diff --git a/host_vars/lists.mx.warenform.de.yml b/host_vars/lists.mx.warenform.de.yml index c46f57c..59e9f9b 100644 --- a/host_vars/lists.mx.warenform.de.yml +++ b/host_vars/lists.mx.warenform.de.yml @@ -91,7 +91,7 @@ resolved_domains: - ~. - warenform.de -resolved_dnssec: false +resolved_dnssec: !!str "allow-downgrade" # dns.as250.net: 194.150.168.168 # diff --git a/host_vars/o19.oopen.de.yml b/host_vars/o19.oopen.de.yml new file mode 100644 index 0000000..4083bd1 --- /dev/null +++ b/host_vars/o19.oopen.de.yml @@ -0,0 +1,360 @@ +--- + +# --- +# vars used by roles/network_interfaces +# --- + + +# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted +network_manage_devices: True + +# Should the interfaces be reloaded after config change? +network_interface_reload: False + +network_interface_path: /etc/network/interfaces.d +network_interface_required_packages: + - vlan + - bridge-utils + - ifmetric + - ifupdown + - ifenslave + + +network_interfaces: + + - device: br0 + # use only once per device (for the first device entry) + headline: br0 - bridge over device enp7s0 + + # auto & allow are only used for the first device entry + allow: [] # array of allow-[stanzas] eg. allow-hotplug + auto: true + + family: inet + method: static + hwaddress: 7c:10:c9:21:f5:c4 + description: + address: 37.27.121.254 + netmask: 26 + gateway: 37.27.121.193 + metric: + pointopoint: + mtu: + scope: + + # additional user by dhcp method + # + hostname: + leasehours: + leasetime: + vendor: + client: + + # additional used by bootp method + # + bootfile: + server: + hwaddr: + + # optional dns settings nameservers: [] + # + # nameservers: + # - 194.150.168.168 # dns.as250.net + # - 91.239.100.100 # anycast.censurfridns.dk + # search: warenform.de + # + # ** MOVED TO systemd-resolved + # + nameservers: + search: + + # optional bridge parameters bridge: {} + # bridge: + # ports: + # stp: + # fd: + # maxwait: + # waitport: + bridge: + ports: enp7s0 # for mor devices support a blank separated list + stp: !!str off + fd: 5 + hello: 2 + maxage: 12 + + # optional bonding parameters bond: {} + # bond: + # master + # primary + # slave + # method: + # miimon: + # lacp-rate: + # ad-select-rate: + # master: + # slaves: + bond: {} + + # optional vlan settings | vlan: {} + # vlan: {} + # raw-device: 'eth0' + vlan: {} + + # inline hook scripts + pre-up: [] # pre-up script lines + up: + - !!str "route add -net 37.27.121.192 netmask 255.255.255.192 gw 37.27.121.193 dev br0" # up script lines + post-up: [] # post-up script lines (alias for up) + pre-down: [] # pre-down script lines (alias for down) + down: [] # down script lines + post-down: [] # post-down script lines + + + + - device: br0 + family: inet6 + method: static + address: '2a01:4f9:3070:2bda::2' + netmask: 64 + gateway: 'fe80::1' + + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + + +# --- +# vars used by roles/common/tasks/apt.yml +# --- + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 185.12.64.1 + - 2a01:4ff:ff00::add:2 + - 185.12.64.2 + - 2a01:4ff:ff00::add:1 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +#resolved_domains: [] +resolved_domains: + - ~. + - oopen.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 194.150.168.168 + + +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + - name: "Check if postfix mailservice is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" + insertafter: PATH + + - name: "Check if Check if all autostart LX-Container are running." + special_time: reboot + job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh" + insertafter: PATH + + - name: "Restart NTP service 'ntpsec'" + special_time: reboot + job: "sleep 2 ; /bin/systemctl restart ntpsec" + insertafter: PATH + + +cron_user_entries: + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_ssh.sh + + - name: "Check if Postfix Mailservice is up and running?" + minute: '*/15' + hour: '*' + job: /root/bin/monitoring/check_postfix.sh + + - name: "Check if NTP service 'ntpsec' is up and running?" + minute: '*/30' + hour: '*' + job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1 + + - name: "Check hard disc usage." + minute: '43' + hour: '6' + job: /root/bin/admin-stuff/check-disc-usage.sh -c 85 + + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + +default_user: + + - name: chris + password: $y$j9T$CmDEzObyDCcl4Assjaqlw1$5wfAVQoNA0jOPCc3H0PaCNVxHW/0D52Rc9hMzASElrD + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: sysadm + + user_id: 1050 + group_id: 1050 + group: sysadm + password: $y$j9T$bBB2QdnooT7rbIYZ0LK730$vDNyiWPZ2x2GmgeYq652MSIxaoyfBjD2Zn1v6asV62D + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: back + user_id: 1060 + group_id: 1060 + group: back + password: $y$j9T$bBB2QdnooT7rbIYZ0LK730$vDNyiWPZ2x2GmgeYq652MSIxaoyfBjD2Zn1v6asV62D + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + +sudo_users: + - chris + - sysadm + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- + +git_firewall_repository: + name: ipt-server + repo: https://git.oopen.de/firewall/ipt-server + dest: /usr/local/src/ipt-server + +# ============================== + + +# --- +# vars used by scripts/reset_root_passwd.yml +# --- + +root_user: + name: root + password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. + diff --git a/host_vars/o25.oopen.de.yml b/host_vars/o25.oopen.de.yml index bdd8cd2..e5157b1 100644 --- a/host_vars/o25.oopen.de.yml +++ b/host_vars/o25.oopen.de.yml @@ -250,6 +250,8 @@ network_interfaces: # vars used by roles/common/tasks/sshd.yml # --- +create_sftp_group: true + # --- # vars used by roles/common/tasks/apt.yml diff --git a/host_vars/o41.oopen.de.yml b/host_vars/o41.oopen.de.yml index 0a7264e..c6830af 100644 --- a/host_vars/o41.oopen.de.yml +++ b/host_vars/o41.oopen.de.yml @@ -118,11 +118,11 @@ cron_env_entries: cron_user_special_time_entries: - - name: "Restart DNS Cache service 'systemd-resolved'" - special_time: reboot - job: "sleep 5 ; /bin/systemctl restart systemd-resolved" - insertafter: PATH - +# - name: "Restart DNS Cache service 'systemd-resolved'" +# special_time: reboot +# job: "sleep 5 ; /bin/systemctl restart systemd-resolved" +# insertafter: PATH +# # - name: "Check if postfix mailservice is running. Restart service if needed." # special_time: reboot # job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" diff --git a/host_vars/o43.oopen.de.yml b/host_vars/o43.oopen.de.yml new file mode 100644 index 0000000..3f52834 --- /dev/null +++ b/host_vars/o43.oopen.de.yml @@ -0,0 +1,360 @@ +--- + +# --- +# vars used by roles/network_interfaces +# --- + + +# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted +network_manage_devices: True + +# Should the interfaces be reloaded after config change? +network_interface_reload: False + +network_interface_path: /etc/network/interfaces.d +network_interface_required_packages: + - vlan + - bridge-utils + - ifmetric + - ifupdown + - ifenslave + + +network_interfaces: + + - device: br0 + # use only once per device (for the first device entry) + headline: br0 - bridge over device enp6s0 + + # auto & allow are only used for the first device entry + allow: [] # array of allow-[stanzas] eg. allow-hotplug + auto: true + + family: inet + method: static + hwaddress: 9c:6b:00:51:bf:54 + description: + address: 176.9.62.77 + netmask: 27 + gateway: 176.9.62.65 + metric: + pointopoint: + mtu: + scope: + + # additional user by dhcp method + # + hostname: + leasehours: + leasetime: + vendor: + client: + + # additional used by bootp method + # + bootfile: + server: + hwaddr: + + # optional dns settings nameservers: [] + # + # nameservers: + # - 194.150.168.168 # dns.as250.net + # - 91.239.100.100 # anycast.censurfridns.dk + # search: warenform.de + # + # ** MOVED TO systemd-resolved + # + nameservers: + search: + + # optional bridge parameters bridge: {} + # bridge: + # ports: + # stp: + # fd: + # maxwait: + # waitport: + bridge: + ports: enp6s0 # for mor devices support a blank separated list + stp: !!str off + fd: 5 + hello: 2 + maxage: 12 + + # optional bonding parameters bond: {} + # bond: + # master + # primary + # slave + # method: + # miimon: + # lacp-rate: + # ad-select-rate: + # master: + # slaves: + bond: {} + + # optional vlan settings | vlan: {} + # vlan: {} + # raw-device: 'eth0' + vlan: {} + + # inline hook scripts + pre-up: [] # pre-up script lines + up: + - !!str "route add -net 176.9.62.64 netmask 255.255.255.224 gw 176.9.62.65 dev br0" # up script lines + post-up: [] # post-up script lines (alias for up) + pre-down: [] # pre-down script lines (alias for down) + down: [] # down script lines + post-down: [] # post-down script lines + + + + - device: br0 + family: inet6 + method: static + address: '2a01:4f8:150:805b::2' + netmask: 64 + gateway: 'fe80::1' + + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + + +# --- +# vars used by roles/common/tasks/apt.yml +# --- + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 185.12.64.1 + - 2a01:4ff:ff00::add:2 + - 185.12.64.2 + - 2a01:4ff:ff00::add:1 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +#resolved_domains: [] +resolved_domains: + - ~. + - oopen.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 194.150.168.168 + + +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + - name: "Check if postfix mailservice is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" + insertafter: PATH + + - name: "Check if Check if all autostart LX-Container are running." + special_time: reboot + job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh" + insertafter: PATH + + - name: "Restart NTP service 'ntpsec'" + special_time: reboot + job: "sleep 2 ; /bin/systemctl restart ntpsec" + insertafter: PATH + + +cron_user_entries: + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_ssh.sh + + - name: "Check if Postfix Mailservice is up and running?" + minute: '*/15' + hour: '*' + job: /root/bin/monitoring/check_postfix.sh + + - name: "Check if NTP service 'ntpsec' is up and running?" + minute: '*/30' + hour: '*' + job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1 + + - name: "Check hard disc usage." + minute: '43' + hour: '6' + job: /root/bin/admin-stuff/check-disc-usage.sh -c 85 + + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + +default_user: + + - name: chris + password: $y$j9T$CmDEzObyDCcl4Assjaqlw1$5wfAVQoNA0jOPCc3H0PaCNVxHW/0D52Rc9hMzASElrD + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: sysadm + + user_id: 1050 + group_id: 1050 + group: sysadm + password: $y$j9T$bBB2QdnooT7rbIYZ0LK730$vDNyiWPZ2x2GmgeYq652MSIxaoyfBjD2Zn1v6asV62D + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: back + user_id: 1060 + group_id: 1060 + group: back + password: $y$j9T$bBB2QdnooT7rbIYZ0LK730$vDNyiWPZ2x2GmgeYq652MSIxaoyfBjD2Zn1v6asV62D + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + +sudo_users: + - chris + - sysadm + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- + +git_firewall_repository: + name: ipt-server + repo: https://git.oopen.de/firewall/ipt-server + dest: /usr/local/src/ipt-server + +# ============================== + + +# --- +# vars used by scripts/reset_root_passwd.yml +# --- + +root_user: + name: root + password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. + diff --git a/host_vars/prometheus-nd.oopen.de.yml b/host_vars/prometheus-nd.oopen.de.yml new file mode 100644 index 0000000..79e46d9 --- /dev/null +++ b/host_vars/prometheus-nd.oopen.de.yml @@ -0,0 +1,226 @@ +--- + +# --- +# vars used by roles/network_interfaces +# --- + + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + + +# --- +# vars used by roles/common/tasks/apt.yml +# --- + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 185.12.64.1 + - 2a01:4ff:ff00::add:2 + - 185.12.64.2 + - 2a01:4ff:ff00::add:1 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +#resolved_domains: [] +resolved_domains: + - ~. + - oopen.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 194.150.168.168 + + +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + - name: "Check if postfix mailservice is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" + insertafter: PATH + + +cron_user_entries: + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_ssh.sh + + - name: "Check if Postfix Mailservice is up and running?" + minute: '*/15' + hour: '*' + job: /root/bin/monitoring/check_postfix.sh + + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + +default_user: + + - name: chris + password: $y$j9T$CmDEzObyDCcl4Assjaqlw1$5wfAVQoNA0jOPCc3H0PaCNVxHW/0D52Rc9hMzASElrD + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: sysadm + + user_id: 1050 + group_id: 1050 + group: sysadm + password: $y$j9T$bBB2QdnooT7rbIYZ0LK730$vDNyiWPZ2x2GmgeYq652MSIxaoyfBjD2Zn1v6asV62D + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: back + user_id: 1060 + group_id: 1060 + group: back + password: $y$j9T$bBB2QdnooT7rbIYZ0LK730$vDNyiWPZ2x2GmgeYq652MSIxaoyfBjD2Zn1v6asV62D + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + +sudo_users: + - chris + - sysadm + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- + +git_firewall_repository: + name: ipt-server + repo: https://git.oopen.de/firewall/ipt-server + dest: /usr/local/src/ipt-server + +# ============================== + + +# --- +# vars used by scripts/reset_root_passwd.yml +# --- + +root_user: + name: root + password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. + diff --git a/host_vars/web-nd.oopen.de.yml b/host_vars/web-nd.oopen.de.yml new file mode 100644 index 0000000..79e46d9 --- /dev/null +++ b/host_vars/web-nd.oopen.de.yml @@ -0,0 +1,226 @@ +--- + +# --- +# vars used by roles/network_interfaces +# --- + + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + + +# --- +# vars used by roles/common/tasks/apt.yml +# --- + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 185.12.64.1 + - 2a01:4ff:ff00::add:2 + - 185.12.64.2 + - 2a01:4ff:ff00::add:1 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +#resolved_domains: [] +resolved_domains: + - ~. + - oopen.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 194.150.168.168 + + +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + - name: "Check if postfix mailservice is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" + insertafter: PATH + + +cron_user_entries: + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_ssh.sh + + - name: "Check if Postfix Mailservice is up and running?" + minute: '*/15' + hour: '*' + job: /root/bin/monitoring/check_postfix.sh + + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + +default_user: + + - name: chris + password: $y$j9T$CmDEzObyDCcl4Assjaqlw1$5wfAVQoNA0jOPCc3H0PaCNVxHW/0D52Rc9hMzASElrD + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: sysadm + + user_id: 1050 + group_id: 1050 + group: sysadm + password: $y$j9T$bBB2QdnooT7rbIYZ0LK730$vDNyiWPZ2x2GmgeYq652MSIxaoyfBjD2Zn1v6asV62D + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + + - name: back + user_id: 1060 + group_id: 1060 + group: back + password: $y$j9T$bBB2QdnooT7rbIYZ0LK730$vDNyiWPZ2x2GmgeYq652MSIxaoyfBjD2Zn1v6asV62D + shell: /bin/bash + ssh_keys: + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol' + +sudo_users: + - chris + - sysadm + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- + +git_firewall_repository: + name: ipt-server + repo: https://git.oopen.de/firewall/ipt-server + dest: /usr/local/src/ipt-server + +# ============================== + + +# --- +# vars used by scripts/reset_root_passwd.yml +# --- + +root_user: + name: root + password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. + diff --git a/hosts b/hosts index ba807a5..a507380 100644 --- a/hosts +++ b/hosts @@ -17,9 +17,10 @@ rage.so36.net ansible_user=ckubu [no_ipt_firewall] lxc-host-kb.anw-kb.netz -o33.oopen.de -o25.oopen.de o13-staging-board.oopen.de +o25.oopen.de +o33.oopen.de +o41.oopen.de dc-opp.oopen.de discourse.oopen.de @@ -123,8 +124,8 @@ stolpersteine.oopen.de c.mx.oopen.de o13.oopen.de -o13-board.oopen.de o13-staging-board.oopen.de +o13-git.oopen.de o13-mail.oopen.de o13-mumble.oopen.de o13-pad.oopen.de @@ -134,6 +135,9 @@ o13-web.oopen.de o17.oopen.de test.mx.oopen.de +# Backup Server O.OPEN +o19.oopen.de + o20.oopen.de # o21.oopen.de @@ -240,6 +244,11 @@ o41.oopen.de o42.oopen.de mm-rav.oopen.de +# ND - prometheus, web +o43.oopen.de +prometheus-nd.oopen.de +web-nd.oopen.de + lxc-host-kb.anw-kb.netz @@ -304,18 +313,21 @@ initiativenserver.oopen.de stolpersteine.oopen.de o13.oopen.de -o13-board.oopen.de o13-staging-board.oopen.de o13-mail.oopen.de o13-mumble.oopen.de o13-pad.oopen.de o13-cryptpad.oopen.de o13-web.oopen.de +o13-git.oopen.de o17.oopen.de test.mx.oopen.de test.mariadb.oopen.de +# Backup Server O.OPEN +o19.oopen.de + # - o20.oopen.de (srv-cityslang.cityslang.com) o20.oopen.de @@ -428,6 +440,11 @@ g.mx.oopen.de o42.oopen.de mm-rav.oopen.de +# ND - prometheus, web +o43.oopen.de +prometheus-nd.oopen.de +web-nd.oopen.de + lxc-host-kb.anw-kb.netz @@ -565,6 +582,10 @@ web-07.oopen.de web-08.oopen.de web-09.oopen.de +# ND - prometheus, web +web-nd.oopen.de + + # --- # Warenform server # --- @@ -667,6 +688,9 @@ web-09.oopen.de g.mx.oopen.de cl-flr.oopen.de +# o43 - ND prometheus, web +web-nd.oopen.de + # --- # O.OPEN office network @@ -815,6 +839,10 @@ cp-flr.oopen.de # o42.oopen.de mm-rav.oopen.de +# o43 - ND prometheus, web +prometheus-nd.oopen.de +web-nd.oopen.de + # GA - Gemeinschaft Altensclirf ga-st-services.ga.netz @@ -897,7 +925,6 @@ lists.mx.warenform.de # --- # o13.oopen.de -o13-board.oopen.de o13-staging-board.oopen.de o13-mail.oopen.de @@ -948,6 +975,9 @@ verdi-django.warenform.de # o42.oopen.de mm-rav.oopen.de +# o43 - ND app +prometheus-nd.oopen.de + [mysql_server] @@ -961,7 +991,6 @@ initiativenserver.oopen.de stolpersteine.oopen.de # o13.oopen.de -o13-board.oopen.de o13-staging-board.oopen.de o13-mail.oopen.de o13-web.oopen.de @@ -1040,6 +1069,9 @@ web-09.oopen.de # o40 - Fluechtlingsrat Berlin cl-flr.oopen.de +# o43 - ND prmetheus, web +web-nd.oopen.de + # --- # Warenform @@ -1328,6 +1360,10 @@ o41.oopen.de o12.oopen.de o13.oopen.de o17.oopen.de + +# Backup Server O.OPEN +o19.oopen.de + #o20.oopen.de o21.oopen.de o22.oopen.de @@ -1350,6 +1386,9 @@ o40.oopen.de # RAV o42.oopen.de +# ND - prometheus, web +o43.oopen.de + lxc-host-kb.anw-kb.netz # --- @@ -1399,13 +1438,13 @@ initiativenserver.oopen.de stolpersteine.oopen.de # - o13.oopen.de -o13-board.oopen.de o13-staging-board.oopen.de o13-mail.oopen.de o13-mumble.oopen.de o13-pad.oopen.de o13-cryptpad.oopen.de o13-web.oopen.de +o13-git.oopen.de # - o17.oopen.de test.mx.oopen.de @@ -1497,6 +1536,10 @@ cp-flr.oopen.de # o42.oopen.de mm-rav.oopen.de +# o43 - ND +prometheus-nd.oopen.de +web-nd.oopen.de + # --- # O.OPEN office network # --- @@ -1586,28 +1629,25 @@ stolpersteine.oopen.de # - o13.oopen.de o13.oopen.de -o13-board.oopen.de o13-staging-board.oopen.de o13-mail.oopen.de o13-mumble.oopen.de o13-pad.oopen.de o13-cryptpad.oopen.de o13-web.oopen.de +o13-git.oopen.de # - o17.oopen.de o17.oopen.de test.mx.oopen.de test.mariadb.oopen.de +# Backup Server O.OPEN +o19.oopen.de + # - o20.oopen.de (srv-cityslang.cityslang.com) o20.oopen.de -# - o31.oopen.de -o31.oopen.de -mail.cadus.org -135.181.22.161 -web.cadus.org - # o21.oopen.de o21.oopen.de @@ -1657,6 +1697,12 @@ o30.oopen.de meet.akweb.de cloud.akweb.de +# - o31.oopen.de +o31.oopen.de +mail.cadus.org +135.181.22.161 +web.cadus.org + # etventure o32.oopen.de @@ -1711,6 +1757,11 @@ o41.oopen.de o42.oopen.de mm-rav.oopen.de +# ND - prometheus, web +o43.oopen.de +prometheus-nd.oopen.de +web-nd.oopen.de + lxc-host-kb.anw-kb.netz @@ -1856,7 +1907,6 @@ ga-al-kvm3.ga.netz # - o13.oopen.de o13.oopen.de -o13-board.oopen.de o13-staging-board.oopen.de o13-mail.oopen.de o13-mumble.oopen.de diff --git a/roles/modify-ipt-server/tasks/ipt-server.yml b/roles/modify-ipt-server/tasks/ipt-server.yml index 85e4180..babe88d 100644 --- a/roles/modify-ipt-server/tasks/ipt-server.yml +++ b/roles/modify-ipt-server/tasks/ipt-server.yml @@ -99,69 +99,103 @@ # === # --- -# LOG CGI script Traffic out +# Add Prometheus Services # --- -- name: Check if String 'log_cgi_traffic_out=..' is present - shell: grep -q -E "^log_cgi_traffic_out=" /etc/ipt-firewall/main_ipv4.conf - register: log_cgi_traffic_out_ipv4_present +- name: Check if String 'prometheus_local_server_ips=..' is present + shell: grep -q -E "^prometheus_local_server_ips=" /etc/ipt-firewall/main_ipv4.conf + register: prometheus_local_server_ips_ipv4_present when: main_ipv4_exists.stat.exists - failed_when: "log_cgi_traffic_out_ipv4_present.rc > 1" - changed_when: "log_cgi_traffic_out_ipv4_present.rc > 0" + failed_when: "prometheus_local_server_ips_ipv4_present.rc > 1" + changed_when: "prometheus_local_server_ips_ipv4_present.rc > 0" -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (log_cgi_traffic_out) +- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (prometheus_local_server_ips) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*http_ports' + insertafter: '^#?\s*tftp_server_ips' block: | - # - LOG CGI script Traffic out + # - Prometheus Monitoring - local Server # - - log_cgi_traffic_out=false + # - blank separated list of IPv4 addresses + # - + prometheus_local_server_ips="" - # - cgi_script_users + # - (Remote) prometheus ports # - - # - List of CGI script users (suexec user, php-fpm user. ...) + # - !! comma separated list of ports # - - # - Blank separated list + prometheus_remote_client_ports="$standard_prometheus_ports" + + + # - Prometheus Monitoring - local Client # - - cgi_script_users="" - marker: "# Marker set by modify-ipt-server.yml (log_cgi_traffic_out)" + # - blank separated list of IPv4 addresses + # - + prometheus_local_client_ips="" + + # - Local prometheus ports + # - + # - !! comma separated list of ports + # - + prometheus_local_client_ports="$standard_prometheus_ports" + + # - blank separated list of IPv4 addresses + # - + prometheus_remote_server_ips="" + marker: "# Marker set by modify-ipt-server.yml (prometheus_local_server_ips)" when: - main_ipv4_exists.stat.exists - - log_cgi_traffic_out_ipv4_present is changed + - prometheus_local_server_ips_ipv4_present is changed notify: - Restart IPv4 Firewall -- name: Check if String 'log_cgi_traffic_out=..' is present - shell: grep -q -E "^log_cgi_traffic_out=" /etc/ipt-firewall/main_ipv6.conf - register: log_cgi_traffic_out_ipv6_present +- name: Check if String 'prometheus_local_server_ips=..' is present + shell: grep -q -E "^prometheus_local_server_ips=" /etc/ipt-firewall/main_ipv6.conf + register: prometheus_local_server_ips_ipv6_present when: main_ipv6_exists.stat.exists - failed_when: "log_cgi_traffic_out_ipv6_present.rc > 1" - changed_when: "log_cgi_traffic_out_ipv6_present.rc > 0" + failed_when: "prometheus_local_server_ips_ipv6_present.rc > 1" + changed_when: "prometheus_local_server_ips_ipv6_present.rc > 0" -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (log_cgi_traffic_out) +- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (prometheus_local_server_ips) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*http_ports' + insertafter: '^#?\s*tftp_server_ips' block: | - # - LOG CGI script Traffic out + # - Prometheus Monitoring - local Server # - - log_cgi_traffic_out=false + # - blank separated list of IPv6 addresses + # - + prometheus_local_server_ips="" - # - cgi_script_users + # - (Remote) prometheus ports # - - # - List of CGI script users (suexec user, php-fpm user. ...) + # - !! comma separated list of ports # - - # - Blank separated list + prometheus_remote_client_ports="$standard_prometheus_ports" + + + # - Prometheus Monitoring - local Client # - - cgi_script_users="" - marker: "# Marker set by modify-ipt-server.yml (log_cgi_traffic_out)" + # - blank separated list of IPv6 addresses + # - + prometheus_local_client_ips="" + + # - Local prometheus ports + # - + # - !! comma separated list of ports + # - + prometheus_local_client_ports="$standard_prometheus_ports" + + # - blank separated list of IPv6 addresses + # - + prometheus_remote_server_ips="" + marker: "# Marker set by modify-ipt-server.yml (prometheus_local_server_ips)" when: - main_ipv6_exists.stat.exists - - log_cgi_traffic_out_ipv6_present is changed + - prometheus_local_server_ips_ipv6_present is changed notify: - Restart IPv6 Firewall