This commit is contained in:
2022-11-17 18:10:40 +01:00
parent f80772ed42
commit 45115c6700
75 changed files with 5165 additions and 436 deletions

View File

@ -0,0 +1,135 @@
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
#---------------------------------------
#-----------------------------
# Settings for script check_cert_for_dovecot.sh
#-----------------------------
#---------------------------------------
# - service_domain
# -
# - The main domain for which the certificate was issued
# -
# - Example:
# - service_domain="a.mx.oopen.de"
# - service_domain="mail.cadus.org"
# - service_domain="mx.warenform.de"
# -
#service_domain=""
service_domain="mx.gemeinschaft-altenschlirf.de"
# - service_name
# -
# - Name of service.
# -
# - Note: this var will also be used to determin systemd service file
# - or sysVinit script.
# -
# - Example:
# - service_name="Mumble"
# - service_name="Prosody"
# -
# - Defaults to:
# - service_name="Dovecot"
# -
#service_name=""
# - check_string_ps
# -
# - String wich (clearly) identifies the service at the process list (ps)
# -
# - Example:
# - check_string_ps="[[:digit:]]\ /usr/sbin/murmurd"
# - check_string_ps=""
# -
# - Defaults to:
# - check_string_ps="[[:digit:]]\ /usr/local/dovecot-[[:digit:]]{1,2}\.[[:digit:]]{1,2}\.[[:digit:]]{1,2}(\.[[:digit:]]{1,2})?/sbin/dovecot"
# -
#check_string_ps=""
# - service_user
# -
# - User under which the service is running.
# -
# - Example:
# - service_user="mumble-server"
# - service_user="prosody"
# -
# - Defaults to:
# - service_user="prosody"
# -
#service_user=""
# - service_group
# -
# - Group under which the service is running.
# -
# - Example:
# - service_group="mumble-server"
# - service_group="prosody"
# -
# - Defaults to:
# - service_group="prosody"
# -
#service_group=""
# - cert_installed
# -
# - Locataion of certificate read by service
# -
# - Example:
# - cert_installed="/var/lib/mumble-server/fullchain.pem"
# - cert_installed="/var/lib/dehydrated/certs/jabber.so36.net/fullchain.pem"
# -
# - Defaults to:
# - /etc/dovecot/ssl/mailserver.crt
# -
#cert_installed=""
# - key_installed
# -
# - Location of the key read by service
# -
# - Example:
# - key_installed="/var/lib/mumble-server/privkey.pem"
# - key_installed="/etc/prosody/certs/privkey_jabber.so36.pem"
# -
# - Defaults to:
# - /etc/dovecot/ssl/mailserver.key
# -
#key_installed=""
# - cert_newest
# -
# - Location of the newest certificate.
# -
# - Example:
# - cert_newest="/var/lib/dehydrated/certs/il-mumble.oopen.de/fullchain.pem"
# - cert_newest="/var/lib/dehydrated/certs/jabber.so36.net/fullchain.pem"
# -
# - Defaults to:
# - /var/lib/dehydrated/certs/${service_domain}/fullchain.pem
# -
#cert_newest=""
# - key_newest
# -
# - Location of the newest Key
# -
# - Example:
# - key_newest="/var/lib/dehydrated/certs/il-mumble.oopen.de/privkey.pem"
# - key_newest="/var/lib/dehydrated/certs/jabber.so36.net/privkey.pem"
# -
# - Defaults to:
# - /var/lib/dehydrated/certs/${service_domain}/privkey.pem
# -
#key_newest=""

View File

@ -0,0 +1,178 @@
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
#---------------------------------------
#-----------------------------
# Settings
#-----------------------------
#---------------------------------------
# ---
# - LOGGING
# -
# - This Parameter is now obsolete. If script is running in a terminal, then output ist verbose,
# - the output will be verbos. If running as cronjob, output will only be written, if warnings or
# - errors occurs.
# ---
# - What to check
# -
check_load=true
check_mysql=false
# - PostgreSQL
# -
# - NOT useful, if more than one PostgreSQL instances are running!
# -
check_postgresql=true
check_apache=true
check_nginx=false
check_php_fpm=true
check_redis=false
check_website=false
# - If service is not listen on 127.0.0.1/loclhost, curl check must
# - be ommited
# -
# - Defaults to: ommit_curl_check_nginx=false
# -
#ommit_curl_check_nginx=false
# - Is this a vserver guest machine?
# -
# - Not VSerber guest host does not support systemd!
# -
# - defaults to: vserver_guest=false
# -
#vserver_guest=false
# - Additional Settings for check_mysql
# -
# - MySQL / MariaDB credentials
# -
# - Giving password on command line is insecure an sind mysql 5.5
# - you will get a warning doing so.
# -
# - Reading username/password fro file ist also possible, using MySQL/MariaDB
# - commandline parameter '--defaults-file'.
# -
# - Since Mysql Version 5.6, you can read username/password from
# - encrypted file.
# -
# - Create (encrypted) option file:
# - $ mysql_config_editor set --login-path=local --socket=/tmp/mysql.sock --user=root --password
# - $ Password:
# -
# - Use of option file:
# - $ mysql --login-path=local ...
# -
# - Example
# - mysql_credential_args="--login-path=local"
# - mysql_credential_args="--defaults-file=/etc/mysql/debian.cnf" (Debian default)
# - mysql_credential_args="--defaults-file=/usr/local/mysql/sys-maint.cnf"
# -
mysql_credential_args=""
# - Additional Settings for check_php_fpm
# -
# - On Linux Vserver System set
# - curl_check_host=localhost
# -
# - On LX-Container set
# - curl_check_host=127.0.0.1
# -
curl_check_host=127.0.0.1
# - Which PHP versions should be supported by this script. If more than one,
# - give a blank separated list
# -
# - Example:
# - php_versions="5.4 5.6 7.0 7.1"
# -
php_versions="7.4"
# - If PHP-FPM's ping.path setting does not match ping-$php_major_version,
# - set the value given in your ping.path setting here. Give ping_path also
# - the concerning php_version in form
# - <php-version>:<ping-path>
# -
# - Multiple settings are possible, give a blank separated list.
# -
# - Example:
# -
# - ping_path="5.4:ping-site36_net 5.6:ping-oopen_de"
# -
ping_path=""
# - Additional Settings for check_website - checking (expected) website response
# -
# - example:
# - is_working_url="https://www.outoflineshop.de/"
# - check_string='ool-account-links'
# - include_cleanup_function=true
# - extra_alert_address="ilker@so36.net"
# - cleanup_function='
# - rm -rf /var/www/www.outoflineshop.de/htdocs/var/cache/*
# - rm -rf /var/www/www.outoflineshop.de/htdocs/var/session/*
# - /usr/local/bin/redis-cli flushall > /dev/null 2>&1
# - if [[ "$?" = "0" ]]; then
# - ok "I have cleaned up directory \"/var/www/www.outoflineshop.de/htdocs/var/cache/\""
# - else
# - error "Cleaning up directory \"/var/www/www.outoflineshop.de/htdocs/var/cache/\" failed!"
# - fi
# - /etc/init.d/redis_6379 restart
# - if [[ "$?" = "0" ]]; then
# - ok "I restarted the redis service"
# - echo -e "\t[ Ok ]: I restarted the redis service" >> $LOCK_DIR/extra_msg.txt
# - else
# - error "Restarting the redis server failed!"
# - echo -e "\t[ Error ]: Restarting the redis server failed!" >> $LOCK_DIR/extra_msg.txt
# - fi
# - '
# -
is_working_url=''
check_string=''
include_cleanup_function=true
# - An extra e-mail address, which will be informed, if the given check URL
# - does not response as expected (check_string) AFTER script checking, restarting
# - servervices (webserver, php-fpm) and cleaning up (cleanup_function) was done.
# -
extra_alert_address=''
# - php_version_of_working_url
# -
# - If given website (is_working_url) does not response as expected, this PHP FPM
# - engines will be restarted.
# -
# - Type "None" if site does not support php
# -
# - If php_version_of_working_url is not set, PHP FPM processes of ALL versions (php_versions)
# - will be restarted
# -
php_version_of_working_url=''
# - Notice:
# - If single qoutes "'" not needed inside cleanup function, then use single quotes
# - to enclose variable "cleanup_function". Then you don't have do masquerade any
# - sign inside.
# -
# - Otherwise use double quotes and masq any sign to prevent bash from interpreting.
# -
cleanup_function='
'
# - E-Mail settings for sending script messages
# -
from_address="root@`hostname -f`"
content_type='Content-Type: text/plain;\n charset="utf-8"'
to_addresses="root"

View File

@ -0,0 +1,176 @@
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
# ---------------------------------------------------------
# - Parameter Settings for script 'create_opendkim_key.sh'.
# ---------------------------------------------------------
# ----------
# DNS Server
# ----------
# - dns_dkim_zone_master_server
# -
# - The DNS Server who is serving the update zone and is used
# - for the dynamic updates (nsupdate)
# -
#dns_dkim_zone_master_server=""
dns_dkim_zone_master_server="b.ns.oopen.de"
# - update_dns
# -
# - Possible Values are 'true' or 'false'
# -
#update_dns=""
# - update_zone
# -
# - Zone containing the DKIM TXT record.
# -
# - Defaults to '_domainkey.<dkim_domaini>'
# -
# - Note:
# - do NOT change/set this option unless you know what you do.
# -
#update_zone=""
# - TTL
# -
# - TTL for the DKIM TXT Record.
# -
# - Defaults to "" if update_dns=false
# - Defaults to "43200" if update_dns=true
#
#TTL=""
# ----------
# TSIG Key
# ----------
# - key_secret
# -
# - Sectret Key used by 'nsupdate' to create/update the
# - DKIM TXT record.
# -
# - Example:
# - key_secret="EtvvMdW0PXD4GMHP+onuHZ0dT/Z8OSJGlce/xH10OwI="
# -
#key_secret=""
key_secret="4woPu0jqf9Jp1IX+gduJ3BVW/1ZMeyCPTQMqEsMXLFw="
# - key_algo
# -
# - The key algorithm used for key creation. Available choices are: hmac-md5,
# - hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and hmac-sha512. The
# - default is hmac-sha256. Options are case-insensitive.
# -
# - Example:
# - key_algo="hmac-md5"
# -
# - Defaults to 'hmac-sha256'
# -
#key_algo="hmac-sha256"
key_algo="hmac-sha256"
# - key_name
# -
# - Name of the Key
# -
# - Defaults to "$update_zone"
# -
#key_name=
key_name="update-dkim"
# ----------
# Access Credentials DNS Server
# ----------
# - dns_ssh_user
# -
# - Defaults to 'manage-bind'
# -
#dns_ssh_user="manage-bind"
# - dns_ssh_port
# -
# - Defaults to '22'
# -
#dns_ssh_port=22
# - dns_ssh_key
# -
# - Defaults to '/root/.ssh/id_rsa-opendkim'
# -
#dns_ssh_key="/root/.ssh/id_rsa-opendkim"
# ----------
# Scripts envoked at DNS Server
# ----------
# - set_new_serial_script
# -
# - Script increases the serial for a given domain or a given
# - hostname's concerning domain.
# -
# - Defaults to '/root/bin/bind/bind_set_new_serial.sh'
# -
#set_new_serial_script="/root/bin/bind/bind_set_new_serial.sh"
# - create_dkim_delegation_script
# -
# - Script adds DKIM subdomain delegation for a given domain
# -
# - Defaults to '/root/bin/bind/bind_create_dkim_delegation.sh'
# -
#create_dkim_delegation_script="/root/bin/bind/bind_create_dkim_delegation.sh"
# - add_dkim_zone_master_script
# -
# - Script adds zone _domainkey.<dkim domain> as master zone
# -
# - Defaults to '/root/bin/bind/bind_add_dkim_zone_master.sh'
# -
#add_dkim_zone_master_script="/root/bin/bind/bind_add_dkim_zone_master.sh"
# - add_dkim_zone_slave_script
# -
# - Script adds zone _domainkey.<dkim domain> as slave zone
# -
# - Defaults to '/root/bin/bind/bind_add_dkim_zone_slave.sh'
# -
#add_dkim_zone_slave_script="/root/bin/bind/bind_add_dkim_zone_slave.sh"
# ----------
# OpenDKIM Installation
# ----------
# - opendkim_dir
# -
# - OpenDKIM's etc-directory
# -
# - Defaults to opendkim_dir="/etc/opendkim"
# -
#opendkim_dir="/etc/opendkim"
# - key_base_dir
# -
# - Defaults to "${opendkim_dir}/keys"
# -
#key_base_dir=${opendkim_dir}/keys
# - signing_table_file
# -
# - Defaults to "${opendkim_dir}/signing.table"
# -
#signing_table_file="${opendkim_dir}/signing.table"
# - key_table_file
# -
# - Defaults to "${opendkim_dir}/key.table"
# -
#key_table_file="${opendkim_dir}/key.table"

View File

@ -0,0 +1,86 @@
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
# ----------------------------------------------------
# ---
# - Parameter Settings for script 'postfix_add_mailboxes.sh'.
# ---
# ----------------------------------------------------
# - dovecot_enc_method
# -
# - The (dovecot) password scheme which should be used to generate the hashed
# - passwords of EXISTING users.
# -
# - Possible values are:
# -
# - See output of 'doveadm pw -l'
# -
# - DEFAULTS to: dovecot_enc_method="SHA512-CRYPT"
# -
#dovecot_enc_method="SHA512-CRYPT"
# - in_file
# -
# - The file from wich the script reads the e-mail-address/password
# - kombination(s). Each line in this file must only contain
# - <emal-address> <password>
# -
# - Defaults to: in_file="${conf_dir}/mailboxes_new.lst"
# -
#in_file="${conf_dir}/mailboxes_new.lst"
# - db_type
# -
# - Type of Postfix Database
# -
# - Possible values are 'pgsql' (PostgeSQL) or 'mysql' (MySQL)
# -
# - Defaults to: db_type="pgsql"
# -
#db_type="pgsql"
# - db_name
# -
# - Database name for the postfix database
# -
# - Defaults to: db_name="postfix"
# -
#db_name="postfix"
# - db_name
# -
# - Database name for the postfix database
# -
# - Defaults to: db_name="postfix"
# -
#db_name="postfix"
# - mysql_credential_args (root access to MySQL Database)
# -
# - Example
# - mysql_credential_args="--login-path=local"
# - mysql_credential_args="--defaults-file=/etc/mysql/debian.cnf" (Debian default)
# - mysql_credential_args="--defaults-file=/usr/local/mysql/sys-maint.cnf"
# -
# - Defaults to:
# - '--defaults-file=/etc/mysql/debian.cnf' if MySQL is installed from debian package system
# - '--defaults-file=/usr/local/mysql/sys-maint.cnf' otherwise
# -
#mysql_credential_args=""
# - quota
# -
# - The quota setting for the new mailboxes.
# -
# - Defaults to: quota="536870912"
# -
#quota="536870912"
quota="2147483648"
# - log_file
# -
# - Where to write logging informations?
# -
# - Defaults to: log_file="${script_dir}/log/postfix_add_mailboxes.log"
# -
#log_file="${script_dir}/log/postfix_add_mailboxes.log"

View File

@ -0,0 +1,92 @@
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
# ----------------------------------------------------
# ---
# - Parameter Settings for script 'sent_userinfo_postfix.sh'.
# ---
# ----------------------------------------------------
# - message_body_file
# -
# - Full path to file containing the user info. This file must contain
# - the message body WITHOUT e-mail headers. If file is placed in the
# - 'files' directory use '${file_dir}/<file-name>'
# -
# - Defaults to '${file_dir}/sent_userinfo_postfix.message'
# -
#message_body_file="${file_dir}/sent_userinfo_postfix.email"
# - email_from
# -
# - From Address of user info
# -
# - Example: 'oo@oopen.de'
# -
email_from="it@gemeinschaft-altenschlirf.de"
# - email_from_org
# -
# - Example: email_from_org="O.OPEN"
# -
email_from_org="Gemeinschaft Altenschlirf"
# - db_type
# -
# - Type of Postfix Database
# -
# - Possible values are 'pgsql' (PostgeSQL) or 'mysql' (MySQL)
# -
# - Defaults to: db_type="pgsql"
# -
#db_type="pgsql"
# - db_name
# -
# - Database name for the postfix database
# -
# - Defaults to: db_name="postfix"
# -
#db_name="postfix"
# - mysql_credential_args (root access to MySQL Database)
# -
# - Example
# - mysql_credential_args="--login-path=local"
# - mysql_credential_args="--defaults-file=/etc/mysql/debian.cnf" (Debian default)
# - mysql_credential_args="--defaults-file=/usr/local/mysql/sys-maint.cnf"
# -
# - Defaults to:
# - '/etc/mysql/debian.cnf' if MySQL is installed from debian package system
# - '/usr/local/mysql/sys-maint.cnf' otherwise
# -
#mysql_credential_args=""
# - mail_user
# -
# - The owner of the mailbox directories and within the e-mails itself.
# -
# - defaults to mail_user="vmail"
# -
#mail_user="vmail"
# - mail_group
# -
# - The group of the mailbox directories
# -
# - defaults to mail_group="vmail"
# -
#mail_group="vmail"
# - mail_basedir - No more needed!
# -
# - The root directory where all mailbox-domains are located.
# -
# - Defaults to '/var/vmail'.
# -
#mail_basedir=/var/vmail

View File

@ -0,0 +1,44 @@
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
# ======================================================
# ---
# Parameter Settings for Script 'whitelist_mb_sigs.conf'
# ---
# ======================================================
# QUARANTINE_BASE_DIR
#
# Base directory where amavis stores quarantined e-mails, mostly in
#
# virus e-mails: $QUARANTINE_BASE_DIR/virus
# spam emails: $QUARANTINE_BASE_DIR/spam
# ..
#
# Defaults to:
# QUARANTINE_BASE_DIR="/var/QUARANTINE"
#
#QUARANTINE_BASE_DIR="/var/QUARANTINE"
# CLAMAV_VIRUS_WHITE_LIST
#
# Full path to clamav's (personal) white list file
#
# Defaults to:
# CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
#
#CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
# WHITE_LIST_STRINGS
#
# A blank separated list of strings to whitelist.
#
# Example:
# WHITE_LIST_STRINGS="google.com tinyurl.com"
#
# Defaults to:
# WHITE_LIST_STRINGS="google.com"
#
#WHITE_LIST_STRINGS="google.com"
WHITE_LIST_STRINGS="google.com tinyurl.com"