roles: use ansible_facts["foo"] pattern

Instead of ansible_foo. Ansible recently started warning that this is deprecated.
roles/nginx: git clone as nginx
2025-12-02 20:42:58 +03:00 · 2025-11-21 22:07:55 +03:00 · 2025-11-21 21:08:29 +03:00 · 2025-11-20 08:47:27 +03:00 · 2025-11-20 08:47:27 +03:00 · 2025-11-20 08:47:27 +03:00
99 changed files with 2800 additions and 23232 deletions
--- a/2
+++ b/2
@@ -10,4 +10,4 @@ ansible = "*"
 ansible-lint = "*"

 [requires]
-python_version = "3.10"
+python_version = "3.13"
--- a/Pipfile.lock
+++ b/Pipfile.lock
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ Ansible playbook for base and initial configuration of the web server hosting my
 ## Assumptions
 Before you can run this, a few things are assumed:

- You have a clean, minimal Ubuntu 20.04 or Debian 10/11 host up and running
+- You have a clean, minimal Debian 12 host up and running
 - Python 3 is installed on the remote server (requirement of Ansible)
 - You have a user account with password-less SSH access to the machine
 - You have sudo privileges on the remote host
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -2,16 +2,16 @@
 retry_files_enabled=False
 force_handlers=True
 inventory=hosts
+gathering = smart
 # instead of using --ask-vault-pass
 ask_vault_pass=True
 remote_user = provisioning
 interpreter_python=auto
-
-ansible_managed = This file is managed by Ansible.%n
-  template: {file}
-  date: %Y-%m-%d %H:%M:%S
-  user: {uid}
-  host: {host}
+# Don't warn on unknown SSH host keys because it's super annoying for new hosts
+# or if you get a new laptop and run Ansible there!
+#
+# See: https://docs.ansible.com/ansible/latest/user_guide/connection_details.html#managing-host-key-checking
+host_key_checking = False

 [privilege_escalation]
 # instead of using -K
--- a/group_vars/all
+++ b/group_vars/all
@@ -3,4 +3,12 @@

 tls_cipher_suite: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"

+ansible_managed: |-
+  This file is managed by Ansible.
+
+  {{ 'template: ' + template_path }}
+  {{ 'date: ' + (template_mtime | string) }}
+  {{ 'user: ' + template_uid }}
+  {{ 'host: ' + template_host }}
+
 # vim: set ts=2 sw=2:
--- a/group_vars/web
+++ b/group_vars/web
@@ -1,8 +1,14 @@
 ---
 # file: group_vars/web

+# run nginx by default
+webserver: nginx
+
 # all hosts run fail2ban with the sshd filter, but some can use other filters
 extra_fail2ban_filters:
  - nginx

+# root prefix for all web servers
+web_root_prefix: /var/www
+
 # vim: set ts=2 sw=2:
--- a/host_vars/nomad02
+++ b/host_vars/nomad02
@@ -1,163 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-36643866316634653430343333316233346137663238373035376232643132663036343736376464
-3033313234383933656361343938653362623265653030360a396638643333633137376231663538
-65313537316564303330663730333131633165633238643532646435386436623163346366383533
-3965636630393834620a343531623964626135636337313861653361393733333463633234363435
-64643934346466663934613962613230623562323666353231326363343430336637323666383634
-36626136643432343332343665343734653435383336313862383863626466663633363738313563
-30303666306439333836306161633432346636396333653434666531353966353430666436623531
-31636562656161333830313362653764306137396231346334613336346538306432636639386561
-65323737383865313264623934613365373465323065616130333837386665666333623832626239
-33333230643332373238363432306466613737373132643134363563613535376365616130333433
-35653262356233626331643432396237306237363135623830643536653938363461303738613130
-66613036393338393037386162383831663866323233383736303532363837663039376166363639
-34666237333562643665653165393730646632316237663337383937353365333532336462656362
-31353934393363363765616335626565343238336262653361306164383030303835303666326532
-31386332346362633433356161643536333862373030306364393935663061396538616637623230
-66383163396139306430343639346264336464646233316636666239643132376164613666363538
-33356365643430383732396235623038643566623131616461376261343563353236306663656634
-64643035373039383031303464346264383066623762323161643561366164313461613038633531
-36383161363065366164383932623231626633646166313835343264373366393236626336353039
-66646338303731346337363962353135346239306562663737363038306433386230326636336162
-65313132626564663738633531333662666661326463643032656136376564643938623061346464
-66653239663464306430613563666336643839323537626338666435336138613763313364323637
-30666566326463623438316263623233333434623366306330656564636163336636623433646631
-65316562616136626330333166646332366537666664303766346239316535333031396235303466
-34393664373361356231333530323865646333653237613636386632393730623330653437393164
-65343266373237386364373862656138633263666633333465623836366233663537393539393638
-34643963363865383434633163623832646632393234636136346137366361393638393461306337
-64653436313065326637363632336565306137613131306364336537613835306332633366313130
-34393732643361663731383661646631353035353064613931333330653031626435353163323633
-65326135376462666435643837333131313863313630336566333835613132383365343234366133
-39336131363366616136663636663334386361646465336331343836626439316532376566353565
-37643361646435643133336333643837633331316432303062623062396564373137613235363762
-32363838333337363035343631353261653063316138626133303937623233326531333837383033
-39366536333434303864616164313137613337643730306261626138343764663662393161613730
-36303736306631636266336131396336646635653131336265623364633038363339353933636632
-39626134353866313439333962376663393831303261633431303035663130613265333739616135
-62623138386235653935383364623230343662333138653562633266336534383963326237663132
-38646335623532383565303466386261613931666438313261653434633934353739613431636132
-39633133656230666231383936396264313630353434313035643565333661393736386637313264
-63636337373334313937643261313564333564383566633730396364653533666236643433643436
-33363061356362386535323038383637613364393639646363366630373735353234333134636565
-37653064636536376638626135393332626539346365353661636439323338653137383866663734
-62303139363436646464383266396464313565376132393937356665396536623332376134393366
-30346435313566313237326461346362353633353261373038656130323365383765613739323239
-38633934643531633037623036623839386637663762366631633033646138323936353433326430
-34396466653230643766636636393735373363616637386662333535643536626261653264346332
-34336337646133646261353939353166393530323730333063393365626365383366633464633236
-64656535613838313461623864666362373030636366373038373863616462373939356238353362
-36363535653734343533666532343166313964303236313135386134623963386535306435656330
-38386430303330303837326138356364373439313836636234656331643131646363386138653065
-64353837396533303463643130613339663166333933643362303565623432643064353865393635
-65663362666130623933623733323933343065633432613965373764383035316338316338373934
-65383061386635316331366532626437303664636436306535663365373064346136393063623335
-35643062363536633332313531356637313032666262366466626462666663303161653635666331
-32343130383231323239363235313031346438323330383938303733323436646336353163356132
-30336136646261323866663530336335636464623035626635333961623363396239353935636531
-64373231386163663962313834333538333133376433623363306239393462383930306432396562
-65393761633834663431353032393032396330393338343863333939323632393438646331613463
-35363530653161653266616331356531666434353663643364316564623438316132383463356437
-38626365343733383735383939646331376531376563623231323535323735356630336130383835
-39633335373163656431336130333664306164336536356431323438333933636365303330393233
-32353437393133646632373234376431626332626333343866643463653662373861346539663131
-32393333633766633738393937356134313236343633636533376665316134653632623061353866
-36373761366264653737386331383235306137323965363265653937353833343362633433313462
-32316466356335366630373635376561636233336165666661653632323835336563313134343064
-30333033333331303164323133613536613636373333663131633162616235316636346337333462
-64306336636562353733613538343462626233303661363131333665366135306332346135323136
-31306535643539303936346632623930333339353439376462633462626165633437393830373739
-61653230646366623830353630336661623466316136373264353762313065346632366164653261
-64313830303466306135313964613537633236383535343132613332613733316161623365333163
-38633930323439303030316433343764356538313632366635653437346161646439663563323832
-38363731353734303932653662326138646239306261383232643537313365393061383663643632
-31343736373739643164623437663239616663373335643262336664326365656137643066383463
-37356666306666353339626662326135636530386462613061326631366535383034303830323237
-65316135343135383230656638363564303635363333623833373163326365393430663235623231
-35646632643735363730613462656562356139323863616266343566343861356238623564326430
-31306366366330363036616137363163663136316565313334616164346639663465666338316439
-33643732343062313536313233333039366435386235333736333937633266653761616262346566
-32636337623266656464636634643632316134376334653932363134613336346539656438633137
-31306439663834663431346133653532636664636463376337616539393239316465636537633630
-30363461343733653465666332646236386633396530333863616236383437333931643731626364
-38393337656130666237373538393430306333333033306466343866303038643234646339306233
-32336364363838636563643939626665643231636633666166653539313461393238333461383262
-62346634633236343433336531396361323238386262313565396265663162353765343037303862
-63633034363664313733633433356332333633366530643863316364653065623161663932323831
-31646530613933613735333834373532616136393662346431656363346364353031303262326134
-31343332386166646530373635343039323163323366616263346431353765303430353636373539
-36346461303730313630373637346266323331373733383465323037343633313739306233336339
-63646137643332623834343462333263356432366631663065383962373634366639656133323964
-64343035323863373139313163323562643066306139363235626532396436663137653635353035
-31396334346137626461633436343539366635356537306231353961333963616334323037346637
-33626161333264643261656661643933653835356236333831343563653938303266323730363865
-31363562383666633636343935386535306361386234346535613363613363393065363832306363
-63643238383363646137306361306265666435363739306463663637343761643831633261633531
-36626562636333336434613365316232343832646163396338613839643064653834633832376230
-33343265386162303266373033353332393931633663623734396133326232303465666432356363
-66306338616634616631363662313963386638343266383063313166353437373433623736333361
-36333163386630376262616362613530346563383637656130363365366634633135323863646363
-35323430343033323734363533326334303438663065656535666432376661613435623365316139
-30623835373535623662633131393831376231623663316331313661646531393338613532623063
-66343665356338636438646339663761336636653332646233326264373435346263386130383861
-34623265373463653165383665306334643233373066356231343666663866373739336436653933
-65623134306536333538333061303066636339376636333438623666366362666137653261376539
-31346435613134303866333065306237343162333138643339313461663934643234303132613961
-65393037396463663034636534323566366161623365666466393634373764333437383263656535
-33643461636362646135626164373335386130303766633434633062356630336463623661396639
-32646565623164363631383731666161343762393639343839373234326337643766336263353166
-62633964303733643035326535656561366139626565643938356264646239336166316534373261
-30623765623338616537353062666338376262393966373033346233383132653839323731626663
-66393938313132653538313031323538333263333361303661646633366633353534373837313935
-37323635633431623365643738623834653631323564393436326562326439666462306263653331
-66316134616432323939373366343564623264336632376132663462396362663134643236643832
-31393366653961323763333335303135383934633538636335303435636334343737306232373561
-31343139363863326536613163663862343263313630336438666132306162646130613233393935
-37336330643361323032366433313939616134366134393032613862616136393339643232356139
-35326534623263353766326132623330323639303230616263636536366263643339663838376238
-35323731303163616236306439343632353561646339663933313937363739303864336438626638
-64633139633338623431343236333534373835356365343536636261386437613538303334663739
-62396532353832323262343763353365333561643633353638313534393164366539353431396336
-36653563633237333730376331326432663561343463616135613738663130323936373136393538
-65636634363631313364326665336164653939356133333031633632373030623666373562623564
-64616365616435393231646236623333333037346363666664666233306661353337343066626136
-35666164356537323735636131383266393064373538303966353531636561623032643233346566
-61633465376631656636366662373865623764336135323865316336663731383335303330616231
-64313836373063313061626365316538653831316562333165616531643434633964333438333665
-66376634323531356538343837326636636636393639396535346264656531613733386337353966
-31363730646365313834316234626532663563613234643563366566373662616335623035393536
-61653334346336613539313732383438313132653738393339373661336531633565303635353665
-31383939643261666538356633326666363934643738636430383537636165623264616236633863
-35336134386437383539303061343261313530313366316338663539383238663966653837663331
-33386464653161376335316536633532383035363066653234626363343232393165313463343930
-63323435613932626435363235396236313365636166663238323534623038663034303365326566
-66306635373433313730343536633931643935323062643136383434643138306138363366663834
-66613964303634616139323832363633363063653237366135613964663733376161373937323462
-30313833623733336366356635323261613132393734613735393062333232313236326264323366
-32376535616334376137663636633333323665333939363366313432633436653864306532393966
-61636337356534373164653637633162613235623364396539623961353466303036383031363162
-37313364613939613939343538633665666136363135656330623332656466383139656234336133
-62366262663064623137626363613066366666313733623463623562636131323435346264653564
-31323431663339653966336230356339303534353139663739363263633564373364323937386434
-37306462653630326366316530656462316539373263366262313930356663376334343562303361
-61623161613939616666386336626537333135346136643537326635383939663863623332373033
-32643730313861636163623133323061333631333332373838636163326562633936363631653062
-37336661626336623462616562333264373330323363363630313739363962323735393332303562
-62393161323962393039346432353066646162336332663636343739343566363833333738316437
-64333337363137643931366536396333633538633830353865323765616264356335383031353534
-33376363386630303332643263383738386532373434613963613764326636333133303262393832
-35373930383662383064333465633736363063363434333662396331633032353733353334363162
-32393361643562623362333963663262363235326536396131643435306665343438333933616466
-34326634373965313638666337326633653938343561663739333464343135346437636436633034
-62333039373136656664363531373430356363363736306533386135323061316339326636643739
-38363763653331646638613963646138666165666439643065363335343132613731623264376536
-37366533636564346661343966373964353731623861633463363638356163346165643164373535
-30373564326263393436326337653631383731313139636339356433333830666265343165323330
-36616538616534626237623862636536303336343331383237333333656637303266616137336439
-61653631636632366563373034346365313337356266636338336663643538303063613036383831
-65613635336366316263336131666238386237366264396438383966313762626639643236313532
-30663235666662396231376631366139653937646132343639396430643339393165656266636235
-38356135666433323434613238356537306630643861353436323037353461326534313632386232
-63643261373263646437373535333036336634396331616330353233613564363361396437326435
-38396462643833313362633436303637323163663166653231653866643733616432323663316362
-3037356363643462356137346638313963376637643162623062
--- a/host_vars/web21
+++ b/host_vars/web21
@@ -1,46 +1,27 @@
 $ANSIBLE_VAULT;1.1;AES256
-31303064616130313334356131393461656264376237303838313334366562376338343931333036
-3165636436393538633063303338636464663634643539310a323766633431376166393134303038
-34316264643034386661343566656139306234383430613032343332643363323534333238376233
-6262383039383065660a313138653738643838346365633238326534646637353033623638306161
-31336565373635663661343930396463333632366665633464646264333732373431633463343462
-64303538343234613532323431643765643738396233376138343561306361313864376165393064
-37313964656461353466306433366538346131313034316633626265346665666332666665336635
-64386261643536386536366337313938343134346532393866663065306434353766666132383666
-37623138653430363964313566666165326130656239333965346234386233643537643231613163
-61333336383265613930613239393663356566633464343732383133336435393036646536353834
-31626235343330666233616533636636316637643665333861386263646363613237613638313835
-39393736313734393539386563333331636361376137313631373833643763623338653462653066
-31633061323161663139633761623662653434363362386235623061626662343535626461663934
-33633966353263613466616439663631363162376466346535383963383332376130303265633935
-31646533633330616136346239356366616530363539323466333765656537623862653633643930
-64646261636239343866663238613834376339366666353534373666333966366264626663326430
-61343530636536613032646630346136656231633730646331666633623634623235666535336536
-36303735373331383332653731616136376163396337323536616431633934633830323531656633
-65666565363133366166323866366137663332343633333262643433396531333833626532313663
-62303265623764613231306365323362303565623232326137386135363262623366343330666134
-64376435363164636332383061343066336439363433653939353235383934346331383933333130
-36623437393461613137316634626638353039343465333161623632363735346438383537306236
-37306531336433346461656466396566623263353632323364643963323835356666393062343137
-36323065323639646330643437373965613563366663363739646237396563336633653232643466
-30336534373463643733613536343762633435343636333632613936383930316532333933613961
-31313535653639653331343364383662653434333833663464623164636538353763346134643762
-36383132326134353632336334303264376162316162646331656434663435326535636164663238
-62383435343366663932346131636530386434333064323734363061633166323363383566383931
-30626337656133613632313136656431623761343036613865663261653437343139303734383231
-33613938643264313138626639393132663032326235383439326132363361616463366266383439
-36656161386531303230396562356438356537653133666336306439303630393665623665396130
-37356633356165333737303235373062663664643434346366613536343164626339633039386538
-30653962373361626436616366396362343739613937633830613235373866613665306334663166
-63643965303465306637663666336563633234333437643565353262623963653562623662323337
-31353636353830336362643536396232333732663937616666383431616161646265313834393232
-66646338303134393232363133653837346638613165323035363266333566663163336338613335
-37303964326663303338643233353939633735616231356430663931646363613565653764303637
-36643063306362373666653531656534646465666134353866313333316239663363663062373038
-33393938663363376530303463636665663539626537373262366536363830653632663736356632
-35653465306236356166653739623461636434636132653237333932333965366464633365326430
-32306533303966373662353061343130306662623735363930626663393139323236613730356336
-34306436333734626339616438383934353934306233323863653964623435663863333330643061
-64626333623436623230613362373533343237313165313030616662633739373065376231313237
-61303561303432613336366238326534616631346364616135363562303161313334303866336434
-6164
+38663333313561616264323430323162323837623430363739623561633331656664613936666665
+6364373033623163393239663035306337383066343438310a383666313434323036643037363065
+30396333626130303633663930663965666662646233393439376661346265616565616236623366
+3930373433646231610a336233663132306263656465633034333030316362643939316465666534
+38353961393038613961353732613434663565633466303265383231343336386330333464376363
+33616330643364376332623634363766656366666239633964316439376463313063333162343963
+61356634393438313063666434626338616264613639656462626639616263366531663135393466
+66346635616439306364356133303664376134626636616131373138656562363363306633333164
+62623135343633393834393165383231316562643062343165663235313930663039623135373263
+61343336643235303962333938613230356465346436376334373438386461366231383737643137
+36343832353730366131653430633465383163396336353065306638373166386438356264616139
+65346635663338366463343932336231386235393836616238373864626235623935663661396663
+31633565356465333737303339333435383162316530396563333335613062623138333232336162
+62376363666431363931663231643561616562383230643737393261623934363633313231333137
+39383238656237343661626662366465356463396336386261326334613436396364633062646532
+61313136366636363861316166396134316562666435653437326331363563653035343138636163
+66336139636533656334643966383962383734623565323435333665666164353732663736326364
+35616264383237316330386539363065376334643432393636643464646238633034333166663665
+33313166393738626133636136346637646437306335326263393634363133663736666338313838
+64623139613037653461643563666539613237323934376534376461313833336338623032616661
+64643062663633366436383232366137373936383430306332616634636331326361383931363961
+62313236313563326438303935373837666434313435653236643135303739373763656562393537
+31653265653739346433663937343439656231663963333633373066356231623762313438393763
+36306336656566633034373834316363333233326130626639313130643935333437653934313636
+32383034346234333561333466653561323834346166633831303566376266373933356536383031
+6236303934323963336662386666653138313165366133303434
--- a/host_vars/web22
+++ b/host_vars/web22
@@ -1,130 +1,141 @@
 $ANSIBLE_VAULT;1.1;AES256
-31346139633764626430393965376336626533643834373732313733643561326464616430313637
-3161313662633462313763643766653133666333366433300a303565386266376238396534376239
-31396132303235353561333337376666643861326531393431353064376532663538663132643834
-6233343632613235350a643262316130363537653062353130646639346361346462346265353036
-33616564363232633165336561343466313835336165626163323137623337383863643830663162
-31336533623439336632666436373537386635613664663938666231306233626433333831373763
-62663130396664643862383930373736663336616165346539666632353436623035383565363230
-30303663353133306235633862653465656264623764663833663561643330633833373366346231
-36613461663436613864373431633736653964643938636265636164613233383563313934643334
-36363132386662346164326666613336636236613830333630643163643336323935333566386638
-39306337656430396533643633626532613730306564333661373337633762653265303737333935
-35346663643665303235623637656135633338663436623261346665303862336633623765313238
-63303565643730343732373962313666393561633335636362356337646365303064616261646431
-38636437346162623363326436393961396335633431373934313563393265623162386133313831
-62643835623264356630663666653861323236636566316231356566656261633139306532643261
-62373439643062366463646438613762386465393130316562373731346461313263396361316634
-65623731623833356337336531633838343730613062633031653236303936633965383136383937
-38316163396666313462363235666162313564376561643739623432303263366333613134316265
-33656533636365303639326332346263326330383138333737303466303162316131316161313035
-64366466333933646566656261666265306535633238393731333233646334343662393133623039
-37626132663561656365323063373463313166323365373733366438363763643762653765353334
-38663065363038616662326537383238393333343934383538623563333633303066633938393836
-38303965333062346139376333306666323237323331336432376532336637656531666633353464
-34356533323531633333363066636438366636626233303238636464333133633835326632613563
-36333138336137303762343232333333653065343564333062383661646364633361303738343161
-31643365376463353463633862363962643136666266336635333336623664323037306463373830
-32663131343463323239373861343361326435313931373264303634306464623831316435663430
-38353936323935373663663266383039386365323433613566656466626161373934646364306261
-39376437343862303461666339346634336239616665653738613761613331643833326630316436
-64623564636534353436313065366266333866663737613331353562316330656536346134376238
-62333533613131643462376365393365363862303865626563353366636330343162636432666237
-35613134353833383165363438663464633534353962333265333235313762646161636662386437
-37396533666330303534623161343331323633326238633534343031323032353834623539336138
-32333834643137393165333939663130306339353736636539623335656464303633323330633134
-35353738653636376135376263326433643230653233383036633264623930313839323763353865
-34333431663530646538393331323033646235633838343130326534376430653437386438376531
-63633866613365616438613163393831383135393531346134303061316566353236333834613937
-62313633323434336164633438393335366133313663326464303163313432353633363030346331
-31396431313539373737656131653330353064636463336632343237316339383062303735643237
-32303037373366383036363532313633626431316363643161623864663861363532653333326538
-38643932346561616634656164643439636566303963663639666363306338323237343665626362
-62666337306134653831333463343566363838363863333536656235393062623933643266386232
-63366633376363306164303963356431353365643862346235366539396530393230626264333132
-62366331623332653466616465626534303633636666613934393032616466316131613130353435
-65356233316533623466663763376534663137396662366262386266336266323630623262366332
-35636333306336336230633565313735343735313265633137303565353639393063333063633330
-61313165613034313566373934646563346631613930666464396633356638643534633061393866
-62656232636264623432663632386234313262646436346639656464646165323865303132663162
-63376134393935336637353433633737323338366166323834623863303333323237396533613134
-61646661316539623361326562663939306665346466623730346162303561346664313936303331
-66306334316162376563356235393932366564613438333563366538633430323333636332633335
-31386634376338383063623233353339663961663965666234653366373063363030373839616630
-64663238333733656636343661653538633130323362336638633838383131663163363161643935
-39313666653262656538336266636261313733626366656633306435346331356636633137323237
-31373035353339316261616363666239353133316566376634383935343566333436303632383734
-65663539396432653531373631346266376231353765393936333437343636643330306639356234
-61386464356634646338343363346362356166626335636232633038313539356636613335316530
-35656334363366323732333466353930313535333366613930633365396439373162643364356465
-65313131333664663337333234666134666639363531376535363932373935363863336233333530
-66656131616635613636643431643165663061356433613436376638646364393537363333363434
-32663635666130616538646433346139653738653464333063373039333434313266363230383235
-62316336346333653839363637323565623734383966653666333133623235656264313063306134
-62623761303034333038626334353434643066376366373937646531336662373930313061356438
-37646134653033376335653766666130663232663839633037313835643763356166663661396432
-31333865363064636539323264626165353362396164306632386335336431653933363063616263
-63393937376437623938653132336665623562663737613762633765336535343131646435333532
-63613832613937633436343564383632623539396364303933363466663830653530626538346439
-34343861376239396332623537323364653338663635643838363836396463306339636561363562
-38636137646430333266323165623536653465313764396162653537376263356136343539393161
-38626434313333363135613065353764666634616361663833366364366334353762663663336161
-61333762643537653965376435356134383565376231356135666636363465636135366539343133
-35373664343135613733356338313362383639613837386266646461353737303333616166333635
-31623534393561366131323763656633393564663935353137643665666438613232366531363138
-64316266333033353836393337313061633065653130363635383334313938323338353632666538
-37653762643130396663386633306462383735303336353634356531663365643265363830346132
-37666537373236343331646265366564396539396531316438623163306265366237663130303439
-33623739376539613438656533646334323664623864643030323831363561316339636636633731
-35353237663065323335323832316163373362346565303833396133323035356330636533343031
-36356464616132656261323732363334616431363833376531303531373036646231316330616238
-62366461633561383633383436333531303165616637663035323865386265636136333561653037
-33616566316564303364613531636530313036326132346434323135373737323836313430656362
-30303538343038303734383130636137386130343462303033393131656535643161333733653462
-33626436343737333736386237376539353232343661623265633662663663363436313062653735
-32326161376361363033373931303332313563383639333563346138333334626637363036353135
-66613333366463396432396266313034616535303038663064383638623531646339323939656432
-33633664323663646334303735633065663337363761306138613335623633393266613661636661
-33373630333234623531303635393164653830383061326234643537333865376261643763333631
-37666663613737323732393130343461353866623339366164346662386363326663363966323565
-61623137353162366463393265643165663339313536343632306339393635313165643037366463
-66666636643437363064363838353833383361643338626333313363323831643633643035666164
-33393632663935323837373363366337363134633166343939356264396436396234366463636366
-61333235396363336634656633393732386433373039356431353337353637316266366465623337
-63313263383761386139316361613763363734636166386561333239393536346337326436626130
-64323937636633386237303331636262613235663261636136393038653765663632396633396435
-37643266373964643665303136623535636265643634313932373734343461333839343230646632
-34633761663237643734303736373636386337366233326262626236663365333665386261323430
-33653966373464386138333366653434653839633536396363346237643932623331346630623938
-65376238323430666234313833316630373030656161306634333134326263663734343561393338
-38363537303464623031663339343565626166363239653465623162663834653364316339393266
-64353530366336353138376164656632303336363662383334636561636630623238393233353132
-63623239613130643537646561303836386164626134393235326533323939666537383665653736
-32396537663138643464623238363430346235613731343064323061303233303538353038643833
-31646530643031353066376336323065363462656132613535633236393035666337643930613439
-32663461356665303735636637313133633035343031326631373766616662613337663731393964
-65366437386236333737383564633530636461643837363131323761656238353764666564623837
-30333736653063613932363236363866316365613237353537353432666263313038343761303931
-32666639373664653764303031656336663230393436626131393331386561643333616236396336
-62646466373536616265323934396335396331353733376334306166663130383037633466393831
-38646434333265336265663763643730353833633335643930353232363034656338623864356537
-39323866363262373134336332303433306161663239343463393163623239316365363739356432
-37336564326132353436626565303733653130646537616533656165363062613237623336626431
-35636635333465396662373933633836303935636361323236613437313965613232323764356239
-32383966343430336636303062333431326366323431363866663464633363366430633831393231
-62303665323764316435303834343461356363313061323039663836313061623063393063356262
-38306336653661346364303435376262346333613234656131373261313134353732393763336430
-36326462663936353634653430613561636536656662633638363538646364303232306439313030
-32643466633133353062383337363538616231623037386536386432663463393961646234326330
-62366230623337343365393333663564616137386333643730626332633665313066623761653531
-38333332653366656265383366613464633462343763396465343565303330636636396134336262
-66646638623162333765633930623034316533373433386535373931623834653636373265316662
-64346232643063653366316533313563333166633530343065646362323163396561333766313637
-62616437636333313936353335373465343466373833333766636335316363373831386563303831
-31333834623130626334613764613864376533393664613663363930396264303735316437633463
-35376565643635636433393632373138313565626364353939336362626132326365626664626330
-37643865623737316135333639323939383233386261386536306561636661353732613162333234
-30366130376333643735626133316439393931303866656236623933313733353866306237386462
-35646663393435336434333739346363333330393964356230376234643932393661383163383236
-63393033386135313534636132373035633961306333386634316363313738316162386262623035
-6130
+65636230346264393938656566653961393466306338353435333061356463363836616435333731
+3537316534663335343333643435383663303438333433650a666133633965643939306661383536
+33626364316338306530393036653134373339653264616537623731323063646531383137333131
+6263363037613631360a343831393830646536326538363764643136613732636165316466316566
+65346162383337626631663533626230643061633139663661656365333738353530316661313864
+32373831396437386434313430666434363534656130613632643264393538663131336635653537
+61613065336133343130353862646130386136333231393962353064666335363330623064626631
+34333137363566313764343335646531326337616563366636316232633936333264373731653332
+66366361643261626563633838663061303762386234336133366233356564343562323965663731
+38326631333166643534313836323337663131313766306166333534336333613735643033326633
+39396335613362363230333863396535343464346437366632316336626539623865313239353539
+30643834633130333564666162623365323439396630333136616137633532363530623234376332
+66353539306637633432353231326666643261386466633533313063353061643761313132623035
+62653263636237666432336662633136653930323532623137386261333862623337326431336365
+36663364386364346631393031326434326334636166663739366435616166363130623463633733
+35383834326231363264623061303066326433613139333237656635643835393762313866356237
+62616435613863616161376666333966323030326531323261646436633233613635383438373834
+31343133326231636661353466396566656365396466343430613262316537623631376433633630
+62336664346363393363306163333662323338343139646238633830326535313034613739616138
+38313637333333383032316134316164363036396338306634633436633564306333336437393566
+61656337343030393936353364386461643766636564333864396130343762323630393839393463
+35343864393035333930313238663465663633633862623336663136626165666131383933626437
+31323936653737646231363036383764333335313762356465333635303334663734636531343331
+37386461643239363434373864373561353339343031346364383530663430393938333963333837
+63303966366364626665303530356433643264343861346238353937386338383034356633623231
+36663735386233396138306561326339626262326463336535646265666637383032396435333835
+31363266666230366438313432356637663632333530646263663563373137313262663937636532
+66633731333166386564386666363130633734643963653030386533393766623038383234646161
+36343135663231323030306430623535373534353835623339333738376362663930343436343637
+34383963306266623437323462356466336533643933653839366666393839626663353264326334
+32663461663561396631363533383334363361373764363132643435373537333839613066396463
+35386436326638353431363064626131306634363339653132396563356239653265303930333634
+32376332643863376237383966623233323864393338346537393865363661616338333631383532
+34373635316138663261633839333664353432666234306463306338653634633038373266646462
+32336534356537306366656236356663616336333031306431653239343132336234626165333032
+38303137666131363462363263333832356333616130346337663837376365346166306261373036
+63383236323738303562623631633064363564663861336162356262373861383965623935343931
+65663934623431363164356331353135633837616130363464353661663438323132363165343766
+31393633306261303762613537343034316535373731363365666530623361623630633137326466
+32326533313362333863383561343230626466303831623033613065363136396362373333306333
+32336464356364663564626234653832323265313364343631646633396362373438666165353962
+38396330333161356365626562383531323664636235643666613631636636323638376638396531
+38646531666164653161353932643662363261323564373537343731666232666532633063353431
+61386163363562313330393037656139303365396438313935306333656264373531373037303939
+63373962356233346164383163323532373163376364623766323933623063653939346537306338
+65353266656532636633326137356430666432333465626437633733356435363163626430303964
+39343935623937616130326637323061373538616633393465653266656666376661393635333662
+30363364653130356137393463613038663762396336306234363461396133306562323838336330
+63303735646132353766313137303162366164613530303966383636393934393035306264626465
+36613233376234633932663963623432663032656236323963353036356437383066373532323865
+36643431373966613533646164303564653336396535343366303339303134613936656137653939
+31333062623734613538333666636561386338306235633165386262383261333264623638383366
+34313266333636376337393736343062363539366235393136663561303663386438333834613539
+38623632656161653766363166653661336136653833336663616261663831656133666232633362
+31373166306134653162313134333432323134623336666632613766386662653831643732326330
+63643737333638626162646136373466613536653831663835616432343537323864343166316461
+34393732353930343430356231626636373763636561343430616533663861346566326262313232
+39623936366633363136353632346134643563383833376134363833336137613337326435613764
+37653232613632333334316162383261383836613936376230393633343336346633386539356232
+30316232373738363038356665366663623536626539376364303038643061386363636337386663
+61383634336530666163346239343838326138373932383339396265653764313039653138643938
+31613163653632656238376533363739346539623863623332653936643731623565613234663430
+39363935306330386634363634363233376234613837353765353732646638663830323335616234
+34366334636436633734333830306136333563666337623035653239313361626438316535313434
+37343930643832383136343737313365316238373638323130653766646637343464653134616137
+38313034383833626433326237633863313364353662326233636333333932633039396565356133
+64376166383064343239633364363861616136643061646636323437376162313438396230393331
+32633662323031666238643934646665303666383834336432363430363166356632353033336333
+64383861663563653531643832656238643066323564656134633639666234363363363132623836
+61386431643130333761376161646262346562363532353632633332343666393562313465303337
+31333732626164363464323531323239333963303333626466623966346361383832353765346565
+37303765363834376237636632386663373061346534643132636333623137366662646538306231
+33353538623231636166653838333264396463616437396264353537633661313932353133316438
+61323439363635383035316335363132383366613733383363306366356466333364633537393033
+66636434623962633063306236303831633637656430376533353436613934636466363461333562
+34613339373732343632343435333331353935303735633732656663643938663439656233613163
+65356232633865656439643430636332386663333761376638323630373930663837653638363963
+63656437323138633664613166353537306466666261353532326363346332343363343035386435
+33326238333730303539363265383761663862313961383030326263353034303866626661623334
+61623365373332366333376630626539343835663466666534636561643736646537646431386631
+36366132663830336234613065626262336564316339383038333330323237363665373935326438
+38646335346239316432636138633365373062663564326465643032633438306230363434323262
+34313932653361346261623030623739313665356464373666346361663430336362383063666134
+38323539653437623030333437373231646634333563306165393231653465313731633536323362
+65613262633563653031306139383436663834616339316164393365336437653730393331636464
+32313537313164386164313832396566353137376239303663656130383336336634313235376363
+63326530333339356432343938306465623636336161363133613864336339393635306234656263
+34343437336461303831393562653934633439336562663366643066393439396531653663386531
+65623061643064396534353364663633653331653535306133386466356236623239646432373066
+61313261366466663866613162323939646534653561356335393237376138633930663364636236
+36613834303338646530663565303438363831663865323531386635303239646464343936303832
+31323531363263333830623838666437636262306164386236643032356165323037656630383739
+65666333656639333263346465666463616534353835656337353464336134303732323037393538
+37366263656133643039373438636537343636663065646534616339303833666532396633616565
+38353139323739656564623065613364346164633863343738633163383031663531663365616534
+31663835323435643463666264623932396133336531626331303862356261306238326333366164
+66306262386137363432376530366432356432653333393833376532623333373337393830316263
+30326531613662313430663130613734663937613663353936346134356537393761373238393433
+37356136393731626561303430626339386531386333386536656465646232633934393630613339
+61333163613862346564316336353766346461626639303661353464633835626663313462613666
+33343561613662303036643937656431393432333831383461323631393262346464393539353537
+33633364383261663535323136393138333739356439663731636136393530323864333566323361
+62643961323264336662316661303630636430323838633535343036303437393439656637326566
+34363832366434316639393939313965633037653931323462363465643262653539623063326432
+36616434366432303235663062663138623336336165373734353838333662363239333762323932
+65393765326232373230666437656433373930643638386131363339343630636634636434326464
+39366339326263666239646237326534383665376536313536303263373265306537316161663262
+31346635346436313261626366333738333966643333313230623133313434373530366462653435
+33353434643635383833643736653461373765326537313430353164306566323733653237343632
+66346133656333303538306133313563393363313230323664303836323861346466343230343264
+36613934643662626365653036636136623630333638373565316437646232316263663433313762
+39353234333131623731643662303130626465386338353833393533646564646565623736343039
+38356635393461353166653565336535626366396532633961393334343234353764303431303663
+61666533633731663666346132383037646433336463643062396465383034346631346165323939
+33313937343338383737373164363930336236326432346465646166363430653932333932343236
+38336235613034386533613665393666633635383164646538373035623862343737353463623730
+33396233353331633463373538326365636231323535633737303562613262613730636237336632
+38626230313637336436623661666438666538333838356632653034303864313232623337306333
+66363464643061363337393732323065306335656531376337323438313733616539613538333837
+34363033666366613933343563303537613564356462313931353533323938656362393536386334
+38336237616335346334613534323130613861663239356363366564623933303737306138613535
+63643639323135663232336131643331343063363234336230653536623765323562393161663266
+32663839613564613636343166396463366665666333306239386338616366363236393931313439
+30386238316261323630633464386265353464333735336435646663656638316130333762666531
+38626463316165373434613436343335303633643965633230326534323761616365376630363039
+30336661313737383535343934366466353231396430353030653762383934666235646161653832
+31613565643031353535353234386665373636356362653337366563316630343838626231646462
+34623262343761373831303861313661666435373565386465336166306631376666643631303863
+37633934326262623737373266326631663932373863346466613133303961386466366336643235
+39303933333236626637663636633739343761393432616232643238663738313636346137316430
+34623238326430616134396166306339626261643032613661343763366138653830376463306461
+62366564393364306139633837646264633130383064383730393862633561303538363232663366
+30343633666632303530356637646337623339303236376164633962383839386265336666396436
+38616238656336343066333063393833623862646237323238393465633662393362353161313963
+63663539383630366536313933643565346162646363353035386666396363633635386564346666
+64336362633033346461353133396363646237613433306366333064626563656637383863323361
+31386262346631343565653836333764636366313330633462303533616531316537353538313031
+64366263666138356339373864383866303632366162633738383437323564313732373738373038
+39643862336136663165343736613730306339643237313361333438613438323439373966396138
+62323661383336396636
--- a/host_vars/web23
+++ b/host_vars/web23
@@ -1,85 +1,67 @@
 $ANSIBLE_VAULT;1.1;AES256
-30633037383332656130363532373262623063623730666337373430336363383964343039663832
-3633313230323565376234336433383330626238373665360a393234643435376431613363313036
-32386236343262643662356563633038333434333730616332353234333363356465326133623139
-3830316433303631640a613231373138336330646639376135326238383230323534316464383135
-35333631356666323161313261633134636364396232323130333666373864333165346233666232
-62346362353033636464323866343334633565373265623431613866623234633133633466383735
-31343439646166633237643364386638306539626562636235666535333438343664323932383865
-39333533363131633930353962336238363234393161623966376365326661643431303263653164
-63666436616437326137303765303730303135663434663235373363323966623166376332393661
-62336336366265623035346162303730323762353961376333313662626232343366653930656338
-36353134333463663034363737653133633536356166353966373563316235636132383530643339
-37326661346666663139326239396466373630633363373431346635626561623665366566653731
-36396138643936623632613934633965663166313364396466633263303738666164316231366662
-64636362356564663330363763323139623065336162353734626539663231663734333962343665
-32613563363130376665333666313733303963633161313633636337646466353064653866623265
-30653762316433653631306535303463663738653731633964666466623534396663326263643437
-62663366613635373832316538653066623733336631663261666564333634643161653962373932
-30313065656238663063313737383432393433656439383033346634373030643166306565646230
-62353930336664393733663462343062323332323030356338316133393838656536306164623435
-64393634363665643862346564326138336136393235316433313538383162396563303937356335
-33646334646630646233323762323335303030393331636532656132313536663465383237623536
-39633364363036636434323963613633353238346134643837316232653038616138373731643033
-64396563353839386334313933653664613230323430383434653964636538393838386639356361
-63643565643636653434343363333966653163616236363366356539313532393133666239376530
-62663930343462633864373138633364636634643361363935303263353766373936386561376638
-65316138646534396435636563326165643737326533303338323665656334346264643262636437
-63303530363063316461333536333433366461356533393139313435396136353439323435366266
-32343566616161636466663339613434643835613831346366613866343536663530326431343139
-38653165383430653064613837343738623134303766373133623131646134613663383637336264
-35313966646639613262623836393933376137623535323365393837326631663930313336313737
-35626139386264303162393636306136306161383565353739643166653262366164386539353266
-38323266343833323063343263346365383534643835353435626335333637303237633239646330
-32643235666331613364616535326230346634333363633938646633633831633364653337373235
-30316161633634303562613263633962376365363038346137316164323036616664626132386461
-65323764383733666634643635633834396635343835663266623839383130343563386231376537
-62326338643833303538343566616461353135333863626462663830366435636564626538346361
-33646661613334636239653636383436653438376235376665363235653837303037363164633931
-32633733326139346261323464393734316661633239643437373235303237643932633433313564
-36643739613330303362663861626637613130383965646639356532353539373437326439356362
-39643137666633313262356366616561353461633033376235313965646132343233326366353264
-35393561633632306265373032306636326261646235623266636662646334363233623330333734
-37663266363639623036323433656166383631386633313131303030306437643761343965353063
-39373435363238616566643239306136366637646437633335313431623839616264616261633339
-33313364323039373531346335333963343034323637643134653566666562373137656335633932
-39653862653465626432663534663965653933623430616561363430666235363666613833656463
-65326430383137663034623233393339623135356535666161366564383564336132363038646663
-61353465393265613337643338326436333237336339326262356362643932623163616638643835
-31323739646335383532396665326535373161666661306538653365346465366434346463663438
-64323766353933633736313266386564656436666534326534663531613936633830386238303861
-37363231656365383531613764386662356334313330333236363734646431383166636132383338
-35343138353232663135366438386366626239326632333937666530626364313463613831313162
-30363933623561396137616130656535393138346339663266353764653931316639636562666164
-61333938363466623031653766313139306439396435663665386665663663306134666563373238
-36316261363063666335363462353066313735386139313465623338366266383434643464643162
-34383836636336316232343132363464383565366162313563393864376433386236376565623631
-64656164646635666139396539353763333065323266663262643233306261656532613362346432
-33373631613137336366666266633331303966653138393539326335653463303033613565663638
-30663465643832643637643836323462633163643534663465336664313265353966306261613339
-32616139353263663033373835653632386262396164343731613836336435616131356632653830
-61613461333632666366653330626537396232323733663930633966663239356130306666376137
-62636333373635356461633431346636643731656338306366396430323537626233316137656465
-65643339346565376166373066643339356666663735313063303130313663393966623866613337
-31386663363166336337633266646363666236623837303634643337316636353531653765323637
-62313330326363303932633336383337353062643865383730613435353832663364643262626162
-63303439383164333037306231613538313639626537323039366561363233303735323032653432
-35643432336666616665386238353034333037353630323234316266373936356439353632336365
-37646462666537306534623937393939326663316532623837326564303330373261323630353863
-38343438316539336464376664326362353831396132393566396333613164646462636361646234
-35313837666463376233623762663239613134356632333730343363346238613334383861306635
-31623665666461643661383265633965386566656165663566376235343338636336336330336661
-64653032656365363835616634656663623365323766396537303361336533313132316631316533
-31353036663766643131386135653366313535366232636538346237613461383761393666336432
-31623364653166356565376463363437386533303062373930393761646163613962636462643865
-33376561323366363936386531663637343465626666623133396162306139366665616132326161
-63663535636465383836333061396239313463343635633135323464646135393031386361633539
-64396534396361323466326364326266386336643831643536383866313033366534636135613736
-34316661313335383239316536623862316637396465616563386361636261313330313466656239
-37626431613464363965343233666534323736363865373734633535343632393335346265643361
-65326436393631353264613761343237386561306261353261356364386137393362306566353032
-31313363613963323136303262323934333961343563626533666563636432653436393937303037
-37336566663932663062633534303632646162316262323935366661313938393735666561343237
-31616366363339353231643561373362613266343266623464323238356261303762316334333266
-39303633316164376330343864336636313333363862323835303735383866363334643933653337
-35373030353264323761
+64326662336532386161646564656439396461666266656463393335663130323930326139386562
+3639653630336132663666646161363938386334323064320a663564613066313533353433333434
+30346561616465646163646534356339666639333862623637613435376361323032636439633930
+3731313063363337380a373961353530383764623830363935626231333734303364313565626633
+37343037633862633632613165323136373662396438613663636433346566653064653632313338
+36396333393334336434326630646164333531306432386133353664336535343363343939393464
+34626335626436353239366138323863656336636536383733363931633933636331643263653566
+30613931616462373336393337363430353962613665353936383533326364353365623333316664
+62383439396131303831326562323264336638623461643361663763356236373464346464316237
+65393232343733643338653734326562626166366562303037613862396564636662363066356664
+32656363616637303039373732396533643432343961666365313963383131643464333765643737
+32386165666131626365313938633530346361383734323334613464353862393931323836626563
+62656531346532646530306463653364326362613162323536643836643839663933343132613435
+63303234646335306632316166626266313635303566396363333464363631353834373761353837
+65643461623135363139646564336430353461336433633765303138313730613630346465326666
+61393133636262653836333664623333656164663361353130623863653863323131326136373238
+33376333316433653337373834666136363130373261333330643439313734343036636364306532
+63343662383539633235356162656366323965383331343139616361653466633865626337326562
+63643761613536613334333065643533323066393764633931633066353064393966646161376361
+37623939386636346161346164303832303534323038626335336665653634386132343031303861
+61323765306366333936303765636436633465356539316631343562363535663932333666363035
+30386233623265636464393662386464333430396337626230306438396563303437363938303061
+32653939383136376365343934613339383563303935623664633639326137353437363261393637
+66613331643530623862636665396536613730306537373666623135663837393466343261646461
+62376162613861643633656334303132353034333834626664666237393534386439313638393933
+35643663613432323432646466386434363335353234643264643463613334356462313766643030
+30336364396235663230356235303264323339643761333036333537633862343862386130626533
+36626536396663393031303533313238616133323239356634303830353439363133353839663266
+36306539636563633734623162356230383232306138393831393336626336383966643335376564
+36303730313936633361643736613736303163363536313038316432323039643362636538333037
+65613663333032623035656665393565366363396134363832363163656532363537373435623233
+36373961333237373264326634353363356537356538343663613034396132396366626330303365
+62353461616434343938386237373365633861333733613631633234623034366364363761613636
+34393532316466323264363363653335366639613731326131393335313039646538626665356333
+62663435633539643237326631636563363833633130363535653336333538366137306235663730
+36633934636536633865376262356239303966646638626638386536366662386432343466366161
+36646436636538643366623864326630396565373462393132343834626638313437316137353564
+34646138616438323065336266366434316135613938643131353034646230396632386433366365
+38616436346232363563336439613939313464323861616530633962316634363462373530613665
+63653636646565303664326631363535373037663734663965346430363831613431613365393832
+62373030336262643430313635626261613232656236333130396537633238623265363932333966
+34326135363762396564613064323135313663613565646461376162306532643433333336666532
+65383661303137613335653336663666653463623565386137326662653839633536326135633764
+33623437333931393737363061356235336232376437643131373531356566323336306138353561
+66333863313461613930383231663162616261616639323238646439656166666261626533636161
+38333362393033316266633364313739366262636530363937386137616234326638303137613433
+65313962653566333364383732386165396136303666383439303064326463346563663434646364
+62396130646632653039383661613638303162363538376236666338623865366639663138363636
+36373766386234383465316635323931356233366262386135363238366538623135623361386436
+64653533646233653463656334633566373433303365353965663732636566663332343337626337
+34623861373562386264346430333133343631653631376366373735626664363965666561306262
+35666235653235346233636361383566616533646662333662323139313865383264633734643263
+63656431393834633935613430643839613433326431666665323136376562333737383862313261
+65656431336439303563373833343965323965346439636131633366633431393032613963666539
+38326539343132326334316233323362633835356265333031663066643535363639623031336362
+64346230383638363763323462386261666266623134393139303264343234623132323437396630
+66363738376133393731616535653230303262313937373333353932303038626166346366303163
+66613831353731373165636532363165356561383137626437333563616561386666623234313438
+37333435306530323235393164383138346131653235633536383636316161316238313064636261
+33353963333430383236303038333939316637326130396430623964633338353863613534653663
+30333839393230626261663966616230303330636335323565663938343562666663303536636332
+34336665323764663163653161373166313631393534326532613538313637313136356336313433
+34353036653738343433613763383137336562373332333062326134626638633938336364376131
+61303435333163663636653135363162303663663266393438656430306532343438386436343735
+31343231653263373532386263653263386435363633396638396164323539306233303562303862
+3339306136613431636138333266633739323666633431363039
--- a/roles/caddy/defaults/main.yml
+++ b/roles/caddy/defaults/main.yml
@@ -0,0 +1,11 @@
+---
+# file: roles/caddy/defaults/main.yml
+
+# parent directory of vhost document roots
+caddy_root_prefix: "{{ web_root_prefix }}"
+
+# Email address to use for the ACME account managing the site's certificates.
+# Not sure what Caddy does if this doesn't exist.
+caddy_email: foo@example.com
+
+# vim: set ts=2 sw=2:
--- a/roles/caddy/handlers/main.yml
+++ b/roles/caddy/handlers/main.yml
@@ -0,0 +1,10 @@
+---
+# file: roles/caddy/handlers/main.yml
+
+# I'm currently not sure when we need to restart versus reload
+- name: reload caddy
+  ansible.builtin.systemd_service:
+    name: caddy
+    state: reloaded
+
+# vim: set sw=2 ts=2:
--- a/roles/caddy/tasks/main.yml
+++ b/roles/caddy/tasks/main.yml
@@ -0,0 +1,82 @@
+---
+# file: roles/caddy/tasks/main.yml
+#
+# Configure Caddy.
+
+- name: Check Caddy package signing key
+  ansible.builtin.stat:
+    path: /etc/apt/keyrings/caddy-stable-archive-keyring.key
+  register: caddy_signing_key_stat
+  tags:
+    - packages
+    - caddy
+
+# See: https://caddyserver.com/docs/install#debian-ubuntu-raspbian
+- name: Download Caddy package signing key
+  ansible.builtin.get_url:
+    url: https://dl.cloudsmith.io/public/caddy/stable/gpg.key
+    dest: /etc/apt/keyrings/caddy-stable-archive-keyring.key
+    owner: root
+    group: root
+    mode: "0644"
+  register: download_caddy_signing_key
+  when: not caddy_signing_key_stat.stat.exists
+  tags:
+    - packages
+    - caddy
+
+- name: Add Caddy stable repo
+  ansible.builtin.apt_repository:
+    repo: deb [signed-by=/etc/apt/keyrings/caddy-stable-archive-keyring.key] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main
+    filename: caddy-stable
+    state: present
+  register: add_caddy_apt_repository
+  tags:
+    - packages
+    - caddy
+
+- name: Update apt cache
+  ansible.builtin.apt: # noqa no-handler
+    update_cache: true
+  when: (download_caddy_signing_key.status_code is defined and download_caddy_signing_key.status_code == 200) or add_caddy_apt_repository is changed
+  tags:
+    - packages
+    - caddy
+
+- name: Install Caddy
+  ansible.builtin.apt:
+    name: caddy
+    state: present
+    install_recommends: false
+    cache_valid_time: 3600
+  tags:
+    - caddy
+    - packages
+
+- name: Create Caddyfile
+  ansible.builtin.template:
+    src: etc/caddy/Caddyfile.j2
+    dest: /etc/caddy/Caddyfile
+    mode: "0755"
+    owner: root
+    group: root
+  notify:
+    - reload caddy
+  tags: caddy
+
+- name: Create Caddy conf.d directory
+  ansible.builtin.file:
+    path: /etc/caddy/conf.d
+    state: directory
+    mode: "0755"
+    owner: root
+    group: root
+  tags: caddy
+
+# TODO: the variable is still named nginx_vhosts
+- name: Configure Caddy virtual hosts
+  ansible.builtin.include_tasks: vhosts.yml
+  when: nginx_vhosts is defined
+  tags: caddy
+
+# vim: set sw=2 ts=2:
--- a/roles/caddy/tasks/vhosts.yml
+++ b/roles/caddy/tasks/vhosts.yml
@@ -0,0 +1,14 @@
+---
+- name: Configure vhosts
+  ansible.builtin.template:
+    src: etc/caddy/conf.d/vhost.j2
+    dest: /etc/caddy/conf.d/{{ item.domain_name }}
+    mode: "0644"
+    owner: root
+    group: root
+  loop: "{{ nginx_vhosts }}"
+  notify:
+    - reload caddy
+  tags: caddy
+
+# vim: set ts=2 sw=2:
--- a/roles/caddy/templates/etc/caddy/Caddyfile.j2
+++ b/roles/caddy/templates/etc/caddy/Caddyfile.j2
@@ -0,0 +1,29 @@
+# Global options
+{
+    email {{ caddy_email }}
+}
+
+# Common security response headers
+(security-headers) {
+    header {
+        # disable Google FLoC tracking
+        Permissions-Policy interest-cohort=()
+
+        # enable HSTS
+        Strict-Transport-Security max-age=31536000
+
+        # disable clients from sniffing the media type
+        X-Content-Type-Options nosniff
+
+        # clickjacking protection: refuse to allow rendering this page
+        # in a frame, iframe, etc.
+        X-Frame-Options DENY
+
+        # keep referrer data off of HTTP connections
+        Referrer-Policy no-referrer-when-downgrade
+    }
+}
+
+# Import additional caddy config files in /etc/caddy/conf.d/
+# Note: these are imported in lexical sort order!
+import /etc/caddy/conf.d/*
--- a/roles/caddy/templates/etc/caddy/conf.d/vhost.j2
+++ b/roles/caddy/templates/etc/caddy/conf.d/vhost.j2
@@ -0,0 +1,46 @@
+{{ ansible_managed | comment }}
+
+{# helper variables and per-site defaults that we can't set in role defaults #}
+{% set domain_name    = item.domain_name %}
+{% set domain_aliases = item.domain_aliases | default("") %}
+{# assume optional features are off unless a vhost explicitly sets them #}
+{% set has_wordpress  = item.has_wordpress | default(false) %}
+{% set needs_php      = item.needs_php | default(false) %}
+{% set has_gitea      = item.has_gitea | default(false) %}
+{% set static_site    = item.static_site | default(false) %}
+{# Allow sites to override the document root #}
+{% if item.document_root is defined %}
+{%   set document_root = item.document_root %}
+{% else %}
+{%   set document_root = (caddy_root_prefix, domain_name) | ansible.builtin.path_join %}
+{% endif %}
+
+{% if domain_aliases %}
+{#   domain_aliases is a string, so we split on space #}
+{%   for domain in domain_aliases | split (' ') %}
+{{ domain }} {
+    redir https://{{domain_name}}{uri}
+}
+{%   endfor %}
+{% endif %}
+
+{{ domain_name }} {
+    {% if has_gitea %}
+    reverse_proxy :3000
+    {% elif static_site -%}
+    root * {{ document_root }}
+
+    encode
+
+    file_server
+    {% elif has_wordpress -%}
+    root * {{ document_root }}
+    encode
+    {%   if ansible_facts["distribution_major_version"] is version('12', '==') -%}
+    php_fastcgi unix//run/php/php8.2-fpm-{{ domain_name }}.sock
+    {%   endif -%}
+    file_server
+    {% endif -%}
+
+    import security-headers
+}
--- a/roles/common/defaults/main.yml
+++ b/roles/common/defaults/main.yml
@@ -8,6 +8,10 @@ fail2ban_maxretry: 6
 fail2ban_findtime: 3600
 # 2 weeks in seconds
 fail2ban_bantime: 1209600
-fail2ban_ignoreip: 127.0.0.1/8 172.26.0.0/16 192.168.5.0/24
+fail2ban_ignoreip: 127.0.0.0/8
+
+# Disable SSH passwords. Must use SSH keys. This is OK because we add the keys
+# before re-configuring the SSH daemon to disable passwords.
+ssh_password_authentication: disabled

 # vim: set ts=2 sw=2:
--- a/roles/common/files/abuseipdb-ipv4.nft
+++ b/roles/common/files/abuseipdb-ipv4.nft
--- a/roles/common/files/abuseipdb-ipv6.nft
+++ b/roles/common/files/abuseipdb-ipv6.nft
@@ -1,5 +0,0 @@
-#!/usr/sbin/nft -f
-
-define ABUSEIPDB_IPV6 = {
-fd21:3523:74e0:7301::
-}
--- a/roles/common/files/abusers-ipv4.xml
+++ b/roles/common/files/abusers-ipv4.xml
--- a/roles/common/files/abusers-ipv6.xml
+++ b/roles/common/files/abusers-ipv6.xml
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<ipset type="hash:ip">
-  <option name="family" value="inet6" />
-  <short>abusers-ipv6</short>
-  <description>A list of abusive IPv6 addresses.</description>
-</ipset>
--- a/roles/common/files/aggregate-cidr-addresses.pl
+++ b/roles/common/files/aggregate-cidr-addresses.pl
@@ -1,89 +0,0 @@
-#!/usr/bin/perl
-#
-# aggregate-cidr-addresses - combine a list of CIDR address blocks
-# Copyright (C) 2001,2007 Mark Suter <suter@zwitterion.org>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see L<http://www.gnu.org/licenses/>.
-#
-# [MJS 22 Oct 2001] Aggregate CIDR addresses
-# [MJS  9 Oct 2007] Overlap idea from Anthony Ledesma at theplanet dot com.
-# [MJS 16 Feb 2012] Prompted to clarify license by Alexander Talos-Zens - at at univie dot ac dot at
-# [MJS 21 Feb 2012] IPv6 fixes by Alexander Talos-Zens
-# [MJS 21 Feb 2012] Split ranges into prefixes (fixes a 10+ year old bug)
-
-use strict;
-use warnings;
-use English qw( -no_match_vars );
-use Net::IP;
-
-## Read in all the IP addresses
-my @addrs = map { Net::IP->new($_) or die "$PROGRAM_NAME: Not an IP: \"$_\"."; }
-    map { / \A \s* (.+?) \s* \Z /msix and $1; } <>;
-
-## Split any ranges into prefixes
-@addrs = map {
-    defined $_->prefixlen ? $_ : map { Net::IP->new($_) }
-        $_->find_prefixes
-} @addrs;
-
-## Sort the IP addresses
-@addrs = sort { $a->version <=> $b->version or $a->bincomp( 'lt', $b ) ? -1 : $a->bincomp( 'gt', $b ) ? 1 : 0 } @addrs;
-
-## Handle overlaps
-my $count   = 0;
-my $current = $addrs[0];
-foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
-    my $r = $current->overlaps($next);
-    if ( $current->version != $next->version or $r == $IP_NO_OVERLAP ) {
-        $current = $next;
-        $count++;
-    }
-    elsif ( $r == $IP_A_IN_B_OVERLAP ) {
-        $current = $next;
-        splice @addrs, $count, 1;
-    }
-    elsif ( $r == $IP_B_IN_A_OVERLAP or $r == $IP_IDENTICAL ) {
-        splice @addrs, $count + 1, 1;
-    }
-    else {
-        die "$PROGRAM_NAME: internal error - overlaps() returned an unexpected value!\n";
-    }
-}
-
-## Keep aggregating until we don't change anything
-my $change = 1;
-while ($change) {
-    $change = 0;
-    my @new_addrs = ();
-    $current = $addrs[0];
-    foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
-        if ( my $total = $current->aggregate($next) ) {
-            $current = $total;
-            $change  = 1;
-        }
-        else {
-            push @new_addrs, $current;
-            $current = $next;
-        }
-    }
-    push @new_addrs, $current;
-    @addrs = @new_addrs;
-}
-
-## Print out the IP addresses
-foreach (@addrs) {
-    print $_->prefix(), "\n";
-}
-
-# $Id: aggregate-cidr-addresses,v 1.9 2012/02/21 10:14:22 suter Exp suter $
--- a/roles/common/files/etc/cron-apt/3-download
+++ b/roles/common/files/etc/cron-apt/3-download
@@ -1,2 +0,0 @@
-autoclean -y
-upgrade -y -o APT::Get::Show-Upgraded=true
--- a/roles/common/files/etc/cron-apt/config
+++ b/roles/common/files/etc/cron-apt/config
@@ -1,5 +0,0 @@
-# Configuration for cron-apt. For further information about the possible
-# configuration settings see the README file.
-
-MAILON="never"
-OPTIONS="-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list -o Dir::Etc::SourceParts=\"/dev/null\""
--- a/roles/common/files/etc/sudoers.d/provisioning
+++ b/roles/common/files/etc/sudoers.d/provisioning
@@ -1 +0,0 @@
-provisioning   ALL=(ALL)  ALL
--- a/roles/common/files/firehol_level1-ipv4.nft
+++ b/roles/common/files/firehol_level1-ipv4.nft
@@ -1,5 +1,5 @@
 #!/usr/sbin/nft -f

-define SPAMHAUS_IPV4 = {
+define FIREHOL_LEVEL1_IPV4 = {
 192.168.254.254/32
 }
--- a/roles/common/files/spamhaus-ipv4.xml
+++ b/roles/common/files/spamhaus-ipv4.xml
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<ipset type="hash:net">
-  <option name="family" value="inet" />
-  <short>spamhaus-ipv4</short>
-  <description>Spamhaus DROP and EDROP lists placeholder (IPv4).</description>
-</ipset>
--- a/roles/common/files/spamhaus-ipv6.nft
+++ b/roles/common/files/spamhaus-ipv6.nft
@@ -1,5 +0,0 @@
-#!/usr/sbin/nft -f
-
-define SPAMHAUS_IPV6 = {
-fd21:3523:74e0:7301::/64
-}
--- a/roles/common/files/spamhaus-ipv6.xml
+++ b/roles/common/files/spamhaus-ipv6.xml
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<ipset type="hash:net">
-  <option name="family" value="inet6" />
-  <short>spamhaus-ipv6</short>
-  <description>Spamhaus DROP list placeholder (IPv6).</description>
-</ipset>
--- a/roles/common/files/ssh-pub-keys/aorth-thinkpad2-ed25519.pub
+++ b/roles/common/files/ssh-pub-keys/aorth-thinkpad2-ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmRO6E0G4Ls3TifVfJ+mQjlfWiBZNJfsSXGhwQ/HA1M aorth@balozi
--- a/roles/common/files/update-abusech-nftables.service
+++ b/roles/common/files/update-abusech-nftables.service
@@ -1,27 +0,0 @@
-[Unit]
-Description=Update Abuse.ch SSL Blacklist IPs
-# This service will fail if nftables is not running so we use Requires to make
-# sure that nftables is started.
-Requires=nftables.service
-# Make sure the network is up and nftables is started
-After=network-online.target nftables.service
-Wants=network-online.target update-abusech-nftables.timer
-
-[Service]
-# https://www.ctrl.blog/entry/systemd-service-hardening.html
-# Doesn't need access to /home or /root
-ProtectHome=true
-# Possibly only works on Ubuntu 18.04+
-ProtectKernelTunables=true
-ProtectSystem=full
-# Newer systemd can use ReadWritePaths to list files, but this works everywhere
-ReadWriteDirectories=/etc/nftables
-PrivateTmp=true
-WorkingDirectory=/var/tmp
-
-SyslogIdentifier=update-abusech-nftables
-ExecStart=/usr/bin/flock -x update-abusech-nftables.lck \
-          /usr/local/bin/update-abusech-nftables.sh
-
-[Install]
-WantedBy=multi-user.target
--- a/roles/common/files/update-abusech-nftables.sh
+++ b/roles/common/files/update-abusech-nftables.sh
@@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-#
-# update-abuseipdb-nftables.sh v0.0.1
-#
-# Download IP addresses seen using a blacklisted SSL certificate and load them
-# into nftables sets. As of 2021-07-28 these appear to only be IPv4.
-# 
-# See: https://sslbl.abuse.ch/blacklist
-#
-# Copyright (C) 2021 Alan Orth
-#
-# SPDX-License-Identifier: GPL-3.0-only
-
-# Exit on first error
-set -o errexit
-
-abusech_ipv4_set_path=/etc/nftables/abusech-ipv4.nft
-abusech_list_temp=$(mktemp)
-
-echo "Downloading Abuse.sh SSL Blacklist IPs"
-
-abusech_response=$(curl -s -G -w "%{http_code}\n" https://sslbl.abuse.ch/blacklist/sslipblacklist.txt --output "$abusech_list_temp")
-
-if [[ $abusech_response -ne 200 ]]; then
-	echo "Abuse.ch responded: HTTP $abusech_response"
-
-	exit 1
-fi
-
-if [[ -f "$abusech_list_temp" ]]; then
-    echo "Processing IPv4 list"
-
-    abusech_ipv4_list_temp=$(mktemp)
-    abusech_ipv4_set_temp=$(mktemp)
-
-    # Remove comments, DOS carriage returns, and IPv6 addresses (even though
-    # Abuse.ch seems to only have IPv4 addresses, let's not break our shit on
-    # that assumption some time down the line).
-    sed -e '/#/d' -e 's/
-//' -e '/:/d' "$abusech_list_temp" > "$abusech_ipv4_list_temp"
-
-    echo "Building abusech-ipv4 set"
-    cat << NFT_HEAD > "$abusech_ipv4_set_temp"
-#!/usr/sbin/nft -f
-
-define ABUSECH_IPV4 = {
-NFT_HEAD
-
-    while read -r network; do
-        # nftables doesn't mind if the last element in the set has a trailing
-        # comma so we don't need to do anything special here.
-        echo "$network," >> "$abusech_ipv4_set_temp"
-    done < $abusech_ipv4_list_temp
-
-    echo "}" >> "$abusech_ipv4_set_temp"
-
-    install -m 0600 "$abusech_ipv4_set_temp" "$abusech_ipv4_set_path"
-
-    rm -f "$abusech_list_temp" "$abusech_ipv4_list_temp" "$abusech_ipv4_set_temp"
-fi
-
-echo "Reloading nftables"
-# The abusech nftables sets are included by nftables.conf
--- a/roles/common/files/update-abusech-nftables.timer
+++ b/roles/common/files/update-abusech-nftables.timer
@@ -1,12 +0,0 @@
-[Unit]
-Description=Update Abuse.ch SSL Blacklist IPs
-
-[Timer]
-# Once a day at midnight
-OnCalendar=*-*-* 00:00:00
-# Add a random delay of 0–3600 seconds
-RandomizedDelaySec=3600
-Persistent=true
-
-[Install]
-WantedBy=timers.target
--- a/roles/common/files/update-firehol-nftables.service
+++ b/roles/common/files/update-firehol-nftables.service
@@ -0,0 +1,24 @@
+[Unit]
+Description=Update FireHOL lists
+# Make sure the network is up
+After=network-online.target
+Wants=network-online.target update-firehol-nftables.timer
+
+[Service]
+# https://www.ctrl.blog/entry/systemd-service-hardening.html
+# Doesn't need access to /home or /root
+ProtectHome=true
+# Possibly only works on Ubuntu 18.04+
+ProtectKernelTunables=true
+ProtectSystem=full
+# Newer systemd can use ReadWritePaths to list files, but this works everywhere
+ReadWriteDirectories=/etc/nftables
+PrivateTmp=true
+WorkingDirectory=/var/tmp
+
+SyslogIdentifier=update-firehol-nftables
+ExecStart=/usr/bin/flock -x update-firehol-nftables.lck \
+          /usr/local/bin/update-firehol-nftables.sh
+
+[Install]
+WantedBy=multi-user.target
--- a/roles/common/files/update-spamhaus-nftables.timer
+++ b/roles/common/files/update-spamhaus-nftables.timer
@@ -1,5 +1,5 @@
 [Unit]
-Description=Update Spamhaus lists
+Description=Update FireHOL lists

 [Timer]
 # Once a day at midnight
--- a/roles/common/files/update-spamhaus-nftables.service
+++ b/roles/common/files/update-spamhaus-nftables.service
@@ -1,27 +0,0 @@
-[Unit]
-Description=Update Spamhaus lists
-# This service will fail if nftables is not running so we use Requires to make
-# sure that nftables is started.
-Requires=nftables.service
-# Make sure the network is up and nftables is started
-After=network-online.target nftables.service
-Wants=network-online.target update-spamhaus-nftables.timer
-
-[Service]
-# https://www.ctrl.blog/entry/systemd-service-hardening.html
-# Doesn't need access to /home or /root
-ProtectHome=true
-# Possibly only works on Ubuntu 18.04+
-ProtectKernelTunables=true
-ProtectSystem=full
-# Newer systemd can use ReadWritePaths to list files, but this works everywhere
-ReadWriteDirectories=/etc/nftables
-PrivateTmp=true
-WorkingDirectory=/var/tmp
-
-SyslogIdentifier=update-spamhaus-nftables
-ExecStart=/usr/bin/flock -x update-spamhaus-nftables.lck \
-          /usr/local/bin/update-spamhaus-nftables.sh
-
-[Install]
-WantedBy=multi-user.target
--- a/roles/common/files/update-spamhaus-nftables.sh
+++ b/roles/common/files/update-spamhaus-nftables.sh
@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-#
-# update-spamhaus-nftables.sh v0.0.1
-#
-# Download Spamhaus DROP lists and load them into nftables sets.
-# 
-# See: https://www.spamhaus.org/drop/
-#
-# Copyright (C) 2021 Alan Orth
-#
-# SPDX-License-Identifier: GPL-3.0-only
-
-# Exit on first error
-set -o errexit
-
-spamhaus_ipv4_set_path=/etc/nftables/spamhaus-ipv4.nft
-spamhaus_ipv6_set_path=/etc/nftables/spamhaus-ipv6.nft
-
-function download() {
-    echo "Downloading $1"
-    wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
-}
-
-download drop.txt
-download edrop.txt
-download dropv6.txt
-
-if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
-    echo "Processing IPv4 DROP lists"
-
-    spamhaus_ipv4_list_temp=$(mktemp)
-    spamhaus_ipv4_set_temp=$(mktemp)
-
-    # Extract all networks from drop.txt and edrop.txt, skipping blank lines and
-    # comments. Use aggregate-cidr-addresses.pl to merge overlapping IPv4 CIDR
-    # ranges to work around a firewalld bug.
-    #
-    # See: https://bugzilla.redhat.com/show_bug.cgi?id=1836571
-    cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' | aggregate-cidr-addresses.pl > "$spamhaus_ipv4_list_temp"
-
-    echo "Building spamhaus-ipv4 set"
-    cat << NFT_HEAD > "$spamhaus_ipv4_set_temp"
-#!/usr/sbin/nft -f
-
-define SPAMHAUS_IPV4 = {
-NFT_HEAD
-
-    while read -r network; do
-        # nftables doesn't mind if the last element in the set has a trailing
-        # comma so we don't need to do anything special here.
-        echo "$network," >> "$spamhaus_ipv4_set_temp"
-    done < $spamhaus_ipv4_list_temp
-
-    echo "}" >> "$spamhaus_ipv4_set_temp"
-
-    install -m 0600 "$spamhaus_ipv4_set_temp" "$spamhaus_ipv4_set_path"
-
-    rm -f "$spamhaus_ipv4_list_temp" "$spamhaus_ipv4_set_temp"
-fi
-
-if [[ -f "dropv6.txt" ]]; then
-    echo "Processing IPv6 DROP lists"
-
-    spamhaus_ipv6_list_temp=$(mktemp)
-    spamhaus_ipv6_set_temp=$(mktemp)
-
-    sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt > "$spamhaus_ipv6_list_temp"
-
-    echo "Building spamhaus-ipv6 set"
-    cat << NFT_HEAD > "$spamhaus_ipv6_set_temp"
-#!/usr/sbin/nft -f
-
-define SPAMHAUS_IPV6 = {
-NFT_HEAD
-
-    while read -r network; do
-        echo "$network," >> "$spamhaus_ipv6_set_temp"
-    done < $spamhaus_ipv6_list_temp
-
-    echo "}" >> "$spamhaus_ipv6_set_temp"
-
-    install -m 0600 "$spamhaus_ipv6_set_temp" "$spamhaus_ipv6_set_path"
-
-    rm -f "$spamhaus_ipv6_list_temp" "$spamhaus_ipv6_set_temp"
-fi
-
-echo "Reloading nftables"
-# The spamhaus nftables sets are included by nftables.conf
-/usr/sbin/nft -f /etc/nftables.conf
-
-rm -v drop.txt edrop.txt dropv6.txt
--- a/roles/common/handlers/main.yml
+++ b/roles/common/handlers/main.yml
@@ -1,23 +1,27 @@
 ---
 # ansible.builtin.file: roles/common/handlers/main.yml

- name: reload sshd
-  ansible.builtin.systemd: name={{ sshd_service_name }} state=reloaded
+- name: Reload sshd
+  ansible.builtin.systemd_service:
+    name: "{{ sshd_service_name }}"
+    state: reloaded

- name: reload sysctl
-  command: sysctl -p /etc/sysctl.conf
+- name: Reload sysctl
+  ansible.builtin.command: sysctl -p /etc/sysctl.conf

- name: restart firewalld
-  ansible.builtin.systemd: name=firewalld state=restarted
+- name: Reload systemd
+  ansible.builtin.systemd_service:
+    daemon_reload: true

- name: reload systemd
-  ansible.builtin.systemd: daemon_reload=true
-
- name: restart nftables
-  ansible.builtin.systemd: name=nftables state=restarted
+- name: Restart nftables
+  ansible.builtin.systemd_service:
+    name: nftables
+    state: restarted

 # 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed
 # in the order they are defined, not in the order they are listed in the task's
 # notify statement and we must restart fail2ban after updating the firewall.
- name: restart fail2ban
-  ansible.builtin.systemd: name=fail2ban state=restarted
+- name: Restart fail2ban
+  ansible.builtin.systemd_service:
+    name: fail2ban
+    state: restarted
--- a/roles/common/tasks/cron-apt.yml
+++ b/roles/common/tasks/cron-apt.yml
@@ -1,12 +1,17 @@
 ---
+- name: Remove cron-apt
+  ansible.builtin.apt:
+    name: cron-apt
+    state: absent
+    cache_valid_time: 3600

- name: Configure cron-apt (config)
-  ansible.builtin.copy: src={{ item.src }} dest={{ item.dest }} mode={{ item.mode }} owner={{ item.owner }} group={{ item.group }}
+- name: Remove cron-apt configs
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
  loop:
-    - { src: 'etc/cron-apt/config', dest: '/etc/cron-apt/config', mode: '0644', owner: 'root', group: 'root' }
-    - { src: 'etc/cron-apt/3-download', dest: '/etc/cron-apt/action.d/3-download', mode: '0644', owner: 'root', group: 'root' }
-
- name: Configure cron-apt (security)
-  ansible.builtin.template: src=security.sources.list.j2 dest=/etc/apt/security.sources.list mode=0644 owner=root group=root
+    - /etc/cron-apt/config
+    - /etc/cron-apt/action.d/3-download
+    - /etc/apt/security.sources.list

 # vim: set ts=2 sw=2:
--- a/roles/common/tasks/fail2ban.yml
+++ b/roles/common/tasks/fail2ban.yml
@@ -1,27 +1,55 @@
 ---
+- name: Install fail2ban
+  when: ansible_facts["distribution_version"] is version('11', '>=')
+  ansible.builtin.apt:
+    name:
+      - fail2ban
+      - python3-systemd
+    state: present
+    cache_valid_time: 3600

 - name: Configure fail2ban sshd filter
-  ansible.builtin.template: src=etc/fail2ban/jail.d/sshd.local.j2 dest=/etc/fail2ban/jail.d/sshd.local owner=root mode=0644
-  notify: restart fail2ban
+  ansible.builtin.template:
+    src: etc/fail2ban/jail.d/sshd.local.j2
+    dest: /etc/fail2ban/jail.d/sshd.local
+    owner: root
+    mode: "0644"
+  notify: Restart fail2ban

 - name: Configure fail2ban nginx filter
  when:
+    - webserver is defined and webserver == 'nginx'
    - extra_fail2ban_filters is defined
    - "'nginx' in extra_fail2ban_filters"
-  ansible.builtin.template: src=etc/fail2ban/jail.d/nginx.local.j2 dest=/etc/fail2ban/jail.d/nginx.local owner=root mode=0644
-  notify: restart fail2ban
+  ansible.builtin.template:
+    src: etc/fail2ban/jail.d/nginx.local.j2
+    dest: /etc/fail2ban/jail.d/nginx.local
+    owner: root
+    mode: "0644"
+  notify: Restart fail2ban

 - name: Create fail2ban service override directory
-  ansible.builtin.file: path=/etc/systemd/system/fail2ban.service.d state=directory owner=root mode=0755
+  ansible.builtin.file:
+    path: /etc/systemd/system/fail2ban.service.d
+    state: directory
+    owner: root
+    mode: "0755"

 # See Arch Linux's example: https://wiki.archlinux.org/index.php/Fail2ban
 - name: Configure fail2ban service override
-  ansible.builtin.template: src=etc/systemd/system/fail2ban.service.d/override.conf.j2 dest=/etc/systemd/system/fail2ban.service.d/override.conf owner=root mode=0644
+  ansible.builtin.template:
+    src: etc/systemd/system/fail2ban.service.d/override.conf.j2
+    dest: /etc/systemd/system/fail2ban.service.d/override.conf
+    owner: root
+    mode: "0644"
  notify:
-    - reload systemd
-    - restart fail2ban
+    - Reload systemd
+    - Restart fail2ban

 - name: Start and enable fail2ban service
-  ansible.builtin.systemd: name=fail2ban state=started enabled=true
+  ansible.builtin.systemd_service:
+    name: fail2ban
+    state: started
+    enabled: true

 # vim: set sw=2 ts=2:
--- a/roles/common/tasks/firewall.yml
+++ b/roles/common/tasks/firewall.yml
@@ -0,0 +1,25 @@
+---
+# Debian 11+ will use nftables directly, with no firewalld.
+
+- name: Install Debian firewall packages
+  when: ansible_facts["distribution_version"] is version('11', '>=')
+  ansible.builtin.apt:
+    name: nftables
+    state: present
+    cache_valid_time: 3600
+
+- name: Remove iptables on newer Debian
+  when: ansible_facts["distribution_version"] is version('11', '>=')
+  ansible.builtin.apt:
+    pkg: iptables
+    state: absent
+
+- name: Configure nftables
+  when: ansible_facts["distribution_version"] is version('11', '>=')
+  ansible.builtin.include_tasks: nftables.yml
+
+- name: Configure fail2ban
+  when: ansible_facts["distribution_version"] is version('9', '>=')
+  ansible.builtin.include_tasks: fail2ban.yml
+
+# vim: set sw=2 ts=2:
--- a/roles/common/tasks/firewall_Debian.yml
+++ b/roles/common/tasks/firewall_Debian.yml
@@ -1,160 +0,0 @@
---
-# Debian 10 will use firewalld with the iptables backend.
-# Debian 11 will use nftables directly, with no firewalld.
-
- block:
-  - name: Set Debian firewall packages
-    when: ansible_distribution_major_version is version('10', '<=')
-    ansible.builtin.set_fact:
-      debian_firewall_packages:
-        - firewalld
-        - tidy
-        - fail2ban
-        - python3-systemd # for fail2ban systemd backend
-
-  - name: Set Debian firewall packages
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.set_fact:
-      debian_firewall_packages:
-        - fail2ban
-        - libnet-ip-perl # for aggregate-cidr-addresses.pl
-        - nftables
-        - python3-systemd
-        - curl # for nftables update scripts
-
-  - name: Install firewall packages
-    ansible.builtin.apt: pkg={{ debian_firewall_packages }} state=present cache_valid_time=3600
-
-  - name: Remove iptables on newer Debian
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.apt: pkg=iptables state=absent
-
-  - name: Copy nftables.conf
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
-    notify:
-      - restart nftables
-      - restart fail2ban
-
-  - name: Create /etc/nftables extra config directory
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.file: path=/etc/nftables state=directory owner=root mode=0755
-
-  - name: Copy extra nftables configuration files
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
-    loop:
-      - { src: "spamhaus-ipv4.nft", force: "no" }
-      - { src: "spamhaus-ipv6.nft", force: "no" }
-      - { src: "abusech-ipv4.nft", force: "no" }
-      - { src: "abuseipdb-ipv4.nft", force: "yes" }
-      - { src: "abuseipdb-ipv6.nft", force: "yes" }
-    notify:
-      - restart nftables
-      - restart fail2ban
-
-  - name: Use iptables backend in firewalld
-    when: ansible_distribution_major_version is version('10', '==')
-    ansible.builtin.lineinfile:
-      dest: /etc/firewalld/firewalld.conf
-      regexp: '^FirewallBackend=nftables$'
-      line: 'FirewallBackend=iptables'
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-# firewalld seems to have an issue with iptables 1.8.2 when using the nftables
-# backend. Using individual calls seems to work around it.
-# See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931722
-  - name: Use individual iptables calls
-    when: ansible_distribution_major_version is version('10', '==')
-    ansible.builtin.lineinfile:
-      dest: /etc/firewalld/firewalld.conf
-      regexp: '^IndividualCalls=no$'
-      line: 'IndividualCalls=yes'
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-  - name: Copy firewalld public zone file
-    when: ansible_distribution_major_version is version('10', '<=')
-    ansible.builtin.template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
-
-  - name: Format public.xml firewalld zone file
-    when: ansible_distribution_major_version is version('10', '<=')
-    command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-  - name: Copy firewalld ipsets of abusive IPs
-    when: ansible_distribution_major_version is version('10', '<=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
-    loop:
-      - abusers-ipv4.xml
-      - abusers-ipv6.xml
-      - spamhaus-ipv4.xml
-      - spamhaus-ipv6.xml
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-  - name: Copy Spamhaus firewalld update script
-    when: ansible_distribution_version is version('10', '<=')
-    ansible.builtin.copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
-
-  - name: Copy Spamhaus firewalld systemd units
-    when: ansible_distribution_version is version('10', '<=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-    loop:
-        - update-spamhaus-lists.service
-        - update-spamhaus-lists.timer
-    register: spamhaus_firewalld_systemd_units
-
-  - name: Copy Spamhaus nftables update scripts
-    when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
-    loop:
-      - update-spamhaus-nftables.sh
-      - aggregate-cidr-addresses.pl
-      - update-abusech-nftables.sh
-
-  - name: Copy nftables systemd units
-    when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-    loop:
-        - update-spamhaus-nftables.service
-        - update-spamhaus-nftables.timer
-        - update-abusech-nftables.service
-        - update-abusech-nftables.timer
-    register: nftables_systemd_units
-
-  # need to reload to pick up service/timer/environment changes
-  - name: Reload systemd daemon
-    ansible.builtin.systemd: daemon_reload=true
-    when: spamhaus_firewalld_systemd_units is changed or
-          nftables_systemd_units is changed
-
-  - name: Start and enable Spamhaus firewalld update timer
-    when: ansible_distribution_version is version('10', '<=')
-    ansible.builtin.systemd: name=update-spamhaus-lists.timer state=started enabled=true
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-  - name: Start and enable nftables update timers
-    when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.systemd: name={{ item }} state=started enabled=true
-    loop:
-      - update-spamhaus-nftables.timer
-      - update-abusech-nftables.timer
-
-  - name: Start and enable nftables
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.systemd: name=nftables state=started enabled=true
-
-  - ansible.builtin.include_tasks: fail2ban.yml
-    when: ansible_distribution_major_version is version('9', '>=')
-  tags: firewall
-
-# vim: set sw=2 ts=2:
--- a/roles/common/tasks/firewall_Ubuntu.yml
+++ b/roles/common/tasks/firewall_Ubuntu.yml
@@ -1,84 +0,0 @@
---
-# Ubuntu 20.04 will use nftables directly, with no firewalld.
-
- block:
-  - name: Set Ubuntu firewall packages
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.set_fact:
-      ubuntu_firewall_packages:
-        - fail2ban
-        - libnet-ip-perl # for aggregate-cidr-addresses.pl
-        - nftables
-        - python3-systemd
-        - curl # for nftables update scripts
-
-  - name: Install firewall packages
-    ansible.builtin.apt: pkg={{ ubuntu_firewall_packages }} state=present cache_valid_time=3600
-
-  - name: Remove ufw
-    when: ansible_distribution_version is version('16.04', '>=')
-    ansible.builtin.apt: pkg=ufw state=absent
-
-  - name: Copy nftables.conf
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
-    notify:
-      - restart nftables
-      - restart fail2ban
-
-  - name: Create /etc/nftables extra config directory
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.file: path=/etc/nftables state=directory owner=root mode=0755
-
-  - name: Copy extra nftables configuration files
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
-    loop:
-      - { src: "spamhaus-ipv4.nft", force: "no" }
-      - { src: "spamhaus-ipv6.nft", force: "no" }
-      - { src: "abusech-ipv4.nft", force: "no" }
-      - { src: "abuseipdb-ipv4.nft", force: "yes" }
-      - { src: "abuseipdb-ipv6.nft", force: "yes" }
-    notify:
-      - restart nftables
-      - restart fail2ban
-
-  - name: Copy nftables update scripts
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
-    loop:
-      - update-spamhaus-nftables.sh
-      - aggregate-cidr-addresses.pl
-      - update-abusech-nftables.sh
-
-  - name: Copy nftables systemd units
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-    loop:
-        - update-spamhaus-nftables.service
-        - update-spamhaus-nftables.timer
-        - update-abusech-nftables.service
-        - update-abusech-nftables.timer
-    register: nftables_systemd_units
-
-  # need to reload to pick up service/timer/environment changes
-  - name: Reload systemd daemon
-    ansible.builtin.systemd: daemon_reload=true
-    when: nftables_systemd_units is changed
-
-  - name: Start and enable nftables update timers
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.systemd: name={{ item }} state=started enabled=true
-    loop:
-      - update-spamhaus-nftables.timer
-      - update-abusech-nftables.timer
-
-  - name: Start and enable nftables
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.systemd: name=nftables state=started enabled=true
-
-  - ansible.builtin.include_tasks: fail2ban.yml
-    when: ansible_distribution_version is version('16.04', '>=')
-  tags: firewall
-
-# vim: set sw=2 ts=2:
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -1,6 +1,6 @@
 ---
 - name: Import OS-specific variables
-  ansible.builtin.include_vars: "vars/{{ ansible_distribution }}.yml"
+  ansible.builtin.include_vars: vars/{{ ansible_facts["distribution"] }}.yml
  tags: always

 - name: Configure network time
@@ -8,23 +8,11 @@
  tags: ntp

 - name: Install common packages
-  ansible.builtin.include_tasks: packages_Debian.yml
-  when: ansible_distribution == 'Debian'
-  tags: packages
-
- name: Install common packages
-  ansible.builtin.include_tasks: packages_Ubuntu.yml
-  when: ansible_distribution == 'Ubuntu'
+  ansible.builtin.include_tasks: packages.yml
  tags: packages

 - name: Configure firewall
-  ansible.builtin.include_tasks: firewall_Debian.yml
-  when: ansible_distribution == 'Debian'
-  tags: firewall
-
- name: Configure firewall
-  ansible.builtin.include_tasks: firewall_Ubuntu.yml
-  when: ansible_distribution == 'Ubuntu'
+  ansible.builtin.import_tasks: firewall.yml
  tags: firewall

 - name: Configure secure shell daemon
@@ -33,14 +21,24 @@

 # containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!
 - name: Reconfigure /etc/sysctl.conf
-  when: ansible_virtualization_role != 'host'
-  ansible.builtin.template: src=sysctl_{{ ansible_distribution }}.j2 dest=/etc/sysctl.conf owner=root group=root mode=0644
+  when: ansible_facts["virtualization_role"] != 'host'
+  ansible.builtin.template:
+    src: "sysctl_{{ ansible_facts['distribution'] }}.j2"
+    dest: /etc/sysctl.conf
+    owner: root
+    group: root
+    mode: "0644"
  notify:
-    - reload sysctl
+    - Reload sysctl
  tags: sysctl

 - name: Set I/O scheduler
-  ansible.builtin.template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644
+  ansible.builtin.template:
+    src: etc/udev/rules.d/60-scheduler.rules.j2
+    dest: /etc/udev/rules.d/60-scheduler.rules
+    owner: root
+    group: root
+    mode: "0644"
  tags: udev

 - name: Copy admin SSH keys
--- a/roles/common/tasks/nftables.yml
+++ b/roles/common/tasks/nftables.yml
@@ -0,0 +1,69 @@
+---
+# Common nftables tasks for Debian 11 and Debian 12.
+
+- name: Copy nftables.conf
+  ansible.builtin.template:
+    src: nftables.conf.j2
+    dest: /etc/nftables.conf
+    owner: root
+    mode: "0644"
+  notify:
+    - Restart nftables
+
+- name: Create /etc/nftables extra config directory
+  ansible.builtin.file:
+    path: /etc/nftables
+    state: directory
+    owner: root
+    mode: "0755"
+
+- name: Copy extra nftables configuration files
+  ansible.builtin.copy:
+    src: firehol_level1-ipv4.nft
+    dest: /etc/nftables/firehol_level1-ipv4.nft
+    owner: root
+    group: root
+    mode: "0644"
+    force: false
+  notify:
+    - Restart nftables
+
+- name: Copy nftables update scripts
+  ansible.builtin.template:
+    src: update-firehol-nftables.sh.j2
+    dest: /usr/local/bin/update-firehol-nftables.sh
+    mode: "0755"
+    owner: root
+    group: root
+
+- name: Copy nftables systemd units
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: /etc/systemd/system/{{ item }}
+    mode: "0644"
+    owner: root
+    group: root
+  loop:
+    - update-firehol-nftables.service
+    - update-firehol-nftables.timer
+  register: nftables_systemd_units
+
+# need to reload to pick up service/timer/environment changes
+- name: Reload systemd daemon
+  when: nftables_systemd_units is changed
+  ansible.builtin.systemd_service: # noqa no-handler
+    daemon_reload: true
+
+- name: Start and enable nftables update timers
+  ansible.builtin.systemd_service:
+    name: update-firehol-nftables.timer
+    state: started
+    enabled: true
+
+- name: Start and enable nftables
+  ansible.builtin.systemd_service:
+    name: nftables
+    state: started
+    enabled: true
+
+# vim: set sw=2 ts=2:
--- a/roles/common/tasks/ntp.yml
+++ b/roles/common/tasks/ntp.yml
@@ -1,27 +1,40 @@
 ---
-# Hosts running Ubuntu 16.04+ and Debian 9+ use systemd init system and should
-# use systemd-timesyncd as a network time client instead of the standalone ntp
-# client.
+# Hosts running Debian 9+ use systemd init system and can use systemd-timesyncd
+# as a network time client instead of the standalone ntp client.

 - name: Set timezone
-  when: timezone is defined and ansible_service_mgr == 'systemd'
-  command: /usr/bin/timedatectl set-timezone {{ timezone }}
+  when:
+    - timezone is defined
+    - ansible_facts["service_mgr"] == 'systemd'
+  community.general.timezone:
+    name: "{{ timezone }}"
  tags: timezone

 # Apparently some cloud images don't have this installed by default. From what
 # I can see on existing servers, systemd-timesyncd is a standalone package on
-# Ubuntu 20.04 and Debian 11.
+# Debian 11 and Debian 12.
 - name: Install systemd-timesyncd
-  when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or
-        (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
-  ansible.builtin.apt: name=systemd-timesyncd state=present cache_valid_time=3600
+  when: ansible_facts["distribution_version"] is version('11', '>=')
+  ansible.builtin.apt:
+    name: systemd-timesyncd
+    state: present
+    cache_valid_time: 3600

 - name: Start and enable systemd's NTP client
-  when: ansible_service_mgr == 'systemd'
-  ansible.builtin.systemd: name=systemd-timesyncd state=started enabled=true
+  when: ansible_facts["service_mgr"] == 'systemd'
+  ansible.builtin.systemd_service:
+    name: systemd-timesyncd
+    state: started
+    enabled: true

- name: Uninstall ntp on modern Ubuntu/Debian
-  ansible.builtin.apt: name=ntp state=absent
-  when: ansible_service_mgr == 'systemd'
+# On Debian 12 ntp doesn't conflict with systemd-timesyncd so we should try to
+# remove it to be sure.
+- name: Uninstall ntp on Debian 12
+  when:
+    - ansible_facts["service_mgr"] == 'systemd'
+    - ansible_facts["distribution_major_version"] is version('12', '==')
+  ansible.builtin.apt:
+    name: ntp
+    state: absent

 # vim: set ts=2 sw=2:
--- a/roles/common/tasks/packages_Debian.yml
+++ b/roles/common/tasks/packages_Debian.yml
@@ -1,10 +1,23 @@
 ---
-
 - name: Configure Debian packages
+  tags: packages
  block:
+    # Scaleway seems to use a weird sources.list format as of Debian 12?
+    - name: Check for weird Debian sources
+      ansible.builtin.stat:
+        path: /etc/apt/sources.list.d/debian.sources
+      register: weird_debian_sources_stat
+
    - name: Configure apt mirror
-      ansible.builtin.template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
-      when: ansible_architecture != 'armv7l'
+      when:
+        - ansible_facts["architecture"] != 'armv7l'
+        - not weird_debian_sources_stat
+      ansible.builtin.template:
+        src: sources.list.j2
+        dest: /etc/apt/sources.list
+        owner: root
+        group: root
+        mode: "0644"

    - name: Set fact for base packages
      ansible.builtin.set_fact:
@@ -15,7 +28,6 @@
          - iotop
          - htop
          - strace
-          - cron-apt
          - safe-rm
          - debian-goodies
          - mosh
@@ -27,16 +39,19 @@
          - zstd
          - rsync
          - lsof
+          - unattended-upgrades

    - name: Install base packages
-      ansible.builtin.apt: name={{ base_packages }} state=present cache_valid_time=3600
+      ansible.builtin.apt:
+        name: "{{ base_packages }}"
+        state: present
+        cache_valid_time: 3600

-    - name: Configure cron-apt
-      ansible.builtin.import_tasks: cron-apt.yml
+    - name: Remove cron-apt
      tags: cron-apt
+      ansible.builtin.import_tasks: cron-apt.yml

    - name: Install tarsnap
      ansible.builtin.import_tasks: tarsnap.yml
-  tags: packages

 # vim: set sw=2 ts=2:
--- a/roles/common/tasks/packages_Ubuntu.yml
+++ b/roles/common/tasks/packages_Ubuntu.yml
@@ -1,93 +0,0 @@
---
-
- name: Configure Ubuntu packages
-  block:
-    - name: Configure apt mirror
-      ansible.builtin.template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
-      when: ansible_architecture != 'armv7l'
-
-    - name: Upgrade base OS
-      ansible.builtin.apt: upgrade=dist cache_valid_time=3600
-
-    - name: Set Ubuntu base packages
-      ansible.builtin.set_fact:
-        ubuntu_base_packages:
-        - git
-        - git-lfs
-        - tmux
-        - iotop
-        - htop
-        - strace
-        - cron-apt
-        - safe-rm
-        - debian-goodies
-        - mosh
-        - python-pycurl # for ansible's apt_repository
-        - vim
-        - unzip
-        - apt-transport-https # for https support in apt
-        - zstd
-        - rsync
-        - lsof
-
-    - name: Install base packages
-      ansible.builtin.apt: pkg={{ ubuntu_base_packages }} state=present cache_valid_time=3600
-
-    # We have to remove snaps one by one in a specific order because some depend
-    # on others. Only after that can we remove the corresponding system packages.
-    - name: Remove lxd snap
-      community.general.snap: name=lxd state=absent
-      when: ansible_distribution_version is version('20.04', '==')
-      ignore_errors: true
-
-    - name: Remove core18 snap
-      community.general.snap: name=core18 state=absent
-      when: ansible_distribution_version is version('20.04', '==')
-      ignore_errors: true
-
-    - name: Remove snapd snap
-      community.general.snap: name=snapd state=absent
-      when: ansible_distribution_version is version('20.04', '==')
-      ignore_errors: true
-
-    - name: Set fact for packages to remove (Ubuntu 20.04)
-      ansible.builtin.set_fact:
-        ubuntu_annoying_packages:
-          - whoopsie # security (CIS 4.1)
-          - apport   # security (CIS 4.1)
-          - command-not-found # annoying
-          - command-not-found-data # annoying
-          - python3-commandnotfound # annoying
-          - snapd # annoying (Ubuntu >= 16.04)
-          - lxd-agent-loader # annoying (Ubuntu 20.04)
-      when: ansible_distribution_version is version('20.04', '==')
-
-    - name: Remove packages
-      ansible.builtin.apt: name={{ ubuntu_annoying_packages }} state=absent purge=true
-
-    - name: Disable annoying Canonical spam in MOTD
-      ansible.builtin.file: path={{ item }} mode=0644 state=absent
-      loop:
-        - /etc/update-motd.d/99-esm # Ubuntu 14.04
-        - /etc/update-motd.d/10-help-text # Ubuntu 14.04+
-        - /etc/update-motd.d/50-motd-news # Ubuntu 18.04+
-        - /etc/update-motd.d/80-esm # Ubuntu 18.04+
-        - /etc/update-motd.d/80-livepatch # Ubuntu 18.04+
-      ignore_errors: true
-
-    - name: Disable annoying Canonical spam in MOTD
-      ansible.builtin.systemd: name={{ item }} state=stopped enabled=no
-      when: ansible_service_mgr == 'systemd'
-      loop:
-        - motd-news.service
-        - motd-news.timer
-
-    - name: Configure cron-apt
-      ansible.builtin.import_tasks: cron-apt.yml
-      tags: cron-apt
-
-    - name: Install tarsnap
-      ansible.builtin.import_tasks: tarsnap.yml
-  tags: packages
-
-# vim: set sw=2 ts=2:
--- a/roles/common/tasks/ssh-keys.yml
+++ b/roles/common/tasks/ssh-keys.yml
@@ -1,9 +1,11 @@
 ---
 - name: Zero .ssh/authorized_keys for provisioning user
-  ansible.builtin.file: dest={{ provisioning_user.home }}/.ssh/authorized_keys state=absent
+  ansible.builtin.file:
+    dest: "{{ provisioning_user.home }}/.ssh/authorized_keys"
+    state: absent

 - name: Add public keys to authorized_keys
-  ansible.posix.authorized_key: { user: '{{ provisioning_user.name }}', key: "{{ lookup('file',item) }}" }
+  ansible.posix.authorized_key: { user: "{{ provisioning_user.name }}", key: "{{ lookup('file', item) }}" }
  with_fileglob:
    # use descriptive names for keys, like: aorth-mzito-rsa.pub
    - ssh-pub-keys/*.pub
--- a/roles/common/tasks/sshd.yml
+++ b/roles/common/tasks/sshd.yml
@@ -1,17 +1,26 @@
 ---
-
-# SSH configs don't change in Debian minor versions
+# Only override the system sshd configuration on older Debian.
 - name: Reconfigure /etc/ssh/sshd_config
-  ansible.builtin.template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
-  when: ansible_distribution == 'Debian'
-  notify: reload sshd
+  when: ansible_facts["distribution_version"] is version('12', '<=')
+  ansible.builtin.template:
+    src: "sshd_config_{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_major_version'] }}.j2"
+    dest: /etc/ssh/sshd_config
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Reload sshd

-# Ubuntu is the only distro we have where SSH version is very different from 14.04 -> 14.10,
-# ie with new ciphers supported etc.
- name: Reconfigure /etc/ssh/sshd_config
-  ansible.builtin.template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
-  when: ansible_distribution == 'Ubuntu'
-  notify: reload sshd
+# Newer OpenSSH versions support including extra configuration. The includes
+# happen at the beginning of the file and the first value to be read is used.
+- name: Configure sshd_config.d overrides
+  when: ansible_facts["distribution_version"] is version('13', '>=')
+  ansible.builtin.template:
+    src: etc/ssh/sshd_config.d/01-{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}.conf.j2
+    dest: /etc/ssh/sshd_config.d/01-custom.conf
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Reload sshd

 # See: WeakDH (2015): https://weakdh.org/sysadmin.html
 - name: Remove small Diffie-Hellman SSH moduli
@@ -24,28 +33,30 @@
      register: check_unsafe_moduli

    - name: Extract safe Diffie-Hellman SSH moduli
+      when: check_unsafe_moduli.stdout | length > 0
      ansible.builtin.shell:
        cmd: awk '$5 >= 3071' moduli > moduli.safe
        chdir: /etc/ssh
        creates: moduli.safe
-      when: check_unsafe_moduli.stdout | length > 0
      register: extract_safe_moduli

    - name: Replace unsafe Diffie-Hellman SSH moduli
+      when: extract_safe_moduli is changed
      ansible.builtin.command:
        cmd: mv moduli.safe moduli
        chdir: /etc/ssh
      register: replace_small_moduli
-      when: extract_safe_moduli is changed
-      notify: reload sshd
+      notify: Reload sshd

 - name: Remove DSA and ECDSA host keys
-  ansible.builtin.file: name=/etc/ssh/{{ item }} state=absent
+  ansible.builtin.file:
+    name: "/etc/ssh/{{ item }}"
+    state: absent
  loop:
    - ssh_host_dsa_key
    - ssh_host_dsa_key.pub
    - ssh_host_ecdsa_key
    - ssh_host_ecdsa_key.pub
-  notify: reload sshd
+  notify: Reload sshd

 # vim: set sw=2 ts=2:
--- a/roles/common/tasks/tarsnap.yml
+++ b/roles/common/tasks/tarsnap.yml
@@ -1,24 +1,45 @@
 ---
- name: Add Tarsnap apt mirror
-  ansible.builtin.template: src=tarsnap_sources.list.j2 dest=/etc/apt/sources.list.d/tarsnap.list owner=root group=root mode=0644
-  register: add_tarsnap_apt_repository
-  when: ansible_architecture != 'armv7l'
+- name: Check tarsnap apt signing key
+  ansible.builtin.stat:
+    path: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
+  register: tarsnap_signing_key_stat

- name: Add GPG key for Tarsnap
-  ansible.builtin.apt_key: id=0xBF75EEAB040E447C url=https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc state=present
-  register: add_tarsnap_apt_key
+- name: Download tarsnap apt signing key
+  when: not tarsnap_signing_key_stat.stat.exists
+  ansible.builtin.get_url:
+    url: https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc
+    dest: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
+    owner: root
+    group: root
+    mode: "0644"
+  register: download_tarsnap_signing_key
+
+- name: Add tarsnap.org repo
+  when: ansible_facts["architecture"] != 'armv7l'
+  ansible.builtin.template:
+    src: tarsnap_sources.list.j2
+    dest: /etc/apt/sources.list.d/tarsnap.list
+    owner: root
+    group: root
+    mode: "0644"
+  register: add_tarsnap_apt_repository

 - name: Update apt cache
-  ansible.builtin.apt:
+  when: (download_tarsnap_signing_key.status_code is defined and download_tarsnap_signing_key.status_code == 200) or add_tarsnap_apt_repository is changed
+  ansible.builtin.apt: # noqa no-handler
    update_cache: true
-  when:
-    add_tarsnap_apt_key is changed or
-    add_tarsnap_apt_repository is changed

 - name: Install tarsnap
-  ansible.builtin.apt: pkg=tarsnap cache_valid_time=3600
+  ansible.builtin.apt:
+    pkg: tarsnap
+    cache_valid_time: 3600

 - name: Copy tarsnaprc
-  ansible.builtin.copy: src=tarsnaprc dest=/root/.tarsnaprc owner=root group=root mode=0600
+  ansible.builtin.copy:
+    src: tarsnaprc
+    dest: /root/.tarsnaprc
+    owner: root
+    group: root
+    mode: "0600"

 # vim: set sw=2 ts=2:
--- a/roles/common/templates/etc/fail2ban/jail.d/nginx.local.j2
+++ b/roles/common/templates/etc/fail2ban/jail.d/nginx.local.j2
@@ -2,13 +2,8 @@
 enabled   = true
 # See: /etc/fail2ban/filter.d/nginx-botsearch.conf
 filter    = nginx-botsearch
-{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
 # Integrate with nftables
 banaction=nftables[type=allports]
-{% else %}
-# Integrate with firewalld and ipsets
-banaction = firewallcmd-ipset
-{% endif %}
 backend   = pyinotify
 logpath   = /var/log/nginx/*-access.log
 # Try to find a non-existent wp-login.php once and get banned. Tough luck.
--- a/roles/common/templates/etc/fail2ban/jail.d/sshd.local.j2
+++ b/roles/common/templates/etc/fail2ban/jail.d/sshd.local.j2
@@ -2,13 +2,8 @@
 enabled   = true
 # See: /etc/fail2ban/filter.d/sshd.conf
 filter    = sshd
-{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
 # Integrate with nftables
 banaction=nftables[type=allports]
-{% else %}
-# Integrate with firewalld and ipsets
-banaction = firewallcmd-ipset
-{% endif %}
 backend   = systemd
 maxretry  = {{ fail2ban_maxretry }}
 findtime  = {{ fail2ban_findtime }}
--- a/roles/common/templates/etc/ssh/sshd_config.d/01-Debian-13.conf.j2
+++ b/roles/common/templates/etc/ssh/sshd_config.d/01-Debian-13.conf.j2
@@ -0,0 +1,40 @@
+{{ ansible_managed | comment }}
+
+HostKey /etc/ssh/ssh_host_ed25519_key
+
+# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear
+# audit track of which key was using to log in.
+LogLevel VERBOSE
+
+MaxAuthTries 4
+
+AuthorizedKeysFile	.ssh/authorized_keys
+
+# To disable tunneled clear text passwords, change to no here!
+{% if ssh_password_authentication == 'disabled' %}
+PasswordAuthentication no
+{% else %}
+PasswordAuthentication yes
+{% endif %}
+
+X11Forwarding no
+
+# Based on the ssh-audit profile for Debian 13, but with but with all algos with
+# less than 256 bits removed, as NSA's Suite B removed them years ago and the
+# new (2018) CNSA suite is 256 bits and up.
+#
+# See: ssh-audit.py -P "Hardened Debian 13 (version 1)"
+# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com
+
+{% if ssh_allowed_users is defined and ssh_allowed_users %}
+AllowUsers {{ ssh_allowed_users|join(" ") }} {{ provisioning_user.name }}
+{% endif %}
+
+PerSourcePenaltyExemptList {{ fail2ban_ignoreip | replace(" ", ",") }}
+
+# Mask to use for IPv4 and IPv6 respectively when applying network penalties.
+# The default is 32:128.
+PerSourceNetBlockSize 24:56
--- a/roles/common/templates/etc/systemd/system/fail2ban.service.d/override.conf.j2
+++ b/roles/common/templates/etc/systemd/system/fail2ban.service.d/override.conf.j2
@@ -1,15 +1,19 @@
+[Unit]
+# If nftables is stopped or restarted, propagate to fail2ban as well
+PartOf=nftables.service
+
 [Service]
 PrivateDevices=yes
 PrivateTmp=yes
 ProtectHome=read-only
-{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
+{% if ansible_facts["distribution_version"] is version('11','>=') %}
 ProtectSystem=strict
 {% else %}
 {# Older systemd versions don't have ProtectSystem=strict #}
 ProtectSystem=full
 {% endif %}
 NoNewPrivileges=yes
-{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
+{% if ansible_facts["distribution_version"] is version('11','>=') %}
 ReadWritePaths=-/var/run/fail2ban
 ReadWritePaths=-/var/lib/fail2ban
 ReadWritePaths=-/var/log/fail2ban.log
--- a/roles/common/templates/nftables.conf.j2
+++ b/roles/common/templates/nftables.conf.j2
@@ -5,47 +5,18 @@

 flush ruleset

-# Lists updated daily by update-spamhaus-nftables.sh
-include "/etc/nftables/spamhaus-ipv4.nft"
-include "/etc/nftables/spamhaus-ipv6.nft"
-
-# Lists updated monthly (manually)
-include "/etc/nftables/abuseipdb-ipv4.nft"
-include "/etc/nftables/abuseipdb-ipv6.nft"
-
-# Lists updated daily by update-abusech-nftables.sh
-include "/etc/nftables/abusech-ipv4.nft"
+# List updated daily by update-firehol-nftables.sh
+include "/etc/nftables/firehol_level1-ipv4.nft"

 # Notes:
 #   - tables hold chains, chains hold rules
 #   - inet is for both ipv4 and ipv6
 table inet filter {
-    set spamhaus-ipv4 {
+    set firehol_level1-ipv4 {
        type ipv4_addr
        # if the set contains prefixes we need to use the interval flag
        flags interval
-        elements = $SPAMHAUS_IPV4
-    }
-
-    set spamhaus-ipv6 {
-        type ipv6_addr
-        flags interval
-        elements = $SPAMHAUS_IPV6
-    }
-
-    set abusech-ipv4 {
-        type ipv4_addr
-        elements = $ABUSECH_IPV4
-    }
-
-    set abuseipdb-ipv4 {
-        type ipv4_addr
-        elements = $ABUSEIPDB_IPV4
-    }
-
-    set abuseipdb-ipv6 {
-        type ipv6_addr
-        elements = $ABUSEIPDB_IPV6
+        elements = $FIREHOL_LEVEL1_IPV4
    }

    chain input {
@@ -55,13 +26,7 @@ table inet filter {

        ct state invalid counter drop comment "Early drop of invalid connections"

-        ip saddr @spamhaus-ipv4 counter drop comment "Early drop of incoming packets matching spamhaus-ipv4 list"
-        ip6 saddr @spamhaus-ipv6 counter drop comment "Early drop of incoming packets matching spamhaus-ipv6 list"
-
-        ip saddr @abusech-ipv4 counter drop comment "Early drop of packets matching abusech-ipv4 list"
-
-        ip saddr @abuseipdb-ipv4 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv4 list"
-        ip6 saddr @abuseipdb-ipv6 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv6 list"
+        ip saddr @firehol_level1-ipv4 counter drop comment "Early drop of incoming packets matching firehol_level1-ipv4 list"

        iifname lo accept comment "Allow from loopback"

@@ -105,12 +70,6 @@ table inet filter {
    chain output {
        type filter hook output priority 0;

-        ip daddr @spamhaus-ipv4 counter drop comment "Drop outgoing packets matching spamhaus-ipv4 list"
-        ip6 daddr @spamhaus-ipv6 counter drop comment "Drop outgoing packets matching spamhaus-ipv6 list"
-
-        ip daddr @abusech-ipv4 counter drop comment "Drop outgoing packets matching abusech-ipv4 list"
-
-        ip daddr @abuseipdb-ipv4 counter drop comment "Drop outgoing packets matching abuseipdb-ipv4 list"
-        ip6 daddr @abuseipdb-ipv6 counter drop comment "Drop outgoing packets matching abuseipdb-ipv6 list"
+        ip daddr @firehol_level1-ipv4 counter drop comment "Drop outgoing packets matching firehol_level1-ipv4 list"
    }
 }
--- a/roles/common/templates/public.xml.j2
+++ b/roles/common/templates/public.xml.j2
@@ -1,81 +0,0 @@
-<zone>
-    <short>Public</short>
-    <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
-    <interface name="{{ ansible_default_ipv4.interface }}"/>
-
-    {# ssh rules #}
-    <rule family="ipv4">
-        <source address="0.0.0.0/0"/>
-        <port protocol="tcp" port="22"/>
-        <accept/>
-    </rule>
-
-    {# ipv6 ssh rules #}
-    <rule family="ipv6">
-        <source address="::/0"/>
-        <port protocol="tcp" port="22"/>
-        <accept/>
-    </rule>
-
-    {# web rules #}
-    <rule family="ipv4">
-        <source address="0.0.0.0/0"/>
-        <port protocol="tcp" port="80"/>
-        <accept/>
-    </rule>
-
-    {# ipv6 web rules #}
-    <rule family="ipv6">
-        <source address="::/0"/>
-        <port protocol="tcp" port="80"/>
-        <accept/>
-    </rule>
-
-    {# munin rules #}
-    {% if munin_master_host is defined %}
-    <rule family="ipv4">
-        <source address="{{ ghetto_ipsets[munin_master_host].src }}"/>
-        <port protocol="tcp" port="{{ munin_node_port }}"/>
-        <accept/>
-    </rule>
-    {% endif %}
-
-    {# extra rules #}
-    {% if extra_iptables_rules is defined %}
-    {% for rule in extra_iptables_rules %}
-    <rule family="ipv4">
-        <source address="{{ ghetto_ipsets[rule.acl].src }}"/>
-        <port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
-        <accept/>
-    </rule>
-
-    {# ipv6 extra rules #}
-    {% if ghetto_ipsets[rule.acl].ipv6src is defined %}
-    <rule family="ipv6">
-        <source address="{{ ghetto_ipsets[rule.acl].ipv6src }}"/>
-        <port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
-        <accept/>
-    </rule>
-    {% endif %}
-
-    {% endfor %}
-    {% endif %}
-
-    <rule>
-      <source ipset="abusers-ipv4"/>
-      <drop/>
-    </rule>
-    <rule>
-      <source ipset="abusers-ipv6"/>
-      <drop/>
-    </rule>
-    <rule>
-      <source ipset="spamhaus-ipv4"/>
-      <drop/>
-    </rule>
-    <rule>
-      <source ipset="spamhaus-ipv6"/>
-      <drop/>
-    </rule>
-
-</zone>
--- a/roles/common/templates/security.sources.list.j2
+++ b/roles/common/templates/security.sources.list.j2
@@ -1,5 +0,0 @@
-{% if ansible_distribution == 'Ubuntu' %}
-deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security main restricted universe multiverse
-{% elif ansible_distribution == 'Debian' %}
-deb http://security.debian.org/debian-security {{ ansible_distribution_release }}/updates main contrib non-free
-{% endif %}
--- a/roles/common/templates/sources.list.j2
+++ b/roles/common/templates/sources.list.j2
@@ -1,16 +1,6 @@
-{% if ansible_distribution == 'Ubuntu' %}
-{% set apt_mirror    = apt_mirror | default("ubuntu.mirror.ac.ke") %}
-
-deb http://{{ apt_mirror }}/ubuntu/ {{ ansible_distribution_release }} main restricted universe multiverse
-deb http://{{ apt_mirror }}/ubuntu/ {{ ansible_distribution_release }}-updates main restricted universe multiverse
-deb http://security.ubuntu.com/ubuntu/ {{ ansible_distribution_release }}-security main restricted universe multiverse
-
-{% else %}
 {% set apt_mirror    = apt_mirror | default('deb.debian.org') %}
 deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }} main contrib non-free

 deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main contrib non-free

 deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }}-updates main contrib non-free
-
-{% endif %} {# ansible_distribution #}
--- a/roles/common/templates/sshd_config_Debian-11.j2
+++ b/roles/common/templates/sshd_config_Debian-11.j2
@@ -56,7 +56,11 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #IgnoreRhosts yes

 # To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
+{% if ssh_password_authentication == 'disabled' %}
+PasswordAuthentication no
+{% else %}
+PasswordAuthentication yes
+{% endif %}
 #PermitEmptyPasswords no

 # Change to yes to enable challenge-response passwords (beware issues with
@@ -131,8 +135,7 @@ Subsystem	sftp	/usr/lib/openssh/sftp-server
 # See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
 MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
-KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256

 {% if ssh_allowed_users is defined and ssh_allowed_users %}
 # Is there a list of allowed users?
--- a/roles/common/templates/sshd_config_Ubuntu-20.04.j2
+++ b/roles/common/templates/sshd_config_Ubuntu-20.04.j2
@@ -1,9 +1,8 @@
-#	$OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.

-# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games

 # The strategy used for options in the default sshd_config shipped with
 # OpenSSH is to specify options with their default value where
@@ -18,6 +17,7 @@ Include /etc/ssh/sshd_config.d/*.conf
 #ListenAddress ::

 #HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
 HostKey /etc/ssh/ssh_host_ed25519_key

 # Ciphers and keying
@@ -56,12 +56,16 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #IgnoreRhosts yes

 # To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
+{% if ssh_password_authentication == 'disabled' %}
+PasswordAuthentication no
+{% else %}
+PasswordAuthentication yes
+{% endif %}
 #PermitEmptyPasswords no

 # Change to yes to enable challenge-response passwords (beware issues with
 # some PAM modules and threads)
-ChallengeResponseAuthentication no
+KbdInteractiveAuthentication no

 # Kerberos options
 #KerberosAuthentication no
@@ -77,13 +81,13 @@ ChallengeResponseAuthentication no

 # Set this to 'yes' to enable PAM authentication, account processing,
 # and session processing. If this is enabled, PAM authentication will
-# be allowed through the ChallengeResponseAuthentication and
+# be allowed through the KbdInteractiveAuthentication and
 # PasswordAuthentication.  Depending on your PAM configuration,
-# PAM authentication via ChallengeResponseAuthentication may bypass
-# the setting of "PermitRootLogin without-password".
+# PAM authentication via KbdInteractiveAuthentication may bypass
+# the setting of "PermitRootLogin prohibit-password".
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
-# and ChallengeResponseAuthentication to 'no'.
+# and KbdInteractiveAuthentication to 'no'.
 UsePAM yes

 #AllowAgentForwarding yes
@@ -101,7 +105,7 @@ PrintMotd no
 #ClientAliveInterval 0
 #ClientAliveCountMax 3
 #UseDNS no
-#PidFile /var/run/sshd.pid
+#PidFile /run/sshd.pid
 #MaxStartups 10:30:100
 #PermitTunnel no
 #ChrootDirectory none
@@ -114,7 +118,7 @@ PrintMotd no
 AcceptEnv LANG LC_*

 # override default of no subsystems
-Subsystem sftp	/usr/lib/openssh/sftp-server
+Subsystem	sftp	/usr/lib/openssh/sftp-server

 # Example of overriding settings on a per-user basis
 #Match User anoncvs
@@ -122,14 +126,16 @@ Subsystem sftp	/usr/lib/openssh/sftp-server
 #	AllowTcpForwarding no
 #	PermitTTY no
 #	ForceCommand cvs server
-PasswordAuthentication yes

-# Originally from: https://stribika.github.io/2015/01/04/secure-secure-shell.html
-# ... but with ciphers and MACs with < 256 bits removed, as NSA's Suite B now
-# does away with these! See: https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
+# Based on the ssh-audit profile for OpenSSH 9.2, but with but with all algos
+# with less than 256 bits removed, as NSA's Suite B removed them years ago and
+# the new (2018) CNSA suite is 256 bits and up.
+#
+# See: https://github.com/jtesta/ssh-audit/blob/master/src/ssh_audit/policy.py
+# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
 MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
-KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
+KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256

 {% if ssh_allowed_users is defined and ssh_allowed_users %}
 # Is there a list of allowed users?
--- a/roles/common/templates/sysctl_Debian.j2
+++ b/roles/common/templates/sysctl_Debian.j2
@@ -90,7 +90,7 @@ net.ipv4.tcp_wmem = 4096 65536 16777216
 # increase the length of the processor input queue
 net.core.netdev_max_backlog = 30000
 {# kernels after 2.6.32 don't have buggy cubic #}
-{% if ansible_kernel < "2.6.33" %}
+{% if ansible_facts["kernel"] < "2.6.33" %}
 # recommended default congestion control is htcp
 net.ipv4.tcp_congestion_control=htcp
 {% endif %}
@@ -98,7 +98,7 @@ net.ipv4.tcp_congestion_control=htcp
 #net.ipv4.tcp_mtu_probing=1

 {# disable iptables on bridge interfaces on VM hosts #}
-{% if ansible_virtualization_role == "host" %}
+{% if ansible_facts["virtualization_role"] == "host" %}
 net.bridge.bridge-nf-call-ip6tables = 0
 net.bridge.bridge-nf-call-iptables = 0
 net.bridge.bridge-nf-call-arptables = 0
--- a/roles/common/templates/sysctl_Ubuntu.j2
+++ b/roles/common/templates/sysctl_Ubuntu.j2
@@ -1,100 +0,0 @@
-#
-# /etc/sysctl.conf - Configuration file for setting system variables
-# See /etc/sysctl.d/ for additional system variables
-# See sysctl.conf (5) for information.
-#
-
-#kernel.domainname = example.com
-
-# Uncomment the following to stop low-level messages on console
-#kernel.printk = 3 4 1 3
-
-##############################################################3
-# Functions previously found in netbase
-#
-
-# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
-# Turn on Source Address Verification in all interfaces to
-# prevent some spoofing attacks
-#net.ipv4.conf.default.rp_filter=1
-#net.ipv4.conf.all.rp_filter=1
-
-# Uncomment the next line to enable TCP/IP SYN cookies
-# See http://lwn.net/Articles/277146/
-# Note: This may impact IPv6 TCP sessions too
-#net.ipv4.tcp_syncookies=1
-
-# Uncomment the next line to enable packet forwarding for IPv4
-#net.ipv4.ip_forward=1
-
-# Uncomment the next line to enable packet forwarding for IPv6
-#  Enabling this option disables Stateless Address Autoconfiguration
-#  based on Router Advertisements for this host
-#net.ipv6.conf.all.forwarding=1
-
-
-###################################################################
-# Additional settings - these settings can improve the network
-# security of the host and prevent against some network attacks
-# including spoofing attacks and man in the middle attacks through
-# redirection. Some network environments, however, require that these
-# settings are disabled so review and enable them as needed.
-#
-# Do not accept ICMP redirects (prevent MITM attacks)
-#net.ipv4.conf.all.accept_redirects = 0
-#net.ipv6.conf.all.accept_redirects = 0
-# _or_
-# Accept ICMP redirects only for gateways listed in our default
-# gateway list (enabled by default)
-# net.ipv4.conf.all.secure_redirects = 1
-#
-# Do not send ICMP redirects (we are not a router)
-#net.ipv4.conf.all.send_redirects = 0
-#
-# Do not accept IP source route packets (we are not a router)
-#net.ipv4.conf.all.accept_source_route = 0
-#net.ipv6.conf.all.accept_source_route = 0
-#
-# Log Martian Packets
-#net.ipv4.conf.all.log_martians = 1
-#
-
-# CIS Benchmark Adjustments
-# See: https://github.com/alanorth/securekickstarts
-kernel.randomize_va_space = 2 
-net.ipv4.ip_forward = 0 
-net.ipv4.conf.all.send_redirects = 0 
-net.ipv4.conf.default.send_redirects = 0 
-net.ipv4.conf.all.accept_source_route = 0 
-net.ipv4.conf.default.accept_source_route = 0 
-net.ipv4.conf.all.accept_redirects = 0 
-net.ipv4.conf.default.accept_redirects = 0 
-net.ipv4.conf.all.secure_redirects = 0 
-net.ipv4.conf.default.secure_redirects = 0 
-net.ipv4.conf.all.log_martians = 1 
-net.ipv4.conf.default.log_martians = 1 
-net.ipv4.icmp_echo_ignore_broadcasts = 1 
-net.ipv4.icmp_ignore_bogus_error_responses = 1 
-net.ipv4.conf.all.rp_filter = 1 
-net.ipv4.conf.default.rp_filter = 1 
-net.ipv4.tcp_syncookies = 1
-
-# TCP stuff
-# See: http://fasterdata.es.net/host-tuning/linux/
-# increase TCP max buffer size settable using setsockopt()
-net.core.rmem_max = 16777216 
-net.core.wmem_max = 16777216 
-# increase Linux autotuning TCP buffer limit 
-net.ipv4.tcp_rmem = 4096 87380 16777216
-net.ipv4.tcp_wmem = 4096 65536 16777216
-# increase the length of the processor input queue
-net.core.netdev_max_backlog = 30000
-# recommended for hosts with jumbo frames enabled
-#net.ipv4.tcp_mtu_probing=1
-
-# increase quadruplets (src ip, src port, dest ip, dest port)
-# see: http://vincent.bernat.im/en/blog/2014-tcp-time-wait-state-linux.html
-net.ipv4.ip_local_port_range = 10240 65535
-# recommended for web servers, especially if running SPDY
-# see: http://www.chromium.org/spdy/spdy-best-practices
-net.ipv4.tcp_slow_start_after_idle = 0
--- a/roles/common/templates/tarsnap_sources.list.j2
+++ b/roles/common/templates/tarsnap_sources.list.j2
@@ -1 +1 @@
-deb [arch=amd64] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./
+deb [arch=amd64 signed-by=/etc/apt/keyrings/tarsnap-deb-packaging-key.asc] https://pkg.tarsnap.com/deb/{{ ansible_facts["distribution_release"] }} ./
--- a/roles/common/templates/update-firehol-nftables.sh.j2
+++ b/roles/common/templates/update-firehol-nftables.sh.j2
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+#
+# update-firehol-nftables.sh v0.0.1
+#
+# Download FireHOL lists and load them into nftables sets.
+# 
+# See: https://iplists.firehol.org/
+#
+# Copyright (C) 2025 Alan Orth
+#
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Exit on first error
+set -o errexit
+
+firehol_level1_ipv4_set_path=/etc/nftables/firehol_level1-ipv4.nft
+
+function download() {
+    echo "Downloading $1"
+    wget -q -O - "https://iplists.firehol.org/files/$1" > "$1"
+}
+
+download firehol_level1.netset
+
+if [[ -f "firehol_level1.netset" ]]; then
+    echo "Processing FireHOL Level 1 list"
+
+    firehol_level1_ipv4_list_temp=$(mktemp)
+    firehol_level1_ipv4_set_temp=$(mktemp)
+
+    # Filter blank lines, comments, and bogons we use inside the LAN, DMZ, and
+    # for local services like systemd-resolved and others on localhost. Ideally
+    # these are blocked already at the WAN side by network administrators.
+    cat firehol_level1.netset \
+        | sed \
+            -e '/^$/d' \
+            -e '/^#.*/d' \
+            -e '/^127\.0\.0\.0\/8/d' \
+        > "$firehol_level1_ipv4_list_temp"
+
+    echo "Building firehol_level1-ipv4 set"
+    cat << NFT_HEAD > "$firehol_level1_ipv4_set_temp"
+#!/usr/sbin/nft -f
+
+define FIREHOL_LEVEL1_IPV4 = {
+NFT_HEAD
+
+    while read -r network; do
+        # nftables doesn't mind if the last element in the set has a trailing
+        # comma so we don't need to do anything special here.
+        echo "$network," >> "$firehol_level1_ipv4_set_temp"
+    done < $firehol_level1_ipv4_list_temp
+
+    echo "}" >> "$firehol_level1_ipv4_set_temp"
+
+    install -m 0600 "$firehol_level1_ipv4_set_temp" "$firehol_level1_ipv4_set_path"
+
+    rm -f "$firehol_level1_ipv4_list_temp" "$firehol_level1_ipv4_set_temp"
+fi
+
+echo "Restarting nftables"
+
+/usr/bin/systemctl restart nftables.service
+
+rm -v firehol_level1.netset
--- a/roles/mariadb/defaults/main.yml
+++ b/roles/mariadb/defaults/main.yml
@@ -1,15 +1,4 @@
 ---
-# ansible.builtin.file: roles/mariadb/defaults/main.yml
-#
-# Based on my running of mysqltuner.pl on a host with three WordPress databases
-#
-
-# default is 128MB but is a waste because it seems only the mysql table uses it
-key_buffer_size: 8M
-
-# default is 128MB but is a waste because it seems only information_schema uses
-# AriaDB, see: https://mariadb.com/kb/en/mariadb/aria-system-variables
-aria_pagecache_buffer_size: 8M

 # default is 128M, but set to at least the size of your InnoDB data
 innodb_buffer_pool_size: 256M
@@ -22,10 +11,6 @@ mariadb_login_unix_socket: /run/mysqld/mysqld.sock
 # default is 100 but the max I've seen used is 5, so let's reduce it
 max_connections: 33

-# disable the query cache by default
-query_cache_size: 0
-query_cache_type: 0
-
 # mysqltuner says we should use larger than 32M on our setup
 tmp_table_size: 64M
 max_heap_table_size: 64M
--- a/roles/mariadb/handlers/main.yml
+++ b/roles/mariadb/handlers/main.yml
@@ -1,5 +1,7 @@
 ---
 - name: restart mariadb
-  ansible.builtin.systemd: name=mariadb state=restarted
+  ansible.builtin.systemd_service:
+    name: mariadb
+    state: restarted

 # vim: set ts=2 sw=2:
--- a/roles/mariadb/tasks/main.yml
+++ b/roles/mariadb/tasks/main.yml
@@ -1,57 +1,63 @@
 ---
- name: Add GPG key for MariaDB repo
-  ansible.builtin.apt_key: id=0x177F4010FE56CA3336300305F1656F24C74CD1D8 url=https://mariadb.org/mariadb_release_signing_key.asc
-  register: add_mariadb_apt_key
-  tags: mariadb, packages
-
- name: Add MariaDB 10.5 repo
-  ansible.builtin.template: src=mariadb.list.j2 dest=/etc/apt/sources.list.d/mariadb.list owner=root group=root mode=0644
-  register: add_mariadb_apt_repository
-  tags: mariadb, packages
-
- name: Update apt cache
-  ansible.builtin.apt:
-    update_cache: true
-  when:
-    add_mariadb_apt_key is changed or
-    add_mariadb_apt_repository is changed
-
 - name: Install mariadb-server
-  ansible.builtin.apt: name={{ item }} state=present cache_valid_time=3600
-  loop:
-    - mariadb-server
-    - python3-pymysql # for ansible
+  ansible.builtin.apt:
+    name: [mariadb-server, python3-pymysql]
+    state: present
+    cache_valid_time: 3600
  tags: mariadb, packages

- name: Create system my.cnf
-  ansible.builtin.template: src=my.cnf.j2 dest=/etc/mysql/my.cnf owner=root group=root mode=0644
+- name: Add MariaDB configuration overrides
+  ansible.builtin.template:
+    src: 70-local.cnf.j2
+    dest: /etc/mysql/mariadb.conf.d/70-local.cnf
+    owner: root
+    group: root
+    mode: "0644"
  notify:
    - restart mariadb
  tags: mariadb

 # See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_user_module.html
 - name: Update MariaDB root password for all root accounts
-  community.mysql.mysql_user: name=root host={{ item }} password={{ mariadb_root_password }} login_unix_socket={{ mariadb_login_unix_socket }}
+  community.mysql.mysql_user:
+    name: root
+    host: "{{ item }}"
+    password: "{{ mariadb_root_password }}"
+    login_unix_socket: "{{ mariadb_login_unix_socket }}"
  loop:
    - 127.0.0.1
    - ::1
  tags: mariadb

 - name: Create .my.conf file with root credentials
-  ansible.builtin.template: src=.my.cnf.j2 dest=/root/.my.cnf owner=root mode=0600
+  ansible.builtin.template:
+    src: .my.cnf.j2
+    dest: /root/.my.cnf
+    owner: root
+    mode: "0600"
  tags: mariadb

 # See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_db_module.html
 - name: Create MariaDB database(s)
-  community.mysql.mysql_db: db={{ item.name }} state=present encoding=utf8mb4 login_unix_socket={{ mariadb_login_unix_socket }}
-  loop: "{{ mariadb_databases }}"
  when: mariadb_databases is defined
+  community.mysql.mysql_db:
+    db: "{{ item.name }}"
+    state: present
+    encoding: utf8mb4
+    login_unix_socket: "{{ mariadb_login_unix_socket }}"
+  loop: "{{ mariadb_databases }}"
  tags: mariadb

 - name: Create MariaDB user(s)
-  community.mysql.mysql_user: name={{ item.user }} password={{ item.pass }} priv={{ item.name }}.*:ALL host=127.0.0.1 state=present login_unix_socket={{ mariadb_login_unix_socket }}
-  loop: "{{ mariadb_databases }}"
  when: mariadb_databases is defined
+  community.mysql.mysql_user:
+    name: "{{ item.user }}"
+    password: "{{ item.pass }}"
+    priv: "{{ item.name }}.*:ALL"
+    host: 127.0.0.1
+    state: present
+    login_unix_socket: "{{ mariadb_login_unix_socket }}"
+  loop: "{{ mariadb_databases }}"
  tags: mariadb

 # vim: set ts=2 sw=2:
--- a/roles/mariadb/templates/70-local.cnf.j2
+++ b/roles/mariadb/templates/70-local.cnf.j2
@@ -0,0 +1,10 @@
+{{ ansible_managed | comment }}
+
+[mysqld]
+# don't resolve connection IPs to hostnames (make sure user accounts are using
+# IPs instead of "localhost")
+skip-name-resolve=1
+max_connections		= {{ max_connections }}
+tmp_table_size		= {{ tmp_table_size }}
+max_heap_table_size	= {{ max_heap_table_size }}
+innodb_buffer_pool_size	= {{ innodb_buffer_pool_size }}
--- a/roles/mariadb/templates/mariadb.list.j2
+++ b/roles/mariadb/templates/mariadb.list.j2
@@ -1,3 +0,0 @@
-{{ ansible_managed | comment }}
-
-deb [arch=amd64] https://dlm.mariadb.com/repo/mariadb-server/10.5/repo/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} main
--- a/roles/mariadb/templates/my.cnf.j2
+++ b/roles/mariadb/templates/my.cnf.j2
@@ -1,196 +0,0 @@
-{{ ansible_managed | comment }}
-
-# MariaDB database server configuration file.
-#
-# You can copy this file to one of:
-# - "/etc/mysql/my.cnf" to set global options,
-# - "~/.my.cnf" to set user-specific options.
-# 
-# One can use all long options that the program supports.
-# Run program with --help to get a list of available options and with
-# --print-defaults to see which it would actually understand and use.
-#
-# For explanations see
-# http://dev.mysql.com/doc/mysql/en/server-system-variables.html
-
-# This will be passed to all mysql clients
-# It has been reported that passwords should be enclosed with ticks/quotes
-# escpecially if they contain "#" chars...
-# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
-[client]
-port		= 3306
-socket		= /run/mysqld/mysqld.sock
-
-# Here is entries for some specific programs
-# The following values assume you have at least 32M ram
-
-# This was formally known as [safe_mysqld]. Both versions are currently parsed.
-[mysqld_safe]
-socket		= /run/mysqld/mysqld.sock
-nice		= 0
-
-[mysqld]
-#
-# * Basic Settings
-#
-user		= mysql
-pid-file	= /run/mysqld/mysqld.pid
-socket		= /run/mysqld/mysqld.sock
-port		= 3306
-basedir		= /usr
-datadir		= /var/lib/mysql
-tmpdir		= /tmp
-lc_messages_dir	= /usr/share/mysql
-lc_messages	= en_US
-skip-external-locking
-#
-# Instead of skip-networking the default is now to listen only on
-# localhost which is more compatible and is not less secure.
-bind-address		= 127.0.0.1
-
-# don't resolve connection IPs to hostnames (make sure user accounts are using
-# IPs instead of "localhost")
-skip-name-resolve=1
-#
-# * Fine Tuning
-#
-max_connections		= {{ max_connections }}
-connect_timeout		= 5
-wait_timeout		= 600
-max_allowed_packet	= 16M
-thread_cache_size       = 128
-sort_buffer_size	= 4M
-bulk_insert_buffer_size	= 16M
-tmp_table_size		= {{ tmp_table_size }}
-max_heap_table_size	= {{ max_heap_table_size }}
-#
-# * MyISAM
-#
-# This replaces the startup script and checks MyISAM tables if needed
-# the first time they are touched. On error, make copy and try a repair.
-myisam_recover_options = BACKUP
-key_buffer_size		= {{ key_buffer_size }}
-#open-files-limit	= 2000
-table_open_cache	= 400
-myisam_sort_buffer_size	= 512M
-concurrent_insert	= 2
-read_buffer_size	= 2M
-read_rnd_buffer_size	= 1M
-#
-# * Query Cache Configuration
-#
-query_cache_limit		= 128K
-query_cache_size		= {{ query_cache_size }}
-query_cache_type		= {{ query_cache_type }}
-#
-# * Logging and Replication
-#
-# Both location gets rotated by the cronjob.
-# Be aware that this log type is a performance killer.
-# As of 5.1 you can enable the log at runtime!
-#general_log_file        = /var/log/mysql/mysql.log
-#general_log             = 1
-#
-# Error logging goes to syslog due to /etc/mysql/conf.d/mysqld_safe_syslog.cnf.
-#
-# we do want to know about network errors and such
-log_warnings		= 2
-#
-# Enable the slow query log to see queries with especially long duration
-#slow_query_log[={0|1}]
-slow_query_log_file	= /var/log/mysql/mariadb-slow.log
-long_query_time = 10
-#log_slow_rate_limit	= 1000
-log_slow_verbosity	= query_plan
-
-#log-queries-not-using-indexes
-#log_slow_admin_statements
-#
-# The following can be used as easy to replay backup logs or for replication.
-# note: if you are setting up a replication slave, see README.Debian about
-#       other settings you may need to change.
-#server-id		= 1
-#report_host		= master1
-#auto_increment_increment = 2
-#auto_increment_offset	= 1
-log_bin			= /var/log/mysql/mariadb-bin
-log_bin_index		= /var/log/mysql/mariadb-bin.index
-# not fab for performance, but safer
-#sync_binlog		= 1
-expire_logs_days	= 10
-max_binlog_size         = 100M
-# slaves
-#relay_log		= /var/log/mysql/relay-bin
-#relay_log_index	= /var/log/mysql/relay-bin.index
-#relay_log_info_file	= /var/log/mysql/relay-bin.info
-#log_slave_updates
-#read_only
-#
-# If applications support it, this stricter sql_mode prevents some
-# mistakes like inserting invalid dates etc.
-#sql_mode		= NO_ENGINE_SUBSTITUTION,TRADITIONAL
-#
-# * InnoDB
-#
-# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
-# Read the manual for more InnoDB related options. There are many!
-default_storage_engine	= InnoDB
-# you can't just change log file size, requires special procedure
-#innodb_log_file_size	= 50M
-innodb_buffer_pool_size	= {{ innodb_buffer_pool_size }}
-innodb_log_buffer_size	= 8M
-innodb_file_per_table	= 1
-innodb_open_files	= 400
-innodb_io_capacity	= 400
-innodb_flush_method	= O_DIRECT
-
-aria_pagecache_buffer_size = {{ aria_pagecache_buffer_size }}
-#
-# * Security Features
-#
-# Read the manual, too, if you want chroot!
-# chroot = /var/lib/mysql/
-#
-# For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
-#
-# ssl-ca=/etc/mysql/cacert.pem
-# ssl-cert=/etc/mysql/server-cert.pem
-# ssl-key=/etc/mysql/server-key.pem
-
-#
-# * Galera-related settings
-#
-[galera]
-# Mandatory settings
-#wsrep_on=ON
-#wsrep_provider=
-#wsrep_cluster_address=
-#binlog_format=row
-#default_storage_engine=InnoDB
-#innodb_autoinc_lock_mode=2
-#
-# Allow server to accept connections on all interfaces.
-#
-#bind-address=0.0.0.0
-#
-# Optional setting
-#wsrep_slave_threads=1
-#innodb_flush_log_at_trx_commit=0
-
-[mysqldump]
-quick
-quote-names
-max_allowed_packet	= 16M
-
-[mysql]
-#no-auto-rehash	# faster start of mysql but no tab completion
-
-[isamchk]
-key_buffer		= 16M
-
-#
-# * IMPORTANT: Additional settings that can override those from this file!
-#   The files must end with '.cnf', otherwise they'll be ignored.
-#
-!include /etc/mysql/mariadb.cnf
-!includedir /etc/mysql/conf.d/
--- a/roles/munin/handlers/main.yml
+++ b/roles/munin/handlers/main.yml
@@ -1,4 +1,4 @@
 ---
 # ansible.builtin.file: roles/munin/handlers/main.yml
 - name: restart munin-node
-  ansible.builtin.systemd: name=munin-node state=restarted
+  ansible.builtin.systemd_service: name=munin-node state=restarted
--- a/roles/munin/tasks/munin-node.yml
+++ b/roles/munin/tasks/munin-node.yml
@@ -1,16 +1,22 @@
 ---
 - name: Install munin-node
-  ansible.builtin.apt: name=munin-node state=present
+  ansible.builtin.apt:
+    name: munin-node
+    state: present
  tags: packages

 # some nice things to have for munin-node on Ubuntu
 # libwww-perl: for munin's nginx_status check
 - name: Install munin-node deps
-  ansible.builtin.apt: name=libwww-perl state=present
+  ansible.builtin.apt:
+    name: libwww-perl
+    state: present
  tags: packages

 - name: Create munin-node.conf
-  ansible.builtin.template: src=munin-node.conf.j2 dest=/etc/munin/munin-node.conf
+  ansible.builtin.template:
+    src: munin-node.conf.j2
+    dest: /etc/munin/munin-node.conf
  notify:
    - restart munin-node

@@ -20,6 +26,9 @@
    - restart munin-node

 - name: Start munin-node
-  ansible.builtin.systemd: name=munin-node state=started enabled=true
+  ansible.builtin.systemd_service:
+    name: munin-node
+    state: started
+    enabled: true

 # vim: set ts=2 sw=2:
--- a/roles/munin/tasks/munin.yml
+++ b/roles/munin/tasks/munin.yml
@@ -1,9 +1,16 @@
 ---
 - name: Install munin package
-  ansible.builtin.apt: name=munin state=present
+  ansible.builtin.apt:
+    name: munin
+    state: present
  tags: packages

 - name: Create munin configuration file
-  ansible.builtin.template: src=munin.conf.j2 dest=/etc/munin/munin.conf owner=root group=root mode=0644
+  ansible.builtin.template:
+    src: munin.conf.j2
+    dest: /etc/munin/munin.conf
+    owner: root
+    group: root
+    mode: "0644"

 # vim: set ts=2 sw=2:
--- a/roles/nginx/defaults/main.yml
+++ b/roles/nginx/defaults/main.yml
@@ -5,20 +5,20 @@
 nginx_confd_path: /etc/nginx/conf.d

 # parent directory of vhost roots
-nginx_root_prefix: /var/www
+nginx_root_prefix: "{{ web_root_prefix }}"

-# 1 hour timeout
-nginx_ssl_session_timeout: 1h
+# 1 day timeout
+nginx_ssl_session_timeout: 1d
 # 10MB -> 40,000 sessions
 nginx_ssl_session_cache: shared:SSL:10m
-# 1400 bytes to fit in one MTU (default is 16k!)
-nginx_ssl_buffer_size: 1400
+nginx_ssl_buffer_size: 4k
 nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
-nginx_ssl_protocols: 'TLSv1.2 TLSv1.3'
+nginx_ssl_protocols: TLSv1.2 TLSv1.3
+nginx_ssl_ecdh_curve: X25519:prime256v1:secp384r1

 # DNS resolvers for OCSP stapling (default to Cloudflare public DNS)
 # See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
-nginx_ssl_stapling_resolver: '1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]'
+nginx_ssl_stapling_resolver: 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]

 # HTTP Strict-Transport-Security header, recommended by Google to be ~1 year
 # in seconds, see: https://hstspreload.org/
@@ -37,8 +37,8 @@ letsencrypt_root: /etc/ssl
 letsencrypt_acme_script_temp: /root/acme.sh
 letsencrypt_acme_home: /root/.acme.sh

-# stable is 1.20.x
-# mainline is 1.21.x
+# stable is 1.26.x
+# mainline is 1.27.x
 nginx_version: mainline

 # vim: set ts=2 sw=2:
--- a/roles/nginx/handlers/main.yml
+++ b/roles/nginx/handlers/main.yml
@@ -1,5 +1,7 @@
 ---
- name: reload nginx
-  ansible.builtin.systemd: name=nginx state=reloaded
+- name: Reload nginx
+  ansible.builtin.systemd_service:
+    name: nginx
+    state: reloaded

 # vim: set ts=2 sw=2:
--- a/roles/nginx/tasks/letsencrypt.yml
+++ b/roles/nginx/tasks/letsencrypt.yml
@@ -1,91 +1,91 @@
 ---
-
 # Use acme.sh instead of certbot because they only support installation via
 # snap now.
- block:
-  - name: Remove certbot
-    ansible.builtin.apt:
-      name: certbot
-      state: absent
-
-  - name: Remove old certbot post and pre hooks for nginx
-    ansible.builtin.file:
-      dest: "{{ item }}"
-      state: absent
-    with_items:
-      - /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
-      - /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
-
-  - name: Check if acme.sh is installed
-    ansible.builtin.stat:
-      path: "{{ letsencrypt_acme_home }}"
-    register: acme_home
-
-  - name: Download acme.sh
-    ansible.builtin.get_url:
-      url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
-      dest: "{{ letsencrypt_acme_script_temp }}"
-      mode: 0700
-    register: acme_download
-    when: not acme_home.stat.exists
-
-  # Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
-  # have to chdir to the /root directory where the script exists or else it
-  # fails. Ansible runs it, but the script can't find itself...).
-  - name: Install acme.sh
-    ansible.builtin.command:
-      cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
-      creates: "{{ letsencrypt_acme_home }}/acme.sh"
-      chdir: /root
-    register: acme_install
-    when: acme_download is changed
-
-  - name: Remove temporary acme.sh script
-    ansible.builtin.file:
-      dest: "{{ letsencrypt_acme_script_temp }}"
-      state: absent
-    when:
-      - acme_install.rc is defined
-      - acme_install.rc == 0
-
-  - name: Set default certificate authority for acme.sh
-    ansible.builtin.command:
-      cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"
-
-  - name: Prepare Let's Encrypt well-known directory
-    ansible.builtin.file:
-      state: directory
-      path: /var/lib/letsencrypt/.well-known
-      owner: root
-      group: nginx
-      mode: g+s
-
-  - name: Copy systemd service to renew Let's Encrypt certs
-    ansible.builtin.template:
-      src: renew-letsencrypt.service.j2
-      dest: /etc/systemd/system/renew-letsencrypt.service
-      mode: 0644
-      owner: root
-      group: root
-
-  - name: Copy systemd timer to renew Let's Encrypt certs
-    ansible.builtin.copy:
-      src: renew-letsencrypt.timer
-      dest: /etc/systemd/system/renew-letsencrypt.timer
-      mode: 0644
-      owner: root
-      group: root
-
-  # always issues daemon-reload just in case the service/timer changed
-  - name: Start and enable systemd timer to renew Let's Encrypt certs
-    ansible.builtin.systemd:
-      name: renew-letsencrypt.timer
-      state: started
-      enabled: true
-      daemon_reload: true
-
-  when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '=='))
-        or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
+- name: Install and configure Let's Encrypt
  tags: letsencrypt
+  when:
+    - ansible_facts["distribution"] == 'Debian'
+    - ansible_facts["distribution_version"] is version('11', '>=')
+  block:
+    - name: Remove certbot
+      ansible.builtin.apt:
+        name: certbot
+        state: absent
+
+    - name: Remove old certbot post and pre hooks for nginx
+      ansible.builtin.file:
+        dest: "{{ item }}"
+        state: absent
+      with_items:
+        - /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
+        - /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
+
+    - name: Check if acme.sh is installed
+      ansible.builtin.stat:
+        path: "{{ letsencrypt_acme_home }}"
+      register: acme_home
+
+    - name: Download acme.sh
+      when: not acme_home.stat.exists
+      ansible.builtin.get_url:
+        url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
+        dest: "{{ letsencrypt_acme_script_temp }}"
+        mode: "0700"
+      register: acme_download
+
+    # Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
+    # have to chdir to the /root directory where the script exists or else it
+    # fails. Ansible runs it, but the script can't find itself...).
+    - name: Install acme.sh
+      when: acme_download is changed
+      ansible.builtin.command:
+        cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
+        creates: "{{ letsencrypt_acme_home }}/acme.sh"
+        chdir: /root
+      register: acme_install
+
+    - name: Remove temporary acme.sh script
+      when:
+        - acme_install.rc is defined
+        - acme_install.rc == 0
+      ansible.builtin.file:
+        dest: "{{ letsencrypt_acme_script_temp }}"
+        state: absent
+
+    - name: Set default certificate authority for acme.sh
+      ansible.builtin.command:
+        cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"
+
+    - name: Prepare Let's Encrypt well-known directory
+      ansible.builtin.file:
+        state: directory
+        path: /var/lib/letsencrypt/.well-known
+        owner: root
+        group: nginx
+        mode: g+s
+
+    - name: Copy systemd service to renew Let's Encrypt certs
+      ansible.builtin.template:
+        src: renew-letsencrypt.service.j2
+        dest: /etc/systemd/system/renew-letsencrypt.service
+        mode: "0644"
+        owner: root
+        group: root
+
+    - name: Copy systemd timer to renew Let's Encrypt certs
+      ansible.builtin.copy:
+        src: renew-letsencrypt.timer
+        dest: /etc/systemd/system/renew-letsencrypt.timer
+        mode: "0644"
+        owner: root
+        group: root
+
+    # always issues daemon-reload just in case the service/timer changed
+    - name: Start and enable systemd timer to renew Let's Encrypt certs
+      ansible.builtin.systemd_service:
+        name: renew-letsencrypt.timer
+        state: started
+        enabled: true
+        daemon_reload: true

 # vim: set ts=2 sw=2:
--- a/roles/nginx/tasks/main.yml
+++ b/roles/nginx/tasks/main.yml
@@ -1,72 +1,120 @@
 ---
- name: Add nginx.org apt signing key
-  ansible.builtin.apt_key: id=0x573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 url=https://nginx.org/keys/nginx_signing.key state=present
-  register: add_nginx_apt_key
-  tags: nginx, packages
+- name: Download nginx apt signing key
+  ansible.builtin.get_url:
+    url: https://nginx.org/keys/nginx_signing.key
+    dest: /usr/share/keyrings/nginx_signing.key
+    owner: root
+    group: root
+    mode: "0644"
+    checksum: sha256:55385da31d198fa6a5012d40ae98ecb272a6c4e8fffffba94719ffd3e87de37a
+  register: download_nginx_signing_key
+  tags:
+    - packages
+    - nginx

 - name: Add nginx.org repo
-  ansible.builtin.template: src=nginx_org_sources.list.j2 dest=/etc/apt/sources.list.d/nginx_org_sources.list owner=root group=root mode=0644
+  ansible.builtin.template:
+    src: nginx_org_sources.list.j2
+    dest: /etc/apt/sources.list.d/nginx_org_sources.list
+    owner: root
+    group: root
+    mode: "0644"
  register: add_nginx_apt_repository
-  tags: nginx, packages
+  tags:
+    - nginx
+    - packages

 - name: Update apt cache
-  ansible.builtin.apt:
+  when: (download_nginx_signing_key.status_code is defined and download_nginx_signing_key.status_code == 200) or add_nginx_apt_repository is changed
+  ansible.builtin.apt: # noqa no-handler
    update_cache: true
-  when:
-    add_nginx_apt_key is changed or
-    add_nginx_apt_repository is changed

 - name: Install nginx
-  ansible.builtin.apt: pkg=nginx cache_valid_time=3600 state=present
-  tags: nginx, packages
+  ansible.builtin.apt:
+    pkg: nginx
+    cache_valid_time: 3600
+    state: present
+  tags:
+    - nginx
+    - packages

 - name: Copy nginx.conf
-  ansible.builtin.template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf mode=0644 owner=root group=root
+  ansible.builtin.template:
+    src: nginx.conf.j2
+    dest: /etc/nginx/nginx.conf
+    mode: "0644"
+    owner: root
+    group: root
  notify:
-    - reload nginx
+    - Reload nginx
  tags: nginx

 - name: Copy extra nginx configs
-  ansible.builtin.copy: src={{ item }} dest=/etc/nginx/{{ item }} mode=0644 owner=root group=root
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: /etc/nginx/{{ item }}
+    mode: "0644"
+    owner: root
+    group: root
  loop:
    - extra-security.conf
    - fastcgi_cache
  notify:
-    - reload nginx
+    - Reload nginx
  tags: nginx

 - name: Remove default nginx vhost
-  ansible.builtin.file: path=/etc/nginx/conf.d/default.conf state=absent
+  ansible.builtin.file:
+    path: /etc/nginx/conf.d/default.conf
+    state: absent
  tags: nginx

 - name: Create fastcgi cache dir
-  ansible.builtin.file: path=/var/cache/nginx/cached/fastcgi state=directory owner=nginx group=nginx mode=0755
+  ansible.builtin.file:
+    path: /var/cache/nginx/cached/fastcgi
+    state: directory
+    owner: nginx
+    group: nginx
+    mode: "0755"
  tags: nginx

 - name: Configure nginx virtual hosts
-  ansible.builtin.include_tasks: vhosts.yml
  when: nginx_vhosts is defined
+  ansible.builtin.include_tasks: vhosts.yml
  tags: nginx

 - name: Configure WordPress
-  ansible.builtin.include_tasks: wordpress.yml
  when: nginx_vhosts is defined
+  ansible.builtin.include_tasks: wordpress.yml
  tags: wordpress

 - name: Configure blank nginx vhost
-  ansible.builtin.template: src=blank-vhost.conf.j2 dest={{ nginx_confd_path }}/blank-vhost.conf  mode=0644 owner=root group=root
+  ansible.builtin.template:
+    src: blank-vhost.conf.j2
+    dest: "{{ nginx_confd_path }}/blank-vhost.conf"
+    mode: "0644"
+    owner: root
+    group: root
  notify:
-    - reload nginx
+    - Reload nginx
  tags: nginx

 - name: Configure munin vhost
-  ansible.builtin.copy: src=munin.conf dest=/etc/nginx/conf.d/munin.conf mode=0644 owner=root group=root
+  ansible.builtin.copy:
+    src: munin.conf
+    dest: /etc/nginx/conf.d/munin.conf
+    mode: "0644"
+    owner: root
+    group: root
  notify:
-    - reload nginx
+    - Reload nginx
  tags: nginx

 - name: Start and enable nginx service
-  ansible.builtin.systemd: name=nginx state=started enabled=true
+  ansible.builtin.systemd_service:
+    name: nginx
+    state: started
+    enabled: true
  tags: nginx

 - name: Configure Let's Encrypt
--- a/roles/nginx/tasks/vhosts.yml
+++ b/roles/nginx/tasks/vhosts.yml
@@ -1,29 +1,40 @@
 ---
-
- block:
-  - name: Configure https vhosts
-    ansible.builtin.template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root
-    loop: "{{ nginx_vhosts }}"
-    notify:
-      - reload nginx
-
-  - name: Generate self-signed TLS cert
-    ansible.builtin.command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
-    notify:
-      - reload nginx
-
-  - name: Download 4096-bit RFC 7919 dhparams
-    ansible.builtin.get_url:
-      url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
-      checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
-      dest: "{{ nginx_ssl_dhparam }}"
-    notify:
-      - reload nginx
-
-  # TODO: this could break because we can override the document root in host vars
-  - name: Create vhost document roots
-    ansible.builtin.file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx
-    loop: "{{ nginx_vhosts }}"
+- name: Configure https vhosts
  tags: nginx
+  block:
+    - name: Configure https vhosts
+      ansible.builtin.template:
+        src: vhost.conf.j2
+        dest: "{{ nginx_confd_path }}/{{ item.domain_name }}.conf"
+        mode: "0644"
+        owner: root
+        group: root
+      loop: "{{ nginx_vhosts }}"
+      notify:
+        - Reload nginx
+
+    - name: Generate self-signed TLS cert
+      ansible.builtin.command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key
+        -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
+      notify:
+        - Reload nginx
+
+    - name: Download 4096-bit RFC 7919 dhparams
+      ansible.builtin.get_url:
+        url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
+        checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
+        dest: "{{ nginx_ssl_dhparam }}"
+      notify:
+        - Reload nginx
+
+    # TODO: this could break because we can override the document root in host vars
+    - name: Create vhost document roots
+      ansible.builtin.file:
+        path: "{{ nginx_root_prefix }}/{{ item.domain_name }}"
+        state: directory
+        mode: "0755"
+        owner: nginx
+        group: nginx
+      loop: "{{ nginx_vhosts }}"

 # vim: set ts=2 sw=2:
--- a/roles/nginx/tasks/wordpress.yml
+++ b/roles/nginx/tasks/wordpress.yml
@@ -1,19 +1,31 @@
 ---
-
- block:
-  - name: Install WordPress
-    ansible.builtin.git: repo=https://github.com/WordPress/WordPress.git dest={{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress version={{ item.wordpress_version }} depth=1 force=true
-    when:
-      - item.has_wordpress is defined
-      - item.has_wordpress == true
-    loop: "{{ nginx_vhosts }}"
-
-  - name: Fix WordPress directory permissions
-    ansible.builtin.file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory owner=nginx group=nginx recurse=true
-    when:
-      - item.has_wordpress is defined
-      - item.has_wordpress == true
-    loop: "{{ nginx_vhosts }}"
+- name: Install and configure WordPress
  tags: wordpress
+  block:
+    - name: Install WordPress
+      when:
+        - item.has_wordpress is defined
+        - item.has_wordpress
+      ansible.builtin.git:
+        repo: https://github.com/WordPress/WordPress.git
+        dest: "{{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress"
+        version: "{{ item.wordpress_version }}"
+        depth: 1
+        force: true
+      loop: "{{ nginx_vhosts }}"
+      become: true
+      become_user: nginx
+
+    - name: Fix WordPress directory permissions
+      when:
+        - item.has_wordpress is defined
+        - item.has_wordpress
+      ansible.builtin.file:
+        path: "{{ nginx_root_prefix }}/{{ item.domain_name }}"
+        state: directory
+        owner: nginx
+        group: nginx
+        recurse: true
+      loop: "{{ nginx_vhosts }}"

 # vim: set ts=2 sw=2:
--- a/roles/nginx/templates/blank-vhost.conf.j2
+++ b/roles/nginx/templates/blank-vhost.conf.j2
@@ -11,9 +11,11 @@ server {

    return 444;
 }
+
 server {
-    listen 443 ssl http2 default_server;
-    listen [::]:443 ssl http2 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    http2 on;
    server_name _;

    # self-signed "snakeoil" certificate
--- a/roles/nginx/templates/https.j2
+++ b/roles/nginx/templates/https.j2
@@ -27,8 +27,9 @@

    ssl_dhparam {{ nginx_ssl_dhparam }};
    ssl_protocols {{ nginx_ssl_protocols }};
+    ssl_ecdh_curve {{ nginx_ssl_ecdh_curve }};
    ssl_ciphers "{{ tls_cipher_suite }}";
-    ssl_prefer_server_ciphers on;
+    ssl_prefer_server_ciphers off;

    {# OSCP stapling only works with real certs #}
    {% if use_letsencrypt == true or item.tls_certificate_path %}
@@ -38,15 +39,6 @@
    resolver {{ nginx_ssl_stapling_resolver }};
    {% endif %} {# end: use_letsencrypt #}

-    # nginx does not auto-rotate session ticket keys: only a HUP / restart will do so and
-    # when a restart is performed the previous key is lost, which resets all previous
-    # sessions. The fix for this is to setup a manual rotation mechanism:
-    # http://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx
-    #
-    # Note that you'll have to define and rotate the keys securely by yourself. In absence
-    # of such infrastructure, consider turning off session tickets:
-    ssl_session_tickets off;
-
    {% if enable_hsts == true %}
    # Enable this if you want HSTS (recommended, but be careful)
    # Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
--- a/roles/nginx/templates/nginx.conf.j2
+++ b/roles/nginx/templates/nginx.conf.j2
@@ -14,7 +14,6 @@ error_log  /var/log/nginx/error.log warn;
 # The file storing the process ID of the main process
 pid        /var/run/nginx.pid;

-
 events {
    # If you need more connections than this, you start optimizing your OS.
    # That's probably the point at which you hire people who are smarter than you as this is *a lot* of requests.
@@ -23,6 +22,7 @@ events {
 }


+
 http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
--- a/roles/nginx/templates/nginx_org_sources.list.j2
+++ b/roles/nginx/templates/nginx_org_sources.list.j2
@@ -1,19 +1,7 @@
 {{ ansible_managed | comment }}

-{% if ansible_distribution == 'Ubuntu' %}
-
 {% if nginx_version == "stable" %}
-deb [arch=amd64] https://nginx.org/packages/ubuntu/ {{ ansible_distribution_release }} nginx
+deb [arch=amd64 signed-by=/usr/share/keyrings/nginx_signing.key] https://nginx.org/packages/debian/ {{ ansible_facts["distribution_release"] }} nginx
 {% elif nginx_version == "mainline" %}
-deb [arch=amd64] https://nginx.org/packages/mainline/ubuntu/ {{ ansible_distribution_release }} nginx
-{% endif %}
-
-{% elif ansible_distribution == 'Debian' %}
-
-{% if nginx_version == "stable" %}
-deb [arch=amd64] https://nginx.org/packages/debian/ {{ ansible_distribution_release }} nginx
-{% elif nginx_version == "mainline" %}
-deb [arch=amd64] https://nginx.org/packages/mainline/debian/ {{ ansible_distribution_release }} nginx
-{% endif %}
-
+deb [arch=amd64 signed-by=/usr/share/keyrings/nginx_signing.key] https://nginx.org/packages/mainline/debian/ {{ ansible_facts["distribution_release"] }} nginx
 {% endif %}
--- a/roles/nginx/templates/vhost.conf.j2
+++ b/roles/nginx/templates/vhost.conf.j2
@@ -8,6 +8,12 @@
 {% set has_wordpress  = item.has_wordpress | default(false) %}
 {% set needs_php      = item.needs_php | default(false) %}
 {% set has_gitea      = item.has_gitea | default(false) %}
+{# Allow sites to override the document root #}
+{% if item.document_root is defined %}
+{%   set document_root = item.document_root %}
+{% else %}
+{%   set document_root = (nginx_root_prefix, domain_name) | ansible.builtin.path_join %}
+{% endif %}

 # http -> https vhost
 server {
@@ -26,15 +32,11 @@ server {
 }

 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;

-    {# Allow sites to override the nginx document root #}
-    {% if item.document_root is defined %}
-    root {{ item.document_root }};
-    {% else %}
-    root {{ nginx_root_prefix }}/{{ domain_name }};
-    {% endif %}
+    root {{ document_root }};

    {# will only work if the TLS cert covers the domain + aliases, like example.com and www.example.com #}
    server_name {{ domain_name }} {{ domain_aliases }};
@@ -75,15 +77,8 @@ server {
        # See: https://httpoxy.org/
        fastcgi_param HTTP_PROXY "";

-        {# As of Ubuntu 16.04 and Debian 9, the PHP-FPM configs are the same #}
-        {% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('16.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('9', '==')) %}
-        fastcgi_pass unix:/run/php/php7.0-fpm-{{ domain_name }}.sock;
-        {% elif ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==') %}
-        fastcgi_pass unix:/run/php/php7.3-fpm-{{ domain_name }}.sock;
-        {% elif (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==')) %}
-        fastcgi_pass unix:/run/php/php7.4-fpm-{{ domain_name }}.sock;
-        {% else %}
-        fastcgi_pass unix:/var/run/php5-fpm-{{ domain_name }}.sock;
+        {% if ansible_facts["distribution_major_version"] is version('12', '==') %}
+        fastcgi_pass unix:/run/php/php8.2-fpm-{{ domain_name }}.sock;
        {% endif %}
        fastcgi_index index.php;
        # set script path relative to document root in server block
--- a/roles/php-fpm/handlers/main.yml
+++ b/roles/php-fpm/handlers/main.yml
@@ -1,10 +0,0 @@
---
-# For Debian 10
- name: reload php7.3-fpm
-  ansible.builtin.systemd: name=php7.3-fpm state=reloaded
-
-# For Ubuntu 20.04
- name: reload php7.4-fpm
-  ansible.builtin.systemd: name=php7.4-fpm state=reloaded
-
-# vim: set ts=2 sw=2:
--- a/roles/php-fpm/tasks/Debian_10.yml
+++ b/roles/php-fpm/tasks/Debian_10.yml
@@ -1,35 +0,0 @@
---
-
- block:
-  - name: Set php-fpm packages
-    ansible.builtin.set_fact:
-      php_fpm_packages:
-        - php-fpm
-        # for WordPress
-        - php-mysql
-        - php-gd
-        - php-curl
-
-  - name: Install php-fpm and deps
-    ansible.builtin.apt: name={{ php_fpm_packages }} state=present update_cache=true
-
-  # only copy php-fpm config for vhosts that need WordPress or PHP
-  - name: Copy php-fpm pool config
-    ansible.builtin.template: src=php7.3-pool.conf.j2 dest=/etc/php/7.3/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
-    loop: "{{ nginx_vhosts }}"
-    when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
-    notify: reload php7.3-fpm
-
-  - name: Remove default www pool
-    ansible.builtin.file: path=/etc/php/7.3/fpm/pool.d/www.conf state=absent
-    notify: reload php7.3-fpm
-
-  # re-configure php.ini
-  - name: Update php.ini
-    ansible.builtin.template: src=php7.3-php.ini.j2 dest=/etc/php/7.3/fpm/php.ini owner=root group=root mode=0644
-    notify: reload php7.3-fpm
-
-  tags: php-fpm
-  when: install_php == true
-
-# vim: set ts=2 sw=2:
--- a/roles/php-fpm/tasks/Ubuntu_20.04.yml
+++ b/roles/php-fpm/tasks/Ubuntu_20.04.yml
@@ -1,36 +0,0 @@
---
-
- block:
-  - name: Set php-fpm packages
-    ansible.builtin.set_fact:
-      php_fpm_packages:
-        - php7.4-fpm
-        # for WordPress
-        - php7.4-mysql
-        - php7.4-gd
-        - php7.4-curl
-        - php7.4-xml
-
-  - name: Install php-fpm and deps
-    ansible.builtin.apt: name={{ php_fpm_packages }} state=present update_cache=true
-
-  # only copy php-fpm config for vhosts that need WordPress or PHP
-  - name: Copy php-fpm pool config
-    ansible.builtin.template: src=php7.4-pool.conf.j2 dest=/etc/php/7.4/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
-    loop: "{{ nginx_vhosts }}"
-    when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
-    notify: reload php7.4-fpm
-
-  - name: Remove default www pool
-    ansible.builtin.file: path=/etc/php/7.4/fpm/pool.d/www.conf state=absent
-    notify: reload php7.4-fpm
-
-  # re-configure php.ini
-  - name: Update php.ini
-    ansible.builtin.template: src=php7.4-php.ini.j2 dest=/etc/php/7.4/fpm/php.ini owner=root group=root mode=0644
-    notify: reload php7.4-fpm
-
-  tags: php-fpm
-  when: install_php == true
-
-# vim: set ts=2 sw=2:
--- a/roles/php-fpm/tasks/main.yml
+++ b/roles/php-fpm/tasks/main.yml
@@ -1,53 +0,0 @@
---
-# Debian 10 uses php-fpm 7.3
-# Ubuntu 20.04 uses PHP 7.4
-# Debian 11 uses PHP 7.4
-
-# If any of the vhosts on this host need WordPress then we need to install PHP.
-# This uses selectattr to filter the list of dicts in nginx_vhosts, selecting
-# any that have has_wordpress defined, and has_wordpress set to true.
-#
-# See: https://stackoverflow.com/a/31896249
- name: Check if any vhost needs WordPress
-  ansible.builtin.set_fact:
-    install_php: true
-  when: "nginx_vhosts | selectattr('has_wordpress', 'defined') | selectattr('has_wordpress', 'equalto', true) | list | length > 0"
-
-# Legacy, was only for Piwik, but leaving for now.
- name: Check if any vhost needs PHP
-  ansible.builtin.set_fact:
-    install_php: true
-  when: "nginx_vhosts | selectattr('needs_php', 'defined') | selectattr('needs_php', 'equalto', true) | list | length > 0"
-
-# If install_php has not been set, then we assume no vhosts need PHP. This is
-# a bit hacky, but it's the closest we come to an if/then/else.
- name: Set install_php to false
-  ansible.builtin.set_fact:
-    install_php: false
-  when: install_php is not defined
-
- name: Configure php-fpm on Debian 10
-  ansible.builtin.include_tasks: Debian_10.yml
-  when:
-    - ansible_distribution == 'Debian'
-    - ansible_distribution_version is version('10', '==')
-    - install_php == true
-  tags: php-fpm
-
- name: Configure php-fpm on Ubuntu 20.04
-  ansible.builtin.include_tasks: Ubuntu_20.04.yml
-  when:
-    - ansible_distribution == 'Ubuntu'
-    - ansible_distribution_version is version('20.04', '==')
-    - install_php == true
-  tags: php-fpm
-
- name: Configure php-fpm on Debian 11
-  ansible.builtin.include_tasks: Ubuntu_20.04.yml
-  when:
-    - ansible_distribution == 'Debian'
-    - ansible_distribution_version is version('11', '==')
-    - install_php == true
-  tags: php-fpm
-
-# vim: set ts=2 sw=2:
--- a/roles/php_fpm/defaults/main.yml
+++ b/roles/php_fpm/defaults/main.yml
--- a/roles/php_fpm/handlers/main.yml
+++ b/roles/php_fpm/handlers/main.yml
@@ -0,0 +1,14 @@
+---
+# For Debian 12
+- name: Reload php8.2-fpm
+  ansible.builtin.systemd_service:
+    name: php8.2-fpm
+    state: reloaded
+
+# For Debian 13
+- name: Reload php8.4-fpm
+  ansible.builtin.systemd_service:
+    name: php8.4-fpm
+    state: reloaded
+
+# vim: set ts=2 sw=2:
--- a/roles/php_fpm/tasks/main.yml
+++ b/roles/php_fpm/tasks/main.yml
@@ -0,0 +1,90 @@
+---
+# Debian 12 uses PHP 8.2
+# Debian 13 uses PHP 8.4
+
+# If any of the vhosts on this host need WordPress then we need to install PHP.
+# This uses selectattr to filter the list of dicts in nginx_vhosts, selecting
+# any that have has_wordpress defined, and has_wordpress set to true.
+#
+# See: https://stackoverflow.com/a/31896249
+- name: Check if any vhost needs WordPress
+  ansible.builtin.set_fact:
+    install_php: true
+  when: nginx_vhosts | selectattr('has_wordpress', 'defined') | selectattr('has_wordpress', 'equalto', true) | list | length > 0
+
+# Legacy, was only for Piwik, but leaving for now.
+- name: Check if any vhost needs PHP
+  ansible.builtin.set_fact:
+    install_php: true
+  when: nginx_vhosts | selectattr('needs_php', 'defined') | selectattr('needs_php', 'equalto', true) | list | length > 0
+
+# If install_php has not been set, then we assume no vhosts need PHP. This is
+# a bit hacky, but it's the closest we come to an if/then/else.
+- name: Set install_php to false
+  ansible.builtin.set_fact:
+    install_php: false
+  when: install_php is not defined
+
+- name: Install and configure php-fpm
+  tags: php-fpm
+  when: install_php
+  block:
+    - name: Set php-fpm packages
+      ansible.builtin.set_fact:
+        php_fpm_packages:
+          - php-fpm
+          # for WordPress
+          - php-mysql
+          - php-gd
+          - php-curl
+          - php-xml
+
+    - name: Install php-fpm and deps
+      ansible.builtin.apt:
+        name: "{{ php_fpm_packages }}"
+        state: present
+        update_cache: true
+
+    - name: Set PHP version for Debian 12
+      when:
+        - ansible_facts["distribution"] == 'Debian'
+        - ansible_facts["distribution_major_version"] is version('12', '==')
+      ansible.builtin.set_fact:
+        php_version: 8.2
+
+    - name: Set PHP version for Debian 13
+      when:
+        - ansible_facts["distribution"] == 'Debian'
+        - ansible_facts["distribution_major_version"] is version('13', '==')
+      ansible.builtin.set_fact:
+        php_version: 8.4
+
+    # only copy php-fpm config for vhosts that need WordPress or PHP
+    - name: Copy php-fpm pool config
+      ansible.builtin.template:
+        src: php{{ php_version }}-pool.conf.j2
+        dest: /etc/php/{{ php_version }}/fpm/pool.d/{{ item.domain_name }}.conf
+        owner: root
+        group: root
+        mode: "0644"
+      loop: "{{ nginx_vhosts }}"
+      when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
+      notify: Reload php{{ php_version }}-fpm
+
+    - name: Remove default www pool
+      ansible.builtin.file:
+        path: /etc/php/{{ php_version }}/fpm/pool.d/www.conf
+        state: absent
+      notify: Reload php{{ php_version }}-fpm
+
+    # re-configure php.ini
+    - name: Update php.ini
+      ansible.builtin.template:
+        src: php{{ php_version }}-php.ini.j2
+        dest: /etc/php/{{ php_version }}/fpm/php.ini
+        owner: root
+        group: root
+        mode: "0644"
+      notify: Reload php{{ php_version }}-fpm
+
+# vim: set ts=2 sw=2:
--- a/roles/php_fpm/templates/php8.2-php.ini.j2
+++ b/roles/php_fpm/templates/php8.2-php.ini.j2
--- a/roles/php_fpm/templates/php8.2-pool.conf.j2
+++ b/roles/php_fpm/templates/php8.2-pool.conf.j2
@@ -19,11 +19,16 @@
 ; Default Value: none
 ;prefix = /path/to/pools/$pool

-; Unix user/group of processes
-; Note: The user is mandatory. If the group is not set, the default user's group
-;       will be used.
-user = nginx
-group = nginx
+; Unix user/group of the child processes. This can be used only if the master
+; process running user is root. It is set after the child process is created.
+; The user and group can be specified either by their name or by their numeric
+; IDs.
+; Note: If the user is root, the executable needs to be started with
+;       --allow-to-run-as-root option to work.
+; Default Values: The user is set to master process running user by default.
+;                 If the group is not set, the user's group is used.
+user = {{ webserver }}
+group = {{ webserver }}

 ; The address on which to accept FastCGI requests.
 ; Valid syntaxes are:
@@ -35,20 +40,22 @@ group = nginx
 ;                            (IPv6 and IPv4-mapped) on a specific port;
 ;   '/path/to/unix/socket' - to listen on a unix socket.
 ; Note: This value is mandatory.
-listen = /run/php/php7.4-fpm-{{ domain_name }}.sock
+listen = /run/php/php8.2-fpm-{{ domain_name }}.sock

 ; Set listen(2) backlog.
-; Default Value: 511 (-1 on FreeBSD and OpenBSD)
+; Default Value: 511 (-1 on Linux, FreeBSD and OpenBSD)
 ;listen.backlog = 511

 ; Set permissions for unix socket, if one is used. In Linux, read/write
 ; permissions must be set in order to allow connections from a web server. Many
-; BSD-derived systems allow connections regardless of permissions.
-; Default Values: user and group are set as the running user
-;                 mode is set to 0660
-listen.owner = nginx
-listen.group = nginx
+; BSD-derived systems allow connections regardless of permissions. The owner
+; and group can be specified either by name or by their numeric IDs.
+; Default Values: Owner is set to the master process running user. If the group
+;                 is not set, the owner's group is used. Mode is set to 0660.
+listen.owner = {{ webserver }}
+listen.group = {{ webserver }}
 ;listen.mode = 0660
+
 ; When POSIX Access Control Lists are supported you can set them using
 ; these options, value is a comma separated list of user/group names.
 ; When set, listen.owner and listen.group are ignored
@@ -63,6 +70,10 @@ listen.group = nginx
 ; Default Value: any
 ;listen.allowed_clients = 127.0.0.1

+; Set the associated the route table (FIB). FreeBSD only
+; Default Value: -1
+;listen.setfib = 1
+
 ; Specify the nice(2) priority to apply to the pool processes (only if set)
 ; The value can vary from -19 (highest priority) to 20 (lower priority)
 ; Note: - It will only work if the FPM master process is launched as root
@@ -71,8 +82,9 @@ listen.group = nginx
 ; Default Value: no set
 ; process.priority = -19

-; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user
-; or group is differrent than the master process user. It allows to create process
+; Set the process dumpable flag (PR_SET_DUMPABLE prctl for Linux or
+; PROC_TRACE_CTL procctl for FreeBSD) even if the process user
+; or group is different than the master process user. It allows to create process
 ; core dump and ptrace the process for the pool user.
 ; Default Value: no
 ; process.dumpable = yes
@@ -94,6 +106,8 @@ listen.group = nginx
 ;                                    state (waiting to process). If the number
 ;                                    of 'idle' processes is greater than this
 ;                                    number then some children will be killed.
+;             pm.max_spawn_rate    - the maximum number of rate to spawn child
+;                                    processes at once.
 ;  ondemand - no children are created at startup. Children will be forked when
 ;             new requests will connect. The following parameter are used:
 ;             pm.max_children           - the maximum number of children that
@@ -129,6 +143,12 @@ pm.min_spare_servers = 1
 ; Note: Mandatory when pm is set to 'dynamic'
 pm.max_spare_servers = 3

+; The number of rate to spawn child processes at once.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+; Default Value: 32
+;pm.max_spawn_rate = 32
+
 ; The number of seconds after which an idle process will be killed.
 ; Note: Used only when pm is set to 'ondemand'
 ; Default Value: 10s
@@ -141,7 +161,7 @@ pm.max_spare_servers = 3
 ;pm.max_requests = 500

 ; The URI to view the FPM status page. If this value is not set, no URI will be
-; recognized as a status page. It shows the following informations:
+; recognized as a status page. It shows the following information:
 ;   pool                 - the name of the pool;
 ;   process manager      - static, dynamic or ondemand;
 ;   start time           - the date and time FPM has started;
@@ -231,7 +251,7 @@ pm.max_spare_servers = 3
 ;   last request memory:  0
 ;
 ; Note: There is a real-time FPM status monitoring sample web page available
-;       It's available in: /usr/share/php/7.4/fpm/status.html
+;       It's available in: /usr/share/php/8.2/fpm/status.html
 ;
 ; Note: The value must start with a leading slash (/). The value can be
 ;       anything, but it may not be a good idea to use the .php extension or it
@@ -239,6 +259,22 @@ pm.max_spare_servers = 3
 ; Default Value: not set
 ;pm.status_path = /status

+; The address on which to accept FastCGI status request. This creates a new
+; invisible pool that can handle requests independently. This is useful
+; if the main pool is busy with long running requests because it is still possible
+; to get the status before finishing the long running requests.
+;
+; Valid syntaxes are:
+;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
+;                            a specific port;
+;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
+;                            a specific port;
+;   'port'                 - to listen on a TCP socket to all addresses
+;                            (IPv6 and IPv4-mapped) on a specific port;
+;   '/path/to/unix/socket' - to listen on a unix socket.
+; Default Value: value of the listen option
+;pm.status_listen = 127.0.0.1:9001
+
 ; The ping URI to call the monitoring page of FPM. If this value is not set, no
 ; URI will be recognized as a ping page. This could be used to test from outside
 ; that FPM is alive and responding, or to
@@ -271,13 +307,13 @@ pm.max_spare_servers = 3
 ;  %d: time taken to serve the request
 ;      it can accept the following format:
 ;      - %{seconds}d (default)
-;      - %{miliseconds}d
-;      - %{mili}d
+;      - %{milliseconds}d
+;      - %{milli}d
 ;      - %{microseconds}d
 ;      - %{micro}d
 ;  %e: an environment variable (same as $_ENV or $_SERVER)
 ;      it must be associated with embraces to specify the name of the env
-;      variable. Some exemples:
+;      variable. Some examples:
 ;      - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
 ;      - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
 ;  %f: script filename
@@ -306,14 +342,30 @@ pm.max_spare_servers = 3
 ;  %s: status (response code)
 ;  %t: server time the request was received
 ;      it can accept a strftime(3) format:
-;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      The strftime(3) format must be encapsulated in a %{<strftime_format>}t tag
 ;  %T: time the log has been written (the request has finished)
 ;      it can accept a strftime(3) format:
-;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      The strftime(3) format must be encapsulated in a %{<strftime_format>}t tag
 ;  %u: remote user
 ;
 ; Default: "%R - %u %t \"%m %r\" %s"
-;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
+;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{milli}d %{kilo}M %C%%"
+
+; A list of request_uri values which should be filtered from the access log.
+;
+; As a security precuation, this setting will be ignored if:
+;     - the request method is not GET or HEAD; or
+;     - there is a request body; or
+;     - there are query parameters; or
+;     - the response code is outwith the successful range of 200 to 299
+;
+; Note: The paths are matched against the output of the access.format tag "%r".
+;       On common configurations, this may look more like SCRIPT_NAME than the
+;       expected pre-rewrite URI.
+;
+; Default Value: not set
+;access.suppress_path[] = /ping
+;access.suppress_path[] = /health_check.php

 ; The log file for slow requests
 ; Default Value: not set
@@ -372,7 +424,7 @@ pm.max_spare_servers = 3

 ; Redirect worker stdout and stderr into main error log. If not set, stdout and
 ; stderr will be redirected to /dev/null according to FastCGI specs.
-; Note: on highloaded environement, this can cause some delay in the page
+; Note: on highloaded environment, this can cause some delay in the page
 ; process time (several ms).
 ; Default Value: no
 ;catch_workers_output = yes
--- a/roles/php_fpm/templates/php8.4-php.ini.j2
+++ b/roles/php_fpm/templates/php8.4-php.ini.j2
--- a/roles/php_fpm/templates/php8.4-pool.conf.j2
+++ b/roles/php_fpm/templates/php8.4-pool.conf.j2
@@ -19,11 +19,16 @@
 ; Default Value: none
 ;prefix = /path/to/pools/$pool

-; Unix user/group of processes
-; Note: The user is mandatory. If the group is not set, the default user's group
-;       will be used.
-user = nginx
-group = nginx
+; Unix user/group of the child processes. This can be used only if the master
+; process running user is root. It is set after the child process is created.
+; The user and group can be specified either by their name or by their numeric
+; IDs.
+; Note: If the user is root, the executable needs to be started with
+;       --allow-to-run-as-root option to work.
+; Default Values: The user is set to master process running user by default.
+;                 If the group is not set, the user's group is used.
+user = {{ webserver }}
+group = {{ webserver }}

 ; The address on which to accept FastCGI requests.
 ; Valid syntaxes are:
@@ -35,20 +40,22 @@ group = nginx
 ;                            (IPv6 and IPv4-mapped) on a specific port;
 ;   '/path/to/unix/socket' - to listen on a unix socket.
 ; Note: This value is mandatory.
-listen = /run/php/php7.3-fpm-{{ domain_name }}.sock
+listen = /run/php/php8.2-fpm-{{ domain_name }}.sock

 ; Set listen(2) backlog.
-; Default Value: 511 (-1 on FreeBSD and OpenBSD)
+; Default Value: 511 (-1 on Linux, FreeBSD and OpenBSD)
 ;listen.backlog = 511

 ; Set permissions for unix socket, if one is used. In Linux, read/write
 ; permissions must be set in order to allow connections from a web server. Many
-; BSD-derived systems allow connections regardless of permissions.
-; Default Values: user and group are set as the running user
-;                 mode is set to 0660
-listen.owner = nginx
-listen.group = nginx
+; BSD-derived systems allow connections regardless of permissions. The owner
+; and group can be specified either by name or by their numeric IDs.
+; Default Values: Owner is set to the master process running user. If the group
+;                 is not set, the owner's group is used. Mode is set to 0660.
+listen.owner = {{ webserver }}
+listen.group = {{ webserver }}
 ;listen.mode = 0660
+
 ; When POSIX Access Control Lists are supported you can set them using
 ; these options, value is a comma separated list of user/group names.
 ; When set, listen.owner and listen.group are ignored
@@ -63,6 +70,10 @@ listen.group = nginx
 ; Default Value: any
 ;listen.allowed_clients = 127.0.0.1

+; Set the associated the route table (FIB). FreeBSD only
+; Default Value: -1
+;listen.setfib = 1
+
 ; Specify the nice(2) priority to apply to the pool processes (only if set)
 ; The value can vary from -19 (highest priority) to 20 (lower priority)
 ; Note: - It will only work if the FPM master process is launched as root
@@ -71,8 +82,9 @@ listen.group = nginx
 ; Default Value: no set
 ; process.priority = -19

-; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user
-; or group is differrent than the master process user. It allows to create process
+; Set the process dumpable flag (PR_SET_DUMPABLE prctl for Linux or
+; PROC_TRACE_CTL procctl for FreeBSD) even if the process user
+; or group is different than the master process user. It allows to create process
 ; core dump and ptrace the process for the pool user.
 ; Default Value: no
 ; process.dumpable = yes
@@ -94,6 +106,8 @@ listen.group = nginx
 ;                                    state (waiting to process). If the number
 ;                                    of 'idle' processes is greater than this
 ;                                    number then some children will be killed.
+;             pm.max_spawn_rate    - the maximum number of rate to spawn child
+;                                    processes at once.
 ;  ondemand - no children are created at startup. Children will be forked when
 ;             new requests will connect. The following parameter are used:
 ;             pm.max_children           - the maximum number of children that
@@ -116,7 +130,7 @@ pm.max_children = 5

 ; The number of child processes created on startup.
 ; Note: Used only when pm is set to 'dynamic'
-; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
+; Default Value: (min_spare_servers + max_spare_servers) / 2
 pm.start_servers = 2

 ; The desired minimum number of idle server processes.
@@ -129,6 +143,12 @@ pm.min_spare_servers = 1
 ; Note: Mandatory when pm is set to 'dynamic'
 pm.max_spare_servers = 3

+; The number of rate to spawn child processes at once.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+; Default Value: 32
+;pm.max_spawn_rate = 32
+
 ; The number of seconds after which an idle process will be killed.
 ; Note: Used only when pm is set to 'ondemand'
 ; Default Value: 10s
@@ -141,7 +161,7 @@ pm.max_spare_servers = 3
 ;pm.max_requests = 500

 ; The URI to view the FPM status page. If this value is not set, no URI will be
-; recognized as a status page. It shows the following informations:
+; recognized as a status page. It shows the following information:
 ;   pool                 - the name of the pool;
 ;   process manager      - static, dynamic or ondemand;
 ;   start time           - the date and time FPM has started;
@@ -211,8 +231,8 @@ pm.max_spare_servers = 3
 ;                          it's always 0 if the process is not in Idle state
 ;                          because memory calculation is done when the request
 ;                          processing has terminated;
-; If the process is in Idle state, then informations are related to the
-; last request the process has served. Otherwise informations are related to
+; If the process is in Idle state, then information is related to the
+; last request the process has served. Otherwise information is related to
 ; the current request being served.
 ; Example output:
 ;   ************************
@@ -231,7 +251,7 @@ pm.max_spare_servers = 3
 ;   last request memory:  0
 ;
 ; Note: There is a real-time FPM status monitoring sample web page available
-;       It's available in: /usr/share/php/7.3/fpm/status.html
+;       It's available in: /usr/share/php/8.4/fpm/status.html
 ;
 ; Note: The value must start with a leading slash (/). The value can be
 ;       anything, but it may not be a good idea to use the .php extension or it
@@ -239,6 +259,22 @@ pm.max_spare_servers = 3
 ; Default Value: not set
 ;pm.status_path = /status

+; The address on which to accept FastCGI status request. This creates a new
+; invisible pool that can handle requests independently. This is useful
+; if the main pool is busy with long running requests because it is still possible
+; to get the status before finishing the long running requests.
+;
+; Valid syntaxes are:
+;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
+;                            a specific port;
+;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
+;                            a specific port;
+;   'port'                 - to listen on a TCP socket to all addresses
+;                            (IPv6 and IPv4-mapped) on a specific port;
+;   '/path/to/unix/socket' - to listen on a unix socket.
+; Default Value: value of the listen option
+;pm.status_listen = 127.0.0.1:9001
+
 ; The ping URI to call the monitoring page of FPM. If this value is not set, no
 ; URI will be recognized as a ping page. This could be used to test from outside
 ; that FPM is alive and responding, or to
@@ -271,13 +307,13 @@ pm.max_spare_servers = 3
 ;  %d: time taken to serve the request
 ;      it can accept the following format:
 ;      - %{seconds}d (default)
-;      - %{miliseconds}d
-;      - %{mili}d
+;      - %{milliseconds}d
+;      - %{milli}d
 ;      - %{microseconds}d
 ;      - %{micro}d
 ;  %e: an environment variable (same as $_ENV or $_SERVER)
 ;      it must be associated with embraces to specify the name of the env
-;      variable. Some exemples:
+;      variable. Some examples:
 ;      - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
 ;      - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
 ;  %f: script filename
@@ -306,14 +342,30 @@ pm.max_spare_servers = 3
 ;  %s: status (response code)
 ;  %t: server time the request was received
 ;      it can accept a strftime(3) format:
-;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      The strftime(3) format must be encapsulated in a %{<strftime_format>}t tag
 ;  %T: time the log has been written (the request has finished)
 ;      it can accept a strftime(3) format:
-;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
-;  %u: remote user
+;      The strftime(3) format must be encapsulated in a %{<strftime_format>}t tag
+;  %u: basic auth user if specified in Authorization header
 ;
 ; Default: "%R - %u %t \"%m %r\" %s"
-;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
+;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{milli}d %{kilo}M %C%%"
+
+; A list of request_uri values which should be filtered from the access log.
+;
+; As a security precaution, this setting will be ignored if:
+;     - the request method is not GET or HEAD; or
+;     - there is a request body; or
+;     - there are query parameters; or
+;     - the response code is outwith the successful range of 200 to 299
+;
+; Note: The paths are matched against the output of the access.format tag "%r".
+;       On common configurations, this may look more like SCRIPT_NAME than the
+;       expected pre-rewrite URI.
+;
+; Default Value: not set
+;access.suppress_path[] = /ping
+;access.suppress_path[] = /health_check.php

 ; The log file for slow requests
 ; Default Value: not set
@@ -337,6 +389,14 @@ pm.max_spare_servers = 3
 ; Default Value: 0
 ;request_terminate_timeout = 0

+; The timeout set by 'request_terminate_timeout' ini option is not engaged after
+; application calls 'fastcgi_finish_request' or when application has finished and
+; shutdown functions are being called (registered via register_shutdown_function).
+; This option will enable timeout limit to be applied unconditionally
+; even in such cases.
+; Default Value: no
+;request_terminate_timeout_track_finished = no
+
 ; Set open file descriptor rlimit.
 ; Default Value: system defined value
 ;rlimit_files = 1024
@@ -364,7 +424,7 @@ pm.max_spare_servers = 3

 ; Redirect worker stdout and stderr into main error log. If not set, stdout and
 ; stderr will be redirected to /dev/null according to FastCGI specs.
-; Note: on highloaded environement, this can cause some delay in the page
+; Note: on highloaded environment, this can cause some delay in the page
 ; process time (several ms).
 ; Default Value: no
 ;catch_workers_output = yes
--- a/site.yml
+++ b/site.yml
@@ -1,7 +1,10 @@
 ---
 # file: site.yml

- import_playbook: nomads.yml
- import_playbook: web.yml
+- name: Import nomads playbook
+  ansible.builtin.import_playbook: nomads.yml
+
+- name: Import web playbook
+  ansible.builtin.import_playbook: web.yml

 # vim: set sw=2 ts=2:
--- a/vars/Ubuntu.yml
+++ b/vars/Ubuntu.yml
@@ -1,10 +0,0 @@
---
-
-# sshd service name is `ssh` on Debian/Ubuntu, but it's
-# `sshd` on CentOS
-sshd_service_name: ssh
-
-# provisioning user vars
-provisioning_user: { name: 'provisioning', home: '/home/provisioning' }
-
-# vim: set ts=2 sw=2:
--- a/web.yml
+++ b/web.yml
@@ -7,8 +7,9 @@
  roles:
    - common
    - { role: mariadb, when: mariadb_databases is defined}
-    - nginx
-    - php-fpm
+    - { role: nginx, when: webserver is defined and webserver == 'nginx' }
+    - { role: caddy, when: webserver is defined and webserver == 'caddy' }
+    - php_fpm
    - munin
  vars_files:
    - vars/ipsets.yml
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmRO6E0G4Ls3TifVfJ+mQjlfWiBZNJfsSXGhwQ/HA1M aorth@balozi`