c0431d4247
Switch HTTPS vhosts to Let's Encrypt certificates
...
For now I generated the certs manually, but in the future the play-
book should run the letsencrypt-auto client for us!
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-11-07 20:53:39 +03:00
13a1889017
roles/mariadb: Upgrade to MariaDB 10.1
...
10.1 was marked as stable:
https://blog.mariadb.org/mariadb-10-1-is-stable-ga/
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-10-19 21:54:26 +01:00
229dd499dd
roles/php5-fpm: Remove default www pool
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-27 01:28:47 +03:00
cb67d6aa40
Rename 'use_https' to 'enable_https'
...
To be consistent with other similar variables.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-27 00:34:40 +03:00
7cb3adf11c
host_vars/web06: Move HSTS variable to host_vars
...
Moved out of role defaults, as it is really a per-vhost thing.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-27 00:31:01 +03:00
52dc0c357b
roles/nginx: Add HSTS check to vhost template
...
We need to actually check if HSTS was requested before setting the
header in the block handing PHP requests. We check in the main vhost
block, but nginx headers are only inherited if you don't set ANY
headers in child blocks (ie, headers set in parent blocks are cleared
if you set any new ones in the child).
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-27 00:27:41 +03:00
48978407b8
roles/nginx: Move HTTP Strict Transport Security toggle to vhosts
...
This is really a per-site setting, so it doesn't make sense to have
a role default. Anyways, HSTS is kinda tricky and potentially dang-
erous, so unless a vhost explicitly sets it to "yes" we shouldn't
enable it.
Note: also switch from using a boolean to using a string; it is st-
ill declarative, but at least now I don't have to guess whether it
is being treated as a bool or not.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-27 00:24:58 +03:00
f098b114d3
README.md: Minor syntax cleanups
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-26 23:37:09 +03:00
295a9b4924
Remove references to Ubuntu for requirements
...
Now I am doing most of the work on Debian boxes.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-26 23:35:12 +03:00
f16b143eac
roles/munin: Update munin-node.conf template
...
We actually need to use /var/log/munin for munin-node on Debian
too, as that's what is created by the package manager during
installation.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-26 23:30:22 +03:00
24a3724dfe
roles/nginx: Remove spdy_headers_comp
...
It was deprecated when nginx added support for HTTP/2.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-23 18:20:38 +03:00
a3e71e75d2
roles/nginx: SPDY -> HTTP/2
...
nginx 1.9.5 mainline adds support for HTTP/2 and deprecates SPDY.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-22 19:40:30 +03:00
110981d9c3
host_vars/web06: Update to WordPress 4.3.1
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-16 10:32:14 +03:00
973b37be4e
roles/common: Tweak sshd_config to match NSA Suite B recommendations
...
NSA stopped recommending AES-128 in August, 2015...
Before: https://web.archive.org/web/20150403110658/https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
After: https://web.archive.org/web/20150815072948/https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
I don't see why we shouldn't follow suit; maybe they know something
we don't!
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-02 16:55:51 +03:00
5c0a7c2c72
group_vars/all: Update TLS cipher suite
...
Use latest Mozilla intermediate suite:
https://wiki.mozilla.org/Security/Server_Side_TLS
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-02 15:11:57 +03:00
5a92694d5b
host_vars/web06: Remove list of ssh users
...
Only allow access by the provisioning user.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-02 12:25:24 +03:00
8b336352d7
roles/common: Only allow ssh access by provisioning user
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-02 12:24:11 +03:00
4b18f91438
Remove host_vars/web05
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-01 11:17:24 +03:00
bc28cd008c
roles/munin: Allow running on Debian hosts
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-09-01 00:10:16 +03:00
abbc9f5073
README.md: Increase header sizes
...
The document is its own namespace, so we should just start with H1
tags. When GitHub displays them in the repo view it wraps the read-
me in an <article> tag anyways.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-31 23:01:35 +03:00
90d7f239c0
Add web06
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-31 22:51:17 +03:00
9c70ab29e3
roles/nginx: Rename nginx sources.list template
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 13:24:43 +03:00
b214bdfae8
roles/nginx: Add Debian support to nginx sources.list template
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 13:22:36 +03:00
9ad8209fd4
roles/mariadb: Allow MariaDB repo installation on Debian and Ubuntu
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 13:14:46 +03:00
c480075789
roles/common: Use "interface" instead of "alias" to get interface name in firewalld template
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 12:06:47 +03:00
9266d48c9f
roles/common: Separate firewalld tasks for Ubuntu and Debian
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 12:06:25 +03:00
18ca44193d
roles/common: Add sysctl template for Debian hosts
...
Note: I've only tested this on a Debian container, and you can't
set these sysctls on containers (the host controls them). To make
matters worse, there is no fact to make ansible skip this on hosts
that are running in containers. For now I will just skip it on
hosts that are "virtualization" servers... even though we actually
do have KVM running on Debian on real hardware. *sigh*
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:12:17 +03:00
56df8b38ca
roles/common: Use new cron-apt tasks
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:40 +03:00
96fe209843
roles/common: Fix mode on Debian 8 sshd_config
...
Accidentally added it with 777.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:39 +03:00
7519995153
roles/common: Add Debian 8 sshd_config
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:39 +03:00
b4310cfc89
Allow Debian hosts to run Ubuntu stuff
...
Sometimes we mean Ubuntu, other times we mean Debian family. Use
ansible_os_family where we mean Debian family.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:39 +03:00
dc24285ec6
roles/common: Use apt_mirror variable in Debian sources
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:39 +03:00
28f61d589e
roles/common: Add Debian support to sources.list template
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:39 +03:00
e15d1be867
roles/common: Add playbook for Debian packages
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:39 +03:00
1fc2453703
roles/common: Add firewalld support
...
Needed in Ubuntu 15.04 where iptables-persistent is going away. I
have added translations of the current IPv4 and IPv6 iptables rules.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:39 +03:00
cc3b6d5026
Vagrantfile: Update to vivid (15.04)
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:39 +03:00
16a0bb9086
roles/nginx: Use utopic (14.10) nginx builds on 15.04
...
Upstream hasn't made 15.04 builds yet...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:38 +03:00
9aaad366f5
roles/common: Only add extras repo on Ubuntu 14.04
...
The Extras repo was discontinued after 14.10 (but the latest we
deploy is 14.04).
See: https://lists.ubuntu.com/archives/technical-board/2015-January/002063.html
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:38 +03:00
e84f777a6b
roles/common: Bring Ubuntu 15.04 sshd_config up to date with standards
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:38 +03:00
b2dbd138f7
roles/common: Add Ubuntu 15.04 sshd_config
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:02:38 +03:00
68493beba3
roles/common: Reload sshd instead of restarting
...
No need to restart for a config change.
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:01:17 +03:00
8e0a292b1d
roles/common: Move sshd tasks to their own playbook
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 00:00:43 +03:00
7f929d5b80
roles/common: Remove unused cron-apt files
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-22 23:42:03 +03:00
fc586a2297
roles/common: Adjust cron-apt stuff
...
- Don't run the static files as templates
- Use a separate playbook for related tasks
- Use a template for security.sources.list
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-22 23:39:22 +03:00
c535cce6a5
host_vars/web05: Upgrade to WordPress 4.3
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-19 22:54:55 +03:00
45bf41dc35
host_vars/web05: Update TLS cert for mjanja.ch
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-17 12:37:22 +03:00
18cca7c203
host_vars/web05: Renew TLS cert for alaninkenya.org
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-15 12:41:45 +03:00
ce1d64ce66
roles/php5-fpm: Hide HTTP X-Powered-By PHP header
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-09 20:10:11 +03:00
b904f65cb1
host_vars/web05: Update WordPress to 4.2.4
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-04 18:44:30 +03:00
e052650443
host_vars/web05: Update to WordPress 4.2.3
...
Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-07-25 12:31:20 +03:00
