Compare commits
5 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 chris
|
d94d28ca67 | ||
|
chris
|
fff295759c | ||
|
chris
|
ed45c5596c | ||
|
chris
|
c6205045c5 | ||
|
chris
|
05cb840e6d |
@@ -158,7 +158,7 @@ apt_manage_sources_list: true
|
||||
apt_src_enable: true
|
||||
apt_backports_enable: true
|
||||
|
||||
apt_debian_mirror: http://ftp2.de.debian.org/debian/
|
||||
apt_debian_mirror: http://ftp.de.debian.org/debian/
|
||||
apt_debian_contrib_nonfree_enable: true
|
||||
|
||||
# Ubuntu mirror
|
||||
|
||||
@@ -299,6 +299,7 @@ default_user:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDNIGI5HpfYnZCvDM3bf3UQti8SRhgL7wLu8LfxZLqwB root@meet.akweb.de'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoLG5tE0tHh+iFRzellU80eJTxZfqDB3e6Dg4XRKBrA root@meet.oopen.de'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF2bxZZNXrlsvERYo0VyXzdW1AZuGmsTNjgF4oQJNfnn root@mm-irights'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINy+3uf7VKQBQuXPeFSlSG4lcNbkCTysMhIideNTyMKr root@mm-nd'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILpKuS8DFuHHvfQZCHOGiurOvzlFkx1unnMfZWEM3wUY root@mm-rav'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMnwSzzSrAQJN3I0Y3xRU0rjlrO2KlHD3tFMgCqEyk0i root@mm'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILXSGiRst5AQ396FQY6jrr1jTCpwGDLWv5akw6SiMUGq root@nd-gate'
|
||||
@@ -337,6 +338,7 @@ default_user:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDW54VI+M5SjV6dQLew/IA31RI1GOneIqg5dI1/VZQgJ root@o42'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII2b60T/OXKCoze083GsHXuMFtm8Zo3WnCFb9Q9ofGie root@o43'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPytU2q7RmehrJyRnXRIZp7qcoswSANsClJP8v3zv6D7 root@o44'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFS0XtUKLgDqciQLr64VbtQSTlz7eHuvA8x9QZiAg9RA root@o45'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMUnxlKIffm8a5BmoQE40h8ut0R6eCxcm+Iewv3evmE9 root@oolm-shop'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF4ylglAkPst7G6kES2lE96ECp0AGXGjzCVkZSqGVru6 root@oolm-shop-dev'
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUZ0WNd3rTqHH1tiXAELwssGw6xUP1ROdhgxKbMinYY root@oolm-web'
|
||||
|
||||
@@ -0,0 +1,205 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 185.12.64.2
|
||||
- 2a01:4ff:ff00::add:1
|
||||
- 185.12.64.1
|
||||
- 2a01:4ff:ff00::add:2
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- oopen.de
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
# ---
|
||||
|
||||
cron_env_entries:
|
||||
- name: PATH
|
||||
job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
|
||||
- name: SHELL
|
||||
job: /bin/bash
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
special_time: reboot
|
||||
job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
|
||||
insertafter: PATH
|
||||
|
||||
- name: "Check if postfix mailservice is running. Restart service if needed."
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
|
||||
insertafter: PATH
|
||||
|
||||
- name: "Check if mattermost service is running. Restart service if needed."
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /root/bin/monitoring/check_local_mattermost_service.sh > /dev/null 2>&1"
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
cron_user_entries:
|
||||
|
||||
- name: "Check if mattermost service ist running - Restart Service if needed."
|
||||
minute: '*/16'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_local_mattermost_service.sh
|
||||
|
||||
- name: "Check if SSH service is running. Restart service if needed."
|
||||
minute: '*/5'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_postfix.sh
|
||||
|
||||
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
|
||||
minute: '01'
|
||||
hour: '05'
|
||||
job: /var/lib/dehydrated/cron/dehydrated_cron.sh
|
||||
|
||||
- name: "Check whether all certificates are included in the VHOST configurations"
|
||||
minute: '33'
|
||||
hour: '05'
|
||||
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,328 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# vars used by roles/network_interfaces
|
||||
# ---
|
||||
|
||||
|
||||
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
|
||||
network_manage_devices: true
|
||||
|
||||
# Should the interfaces be reloaded after config change?
|
||||
network_interface_reload: false
|
||||
|
||||
network_interface_path: /etc/network/interfaces.d
|
||||
network_interface_required_packages:
|
||||
- vlan
|
||||
- bridge-utils
|
||||
- ifmetric
|
||||
- ifupdown
|
||||
- ifenslave
|
||||
|
||||
|
||||
network_interfaces:
|
||||
|
||||
- device: br0
|
||||
# use only once per device (for the first device entry)
|
||||
headline: br0 - bridge over device enp6s0
|
||||
|
||||
# auto & allow are only used for the first device entry
|
||||
allow: [] # array of allow-[stanzas] eg. allow-hotplug
|
||||
auto: true
|
||||
|
||||
family: inet
|
||||
method: static
|
||||
hwaddress: 08:bf:b8:a6:9b:96
|
||||
description:
|
||||
address: 135.181.239.145
|
||||
netmask: 26
|
||||
gateway: 135.181.239.129
|
||||
metric:
|
||||
pointopoint:
|
||||
mtu:
|
||||
scope:
|
||||
|
||||
# additional user by dhcp method
|
||||
#
|
||||
hostname:
|
||||
leasehours:
|
||||
leasetime:
|
||||
vendor:
|
||||
client:
|
||||
|
||||
# additional used by bootp method
|
||||
#
|
||||
bootfile:
|
||||
server:
|
||||
hwaddr:
|
||||
|
||||
# optional dns settings nameservers: []
|
||||
#
|
||||
# nameservers:
|
||||
# - 194.150.168.168 # dns.as250.net
|
||||
# - 91.239.100.100 # anycast.censurfridns.dk
|
||||
# search: warenform.de
|
||||
#
|
||||
# ** MOVED TO systemd-resolved
|
||||
#
|
||||
nameservers:
|
||||
search:
|
||||
|
||||
# optional bridge parameters bridge: {}
|
||||
# bridge:
|
||||
# ports:
|
||||
# stp:
|
||||
# fd:
|
||||
# maxwait:
|
||||
# waitport:
|
||||
bridge:
|
||||
ports: eno1 # for mor devices support a blank separated list
|
||||
stp: !!str off
|
||||
fd: 5
|
||||
hello: 2
|
||||
maxage: 12
|
||||
|
||||
# optional bonding parameters bond: {}
|
||||
# bond:
|
||||
# master
|
||||
# primary
|
||||
# slave
|
||||
# method:
|
||||
# miimon:
|
||||
# lacp-rate:
|
||||
# ad-select-rate:
|
||||
# master:
|
||||
# slaves:
|
||||
bond: {}
|
||||
|
||||
# optional vlan settings | vlan: {}
|
||||
# vlan: {}
|
||||
# raw-device: 'eth0'
|
||||
vlan: {}
|
||||
|
||||
# inline hook scripts
|
||||
pre-up: [] # pre-up script lines
|
||||
up:
|
||||
- !!str "route add -net 135.181.239.128 netmask 255.255.255.192 gw 135.181.239.129 dev br0" # up script lines
|
||||
post-up: [] # post-up script lines (alias for up)
|
||||
pre-down: [] # pre-down script lines (alias for down)
|
||||
down:
|
||||
- !!str "route del -net 135.181.239.128 netmask 255.255.255.192 gw 135.181.239.129 dev br0" # up script lines
|
||||
post-down: [] # post-down script lines
|
||||
|
||||
|
||||
- device: br0
|
||||
family: inet6
|
||||
method: static
|
||||
address: '2a01:4f9:3080:3d2d::2'
|
||||
netmask: 64
|
||||
gateway: 'fe80::1'
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_dependencies
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/ansible_user
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/basic.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sshd.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/apt.yml
|
||||
# ---
|
||||
|
||||
apt_install_extra_pkgs: true
|
||||
apt_extra_pkgs:
|
||||
- systemd-cryptsetup
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/systemd-resolved.yml
|
||||
# ---
|
||||
|
||||
systemd_resolved: true
|
||||
|
||||
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
|
||||
# Primäre DNS-Adresse: 38.132.106.139
|
||||
# Sekundäre DNS-Adresse: 194.187.251.67
|
||||
#
|
||||
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 1.1.1.1
|
||||
# IPv6: 2606:4700:4700::1111
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 1.0.0.1
|
||||
# IPv6: 2606:4700:4700::1001
|
||||
#
|
||||
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 8.8.8.8
|
||||
# IPv6: 2001:4860:4860::8888
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 8.8.4.4
|
||||
# IPv6: 2001:4860:4860::8844
|
||||
#
|
||||
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
|
||||
# primäre DNS-Adresse
|
||||
# IPv4: 9.9.9.9
|
||||
# IPv6: 2620:fe::fe
|
||||
# sekundäre DNS-Adresse
|
||||
# IPv4: 149.112.112.112
|
||||
# IPv6: 2620:fe::9
|
||||
#
|
||||
# OpenNIC - https://www.opennic.org/
|
||||
# IPv4: 195.10.195.195 - ns31.de
|
||||
# IPv4: 94.16.114.254 - ns28.de
|
||||
# IPv4: 51.254.162.59 - ns9.de
|
||||
# IPv4: 194.36.144.87 - ns29.de
|
||||
# IPv6: 2a00:f826:8:2::195 - ns31.de
|
||||
#
|
||||
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
|
||||
# IPv4: 5.1.66.255
|
||||
# IPv6: 2001:678:e68:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# IPv4: 185.150.99.255
|
||||
# IPv6: 2001:678:ed0:f000::
|
||||
# Servername für DNS-over-TLS: dot.ffmuc.net
|
||||
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
|
||||
resolved_nameserver:
|
||||
- 185.12.64.1
|
||||
- 2a01:4ff:ff00::add:2
|
||||
- 185.12.64.2
|
||||
- 2a01:4ff:ff00::add:1
|
||||
|
||||
# search domains
|
||||
#
|
||||
# If there are more than one search domains, then specify them here in the order in which
|
||||
# the resolver should also search them
|
||||
#
|
||||
# resolved_domains: []
|
||||
resolved_domains:
|
||||
- ~.
|
||||
- oopen.de
|
||||
|
||||
resolved_dnssec: false
|
||||
|
||||
# dns.as250.net: 194.150.168.168
|
||||
#
|
||||
resolved_fallback_nameserver:
|
||||
- 194.150.168.168
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/cron.yml
|
||||
# ---
|
||||
|
||||
cron_env_entries:
|
||||
- name: PATH
|
||||
job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
|
||||
- name: SHELL
|
||||
job: /bin/bash
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
cron_user_special_time_entries:
|
||||
|
||||
- name: "Restart DNS Cache service 'systemd-resolved'"
|
||||
special_time: reboot
|
||||
job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
|
||||
insertafter: PATH
|
||||
|
||||
- name: "Check if postfix mailservice is running. Restart service if needed."
|
||||
special_time: reboot
|
||||
job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
|
||||
insertafter: PATH
|
||||
|
||||
- name: "Check if Check if all autostart LX-Container are running."
|
||||
special_time: reboot
|
||||
job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh"
|
||||
insertafter: PATH
|
||||
|
||||
- name: "Restart NTP service 'ntpsec'"
|
||||
special_time: reboot
|
||||
job: "sleep 2 ; /bin/systemctl restart ntpsec > /dev/null 2>&1"
|
||||
insertafter: PATH
|
||||
|
||||
|
||||
cron_user_entries:
|
||||
|
||||
- name: "Check if SSH service is running. Restart service if needed."
|
||||
minute: '*/5'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ssh.sh
|
||||
|
||||
- name: "Check if Postfix Mailservice is up and running?"
|
||||
minute: '*/15'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_postfix.sh
|
||||
|
||||
- name: "Check if NTP service 'ntpsec' is up and running?"
|
||||
minute: '*/30'
|
||||
hour: '*'
|
||||
job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1
|
||||
|
||||
- name: "Check hard disc usage."
|
||||
minute: '43'
|
||||
hour: '6'
|
||||
job: /root/bin/admin-stuff/check-disc-usage.sh -c 85
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/users-systemfiles.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/webadmin-user.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/sudoers.yml
|
||||
# ---
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/caching-nameserver.yml
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by scripts/reset_root_passwd.yml
|
||||
# ---
|
||||
|
||||
root_user:
|
||||
name: root
|
||||
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
|
||||
@@ -0,0 +1,36 @@
|
||||
---
|
||||
# ipt-firewall configuration for a.mx.oopen.de
|
||||
# Generated by extract-fw-host-vars.py - review before committing!
|
||||
# Place in: host_vars/<hostname>/ipt_firewall.yml
|
||||
|
||||
fw_manage_config: true
|
||||
|
||||
# --- Network
|
||||
fw_ext_interfaces:
|
||||
- "br0"
|
||||
fw_ext_ips_v4:
|
||||
- "135.181.239.145"
|
||||
fw_ext_ips_v6:
|
||||
- "2a01:4f9:3080:3d2d::2"
|
||||
|
||||
fw_lxc_guest_ips_v4:
|
||||
- "95.216.231.188"
|
||||
- "135.181.239.139"
|
||||
- "135.181.239.144"
|
||||
fw_lxc_guest_ips_v6:
|
||||
- "2a01:4f9:3080:3d2d::139"
|
||||
- "2a01:4f9:3080:3d2d::144"
|
||||
- "a01:4f9:3080:3d2d::188"
|
||||
|
||||
# --- Munin
|
||||
munin_remote_ipv4: 37.27.121.227
|
||||
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
|
||||
|
||||
# --- Bridged / LXC
|
||||
fw_do_not_firewall_bridged_traffic: true
|
||||
fw_do_not_firewall_lx_guest_systems: true
|
||||
|
||||
# --- Forwarding
|
||||
fw_kernel_activate_forwarding: true
|
||||
fw_kernel_forward_between_interfaces: true
|
||||
|
||||
@@ -303,6 +303,10 @@ test-nd.oopen.de
|
||||
o44.oopen.de
|
||||
cl-nd.oopen.de
|
||||
|
||||
# o45 - mm matomom h.mc
|
||||
o45.oopen.de
|
||||
mm-nd.oopen.de
|
||||
|
||||
# Hetzner Cloud
|
||||
cl-nd-test.oopen.de
|
||||
|
||||
@@ -532,6 +536,10 @@ test-nd.oopen.de
|
||||
o44.oopen.de
|
||||
cl-nd.oopen.de
|
||||
|
||||
# o45 - mm matomom h.mc
|
||||
o45.oopen.de
|
||||
mm-nd.oopen.de
|
||||
|
||||
# Hetzner Cloud
|
||||
cl-nd-test.oopen.de
|
||||
|
||||
@@ -984,6 +992,9 @@ iam-nd.oopen.de
|
||||
prometheus-nd.oopen.de
|
||||
web-nd.oopen.de
|
||||
|
||||
# o45 - ND
|
||||
mm-nd.oopen.de
|
||||
|
||||
# GA - Gemeinschaft Altensclirf
|
||||
ga-st-services.ga.netz
|
||||
|
||||
@@ -1129,6 +1140,9 @@ keycloak-nd.oopen.de
|
||||
iam-nd.oopen.de
|
||||
prometheus-nd.oopen.de
|
||||
|
||||
# o45 - ND
|
||||
mm-nd.oopen.de
|
||||
|
||||
|
||||
[mysql_server]
|
||||
|
||||
@@ -1606,6 +1620,9 @@ o43.oopen.de
|
||||
# ND - cloud
|
||||
o44.oopen.de
|
||||
|
||||
# o45 - mm matomom h.mc
|
||||
o45.oopen.de
|
||||
|
||||
|
||||
lxc-host-kb.anw-kb.netz
|
||||
|
||||
@@ -1781,6 +1798,9 @@ test-nd.oopen.de
|
||||
# o44 - ND cloud
|
||||
cl-nd.oopen.de
|
||||
|
||||
# o45 - ND
|
||||
mm-nd.oopen.de
|
||||
|
||||
# Hetzner Cloud
|
||||
cl-nd-test.oopen.de
|
||||
|
||||
@@ -2036,6 +2056,10 @@ test-nd.oopen.de
|
||||
o44.oopen.de
|
||||
cl-nd.oopen.de
|
||||
|
||||
# o45 - mm matomom h.mc
|
||||
o45.oopen.de
|
||||
mm-nd.oopen.de
|
||||
|
||||
# Hetzner Cloud
|
||||
cl-nd-test.oopen.de
|
||||
|
||||
|
||||
@@ -166,10 +166,10 @@
|
||||
- apt-configuration
|
||||
|
||||
- name: (apt.yml) apt update
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}"
|
||||
ansible.builtin.command: apt-get update # noqa: command-instead-of-module
|
||||
changed_when: false
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
when: apt_update|bool
|
||||
tags:
|
||||
- apt-update
|
||||
|
||||
@@ -224,28 +224,20 @@
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
- name: (basic.yml) check if /etc/apt/apt.conf.d/20auto-upgrades exists
|
||||
ansible.builtin.stat:
|
||||
path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
register: common_ua_enabled
|
||||
- name: (basic.yml) configure auto-upgrades periodic settings
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
- name: (basic.yml) activate unattended upgrades
|
||||
ansible.builtin.command:
|
||||
cmd: dpkg-reconfigure -plow unattended-upgrades
|
||||
creates: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
DEBCONF_NONINTERACTIVE_SEEN: "true"
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- not common_ua_enabled.stat.exists
|
||||
tags:
|
||||
- unattended-upgrades
|
||||
|
||||
- name: (basic.yml) copy apt-listchanges.conf
|
||||
ansible.builtin.template:
|
||||
src: etc/apt/listchanges.conf.j2
|
||||
|
||||
@@ -4,10 +4,10 @@
|
||||
# ---
|
||||
|
||||
- name: (caching-nameserver.yml) update
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
cache_valid_time: "{{ 0 if common_apt_config_updated is defined and common_apt_config_updated.changed else apt_update_cache_valid_time }}"
|
||||
ansible.builtin.command: apt-get update # noqa: command-instead-of-module
|
||||
changed_when: false
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
when:
|
||||
- ansible_facts["distribution"] == "Debian"
|
||||
- apt_update|bool
|
||||
|
||||
@@ -8,22 +8,6 @@
|
||||
else '/etc/redis/redis.conf'
|
||||
}}
|
||||
|
||||
- name: (redis-server.yml) update
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
cache_valid_time: >-
|
||||
{{
|
||||
0
|
||||
if apt_config_updated is defined and apt_config_updated.changed
|
||||
else apt_update_cache_valid_time
|
||||
}}
|
||||
changed_when: false
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- apt_update|bool
|
||||
tags:
|
||||
- redis-server
|
||||
|
||||
- name: >-
|
||||
(redis-server.yml) Configure any half-installed packages
|
||||
'dpkg --configure -a'
|
||||
@@ -37,10 +21,21 @@
|
||||
tags:
|
||||
- redis-server
|
||||
|
||||
- name: (redis-server.yml) update
|
||||
ansible.builtin.command: apt-get update # noqa: command-instead-of-module
|
||||
changed_when: false
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
when:
|
||||
- ansible_facts['distribution'] == "Debian"
|
||||
- apt_update|bool
|
||||
tags:
|
||||
- redis-server
|
||||
|
||||
- name: (redis-server.yml) upgrade
|
||||
ansible.builtin.apt:
|
||||
upgrade: "{{ apt_upgrade_type }}"
|
||||
# apt cache is refreshed in the preceding "update" task
|
||||
# apt cache refresh happens in the preceding redis update task
|
||||
update_cache: false
|
||||
dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
|
||||
when:
|
||||
|
||||
Reference in New Issue
Block a user