@ gw-elster.oopen.de # - Kanzlei Kiel gw-ah.oopen.de file-ah.kanzlei-kiel.netz -file-ah-neu.kanzlei-kiel.netz -file-ah-alt.kanzlei-kiel.netz # Kanzlei Kreuzbergstraße gw-kb.oopen.de @@ -630,10 +598,7 @@ gw-mbr.oopen.de # OPP gw-opp.oopen.de -gw-opp-neu.opp.netz zapata.opp.netz -zapata-neu.opp.netz -zapata-alt.opp.netz # Sprachenatelier gw-spr.oopen.de @@ -644,9 +609,7 @@ gw-d11.oopen.de # - GA - Gemeinschaft Altensclirf ga-st-gw-ersatz.ga.netz ga-st-gw.ga.netz -ga-st-gw-neu.ga.netz ga-al-gw.oopen.de -ga-al-gw-neu.ga.netz ga-nh-gw.oopen.de ga-gh-gw.oopen.de gw-campus.oopen.de @@ -672,7 +635,6 @@ devel-repos.wf.netz devel-php.wf.netz devel-todo.wf.netz devel-wiki.wf.netz -devel-ruby.wf.netz [ftp_server] @@ -771,7 +733,6 @@ cl-test.oopen.de # o24.oopen.de cl-irights.oopen.de -cl-irights-neu.oopen.de # Backup Faire Mobilitaet o26.oopen.de @@ -780,9 +741,6 @@ o26.oopen.de cl-fm.oopen.de mail.faire-mobilitaet.de -# Hetzner cloud (CPX22) -ki-fm.oopen.de - # - o28 neue deutsche Medienmacher*innen - NDM Host System cl-ndm.oopen.de psono-ndm.oopen.de @@ -794,7 +752,7 @@ cl-dissens.oopen.de cloud.akweb.de # o32.oopen.de / cl-lubax.oopen.de -cl-lubax.oopen.de +o32.oopen.de # Nextcloud / DokuWiki VBER o34.oopen.de @@ -890,7 +848,6 @@ verdi-es.warenform.de devel-php.wf.netz devel-todo.wf.netz devel-wiki.wf.netz -devel-ruby.wf.netz # --- # O.OPEN office network @@ -929,14 +886,10 @@ devel-php.wf.netz devel-todo.wf.netz devel-wiki.wf.netz devel-repos.wf.netz -devel-ruby.wf.netz [nginx_webserver] -# Jitsi Meet - Faire Integration -server28.warenform.de - # o12.oopen.de stolpersteine.oopen.de @@ -951,7 +904,6 @@ o13-cryptpad.oopen.de cp-01.oopen.de meet.oopen.de mm.oopen.de -mm-migration.oopen.de # o24.oopen.de mm-irights.oopen.de @@ -965,14 +917,10 @@ psono-ndm.oopen.de # o29.oopen.de . Dissens cl-dissens.oopen.de -# Hetzner cloud (CPX22) - Faire Mobilitaet -ki-fm.oopen.de - # Nextcloud / DokuWiki VBER o34.oopen.de # o35.oopen.de -etherpad.oopen.de web-02.oopen.de # o36 - b.mx, web-01, web-03,-- @@ -1098,7 +1046,6 @@ o13-mail.oopen.de # o23.oopen.de mm.oopen.de -mm-migration.oopen.de # o24.oopen.de mm-irights.oopen.de @@ -1196,17 +1143,14 @@ o20.oopen.de o21.oopen.de # o22.oopen.de -oolm-db.oopen.de oolm-web.oopen.de # o23.oopen.de cl-01.oopen.de mm.oopen.de -mm-migration.oopen.de # o24.oopen.de cl-irights.oopen.de -cl-irights-neu.oopen.de mm-irights.oopen.de # Hetzner Cloud CX31 - AK @@ -1217,9 +1161,6 @@ o26.oopen.de # o27.oopen.de cl-fm.oopen.de -# Hetzner cloud (CPX22) -ki-fm.oopen.de - # - o28 neue deutsche Medienmacher*innen - NDM Host System cl-ndm.oopen.de psono-ndm.oopen.de @@ -1235,14 +1176,13 @@ web.cadus.org mail.cadus.org # o32.oopen.de / cl-lubax.oopen.de -cl-lubax.oopen.de +o32.oopen.de # Nextcloud / DokuWiki VBER o34.oopen.de # o35.oopen.de cl-02.oopen.de -etherpad.oopen.de web-02.oopen.de d.mx.oopen.de @@ -1333,7 +1273,6 @@ cl-test.oopen.de # o24.oopen.de cl-irights.oopen.de -cl-irights-neu.oopen.de # o26.oopen.de o26.oopen.de @@ -1341,9 +1280,6 @@ o26.oopen.de # o27.oopen.de cl-fm.oopen.de -# Hetzner cloud (CPX22) -ki-fm.oopen.de - # - o28 neue deutsche Medienmacher*innen - NDM Host System cl-ndm.oopen.de psono-ndm.oopen.de @@ -1355,7 +1291,7 @@ cl-dissens.oopen.de cloud.akweb.de # o32.oopen.de / cl-lubax.oopen.de -cl-lubax.oopen.de +o32.oopen.de # Nextcloud / DokuWiki VBER o34.oopen.de @@ -1505,22 +1441,16 @@ anita.wf.netz # Büro Netzwerke # --- at-10-neu.ak.netz -bbb-server.b3-bornim.netz file-ah.kanzlei-kiel.netz -file-ah-neu.kanzlei-kiel.netz -file-ah-alt.kanzlei-kiel.netz file-ebs.ebs.netz file-fm.fm.netz file-fhxb.fhxb.netz file-km.anw-km.netz file-km-alt.anw-km.netz -file-km-neu.anw-km.netz file-kb.anw-kb.netz file-blkr.blkr.netz file-dissens.dissens.netz zapata.opp.netz -zapata-neu.opp.netz -zapata-alt.opp.netz @@ -1529,8 +1459,6 @@ zapata-alt.opp.netz file-blkr.blkr.netz file-dissens.dissens.netz file-ah.kanzlei-kiel.netz -file-ah-neu.kanzlei-kiel.netz -file-ah-alt.kanzlei-kiel.netz file-ebs.ebs.netz file-fm.fm.netz file-fhxb.fhxb.netz @@ -1566,9 +1494,6 @@ file-blkr.blkr.netz # o23.oopen.de meet.oopen.de -# Jitsi Meet - Faire Integration -server28.warenform.de - # o30.oopen.de - AK Server Nextcloud/Jitsi Meet meet.akweb.de @@ -1648,18 +1573,12 @@ lxc-host-kb.anw-kb.netz # O.OPEN office network # --- -bbb-server.b3-bornim.netz file-ah.kanzlei-kiel.netz -file-ah-neu.kanzlei-kiel.netz -file-ah-alt.kanzlei-kiel.netz file-km.anw-km.netz file-km-alt.anw-km.netz -file-km-neu.anw-km.netz file-kb.anw-kb.netz file-blkr.blkr.netz zapata.opp.netz -zapata-neu.opp.netz -zapata-alt.opp.netz # - GA - Gemeinschaft Altensclirf ga-st-lxc1.ga.netz @@ -1725,7 +1644,6 @@ web.cadus.org o21.oopen.de # - o22.oopen.de -oolm-db.oopen.de oolm-shop.oopen.de oolm-shop-dev.oopen.de oolm-web.oopen.de @@ -1737,20 +1655,15 @@ cp-01.oopen.de meet.oopen.de mm.oopen.de discourse.oopen.de -mm-migration.oopen.de # - o24.oopen.de cl-irights.oopen.de -cl-irights-neu.oopen.de mm-irights.oopen.de # - o27.oopen.de cl-fm.oopen.de mail.faire-mobilitaet.de -# Hetzner cloud (CPX22) -ki-fm.oopen.de - # Hetzner Cloud CX31 - AK # o28.oopen.de NDM - neue deutsche Medienmacher*innen @@ -1773,7 +1686,6 @@ o34.oopen.de # o35.oopen.de cl-02.oopen.de e.mx.oopen.de -etherpad.oopen.de web-02.oopen.de b.ns.oopen.de d.mx.oopen.de @@ -1829,22 +1741,16 @@ cl-nd-test.oopen.de # --- at-10-neu.ak.netz -bbb-server.b3-bornim.netz file-ah.kanzlei-kiel.netz -file-ah-neu.kanzlei-kiel.netz -file-ah-alt.kanzlei-kiel.netz file-ebs.ebs.netz file-fm.fm.netz file-fhxb.fhxb.netz file-km.anw-km.netz file-km-alt.anw-km.netz -file-km-neu.anw-km.netz file-kb.anw-kb.netz file-blkr.blkr.netz file-dissens.dissens.netz zapata.opp.netz -zapata-neu.opp.netz -zapata-alt.opp.netz # - GA - Gemeinschaft Altensclirf @@ -1887,9 +1793,6 @@ git.warenform.de verdi-django.warenform.de verdi-es.warenform.de -# Jitsi Meet - Faire Integration -server28.warenform.de - # - Vserver von Sinma dns1.warenform.de @@ -1905,7 +1808,6 @@ devel-php.wf.netz devel-repos.wf.netz devel-todo.wf.netz devel-wiki.wf.netz -devel-ruby.wf.netz # All oopen server (except office networks) @@ -1953,7 +1855,6 @@ o21.oopen.de # - o22.oopen.de o22.oopen.de -oolm-db.oopen.de oolm-shop.oopen.de oolm-shop-dev.oopen.de oolm-web.oopen.de @@ -1966,12 +1867,10 @@ cp-01.oopen.de meet.oopen.de mm.oopen.de discourse.oopen.de -mm-migration.oopen.de # - o24.oopen.de o24.oopen.de cl-irights.oopen.de -cl-irights-neu.oopen.de mm-irights.oopen.de # IL - PAD @@ -1987,9 +1886,6 @@ o27.oopen.de cl-fm.oopen.de mail.faire-mobilitaet.de -# Hetzner cloud (CPX22) -ki-fm.oopen.de - # o28.oopen.de NDM - neue deutsche Medienmacher*innen o28.oopen.de cl-ndm.oopen.de @@ -2011,7 +1907,7 @@ mail.cadus.org web.cadus.org # o32.oopen.de / cl-lubax.oopen.de -cl-lubax.oopen.de +o32.oopen.de # BigBlueButton - O.OPEN @@ -2022,7 +1918,6 @@ o34.oopen.de o35.oopen.de cl-02.oopen.de e.mx.oopen.de -etherpad.oopen.de web-02.oopen.de b.ns.oopen.de d.mx.oopen.de @@ -2094,22 +1989,16 @@ lxc-host-kb.anw-kb.netz [oopen_office_server] at-10-neu.ak.netz -bbb-server.b3-bornim.netz file-ah.kanzlei-kiel.netz -file-ah-neu.kanzlei-kiel.netz -file-ah-alt.kanzlei-kiel.netz file-ebs.ebs.netz file-fm.fm.netz file-fhxb.fhxb.netz file-km.anw-km.netz file-km-alt.anw-km.netz -file-km-neu.anw-km.netz file-kb.anw-kb.netz file-blkr.blkr.netz file-dissens.dissens.netz zapata.opp.netz -zapata-neu.opp.netz -zapata-alt.opp.netz [gateway_server_ro] @@ -2142,7 +2031,6 @@ gw-irights.oopen.de gw-km.oopen.de gw-mbr.oopen.de gw-opp.oopen.de -gw-opp-neu.opp.netz gw-spr.oopen.de gw-kb.oopen.de @@ -2152,9 +2040,7 @@ k1371.dyndns.org ga-st-gw-ersatz.ga.netz ga-st-gw.ga.netz -ga-st-gw-neu.ga.netz ga-al-gw.oopen.de -ga-al-gw-neu.ga.netz ga-nh-gw.oopen.de ga-gh-gw.oopen.de gw-campus.oopen.de @@ -2212,9 +2098,6 @@ server27.warenform.de verdi-django.warenform.de verdi-es.warenform.de -# Jitsi Meet - Faire Integration -server28.warenform.de - # - Vserver von Sinma dns1.warenform.de @@ -2229,13 +2112,11 @@ devel-php.wf.netz devel-repos.wf.netz devel-todo.wf.netz devel-wiki.wf.netz -devel-ruby.wf.netz [oopen_office_ga] # - GA - Gemeinschaft Altensclirf ga-al-gw.oopen.de -ga-al-gw-neu.ga.netz ga-al-kvm2.ga.netz ga-al-kvm3.ga.netz ga-al-relay.ga.netz