update..

decrypt-interactiv.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# Prüfen, ob ein Dateiname als Argument übergeben wurde
+if [ -z "$1" ]; then
+  echo "Usage: $0 <filename>"
+  exit 1
+fi
+
+DATEI="$1"
+
+# Prüfen, ob ansible-vault existiert und ausführbar ist
+if ! command -v ansible-vault >/dev/null 2>&1; then
+  echo "Fehler: 'ansible-vault' ist nicht installiert oder nicht im PATH."
+  exit 2
+fi
+
+# Prüfen, ob die angegebene Datei existiert
+if [ ! -f "$DATEI" ]; then
+  echo "Fehler: Datei '$DATEI' existiert nicht."
+  exit 3
+fi
+
+# Befehl ausführen
+ansible-vault decrypt --ask-vault-pass "$DATEI"
+
+exit 0

decrypt-vault-strings-from-file.sh

@@ -13,8 +13,6 @@
 
 set -euo pipefail
 
-VAULT_PASS_FILE="${HOME}/.vault-pass"
-
 ########################################
 # Hilfe anzeigen
 ########################################
@@ -42,7 +40,6 @@ Options:
   -h, --help   Show this help and exit
 
 Notes:
-  - Vault password file: ${VAULT_PASS_FILE}
   - This script prints decrypted values to stdout.
 EOF
 }
@@ -65,12 +62,6 @@ vdecr() {
     return 1
   fi
 
-  # Prüfen ob Vault-Passwortdatei lesbar ist
-  #if [[ ! -r "$VAULT_PASS_FILE" ]]; then
-  #  echo "Error: vault password file not readable: $VAULT_PASS_FILE" >&2
-  #  return 1
-  #fi
-
   ########################################
   # Wenn ein Argument übergeben wurde
   ########################################
@@ -83,7 +74,7 @@ vdecr() {
       # (Header ist die erste Zeile)
       if [[ "$(head -n1 "$1")" == "\$ANSIBLE_VAULT;1.1;AES256" ]]; then
         # Vollständige Datei entschlüsseln und ausgeben
-        ansible-vault decrypt --vault-password-file "$VAULT_PASS_FILE" "$1" 2>/dev/null
+        ansible-vault decrypt "$1" 2>/dev/null
         return 0
       fi
 
@@ -174,7 +165,7 @@ vdecr() {
   printf -- "%s" "$str" | \
     sed 's/ /\n/g' | \
     sed '/---\|^.*:\|\!vault\||\|^$/d' | \
-    ansible-vault decrypt --vault-password-file "$VAULT_PASS_FILE" 2>/dev/null
+    ansible-vault decrypt 2>/dev/null
 
   printf '\n'
 }

encrypt-interactiv.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# Prüfen, ob ein Dateiname als Argument übergeben wurde
+if [ -z "$1" ]; then
+  echo "Usage: $0 <filename>"
+  exit 1
+fi
+
+DATEI="$1"
+
+# Prüfen, ob ansible-vault existiert und ausführbar ist
+if ! command -v ansible-vault >/dev/null 2>&1; then
+  echo "Fehler: 'ansible-vault' ist nicht installiert oder nicht im PATH."
+  exit 2
+fi
+
+# Prüfen, ob die angegebene Datei existiert
+if [ ! -f "$DATEI" ]; then
+  echo "Fehler: Datei '$DATEI' existiert nicht."
+  exit 3
+fi
+
+# Befehl ausführen
+ansible-vault encrypt --ask-vault-pass "$DATEI"
+
+exit 0

encrypt-vault-string.sh

@@ -1,4 +1,4 @@
-!/usr/bin/env bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 read -r -s -p "String zum Verschlüsseln: " PLAINTEXT

encrypt-vault-strings-from-file.sh

@@ -14,8 +14,6 @@
 
 set -euo pipefail
 
-VAULT_PASS_FILE="${HOME}/.vault-pass"
-
 ########################################
 # Hilfe anzeigen
 ########################################
@@ -43,7 +41,6 @@ Options:
   -h, --help  Show this help and exit
 
 Notes:
-  - Vault password file: ${VAULT_PASS_FILE}
   - Simple "key: value" YAML lines will be converted.
   - Already encrypted (!vault) entries are preserved.
   - Full vault-encrypted files (ANSIBLE_VAULT header) are detected.
@@ -64,12 +61,6 @@ vencr() {
     exit 0
   fi
 
-  # Prüfen ob Vault-Passwortdatei existiert
-  if [[ ! -r "$VAULT_PASS_FILE" ]]; then
-    echo "Vault password file not readable: $VAULT_PASS_FILE" >&2
-    exit 1
-  fi
-
   ########################################
   # Optionales Output-File (-o)
   ########################################
@@ -133,8 +124,7 @@ vencr() {
           done < <(
             printf '%s' "$value" |
             ansible-vault encrypt_string \
-              --stdin-name "$key" \
+              --stdin-name "$key" 
-              --vault-password-file "$VAULT_PASS_FILE"
           )
 
         else
@@ -157,9 +147,7 @@ vencr() {
     fi
 
     # Fall C: Normale Datei → komplett verschlüsseln (in-place)
-    ansible-vault encrypt \
+    ansible-vault encrypt "$f"
-      --vault-password-file "$VAULT_PASS_FILE" \
-      "$f"
 
     echo "Encrypted file in-place: $f" >&2
     return 0
@@ -193,10 +181,9 @@ vencr() {
   fi
 
   # Ausgabe als YAML-kompatibler !vault Block
-  printf '%s' "$str" |
+  echo "Hallo"
-  ansible-vault encrypt_string \
+  printf '%s' "$str" | ansible-vault encrypt_string --stdin-name "$name"
-    --stdin-name "$name" \
+
-    --vault-password-file "$VAULT_PASS_FILE"
 }
 
 ########################################

host_vars/backup.oopen.de.yml

@@ -331,6 +331,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4J/cF/pB9cWyWEKmyTkVEDocPHH3ZMNHdoiqcOmsfp root@o41'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDW54VI+M5SjV6dQLew/IA31RI1GOneIqg5dI1/VZQgJ root@o42'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII2b60T/OXKCoze083GsHXuMFtm8Zo3WnCFb9Q9ofGie root@o43'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPytU2q7RmehrJyRnXRIZp7qcoswSANsClJP8v3zv6D7 root@o44'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMUnxlKIffm8a5BmoQE40h8ut0R6eCxcm+Iewv3evmE9 root@oolm-shop'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF4ylglAkPst7G6kES2lE96ECp0AGXGjzCVkZSqGVru6 root@oolm-shop-dev'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUZ0WNd3rTqHH1tiXAELwssGw6xUP1ROdhgxKbMinYY root@oolm-web'

host_vars/gw-b3.oopen.de.yml

@@ -150,7 +150,7 @@ cron_user_entries:
   - name: "Copy gateway configuration"
     minute: '09'
     hour: '3'
-    job: /root/bin/manage-gw-config/copy_gateway-config.sh B3
+    job: /root/bin/manage-gw-config/copy_gateway-config.sh B3-Bornim
 
   - name: "Speedtest"
     minute: 13

host_vars/gw-elster.oopen.de.yml

@@ -116,7 +116,7 @@ cron_user_entries:
   - name: "Copy gateway configuration"
     minute: '09'
     hour: '3'
-    job: /root/bin/manage-gw-config/copy_gateway-config.sh Elster
+    job: /root/bin/manage-gw-config/copy_gateway-config.sh ELSTER
 
   - name: "Speedtest"
     minute: 13

host_vars/o44.oopen.de.yml

@@ -0,0 +1,326 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: True
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: False
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+
+
+network_interfaces:
+
+  - device: br0
+    # use only once per device (for the first device entry)
+    headline: br0 - bridge over device enp6s0
+
+    # auto & allow are only used for the first device entry
+    allow: [] # array of allow-[stanzas] eg. allow-hotplug
+    auto: true
+
+    family: inet
+    method: static
+    hwaddress: 9c:6b:00:0c:03:7e
+    description:
+    address: 148.251.194.59
+    netmask: 26
+    gateway: 148.251.194.1
+    metric:
+    pointopoint:
+    mtu:
+    scope:
+
+    # additional user by dhcp method
+    #
+    hostname:
+    leasehours:
+    leasetime:
+    vendor:
+    client:
+
+    # additional used by bootp method
+    #
+    bootfile:
+    server:
+    hwaddr:
+
+    # optional dns settings nameservers: []
+    #
+    #    nameservers:
+    #      - 194.150.168.168  # dns.as250.net
+    #      - 91.239.100.100   # anycast.censurfridns.dk
+    #    search: warenform.de
+    #
+    # ** MOVED TO systemd-resolved
+    #
+    nameservers:
+    search:
+
+    # optional bridge parameters bridge: {}
+    # bridge:
+    #   ports:
+    #   stp:
+    #   fd:
+    #   maxwait:
+    #   waitport:
+    bridge:
+      ports: enp6s0 # for mor devices support a blank separated list
+      stp: !!str off
+      fd: 5
+      hello: 2
+      maxage: 12
+
+    #  optional bonding parameters bond: {}
+    #  bond:
+    #    master
+    #    primary
+    #    slave
+    #    method:
+    #    miimon:
+    #    lacp-rate:
+    #    ad-select-rate:
+    #    master:
+    #    slaves:
+    bond: {}
+
+    # optional vlan settings | vlan: {}
+    # vlan: {}
+    #   raw-device: 'eth0'
+    vlan: {}
+
+    # inline hook scripts
+    pre-up: [] # pre-up script lines
+    up: 
+      - !!str "route add -net  148.251.194.0 netmask 255.255.255.192 gw 148.251.194.1 dev br0" # up script lines
+    post-up: [] # post-up script lines (alias for up)
+    pre-down: [] # pre-down script lines (alias for down)
+    down: [] # down script lines
+    post-down: [] # post-down script lines
+
+
+
+  - device: br0
+    family: inet6
+    method: static
+    address: '2a01:4f8:211:f89::2'
+    netmask: 64
+    gateway: 'fe80::1'
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+  - name: "Check if Check if all autostart LX-Container are running."
+    special_time: reboot
+    job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh"
+    insertafter: PATH
+
+  - name: "Restart NTP service 'ntpsec'"
+    special_time: reboot
+    job: "sleep 2 ; /bin/systemctl restart ntpsec > /dev/null 2>&1"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check if NTP service 'ntpsec' is up and running?"
+    minute: '*/30'
+    hour: '*'
+    job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1
+
+  - name: "Check hard disc usage."
+    minute: '43'
+    hour: '6'
+    job: /root/bin/admin-stuff/check-disc-usage.sh -c 85
+
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

hosts

@@ -286,6 +286,10 @@ prometheus-nd.oopen.de
 web-nd.oopen.de
 test-nd.oopen.de
 
+# o44 - ND cloud
+o44.oopen.de
+cl-nd.oopen.de
+
 
 lxc-host-kb.anw-kb.netz
 
@@ -499,6 +503,10 @@ prometheus-nd.oopen.de
 web-nd.oopen.de
 test-nd.oopen.de
 
+# o44 - ND cloud
+o44.oopen.de
+cl-nd.oopen.de
+
 
 lxc-host-kb.anw-kb.netz
 
@@ -773,6 +781,12 @@ cl-flr.oopen.de
 # o43 - ND prometheus, web
 web-nd.oopen.de
 
+# o44 - ND cloud
+cl-nd.oopen.de
+
+# ND - cloud
+o44.oopen.de
+cloud-nd.oopen.de
 
 # ---
 #  O.OPEN office network
@@ -1172,6 +1186,9 @@ cl-flr.oopen.de
 # o43 - ND prmetheus, web
 web-nd.oopen.de
 
+# o44 - ND - cloud
+cl-nd.oopen.de
+
 
 # ---
 # Warenform
@@ -1265,6 +1282,9 @@ cl-opp.oopen.de
 # 040 - Fluechtlingsrat Berlin
 cl-flr.oopen.de
 
+# o44.oopen.de
+cl-nd.oopen.de
+
 # ---
 # Warenform
 # ---
@@ -1517,6 +1537,10 @@ o42.oopen.de
 # ND - prometheus, web
 o43.oopen.de
 
+# ND - cloud
+o44.oopen.de
+
+
 lxc-host-kb.anw-kb.netz
 
 # ---
@@ -1677,6 +1701,9 @@ prometheus-nd.oopen.de
 web-nd.oopen.de
 test-nd.oopen.de
 
+# o44 - ND cloud
+cl-nd.oopen.de
+
 # ---
 #  O.OPEN office network
 # ---
@@ -1914,6 +1941,10 @@ prometheus-nd.oopen.de
 web-nd.oopen.de
 test-nd.oopen.de
 
+# o44 - ND cloud
+o44.oopen.de
+cl-nd.oopen.de
+
 # Gemeinchaft Altenschlirf
 
 

roles/firewall/tasks/ipt-server.yml

@@ -1789,7 +1789,7 @@
      - load_modules_ipv6.conf
      - logging_ipv4.conf
      - logging_ipv6.conf
-     - post_decalrations.conf
+     - post_declarations.conf
   register: diff_output
 
 - name: Ensure common configuration files are latest
@@ -1801,7 +1801,7 @@
      - load_modules_ipv6.conf
      - logging_ipv4.conf
      - logging_ipv6.conf
-     - post_decalrations.conf
+     - post_declarations.conf
   when:
     - (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
     - diff_output.changed

roles/modify-ipt-server/tasks/ipt-server.yml

@@ -52,6 +52,17 @@
 # Adjust/Correct some values..
 # ===
 
+- name: addjust line 'dynaddr_flag' (IPv4)
+  lineinfile:
+    path: /etc/ipt-firewall/main_ipv4.conf
+    regexp: '^dynaddr_flag='
+    line: 'dynaddr_flag="1"'
+  when:
+    - main_ipv4_exists.stat.exists
+  notify:
+    - Restart IPv4 Firewall
+
+
 - name: addjust line 'munin_remote_ip' (IPv4)
   lineinfile:
     path: /etc/ipt-firewall/main_ipv4.conf

zzz.txt

@@ -0,0 +1,6 @@
+$ANSIBLE_VAULT;1.1;AES256
+35613761666536306430613261616634356134333137396661663261336231626233383334663463
+3134376265353534383336323166393232326330306134630a343036363439393461663532396233
+39653866646161386236626261643634613564666536386664356231396636376130643536326662
+3064393033353962370a303035633266623736316564383538656136646266343361313965396331
+6239