ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
387 Commits 1 Branch 0 Tags
f14b8817c043185186ee4df80b322702f4b5fbb3
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
chrisandClaude Opus 5.5 f14b8817c0 Inventory/host_vars cleanup. 
- hosts: remove gw-replacement2/3.local.netz and k1371.dyndns.org
  (duplicate of gw-ak.oopen.de).
- host_vars: move obsolete host directories to host_vars/DELETED/
  (devel-cloud, file-blkr-alt, file-ipa, ga-campus-gw-temp, ga-st-mm,
  gitea.so36.net, nc-gw, moodle, nscache, server16, server20, web-test,
  gw-replacement2/3/4).
- host_vars: fix file names (ga-al-gw-common.yml,
  gw-replacement.local.netz/gw-replacement-common.yml) and the header of
  mm-nd-test-ipt-server.yml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-03 23:43:34 +01:00
chrisandClaude Opus 5.5 3a73ed9583 Inventory cleanup; add ipt-server host_vars for all ipt hosts. 
- hosts: remove unreachable/decommissioned hosts (file-ah-neu, file-ah-alt,
  file-km-neu, ga-al-gw-neu, gw-opp-neu, zapata-neu, zapata-alt, bbb-server,
  ki-fm, server28, ...) and duplicate aliases (etherpad = b.ns,
  cl-irights-neu = cl-irights, oolm-db = o21, devel-ruby = devel-todo).
- host_vars: add <short>-ipt-server.yml (fw_manage_config: false) for all
  hosts running the ipt-server firewall, generated by extract-fw-host-vars.py.
- host_vars: move/remove obsolete host directories, replace alias
  directories by symlinks (cl-lubax -> o32, cl-vbrg -> o34, oolm-db -> o21).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-03 23:08:58 +01:00
chrisandClaude Opus 5.5 8484fd1508 extract-fw-host-vars.py: use the SSH user from ~/.ssh/config unless --user is given. 
Previously "-l chris" was always passed, which overrode per-host users in
~/.ssh/config (e.g. the so36 hosts).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-03 20:36:01 +01:00
chrisandClaude Opus 5.5 0499706703 extract-fw-host-vars.py: write host_vars/<host>/<short>-ipt-server.yml by default. 
Without -o the script now writes the standard host_vars file (relative to
the script, independent of the cwd). An existing file is only overwritten
with --force; this is checked before connecting to the host. -o - prints
to stdout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-03 01:28:00 +01:00
chrisandClaude Opus 5.5 b585f3c122 Role ipt-server: migrate o34.oopen.de (fw_manage_config: true). 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-03 01:21:03 +01:00
chrisandClaude Opus 5.5 3e6486c5b5 extract-fw-host-vars.py: abort if a conf file cannot be read; add --from-dir. Migrate cl-test. 
Previously an unreadable file (e.g. /etc/ipt-firewall is 0750 after the
role ran) silently produced almost empty host_vars. The script now exits
with an error and writes nothing. --from-dir reads the conf files from a
local directory, e.g. fetched with ansible using the vaulted become
password.

Add host_vars for cl-test.oopen.de (fw_manage_config: true).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-03 01:00:55 +01:00
chrisandClaude Opus 5.5 ec62f54ab4 Role ipt-server: restart fail2ban after a firewall restart if it is running. 
A firewall restart flushes the fail2ban chains. The new handler restarts
fail2ban only if it is active; it does nothing if fail2ban is stopped or
not installed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-03 00:52:08 +01:00
chrisandClaude Opus 5.5 3d6840ef3a Role ipt-server: allow IPv6-only overrides of shared variables; migrate nd, oolm-shop, web-01, web0. 
Shared variables (and fw_ext_interfaces / fw_local_interfaces) can now be
overridden for IPv6 via <name>_v6. extract-fw-host-vars.py emits these
overrides when the IPv4 and IPv6 configs differ, instead of a warning.

Add host_vars for nd.warenform.de, oolm-shop.oopen.de, web-01.oopen.de
and web0.warenform.de (fw_manage_config: true).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-03 00:50:03 +01:00
chris fe2e749b63 Change git_other_repositories from empty dictionary to empty list 2026-11-03 00:17:24 +01:00
chris 19e1e24b26 Remove vault password configuration from oopen_server.yml 2026-11-03 00:17:02 +01:00
chris 221c7a0552 Add vault password configuration for privilege escalation 2026-11-03 00:08:41 +01:00
chrisandClaude Opus 5.5 402a6c9e89 Role ipt-server: sync with ipt-server repo (93d9af8); adapt extract-fw-host-vars.py. 
- Update firewall scripts and shared conf files from firewall/ipt-server
  (HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
  mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
  fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
  fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
  fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
  fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
  rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
  bash variables, fall back to IPv6 for shared variables and warn if IPv4
  and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
  (<short-hostname>-ipt-server.yml) and new variables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-02 22:01:28 +01:00
chris 4a6fc84c01 Update Samba user password for enhanced security 2026-10-31 09:49:20 +01:00
chris bf50baa357 Rename 'vze' to 'vfk' in Samba user and share configurations 2026-10-31 09:48:59 +01:00
chris 9c6f2f89a0 Add ga-al-gw-neu.ga.netz to multiple sections in hosts file 2026-10-31 09:48:48 +01:00
chris 29f6dc7e32 Disable systemd-resolved for multiple host. 2026-10-31 09:47:46 +01:00
chris 758739ec2b Update git_firewall_repository to use an empty array and add OpenVPN repository configuration 2026-10-30 21:25:57 +01:00
chris a0c99ae1ba Fix recursion configuration check in named.conf.options.gateway.j2 2026-10-30 21:23:57 +01:00
chris a99b593b67 Add network configuration and DNS settings for various hosts 
- Created a new configuration file for ga-al-gw-neu with detailed network interface settings and routing rules.
- Updated existing configurations for ga-al-gw, ga-gh-gw, ga-nh-gw, ga-st-gw-ersatz, ga-st-gw, and ga-st-mail to include additional DNS servers and correct domain controller IPs.
- Disabled systemd-resolved for ga-st-mail to prevent conflicts with DNS settings.
- Added user definitions and SSH key configurations for default users across multiple hosts.
 2026-10-30 21:13:28 +01:00
chris 056038c780 update.. 2026-10-12 18:51:07 +02:00
chris 11eee62a3c add extrepo.yml: Workaround für einen ifupdown-Paketbug. 2026-08-28 17:21:44 +02:00
chris b50f65ed14 file-dissens-common.ym: add new user. remove old users. 2026-08-28 17:21:11 +02:00
chris e7a9c4b661 backup-common.yml: remove server-agr from daily backups. 2026-08-28 17:20:10 +02:00
chris b4a09a7b94 feat(ipt-firewall): add ipt-firewall configuration for mm-irights, mm-nd, and mm-rav hosts 2026-08-09 23:14:08 +02:00
chris 33e8368d76 Rnaem SSH keys. 2026-08-09 23:13:48 +02:00
chris 53e17715fd feat(mm-nd): add extra user configuration and sudoers for nd-admin 2026-08-09 23:09:35 +02:00
chris 845052a9db fix(o45): correct formatting in ipt-firewall configuration for a.mx.oopen.de 2026-08-09 00:37:29 +02:00
chris d94d28ca67 feat(mm-nd): update DNS settings and add cron jobs for service monitoring 2026-08-09 00:35:57 +02:00
chris fff295759c feat(o45): add ipt-firewall configuration for a.mx.oopen.de 2026-08-09 00:35:36 +02:00
chris ed45c5596c feat(o45): add configuration files and firewall settings for o45 host 2026-08-09 00:34:20 +02:00
chris c6205045c5 feat(o45): add configuration files for o45 host and update apt tasks for compatibility 2026-08-09 00:33:51 +02:00
chris 05cb840e6d feat(redis): replace apt update task with command to ensure compatibility 2026-08-09 00:33:03 +02:00
chris 80a4e33fc2 add user bauhofer 2026-08-07 19:32:41 +02:00
chris ead9de9bac feat: add workaround for cssh/Perl-Tk under Wayland to allow local X11 access 2026-08-07 12:54:52 +02:00
chris c4acc32add feat: update apt upgrade tasks to conditionally refresh cache based on apt_update variable 2026-08-07 11:43:28 +02:00
chris 6ba7c61cb7 fix(common): avoid localhost become prompts, stabilize redis apt upgrade, and lint handlers 2026-08-06 17:09:17 +02:00
chris 88f40fe0cd feat: update apt packages for webserver and add extra Python packages 2026-08-06 14:49:53 +02:00
chris 79a38027df set become false for localhost checks in users-systemfiles to prevent sudo timeout 2026-08-06 14:48:15 +02:00
chris 55f9a6f5b8 refactot encrytion- and decryption scripts. 2026-08-03 15:43:39 +02:00
chris a318e1258c Encrypt actual hosts file - outfile: hosts.BAK. 2026-08-03 15:42:50 +02:00
chris 19eafadac4 chore: remove obsolete playbooks and scripts 2026-08-03 12:36:38 +02:00
chris 5af310e55a fix: set changed_when to false for apt update command. 2026-07-31 13:09:11 +02:00
chris 965ad5cde2 fix: specify ansible.builtin.template for service file and configuration deployments 2026-07-30 23:48:29 +02:00
chris 9c6094cef8 add host ki-fm.oopen.de 2026-07-30 12:54:19 +02:00
chris 4f8e5f4454 fix(file-ah-common.yml): correct indentation for samba user group assignments 2026-07-30 01:53:06 +02:00
chris ca02faf748 fix(sshd_config.j2): update condition for SFTP subsystem configuration to use common variable 2026-07-30 01:38:49 +02:00
chris 1c1ae9464c fix(yum.yml): change package state to 'present' for consistency and improve comment clarity 2026-07-29 23:40:23 +02:00
chris 451baa5f9a fix(sudoers.yml): improve formatting of comments for clarity in sudoers configuration tasks 2026-07-29 23:34:58 +02:00
chris b87c60c41e fix(samba-remove-user.yml): enhance command structure and error handling for samba user removal tasks 2026-07-29 23:32:24 +02:00
chris e125f9952f fix(samba-user.yml): improve command structure and enhance error handling for samba user management 2026-07-29 23:30:04 +02:00
chris 71e9cf6551 fix(show.yml): improve formatting of hostname display message for clarity 2026-07-29 23:21:15 +02:00
chris fc9c1548c3 fix(sshd.yml): standardize variable names for SSHD configuration facts and improve clarity 2026-07-29 18:08:17 +02:00
chris b5a4edc181 fix(webadmin-user.yml): standardize variable names for local template directory references 2026-07-29 18:03:07 +02:00
chris fea739f0e6 fix(webadmin-user.yml): update inventory checks and standardize variable names for clarity 2026-07-29 17:53:55 +02:00
chris e72d9aac70 fix(users.yml): replace deprecated 'authorized_key' with 'ansible.posix.authorized_key' for improved compatibility 2026-07-29 17:46:31 +02:00
chris eece49f53b fix(users-systemfiles.yml): standardize variable names and improve clarity in user file checks and backups 2026-07-29 17:44:18 +02:00
chris b14e82c6c2 fix(git.yml): improve error handling and register results for backup and samba repositories 2026-07-29 17:31:36 +02:00
chris 56ba319f2f fix(redis-server.yml): standardize variable names and improve configuration clarity 2026-07-28 22:47:20 +02:00
chris c443ce7c79 fix(yml): update SSH keypair paths for ga-al-relay and ga-st-mail configurations 2026-07-28 22:47:03 +02:00
chris dc61dfc049 fix(yml): uncomment and standardize commented configuration options for clarity 2026-07-28 22:04:09 +02:00
chris 81e1f3fb3e fix(ntp.yml): standardize variable naming and replace command with copy module for backup 2026-07-28 22:03:46 +02:00
chris 86aec11206 fix(common.yml): update SSH keypair paths for b.mx and d.mx configurations 2026-07-28 21:55:46 +02:00
chris b3babf6831 fix(mail-common.yml): update SSH keypair paths and format email messages for clarity 2026-07-28 21:28:43 +02:00
chris 4d92340f9b chore(ansible): clean up host_vars YAML and normalize mail text blocks 2026-07-28 21:24:03 +02:00
chris ae60fa01a5 refactor(mx-common.yml): update paths for SSH keypair and file configurations 
delete: remove obsolete postfix configuration files for rate limiting and user info
 2026-07-28 02:16:07 +02:00
chris 9181734c51 fix(systemd-services): add condition to prevent service management for specific lxc_guest items 2026-07-28 01:52:41 +02:00
chris 1849c6d72d refactor(systemd-services): streamline service checks for Debian and RedHat OS 2026-07-28 01:24:58 +02:00
chris 5525fa3e73 refactor(systemd-resolved): rename facts to common_resolved variables for consistency 2026-07-28 01:10:41 +02:00
chris 5832d0b938 chore(main.yml): clear apt_remove list and comment out previous entries 2026-07-28 01:02:48 +02:00
chris 4310ae08b0 fix(copy_files.yml): correct formatting of template files task 2026-07-28 00:48:36 +02:00
chris 385b4a6802 refactor(copy_files.yml): simplify template file handling by removing redundant tasks 2026-07-28 00:46:19 +02:00
chris c30543280b feat(git.yml): enhance error handling for backup and samba server repository installations 2026-07-28 00:36:36 +02:00
chris 7e5fe673cf feat(postfwd.cf): add final=yes to rate limiting rules for enhanced message handling 2026-07-28 00:32:28 +02:00
chris 032ea670ef chore(main.yml): remove commented-out entries for authorized SSH keys 2026-07-28 00:13:02 +02:00
chris 00457b2ac7 chore(first-run.yml): remove obsolete first-run tasks for package installation 2026-07-28 00:11:19 +02:00
chris 095f5de034 feat(git.yml): enhance version handling for git repositories to prioritize 'master' if available 2026-07-28 00:02:49 +02:00
chris e60c1b81d1 feat(git.yml): add version handling for git repository installations 2026-07-27 22:16:45 +02:00
chris eb2c7cc15a chore(main.yml): set default git branch to main; Also includes various unrelated housekeeping updates in this file. 2026-07-27 22:16:27 +02:00
chris f39babaf5d feat(common): add host-tree file/template overrides and skip global items when host overrides exist 2026-07-27 21:55:27 +02:00
chris b40d3249fb Refactor variable names in samba-config-server.yml for consistency and clarity 2026-07-21 01:28:32 +02:00
chris 720fb84fb4 Refactor variable name for clarity and update condition in nfs.yml 2026-07-21 00:55:07 +02:00
chris 70eeebe4c4 roles/common/tasks/mysql.yml: remove trailing spaces. 2026-07-21 00:53:27 +02:00
chris baba4c4b7d Refactor variable names in motd.yml for consistency and clarity 2026-07-21 00:48:33 +02:00
chris ab4ef8f831 Refactor variable names in git.yml for consistency and clarity 2026-07-21 00:42:05 +02:00
chris 618eaa0bf7 Refactor variable names in cron.yml for consistency and clarity 2026-07-21 00:25:21 +02:00
chris 924e6bbf03 Refactor variable names in copy_files.yml for consistency and clarity 2026-07-21 00:24:25 +02:00
chris 03951153c1 Refactor caching-nameserver.yml for consistency and clarity in variable naming 2026-07-21 00:22:39 +02:00
chris ee5819c82c Remove update_cache parameter from util-linux-extra installation task in basic.yml 2026-07-20 23:52:43 +02:00
chris 062d1a6fc7 Refactor variable names in apt.yml for consistency and clarity 2026-07-20 23:48:19 +02:00
chris 81398e847e Refactor Ansible tasks to use fully qualified module names and improve code consistency 
- Updated all tasks to use fully qualified module names (e.g., ansible.builtin.shell, ansible.builtin.copy) for clarity and to avoid ambiguity.
- Replaced deprecated 'yum' module with 'dnf' for package management on RedHat-based systems.
- Improved formatting and consistency in task definitions, including the use of double quotes for strings and consistent indentation.
- Removed unnecessary comments and whitespace to enhance readability.
- Ensured that conditions and loops are consistently formatted across all tasks.
 2026-07-20 23:09:30 +02:00
chris bc330beebf Refactor Ansible tasks in basic.yml to use module prefixes and improve variable naming consistency 2026-07-20 22:57:13 +02:00
chris ba1d600cd8 Refactor ansible tasks in apt-gateway.yml to include module prefixes and improve variable naming consistency 2026-07-20 22:49:38 +02:00
chris de82385bec Add virus filter include and exclude file configurations for Samba shares 2026-07-20 17:42:15 +02:00
chris 509dc48851 Add unprotected interface configuration for Docker network in ipt-server.yml and new Samba share for Windows-Server-2025-Backup in common.yml 2026-07-20 11:00:53 +02:00
chris 88928adddb Remove debug task for displaying cron variables in cron.yml 2026-07-17 18:37:24 +02:00
chris ef7c88f64d Add host variable files for various hosts and update DNS configurations 
- Created `wiki-common.yml` for wiki.cadus.org with DNS settings and git repository configurations.
- Added `www-common.yml` for www.oopen.de including SFTP group creation and root user password.
- Introduced `zapata-alt-common.yml` for zapata-alt.opp.netz with network interface configurations, Samba user reorganize 'host_vars'
 2026-07-17 18:26:32 +02:00
chris ed8887e5be Add debug task to display cron variables and improve formatting in cron.yml 2026-07-17 18:24:56 +02:00
chris 4f7da3ae5d Add check for legacy /etc/apt/sources.list existence before backup in apt.yml 2026-07-17 18:24:14 +02:00
chris d68e39127a Add deb822 source templates for Debian backports and security repositories 2026-07-13 21:24:24 +02:00
chris 3ab7d16906 Update apt_initial_install_trixie: add bind9-dnsutils, man-db, python3 packages and remove duplicates 2026-07-13 21:23:50 +02:00