alanorth
/
ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity
967 Commits 2 Branches 0 Tags 4.5 MiB
Commit Graph

636 Commits

Author SHA1 Message Date
Alan Orth 08a920d0cb Revert "roles/nginx: Ingenius use of YAML hashes to derive TLS key from another file" 
This reverts commit 59b9bd70b8.

Might not be so ingenious.  Can't get this to work anymore...
 2014-10-27 21:16:43 +03:00
Alan Orth c3f5e27642
roles/common: Add ECDSA public key for noma 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-12 13:25:48 +03:00
Alan Orth a265e48a9f
roles/common: Remove RSA public key 
Both client and server support ed25519, so there's no need to even
have the RSA key here.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-12 13:23:01 +03:00
Alan Orth 59b9bd70b8 roles/nginx: Ingenius use of YAML hashes to derive TLS key from another file 
This is kinda crazy, but makes the host_vars much easier to read.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-11 15:42:44 +03:00
Alan Orth 5e0da37542
roles/common: Remove task which removes irqbalance 
Prevailing wisdom is actually that this *can* help virtual hosts,
especially when the VM guest has multiple CPUs.

See: http://wiki.xen.org/wiki/Network_Throughput_and_Performance_Guide

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-11 13:31:23 +03:00
Alan Orth 1ee7b385bf
roles/common: Rename SSH keys 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-11 13:19:32 +03:00
Alan Orth 1e2193efc9
roles/common: Add functionality to copy user keys to provisioning user 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-11 12:13:45 +03:00
Alan Orth c53dd18181
roles/common: Add role to manage provisioning user 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-11 12:11:44 +03:00
Alan Orth 42b893b2a7
roles/nginx: Add expires to static files 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-10 11:05:42 +03:00
Alan Orth 81a98596e3
Downgrade TLS configuration to Mozilla's "intermediate" spec 
From looking at the list of clients who would be allowed to connect
when using the "modern" spec, I think I'd be doing more harm than
good to use that config right now...

https://www.ssllabs.com/ssltest/analyze.html?d=alaninkenya.org
https://wiki.mozilla.org/Security/Server_Side_TLS

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-09 21:09:18 +03:00
Alan Orth d06ddf8a81
roles/nginx: Update TLS vhost task for Ansible > 1.7.1 
Seems there is some YAML sublety that causes this syntax to insert
double spaces on the destination file... using native YAML hashes
are a workaround, see GitHub issues:

https://github.com/ansible/ansible/issues/9067
https://github.com/ansible/ansible/issues/9172

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-09 20:57:24 +03:00
Alan Orth ad8a704470
Update TLS configuration to Mozilla's "modern" spec 
Details, see:

- https://jve.linuxwall.info/blog/index.php?post/2014/10/09/Automated-configuration-analysis-for-Mozilla-s-TLS-guidelines
- https://wiki.mozilla.org/Security/Server_Side_TLS

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-09 20:56:08 +03:00
Alan Orth ad90f7f0fb
roles/nginx: Use HSTS for https vhosts 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-06 10:46:04 +03:00
Alan Orth fd9c6f31cb
roles/nginx: Add index to munin vhost 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-05 15:47:14 +03:00
Alan Orth e741a77c00
roles/common: Add unzip to Ubuntu base packages 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-10-05 15:21:47 +03:00
Alan Orth 6d07af97f3
roles/php5-fpm: Fix php.ini reconfiguration (pathinfo) 
Use replace instead of lineinfile, addresses GitHub issue #1.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-09-14 12:34:44 +03:00
Alan Orth 3d3b6c8a3f
roles/php5-fpm: Fix pool creation for vhosts 
Now loops over both http and https vhosts properly. Fixes GitHub
issue #2.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-09-14 12:19:26 +03:00
Alan Orth e6ffdf8652
roles/nginx: Update nginx https stuff 
- re-organize tls vhost configuration
- copy TLS cert from host_vars directly to file

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-09-13 23:16:54 +03:00
Alan Orth be0e0ea21a
roles/common: Remove irqbalance 
We're a VM, we don't have IRQs.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-09-07 23:51:52 +03:00
Alan Orth 2156f8b07d
roles/nginx: Tweaks for vhosts with WordPress 
My WordPress blogs have a /wordpress subdirectory in the document
root, but I don't serve from the /wordpress URI.

Technically, all we need is the tweaks to the try_files:
    - `?args` passes query strings to php5-fpm
    - removing 404 from the vhost's try_files so we don't return 404
    when the requested file doesn't exist (obviously not all request
    URI's in WordPress are actual files on the disk)

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-09-07 22:51:34 +03:00
Alan Orth df65172952
roles/common: Add lrzip to base packages 
Provides good mix of compression/decompression speed with size,
see: http://ck.kolivas.org/apps/lrzip/README.benchmarks

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-09-07 16:32:06 +03:00
Alan Orth 162197ad25
roles/nginx: Re-work vhost template to support HTTPS 
Assumes you have a TLS cert for one domain, but not the others, ie:

    http://blah.com \
    http://blah.net  -> https://blah.io
    http://blah.org /

Otherwise, without https, it creates a vhost with all domain names.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-09-06 21:32:37 +03:00
Alan Orth 05faeecc5d
roles/mariadb: Quote the password in .my.conf template 
Ansible's mysql module can get this password and connect fine, but
`mysql` on the command line chokes if the password is slightly
complicated and is not quoted.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-09-01 12:41:56 +03:00
Alan Orth 5166ebf219
roles/munin: Fix nginx template 
Accidental syntax error came in when I removed the dns domain

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-28 22:08:32 +03:00
Alan Orth e24464941f
roles/mariadb: Create WordPress db/users when necessary 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-28 14:29:23 +03:00
Alan Orth 850a6a8da3
roles/mariadb: Add plays for creating WordPress db/users 
Relies on the host having a dict with appropriate values defined,
for example:

  wordpress_blogs:
    - site_name:            blah.com
      wordpress_version:    3.9.2
      wordpress_db_user:    db_user
      wordpress_db_name:    db_name
      wordpress_db_pass:    V9&XvvKu1hYl

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-28 12:47:30 +03:00
Alan Orth fafd475f6b
roles/nginx: Add index to vhost config 
Without this, all requests to directory URIs throw 403 errors due
to directory listings not being allowed.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-28 12:27:24 +03:00
Alan Orth 41b1ab79c2
roles/php5-fpm: Update comment 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-28 11:25:35 +03:00
Alan Orth 0b8e0c38bf
roles/nginx: Per-vhost logs 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-27 20:26:12 +03:00
Alan Orth 5bbec6716c
roles/nginx: Use template to configure nginx vhosts 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-27 20:03:34 +03:00
Alan Orth 75a705ac87
roles/nginx: Add defaults for nginx role 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-27 20:02:29 +03:00
Alan Orth ff95a34605
roles/nginx: Add vim modeline to main.yml 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-27 20:00:42 +03:00
Alan Orth 0689153bd9
roles/php5-fpm: Use template for pools 
Each vhost has a separate pool.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-27 19:48:21 +03:00
Alan Orth 2afa1ef2f3
roles/munin: Remove dns domain 
Don't really need this, as we only have one server.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-27 15:57:28 +03:00
Alan Orth 775f0e7f5f
roles/mariadb: Install python bindings for ansible's mysql module 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-27 15:56:54 +03:00
Alan Orth 60b8ecdd4c
Initial commit 
Signed-off-by: Alan Orth <alan.orth@gmail.com>
 2014-08-17 00:35:57 +03:00