update..
This commit is contained in:
parent
3fb347061c
commit
976f497d78
@ -828,6 +828,7 @@ apt_webserver_pkgs:
|
|||||||
- expect
|
- expect
|
||||||
- expect-dev
|
- expect-dev
|
||||||
- libexpect-perl
|
- libexpect-perl
|
||||||
|
- poppler-utils
|
||||||
|
|
||||||
apt_install_postgresql_pkgs: false
|
apt_install_postgresql_pkgs: false
|
||||||
apt_postgresql_pkgs:
|
apt_postgresql_pkgs:
|
||||||
|
|||||||
@ -1,210 +0,0 @@
|
|||||||
---
|
|
||||||
# ---
|
|
||||||
# vars used by roles/network_interfaces
|
|
||||||
# ---
|
|
||||||
|
|
||||||
|
|
||||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
|
||||||
network_manage_devices: True
|
|
||||||
|
|
||||||
# Should the interfaces be reloaded after config change?
|
|
||||||
network_interface_reload: False
|
|
||||||
|
|
||||||
network_interface_path: /etc/network/interfaces.d
|
|
||||||
network_interface_required_packages:
|
|
||||||
- vlan
|
|
||||||
- bridge-utils
|
|
||||||
- ifmetric
|
|
||||||
- ifupdown
|
|
||||||
- ifenslave
|
|
||||||
- resolvconf
|
|
||||||
|
|
||||||
network_interfaces:
|
|
||||||
|
|
||||||
- device: eno1
|
|
||||||
headline: eno1 - holds uplink WiDSL Antenna (ppp line widsl)
|
|
||||||
auto: true
|
|
||||||
family: inet
|
|
||||||
method: static
|
|
||||||
address: 10.12.136.254
|
|
||||||
netmask: 24
|
|
||||||
|
|
||||||
|
|
||||||
- device: dsl-widsl
|
|
||||||
headline: dsl-widsl - ppp line widsl
|
|
||||||
auto: true
|
|
||||||
family: inet
|
|
||||||
method: ppp
|
|
||||||
provider: dsl-widsl
|
|
||||||
pre-up:
|
|
||||||
- /sbin/ifconfig eno1 up
|
|
||||||
|
|
||||||
|
|
||||||
- device: eno2
|
|
||||||
headline: eno2 - uplink Telekom (static line via digitbox)
|
|
||||||
auto: true
|
|
||||||
family: inet
|
|
||||||
method: static
|
|
||||||
address: 172.16.81.1
|
|
||||||
netmask: 24
|
|
||||||
gateway: 172.16.81.254
|
|
||||||
nameservers:
|
|
||||||
- 192.168.81.1
|
|
||||||
- 192.168.11.1
|
|
||||||
search: ga.netz
|
|
||||||
|
|
||||||
|
|
||||||
- device: eno5
|
|
||||||
headline: eno5 - LAN
|
|
||||||
auto: true
|
|
||||||
family: inet
|
|
||||||
method: static
|
|
||||||
address: 192.168.81.254
|
|
||||||
netmask: 24
|
|
||||||
|
|
||||||
|
|
||||||
- device: eno5:ns
|
|
||||||
headline: eno5:ns - Alias on eno5 (Nameserver)
|
|
||||||
auto: true
|
|
||||||
family: inet
|
|
||||||
method: static
|
|
||||||
address: 192.168.81.1
|
|
||||||
netmask: 32
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/ansible_dependencies
|
|
||||||
# ---
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/ansible_user
|
|
||||||
# ---
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/common/tasks/basic.yml
|
|
||||||
# ---
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/common/tasks/sshd.yml
|
|
||||||
# ---
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/common/tasks/apt.yml
|
|
||||||
# ---
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/common/tasks/users.yml
|
|
||||||
# ---
|
|
||||||
|
|
||||||
insert_ssh_keypair_backup_server: false
|
|
||||||
ssh_keypair_backup_server:
|
|
||||||
- name: backup
|
|
||||||
backup_user: back
|
|
||||||
priv_key_src: root/.ssh/id_rsa.backup.oopen.de
|
|
||||||
priv_key_dest: /root/.ssh/id_rsa
|
|
||||||
pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
|
|
||||||
pub_key_dest: /root/.ssh/id_rsa.pub
|
|
||||||
|
|
||||||
insert_keypair_backup_client: true
|
|
||||||
ssh_keypair_backup_client:
|
|
||||||
- name: backup
|
|
||||||
priv_key_src: root/.ssh/id_ed25519.oopen-server
|
|
||||||
priv_key_dest: /root/.ssh/id_ed25519
|
|
||||||
pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
|
|
||||||
pub_key_dest: /root/.ssh/id_ed25519.pub
|
|
||||||
target: backup.oopen.de
|
|
||||||
|
|
||||||
default_user:
|
|
||||||
|
|
||||||
- name: chris
|
|
||||||
password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
|
|
||||||
shell: /bin/bash
|
|
||||||
ssh_keys:
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
|
|
||||||
|
|
||||||
- name: wadmin
|
|
||||||
password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
|
|
||||||
shell: /bin/bash
|
|
||||||
ssh_keys:
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
|
|
||||||
|
|
||||||
- name: sysadm
|
|
||||||
user_id: 1050
|
|
||||||
group_id: 1050
|
|
||||||
group: sysadm
|
|
||||||
password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
|
|
||||||
shell: /bin/bash
|
|
||||||
ssh_keys:
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
|
|
||||||
|
|
||||||
- name: back
|
|
||||||
user_id: 1060
|
|
||||||
group_id: 1060
|
|
||||||
group: back
|
|
||||||
password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
|
|
||||||
shell: /bin/bash
|
|
||||||
ssh_keys:
|
|
||||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
|
||||||
|
|
||||||
sudo_users:
|
|
||||||
- chris
|
|
||||||
- sysadm
|
|
||||||
- wadmin
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
|
||||||
# ---
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/common/tasks/webadmin-user.yml
|
|
||||||
# ---
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/common/tasks/sudoers.yml
|
|
||||||
# ---
|
|
||||||
#
|
|
||||||
# see: roles/common/tasks/vars
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
|
||||||
# ---
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/common/tasks/git.yml
|
|
||||||
# ---
|
|
||||||
|
|
||||||
git_firewall_repository:
|
|
||||||
name: ipt-gateway
|
|
||||||
repo: https://git.oopen.de/firewall/ipt-gateway
|
|
||||||
dest: /usr/local/src/ipt-gateway
|
|
||||||
|
|
||||||
# ==============================
|
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by scripts/reset_root_passwd.yml
|
|
||||||
# ---
|
|
||||||
|
|
||||||
root_user:
|
|
||||||
name: root
|
|
||||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
|
||||||
|
|
||||||
@ -131,7 +131,7 @@ bind9_gateway_acl:
|
|||||||
- internaldns:
|
- internaldns:
|
||||||
name: internaldns
|
name: internaldns
|
||||||
entries:
|
entries:
|
||||||
- '# Nameserver Kanzlei EBS'
|
- '// Nameserver Kanzlei EBS'
|
||||||
- 192.168.182.1
|
- 192.168.182.1
|
||||||
|
|
||||||
bind9_gateway_listen_on_v6:
|
bind9_gateway_listen_on_v6:
|
||||||
|
|||||||
@ -1,5 +1,58 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# vars used by roles/network_interfaces
|
||||||
|
# ---
|
||||||
|
|
||||||
|
|
||||||
|
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||||
|
network_manage_devices: True
|
||||||
|
|
||||||
|
# Should the interfaces be reloaded after config change?
|
||||||
|
network_interface_reload: False
|
||||||
|
|
||||||
|
network_interface_path: /etc/network/interfaces.d
|
||||||
|
network_interface_required_packages:
|
||||||
|
- vlan
|
||||||
|
- bridge-utils
|
||||||
|
- ifmetric
|
||||||
|
- ifupdown
|
||||||
|
- ifenslave
|
||||||
|
- resolvconf
|
||||||
|
|
||||||
|
network_interfaces:
|
||||||
|
|
||||||
|
- device: eno1
|
||||||
|
headline: eno1 - Uplink DSL via Fritz!Box
|
||||||
|
auto: true
|
||||||
|
family: inet
|
||||||
|
method: static
|
||||||
|
address: 172.16.182.1
|
||||||
|
netmask: 24
|
||||||
|
gateway: 172.16.182.254
|
||||||
|
nameservers:
|
||||||
|
- 127.0.0.1
|
||||||
|
- 192.168.182.1
|
||||||
|
search: ebs.netz kanzlei-kiel.netz elster.netz
|
||||||
|
|
||||||
|
|
||||||
|
- device: eno2
|
||||||
|
headline: eno2 - LAN
|
||||||
|
auto: true
|
||||||
|
family: inet
|
||||||
|
method: static
|
||||||
|
address: 192.168.182.254
|
||||||
|
netmask: 24
|
||||||
|
|
||||||
|
|
||||||
|
- device: eno2:ns
|
||||||
|
headline: eno2:ns - Alias on eno2 (Nameserver)
|
||||||
|
auto: true
|
||||||
|
family: inet
|
||||||
|
method: static
|
||||||
|
address: 192.168.182.1
|
||||||
|
netmask: 32
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
# vars used by roles/ansible_dependencies
|
# vars used by roles/ansible_dependencies
|
||||||
# ---
|
# ---
|
||||||
@ -129,9 +182,9 @@ bind9_gateway_acl:
|
|||||||
- internaldns:
|
- internaldns:
|
||||||
name: internaldns
|
name: internaldns
|
||||||
entries:
|
entries:
|
||||||
- '# Nameserver Kanzlei Kiel'
|
- '// Nameserver Kanzlei Kiel'
|
||||||
- 192.168.100.1
|
- 192.168.100.1
|
||||||
- '# Nameserver Kanzlei Elster'
|
- '// Nameserver Kanzlei Elster'
|
||||||
- 192.168.202.1
|
- 192.168.202.1
|
||||||
|
|
||||||
bind9_gateway_listen_on_v6:
|
bind9_gateway_listen_on_v6:
|
||||||
|
|||||||
@ -1,4 +1,5 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
# vars used by roles/network_interfaces
|
# vars used by roles/network_interfaces
|
||||||
# ---
|
# ---
|
||||||
@ -32,7 +33,7 @@ network_interfaces:
|
|||||||
nameservers:
|
nameservers:
|
||||||
- 127.0.0.1
|
- 127.0.0.1
|
||||||
- 192.168.202.1
|
- 192.168.202.1
|
||||||
search: elster.netz
|
search: elster.netz ebs.netz
|
||||||
|
|
||||||
|
|
||||||
- device: eno2
|
- device: eno2
|
||||||
@ -234,7 +235,7 @@ bind9_gateway_acl:
|
|||||||
- internaldns:
|
- internaldns:
|
||||||
name: internaldns
|
name: internaldns
|
||||||
entries:
|
entries:
|
||||||
- '# Nameserver Kanzlei EBS'
|
- '// Nameserver Kanzlei EBS'
|
||||||
- 192.168.182.1
|
- 192.168.182.1
|
||||||
|
|
||||||
bind9_gateway_listen_on_v6:
|
bind9_gateway_listen_on_v6:
|
||||||
|
|||||||
@ -1,123 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# vars used by roles/network_interfaces
|
|
||||||
# ---
|
|
||||||
|
|
||||||
|
|
||||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
|
||||||
network_manage_devices: True
|
|
||||||
|
|
||||||
# Should the interfaces be reloaded after config change?
|
|
||||||
network_interface_reload: False
|
|
||||||
|
|
||||||
network_interface_path: /etc/network/interfaces.d
|
|
||||||
network_interface_required_packages:
|
|
||||||
- vlan
|
|
||||||
- bridge-utils
|
|
||||||
- ifmetric
|
|
||||||
- ifupdown
|
|
||||||
- resolvconf
|
|
||||||
|
|
||||||
|
|
||||||
network_interfaces:
|
|
||||||
|
|
||||||
- device: br0
|
|
||||||
# use only once per device (for the first device entry)
|
|
||||||
headline: br0 - bridge over device enp8s0
|
|
||||||
|
|
||||||
# auto & allow are only used for the first device entry
|
|
||||||
allow: [] # array of allow-[stanzas] eg. allow-hotplug
|
|
||||||
auto: true
|
|
||||||
|
|
||||||
family: inet
|
|
||||||
method: static
|
|
||||||
hwaddress: 00:d8:61:0e:b9:1c
|
|
||||||
description:
|
|
||||||
address: 144.76.24.11
|
|
||||||
netmask: 27
|
|
||||||
gateway: 144.76.24.1
|
|
||||||
metric:
|
|
||||||
pointopoint:
|
|
||||||
mtu:
|
|
||||||
scope:
|
|
||||||
|
|
||||||
# additional user by dhcp method
|
|
||||||
#
|
|
||||||
hostname:
|
|
||||||
leasehours:
|
|
||||||
leasetime:
|
|
||||||
vendor:
|
|
||||||
client:
|
|
||||||
|
|
||||||
# additional used by bootp method
|
|
||||||
#
|
|
||||||
bootfile:
|
|
||||||
server:
|
|
||||||
hwaddr:
|
|
||||||
|
|
||||||
# optional dns settings nameservers: []
|
|
||||||
#
|
|
||||||
# nameservers:
|
|
||||||
# - 194.150.168.168 # dns.as250.net
|
|
||||||
# - 91.239.100.100 # anycast.censurfridns.dk
|
|
||||||
# search: warenform.de
|
|
||||||
#
|
|
||||||
nameservers:
|
|
||||||
- 195.201.179.131
|
|
||||||
- 95.217.204.204
|
|
||||||
search:
|
|
||||||
|
|
||||||
# optional additional subnets/ips subnets: []
|
|
||||||
# subnets:
|
|
||||||
# - '192.168.123.0/24'
|
|
||||||
# - '192.168.124.11/32'
|
|
||||||
|
|
||||||
# optional bridge parameters bridge: {}
|
|
||||||
# bridge:
|
|
||||||
# ports:
|
|
||||||
# stp:
|
|
||||||
# fd:
|
|
||||||
# maxwait:
|
|
||||||
# waitport:
|
|
||||||
bridge:
|
|
||||||
ports: enp8s0 # for mor devices support a blank separated list
|
|
||||||
stp: !!str off
|
|
||||||
fd: 5
|
|
||||||
hello: 2
|
|
||||||
maxage: 12
|
|
||||||
|
|
||||||
# optional bonding parameters bond: {}
|
|
||||||
# bond:
|
|
||||||
# master
|
|
||||||
# primary
|
|
||||||
# slave
|
|
||||||
# method:
|
|
||||||
# miimon:
|
|
||||||
# lacp-rate:
|
|
||||||
# ad-select-rate:
|
|
||||||
# master:
|
|
||||||
# slaves:
|
|
||||||
bond: {}
|
|
||||||
|
|
||||||
# optional vlan settings | vlan: {}
|
|
||||||
# vlan: {}
|
|
||||||
# raw-device: 'eth0'
|
|
||||||
vlan: {}
|
|
||||||
|
|
||||||
# inline hook scripts
|
|
||||||
pre-up: [] # pre-up script lines
|
|
||||||
up: [] # up script lines
|
|
||||||
post-up: [] # post-up script lines (alias for up)
|
|
||||||
pre-down: [] # pre-down script lines (alias for down)
|
|
||||||
down: [] # down script lines
|
|
||||||
post-down: [] # post-down script lines
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- device: br0
|
|
||||||
family: inet6
|
|
||||||
method: static
|
|
||||||
address: 2a01:4f8:191:b::2
|
|
||||||
netmask: 64
|
|
||||||
gateway: fe80::1
|
|
||||||
101
hosts
101
hosts
@ -19,9 +19,6 @@ dns1.warenform.de
|
|||||||
[extra_hosts]
|
[extra_hosts]
|
||||||
backup.oopen.de
|
backup.oopen.de
|
||||||
|
|
||||||
gitea.so36.net
|
|
||||||
backup.so36.net
|
|
||||||
|
|
||||||
devel-root.wf.netz
|
devel-root.wf.netz
|
||||||
|
|
||||||
gw-123.oopen.de
|
gw-123.oopen.de
|
||||||
@ -69,11 +66,8 @@ ga-st-kvm5.ga.netz
|
|||||||
ga-al-kvm2.ga.netz
|
ga-al-kvm2.ga.netz
|
||||||
ga-al-kvm3.ga.netz
|
ga-al-kvm3.ga.netz
|
||||||
|
|
||||||
server16.warenform.de
|
|
||||||
helden.warenform.de
|
|
||||||
server18.warenform.de
|
server18.warenform.de
|
||||||
piwik.warenform.de
|
piwik.warenform.de
|
||||||
server20.warenform.de
|
|
||||||
server22.warenform.de
|
server22.warenform.de
|
||||||
server23.warenform.de
|
server23.warenform.de
|
||||||
server24.warenform.de
|
server24.warenform.de
|
||||||
@ -81,9 +75,6 @@ server25.warenform.de
|
|||||||
server26.warenform.de
|
server26.warenform.de
|
||||||
server27.warenform.de
|
server27.warenform.de
|
||||||
|
|
||||||
# server20.warenform.de
|
|
||||||
cloud-giz.warenform.de
|
|
||||||
|
|
||||||
#server22.warenform.de
|
#server22.warenform.de
|
||||||
nd.warenform.de
|
nd.warenform.de
|
||||||
nd-archiv.warenform.de
|
nd-archiv.warenform.de
|
||||||
@ -161,7 +152,6 @@ o25.oopen.de
|
|||||||
# - o27.oopen.de
|
# - o27.oopen.de
|
||||||
o27.oopen.de
|
o27.oopen.de
|
||||||
cl-fm.oopen.de
|
cl-fm.oopen.de
|
||||||
cl-fm-neu.oopen.de
|
|
||||||
mail.faire-mobilitaet.de
|
mail.faire-mobilitaet.de
|
||||||
|
|
||||||
# Hetzner Cloud CX31 - AK
|
# Hetzner Cloud CX31 - AK
|
||||||
@ -184,9 +174,6 @@ o32.oopen.de
|
|||||||
# BigBlueButton - O.OPEN
|
# BigBlueButton - O.OPEN
|
||||||
o33.oopen.de
|
o33.oopen.de
|
||||||
|
|
||||||
# Jitsi Meet - AG Beratung
|
|
||||||
o34.oopen.de
|
|
||||||
|
|
||||||
o35.oopen.de
|
o35.oopen.de
|
||||||
b.ns.oopen.de
|
b.ns.oopen.de
|
||||||
cl-02.oopen.de
|
cl-02.oopen.de
|
||||||
@ -214,18 +201,10 @@ lxc-host-kb.anw-kb.netz
|
|||||||
# - Warenform Server
|
# - Warenform Server
|
||||||
# ---
|
# ---
|
||||||
|
|
||||||
# server16
|
|
||||||
server16.warenform.de
|
|
||||||
helden.warenform.de
|
|
||||||
|
|
||||||
# server18
|
# server18
|
||||||
server18.warenform.de
|
server18.warenform.de
|
||||||
piwik.warenform.de
|
piwik.warenform.de
|
||||||
|
|
||||||
# server20
|
|
||||||
server20.warenform.de
|
|
||||||
cloud-giz.warenform.de
|
|
||||||
|
|
||||||
# server22
|
# server22
|
||||||
server22.warenform.de
|
server22.warenform.de
|
||||||
nd.warenform.de
|
nd.warenform.de
|
||||||
@ -325,7 +304,6 @@ o25.oopen.de
|
|||||||
# - o27.oopen.de
|
# - o27.oopen.de
|
||||||
o27.oopen.de
|
o27.oopen.de
|
||||||
cl-fm.oopen.de
|
cl-fm.oopen.de
|
||||||
cl-fm-neu.oopen.de
|
|
||||||
mail.faire-mobilitaet.de
|
mail.faire-mobilitaet.de
|
||||||
|
|
||||||
# Hetzner Cloud CX31 - AK
|
# Hetzner Cloud CX31 - AK
|
||||||
@ -352,9 +330,6 @@ o32.oopen.de
|
|||||||
# BigBlueButton - O.OPEN
|
# BigBlueButton - O.OPEN
|
||||||
o33.oopen.de
|
o33.oopen.de
|
||||||
|
|
||||||
# Jitsi Meet - AG Beratung
|
|
||||||
o34.oopen.de
|
|
||||||
|
|
||||||
# - o35.oopen.de
|
# - o35.oopen.de
|
||||||
o35.oopen.de
|
o35.oopen.de
|
||||||
b.ns.oopen.de
|
b.ns.oopen.de
|
||||||
@ -477,14 +452,6 @@ devel-todo.wf.netz
|
|||||||
devel-wiki.wf.netz
|
devel-wiki.wf.netz
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# so36.NET
|
|
||||||
# ---
|
|
||||||
|
|
||||||
gitea.so36.net
|
|
||||||
backup.so36.net
|
|
||||||
|
|
||||||
|
|
||||||
[apache2_webserver]
|
[apache2_webserver]
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
@ -528,7 +495,6 @@ cl-irights.oopen.de
|
|||||||
|
|
||||||
# o27.oopen.de
|
# o27.oopen.de
|
||||||
cl-fm.oopen.de
|
cl-fm.oopen.de
|
||||||
cl-fm-neu.oopen.de
|
|
||||||
mail.faire-mobilitaet.de
|
mail.faire-mobilitaet.de
|
||||||
|
|
||||||
# Backup Faire Mobilitaet
|
# Backup Faire Mobilitaet
|
||||||
@ -567,15 +533,9 @@ ga-al-ws1.ga.netz
|
|||||||
# Warenform server
|
# Warenform server
|
||||||
# ---
|
# ---
|
||||||
|
|
||||||
# server16
|
|
||||||
helden.warenform.de
|
|
||||||
|
|
||||||
# server18
|
# server18
|
||||||
piwik.warenform.de
|
piwik.warenform.de
|
||||||
|
|
||||||
# server20
|
|
||||||
cloud-giz.warenform.de
|
|
||||||
|
|
||||||
# server22
|
# server22
|
||||||
nd.warenform.de
|
nd.warenform.de
|
||||||
nd-archiv.warenform.de
|
nd-archiv.warenform.de
|
||||||
@ -683,9 +643,6 @@ o32.oopen.de
|
|||||||
# BigBlueButton - O.OPEN
|
# BigBlueButton - O.OPEN
|
||||||
o33.oopen.de
|
o33.oopen.de
|
||||||
|
|
||||||
# Jitsi Meet - AG Beratung
|
|
||||||
o34.oopen.de
|
|
||||||
|
|
||||||
# o35.oopen.de
|
# o35.oopen.de
|
||||||
cl-02.oopen.de
|
cl-02.oopen.de
|
||||||
|
|
||||||
@ -888,7 +845,6 @@ o26.oopen.de
|
|||||||
|
|
||||||
# o27.oopen.de
|
# o27.oopen.de
|
||||||
cl-fm.oopen.de
|
cl-fm.oopen.de
|
||||||
cl-fm-neu.oopen.de
|
|
||||||
|
|
||||||
# Backup Faire Mobilitaet
|
# Backup Faire Mobilitaet
|
||||||
o28.oopen.de
|
o28.oopen.de
|
||||||
@ -920,15 +876,9 @@ cl-test.oopen.de
|
|||||||
# Warenform
|
# Warenform
|
||||||
# ---
|
# ---
|
||||||
|
|
||||||
# server16.warenform.de
|
|
||||||
helden.warenform.de
|
|
||||||
|
|
||||||
# server18.warenform.de
|
# server18.warenform.de
|
||||||
piwik.warenform.de
|
piwik.warenform.de
|
||||||
|
|
||||||
# server20.warenform.de
|
|
||||||
cloud-giz.warenform.de
|
|
||||||
|
|
||||||
# server22.warenform.de
|
# server22.warenform.de
|
||||||
nd.warenform.de
|
nd.warenform.de
|
||||||
nd-archiv.warenform.de
|
nd-archiv.warenform.de
|
||||||
@ -996,10 +946,6 @@ cl-test.oopen.de
|
|||||||
# Warenform
|
# Warenform
|
||||||
# ---
|
# ---
|
||||||
|
|
||||||
# server20.warenform.de
|
|
||||||
cloud-giz.warenform.de
|
|
||||||
|
|
||||||
|
|
||||||
[dns_server]
|
[dns_server]
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
@ -1061,15 +1007,9 @@ ga-st-mail.ga.netz
|
|||||||
# Warenform
|
# Warenform
|
||||||
# ---
|
# ---
|
||||||
|
|
||||||
server16.warenform.de
|
|
||||||
helden.warenform.de
|
|
||||||
|
|
||||||
server18.warenform.de
|
server18.warenform.de
|
||||||
piwik.warenform.de
|
piwik.warenform.de
|
||||||
|
|
||||||
# server20.warenform.de
|
|
||||||
cloud-giz.warenform.de
|
|
||||||
|
|
||||||
server22.warenform.de
|
server22.warenform.de
|
||||||
nd-live.warenform.de
|
nd-live.warenform.de
|
||||||
nd-epaper.warenform.de
|
nd-epaper.warenform.de
|
||||||
@ -1171,9 +1111,6 @@ server28.warenform.de
|
|||||||
# o30.oopen.de - AK Server Nextcloud/Jitsi Meet
|
# o30.oopen.de - AK Server Nextcloud/Jitsi Meet
|
||||||
meet.akweb.de
|
meet.akweb.de
|
||||||
|
|
||||||
# Jitsi Meet - AG Beratung
|
|
||||||
o34.oopen.de
|
|
||||||
|
|
||||||
|
|
||||||
[kvm_host]
|
[kvm_host]
|
||||||
|
|
||||||
@ -1225,9 +1162,7 @@ ga-st-lxc1.ga.netz
|
|||||||
# Warenform
|
# Warenform
|
||||||
# ---
|
# ---
|
||||||
|
|
||||||
server16.warenform.de
|
|
||||||
server18.warenform.de
|
server18.warenform.de
|
||||||
server20.warenform.de
|
|
||||||
server22.warenform.de
|
server22.warenform.de
|
||||||
server23.warenform.de
|
server23.warenform.de
|
||||||
server24.warenform.de
|
server24.warenform.de
|
||||||
@ -1293,7 +1228,6 @@ mm-irights.oopen.de
|
|||||||
|
|
||||||
# - o27.oopen.de
|
# - o27.oopen.de
|
||||||
cl-fm.oopen.de
|
cl-fm.oopen.de
|
||||||
cl-fm-neu.oopen.de
|
|
||||||
mail.faire-mobilitaet.de
|
mail.faire-mobilitaet.de
|
||||||
|
|
||||||
# Hetzner Cloud CX31 - AK
|
# Hetzner Cloud CX31 - AK
|
||||||
@ -1315,9 +1249,6 @@ o32.oopen.de
|
|||||||
# BigBlueButton - O.OPEN
|
# BigBlueButton - O.OPEN
|
||||||
o33.oopen.de
|
o33.oopen.de
|
||||||
|
|
||||||
# Jitsi Meet - AG Beratung
|
|
||||||
o34.oopen.de
|
|
||||||
|
|
||||||
# o35.oopen.de
|
# o35.oopen.de
|
||||||
cl-02.oopen.de
|
cl-02.oopen.de
|
||||||
e.mx.oopen.de
|
e.mx.oopen.de
|
||||||
@ -1354,15 +1285,9 @@ ga-st-mail.ga.netz
|
|||||||
# Warenform Server
|
# Warenform Server
|
||||||
# ---
|
# ---
|
||||||
|
|
||||||
# server16
|
|
||||||
helden.warenform.de
|
|
||||||
|
|
||||||
# server18
|
# server18
|
||||||
piwik.warenform.de
|
piwik.warenform.de
|
||||||
|
|
||||||
# server20
|
|
||||||
cloud-giz.warenform.de
|
|
||||||
|
|
||||||
# server22
|
# server22
|
||||||
nd.warenform.de
|
nd.warenform.de
|
||||||
nd-archiv.warenform.de
|
nd-archiv.warenform.de
|
||||||
@ -1413,13 +1338,6 @@ devel-todo.wf.netz
|
|||||||
devel-wiki.wf.netz
|
devel-wiki.wf.netz
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# so36.NET
|
|
||||||
# ---
|
|
||||||
|
|
||||||
gitea.so36.net
|
|
||||||
|
|
||||||
|
|
||||||
# All oopen server (except office networks)
|
# All oopen server (except office networks)
|
||||||
[oopen_server]
|
[oopen_server]
|
||||||
|
|
||||||
@ -1480,7 +1398,6 @@ o25.oopen.de
|
|||||||
# - o27.oopen.de
|
# - o27.oopen.de
|
||||||
o27.oopen.de
|
o27.oopen.de
|
||||||
cl-fm.oopen.de
|
cl-fm.oopen.de
|
||||||
cl-fm-neu.oopen.de
|
|
||||||
mail.faire-mobilitaet.de
|
mail.faire-mobilitaet.de
|
||||||
|
|
||||||
# Hetzner Cloud CX31 - AK
|
# Hetzner Cloud CX31 - AK
|
||||||
@ -1507,9 +1424,6 @@ o32.oopen.de
|
|||||||
# BigBlueButton - O.OPEN
|
# BigBlueButton - O.OPEN
|
||||||
o33.oopen.de
|
o33.oopen.de
|
||||||
|
|
||||||
# Jitsi Meet - AG Beratung
|
|
||||||
o34.oopen.de
|
|
||||||
|
|
||||||
# - o35.oopen.de
|
# - o35.oopen.de
|
||||||
o35.oopen.de
|
o35.oopen.de
|
||||||
cl-02.oopen.de
|
cl-02.oopen.de
|
||||||
@ -1531,13 +1445,6 @@ cl-test.oopen.de
|
|||||||
lxc-host-kb.anw-kb.netz
|
lxc-host-kb.anw-kb.netz
|
||||||
|
|
||||||
|
|
||||||
# ---
|
|
||||||
# so36.NET
|
|
||||||
# ---
|
|
||||||
|
|
||||||
gitea.so36.net
|
|
||||||
|
|
||||||
|
|
||||||
[oopen_office]
|
[oopen_office]
|
||||||
|
|
||||||
bbb.b3-bornim.netz
|
bbb.b3-bornim.netz
|
||||||
@ -1596,18 +1503,10 @@ gateway_server_rw
|
|||||||
|
|
||||||
[warenform_server]
|
[warenform_server]
|
||||||
|
|
||||||
# server16
|
|
||||||
server16.warenform.de
|
|
||||||
helden.warenform.de
|
|
||||||
|
|
||||||
# server18
|
# server18
|
||||||
server18.warenform.de
|
server18.warenform.de
|
||||||
piwik.warenform.de
|
piwik.warenform.de
|
||||||
|
|
||||||
# server20
|
|
||||||
server20.warenform.de
|
|
||||||
cloud-giz.warenform.de
|
|
||||||
|
|
||||||
# server22
|
# server22
|
||||||
server22.warenform.de
|
server22.warenform.de
|
||||||
nd.warenform.de
|
nd.warenform.de
|
||||||
|
|||||||
@ -274,6 +274,185 @@
|
|||||||
- Restart IPv6 Firewall
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# Mattermost (MM) Service
|
||||||
|
# ---
|
||||||
|
|
||||||
|
- name: Check if String 'mm_server_ips=..' is present
|
||||||
|
shell: grep -q -E "^mm_server_ips=" /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
register: mattermost_service_ipv4_present
|
||||||
|
when: main_ipv4_exists.stat.exists
|
||||||
|
failed_when: "mattermost_service_ipv4_present.rc > 1"
|
||||||
|
changed_when: "mattermost_service_ipv4_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mattermost_service)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
insertafter: '^#?\s*http_ports'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# - Mattermost (MM) Service
|
||||||
|
# -
|
||||||
|
mm_server_ips=""
|
||||||
|
forward_mm_server_ips=""
|
||||||
|
|
||||||
|
# - UDP Ports IN and OUT used by MM Servive
|
||||||
|
# -
|
||||||
|
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
|
||||||
|
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (mattermost_service)"
|
||||||
|
when:
|
||||||
|
- main_ipv4_exists.stat.exists
|
||||||
|
- mattermost_service_ipv4_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
- name: Check if String 'mm_server_ips=..' is present
|
||||||
|
shell: grep -q -E "^mm_server_ips=" /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
register: mattermost_service_ipv6_present
|
||||||
|
when: main_ipv6_exists.stat.exists
|
||||||
|
failed_when: "mattermost_service_ipv6_present.rc > 1"
|
||||||
|
changed_when: "mattermost_service_ipv6_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mattermost_service)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
insertafter: '^#?\s*http_ports'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# - Mattermost (MM) Service
|
||||||
|
# -
|
||||||
|
mm_server_ips=""
|
||||||
|
forward_mm_server_ips=""
|
||||||
|
|
||||||
|
# - UDP Ports IN and OUT used by MM Servive
|
||||||
|
# -
|
||||||
|
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
|
||||||
|
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (mattermost_service)"
|
||||||
|
when:
|
||||||
|
- main_ipv6_exists.stat.exists
|
||||||
|
- mattermost_service_ipv6_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# Protection against and Limit Connections settings
|
||||||
|
# ---
|
||||||
|
|
||||||
|
- name: Check if String 'protection_against_syn_flooding=..' is present
|
||||||
|
shell: grep -q -E "^protection_against_syn_flooding=" /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
register: protect_settings_ipv4_present
|
||||||
|
when: main_ipv4_exists.stat.exists
|
||||||
|
failed_when: "protect_settings_ipv4_present.rc > 1"
|
||||||
|
changed_when: "protect_settings_ipv4_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (protect_settings)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv4.conf
|
||||||
|
insertafter: '^#?\s*create_iperf_rules'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# - Protection against ...
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# - Protection against syn-flooding
|
||||||
|
# -
|
||||||
|
protection_against_syn_flooding=true
|
||||||
|
|
||||||
|
# - Protection against port scanning
|
||||||
|
# -
|
||||||
|
protection_against_port_scanning=true
|
||||||
|
|
||||||
|
# - Protection against SSH brute-force attacks
|
||||||
|
# -
|
||||||
|
protection_against_ssh_brute_force_attacks=true
|
||||||
|
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# - Limit Connections
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# - Limit connections per source IP
|
||||||
|
# -
|
||||||
|
limit_connections_per_source_IP=true
|
||||||
|
|
||||||
|
# - Limit RST packets
|
||||||
|
# -
|
||||||
|
limit_rst_packets=true
|
||||||
|
|
||||||
|
# - Limit new TCP connections per second per source IP
|
||||||
|
# -
|
||||||
|
limit_new_tcp_connections_per_seconds_per_source_IP=true
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (protect_settings)"
|
||||||
|
when:
|
||||||
|
- main_ipv4_exists.stat.exists
|
||||||
|
- protect_settings_ipv4_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv4 Firewall
|
||||||
|
|
||||||
|
|
||||||
|
- name: Check if String 'protection_against_syn_flooding=..' is present
|
||||||
|
shell: grep -q -E "^protection_against_syn_flooding=" /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
register: protect_settings_ipv6_present
|
||||||
|
when: main_ipv6_exists.stat.exists
|
||||||
|
failed_when: "protect_settings_ipv6_present.rc > 1"
|
||||||
|
changed_when: "protect_settings_ipv6_present.rc > 0"
|
||||||
|
|
||||||
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (protect_settings)
|
||||||
|
blockinfile:
|
||||||
|
path: /etc/ipt-firewall/main_ipv6.conf
|
||||||
|
insertafter: '^#?\s*create_iperf_rules'
|
||||||
|
block: |
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# - Protection against ...
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# - Protection against syn-flooding
|
||||||
|
# -
|
||||||
|
protection_against_syn_flooding=true
|
||||||
|
|
||||||
|
# - Protection against port scanning
|
||||||
|
# -
|
||||||
|
protection_against_port_scanning=true
|
||||||
|
|
||||||
|
# - Protection against SSH brute-force attacks
|
||||||
|
# -
|
||||||
|
protection_against_ssh_brute_force_attacks=true
|
||||||
|
|
||||||
|
|
||||||
|
# -------------
|
||||||
|
# - Limit Connections
|
||||||
|
# -------------
|
||||||
|
|
||||||
|
# - Limit connections per source IP
|
||||||
|
# -
|
||||||
|
limit_connections_per_source_IP=true
|
||||||
|
|
||||||
|
# - Limit RST packets
|
||||||
|
# -
|
||||||
|
limit_rst_packets=true
|
||||||
|
|
||||||
|
# - Limit new TCP connections per second per source IP
|
||||||
|
# -
|
||||||
|
limit_new_tcp_connections_per_seconds_per_source_IP=true
|
||||||
|
|
||||||
|
marker: "# Marker set by modify-ipt-server.yml (protect_settings)"
|
||||||
|
when:
|
||||||
|
- main_ipv6_exists.stat.exists
|
||||||
|
- protect_settings_ipv6_present is changed
|
||||||
|
notify:
|
||||||
|
- Restart IPv6 Firewall
|
||||||
|
|
||||||
|
|
||||||
# ===
|
# ===
|
||||||
# Remove Marker set by blockinfile
|
# Remove Marker set by blockinfile
|
||||||
# ===
|
# ===
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user