Inventory/host_vars cleanup.
- hosts: remove gw-replacement2/3.local.netz and k1371.dyndns.org (duplicate of gw-ak.oopen.de). - host_vars: move obsolete host directories to host_vars/DELETED/ (devel-cloud, file-blkr-alt, file-ipa, ga-campus-gw-temp, ga-st-mm, gitea.so36.net, nc-gw, moodle, nscache, server16, server20, web-test, gw-replacement2/3/4). - host_vars: fix file names (ga-al-gw-common.yml, gw-replacement.local.netz/gw-replacement-common.yml) and the header of mm-nd-test-ipt-server.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,153 @@
|
||||
---
|
||||
# yamllint disable rule:line-length
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
resolved_nameserver:
|
||||
- 192.168.52.1
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- wf.netz
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
extra_user:
|
||||
|
||||
- name: kaya
|
||||
password: $6$t9gheUvd$hFTJ5mp0bdu4Hc5zGmS6HuSAfFOc4QRROLX4wnCauLjwTxUtvhgeLDlL5YkjGfiWOCEe84krH4op0DdKjTJWG/
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNeWlp4fwExBSttvzD1LvSI49+b4YfIncB1lpFcCzLU4yJoAmPFCgoquhiL7TAjUnXa2/7BWLEJhsNQgdtOhCm431idLcJomwtK1FYpRkY/qfBYsYs8lLtpZwasHGrikEswDt5LiKutNnMnRlUBRNiJLRv90dR0hSNuGnIMaQUDfTkiq/RtkbOPJLNMcSsNr7MPN3GqzxhN2WBpcQ9dLUZKRJbHfrDt8g1aaLMrZVu/mO/kRplaShzmHtkJSQTXCsuA/hZy9mO38NNQdSl0+IY2OPDXxZtdHLbi+KKymIHHtKV7rxGmP3CF/stV1ux0H2ZLuv7c5dy75EZ386iT2c0OfUVXHX5+IBFrDP5RR9usyfyvTcqNhlGi39MiAaxlkn1GI1M/PXnrExEO4hqTQRbu4lnDbWxgeC7RIoUp62Y4UVjEOrTk57Reg5MeUx2Lp20Kd0OMYv4nJB2eEZ6uCfrh1s1QediVZ0SSE1Z1vJc2hoaGRUUX1q8bww2HzZaF+rBJo+euOZiSkYWgXNBnag74BBM9RPHOSRMdajNrgop2ceBkC/G3Z71Z39QIisF1y0KExmfsPMO4k126o55DnbfsAzCDNiBqv8unBZcFCq+4EP6SWXzWhtS3/71/W3XK9/JJ9n7JS1SCl5USyJMxAV7VUIjEkmU+8nkxQB1/tzKXw== xayax@xAyAx-imac.local'
|
||||
|
||||
sudo_users:
|
||||
- chris
|
||||
- axel
|
||||
- kaya
|
||||
- sysadm
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,340 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
- vlan
|
||||
- bridge-utils
|
||||
- ifmetric
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: eno1
|
||||
# use only once per device (for the first device entry)
|
||||
headline: eno1 - LAN
|
||||
|
||||
# auto & allow are only used for the first device entry
|
||||
allow: [] # array of allow-[stanzas] eg. allow-hotplug
|
||||
auto: true
|
||||
|
||||
family: inet
|
||||
method: static
|
||||
description:
|
||||
address: 192.168.162.10
|
||||
netmask: 24
|
||||
gateway: 192.168.162.254
|
||||
|
||||
# optional dns settings nameservers: []
|
||||
#
|
||||
# nameservers:
|
||||
# - 194.150.168.168 # dns.as250.net
|
||||
# - 91.239.100.100 # anycast.censurfridns.dk
|
||||
# search: warenform.de
|
||||
#
|
||||
# nameservers:
|
||||
# - 192.168.162.1
|
||||
# search: blkr.netz
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
sshd_macs:
|
||||
- hmac-sha1
|
||||
- hmac-sha2-256-etm@openssh.com
|
||||
- hmac-sha2-512-etm@openssh.com
|
||||
- umac-128-etm@openssh.com
|
||||
|
||||
sshd_hostkeyalgorithms:
|
||||
- ecdsa-sha2-nistp256-cert-v01@openssh.com
|
||||
- ecdsa-sha2-nistp384-cert-v01@openssh.com
|
||||
- ecdsa-sha2-nistp521-cert-v01@openssh.com
|
||||
- ssh-ed25519-cert-v01@openssh.com
|
||||
- rsa-sha2-512-cert-v01@openssh.com
|
||||
- rsa-sha2-256-cert-v01@openssh.com
|
||||
- ssh-rsa-cert-v01@openssh.com
|
||||
- ecdsa-sha2-nistp256
|
||||
- ecdsa-sha2-nistp384
|
||||
- ecdsa-sha2-nistp521
|
||||
- ssh-ed25519
|
||||
- rsa-sha2-512
|
||||
- rsa-sha2-256
|
||||
- ssh-rsa
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 192.168.162.1
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- blkr.netz
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
# ---
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/samba-config-server.yml
|
||||
# vars used by roles/common/tasks/samba-user.yml
|
||||
# ---
|
||||
|
||||
samba_server_ip: 192.168.162.10
|
||||
samba_server_cidr_prefix: 24
|
||||
|
||||
samba_workgroup: BLKR
|
||||
|
||||
samba_netbios_name: FILE-BLKR
|
||||
|
||||
samba_server_min_protocol: !!str NT1
|
||||
|
||||
samba_groups:
|
||||
- name: buero
|
||||
group_id: 1100
|
||||
- name: verwaltung
|
||||
group_id: 1110
|
||||
|
||||
samba_user:
|
||||
- name: anya
|
||||
groups:
|
||||
- buero
|
||||
- verwaltung
|
||||
password: 'Mq9R.WhKtP4v'
|
||||
- name: chris
|
||||
groups:
|
||||
- buero
|
||||
- verwaltung
|
||||
password: !vault |
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
63643330373231636537366333326630333265303265653933613835656262323863363038653234
|
||||
3462653135633266373439626263356636646637643035340a653466356235346663626163306363
|
||||
61313164643061306433643738643563303036646334376536626531383965303036386162393832
|
||||
6631333038306462610a356535633265633563633962333137326533633834636331343562633765
|
||||
3631
|
||||
- name: josephine
|
||||
groups:
|
||||
- buero
|
||||
- verwaltung
|
||||
password: 'H7jnJ/m9W-bf'
|
||||
- name: julius
|
||||
groups:
|
||||
- buero
|
||||
- verwaltung
|
||||
password: 'fx9j/3X-thPr'
|
||||
- name: julius-e
|
||||
groups:
|
||||
- buero
|
||||
password: '2/kcx3jju-tr'
|
||||
- name: leonie
|
||||
groups:
|
||||
- buero
|
||||
password: '6.4aVX7rQ-9H'
|
||||
- name: philip
|
||||
groups:
|
||||
- buero
|
||||
- verwaltung
|
||||
password: 'fN%749Psv_NR'
|
||||
- name: buero1
|
||||
groups:
|
||||
- buero
|
||||
password: 'Mfr!7tK+d49C'
|
||||
- name: buero2
|
||||
groups:
|
||||
- buero
|
||||
password: 'gW-wg3Pttf4/'
|
||||
- name: buero3
|
||||
groups:
|
||||
- buero
|
||||
password: 'Qc-WyMhJ/3-2'
|
||||
- name: referendariat
|
||||
groups:
|
||||
- buero
|
||||
password: '4/zCNXnVF7+i'
|
||||
- name: ref1
|
||||
groups:
|
||||
- buero
|
||||
password: '???'
|
||||
- name: sebastian
|
||||
groups:
|
||||
- buero
|
||||
password: 'bhNC.P5eTy-2'
|
||||
|
||||
base_home: /home
|
||||
|
||||
samba_homes_virusfilter: true
|
||||
|
||||
# remove_samba_users:
|
||||
# - name: name1
|
||||
# - name: name2
|
||||
#
|
||||
remove_samba_users: []
|
||||
|
||||
samba_shares:
|
||||
|
||||
- name: buero
|
||||
comment: Buero auf Fileserver
|
||||
path: /data/samba/shares/buero
|
||||
group_valid_users: buero
|
||||
group_write_list: buero
|
||||
file_create_mask: !!str 664
|
||||
dir_create_mask: !!str 2775
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle'
|
||||
|
||||
- name: Verwaltung
|
||||
comment: verwaltung auf Fileserver
|
||||
path: /data/samba/shares/verwaltung
|
||||
group_valid_users: verwaltung
|
||||
group_write_list: verwaltung
|
||||
file_create_mask: !!str 664
|
||||
dir_create_mask: !!str 2775
|
||||
vfs_object_virusfilter: true
|
||||
vfs_object_recycle: true
|
||||
recycle_path: '@Recycle'
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,78 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
install_compiler_pkgs: true
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/copy_files.yml
|
||||
# ---
|
||||
|
||||
|
||||
# copy_template_files: []
|
||||
#
|
||||
# - name: mailsystem_install_amavis.conf
|
||||
# src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
|
||||
# dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
|
||||
# ---
|
||||
@@ -0,0 +1,391 @@
|
||||
---
|
||||
# ---
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
- vlan
|
||||
- bridge-utils
|
||||
- ifmetric
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: eno1
|
||||
headline: eno1 - Uplink DSL via (static) line to Fritz!Box 7490
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 172.16.72.1
|
||||
netmask: 24
|
||||
gateway: 172.16.72.254
|
||||
# nameservers:
|
||||
# - 192.168.81.1
|
||||
# - 172.16.81.254
|
||||
# search: ga.netz ga.intra
|
||||
|
||||
- device: eno2
|
||||
headline: eno2 - Uplink Lehrer-und Schülerdatenbank (LUSD)
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 192.168.100.254
|
||||
netmask: 24
|
||||
post-up:
|
||||
# Traffic zur ehrer-und Schülerdatenbank (LUSD)
|
||||
- /sbin/ip route add 10.9.131.0/24 via 192.168.100.253
|
||||
|
||||
|
||||
- device: eno3
|
||||
family: inet
|
||||
method: manual
|
||||
post-up:
|
||||
# VLAN 10 LAN 1 Campus
|
||||
- /sbin/ip link add link eno3 name eno3.10 type vlan id 10
|
||||
|
||||
- device: eno3:ns
|
||||
headline: eno3:ns - Alias on eno3 (Nameserver)
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 192.168.72.1
|
||||
netmask: 32
|
||||
|
||||
- device: eno3.10
|
||||
headline: eno3.10 - LAN 1 Campus - network 192.168.72.0/24
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 192.168.72.254
|
||||
netmask: 24
|
||||
pre-up:
|
||||
- /sbin/ifconfig eno3 up
|
||||
|
||||
|
||||
- device: eno4
|
||||
family: inet
|
||||
method: manual
|
||||
post-up:
|
||||
# VLAN 20 - LAN 2 Campus including UniFi Accesspoints
|
||||
- /sbin/ip link add link eno4 name eno4.20 type vlan id 20
|
||||
|
||||
- device: eno4.20
|
||||
headline: eno4.20 - LAN 2 Campus - network 192.168.73.0/24
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 192.168.73.254
|
||||
netmask: 24
|
||||
pre-up:
|
||||
- /sbin/ifconfig eno4 up
|
||||
|
||||
|
||||
- device: eno6
|
||||
headline: eno6 - Management Network Campus - network 10.72.1.0/24
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 10.72.1.254
|
||||
netmask: 24
|
||||
|
||||
|
||||
- device: eno7
|
||||
headline: eno7 - network 192.168.11.0/24 (LAN Stockhausen)
|
||||
auto: true
|
||||
family: inet
|
||||
method: static
|
||||
address: 192.168.11.72/24
|
||||
gateway: 192.168.11.254
|
||||
netmask: 24
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 127.0.0.1
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- campus.netz
|
||||
- campus.intra
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
insert_ssh_keypair_backup_server: false
|
||||
ssh_keypair_backup_server:
|
||||
- name: backup
|
||||
backup_user: back
|
||||
priv_key_src: root/.ssh/id_rsa.backup.oopen.de
|
||||
priv_key_dest: /root/.ssh/id_rsa
|
||||
pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
|
||||
pub_key_dest: /root/.ssh/id_rsa.pub
|
||||
|
||||
insert_keypair_backup_client: true
|
||||
ssh_keypair_backup_client:
|
||||
- name: backup
|
||||
priv_key_src: root/.ssh/id_ed25519.oopen-server
|
||||
priv_key_dest: /root/.ssh/id_ed25519
|
||||
pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
|
||||
pub_key_dest: /root/.ssh/id_ed25519.pub
|
||||
target: backup.oopen.de
|
||||
|
||||
default_user:
|
||||
|
||||
- name: chris
|
||||
password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
|
||||
|
||||
- name: maadmin
|
||||
password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
|
||||
|
||||
- name: wadmin
|
||||
password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
|
||||
|
||||
- name: sysadm
|
||||
user_id: 1050
|
||||
group_id: 1050
|
||||
group: sysadm
|
||||
password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
|
||||
|
||||
- name: back
|
||||
user_id: 1060
|
||||
group_id: 1060
|
||||
group: back
|
||||
password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
||||
|
||||
sudo_users:
|
||||
- chris
|
||||
- sysadm
|
||||
- maadmin
|
||||
- wadmin
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
install_bind_packages: true
|
||||
|
||||
bind9_gateway_acl:
|
||||
- local-net:
|
||||
name: local-net
|
||||
entries:
|
||||
- 127.0.0.0/8
|
||||
- 172.16.0.0/12
|
||||
- 192.168.0.0/16
|
||||
- 10.0.0.0/8
|
||||
- fc00::/7
|
||||
- fe80::/10
|
||||
- ::1/128
|
||||
- internaldns:
|
||||
name: internaldns
|
||||
entries:
|
||||
- '# Nameserver Gateway Stockhausen'
|
||||
- 192.168.11.1
|
||||
- '# Domain Controller Stockhausen'
|
||||
- 192.168.10.3
|
||||
- '# Nameserver Gateway Altenschlirf'
|
||||
- 192.168.10.1
|
||||
- '# Domain Controller Altenschlirf'
|
||||
- 192.168.10.3
|
||||
- 192.168.10.6
|
||||
- 172.16.0.1
|
||||
- '# Nameserver Gateway Novalishaus'
|
||||
- 192.168.81.1
|
||||
- 10.2.11.2
|
||||
- '# Nameserver wolle'
|
||||
- 10.113.12.3
|
||||
- '# Postfix Mailserver'
|
||||
- 192.168.11.2
|
||||
- '# Mail Relay System'
|
||||
- 192.168.10.2
|
||||
|
||||
bind9_gateway_listen_on_v6:
|
||||
- none
|
||||
|
||||
bind9_gateway_listen_on:
|
||||
- any
|
||||
|
||||
# bind9_gateway_allow_transfer: {}
|
||||
bind9_gateway_allow_transfer:
|
||||
- none
|
||||
|
||||
bind9_transfer_source: !!str "192.168.81.1"
|
||||
bind9_notify_source: !!str "192.168.81.1"
|
||||
|
||||
# bind9_gateway_allow_query: {}
|
||||
bind9_gateway_allow_query:
|
||||
- local-net
|
||||
|
||||
# bind9_gateway_allow_query_cache: {}
|
||||
bind9_gateway_allow_query_cache:
|
||||
- local-net
|
||||
|
||||
bind9_gateway_recursion: !!str "yes"
|
||||
# bind9_gateway_allow_recursion: {}
|
||||
bind9_gateway_allow_recursion:
|
||||
- local-net
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-gateway
|
||||
repo: https://git.oopen.de/firewall/ipt-gateway
|
||||
dest: /usr/local/src/ipt-gateway
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,214 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
install_compiler_pkgs: true
|
||||
|
||||
install_postgresql_pkgs: true
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 192.168.11.1
|
||||
- 192.168.10.3
|
||||
- 192.168.10.1
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- ga.netz
|
||||
- ga.intra
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 192.168.11.3
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
insert_root_ssh_keypair: true
|
||||
|
||||
root_ssh_keypair:
|
||||
- name: id-rsa-dehydrated
|
||||
priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated
|
||||
priv_key_dest: /root/.ssh/id_rsa-dehydrated
|
||||
pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
|
||||
pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
|
||||
- name: id-rsa-opendkim
|
||||
priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim
|
||||
priv_key_dest: /root/.ssh/id_rsa-opendkim
|
||||
pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
|
||||
pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
|
||||
|
||||
default_user:
|
||||
|
||||
- name: chris
|
||||
password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
|
||||
|
||||
- name: maadmin
|
||||
password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
|
||||
|
||||
- name: wadmin
|
||||
password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
|
||||
|
||||
- name: sysadm
|
||||
user_id: 1050
|
||||
group_id: 1050
|
||||
group: sysadm
|
||||
password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
|
||||
|
||||
- name: back
|
||||
user_id: 1060
|
||||
group_id: 1060
|
||||
group: back
|
||||
password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
||||
|
||||
sudo_users:
|
||||
- chris
|
||||
- sysadm
|
||||
- maadmin
|
||||
- wadmin
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/copy_files.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
|
||||
# ---
|
||||
@@ -0,0 +1,275 @@
|
||||
---
|
||||
# yamllint disable rule:line-length
|
||||
|
||||
# ---
|
||||
# vars used by role firewall
|
||||
# --
|
||||
|
||||
is_web_server: true
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
sshd_ports:
|
||||
- 22
|
||||
- 1036
|
||||
|
||||
sshd_listen_address:
|
||||
- '::'
|
||||
- '0.0.0.0'
|
||||
|
||||
sshd_host_keys:
|
||||
- /etc/ssh/ssh_host_rsa_key
|
||||
- /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# only for debian version <= 9
|
||||
#
|
||||
sshd_use_privilege_separation: !!str "sandbox"
|
||||
|
||||
sshd_permit_root_login: !!str "no"
|
||||
|
||||
sshd_authorized_keys_file: ".ssh/authorized_keys .ssh/authorized_keys2"
|
||||
|
||||
sshd_pubkey_authentication: !!str "yes"
|
||||
|
||||
sshd_password_authentication: !!str "no"
|
||||
|
||||
sshd_use_pam: !!str "yes"
|
||||
|
||||
sshd_allowed_users:
|
||||
- back
|
||||
- alex
|
||||
- alis
|
||||
- ckubu
|
||||
- defa
|
||||
- init
|
||||
- sysadm
|
||||
|
||||
# sshd_kexalgorithms
|
||||
#
|
||||
# Example:
|
||||
# sshd_kexalgorithms:
|
||||
# - curve25519-sha256@libssh.org
|
||||
# - diffie-hellman-group-exchange-sha256
|
||||
# - diffie-hellman-group14-sha1
|
||||
#
|
||||
# sshd_kexalgorithms: {}
|
||||
sshd_kexalgorithms:
|
||||
- curve25519-sha256
|
||||
- curve25519-sha256@libssh.org
|
||||
- diffie-hellman-group16-sha512
|
||||
- diffie-hellman-group18-sha512
|
||||
- diffie-hellman-group-exchange-sha256
|
||||
|
||||
# sshd__ciphers
|
||||
#
|
||||
# Example:
|
||||
# sshd_ciphers:
|
||||
# - chacha20-poly1305@openssh.com
|
||||
# - aes256-gcm@openssh.com
|
||||
# - aes256-ctr
|
||||
# sshd_ciphers: {}
|
||||
sshd_ciphers:
|
||||
- chacha20-poly1305@openssh.com
|
||||
- aes256-gcm@openssh.com
|
||||
- aes128-gcm@openssh.com
|
||||
- aes256-ctr
|
||||
- aes192-ctr
|
||||
- aes128-ctr
|
||||
|
||||
# sshd_macs: {}
|
||||
sshd_macs:
|
||||
- hmac-sha2-256-etm@openssh.com
|
||||
- hmac-sha2-512-etm@openssh.com
|
||||
- umac-128-etm@openssh.com
|
||||
|
||||
# sshd_hostkeyalgorithms: {}
|
||||
sshd_hostkeyalgorithms:
|
||||
- ssh-ed25519
|
||||
- ssh-ed25519-cert-v01@openssh.com
|
||||
- rsa-sha2-256
|
||||
- rsa-sha2-512
|
||||
- rsa-sha2-256-cert-v01@openssh.com
|
||||
- rsa-sha2-512-cert-v01@openssh.com
|
||||
|
||||
# sshd_kexalgorithms:
|
||||
# - curve25519-sha256@libssh.org
|
||||
# - diffie-hellman-group-exchange-sha256
|
||||
# - diffie-hellman-group14-sha1
|
||||
|
||||
# sshd_ciphers:
|
||||
# - chacha20-poly1305@openssh.com
|
||||
# - aes256-gcm@openssh.com
|
||||
# - aes256-ctr
|
||||
|
||||
sshd_print_motd: !!str "no"
|
||||
|
||||
sshd_use_dns: !!str "no"
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
apt_manage_sources_list: true
|
||||
|
||||
apt_src_enable: false
|
||||
apt_backports_enable: true
|
||||
|
||||
apt_debian_mirror: http://ftp.de.debian.org/debian/
|
||||
apt_debian_contrib_nonfree_enable: true
|
||||
|
||||
apt_update_cache_valid_time: 3600
|
||||
|
||||
apt_upgrade: true
|
||||
apt_update: true
|
||||
|
||||
apt_clean: true
|
||||
apt_autoremove: true
|
||||
|
||||
apt_dpkg_configure: true
|
||||
apt_upgrade_type: dist
|
||||
apt_upgrade_dpkg_options:
|
||||
- force-confdef
|
||||
- force-confold
|
||||
|
||||
apt_install_state: latest
|
||||
|
||||
apt_remove:
|
||||
- rpcbind
|
||||
|
||||
apt_remove_purge: false
|
||||
|
||||
microcode_package:
|
||||
- intel-microcode
|
||||
- amd64-microcode
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
default_user:
|
||||
|
||||
- name: alex
|
||||
password: $6$GTP91Vzk$HBBq323cWk5NXqmIaFXAoHBavJWMO9KZdpdORvwaPtnQTT/ZxsHSlMrlI4W2mPWnDwa8IRy6.ZYL1FAMS9do21
|
||||
shell: /usr/bin/zsh
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMyXy0+TVREnROtJOzuFFrFW18UXaRyWWLm4Z1vCOXU home'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKb9VsHdwzIW8MpEtOKzWPJW+toe1UL1odj4k0mtYPac work'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJywUxxa2hNC8DNGmiyyLDaY0BP8muqqR1upMS8vBx6O laptop'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPKDhjGkGJNO9pmc3CDp0fi4TXmkXP1hm6wzAdqiMphE netbook'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINk3tyHir3go59oZnp98WhauGJNwf6KTRYcBvfFMs8fY mobile'
|
||||
|
||||
- name: alis
|
||||
password: $6$a/PWqRoP$bQs3qmthLdL6nVVt65ml6XcZqfVxQ9nQg0/VcUjuh44vuVlJ7lGgvb6Zv1MM.Ryu1Qis1a3GFuKIRww3p7RVJ.
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEXvi4aBvd8777iALbpxMvzXdX+LnFYEOzHPuBEMjFt7+LArqqpfqU4rSCtfMD3QExAYbstIj0K/eyQ3S+Oe+Ry4Fr3hkZOtkpZF+MW1yvO2m1QuEzj+/2C9SU+yhGLo4cyIZN59wJOodWmLNy4u/vIQw305AHVwBdyE0zdq/5WRngk5nJmyjZHw7/rX5DPRgxOWk1zjruXt6mWoImRPk0Cy4jpouIl6DQ9gawryryX9+9E6aSI6Ona7ngUxKGcwe3ec3CM66c83J7xfC17EiZccjrJ+u9UPIlsXNs/ka3W/625wHTHCIaj2uOL2JZOj/TboZETPti5LO1fA5iLww+Iu1eGVPncdxojSgAcv4fcDKIG+IrEf8RyP7z7kABQH0jB+4jrnpptkOulrxccAYBxKp9AA0fp0dRo1IdSZ8IEnXluJ5pg2N73SFi/1MyC67urWC/qqhK5C32WjezDoXUx/n9DE9gKsFID6vEHmIZsuD1ohsIbksLkLq0Guh8goLfFxATJEdj1CpL+FtpaCcMLFSYYgSZwVsoCeEXz8h4nlYy8w7+kcweJIEJstjLHziZ0oIwmmRxqGLIeLrfQRF7miFUJzgIVmj+wIHrhk11ZdceP9RNT/TpnYFQvICRFJp7tYS4+uYS4rdNgJ0o9VtyHEoFrCKtB7mHvl1/MFGoYw== alis@mail36.net'
|
||||
|
||||
- name: ckubu
|
||||
password: $6$nmAWOQHZ$PRx3FAGI4.X4ah7nmuTFJi0iFMwlWwTz.iM9B4yjLGcnQ/hg3K0O0lSDXOOn7yRJlhwRejVq2XSNvrmSGwJw//
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
|
||||
|
||||
- name: defa
|
||||
password: $6$LMelojO.$TY0vb.xSBparEY5O7p86YT.E4RXKVH0bDfwGsszuFS6EAl3oh.s6V.jIZYg56P1RTDiVUh4A0BOwk87Q/utaS1
|
||||
shell: /bin/zsh
|
||||
ssh_keys:
|
||||
- 'ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAmPpPUHYmhTlN97lPAIdDjmkvM4xbCrWHiAjJJ7RdM8lW6hLbBaiMgbUwULOB86FB49V2YSoaVX09UkxJOCf15TYbq79P7W2x2UtFzYxVEVgpr/HVhJjytEDzmFYbsNN3VDK/2JEFqYqtLpTXOqf/TFihmqbvfbkUQOK/NMbE8udxj/RHnwRDMaJJ0IP7L6Z/v5s654H75nv7/IRm8Ov5DmcJyz9BcEL7fpow2HYexUzUozWN9zMXabrQ5AtEeJ0FYuBFIkYPLaUQ+WJ5bLCmoeE81+SIl+fw0UG5Zeb6SMo+NFFaMBIvwyEsNVyz9Gf2SUq/9weTr0JxVdCGKmEZLj9imcr2WtQxcXRhjTzAyq4m8F/2uA9GkisFUM2VybfZxNtkTZdIEHYE1X/36PYNI7P8Cp98cM7EKNLaPniDuQRh7IBixVt9oxxwxVFjZrG21ySanvg6GnpHHAkhM2nlwA0zcDMYd2h5rJt9JB8s8UQplTJzmo+lAbGBc47pZr4J0BKywjTsfQtQed1kClm/oEjO19mvRIC5DBznBtWJ4jWeTsjs91tEARE7LforRCy2VkA2rNxPsWz6Iks/towoySuWz8oUmA0FdfE5ULUavuv4uFZQXurIX0AvyWp3dg8dG2srnoZqqagr3VdZT7jV5nlNICeaEFbb5iShaxDBoBk= defa@walther'
|
||||
|
||||
- name: init
|
||||
password: $6$NcRlPYtm$1YiBoiJUcEwB1ovXYLpQ.OM/ehceh46/G2K4jz0I/PK7tJzD/HDoKhaKVYEIe.uWld6zC63GrgEhq.UMJzFuS1
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcOAGa9XHPVGx7k5YWptABoMs2f1+OeqRr6UFXveCWtjdDuk+YUAWl1W8TlDaFmw0+kLGk4Sg5TEcDzlVL+9L1Du044mwieeGQx5WRnz2vtg9XP/AP19jmpn1gTUPt5HGvFWVCeCDkMnc2aEz+fbW1MGN3ZxRNXhoNZfSS/jC7B0RANu1o3nPDQ3fGxFee02bAWi76To+0dJJppH02qSmlkOSUExOI+9i5WSog5KuCim25isLTIwv/GJNWAASL2/OUMuH82mX1EIS6qRdvcRufWH8qxTAkSeNrLUjiJOtCcE9dchS566KDs8p0U02PBN/92VB9aS/ErQ23l7llVr4jr776qBlUQn4vMxv1MG9ETM+/tUErYNDYazx+FV4NT90sxvepc+8I/q0AZjD2HNp6P25LgPNIhegNznnF/Twy9wW4Jn50FB4GMf8tHCeD9clXOMA1gSGGQiyeyly+wzZ5eLduwWAtzzYJ7MpOfncPYq2kKqs/29p77/0fvdbH2zzJQDbR2A0kHK1z3K6A7I8c+dBdcf2Kb5pvmglHjjSS06rD3oJtl3EvTfBe7AFhCou+zaaIf9fjMyM5upOu/ik23gRcDD32pX6Y0ltixfIWm6PV+Rgl88q6mOeLMwnItKtXID/O2908JE4dyLao2JeauzhXBJjMY2yzbcPLSlz2xw== so_init_03'
|
||||
|
||||
- name: sysadm
|
||||
|
||||
user_id: 1050
|
||||
group_id: 1050
|
||||
group: sysadm
|
||||
password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5IhVprsvVOcFPbZzD9xR0nCjZ/9qVG6RhLJ7QBSts81nRvLwnmvcMBHSf5Rfaigey7Ff5dLHfJnxRE0KDATn6n2yd/5mXpn2GAA8hDVfhdsmsb5U7bROjZNr8MmIUrP7c3msUGx1FtvzhwxtyvIWOFQpWx+W5biBa6hFjIxT1pkUJqe6fclp7xbGYKZiqZRBS4qKG5CpKnisuOYDsqYPND+OkU+PShoxGVzp1JywIVze7qeKv6GyYbRA9SP9Np+5Mit6B21Io4zOI81c2Rz6sPX7mwEAQEs7iCm2hzG8qJws45Lb4ERqDkVEVhGNUyHjHgGebS1sZx1mLExdurXlPm1l/EamkncDFDCutHXtLP7lsFFiym7fKUjSEgiiLmyu5Xm+mwZvesKa1FYNaeiFWfYZpCJrNzIk+ffs+mgg3kmL4Sd4Ooy7jXPX+WJe5Xyh1KLU/+Wj2TVrhN+LbmupYAti/Wgd3DA1v601svmG82aLmyJRtKC0rGMePH3kDbtqU72kYpzI8mXERe1TIQ00Z77kQBR/7BF/9y5/0YmYDcXt1wNCoSie+mzz3xYcEdLAc7T+DhYpd4M6VgWnuz/exzRzhQwoSdEKkEED8CpEoBrEWEiMdrlElGmlkVomLU7P9i9j1rshX/pAq0asnqeSoPdC3vNbU3keiJQnhIHECvw== chris@luna'
|
||||
- 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCyWbdnjnN/xfy1F6kPbsRXp8zvJEh8uHfTZuZKyaRV/iRuhsvqRiDB+AhUAlIaPwgQ8itaI6t5hijD+sZf+2oXXbNy3hkOHTrCDKCoVAWfMRKPuA1m8RqS4ZXXgayaeCzVnPEq6UrC5z0wO/XBwAktT37RRSQ/Hq2zCHy36NQEQYrhF3+ytX7ayb10pJAMVGRctYmr5YnLEVMSIREbPxZTNc80H1zqNPVJwYZhl8Ox61U4MoNhJmJwbKWPRPZsJpbTh9W2EU37tdwRBVQP6yxhua3TR6C7JnNPVY0IK23BYlNtQEDY4PHcIuewkamEWpP0+jhEjtwy1TqjRPdU/y+2uQjC6FSOVMsSPxgd8mw4cSsfp+Ard7P+YOevUXD81+jFZ3Wz0PRXbWMWAm2OCe7n8jVvkXMz+KxSYtrsvKNw1WugJq1z//bJNMTK6ISWpqaXDevGYQRJJ8dPbMmbey40WpS5CA/l29P7fj/cOl59w3LZGshrMOm7lVz9qysVV0ylfE3OpfKCGitkpY0Asw4lSkuLHoNZnDo6I5/ulRuKi6gsLk27LO5LYS8Zm1VOis/qHk1Gg1+QY47C4RzdTUxlU1CGesPIiQ1uUX2Z4bD7ebTrrOuEFcmNs3Wu5nif21Qq0ELEWhWby6ChFrbFHPn+hWlDwNM0Nr11ftwg0+sqVw== root@luna'
|
||||
|
||||
- name: back
|
||||
user_id: 1060
|
||||
group_id: 1060
|
||||
group: back
|
||||
password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
|
||||
shell: /bin/bash
|
||||
ssh_keys:
|
||||
- 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5IhVprsvVOcFPbZzD9xR0nCjZ/9qVG6RhLJ7QBSts81nRvLwnmvcMBHSf5Rfaigey7Ff5dLHfJnxRE0KDATn6n2yd/5mXpn2GAA8hDVfhdsmsb5U7bROjZNr8MmIUrP7c3msUGx1FtvzhwxtyvIWOFQpWx+W5biBa6hFjIxT1pkUJqe6fclp7xbGYKZiqZRBS4qKG5CpKnisuOYDsqYPND+OkU+PShoxGVzp1JywIVze7qeKv6GyYbRA9SP9Np+5Mit6B21Io4zOI81c2Rz6sPX7mwEAQEs7iCm2hzG8qJws45Lb4ERqDkVEVhGNUyHjHgGebS1sZx1mLExdurXlPm1l/EamkncDFDCutHXtLP7lsFFiym7fKUjSEgiiLmyu5Xm+mwZvesKa1FYNaeiFWfYZpCJrNzIk+ffs+mgg3kmL4Sd4Ooy7jXPX+WJe5Xyh1KLU/+Wj2TVrhN+LbmupYAti/Wgd3DA1v601svmG82aLmyJRtKC0rGMePH3kDbtqU72kYpzI8mXERe1TIQ00Z77kQBR/7BF/9y5/0YmYDcXt1wNCoSie+mzz3xYcEdLAc7T+DhYpd4M6VgWnuz/exzRzhQwoSdEKkEED8CpEoBrEWEiMdrlElGmlkVomLU7P9i9j1rshX/pAq0asnqeSoPdC3vNbU3keiJQnhIHECvw== chris@luna'
|
||||
|
||||
sudo_users:
|
||||
- alex
|
||||
- alis
|
||||
- ckubu
|
||||
- defa
|
||||
- init
|
||||
- sysadm
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,156 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
copy_additional_plain_files_sysctl:
|
||||
|
||||
- name: enable-ipv6
|
||||
src_path: etc/sysctl.d/30-enable-ipv6.conf
|
||||
dest_path: /etc/sysctl.d/30-enable-ipv6.conf
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
sshd_hostkeyalgorithms:
|
||||
- ssh-ed25519
|
||||
- ssh-ed25519-cert-v01@openssh.com
|
||||
- rsa-sha2-256
|
||||
- rsa-sha2-512
|
||||
- ecdsa-sha2-nistp256
|
||||
- rsa-sha2-256-cert-v01@openssh.com
|
||||
- rsa-sha2-512-cert-v01@openssh.com
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 127.0.0.1
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- local.netz
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-gateway
|
||||
repo: https://git.oopen.de/firewall/ipt-gateway
|
||||
dest: /usr/local/src/ipt-gateway
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
install_bind_packages: true
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $y$j9T$IVBTpn.OrI6YiQ9q3fA8b1$Y1bmID5yXJbKfoLFt1VmQs6LezeTj5/1M9ppZBD2Pn4
|
||||
@@ -0,0 +1,156 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
copy_additional_plain_files_sysctl:
|
||||
|
||||
- name: enable-ipv6
|
||||
src_path: etc/sysctl.d/30-enable-ipv6.conf
|
||||
dest_path: /etc/sysctl.d/30-enable-ipv6.conf
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
sshd_hostkeyalgorithms:
|
||||
- ssh-ed25519
|
||||
- ssh-ed25519-cert-v01@openssh.com
|
||||
- rsa-sha2-256
|
||||
- rsa-sha2-512
|
||||
- ecdsa-sha2-nistp256
|
||||
- rsa-sha2-256-cert-v01@openssh.com
|
||||
- rsa-sha2-512-cert-v01@openssh.com
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 127.0.0.1
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- local.netz
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-gateway
|
||||
repo: https://git.oopen.de/firewall/ipt-gateway
|
||||
dest: /usr/local/src/ipt-gateway
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
install_bind_packages: true
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $y$j9T$IVBTpn.OrI6YiQ9q3fA8b1$Y1bmID5yXJbKfoLFt1VmQs6LezeTj5/1M9ppZBD2Pn4
|
||||
@@ -0,0 +1,174 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
copy_additional_plain_files_sysctl:
|
||||
|
||||
- name: enable-ipv6
|
||||
src_path: etc/sysctl.d/30-enable-ipv6.conf
|
||||
dest_path: /etc/sysctl.d/30-enable-ipv6.conf
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
sshd_hostkeyalgorithms:
|
||||
- ssh-ed25519
|
||||
- ssh-ed25519-cert-v01@openssh.com
|
||||
- rsa-sha2-256
|
||||
- rsa-sha2-512
|
||||
- ecdsa-sha2-nistp256
|
||||
- rsa-sha2-256-cert-v01@openssh.com
|
||||
- rsa-sha2-512-cert-v01@openssh.com
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 127.0.0.1
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- wf.netz
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
# ---
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart NTP service 'ntpsec'"
|
||||
special_time: reboot
|
||||
job: "sleep 15 ; /bin/systemctl restart ntpsec"
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-gateway
|
||||
repo: https://git.oopen.de/firewall/ipt-gateway
|
||||
dest: /usr/local/src/ipt-gateway
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
install_bind_packages: true
|
||||
|
||||
bind9_gateway_listen_on_v6:
|
||||
- none
|
||||
|
||||
bind9_gateway_listen_on:
|
||||
- any
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $y$j9T$IVBTpn.OrI6YiQ9q3fA8b1$Y1bmID5yXJbKfoLFt1VmQs6LezeTj5/1M9ppZBD2Pn4
|
||||
@@ -0,0 +1,84 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
# apt_manage_sources_list: false
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
git_other_repositories:
|
||||
- name: moodle
|
||||
repo: https://git.oopen.de/install/moodle
|
||||
dest: /usr/local/src/moodle
|
||||
|
||||
- name: bigbluebutton
|
||||
repo: https://git.oopen.de/install/bigbluebutton
|
||||
dest: /usr/local/src/bigbluebutton
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,79 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
sshd_use_privilege_separation: !!str "yes"
|
||||
|
||||
sshd_permit_root_login: !!str "yes"
|
||||
|
||||
sshd_gateway_ports: !!str "yes"
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,114 @@
|
||||
---
|
||||
|
||||
|
||||
# ---
|
||||
# used at role 'firewall'
|
||||
# ---
|
||||
|
||||
is_local_resolver: true
|
||||
resolver_allowed_ipv4_networks:
|
||||
- 192.68.11.64/27
|
||||
- 194.150.169.136/29
|
||||
- 138.201.23.195
|
||||
- 138.201.23.196
|
||||
resolver_allowed_ipv6_networks:
|
||||
- 2001:678:a40:3000::/64
|
||||
- 2a01:4f8:171:2895::195
|
||||
- 2a01:4f8:171:2895::196
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
# Note:
|
||||
# - if acl_caching_nameserver is set, caching nameserver will listen on
|
||||
# all interfaces.
|
||||
#
|
||||
# - DON'T FORGET ';' sign at the end of ip-addresses
|
||||
#
|
||||
acl_caching_nameserver:
|
||||
- so36net:
|
||||
name: so36net
|
||||
entries:
|
||||
- /* so36.NET */
|
||||
- 192.68.11.64/27;
|
||||
- 2001:678:a40:3000::/64;
|
||||
- /* Backup wipe.so36.net / backup.so36.net */
|
||||
- 194.150.169.139;
|
||||
- 194.150.169.138;
|
||||
- // site36.net
|
||||
- 138.201.23.195;
|
||||
- 138.201.23.196;
|
||||
- 2a01:4f8:171:2895::195;
|
||||
- 2a01:4f8:171:2895::196;
|
||||
- sinma:
|
||||
name: sinma
|
||||
entries:
|
||||
- 83.223.64.0/19;
|
||||
- ckubu:
|
||||
name: ckubu
|
||||
entries:
|
||||
- 2003:ec:df1b:7dfd:dfa8:efd5:14f3:5275;
|
||||
- 84.140.145.23;
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
@@ -0,0 +1,210 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
- vlan
|
||||
- bridge-utils
|
||||
- ifmetric
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: br0
|
||||
# use only once per device (for the first device entry)
|
||||
headline: br0 - bridge over device eth0
|
||||
|
||||
# auto & allow are only used for the first device entry
|
||||
allow: [] # array of allow-[stanzas] eg. allow-hotplug
|
||||
auto: true
|
||||
|
||||
family: inet
|
||||
method: manual
|
||||
hwaddress: 52:54:00:a3:af:1f
|
||||
description: Bridge Interface IPv4 for LXC
|
||||
address:
|
||||
netmask:
|
||||
gateway:
|
||||
metric:
|
||||
pointopoint:
|
||||
mtu:
|
||||
scope:
|
||||
|
||||
# additional user by dhcp method
|
||||
#
|
||||
hostname:
|
||||
leasehours:
|
||||
leasetime:
|
||||
vendor:
|
||||
client:
|
||||
|
||||
# additional used by bootp method
|
||||
#
|
||||
bootfile:
|
||||
server:
|
||||
hwaddr:
|
||||
|
||||
# optional dns settings nameservers: []
|
||||
#
|
||||
# nameservers:
|
||||
# - 194.150.168.168 # dns.as250.net
|
||||
# - 91.239.100.100 # anycast.censurfridns.dk
|
||||
# search: warenform.de
|
||||
#
|
||||
nameservers:
|
||||
- 127.0.0.1
|
||||
search:
|
||||
|
||||
# optional additional subnets/ips subnets: []
|
||||
# subnets:
|
||||
# - '192.168.123.0/24'
|
||||
# - '192.168.124.11/32'
|
||||
|
||||
# optional bridge parameters bridge: {}
|
||||
# bridge:
|
||||
# ports:
|
||||
# stp:
|
||||
# fd:
|
||||
# maxwait:
|
||||
# waitport:
|
||||
bridge:
|
||||
ports: eth0 # for mor devices support a blank separated list
|
||||
stp: !!str off
|
||||
fd: 1
|
||||
hello: 2
|
||||
maxage: 12
|
||||
|
||||
# optional bonding parameters bond: {}
|
||||
# bond:
|
||||
# master
|
||||
# primary
|
||||
# slave
|
||||
# method:
|
||||
# miimon:
|
||||
# lacp-rate:
|
||||
# ad-select-rate:
|
||||
# master:
|
||||
# slaves:
|
||||
bond: {}
|
||||
|
||||
# optional vlan settings | vlan: {}
|
||||
# vlan: {}
|
||||
# raw-device: 'eth0'
|
||||
vlan: {}
|
||||
|
||||
# inline hook scripts
|
||||
pre-up: [] # pre-up script lines
|
||||
up:
|
||||
- !!str "ip addr add 83.223.86.81/24 dev br0"
|
||||
- !!str "ip route add default via 83.223.86.1"
|
||||
post-up: [] # post-up script lines (alias for up)
|
||||
pre-down: [] # pre-down script lines (alias for down)
|
||||
down: [] # down script lines
|
||||
post-down: [] # post-down script lines
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
apt_install_extra_pkgs: true
|
||||
apt_extra_pkgs:
|
||||
- subversion
|
||||
- subversion-tools
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
insert_ssh_keypair_backup_server: false
|
||||
ssh_keypair_backup_server:
|
||||
- name: backup
|
||||
backup_user: back
|
||||
priv_key_src: root/.ssh/id_rsa.backup.warenform.de
|
||||
priv_key_dest: /root/.ssh/id_rsa
|
||||
pub_key_src: root/.ssh/id_rsa.backup.warenform.de.pub
|
||||
pub_key_dest: /root/.ssh/id_rsa.pub
|
||||
|
||||
insert_keypair_backup_client: true
|
||||
ssh_keypair_backup_client:
|
||||
- name: backup
|
||||
priv_key_src: root/.ssh/id_ed25519.warenform-server
|
||||
priv_key_dest: /root/.ssh/id_ed25519
|
||||
pub_key_src: root/.ssh/id_ed25519.warenform-server.pub
|
||||
pub_key_dest: /root/.ssh/id_ed25519.pub
|
||||
target: backup.warenform.de
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,200 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
- vlan
|
||||
- bridge-utils
|
||||
- ifmetric
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: br0
|
||||
# use only once per device (for the first device entry)
|
||||
headline: br0 - bridge over device eth0
|
||||
|
||||
# auto & allow are only used for the first device entry
|
||||
allow: [] # array of allow-[stanzas] eg. allow-hotplug
|
||||
auto: true
|
||||
|
||||
family: inet
|
||||
method: manual
|
||||
hwaddress: 52:54:00:89:62:31
|
||||
description:
|
||||
address:
|
||||
netmask:
|
||||
gateway:
|
||||
metric:
|
||||
pointopoint:
|
||||
mtu:
|
||||
scope:
|
||||
|
||||
# additional user by dhcp method
|
||||
#
|
||||
hostname:
|
||||
leasehours:
|
||||
leasetime:
|
||||
vendor:
|
||||
client:
|
||||
|
||||
# additional used by bootp method
|
||||
#
|
||||
bootfile:
|
||||
server:
|
||||
hwaddr:
|
||||
|
||||
# optional additional subnets/ips subnets: []
|
||||
# subnets:
|
||||
# - '192.168.123.0/24'
|
||||
# - '192.168.124.11/32'
|
||||
|
||||
# optional bridge parameters bridge: {}
|
||||
# bridge:
|
||||
# ports:
|
||||
# stp:
|
||||
# fd:
|
||||
# maxwait:
|
||||
# waitport:
|
||||
bridge:
|
||||
ports: eth0 # for mor devices support a blank separated list
|
||||
stp: !!str off
|
||||
fd: 1
|
||||
hello: 2
|
||||
maxage: 12
|
||||
|
||||
# optional bonding parameters bond: {}
|
||||
# bond:
|
||||
# master
|
||||
# primary
|
||||
# slave
|
||||
# method:
|
||||
# miimon:
|
||||
# lacp-rate:
|
||||
# ad-select-rate:
|
||||
# master:
|
||||
# slaves:
|
||||
bond: {}
|
||||
|
||||
# optional vlan settings | vlan: {}
|
||||
# vlan: {}
|
||||
# raw-device: 'eth0'
|
||||
vlan: {}
|
||||
|
||||
# inline hook scripts
|
||||
pre-up: [] # pre-up script lines
|
||||
up:
|
||||
- !!str "ip addr add 83.223.85.220/24 dev br0"
|
||||
- !!str "ip route add default via 83.223.85.1"
|
||||
post-up: [] # post-up script lines (alias for up)
|
||||
pre-down: [] # pre-down script lines (alias for down)
|
||||
down: [] # down script lines
|
||||
post-down: [] # post-down script lines
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
apt_install_extra_pkgs: true
|
||||
apt_extra_pkgs:
|
||||
- subversion
|
||||
- subversion-tools
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
insert_ssh_keypair_backup_server: false
|
||||
ssh_keypair_backup_server:
|
||||
- name: backup
|
||||
backup_user: back
|
||||
priv_key_src: root/.ssh/id_rsa.backup.warenform.de
|
||||
priv_key_dest: /root/.ssh/id_rsa
|
||||
pub_key_src: root/.ssh/id_rsa.backup.warenform.de.pub
|
||||
pub_key_dest: /root/.ssh/id_rsa.pub
|
||||
|
||||
insert_keypair_backup_client: true
|
||||
ssh_keypair_backup_client:
|
||||
- name: backup
|
||||
priv_key_src: root/.ssh/id_ed25519.warenform-server
|
||||
priv_key_dest: /root/.ssh/id_ed25519
|
||||
pub_key_src: root/.ssh/id_ed25519.warenform-server.pub
|
||||
pub_key_dest: /root/.ssh/id_ed25519.pub
|
||||
target: backup.warenform.de
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,144 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 213.133.100.100
|
||||
- 2a01:4f8:0:1::add:9898
|
||||
- 213.133.99.99
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- oopen.de
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
Reference in New Issue
Block a user