Browse Source
style and variables refactoring
- Coherent quotation style
Single quotes for text variable (even if implicit), no quotes for
variable and conditional statements, if not required.
- Some useful tags added:
* ssh_certs
renewal of server SSH certificates and configuration of authorized
CA.
* tls_pub
renewal of public TLS certificates (let's encrypt) and certbot
configuration.
* tls_int
renewal of internal TLS certificates (service authorizations) and
configuration of authorized internal CA.
*(ToDo: deployment of Certificate Revokation Lists)*
* lxc
deployment of new containers (deployment of configuration file
excluded, for instance change in ip address are always applied and
trigger a container restart even if you skip this tag.
* packages
installation and upgrade of software packages (apt, opkg or
tarballs)
* service_password
create new random password for services-only password, for routine
rotation. Not meant to be skipped (some roles need to know the
service password, so they do a rotation).
- prepare_host
- ssh_server
- lxc_guest
- ldap
- gitlab
- x509_subject_prefix
- x509_ldap_suffix
*Replaces:* x509_suffix in ldap.yaml
- letsencrypt_email
Used in roles/certbot and roles/gitlab
- root_ca_cert
*Replaces:* ssl_ca_cert and files/lilik_x1.crt
New defaults:
- ldap_domain | default: `${domain}`
- server_fqdn | default: `${hostname}.dmz.${domain}`
*Replaces:* fqdn_domain
Removed:
- fqdn_dmain
- x509_suffix
*Replaced by:* x509_ldap_suffix in common
New defaults:
- server_fqdn | default: `${hostname}.${domain}`
*Replaces*: fqdn
- ldap_domain | default: `${domain}`
- ldap_server | default: `ldap1.dmz.${domain}`
- ldap_basedn | default: `dn(${ldap_domain})`
- enable_https | default: `true`
New defaults:
- server_fqdn | default: `${hostname}.${domain}`
python3
21 changed files with 364 additions and 292 deletions
Split View
Diff Options
-
+8 -11ldap.yaml
-
+58 -51prepare_host.yaml
-
+10 -10projects.yaml
-
+2 -1roles/certbot/defaults/main.yaml
-
+29 -19roles/certbot/tasks/main.yaml
-
+11 -12roles/gitlab/README.md
-
+7 -4roles/gitlab/defaults/main.yaml
-
+32 -13roles/gitlab/tasks/main.yaml
-
+18 -4roles/gitlab/templates/gitlab.rb.j2
-
+16 -40roles/ldap/README.md
-
+2 -0roles/ldap/defaults/main.yaml
-
+9 -2roles/ldap/tasks/2_renew_rootpw.yaml
-
+32 -23roles/ldap/tasks/4_setup_tls.yaml
-
+5 -5roles/ldap/tasks/main.yaml
-
+23 -12roles/lxc_guest/tasks/main.yaml
-
+2 -1roles/nginx/defaults/main.yml
-
+4 -3roles/nginx/handlers/main.yaml
-
+1 -1roles/nginx/meta/main.yaml
-
+26 -24roles/nginx/tasks/main.yaml
-
+55 -56roles/reverse_proxy/tasks/main.yaml
-
+14 -0roles/ssh_server/tasks/main.yaml
+ 8
- 11
ldap.yaml
View File
+ 58
- 51
prepare_host.yaml
View File
| @ -1,79 +1,86 @@ | |||
| --- | |||
| - hosts: vm_hosts | |||
| - hosts: 'vm_hosts' | |||
| roles: | |||
| - role: ssh_server | |||
| - role: 'ssh_server' | |||
| vars: | |||
| management_vlan: 9 | |||
| virtual_machine_vlan: 13 | |||
| virtual_machine_vlan: 5 | |||
| tasks: | |||
| - name: install lxc related packages | |||
| - name: 'install lxc related packages' | |||
| apt: | |||
| pkg: | |||
| - lxc | |||
| - python3 | |||
| - python3-lxc | |||
| state: present | |||
| update_cache: yes | |||
| - 'lxc' | |||
| - 'python3' | |||
| - 'python3-lxc' | |||
| state: 'present' | |||
| update_cache: true | |||
| cache_valid_time: 3600 | |||
| tags: | |||
| - 'packages' | |||
| - name: install common lxc filesystem support | |||
| - name: 'install common lxc filesystem support' | |||
| apt: | |||
| name: xfsprogs | |||
| state: present | |||
| notify: load xfs module | |||
| name: 'xfsprogs' | |||
| state: 'present' | |||
| notify: 'load xfs module' | |||
| tags: | |||
| - 'packages' | |||
| - name: autoload xfs module | |||
| - name: 'autoload xfs module' | |||
| copy: | |||
| content: "xfs\n" | |||
| dest: /etc/modules-load.d/xfs.conf | |||
| notify: load xfs module | |||
| content: 'xfs\n' | |||
| dest: '/etc/modules-load.d/xfs.conf' | |||
| notify: 'load xfs module' | |||
| - name: install network bridge utilities | |||
| - name: 'install network bridge utilities' | |||
| apt: | |||
| pkg: | |||
| - bridge-utils | |||
| - vlan | |||
| state: present | |||
| update_cache: yes | |||
| cache_valid_time: 3600 | |||
| notify: restart networking | |||
| # We should fix this bug. We really should. It's a bug. | |||
| # Bridge-utils requires a complete system reboot to enable the new bridge. | |||
| - name: configure network bridge with vlans | |||
| template: | |||
| src: templates/interfaces.j2 | |||
| dest: /etc/network/interfaces | |||
| notify: restart networking | |||
| - 'bridge-utils' | |||
| - 'vlan' | |||
| state: 'present' | |||
| update_cache: true | |||
| cache_valid_time: '3600' | |||
| notify: 'restart networking' | |||
| tags: | |||
| - 'pacakges' | |||
| - name: 'configure network bridge with vlans' | |||
| template: | |||
| src: 'templates/interfaces.j2' | |||
| dest: '/etc/network/interfaces' | |||
| notify: 'restart networking' | |||
| - name: install utilities | |||
| - name: 'install utilities' | |||
| apt: | |||
| pkg: | |||
| - vim | |||
| - htop | |||
| state: present | |||
| update_cache: yes | |||
| - 'vim' | |||
| - 'htop' | |||
| state: 'present' | |||
| update_cache: true | |||
| cache_valid_time: 3600 | |||
| tags: | |||
| - 'packages' | |||
| - name: enable lvm wipe signature | |||
| - name: 'enable lvm wipe signature' | |||
| lineinfile: | |||
| dest: /etc/lvm/lvm.conf | |||
| state: present | |||
| line: " wipe_signatures_when_zeroing_new_lvs = 0" | |||
| dest: '/etc/lvm/lvm.conf' | |||
| state: 'present' | |||
| line: ' wipe_signatures_when_zeroing_new_lvs = 0' | |||
| regexp: '^\s*.+wipe_signatures_when_zeroing_new_lvs = ' | |||
| notify: restart lvm | |||
| notify: 'restart lvm' | |||
| handlers: | |||
| - name: restart networking | |||
| - name: 'restart networking' | |||
| service: | |||
| name: networking | |||
| state: restarted | |||
| - name: restart lvm | |||
| shell: /etc/init.d/lvm2 reload | |||
| - name: load xfs module | |||
| name: 'networking' | |||
| state: 'restarted' | |||
| - name: 'restart lvm' | |||
| command: '/etc/init.d/lvm2 reload' | |||
| - name: 'load xfs module' | |||
| modprobe: | |||
| name: xfs | |||
| state: present | |||
| name: 'xfs' | |||
| state: 'present' | |||
| - hosts: status | |||
| - hosts: 'status' | |||
| roles: | |||
| - role: icinga2-monitoring | |||
| - role: 'icinga2-monitoring' | |||
+ 10
- 10
projects.yaml
View File
+ 2
- 1
roles/certbot/defaults/main.yaml
View File
| @ -1,2 +1,3 @@ | |||
| --- | |||
| webserver_name: nginx | |||
| webserver_name: 'nginx' | |||
| ... | |||
+ 29
- 19
roles/certbot/tasks/main.yaml
View File
+ 11
- 12
roles/gitlab/README.md
View File
+ 7
- 4
roles/gitlab/defaults/main.yaml
View File
| @ -1,5 +1,8 @@ | |||
| fqdn: '{{ ansible_hostname }}.{{ domain }}' | |||
| --- | |||
| server_fqdn: '{{ ansible_hostname }}.{{ domain }}' | |||
| ssh_port: 8022 | |||
| ldap_server: ldap1.dmz.lilik.it | |||
| ldap_basedn: 'dc=lilik,dc=it' | |||
| enable_https: false | |||
| ldap_domain: '{{ domain }}' | |||
| ldap_server: 'ldap1.dmz.{{ domain }}' | |||
| ldap_basedn: 'dc={{ ldap_domain.replace(".", ",dc=") }}' | |||
| enable_https: true | |||
| ... | |||
+ 32
- 13
roles/gitlab/tasks/main.yaml
View File
+ 18
- 4
roles/gitlab/templates/gitlab.rb.j2
View File
+ 16
- 40
roles/ldap/README.md
View File
+ 2
- 0
roles/ldap/defaults/main.yaml
View File
| @ -1,4 +1,6 @@ | |||
| --- | |||
| ldap_domain: '{{ domain }}' | |||
| server_fqdn: '{{ ansible_hostname }}.dmz.{{ domain }}' | |||
| ldap_tls_enabled: true | |||
| renew_rootdn_pw: true | |||
| check_tree: true | |||
+ 9
- 2
roles/ldap/tasks/2_renew_rootpw.yaml
View File
+ 32
- 23
roles/ldap/tasks/4_setup_tls.yaml
View File
+ 5
- 5
roles/ldap/tasks/main.yaml
View File
| @ -1,16 +1,16 @@ | |||
| --- | |||
| - name: 'including configuration tasks' | |||
| include_tasks: '1_configure_server.yaml' | |||
| import_tasks: '1_configure_server.yaml' | |||
| - name: 'including password renewal tasks' | |||
| include_tasks: '2_renew_rootpw.yaml' | |||
| when: renew_rootdn_pw | |||
| import_tasks: '2_renew_rootpw.yaml' | |||
| tags: service_password | |||
| - name: 'including tree provisionig tasks' | |||
| include_tasks: '3_provision_tree.yaml' | |||
| import_tasks: '3_provision_tree.yaml' | |||
| when: check_tree | |||
| - name: 'including tls tasks' | |||
| include_tasks: '4_setup_tls.yaml' | |||
| import_tasks: '4_setup_tls.yaml' | |||
| when: ldap_tls_enabled | |||
| ... | |||
+ 23
- 12
roles/lxc_guest/tasks/main.yaml
View File
+ 2
- 1
roles/nginx/defaults/main.yml
View File
| @ -1,2 +1,3 @@ | |||
| --- | |||
| server_fqdn: "{{ ansible_hostname }}.lilik.it" | |||
| server_fqdn: '{{ ansible_hostname }}.{{ domain }}' | |||
| ... | |||
+ 4
- 3
roles/nginx/handlers/main.yaml
View File
| @ -1,4 +1,5 @@ | |||
| --- | |||
| - name: validate nginx configuration | |||
| command: nginx -t -c /etc/nginx/nginx.conf | |||
| changed_when: False | |||
| - name: 'validate nginx configuration' | |||
| command: 'nginx -t -c /etc/nginx/nginx.conf' | |||
| changed_when: false | |||
| ... | |||
+ 1
- 1
roles/nginx/meta/main.yaml
View File
| @ -1,3 +1,3 @@ | |||
| --- | |||
| dependencies: | |||
| - role: certbot | |||
| - role: 'certbot' | |||
+ 26
- 24
roles/nginx/tasks/main.yaml
View File
+ 55
- 56
roles/reverse_proxy/tasks/main.yaml
View File
| @ -1,77 +1,76 @@ | |||
| --- | |||
| - name: add https configs to nginx | |||
| - name: 'add https configs to nginx' | |||
| blockinfile: | |||
| dest: /etc/nginx/nginx.conf | |||
| dest: '/etc/nginx/nginx.conf' | |||
| block: | | |||
| stream { | |||
| stream { | |||
| map $ssl_preread_server_name $name { | |||
| include /etc/nginx/map.conf.d/*.conf; | |||
| } | |||
| include /etc/nginx/upstream.conf.d/*.conf; | |||
| map $ssl_preread_server_name $name { | |||
| include /etc/nginx/map.conf.d/*.conf; | |||
| } | |||
| include /etc/nginx/upstream.conf.d/*.conf; | |||
| log_format stream_routing '$remote_addr [$time_local] ' | |||
| 'with SNI name "$ssl_preread_server_name" ' | |||
| 'proxying to "$name" ' | |||
| '$protocol $status $bytes_sent $bytes_received ' | |||
| '$session_time'; | |||
| server { | |||
| listen {{ public_ip }}:443; | |||
| ssl_preread on; | |||
| proxy_pass $name; | |||
| access_log /var/log/nginx/stream_443.log stream_routing; | |||
| } | |||
| } | |||
| delegate_to: reverse_proxy | |||
| log_format stream_routing '$remote_addr [$time_local] ' | |||
| 'with SNI name "$ssl_preread_server_name" ' | |||
| 'proxying to "$name" ' | |||
| '$protocol $status $bytes_sent $bytes_received ' | |||
| '$session_time'; | |||
| server { | |||
| listen {{ public_ip }}:443; | |||
| ssl_preread on; | |||
| proxy_pass $name; | |||
| # Pass original Client IP with PROXY PROTOCOL | |||
| access_log /var/log/nginx/stream_443.log stream_routing; | |||
| } | |||
| } | |||
| delegate_to: 'reverse_proxy' | |||
| notify: reload nginx | |||
| - name: add http configs to nginx | |||
| - name: 'add http configs to nginx' | |||
| lineinfile: | |||
| dest: /etc/nginx/nginx.conf | |||
| dest: '/etc/nginx/nginx.conf' | |||
| insertafter: '^http {' | |||
| line: 'include /etc/nginx/http.conf.d/*.conf;' | |||
| delegate_to: reverse_proxy | |||
| notify: reload nginx | |||
| delegate_to: 'reverse_proxy' | |||
| notify: 'reload nginx' | |||
| - name: Create the http.conf directory for nginx | |||
| - name: 'create the http.conf.d directory for nginx' | |||
| file: | |||
| state: directory | |||
| dest: "/etc/nginx/http.conf.d" | |||
| delegate_to: reverse_proxy | |||
| notify: reload nginx | |||
| state: 'directory' | |||
| dest: '/etc/nginx/http.conf.d' | |||
| delegate_to: 'reverse_proxy' | |||
| notify: 'reload nginx' | |||
| - name: Upload http to reverse proxy | |||
| - name: 'upload http to reverse proxy' | |||
| template: | |||
| src: http.j2 | |||
| dest: "/etc/nginx/http.conf.d/http_{{ hostname }}.conf" | |||
| delegate_to: reverse_proxy | |||
| notify: reload nginx | |||
| src: 'http.j2' | |||
| dest: '/etc/nginx/http.conf.d/http_{{ hostname }}.conf' | |||
| delegate_to: 'reverse_proxy' | |||
| notify: 'reload nginx' | |||
| - name: Create the map.conf directory for nginx | |||
| - name: 'create the map.conf directory for nginx' | |||
| file: | |||
| state: directory | |||
| dest: "/etc/nginx/map.conf.d" | |||
| delegate_to: reverse_proxy | |||
| notify: reload nginx | |||
| state: 'directory' | |||
| dest: '/etc/nginx/map.conf.d' | |||
| delegate_to: 'reverse_proxy' | |||
| notify: 'reload nginx' | |||
| - name: Create the upstream.conf directory for nginx | |||
| - name: 'create the upstream.conf directory for nginx' | |||
| file: | |||
| state: directory | |||
| dest: "/etc/nginx/upstream.conf.d" | |||
| delegate_to: reverse_proxy | |||
| notify: reload nginx | |||
| state: 'directory' | |||
| dest: '/etc/nginx/upstream.conf.d' | |||
| delegate_to: 'reverse_proxy' | |||
| notify: 'reload nginx' | |||
| - name: Upload mappings to reverse proxy | |||
| - name: 'upload mappings to reverse proxy' | |||
| template: | |||
| src: map.j2 | |||
| dest: "/etc/nginx/map.conf.d/map_{{ hostname }}.conf" | |||
| delegate_to: reverse_proxy | |||
| notify: reload nginx | |||
| src: 'map.j2' | |||
| dest: '/etc/nginx/map.conf.d/map_{{ hostname }}.conf' | |||
| delegate_to: 'reverse_proxy' | |||
| notify: 'reload nginx' | |||
| - name: Upload upstream to reverse proxy | |||
| - name: 'upload upstream to reverse proxy' | |||
| template: | |||
| src: upstream.j2 | |||
| dest: "/etc/nginx/upstream.conf.d/upstream_{{ hostname }}.conf" | |||
| delegate_to: reverse_proxy | |||
| notify: reload nginx | |||
| src: 'upstream.j2' | |||
| dest: '/etc/nginx/upstream.conf.d/upstream_{{ hostname }}.conf' | |||
| delegate_to: 'reverse_proxy' | |||
| notify: 'reload nginx' | |||