From 90786f2fafd07e7c2d76705d24303357dee500d2 Mon Sep 17 00:00:00 2001 From: Christoph Date: Fri, 20 Mar 2026 00:04:46 +0100 Subject: [PATCH] update.. --- decrypt-interactiv.sh | 26 ++ decrypt-vault-strings-from-file.sh | 13 +- encrypt-interactiv.sh | 26 ++ encrypt-vault-string.sh | 2 +- encrypt-vault-strings-from-file.sh | 23 +- host_vars/backup.oopen.de.yml | 1 + host_vars/gw-b3.oopen.de.yml | 2 +- host_vars/gw-elster.oopen.de.yml | 2 +- host_vars/o44.oopen.de.yml | 326 +++++++++++++++++++ hosts | 31 ++ roles/firewall/tasks/ipt-server.yml | 4 +- roles/modify-ipt-server/tasks/ipt-server.yml | 11 + zzz.txt | 6 + 13 files changed, 439 insertions(+), 34 deletions(-) create mode 100755 decrypt-interactiv.sh create mode 100755 encrypt-interactiv.sh create mode 100644 host_vars/o44.oopen.de.yml create mode 100644 zzz.txt diff --git a/decrypt-interactiv.sh b/decrypt-interactiv.sh new file mode 100755 index 0000000..cc762fd --- /dev/null +++ b/decrypt-interactiv.sh @@ -0,0 +1,26 @@ +#!/usr/bin/env bash + +# Prüfen, ob ein Dateiname als Argument übergeben wurde +if [ -z "$1" ]; then + echo "Usage: $0 " + exit 1 +fi + +DATEI="$1" + +# Prüfen, ob ansible-vault existiert und ausführbar ist +if ! command -v ansible-vault >/dev/null 2>&1; then + echo "Fehler: 'ansible-vault' ist nicht installiert oder nicht im PATH." + exit 2 +fi + +# Prüfen, ob die angegebene Datei existiert +if [ ! -f "$DATEI" ]; then + echo "Fehler: Datei '$DATEI' existiert nicht." + exit 3 +fi + +# Befehl ausführen +ansible-vault decrypt --ask-vault-pass "$DATEI" + +exit 0 diff --git a/decrypt-vault-strings-from-file.sh b/decrypt-vault-strings-from-file.sh index 3de389e..cfd1856 100755 --- a/decrypt-vault-strings-from-file.sh +++ b/decrypt-vault-strings-from-file.sh @@ -13,8 +13,6 @@ set -euo pipefail -VAULT_PASS_FILE="${HOME}/.vault-pass" - ######################################## # Hilfe anzeigen ######################################## @@ -42,7 +40,6 @@ Options: -h, --help Show this help and exit Notes: - - Vault password file: ${VAULT_PASS_FILE} - This script prints decrypted values to stdout. EOF } @@ -65,12 +62,6 @@ vdecr() { return 1 fi - # Prüfen ob Vault-Passwortdatei lesbar ist - #if [[ ! -r "$VAULT_PASS_FILE" ]]; then - # echo "Error: vault password file not readable: $VAULT_PASS_FILE" >&2 - # return 1 - #fi - ######################################## # Wenn ein Argument übergeben wurde ######################################## @@ -83,7 +74,7 @@ vdecr() { # (Header ist die erste Zeile) if [[ "$(head -n1 "$1")" == "\$ANSIBLE_VAULT;1.1;AES256" ]]; then # Vollständige Datei entschlüsseln und ausgeben - ansible-vault decrypt --vault-password-file "$VAULT_PASS_FILE" "$1" 2>/dev/null + ansible-vault decrypt "$1" 2>/dev/null return 0 fi @@ -174,7 +165,7 @@ vdecr() { printf -- "%s" "$str" | \ sed 's/ /\n/g' | \ sed '/---\|^.*:\|\!vault\||\|^$/d' | \ - ansible-vault decrypt --vault-password-file "$VAULT_PASS_FILE" 2>/dev/null + ansible-vault decrypt 2>/dev/null printf '\n' } diff --git a/encrypt-interactiv.sh b/encrypt-interactiv.sh new file mode 100755 index 0000000..1b81d3e --- /dev/null +++ b/encrypt-interactiv.sh @@ -0,0 +1,26 @@ +#!/usr/bin/env bash + +# Prüfen, ob ein Dateiname als Argument übergeben wurde +if [ -z "$1" ]; then + echo "Usage: $0 " + exit 1 +fi + +DATEI="$1" + +# Prüfen, ob ansible-vault existiert und ausführbar ist +if ! command -v ansible-vault >/dev/null 2>&1; then + echo "Fehler: 'ansible-vault' ist nicht installiert oder nicht im PATH." + exit 2 +fi + +# Prüfen, ob die angegebene Datei existiert +if [ ! -f "$DATEI" ]; then + echo "Fehler: Datei '$DATEI' existiert nicht." + exit 3 +fi + +# Befehl ausführen +ansible-vault encrypt --ask-vault-pass "$DATEI" + +exit 0 diff --git a/encrypt-vault-string.sh b/encrypt-vault-string.sh index 6e822f8..7a45c32 100755 --- a/encrypt-vault-string.sh +++ b/encrypt-vault-string.sh @@ -1,4 +1,4 @@ -!/usr/bin/env bash +#!/usr/bin/env bash set -euo pipefail read -r -s -p "String zum Verschlüsseln: " PLAINTEXT diff --git a/encrypt-vault-strings-from-file.sh b/encrypt-vault-strings-from-file.sh index 8bf3f62..eb78e84 100755 --- a/encrypt-vault-strings-from-file.sh +++ b/encrypt-vault-strings-from-file.sh @@ -14,8 +14,6 @@ set -euo pipefail -VAULT_PASS_FILE="${HOME}/.vault-pass" - ######################################## # Hilfe anzeigen ######################################## @@ -43,7 +41,6 @@ Options: -h, --help Show this help and exit Notes: - - Vault password file: ${VAULT_PASS_FILE} - Simple "key: value" YAML lines will be converted. - Already encrypted (!vault) entries are preserved. - Full vault-encrypted files (ANSIBLE_VAULT header) are detected. @@ -64,12 +61,6 @@ vencr() { exit 0 fi - # Prüfen ob Vault-Passwortdatei existiert - if [[ ! -r "$VAULT_PASS_FILE" ]]; then - echo "Vault password file not readable: $VAULT_PASS_FILE" >&2 - exit 1 - fi - ######################################## # Optionales Output-File (-o) ######################################## @@ -133,8 +124,7 @@ vencr() { done < <( printf '%s' "$value" | ansible-vault encrypt_string \ - --stdin-name "$key" \ - --vault-password-file "$VAULT_PASS_FILE" + --stdin-name "$key" ) else @@ -157,9 +147,7 @@ vencr() { fi # Fall C: Normale Datei → komplett verschlüsseln (in-place) - ansible-vault encrypt \ - --vault-password-file "$VAULT_PASS_FILE" \ - "$f" + ansible-vault encrypt "$f" echo "Encrypted file in-place: $f" >&2 return 0 @@ -193,10 +181,9 @@ vencr() { fi # Ausgabe als YAML-kompatibler !vault Block - printf '%s' "$str" | - ansible-vault encrypt_string \ - --stdin-name "$name" \ - --vault-password-file "$VAULT_PASS_FILE" + echo "Hallo" + printf '%s' "$str" | ansible-vault encrypt_string --stdin-name "$name" + } ######################################## diff --git a/host_vars/backup.oopen.de.yml b/host_vars/backup.oopen.de.yml index 25feda1..70a8bdd 100644 --- a/host_vars/backup.oopen.de.yml +++ b/host_vars/backup.oopen.de.yml @@ -331,6 +331,7 @@ default_user: - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4J/cF/pB9cWyWEKmyTkVEDocPHH3ZMNHdoiqcOmsfp root@o41' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDW54VI+M5SjV6dQLew/IA31RI1GOneIqg5dI1/VZQgJ root@o42' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII2b60T/OXKCoze083GsHXuMFtm8Zo3WnCFb9Q9ofGie root@o43' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPytU2q7RmehrJyRnXRIZp7qcoswSANsClJP8v3zv6D7 root@o44' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMUnxlKIffm8a5BmoQE40h8ut0R6eCxcm+Iewv3evmE9 root@oolm-shop' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF4ylglAkPst7G6kES2lE96ECp0AGXGjzCVkZSqGVru6 root@oolm-shop-dev' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUZ0WNd3rTqHH1tiXAELwssGw6xUP1ROdhgxKbMinYY root@oolm-web' diff --git a/host_vars/gw-b3.oopen.de.yml b/host_vars/gw-b3.oopen.de.yml index 9607b39..5938c80 100644 --- a/host_vars/gw-b3.oopen.de.yml +++ b/host_vars/gw-b3.oopen.de.yml @@ -150,7 +150,7 @@ cron_user_entries: - name: "Copy gateway configuration" minute: '09' hour: '3' - job: /root/bin/manage-gw-config/copy_gateway-config.sh B3 + job: /root/bin/manage-gw-config/copy_gateway-config.sh B3-Bornim - name: "Speedtest" minute: 13 diff --git a/host_vars/gw-elster.oopen.de.yml b/host_vars/gw-elster.oopen.de.yml index 04975c8..e151b0e 100644 --- a/host_vars/gw-elster.oopen.de.yml +++ b/host_vars/gw-elster.oopen.de.yml @@ -116,7 +116,7 @@ cron_user_entries: - name: "Copy gateway configuration" minute: '09' hour: '3' - job: /root/bin/manage-gw-config/copy_gateway-config.sh Elster + job: /root/bin/manage-gw-config/copy_gateway-config.sh ELSTER - name: "Speedtest" minute: 13 diff --git a/host_vars/o44.oopen.de.yml b/host_vars/o44.oopen.de.yml new file mode 100644 index 0000000..2b0a859 --- /dev/null +++ b/host_vars/o44.oopen.de.yml @@ -0,0 +1,326 @@ +--- + +# --- +# vars used by roles/network_interfaces +# --- + + +# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted +network_manage_devices: True + +# Should the interfaces be reloaded after config change? +network_interface_reload: False + +network_interface_path: /etc/network/interfaces.d +network_interface_required_packages: + - vlan + - bridge-utils + - ifmetric + - ifupdown + - ifenslave + + +network_interfaces: + + - device: br0 + # use only once per device (for the first device entry) + headline: br0 - bridge over device enp6s0 + + # auto & allow are only used for the first device entry + allow: [] # array of allow-[stanzas] eg. allow-hotplug + auto: true + + family: inet + method: static + hwaddress: 9c:6b:00:0c:03:7e + description: + address: 148.251.194.59 + netmask: 26 + gateway: 148.251.194.1 + metric: + pointopoint: + mtu: + scope: + + # additional user by dhcp method + # + hostname: + leasehours: + leasetime: + vendor: + client: + + # additional used by bootp method + # + bootfile: + server: + hwaddr: + + # optional dns settings nameservers: [] + # + # nameservers: + # - 194.150.168.168 # dns.as250.net + # - 91.239.100.100 # anycast.censurfridns.dk + # search: warenform.de + # + # ** MOVED TO systemd-resolved + # + nameservers: + search: + + # optional bridge parameters bridge: {} + # bridge: + # ports: + # stp: + # fd: + # maxwait: + # waitport: + bridge: + ports: enp6s0 # for mor devices support a blank separated list + stp: !!str off + fd: 5 + hello: 2 + maxage: 12 + + # optional bonding parameters bond: {} + # bond: + # master + # primary + # slave + # method: + # miimon: + # lacp-rate: + # ad-select-rate: + # master: + # slaves: + bond: {} + + # optional vlan settings | vlan: {} + # vlan: {} + # raw-device: 'eth0' + vlan: {} + + # inline hook scripts + pre-up: [] # pre-up script lines + up: + - !!str "route add -net 148.251.194.0 netmask 255.255.255.192 gw 148.251.194.1 dev br0" # up script lines + post-up: [] # post-up script lines (alias for up) + pre-down: [] # pre-down script lines (alias for down) + down: [] # down script lines + post-down: [] # post-down script lines + + + + - device: br0 + family: inet6 + method: static + address: '2a01:4f8:211:f89::2' + netmask: 64 + gateway: 'fe80::1' + + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + + +# --- +# vars used by roles/common/tasks/apt.yml +# --- + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 185.12.64.1 + - 2a01:4ff:ff00::add:2 + - 185.12.64.2 + - 2a01:4ff:ff00::add:1 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +#resolved_domains: [] +resolved_domains: + - ~. + - oopen.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 194.150.168.168 + + +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + - name: "Check if postfix mailservice is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" + insertafter: PATH + + - name: "Check if Check if all autostart LX-Container are running." + special_time: reboot + job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh" + insertafter: PATH + + - name: "Restart NTP service 'ntpsec'" + special_time: reboot + job: "sleep 2 ; /bin/systemctl restart ntpsec > /dev/null 2>&1" + insertafter: PATH + + +cron_user_entries: + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_ssh.sh + + - name: "Check if Postfix Mailservice is up and running?" + minute: '*/15' + hour: '*' + job: /root/bin/monitoring/check_postfix.sh + + - name: "Check if NTP service 'ntpsec' is up and running?" + minute: '*/30' + hour: '*' + job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1 + + - name: "Check hard disc usage." + minute: '43' + hour: '6' + job: /root/bin/admin-stuff/check-disc-usage.sh -c 85 + + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- + +git_firewall_repository: + name: ipt-server + repo: https://git.oopen.de/firewall/ipt-server + dest: /usr/local/src/ipt-server + +# ============================== + + +# --- +# vars used by scripts/reset_root_passwd.yml +# --- + +root_user: + name: root + password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. + diff --git a/hosts b/hosts index 2a158e9..c5dd1b4 100644 --- a/hosts +++ b/hosts @@ -286,6 +286,10 @@ prometheus-nd.oopen.de web-nd.oopen.de test-nd.oopen.de +# o44 - ND cloud +o44.oopen.de +cl-nd.oopen.de + lxc-host-kb.anw-kb.netz @@ -499,6 +503,10 @@ prometheus-nd.oopen.de web-nd.oopen.de test-nd.oopen.de +# o44 - ND cloud +o44.oopen.de +cl-nd.oopen.de + lxc-host-kb.anw-kb.netz @@ -773,6 +781,12 @@ cl-flr.oopen.de # o43 - ND prometheus, web web-nd.oopen.de +# o44 - ND cloud +cl-nd.oopen.de + +# ND - cloud +o44.oopen.de +cloud-nd.oopen.de # --- # O.OPEN office network @@ -1172,6 +1186,9 @@ cl-flr.oopen.de # o43 - ND prmetheus, web web-nd.oopen.de +# o44 - ND - cloud +cl-nd.oopen.de + # --- # Warenform @@ -1265,6 +1282,9 @@ cl-opp.oopen.de # 040 - Fluechtlingsrat Berlin cl-flr.oopen.de +# o44.oopen.de +cl-nd.oopen.de + # --- # Warenform # --- @@ -1517,6 +1537,10 @@ o42.oopen.de # ND - prometheus, web o43.oopen.de +# ND - cloud +o44.oopen.de + + lxc-host-kb.anw-kb.netz # --- @@ -1677,6 +1701,9 @@ prometheus-nd.oopen.de web-nd.oopen.de test-nd.oopen.de +# o44 - ND cloud +cl-nd.oopen.de + # --- # O.OPEN office network # --- @@ -1914,6 +1941,10 @@ prometheus-nd.oopen.de web-nd.oopen.de test-nd.oopen.de +# o44 - ND cloud +o44.oopen.de +cl-nd.oopen.de + # Gemeinchaft Altenschlirf diff --git a/roles/firewall/tasks/ipt-server.yml b/roles/firewall/tasks/ipt-server.yml index a23dd77..f830ea4 100644 --- a/roles/firewall/tasks/ipt-server.yml +++ b/roles/firewall/tasks/ipt-server.yml @@ -1789,7 +1789,7 @@ - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - - post_decalrations.conf + - post_declarations.conf register: diff_output - name: Ensure common configuration files are latest @@ -1801,7 +1801,7 @@ - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - - post_decalrations.conf + - post_declarations.conf when: - (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - diff_output.changed diff --git a/roles/modify-ipt-server/tasks/ipt-server.yml b/roles/modify-ipt-server/tasks/ipt-server.yml index 745915f..6174fa3 100644 --- a/roles/modify-ipt-server/tasks/ipt-server.yml +++ b/roles/modify-ipt-server/tasks/ipt-server.yml @@ -52,6 +52,17 @@ # Adjust/Correct some values.. # === +- name: addjust line 'dynaddr_flag' (IPv4) + lineinfile: + path: /etc/ipt-firewall/main_ipv4.conf + regexp: '^dynaddr_flag=' + line: 'dynaddr_flag="1"' + when: + - main_ipv4_exists.stat.exists + notify: + - Restart IPv4 Firewall + + - name: addjust line 'munin_remote_ip' (IPv4) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf diff --git a/zzz.txt b/zzz.txt new file mode 100644 index 0000000..e798d60 --- /dev/null +++ b/zzz.txt @@ -0,0 +1,6 @@ +$ANSIBLE_VAULT;1.1;AES256 +35613761666536306430613261616634356134333137396661663261336231626233383334663463 +3134376265353534383336323166393232326330306134630a343036363439393461663532396233 +39653866646161386236626261643634613564666536386664356231396636376130643536326662 +3064393033353962370a303035633266623736316564383538656136646266343361313965396331 +6239