diff --git a/README.md b/README.md index d8983cd..1082957 100644 --- a/README.md +++ b/README.md @@ -37,11 +37,15 @@ Following roles have been defined to make creating a server configuration easy: - **node** defines roles for setting up node applications - **application** installs the main application - **server** defines roles using different kind of server applications, applications will be configured using separated system users + - **firefox-sync** sets up a syncserver for Mozilla Firefox - **gitea** sets up a git repository using *Gitea* as web overlay - **nextcloud** sets up a cloud storage using *NextCloud* - **node** sets up a *Node.js* server from a repository with a database expecting it can be configured by command arguments + - **php** sets up a PHP webpage from a repository - **spotme** sets up a SpotMe server - **static** sets up a static virtual server with files from a repository + - **tt-rss** sets up a RSS feed using *TinyTinyRSS* + - **typo3** defines a CMS using *typo3* - **wireguard** defines roles to handle a *WireGuard* configuration across different servers - **application** installs and configures the main application - **special_client** creates a configuration for a device not configurable by Ansible and stores it locally diff --git a/roles/autorelease/application/tasks/main.yml b/roles/autorelease/application/tasks/main.yml new file mode 100644 index 0000000..cd21505 --- /dev/null +++ b/roles/autorelease/application/tasks/main.yml @@ -0,0 +1,2 @@ +--- + diff --git a/roles/autorelease/repository/defaults/main.yml b/roles/autorelease/repository/defaults/main.yml new file mode 100644 index 0000000..39de787 --- /dev/null +++ b/roles/autorelease/repository/defaults/main.yml @@ -0,0 +1,3 @@ +--- + +dest: "" diff --git a/roles/autorelease/repository/tasks/main.yml b/roles/autorelease/repository/tasks/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/autorelease/repository/tasks/main.yml @@ -0,0 +1 @@ +--- diff --git a/roles/mail/smtp_application/handlers/main.yml b/roles/mail/smtp_application/handlers/main.yml new file mode 100644 index 0000000..12c98ac --- /dev/null +++ b/roles/mail/smtp_application/handlers/main.yml @@ -0,0 +1,27 @@ +--- + +- name: restart opendkim + service: + name: opendkim + state: restarted + +- name: restart opendmarc + service: + name: opendmarc + state: restarted + +- name: restart postfix + service: + name: postfix + state: restarted + +- name: restart saslauthd + service: + name: saslauthd + state: restarted + +- name: restart spamassassin + service: + name: spamassassin + state: restarted +# TODO Enable diff --git a/roles/mail/smtp_application/tasks/main.yml b/roles/mail/smtp_application/tasks/main.yml new file mode 100644 index 0000000..8614b80 --- /dev/null +++ b/roles/mail/smtp_application/tasks/main.yml @@ -0,0 +1,18 @@ +--- + +- name: Install required packages + apt: + state: present + name: + - ca-certificates + - mailutils + - libsasl2-2 + - libsasl2-modules + - opendkim + - opendkim-tools + - opendmarc + - postfix + - postfix-policyd-spf-python + - sasl2-bin + - spamassassin + - spamc diff --git a/roles/misc/ssh_tg_notify/templates/sendNotification.sh b/roles/misc/ssh_tg_notify/templates/sendNotification.sh new file mode 100644 index 0000000..72044ff --- /dev/null +++ b/roles/misc/ssh_tg_notify/templates/sendNotification.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +local USERID="" +local KEY="" +local TIMEOUT="10" +local URL="https://api.telegram.org/bot$KEY/sendMessage" +local DATE_EXEC="$(date "+%d %b %Y %H:%M")" #Collect date & time. +if [ -n "$SSH_CLIENT" ] && [ -z "$TMUX" ]; then #Trigger + IP=$(echo $SSH_CLIENT | awk '{print $1}') #Get Client IP address. + PORT=$(echo $SSH_CLIENT | awk '{print $3}') #Get SSH port + HOSTNAME=$(hostname -f) #Get hostname + IPADDR=$(hostname -I | awk '{print $1}') + TEXT="$DATE_EXEC: ${USER} logged in to $HOSTNAME ($IPADDR) from $IP - $(curl https://ipinfo.io/$IP -s | jq -r '.org + " - " + .city + ", " + .region + ", " + .country') port $PORT" + curl -s --max-time $TIMEOUT -d "chat_id=$USERID&disable_web_page_preview=1&text=$TEXT" $URL > /dev/null + rm $TMPFILE #clean up after +fi diff --git a/roles/nginx/TODO b/roles/nginx/TODO new file mode 100644 index 0000000..f68e271 --- /dev/null +++ b/roles/nginx/TODO @@ -0,0 +1,11 @@ +TODOs: + +- PHP OPCache Configuration +File: /etc/php/7.0/fpm/php.ini (check path) +opcache.enable=1 +opcache.enable_cli=1 +opcache.memory_consumption=128 +opcache.interned_strings_buffer=8 +opcache.max_accelerated_files=10000 +opcache.revalidate_freq=1 +opcache.save_comments=1 diff --git a/roles/nginx/php/defaults/main.yml b/roles/nginx/php/defaults/main.yml new file mode 100644 index 0000000..3ae4b75 --- /dev/null +++ b/roles/nginx/php/defaults/main.yml @@ -0,0 +1,7 @@ +--- + +# domain: "example.com" +# system_user: "www-data" +# src: "/of/php/files" +# pool_name from nginx/php-pool +# TODO includes: ... diff --git a/roles/nginx/php/meta/main.yml b/roles/nginx/php/meta/main.yml new file mode 100644 index 0000000..ff3b36f --- /dev/null +++ b/roles/nginx/php/meta/main.yml @@ -0,0 +1,12 @@ +--- + +allow_duplicates: yes + +dependencies: + - role: nginx/application + - role: acme/certificate + # domain + - role: nginx/php-pool + # system_user + # src + # pool_name diff --git a/roles/nginx/php/tasks/main.yml b/roles/nginx/php/tasks/main.yml new file mode 100644 index 0000000..99d338b --- /dev/null +++ b/roles/nginx/php/tasks/main.yml @@ -0,0 +1,10 @@ +--- + +- name: Configure forward in nginx + template: + src: server.conf + dest: "{{ nginx_sites_directory }}/{{ domain }}" + owner: root + group: root + mode: "u=rw,g=r,o=r" + notify: reload nginx diff --git a/roles/nginx/php/templates/server.conf b/roles/nginx/php/templates/server.conf new file mode 100644 index 0000000..6593acf --- /dev/null +++ b/roles/nginx/php/templates/server.conf @@ -0,0 +1,31 @@ +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name {{ domain }}; + + ssl on; + ssl_certificate {{ acme_certificate_location }}; + ssl_certificate_key {{ acme_key_location }}; + + include {{ nginx_snippets_directory }}/https; + include {{ nginx_snippets_directory }}/global; + + index index.php index.html index.htm index.nginx-debian.html; + root {{ src }}; + fastcgi_hide_header X-Powered-By; + + location ~\.php$ { + fastcgi_split_path_info ^(.+?\.php)(/.*)$; + try_files $uri =404; + fastcgi_index index.php; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param HTTPS on; + fastcgi_param modHeadersAvailable true; + fastcgi_param front_controller_active true; + fastcgi_pass {{ pool_name }}; + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + } +} diff --git a/roles/server/mail_deprecated/README.md b/roles/server/mail_deprecated/README.md new file mode 100644 index 0000000..fb0f7e8 --- /dev/null +++ b/roles/server/mail_deprecated/README.md @@ -0,0 +1,5 @@ +# Mail Module + +Configures a fully enabled mail server +with integration into NextCloud +following https://123qwe.com/tutorial/ diff --git a/roles/server/mail_deprecated/defaults/aptlist2 b/roles/server/mail_deprecated/defaults/aptlist2 new file mode 100644 index 0000000..1546221 --- /dev/null +++ b/roles/server/mail_deprecated/defaults/aptlist2 @@ -0,0 +1,21 @@ +- php-apcu +- php-bz2 +- php-curl +- php-dom +- php-fileinfo +- php-gd +- php-iconv +- php-imagick +- php-intl +- php-json +- php-mbstring +- php-mcrypt +- php-posix +- php-simplexml +- php-xmlreader +- php-xmlwriter +- php-zip +- php-curl +- php-gd +- php-bz2 +- php-apcu diff --git a/roles/server/mail_deprecated/defaults/main.yml b/roles/server/mail_deprecated/defaults/main.yml new file mode 100644 index 0000000..c0791d0 --- /dev/null +++ b/roles/server/mail_deprecated/defaults/main.yml @@ -0,0 +1,18 @@ +--- + +mail_domains: + - example.com +mail_main_domain: "{{ mail_domains[0] }}" +mail_server_domain: "mail.{{ mail_main_domain }}" + +mail_postmaster_address: "postmaster@{{ mail_main_domain }}" + +mail_sql_database: "mail_server" +mail_sql_username: "mail_user" +mail_sql_password: "TODO" +mail_nextcloud_sql_username: "mail_nextcloud" +mail_nextcloud_sql_password: "TODO" + +mail_postfix_username: "postfix" +mail_postfix_configuration_directory: "/etc/postfix" +mail_postfix_message_size_limit: 52428800 # 50 MB diff --git a/roles/server/mail_deprecated/files/maildb.sql b/roles/server/mail_deprecated/files/maildb.sql new file mode 100644 index 0000000..6968713 --- /dev/null +++ b/roles/server/mail_deprecated/files/maildb.sql @@ -0,0 +1,7 @@ +USE DATABASE mail_server; + +-- TODO Database transfer from local phpmyadmin +-- TODO Workaround for rule + +CREATE TABLE domains ( +) diff --git a/roles/server/mail_deprecated/meta/main.yml b/roles/server/mail_deprecated/meta/main.yml new file mode 100644 index 0000000..2347d50 --- /dev/null +++ b/roles/server/mail_deprecated/meta/main.yml @@ -0,0 +1,7 @@ +--- + +dependencies: + - role: acme/certificate + domain: "{{ mail_main_domain }}" + - role: mysql/application # TODO Repl + - role: nginx/application # TODO Repl diff --git a/roles/server/mail_deprecated/tasks/dns.yml b/roles/server/mail_deprecated/tasks/dns.yml new file mode 100644 index 0000000..69b86c4 --- /dev/null +++ b/roles/server/mail_deprecated/tasks/dns.yml @@ -0,0 +1,9 @@ +# TODO Create following DNS entries + +# A Record (TODO move) +# AAAA Record (TODO move) + +# For each mail domain by mail_domains +# {{ mail_domain }} MX 10 {{ mail_server_domain }} +# {{ mail_domain }} TXT v=spf1 mx -all +# _dmarc.{{ mail_domain }} TXT v=DMARC1; aspf=s; adkim=s; pct=100; p=reject; rua=mailto:{{ mail_postmaster_address }}; diff --git a/roles/server/mail_deprecated/tasks/main.yml b/roles/server/mail_deprecated/tasks/main.yml new file mode 100644 index 0000000..e1259a7 --- /dev/null +++ b/roles/server/mail_deprecated/tasks/main.yml @@ -0,0 +1,28 @@ +--- + +- name: Configure DNS entries + include_tasks: dns.yml + +- name: Register apt key for rspamd + apt_key: + id: 3FA347D5E599BE4595CA2576FFA232EDBF21E25E + url: https://rspamd.com/apt-stable/gpg.key + +- name: Register apt repository for rspamd + apt_repository: + repo: "deb http://rspamd.com/apt-stable/ {{ ansible_distribution_release }} main" + filename: rspamd + +- name: Install required packages + apt: + state: present + name: + - dovecot-imapd + - dovecot-mysql + - dovecot-lmtpd + - dovecot-sieve + - dovecot-managesieved + - postfix + - postfix-mysql + - rspamd + update_cache: yes # TODO If added repository diff --git a/roles/server/mail_deprecated/tasks/postfix.yml b/roles/server/mail_deprecated/tasks/postfix.yml new file mode 100644 index 0000000..014aba5 --- /dev/null +++ b/roles/server/mail_deprecated/tasks/postfix.yml @@ -0,0 +1,17 @@ +--- + +- template: + dest: "{{ mail_postfix_configuration_directory }}/{{ item }}" + group: "{{ mail_postfix_username }}" + mode: 0640 + owner: root + src: "{{ item }}" + loop: + - mysql-virtual-alias-maps.cf + - mysql-virtual-mailbox-domains.cf + - mysql-virtual-mailbox-maps.cf + +- template: + dest: "{{ mail_postfix_configuration_directory }}/main.cf" + src: "main.cf" + validate: postfix check diff --git a/roles/server/mail_deprecated/templates/main.cf b/roles/server/mail_deprecated/templates/main.cf new file mode 100644 index 0000000..a84e8b6 --- /dev/null +++ b/roles/server/mail_deprecated/templates/main.cf @@ -0,0 +1,55 @@ +myhostname={{ mail_main_domain }} + +smptd_tls_cert_file={{ acme_certificates_directory }}/{{ mail_main_domain }}.crt +smptd_tls_key_file={{ acme_certificates_directory }}/{{ mail_main_domain }}.key +smtpd_tls_security_level=may +smtpd_tls_auth_only=yes + +smtp_tls_security_level=may + +smtpd_sasl_type=dovecot +smtpd_sasl_path=private/auth +smtpd_sasl_auth_enable=yes + +virtual_mailbox_domains=mysql:{{ mail_postfix_configuration_directory }}/mysql-virtual-mailbox-domains.cf +virtual_mailbox_maps=mysql:{{ mail_postfix_configuration_directory }}/mysql-virtual-mailbox-maps.cf +virtual_alias_maps=mysql:{{ mail_postfix_configuration_directory }}/mysql-virtual-alias-maps.cf + +virtual_transport=lmtp:unix:private/dovecot-lmtp + +smtpd_client_restrictions = + permit_mynetworks + permit_sasl_authenticated + reject_unknown_reverse_client_hostname + +smtpd_helo_restrictions = + permit_mynetworks + permit_sasl_authenticated + reject_invalid_helo_hostname + reject_non_fqdn_helo_hostname + reject_unknown_helo_hostname +smtpd_helo_required=yes + +smtpd_sender_login_maps= + mysql:{{ mail_postfix_configuration_directory }}/mysql-virtual-mailbox-domains.cf + mysql:{{ mail_postfix_configuration_directory }}/mysql-virtual-alias-maps.cf + +smtpd_sender_restrictions = + reject_non_fqdn_sender + reject_sender_login_mismatch + reject_unknown_sender_domain + +smtpd_relay_restrictions = + permit_sasl_authenticated + reject_unauth_destination + +smtpd_recipient_restrictions = + reject_non_fqdn_recipient + reject_unknown_recipient_domain + reject_unauth_pipelining + +message_size_limit={{ mail_postfix_message_size_limit }} + +smtpd_milters=inet:127.0.0.1:11332 +non_smtpd_milters=inet:127.0.0.1:11332 +milter_mail_macros=i {mail_addr} {client_addr} {client_name} {auth_authen} diff --git a/roles/server/mail_deprecated/templates/mysql-virtual-alias-maps.cf b/roles/server/mail_deprecated/templates/mysql-virtual-alias-maps.cf new file mode 100644 index 0000000..9ece1f1 --- /dev/null +++ b/roles/server/mail_deprecated/templates/mysql-virtual-alias-maps.cf @@ -0,0 +1,5 @@ +user = {{ mail_sql_username }} +password = {{ mail_sql_password }} +hosts = 127.0.0.1 +dbname = {{ mail_sql_database }} +query = SELECT destination_local || '@' || destination_domain FROM aliases WHERE source_local='%u' AND source_domain='%d'; diff --git a/roles/server/mail_deprecated/templates/mysql-virtual-mailbox-domains.cf b/roles/server/mail_deprecated/templates/mysql-virtual-mailbox-domains.cf new file mode 100644 index 0000000..ae643ad --- /dev/null +++ b/roles/server/mail_deprecated/templates/mysql-virtual-mailbox-domains.cf @@ -0,0 +1,5 @@ +user = {{ mail_sql_username }} +password = {{ mail_sql_password }} +hosts = 127.0.0.1 +dbname = {{ mail_sql_database }} +query = SELECT * FROM domains WHERE domain='%s' diff --git a/roles/server/mail_deprecated/templates/mysql-virtual-mailbox-maps.cf b/roles/server/mail_deprecated/templates/mysql-virtual-mailbox-maps.cf new file mode 100644 index 0000000..2288398 --- /dev/null +++ b/roles/server/mail_deprecated/templates/mysql-virtual-mailbox-maps.cf @@ -0,0 +1,5 @@ +user = {{ mail_sql_username }} +password = {{ mail_sql_password }} +hosts = 127.0.0.1 +dbname = {{ mail_sql_database }} +query = SELECT fqda FROM users_fqda WHERE fqda='%s'; diff --git a/roles/server/typo3/handlers/main.yml b/roles/server/typo3/handlers/main.yml new file mode 100644 index 0000000..e69de29 diff --git a/roles/server/typo3/meta/main.yml b/roles/server/typo3/meta/main.yml new file mode 100644 index 0000000..cf5427b --- /dev/null +++ b/roles/server/typo3/meta/main.yml @@ -0,0 +1,3 @@ +--- + +allow_duplicates: yes diff --git a/roles/server/typo3/tasks/main.yml b/roles/server/typo3/tasks/main.yml new file mode 100644 index 0000000..5a9407b --- /dev/null +++ b/roles/server/typo3/tasks/main.yml @@ -0,0 +1,7 @@ +--- + +- name: Install required packages + apt: + state: present + name: + - composer diff --git a/svg/banananetwork.png b/svg/banananetwork.png new file mode 100644 index 0000000..2c11121 Binary files /dev/null and b/svg/banananetwork.png differ diff --git a/svg/banananetwork.svg b/svg/banananetwork.svg new file mode 100644 index 0000000..b29e9cc --- /dev/null +++ b/svg/banananetwork.svg @@ -0,0 +1,44 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/todo.md b/todo.md new file mode 100644 index 0000000..cbb8c06 --- /dev/null +++ b/todo.md @@ -0,0 +1,14 @@ +- Mail Server? +- Firefox Syncserver +- docker Installation? +- fstab of some pcs + +Servers: +- nvak !!FAST!! +- hardie.khitomer +- morska + - VNC +- rurapenthe + - simple docker client +- master.qonos +- zockerpc.khitomer (simple configuration)