#+CAPTION: [[file:private/vars.yml][=private/vars.yml=]]
#+BEGIN_SRC conf :tangle private/vars.yml
-
private_net_cidr: 192.168.56.0/24
wild_net_cidr: 192.168.57.0/24
public_wg_net_cidr: 10.177.87.0/24
#+NAME: address-vars
#+CAPTION: ~address-vars~
#+BEGIN_SRC conf
-
core_addr_cidr: "{{ private_net_cidr | ansible.utils.ipaddr('1') }}"
gate_addr_cidr: "{{ private_net_cidr | ansible.utils.ipaddr('2') }}"
gate_wild_addr_cidr:
#+CAPTION: [[file:roles_t/all/tasks/main.yml][=roles_t/all/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/all/tasks/main.yml
-
- name: Install systemd-resolved.
become: yes
apt: pkg=systemd-resolved
#+CAPTION: [[file:roles_t/all/tasks/main.yml][=roles_t/all/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/all/tasks/main.yml
-
- name: Trust the institute CA.
become: yes
copy:
#+BEGIN_SRC conf :tangle roles_t/front/defaults/main.yml :noweb no-export :mkdirp yes
---
<<network-vars>>
+
<<address-vars>>
+
<<membership-rolls>>
#+END_SRC
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Configure hostname.
become: yes
copy:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Add {{ ansible_user }} to system groups.
become: yes
user:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Create monkey.
become: yes
user:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Install rsync.
become: yes
apt: pkg=rsync
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Install basic software.
become: yes
apt: pkg=unattended-upgrades
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Create user accounts.
become: yes
user:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Install server certificate/key.
become: yes
copy:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml :noweb no-export
-
- name: Install Postfix.
become: yes
apt: pkg=postfix
#+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
- name: New aliases.
become: yes
command: newaliases
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml :noweb no-export
-
- name: Install OpenDKIM.
become: yes
apt: pkg=opendkim
#+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
- name: Restart OpenDKIM.
become: yes
systemd:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml :noweb no-export
-
- name: Install Dovecot IMAPd.
become: yes
apt: pkg=dovecot-imapd
#+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
- name: Restart Dovecot.
become: yes
systemd:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml :noweb no-export
-
- name: Install Apache2.
become: yes
apt: pkg=apache2
#+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
- name: Restart Apache2.
become: yes
systemd:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Disable default vhosts.
become: yes
file:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Disable other-vhosts-access-log option.
become: yes
file:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Create UserDir.
become: yes
file:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Enable IP forwarding.
become: yes
copy:
#+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
- name: Reload sysctl.
become: yes
systemd:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Install Kamailio.
become: yes
apt: pkg=kamailio
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
- name: Create Kamailio/Systemd configuration drop.
become: yes
file:
#+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
- name: Reload Systemd.
become: yes
systemd:
#+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml :noweb no-export
-
- name: Configure Kamailio.
become: yes
copy:
#+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
- name: Restart Kamailio.
become: yes
systemd:
#+BEGIN_SRC conf :tangle roles_t/core/defaults/main.yml :noweb no-export :mkdirp yes
---
<<network-vars>>
+
<<address-vars>>
+
<<membership-rolls>>
#+END_SRC
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Configure hostname.
become: yes
copy:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Configure resolved.
become: yes
lineinfile:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install 10-lan.link.
become: yes
copy:
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: Reload networkd.
become: yes
command: networkctl reload
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install DHCP server.
become: yes
apt: pkg=isc-dhcp-server
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: Restart DHCP server.
become: yes
systemd:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml :noweb no-export
-
- name: Install BIND9.
become: yes
apt: pkg=bind9
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: Reload BIND9.
become: yes
systemd:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Add {{ ansible_user }} to system groups.
become: yes
user:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Create monkey.
become: yes
user:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install basic software.
become: yes
apt: pkg=unattended-upgrades
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Create user accounts.
become: yes
user:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install server certificate/key.
become: yes
copy:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install Chrony.
become: yes
apt: pkg=chrony
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: Restart Chrony.
become: yes
systemd:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml :noweb no-export
-
- name: Install Postfix.
become: yes
apt: pkg=postfix
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: Restart Postfix.
become: yes
systemd:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install institute email aliases.
become: yes
blockinfile:
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: New aliases.
become: yes
command: newaliases
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml :noweb no-export
-
- name: Install Dovecot IMAPd.
become: yes
apt: pkg=dovecot-imapd
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: Restart Dovecot.
become: yes
systemd:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml :noweb no-export
-
- name: Install fetchmail.
become: yes
apt: pkg=fetchmail
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Stop former user fetchmail services.
become: yes
systemd:
Otherwise the following task might be appropriate.
#+BEGIN_SRC conf
-
- name: Delete former user fetchmail services.
become: yes
file:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install Apache2.
become: yes
apt: pkg=apache2
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml :noweb no-export
-
- name: Install live web site.
become: yes
copy:
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: Restart Apache2.
become: yes
systemd:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: "Install Monkey's webupdate script."
become: yes
copy:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Enable IP forwarding.
become: yes
copy:
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: Reload sysctl.
become: yes
systemd:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install NAGIOS4.
become: yes
apt:
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: Reload NAGIOS4.
become: yes
systemd:
#+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
#+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
define command {
command_name inst_sensors
command_line /usr/local/sbin/inst_sensors
#+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
#+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
define host {
use linux-server
host_name gate
#+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
#+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
define service {
use generic-service
host_name gate
#+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
#+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
define service {
use generic-service
host_name gate
#+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
#+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
define service {
use generic-service
host_name gate
#+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
#+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
define service {
use generic-service
host_name gate
#+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
#+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
define service {
use generic-service
host_name gate
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install backup script.
become: yes
copy:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install packages required by Nextcloud.
become: yes
apt:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Enable Apache2 modules for Nextcloud.
become: yes
apache2_module:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install Nextcloud web configuration.
become: yes
copy:
#+CAPTION: [[file:roles_t/core/files/nextcloud.conf][=roles_t/core/files/nextcloud.conf=]]
#+BEGIN_SRC conf :tangle roles_t/core/files/nextcloud.conf
-
<Directory /var/www/html/>
<IfModule mod_rewrite.c>
RewriteEngine on
#+CAPTION: [[file:roles_t/core/files/nextcloud.conf][=roles_t/core/files/nextcloud.conf=]]
#+BEGIN_SRC conf :tangle roles_t/core/files/nextcloud.conf
-
<IfModule mod_headers.c>
Header always set \
Strict-Transport-Security "max-age=15552000; includeSubDomains"
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Add {{ ansible_user }} to web server group.
become: yes
user:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Create Nextcloud cron job.
become: yes
cron:
the following task can create Nextcloud's DB.
#+BEGIN_SRC conf
-
- name: Create Nextcloud DB.
become: yes
mysql_db:
created manually.
#+BEGIN_SRC conf
-
- name: Create Nextcloud DB user.
become: yes
mysql_user:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Link /var/www/nextcloud.
become: yes
file:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Set PHP memory_limit for Nextcloud.
become: yes
lineinfile:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Test for /Nextcloud/nextcloud/.
stat:
path: /Nextcloud/nextcloud
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Configure Nextcloud trusted domains.
become: yes
replace:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Configure Nextcloud memcache.
become: yes
lineinfile:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Configure Nextcloud for Pretty URLs.
become: yes
lineinfile:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Configure Nextcloud settings.
become: yes
lineinfile:
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Create /Nextcloud/dbbackup.cnf.
no_log: yes
become: yes
#+BEGIN_SRC conf :tangle roles_t/gate/defaults/main.yml :noweb no-export :mkdirp yes
---
<<network-vars>>
+
<<address-vars>>
#+END_SRC
#+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml
-
- name: Install 10-lan.link.
become: yes
copy:
#+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml
-
- name: Install 10-wild.link.
become: yes
copy:
#+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml
-
- name: Install 10-isp.link.
become: yes
copy:
#+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml
-
- name: Configure resolved.
become: yes
lineinfile:
#+CAPTION: [[file:roles_t/gate/handlers/main.yml][=roles_t/gate/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/gate/handlers/main.yml
-
- name: Reload Systemd.
become: yes
systemd:
#+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml :noweb no-export
-
- name: Install UFW.
become: yes
apt: pkg=ufw
#+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml
-
- name: Enable IP forwarding.
become: yes
copy:
#+CAPTION: [[file:roles_t/gate/handlers/main.yml][=roles_t/gate/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/gate/handlers/main.yml
-
- name: Reload sysctl.
become: yes
systemd:
#+BEGIN_SRC conf :tangle roles_t/campus/defaults/main.yml :noweb no-export :mkdirp yes
---
<<network-vars>>
+
<<address-vars>>
#+END_SRC
#+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
- name: Configure hostname.
become: yes
copy:
#+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
- name: Install timesyncd.
become: yes
apt: pkg=systemd-timesyncd
#+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
- name: Add {{ ansible_user }} to system groups.
become: yes
user:
#+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
- name: Install basic software.
become: yes
apt: pkg=unattended-upgrades
#+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml :noweb no-export
-
- name: Install Postfix.
become: yes
apt: pkg=postfix
#+CAPTION: [[file:roles_t/campus/handlers/main.yml][=roles_t/campus/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/campus/handlers/main.yml
-
- name: Restart Postfix.
become: yes
systemd:
#+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
- name: Set domain name.
become: yes
vars:
#+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
- name: Install NRPE.
become: yes
apt:
#+CAPTION: [[file:roles_t/campus/handlers/main.yml][=roles_t/campus/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/campus/handlers/main.yml
-
- name: Reload NRPE server.
become: yes
systemd:
#+CAPTION: [[file:inst][=inst=]]
#+BEGIN_SRC perl :tangle inst
-
sub note_missing_file_p ($);
sub note_missing_directory_p ($);
#+CAPTION: [[file:inst][=inst=]]
#+BEGIN_SRC conf :tangle inst
-
sub mysystem (@) {
my $line = join (" ", @_);
print "$line\n";
#+BEGIN_SRC conf :tangle roles_t/check-inst-vars/defaults/main.yml :noweb no-export :mkdirp yes
---
<<network-vars>>
+
<<address-vars>>
#+END_SRC
#+CAPTION: [[file:inst][=inst=]]
#+BEGIN_SRC perl :tangle inst
-
if (defined $ARGV[0] && $ARGV[0] eq "CA") {
die "usage: $0 CA" if @ARGV != 1;
die "Secret/CA/easyrsa: not an executable\n"
#+CAPTION: [[file:inst][=inst=]]
#+BEGIN_SRC perl :tangle inst
-
if (defined $ARGV[0] && $ARGV[0] eq "config") {
die "Secret/CA/easyrsa: not executable\n"
if ! -x "Secret/CA/easyrsa";
#+NAME: membership-rolls
#+CAPTION: ~membership-rolls~
#+BEGIN_SRC conf
-
membership_rolls:
- "../private/members.yml"
- "../private/members-empty.yml"
#+CAPTION: [[file:inst][=inst=]]
#+BEGIN_SRC perl :tangle inst
-
use YAML::XS qw(LoadFile DumpFile);
sub read_members_yaml () {
#+CAPTION: [[file:inst][=inst=]]
#+BEGIN_SRC perl :tangle inst
-
sub print_member ($$$) {
my ($out, $username, $member) = @_;
print $out " ", $username, ":\n";
#+CAPTION: [[file:inst][=inst=]]
#+BEGIN_SRC perl :tangle inst
-
sub valid_username (@);
sub shell_escape ($);
sub strip_vault ($);
#+CAPTION: [[file:inst][=inst=]]
#+BEGIN_SRC perl :tangle inst
-
use MIME::Base64;
sub write_wireguard ($);
#+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
- name: Install institute passwd command.
become: yes
template:
#+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
#+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
- name: Import root PGP key.
become: no
command: gpg --import /etc/root-pub.pem
#+CAPTION: [[file:inst][=inst=]]
#+BEGIN_SRC perl :tangle inst
-
if (defined $ARGV[0] && $ARGV[0] eq "old") {
my $user = valid_username (@ARGV);
my $yaml = read_members_yaml ();
#+CAPTION: [[file:inst][=inst=]]
#+BEGIN_SRC perl :tangle inst
-
die "usage: $0 [CA|config|new|pass|old|client] ...\n";
#+END_SRC
#+CAPTION: [[file:private/test-front-prep][=private/test-front-prep=]]
#+BEGIN_SRC sh :tangle private/test-front-prep :noweb no-export
-
( umask 377
echo "AJkzVxfTm/KvRjzTN/9X2jYy+CAugiwZfN5F3JTegms=" \
| sudo tee /etc/wireguard/private-key >/dev/null )
#+CAPTION: [[file:private/test-front-prep][=private/test-front-prep=]]
#+BEGIN_SRC sh :tangle private/test-front-prep :tangle-mode u=rwx,g=,o=
-
( cd /etc/network/; \
[ -f interfaces~ ] || sudo mv interfaces interfaces~ )
cat <<EOF | sudo tee /etc/network/interfaces >/dev/null
#+CAPTION: [[file:private/test-front-prep][=private/test-front-prep=]]
#+BEGIN_SRC sh :tangle private/test-front-prep
-
( cd front_ssh/; sudo cp -b ssh_host_* /etc/ssh/ )
#+END_SRC
#+CAPTION: [[file:private/test-gate-prep][=private/test-gate-prep=]]
#+BEGIN_SRC sh :tangle private/test-gate-prep
-
cat <<EOD | sudo tee /etc/systemd/network/10-lan.link >/dev/null
[Match]
MACAddress=08:00:27:f3:16:79
#+CAPTION: [[file:private/test-core-prep][=private/test-core-prep=]]
#+BEGIN_SRC sh :tangle private/test-core-prep
-
cat <<EOD | sudo tee /etc/systemd/network/10-lan.link >/dev/null
[Match]
MACAddress=08:00:27:b3:e5:5f
projects / Institute / commitdiff