Moved roles to subdirectory

2020-01-03 16:37:00 +01:00
parent a8cca4f575
commit ec4e0d3b96
25 changed files with 0 additions and 0 deletions
@@ -0,0 +1,9 @@
+---
+- name: restart apache
+  service:
+    name: apache2
+    state: restarted
+- name: reload apache
+  service:
+    name: apache2
+    state: reloaded
@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: common
@@ -0,0 +1,27 @@
+---
+- name: install apache 2
+  apt:
+    name: apache2
+    state: latest
+    update_cache: yes
+  tags:
+    - apache
+- name: allow apache through firewall
+  ufw:
+    name: Apache Full
+    rule: allow
+- name: enable mods
+  block:
+    - name: enable proxy
+      command:
+        cmd: a2enmod proxy
+    - name: enable proxy_wstunnel
+      command:
+        cmd: a2enmod proxy_wstunnel
+    - name: enable proxy_http
+      command:
+        cmd: a2enmod proxy_http
+    - name: enable ssl
+      command:
+        cmd: a2enmod ssl
+  notify: restart apache
@@ -0,0 +1,5 @@
+---
+dependencies:
+  - role: docker
+  - role: apache
+  - role: letsencrypt
@@ -0,0 +1,31 @@
+---
+- name: add collabora http site
+  template:
+    src: etc/apache2/sites-available/ansible_domain.conf.j2
+    dest: /etc/apache2/sites-available/{{ ansible_domain }}.conf
+    owner: root
+    group: root
+    mode: 0644
+- name: disable default site and enable collabora site
+  block:
+    - name: disable default site
+      command:
+        cmd: a2dissite 000-default.conf
+    - name: enable collabora site
+      command:
+        cmd: a2ensite {{ ansible_domain }}.conf
+  notify: reload apache
+- name: run certbot
+  command:
+    cmd: certbot --apache --non-interactive --keep-until-expiring --no-eff-email --redirect --renew-with-new-domains --agree-tos -d {{ ansible_domain }}
+- name: add collabora https site
+  template:
+    src: etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2
+    dest: /etc/apache2/sites-available/{{ ansible_domain }}-le-ssl.conf
+    owner: root
+    group: root
+    mode: 0644
+- name: enable collabora https site
+  command:
+    cmd: a2ensite {{ ansible_domain }}-le-ssl.conf
+  notify: restart apache
@@ -0,0 +1,14 @@
+---
+- name: copy docker compose file for collabora
+  template:
+    src: etc/collabora/docker-compose.yml.j2
+    dest: /etc/collabora/docker-compose.yml
+    owner: root
+    group: root
+    mode: 0644
+  vars_prompt:
+    - name: nextcloud_domain
+      prompt: "Nextcloud domain"
+      private: no
+- name: start collabora docker container
+  command: docker-compose --project-directory /etc/collabora up -d
@@ -0,0 +1,3 @@
+---
+- include: apache.yml
+- include: collabora.yml
@@ -0,0 +1,48 @@
+<IfModule mod_ssl.c>
+<VirtualHost *:443>
+  ServerName {{ ansible_domain }}
+  ServerAdmin {{ admin_mail }}
+  ErrorLog ${APACHE_LOG_DIR}/error.log
+  CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+  SSLCertificateFile /etc/letsencrypt/live/{{ ansible_domain }}/fullchain.pem
+  SSLCertificateKeyFile /etc/letsencrypt/live/{{ ansible_domain }}/privkey.pem
+  Include /etc/letsencrypt/options-ssl-apache.conf
+
+  # Encoded slashes need to be allowed
+  AllowEncodedSlashes NoDecode
+
+  # Container uses a unique non-signed certificate
+  SSLProxyEngine On
+  SSLProxyVerify None
+  SSLProxyCheckPeerCN Off
+  SSLProxyCheckPeerName Off
+
+  # keep the host
+  ProxyPreserveHost On
+
+  # static html, js, images, etc. served from loolwsd
+  # loleaflet is the client part of LibreOffice Online
+  ProxyPass           /loleaflet https://127.0.0.1:9980/loleaflet retry=0
+  ProxyPassReverse    /loleaflet https://127.0.0.1:9980/loleaflet
+
+  # WOPI discovery URL
+  ProxyPass           /hosting/discovery https://127.0.0.1:9980/hosting/discovery retry=0
+  ProxyPassReverse    /hosting/discovery https://127.0.0.1:9980/hosting/discovery
+
+  # Main websocket
+  ProxyPassMatch "/lool/(.*)/ws$" wss://127.0.0.1:9980/lool/$1/ws nocanon
+
+  # Admin Console websocket
+  ProxyPass   /lool/adminws wss://127.0.0.1:9980/lool/adminws
+
+  # Download as, Fullscreen presentation and Image upload operations
+  ProxyPass           /lool https://127.0.0.1:9980/lool
+  ProxyPassReverse    /lool https://127.0.0.1:9980/lool
+
+  # Endpoint with information about availability of various features
+  ProxyPass           /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities retry=0
+  ProxyPassReverse    /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities
+
+</VirtualHost>
+</IfModule>
@@ -0,0 +1,6 @@
+<VirtualHost *:80>
+  ServerName {{ ansible_domain }}
+  ServerAdmin {{ admin_mail }}
+  ErrorLog ${APACHE_LOG_DIR}/error.log
+  CustomLog ${APACHE_LOG_DIR}/access.log combined
+</VirtualHost>
@@ -0,0 +1,17 @@
+version: '3'
+
+services:
+  collabora:
+    image: collabora/code
+    ports:
+      - 9980:9980
+    restart: always
+    environment:
+      - domain={{ nextcloud_domain }}
+    volumes:
+      - config-volume:/etc/loolwsd
+    cap_add:
+      - MKNOD
+volumes:
+  config-volume:
+
@@ -0,0 +1,5 @@
+---
+sshport: 22
+openports_list:
+  - 22
+#blacklist_ip_list:
@@ -0,0 +1,4 @@
+---
+- name: update the package list
+  apt: update_cache=yes
+
@@ -0,0 +1,23 @@
+---
+- name: ensure apticron packages are installed
+  apt:
+    pkg: "{{ packages }}"
+    state: latest
+    update_cache: yes
+    cache_valid_time: 600
+  vars:
+    packages:
+      - apticron
+
+- name: configure apticron
+  template:
+    src: etc/apticron/apticron.conf.j2
+    dest: /etc/apticron/apticron.conf
+    owner: root
+    group: root
+    mode: 0644
+  vars_prompt:
+    - name: admin_mail
+      prompt: "Mail of server admin"
+      private: no
+
@@ -0,0 +1,9 @@
+---
+- name: set up check disk space cron script
+  template:
+    src: etc/cron.hourly/check-disk-space.sh.j2
+    dest: /etc/cron.hourly/check-disk-space.sh
+    owner: root
+    group: root
+    mode: 0750
+
@@ -0,0 +1,11 @@
+---
+- name: install fail2ban
+  apt:
+    name: fail2ban
+    state: latest
+    update_cache: yes
+- name: enable fail2ban
+  service:
+    name: fail2ban
+    enabled: yes
+    started: started
@@ -0,0 +1,17 @@
+---
+- include: apt.yml
+  tags:
+    - apt
+- include: apticron.yml
+  tags:
+    - apticron
+- include: disk-check.yml
+  tags:
+    - disk
+- include: ufw.yml
+  tags:
+    - firewall
+- include: fail2ban.yml
+  tags:
+    - firewall
+- include: tools.yml
@@ -0,0 +1,19 @@
+---
+- name: ensure all tools packages are installed
+  apt:
+    pkg: "{{ packages }}"
+    state: latest
+    update_cache: yes
+    cache_valid_time: 600
+  vars:
+    packages:
+      - curl
+      - debsums
+      - iperf3
+      - mosh
+      - net-tools
+      - needrestart
+      - sqlite3
+      - sudo
+      - tmux
+
@@ -0,0 +1,8 @@
+---
+- name: allow ssh through firewall
+  ufw:
+    name: OpenSSH
+    rule: allow
+- name: enable ufw firewall
+  command:
+    cmd: ufw enable
@@ -0,0 +1,6 @@
+# apticron.conf
+#
+# Set EMAIL to a space separated list of addresses which will be notified of
+# impending updates. By default the root account will be notified.
+
+EMAIL="{{ admin_mail }}"
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+# Check disk space
+CURRENT=$(df / --output=pcent | tail --lines=1 | cut --delimiter='%' --field=1)
+THRESHOLD=90
+ADMIN="root@{{ ansible_domain }}"
+SUBJECT="[Disk Space Alert] The free space on {{ ansible_fqdn }} is critically low"
+MESSAGE=
+
+if [ "$CURRENT" -gt "$THRESHOLD" ]; then
+  mail -s "$SUBJECT" "$ADMIN" << EOF
+Your root partition remaining free space is critically low. Used: $CURRENT%
+EOF
+fi
+
@@ -0,0 +1,3 @@
+---
+dependencies
+  - role: common
@@ -0,0 +1,8 @@
+---
+- name: install docker-compose
+  apt:
+    name: docker-compose
+    state: latest
+    update_cache: yes
+  tags:
+    - docker
@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: apache
@@ -0,0 +1,9 @@
+---
+- name: add certbot repo
+  apt_repository:
+    repo: ppa:certbot/certbot
+- name: install certbot
+  apt:
+    name: python-certbot-apache
+    state: latest
+    update_cache: yes