back to singular

roles/server/files/distro

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+
+source /etc/os-release
+echo "${PRETTY_NAME}"

roles/server/files/sudoers

@@ -0,0 +1,2 @@
+Debian-snmp ALL = NOPASSWD: /etc/snmp/bind, /etc/snmp/fail2ban, /etc/snmp/docker-stats.sh, /etc/snmp/mailcow-dockerized-postfix, /etc/snmp/unbound, /etc/snmp/osupdate, /etc/snmp/distro
+Debian-snmp ALL = (postgres) NOPASSWD: /etc/snmp/postgres

roles/server/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: restart_snmpd
+  service:
+    name: "snmpd"
+    state: restarted

roles/server/tasks/main.yml

@@ -0,0 +1,23 @@
+---
+# Load distro specific variables
+- include_vars: "{{ ansible_distribution }}.yml"
+  tags: always
+  ignore_errors: True
+- include_vars: "{{ ansible_fqdn }}.yml"
+  ignore_errors: True
+
+- block:
+  - include_tasks: utilities/mta.yml
+  - include_tasks: utilities/netdata.yml
+    when: netdata is defined and netdata == true
+  - include_tasks: utilities/snmpd.yml
+  - include_tasks: utilities/glusterfs.yml
+    when:
+      - glusterfs is defined
+      - glusterfs == true
+  - include_tasks: system_setup/cron.yml
+  # - include_role:
+  #     name: base
+  #     tasks_from: users.yml
+
+# vim: ts=2 sw=2

roles/server/tasks/system_setup/cron.yml

@@ -0,0 +1,17 @@
+- name: server | system_setup | install cron (archlinux)
+  package:
+    name: "cronie"
+    state: latest
+  when: ansible_distribution == "Archlinux"
+
+- name: server | system_setup | cron
+  tags: cron
+  cron:
+    name: "{{ item.title }}"
+    user: root
+    hour: "{{ item.hour }}"
+    minute: "{{ item.minute }}"
+    job: "{{ item.job }}"
+  loop:
+    - { title: "Send me a list of upgradeable packages", job: "apt list --upgradable", hour: 0, minute: 0 }
+    - { title: "Backup", job: "/root/bin/backup_vps.bash", hour: 1, minute: 0 }

roles/server/tasks/system_setup/mail.yml

@@ -0,0 +1,8 @@
+- name: server | system_setup | create mail aliases
+  lineinfile:
+    path: "/etc/alias"
+    state: present
+    line: "root rene@tantooine.myfirewall.org"
+
+- name: server | system setup | generate aliases db
+  command: newaliases

roles/server/tasks/system_setup/swap.yml

@@ -0,0 +1,15 @@
+- block:
+  - name: server | system setup | create swapfile
+    command: "fallocate -l {{ ansible_facts['memtotal_mb'] / 4 | round }} /swapfile"
+  - name: server | system setup | format swapfile
+    filesystem:
+      fstype: swap
+      dev: "/swapfile" # required. Target path to device or image file.
+  - name: server | system setup | enable swap
+    command: "swapon /swapfile"
+  - name: server | system setup | edit fstab
+    lineinfile:
+      path: "/etc/fstab"
+      state: present
+      line: "/swapfile none swap sw 0 0"
+  when: ansible_facts['memory_mb']['swap']['total'] == '0'

roles/server/tasks/system_setup/sysctl.yml

@@ -0,0 +1,9 @@
+- name: server | system setup | sysctl
+  sysctl:
+    name: "{{ item.key }}"
+    value: "{{ item.value }}"
+    state: present
+    reload: yes
+  loop:
+    - { key: "vm.swappiness", value: "10"}
+    - { key: "vm.vfs_cache_pressure", value: "50"}

roles/server/tasks/utilities/glusterfs.yml

@@ -0,0 +1,10 @@
+- name: server | glusterfs | install glusterfs
+  package:
+    state: latest
+    name: "{{ item.package }}"
+  with_items: "{{ glusterfs_packages }}"
+
+- name: server | glusterfs | enable and start glusterd
+  service:
+    name: glusterd
+    state: started

roles/server/tasks/utilities/mta.yml

@@ -0,0 +1,17 @@
+- name: server | utilities | install {{ mta_package }}
+  package:
+    name: "{{ mta_package }}"
+    state: present
+  when: postfix is not defined or postfix == false
+
+- name: server | utitilies | configure {{ mta_package }}
+  lineinfile:
+    path: "/etc/ssmtp/ssmtp.conf" # required. The file to modify. Before Ansible 2.3 this option was only usable as I(dest), I(destfile) and I(name).
+    regexp: "{{ item.regex }}"
+    state: present
+    line: "{{ item.line }}"
+  loop:
+    - { regex: "^root=.*$", line: "root=rene@tantooine.myfirewall.org"}
+    - { regex: "^mailhub=.*", line: "mailhub=coruscant.universe.local"}
+    - { regex: "^hostname=.*", line: "hostname={{ ansible_fqdn }}"}
+  when: ansible_distribution in ["Debian", "Pop!_OS", "Ubuntu"]

roles/server/tasks/utilities/netdata.yml

@@ -0,0 +1,13 @@
+---
+- name: Install netdata
+  package:
+    name: netdata
+    state: present
+
+- name: Enable and start netdata service
+  service:
+    name: netdata
+    state: started
+    enabled: yes
+
+# vim: ts=2 sw=2

roles/server/tasks/utilities/snmpd.yml

@@ -0,0 +1,115 @@
+- include_vars: snmp_users.yml
+
+- name: server | snmpd | install package
+  package:
+    name: "{{ snmpd_package }}"
+    state: present
+
+- name: server | snmpd | install sudoers file
+  copy:
+    dest: "/etc/sudoers.d/10-debian-snmp"
+    src: "sudoers"
+    owner: "root"
+    group: "root"
+    mode: "0660"
+    validate: "visudo -cf %s"
+  when: ansible_distribution in ["Debian", "Ubuntu"]
+
+- name: server | snmpd | create /etc/snmp
+  file:
+    path: "/etc/snmp"
+    state: directory
+    owner: "root"
+    group: "root"
+
+- name: server | snmpd | insert anchors to snmpd.conf
+  blockinfile:
+    path: "{{ snmpd_conf }}"
+    create: true
+    marker: "# {mark} ANSIBLE MANAGED BLOCK"
+    block: |
+      ################################################################################
+      # SECTION: custom settings
+
+- name: server | snmpd | stop service
+  service:
+    name: "snmpd"
+    state: stopped
+
+- name: server | snmpd | setup monitoring user SNMPv3
+  lineinfile:
+    path: "{{ snmpd_user_file }}"
+    create: true
+    line: "createuser {{ snmp_user }} {{ snmp_auth_proto }} {{ snmp_auth_pass }} {{ snmp_priv_proto }} {{ snmp_priv_pass }}"
+
+- name: server | snmpd | setup ACLs
+  lineinfile:
+    path: "{{ snmpd_conf }}" # required. The file to modify. Before Ansible 2.3 this option was only usable as I(dest), I(destfile) and I(name).
+    line: "rouser {{ snmp_user }} authpriv"
+    insertafter: "# SECTION: custom settings"
+
+- name: server | snmpd | enable service on wireguard interface
+  lineinfile:
+    path: "{{ snmpd_conf }}"
+    regexp: "^agentaddress.*$"
+    state: present
+    line: "agentaddress 127.0.0.1,{{ wg_local_ip | ipaddr('address') }},[::1]"
+  when: wg_local_ip is defined
+
+- name: server | snmpd | enable service on all interfaces
+  lineinfile:
+    path: "{{ snmpd_conf }}"
+    regexp: "^agentaddress.*$"
+    state: present
+    line: "agentaddress udp:161,udp6:[::1]:161"
+  when: wg_local_ip is not defined
+
+- name: server | snmpd | copy distro script
+  copy:
+    dest: "/etc/snmp/distro"
+    src: "distro"
+    mode: "0755"
+
+- name: server | snmpd | get os-updates script
+  get_url:
+    url: "https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/osupdate"
+    dest: "/etc/snmp/osupdate"
+    mode: "0755"
+    owner: "root"
+    group: "root"
+
+- name: server | snmpd | configure extends
+  lineinfile:
+    path: "{{ snmpd_conf }}"
+    state: present
+    line: "extend {{ item.service }} '{{ item.script }}'"
+    insertafter: "# SECTION: custom settings"
+  loop:
+    - { service: "distro", script: "{{ sudo }} /etc/snmp/distro" }
+    - { service: "osupdate", script: "{{ sudo }} /etc/snmp/osupdate" }
+    - { service: "hardware", script: "/bin/cat /sys/devices/virtual/dmi/id/product_name" }
+    - { service: "manufacturer", script: "/bin/cat /sys/devices/virtual/dmi/id/sys_vendor" }
+    - { service: "serial", script: "/bin/cat /sys/devices/virtual/dmi/id/product_serial" }
+
+- block:
+  - name: server | snmpd | get proxmox script
+    get_url:
+      url: "https://raw.githubusercontent.com/librenms/librenms-agent/master/agent-local/proxmox"
+      dest: "/usr/local/bin/proxmox"
+      mode: "0755"
+      owner: "root"
+      group: "root"
+  - name: server | snmpd | configure proxmox extends
+    lineinfile:
+      path: "{{ snmpd_conf }}"
+      state: present
+      line: "extend proxmox {{ sudo }} /usr/local/bin/proxmox"
+      insertafter: "# SECTION: custom settings"
+  when:
+    - is_proxmox is defined
+    - is_proxmox == true
+
+- name: server | snmpd start service
+  service:
+    name: "snmpd"
+    state: started

roles/server/templates/client_VPN.conf.j2

@@ -0,0 +1,10 @@
+[Interface]
+Address = {{ wg_local_ip }}
+ListenPort = 41475
+PostUp = wg set %i private-key /etc/wireguard/privatekey
+
+[Peer]
+PublicKey = {{ wg_server_pubkey }}
+Endpoint = {{ wg_endpoint }}
+AllowedIPs = 192.168.3.0/24, 192.168.1.0/24
+PersistentKeepalive = 25

roles/server/vars/Archlinux.yml

@@ -0,0 +1,7 @@
+mta_package: msmtp-mta
+snmpd_package: net-snmp
+snmpd_user_file: "/var/net-snmp/snmpd.conf"
+wireguard_package: wireguard-tools
+
+glusterfs_packages:
+  - package: glusterfs

roles/server/vars/Debian.yml

@@ -0,0 +1,9 @@
+mta_package: ssmtp
+snmpd_package: snmpd
+snmpd_user_file: "/var/lib/snmp/snmpd.conf"
+wireguard_package: wireguard
+
+glusterfs_packages:
+  - package: glusterfs-common
+  - package: glusterfs-server
+  - package: glusterfs-client

roles/server/vars/Ubuntu.yml

@@ -0,0 +1 @@
+Debian.yml

roles/server/vars/main.yml

@@ -0,0 +1,3 @@
+swappiness_value: 5
+wg_endpoint: tantooine.myfirewall.org:51820
+wg_server_pubkey: vhRa0WQnMdo97jAwS3a8wnb1C69oL5z1Ee5nmxoiX1w=

roles/server/vars/mewimeet.com.yml

@@ -0,0 +1,11 @@
+$ANSIBLE_VAULT;1.1;AES256
+65363966633438663266346230643831396530313038643036636532613338393961333030613738
+3837623039666439343464623437623161396663383839360a666333373063613165333463616339
+35616565313932313233373936313030393030333264373935626161646366643734366466636231
+3037636633336662330a376163363739393564386531653963666237343835396164343761396235
+31393830363837613835353637323631313063613033663965353035343232663663363434623137
+35643236353061333265383338393337383333386139623864373533613666336639356339353065
+32613032383034366636663433633064643033616264316665383339383662313336313830653037
+30643636616565333038626439353463343162346630346634333038376462303365316466666564
+30643336333035653832383637633036326536613130663830336338666333393836386435326535
+6335333836383936643036353861303764353530613266663736

roles/server/vars/mewimeet.de.yml

@@ -0,0 +1,11 @@
+$ANSIBLE_VAULT;1.1;AES256
+62616435356338323962643761613761633061376366643536343533373062643732376439353738
+6461363065616630323164653263636430626635323937660a326530623063643338643730656537
+37396630363861653333326362396336643136623866623064653765383261623763623339663363
+6435303032396137320a653630643537396462613061303733356163303563363935666661353362
+63313466383830373165663462393661353135356138653839623631616537343033343435353264
+33393636383365653963643239386530313135326365316233366165383831643833663962636561
+32633336356438376632353264376265643466343365313133376637396632616339323336373035
+39313138356438613637333361363839626132363337643835383332336666353862303262346534
+34373137343939633034373432653332353531396666393532316238333462306330373930383833
+3030383562626231656362383233656662303537316439313065

roles/server/vars/snmp_users.yml

@@ -0,0 +1,11 @@
+$ANSIBLE_VAULT;1.1;AES256
+31303532326531323738633661646339316639306435333333386438613035626134373835626234
+3633393864646561663630663038366239656539656639380a356134363664616334653037303436
+65306661353865633432323763633133353364393138656638626265386339336166366630663066
+3034326233623262320a336131613839343034373632656538636635613665326335633034656231
+39616662623064643233626661303063613432653062613561303337303163343866313932343732
+64386332373430656362646431366332333466396465306362623437623966663032303236613864
+31633338666635633132386264666339643639393838323730336333323933663061373965393237
+36656539326466353634633531333132313237306137636234383339633963326537323463386638
+66393231313331653838613734653134373965653563326562306534316266623766316433633366
+3965336266376365613235656337386463663766326530626265