Merge work from ansible

This commit is contained in:
Shaun Reed 2020-04-26 18:12:27 -04:00
commit 255ba5a291
18 changed files with 294 additions and 1 deletions

6
ansible/fail2ban.yml Normal file
View File

@ -0,0 +1,6 @@
---
- hosts: plumbi
become: yes
roles:
- fail2ban

View File

@ -1,5 +1,5 @@
---
- hosts: nginx-server
- hosts: plumbi
become: yes
roles:
- nginx

6
ansible/postfix.yml Normal file
View File

@ -0,0 +1,6 @@
---
- hosts: plumbi
become: yes
roles:
- postfix

Binary file not shown.

View File

@ -0,0 +1,25 @@
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
body {
width: 35em;
margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
}
</style>
</head>
<body>
<h1>Klips!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>

View File

@ -0,0 +1,55 @@
user www-data;
worker_processes auto;
pid /run/nginx.pid;
events { }
http {
include mime.types;
# Basic Server Configuration
server {
listen 80;
server_tokens off;
server_name {{ domain_name }};
location / {
root {{ nginx_root_dir }};
index {{ index_files }};
}
# Uncomment to pass for SSL
#return 301 https://$host$request_uri;
}
}
# Terminate SSL and route traffic
# server {
# server_name localhost;
# server_tokens off;
#
# SSL Settings
# listen 443 ssl;
# ssl_certificate /etc/letsencrypt/live/www.domain.com/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/www.domain.com/privkey.pem;
# include /etc/letsencrypt/options-ssl-nginx.conf;
# ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
# location / {
# include proxy_params;
# proxy_pass http://0.0.0.0:8080/;
# }
# }
# Private subdomain for routing custom ssh port
# server {
# server_name sub.domain.com;
# server_tokens off;
#
# location / {
# include proxy_params;
# proxy_pass http://0.0.0.0:3333;
# }
#
#}

View File

@ -0,0 +1,38 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

View File

@ -0,0 +1,8 @@
---
# defaults file for /etc/ansible/roles/postfix
#
packages: [mailutils, postfix]
relay_host: "[sub.domain.com]:777"
email: "email@domain.com"
sasl_passwd: "xxxxxxxxxxxxx"

View File

@ -0,0 +1,3 @@
sudo postmap /etc/postfix/sasl/sasl_passwd;
sudo chown root:root /etc/postfix/sasl/sasl_passwd /etc/postfix/sasl/sasl_passwd.db;
sudo chmod 600 /etc/postfix/sasl/sasl_passwd /etc/postfix/sasl/sasl_passwd.db;

View File

@ -0,0 +1,55 @@
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
# fresh installs.
compatibility_level = 2
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = {{ ansible_hostname }}
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = $myhostname, {{ ansible_hostname }}, localhost.localdomain, localhost
relayhost = {{ relay_host }}
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
# Enable SASL authentication
smtp_sasl_auth_enable = yes
# Disallow methods that allow anonymous authentication
smtp_sasl_security_options = noanonymous
# Location of sasl_passwd
smtp_sasl_password_maps = hash:/etc/postfix/sasl/sasl_passwd
# Enable STARTTLS encryption
smtp_tls_security_level = encrypt
# Location of CA certificates
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

View File

@ -0,0 +1 @@
{{ relay_host }} {{ email }}:{{ sasl_passwd }}

View File

@ -0,0 +1,7 @@
---
# handlers file for /etc/ansible/roles/postfix
#
- name: restart postfix
service: name=postfix state=restarted

View File

@ -0,0 +1,53 @@
galaxy_info:
author: Shaun Reed
description: A template for basic postfix configuration
company: (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.4
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
#
# Provide a list of supported platforms, and for each platform a list of versions.
# If you don't wish to enumerate all versions for a particular platform, use 'all'.
# To view available platforms and versions (or releases), visit:
# https://galaxy.ansible.com/api/v1/platforms/
#
# platforms:
# - name: Fedora
# versions:
# - all
# - 25
# - name: SomePlatform
# versions:
# - all
# - 1.0
# - 7
# - 99.99
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

View File

@ -0,0 +1,20 @@
---
- name: Copy postfix configuration template
template: src=files/postfix/main.cf dest=/etc/postfix/main.cf
- name: Copy postfix sasl_passwd
template: src=files/postfix/sasl_passwd dest=/etc/postfix/sasl/sasl_passwd
- name: Copy init-mail.sh script to remote hosts
copy: src=files/postfix/init-mail.sh dest=/etc/postfix/init-mail.sh
- name: Touch a file, using symbolic modes to set the permissions (equivalent to 0644)
file:
path: /etc/postfix/init-mail.sh
state: touch
mode: u=rwx,g=rwx,o=rwx
- name: Run script to initialize postfix
script: files/postfix/init-mail.sh
notify:
- restart postfix

View File

@ -0,0 +1,4 @@
---
- name: Install packages
apt: name="{{ item }}" state=latest
with_items: "{{ packages }}"

View File

@ -0,0 +1,7 @@
---
# tasks file for /etc/ansible/roles/nginx
- import_tasks: install.yml
- import_tasks: configure.yml
- import_tasks: service.yml

View File

@ -0,0 +1,3 @@
---
- name: Start and enable postfix service
service: name=postfix state=restarted enabled=yes

View File

@ -0,0 +1,2 @@
---
# vars file for /etc/ansible/roles/postfix