Inventory cleanup; add ipt-server host_vars for all ipt hosts.
- hosts: remove unreachable/decommissioned hosts (file-ah-neu, file-ah-alt, file-km-neu, ga-al-gw-neu, gw-opp-neu, zapata-neu, zapata-alt, bbb-server, ki-fm, server28, ...) and duplicate aliases (etherpad = b.ns, cl-irights-neu = cl-irights, oolm-db = o21, devel-ruby = devel-todo). - host_vars: add <short>-ipt-server.yml (fw_manage_config: false) for all hosts running the ipt-server firewall, generated by extract-fw-host-vars.py. - host_vars: move/remove obsolete host directories, replace alias directories by symlinks (cl-lubax -> o32, cl-vbrg -> o34, oolm-db -> o21). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,438 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
- vlan
|
||||
- bridge-utils
|
||||
- ifmetric
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: eth0
|
||||
# use only once per device (for the first device entry)
|
||||
headline: eth0 - The primary network interface
|
||||
|
||||
# auto & allow are only used for the first device entry
|
||||
allow: [] # array of allow-[stanzas] eg. allow-hotplug
|
||||
auto: true
|
||||
|
||||
family: inet
|
||||
method: static
|
||||
description:
|
||||
address: 192.168.42.10
|
||||
netmask: 24
|
||||
gateway: 192.168.42.254
|
||||
|
||||
# optional dns settings nameservers: []
|
||||
#
|
||||
# nameservers:
|
||||
# - 194.150.168.168 # dns.as250.net
|
||||
# - 91.239.100.100 # anycast.censurfridns.dk
|
||||
# search: warenform.de
|
||||
#
|
||||
# nameservers:
|
||||
# - 192.168.42.1
|
||||
# search: b3-bornim.netz
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 192.168.42.1
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- b3-bornim.netz
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 172.16.42.254
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
# ---
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
sudo_users:
|
||||
- chris
|
||||
- sysadm
|
||||
- localadmin
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/samba-config-server.yml
|
||||
# vars used by roles/common/tasks/samba-user.yml
|
||||
# ---
|
||||
|
||||
samba_server_ip: 192.168.42.10
|
||||
samba_server_cidr_prefix: 24
|
||||
|
||||
samba_workgroup: B3-BORNIM
|
||||
|
||||
samba_netbios_name: BBB-SERVER
|
||||
|
||||
samba_groups:
|
||||
- name: buero
|
||||
group_id: 1100
|
||||
- name: team
|
||||
group_id: 1110
|
||||
- name: fnr
|
||||
group_id: 1120
|
||||
- name: gs
|
||||
group_id: 1130
|
||||
- name: gf
|
||||
group_id: 1140
|
||||
- name: praktikant
|
||||
group_id: 1150
|
||||
|
||||
|
||||
samba_user:
|
||||
|
||||
- name: b3-user
|
||||
groups:
|
||||
- buero
|
||||
- team
|
||||
- fnr
|
||||
- praktikant
|
||||
password: '20-buero_user-22!'
|
||||
|
||||
- name: b3-prakti
|
||||
groups:
|
||||
- praktikant
|
||||
password: '20-b3_praktikant-22%'
|
||||
|
||||
- name: caroline
|
||||
groups:
|
||||
- praktikant
|
||||
password: '19-caro_20-line%'
|
||||
|
||||
- name: chris
|
||||
groups:
|
||||
- buero
|
||||
- team
|
||||
- fnr
|
||||
- gs
|
||||
- gf
|
||||
- praktikant
|
||||
password: !vault |
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
63643330373231636537366333326630333265303265653933613835656262323863363038653234
|
||||
3462653135633266373439626263356636646637643035340a653466356235346663626163306363
|
||||
61313164643061306433643738643563303036646334376536626531383965303036386162393832
|
||||
6631333038306462610a356535633265633563633962333137326533633834636331343562633765
|
||||
3631
|
||||
|
||||
- name: christian
|
||||
groups:
|
||||
- buero
|
||||
- team
|
||||
- fnr
|
||||
- praktikant
|
||||
password: '17-chris_tian%20'
|
||||
|
||||
- name: christiane
|
||||
groups:
|
||||
- buero
|
||||
- team
|
||||
- fnr
|
||||
- praktikant
|
||||
password: '18-chris_tiane%20!'
|
||||
|
||||
- name: ingo
|
||||
groups:
|
||||
- buero
|
||||
- team
|
||||
- fnr
|
||||
- praktikant
|
||||
password: '20ib11'
|
||||
|
||||
- name: janin
|
||||
groups:
|
||||
- buero
|
||||
- team
|
||||
- fnr
|
||||
- praktikant
|
||||
password: '20_janin-17%'
|
||||
|
||||
- name: matthias
|
||||
groups:
|
||||
- buero
|
||||
- team
|
||||
- fnr
|
||||
- gs
|
||||
- gf
|
||||
- praktikant
|
||||
password: 'bornim'
|
||||
|
||||
- name: prakti
|
||||
groups:
|
||||
- buero
|
||||
- team
|
||||
- fnr
|
||||
- praktikant
|
||||
password: 'pr2011'
|
||||
|
||||
- name: susi
|
||||
groups:
|
||||
- buero
|
||||
- team
|
||||
- fnr
|
||||
- gf
|
||||
- praktikant
|
||||
password: '21susi21'
|
||||
# password system: 1.Larsi2
|
||||
# password samba: 21susi21
|
||||
|
||||
base_home: /home
|
||||
|
||||
samba_homes_virusfilter: true
|
||||
|
||||
# remove_samba_users:
|
||||
# - name: name1
|
||||
# - name: name2
|
||||
#
|
||||
remove_samba_users: []
|
||||
|
||||
samba_shares:
|
||||
|
||||
- name: bhoch3-verzeichnis
|
||||
comment: bhoch3 - READONLY
|
||||
path: /home/bhoch3
|
||||
read_only: !!str yes
|
||||
browsable: !!str yes
|
||||
guest_ok: !!str no
|
||||
writeable: !!str no
|
||||
group_valid_users: buero
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: false
|
||||
|
||||
- name: bhoch3
|
||||
path: /data/samba/share/bhoch3
|
||||
group_valid_users: buero
|
||||
group_write_list: buero
|
||||
file_create_mask: !!str 664
|
||||
dir_create_mask: !!str 2775
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle'
|
||||
|
||||
- name: team
|
||||
path: '/data/samba/share/team'
|
||||
group_valid_users: 'team'
|
||||
group_write_list: 'team'
|
||||
file_create_mask: !!str 664
|
||||
dir_create_mask: !!str 2775
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle'
|
||||
|
||||
- name: team-praktikant
|
||||
path: '/data/samba/share/team-praktikant'
|
||||
group_valid_users: 'praktikant'
|
||||
group_write_list: 'praktikant'
|
||||
file_create_mask: !!str 664
|
||||
dir_create_mask: !!str 2775
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle'
|
||||
|
||||
- name: fnr-projekt
|
||||
comment: FNR Projekt
|
||||
path: /data/samba/share/fnr-projekt
|
||||
group_valid_users: fnr
|
||||
group_write_list: fnr
|
||||
file_create_mask: !!str 664
|
||||
dir_create_mask: !!str 2775
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle'
|
||||
|
||||
- name: buero
|
||||
path: /data/samba/share/buero
|
||||
group_valid_users: buero
|
||||
group_write_list: buero
|
||||
file_create_mask: !!str 664
|
||||
dir_create_mask: !!str 2775
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle'
|
||||
|
||||
- name: gs
|
||||
comment: Gesellschafter
|
||||
path: /data/samba/share/gesellschafter
|
||||
group_valid_users: gs
|
||||
group_write_list: gs
|
||||
file_create_mask: !!str 660
|
||||
dir_create_mask: !!str 2770
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle'
|
||||
|
||||
- name: gf
|
||||
comment: Geschäftsführer
|
||||
path: /data/samba/share/geschaeftsfuehrer
|
||||
group_valid_users: gf
|
||||
group_write_list: gf
|
||||
file_create_mask: !!str 660
|
||||
dir_create_mask: !!str 2770
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle'
|
||||
|
||||
- name: private_mp
|
||||
comment: Matthias - privat
|
||||
path: /data/samba/share-not-backuped/private_mp
|
||||
group_valid_users: matthias
|
||||
group_write_list: matthias
|
||||
file_create_mask: !!str 660
|
||||
dir_create_mask: !!str 2770
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle'
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,374 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
- vlan
|
||||
- bridge-utils
|
||||
- ifmetric
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: enp6s0
|
||||
# use only once per device (for the first device entry)
|
||||
headline: enp6s0 - primary network interface
|
||||
|
||||
# auto & allow are only used for the first device entry
|
||||
allow: [] # array of allow-[stanzas] eg. allow-hotplug
|
||||
auto: true
|
||||
|
||||
family: inet
|
||||
method: static
|
||||
hwaddress:
|
||||
description:
|
||||
address: 65.109.158.101
|
||||
netmask: 26
|
||||
gateway: 65.109.158.65
|
||||
metric:
|
||||
pointopoint:
|
||||
mtu:
|
||||
scope:
|
||||
|
||||
# additional user by dhcp method
|
||||
#
|
||||
hostname:
|
||||
leasehours:
|
||||
leasetime:
|
||||
vendor:
|
||||
client:
|
||||
|
||||
# additional used by bootp method
|
||||
#
|
||||
bootfile:
|
||||
server:
|
||||
hwaddr:
|
||||
|
||||
# optional dns settings nameservers: []
|
||||
#
|
||||
# nameservers:
|
||||
# - 194.150.168.168 # dns.as250.net
|
||||
# - 91.239.100.100 # anycast.censurfridns.dk
|
||||
# search: warenform.de
|
||||
#
|
||||
# nameservers:
|
||||
# - 127.0.0.1
|
||||
# - 185.12.64.2
|
||||
# - 2a01:4ff:ff00::add:1
|
||||
# search:
|
||||
|
||||
# optional additional subnets/ips subnets: []
|
||||
# subnets:
|
||||
# - '192.168.123.0/24'
|
||||
# - '192.168.124.11/32'
|
||||
|
||||
# optional bridge parameters bridge: {}
|
||||
# bridge:
|
||||
# ports:
|
||||
# stp:
|
||||
# fd:
|
||||
# maxwait:
|
||||
# waitport:
|
||||
bridge: {}
|
||||
|
||||
# optional bonding parameters bond: {}
|
||||
# bond:
|
||||
# master
|
||||
# primary
|
||||
# slave
|
||||
# method:
|
||||
# miimon:
|
||||
# lacp-rate:
|
||||
# ad-select-rate:
|
||||
# master:
|
||||
# slaves:
|
||||
bond: {}
|
||||
|
||||
# optional vlan settings | vlan: {}
|
||||
# vlan: {}
|
||||
# raw-device: 'enp6s0'
|
||||
vlan: {}
|
||||
|
||||
# inline hook scripts
|
||||
pre-up: [] # pre-up script lines
|
||||
up:
|
||||
- route add -net 65.109.158.64 netmask 255.255.255.192 gw 65.109.158.65 dev enp6s0
|
||||
post-up: [] # post-up script lines (alias for up)
|
||||
pre-down: [] # pre-down script lines (alias for down)
|
||||
down: [] # down script lines
|
||||
post-down: [] # post-down script lines
|
||||
|
||||
|
||||
- device: enp6s0
|
||||
family: inet6
|
||||
method: static
|
||||
address: 2a01:4f9:3080:155d::2
|
||||
netmask: 64
|
||||
gateway: fe80::1
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 213.133.100.100
|
||||
- 195.201.179.131
|
||||
- 95.217.204.204
|
||||
- 213.133.98.98
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- oopen.de
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
# ---
|
||||
|
||||
cron_env_entries:
|
||||
- name: PATH
|
||||
job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
|
||||
- name: SHELL
|
||||
job: /bin/bash
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
special_time: reboot
|
||||
job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
|
||||
insertafter: PATH
|
||||
|
||||
- name: "Check if postfix mailservice is running. Restart service if needed."
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
cron_user_entries:
|
||||
|
||||
- name: "Check if webservices sre running. Restart if necessary"
|
||||
minute: '*/5'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_webservice_load.sh
|
||||
|
||||
- name: "Check if SSH service is running. Restart service if needed."
|
||||
minute: '*/10'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check connectifity - reboot if needed"
|
||||
minute: '*/10'
|
||||
hour: '*'
|
||||
job: /root/bin/admin-stuff/check-connectivity.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_postfix.sh
|
||||
|
||||
- name: "Check Postfix E-Mail LOG file for 'fatal' errors.."
|
||||
minute: '*/5'
|
||||
hour: '*'
|
||||
job: /root/bin/postfix/check-postfix-fatal-errors.sh
|
||||
|
||||
- name: "Check if NTP service 'ntpsec' is up and running?"
|
||||
minute: '*/30'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1
|
||||
|
||||
- name: "Optimize mysql tables"
|
||||
minute: '53'
|
||||
hour: '04'
|
||||
job: /root/bin/mysql/optimize_mysql_tables.sh
|
||||
|
||||
- name: "Flush query cache for mysql tables"
|
||||
minute: '27'
|
||||
hour: '04'
|
||||
job: /root/bin/mysql/flush_query_cache.sh
|
||||
|
||||
- name: "Flush Host cache"
|
||||
minute: '17'
|
||||
hour: '05'
|
||||
job: /root/bin/mysql/flush_host_cache.sh
|
||||
|
||||
- name: "Run occ file:scan for each cloud account"
|
||||
minute: '03'
|
||||
hour: '23'
|
||||
job: /root/bin/nextcloud/occ_maintenance.sh -s cloud.verband-brg.de
|
||||
|
||||
- name: "Background job for nextcloud instance 'cloud.verband-brg.de"
|
||||
minute: '*/15'
|
||||
hour: '*'
|
||||
job: sudo -u "www-data" /usr/local/php/bin/php -f /var/www/cloud.verband-brg.de/htdocs/cron.php
|
||||
|
||||
- name: "Check if certificates for coolwsd service are up to date"
|
||||
minute: '17'
|
||||
hour: '05'
|
||||
job: /root/bin/nextcloud/check_cert_coolwsd.sh
|
||||
|
||||
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
|
||||
minute: '23'
|
||||
hour: '05'
|
||||
job: /var/lib/dehydrated/cron/dehydrated_cron.sh
|
||||
|
||||
- name: "Check whether all certificates are included in the VHOST configurations"
|
||||
minute: '33'
|
||||
hour: '05'
|
||||
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
|
||||
|
||||
- name: "Check hard disc usage."
|
||||
minute: '43'
|
||||
hour: '6'
|
||||
job: /root/bin/admin-stuff/check-disc-usage.sh -c 85
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
sudoers_file_user_privileges:
|
||||
- name: back
|
||||
entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
|
||||
- name: www-data
|
||||
entry: 'ALL=(root) NOPASSWD: /root/bin/nextcloud/add-new-account.sh'
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,33 @@
|
||||
---
|
||||
# ipt-firewall configuration for o34.oopen.de
|
||||
# Generated by extract-fw-host-vars.py - review before committing!
|
||||
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
|
||||
|
||||
fw_manage_config: true
|
||||
|
||||
# --- Network
|
||||
fw_ext_interfaces:
|
||||
- "enp6s0"
|
||||
fw_ext_ips_v4:
|
||||
- "65.109.158.101"
|
||||
fw_ext_ips_v6:
|
||||
- "2a01:4f9:3080:155d::2"
|
||||
|
||||
# --- Munin
|
||||
munin_remote_ipv4: 37.27.121.227
|
||||
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
|
||||
|
||||
# --- Bridged / LXC
|
||||
fw_do_not_firewall_bridged_traffic: true
|
||||
|
||||
# --- HTTP
|
||||
fw_http_server_ips: $ext_1_ip
|
||||
|
||||
# --- Mail
|
||||
fw_mail_client_ips: $ext_1_ip
|
||||
|
||||
# --- FTP
|
||||
fw_ftp_server_ips: $ext_1_ip
|
||||
|
||||
# --- Block
|
||||
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
|
||||
Reference in New Issue
Block a user