feat(ipt-firewall): add ipt-firewall configuration for mm-irights, mm-nd, and mm-rav hosts

ansible.cfg

@@ -40,7 +40,7 @@
 inventory = ./hosts
 remote_user = chris
 roles_path = ./roles
-vault_password_file = open_the_vault.sh
+vault_password_file = oopen-server_the_vault.sh
 #retry_files_enabled = False
 #allow_world_readable_tmpfiles = True
 #interpreter_python: auto

decrypt-interactiv.sh

@@ -1,26 +1,203 @@
 #!/usr/bin/env bash
+#
+# decrypt-interactiv.sh
+#
+# Zweck:
+#   - Entschluesselt entweder:
+#       (A) eine komplett mit ansible-vault verschluesselte Datei (ANSIBLE_VAULT Header)
+#       (B) einzelne YAML "!vault |" Bloecke in einer Datei (z.B. group_vars/host_vars)
+#       (C) einen einzelnen verschluesselten String (Argument, Pipe oder interaktiv)
+#
+# Passwort wird einmalig interaktiv abgefragt.
+#
 
-# Prüfen, ob ein Dateiname als Argument übergeben wurde
+set -euo pipefail
-if [ -z "$1" ]; then
+
-  echo "Usage: $0 <filename>"
+# Temporare Datei fuer das einmalig abgefragte Vault-Passwort.
-  exit 1
+VAULT_PASS_FILE=""
+
+cleanup() {
+  # Sicherheitsnetz: Temp-Datei immer entfernen, auch bei Fehler/Abbruch.
+  if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
+    rm -f "${VAULT_PASS_FILE}"
+  fi
+}
+
+ask_vault_password_once() {
+  # Passwort nur einmal pro Lauf abfragen und danach wiederverwenden.
+  if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
+    return 0
+  fi
+
+  if [[ ! -r /dev/tty ]]; then
+    echo "Error: No interactive TTY available for password prompt." >&2
+    return 1
+  fi
+
+  local pw1=""
+
+  # Wichtig: Passwort direkt vom Terminal lesen, nicht von stdin.
+  read -rsp "Vault password: " pw1 < /dev/tty
+  printf '\n' > /dev/tty
+
+  if [[ -z "${pw1}" ]]; then
+    echo "Error: Empty password is not allowed." >&2
+    return 1
+  fi
+
+  # Passwort in Datei speichern, damit ansible-vault es nicht interaktiv erwartet.
+  VAULT_PASS_FILE="$(mktemp)"
+  chmod 600 "${VAULT_PASS_FILE}"
+  printf '%s' "${pw1}" > "${VAULT_PASS_FILE}"
+
+  unset pw1
+}
+
+decrypt_with_prompted_password() {
+  # Alle decrypt-Aufrufe laufen zentral ueber diese Funktion.
+  ask_vault_password_once
+  ansible-vault decrypt --vault-password-file "${VAULT_PASS_FILE}" "$@" 2>/dev/null
+}
+
+########################################
+# Hilfe anzeigen
+########################################
+show_help() {
+  cat <<EOF
+Usage:
+  $(basename "$0") [OPTION] [INPUT]
+
+Decrypt modes:
+
+  1) Full vault-encrypted file (ANSIBLE_VAULT header):
+     $(basename "$0") secrets.vault
+
+  2) YAML file containing one or multiple "!vault |" blocks:
+     $(basename "$0") group_vars/all.yml
+
+  3) Encrypted vault string:
+     $(basename "$0") 'secret: !vault | \$ANSIBLE_VAULT;1.1;AES256 ...'
+     echo 'secret: !vault | ...' | $(basename "$0")
+
+  4) Interactive mode (paste, then Ctrl-D):
+     $(basename "$0")
+
+Options:
+  -h, --help   Show this help and exit
+
+Notes:
+  - This script prints decrypted values to stdout.
+  - Vault password is prompted once per script run.
+EOF
+}
+
+########################################
+# Hauptfunktion
+########################################
+vdecr() {
+  unset IFS
+
+  if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+    show_help
+    return 0
+  fi
+
+  if ! command -v ansible-vault >/dev/null 2>&1; then
+    echo "Error: ansible-vault not found in PATH." >&2
+    return 1
+  fi
+
+  ########################################
+  # Wenn ein Argument uebergeben wurde
+  ########################################
+  if [[ -n "${1:-}" ]]; then
+
+    # --- Fall 1: Argument ist eine Datei ---
+    if [[ -f "$1" ]]; then
+
+      if [[ "$(head -n1 "$1")" == "\$ANSIBLE_VAULT;1.1;AES256" ]]; then
+        decrypt_with_prompted_password "$1"
+        return 0
+      fi
+
+      printf 'Reading vault values from file...\n\n'
+
+      local parsing=0
+      local result=""
+      local name=""
+
+      local blue
+      local discard
+      blue="$(tput setaf 4 || true)"
+      discard="$(tput sgr0 || true)"
+
+      # Best-effort Parsing: Datei wird in Tokens zerlegt und !vault-Bloecke
+      # werden gesammelt, dann rekursiv als Stringinput entschluesselt.
+      while IFS= read -r token; do
+
+        if [[ "$(echo "$token" | grep -c "\!vault")" -gt 0 ]] && [[ $parsing -eq 0 ]]; then
+          parsing=1
+
+        elif [[ $parsing -eq 1 ]] && [[ "$(echo "$token" | grep -c ":")" -eq 0 ]]; then
+          result="$(printf "%s\n%s" "$result" "$token")"
+
+        else
+          if [[ -n "$result" ]]; then
+            printf "\n\n%s%s%s\n" "$blue" "$name" "$discard"
+            printf "%s" "$result" | vdecr
+            name=""
+            result=""
+            parsing=0
+          fi
+        fi
+
+        if [[ "$(echo "$token" | grep -c ":")" -eq 1 ]]; then
+          name="$token"
+        fi
+
+      done < <(tr -s '[:space:]' '\n' < "$1")
+
+      return 0
+    fi
+
+    # --- Fall 3: Argument ist ein String ---
+    local str="$1"
+
+  # --- Fall 4: String kommt per Pipe (stdin ist kein TTY) ---
+  elif [[ ! -t 0 ]]; then
+    local str
+    str="$(cat)"
+
+  # --- Fall 5: Interaktiv ---
+  else
+    printf 'Interactive mode. Paste encrypted string and press Ctrl-D two times to confirm.\n'
+    local str
+    str="$(cat)"
+    printf '\n'
+  fi
+
+  ########################################
+  # String entschluesseln
+  ########################################
+  # YAML-Deko entfernen und den Ciphertext in ein Format bringen,
+  # das ansible-vault decrypt direkt verarbeiten kann.
+  printf -- "%s" "$str" | \
+    sed 's/ /\n/g' | \
+    sed '/---\|^.*:\|\!vault\||\|^$/d' | \
+    decrypt_with_prompted_password
+
+  printf '\n'
+}
+
+# Aufraeumen erfolgt automatisch beim Verlassen des Skripts.
+trap cleanup EXIT
+
+########################################
+# Main
+########################################
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  show_help
+  exit 0
 fi
 
-DATEI="$1"
+vdecr "${1:-}"
-
-# Prüfen, ob ansible-vault existiert und ausführbar ist
-if ! command -v ansible-vault >/dev/null 2>&1; then
-  echo "Fehler: 'ansible-vault' ist nicht installiert oder nicht im PATH."
-  exit 2
-fi
-
-# Prüfen, ob die angegebene Datei existiert
-if [ ! -f "$DATEI" ]; then
-  echo "Fehler: Datei '$DATEI' existiert nicht."
-  exit 3
-fi
-
-# Befehl ausführen
-ansible-vault decrypt --ask-vault-pass "$DATEI"
-
-exit 0

decrypt-vault-strings-from-file.sh

@@ -75,6 +75,7 @@ vdecr() {
       if [[ "$(head -n1 "$1")" == "\$ANSIBLE_VAULT;1.1;AES256" ]]; then
         # Vollständige Datei entschlüsseln und ausgeben
         ansible-vault decrypt "$1" 2>/dev/null
+        echo "Decrypted file: $1" >&2
         return 0
       fi
 
@@ -133,6 +134,8 @@ vdecr() {
       # Tokenisierung nach Whitespace (ähnlich dem Original)
       done < <(tr -s '[:space:]' '\n' < "$1")
 
+      echo "Processed vault values from file: $1" >&2
+
       return 0
     fi
 

decrypt-vault-strings-from-file.sh.00

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-
-vdecr() {
-  unset IFS
-
-  if [[ -n "$1" ]]; then
-    if [[ -f "$1" ]]; then
-
-      if [[ $(head -n1 "$1") == "\$ANSIBLE_VAULT;1.1;AES256" ]]; then
-        cat "$1" | ansible-vault decrypt 2> /dev/null
-        return 0
-      fi
-      printf 'Reading vault values from file...\n\n'
-      local parsing=0
-      local result=""
-      local name=""
-      local blue=$(tput setaf 4)
-      local discard=$(tput sgr0)
-      for line in $(cat $1); do
-        if [[ $(echo "$line" | grep -c "\!vault") -gt 0 ]] && [[ $parsing -eq 0 ]]; then
-          parsing=1
-        elif [[ $parsing -eq 1 ]] && [[ $( echo $line | grep -c ":") -eq 0 ]]; then
-          result=$(printf "${result}\n${line}")
-        else
-          if [[ $result != "" ]]; then
-            printf "\n\n${blue}$name${discard}\n"
-            printf "$result" | vdecr
-            name=""
-            result=""
-            parsing=0
-          fi
-        fi
-        if  [[ $( echo "$line" | grep -c ":") -eq 1 ]]; then
-          name="$line"
-        fi
-      done
-      return 0
-    fi
-    local str="$1"
-  elif [[ ! -t 0 ]]; then
-    local str=$(cat)
-  else
-    printf 'Interactive mode. Paste encrypted string and press Ctrl-D two times to confirm.\n'
-    local str=$(cat)
-    printf '\n'
-  fi
-
-  printf -- "$str" | sed 's/ /\n/g' | \
-  sed '/---\|^.*:\|\!vault\||\|^$/d' | \
-  #ansible-vault decrypt --vault-password-file ~/.vault-pass 2> /dev/null
-  ansible-vault decrypt 2> /dev/null
-  printf '\n'
-}
-
-vdecr $1

encrypt-interactiv.sh

@@ -1,26 +1,244 @@
 #!/usr/bin/env bash
+#
+# encrypt-interactiv.sh
+#
+# Zweck:
+#   - Verschluesselt entweder:
+#       (A) ein komplettes File mit ansible-vault encrypt
+#       (B) YAML key: value Zeilen als key: !vault | Block
+#       (C) einen einzelnen String (Argument, Pipe oder interaktiv)
+#
+# Passwort wird einmalig interaktiv abgefragt.
+#
 
-# Prüfen, ob ein Dateiname als Argument übergeben wurde
+set -euo pipefail
-if [ -z "$1" ]; then
-  echo "Usage: $0 <filename>"
-  exit 1
-fi
 
-DATEI="$1"
+# Temp-Datei fuer das einmalig abgefragte Passwort.
+VAULT_PASS_FILE=""
+# Vault-ID fuer Encrypt-Operationen (bei Bedarf per ENV ueberschreibbar).
+VAULT_ID_LABEL="${VAULT_ID_LABEL:-default}"
 
-# Prüfen, ob ansible-vault existiert und ausführbar ist
+cleanup() {
-if ! command -v ansible-vault >/dev/null 2>&1; then
+  # Temp-Datei immer entfernen, auch bei Fehler/Abbruch.
-  echo "Fehler: 'ansible-vault' ist nicht installiert oder nicht im PATH."
+  if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
-  exit 2
+    rm -f "${VAULT_PASS_FILE}"
-fi
+  fi
+}
 
-# Prüfen, ob die angegebene Datei existiert
+ask_vault_password_once() {
-if [ ! -f "$DATEI" ]; then
+  # Passwort nur einmal pro Skriptlauf abfragen.
-  echo "Fehler: Datei '$DATEI' existiert nicht."
+  if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
-  exit 3
+    return 0
-fi
+  fi
 
-# Befehl ausführen
+  if [[ ! -r /dev/tty ]]; then
-ansible-vault encrypt --ask-vault-pass "$DATEI"
+    echo "Error: No interactive TTY available for password prompt." >&2
+    return 1
+  fi
 
-exit 0
+  local pw1=""
+  local pw2=""
+
+  # Wichtig: Passwort immer direkt vom Terminal lesen,
+  # nicht von stdin (stdin kann String/Pipe-Daten enthalten).
+  read -rsp "Vault password: " pw1 < /dev/tty
+  printf '\n' > /dev/tty
+  read -rsp "Confirm password: " pw2 < /dev/tty
+  printf '\n' > /dev/tty
+
+  if [[ -z "${pw1}" ]]; then
+    echo "Error: Empty password is not allowed." >&2
+    return 1
+  fi
+
+  if [[ "${pw1}" != "${pw2}" ]]; then
+    echo "Error: Password confirmation does not match." >&2
+    return 1
+  fi
+
+  VAULT_PASS_FILE="$(mktemp)"
+  chmod 600 "${VAULT_PASS_FILE}"
+  printf '%s' "${pw1}" > "${VAULT_PASS_FILE}"
+
+  unset pw1 pw2
+}
+
+encrypt_with_prompted_password() {
+  ask_vault_password_once
+  ansible-vault encrypt \
+    --encrypt-vault-id "${VAULT_ID_LABEL}" \
+    --vault-password-file "${VAULT_PASS_FILE}" \
+    "$@"
+}
+
+encrypt_string_with_prompted_password() {
+  ask_vault_password_once
+  ansible-vault encrypt_string \
+    --encrypt-vault-id "${VAULT_ID_LABEL}" \
+    --vault-password-file "${VAULT_PASS_FILE}" \
+    "$@"
+}
+
+########################################
+# Hilfe anzeigen
+########################################
+show_help() {
+cat <<EOF
+Usage:
+  $(basename "$0") [OPTION] [INPUT]
+
+Modes:
+
+  1) File encrypt (in-place):
+     $(basename "$0") secrets.txt
+
+  2) YAML file (key: value -> !vault block):
+     $(basename "$0") vars.yml
+     $(basename "$0") -o output.yml vars.yml
+
+  3) String encrypt:
+     $(basename "$0") 'mySecret'
+     echo 'mySecret' | $(basename "$0")
+     $(basename "$0")        (interactive mode)
+
+Options:
+  -o FILE     Write YAML output to FILE instead of stdout
+  -h, --help  Show this help and exit
+
+Notes:
+  - Simple "key: value" YAML lines will be converted.
+  - Already encrypted (!vault) entries are preserved.
+  - Full vault-encrypted files (ANSIBLE_VAULT header) are detected.
+  - Vault password is prompted once per script run.
+  - Vault ID defaults to "default" and can be changed via VAULT_ID_LABEL.
+
+EOF
+}
+
+########################################
+# Hauptfunktion
+########################################
+vencr() {
+
+  unset IFS
+
+  if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+    show_help
+    return 0
+  fi
+
+  if ! command -v ansible-vault >/dev/null 2>&1; then
+    echo "Error: ansible-vault not found in PATH." >&2
+    return 1
+  fi
+
+  ########################################
+  # Optionales Output-File (-o)
+  ########################################
+  local out_file=""
+  if [[ "${1:-}" == "-o" && -n "${2:-}" ]]; then
+    out_file="$2"
+    shift 2
+  fi
+
+  ########################################
+  # 1) File als Argument
+  ########################################
+  if [[ -n "${1:-}" && -f "$1" ]]; then
+    local f="$1"
+
+    if [[ "$(head -n1 "$f")" == "\$ANSIBLE_VAULT;1.1;AES256"* ]]; then
+      echo "File already encrypted (ANSIBLE_VAULT header found): $f" >&2
+      return 0
+    fi
+
+    if grep -Eq '^[[:space:]]*[A-Za-z0-9_.-]+:[[:space:]]*[^#].*$' "$f"; then
+      local tmpout
+      tmpout="$(mktemp)"
+
+      while IFS= read -r line || [[ -n "$line" ]]; do
+
+        if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
+          printf '%s\n' "$line" >> "$tmpout"
+          continue
+        fi
+
+        if echo "$line" | grep -q '\!vault'; then
+          printf '%s\n' "$line" >> "$tmpout"
+          continue
+        fi
+
+        if [[ "$line" =~ ^([[:space:]]*)([A-Za-z0-9_.-]+):[[:space:]]*(.+)$ ]]; then
+          local indent="${BASH_REMATCH[1]}"
+          local key="${BASH_REMATCH[2]}"
+          local value="${BASH_REMATCH[3]}"
+
+          if [[ "$value" == "|" || "$value" == ">" || "$value" == "" ]]; then
+            printf '%s\n' "$line" >> "$tmpout"
+            continue
+          fi
+
+          value="${value%\"}"; value="${value#\"}"
+          value="${value%\'}"; value="${value#\'}"
+
+          # Aus key: value wird ein key: !vault |-Block.
+          while IFS= read -r enc_line; do
+            printf '%s%s\n' "$indent" "$enc_line" >> "$tmpout"
+          done < <(
+            printf '%s' "$value" |
+            encrypt_string_with_prompted_password --stdin-name "$key"
+          )
+
+        else
+          printf '%s\n' "$line" >> "$tmpout"
+        fi
+
+      done < "$f"
+
+      if [[ -n "$out_file" ]]; then
+        mv "$tmpout" "$out_file"
+        echo "Encrypted YAML written to: $out_file" >&2
+      else
+        cat "$tmpout"
+        rm -f "$tmpout"
+      fi
+
+      return 0
+    fi
+
+    encrypt_with_prompted_password "$f"
+    echo "Encrypted file in-place: $f" >&2
+    return 0
+  fi
+
+  ########################################
+  # 2) String-Verschluesselung
+  ########################################
+  local str=""
+  local name="secret"
+
+  if [[ -n "${1:-}" ]]; then
+    str="$1"
+  elif [[ ! -t 0 ]]; then
+    str="$(cat)"
+  else
+    echo "Interactive mode."
+    read -r -p "Variable name (default: secret): " name_in
+    if [[ -n "$name_in" ]]; then
+      name="$name_in"
+    fi
+
+    echo "Paste plaintext and press Ctrl-D to confirm:"
+    str="$(cat)"
+    echo
+  fi
+
+  printf '%s' "$str" | encrypt_string_with_prompted_password --stdin-name "$name"
+}
+
+trap cleanup EXIT
+
+########################################
+# Script starten
+########################################
+vencr "$@"

encrypt-vault-string.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-read -r -s -p "String zum Verschlüsseln: " PLAINTEXT
-echo
-
-printf '%s' "$PLAINTEXT" | ansible-vault encrypt_string --stdin-name 'secret' 

encrypt-vault-strings-from-file.sh

@@ -31,6 +31,9 @@ Modes:
      $(basename "$0") vars.yml
      $(basename "$0") -o output.yml vars.yml
 
+      Force whole-file encryption for a YAML file:
+      $(basename "$0") --full-file vars.yml
+
   3) String encrypt:
      $(basename "$0") 'mySecret'
      echo 'mySecret' | $(basename "$0")
@@ -38,6 +41,7 @@ Modes:
 
 Options:
   -o FILE     Write YAML output to FILE instead of stdout
+  --full-file Encrypt the given file in-place, even if it is .yml/.yaml
   -h, --help  Show this help and exit
 
 Notes:
@@ -62,13 +66,37 @@ vencr() {
   fi
 
   ########################################
-  # Optionales Output-File (-o)
+  # Optionen: Ausgabe-Datei und Vollverschluesselung fuer YAML-Dateien.
   ########################################
   local out_file=""
-  if [[ "${1:-}" == "-o" && -n "${2:-}" ]]; then
+  local force_full_file=0
-    out_file="$2"
+  while [[ -n "${1:-}" && "${1:-}" == -* ]]; do
-    shift 2
+    case "$1" in
-  fi
+      -o)
+        if [[ -z "${2:-}" ]]; then
+          echo "Error: -o requires a file name." >&2
+          return 1
+        fi
+        out_file="$2"
+        shift 2
+        ;;
+      --full-file)
+        force_full_file=1
+        shift
+        ;;
+      -h|--help)
+        show_help
+        exit 0
+        ;;
+      --)
+        shift
+        break
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done
 
   ########################################
   # --- 1) File als Argument ---
@@ -82,8 +110,9 @@ vencr() {
       return 0
     fi
 
-    # Fall B: YAML mit key: value Zeilen
+    # Fall B: YAML mit key: value Zeilen nur fuer typische YAML-Dateien
-    if grep -Eq '^[[:space:]]*[A-Za-z0-9_.-]+:[[:space:]]*[^#].*$' "$f"; then
+    # (damit z.B. README.md als normale Datei komplett verschluesselt wird).
+    if [[ $force_full_file -eq 0 ]] && [[ "$f" =~ \.(yml|yaml)$ ]] && grep -Eq '^[[:space:]]*[A-Za-z0-9_.-]+:[[:space:]]*[^#].*$' "$f"; then
       local tmpout
       tmpout="$(mktemp)"
 

files/homedirs/chris/_bashrc

@@ -116,3 +116,9 @@ export EDITOR=vim
 # turn off the beep (only in bash tab-complete ?)
 # only if interactiv shell
 [[ "$-" =~ "i" ]] && bind 'set bell-style none'
+
+# Workaround für cssh/Perl-Tk unter Wayland: "Authorization required, but
+# no authorization protocol specified" (Debian Bug #1028370). Erlaubt dem
+# lokalen User pauschalen X11-Zugriff, ohne fehlerhaftes Cookie-Verfahren.
+#
+#xhost +SI:localuser:$(whoami) >/dev/null 2>&1

group_vars/all/main.yml

@@ -158,7 +158,7 @@ apt_manage_sources_list: true
 apt_src_enable: true
 apt_backports_enable: true
 
-apt_debian_mirror: http://ftp2.de.debian.org/debian/
+apt_debian_mirror: http://ftp.de.debian.org/debian/
 apt_debian_contrib_nonfree_enable: true
 
 # Ubuntu mirror
@@ -1728,87 +1728,88 @@ apt_webserver_pkgs:
 
 
 apt_webserver_pkgs_trixie:
-  - libdb-dev
+  - build-essential
-  - zlib1g
-  - zlib1g-dev
-  - libssl-dev
-  - libneon27-dev
-  - libxml2
-  - libxml2-dev
   - curl
-  - libcurl4-openssl-dev
-  - libqdbm-dev
-  - libgdbm-dev
-  - libpspell-dev
-  - libjpeg-dev
-  - libpng-dev
-  - libxpm-dev
-  - libfreetype6-dev
-  - libwmf-dev
-  - libtiff-dev
-  - libpaper-dev
-  - libmagic-dev
-  - libgraphics-magick-perl
-  - libgraphicsmagick++1-dev
-  - libgraphicsmagick-q16-3
-  - libgraphicsmagick1-dev
-  - libgraphviz-dev
-  - libgsf-1-dev
-  - libilmbase-dev
-  - libvpx-dev
-  - vpx-tools
-  - libgpm-dev
-  - libkpathsea-dev
-  - libopenexr-dev
-  - librsvg2-dev
-  - libdjvulibre-dev
-  - libatm-dev
-  - libexpat-dev
-  - imagemagick
-  - graphicsmagick
-  - exif
-  - libexiv2-dev
-  - re2c
-  - netpbm
-  - libnetpbm-dev
-  - libmcrypt-dev
-  - mcrypt
   - default-libmysqlclient-dev
-  - libpq-dev
+  - exif
-  - postgresql-client
+  - expect
-  - libreadline-dev
+  - expect-dev
-  - libncurses-dev
+  - ffmpeg
+  - graphicsmagick
+  - imagemagick
+  - libaio-dev
+  - libapr1-dev
+  - libaprutil1-dev
+  - libatm-dev
+  - libcrypto++-dev
+  - libcurl4-openssl-dev
   - libdb5.3
   - libdb5.3++
   - libdb5.3++-dev
   - libdb5.3-dev
-  - libxslt1-dev
+  - libdb-dev
-  - libpcre2-dev
+  - libdjvulibre-dev
-  - libicu-dev
+  - libexiv2-dev
-  - libtidy-dev
+  - libexpat-dev
-  - libmm-dev
+  - libexpect-perl
+  - libfreetype6-dev
+  - libgdbm-dev
+  - libgd-dev
+  - libgeoip-dev
   - libgmp-dev
+  - libgpm-dev
+  - libgraphicsmagick++1-dev
+  - libgraphicsmagick1-dev
+  - libgraphics-magick-perl
+  - libgraphicsmagick-q16-3
+  - libgraphviz-dev
+  - libgsf-1-dev
+  - libicu-dev
+  - libilmbase-dev
+  - libjpeg-dev
+  - libkpathsea-dev
   - libkrb5-dev
   - libldap-dev
-  - libmhash-dev
-  - libgd-dev
   - liblua5.3-dev
-  - libapr1-dev
+  - libmagic-dev
-  - libaprutil1-dev
-  - libsctp-dev
-  - libcrypto++-dev
-  - ffmpeg
   - libmagickwand-dev
-  - libgeoip-dev
+  - libmcrypt-dev
-  - libaio-dev
+  - libmhash-dev
-  - tk-dev
+  - libmm-dev
+  - libncurses-dev
+  - libneon27-dev
+  - libnetpbm-dev
+  - libopenexr-dev
+  - libpaper-dev
+  - libpcre2-dev
+  - libpng-dev
+  - libpq-dev
+  - libpspell-dev
+  - libqdbm-dev
+  - libreadline-dev
+  - librsvg2-dev
+  - libsctp-dev
+  - libssl-dev
+  - libtidy-dev
+  - libtiff-dev
+  - libvpx-dev
+  - libwmf-dev
+  - libxml2
+  - libxml2-dev
+  - libxpm-dev
+  - libxslt1-dev
+  - mcrypt
+  - netpbm
+  - poppler-utils
+  - postgresql-client
+  - re2c
   - tcl-dev
   - tclreadline
-  - expect
+  - tk-dev
-  - expect-dev
+  - vpx-tools
-  - libexpect-perl
-  - poppler-utils
   - weasyprint
+  - zlib1g
+  - zlib1g-dev
 
 #  - libc-client2007e-dev
 #  - libc-client-dev

host_vars/backup.oopen.de/backup-common.yml

@@ -299,6 +299,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDNIGI5HpfYnZCvDM3bf3UQti8SRhgL7wLu8LfxZLqwB root@meet.akweb.de'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoLG5tE0tHh+iFRzellU80eJTxZfqDB3e6Dg4XRKBrA root@meet.oopen.de'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF2bxZZNXrlsvERYo0VyXzdW1AZuGmsTNjgF4oQJNfnn root@mm-irights'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINy+3uf7VKQBQuXPeFSlSG4lcNbkCTysMhIideNTyMKr root@mm-nd'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILpKuS8DFuHHvfQZCHOGiurOvzlFkx1unnMfZWEM3wUY root@mm-rav'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMnwSzzSrAQJN3I0Y3xRU0rjlrO2KlHD3tFMgCqEyk0i root@mm'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILXSGiRst5AQ396FQY6jrr1jTCpwGDLWv5akw6SiMUGq root@nd-gate'
@@ -337,6 +338,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDW54VI+M5SjV6dQLew/IA31RI1GOneIqg5dI1/VZQgJ root@o42'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII2b60T/OXKCoze083GsHXuMFtm8Zo3WnCFb9Q9ofGie root@o43'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPytU2q7RmehrJyRnXRIZp7qcoswSANsClJP8v3zv6D7 root@o44'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFS0XtUKLgDqciQLr64VbtQSTlz7eHuvA8x9QZiAg9RA root@o45'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMUnxlKIffm8a5BmoQE40h8ut0R6eCxcm+Iewv3evmE9 root@oolm-shop'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF4ylglAkPst7G6kES2lE96ECp0AGXGjzCVkZSqGVru6 root@oolm-shop-dev'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUZ0WNd3rTqHH1tiXAELwssGw6xUP1ROdhgxKbMinYY root@oolm-web'

host_vars/file-ah.kanzlei-kiel.netz/file-ah-common.yml

@@ -472,6 +472,13 @@ samba_user:
       - gubitz-partner
     password: '20-heckert.22%'
 
+  - name: bauhofer
+    groups:
+      - buero
+      - intern
+      - verwaltung
+    password: '20-bau.hofer-26'
+
   - name: schultheis
     groups:
       - intern

host_vars/ki-fm.oopen.de/ki-fm-common.yml

@@ -25,6 +25,15 @@ sshd_permit_root_login: !!str "prohibit-password"
 # vars used by apt.yml
 # ---
 
+apt_install_extra_pkgs: true
+apt_extra_pkgs:
+  - python3
+  - python3-venv
+  - python3-pip
+  - build-essential
+  - libxml2-dev
+  - libxslt1-dev
+
 
 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml

host_vars/mm-irights.oopen.de/mm-irights-ipt-server.yml

@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "157.90.140.169"
+fw_ext_ips_v6:
+  - "2a01:4f8:2220:37c3::169"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip

host_vars/mm-nd.oopen.de/mm-nd-common.yml

@@ -0,0 +1,223 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+# resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+  - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+  - name: "Check if mattermost service is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_local_mattermost_service.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if mattermost service ist running - Restart Service if needed."
+    minute: '*/16'
+    hour: '*'
+    job: /root/bin/monitoring/check_local_mattermost_service.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '01'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+extra_user:
+
+  - name: nd-admin
+    user_id: 1045
+    group_id: 1045
+    group: nd-admin
+    password: $y$j9T$1YJwHY0qdLimgtdOKlTxR1$/O9QWTpr0Y41TduR2GZ0FMCiIxFqOaXWSM9hmHRnv80
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTjd4XFBdF/V9VdSZjy9G7nupBwaMqsrtQSP4Uctkrz org@rdsgn.de'
+
+sudo_users:
+  - chris
+  - sysadm
+  - nd-admin
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/mm-nd.oopen.de/mm-nd-ipt-server.yml

@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "135.181.239.139"
+fw_ext_ips_v6:
+  - "2a01:4f9:3080:3d2d::139"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip

host_vars/mm-rav.oopen.de/mm-rav-ipt-server.yml

@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "95.217.194.17"
+fw_ext_ips_v6:
+  - "2a01:4f9:4a:5114::17"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip

host_vars/mm.oopen.de/mm-ipt-server.yml

@@ -0,0 +1,41 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "159.69.74.147"
+fw_ext_ips_v6:
+  - "2a01:4f8:231:19a7::147"
+fw_local_interfaces:
+  - "eth1"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Outgoing / interfaces
+fw_unprotected_ifs: eth1
+
+# --- Access control IPv4
+fw_allow_local_service_v4: "8065:tcp"
+
+# --- Access control IPv6
+fw_allow_local_service_v6: "8065:tcp"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- Mattermost
+fw_mm_server_ips: $ext_1_ip
+
+# --- Protection / limits
+fw_limit_connections_per_source_IP: false

host_vars/o45.oopen.de/o45-common.yml

@@ -0,0 +1,328 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: true
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: false
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+
+
+network_interfaces:
+
+  - device: br0
+    # use only once per device (for the first device entry)
+    headline: br0 - bridge over device enp6s0
+
+    # auto & allow are only used for the first device entry
+    allow: [] # array of allow-[stanzas] eg. allow-hotplug
+    auto: true
+
+    family: inet
+    method: static
+    hwaddress: 08:bf:b8:a6:9b:96
+    description:
+    address: 135.181.239.145
+    netmask: 26
+    gateway: 135.181.239.129
+    metric:
+    pointopoint:
+    mtu:
+    scope:
+
+    # additional user by dhcp method
+    #
+    hostname:
+    leasehours:
+    leasetime:
+    vendor:
+    client:
+
+    # additional used by bootp method
+    #
+    bootfile:
+    server:
+    hwaddr:
+
+    # optional dns settings nameservers: []
+    #
+    #    nameservers:
+    #      - 194.150.168.168  # dns.as250.net
+    #      - 91.239.100.100   # anycast.censurfridns.dk
+    #    search: warenform.de
+    #
+    # ** MOVED TO systemd-resolved
+    #
+    nameservers:
+    search:
+
+    # optional bridge parameters bridge: {}
+    # bridge:
+    #   ports:
+    #   stp:
+    #   fd:
+    #   maxwait:
+    #   waitport:
+    bridge:
+      ports: eno1 # for mor devices support a blank separated list
+      stp: !!str off
+      fd: 5
+      hello: 2
+      maxage: 12
+
+    #  optional bonding parameters bond: {}
+    #  bond:
+    #    master
+    #    primary
+    #    slave
+    #    method:
+    #    miimon:
+    #    lacp-rate:
+    #    ad-select-rate:
+    #    master:
+    #    slaves:
+    bond: {}
+
+    # optional vlan settings | vlan: {}
+    # vlan: {}
+    #   raw-device: 'eth0'
+    vlan: {}
+
+    # inline hook scripts
+    pre-up: [] # pre-up script lines
+    up:
+      - !!str "route add -net 135.181.239.128 netmask 255.255.255.192 gw 135.181.239.129 dev br0" # up script lines
+    post-up: [] # post-up script lines (alias for up)
+    pre-down: [] # pre-down script lines (alias for down)
+    down:
+      - !!str "route del -net 135.181.239.128 netmask 255.255.255.192 gw 135.181.239.129 dev br0" # up script lines
+    post-down: [] # post-down script lines
+
+
+  - device: br0
+    family: inet6
+    method: static
+    address: '2a01:4f9:3080:3d2d::2'
+    netmask: 64
+    gateway: 'fe80::1'
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+apt_install_extra_pkgs: true
+apt_extra_pkgs:
+  - systemd-cryptsetup
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+# resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+  - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+  - name: "Check if Check if all autostart LX-Container are running."
+    special_time: reboot
+    job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh"
+    insertafter: PATH
+
+  - name: "Restart NTP service 'ntpsec'"
+    special_time: reboot
+    job: "sleep 2 ; /bin/systemctl restart ntpsec > /dev/null 2>&1"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check if NTP service 'ntpsec' is up and running?"
+    minute: '*/30'
+    hour: '*'
+    job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1
+
+  - name: "Check hard disc usage."
+    minute: '43'
+    hour: '6'
+    job: /root/bin/admin-stuff/check-disc-usage.sh -c 85
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/o45.oopen.de/o45-ipt-server.yml

@@ -0,0 +1,35 @@
+---
+# ipt-firewall configuration for a.mx.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "br0"
+fw_ext_ips_v4:
+  - "135.181.239.145"
+fw_ext_ips_v6:
+  - "2a01:4f9:3080:3d2d::2"
+
+fw_lxc_guest_ips_v4:
+  - "95.216.231.188"
+  - "135.181.239.139"
+  - "135.181.239.144"
+fw_lxc_guest_ips_v6:
+  - "2a01:4f9:3080:3d2d::139"
+  - "2a01:4f9:3080:3d2d::144"
+  - "a01:4f9:3080:3d2d::188"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Bridged / LXC
+fw_do_not_firewall_bridged_traffic: true
+fw_do_not_firewall_lx_guest_systems: true
+
+# --- Forwarding
+fw_kernel_activate_forwarding: true
+fw_kernel_forward_between_interfaces: true

host_vars/server23.warenform.de/server23-common.yml

@@ -238,6 +238,11 @@ cron_user_special_time_entries:
 
 cron_user_entries:
 
+  - name: "Check load on thi machine"
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_webservice_load.sh
+
   - name: "Check if SSH service is running. Restart service if needed."
     minute: '*/5'
     hour: '*'

hosts

@@ -303,6 +303,10 @@ test-nd.oopen.de
 o44.oopen.de
 cl-nd.oopen.de
 
+# o45 - mm matomom h.mc
+o45.oopen.de
+mm-nd.oopen.de
+
 # Hetzner  Cloud
 cl-nd-test.oopen.de
 
@@ -532,6 +536,10 @@ test-nd.oopen.de
 o44.oopen.de
 cl-nd.oopen.de
 
+# o45 - mm matomom h.mc
+o45.oopen.de
+mm-nd.oopen.de
+
 # Hetzner  Cloud
 cl-nd-test.oopen.de
 
@@ -948,6 +956,9 @@ psono-ndm.oopen.de
 # o29.oopen.de . Dissens
 cl-dissens.oopen.de
 
+# Hetzner cloud (CPX22) - Faire Mobilitaet
+ki-fm.oopen.de
+
 # Nextcloud / DokuWiki VBER
 o34.oopen.de
 
@@ -981,6 +992,9 @@ iam-nd.oopen.de
 prometheus-nd.oopen.de
 web-nd.oopen.de
 
+# o45 - ND
+mm-nd.oopen.de
+
 # GA - Gemeinschaft Altensclirf
 ga-st-services.ga.netz
 
@@ -1126,6 +1140,9 @@ keycloak-nd.oopen.de
 iam-nd.oopen.de
 prometheus-nd.oopen.de
 
+# o45 - ND
+mm-nd.oopen.de
+
 
 [mysql_server]
 
@@ -1603,6 +1620,9 @@ o43.oopen.de
 # ND - cloud
 o44.oopen.de
 
+# o45 - mm matomom h.mc
+o45.oopen.de
+
 
 lxc-host-kb.anw-kb.netz
 
@@ -1778,6 +1798,9 @@ test-nd.oopen.de
 # o44 - ND cloud
 cl-nd.oopen.de
 
+# o45 - ND
+mm-nd.oopen.de
+
 # Hetzner  Cloud
 cl-nd-test.oopen.de
 
@@ -2033,6 +2056,10 @@ test-nd.oopen.de
 o44.oopen.de
 cl-nd.oopen.de
 
+# o45 - mm matomom h.mc
+o45.oopen.de
+mm-nd.oopen.de
+
 # Hetzner  Cloud
 cl-nd-test.oopen.de
 

roles/ansible_dependencies-bookworm/tasks/main.yml

@@ -29,7 +29,7 @@
 - name: apt upgrade
   apt:
     upgrade: "{{ apt_upgrade_type }}"
-    update_cache: true
+    update_cache: "{{ not (apt_update | default(true) | bool) }}"
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when: apt_upgrade|bool
   tags:

roles/ansible_dependencies-bullseye/tasks/main.yml

@@ -32,7 +32,7 @@
 - name: apt upgrade
   apt:
     upgrade: "{{ apt_upgrade_type }}"
-    update_cache: true
+    update_cache: "{{ not (apt_update | default(true) | bool) }}"
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when: apt_upgrade|bool
   tags:

roles/ansible_dependencies-trixie/tasks/main.yml

@@ -56,7 +56,7 @@
 - name: Upgrade packages
   ansible.builtin.apt:
     upgrade: "{{ apt_upgrade_type | default('safe') }}"
-    update_cache: true
+    update_cache: "{{ not (apt_update | default(true) | bool) }}"
     dpkg_options: "{{ (apt_upgrade_dpkg_options | default(['force-confdef','force-confold'])) | join(',') }}"
   when: (apt_upgrade | default(false)) | bool
   tags: [ansible-dependencies]

roles/ansible_dependencies-ubuntu-noble/tasks/main.yml

@@ -32,7 +32,7 @@
 - name: apt upgrade
   apt:
     upgrade: "{{ apt_upgrade_type }}"
-    update_cache: true
+    update_cache: "{{ not (apt_update | default(true) | bool) }}"
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when: apt_upgrade|bool
   tags:

roles/ansible_dependencies/tasks/main.yml

@@ -32,7 +32,7 @@
 - name: apt upgrade
   apt:
     upgrade: "{{ apt_upgrade_type }}"
-    update_cache: true
+    update_cache: "{{ not (apt_update | default(true) | bool) }}"
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when: apt_upgrade|bool
   tags:

roles/common/handlers/main.yml

@@ -1,12 +1,14 @@
 ---
 
 - name: Update timezone
-  command: dpkg-reconfigure --frontend noninteractive tzdata
+  ansible.builtin.command:
+    cmd: dpkg-reconfigure --frontend noninteractive tzdata
+  changed_when: false
 
-#- name: Restart ssh
+# - name: Restart ssh
-#  shell: sleep 3; systemctl restart sshd
+#   shell: sleep 3; systemctl restart sshd
-#  async: 1
+#   async: 1
-#  poll: 0
+#   poll: 0
 
 # Does NOT Work
 #
@@ -14,108 +16,112 @@
 #    Start request repeated too quickly.
 #
 # See also: https://github.com/ansible/ansible-modules-core/issues/1533
-# 
+
 - name: Restart ssh
-  service:
+  ansible.builtin.service:
     name: ssh
     state: restarted
 
 - name: Reload nfs
-  service:
+  ansible.builtin.service:
     name: nfs-kernel-server
     state: reloaded
-    enabled: yes
+    enabled: true
   when:
     - "groups['nfs_server']|string is search(inventory_hostname)"
 
 - name: Restart postfix
-  service:
+  ansible.builtin.service:
     name: postfix
     state: restarted
 
 - name: Reload bind9
-  service:
+  ansible.builtin.service:
     name: bind9
     state: reloaded
-    enabled: yes
+    enabled: true
 
 
 - name: Restart smbd
-  service:
+  ansible.builtin.service:
     name: smbd
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
 
 - name: Restart nmbd
-  service:
+  ansible.builtin.service:
     name: nmbd
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
 
 - name: Reload samba config
-  shell: smbcontrol all reload-config
+  ansible.builtin.command:
+    cmd: smbcontrol all reload-config
+  changed_when: false
   when:
     - inventory_hostname in groups['samba_server']
 
 - name: Restart systemd-journald
-  service:
+  ansible.builtin.service:
     name: systemd-journald
     state: restarted
 
 - name: Restart redis-server
   vars:
     _daemon: "{{ 'redis' if ansible_facts['distribution'] == 'CentOS' else 'redis-server' }}"
-  service:
+  ansible.builtin.service:
     name: "{{ _daemon }}"
     state: restarted
 
 - name: Restart tor service
-  service: 
+  ansible.builtin.service:
     name: tor
     state: restarted
 
 - name: Reload tor service
-  service:
+  ansible.builtin.service:
     name: tor
     state: reloaded
 
 - name: Reload postfwd
-  service:
+  ansible.builtin.service:
     name: postfwd
     state: reloaded
 
 - name: Restart systemd-resolved
-  service:
+  ansible.builtin.service:
     name: systemd-resolved
     state: restarted
 
 - name: Restart nfs-kernel-server
-  service:
+  ansible.builtin.service:
     name: nfs-kernel-server
     state: restarted
 
 - name: Restart ntp
-  service:
+  ansible.builtin.service:
     name: ntpsec
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
 
 - name: Restart mariadb
-  service:
+  ansible.builtin.service:
     name: mariadb
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
 
 - name: Restart apache2
-  service:
+  ansible.builtin.service:
     name: apache2
-    daemon_reload: yes
+    daemon_reload: true
     state: restarted
 
 - name: Reload AppArmor profile clamd
-  command: apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd
+  ansible.builtin.command:
+    cmd: apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd
+  changed_when: false
 
 - name: Restart clamav-daemon
-  service:
+  ansible.builtin.service:
     name: clamav-daemon
     state: restarted

roles/common/tasks/apt.yml

@@ -166,10 +166,10 @@
     - apt-configuration
 
 - name: (apt.yml) apt update
-  ansible.builtin.apt:
+  ansible.builtin.command: apt-get update # noqa: command-instead-of-module
-    update_cache: true
-    cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}"
   changed_when: false
+  environment:
+    DEBIAN_FRONTEND: noninteractive
   when: apt_update|bool
   tags:
     - apt-update
@@ -196,7 +196,9 @@
 - name: (apt.yml) apt upgrade
   ansible.builtin.apt:
     upgrade: "{{ apt_upgrade_type }}"
-    update_cache: true
+    # Cache refresh happens in the apt update task above.
+    # Keep fallback refresh only if apt_update is disabled.
+    update_cache: "{{ not (apt_update | bool) }}"
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when: apt_upgrade|bool
   tags:

roles/common/tasks/basic.yml

@@ -224,28 +224,20 @@
   tags:
     - unattended-upgrades
 
-- name: (basic.yml) check if /etc/apt/apt.conf.d/20auto-upgrades exists
+- name: (basic.yml) configure auto-upgrades periodic settings
-  ansible.builtin.stat:
+  ansible.builtin.copy:
-    path: /etc/apt/apt.conf.d/20auto-upgrades
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
-  register: common_ua_enabled
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+    owner: root
+    group: root
+    mode: "0644"
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
     - unattended-upgrades
 
-- name: (basic.yml) activate unattended upgrades
-  ansible.builtin.command:
-    cmd: dpkg-reconfigure -plow unattended-upgrades
-    creates: /etc/apt/apt.conf.d/20auto-upgrades
-  environment:
-    DEBIAN_FRONTEND: noninteractive
-    DEBCONF_NONINTERACTIVE_SEEN: "true"
-  when:
-    - ansible_facts['distribution'] == "Debian"
-    - not common_ua_enabled.stat.exists
-  tags:
-    - unattended-upgrades
-
 - name: (basic.yml) copy apt-listchanges.conf
   ansible.builtin.template:
     src: etc/apt/listchanges.conf.j2

roles/common/tasks/caching-nameserver.yml

@@ -4,10 +4,10 @@
 # ---
 
 - name: (caching-nameserver.yml) update
-  ansible.builtin.apt:
+  ansible.builtin.command: apt-get update # noqa: command-instead-of-module
-    update_cache: true
-    cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}"
   changed_when: false
+  environment:
+    DEBIAN_FRONTEND: noninteractive
   when:
     - ansible_facts["distribution"] == "Debian"
     - apt_update|bool
@@ -28,7 +28,7 @@
 - name: (caching-nameserver.yml) upgrade
   ansible.builtin.apt:
     upgrade: "{{ apt_upgrade_type }}"
-    update_cache: true
+    update_cache: "{{ not (apt_update | bool) }}"
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when:
     - ansible_facts["distribution"] == "Debian"

roles/common/tasks/redis-server.yml

@@ -8,22 +8,6 @@
         else '/etc/redis/redis.conf'
       }}
 
-- name: (redis-server.yml) update
-  ansible.builtin.apt:
-    update_cache: true
-    cache_valid_time: >-
-      {{
-        0
-        if apt_config_updated is defined and apt_config_updated.changed
-        else apt_update_cache_valid_time
-      }}
-  changed_when: false
-  when:
-    - ansible_facts['distribution'] == "Debian"
-    - apt_update|bool
-  tags:
-    - redis-server
-
 - name: >-
     (redis-server.yml) Configure any half-installed packages
     'dpkg --configure -a'
@@ -37,10 +21,22 @@
   tags:
     - redis-server
 
+- name: (redis-server.yml) update
+  ansible.builtin.command: apt-get update # noqa: command-instead-of-module
+  changed_when: false
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+  when:
+    - ansible_facts['distribution'] == "Debian"
+    - apt_update|bool
+  tags:
+    - redis-server
+
 - name: (redis-server.yml) upgrade
   ansible.builtin.apt:
     upgrade: "{{ apt_upgrade_type }}"
-    update_cache: true
+    # apt cache refresh happens in the preceding redis update task
+    update_cache: false
     dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
   when:
     - ansible_facts['distribution'] == "Debian"

roles/common/tasks/users-systemfiles.yml

@@ -8,6 +8,7 @@
   ansible.builtin.stat:
     path: "{{ inventory_dir }}/files/homedirs/{{ user.name }}"
   delegate_to: localhost
+  become: false
   loop: "{{ default_user }}"
   loop_control:
     loop_var: user
@@ -19,6 +20,7 @@
   ansible.builtin.stat:
     path: "{{ inventory_dir }}/files/homedirs/root"
   delegate_to: localhost
+  become: false
   register: common_local_template_dir_root
 
 # --

roles/common/tasks/webadmin-user.yml

@@ -128,6 +128,7 @@
   ansible.builtin.stat:
     path: "{{ inventory_dir }}/files/homedirs/{{ item.name }}"
   delegate_to: localhost
+  become: false
   with_items: "{{ webadmin_user }}"
   loop_control:
     label: "{{ item.name }}"
@@ -268,6 +269,7 @@
   ansible.builtin.stat:
     path: "{{ inventory_dir }}/files/homedirs/webadmin/.vim"
   delegate_to: localhost
+  become: false
   register: common_local_template_dir_vim_webadmin
   with_items: "{{ webadmin_user }}"
   loop_control: