From d94d28ca678cca21fdf2998020270d778df16297 Mon Sep 17 00:00:00 2001 From: Christoph Date: Sun, 9 Aug 2026 00:35:57 +0200 Subject: [PATCH] feat(mm-nd): update DNS settings and add cron jobs for service monitoring --- group_vars/all/main.yml | 2 +- host_vars/backup.oopen.de/backup-common.yml | 2 + host_vars/mm-nd.oopen.de/mm-nd-common.yml | 205 ++++++++++++++++++++ hosts | 24 +++ 4 files changed, 232 insertions(+), 1 deletion(-) create mode 100644 host_vars/mm-nd.oopen.de/mm-nd-common.yml diff --git a/group_vars/all/main.yml b/group_vars/all/main.yml index df45a4d..7ddb250 100644 --- a/group_vars/all/main.yml +++ b/group_vars/all/main.yml @@ -158,7 +158,7 @@ apt_manage_sources_list: true apt_src_enable: true apt_backports_enable: true -apt_debian_mirror: http://ftp2.de.debian.org/debian/ +apt_debian_mirror: http://ftp.de.debian.org/debian/ apt_debian_contrib_nonfree_enable: true # Ubuntu mirror diff --git a/host_vars/backup.oopen.de/backup-common.yml b/host_vars/backup.oopen.de/backup-common.yml index 1df8884..5db37ae 100644 --- a/host_vars/backup.oopen.de/backup-common.yml +++ b/host_vars/backup.oopen.de/backup-common.yml @@ -299,6 +299,7 @@ default_user: - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDNIGI5HpfYnZCvDM3bf3UQti8SRhgL7wLu8LfxZLqwB root@meet.akweb.de' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoLG5tE0tHh+iFRzellU80eJTxZfqDB3e6Dg4XRKBrA root@meet.oopen.de' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF2bxZZNXrlsvERYo0VyXzdW1AZuGmsTNjgF4oQJNfnn root@mm-irights' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINy+3uf7VKQBQuXPeFSlSG4lcNbkCTysMhIideNTyMKr root@mm-nd' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILpKuS8DFuHHvfQZCHOGiurOvzlFkx1unnMfZWEM3wUY root@mm-rav' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMnwSzzSrAQJN3I0Y3xRU0rjlrO2KlHD3tFMgCqEyk0i root@mm' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILXSGiRst5AQ396FQY6jrr1jTCpwGDLWv5akw6SiMUGq root@nd-gate' @@ -337,6 +338,7 @@ default_user: - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDW54VI+M5SjV6dQLew/IA31RI1GOneIqg5dI1/VZQgJ root@o42' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII2b60T/OXKCoze083GsHXuMFtm8Zo3WnCFb9Q9ofGie root@o43' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPytU2q7RmehrJyRnXRIZp7qcoswSANsClJP8v3zv6D7 root@o44' + - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFS0XtUKLgDqciQLr64VbtQSTlz7eHuvA8x9QZiAg9RA root@o45' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMUnxlKIffm8a5BmoQE40h8ut0R6eCxcm+Iewv3evmE9 root@oolm-shop' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF4ylglAkPst7G6kES2lE96ECp0AGXGjzCVkZSqGVru6 root@oolm-shop-dev' - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUZ0WNd3rTqHH1tiXAELwssGw6xUP1ROdhgxKbMinYY root@oolm-web' diff --git a/host_vars/mm-nd.oopen.de/mm-nd-common.yml b/host_vars/mm-nd.oopen.de/mm-nd-common.yml new file mode 100644 index 0000000..d783678 --- /dev/null +++ b/host_vars/mm-nd.oopen.de/mm-nd-common.yml @@ -0,0 +1,205 @@ +--- + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + + +# --- +# vars used by roles/common/tasks/apt.yml +# --- + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 185.12.64.2 + - 2a01:4ff:ff00::add:1 + - 185.12.64.1 + - 2a01:4ff:ff00::add:2 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +# resolved_domains: [] +resolved_domains: + - ~. + - oopen.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 194.150.168.168 + + +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + - name: "Check if postfix mailservice is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1" + insertafter: PATH + + - name: "Check if mattermost service is running. Restart service if needed." + special_time: reboot + job: "sleep 10 ; /root/bin/monitoring/check_local_mattermost_service.sh > /dev/null 2>&1" + insertafter: PATH + + +cron_user_entries: + + - name: "Check if mattermost service ist running - Restart Service if needed." + minute: '*/16' + hour: '*' + job: /root/bin/monitoring/check_local_mattermost_service.sh + + - name: "Check if SSH service is running. Restart service if needed." + minute: '*/5' + hour: '*' + job: /root/bin/monitoring/check_ssh.sh + + - name: "Check if Postfix Mailservice is up and running?" + minute: '*/15' + hour: '*' + job: /root/bin/monitoring/check_postfix.sh + + - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)" + minute: '01' + hour: '05' + job: /var/lib/dehydrated/cron/dehydrated_cron.sh + + - name: "Check whether all certificates are included in the VHOST configurations" + minute: '33' + hour: '05' + job: /var/lib/dehydrated/tools/update_ssl_directives.sh + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- + +git_firewall_repository: + name: ipt-server + repo: https://git.oopen.de/firewall/ipt-server + dest: /usr/local/src/ipt-server + +# ============================== + + +# --- +# vars used by scripts/reset_root_passwd.yml +# --- + +root_user: + name: root + password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq. diff --git a/hosts b/hosts index 73ccf77..569b6f8 100644 --- a/hosts +++ b/hosts @@ -303,6 +303,10 @@ test-nd.oopen.de o44.oopen.de cl-nd.oopen.de +# o45 - mm matomom h.mc +o45.oopen.de +mm-nd.oopen.de + # Hetzner Cloud cl-nd-test.oopen.de @@ -532,6 +536,10 @@ test-nd.oopen.de o44.oopen.de cl-nd.oopen.de +# o45 - mm matomom h.mc +o45.oopen.de +mm-nd.oopen.de + # Hetzner Cloud cl-nd-test.oopen.de @@ -984,6 +992,9 @@ iam-nd.oopen.de prometheus-nd.oopen.de web-nd.oopen.de +# o45 - ND +mm-nd.oopen.de + # GA - Gemeinschaft Altensclirf ga-st-services.ga.netz @@ -1129,6 +1140,9 @@ keycloak-nd.oopen.de iam-nd.oopen.de prometheus-nd.oopen.de +# o45 - ND +mm-nd.oopen.de + [mysql_server] @@ -1606,6 +1620,9 @@ o43.oopen.de # ND - cloud o44.oopen.de +# o45 - mm matomom h.mc +o45.oopen.de + lxc-host-kb.anw-kb.netz @@ -1781,6 +1798,9 @@ test-nd.oopen.de # o44 - ND cloud cl-nd.oopen.de +# o45 - ND +mm-nd.oopen.de + # Hetzner Cloud cl-nd-test.oopen.de @@ -2036,6 +2056,10 @@ test-nd.oopen.de o44.oopen.de cl-nd.oopen.de +# o45 - mm matomom h.mc +o45.oopen.de +mm-nd.oopen.de + # Hetzner Cloud cl-nd-test.oopen.de