Commit Graph

744 Commits

Author SHA1 Message Date
ca15b27789
Add host_vars/web17 2018-05-20 14:58:27 +03:00
131420be17
roles/common: Add task to copy tarsnaprc
One less thing to do manually after server provisioning, and there is
nothing sensitive in here anyways.
2018-05-20 12:51:02 +03:00
c29d37c159
roles/mariadb: Use German mirror 2018-05-20 12:05:35 +03:00
05e853d0ad
README.md: Add note about Python 2 being installed 2018-05-20 11:46:18 +03:00
314a33d37c
Use official MariaDB builds for Ubuntu bionic
We had been using the Ubuntu 17.10 "artful" builds for Ubuntu 18.04
"bionic" but there are now official bionic builds.
2018-05-19 23:12:35 +03:00
533b9c60e7
Use ansible >= 2.5.1 for pipenv 2018-05-18 17:35:07 +03:00
073e02f875
host_vars/web12: WordPress 4.9.6 2018-05-18 12:41:50 +03:00
23073100ce
Remove tor-relay stuff
Harder to run one of these than I thought. Mostly it takes a lot of
bandwidth, and it's probably better to spend the $5/month you'd sp-
end on the VPS by donating $50 to the torservers.net project.
2018-05-16 09:58:08 +03:00
2837de4e3f
roles/php-fpm: Update defaults
From latest PHP 7.2 on Ubuntu 18.04's php.ini-production.
2018-05-15 00:00:27 +03:00
70abcb2051
roles/php-fpm: Import new php.ini-production
From latest Ubuntu 18.04 PHP 7.2 package.
2018-05-14 23:58:45 +03:00
92e0b67149
Remove relay03 2018-05-13 12:30:41 +03:00
6e9fa0a213
Add relay03 2018-05-13 10:45:48 +03:00
207856d587
Remove relay02 2018-05-13 09:25:31 +03:00
c8f0421ff7
host_vars/relay02: Reduce bandwidth to 75 KBytes
This is the minimum for Tor relays according to the torrc man page.
2018-05-13 08:17:20 +03:00
3a4bd1e5c4
host_vars/relay02: Increase bandwidth to 1 megabit 2018-05-12 23:35:17 +03:00
142ae35904
host_vars/relay02: Reduce speed to 700 kilobits 2018-05-12 21:58:59 +03:00
d6340a3c09
README.md: Update todo 2018-05-09 00:06:21 +03:00
1a9033dece
roles/common: Use bionic tarsnap builds on Ubuntu 18.04
Tarsnap finally published builds for Ubuntu 18.04 "bionic" so we don't
need to use the 17.10 "artful" ones anymore.
2018-05-09 00:05:42 +03:00
42fcd933a8
roles/nginx: Fix Jinja2 logic in apt sources template 2018-05-08 23:53:47 +03:00
5a8b7f0425
README.md: Update todo 2018-05-08 23:43:54 +03:00
3f0c45d504
roles/nginx: Force amd64 builds on apt sources
Avoids the following error in apt:

Skipping acquire of configured file 'nginx/binary-i386/Packages' as repository 'https://nginx.org/packages/ubuntu bionic InRelease' doesn't support architecture 'i386'
2018-05-08 23:41:25 +03:00
f5fbc4b8f1
roles/nginx: Use bionic builds on Ubuntu 18.04
NGINX finally published builds for Ubuntu 18.04 "bionic" so we don't
need to use the 17.10 "artful" ones anymore.
2018-05-08 23:39:59 +03:00
70c279ea81
Add host_vars/relay02 2018-05-07 11:04:38 +03:00
d4a0dab704
Add netaddr to pipenv configuration
Required by the ansible-relayor role.
2018-05-07 11:04:22 +03:00
42501acb74
Add install instructions for ansible-relayor
There are several ways to install external roles, ie via ansible-galaxy,
git submodules, etc. I found that adding this role to a requirements.yml
file and adding instructions to the README.md is probably the best way.

Using ansible-galaxy actually had issues because the ansible-relayor git
repository has version tags that use mixed styles, like v0.3.3 and 0.1.0
without a v.
2018-05-07 10:54:40 +03:00
1277f422c8
Add playbook for configuring Tor relays
Utilizes the ansible-relayor role developed by nusenu.

See: https://github.com/nusenu/ansible-relayor
2018-05-07 10:53:36 +03:00
f9ea7d30f5
host_vars/web12: Update DNS resolvers for TLS stapling 2018-04-30 18:12:29 +03:00
0a39051a95
roles/nginx: Allow custom resolvers for TLS stapling
Allows to specify custom DNS resolvers for TLS stapling, with a default
of Cloudflare's public DNS servers.
2018-04-30 18:04:17 +03:00
bda95b6a1c
roles/nginx: Default to Cloudflare public DNS for TLS stapling
No need to give Google even more data or free advertising by using
this as the default! In practice I always use the DNS servers from
the VPS provider anyways.
2018-04-30 17:51:59 +03:00
54d62feead
README.md: Add note about unattended-upgrades 2018-04-29 21:16:03 +03:00
7aed78016c
roles/php-fpm: Use set_fact to set packages
Instead of looping over a list of items to install, we can actually
just give a list directly to the apt module. This allows the module
to install all packages in one transaction, which is faster as well
as slightly safer for some dependency resolution scenarios.
2018-04-29 16:10:53 +03:00
45517a1421
roles/php-fpm: Remove "packages" tag
This tag is no longer reachable after switching to the new dynamic
includes in Ansible 2.4 and 2.5. Anyways, I've been questioning my
decision to add the "packages" tag to any task that uses the apt
module.
2018-04-29 16:04:47 +03:00
434fe59a63
roles/php-fpm: Use blocks to tag children of dynamic tasks
When using dynamic includes, child tasks do not inherit tags from their
parents. You must tag the parent and each child task separately, or use
a block to group children and then apply a tag to a block.

See: https://docs.ansible.com/ansible/devel/porting_guides/porting_guide_2.5.html
2018-04-29 16:04:03 +03:00
03700596bc
README.md: Update notes 2018-04-29 15:51:21 +03:00
436e823415
Update Ansible to 2.5.2 in pipenv 2018-04-29 11:41:24 +03:00
6208d1518c
roles/nginx: Use set_fact to set certbot dependencies
Instead of looping over a list of items to install, we can actually
just give a list directly to the apt module. This allows the module
to install all packages in one transaction, which is faster as well
as slightly safer for some dependency resolution scenarios.
2018-04-26 19:48:05 +03:00
baa5890d6d
roles/nginx: Add name to Let's Encrypt task
All tasks should have names, even if they are just including other
tasks.
2018-04-26 17:12:22 +03:00
fa5db39674
roles/nginx: Move WordPress tasks to separate file
Because of the shift from static imports to dynamic includes these
tags will never be reached unless they have their own task that is
tagged at the top-level (dynamic includes don't pass their tags to
their children).
2018-04-26 17:09:09 +03:00
0f512a5bf7
roles/common: Use blocks to tag children of dynamic tasks
When using dynamic includes, child tasks do not inherit tags from their
parents. You must tag the parent and each child task separately, or use
a block to group children and then apply a tag to a block.

See: https://docs.ansible.com/ansible/devel/porting_guides/porting_guide_2.5.html
2018-04-26 16:58:35 +03:00
7d950ade99
roles: Remove unreachable "packages" tags
After reörganizing for dynamic includes these tags will never be reached
because the children of dynamic includes do not inherit tags from their
parents as they did with static imports.
2018-04-26 16:31:06 +03:00
1738507ee9
roles/nginx: Use dynamic includes for Let's Encrypt
As of Ansible 2.4 and 2.5 the behavior for importing tasks has changed
to introduce the notion of static imports and dynamic includes. If the
tasks doing the import is using variable interpolation or conditionals
then the task should be dynamic. This results in quicker playbook runs
due to less importing of unneccessary tasks.

One side effect of this is that child tasks of dynamic includes do not
inherit their parents' tags so you must tag them explicitly or a block.

Also, I had to move the letsencrypt tasks to the main task file so the
tags were available (due to dynamic tasks not inheriting tags).
2018-04-26 11:00:47 +03:00
2da7f39bb4
roles/nginx: Use dynamic includes for tasks
As of Ansible 2.4 and 2.5 the behavior for importing tasks has changed
to introduce the notion of static imports and dynamic includes. If the
tasks doing the import is using variable interpolation or conditionals
then the task should be dynamic. This results in quicker playbook runs
due to less importing of unneccessary tasks.

One side effect of this is that child tasks of dynamic includes do not
inherit their parents' tags so you must tag them explicitly or a block.
2018-04-26 10:45:01 +03:00
c608331e3c
roles/nginx: Rename Let's Encrypt dependency lists 2018-04-26 08:26:58 +03:00
e50f413f5e
roles/nginx: Use dynamic include_tasks for Let's Encrypt
Use dynamic includes instead of static imports when you are running
tasks conditionally or using variable interpolation. The down side
is that you need to then tag the parent task as well as all child
tasks, as tags only apply to children of statically imported tasks.
2018-04-25 20:03:32 +03:00
ebda406de3
roles/nginx: Separate Debian 9 "stretch" Let's Encrypt deps
Instead of iterating over fifteen packages with a loop that does fifteen
separate apt transactions, it is better to give the apt module a list so
it can install them all in one transaction. This is both quicker and te-
chnically more safe for dependency resolution.
2018-04-25 20:02:42 +03:00
f427350feb
roles/nginx: Separate Ubuntu 16.04 "Xenial" Let's Encrypt deps
Instead of iterating over fifteen packages with a loop that does fifteen
separate apt transactions, it is better to give the apt module a list so
it can install them all in one transaction. This is both quicker and te-
chnically more safe for dependency resolution.
2018-04-25 20:01:39 +03:00
12711afac9
roles/nginx: Add dependencies for certbot on Ubuntu 18.04
Taken from running the Let's Encrypt certbot-auto client on a freshly
installed Ubuntu 18.04 system.
2018-04-25 19:40:33 +03:00
ab27caf877
roles/common: Use dynamic include_tasks for firewall
Use dynamic includes instead of static imports when you are running
tasks conditionally or using variable interpolation. The down side
is that you need to then tag the parent task as well as all child
tasks, as tags only apply to children of statically imported tasks.
2018-04-25 18:58:31 +03:00
a044fd2f55
roles/common: Add missing vim modelines 2018-04-25 18:55:22 +03:00
8b660dcfbe
roles/common: Use dynamic include_tasks for packages
Basically, when using conditionals or variables in your tasks you should
use include_tasks instead of import_tasks. The down side is that you now
need to tag all included tasks individually or with a block, unlike when
using static imports (tags are applied to all imported child tasks).

I would actually like to reduce this task to a single one that uses the
host's ansible_distribution variable, but Ansible 2.5.1 currently gives
the following error: ansible_distribution is undefined.
2018-04-25 18:46:28 +03:00