Compare commits

..

151 commits

Author SHA1 Message Date
0283c0c589 🚨 fix risky-file-permissions
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2021-02-20 14:18:09 +01:00
5d8874b489 🚨 fix trailling-spaces 2021-02-20 14:17:07 +01:00
6958bbf17a 🚨 fix risky-file-permission 2021-02-20 14:15:30 +01:00
6dae04fe62 🚨 fix trailling spaces and space in front of comment 2021-02-20 14:14:25 +01:00
otthorn
b06ac0647c Merge branch 'master' into mailserver
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-20 14:00:43 +01:00
a2cbf4a487 Merge branch 'mailserver' of ssh://gitea.auro.re:2222/Aurore/ansible into mailserver
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-06 13:09:37 +01:00
4cd6a2d2c5 Correct typo, this one was sneaky!
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-06 12:54:00 +01:00
11d5d19bb6 Add postfix quota check 2021-02-06 12:54:00 +01:00
18ca5b4805 Fix postfix cert variables 2021-02-06 12:54:00 +01:00
5dcb7eb0d1 Remove file since I did not git mv correclty... 2021-02-06 12:54:00 +01:00
402b203489 move files to the right place and fix small typo 2021-02-06 12:54:00 +01:00
a2fbe9b1e6 Post renewal hook for certbot to reload dovecot and postfix 2021-02-06 12:54:00 +01:00
9e6a127a8f Fix broken vars 2021-02-06 12:54:00 +01:00
391d5ce9a0 fix yaml syntax 2021-02-06 12:54:00 +01:00
bf692f4501 Add additional role for mailserver 2021-02-06 12:54:00 +01:00
d0196c8c00 Postfix conf add certs and other security related modifications 2021-02-06 12:54:00 +01:00
59302b7fd8 Don't reinvent the whell, use existing roles (have to be tested) 2021-02-06 12:54:00 +01:00
95e67e8fe1 Use correct re2o API vars (don't add them twice in vault, reuse them) 2021-02-06 12:54:00 +01:00
cac03b51c0 Mail VM has a public addr now and FQDN is mail.auro.re 2021-02-06 12:54:00 +01:00
8b59794013 Add Re2o API vars 2021-02-06 12:54:00 +01:00
ed81571cb8 add re2o service mail cron 2021-02-06 12:54:00 +01:00
5ae66dae15 Re2o API config 2021-02-06 12:54:00 +01:00
3af1aa8a18 Add re2o mail server 2021-02-06 12:54:00 +01:00
49243202b2 Add re2o mail server to the roles of the mailserver playbook 2021-02-06 12:54:00 +01:00
4d769ff6d3 Add quota to dovecot 2021-02-06 12:54:00 +01:00
b8edf512f7 Enable Dovecot sieve 2021-02-06 12:54:00 +01:00
477781e293 Fix syntax: don't forget the underscore 2021-02-06 12:54:00 +01:00
0d9de57a78 Add LMTP for Postfix-Dovecot communication 2021-02-06 12:54:00 +01:00
3b19ef06ee Add config in the right section 2021-02-06 12:54:00 +01:00
4bcdbec9c4 Don't add conf.d/*.conf into a file that is itself already there! dumb dumb 2021-02-06 12:54:00 +01:00
c1fc197da7 remove non-existant conf file from the role 2021-02-06 12:54:00 +01:00
c36e52c263 Add sane logging timestamp format 2021-02-06 12:54:00 +01:00
012a6076f3 fix conf.d template files path 2021-02-06 12:54:00 +01:00
ab124e560a Fix indentation... again 2021-02-06 12:54:00 +01:00
e26bc5f8c1 fix typo and indentation problem 2021-02-06 12:54:00 +01:00
32adecd5c1 add local_network variable 2021-02-06 12:54:00 +01:00
495f4c4343 User handlers to run when something changed 2021-02-06 12:54:00 +01:00
486216b8ff use command instead of shell when no shell functionality is required 2021-02-06 12:54:00 +01:00
f8774587c2 use underscores instead of dashes inside role names 2021-02-06 12:54:00 +01:00
522d286bdd Fix mode, shoudl always be set 2021-02-06 12:54:00 +01:00
5732fef21e rename roles to match regex set by linter 2021-02-06 12:54:00 +01:00
b8aa507166 fix typo 2021-02-06 12:54:00 +01:00
8436e64b3a reload -> restart 2021-02-06 12:54:00 +01:00
5c7537f4ac Add dovecot role to the mailserver 2021-02-06 12:54:00 +01:00
482bf1f8bc Add dovecot bind password into the vault 2021-02-06 12:53:50 +01:00
f14da45305 dovecot vars 2021-02-06 12:51:12 +01:00
637d7b02d3 dovecot ldap conf 2021-02-06 12:51:12 +01:00
910838c416 Add ssl conf 2021-02-06 12:51:12 +01:00
f0a2bfd740 Add IMAP/POP/SMTP auth conf 2021-02-06 12:51:12 +01:00
f3eeb243bb renamed to fit jinja template 2021-02-06 12:51:12 +01:00
05e16f3226 maildir conf 2021-02-06 12:51:12 +01:00
9260b902d6 auth config 2021-02-06 12:51:12 +01:00
1ec03eda87 dovecot handlers 2021-02-06 12:51:12 +01:00
74e722fef8 fix typo 2021-02-06 12:51:12 +01:00
46c8b82a57 Config outside of conf.d 2021-02-06 12:51:12 +01:00
946b3c973e Apt retry mechanism 2021-02-06 12:51:12 +01:00
cbdde70c2a Starting to try out postfix config 2021-02-06 12:51:12 +01:00
facb7365fc Please linter 2021-02-06 12:51:12 +01:00
769dc5619b Add the mail-certificate role 2021-02-06 12:51:12 +01:00
155daedd24 Agree to Letsencrypt TOS 2021-02-06 12:51:05 +01:00
d49ad0f8d8 oupsie, reverse this 2021-02-06 12:47:49 +01:00
3a2f073db5 fix typo 2021-02-06 12:47:49 +01:00
9543c2f10d dashes are evil, use underscore in var names 2021-02-06 12:47:49 +01:00
a0a6124481 add sain defaults for NFS client 2021-02-06 12:47:49 +01:00
ed9557d342 fix ansible-lint 2021-02-06 12:47:49 +01:00
f7ee1403d9 Fix yaml lint 2021-02-06 12:47:49 +01:00
8cb8548139 mail is no longer in adm 2021-02-06 12:46:39 +01:00
b6355ebb0a Added NFS host_var for mail.auro.re 2021-02-06 12:46:39 +01:00
2605266137 fix var names for better hierarchy 2021-02-06 12:46:39 +01:00
991e306320 Add nfs-client role 2021-02-06 12:46:39 +01:00
40df593f11 Added the certificates gestion 2021-02-06 12:46:39 +01:00
3714396b6b commented unused tasks for the moment 2021-02-06 12:46:39 +01:00
750753f16d Starting the dovecot task 2021-02-06 12:46:39 +01:00
673d77d1be fix yaml lint 2021-02-06 12:46:39 +01:00
de83af936d Add (initial) mailserver playbook 2021-02-06 12:46:39 +01:00
5377378bf7 Add (initial) mail-utils role 2021-02-06 12:46:39 +01:00
f01533409f Add (initial) postfix role 2021-02-06 12:46:39 +01:00
4b3e491983 Add mail vars 2021-02-06 12:46:39 +01:00
faba1d2005 Correct typo, this one was sneaky!
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-05 01:50:56 +01:00
5f48a46522 Add postfix quota check
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-05 01:35:46 +01:00
c0cd3946fb Fix postfix cert variables
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-05 01:17:58 +01:00
b35922346e Remove file since I did not git mv correclty...
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-05 00:09:12 +01:00
77918e00ce move files to the right place and fix small typo
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-05 00:07:36 +01:00
256d2d5df4 Post renewal hook for certbot to reload dovecot and postfix
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-05 00:05:26 +01:00
43053e57f9 Fix broken vars
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-04 23:44:32 +01:00
efa34dab42 fix yaml syntax
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-04 23:35:12 +01:00
e316679e13 Add additional role for mailserver 2021-02-04 23:34:53 +01:00
2c531d1af2 Postfix conf add certs and other security related modifications
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-04 23:18:23 +01:00
27cfcc1320 Don't reinvent the whell, use existing roles (have to be tested)
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-04 14:47:40 +01:00
ebf712d0bc Use correct re2o API vars (don't add them twice in vault, reuse them)
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-04 13:02:52 +01:00
0a7de4fc78 Mail VM has a public addr now and FQDN is mail.auro.re
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-04 02:24:35 +01:00
1e59bec323 Add Re2o API vars
Some checks failed
continuous-integration/drone/push Build is failing
continuous-integration/drone/pr Build is failing
2021-02-04 02:14:52 +01:00
1c7b4f8560 add re2o service mail cron
Some checks failed
continuous-integration/drone/push Build is failing
2021-02-04 01:46:55 +01:00
9e91f2e9d5 Re2o API config 2021-02-04 01:38:49 +01:00
cf58c2bac5 Add re2o mail server
Some checks failed
continuous-integration/drone/push Build is failing
2021-02-04 01:30:14 +01:00
1c20193fc8 Add re2o mail server to the roles of the mailserver playbook 2021-02-04 01:03:18 +01:00
c85b2b58fe Add quota to dovecot
Some checks failed
continuous-integration/drone/push Build is failing
2021-02-03 23:20:10 +01:00
2673f771d9 Enable Dovecot sieve 2021-02-03 20:18:46 +01:00
52a29ff010 Fix syntax: don't forget the underscore
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-30 01:14:53 +01:00
b2a49c1e42 Add LMTP for Postfix-Dovecot communication
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-30 01:10:31 +01:00
809f5f9cc9 Add config in the right section
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-30 01:05:37 +01:00
c45dab323a Don't add conf.d/*.conf into a file that is itself already there! dumb dumb
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-30 00:56:17 +01:00
af4d66c85b remove non-existant conf file from the role
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-30 00:46:00 +01:00
fcb53b7cf5 Add sane logging timestamp format
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-30 00:41:30 +01:00
b50ef60e8a fix conf.d template files path
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-30 00:38:15 +01:00
d05425745f Fix indentation... again 2021-01-30 00:34:54 +01:00
8612f835af fix typo and indentation problem
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-30 00:30:35 +01:00
24fa5a969c add local_network variable
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-30 00:25:15 +01:00
99a46af244 User handlers to run when something changed
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-30 00:02:28 +01:00
8b66ba059b use command instead of shell when no shell functionality is required 2021-01-29 23:59:53 +01:00
b8e4ece8a7 use underscores instead of dashes inside role names
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-29 23:44:20 +01:00
094334e069 Fix mode, shoudl always be set
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-29 01:03:18 +01:00
de2758f4d6 rename roles to match regex set by linter 2021-01-29 01:01:10 +01:00
58064df056 fix typo 2021-01-29 00:57:24 +01:00
bd8942eff2 reload -> restart 2021-01-29 00:56:08 +01:00
418da50049 Add dovecot role to the mailserver 2021-01-29 00:55:02 +01:00
645f0fd445 Add dovecot bind password into the vault
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-29 00:27:00 +01:00
eb257b966b dovecot vars 2021-01-29 00:20:02 +01:00
ad1a1602eb dovecot ldap conf
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-29 00:16:42 +01:00
1297884ce1 Add ssl conf
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-28 03:15:45 +01:00
026e35adc7 Add IMAP/POP/SMTP auth conf
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-28 01:34:09 +01:00
f991befbc6 renamed to fit jinja template
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-28 01:27:22 +01:00
79b75cae00 maildir conf
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-28 01:24:50 +01:00
765ce39625 auth config 2021-01-28 01:11:32 +01:00
d3cf2c7e5f dovecot handlers
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-28 00:15:51 +01:00
e1d8382fed fix typo
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-28 00:13:08 +01:00
241997396b Config outside of conf.d
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-28 00:11:36 +01:00
a54c5832a3 Apt retry mechanism 2021-01-28 00:07:23 +01:00
851e459b6f Starting to try out postfix config
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 23:48:36 +01:00
a8cbe4549c fix ansible lint v2 -- we actually git add the file this time
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 23:45:09 +01:00
ee16220591 Please linter
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 17:02:52 +01:00
9d4c630c7e Add the mail-certificate role
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 17:02:05 +01:00
06917ce46b Agree to Letsencrypt TOS
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 16:40:28 +01:00
a5a0e5ccfe oupsie, reverse this
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 13:27:55 +01:00
72d486119e fix typo 2021-01-17 13:27:43 +01:00
7e03eafeaa dashes are evil, use underscore in var names 2021-01-17 13:27:24 +01:00
e77047a532 add sain defaults for NFS client
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 13:03:09 +01:00
d873b3f3a8 fix ansible-lint
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 12:51:52 +01:00
5c9ae10a8c Fix yaml lint 2021-01-17 12:47:58 +01:00
17a64241d6 mail is no longer in adm
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 12:42:15 +01:00
807ecda890 Added NFS host_var for mail.auro.re
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 12:41:37 +01:00
f901669341 fix var names for better hierarchy
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 12:34:25 +01:00
1847a5a698 Add nfs-client role
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-17 12:31:30 +01:00
8557db5e89 Added the certificates gestion
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-15 19:52:55 +01:00
ca6d4a9839 commented unused tasks for the moment
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-14 22:48:13 +01:00
9a04934bd2 Starting the dovecot task 2021-01-14 22:47:29 +01:00
bb8bd718a9 fix yaml lint
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-14 12:25:23 +01:00
9c0f7010a7 Add (initial) mailserver playbook
Some checks failed
continuous-integration/drone/push Build is failing
2021-01-14 12:16:20 +01:00
846665961a Add (initial) mail-utils role 2021-01-14 12:16:00 +01:00
b412210d56 Add (initial) postfix role 2021-01-14 12:15:48 +01:00
b2fb30d46d Add mail vars 2021-01-14 12:14:57 +01:00
219 changed files with 3888 additions and 6043 deletions

View file

@ -2,9 +2,9 @@ skip_list:
- no-changed-when
- load-failure
- document-start
- meta-no-info
- ignore-errors
warn_list:
- experimental # all rules tagged as experimental
exclude_paths:
- group_vars/all/vault.yml
- utils/
- group_vars/all/vault.yml

View file

@ -5,7 +5,8 @@ name: check
steps:
- name: ansible and yaml linting
image: quay.io/ansible/toolset:3.5.0
pull: never
image: aurore-ansible-lint-image
commands:
- ansible-lint
...

View file

@ -2,9 +2,8 @@
# Recettes Ansible d'Aurore
Dépendances requises :
* Ansible 2.9 ou plus récent.
Ensemble des recettes de déploiement Ansible pour les serveurs d'Aurore.
Pour les utiliser, vérifiez que vous avez au moins Ansible 2.7.
## Ansible 101
@ -89,11 +88,8 @@ On va utiliser plutôt `ProxyJump`.
Dans la configuration SSH :
```
Host *.adm.auro.re *.pve.auro.re
# Accept new host keys
StrictHostKeyChecking accept-new
# Use passerelle to connect to administration VLANs
# Use a proxy jump server to log on all Aurore inventory
Host 10.128.0.* *.adm.auro.re
ProxyJump passerelle.auro.re
```

View file

@ -1,17 +1,38 @@
# Ansible configuration
[defaults]
ask_vault_pass = True
roles_path = ./roles
# Do not create .retry files
retry_files_enabled = False
# Use inventory
inventory = ./hosts
filter_plugins = ./filter_plugins
ansible_managed = Ansible managed, modified on %Y-%m-%d %H:%M:%S
# Custom header in templates
ansible_managed = Ansible managed, modified on %Y-%m-%d %H:%M:%S by {uid}
# Do not use cows (with cowsay)
nocows = 1
# Do more parallelism
forks = 15
# Some SSH connection will take time
timeout = 60
remote_user = root
[privilege_escalation]
# Use sudo to get priviledge access
become = True
# Ask for password
become_ask_pass = True
[diff]
# TO know what changed
always = yes
[ssh_connection]
pipelining = True

View file

@ -5,6 +5,13 @@
roles:
- baseconfig
- basesecurity
# Plug LDAP on all servers
- hosts: all,!unifi
roles:
- ldap_client
# Install logrotate
- hosts: all,!unifi,!pve
roles:
- logrotate
- update_motd

20
copy-keys.sh Executable file
View file

@ -0,0 +1,20 @@
#!/bin/bash
set -e
# Grab valid unique hostnames from the Ansible inventory.
HOSTS=$(grep -ve '^[#\[]' hosts \
| grep -F adm.auro.re \
| sort -u)
# Ask password
read -s -p "Hello adventurer, what is your LDAP password? " passwd
echo
for host in $HOSTS; do
echo "[+] Handling host $host"
# sshpass can be used for non-interactive password authentication.
# place your password in ldap-password.txt.
SSHPASS=${passwd} sshpass -v -e ssh-copy-id -i ~/.ssh/id_rsa "$host"
done

View file

@ -1,3 +0,0 @@
#!/usr/bin/env bash
# Deploy all playbooks
ansible-playbook playbooks/*.yml $@

View file

@ -0,0 +1,8 @@
---
# Deploy a correclty configured postfix on non mailhost servers
- hosts: all,!unifi
vars:
local_network: 10.128.0.0/16
relay_host: proxy.adm.auro.re
roles:
- postfix_non_mailhost

View file

@ -0,0 +1,7 @@
FROM python:3.9-alpine
LABEL description="Aurore's docker image for ansible-lint"
RUN apk add --no-cache gcc musl-dev python3-dev libffi-dev openssl-dev cargo
RUN pip install "yamllint>=1.26.0,<2.0"
RUN pip install "ansible-lint==5.0.0"
RUN pip install "ansible>=2.10,<2.11"

View file

@ -0,0 +1,18 @@
# Ansible-lint image
In order to build this image when a new version comes out, you need to
1. ssh into the `drone.adm.auro.re` server
2. git pull this repo to the lastest version
3. optionally make the changes if it has not been done yet
4. `sudo docker build -t aurore-ansible-lint-image docker-ansible-lint/`
5. ???
6. enjoy
You can verify that the image was correclty built by running
```
# list the images present
sudo docker image ls
# run your image with an interactive shell
sudo docker run -it --rm aurore-ansible-lint-image /bin/sh
```

View file

@ -1,40 +0,0 @@
import ipaddress
from operator import attrgetter
import dns.name
class FilterModule:
def filters(self):
return {
"remove_domain_suffix": remove_domain_suffix,
"ipaddr_sort": ipaddr_sort,
}
def remove_domain_suffix(name):
parent = dns.name.from_text(name).parent()
return parent.to_text()
def ipaddr_sort(addrs, types, unknown_after=True):
check_types = {
"global": attrgetter("is_global"),
"link-local": attrgetter("is_link_local"),
"loopback": attrgetter("is_loopback"),
"multicast": attrgetter("is_multicast"),
"private": attrgetter("is_private"),
"reserved": attrgetter("is_reserved"),
"site_local": attrgetter("is_site_local"),
"unspecified": attrgetter("is_unspecified"),
}
def addr_weight(addr):
if isinstance(addr, str):
addr = ipaddress.ip_address(addr.split("/")[0])
for index, ty in enumerate(types):
if check_types[ty](ipaddress.ip_address(addr)):
return index
return len(types) if unknown_after else -1
return sorted(addrs, key=addr_weight)

View file

@ -15,9 +15,13 @@ ldap_matrix_password: "{{ vault_ldap_matrix_password }}"
ldap_replica_password: "{{ vault_ldap_replica_password }}"
ldap_admin_password: "{{ vault_ldap_admin_password }}"
ldap_admin_hashed_passwd: "{{ vault_ldap_admin_hashed_passwd }}"
ldap_dovecot_bind_dn: "cn=dovecot,ou=service-users,{{ ldap_base }}"
ldap_dovecot_password: "{{ vault_ldap_dovecot_password }}"
# Databases
postgresql_services_url: 'bdd-ovh.adm.auro.re'
postgresql_services_url: 'services-bdd.adm.auro.re'
postgresql_synapse_passwd: "{{ vault_postgresql_synapse_passwd }}"
postgresql_codimd_passwd: "{{ vault_postgresql_codimd_passwd }}"
# Scripts will tell users to go there to manage their account
intranet_url: 'https://re2o.auro.re/'
@ -66,6 +70,9 @@ keepalived_password: "{{ vault_keepalived_password[apartment_block] }}"
re2o_secret_key: "{{ vault_re2o_secret_key }}"
re2o_db_password: "{{ vault_re2o_db_password }}"
re2o_aes_key: "{{ vault_re2o_aes_key }}"
re2o_hostname: "re2o.auro.re"
re2o_api_username: "service-user"
re2o_api_password: "{{ vault_re2o_serviceuser_passwd }}"
# Radius
radius_secret_aurore: "{{ vault_radius_secrets.aurore }}"
@ -88,23 +95,9 @@ ipv6_base_prefix: "2a09:6840"
is_aurore_host: "{{ 'aurore_vm' in group_names }}"
# Borgbackup
borg_keep_daily: 7
borg_keep_weekly: 4
borg_keep_monthly: 12
borg_backup_directories:
- /etc
- /var
borg_backup_exclude:
- /var/log
- /var/lib/docker
- /var/lib/lxcfs
borg_encryption_passphrase: "{{ vault_borg_encryption_passphrase }}"
# Mail
borg_server_host: 10.128.0.4
rsyslog_outputs:
- proto: relp
address: 10.128.0.241
port: 20514
...
myorigin: "auro.re"
# myhostname should be the FQDN (Fully Qualified Domain Name)
myhostname: "mail.auro.re"
local_network: "10.128.0.0/24"

View file

@ -1,246 +1,176 @@
$ANSIBLE_VAULT;1.1;AES256
64313161633263303464663933363265373935633862653634643862343232643432343966376438
6134633764383937373966346538306530316539303966320a363035303038616435383366656532
39346463396563626166333362306464343836386365303836356461323663633831636562393039
3832636432626238350a666566323435623834396166656233306639333830343130326265616234
61666365663963643437386530363261306438376665386463376366363662656161316263303831
61393136363934316462616131326463333736656136643038623061313363386538393833663637
36373565333566306632313865646538633532393731313430633462666334323762653337383338
63313433333835653366363061343839326131666139346563306366656365316663333438363837
33323165353936343165646464306434303161313139653561346461653537616164623434376534
33666662343734633766356230383761353239333632613031396365346536373432363433633564
61633762393033343336373864653438336436613630366539333731383336346665313732396265
32356138666135383562656366353131366436363464643630656130303437623131333239386363
66373866393064306565306565386230373638633733326661333065633136633130323963323765
30353262323835313365383562326363343965636634376133613331363133313030346561653931
39363636636235646131353034663861336362383263613165323230366439383561653165363764
65366130623362623539393461363832353435616266393036386439303834316635366438393936
33383933366262636232383066663130383965306137356363363539633661373664613738336539
31363131616135623039346465623530376533386263343836376662316562386530336266303062
64386531303938623939653635313163633261336339366139666135323130653862346132646636
30363065303235346331333434653331646333616337623562643564366435613938643235333664
30626164373030303237656366623631396138333265383566333664663061613536666363623630
61623362383439636239336234333161366635306432363230366630383836326330343932303863
39393232373831363863333332636362396639663831656266336430313837666463336439353332
63303036633433323439613535326663633332346565646338353761363733643766363132666365
34303865656262303563323665363730663062626537363461646363636461633762663237366366
64393133656464643065633634313261336662646435313735306266316132636530393631353830
61303939373363323131316463333136326365333430626266376636356130396239323464353937
64616232373532396334343433636332353530386662633164353235626361623164313039336666
31636434666437393839393133633961373139313663616366373239386163623064373836376164
62316638366366376134386231306435616138656461373633393339653532363434393834393430
37363335623934306661333135343266663464623438353665613330356236323036363139643064
62383934363465316338393065383935646134353230376131613935613431656333383565353134
34643866353131653061623236306536363163373639396564336434653839346263303930633663
39393935636235313431303032336361313730373238333732626465346662363038636361383631
65393433346363366337383233646166306339653533646632623262376630383265393438326135
31643039333835666338383762336163336337343532393063323165636531353361613731363065
65303637396332613432663636326334646635346237396461636366356133303333306239393739
34353966653662346230383865643231313239626533643761366162613164333132373636623237
32356335643766646266646266633366363165373861306433316561363166363865303133633939
34633132343438363034323638376666313061383965323566646463653163313235373364386666
62393865373137343237306637363536383939303833663532396333313931336162333837613935
66383266343735396337663936333162323738383264376533316536376563396333343263643931
65646535363337373865353265306434356432353066656665366638353331366334366339613538
32373637633564613861626538373365336362313434633137613966353861393462623862663330
64386431373066306334383863366133333564373163386433313231363366393830343230323734
61633962356637326538336663386330653563353763663236623539363630626363323237333237
30656139626561313064323330373032323031343137366638303966313832646365666238326337
63306363613361653933306234386163383837666430616663383664386563323839326232383761
35373539626438356539393266653864353066633365383437623437356464383335383039343137
61373539343631373932373033656233323964353666626162386537616333366562346265656238
35396130356166303564303036383664656435626534303064653363316464616335303965376330
61646638383138323265313631613037396561626162306661653231646230343139656135333236
63303838316266333665636335663361656262353066666430656162323236633564313337353665
35363565303736633564356632346632343832363934343962313030646132663566346664313632
38393061613163356265643434626166393366366634343032626637333332316361663639623534
62323239373639393337373537646232663531653835356165313264663561623633633830373734
31336234613633666538373961626430316530346462343061323661353564323938353338373961
64616637303734303333626166306330613238646265636136653939363936356165356232396436
65353731633836363433616534636330663565643561363233396538386430393964353433616437
36343936313936303165396236393463646363383338366238363961666530623335653234656139
65346337663437623134376137326166323933613861663032623965643538343638376234316232
36333065323234663263343630353739313661373536316162366532336438373263303730626464
38613136393166626663636631363064303736666235333036616435373063363762666565363136
38333966303831313333613831313132633062616235353365313533386236613338373130303836
61326262313833306437366364316433393931353265326131653563656131333436376338613266
39326632613366666136643137303635336631353230396435313537656366326239626362313833
62653039343261613265306362323234623264366664306561663839306631663465303962386462
39353934643562383762623937643034383534393962333466613636346637323235346438666636
31613838313535666166663063373333653439313035346266666463623666613837313933623837
63343565663739393764353761316432626237346234663032316131306262356233333439323961
38646664383030303832646563393836643135303731306435383338623633626638306165386637
65393238653464623032336437643838333932366131656332333165376261383539386466343139
65613733383837323832303738363664653138613830376333363038383839623463623631666237
63363263396533353763373934373034643763376665316638353435663635346135333265363235
62663432343935343964626432353563313036303761393039386231343530663737633466643035
65343835353037643539316439666666633866356530363237373230373439373133313337653237
66613631373637313534353862653437393234363365323032393035376438616264336661616262
37336435326135373065353564383637626637343532396331623334643139386364316431376435
36356566363033636539363430356565373039363863396565643730656531346364626334393436
33343839303538383530363231366166623233333730323163323432373831313639626337346230
30333930333064393337616564386163623436613933623466353933393733346339383534633239
30633365313364666566643533326163336330323232353533316633313739343035383465376330
65356139386463633565366132383832643032333234633964373437633836343435393631396166
34633439643764623936366536353931646132373539326238303761383339643661616266646130
30393166393465326365393130636136336433623262346435353936306133616135653734383635
65393530633836613937346430366337626365363361663533313837363063396538663766646566
63373639653732353135343562353266316164303863336365303635653464393232613939396131
30636361343932663233663566656131363938656161623966316366656561343166336532613666
65613534663762353662353262623634616264373964316336626166353330303539356130646166
63643435353765633766626165643465386331333637366562393861613834323464363932306430
32643836646266643031396262626136313363623663366430376432373036643835653863323631
30613164326430633664306630333632363931656135643465363439376263386561383534633666
64323763656466343064396639313264386239356664663461333166626332326536623132333434
62303261643164643330333662623935383037353338306135613737306563326336336162633138
33623066373265663362303133363032343933306336396466383034636131333837313333326531
39336163313633623639303462313763656632633030336236643030343262653366633939643536
31636535393864663363353930363761623264343630396336396431663330323436613462633136
37336464353730643566393432343762333336653932333366636265343663323462626232623635
34346136333630363539633666316561376266373032373961313437653564636537656630303261
37313639333233333365383763333061373730623939303530303832646365323739356564626137
35633366393636376463393961333830343232363266633931613332643134643234303733373466
35323831623931633436626636346431303965663639666566623433383736633834626330303265
37353337656233663938663839373931623137666662623266336537383631626631306235363064
33313564316438633139336261623736336336326239376630316335313631376132646563333430
33656432643130643832343065353834633366363339353964623762666564633835633636313731
63353637636165663136623736343234393038313235333363643237643566623766393838386635
33646233623032653233336266636335666233353032303837663162303939383262373761623261
35366661363966346233633739663635353361303264356534366235616164316138623730623632
62316362623736396264366632373661373835393434343364353431316362666235616635633566
64353530633334393737346663653562346335323065356665643132353738363132623031353664
66666639326238386634363664356664343161386435323736316636343536326435303066353035
37363731613138393333636562386363333932386362303139643262386237353863363764643139
64616561373239346464623165616332623434303433626638376232333733646136376431626438
66613134343639656331626630303030366133356636663735353466353834613430356265386162
66613332663232623438636661306332613162666561353537313336643134663664306630636639
61613363353264373831393962333631383236666130646333336431303735333165656438363432
38396530333631636135653534393531326434306362396237366430383166323832336434376364
38393431646338316232373431613930326532646333386435303034356564336665346133393866
61643533643361646265313334633463616437393437653935613261366635616430313064346532
32363831613565313836376338646466323130373032613863323037323566643164653132633735
65636562653535626461396666643330386333663137613333643165656336633038323036373162
31376338613862333334643561313332326237646565633934323032626662633631633033623063
63306664656437663732323339383735306132616531373865323835633264333639336163366466
33373433653839393638323034623835643531393266306331313563613265616633353763653438
65363532653163303861383531356639316331343531666666636336373634636134633331366364
62366230366435323435613964636533353236373935626632623536396664313264653031623062
33366166343630313839366262313234346262343336386538336335393835646138666330656361
61313936323838653832633130346539636363613838343363663431623063333933383466353938
65383361333561383631643938613862343236346233363466333237316339616362366565306639
39356563656132303463346138356435303038303165363935343266396462326365363262393336
37396235366639623761366239386165613065626431633733306234343866663266633631656237
63643430383433393835663635356265636635363137613064353066313338346436356632346265
38393730336465396263373137383238653337396364643061303234666266663064663265383434
36636138643432373633313038393737663735363838396164366234643533633762383062353831
66326231363337323666386263373438656630346336663239643030386434636264666634393631
39313364333761343532346165396365306463393037643935666363323630326664616638313338
39396336653738353333343835363861643166376565346463303135376439336134666235623230
32363031303732666133386164313437366164326539373564623236356432303132633436323563
36323634373538376133613736633133356638323861636434646465643432636366376138636232
63633830613462613831313938326339343632393038376639623131366364623536353338363439
32613331623863336165636364616634303264356630303665383638663737343836663831363263
63366562393734323030306436346534626530656465396535323835316139633562363830373437
63626530326530383538623165356532303862353763326432373966626436303465373431373762
38613539623164353732623636376630643465343839666531306438326633343362306665366132
39396537366266353864656232616334336130333337306463313932393832653661343036396261
64613461633433356334623631643861303133383963336635623138326139613564343838366565
36343130353462333162313736636139306233366466626231306561626335396262663531333839
61336437343137356335633764373730306466326133356331333530353537616661373062656438
35356235666464656466323937353837623535643937383866666133383633396563333338633034
38366531613164363966323137646237393135383164643230663331306335636432656565633636
34343031633632346533353666353034666266666561346464306665386634313263323333653330
66323033393531343633356466613837346164393332613037636465343230623731616361336338
61373332373636646435353734386366613334323161626437396232613534613330613532323534
65653065386432313733663165616333663666363733623162306536303833663136353334656466
64353931363838613761663561666639373865393438396565626661343934353662363834636535
65363664393433313036383438643864663339626331343230343337316437336634636363303563
35373539383535353235633730386232363539616632336566376264393832383637663330613133
37643261363966633138373935333438393536373938383265373261363232343030373539366335
61633162663137643061363366653135323639363838626266386262666133306461333432313738
30313332626166303630363839396663396564633961383863326663356230343938643833303933
34333032353935323565346633363537656639613663356130383264373739636231363364613066
36653664346434393933383337313630623131396461343930383537633536643365306564396665
31353861643335353538623838393335326364393738376239623431306231363739656438626265
37666532336661306262303761616238666239623265663231386165353437366631376234343035
33393037316563373534373765616238616639303031346430623561663430393536303163613338
65353062336164626335376235656235343637366438353334356436653266333062663838316263
32623732306462356162623437393035626433336631643833626463656634366332613936346465
34653331363133373635633330363564333264623566613432383439396537343963653239336265
33326132663434363065646265646130333935303662623037363938313464366564323734333437
36336335303738643634653164306332636130316161393335656536386131396662616366383139
36663863343736666665363337663537326330323437346565346465326231366563643136366365
37636361343961326261336437616266373962643765346438333766306537303137353764396330
39626635373631353635313935363834363730386132376363663462653330623130663266373432
65343237326535613535386363396236336536366165306463643162346638623638373433646163
62613935363636353639623839396231393838303135346536383037353636613563323234626131
64373666303436393861373164376564646235366131343433623733663832653039393738343537
65323534343464613230346532623966616462353532373064623566626563336464326336393364
39626237646431313135323036303065343138616632343237396136366332636132303037376132
33623031623635653162616265316366663262373666636638386130643336383130643232643662
34326663343562613962343033396332303261636230353331313730336630633461333736626333
66636430643330383032646634396133626339623036333963396662313234623466366634636334
33373762386662613966353664346239666133656435353365653536356331613632666132376264
62613433366633663065306166396166633836306139376533396165393966323465303638373563
63326330323161303065643365343363313338326238363137663139613463613434643834613662
64663365633965653363633165653038333335333232633434323037643936646561376431626230
66356138373136366134373533386634373061666330663364376336383433306331386162393633
33636330643531396464313736363061303466393861613730323563626363643731333633366532
64646130636234653566346533323962353332653335336239353630633535623935396638663366
37383661343636613261623833653032373764653164346634663431653664636233323734666166
36373664306566663930353338366431623563396166356638626166333165623263636336613138
34343936393964666564306637346561393538383137663162663630336462656663316338376236
63633666333263663734353861633164653132663334306664643133663736663766626639393236
32653430333163313363343731666135656662363838366132383732346130313130363365656263
32643533393163376264653632663262353966306630333064313932616262323134326361633764
63383837303936616434616630653833653833623263623532306363373836323431393335623530
34316562343035326265333164643163356230643639373431326431303538346363376332373434
31313666313663343363353130306561646136393732663164393232636330663635346434343134
33663138663336636430373763396435323138373633666438623234363631336232366635366532
62616239663934653462656163326134303261376635323864633435383666363065656665303538
62626538343638366236646136363232373437336630383739656438636465326531646664366462
36353663626634386538336239623734323234393463313034303837363164363263623065613061
38333162646232366339333662313965663336613238386530393162346266636532353433656136
66326436323836376432313238613165373565643233333435393361636637653361616435393438
32383763393561343734643438346635613663393736613839623263663866336165343235663933
66623137616561313462653631613830363666653635336534643935373739353138363934656134
35663063396162623432373534333463376231666466393963336231653939326663396336383735
34633763336163313432616163313638623963306666643432306661393632346339373963633265
32303862643661376433356661383335313365306534663534396638313531373538326236636363
37626138333437393363323261336663653163643565303063313231346131376261653763356631
62306262336337366134626632333663363139393131306666303235303761623665356431646234
33666461663035303066353137623762653565353533613435663839396238336337333463636465
38353135356634626137376232613330393235383432356436393030313564306537616363383136
66356463373138313661373565326565343066643133633630313031303132313031663739316631
66666631386163313034306532393862393930653931363235396662366262636466363464396466
61303962303066633764393831396632626233343633313061323838623134373036393164633139
30303861636335636131376334376239636235653233323435623262366132663934613661333135
61386136326435363337316363666330363431613135663661303438383664663930656564373730
32373731393666333364633835646431646662313232383136616238303264383438663766356462
32346664376430663934626661663039656461383738626265346162393861346163656161323333
39323666643031376530303230626166613233383731363766373634623430633635303963313466
34646331363539636133373134353535356265393265393635323532323134643034343663636362
38633261613433393634396234396265623063346138363133646532366638306632396464646432
61373961383438386535336131393633303430346162613738343839653038303035303033626535
37343030623530333332306265373539633735616634663666356437303862636338363866613861
38346130336338373865343866306665616530313938616366346131376262346135323537663137
39383366313766666234323234363937623264353532323033363966313135653163343036666262
34393832613034383239393930383063336131356364303231323966303633333331633666373764
65383137333965663234663933303231356165376233326233303035316536666563656363343933
36633039666432643135636331353932633164633964623661373739633665313433306561303637
62373534346562363132643063643732343462653838393635343266626535353864656437313434
34376538303965616539626534613431623834376337643936613137323031323139393762636463
66346664666361623636666533663037613434353135393862376633636233656330366136646434
30653735323961383130393763333630306131376430363436623238646632363462383739653636
37346566663039383866323639633565366338353438386461616239313639343766333661346435
33316538366463383733346663316564656566656165396465393461363061613239666165346661
62346639623163363762366431313831663135643062336363323336303737393437653863303665
36643466336566336236353166333063633830646461626262333937316162353365353130353535
30383164363532363532306364393236303537383139643431393962333063633162313033613561
32323434336364343061386666616639336566373461633462393130336461303531353436623065
65663430623066336533373662306566396263376562343936666166626666323964373334613835
64633535303365643564626562643562636363363834353865353765356665643965663861366436
63333736613232353130616466316637613966646139323565356537666331666564623832333439
36376131663431616430616265323039646432393166613631313762613264313765323231663961
65616636306362386534626130636261636566626365643630616135323634343935653033653433
3061
66303361306465306436306562636265303832353830313933363965316261376162313738653737
3334363661316563633238316632336463323737633066610a306236343636656261623835343466
39386437363564623661333465386338613632316563373164363839623138336165343834313237
6433343439383431360a633139363034623861396633316632336131333137626239646639326131
65613236363733346330636565303039613737366263356230313734383033383435343433386536
30653263396339656337626239303662326134373231303364613066656339376662643934323466
30643261393463373063623865343537653862353766323538613731353534363639616438313663
66366133643462333935636231636638326364636334613430333062616264663961326362613466
66313730363933653631646638616166343030626465336361313239323731356534313963613530
65383735626234663261393834313232626239666135313566353839616162323732323265633031
62393862663438313237663335396332613661313864303630653533343362333834356262363465
30666232356539386437353438643038333766363362653432366263616338393066363532633064
63646561653264393162303430346662623536363364383862366264393532613461303935653261
39376462623561626336306435323934323130613031623865656432626233616563393365343036
37643463666436386230653339613463633133333661356564646234653632313931333765383666
39646331383939343663306634393531646265363531326636326636616632643437343566656464
64643638616264376130656637386134396161306636333064633731646234396566303934626332
66393466626137336265653933346362396639383064393663613866333337653166343262646536
61333864373737333133626438646538353338663531323961666335333166613363653230643139
38616462306461356135306164376332313538613465316563663566373533396635346635646134
31386661306533383130633130346539303666316663333762383131623535343038613963353336
32336135366435643463613962383833666130363765326631613963363266626633643966663063
33363235353765623961346331393963653130663434356234336538626438616334613761636161
32346234643531396530653636626531653033393863383963663938646135616238393861373738
30346664646465666666333165336636616265303265393236626534343163353633643737366264
63303937306637643033663333353633346166636361323538393063353438353135303665616663
34613230383836343861613661356162363831623363633435646234353839663530363936356238
63383038616631666633653032613435316265626137643730666539393561373264613663656464
30613033373435313036633938353461623335396264313236623065323339623537613164316366
33356432646438636530353230333762346165336661393038666138356561333363613563656665
34306136393233346532303461393736636561316231626231643633333938656435663638306261
33393064333662336466313461363638393339373637303735663736353537363364663235363263
36623663636235363332616433626266653330393633326339376562636165323539313532363535
64386136393631656665343337333738653664613966363361313931313763323563383265623935
31643532346363656462646436343761353938626661383336636436373233343530353130626463
36346330626432376338306339396563316233313836383863303232396439336436363833383063
39663864306533376630623334386336663237666635336661383630616139633736393835666534
61393036363763336632623236383236383639373662393761313834653833316332373733653830
62616563386435396433653930653637643031636462633336663033306531356239346564663564
30636462343263643236316635346163373765393262623365353933313065333532353562333932
62656234656363306266386135313466376665663166623038616637663333353731313564356434
61343235613639386364663533376362613364653562613431393862656265313432623532343965
65326362323534346535326331613262653130623336653231323564376534336261643538333434
31333830653933633562626364363364386630343364376337613436663030333865323433316163
33356438366161626666653731386438643064656538373036393532396432396138353564313833
34643231366439656439336534323039616364396137653661373761343635663366363134623032
62313734313061353065613561613337373338623732326362363436616134343864643439363631
38346339383864373635383462326466303635383661633665663362646165663934336632633838
64373332356664663663613735663163336465353030383365346661326634373832656137393061
34626363383964646439356338343439343336626237626366383663386161663037343339383066
30356332623337626437313235623161373937663532613238353333326265663937653034616135
64663731653965613933636561313730623030656666656232396433646563623137643661643132
30383439343764396137313231353161323835393934373561623666653630656335366434636235
36306162316464613365616330626433306335396130336266616566653661336335346566613763
30373638353230313433333539306664323333646463333334366362613832376534356636383235
30626263383036643034303465366137356665366238366663313837323937646631396262623331
62323366623530663561643036643733323230343832633639663737356530643564643534666366
64646339363235376561363835643166663735643333656230386565653234356565323135333731
65313864316166383566386564303461343031356138386362633834316230396436306533306239
62306132373535363931306664346637663561323530346339373234343633663062393361323532
32653938623738383565353965656636336662323939346331396162623862613038633035643766
30346431393237323735386337643062396433366434396531623130643038366465643132303532
62366266393166333138643238383764656461623361326236333565373762316431373132356263
30396263396264626330613734346361646531626531363639393431366636316135333566393561
65393661333837633236396563333631663036376633666538306564333565653030303135313866
32366234313532656437393964666438393737363437303562633937396437663062616636383564
33393564643066383662323765346535616164633239636235656263336663633562646665393734
31393232376662666431393064643161653730653263313536613963376561386536353536616163
63316237636630306165346633646437636636626331303262663032653662333236646564613363
63616263643266393861386166346139343237633232653734363465303935613264366130336261
63333137633266306465363837646163323266363665396266363437303931353938653638343630
61386561616663303330663634306235336432316365303461623665393338396434346533366130
35303363643334613862613831366464616264386338373566613431303939623638656536306532
31346365623766346566353564613761333563303233336139376639363634616564303336393737
38333637376566393437383264386561386336653135663135356466663430383634313535626233
65646131353961663064316434353564383163646166323832663662373031636531623736643566
37336530636133363561643438663563353963373265333333386434336361326338646666636263
64396438616335393338376632326162326530636431323466646261623531303335656135313834
34613764336234303230373737326662396562303439363535643562386661303861666530366332
62316635343436396535656163393737343664333963356539313037306432643166393333353036
63663266613332363364313863303465366136333862346164306335353838333830343261323365
61373565666665663065666233316639326238323763333336383665653434623031383063613162
33666532363638353130303665646536663139633463343764353962643838353037323865623236
39613832616265376464363234363532323265366362316564343964636539656263376632313538
38653066666165333866646437353264383638366138633538336434623139623264623033656661
36643336343764613136653432316361343963313162326439656662386334356535373361303330
31653963306365373633323937363332636633613266363064363535366136646639643632343031
34393363373861613863313039393336333165386637393265333439396230643735363230363530
61643036353062643164663063343930613536653762633231333931646239343661343738386232
66373934643837323266623866393166373837323034373662306565623534396562326635323362
31613138613261626231663330626664376539366165353836343039336138623931643537363931
62313862313164306337383465333464313966656538643836643639653632663564633232343362
61323033316630616536633938393735343332653965656565663163396335643738646463303130
64363334326165653962656534313939666230373362316438346139356266616566346462356162
61316233346463376162356461623734313431623330633239353730643964616662383966323932
35373962663333653738616562396638633136376635383032313634333931626530393532663531
30356232626566386632356334393939343262393536666130333537646338343063313565623163
64383337303665613630393164383337346132346462373338323933316231386233323061353661
64336337376231383035653861373639373763633337396236373161613833303630316663626331
62633336383834363033316539336261346137303463643337393465393339663966653464336162
66633832383734373635356165343336323866663735353931626466613361636632313437326566
36386631653935633036373831643763656564643138303564306630396539373536383261663366
63333061333431626465353839343564346331323961663939373538636261343336663461336566
61343231633064336561666362633739636435633663653432393862356232356434356439343936
35326237313033363031336162303436383733626365373832333438393436663938316366343161
65656566353535363664386336383137313962333339396530356361363630353365366532656464
39353639626639653535316665383962646331326463353663383630633961353031396131393562
64663661396330356664316536623666383762623934306532636562663038336165376262633661
30373531356163386531623738373837366666323637333932393131366531316439643338373230
39663131313531343736353666376532326566313963623432643965646666333939613538643463
66333762306162623963306136343930306638383933333835626231616466633561633766383564
36653163366336666565626665323966373434383432303430306632333636353337386265323534
61306435356164313731393862383531646665346134616330303237396136313765313233313434
35393065363264323232323537363237303330386635346263306463636233393461393232306534
34636138333038366165343434323937363864366463326330353438313662323035653965383138
34646331356237613461393464386465303834373536336666626539313431303635653831303237
66643536336330303438393161613833346337336333636137336435333830386137653139386665
34636463313438323038616134383932646266656434633861363331393634393030356562646134
36653830326330353962393736393566393839366132643163303862316566633838373537613531
30396636333564623930313636363762636437373138313835393362346237353731316662343661
36636536643534636632646463376333346230383866353736393535313931313066656231336234
65333935653537613239663166303636356466653337643362313834303634623535653166613138
33316638313233613239386235383737623361376132346666393661393464613963616233613033
35386534353462386238313833666234633662353166303463333463346636646565313333613866
62313066366131353961323761306461653732393737386539646461346133626363303563353035
63313536646234396433306361366338386539326366316163363132326230366632383032646233
35626138326633653032393263326261313761623437336630646634636463613533353239353734
65363236373038623965353166656131313835373834386635656361323931653237393336333938
38373737613966356366313636656366363031396639623633373162363363373830363564356336
37373537323462633337663462666637363661313166323038623665393562663862383161383363
64366663656537663837373662313564663033333663633333613733656662303639313630623162
65663165363164343364633132376538653834323764646664626266343534393763663936616339
37336336356164613534653862626230356635333361326266323365353665666531343337613331
61303731313431386633616230393562373331643966306161343730336539313935306662343865
39303237653733663162303664386237376266333963663034636564363032373235646430363837
38636261613564323565336639623533343964663733366138303635303833633738326165643938
38616364663737333535346661356333326238303439626138303465663932393839653362393432
33613236316161323135373162333866666136623062373037383665633034356534333530643037
33363466643030323061373633393233383838616631636266323165656137636532626136353561
64663936396364613236363663316534366162623735336235643631373263616330353036623333
32393334663663393264376630626630653962393632353239356236626334633833306335386333
30356630306630323334663334363063343462383837393663636133343465336537353433663536
66313265613032343838633164633366396236343136303163353365343032353239376539393965
32316361663438623731336537393135336465336161646661366565356338326537646561376434
36626332303661373561306338666533633435393433393832656166656264376266363035366637
64346432336339396636353930363263653838343266623430613730373235376538366465373764
31326537383336633434663231663865353763323235623866633339393633323836366637303536
62313139646562616339356336663838386439313531333030643032333838343332383533663134
32323935376462646130346631656362373035346436376266653164303263653566303037393136
36313038303862373662356662663437353265326433653330343437316230646338306639646532
35653732306239653133656361333330333634376332323737303831666461346165616138663637
63376263333365623037616336303038613536303163343930396635386536363936346465326137
63653835623135353161643765643563396636313635306461376531626332333335393661646431
33323430653464396230366465343236303033356432643066303730323132306238643737376533
65643232323138313562346661396361363730643736626166386664313732326136373531663466
36383630636161376431393135373863356137353737306166393934656437363063363630393864
62663464623932616532636231643964396533396230363837383235666561663032663938373165
32313931373935316137643937623161306330653161336138363562313033613132306164623364
38336435333432323237353734393666646361626535393665306662393831393765636265373938
61303832343631313634393037356662643162643233363731386265323862383034623564393661
30646566643336323038633161356437613666626431613762363530343166633735383365323462
36336364616531393031326361626638323834353365666437363466653234316532396662343365
63393331336336636363313438386461303838306539303161333433313037373361366336653462
65626531646338626532646563346566626536643166313432363231343163313039323461633265
61396263303433383830333865366537633066366231393034623233633436316133303030653236
64366638353634666661666534363763356164333065313136613761626262383239646539626330
31636665326134653836626364616161636265393534666138386234373635313834343338646139
39363432643962623339636463346264343530666133656361316437333837346236353532613131
36626562326536303263373361326565326364363934343430313662376464303532346361653563
62333238633765363363363265303438396631303463376561383832643633353065366633633364
65663634613638336638376632353733646536313839313335383939613565623463313534633335
33333139343633353830663434643139663839323364643235623832386536633264373434336133
63303461383063313738626431663361633730343730623865613936373232616663373636646338
31376261376139666531376663613331366539303133353564333036336239343233666238303361
303137643632666133393733336431393664

View file

@ -1,5 +0,0 @@
---
borg_keep_hourly: 6
borg_backup_exclude:
- "/var/lib/postgresql/"
...

View file

@ -1,8 +1,8 @@
---
glob_certbot:
- dns_rfc2136_server: '10.128.0.30'
dns_rfc2136_server: '10.128.0.30'
dns_rfc2136_name: certbot_challenge.
dns_rfc2136_secret: "{{ vault_certbot_dns_secret }}"
mail: tech.aurore@lists.crans.org
certname: auro.re
domains: "*.auro.re"
domains: "auro.re"

View file

@ -4,14 +4,11 @@ glob_nginx:
who: "L'équipe technique d'Aurore"
service_name: service
ssl:
# Add adm.auro.re if necessary
- name: auro.re
cert: /etc/letsencrypt/live/auro.re/fullchain.pem
cert_key: /etc/letsencrypt/live/auro.re/privkey.pem
trusted_cert: /etc/letsencrypt/live/auro.re/chain.pem
servers:
- ssl: false # Replace by auro.re or adm.auro.re
default: true
- ssl: false
server_name:
- "default"
- "_"
@ -19,14 +16,9 @@ glob_nginx:
locations:
- filter: "/"
params: []
additional_params: []
upstreams: []
auth_passwd: []
default_server:
default_ssl_server:
default_ssl_domain: auro.re
real_ip_from:
- "10.128.0.0/16"
- "2a09:6840:128::/64"
deploy_robots_file: false

View file

@ -1,12 +0,0 @@
---
loc_nginx:
servers: []
glob_reverseproxy:
redirect_dnames:
- aurores.net
- fede-aurore.net
reverseproxy_sites: []
redirect_sites: []

View file

@ -1,3 +0,0 @@
---
rsyslog_high_density: true
...

View file

@ -1,12 +0,0 @@
---
borg_keep_hourly: 6
borg_keep_daily: 7
borg_keep_weekly: 4
borg_keep_monthly: 12
borg_backup_directories:
- "/etc"
- "/var"
- "/data_nextcloud"
- "/data_gitea"
- "/data_mail"
...

View file

@ -1,16 +0,0 @@
---
borg_backup_directories:
- "/etc/"
- "/var/"
borg_backup_exclude: []
rsyslog_collector_base_dir: /var/log/remote
rsyslog_inputs:
- proto: relp
port: 20514
- proto: udp
port: 514
- proto: tcp
port: 6514
rsyslog_outputs: []
...

View file

@ -0,0 +1,19 @@
---
certbot:
domains:
- mail.auro.re
- smtp.auro.re
mail: tech.aurore@lists.crans.org
certname: auro.re
cert:
# path_cert: "/etc/letsencrypt/live/auro.re/cert.pem"
# path_chain: "/etc/letsencrypt/live/auro.re/chain.pem"
path_fullchain: "/etc/letsencrypt/live/auro.re/fullchain.pem"
path_privkey: "/etc/letsencrypt/live/auro.re/privkey.pem"
nfs:
src: "10.128.0.6:/data_mail" # caradoc
mount_path: "/var/vmail"
dir_owner: vmail
dir_group: vmail

View file

@ -1,3 +0,0 @@
---
borg_server_backups_dir: /borg
...

View file

@ -1,18 +1,29 @@
---
loc_certbot:
domains:
- portail-fleming.auro.re
- portail-pacaterie.auro.re
- portail-rives.auro.re
- portail-edc.auro.re
- portail-gs.auro.re
mail: tech.aurore@lists.crans.org
certname: auro.re
loc_nginx:
service_name: captive_portal
default_server: '$server_addr'
default_ssl_server: '$server_addr'
servers:
- server_name:
- ssl: false
server_name:
- "10.13.0.247"
locations:
- filter: "/"
params:
- "return 302 https://portail-fleming.auro.re/portail/"
- ssl: auro.re
- ssl: true
server_name:
- portail-fleming.auro.re
locations:
@ -24,7 +35,7 @@ loc_nginx:
params:
- "return 302 https://portail-fleming.auro.re/portail/"
- ssl: auro.re
- ssl: false
server_name:
- 10.23.0.247
locations:
@ -32,7 +43,7 @@ loc_nginx:
params:
- "return 302 https://portail-pacaterie.auro.re/portail/"
- ssl: auro.re
- ssl: true
server_name:
- portail-pacaterie.auro.re
locations:
@ -44,7 +55,7 @@ loc_nginx:
params:
- "return 302 https://portail-pacaterie.auro.re/portail/"
- ssl: auro.re
- ssl: false
server_name:
- "10.33.0.247"
locations:
@ -52,7 +63,7 @@ loc_nginx:
params:
- "return 302 https://portail-rives.auro.re/portail/"
- ssl: auro.re
- ssl: true
server_name:
- portail-rives.auro.re
locations:
@ -64,7 +75,7 @@ loc_nginx:
params:
- "return 302 https://portail-rives.auro.re/portail/"
- ssl: auro.re
- ssl: false
server_name:
- "10.43.0.247"
locations:
@ -72,7 +83,7 @@ loc_nginx:
params:
- "return 302 https://portail-edc.auro.re/portail/"
- ssl: auro.re
- ssl: true
server_name:
- portail-edc.auro.re
locations:
@ -84,7 +95,7 @@ loc_nginx:
params:
- "return 302 https://portail-edc.auro.re/portail/"
- ssl: auro.re
- ssl: false
server_name:
- "10.53.0.247"
locations:
@ -92,7 +103,7 @@ loc_nginx:
params:
- "return 302 https://portail-gs.auro.re/portail/"
- ssl: auro.re
- ssl: true
server_name:
- portail-gs.auro.re
locations:

View file

@ -1,20 +1,44 @@
---
loc_certbot:
- dns_rfc2136_server: '10.128.0.30'
dns_rfc2136_name: certbot_challenge.
dns_rfc2136_secret: "{{ vault_certbot_dns_secret }}"
certbot:
domains:
- auro.re
- chat.auro.re # cname to riot.auro.re
- codimd.auro.re
- element.auro.re # cname to riot.auro.re
- ehterpad.auro.re # cname to pad.auro.re
- grafana.auro.re
- hedgedoc.auro.re # cname to codimd.auro.re
- pad.auro.re
- passbolt.auro.re
- paste.auro.re # cname to privatebin.auro.re
- phabricator.auro.re
- privatebin.auro.re
- riot.auro.re
- sharelatex.auro.re
- status.auro.re
- wiki.auro.re
- www.auro.re
- zero.auro.re # cname to privatebin.auro.re
mail: tech.aurore@lists.crans.org
certname: auro.re
domains: "auro.re, *.auro.re"
loc_reverseproxy:
nginx:
ssl:
cert: /etc/letsencrypt/live/auro.re/fullchain.pem
cert_key: /etc/letsencrypt/live/auro.re/privkey.pem
trusted_cert: /etc/letsencrypt/live/auro.re/chain.pem
redirect_dnames:
- aurores.net
- fede-aurore.net
redirect_tcp: {}
redirect_sites:
- from: www.auro.re
to: auro.re
- from: 92.222.211.195
to: auro.re
- from: codimd.auro.re
to: hedgedoc.auro.re
reverseproxy_sites:
- from: phabricator.auro.re
@ -29,9 +53,6 @@ loc_reverseproxy:
- from: passbolt.auro.re
to: 10.128.0.53
- from: auth.auro.re
to: 10.128.0.150:8089
- from: riot.auro.re
to: "10.128.0.150:8080"
- from: element.auro.re
@ -39,6 +60,8 @@ loc_reverseproxy:
- from: chat.auro.re
to: "10.128.0.150:8080"
- from: codimd.auro.re
to: "10.128.0.150:8081"
- from: hedgedoc.auro.re
to: "10.128.0.150:8081"
@ -59,10 +82,5 @@ loc_reverseproxy:
- from: cas.auro.re
to: "10.128.0.150:8085"
- from: rss.auro.re
to: 10.128.0.150:8090
- from: status.auro.re
to: "10.128.0.150:8086"
- from: "kanboard.auro.re"
to: "10.128.0.150:8088"
...

View file

@ -1,31 +1,31 @@
---
loc_certbot:
- dns_rfc2136_server: '10.128.0.30'
dns_rfc2136_name: certbot_adm_challenge.
dns_rfc2136_secret: "{{ vault_certbot_adm_dns_secret }}"
mail: tech.aurore@lists.crans.org
certname: adm.auro.re
domains: "*.adm.auro.re"
- dns_rfc2136_server: '10.128.0.30'
dns_rfc2136_name: certbot_challenge.
dns_rfc2136_secret: "{{ vault_certbot_dns_secret }}"
certbot:
domains:
- bbb.auro.re
- drone.auro.re
- gitea.auro.re
- intranet.auro.re
- litl.auro.re
- nextcloud.auro.re
- re2o.auro.re
- vote.auro.re
- re2o-server.auro.re
- re2o-test.auro.re
- wikijs.auro.re
mail: tech.aurore@lists.crans.org
certname: auro.re
domains: "*.auro.re"
loc_nginx:
servers: []
nginx:
ssl:
- name: adm.auro.re
cert: /etc/letsencrypt/live/adm.auro.re/fullchain.pem
cert_key: /etc/letsencrypt/live/adm.auro.re/privkey.pem
trusted_cert: /etc/letsencrypt/live/adm.auro.re/chain.pem
- name: auro.re
cert: /etc/letsencrypt/live/auro.re/fullchain.pem
cert_key: /etc/letsencrypt/live/auro.re/privkey.pem
trusted_cert: /etc/letsencrypt/live/auro.re/chain.pem
loc_reverseproxy:
redirect_dnames:
- aurores.net
- fede-aurore.net
redirect_tcp:
- name: Gitea
port: 2222
@ -41,14 +41,14 @@ loc_reverseproxy:
- from: intranet.auro.re
to: 10.128.0.20
- from: bbb.auro.re
to: 10.128.0.54
- from: nextcloud.auro.re
to: "10.128.0.58:8080"
- from: gitea.auro.re
to: "10.128.0.60:3000"
- from: git.adm.auro.re
to: "10.128.0.60:3000"
ssl: adm.auro.re
- from: drone.auro.re
to: "10.128.0.64:8000"
@ -61,12 +61,3 @@ loc_reverseproxy:
- from: wikijs.auro.re
to: "10.128.0.66:3000"
- from: wiki.auro.re
to: "10.128.0.66:3000"
- from: netbox.auro.re
to: 10.128.0.97
- from: grafana.auro.re
to: "10.128.0.98:3000"

371
hosts
View file

@ -8,11 +8,10 @@
###############################################################################
# Aurore : main services
viviane.adm.auro.re
[aurore_pve]
escalope.adm.auro.re
services-1.pve.auro.re
services-2.pve.auro.re
services-3.pve.auro.re
merlin.adm.auro.re
[aurore_vm]
routeur-aurore.adm.auro.re
@ -26,30 +25,21 @@ camelot.adm.auro.re
gitea.adm.auro.re
drone.adm.auro.re
nextcloud.adm.auro.re
galene.adm.auro.re
stream.adm.auro.re
re2o-server.adm.auro.re
re2o-ldap.adm.auro.re
re2o-db.adm.auro.re
mail.adm.auro.re
services-bdd-local.adm.auro.re
backup.adm.auro.re
services-web.adm.auro.re
mail.auro.re
wikijs.adm.auro.re
prometheus-aurore.adm.auro.re
portail.adm.auro.re
jitsi-aurore.adm.auro.re
log.adm.auro.re
bdd.adm.auro.re
bdd-ovh.adm.auro.re
litl.adm.auro.re
log.adm.auro.re
netbox.adm.auro.re
grafana.adm.auro.re
dolibarr.adm.auro.re
infra-1.router.auro.re ansible_host=10.129.0.245
infra-2.router.auro.re ansible_host=10.129.0.246
[aurore_testing_vm]
[aurore_ilo]
escalope-ilo.adm.auro.re
pendragon.adm.auro.re
###############################################################################
# OVH
@ -59,11 +49,17 @@ horus.adm.auro.re
[ovh_container]
synapse.adm.auro.re
services-bdd.adm.auro.re
phabricator.adm.auro.re
wiki.adm.auro.re
www.adm.auro.re
proxy-ovh.adm.auro.re
matrix-services.adm.auro.re
[ovh_vm]
serge.adm.auro.re
passbolt.adm.auro.re
vpn-ovh.adm.auro.re
docker-ovh.adm.auro.re
switchs-manager.adm.auro.re
ldap-replica-ovh.adm.auro.re
@ -77,10 +73,8 @@ prometheus-federate.adm.auro.re
###############################################################################
# Les Jardins de Fleming
[fleming_server]
perceval.adm.auro.re
[fleming_pve]
freya.adm.auro.re
marki.adm.auro.re
[fleming_vm]
@ -89,30 +83,37 @@ dhcp-fleming.adm.auro.re
dhcp-fleming-backup.adm.auro.re
dns-fleming.adm.auro.re
dns-fleming-backup.adm.auro.re
ntp-1.int.infra.auro.re
prometheus-fleming.adm.auro.re
#prometheus-fleming-fo.adm.auro.re
radius-fleming.adm.auro.re
dns-1.int.infra.auro.re
isp-1.rtr.infra.auro.re
isp-2.rtr.infra.auro.re
dhcp-1.isp.auro.re
dhcp-2.isp.auro.re
radius-fleming-backup.adm.auro.re
unifi-fleming.adm.auro.re
routeur-fleming.adm.auro.re
routeur-fleming-backup.adm.auro.re
[fleming_ilo]
marki-ilo.adm.auro.re
[fleming_unifi]
fa-0-1.borne.auro.re
ff-1-2.borne.auro.re
fe-1-2.borne.auro.re
ff-2-2.borne.auro.re
ff-3-2.borne.auro.re
ff-4-2.borne.auro.re
fh-1-2.borne.auro.re
fh-2-2.borne.auro.re
fe-3-2.borne.auro.re
fe-2-2.borne.auro.re
fe-4-2.borne.auro.re
fh-3-2.borne.auro.re
fh-4-2.borne.auro.re
fg-3-2.borne.auro.re
fg-2-2.borne.auro.re
fi-1-2.borne.auro.re
fi-2-2.borne.auro.re
fi-3-2.borne.auro.re
fi-4-2.borne.auro.re
fa-1-1.borne.auro.re
fa-2-1.borne.auro.re
fa-3-1.borne.auro.re
fa-4-1.borne.auro.re
fa-j-1.borne.auro.re
fb-0-1.borne.auro.re
fb-1-1.borne.auro.re
fb-2-1.borne.auro.re
@ -123,83 +124,67 @@ fc-1-1.borne.auro.re
fc-2-1.borne.auro.re
fc-3-1.borne.auro.re
fc-4-1.borne.auro.re
fd-2-1.borne.auro.re
fd-0-1.borne.auro.re
fd-1-1.borne.auro.re
fd-2-1.borne.auro.re
fa-0-1.borne.auro.re
fd-3-1.borne.auro.re
fe-0-1.borne.auro.re
fe-1-1.borne.auro.re
fe-1-2.borne.auro.re
fe-2-1.borne.auro.re
fe-2-2.borne.auro.re
fe-3-1.borne.auro.re
fe-3-2.borne.auro.re
fe-4-1.borne.auro.re
fe-4-2.borne.auro.re
ff-0-1.borne.auro.re
ff-0-f.borne.auro.re
ff-1-1.borne.auro.re
ff-1-2.borne.auro.re
ff-2-1.borne.auro.re
ff-2-2.borne.auro.re
ff-3-1.borne.auro.re
ff-3-2.borne.auro.re
ff-4-1.borne.auro.re
ff-4-2.borne.auro.re
fg-0-1.borne.auro.re
fg-1-1.borne.auro.re
fg-1-2.borne.auro.re
fg-2-1.borne.auro.re
fg-2-2.borne.auro.re
fg-3-1.borne.auro.re
fg-3-2.borne.auro.re
fg-4-1.borne.auro.re
fh-0-1.borne.auro.re
fh-1-1.borne.auro.re
fh-1-2.borne.auro.re
fh-2-1.borne.auro.re
fh-2-2.borne.auro.re
fh-3-1.borne.auro.re
fh-3-2.borne.auro.re
fe-2-1.borne.auro.re
fh-4-1.borne.auro.re
fh-4-2.borne.auro.re
fi-0-1.borne.auro.re
fi-0-2.borne.auro.re
fi-1-1.borne.auro.re
fi-1-2.borne.auro.re
fi-2-1.borne.auro.re
fi-2-2.borne.auro.re
fi-3-1.borne.auro.re
fi-3-2.borne.auro.re
fi-4-1.borne.auro.re
fi-4-2.borne.auro.re
fj-0-1.borne.auro.re
fj-1-1.borne.auro.re
fj-1-2.borne.auro.re
fj-2-1.borne.auro.re
fj-2-2.borne.auro.re
fj-3-1.borne.auro.re
fj-3-2.borne.auro.re
fj-4-1.borne.auro.re
fj-4-2.borne.auro.re
fk-0-1.borne.auro.re
fk-1-1.borne.auro.re
fk-1-2.borne.auro.re
fk-2-1.borne.auro.re
fk-2-2.borne.auro.re
fk-3-1.borne.auro.re
fk-3-2.borne.auro.re
fk-4-1.borne.auro.re
fk-4-2.borne.auro.re
fl-0-1.borne.auro.re
fl-1-1.borne.auro.re
fl-1-2.borne.auro.re
fl-2-1.borne.auro.re
fl-2-2.borne.auro.re
fl-3-1.borne.auro.re
fl-3-2.borne.auro.re
fl-4-1.borne.auro.re
fe-1-1.borne.auro.re
ff-0-f.borne.auro.re
fj-4-2.borne.auro.re
fj-3-2.borne.auro.re
fj-2-2.borne.auro.re
fj-1-2.borne.auro.re
fk-4-2.borne.auro.re
fk-3-2.borne.auro.re
fk-2-2.borne.auro.re
fk-1-2.borne.auro.re
fl-4-2.borne.auro.re
fl-3-2.borne.auro.re
fl-2-2.borne.auro.re
fl-1-2.borne.auro.re
fa-j-1.borne.auro.re
fg-1-2.borne.auro.re
fi-0-2.borne.auro.re
###############################################################################
# Pacaterie
@ -222,51 +207,48 @@ unifi-pacaterie.adm.auro.re
routeur-pacaterie.adm.auro.re
routeur-pacaterie-backup.adm.auro.re
[pacaterie_ilo]
mordred-ilo.adm.auro.re
titan-ilo.adm.auro.re
[pacaterie_unifi]
pc-1-1.borne.auro.re
pn-0-1.borne.auro.re
pn-1-1.borne.auro.re
pn-0-2.borne.auro.re
pn-0-3.borne.auro.re
pn-1-1.borne.auro.re
pn-1-2.borne.auro.re
pn-1-3.borne.auro.re
pn-2-1.borne.auro.re
pn-3-1.borne.auro.re
pn-2-2.borne.auro.re
pn-2-3.borne.auro.re
pn-3-1.borne.auro.re
pn-3-2.borne.auro.re
pn-3-3.borne.auro.re
pn-4-1.borne.auro.re
pn-4-2.borne.auro.re
pn-4-3.borne.auro.re
ps-0-1.borne.auro.re
ps-0-2.borne.auro.re
pn-2-1.borne.auro.re
pn-3-2.borne.auro.re
pn-0-1.borne.auro.re
pn-1-2.borne.auro.re
pc-1-1.borne.auro.re
pn-4-2.borne.auro.re
pn-4-1.borne.auro.re
ps-0-3.borne.auro.re
ps-1-1.borne.auro.re
ps-1-2.borne.auro.re
ps-0-1.borne.auro.re
ps-1-3.borne.auro.re
ps-2-1.borne.auro.re
ps-2-2.borne.auro.re
ps-2-3.borne.auro.re
ps-3-1.borne.auro.re
ps-1-2.borne.auro.re
ps-3-2.borne.auro.re
ps-3-3.borne.auro.re
ps-4-1.borne.auro.re
ps-4-2.borne.auro.re
ps-2-1.borne.auro.re
ps-3-1.borne.auro.re
ps-4-3.borne.auro.re
ps-2-2.borne.auro.re
ps-1-1.borne.auro.re
ps-4-2.borne.auro.re
ps-0-2.borne.auro.re
ps-3-3.borne.auro.re
###############################################################################
# Emilie du Chatelet
[edc_server]
caradoc.adm.auro.re
perceval.adm.auro.re
[edc_pve]
chapalux.adm.auro.re
escalope.adm.auro.re
[edc_vm]
routeur-edc.adm.auro.re
@ -281,20 +263,13 @@ radius-edc-backup.adm.auro.re
ldap-replica-edc.adm.auro.re
prometheus-edc.adm.auro.re
[edc_ilo]
caradoc-ilo.adm.auro.re
chapalux-ilo.adm.auro.re
[edc_unifi]
ee-2-1.borne.auro.re
ee-2-2.borne.auro.re
eo-0-1.borne.auro.re
eo-2-1.borne.auro.re
ep-0-1.borne.auro.re
ep-1-1.borne.auro.re
ep-1-2.borne.auro.re
ep-1-3.borne.auro.re
ep-1-2.borne.auro.re
ep-0-1.borne.auro.re
eo-2-1.borne.auro.re
ee-2-1.borne.auro.re
###############################################################################
# George Sand
@ -316,64 +291,59 @@ radius-gs-backup.adm.auro.re
prometheus-gs.adm.auro.re
ldap-replica-gs.adm.auro.re
[gs_ilo]
lancelot-ilo.adm.auro.re
odin-ilo.adm.auro.re
[gs_unifi]
ga-1-2.borne.auro.re
ge-3-2.borne.auro.re
gb-4-2.borne.auro.re
gg-5-2.borne.auro.re
gd-5-2.borne.auro.re
gc-5-2.borne.auro.re
gc-3-1.borne.auro.re
gc-4-1.borne.auro.re
gg-5-1.borne.auro.re
ge-1-2.borne.auro.re
gh-1-2.borne.auro.re
gd-1-2.borne.auro.re
gf-3-2.borne.auro.re
gd-4-2.borne.auro.re
ga-0-1.borne.auro.re
ga-1-1.borne.auro.re
ga-1-2.borne.auro.re
ga-2-1.borne.auro.re
ga-2-2.borne.auro.re
ga-3-1.borne.auro.re
ga-4-1.borne.auro.re
ga-5-1.borne.auro.re
ga-5-2.borne.auro.re
gb-1-1.borne.auro.re
gc-1-1.borne.auro.re
gc-2-1.borne.auro.re
gc-5-1.borne.auro.re
gb-2-1.borne.auro.re
gb-3-1.borne.auro.re
gb-4-1.borne.auro.re
gb-4-2.borne.auro.re
gb-5-1.borne.auro.re
gc-1-1.borne.auro.re
gc-2-1.borne.auro.re
gc-3-1.borne.auro.re
gc-4-1.borne.auro.re
gc-5-1.borne.auro.re
gc-5-2.borne.auro.re
gd-1-1.borne.auro.re
gd-1-2.borne.auro.re
gd-2-1.borne.auro.re
gd-3-1.borne.auro.re
gd-4-1.borne.auro.re
gd-4-2.borne.auro.re
gd-5-1.borne.auro.re
gd-5-2.borne.auro.re
gd-garage-1.borne.auro.re
ge-0-1.borne.auro.re
ge-1-1.borne.auro.re
ge-1-2.borne.auro.re
ge-2-1.borne.auro.re
ge-2-2.borne.auro.re
ge-3-1.borne.auro.re
ge-3-2.borne.auro.re
ge-4-1.borne.auro.re
ge-5-1.borne.auro.re
gf-0-1.borne.auro.re
gf-1-1.borne.auro.re
gf-2-1.borne.auro.re
gf-3-1.borne.auro.re
gf-3-2.borne.auro.re
gf-4-1.borne.auro.re
gf-1-1.borne.auro.re
gd-garage-1.borne.auro.re
gf-5-1.borne.auro.re
gg-5-1.borne.auro.re
gg-5-2.borne.auro.re
gh-1-2.borne.auro.re
###############################################################################
# Les Rives
[rives_pve]
thor.adm.auro.re
loki.adm.auro.re
[rives_vm]
@ -384,75 +354,41 @@ radius-rives-backup.adm.auro.re
routeur-rives-backup.adm.auro.re
ldap-replica-rives.adm.auro.re
prometheus-rives.adm.auro.re
dhcp-rives.adm.auro.re
dns-rives.adm.auro.re
radius-rives.adm.auro.re
routeur-rives.adm.auro.re
[rives_ilo]
loki-ilo.adm.auro.re
[rives_unifi]
r1-1-1.borne.auro.re
r1-1-2.borne.auro.re
r1-1-3.borne.auro.re
r1-1-4.borne.auro.re
r1-1-5.borne.auro.re
r1-1-6.borne.auro.re
r1-2-1.borne.auro.re
r1-2-2.borne.auro.re
r1-2-3.borne.auro.re
r1-2-4.borne.auro.re
r1-3-1.borne.auro.re
r1-3-2.borne.auro.re
r1-3-3.borne.auro.re
r1-3-4.borne.auro.re
r1-3-5.borne.auro.re
r1-3-6.borne.auro.re
r2-1-1.borne.auro.re
r2-1-2.borne.auro.re
r2-1-3.borne.auro.re
r2-1-4.borne.auro.re
r2-2-1.borne.auro.re
r2-2-2.borne.auro.re
r2-2-3.borne.auro.re
r2-3-1.borne.auro.re
r2-3-2.borne.auro.re
r2-3-3.borne.auro.re
r2-3-4.borne.auro.re
r3-0-1.borne.auro.re
r3-0-2.borne.auro.re
r3-0-3.borne.auro.re
r3-0-4.borne.auro.re
r3-1-1.borne.auro.re
r3-1-2.borne.auro.re
r3-4-4.borne.auro.re
r3-4-3.borne.auro.re
r3-2-1.borne.auro.re
r3-4-1.borne.auro.re
r3-2-8.borne.auro.re
r3-3-4.borne.auro.re
r3-1-3.borne.auro.re
r3-1-4.borne.auro.re
r3-1-5.borne.auro.re
r3-3-5.borne.auro.re
r3-2-4.borne.auro.re
r3-3-6.borne.auro.re
r3-1-2.borne.auro.re
r3-4-5.borne.auro.re
r3-2-2.borne.auro.re
r3-4-6.borne.auro.re
r3-1-1.borne.auro.re
r3-4-7.borne.auro.re
r3-4-2.borne.auro.re
r3-4-8.borne.auro.re
r3-2-3.borne.auro.re
r3-1-6.borne.auro.re
r3-1-7.borne.auro.re
r3-2-1.borne.auro.re
r3-2-2.borne.auro.re
r3-2-3.borne.auro.re
r3-2-4.borne.auro.re
r3-2-5.borne.auro.re
r3-2-6.borne.auro.re
r3-2-7.borne.auro.re
r3-2-8.borne.auro.re
r3-3-1.borne.auro.re
r3-3-2.borne.auro.re
r3-3-3.borne.auro.re
r3-3-4.borne.auro.re
r3-3-5.borne.auro.re
r3-3-6.borne.auro.re
r3-4-1.borne.auro.re
r3-4-2.borne.auro.re
r3-4-3.borne.auro.re
r3-4-4.borne.auro.re
r3-4-5.borne.auro.re
r3-4-6.borne.auro.re
r3-4-7.borne.auro.re
r3-4-8.borne.auro.re
r3-0-1.borne.auro.re
r3-3-2.borne.auro.re
r3-0-2.borne.auro.re
r3-3-1.borne.auro.re
r3-0-3.borne.auro.re
r3-1-5.borne.auro.re
r3-0-4.borne.auro.re
r3-1-4.borne.auro.re
# -aurore services
[aurore:children]
@ -467,7 +403,6 @@ ovh_vm
# everything at fleming
[fleming:children]
fleming_server
fleming_pve
fleming_vm
fleming_unifi
@ -480,7 +415,6 @@ pacaterie_unifi
# everything at edc
[edc:children]
edc_server
edc_pve
edc_vm
edc_unifi
@ -513,11 +447,6 @@ edc_vm
gs_vm
rives_vm
# every server
[server:children]
fleming_server
edc_server
# every PVE
[pve:children]
ovh_pve
@ -538,20 +467,6 @@ pacaterie_unifi
###############################################################################
# Groups by service
[routeur]
routeur-fleming.adm.auro.re
routeur-fleming-backup.adm.auro.re
routeur-pacaterie.adm.auro.re
routeur-pacaterie-backup.adm.auro.re
routeur-edc.adm.auro.re
routeur-edc-backup.adm.auro.re
routeur-gs.adm.auro.re
routeur-gs-backup.adm.auro.re
routeur-rives.adm.auro.re
routeur-rives-backup.adm.auro.re
routeur-aurore.adm.auro.re
routeur-aurore-backup.adm.auro.re
[ldap_replica:children]
ldap_replica_fleming
ldap_replica_pacaterie
@ -581,43 +496,5 @@ ldap-replica-rives.adm.auro.re
[certbot]
portail.adm.auro.re
[certbot:children]
reverseproxy
[nginx]
portail.adm.auro.re
[nginx:children]
reverseproxy
[reverseproxy]
proxy-ovh.adm.auro.re
proxy.adm.auro.re
[bdd]
bdd.adm.auro.re
bdd-ovh.adm.auro.re
re2o-db.adm.auro.re
[radius]
radius-aurore.adm.auro.re
radius-fleming.adm.auro.re
radius-fleming-backup.adm.auro.re
radius-edc.adm.auro.re
radius-edc-backup.adm.auro.re
radius-gs.adm.auro.re
radius-gs-backup.adm.auro.re
radius-pacaterie.adm.auro.re
radius-pacaterie-backup.adm.auro.re
radius-rives.adm.auro.re
radius-rives-backup.adm.auro.re
[prometheus]
prometheus-ovh.adm.auro.re
prometheus-aurore.adm.auro.re
prometheus-rives.adm.auro.re
prometheus-gs.adm.auro.re
prometheus-edc.adm.auro.re
prometheus-pacaterie.adm.auro.re
prometheus-fleming.adm.auro.re
prometheus-federate.adm.auro.re

View file

@ -1,10 +1,7 @@
#!/usr/bin/env ansible-playbook
---
- hosts: all
roles: []
# Clone LDAP on local geographic location
# DON'T DO THIS AS IT RECREATES THE REPLICA
# - hosts: ldap_replica
# roles:
# - ldap_replica
- hosts: ldap_replica
roles:
- ldap_replica

31
mailserver.yml Executable file
View file

@ -0,0 +1,31 @@
#!/usr/bin/env ansible-playbook
---
# Deploy mail server
- hosts: mail.auro.re
roles:
- mail_utils
- mail_certificates
- nfs_client
# - postfix
- dovecot
- re2o_service_mailserver
# - rspamd
# - mail-fail2ban
#
# Make OVH server send mails through proxy ?
# Add multiple MX
# Configure DKIM, SPF, Greylisting, etc...
# Deploy Re2o mail service
- hosts: mail.auro.re
vars:
service_repo: https://gitea.auro.re/aurore/re2o-mail-server.git
service_name: mail-server
service_version: aurore
service_config:
hostname: re2o-test.adm.auro.re # use test instance for now, should be changed for prod!
username: service-user
password: "{{ vault_serviceuser_passwd }}"
roles:
- re2o-service

View file

@ -1,18 +1,18 @@
#!/usr/bin/env ansible-playbook
---
# Install Matrix Synapse
# Install Matrix Synapse on corresponding containers
- hosts: synapse.adm.auro.re
vars:
mxisd_releases: https://github.com/kamax-matrix/mxisd/releases
mxisd_deb: "{{ mxisd_releases }}/download/v1.3.1/mxisd_1.3.1_all.deb"
update_motd:
matrix-synapse: matrix-synapse est déployé.
matrix-appservice-irc: matrix-appservice-irc est déployé.
matrix-appservice-webhooks: matrix-appservice-webhooks est déployé.
roles:
- debian_backports
- nodejs
- matrix_synapse
- matrix_appservice_irc
- matrix_appservice_webhooks
- update_motd
# Install Matrix services
- hosts: matrix-services.adm.auro.re
roles:
- debian_backports

132
monitoring.yml Executable file
View file

@ -0,0 +1,132 @@
#!/usr/bin/env ansible-playbook
---
- hosts: prometheus-fleming.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
# Prometheus targets.json
prometheus_targets:
- targets: |
{{ groups['fleming_pve'] + groups['fleming_vm'] | list | sort }}
prometheus_unifi_snmp_targets:
- targets: "{{ groups['fleming_unifi'] | list | sort }}"
roles:
- prometheus
- hosts: prometheus-pacaterie.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
# Prometheus targets.json
prometheus_targets:
- targets: |
{{ groups['pacaterie_pve'] + groups['pacaterie_vm'] | list | sort }}
prometheus_unifi_snmp_targets:
- targets: "{{ groups['pacaterie_unifi'] | list | sort }}"
prometheus_ups_snmp_targets:
- ups-pn-1.ups.auro.re
roles:
- prometheus
- hosts: prometheus-edc.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
# Prometheus targets.json
prometheus_ups_snmp_targets:
- ups-ec-1.ups.auro.re
prometheus_targets:
- targets: |
{{ groups['edc_pve'] + groups['edc_vm'] | list | sort }}
prometheus_unifi_snmp_targets:
- targets: "{{ groups['edc_unifi'] | list | sort }}"
roles:
- prometheus
- hosts: prometheus-gs.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
# Prometheus targets.json
prometheus_targets:
- targets: |
{{ groups['gs_pve'] + groups['gs_vm'] | list | sort }}
prometheus_unifi_snmp_targets:
- targets: "{{ groups['gs_unifi'] | list | sort }}"
prometheus_ups_snmp_targets:
- ups-gk-1.ups.auro.re
roles:
- prometheus
- hosts: prometheus-rives.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
# Prometheus targets.json
prometheus_ups_snmp_targets:
- ups-r3-1.ups.auro.re
prometheus_targets:
- targets: |
{{ groups['rives_pve'] + groups['rives_vm'] | list | sort }}
prometheus_unifi_snmp_targets:
- targets: "{{ groups['rives_unifi'] | list | sort }}"
roles:
- prometheus
- hosts: prometheus-aurore.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
# Prometheus targets.json
prometheus_targets:
- targets: |
{{ groups['aurore_pve'] + groups['aurore_vm'] | list | sort }}
roles:
- prometheus
- hosts: prometheus-ovh.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
# Prometheus targets.json
prometheus_targets:
- targets: |
{{ groups['ovh_pve'] + groups['ovh_vm'] | list | sort }}
prometheus_docker_targets:
- docker-ovh.adm.auro.re:8087
roles:
- prometheus
- hosts: prometheus-federate.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
# Prometheus targets.json
prometheus_targets:
- prometheus-edc.adm.auro.re
- prometheus-gs.adm.auro.re
- prometheus-fleming.adm.auro.re
- prometheus-pacaterie.adm.auro.re
- prometheus-rives.adm.auro.re
- prometheus-aurore.adm.auro.re
- prometheus-ovh.adm.auro.re
- prometheus-federate.adm.auro.re
roles:
- prometheus_federate
# Monitor all hosts
- hosts: all,!edc_unifi,!fleming_unifi,!pacaterie_unifi,!gs_unifi,!rives_unifi,!aurore_testing_vm,!ovh_container
roles:
- prometheus_node

65
network.yml Executable file
View file

@ -0,0 +1,65 @@
#!/usr/bin/env ansible-playbook
---
# Set up DHCP servers.
- hosts: dhcp-*.adm.auro.re
roles:
- isc_dhcp_server
# Deploy unbound DNS server (recursive).
- hosts: dns-*.adm.auro.re,!dns-aurore*.adm.auro.re
roles:
- unbound
# Déploiement du service re2o aurore-firewall et keepalived
# radvd: IPv6 SLAAC (/64 subnets, private IPs).
# Must NOT be on routeur-aurore-*, or will with DHCPv6!
- hosts: ~routeur-(pacaterie|edc|fleming|gs|rives).*\.adm\.auro\.re
roles:
- router
- radvd
# No radvd here
- hosts: ~routeur-aurore.*\.adm\.auro\.re
roles:
- router
- ipv6_edge_router
# Radius (backup only for now)
- hosts: radius-*.adm.auro.re
roles:
- radius
# WIP: Deploy authoritative DNS servers
# - hosts: authoritative_dns
# vars:
# service_repo: https://gitlab.crans.org/nounous/re2o-dns.git
# service_name: dns
# service_version: crans
# service_config:
# hostname: re2o-server.adm.auro.re
# username: service-user
# password: "{{ vault_serviceuser_passwd }}"
# roles:
# - re2o_service
# Deploy Unifi Controller
# - hosts: unifi-fleming.adm.auro.re,unifi-pacaterie.adm.auro.re
# roles:
# - unifi-controller
# Deploy Re2o switch service
# - hosts: switchs-manager.adm.auro.re
# vars:
# service_repo: https://gitlab.federez.net/re2o/switchs.git
# service_name: switchs
# service_version: master
# service_config:
# hostname: re2o-server.adm.auro.re
# username: service-user
# password: "{{ vault_serviceuser_passwd }}"
# roles:
# - re2o_service

View file

@ -1,32 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts: perceval.adm.auro.re
vars:
update_motd:
borgbackup_server: >-
Les sauvegardes (borg) sont stockées dans
{{ borg_server_backups_dir }}.
roles:
- borgbackup_server
- update_motd
- hosts: all,!unifi,!unifi-*,!bdd
vars:
update_motd:
borgbackup_client: >-
BorgBackup est déployé (/etc/borgmatic/config.yaml)
roles:
- borgbackup_client
- update_motd
# On databases server, also backup databases
- hosts: bdd
vars:
borg_postgresql_databases: true
update_motd:
borgbackup_client: >-
BorgBackup est déployé (/etc/borgmatic/config.yaml)
roles:
- borgbackup_client
- update_motd
...

View file

@ -1,27 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts:
- ntp-1.int.infra.auro.re
vars:
chronyd__allow_networks:
- 10.128.0.0/16
- 2a09:6840:128::/48
chronyd__pools:
- 0.pool.ntp.org
- 1.pool.ntp.org
- 2.pool.ntp.org
- 3.pool.ntp.org
chronyd__local_stratum: 10
roles:
- chronyd
- hosts:
- all
- "!ntp-1.int.infra.auro.re"
- "!unifi"
vars:
chronyd__pools:
- ntp-1.int.infra.auro.re
roles:
- chronyd
...

View file

@ -1,10 +0,0 @@
#!/usr/bin/env ansible-playbook
---
# Deploy Docker hosts
- hosts: docker-ovh.adm.auro.re,gitea.adm.auro.re,drone.adm.auro.re,wikijs.adm.auro.re
vars:
update_motd:
docker: Docker est déployé.
roles:
- docker
- update_motd

View file

@ -1,27 +0,0 @@
#!/usr/bin/env ansible-playbook
---
# Deploy Grafana
- hosts: grafana.adm.auro.re
vars:
grafana:
root_url: https://grafana.auro.re
database:
type: postgres
host: 10.128.0.95
name: grafana
user: grafana
password: "{{ vault_postgresql_grafana_passwd }}"
ldap:
host: "re2o-ldap.adm.auro.re ldap-replica-ovh.adm.auro.re 10.128.0.21 10.128.0.149"
bind_dn: cn=grafana,ou=service-users,dc=auro,dc=re
bind_password: "{{ vault_ldap_grafana_password }}"
search_base_dns: "cn=Utilisateurs,dc=auro,dc=re"
group_search_base_dns: "ou=posix,ou=groups,dc=auro,dc=re"
editors_group_dn:
- cn=sudoldap,ou=posix,ou=groups,dc=auro,dc=re
- cn=technicien,ou=posix,ou=groups,dc=auro,dc=re
update_motd:
grafana: Grafana est déployé (/etc/grafana).
roles:
- grafana
- update_motd

View file

@ -1,213 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts:
- ntp-1.int.infra.auro.re
- dns-1.int.infra.auro.re
- dhcp-1.isp.auro.re
- dhcp-2.isp.auro.re
- isp-1.rtr.infra.auro.re
- isp-2.rtr.infra.auro.re
vars:
# TODO: netbox
ifupdown2__hosts:
ntp-1.int.infra.auro.re:
ens18:
gateways:
- 2a09:6840:128::254
- 10.128.0.254
addresses:
- 2a09:6840:128::203/56
- 10.128.0.203/16
dns-1.int.infra.auro.re:
ens18:
gateways:
- 2a09:6840:128::254
- 10.128.0.254
addresses:
- 2a09:6840:128::127/56
- 10.128.0.127/16
dhcp-1.isp.auro.re:
ens18:
gateways:
- 2a09:6840:128::254
- 10.128.0.254
addresses:
- 2a09:6840:128::204/56
- 10.128.0.204/16
ens19: null
clients:
bridge_vlan_aware: true
bridge_ports:
- ens19
bridge_vids:
- 1000-1004
client-0:
addresses:
- 100.64.0.2/27
vlan_id: 1000
vlan_raw_device: clients
client-1:
addresses:
- 100.64.0.34/27
vlan_id: 1001
vlan_raw_device: clients
client-2:
addresses:
- 100.64.0.66/27
vlan_id: 1002
vlan_raw_device: clients
client-3:
addresses:
- 100.64.0.98/27
vlan_id: 1003
vlan_raw_device: clients
client-4:
addresses:
- 100.64.0.130/27
vlan_id: 1004
vlan_raw_device: clients
dhcp-2.isp.auro.re:
ens18:
gateways:
- 2a09:6840:128::254
- 10.128.0.254
addresses:
- 2a09:6840:128::91/56
- 10.128.0.91/16
ens19: null
clients:
bridge_vlan_aware: true
bridge_ports:
- ens19
bridge_vids:
- 1000-1004
client-0:
addresses:
- 100.64.0.3/27
vlan_id: 1000
vlan_raw_device: clients
client-1:
addresses:
- 100.64.0.35/27
vlan_id: 1001
vlan_raw_device: clients
client-2:
addresses:
- 100.64.0.67/27
vlan_id: 1002
vlan_raw_device: clients
client-3:
addresses:
- 100.64.0.99/27
vlan_id: 1003
vlan_raw_device: clients
client-4:
addresses:
- 100.64.0.131/27
vlan_id: 1004
vlan_raw_device: clients
isp-1.rtr.infra.auro.re:
ens18:
gateways:
- 2a09:6840:128::254
- 10.128.0.254
addresses:
- 2a09:6840:128::255/56
- 10.128.0.255/16
ens19: null
clients:
bridge_vlan_aware: true
bridge_ports:
- ens19
bridge_vids:
- 1000-1004
bridge_disable_pvid: true
forward: true
ipv6_addrgen: false
client-0:
forward: true
vlan_id: 1000
vlan_raw_device: clients
ipv6_addrgen: false
client-1:
forward: true
vlan_id: 1001
vlan_raw_device: clients
ipv6_addrgen: false
client-2:
forward: true
vlan_id: 1002
vlan_raw_device: clients
ipv6_addrgen: false
client-3:
forward: true
vlan_id: 1003
vlan_raw_device: clients
ipv6_addrgen: false
client-4:
forward: true
vlan_id: 1004
vlan_raw_device: clients
ipv6_addrgen: false
isp-2.rtr.infra.auro.re:
ens18:
gateways:
- 2a09:6840:128::254
- 10.128.0.254
addresses:
- 2a09:6840:128::158/56
- 10.128.0.158/16
ens19: null
clients:
bridge_vlan_aware: true
bridge_ports:
- ens19
bridge_vids:
- 1000-1004
client-0:
forward: true
vlan_id: 1000
vlan_raw_device: clients
ipv6_addrgen: false
client-1:
forward: true
vlan_id: 1001
vlan_raw_device: clients
ipv6_addrgen: false
client-2:
forward: true
vlan_id: 1002
vlan_raw_device: clients
ipv6_addrgen: false
client-3:
forward: true
vlan_id: 1003
vlan_raw_device: clients
ipv6_addrgen: false
client-4:
forward: true
vlan_id: 1004
vlan_raw_device: clients
ipv6_addrgen: false
ifupdown2__interfaces: "{{ ifupdown2__hosts[inventory_hostname] }}"
roles:
- ifupdown2
- hosts:
- ntp-1.int.infra.auro.re
- dns-1.int.infra.auro.re
- dhcp-1.isp.auro.re
- dhcp-2.isp.auro.re
- isp-1.rtr.infra.auro.re
- isp-2.rtr.infra.auro.re
vars:
resolvconf__nameservers:
- 2a09:6840:128::127
- 10.128.0.127
resolvconf__domain: auro.re
resolvconf__search:
- "{{ inventory_hostname | remove_domain_suffix }}"
- auro.re
roles:
- resolvconf
...

View file

@ -1,9 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts: dhcp-*.adm.auro.re
vars:
update_motd:
unbound: isc-dhcp-server est déployé.
roles:
- isc_dhcp_server
- update_motd

View file

@ -1,32 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts:
- isp-1.rtr.infra.auro.re
- isp-2.rtr.infra.auro.re
vars:
keepalived__virtual_router_id: 80
keepalived__interface: ens18
keepalived__virtual_addresses:
client-0:
- 100.64.0.1/27
- 2a09:6841::/56
- fe80::1/10
client-1:
- 100.64.0.33/27
- 2a09:6841:0:100::/56
- fe80::1/10
client-2:
- 100.64.0.65/27
- 2a09:6841:0:100::/56
- fe80::1/10
client-3:
- 100.64.0.97/27
- 2a09:6841:0:200::/56
- fe80::1/10
client-4:
- 100.64.0.129/27
- 2a09:6841:0:300::/56
- fe80::1/10
roles:
- keepalived
...

View file

@ -1,17 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts: all
roles: []
# WIP: Deploy authoritative DNS servers
# - hosts: authoritative_dns
# vars:
# service_repo: https://gitlab.crans.org/nounous/re2o-dns.git
# service_name: dns
# service_version: crans
# service_config:
# hostname: re2o-server.adm.auro.re
# username: service-user
# password: "{{ vault_serviceuser_passwd }}"
# roles:
# - re2o_service

View file

@ -1,26 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts: reverseproxy
vars:
certbot: '{{ loc_certbot | default(glob_certbot | default([])) }}'
nginx: '{{ glob_nginx | default({}) | combine(loc_nginx | default({})) }}'
reverseproxy: '{{ glob_reverseproxy | default({}) | combine(loc_reverseproxy | default({})) }}'
update_motd:
nginx: >-
Le reverse-proxy NGINX est déployé (/etc/nginx).
roles:
- certbot
- nginx
- update_motd
- hosts: nginx,!reverseproxy
vars:
certbot: '{{ loc_certbot | default(glob_certbot | default([])) }}'
nginx: '{{ glob_nginx | default({}) | combine(loc_nginx | default({})) }}'
update_motd:
nginx: >-
NGINX avec certbot est déployé (/etc/nginx).
roles:
- certbot
- nginx
- update_motd

View file

@ -1,170 +0,0 @@
#!/usr/bin/env ansible-playbook
---
# Install and configure database servers at Saclay
- hosts: bdd.adm.auro.re
vars:
postgresql:
version: 13
hosts:
- database: nextcloud
user: nextcloud
net: 10.128.0.58/32
method: md5
- database: gitea
user: gitea
net: 10.128.0.60/32
method: md5
- database: wikijs
user: wikijs
net: 10.128.0.66/32
method: md5
- database: drone
user: drone
net: 10.128.0.64/32
method: md5
- database: netbox
user: netbox
net: 10.128.0.97/32
method: md5
- database: grafana
user: grafana
net: 10.128.0.98/32
method: md5
- database: dolibarr
user: dolibarr
net: 10.128.0.236/32
method: md5
- database: rt5
user: rt5
net: 10.128.0.123/32
method: md5
databases:
- nextcloud
- gitea
- wikijs
- drone
- netbox
- grafana
- dolibarr
- rt5
users:
- name: nextcloud
database: nextcloud
password: "{{ vault_postgresql_nextcloud_passwd }}"
privs:
- ALL
- name: gitea
database: gitea
password: "{{ vault_postgresql_gitea_passwd }}"
privs:
- ALL
- name: wikijs
database: wikijs
password: "{{ vault_postgresql_wikijs_passwd }}"
privs:
- ALL
- name: drone
database: drone
password: "{{ vault_postgresql_drone_passwd }}"
privs:
- ALL
- name: netbox
database: netbox
password: "{{ vault_postgresql_netbox_passwd }}"
privs:
- ALL
- name: grafana
database: grafana
password: "{{ vault_postgresql_grafana_passwd }}"
privs:
- ALL
- name: dolibarr
database: dolibarr
password: "{{ vault_postgresql_dolibarr_passwd }}"
privs:
- ALL
- name: rt5
database: rt5
password: "{{ vault_postgresql_rt5_passwd }}"
privs:
- ALL
update_motd:
postgresql: PostgreSQL est déployé.
roles:
- postgresql
- update_motd
# Install and configure database servers at OVH
- hosts: bdd-ovh.adm.auro.re
vars:
postgresql:
version: 13
hosts:
- database: etherpad
user: etherpad
net: 10.128.0.150/32
method: md5
- database: codimd
user: codimd
net: 10.128.0.150/32
method: md5
- database: synapse
user: synapse
net: 10.128.0.56/32
method: md5
- database: kanboard
user: kanboard
net: 10.128.0.150/32
method: md5
- database: cas
user: cas
net: 10.128.0.150/32
method: md5
- database: appservice-discord
user: appservice-discord
net: 10.128.0.150/32
method: md5
databases:
- synapse
- codimd
- etherpad
- kanboard
- cas
- appservice-discord
users:
- name: synapse
database: synapse
password: "{{ vault_postgresql_synapse_passwd }}"
privs:
- ALL
- name: codimd
database: codimd
password: "{{ vault_postgresql_codimd_passwd }}"
privs:
- ALL
- name: etherpad
database: etherpad
password: "{{ vault_postgresql_etherpad_passwd }}"
privs:
- ALL
- name: kanboard
database: kanboard
password: "{{ vault_postgresql_kanboard_passwd }}"
privs:
- ALL
- name: cas
database: cas
password: "{{ vault_postgresql_cas_passwd }}"
privs:
- ALL
- name: appservice-discord
database: appservice-discord
password: "{{ vault_postgresql_appservice_discord_passwd }}"
privs:
- ALL
update_motd:
postgresql: PostgreSQL est déployé.
roles:
- postgresql
- update_motd
...

View file

@ -1,241 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts: prometheus-fleming.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
snmp_switch_community: "{{ vault_snmp_switch_community }}"
snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
snmp_ilo_user: aurore
snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"
prometheus_servers_targets: |
{{ groups['fleming_pve'] + groups['fleming_vm'] | list | sort }}
prometheus_unifi_snmp_targets: |
{{ groups['fleming_unifi'] | list | sort }}
prometheus_ilo_snmp_targets: |
{{ groups['fleming_ilo'] | list | sort }}
update_motd:
prometheus: >-
Prometheus (en configuration fleming) est déployé (/etc/prometheus).
roles:
- prometheus
- update_motd
- hosts: prometheus-pacaterie.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
snmp_switch_community: "{{ vault_snmp_switch_community }}"
snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
snmp_ilo_user: aurore
snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"
prometheus_servers_targets: |
{{ groups['pacaterie_pve'] + groups['pacaterie_vm'] | list | sort }}
prometheus_unifi_snmp_targets: |
{{ groups['pacaterie_unifi'] | list | sort }}
prometheus_ups_snmp_targets:
- ups-pn-1.ups.auro.re
- ups-ps-1.ups.auro.re
prometheus_ilo_snmp_targets: |
{{ groups['pacaterie_ilo'] | list | sort }}
update_motd:
prometheus: >-
Prometheus (en configuration pacaterie) est déployé (/etc/prometheus).
roles:
- prometheus
- update_motd
- hosts: prometheus-edc.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
snmp_switch_community: "{{ vault_snmp_switch_community }}"
snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
snmp_ilo_user: aurore
snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"
prometheus_ups_snmp_targets:
- ups-ec-1.ups.auro.re
# - ups-ec-2.ups.auro.re
- ups-ec-3.ups.auro.re
prometheus_servers_targets: |
{{ groups['edc_pve'] + groups['edc_vm'] + groups['edc_server'] | list | sort }}
prometheus_unifi_snmp_targets: |
{{ groups['edc_unifi'] | list | sort }}
prometheus_ilo_snmp_targets: |
{{ groups['edc_ilo'] | list | sort }}
update_motd:
prometheus: >-
Prometheus (en configuration edc) est déployé (/etc/prometheus).
roles:
- prometheus
- update_motd
- hosts: prometheus-gs.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
snmp_switch_community: "{{ vault_snmp_switch_community }}"
snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
snmp_ilo_user: aurore
snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"
prometheus_servers_targets: |
{{ groups['gs_pve'] + groups['gs_vm'] | list | sort }}
prometheus_unifi_snmp_targets: |
{{ groups['gs_unifi'] | list | sort }}
prometheus_ups_snmp_targets:
- ups-gk-1.ups.auro.re
prometheus_apc_pdu_snmp_targets:
- pdu-ga-1.ups.auro.re
prometheus_ilo_snmp_targets: |
{{ groups['gs_ilo'] | list | sort }}
update_motd:
prometheus: >-
Prometheus (en configuration gs) est déployé (/etc/prometheus).
roles:
- prometheus
- update_motd
- hosts: prometheus-rives.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
snmp_switch_community: "{{ vault_snmp_switch_community }}"
snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
snmp_ilo_user: aurore
snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"
prometheus_ups_snmp_targets:
- ups-r3-1.ups.auro.re
- ups-r1-1.ups.auro.re
prometheus_servers_targets: |
{{ groups['rives_pve'] + groups['rives_vm'] | list | sort }}
prometheus_unifi_snmp_targets: |
{{ groups['rives_unifi'] | list | sort }}
prometheus_ilo_snmp_targets: |
{{ groups['rives_ilo'] | list | sort }}
update_motd:
prometheus: >-
Prometheus (en configuration rives) est déployé (/etc/prometheus).
roles:
- prometheus
- update_motd
- hosts: prometheus-aurore.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
snmp_switch_community: "{{ vault_snmp_switch_community }}"
snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
snmp_ilo_user: aurore
snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"
prometheus_servers_targets: |
{{ groups['aurore_pve'] + groups['aurore_vm'] | list | sort }}
prometheus_postgresql_targets: |
{{ groups['bdd'] + groups['radius'] | list | sort }}
prometheus_switch_snmp_targets:
- yggdrasil.switch.auro.re
- sw-pn-serveurs.switch.auro.re
- sw-ec-serveurs.switch.auro.re
- sw-gk-serveurs.switch.auro.re
- sw-fl-serveurs.switch.auro.re
- sw-ff-uplink.switch.auro.re
- sw-fl-core.switch.auro.re
- sw-fd-vcore.switch.auro.re
- sw-fl-vcore.switch.auro.re
- sw-ff-vcore.switch.auro.re
- sw-pn-core.switch.auro.re
- sw-ec-core.switch.auro.re
- sw-gk-core.switch.auro.re
- sw-r3-core.switch.auro.re
prometheus_ilo_snmp_targets: |
{{ groups['aurore_ilo'] | list | sort }}
update_motd:
prometheus: >-
Prometheus (en configuration aurore) est déployé (/etc/prometheus).
roles:
- prometheus
- update_motd
- hosts: prometheus-ovh.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
snmp_switch_community: "{{ vault_snmp_switch_community }}"
snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
snmp_ilo_user: aurore
snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"
prometheus_servers_targets: |
{{ groups['ovh_pve'] + groups['ovh_vm'] | list | sort }}
prometheus_postgresql_targets:
- bdd-ovh.adm.auro.re
prometheus_docker_targets:
- docker-ovh.adm.auro.re
update_motd:
prometheus: >-
Prometheus (en configuration ovh) est déployé (/etc/prometheus).
roles:
- prometheus
- update_motd
- hosts: prometheus-federate.adm.auro.re
vars:
prometheus_alertmanager: docker-ovh.adm.auro.re:9093
snmp_unifi_password: "{{ vault_snmp_unifi_password }}"
snmp_pdu_user: "{{ vault_snmp_pdu_user }}"
snmp_pdu_password: "{{ vault_snmp_pdu_password }}"
snmp_ilo_user: aurore
snmp_ilo_auth: "{{ vault_snmp_ilo_auth }}"
snmp_ilo_priv: "{{ vault_snmp_ilo_priv }}"
prometheus_servers_targets:
- prometheus-edc.adm.auro.re
- prometheus-gs.adm.auro.re
- prometheus-fleming.adm.auro.re
- prometheus-pacaterie.adm.auro.re
- prometheus-rives.adm.auro.re
- prometheus-aurore.adm.auro.re
- prometheus-ovh.adm.auro.re
update_motd:
prometheus_federate: >-
Prometheus (en configuration fédération) est déployé (/etc/prometheus).
roles:
- prometheus_federate
- update_motd
# Postgres Exporters
- hosts: bdd,radius
roles:
- prometheus_postgres
# Monitor all hosts
- hosts: all,!edc_unifi,!fleming_unifi,!pacaterie_unifi,!gs_unifi,!rives_unifi,!aurore_testing_vm,!ovh_container
roles:
- prometheus_node

View file

@ -1,10 +0,0 @@
#!/usr/bin/env ansible-playbook
---
# Deploy Radius
- hosts: radius-*.adm.auro.re
vars:
update_motd:
unbound: FreeRADIUS est déployé.
roles:
- radius
- update_motd

View file

@ -1,9 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts: all,!unifi
vars:
root_shell: /bin/bash
root_password: "{{ vault_root_password }}"
roles:
- root_account
...

View file

@ -1,23 +0,0 @@
#!/usr/bin/env ansible-playbook
---
# Deploy firewall and keepalived
# radvd: IPv6 SLAAC (/64 subnets, private IPs).
# Must NOT be on routeur-aurore-*, or will with DHCPv6!
- hosts: ~routeur-(pacaterie|edc|fleming|gs|rives).*\.adm\.auro\.re
vars:
update_motd:
unbound: Le routage (avec radvd) est déployé.
roles:
- router
- radvd
- update_motd
# No radvd here
- hosts: ~routeur-aurore.*\.adm\.auro\.re
vars:
update_motd:
unbound: Le routage (avec DHCPv6) est déployé.
roles:
- router
- ipv6_edge_router
- update_motd

View file

@ -1,10 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts: log.adm.auro.re
roles:
- rsyslog_collector
- hosts: all,!unifi
roles:
- rsyslog_common
...

View file

@ -1,14 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts: all,!unifi
vars:
openssh_users_ca_public_key:
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAAB\
hBIpT7d7WeR88bs53KkNkZNOzkPJ7CQ5Ui6Wl9LXzAjjIdH+hKJieBMHrKew7+kzxGYaTqXW\
F1fQWsACG6aniy7VZpsdgTaNw7qr9frGfmo950V7IlU6w1HRc5c+3oVBWpg=="
openssh_authorized_principals:
- any
- "{{ inventory_hostname }}"
roles:
- openssh_server
...

View file

@ -1,17 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts: all
roles: []
# Deploy Re2o switch service
# - hosts: switchs-manager.adm.auro.re
# vars:
# service_repo: https://gitlab.federez.net/re2o/switchs.git
# service_name: switchs
# service_version: master
# service_config:
# hostname: re2o-server.adm.auro.re
# username: service-user
# password: "{{ vault_serviceuser_passwd }}"
# roles:
# - re2o_service

View file

@ -1,10 +0,0 @@
#!/usr/bin/env ansible-playbook
---
# Deploy unbound DNS server (recursive).
- hosts: dns-*.adm.auro.re,!dns-aurore*.adm.auro.re
vars:
update_motd:
unbound: Unbound est déployé.
roles:
- unbound
- update_motd

View file

@ -1,9 +0,0 @@
#!/usr/bin/env ansible-playbook
---
- hosts: all
roles: []
# Deploy Unifi Controller
# - hosts: unifi-fleming.adm.auro.re,unifi-pacaterie.adm.auro.re
# roles:
# - unifi-controller

432
proxmox.yml Executable file
View file

@ -0,0 +1,432 @@
#!/usr/bin/env ansible-playbook
---
# This is a special playbook to create a new VM !
- hosts: proxy.adm.auro.re # Host with python-proxmoxer and python-requests
become: false # We do not need root as we use Proxmox API
vars:
vm_definitions:
# Réseau Pacaterie
- name: ldap-replica-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dhcp-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dns-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: prometheus-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: radius-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: unifi-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-9.9.0-amd64-netinst.iso
# Réseau Fleming
- name: ldap-replica-fleming1
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dhcp-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dns-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: prometheus-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: radius-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: unifi-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-9.9.0-amd64-netinst.iso
# Réseau EdC
- name: ldap-replica-edc1
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dhcp-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dns-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: prometheus-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: radius-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: unifi-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-9.9.0-amd64-netinst.iso
# Réseau George Sand
- name: ldap-replica-gs1
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dhcp-gs
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dns-gs
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: prometheus-gs
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: radius-gs
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: unifi-gs
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-9.9.0-amd64-netinst.iso
vars_prompt:
- name: "password"
prompt: "Enter LDAP password for your user"
private: true
tasks:
- name: Define a virtual machine in Proxmox
proxmox_kvm:
api_user: "{{ ansible_user_id }}@pam"
api_password: "{{ password }}"
api_host: "{{ item.virtu }}.adm.auro.re"
name: "{{ item.name }}"
node: "{{ item.virtu }}"
scsihw: virtio-scsi-pci
scsi: '{"scsi0":"{{ item.virtu }}:{{ item.disksize }},format=raw"}'
sata: '{"sata0":"local:iso/{{ item.installiso }},media=cdrom"}'
net: '{"net0":"virtio,bridge=vmbr2"}' # Adm only by default
cores: "{{ item.cores }}"
memory: "{{ item.memory }}"
balloon: "{{ item.memory // 2 }}"
bios: seabios # Ansible module doesn't support UEFI boot disk
loop:
# Réseau Fleming
- name: ldap-replica-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dhcp-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dns-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: prometheus-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: radius-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: unifi-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-9.9.0-amd64-netinst.iso
- name: routeur-fleming
virtu: freya
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: ldap-replica-fleming-fo
virtu: marki
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dhcp-fleming-fo
virtu: marki
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dns-fleming-fo
virtu: marki
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: prometheus-fleming-fo
virtu: marki
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: radius-fleming-fo
virtu: marki
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: routeur-fleming-fo
virtu: marki
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
# Réseau Pacaterie
- name: ldap-replica-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dhcp-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dns-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: prometheus-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: radius-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: unifi-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-9.9.0-amd64-netinst.iso
- name: routeur-pacaterie
virtu: mordred
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: ldap-replica-pacaterie-fo
virtu: titan
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dhcp-pacaterie-fo
virtu: titan
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dns-pacaterie-fo
virtu: titan
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: prometheus-pacaterie-fo
virtu: titan
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: radius-pacaterie-fo
virtu: titan
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: routeur-pacaterie-fo
virtu: titan
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
# Réseau EDC
- name: ldap-replica-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dhcp-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dns-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: prometheus-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: radius-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: unifi-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-9.9.0-amd64-netinst.iso
- name: routeur-edc
virtu: chapalux
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
# Réseau George Sand
- name: ldap-replica-georgesand
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dhcp-georgesand
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: dns-georgesand
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: prometheus-georgesand
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: radius-georgesand
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso
- name: unifi-georgesand
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-9.9.0-amd64-netinst.iso
- name: routeur-georgesand
virtu: perceval
cores: 2 # 2 mimimum, 10 maximum
memory: 1024 # M
disksize: 16 # G
installiso: debian-10.0.0-amd64-netinst.iso

View file

@ -1,23 +1,23 @@
#!/bin/sh
{{ ansible_managed | comment }}
# {{ ansible_managed }}
# Pretty uptime
upSeconds="$(/usr/bin/cut -d. -f1 /proc/uptime)"
mins="$((upSeconds / 60 % 60))"
hours="$((upSeconds / 3600 % 24))"
days="$((upSeconds / 86400))"
UPTIME="$(printf "%d jours, %02dh%02dm" "$days" "$hours" "$mins")"
mins=$((${upSeconds}/60%60))
hours=$((${upSeconds}/3600%24))
days=$((${upSeconds}/86400))
UPTIME=`printf "%d jours, %02dh%02dm" "$days" "$hours" "$mins"`
# RAM
RAM="$(free -m | awk 'NR==2{printf "%s/%sMB (%.2f%%)\n", $3,$2,$3*100/$2}')"
DISK="$(df -h | awk '$NF=="/"{printf "%d/%dGB (%s)\n", $3,$2,$5}')"
RAM=`free -m | awk 'NR==2{printf "%s/%sMB (%.2f%%)\n", $3,$2,$3*100/$2 }'`
DISK=`df -h | awk '$NF=="/"{printf "%d/%dGB (%s)\n", $3,$2,$5}'`
# Text font
bold="$(tput bold)"
normal="$(tput sgr0)"
bold=$(tput bold)
normal=$(tput sgr0)
# Logo
cat <<EOF
cat << EOF

      ${bold}Uptime${normal} : ${UPTIME}
    ${bold}Mémoire${normal} : ${RAM}

View file

@ -0,0 +1,3 @@
#!/bin/sh
# {{ ansible_managed }}
uname -snrvm

View file

@ -9,6 +9,8 @@
- aptitude # nice to have for Ansible
- bash-completion # because bash
- curl # better than wget
- emacs-nox # for maman
- fish # to motivate @edpibu
- git # code versioning
- htop # better than top
- iotop # monitor i/o
@ -16,19 +18,35 @@
- lsb-release
- molly-guard # prevent reboot
- nano # for vulcain
- net-tools
- ntp # network time sync
- oidentd # postgresql identification
- screen # Vulcain asked for this
- sudo
- tmux # For shirenn
- tree # create a graphical tree of files
- vim # better than nano
- zsh # to be able to ssh @erdnaxe
- dnsutils # dig
update_cache: true
register: apt_result
retries: 3
until: apt_result is succeeded
# Pimp my server
- name: Customize motd
copy:
src: "update-motd.d/{{ item }}"
dest: "/etc/update-motd.d/{{ item }}"
mode: 0755
loop:
- 00-logo
- 10-uname
- name: Remove Debian warranty motd
file:
path: /etc/motd
state: absent
# Configure APT mirrors on Debian Stretch
- name: Configure APT mirrors
when:

View file

@ -1,8 +0,0 @@
---
borg_keep_hourly: 0
borg_keep_daily: 0
borg_keep_weekly: 0
borg_keep_monthly: 0
borg_server_user: borgbackup
borg_server_group: borgbackup
...

View file

@ -1,5 +0,0 @@
---
- name: Run systemd daemon-reload
systemd:
daemon_reload: true
...

View file

@ -1,110 +0,0 @@
---
- name: Pin borgmatic
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
owner: root
group: root
mode: u=rw,g=r,o=
loop:
- src: apt/list.j2
dest: /etc/apt/sources.list.d/bullseye.list
- src: apt/preferences.j2
dest: /etc/apt/preferences.d/borgmatic-bullseye
when:
- "ansible_distribution == 'Debian'"
- "ansible_distribution_major_version in ('stretch', 'buster', '9', '10')"
- name: Install borgmatic
apt:
name: borgmatic
update_cache: true
register: apt_result
retries: 3
until: apt_result is succeeded
- name: Create configuration directory for borgmatic
file:
path: /etc/borgmatic
state: directory
owner: root
group: root
mode: u=rwx,g=rx,o=
- name: Add borgmatic configuration file
become: true
template:
src: config.yaml.j2
dest: /etc/borgmatic/config.yaml
owner: root
group: root
mode: u=rw,g=r,o=
vars:
borg_host_dir: "/borg/{{ inventory_hostname }}"
- name: Create SSH key
openssh_keypair:
path: "/etc/borgmatic/id_remote"
type: ed25519
regenerate: full_idempotence
owner: root
group: root
mode: u=rw,g=,o=
register: ssh_key
- name: Gather SSH host keys
delegate_to: "{{ borg_server_host }}"
command: "ssh-keyscan {{ borg_server_host }}"
register: keys
- name: Add server key to known hosts
known_hosts:
hash_host: true
host: "{{ borg_server_host }}"
key: "{{ item }}"
loop: "{{ keys.stdout_lines }}"
- name: Add public key to remote
delegate_to: "{{ borg_server_host }}"
become: true
authorized_key:
exclusive: false
user: "{{ borg_server_user }}"
key: "{{ ssh_key.public_key }}"
key_options: "{{ options | join(',') }}"
vars:
borg_host_dir: "/borg/{{ inventory_hostname }}"
options:
- 'command="borg serve --restrict-to-path {{ borg_host_dir }}"'
- no-agent-forwarding
- no-port-forwarding
- no-pty
- no-user-rc
- no-X11-forwarding
- name: Init repository
command: borgmatic init --encryption repokey
- name: Install timer and service for borgmatic
template:
src: "{{ item }}.j2"
dest: "/etc/systemd/system/{{ item }}"
owner: root
group: root
mode: u=rw,g=r,o=
loop:
- borgmatic.timer
- borgmatic.service
notify:
- Run systemd daemon-reload
- name: Run systemd deamon-reload
systemd:
daemon_reload: true
- name: Start and enable borgmatic timer
systemd:
name: borgmatic.timer
state: started
enabled: true
...

View file

@ -1,3 +0,0 @@
{{ ansible_managed | comment }}
deb https://deb.debian.org/debian/ bullseye main

View file

@ -1,9 +0,0 @@
{{ ansible_managed | comment }}
Package: *
Pin: release n=bullseye
Pin-Priority: 1
Package: borgmatic
Pin: release n=bullseye
Pin-Priority: 900

View file

@ -1,32 +0,0 @@
{{ ansible_managed | comment }}
[Unit]
Description=Service for borgmatic backup
Wants=network-online.target
After=network-online.target
ConditionACPower=true
[Service]
Type=simple
ProtectSystem=full
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_NET_RAW
# Lower CPU and I/O priority.
Nice=19
CPUSchedulingPolicy=batch
IOSchedulingClass=best-effort
IOSchedulingPriority=7
IOWeight=100
Restart=no
# Prevent rate limiting of borgmatic log events. If you are using an older
# version of systemd that doesn't support this (pre-240 or so), you may have
# to remove this option.
LogRateLimitIntervalSec=0
# Delay start to prevent backups running during boot. Note that
# systemd-inhibit requires dbus and dbus-user-session to be installed.
# ExecStartPre=sleep 1m
ExecStart=systemd-inhibit --who="borgmatic" \
--why="Prevent interrupting scheduled backup" \
/usr/bin/borgmatic -v 2

View file

@ -1,17 +0,0 @@
{{ ansible_managed | comment }}
[Unit]
Description=Timer for borgmatic backup
[Timer]
{% if borg_keep_hourly > 0 %}
OnCalendar=hourly
RandomizedDelaySec=60m
{% else %}
OnCalendar=daily
RandomizedDelaySec=24h
{% endif %}
FixedRandomDelay=true
[Install]
WantedBy=timers.target

View file

@ -1,51 +0,0 @@
---
{{ ansible_managed | comment }}
location:
source_directories:
{% for source in borg_backup_directories %}
- {{ source }}
{% endfor %}
exclude_patterns:
{% for exclude in borg_backup_exclude %}
- {{ exclude }}
{% endfor %}
repositories:
- {{ borg_server_user }}@{{ borg_server_host }}:{{ borg_host_dir }}
borgmatic_source_directory: /var/backups
storage:
encryption_passphrase: "{{ borg_encryption_passphrase }}"
ssh_command: ssh -i /etc/borgmatic/id_remote
# compression: 'lz4'
# umask: 0077
# lock_wait: 5
# archive_name_format: '{hostname}-{now}'
retention:
{% if borg_keep_hourly > 0 %}
keep_hourly: {{ borg_keep_hourly }}
{% endif %}
{% if borg_keep_daily > 0 %}
keep_daily: {{ borg_keep_daily }}
{% endif %}
{% if borg_keep_weekly > 0 %}
keep_weekly: {{ borg_keep_weekly }}
{% endif %}
{% if borg_keep_monthly > 0 %}
keep_monthly: {{ borg_keep_monthly }}
{% endif %}
consistency:
checks:
- repository
- archives
{% if borg_postgresql_databases is defined %}
hooks:
postgresql_databases:
- name: all
username: postgres
{% endif %}
...

View file

@ -1,5 +0,0 @@
---
borg_server_user: borgbackup
borg_server_group: borgbackup
borg_home_dir: /var/lib/borgbackup
...

View file

@ -1,38 +0,0 @@
---
- name: Install borg
apt:
name: borgbackup
state: present
update_cache: true
register: apt_result
retries: 3
until: apt_result is succeeded
- name: Create a local group for borg
become: true
group:
name: "{{ borg_server_group }}"
system: true
- name: Create a local user for borg
become: true
user:
home: "{{ borg_home_dir }}"
create_home: true
comment: Local user for borgbackup server
name: "{{ borg_server_user }}"
group: "{{ borg_server_group }}"
system: true
# Does not constitute a valid hash, preventing from login via password
password: "*"
update_password: always
- name: Create backup directory
become: true
file:
path: "{{ borg_server_backups_dir }}"
state: directory
owner: "{{ borg_server_user }}"
group: "{{ borg_server_group }}"
mode: u=rwx,g=,o=
...

View file

@ -0,0 +1,8 @@
---
- name: Reload nginx
service:
name: nginx
state: reloaded
- name: Generate certificates
command: "certbot certonly --non-interactive --config /etc/letsencrypt/conf.d/{{ certbot.certname }}.ini"

View file

@ -5,24 +5,9 @@
name:
- certbot
- python3-certbot-dns-rfc2136
state: present
register: apt_result
register: pkg_result
retries: 3
until: apt_result is succeeded
- name: Add DNS credentials
template:
src: letsencrypt/rfc2136.ini.j2
dest: "/etc/letsencrypt/rfc2136.{{ item.certname }}.ini"
mode: 0600
owner: root
loop: "{{ certbot }}"
- name: Add dhparam
template:
src: "letsencrypt/dhparam.j2"
dest: "/etc/letsencrypt/dhparam"
mode: 0600
until: pkg_result is succeeded
- name: Create /etc/letsencrypt/conf.d
file:
@ -30,22 +15,24 @@
state: directory
mode: 0755
- name: Lookup DNS masters IPv4
set_fact:
dns_masters_ipv4:
- "10.128.0.30"
cacheable: true
- name: Add DNS credentials
template:
src: letsencrypt/rfc2136.ini.j2
dest: /etc/letsencrypt/rfc2136.ini
mode: 0600
owner: root
- name: Add Certbot configuration
template:
src: "letsencrypt/conf.d/certname.ini.j2"
dest: "/etc/letsencrypt/conf.d/{{ item.certname }}.ini"
dest: "/etc/letsencrypt/conf.d/{{ certbot.certname }}.ini"
mode: 0644
loop: "{{ certbot }}"
- name: Run certbot
command: certbot --non-interactive --config /etc/letsencrypt/conf.d/{{ item.certname }}.ini certonly
loop: "{{ certbot }}"
- name: Clean old files
file:
path: "{{ item }}"
state: absent
loop:
- "/etc/letsencrypt/options-ssl-nginx.conf"
- "/etc/letsencrypt/ssl-dhparams.pem"
- "/etc/letsencrypt/rfc2136.ini"
notify:
- Generate certificates
- Reload nginx

View file

@ -1,7 +1,7 @@
{{ ansible_managed | comment(decoration='# ') }}
# {{ ansible_managed }}
# To generate the certificate, please use the following command
# certbot --config /etc/letsencrypt/conf.d/{{ item.certname }}.ini certonly
# Pour appliquer cette conf et générer la conf de renewal :
# certbot --config /etc/letsencrypt/conf.d/{{ certbot.certname }}.ini certonly
# Use a 4096 bit RSA key instead of 2048
rsa-key-size = 4096
@ -10,7 +10,7 @@ rsa-key-size = 4096
# server = https://acme-staging.api.letsencrypt.org/directory
# Uncomment and update to register with the specified e-mail address
email = {{ item.mail }}
email = {{ certbot.mail }}
# Uncomment to use a text interface instead of ncurses
text = True
@ -20,9 +20,12 @@ agree-tos = True
# Use DNS-01 challenge
authenticator = dns-rfc2136
dns-rfc2136-credentials = /etc/letsencrypt/rfc2136.{{ item.certname }}.ini
dns-rfc2136-credentials = /etc/letsencrypt/rfc2136.ini
dns-rfc2136-propagation-seconds = 30
# Accept TOS
agree-tos = True
# Wildcard the domain
cert-name = {{ item.certname }}
domains = {{ item.domains }}
cert-name = {{ certbot.certname }}
domains = {{ ", ".join(certbot.domains) }}

View file

@ -1,7 +1,7 @@
{{ ansible_managed | comment(decoration='# ') }}
dns_rfc2136_server = {{ item.dns_rfc2136_server }}
dns_rfc2136_server = {{ certbot.dns_rfc2136_server }}
dns_rfc2136_port = 53
dns_rfc2136_name = {{ item.dns_rfc2136_name }}
dns_rfc2136_secret = {{ item.dns_rfc2136_secret }}
dns_rfc2136_name = {{ certbot.dns_rfc2136_name }}
dns_rfc2136_secret = {{ certbot.dns_rfc2136_secret }}
dns_rfc2136_algorithm = HMAC-SHA512

View file

@ -1,11 +0,0 @@
---
chronyd__pools: []
chronyd__key_file: /etc/chrony/chrony.keys
chronyd__drift_file: /var/lib/chrony/chrony.drift
chronyd__nts_dump_dir: /var/lib/chrony
chronyd__log_dir: /var/log/chrony
chronyd__max_update_skew: 100.0
chronyd__rtcsync: true
chronyd__allow_networks: []
chronyd__log_change_seconds: 0.5
...

View file

@ -1,6 +0,0 @@
---
- name: Restart chronyd
systemd:
name: chrony.service
state: restarted
...

View file

@ -1,32 +0,0 @@
---
- name: Uninstall ntp and sntp
apt:
name:
- sntp
- ntp
- systemd-timesyncd
state: absent
- name: Install chronyd
apt:
name: chrony
- name: Configure chronyd
template:
src: "{{ item }}.j2"
dest: "/etc/chrony/{{ item }}"
owner: root
group: root
mode: u=rw,g=r,o=
loop:
- chrony.conf
- chrony.keys
notify:
- Restart chronyd
- name: Enable and start chronyd
systemd:
name: chrony.service
enabled: true
state: started
...

View file

@ -1,30 +0,0 @@
{{ ansible_managed | comment }}
{% for pool in chronyd__pools %}
pool {{ pool }} iburst
{% endfor %}
keyfile {{ chronyd__key_file }}
driftfile {{ chronyd__drift_file }}
ntsdumpdir {{ chronyd__nts_dump_dir }}
logdir {{ chronyd__log_dir }}
log tracking measurements statistics
maxupdateskew {{ chronyd__max_update_skew | float }}
{% if chronyd__rtcsync %}
rtcsync
{% endif %}
{% if chronyd__local_stratum is defined %}
local stratum {{ chronyd__local_stratum | int }}
{% endif %}
logchange {{ chronyd__log_change_seconds | float }}
leapsectz right/UTC
{% for network in chronyd__allow_networks %}
allow {{ network | ipaddr }}
{% endfor %}

View file

@ -1 +0,0 @@
{{ ansible_managed | comment }}

View file

@ -50,4 +50,9 @@
url: https://github.com/docker/compose/releases/download/1.24.1/docker-compose-Linux-x86_64
dest: /usr/local/bin/docker-compose
mode: "0755"
...
- name: Indicate role in motd
template:
src: update-motd.d/05-service.j2
dest: /etc/update-motd.d/05-docker
mode: 0755

View file

@ -0,0 +1,3 @@
#!/bin/sh
# {{ ansible_managed }}
echo "> Les recettes Docker-compose se trouvent dans /var/local/ansible-docker"

View file

@ -0,0 +1,30 @@
---
# For DokuWiki package
- name: Configure Debian Buster mirrors
when:
- ansible_distribution == 'Debian'
- ansible_distribution_release == 'stretch'
template:
src: apt/buster.list.j2
dest: /etc/apt/sources.list.d/buster.list
mode: 0644
# For DokuWiki package
- name: Configure DokuWiki pin
when:
- ansible_distribution == 'Debian'
- ansible_distribution_release == 'stretch'
template:
src: apt/dokuwiki.j2
dest: /etc/apt/preferences.d/dokuwiki
mode: 0644
# Install
- name: Install DokuWiki
apt:
update_cache: true
name: dokuwiki
state: present
register: apt_result
retries: 3
until: apt_result is succeeded

View file

@ -0,0 +1,9 @@
# {{ ansible_managed }}
{# #}
{# Default mirror #}
{% if debian_mirror is not defined %}
{% set debian_mirror = 'http://ftp.fr.debian.org/debian' %}
{% endif %}
deb {{ debian_mirror }} buster main
deb-src {{ debian_mirror }} buster main

View file

@ -0,0 +1,9 @@
# {{ ansible_managed }}
Package: *
Pin: release n=stretch*
Pin-Priority: 990
Package: dokuwiki
Pin: release n=buster
Pin-Priority: 990

View file

@ -0,0 +1,5 @@
---
- name: Restart dovecot
service:
name: dovecot
state: restarted

View file

@ -0,0 +1,65 @@
---
# Install and configure Dovecot
- name: Install Dovecot
apt:
update_cache: true
name:
- dovecot-core
- dovecot-imapd
- dovecot-managesieved
- dovecot-lmtpd
- dovecot-ldap
- dovecot-pop3d
register: apt_result
retries: 3
until: apt_result is succeeded
# Create the vmail user with UID and GID 5000
- name: Create vmail user
user:
name: vmail
uid: 5000
group: 5000
home: /var/vmail
# Create mail user seive directory with right ownernship and rights
- name: Create mail user sieve directory
file:
path: /var/vmail/sieve/global
state: directory
owner: vmail
group: vmail
mode: 0770
# Do the same for mailboxes
- name: Create mail user mailbox directory
file:
path: /var/vmail/mailboxes
state: directory
owner: vmail
group: vmail
mode: 0770
# Add the Dovecot configuration files (conf.d)
- name: Add Dovecot configuration in conf.d
template:
src: "conf.d/{{ item }}.j2"
dest: "/etc/dovecot/conf.d/{{ item }}"
mode: 0644
loop:
- "10-auth.conf"
- "10-mail.conf"
- "10-master.conf"
- "10-ssl.conf"
- "10-logging.conf"
notify: Restart dovecot
# Add the Dovecot configuration file outside of conf.d
- name: Add Dovecot configuration outside of conf.d
template:
src: "dovecot-ldap.conf.ext.j2"
dest: "/etc/dovecot/dovecot-ldap.conf.ext"
mode: 0600 # only legible by root
owner: root
group: root
notify: Restart dovecot

View file

@ -0,0 +1,10 @@
# {{ ansible_managed }}
# Dovecot configuration for Aurore
# More info at https://gitea.auro.re/Aurore/ansible
# And on the Dovecot wiki : https://doc.dovecot.org/
# Include LDAP conf
!include auth-ldap.conf.ext
# Authentification mechanisms
auth_mechanisms = plain login

View file

@ -0,0 +1,8 @@
# {{ ansible_managed }}
# Dovecot configuration for Aurore
# More info at https://gitea.auro.re/Aurore/ansible
# And on the Dovecot wiki : https://doc.dovecot.org/
# Prefix for each line written to log file. % codes are in strftime(3) format.
#log_timestamp = "%b %d %H:%M:%S "
log_timestamp = "%Y-%m-%d %H:%M:%S "

View file

@ -0,0 +1,13 @@
# {{ ansible_managed }}
# Dovecot configuration for Aurore
# More info at https://gitea.auro.re/Aurore/ansible
# And on the Dovecot wiki : https://doc.dovecot.org/
# Mailbox locations and namespaces
# Simple mail location
mail_location = maildir:~/Maildir
# Plugins
mail_plugins = quota
#mail_plugins = quota mail_log notify # to be tested

View file

@ -0,0 +1,26 @@
# {{ ansible_managed }}
# Dovecot configuration for Aurore
# More info at https://gitea.auro.re/Aurore/ansible
# And on the Dovecot wiki : https://doc.dovecot.org/
# IMAP/POP/STMP auth configuration
# Authentification
service auth {
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
}
# Local LMTP
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
group = postfix
mode = 0600
user = postfix
}
}

View file

@ -0,0 +1,13 @@
# {{ ansible_managed }}
# Dovecot configuration for Aurore
# More info at https://gitea.auro.re/Aurore/ansible
# And on the Dovecot wiki : https://doc.dovecot.org/
# SSL and certificates configuration
# Cetificates location
ssl_cert = </etc/letsencrypt/live/auro.re/fullchain.pem
ssl_key = </etc/letsencrypt/live/auro.re/privkey.pem
# Enforce TLS encryption
ssl = required

View file

@ -0,0 +1,31 @@
# {{ ansible_managed }}
# Dovecot configuration for Aurore
# More info at https://gitea.auro.re/Aurore/ansible
# And on the Dovecot wiki : https://doc.dovecot.org/
##
## LMTP specific settings
##
# Support proxying to other LMTP/SMTP servers by performing passdb lookups.
#lmtp_proxy = no
# When recipient address includes the detail (e.g. user+detail), try to save
# the mail to the detail mailbox. See also recipient_delimiter and
# lda_mailbox_autocreate settings.
#lmtp_save_to_detail_mailbox = no
# Verify quota before replying to RCPT TO. This adds a small overhead.
#lmtp_rcpt_check_quota = no
# Which recipient address to use for Delivered-To: header and Received:
# header. The default is "final", which is the same as the one given to
# RCPT TO command. "original" uses the address given in RCPT TO's ORCPT
# parameter, "none" uses nothing. Note that "none" is currently always used
# when a mail has multiple recipients.
#lmtp_hdr_delivery_address = final
protocol lmtp {
# Space separated list of plugins to load (default is global mail_plugins).
mail_plugins = $mail_plugins sieve
}

View file

@ -0,0 +1,97 @@
# {{ ansible_managed }}
# Dovecot configuration for Aurore
# More info at https://gitea.auro.re/Aurore/ansible
# And on the Dovecot wiki : https://doc.dovecot.org/
##
## Quota configuration.
##
# Note that you also have to enable quota plugin in mail_plugins setting.
# <doc/wiki/Quota.txt>
##
## Quota limits
##
# Quota limits are set using "quota_rule" parameters. To get per-user quota
# limits, you can set/override them by returning "quota_rule" extra field
# from userdb. It's also possible to give mailbox-specific limits, for example
# to give additional 100 MB when saving to Trash:
plugin {
#quota_rule = *:storage=1G
#quota_rule2 = Trash:storage=+100M
# LDA/LMTP allows saving the last mail to bring user from under quota to
# over quota, if the quota doesn't grow too high. Default is to allow as
# long as quota will stay under 10% above the limit. Also allowed e.g. 10M.
#quota_grace = 10%%
# Quota plugin can also limit the maximum accepted mail size.
#quota_max_mail_size = 100M
}
##
## Quota warnings
##
# You can execute a given command when user exceeds a specified quota limit.
# Each quota root has separate limits. Only the command for the first
# exceeded limit is executed, so put the highest limit first.
# The commands are executed via script service by connecting to the named
# UNIX socket (quota-warning below).
# Note that % needs to be escaped as %%, otherwise "% " expands to empty.
plugin {
#quota_warning = storage=95%% quota-warning 95 %u
#quota_warning2 = storage=80%% quota-warning 80 %u
}
# Example quota-warning service. The unix listener's permissions should be
# set in a way that mail processes can connect to it. Below example assumes
# that mail processes run as vmail user. If you use mode=0666, all system users
# can generate quota warnings to anyone.
#service quota-warning {
# executable = script /usr/local/bin/quota-warning.sh
# user = dovecot
# unix_listener quota-warning {
# user = vmail
# }
#}
##
## Quota backends
##
# Multiple backends are supported:
# dirsize: Find and sum all the files found from mail directory.
# Extremely SLOW with Maildir. It'll eat your CPU and disk I/O.
# dict: Keep quota stored in dictionary (eg. SQL)
# maildir: Maildir++ quota
# fs: Read-only support for filesystem quota
plugin {
#quota = dirsize:User quota
#quota = maildir:User quota
#quota = dict:User quota::proxy::quota
#quota = fs:User quota
}
# Multiple quota roots are also possible, for example this gives each user
# their own 100MB quota and one shared 1GB quota within the domain:
plugin {
#quota = dict:user::proxy::quota
#quota2 = dict:domain:%d:proxy::quota_domain
#quota_rule = *:storage=102400
#quota2_rule = *:storage=1048576
}
plugin {
quota = maildir:User quota
quota_status_success = DUNNO
quota_status_nouser = DUNNO
quota_status_overquota = "452 4.2.2 Mailbox is full and cannot receive any more emails"
}

View file

@ -0,0 +1,20 @@
# {{ ansible_managed }}
# Dovecot configuration for Aurore
# More info at https://gitea.auro.re/Aurore/ansible
# And on the Dovecot wiki : https://doc.dovecot.org/
uris = {{ ldap_master_uri }}
dn = {{ ldap_dovecot_bind_dn }}
dnpass = {{ ldap_dovecot_password }}
base = {{ ldap_user_tree }}
#user_attrs = homeDirectory=home, uidNumber=uid, gidNumber=gid
#user_filter = (&(objectClass=posixAccount)(uid=%u))
pass_attrs = uid=user, userPassword=password
pass_filter = (&(objectClass=posixAccount)(uid=%u))
# Convert LDAP lookup to lowercase
# would be needed if re2o did not already had lowercase enforced by a
# validator
#auth_username_format = %Lu

View file

@ -1,5 +0,0 @@
---
- name: Restart grafana
service:
name: grafana-server
state: restarted

View file

@ -1,111 +0,0 @@
---
- name: Install gpg (to import Grafana key)
apt:
name: gpg
state: present
register: apt_result
retries: 3
until: apt_result is succeeded
- name: Import Grafana GPG signing key
apt_key:
url: https://packages.grafana.com/gpg.key
state: present
register: apt_key_result
retries: 3
until: apt_key_result is succeeded
- name: Add Grafana repository
apt_repository:
repo: deb https://packages.grafana.com/oss/deb stable main
state: present
update_cache: true
- name: Install Grafana
apt:
name: grafana
state: present
register: apt_result
retries: 3
until: apt_result is succeeded
- name: Configure Grafana
ini_file:
path: /etc/grafana/grafana.ini
section: "{{ item.section }}"
option: "{{ item.option }}"
value: "{{ item.value }}"
mode: 0640
loop:
- section: server
option: root_url
value: "{{ grafana.root_url }}"
- section: analytics
option: reporting_enabled
value: "false"
- section: analytics
option: check_for_updates
value: "false"
- section: security
option: disable_initial_admin_creation
value: "true"
- section: security
option: cookie_secure
value: "true"
- section: security
option: disable_gravatar
value: "true"
- section: snapshots
option: external_enabled
value: "false"
- section: users
option: allow_sign_up
value: "false"
- section: users
option: allow_org_create
value: "false"
- section: auth.anonymous
option: enabled
value: "false" # no public access
- section: auth.anonymous
option: hide_version
value: "true"
- section: auth.basic # only LDAP auth
option: enabled
value: "false"
- section: auth.ldap
option: enabled
value: "true"
- section: alerting
option: enabled
value: "false"
- section: database
option: type
value: "{{ grafana.database.type }}"
- section: database
option: host
value: "{{ grafana.database.host }}"
- section: database
option: name
value: "{{ grafana.database.name }}"
- section: database
option: user
value: "{{ grafana.database.user }}"
- section: database
option: password
value: "{{ grafana.database.password }}"
notify: Restart grafana
- name: Configure Grafana LDAP
template:
src: ldap.toml.j2
dest: /etc/grafana/ldap.toml
mode: 0640
notify: Restart grafana
- name: Enable and start Grafana
systemd:
name: grafana-server
enabled: true
state: started
daemon_reload: true

View file

@ -1,61 +0,0 @@
{{ ansible_managed | comment }}
# To troubleshoot and get more log info enable ldap debug logging in grafana.ini
# [log]
# filters = ldap:debug
[[servers]]
# Ldap server host (specify multiple hosts space separated)
host = "{{ grafana.ldap.host }}"
# Default port is 389 or 636 if use_ssl = true
port = 389
# Set to true if ldap server supports TLS
use_ssl = false
# Set to true if connect ldap server with STARTTLS pattern (create connection in insecure, then upgrade to secure connection with TLS)
start_tls = false
# set to true if you want to skip ssl cert validation
ssl_skip_verify = false
# set to the path to your root CA certificate or leave unset to use system defaults
# root_ca_cert = "/path/to/certificate.crt"
# Authentication against LDAP servers requiring client certificates
# client_cert = "/path/to/client.crt"
# client_key = "/path/to/client.key"
# Search user bind dn
bind_dn = "{{ grafana.ldap.bind_dn }}"
# Search user bind password
# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
bind_password = '{{ grafana.ldap.bind_password }}'
# User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)"
search_filter = "(cn=%s)"
# An array of base dns to search through
search_base_dns = ["{{ grafana.ldap.search_base_dns }}"]
## For Posix or LDAP setups that does not support member_of attribute you can define the below settings
## Please check grafana LDAP docs for examples
group_search_filter = "(&(objectClass=posixGroup)(memberUid=%s))"
group_search_base_dns = ["{{ grafana.ldap.group_search_base_dns }}"]
group_search_filter_user_attribute = "cn"
# Specify names of the ldap attributes your ldap uses
[servers.attributes]
name = "sn"
surname = ""
username = "cn"
member_of = "dn"
email = "mail"
# Editors
{% for group_dn in grafana.ldap.editors_group_dn %}
[[servers.group_mappings]]
group_dn = "{{ group_dn }}"
org_role = "Editor"
{% endfor %}
# Viewers
[[servers.group_mappings]]
# If you want to match all (or no ldap groups) then you can use wildcard
group_dn = "*"
org_role = "Viewer"

View file

@ -1,3 +0,0 @@
---
ifupdown2__interfaces: {}
...

View file

@ -1,9 +0,0 @@
---
- name: Restart networking
systemd:
name: networking.service
state: restarted
- name: Bring all interfaces up
shell: /usr/sbin/ifup -a
...

View file

@ -1,42 +0,0 @@
---
- name: Gather package facts
package_facts:
manager: apt
- name: Check if ifupdown2 is installed
set_fact:
must_mask: "{{ 'ifupdown2' not in ansible_facts.packages }}"
- name: Mask networking before installing ifupdown2
systemd:
name: networking.service
masked: true
when: must_mask
- name: Install ifupdown2
apt:
name: ifupdown2
- name: Unmask networking now that ifupdown2 is installed
systemd:
name: networking.service
masked: false
when: must_mask
- name: Configure ifupdown2
template:
src: interfaces.j2
dest: /etc/network/interfaces
owner: root
group: root
mode: u=rw,g=r,o=
notify:
- Restart networking
- Bring all interfaces up
- name: Enable and start networking
systemd:
name: networking.service
state: started
enabled: true
...

View file

@ -1,41 +0,0 @@
{{ ansible_managed | comment }}
{% for name, iface in ifupdown2__interfaces.items() %}
auto {{ name }}
iface {{ name }}
{% for address in iface.addresses | default([]) %}
address {{ address | ipaddr }}
{% endfor %}
{% for gateway in iface.gateways | default([]) %}
gateway {{ gateway | ipaddr }}
{% endfor %}
{% if iface.bridge_ports is defined %}
bridge-ports {{ iface.bridge_ports | join(" ") }}
{% endif %}
{% if iface.bridge_vlan_aware is defined %}
bridge-vlan-aware {{ iface.bridge_vlan_aware
| ternary("yes", "no") }}
{% endif %}
{% if iface.bridge_vids is defined %}
bridge-vids {{ iface.bridge_vids | join(",") }}
{% endif %}
{% if iface.vlan_id is defined %}
vlan-id {{ iface.vlan_id | int }}
{% endif %}
{% if iface.vlan_raw_device is defined %}
vlan-raw-device {{ iface.vlan_raw_device }}
{% endif %}
{% if iface.bridge_disable_pvid | default(false) %}
bridge-pvid 0
post-up bridge vlan del dev {{ name }} vid 1 self
{% endif %}
{% if iface.forward | default(false) %}
ip-forward yes
ip6-forward yes
{% endif %}
{% if iface.ipv6_addrgen is defined %}
ipv6-addrgen {{ iface.ipv6_addrgen
| ternary("yes", "no") }}
{% endif %}
{% endfor %}

View file

@ -1,7 +0,0 @@
---
keepalived__virtual_addresses: {}
keepalived__notify_master: []
keepalived__notify_backup: []
keepalived__notify_fault: []
keepalived__max_auto_priority: -1
...

View file

@ -1,6 +0,0 @@
---
- name: Reload keepalived
systemd:
name: keepalived.service
state: reloaded
...

View file

@ -1,28 +0,0 @@
---
- name: Install keepalived
apt:
name: keepalived
- name: Configure keepalived
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
owner: root
group: root
mode: "{{ item.mode }}"
loop:
- src: keepalived.conf.j2
dest: /etc/keepalived/keepalived.conf
mode: u=rw,g=,o=
- src: notify.sh.j2
dest: /etc/keepalived/notify.sh
mode: u=rwx,g=,o=
notify:
- Reload keepalived
- name: Enable and start keepalived
systemd:
name: keepalived
enabled: true
state: started
...

View file

@ -1,92 +0,0 @@
{{ ansible_managed | comment }}
global_defs {
dynamic_interfaces
script_user root
enable_script_security
vrrp_version 3
{% if keepalived__max_auto_priority is defined %}
max_auto_priority {{ keepalived__max_auto_priority | int }}
{% endif %}
}
{%
set ipv4_enabled =
keepalived__ipv4_enabled
| default(keepalived__virtual_addresses.values()
| flatten | ansible.utils.ipv4)
%}
{%
set ipv6_enabled =
keepalived__ipv6_enabled
| default(keepalived__virtual_addresses.values()
| flatten | ansible.utils.ipv6)
%}
{% if ipv4_enabled and ipv6_enabled %}
vrrp_sync_group group {
group {
{% if ipv4_enabled %}
instance_v4
{% endif %}
{% if ipv6_enabled %}
instance_v6
{% endif %}
}
notify_master "/etc/keepalived/notify.sh master"
notify_backup "/etc/keepalived/notify.sh backup"
notify_fault "/etc/keepalived/notify.sh fault"
}
{% endif %}
{% if ipv4_enabled %}
vrrp_instance instance_v4 {
virtual_router_id {{ keepalived__virtual_router_id | int }}
interface {{ keepalived__interface }}
state BACKUP
priority 250
nopreempt
advert_int 1
accept
virtual_ipaddress {
{% for dev, addresses in keepalived__virtual_addresses.items() %}
{% for address in addresses %}
{% if address | ansible.utils.ipv4 %}
{{ address }} dev {{ dev }}
{% endif %}
{% endfor %}
{% endfor %}
}
{% if not (ipv4_enabled and ipv6_enabled) %}
notify_master "/etc/keepalived/notify.sh master"
notify_backup "/etc/keepalived/notify.sh backup"
notify_fault "/etc/keepalived/notify.sh fault"
{% endif %}
}
{% endif %}
{% if ipv6_enabled %}
vrrp_instance instance_v6 {
virtual_router_id {{ keepalived__virtual_router_id | int }}
interface {{ keepalived__interface }}
state BACKUP
priority 250
nopreempt
advert_int 1
accept
virtual_ipaddress {
{% for dev, addresses in keepalived__virtual_addresses.items() %}
{% for address in addresses | ipaddr_sort(["link-local"]) %}
{% if address | ansible.utils.ipv6 %}
{{ address }} dev {{ dev }}
{% endif %}
{% endfor %}
{% endfor %}
}
{% if not (ipv4_enabled and ipv6_enabled) %}
notify_master "/etc/keepalived/notify.sh master"
notify_backup "/etc/keepalived/notify.sh backup"
notify_fault "/etc/keepalived/notify.sh fault"
{% endif %}
}
{% endif %}

View file

@ -1,33 +0,0 @@
#!/bin/bash
master=(
{% for notify in keepalived__notify_master %}
{{ notify | quote }}
{% endfor %}
)
backup=(
{% for notify in keepalived__notify_backup %}
{{ notify | quote }}
{% endfor %}
)
fault=(
{% for notify in keepalived__notify_fault %}
{{ notify | quote }}
{% endfor %}
)
case "$1" in
master | backup | fault)
scripts="$1[@]"
;;
*)
echo "Usage: $0 (master|backup|fault)" >&2
exit 1
esac
for script in "${!scripts}"
do
eval "${script}"
done

Some files were not shown because too many files have changed in this diff Show more