Commit Graph

281 Commits

Author SHA1 Message Date
9aaad366f5 roles/common: Only add extras repo on Ubuntu 14.04
The Extras repo was discontinued after 14.10 (but the latest we
deploy is 14.04).

See: https://lists.ubuntu.com/archives/technical-board/2015-January/002063.html

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:38 +03:00
e84f777a6b roles/common: Bring Ubuntu 15.04 sshd_config up to date with standards
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:38 +03:00
b2dbd138f7 roles/common: Add Ubuntu 15.04 sshd_config
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:38 +03:00
68493beba3
roles/common: Reload sshd instead of restarting
No need to restart for a config change.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:01:17 +03:00
8e0a292b1d
roles/common: Move sshd tasks to their own playbook
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:00:43 +03:00
7f929d5b80
roles/common: Remove unused cron-apt files
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-22 23:42:03 +03:00
fc586a2297
roles/common: Adjust cron-apt stuff
- Don't run the static files as templates
- Use a separate playbook for related tasks
- Use a template for security.sources.list

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-22 23:39:22 +03:00
c535cce6a5
host_vars/web05: Upgrade to WordPress 4.3
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-19 22:54:55 +03:00
45bf41dc35
host_vars/web05: Update TLS cert for mjanja.ch
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-17 12:37:22 +03:00
18cca7c203
host_vars/web05: Renew TLS cert for alaninkenya.org
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-15 12:41:45 +03:00
ce1d64ce66
roles/php5-fpm: Hide HTTP X-Powered-By PHP header
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-09 20:10:11 +03:00
b904f65cb1
host_vars/web05: Update WordPress to 4.2.4
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-04 18:44:30 +03:00
e052650443
host_vars/web05: Update to WordPress 4.2.3
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-07-25 12:31:20 +03:00
d8ac5a7914 Merge pull request #21 from oguya/readme-fixes
README.md: Make minor formatting changes
2015-06-28 23:05:15 +03:00
5989a8873e Merge pull request #20 from oguya/limit-roles
Run roles on Ubuntu hosts only
2015-06-28 23:03:04 +03:00
James Oguya
d4b04ca789
README.md: Make minor formatting changes
To enhance readability of long commands, break them into multiple lines
& skip new lines using '\' character.
Use system default libvirt images path & sample preseed file from
ubuntu.com.

Signed-off-by: James Oguya <oguyajames@gmail.com>
2015-06-27 21:35:40 +03:00
James Oguya
95e702e388
Run roles on Ubuntu hosts only
I think it's a good idea to only run/include a role if the remote host
is running Ubuntu OS - doesn't hurt to do an extra check even though
the README clearly assumes so.

Signed-off-by: James Oguya <oguyajames@gmail.com>
2015-06-27 20:50:09 +03:00
75cda0a066
host_vars: Delete old hosts
web01, web02, and web04 are no longer used.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-07 12:44:05 +03:00
6b75d0c87e README.md: Shorten Vagrant text
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-06 00:14:40 +03:00
78cb49c88b roles/nginx: Add missing nginx tag to blank vhost task
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-06 00:07:50 +03:00
151fb29687 roles/nginx: Add blank vhost
For security and predictability clients should only get a reponse
if they request a hostname we are actually hosting.

If TLS is in use then this will use a self-signed snakeoil cert for
an HTTPS-enabled blank, default vhost.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-06 00:07:50 +03:00
8b77fd7f94 roles/nginx: Templatize SSL parameters using role defaults
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-06 00:07:50 +03:00
bd4f2ae5b6
README.md: Use simple syntax for code blocks
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-05 18:18:28 +03:00
afa15c9671
README.md: Update instructions for usage with Vagrant
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-05 18:17:13 +03:00
eae33a26d7 Add Vagrantfile
Quickly bring up an Ubuntu 14.04 box then SSH in and add the provisioning
user. Then provision it with ansible like any other machine.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-05 08:34:30 +03:00
b701e9641c
host_vars/web05: Override apt_mirror
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-04 21:59:13 +03:00
ae10677b65
roles/common: Specify default apt_mirror for fallback in sources.list template
New hosts often fail due to not having an apt_mirror, because there
isn't one defined for their group and their host_vars haven't over-
ridden it.

We want new hosts to deploy successfully, so let's just use a default
apt_mirror if there isn't one defined. Rather have a slow mirror than
a failed deployment. And in any case, Linode can download from KENET's
mirror at 10MB/sec. ;)

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-04 21:57:11 +03:00
fe765f5d3a
roles/nginx: Fix TLS cert loop to use the current item
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-01 14:46:06 +03:00
4b74964963
roles/nginx: Do a shallow clone of WordPress git
I realized there was no need to do a full clone when I was working
in a Vagrant environment in a coffee shop with slow Internet. ;)

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-01 14:32:05 +03:00
636d37f5a3
Add miscellaneous playbook to change the provisioning user's password
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-01 14:27:58 +03:00
def8d83d49
roles/munin: Use apt module explicitly
Instead of using dynamic hack to use the package manager for the
current host. We only have Ubuntu here anyways.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-26 00:02:43 +03:00
a8f4500567 Add IPv6 support to firewall tasks / template
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-25 18:17:23 +03:00
a17cb2a0a0 roles/nginx: Add initial IPv6 support to vhost template
Still need to add ip6tables rules

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-25 11:53:57 +03:00
3746e798b6
roles/nginx: Use template for nginx repo
A template is better than ansible's `apt_repository` module because
we can idempotently control the contents of the file based on vari-
ables.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-25 00:15:49 +03:00
aa5a9f5dd8
roles/common: Add vim modeline
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-24 23:55:04 +03:00
44642387b4
.gitignore: Ignore Vagrant directory
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-24 23:00:48 +03:00
7212b87f09
roles/nginx: Adjust HSTS headers for https block of vhost template
I was only setting it on the PHP block, which is for all dynamic
requests (ie pages from WordPress), but it should also be the same
for all static files not served from that block.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-20 15:56:19 +03:00
caec2440bb
roles/nginx: Fix HSTS header in vhost config
We always want to add the header, not add a header with value
"always"!

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-20 15:54:10 +03:00
f9ea01ba8f roles/nginx: Use stronger HSTS header
Include subdomains in the HTTP Strict Transport Security header,
and include the "preload" verb to inform Google we want to be pre-
loaded into the HSTS preload.

See: https://hstspreload.appspot.com/

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-13 18:35:26 +03:00
3a4e7455c7
roles/php5-fpm: Tweak opcache settings
Reduce memory allocation from 128 -> 72M because after a few days
of running it's only using 64 or so, so it's really just a waste of
memory.

Also, disable opcache for CLI. What the hell do you need opcaching
in the CLI invocation for? It only persists for one process!

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-09 12:34:45 +03:00
3edd31d347
README.md: Add section about Licensing
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-08 15:59:32 +03:00
06e9672d04
Add copy of GPLv3 license
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-08 15:59:15 +03:00
9c9af27211
README.md: Adjust headings
Use second- and third-level headings, respectively. When rendered
in GitHub, `#` is an `<h1>`, which should actually be the most pro-
minent heading on the page; in this case GitHub's own headings sho-
uld take precedence, so ours should start at `<h2>` essentially.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-08 11:19:46 +03:00
00ad866655
host_vars/web05: WordPress 4.2.1 -> 4.2.2
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-07 10:16:47 +03:00
40499131cc Merge pull request #10 from alanorth/php.ini
roles/php5-fpm: Add templated php.ini
2015-05-05 11:33:51 +03:00
2d6ce778df
roles/php5-fpm: Add templated php.ini
Adds a default php.ini for php5-fpm from Ubuntu 14.04 which enables
sane settings for PHP 5.5's opcache as well as disables pathinfo.

Closes #9.

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-05 11:27:13 +03:00
48daa37462
host_vars/web05: Update WordPress to 4.2.1
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-04-28 12:06:06 +03:00
be22b70ec3
host_vars/web05: Update WordPress from 4.1.2 -> 4.2
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-04-24 22:06:24 +03:00
25de66d605
host_vars/web05: WordPress 4.1.1 -> 4.1.2
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-04-23 23:12:20 +03:00
e675b750c4
roles/nginx: Switch to nginx stable branch
Remove old mainline repo and add stable repo to get nginx 1.8.0.

See: http://nginx.org/en/CHANGES-1.8

Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-04-23 14:52:22 +03:00