Compare commits
216 Commits
6bc044d454
...
debian13
| Author | SHA1 | Date | |
|---|---|---|---|
d51f8fefaa
|
|||
|
9ff6e19135
|
|||
|
4680999680
|
|||
|
602734acce
|
|||
|
0db7911b70
|
|||
|
ee4c62e5f9
|
|||
|
a315db8a7c
|
|||
|
5f00892df3
|
|||
|
9357265d27
|
|||
|
dd62266340
|
|||
|
a1bec20824
|
|||
|
8e91c44529
|
|||
|
02d4135c79
|
|||
|
37e148d009
|
|||
|
73dbbd23b6
|
|||
|
b84283aa38
|
|||
|
1695fdf8d1
|
|||
|
9f1f7b1c69
|
|||
|
7d725f2084
|
|||
|
4c39b0d48c
|
|||
|
f4023d0b20
|
|||
|
6aaface4a2
|
|||
|
333e1cbeb9
|
|||
|
0c62f4bdf0
|
|||
|
26f22c0447
|
|||
|
05881e2585
|
|||
|
d4d326c2f7
|
|||
|
1d4a6f208b
|
|||
|
8b22076d4a
|
|||
|
38176cb34c
|
|||
|
da737b71f7
|
|||
|
c28189a1a5
|
|||
|
b600141e89
|
|||
|
4be98d1a33
|
|||
|
2bb018a40c
|
|||
|
89a1e11b7a
|
|||
|
0c0cad9084
|
|||
|
9dce701a19
|
|||
|
3e9ee44d5b
|
|||
|
599b5e5e83
|
|||
|
bc700ea532
|
|||
|
8016701b57
|
|||
|
00558c7dea
|
|||
|
c927186837
|
|||
|
690774c862
|
|||
|
cc021bd14a
|
|||
|
73fd06fe3a
|
|||
|
88cb3a370e
|
|||
|
027a43ddbe
|
|||
|
bb30c3be20
|
|||
|
d8d9790d21
|
|||
|
9a500ebc0d
|
|||
|
4bae942585
|
|||
|
99866c0c90
|
|||
|
0afb8a4493
|
|||
|
506695da31
|
|||
|
f67ed7762c
|
|||
|
014f4d9502
|
|||
|
22c16e1ed3
|
|||
|
5aa6a33e51
|
|||
|
7f9b06af9c
|
|||
|
84db337fea
|
|||
|
7b23f5f94f
|
|||
|
9830338be3
|
|||
|
e3eed26765
|
|||
|
8b31c7e148
|
|||
|
3ff8043aaf
|
|||
|
cb79f7ef70
|
|||
|
bb14f05d2a
|
|||
|
5b1530fa91
|
|||
|
5312dc6bd5
|
|||
|
d6e060d3af
|
|||
|
b873af004a
|
|||
|
7ea3ab46f8
|
|||
|
0561bd5b52
|
|||
|
d62572f02c
|
|||
|
2ffe5e87d9
|
|||
|
38d4f1a303
|
|||
|
ed8cb88038
|
|||
|
c31e447861
|
|||
|
545684467c
|
|||
|
24ae5eaab1
|
|||
|
dac23f1427
|
|||
|
41fbc73dd1
|
|||
|
fee794bcf0
|
|||
|
8bce1d8b1b
|
|||
|
6dc2ea36b6
|
|||
|
af71a9b5f8
|
|||
|
4dd57803e2
|
|||
|
18d4245fc0
|
|||
|
1bddf3cccd
|
|||
|
20dbe61fe1
|
|||
|
899e87321b
|
|||
|
06416a3b64
|
|||
|
7a9a24ef5d
|
|||
|
067adcd9f5
|
|||
|
84d210cfab
|
|||
|
17736a4f14
|
|||
|
b9e91c4a3d
|
|||
|
51c95e5d4c
|
|||
|
8dbec29d2a
|
|||
|
d3bf3dab04
|
|||
|
8f50b7756b
|
|||
|
e86ccc9979
|
|||
|
cea8529f49
|
|||
|
d77718edae
|
|||
|
14d57fc477
|
|||
|
5c39f1abd8
|
|||
|
6794eb0432
|
|||
|
11614e3725
|
|||
|
b106f9d9e5
|
|||
|
3c8250e6ac
|
|||
|
d280859b0d
|
|||
|
bca1629d2f
|
|||
|
4fa82faf18
|
|||
|
b8f0b4b1fb
|
|||
|
68e5d05bbb
|
|||
|
446d402778
|
|||
|
67379fc2e4
|
|||
|
73546967b6
|
|||
|
16b661efe1
|
|||
|
fdb9a75489
|
|||
|
232d7a0348
|
|||
|
6e4bb5bc34
|
|||
|
c840ffe018
|
|||
|
45c9d7ea0a
|
|||
|
a62bc446e8
|
|||
|
62a6a491db
|
|||
|
4867d6da6a
|
|||
|
d9f7c7a93b
|
|||
|
bc8c030700
|
|||
|
f7598d8f1c
|
|||
|
c353e84a84
|
|||
|
99ca23f258
|
|||
|
b663d27fd8
|
|||
|
67c99dacf6
|
|||
|
4abf2b10e4
|
|||
|
f5199264f9
|
|||
|
b259f09cbd
|
|||
|
f4b32e516b
|
|||
|
fcb12ecee0
|
|||
|
5bc03ceacc
|
|||
|
c317429f6d
|
|||
|
b512a7f765
|
|||
|
e3a87d4f79
|
|||
|
dec2d50fbc
|
|||
|
34be0013b7
|
|||
|
399585f4e7
|
|||
|
0240897b1b
|
|||
|
1da0da53ec
|
|||
|
677cc9f160
|
|||
|
ffe7a872dd
|
|||
|
95d0005978
|
|||
|
498766fdc4
|
|||
| fc0fcc5742 | |||
| 587bd6dcdd | |||
|
92a4c72809
|
|||
|
a2d61abba2
|
|||
|
d2a5a28809
|
|||
|
84c0589aee
|
|||
|
2961578a54
|
|||
|
4d74f76b3c
|
|||
|
9e737466c5
|
|||
|
0ffb1b1a36
|
|||
|
68f0b85eb3
|
|||
|
ebbde530d2
|
|||
|
ab47df6031
|
|||
|
de75b2ffb6
|
|||
|
e10d83dadd
|
|||
|
f070fd9a64
|
|||
|
6e1527b1a8
|
|||
|
ebd8b0632b
|
|||
|
df26b6c17e
|
|||
|
d92151b8a6
|
|||
|
b13ead0657
|
|||
|
89ced6f952
|
|||
|
ae5ba0607a
|
|||
|
89fd642b78
|
|||
|
65e6dd34cd
|
|||
|
0421807e4d
|
|||
|
d5eed5055e
|
|||
|
f8752bb3e7
|
|||
|
170e591701
|
|||
|
8d6c3c57c3
|
|||
|
79b29f0c51
|
|||
|
a4acc85704
|
|||
|
f7b9aa67f5
|
|||
|
0a39c4f0ef
|
|||
|
85323d789c
|
|||
|
341a1bf11e
|
|||
|
6ee389eda5
|
|||
|
83fea62b0f
|
|||
|
0d1a5fbb25
|
|||
|
4d8444abf2
|
|||
|
e8486f6c9e
|
|||
|
20cd6f213c
|
|||
|
eb80e797c6
|
|||
|
736bb8eb38
|
|||
|
34a30c4d13
|
|||
|
c03e75d736
|
|||
|
d08f10f9c8
|
|||
|
8467dc1300
|
|||
|
635bb5234d
|
|||
|
37901da5b5
|
|||
|
e36ae3b11e
|
|||
|
81c1231a28
|
|||
|
bb6f058025
|
|||
|
547395b26e
|
|||
|
15208241d3
|
|||
|
0fd05d496e
|
|||
|
023a0d48ba
|
|||
|
c687b7a91a
|
|||
|
bd4ae36bb6
|
|||
|
b60637c7d9
|
|||
|
479127a5e4
|
|||
|
d261f81642
|
3
Pipfile
3
Pipfile
@@ -7,6 +7,7 @@ verify_ssl = true
|
||||
|
||||
[packages]
|
||||
ansible = "*"
|
||||
ansible-lint = "*"
|
||||
|
||||
[requires]
|
||||
python_version = "3.9"
|
||||
python_version = "3.13"
|
||||
|
||||
862
Pipfile.lock
generated
862
Pipfile.lock
generated
@@ -1,11 +1,11 @@
|
||||
{
|
||||
"_meta": {
|
||||
"hash": {
|
||||
"sha256": "65b615b857250757470e21fc3a4b1cdfe75b4b012c0d1d633a5ebf1988d9cb91"
|
||||
"sha256": "47970866f4ffc7775e3a95dd04ee8b75f9784c457baadd8a31fe1783584fa73f"
|
||||
},
|
||||
"pipfile-spec": 6,
|
||||
"requires": {
|
||||
"python_version": "3.9"
|
||||
"python_version": "3.13"
|
||||
},
|
||||
"sources": [
|
||||
{
|
||||
@@ -18,224 +18,730 @@
|
||||
"default": {
|
||||
"ansible": {
|
||||
"hashes": [
|
||||
"sha256:cc5352b2351a381015ece79eab783a1b0668f97b377810fed3c746e2f1d50db1"
|
||||
"sha256:1a17f8c593a973e6d81f10ebfe7eac53e799616f745d57b99bd36b34f79f16a2",
|
||||
"sha256:1b3ad8158dd2597ce45a864a55ca09e5be1807cc97f44a00c39d7bb9e1520aa6"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==4.5.0"
|
||||
"markers": "python_version >= '3.11'",
|
||||
"version": "==12.0.0"
|
||||
},
|
||||
"ansible-compat": {
|
||||
"hashes": [
|
||||
"sha256:5bb843838414b75efff24dae5ff5b332cd503a596143d471980243cec4b46c9c",
|
||||
"sha256:f29ab81264b3f04fb94ac2d7f68fe73efc2eb3cbe4ecf00f9b4742e77c41756f"
|
||||
],
|
||||
"markers": "python_version >= '3.10'",
|
||||
"version": "==25.8.1"
|
||||
},
|
||||
"ansible-core": {
|
||||
"hashes": [
|
||||
"sha256:22eaa7c2dfe6c875e9ae380323f1cba6259c6050a5e4c8819f85f92b3683ea49"
|
||||
"sha256:1fe6ca533951b5ba4a619e763ea4f6725f68c36677c7d5aaa467b59aa449bdc8",
|
||||
"sha256:87fcbbc492ed16eb6adb0379bae0adbf69f3ce88a8440e7e88e0dcefa9f8a54c"
|
||||
],
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
|
||||
"version": "==2.11.4"
|
||||
"markers": "python_version >= '3.11'",
|
||||
"version": "==2.19.2"
|
||||
},
|
||||
"ansible-lint": {
|
||||
"hashes": [
|
||||
"sha256:2d5a8a2b01c46966591a17769a129142181515aac19c27742ecb8c94e84bf692",
|
||||
"sha256:b8fe138a1257c6e58a755febd726b3186820f6dcb23a5bb062538c939a7277bb"
|
||||
],
|
||||
"index": "pypi",
|
||||
"markers": "python_version >= '3.10'",
|
||||
"version": "==25.9.0"
|
||||
},
|
||||
"attrs": {
|
||||
"hashes": [
|
||||
"sha256:427318ce031701fea540783410126f03899a97ffc6f61596ad581ac2e40e3bc3",
|
||||
"sha256:75d7cefc7fb576747b2c81b4442d4d4a1ce0900973527c011d1030fd3bf4af1b"
|
||||
],
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==25.3.0"
|
||||
},
|
||||
"black": {
|
||||
"hashes": [
|
||||
"sha256:0172a012f725b792c358d57fe7b6b6e8e67375dd157f64fa7a3097b3ed3e2175",
|
||||
"sha256:0474bca9a0dd1b51791fcc507a4e02078a1c63f6d4e4ae5544b9848c7adfb619",
|
||||
"sha256:154b06d618233fe468236ba1f0e40823d4eb08b26f5e9261526fde34916b9140",
|
||||
"sha256:1b9dc70c21ef8b43248f1d86aedd2aaf75ae110b958a7909ad8463c4aa0880b0",
|
||||
"sha256:2ab0ce111ef026790e9b13bd216fa7bc48edd934ffc4cbf78808b235793cbc92",
|
||||
"sha256:3bec74ee60f8dfef564b573a96b8930f7b6a538e846123d5ad77ba14a8d7a64f",
|
||||
"sha256:456386fe87bad41b806d53c062e2974615825c7a52159cde7ccaeb0695fa28fa",
|
||||
"sha256:474b34c1342cdc157d307b56c4c65bce916480c4a8f6551fdc6bf9b486a7c4ae",
|
||||
"sha256:77e7060a00c5ec4b3367c55f39cf9b06e68965a4f2e61cecacd6d0d9b7ec945a",
|
||||
"sha256:846d58e3ce7879ec1ffe816bb9df6d006cd9590515ed5d17db14e17666b2b357",
|
||||
"sha256:8e46eecf65a095fa62e53245ae2795c90bdecabd53b50c448d0a8bcd0d2e74c4",
|
||||
"sha256:9101ee58ddc2442199a25cb648d46ba22cd580b00ca4b44234a324e3ec7a0f7e",
|
||||
"sha256:a16b14a44c1af60a210d8da28e108e13e75a284bf21a9afa6b4571f96ab8bb9d",
|
||||
"sha256:aaf319612536d502fdd0e88ce52d8f1352b2c0a955cc2798f79eeca9d3af0608",
|
||||
"sha256:b756fc75871cb1bcac5499552d771822fd9db5a2bb8db2a7247936ca48f39831",
|
||||
"sha256:c0372a93e16b3954208417bfe448e09b0de5cc721d521866cd9e0acac3c04a1f",
|
||||
"sha256:ce41ed2614b706fd55fd0b4a6909d06b5bab344ffbfadc6ef34ae50adba3d4f7",
|
||||
"sha256:d119957b37cc641596063cd7db2656c5be3752ac17877017b2ffcdb9dfc4d2b1",
|
||||
"sha256:e3c1f4cd5e93842774d9ee4ef6cd8d17790e65f44f7cdbaab5f2cf8ccf22a823",
|
||||
"sha256:e593466de7b998374ea2585a471ba90553283fb9beefcfa430d84a2651ed5933",
|
||||
"sha256:ef69351df3c84485a8beb6f7b8f9721e2009e20ef80a8d619e2d1788b7816d47",
|
||||
"sha256:f96b6726d690c96c60ba682955199f8c39abc1ae0c3a494a9c62c0184049a713"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==25.9.0"
|
||||
},
|
||||
"bracex": {
|
||||
"hashes": [
|
||||
"sha256:0b0049264e7340b3ec782b5cb99beb325f36c3782a32e36e876452fd49a09952",
|
||||
"sha256:98f1347cd77e22ee8d967a30ad4e310b233f7754dbf31ff3fceb76145ba47dc7"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==2.6"
|
||||
},
|
||||
"cffi": {
|
||||
"hashes": [
|
||||
"sha256:06c54a68935738d206570b20da5ef2b6b6d92b38ef3ec45c5422c0ebaf338d4d",
|
||||
"sha256:0c0591bee64e438883b0c92a7bed78f6290d40bf02e54c5bf0978eaf36061771",
|
||||
"sha256:19ca0dbdeda3b2615421d54bef8985f72af6e0c47082a8d26122adac81a95872",
|
||||
"sha256:22b9c3c320171c108e903d61a3723b51e37aaa8c81255b5e7ce102775bd01e2c",
|
||||
"sha256:26bb2549b72708c833f5abe62b756176022a7b9a7f689b571e74c8478ead51dc",
|
||||
"sha256:33791e8a2dc2953f28b8d8d300dde42dd929ac28f974c4b4c6272cb2955cb762",
|
||||
"sha256:3c8d896becff2fa653dc4438b54a5a25a971d1f4110b32bd3068db3722c80202",
|
||||
"sha256:4373612d59c404baeb7cbd788a18b2b2a8331abcc84c3ba40051fcd18b17a4d5",
|
||||
"sha256:487d63e1454627c8e47dd230025780e91869cfba4c753a74fda196a1f6ad6548",
|
||||
"sha256:48916e459c54c4a70e52745639f1db524542140433599e13911b2f329834276a",
|
||||
"sha256:4922cd707b25e623b902c86188aca466d3620892db76c0bdd7b99a3d5e61d35f",
|
||||
"sha256:55af55e32ae468e9946f741a5d51f9896da6b9bf0bbdd326843fec05c730eb20",
|
||||
"sha256:57e555a9feb4a8460415f1aac331a2dc833b1115284f7ded7278b54afc5bd218",
|
||||
"sha256:5d4b68e216fc65e9fe4f524c177b54964af043dde734807586cf5435af84045c",
|
||||
"sha256:64fda793737bc4037521d4899be780534b9aea552eb673b9833b01f945904c2e",
|
||||
"sha256:6d6169cb3c6c2ad50db5b868db6491a790300ade1ed5d1da29289d73bbe40b56",
|
||||
"sha256:7bcac9a2b4fdbed2c16fa5681356d7121ecabf041f18d97ed5b8e0dd38a80224",
|
||||
"sha256:80b06212075346b5546b0417b9f2bf467fea3bfe7352f781ffc05a8ab24ba14a",
|
||||
"sha256:818014c754cd3dba7229c0f5884396264d51ffb87ec86e927ef0be140bfdb0d2",
|
||||
"sha256:8eb687582ed7cd8c4bdbff3df6c0da443eb89c3c72e6e5dcdd9c81729712791a",
|
||||
"sha256:99f27fefe34c37ba9875f224a8f36e31d744d8083e00f520f133cab79ad5e819",
|
||||
"sha256:9f3e33c28cd39d1b655ed1ba7247133b6f7fc16fa16887b120c0c670e35ce346",
|
||||
"sha256:a8661b2ce9694ca01c529bfa204dbb144b275a31685a075ce123f12331be790b",
|
||||
"sha256:a9da7010cec5a12193d1af9872a00888f396aba3dc79186604a09ea3ee7c029e",
|
||||
"sha256:aedb15f0a5a5949ecb129a82b72b19df97bbbca024081ed2ef88bd5c0a610534",
|
||||
"sha256:b315d709717a99f4b27b59b021e6207c64620790ca3e0bde636a6c7f14618abb",
|
||||
"sha256:ba6f2b3f452e150945d58f4badd92310449876c4c954836cfb1803bdd7b422f0",
|
||||
"sha256:c33d18eb6e6bc36f09d793c0dc58b0211fccc6ae5149b808da4a62660678b156",
|
||||
"sha256:c9a875ce9d7fe32887784274dd533c57909b7b1dcadcc128a2ac21331a9765dd",
|
||||
"sha256:c9e005e9bd57bc987764c32a1bee4364c44fdc11a3cc20a40b93b444984f2b87",
|
||||
"sha256:d2ad4d668a5c0645d281dcd17aff2be3212bc109b33814bbb15c4939f44181cc",
|
||||
"sha256:d950695ae4381ecd856bcaf2b1e866720e4ab9a1498cba61c602e56630ca7195",
|
||||
"sha256:e22dcb48709fc51a7b58a927391b23ab37eb3737a98ac4338e2448bef8559b33",
|
||||
"sha256:e8c6a99be100371dbb046880e7a282152aa5d6127ae01783e37662ef73850d8f",
|
||||
"sha256:e9dc245e3ac69c92ee4c167fbdd7428ec1956d4e754223124991ef29eb57a09d",
|
||||
"sha256:eb687a11f0a7a1839719edd80f41e459cc5366857ecbed383ff376c4e3cc6afd",
|
||||
"sha256:eb9e2a346c5238a30a746893f23a9535e700f8192a68c07c0258e7ece6ff3728",
|
||||
"sha256:ed38b924ce794e505647f7c331b22a693bee1538fdf46b0222c4717b42f744e7",
|
||||
"sha256:f0010c6f9d1a4011e429109fda55a225921e3206e7f62a0c22a35344bfd13cca",
|
||||
"sha256:f0c5d1acbfca6ebdd6b1e3eded8d261affb6ddcf2186205518f1428b8569bb99",
|
||||
"sha256:f10afb1004f102c7868ebfe91c28f4a712227fe4cb24974350ace1f90e1febbf",
|
||||
"sha256:f174135f5609428cc6e1b9090f9268f5c8935fddb1b25ccb8255a2d50de6789e",
|
||||
"sha256:f3ebe6e73c319340830a9b2825d32eb6d8475c1dac020b4f0aa774ee3b898d1c",
|
||||
"sha256:f627688813d0a4140153ff532537fbe4afea5a3dffce1f9deb7f91f848a832b5",
|
||||
"sha256:fd4305f86f53dfd8cd3522269ed7fc34856a8ee3709a5e28b2836b2db9d4cd69"
|
||||
"sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb",
|
||||
"sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b",
|
||||
"sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f",
|
||||
"sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9",
|
||||
"sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44",
|
||||
"sha256:0f6084a0ea23d05d20c3edcda20c3d006f9b6f3fefeac38f59262e10cef47ee2",
|
||||
"sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c",
|
||||
"sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75",
|
||||
"sha256:1cd13c99ce269b3ed80b417dcd591415d3372bcac067009b6e0f59c7d4015e65",
|
||||
"sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e",
|
||||
"sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a",
|
||||
"sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e",
|
||||
"sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25",
|
||||
"sha256:2081580ebb843f759b9f617314a24ed5738c51d2aee65d31e02f6f7a2b97707a",
|
||||
"sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe",
|
||||
"sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b",
|
||||
"sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91",
|
||||
"sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592",
|
||||
"sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187",
|
||||
"sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c",
|
||||
"sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1",
|
||||
"sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94",
|
||||
"sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba",
|
||||
"sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb",
|
||||
"sha256:3f4d46d8b35698056ec29bca21546e1551a205058ae1a181d871e278b0b28165",
|
||||
"sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529",
|
||||
"sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca",
|
||||
"sha256:4647afc2f90d1ddd33441e5b0e85b16b12ddec4fca55f0d9671fef036ecca27c",
|
||||
"sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6",
|
||||
"sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c",
|
||||
"sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0",
|
||||
"sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743",
|
||||
"sha256:61d028e90346df14fedc3d1e5441df818d095f3b87d286825dfcbd6459b7ef63",
|
||||
"sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5",
|
||||
"sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5",
|
||||
"sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4",
|
||||
"sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d",
|
||||
"sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b",
|
||||
"sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93",
|
||||
"sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205",
|
||||
"sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27",
|
||||
"sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512",
|
||||
"sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d",
|
||||
"sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c",
|
||||
"sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037",
|
||||
"sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26",
|
||||
"sha256:89472c9762729b5ae1ad974b777416bfda4ac5642423fa93bd57a09204712322",
|
||||
"sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb",
|
||||
"sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c",
|
||||
"sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8",
|
||||
"sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4",
|
||||
"sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414",
|
||||
"sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9",
|
||||
"sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664",
|
||||
"sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9",
|
||||
"sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775",
|
||||
"sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739",
|
||||
"sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc",
|
||||
"sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062",
|
||||
"sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe",
|
||||
"sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9",
|
||||
"sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92",
|
||||
"sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5",
|
||||
"sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13",
|
||||
"sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d",
|
||||
"sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26",
|
||||
"sha256:cb527a79772e5ef98fb1d700678fe031e353e765d1ca2d409c92263c6d43e09f",
|
||||
"sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495",
|
||||
"sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b",
|
||||
"sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6",
|
||||
"sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c",
|
||||
"sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef",
|
||||
"sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5",
|
||||
"sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18",
|
||||
"sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad",
|
||||
"sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3",
|
||||
"sha256:de8dad4425a6ca6e4e5e297b27b5c824ecc7581910bf9aee86cb6835e6812aa7",
|
||||
"sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5",
|
||||
"sha256:e6e73b9e02893c764e7e8d5bb5ce277f1a009cd5243f8228f75f842bf937c534",
|
||||
"sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49",
|
||||
"sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2",
|
||||
"sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5",
|
||||
"sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453",
|
||||
"sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf"
|
||||
],
|
||||
"version": "==1.14.6"
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==2.0.0"
|
||||
},
|
||||
"click": {
|
||||
"hashes": [
|
||||
"sha256:9b9f285302c6e3064f4330c05f05b81945b2a39544279343e6e7c5f27a9baddc",
|
||||
"sha256:e7b8232224eba16f4ebe410c25ced9f7875cb5f3263ffc93cc3e8da705e229c4"
|
||||
],
|
||||
"markers": "python_version >= '3.10'",
|
||||
"version": "==8.3.0"
|
||||
},
|
||||
"cryptography": {
|
||||
"hashes": [
|
||||
"sha256:0a7dcbcd3f1913f664aca35d47c1331fce738d44ec34b7be8b9d332151b0b01e",
|
||||
"sha256:1eb7bb0df6f6f583dd8e054689def236255161ebbcf62b226454ab9ec663746b",
|
||||
"sha256:21ca464b3a4b8d8e86ba0ee5045e103a1fcfac3b39319727bc0fc58c09c6aff7",
|
||||
"sha256:34dae04a0dce5730d8eb7894eab617d8a70d0c97da76b905de9efb7128ad7085",
|
||||
"sha256:3520667fda779eb788ea00080124875be18f2d8f0848ec00733c0ec3bb8219fc",
|
||||
"sha256:3fa3a7ccf96e826affdf1a0a9432be74dc73423125c8f96a909e3835a5ef194a",
|
||||
"sha256:5b0fbfae7ff7febdb74b574055c7466da334a5371f253732d7e2e7525d570498",
|
||||
"sha256:8695456444f277af73a4877db9fc979849cd3ee74c198d04fc0776ebc3db52b9",
|
||||
"sha256:94cc5ed4ceaefcbe5bf38c8fba6a21fc1d365bb8fb826ea1688e3370b2e24a1c",
|
||||
"sha256:94fff993ee9bc1b2440d3b7243d488c6a3d9724cc2b09cdb297f6a886d040ef7",
|
||||
"sha256:9965c46c674ba8cc572bc09a03f4c649292ee73e1b683adb1ce81e82e9a6a0fb",
|
||||
"sha256:a00cf305f07b26c351d8d4e1af84ad7501eca8a342dedf24a7acb0e7b7406e14",
|
||||
"sha256:a305600e7a6b7b855cd798e00278161b681ad6e9b7eca94c721d5f588ab212af",
|
||||
"sha256:cd65b60cfe004790c795cc35f272e41a3df4631e2fb6b35aa7ac6ef2859d554e",
|
||||
"sha256:d2a6e5ef66503da51d2110edf6c403dc6b494cc0082f85db12f54e9c5d4c3ec5",
|
||||
"sha256:d9ec0e67a14f9d1d48dd87a2531009a9b251c02ea42851c060b25c782516ff06",
|
||||
"sha256:f44d141b8c4ea5eb4dbc9b3ad992d45580c1d22bf5e24363f2fbf50c2d7ae8a7"
|
||||
"sha256:0a17377fa52563d730248ba1f68185461fff36e8bc75d8787a7dd2e20a802b7a",
|
||||
"sha256:0ca4be2af48c24df689a150d9cd37404f689e2968e247b6b8ff09bff5bcd786f",
|
||||
"sha256:0d1922d9280e08cde90b518a10cd66831f632960a8d08cb3418922d83fce6f12",
|
||||
"sha256:0dfb7c88d4462a0cfdd0d87a3c245a7bc3feb59de101f6ff88194f740f72eda6",
|
||||
"sha256:0ff483716be32690c14636e54a1f6e2e1b7bf8e22ca50b989f88fa1b2d287080",
|
||||
"sha256:13e67c4d3fb8b6bc4ef778a7ccdd8df4cd15b4bcc18f4239c8440891a11245cc",
|
||||
"sha256:15b5fd9358803b0d1cc42505a18d8bca81dabb35b5cfbfea1505092e13a9d96d",
|
||||
"sha256:1cd6d50c1a8b79af1a6f703709d8973845f677c8e97b1268f5ff323d38ce8475",
|
||||
"sha256:2dd339ba3345b908fa3141ddba4025568fa6fd398eabce3ef72a29ac2d73ad75",
|
||||
"sha256:341fb7a26bc9d6093c1b124b9f13acc283d2d51da440b98b55ab3f79f2522ead",
|
||||
"sha256:34f04b7311174469ab3ac2647469743720f8b6c8b046f238e5cb27905695eb2a",
|
||||
"sha256:41c281a74df173876da1dc9a9b6953d387f06e3d3ed9284e3baae3ab3f40883a",
|
||||
"sha256:449ef2b321bec7d97ef2c944173275ebdab78f3abdd005400cc409e27cd159ab",
|
||||
"sha256:45f790934ac1018adeba46a0f7289b2b8fe76ba774a88c7f1922213a56c98bc1",
|
||||
"sha256:48948940d0ae00483e85e9154bb42997d0b77c21e43a77b7773c8c80de532ac5",
|
||||
"sha256:4c49eda9a23019e11d32a0eb51a27b3e7ddedde91e099c0ac6373e3aacc0d2ee",
|
||||
"sha256:504e464944f2c003a0785b81668fe23c06f3b037e9cb9f68a7c672246319f277",
|
||||
"sha256:534b96c0831855e29fc3b069b085fd185aa5353033631a585d5cd4dd5d40d657",
|
||||
"sha256:6ef1488967e729948d424d09c94753d0167ce59afba8d0f6c07a22b629c557b2",
|
||||
"sha256:7176a5ab56fac98d706921f6416a05e5aff7df0e4b91516f450f8627cda22af3",
|
||||
"sha256:7411c910fb2a412053cf33cfad0153ee20d27e256c6c3f14d7d7d1d9fec59fd5",
|
||||
"sha256:757af4f6341ce7a1e47c326ca2a81f41d236070217e5fbbad61bbfe299d55d28",
|
||||
"sha256:7823bc7cdf0b747ecfb096d004cc41573c2f5c7e3a29861603a2871b43d3ef32",
|
||||
"sha256:7fab1187b6c6b2f11a326f33b036f7168f5b996aedd0c059f9738915e4e8f53a",
|
||||
"sha256:84ef1f145de5aee82ea2447224dc23f065ff4cc5791bb3b506615957a6ba8128",
|
||||
"sha256:92e8cfe8bd7dd86eac0a677499894862cd5cc2fd74de917daa881d00871ac8e7",
|
||||
"sha256:9394c7d5a7565ac5f7d9ba38b2617448eba384d7b107b262d63890079fad77ca",
|
||||
"sha256:9495d78f52c804b5ec8878b5b8c7873aa8e63db9cd9ee387ff2db3fffe4df784",
|
||||
"sha256:9873bf7c1f2a6330bdfe8621e7ce64b725784f9f0c3a6a55c3047af5849f920e",
|
||||
"sha256:9babb7818fdd71394e576cf26c5452df77a355eac1a27ddfa24096665a27f8fd",
|
||||
"sha256:9e8776dac9e660c22241b6587fae51a67b4b0147daa4d176b172c3ff768ad736",
|
||||
"sha256:9ed64e5083fa806709e74fc5ea067dfef9090e5b7a2320a49be3c9df3583a2d8",
|
||||
"sha256:9f2c4cc63be3ef43c0221861177cee5d14b505cd4d4599a89e2cd273c4d3542a",
|
||||
"sha256:9f40642a140c0c8649987027867242b801486865277cbabc8c6059ddef16dc8b",
|
||||
"sha256:af84e8e99f1a82cea149e253014ea9dc89f75b82c87bb6c7242203186f465129",
|
||||
"sha256:b9c79af2c3058430d911ff1a5b2b96bbfe8da47d5ed961639ce4681886614e70",
|
||||
"sha256:c52fded6383f7e20eaf70a60aeddd796b3677c3ad2922c801be330db62778e05",
|
||||
"sha256:cbb8e769d4cac884bb28e3ff620ef1001b75588a5c83c9c9f1fdc9afbe7f29b0",
|
||||
"sha256:d84c40bdb8674c29fa192373498b6cb1e84f882889d21a471b45d1f868d8d44b",
|
||||
"sha256:db5597a4c7353b2e5fb05a8e6cb74b56a4658a2b7bf3cb6b1821ae7e7fd6eaa0",
|
||||
"sha256:e22801b61613ebdebf7deb18b507919e107547a1d39a3b57f5f855032dd7cfb8",
|
||||
"sha256:e34da95e29daf8a71cb2841fd55df0511539a6cdf33e6f77c1e95e44006b9b46",
|
||||
"sha256:e46710a240a41d594953012213ea8ca398cd2448fbc5d0f1be8160b5511104a0",
|
||||
"sha256:e94eb5fa32a8a9f9bf991f424f002913e3dd7c699ef552db9b14ba6a76a6313b",
|
||||
"sha256:ec13b7105117dbc9afd023300fb9954d72ca855c274fe563e72428ece10191c0",
|
||||
"sha256:ed570874e88f213437f5cf758f9ef26cbfc3f336d889b1e592ee11283bb8d1c7",
|
||||
"sha256:ed957044e368ed295257ae3d212b95456bd9756df490e1ac4538857f67531fcc",
|
||||
"sha256:ef648d2c690703501714588b2ba640facd50fd16548133b11b2859e8655a69da",
|
||||
"sha256:efc9e51c3e595267ff84adf56e9b357db89ab2279d7e375ffcaf8f678606f3d9",
|
||||
"sha256:f736ab8036796f5a119ff8211deda416f8c15ce03776db704a7a4e17381cb2ef",
|
||||
"sha256:f7a24ea78de345cfa7f6a8d3bde8b242c7fac27f2bd78fa23474ca38dfaeeab9",
|
||||
"sha256:f7de12fa0eee6234de9a9ce0ffcfa6ce97361db7a50b09b65c63ac58e5f22fc7",
|
||||
"sha256:f9b55038b5c6c47559aa33626d8ecd092f354e23de3c6975e4bb205df128a2a0",
|
||||
"sha256:fd4b5e2ee4e60425711ec65c33add4e7a626adef79d66f62ba0acfd493af282d"
|
||||
],
|
||||
"markers": "python_version >= '3.8' and python_full_version not in '3.9.0, 3.9.1'",
|
||||
"version": "==46.0.1"
|
||||
},
|
||||
"distro": {
|
||||
"hashes": [
|
||||
"sha256:2fa77c6fd8940f116ee1d6b94a2f90b13b5ea8d019b98bc8bafdcabcdd9bdbed",
|
||||
"sha256:7bffd925d65168f85027d8da9af6bddab658135b840670a223589bc0c8ef02b2"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==3.4.8"
|
||||
"version": "==1.9.0"
|
||||
},
|
||||
"filelock": {
|
||||
"hashes": [
|
||||
"sha256:66eda1888b0171c998b35be2bcc0f6d75c388a7ce20c3f3f37aa8e96c2dddf58",
|
||||
"sha256:d38e30481def20772f5baf097c122c3babc4fcdb7e14e57049eb9d88c6dc017d"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==3.19.1"
|
||||
},
|
||||
"importlib-metadata": {
|
||||
"hashes": [
|
||||
"sha256:d13b81ad223b890aa16c5471f2ac3056cf76c5f10f82d6f9292f0b415f389000",
|
||||
"sha256:e5dd1551894c77868a30651cef00984d50e1002d06942a7101d34870c5f02afd"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==8.7.0"
|
||||
},
|
||||
"jinja2": {
|
||||
"hashes": [
|
||||
"sha256:1f06f2da51e7b56b8f238affdd6b4e2c61e39598a378cc49345bc1bd42a978a4",
|
||||
"sha256:703f484b47a6af502e743c9122595cc812b0271f661722403114f71a79d0f5a4"
|
||||
"sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d",
|
||||
"sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==3.0.1"
|
||||
"markers": "python_version >= '3.7'",
|
||||
"version": "==3.1.6"
|
||||
},
|
||||
"jsonschema": {
|
||||
"hashes": [
|
||||
"sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63",
|
||||
"sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==4.25.1"
|
||||
},
|
||||
"jsonschema-specifications": {
|
||||
"hashes": [
|
||||
"sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe",
|
||||
"sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==2025.9.1"
|
||||
},
|
||||
"markupsafe": {
|
||||
"hashes": [
|
||||
"sha256:01a9b8ea66f1658938f65b93a85ebe8bc016e6769611be228d797c9d998dd298",
|
||||
"sha256:023cb26ec21ece8dc3907c0e8320058b2e0cb3c55cf9564da612bc325bed5e64",
|
||||
"sha256:0446679737af14f45767963a1a9ef7620189912317d095f2d9ffa183a4d25d2b",
|
||||
"sha256:0717a7390a68be14b8c793ba258e075c6f4ca819f15edfc2a3a027c823718567",
|
||||
"sha256:0955295dd5eec6cb6cc2fe1698f4c6d84af2e92de33fbcac4111913cd100a6ff",
|
||||
"sha256:0d4b31cc67ab36e3392bbf3862cfbadac3db12bdd8b02a2731f509ed5b829724",
|
||||
"sha256:10f82115e21dc0dfec9ab5c0223652f7197feb168c940f3ef61563fc2d6beb74",
|
||||
"sha256:168cd0a3642de83558a5153c8bd34f175a9a6e7f6dc6384b9655d2697312a646",
|
||||
"sha256:1d609f577dc6e1aa17d746f8bd3c31aa4d258f4070d61b2aa5c4166c1539de35",
|
||||
"sha256:1f2ade76b9903f39aa442b4aadd2177decb66525062db244b35d71d0ee8599b6",
|
||||
"sha256:2a7d351cbd8cfeb19ca00de495e224dea7e7d919659c2841bbb7f420ad03e2d6",
|
||||
"sha256:2d7d807855b419fc2ed3e631034685db6079889a1f01d5d9dac950f764da3dad",
|
||||
"sha256:2ef54abee730b502252bcdf31b10dacb0a416229b72c18b19e24a4509f273d26",
|
||||
"sha256:36bc903cbb393720fad60fc28c10de6acf10dc6cc883f3e24ee4012371399a38",
|
||||
"sha256:37205cac2a79194e3750b0af2a5720d95f786a55ce7df90c3af697bfa100eaac",
|
||||
"sha256:3c112550557578c26af18a1ccc9e090bfe03832ae994343cfdacd287db6a6ae7",
|
||||
"sha256:3dd007d54ee88b46be476e293f48c85048603f5f516008bee124ddd891398ed6",
|
||||
"sha256:47ab1e7b91c098ab893b828deafa1203de86d0bc6ab587b160f78fe6c4011f75",
|
||||
"sha256:49e3ceeabbfb9d66c3aef5af3a60cc43b85c33df25ce03d0031a608b0a8b2e3f",
|
||||
"sha256:4efca8f86c54b22348a5467704e3fec767b2db12fc39c6d963168ab1d3fc9135",
|
||||
"sha256:53edb4da6925ad13c07b6d26c2a852bd81e364f95301c66e930ab2aef5b5ddd8",
|
||||
"sha256:5855f8438a7d1d458206a2466bf82b0f104a3724bf96a1c781ab731e4201731a",
|
||||
"sha256:594c67807fb16238b30c44bdf74f36c02cdf22d1c8cda91ef8a0ed8dabf5620a",
|
||||
"sha256:5bb28c636d87e840583ee3adeb78172efc47c8b26127267f54a9c0ec251d41a9",
|
||||
"sha256:60bf42e36abfaf9aff1f50f52644b336d4f0a3fd6d8a60ca0d054ac9f713a864",
|
||||
"sha256:611d1ad9a4288cf3e3c16014564df047fe08410e628f89805e475368bd304914",
|
||||
"sha256:6557b31b5e2c9ddf0de32a691f2312a32f77cd7681d8af66c2692efdbef84c18",
|
||||
"sha256:693ce3f9e70a6cf7d2fb9e6c9d8b204b6b39897a2c4a1aa65728d5ac97dcc1d8",
|
||||
"sha256:6a7fae0dd14cf60ad5ff42baa2e95727c3d81ded453457771d02b7d2b3f9c0c2",
|
||||
"sha256:6c4ca60fa24e85fe25b912b01e62cb969d69a23a5d5867682dd3e80b5b02581d",
|
||||
"sha256:6fcf051089389abe060c9cd7caa212c707e58153afa2c649f00346ce6d260f1b",
|
||||
"sha256:7d91275b0245b1da4d4cfa07e0faedd5b0812efc15b702576d103293e252af1b",
|
||||
"sha256:905fec760bd2fa1388bb5b489ee8ee5f7291d692638ea5f67982d968366bef9f",
|
||||
"sha256:97383d78eb34da7e1fa37dd273c20ad4320929af65d156e35a5e2d89566d9dfb",
|
||||
"sha256:984d76483eb32f1bcb536dc27e4ad56bba4baa70be32fa87152832cdd9db0833",
|
||||
"sha256:99df47edb6bda1249d3e80fdabb1dab8c08ef3975f69aed437cb69d0a5de1e28",
|
||||
"sha256:a30e67a65b53ea0a5e62fe23682cfe22712e01f453b95233b25502f7c61cb415",
|
||||
"sha256:ab3ef638ace319fa26553db0624c4699e31a28bb2a835c5faca8f8acf6a5a902",
|
||||
"sha256:add36cb2dbb8b736611303cd3bfcee00afd96471b09cda130da3581cbdc56a6d",
|
||||
"sha256:b2f4bf27480f5e5e8ce285a8c8fd176c0b03e93dcc6646477d4630e83440c6a9",
|
||||
"sha256:b7f2d075102dc8c794cbde1947378051c4e5180d52d276987b8d28a3bd58c17d",
|
||||
"sha256:baa1a4e8f868845af802979fcdbf0bb11f94f1cb7ced4c4b8a351bb60d108145",
|
||||
"sha256:be98f628055368795d818ebf93da628541e10b75b41c559fdf36d104c5787066",
|
||||
"sha256:bf5d821ffabf0ef3533c39c518f3357b171a1651c1ff6827325e4489b0e46c3c",
|
||||
"sha256:c47adbc92fc1bb2b3274c4b3a43ae0e4573d9fbff4f54cd484555edbf030baf1",
|
||||
"sha256:d7f9850398e85aba693bb640262d3611788b1f29a79f0c93c565694658f4071f",
|
||||
"sha256:d8446c54dc28c01e5a2dbac5a25f071f6653e6e40f3a8818e8b45d790fe6ef53",
|
||||
"sha256:e0f138900af21926a02425cf736db95be9f4af72ba1bb21453432a07f6082134",
|
||||
"sha256:e9936f0b261d4df76ad22f8fee3ae83b60d7c3e871292cd42f40b81b70afae85",
|
||||
"sha256:f5653a225f31e113b152e56f154ccbe59eeb1c7487b39b9d9f9cdb58e6c79dc5",
|
||||
"sha256:f826e31d18b516f653fe296d967d700fddad5901ae07c622bb3705955e1faa94",
|
||||
"sha256:f8ba0e8349a38d3001fae7eadded3f6606f0da5d748ee53cc1dab1d6527b9509",
|
||||
"sha256:f9081981fe268bd86831e5c75f7de206ef275defcb82bc70740ae6dc507aee51",
|
||||
"sha256:fa130dd50c57d53368c9d59395cb5526eda596d3ffe36666cd81a44d56e48872"
|
||||
"sha256:0bff5e0ae4ef2e1ae4fdf2dfd5b76c75e5c2fa4132d05fc1b0dabcd20c7e28c4",
|
||||
"sha256:0f4ca02bea9a23221c0182836703cbf8930c5e9454bacce27e767509fa286a30",
|
||||
"sha256:1225beacc926f536dc82e45f8a4d68502949dc67eea90eab715dea3a21c1b5f0",
|
||||
"sha256:131a3c7689c85f5ad20f9f6fb1b866f402c445b220c19fe4308c0b147ccd2ad9",
|
||||
"sha256:15ab75ef81add55874e7ab7055e9c397312385bd9ced94920f2802310c930396",
|
||||
"sha256:1a9d3f5f0901fdec14d8d2f66ef7d035f2157240a433441719ac9a3fba440b13",
|
||||
"sha256:1c99d261bd2d5f6b59325c92c73df481e05e57f19837bdca8413b9eac4bd8028",
|
||||
"sha256:1e084f686b92e5b83186b07e8a17fc09e38fff551f3602b249881fec658d3eca",
|
||||
"sha256:2181e67807fc2fa785d0592dc2d6206c019b9502410671cc905d132a92866557",
|
||||
"sha256:2cb8438c3cbb25e220c2ab33bb226559e7afb3baec11c4f218ffa7308603c832",
|
||||
"sha256:3169b1eefae027567d1ce6ee7cae382c57fe26e82775f460f0b2778beaad66c0",
|
||||
"sha256:3809ede931876f5b2ec92eef964286840ed3540dadf803dd570c3b7e13141a3b",
|
||||
"sha256:38a9ef736c01fccdd6600705b09dc574584b89bea478200c5fbf112a6b0d5579",
|
||||
"sha256:3d79d162e7be8f996986c064d1c7c817f6df3a77fe3d6859f6f9e7be4b8c213a",
|
||||
"sha256:444dcda765c8a838eaae23112db52f1efaf750daddb2d9ca300bcae1039adc5c",
|
||||
"sha256:48032821bbdf20f5799ff537c7ac3d1fba0ba032cfc06194faffa8cda8b560ff",
|
||||
"sha256:4aa4e5faecf353ed117801a068ebab7b7e09ffb6e1d5e412dc852e0da018126c",
|
||||
"sha256:52305740fe773d09cffb16f8ed0427942901f00adedac82ec8b67752f58a1b22",
|
||||
"sha256:569511d3b58c8791ab4c2e1285575265991e6d8f8700c7be0e88f86cb0672094",
|
||||
"sha256:57cb5a3cf367aeb1d316576250f65edec5bb3be939e9247ae594b4bcbc317dfb",
|
||||
"sha256:5b02fb34468b6aaa40dfc198d813a641e3a63b98c2b05a16b9f80b7ec314185e",
|
||||
"sha256:6381026f158fdb7c72a168278597a5e3a5222e83ea18f543112b2662a9b699c5",
|
||||
"sha256:6af100e168aa82a50e186c82875a5893c5597a0c1ccdb0d8b40240b1f28b969a",
|
||||
"sha256:6c89876f41da747c8d3677a2b540fb32ef5715f97b66eeb0c6b66f5e3ef6f59d",
|
||||
"sha256:6e296a513ca3d94054c2c881cc913116e90fd030ad1c656b3869762b754f5f8a",
|
||||
"sha256:70a87b411535ccad5ef2f1df5136506a10775d267e197e4cf531ced10537bd6b",
|
||||
"sha256:7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8",
|
||||
"sha256:846ade7b71e3536c4e56b386c2a47adf5741d2d8b94ec9dc3e92e5e1ee1e2225",
|
||||
"sha256:88416bd1e65dcea10bc7569faacb2c20ce071dd1f87539ca2ab364bf6231393c",
|
||||
"sha256:88b49a3b9ff31e19998750c38e030fc7bb937398b1f78cfa599aaef92d693144",
|
||||
"sha256:8c4e8c3ce11e1f92f6536ff07154f9d49677ebaaafc32db9db4620bc11ed480f",
|
||||
"sha256:8e06879fc22a25ca47312fbe7c8264eb0b662f6db27cb2d3bbbc74b1df4b9b87",
|
||||
"sha256:9025b4018f3a1314059769c7bf15441064b2207cb3f065e6ea1e7359cb46db9d",
|
||||
"sha256:93335ca3812df2f366e80509ae119189886b0f3c2b81325d39efdb84a1e2ae93",
|
||||
"sha256:9778bd8ab0a994ebf6f84c2b949e65736d5575320a17ae8984a77fab08db94cf",
|
||||
"sha256:9e2d922824181480953426608b81967de705c3cef4d1af983af849d7bd619158",
|
||||
"sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84",
|
||||
"sha256:a904af0a6162c73e3edcb969eeeb53a63ceeb5d8cf642fade7d39e7963a22ddb",
|
||||
"sha256:ad10d3ded218f1039f11a75f8091880239651b52e9bb592ca27de44eed242a48",
|
||||
"sha256:b424c77b206d63d500bcb69fa55ed8d0e6a3774056bdc4839fc9298a7edca171",
|
||||
"sha256:b5a6b3ada725cea8a5e634536b1b01c30bcdcd7f9c6fff4151548d5bf6b3a36c",
|
||||
"sha256:ba8062ed2cf21c07a9e295d5b8a2a5ce678b913b45fdf68c32d95d6c1291e0b6",
|
||||
"sha256:ba9527cdd4c926ed0760bc301f6728ef34d841f405abf9d4f959c478421e4efd",
|
||||
"sha256:bbcb445fa71794da8f178f0f6d66789a28d7319071af7a496d4d507ed566270d",
|
||||
"sha256:bcf3e58998965654fdaff38e58584d8937aa3096ab5354d493c77d1fdd66d7a1",
|
||||
"sha256:c0ef13eaeee5b615fb07c9a7dadb38eac06a0608b41570d8ade51c56539e509d",
|
||||
"sha256:cabc348d87e913db6ab4aa100f01b08f481097838bdddf7c7a84b7575b7309ca",
|
||||
"sha256:cdb82a876c47801bb54a690c5ae105a46b392ac6099881cdfb9f6e95e4014c6a",
|
||||
"sha256:cfad01eed2c2e0c01fd0ecd2ef42c492f7f93902e39a42fc9ee1692961443a29",
|
||||
"sha256:d16a81a06776313e817c951135cf7340a3e91e8c1ff2fac444cfd75fffa04afe",
|
||||
"sha256:d8213e09c917a951de9d09ecee036d5c7d36cb6cb7dbaece4c71a60d79fb9798",
|
||||
"sha256:e07c3764494e3776c602c1e78e298937c3315ccc9043ead7e685b7f2b8d47b3c",
|
||||
"sha256:e17c96c14e19278594aa4841ec148115f9c7615a47382ecb6b82bd8fea3ab0c8",
|
||||
"sha256:e444a31f8db13eb18ada366ab3cf45fd4b31e4db1236a4448f68778c1d1a5a2f",
|
||||
"sha256:e6a2a455bd412959b57a172ce6328d2dd1f01cb2135efda2e4576e8a23fa3b0f",
|
||||
"sha256:eaa0a10b7f72326f1372a713e73c3f739b524b3af41feb43e4921cb529f5929a",
|
||||
"sha256:eb7972a85c54febfb25b5c4b4f3af4dcc731994c7da0d8a0b4a6eb0640e1d178",
|
||||
"sha256:ee55d3edf80167e48ea11a923c7386f4669df67d7994554387f84e7d8b0a2bf0",
|
||||
"sha256:f3818cb119498c0678015754eba762e0d61e5b52d34c8b13d770f0719f7b1d79",
|
||||
"sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430",
|
||||
"sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==2.0.1"
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==3.0.2"
|
||||
},
|
||||
"mypy-extensions": {
|
||||
"hashes": [
|
||||
"sha256:1be4cccdb0f2482337c4743e60421de3a356cd97508abadd57d47403e94f5505",
|
||||
"sha256:52e68efc3284861e772bbcd66823fde5ae21fd2fdb51c62a211403730b916558"
|
||||
],
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==1.1.0"
|
||||
},
|
||||
"packaging": {
|
||||
"hashes": [
|
||||
"sha256:7dc96269f53a4ccec5c0670940a4281106dd0bb343f47b7471f779df49c2fbe7",
|
||||
"sha256:c86254f9220d55e31cc94d69bade760f0847da8000def4dfe1c6b872fd14ff14"
|
||||
"sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484",
|
||||
"sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==21.0"
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==25.0"
|
||||
},
|
||||
"pathspec": {
|
||||
"hashes": [
|
||||
"sha256:a0d503e138a4c123b27490a4f7beda6a01c6f288df0e4a8b79c7eb0dc7b4cc08",
|
||||
"sha256:a482d51503a1ab33b1c67a6c3813a26953dbdc71c31dacaef9a838c4e29f5712"
|
||||
],
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==0.12.1"
|
||||
},
|
||||
"platformdirs": {
|
||||
"hashes": [
|
||||
"sha256:abd01743f24e5287cd7a5db3752faf1a2d65353f38ec26d98e25a6db65958c85",
|
||||
"sha256:ca753cf4d81dc309bc67b0ea38fd15dc97bc30ce419a7f58d13eb3bf14c4febf"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==4.4.0"
|
||||
},
|
||||
"pycparser": {
|
||||
"hashes": [
|
||||
"sha256:2d475327684562c3a96cc71adf7dc8c4f0565175cf86b6d7a404ff4c771f15f0",
|
||||
"sha256:7582ad22678f0fcd81102833f60ef8d0e57288b6b5fb00323d101be910e35705"
|
||||
"sha256:78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2",
|
||||
"sha256:e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934"
|
||||
],
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
|
||||
"version": "==2.20"
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==2.23"
|
||||
},
|
||||
"pyparsing": {
|
||||
"pytokens": {
|
||||
"hashes": [
|
||||
"sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1",
|
||||
"sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b"
|
||||
"sha256:c9a4bfa0be1d26aebce03e6884ba454e842f186a59ea43a6d3b25af58223c044",
|
||||
"sha256:db7b72284e480e69fb085d9f251f66b3d2df8b7166059261258ff35f50fb711b"
|
||||
],
|
||||
"markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
|
||||
"version": "==2.4.7"
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==0.1.10"
|
||||
},
|
||||
"pyyaml": {
|
||||
"hashes": [
|
||||
"sha256:08682f6b72c722394747bddaf0aa62277e02557c0fd1c42cb853016a38f8dedf",
|
||||
"sha256:0f5f5786c0e09baddcd8b4b45f20a7b5d61a7e7e99846e3c799b05c7c53fa696",
|
||||
"sha256:129def1b7c1bf22faffd67b8f3724645203b79d8f4cc81f674654d9902cb4393",
|
||||
"sha256:294db365efa064d00b8d1ef65d8ea2c3426ac366c0c4368d930bf1c5fb497f77",
|
||||
"sha256:3b2b1824fe7112845700f815ff6a489360226a5609b96ec2190a45e62a9fc922",
|
||||
"sha256:3bd0e463264cf257d1ffd2e40223b197271046d09dadf73a0fe82b9c1fc385a5",
|
||||
"sha256:4465124ef1b18d9ace298060f4eccc64b0850899ac4ac53294547536533800c8",
|
||||
"sha256:49d4cdd9065b9b6e206d0595fee27a96b5dd22618e7520c33204a4a3239d5b10",
|
||||
"sha256:4e0583d24c881e14342eaf4ec5fbc97f934b999a6828693a99157fde912540cc",
|
||||
"sha256:5accb17103e43963b80e6f837831f38d314a0495500067cb25afab2e8d7a4018",
|
||||
"sha256:607774cbba28732bfa802b54baa7484215f530991055bb562efbed5b2f20a45e",
|
||||
"sha256:6c78645d400265a062508ae399b60b8c167bf003db364ecb26dcab2bda048253",
|
||||
"sha256:72a01f726a9c7851ca9bfad6fd09ca4e090a023c00945ea05ba1638c09dc3347",
|
||||
"sha256:74c1485f7707cf707a7aef42ef6322b8f97921bd89be2ab6317fd782c2d53183",
|
||||
"sha256:895f61ef02e8fed38159bb70f7e100e00f471eae2bc838cd0f4ebb21e28f8541",
|
||||
"sha256:8c1be557ee92a20f184922c7b6424e8ab6691788e6d86137c5d93c1a6ec1b8fb",
|
||||
"sha256:bb4191dfc9306777bc594117aee052446b3fa88737cd13b7188d0e7aa8162185",
|
||||
"sha256:bfb51918d4ff3d77c1c856a9699f8492c612cde32fd3bcd344af9be34999bfdc",
|
||||
"sha256:c20cfa2d49991c8b4147af39859b167664f2ad4561704ee74c1de03318e898db",
|
||||
"sha256:cb333c16912324fd5f769fff6bc5de372e9e7a202247b48870bc251ed40239aa",
|
||||
"sha256:d2d9808ea7b4af864f35ea216be506ecec180628aced0704e34aca0b040ffe46",
|
||||
"sha256:d483ad4e639292c90170eb6f7783ad19490e7a8defb3e46f97dfe4bacae89122",
|
||||
"sha256:dd5de0646207f053eb0d6c74ae45ba98c3395a571a2891858e87df7c9b9bd51b",
|
||||
"sha256:e1d4970ea66be07ae37a3c2e48b5ec63f7ba6804bdddfdbd3cfd954d25a82e63",
|
||||
"sha256:e4fac90784481d221a8e4b1162afa7c47ed953be40d31ab4629ae917510051df",
|
||||
"sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc",
|
||||
"sha256:fd7f6999a8070df521b6384004ef42833b9bd62cfee11a09bda1079b4b704247",
|
||||
"sha256:fdc842473cd33f45ff6bce46aea678a54e3d21f1b61a7750ce3c498eedfe25d6",
|
||||
"sha256:fe69978f3f768926cfa37b867e3843918e012cf83f680806599ddce33c2c68b0"
|
||||
"sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff",
|
||||
"sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48",
|
||||
"sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086",
|
||||
"sha256:0b69e4ce7a131fe56b7e4d770c67429700908fc0752af059838b1cfb41960e4e",
|
||||
"sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133",
|
||||
"sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5",
|
||||
"sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484",
|
||||
"sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee",
|
||||
"sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5",
|
||||
"sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68",
|
||||
"sha256:24471b829b3bf607e04e88d79542a9d48bb037c2267d7927a874e6c205ca7e9a",
|
||||
"sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf",
|
||||
"sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99",
|
||||
"sha256:39693e1f8320ae4f43943590b49779ffb98acb81f788220ea932a6b6c51004d8",
|
||||
"sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85",
|
||||
"sha256:3b1fdb9dc17f5a7677423d508ab4f243a726dea51fa5e70992e59a7411c89d19",
|
||||
"sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc",
|
||||
"sha256:43fa96a3ca0d6b1812e01ced1044a003533c47f6ee8aca31724f78e93ccc089a",
|
||||
"sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1",
|
||||
"sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317",
|
||||
"sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c",
|
||||
"sha256:6395c297d42274772abc367baaa79683958044e5d3835486c16da75d2a694631",
|
||||
"sha256:688ba32a1cffef67fd2e9398a2efebaea461578b0923624778664cc1c914db5d",
|
||||
"sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652",
|
||||
"sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5",
|
||||
"sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e",
|
||||
"sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b",
|
||||
"sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8",
|
||||
"sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476",
|
||||
"sha256:82d09873e40955485746739bcb8b4586983670466c23382c19cffecbf1fd8706",
|
||||
"sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563",
|
||||
"sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237",
|
||||
"sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b",
|
||||
"sha256:9056c1ecd25795207ad294bcf39f2db3d845767be0ea6e6a34d856f006006083",
|
||||
"sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180",
|
||||
"sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425",
|
||||
"sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e",
|
||||
"sha256:a8786accb172bd8afb8be14490a16625cbc387036876ab6ba70912730faf8e1f",
|
||||
"sha256:a9f8c2e67970f13b16084e04f134610fd1d374bf477b17ec1599185cf611d725",
|
||||
"sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183",
|
||||
"sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab",
|
||||
"sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774",
|
||||
"sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725",
|
||||
"sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e",
|
||||
"sha256:d7fded462629cfa4b685c5416b949ebad6cec74af5e2d42905d41e257e0869f5",
|
||||
"sha256:d84a1718ee396f54f3a086ea0a66d8e552b2ab2017ef8b420e92edbc841c352d",
|
||||
"sha256:d8e03406cac8513435335dbab54c0d385e4a49e4945d2909a581c83647ca0290",
|
||||
"sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44",
|
||||
"sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed",
|
||||
"sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4",
|
||||
"sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba",
|
||||
"sha256:f753120cb8181e736c57ef7636e83f31b9c0d1722c516f7e86cf15b7aa57ff12",
|
||||
"sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4"
|
||||
],
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
|
||||
"version": "==5.4.1"
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==6.0.2"
|
||||
},
|
||||
"referencing": {
|
||||
"hashes": [
|
||||
"sha256:df2e89862cd09deabbdba16944cc3f10feb6b3e6f18e902f7cc25609a34775aa",
|
||||
"sha256:e8699adbbf8b5c7de96d8ffa0eb5c158b3beafce084968e2ea8bb08c6794dcd0"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==0.36.2"
|
||||
},
|
||||
"resolvelib": {
|
||||
"hashes": [
|
||||
"sha256:8113ae3ed6d33c6be0bcbf03ffeb06c0995c099b7b8aaa5ddf2e9b3b3df4e915",
|
||||
"sha256:9b9b80d5c60e4c2a8b7fbf0712c3449dc01d74e215632e5199850c9eca687628"
|
||||
"sha256:8e3e2000beaf53fdfd8772fda1a7b1df97e803ab7c8925621bbb87c4d187a94d",
|
||||
"sha256:c27fbb5098acd7dfc01fb2be3724bd0881168edc2bd3b4dc876ca3f46b8e4a3d"
|
||||
],
|
||||
"version": "==0.5.4"
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==1.2.0"
|
||||
},
|
||||
"rpds-py": {
|
||||
"hashes": [
|
||||
"sha256:008b839781d6c9bf3b6a8984d1d8e56f0ec46dc56df61fd669c49b58ae800400",
|
||||
"sha256:037a2361db72ee98d829bc2c5b7cc55598ae0a5e0ec1823a56ea99374cfd73c1",
|
||||
"sha256:079bc583a26db831a985c5257797b2b5d3affb0386e7ff886256762f82113b5e",
|
||||
"sha256:08f1e20bccf73b08d12d804d6e1c22ca5530e71659e6673bce31a6bb71c1e73f",
|
||||
"sha256:0b08d152555acf1f455154d498ca855618c1378ec810646fcd7c76416ac6dc60",
|
||||
"sha256:0d807710df3b5faa66c731afa162ea29717ab3be17bdc15f90f2d9f183da4059",
|
||||
"sha256:0dc5dceeaefcc96dc192e3a80bbe1d6c410c469e97bdd47494a7d930987f18b2",
|
||||
"sha256:12ed005216a51b1d6e2b02a7bd31885fe317e45897de81d86dcce7d74618ffff",
|
||||
"sha256:134fae0e36022edad8290a6661edf40c023562964efea0cc0ec7f5d392d2aaef",
|
||||
"sha256:13e608ac9f50a0ed4faec0e90ece76ae33b34c0e8656e3dceb9a7db994c692cd",
|
||||
"sha256:1441811a96eadca93c517d08df75de45e5ffe68aa3089924f963c782c4b898cf",
|
||||
"sha256:15d3b4d83582d10c601f481eca29c3f138d44c92187d197aff663a269197c02d",
|
||||
"sha256:16323f674c089b0360674a4abd28d5042947d54ba620f72514d69be4ff64845e",
|
||||
"sha256:168b025f8fd8d8d10957405f3fdcef3dc20f5982d398f90851f4abc58c566c52",
|
||||
"sha256:1b207d881a9aef7ba753d69c123a35d96ca7cb808056998f6b9e8747321f03b8",
|
||||
"sha256:1fea2b1a922c47c51fd07d656324531adc787e415c8b116530a1d29c0516c62d",
|
||||
"sha256:23f6b69d1c26c4704fec01311963a41d7de3ee0570a84ebde4d544e5a1859ffc",
|
||||
"sha256:2643400120f55c8a96f7c9d858f7be0c88d383cd4653ae2cf0d0c88f668073e5",
|
||||
"sha256:26a1c73171d10b7acccbded82bf6a586ab8203601e565badc74bbbf8bc5a10f8",
|
||||
"sha256:2bde09cbcf2248b73c7c323be49b280180ff39fadcfe04e7b6f54a678d02a7cf",
|
||||
"sha256:2c426b99a068601b5f4623573df7a7c3d72e87533a2dd2253353a03e7502566c",
|
||||
"sha256:2efe4eb1d01b7f5f1939f4ef30ecea6c6b3521eec451fb93191bf84b2a522418",
|
||||
"sha256:2f57af9b4d0793e53266ee4325535a31ba48e2f875da81a9177c9926dfa60746",
|
||||
"sha256:2fd50659a069c15eef8aa3d64bbef0d69fd27bb4a50c9ab4f17f83a16cbf8905",
|
||||
"sha256:3020724ade63fe320a972e2ffd93b5623227e684315adce194941167fee02688",
|
||||
"sha256:3182af66048c00a075010bc7f4860f33913528a4b6fc09094a6e7598e462fe39",
|
||||
"sha256:31d3ebadefcd73b73928ed0b2fd696f7fefda8629229f81929ac9c1854d0cffb",
|
||||
"sha256:33aa65b97826a0e885ef6e278fbd934e98cdcfed80b63946025f01e2f5b29502",
|
||||
"sha256:387ce8c44ae94e0ec50532d9cb0edce17311024c9794eb196b90e1058aadeb66",
|
||||
"sha256:3adc388fc3afb6540aec081fa59e6e0d3908722771aa1e37ffe22b220a436f0b",
|
||||
"sha256:3c64d07e95606ec402a0a1c511fe003873fa6af630bda59bac77fac8b4318ebc",
|
||||
"sha256:3ce0cac322b0d69b63c9cdb895ee1b65805ec9ffad37639f291dd79467bee675",
|
||||
"sha256:3d905d16f77eb6ab2e324e09bfa277b4c8e5e6b8a78a3e7ff8f3cdf773b4c013",
|
||||
"sha256:3deab27804d65cd8289eb814c2c0e807c4b9d9916c9225e363cb0cf875eb67c1",
|
||||
"sha256:3e039aabf6d5f83c745d5f9a0a381d031e9ed871967c0a5c38d201aca41f3ba1",
|
||||
"sha256:41e532bbdcb57c92ba3be62c42e9f096431b4cf478da9bc3bc6ce5c38ab7ba7a",
|
||||
"sha256:42a89282d711711d0a62d6f57d81aa43a1368686c45bc1c46b7f079d55692734",
|
||||
"sha256:466bfe65bd932da36ff279ddd92de56b042f2266d752719beb97b08526268ec5",
|
||||
"sha256:4708c5c0ceb2d034f9991623631d3d23cb16e65c83736ea020cdbe28d57c0a0e",
|
||||
"sha256:47162fdab9407ec3f160805ac3e154df042e577dd53341745fc7fb3f625e6d92",
|
||||
"sha256:4848ca84d6ded9b58e474dfdbad4b8bfb450344c0551ddc8d958bf4b36aa837c",
|
||||
"sha256:4b507d19f817ebaca79574b16eb2ae412e5c0835542c93fe9983f1e432aca195",
|
||||
"sha256:4e44099bd522cba71a2c6b97f68e19f40e7d85399de899d66cdb67b32d7cb786",
|
||||
"sha256:4ed2e16abbc982a169d30d1a420274a709949e2cbdef119fe2ec9d870b42f274",
|
||||
"sha256:4f75e4bd8ab8db624e02c8e2fc4063021b58becdbe6df793a8111d9343aec1e3",
|
||||
"sha256:4fc9b7fe29478824361ead6e14e4f5aed570d477e06088826537e202d25fe859",
|
||||
"sha256:50c946f048209e6362e22576baea09193809f87687a95a8db24e5fbdb307b93a",
|
||||
"sha256:5281ed1cc1d49882f9997981c88df1a22e140ab41df19071222f7e5fc4e72125",
|
||||
"sha256:530064db9146b247351f2a0250b8f00b289accea4596a033e94be2389977de71",
|
||||
"sha256:55266dafa22e672f5a4f65019015f90336ed31c6383bd53f5e7826d21a0e0b83",
|
||||
"sha256:5b640501be9288c77738b5492b3fd3abc4ba95c50c2e41273c8a1459f08298d3",
|
||||
"sha256:62ac3d4e3e07b58ee0ddecd71d6ce3b1637de2d373501412df395a0ec5f9beb5",
|
||||
"sha256:62f85b665cedab1a503747617393573995dac4600ff51869d69ad2f39eb5e817",
|
||||
"sha256:639fd5efec029f99b79ae47e5d7e00ad8a773da899b6309f6786ecaf22948c48",
|
||||
"sha256:6567d2bb951e21232c2f660c24cf3470bb96de56cdcb3f071a83feeaff8a2772",
|
||||
"sha256:67ce7620704745881a3d4b0ada80ab4d99df390838839921f99e63c474f82cf2",
|
||||
"sha256:689fb5200a749db0415b092972e8eba85847c23885c8543a8b0f5c009b1a5948",
|
||||
"sha256:68afeec26d42ab3b47e541b272166a0b4400313946871cba3ed3a4fc0cab1cef",
|
||||
"sha256:6e5e54da1e74b91dbc7996b56640f79b195d5925c2b78efaa8c5d53e1d88edde",
|
||||
"sha256:6f4461bf931108c9fa226ffb0e257c1b18dc2d44cd72b125bec50ee0ab1248a9",
|
||||
"sha256:6f5b7bd8e219ed50299e58551a410b64daafb5017d54bbe822e003856f06a802",
|
||||
"sha256:70d0738ef8fee13c003b100c2fbd667ec4f133468109b3472d249231108283a3",
|
||||
"sha256:71108900c9c3c8590697244b9519017a400d9ba26a36c48381b3f64743a44aab",
|
||||
"sha256:74e5b2f7bb6fa38b1b10546d27acbacf2a022a8b5543efb06cfebc72a59c85be",
|
||||
"sha256:78af06ddc7fe5cc0e967085a9115accee665fb912c22a3f54bad70cc65b05fe6",
|
||||
"sha256:7b002cab05d6339716b03a4a3a2ce26737f6231d7b523f339fa061d53368c9d8",
|
||||
"sha256:7b90b0496570bd6b0321724a330d8b545827c4df2034b6ddfc5f5275f55da2ad",
|
||||
"sha256:7ba22cb9693df986033b91ae1d7a979bc399237d45fccf875b76f62bb9e52ddf",
|
||||
"sha256:7ba32c16b064267b22f1850a34051121d423b6f7338a12b9459550eb2096e7ec",
|
||||
"sha256:7e32721e5d4922deaaf963469d795d5bde6093207c52fec719bd22e5d1bedbc4",
|
||||
"sha256:7ee6521b9baf06085f62ba9c7a3e5becffbc32480d2f1b351559c001c38ce4c1",
|
||||
"sha256:80c60cfb5310677bd67cb1e85a1e8eb52e12529545441b43e6f14d90b878775a",
|
||||
"sha256:8177002868d1426305bb5de1e138161c2ec9eb2d939be38291d7c431c4712df8",
|
||||
"sha256:819064fa048ba01b6dadc5116f3ac48610435ac9a0058bbde98e569f9e785c39",
|
||||
"sha256:84f7d509870098de0e864cad0102711c1e24e9b1a50ee713b65928adb22269e4",
|
||||
"sha256:879b0e14a2da6a1102a3fc8af580fc1ead37e6d6692a781bd8c83da37429b5ab",
|
||||
"sha256:8a3f29aba6e2d7d90528d3c792555a93497fe6538aa65eb675b44505be747808",
|
||||
"sha256:8a63b640a7845f2bdd232eb0d0a4a2dd939bcdd6c57e6bb134526487f3160ec5",
|
||||
"sha256:8b61097f7488de4be8244c89915da8ed212832ccf1e7c7753a25a394bf9b1f10",
|
||||
"sha256:8ee50c3e41739886606388ba3ab3ee2aae9f35fb23f833091833255a31740797",
|
||||
"sha256:8fabb8fd848a5f75a2324e4a84501ee3a5e3c78d8603f83475441866e60b94a3",
|
||||
"sha256:9024de74731df54546fab0bfbcdb49fae19159ecaecfc8f37c18d2c7e2c0bd61",
|
||||
"sha256:92022bbbad0d4426e616815b16bc4127f83c9a74940e1ccf3cfe0b387aba0228",
|
||||
"sha256:93a2ed40de81bcff59aabebb626562d48332f3d028ca2036f1d23cbb52750be4",
|
||||
"sha256:94c44ee01fd21c9058f124d2d4f0c9dc7634bec93cd4b38eefc385dabe71acbf",
|
||||
"sha256:9a1f4814b65eacac94a00fc9a526e3fdafd78e439469644032032d0d63de4881",
|
||||
"sha256:9d992ac10eb86d9b6f369647b6a3f412fc0075cfd5d799530e84d335e440a002",
|
||||
"sha256:9e71f5a087ead99563c11fdaceee83ee982fd39cf67601f4fd66cb386336ee52",
|
||||
"sha256:a205fdfe55c90c2cd8e540ca9ceba65cbe6629b443bc05db1f590a3db8189ff9",
|
||||
"sha256:a46fdec0083a26415f11d5f236b79fa1291c32aaa4a17684d82f7017a1f818b1",
|
||||
"sha256:a50431bf02583e21bf273c71b89d710e7a710ad5e39c725b14e685610555926f",
|
||||
"sha256:a512c8263249a9d68cac08b05dd59d2b3f2061d99b322813cbcc14c3c7421998",
|
||||
"sha256:a55b9132bb1ade6c734ddd2759c8dc132aa63687d259e725221f106b83a0e485",
|
||||
"sha256:a6e57b0abfe7cc513450fcf529eb486b6e4d3f8aee83e92eb5f1ef848218d456",
|
||||
"sha256:a75f305c9b013289121ec0f1181931975df78738cdf650093e6b86d74aa7d8dd",
|
||||
"sha256:a9e960fc78fecd1100539f14132425e1d5fe44ecb9239f8f27f079962021523e",
|
||||
"sha256:aa8933159edc50be265ed22b401125c9eebff3171f570258854dbce3ecd55475",
|
||||
"sha256:aaf94f812c95b5e60ebaf8bfb1898a7d7cb9c1af5744d4a67fa47796e0465d4e",
|
||||
"sha256:abfa1171a9952d2e0002aba2ad3780820b00cc3d9c98c6630f2e93271501f66c",
|
||||
"sha256:acb9aafccaae278f449d9c713b64a9e68662e7799dbd5859e2c6b3c67b56d334",
|
||||
"sha256:ae2775c1973e3c30316892737b91f9283f9908e3cc7625b9331271eaaed7dc90",
|
||||
"sha256:ae92443798a40a92dc5f0b01d8a7c93adde0c4dc965310a29ae7c64d72b9fad2",
|
||||
"sha256:b2e7f8f169d775dd9092a1743768d771f1d1300453ddfe6325ae3ab5332b4657",
|
||||
"sha256:b4938466c6b257b2f5c4ff98acd8128ec36b5059e5c8f8372d79316b1c36bb15",
|
||||
"sha256:b6dfb0e058adb12d8b1d1b25f686e94ffa65d9995a5157afe99743bf7369d62b",
|
||||
"sha256:b7fb801aa7f845ddf601c49630deeeccde7ce10065561d92729bfe81bd21fb33",
|
||||
"sha256:ba81d2b56b6d4911ce735aad0a1d4495e808b8ee4dc58715998741a26874e7c2",
|
||||
"sha256:bbf94c58e8e0cd6b6f38d8de67acae41b3a515c26169366ab58bdca4a6883bb8",
|
||||
"sha256:be898f271f851f68b318872ce6ebebbc62f303b654e43bf72683dbdc25b7c881",
|
||||
"sha256:bf876e79763eecf3e7356f157540d6a093cef395b65514f17a356f62af6cc136",
|
||||
"sha256:c1476d6f29eb81aa4151c9a31219b03f1f798dc43d8af1250a870735516a1212",
|
||||
"sha256:c2a8fed130ce946d5c585eddc7c8eeef0051f58ac80a8ee43bd17835c144c2cc",
|
||||
"sha256:c46c9dd2403b66a2a3b9720ec4b74d4ab49d4fabf9f03dfdce2d42af913fe8d0",
|
||||
"sha256:c4b676c4ae3921649a15d28ed10025548e9b561ded473aa413af749503c6737e",
|
||||
"sha256:c796c0c1cc68cb08b0284db4229f5af76168172670c74908fdbd4b7d7f515819",
|
||||
"sha256:c918c65ec2e42c2a78d19f18c553d77319119bf43aa9e2edf7fb78d624355527",
|
||||
"sha256:cb56c6210ef77caa58e16e8c17d35c63fe3f5b60fd9ba9d424470c3400bcf9ed",
|
||||
"sha256:cdfe4bb2f9fe7458b7453ad3c33e726d6d1c7c0a72960bcc23800d77384e42df",
|
||||
"sha256:cf9931f14223de59551ab9d38ed18d92f14f055a5f78c1d8ad6493f735021bbb",
|
||||
"sha256:d252f2d8ca0195faa707f8eb9368955760880b2b42a8ee16d382bf5dd807f89a",
|
||||
"sha256:d5fa0ee122dc09e23607a28e6d7b150da16c662e66409bbe85230e4c85bb528a",
|
||||
"sha256:d76f9cc8665acdc0c9177043746775aa7babbf479b5520b78ae4002d889f5c21",
|
||||
"sha256:d78827d7ac08627ea2c8e02c9e5b41180ea5ea1f747e9db0915e3adf36b62dcf",
|
||||
"sha256:d7ff07d696a7a38152ebdb8212ca9e5baab56656749f3d6004b34ab726b550b8",
|
||||
"sha256:d9199717881f13c32c4046a15f024971a3b78ad4ea029e8da6b86e5aa9cf4594",
|
||||
"sha256:dc23e6820e3b40847e2f4a7726462ba0cf53089512abe9ee16318c366494c17a",
|
||||
"sha256:dce51c828941973a5684d458214d3a36fcd28da3e1875d659388f4f9f12cc33e",
|
||||
"sha256:dd2135527aa40f061350c3f8f89da2644de26cd73e4de458e79606384f4f68e7",
|
||||
"sha256:dd6cd0485b7d347304067153a6dc1d73f7d4fd995a396ef32a24d24b8ac63ac8",
|
||||
"sha256:df8b74962e35c9249425d90144e721eed198e6555a0e22a563d29fe4486b51f6",
|
||||
"sha256:dfbfac137d2a3d0725758cd141f878bf4329ba25e34979797c89474a89a8a3a3",
|
||||
"sha256:e202e6d4188e53c6661af813b46c37ca2c45e497fc558bacc1a7630ec2695aec",
|
||||
"sha256:e2f6fd8a1cea5bbe599b6e78a6e5ee08db434fc8ffea51ff201c8765679698b3",
|
||||
"sha256:e48af21883ded2b3e9eb48cb7880ad8598b31ab752ff3be6457001d78f416723",
|
||||
"sha256:e4b9fcfbc021633863a37e92571d6f91851fa656f0180246e84cbd8b3f6b329b",
|
||||
"sha256:e5c20f33fd10485b80f65e800bbe5f6785af510b9f4056c5a3c612ebc83ba6cb",
|
||||
"sha256:eb11a4f1b2b63337cfd3b4d110af778a59aae51c81d195768e353d8b52f88081",
|
||||
"sha256:ed090ccd235f6fa8bb5861684567f0a83e04f52dfc2e5c05f2e4b1309fcf85e7",
|
||||
"sha256:ed10dc32829e7d222b7d3b93136d25a406ba9788f6a7ebf6809092da1f4d279d",
|
||||
"sha256:eda8719d598f2f7f3e0f885cba8646644b55a187762bec091fa14a2b819746a9",
|
||||
"sha256:ee4308f409a40e50593c7e3bb8cbe0b4d4c66d1674a316324f0c2f5383b486f9",
|
||||
"sha256:ee5422d7fb21f6a00c1901bf6559c49fee13a5159d0288320737bbf6585bd3e4",
|
||||
"sha256:f149826d742b406579466283769a8ea448eed82a789af0ed17b0cd5770433444",
|
||||
"sha256:f2729615f9d430af0ae6b36cf042cb55c0936408d543fb691e1a9e36648fd35a",
|
||||
"sha256:f39f58a27cc6e59f432b568ed8429c7e1641324fbe38131de852cd77b2d534b0",
|
||||
"sha256:f41f814b8eaa48768d1bb551591f6ba45f87ac76899453e8ccd41dba1289b04b",
|
||||
"sha256:f9025faafc62ed0b75a53e541895ca272815bec18abe2249ff6501c8f2e12b83",
|
||||
"sha256:faf8d146f3d476abfee026c4ae3bdd9ca14236ae4e4c310cbd1cf75ba33d24a3",
|
||||
"sha256:fb08b65b93e0c6dd70aac7f7890a9c0938d5ec71d5cb32d45cf844fb8ae47636",
|
||||
"sha256:fb7c72262deae25366e3b6c0c0ba46007967aea15d1eea746e44ddba8ec58dcc",
|
||||
"sha256:fb89bec23fddc489e5d78b550a7b773557c9ab58b7946154a10a6f7a214a48b2",
|
||||
"sha256:fe0dd05afb46597b9a2e11c351e5e4283c741237e7f617ffb3252780cca9336a",
|
||||
"sha256:fecc80cb2a90e28af8a9b366edacf33d7a91cbfe4c2c4544ea1246e949cfebeb",
|
||||
"sha256:fed467af29776f6556250c9ed85ea5a4dd121ab56a5f8b206e3e7a4c551e48ec",
|
||||
"sha256:ffce0481cc6e95e5b3f0a47ee17ffbd234399e6d532f394c8dce320c3b089c21"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==0.27.1"
|
||||
},
|
||||
"ruamel-yaml": {
|
||||
"hashes": [
|
||||
"sha256:148f6488d698b7a5eded5ea793a025308b25eca97208181b6a026037f391f701",
|
||||
"sha256:dbfca74b018c4c3fba0b9cc9ee33e53c371194a9000e694995e620490fd40700"
|
||||
],
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==0.18.15"
|
||||
},
|
||||
"ruamel-yaml-clib": {
|
||||
"hashes": [
|
||||
"sha256:040ae85536960525ea62868b642bdb0c2cc6021c9f9d507810c0c604e66f5a7b",
|
||||
"sha256:0467c5965282c62203273b838ae77c0d29d7638c8a4e3a1c8bdd3602c10904e4",
|
||||
"sha256:0b7e75b4965e1d4690e93021adfcecccbca7d61c7bddd8e22406ef2ff20d74ef",
|
||||
"sha256:11f891336688faf5156a36293a9c362bdc7c88f03a8a027c2c1d8e0bcde998e5",
|
||||
"sha256:1492a6051dab8d912fc2adeef0e8c72216b24d57bd896ea607cb90bb0c4981d3",
|
||||
"sha256:20b0f8dc160ba83b6dcc0e256846e1a02d044e13f7ea74a3d1d56ede4e48c632",
|
||||
"sha256:22353049ba4181685023b25b5b51a574bce33e7f51c759371a7422dcae5402a6",
|
||||
"sha256:2c59aa6170b990d8d2719323e628aaf36f3bfbc1c26279c0eeeb24d05d2d11c7",
|
||||
"sha256:32621c177bbf782ca5a18ba4d7af0f1082a3f6e517ac2a18b3974d4edf349680",
|
||||
"sha256:3bc2a80e6420ca8b7d3590791e2dfc709c88ab9152c00eeb511c9875ce5778bf",
|
||||
"sha256:3eac5a91891ceb88138c113f9db04f3cebdae277f5d44eaa3651a4f573e6a5da",
|
||||
"sha256:4a6679521a58256a90b0d89e03992c15144c5f3858f40d7c18886023d7943db6",
|
||||
"sha256:4c8c5d82f50bb53986a5e02d1b3092b03622c02c2eb78e29bec33fd9593bae1a",
|
||||
"sha256:4f6f3eac23941b32afccc23081e1f50612bdbe4e982012ef4f5797986828cd01",
|
||||
"sha256:5a0e060aace4c24dcaf71023bbd7d42674e3b230f7e7b97317baf1e953e5b519",
|
||||
"sha256:6442cb36270b3afb1b4951f060eccca1ce49f3d087ca1ca4563a6eb479cb3de6",
|
||||
"sha256:6c8fbb13ec503f99a91901ab46e0b07ae7941cd527393187039aec586fdfd36f",
|
||||
"sha256:749c16fcc4a2b09f28843cda5a193e0283e47454b63ec4b81eaa2242f50e4ccd",
|
||||
"sha256:7dd5adc8b930b12c8fc5b99e2d535a09889941aa0d0bd06f4749e9a9397c71d2",
|
||||
"sha256:811ea1594b8a0fb466172c384267a4e5e367298af6b228931f273b111f17ef52",
|
||||
"sha256:932205970b9f9991b34f55136be327501903f7c66830e9760a8ffb15b07f05cd",
|
||||
"sha256:943f32bc9dedb3abff9879edc134901df92cfce2c3d5c9348f172f62eb2d771d",
|
||||
"sha256:95c3829bb364fdb8e0332c9931ecf57d9be3519241323c5274bd82f709cebc0c",
|
||||
"sha256:96777d473c05ee3e5e3c3e999f5d23c6f4ec5b0c38c098b3a5229085f74236c6",
|
||||
"sha256:a274fb2cb086c7a3dea4322ec27f4cb5cc4b6298adb583ab0e211a4682f241eb",
|
||||
"sha256:a52d48f4e7bf9005e8f0a89209bf9a73f7190ddf0489eee5eb51377385f59f2a",
|
||||
"sha256:a606ef75a60ecf3d924613892cc603b154178ee25abb3055db5062da811fd969",
|
||||
"sha256:ab007f2f5a87bd08ab1499bdf96f3d5c6ad4dcfa364884cb4549aa0154b13a28",
|
||||
"sha256:b82a7c94a498853aa0b272fd5bc67f29008da798d4f93a2f9f289feb8426a58d",
|
||||
"sha256:bb43a269eb827806502c7c8efb7ae7e9e9d0573257a46e8e952f4d4caba4f31e",
|
||||
"sha256:bc5f1e1c28e966d61d2519f2a3d451ba989f9ea0f2307de7bc45baa526de9e45",
|
||||
"sha256:bd0a08f0bab19093c54e18a14a10b4322e1eacc5217056f3c063bd2f59853ce4",
|
||||
"sha256:beffaed67936fbbeffd10966a4eb53c402fafd3d6833770516bf7314bc6ffa12",
|
||||
"sha256:bf165fef1f223beae7333275156ab2022cffe255dcc51c27f066b4370da81e31",
|
||||
"sha256:cf12567a7b565cbf65d438dec6cfbe2917d3c1bdddfce84a9930b7d35ea59642",
|
||||
"sha256:d84318609196d6bd6da0edfa25cedfbabd8dbde5140a0a23af29ad4b8f91fb1e",
|
||||
"sha256:d85252669dc32f98ebcd5d36768f5d4faeaeaa2d655ac0473be490ecdae3c285",
|
||||
"sha256:e143ada795c341b56de9418c58d028989093ee611aa27ffb9b7f609c00d813ed",
|
||||
"sha256:e188d2699864c11c36cdfdada94d781fd5d6b0071cd9c427bceb08ad3d7c70e1",
|
||||
"sha256:e2f1c3765db32be59d18ab3953f43ab62a761327aafc1594a2a1fbe038b8b8a7",
|
||||
"sha256:e5b8daf27af0b90da7bb903a876477a9e6d7270be6146906b276605997c7e9a3",
|
||||
"sha256:e7e3736715fbf53e9be2a79eb4db68e4ed857017344d697e8b9749444ae57475",
|
||||
"sha256:e8c4ebfcfd57177b572e2040777b8abc537cdef58a2120e830124946aa9b42c5",
|
||||
"sha256:f66efbc1caa63c088dead1c4170d148eabc9b80d95fb75b6c92ac0aad2437d76",
|
||||
"sha256:fc4b630cd3fa2cf7fce38afa91d7cfe844a9f75d7f0f36393fa98815e911d987",
|
||||
"sha256:fd5415dded15c3822597455bc02bcd66e81ef8b7a48cb71a33628fc9fdde39df"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==0.2.12"
|
||||
},
|
||||
"subprocess-tee": {
|
||||
"hashes": [
|
||||
"sha256:21942e976715af4a19a526918adb03a8a27a8edab959f2d075b777e3d78f532d",
|
||||
"sha256:91b2b4da3aae9a7088d84acaf2ea0abee3f4fd9c0d2eae69a9b9122a71476590"
|
||||
],
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==0.4.2"
|
||||
},
|
||||
"wcmatch": {
|
||||
"hashes": [
|
||||
"sha256:5848ace7dbb0476e5e55ab63c6bbd529745089343427caa5537f230cc01beb8a",
|
||||
"sha256:f11f94208c8c8484a16f4f48638a85d771d9513f4ab3f37595978801cb9465af"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==10.1"
|
||||
},
|
||||
"yamllint": {
|
||||
"hashes": [
|
||||
"sha256:364f0d79e81409f591e323725e6a9f4504c8699ddf2d7263d8d2b539cd66a583",
|
||||
"sha256:81f7c0c5559becc8049470d86046b36e96113637bcbe4753ecef06977c00245d"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==1.37.1"
|
||||
},
|
||||
"zipp": {
|
||||
"hashes": [
|
||||
"sha256:071652d6115ed432f5ce1d34c336c0adfd6a884660d1e9712a256d3d3bd4b14e",
|
||||
"sha256:a07157588a12518c9d4034df3fbbee09c814741a33ff63c05fa29d26a2404166"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==3.23.0"
|
||||
}
|
||||
},
|
||||
"develop": {}
|
||||
|
||||
@@ -4,7 +4,7 @@ Ansible playbook for base and initial configuration of the web server hosting my
|
||||
## Assumptions
|
||||
Before you can run this, a few things are assumed:
|
||||
|
||||
- You have a clean, minimal Ubuntu 18.04, Debian 10, or Ubuntu 20.04 host up and running
|
||||
- You have a clean, minimal Debian 12 host up and running
|
||||
- Python 3 is installed on the remote server (requirement of Ansible)
|
||||
- You have a user account with password-less SSH access to the machine
|
||||
- You have sudo privileges on the remote host
|
||||
|
||||
12
ansible.cfg
12
ansible.cfg
@@ -2,16 +2,16 @@
|
||||
retry_files_enabled=False
|
||||
force_handlers=True
|
||||
inventory=hosts
|
||||
gathering = smart
|
||||
# instead of using --ask-vault-pass
|
||||
ask_vault_pass=True
|
||||
remote_user = provisioning
|
||||
interpreter_python=auto
|
||||
|
||||
ansible_managed = This file is managed by Ansible.%n
|
||||
template: {file}
|
||||
date: %Y-%m-%d %H:%M:%S
|
||||
user: {uid}
|
||||
host: {host}
|
||||
# Don't warn on unknown SSH host keys because it's super annoying for new hosts
|
||||
# or if you get a new laptop and run Ansible there!
|
||||
#
|
||||
# See: https://docs.ansible.com/ansible/latest/user_guide/connection_details.html#managing-host-key-checking
|
||||
host_key_checking = False
|
||||
|
||||
[privilege_escalation]
|
||||
# instead of using -K
|
||||
|
||||
@@ -3,4 +3,12 @@
|
||||
|
||||
tls_cipher_suite: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
|
||||
|
||||
ansible_managed: |-
|
||||
This file is managed by Ansible.
|
||||
|
||||
{{ 'template: ' + template_path }}
|
||||
{{ 'date: ' + (template_mtime | string) }}
|
||||
{{ 'user: ' + template_uid }}
|
||||
{{ 'host: ' + template_host }}
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,8 +1,14 @@
|
||||
---
|
||||
# file: group_vars/web
|
||||
|
||||
# run nginx by default
|
||||
webserver: nginx
|
||||
|
||||
# all hosts run fail2ban with the sshd filter, but some can use other filters
|
||||
extra_fail2ban_filters:
|
||||
- nginx
|
||||
|
||||
# root prefix for all web servers
|
||||
web_root_prefix: /var/www
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,71 +0,0 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
39303965636262373331663530663562363864636132363362616636346166303835336463326261
|
||||
6435316332636438363630386231326231666163626335350a353662623034313766383035636237
|
||||
38346531313235613266646665363135393735613836393838313164356561663431333864353237
|
||||
6230666363363738370a306432643732626337376638383564323032626465306263643533653561
|
||||
63326261323032303466656162303132633933643232656238643936306235316436616237333963
|
||||
32633363333636303564383062636463393531326565643732396539386230393434633134306433
|
||||
38363130626139616631373336653530343762336165666131303464386561646434363163333034
|
||||
65323837313164343238623766373431656462376262393737323166306537353365663163383032
|
||||
61393662393433653937313533313537336132663432383634343163653866306232326464626131
|
||||
33356630666130376565663666613032333637633061663433623363626632356531313231393136
|
||||
64343463396632633061353861613438613537666466613132316265326530343733343535333836
|
||||
39376632373137383636623637373639653933623639646266336331353337343166313132613131
|
||||
32373632323363616333303863656537613264346439326662383265323731613263396138366161
|
||||
62393838376435393036383836646433346365306239666335356265616237336138373632313139
|
||||
63613236613166343332363730356262373131646462373561663964343438623863636539633030
|
||||
38353430363435616139353165633330396135383939396531333436663533666564653765336330
|
||||
39303832633931653461363766616562323865383832663434356534386337386262653730663838
|
||||
65623234356134393963376431653965353566303261386533383736316439636536363463633339
|
||||
35323939373939386436336233333664313735376439353062306562353435323031346335666334
|
||||
36306537643734316131373335613234363135393866333231343533623961333562646333663332
|
||||
64643036386237626138633561613966373831326331636437636564616662326563393336636138
|
||||
62643034333831333765636532633235653733303838393430363830346436646632373364353832
|
||||
33376635336338303230343833313936633832653235353836633932393230376435353739646563
|
||||
31653765393631316135366466353162633261386132633433313866363563386563383437623538
|
||||
33636134646531383130663038343939333565613736363162366132303535336663646265353138
|
||||
32376536623864656531346434383537396563383130386231336431653464326461326531393861
|
||||
62356361636434623133383264326433333163633964316262633138633838393234343538316465
|
||||
32656534623839343132313662636464333963306138356162623462353933633436333930346430
|
||||
33636235303339353236646438666233653736653566356638653538366131646432373338303535
|
||||
38643630363231656334623539633235393062656165316266626538663339363538343031323835
|
||||
34383865663936383161326664353464393263626262383463616336623662613233656630303037
|
||||
35633461643439666233666136626462353838323162653730646632636132323632663666316166
|
||||
34373237343931363331653966306535396635306364643135336234366364303062383332376532
|
||||
61623337326236623861326433653739613133666538396438643937353730363062626136333034
|
||||
35353733633234313965616439326666623936303464323462313037303230346164353366373661
|
||||
33613231316461386636383030643862616165623565623337346264656531393232323030306464
|
||||
37393065386161383532663862333263626338393832343566383065316434656564613831636535
|
||||
30653330393936323733373938353763643431366134636263616535343565656164343931326464
|
||||
65653464373231636337313932636238376130323566323637376634626439366635363537623234
|
||||
34656466366435666162643237383163303936383061393939356438303765313566343162303038
|
||||
37383531326436373336363134663838346463613462333265663363323538663437623830363831
|
||||
39333934316634386562333330613831386530633365613939393638373063323830636363356432
|
||||
62626562366634636266333737343238363235613366313737383335383264343435623434353838
|
||||
63633964333262616439623266643938313466396339343237666239363730393935626466366434
|
||||
66333739373662656237386663373465303336343432393735376463643562303431383832313934
|
||||
61396134393830303234383162633533336436346334393265363766386638303831613036343163
|
||||
33663638323235613465363539373965326430323035656564633830656365663537393233626365
|
||||
61646162383439626638633137656639653830366162636532616634313738353166633438346433
|
||||
64633037343864343939383865333737366638386331623230303830343636363938366432366265
|
||||
37313963633536396433376331663132643435376164393138653738376338623239323966363430
|
||||
63346464303162306332303036346362626134363666396130326163613730633966393438316333
|
||||
30626365623532636436646138373434343031643131343238353661623636623138346333663866
|
||||
62393937376538343135353030653838346239393633343239313137663464353165653961336237
|
||||
36646332663539363438343939643335613236666630616636623837386133396262303033333435
|
||||
36336566333333393137666533323439303036653362333832346537356663656635356635363761
|
||||
62363638316435633563396662323131383736663939633133626131616638653665633963623439
|
||||
33343038326339356634366461346132393537613232623334326561366164333862343766386137
|
||||
66636437613661616261336232316436353739316463383063363663383230613934663334333538
|
||||
39623037646638386263643438623137346137616664396638366436383561313933633039393936
|
||||
32383432363363666466363364376631346365373239353339633532666134396138373765643031
|
||||
64333061343237616135643439396266616161333537333837643530633136313932623531653163
|
||||
36373165393238306264353461383765343938393635633236313565393733306536386464373639
|
||||
38386131623133376230653134316536356238336162356331376465613962356231316666643661
|
||||
65616138333731313961316463643137373831616266623631376266643864656164356531316238
|
||||
34376264373432356162363962353338393362386434313465643533396330386666636430663530
|
||||
66396665383431333534383038333163336639613435333039633136366235636638393337613232
|
||||
35636336383333376138306630383230383861396164386162323264376234396130323933666437
|
||||
38343036656562636130366663663565666530623765353265363833303634643862313634326461
|
||||
62643864613762386366633634343964396631356462346665663131623034303133346438613433
|
||||
6336623030393661663631303038366630353638613337653365
|
||||
@@ -1,112 +0,0 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
30376632333335323537323138636238323530386133633466623762316234336531396562613262
|
||||
6436623766616265346136633061383834323438303661350a373331386231633036313264616262
|
||||
64303263633334383736616133666330646666623936373762356131626637383939643739376563
|
||||
6137333439396337330a643631353338366666363135393635356333313232633638386366653163
|
||||
63643165356563383265333534303430363939643539396637303861396432633963653332653164
|
||||
33346537336434666333343733623464653565386630346131306538356238306537353037363139
|
||||
30383039346539356166313534666433393539633231356138303662386137626136623735303161
|
||||
62633036653531303837666331636165386164613766643764653664633361353431343139653266
|
||||
31393937656565303161646135376130613932376266616337633262613739333830356235633030
|
||||
32326230633536353938363032373165353737643631636662663333386561393262313866346530
|
||||
39376532633961376337613133636233366433623764666536616439643833316331633965616364
|
||||
30336135643639313531323538663337363930373630633238356663623366666539313161323839
|
||||
66656530333136663932643731663739636331633363623063646366353935666634636365653934
|
||||
62643461306163626632353732356133313563326163646661343134383064353966363933643033
|
||||
66346636363662656138326530366136303762326265636364323038653562366631366563613830
|
||||
34316130393030643136663263643934333731626361333932363338396661346330323234363135
|
||||
65663631333630303032373530363930333062643436303736303938656331373138623163396232
|
||||
36643838303038363736306639353238373234643162313233356463333764393031643865323033
|
||||
30353031363061643363623464376164636233623765343739613565336236626638393966396631
|
||||
66396262653535663365343434316139363235633333613438316162323538663562336164656438
|
||||
62653532636631653831663331353536633335376465653935313564333364363565323761636261
|
||||
63653565383837623936313535313063373336663337643837363831653235303530646464633935
|
||||
62663932373634356631633736656166356539346339656363613933656562323965633165613837
|
||||
35396330353861316562653166363931333362333863663231386538363932383361316439313561
|
||||
30313266626162633965316331633330616435376539626239356266313439653162613731323261
|
||||
36343961623763376664326137303866376562346438623739393665333539366537373461393739
|
||||
65336230623138336166376565643865626362323336343833653964643166613738363361353464
|
||||
31333832663234613035383731666130326461393063313933343132336432653439323439373131
|
||||
34376232323132623532646532306337373531316466303037326139666133613930666662373236
|
||||
31303031626532333133666133306337366530353139393433643432386132393662383363376335
|
||||
65623839313935613761303865313632303166343732343964393539313732333033613034306661
|
||||
30333832656636316232643439633831633530373866343866306432646534336634383830353335
|
||||
34303336303735386166653034346137643961363031336461653165376235323763346531353762
|
||||
38346230666138336333383537353132336665376163363032613639363830353634623662303564
|
||||
65373235646339386635353430623464336230313234363332656335346432313235373230643130
|
||||
33623761343635303131366239363837656262366364643162393036343630336232363032623466
|
||||
30663531343830613461393038353638666266623162653464643761323237616337633937353933
|
||||
61643666386536306664636237346231623764326536656537613535383038613365313332623964
|
||||
31306462626361653131666337653638313135663833386535366464333838333463326363306463
|
||||
32396338373361303736373135326230393330376539316564626362646166343362366465623232
|
||||
33623636653061653461303537613232346333396137313762663539623631636361303837336666
|
||||
62636638363735653965303532393130303733316231613134313637666166323238336333333966
|
||||
63353663326234663735336265643833626161623332373261376635633364613337396638666361
|
||||
63653435366135666162653739303032313438343031653561313739336135333937633933383966
|
||||
61336439656638616432383164376166356362333738373135386538613164373537396435323332
|
||||
37626530363437323765646561366437393562653839333964396538656265326563393863653662
|
||||
32646432383966363732386163376263373433633934623237636335363163386332633565636334
|
||||
36396330313761663237386165333465383033376330633461643666636136656635343365316266
|
||||
66643363663666343337313530663762303234643335326563656239613665373633393837643963
|
||||
35356263393566363362373965393331353439633431633539336565333565326631336631323833
|
||||
35656466626463663037386334343530356661663236646166353733333431656534376439646235
|
||||
31653564636264666137396362643763353364393132306432336164356366616533363937393665
|
||||
61353161343238316433363733636530633361316436303863666466666162363835643437653633
|
||||
31376561653266373863623266393464363433303436656563376561643237396436333462333365
|
||||
31656238383631643034363063633132343665663563656333613636636134383333343662313237
|
||||
32643839646363343162383536343066643862666439653462376231386538356430373263393865
|
||||
61663333373330316131653335643161626366333237383633363564316231633761323165313265
|
||||
32666137643236333561616331373236373137663866656539663738343862666534386531336661
|
||||
30643533633566326135333464316264636461376630363732336339373730663239356265663834
|
||||
33643933326231373464333263336632313633303431396539346238383761346363323230623832
|
||||
39623866306261373035633166656234313461306535383638386431666164313936356664616264
|
||||
65343934383931303962653536643031636235626234306164386531633535633139393835636435
|
||||
39616166363031396564373932376534383830313034333764333161316438396636383265643235
|
||||
66373332633037376138653230333664393164613136316439393531623134383261626262383432
|
||||
63313461373136616236656432343262663734663665623838383032666631636635656339353335
|
||||
61636531356131393665323164643561646334363737343434613930616333383465623832306235
|
||||
61396136313662663839613034633433396664336361353539633561616238623864346166356161
|
||||
66373736633239353233313531633939643065303530323031623735636539633834653162633262
|
||||
63633265316234653537376463636138393139643661393233303631373562393234626161343766
|
||||
66363265393930353733623363653434313765323532646665626563373563616536393938623465
|
||||
37326330636664386464653832306138313137616464386339366539623434333062623136353539
|
||||
36643631323863393934333266376362323430356665653863316163336563323865396132323836
|
||||
62346131336133643438633064326236666165386439663931636335306333396534383462356135
|
||||
63306130376634386462663139323439333066383331336163623665616665316162613130376433
|
||||
38333339636237326230643061386234643064656138396163396134613837666531383261333230
|
||||
30643262333530396563366233323338656364666461316134363532636537303832343361313364
|
||||
65626566373266643165623832626634653733383334396435616139346434393036323162373861
|
||||
31356137353032613831643037613239393061306565336435313431333738623338323766303139
|
||||
38333137656564386334333666636431323738623264633136663239346635386662313366336334
|
||||
37643465333336383739623235373064363662373937663330623132623236313432306533373937
|
||||
66623130626638333962386334633537643338376566323638373939323230643734313263386531
|
||||
63623966613832626136393734326639363262386531343862353631303834643837346164646232
|
||||
66623561613436326363363932373563363337343431356432633663383636356339616362366638
|
||||
38363532393832643665356461393661373838613764383061643364383962663535353531346365
|
||||
61366266326135663264323132353832386135383165646439633561313636373633316666353065
|
||||
38396665636239653038653634653831363933633531653965636135316136393532623561373539
|
||||
36333263306664633865653365363261643135633062356637343365656133656336323131313562
|
||||
39316639383432326632396135313064353834656265383537313866396439663865363134363066
|
||||
61646337363537323531306434646163623162333362343162316235323436386337623761666638
|
||||
36376336616665336334353661333237366638343436613839613761326336363435326630633234
|
||||
37303562333762393334663462633063623036343331323761393932336166363038383731363238
|
||||
35363639353134383637396463633263353735386263663535336139616230303863313362616464
|
||||
39303264363566346666326236643563643961333232626637356534343530356430366238336339
|
||||
37626233383230636234623532643739353162303562633537303536376535646235313837376666
|
||||
62376365623566666561333933346232316637326634343437363333666530326237663632356338
|
||||
39376333653436366439663439343639613661396562623661376538646532316432646266663566
|
||||
39306235616335313731396436363836643766333462393733363833303938346561613764343738
|
||||
38356261346332666564633333363566353465316133396362313135623463376133666661363133
|
||||
61626232383631353965336362623835616137323837333139653338663739346265633832396535
|
||||
39373436316434633539353137636633386562323034656663303834313538333063613437393131
|
||||
37616162653566346233386130363134343536363862626430313064393437363063663439383463
|
||||
39613530393838323064636263633464623234323137323831383232333561663563303561363836
|
||||
62383430663333613062326530346465636164393133313832626135663231353965303131323631
|
||||
31363165623431373637623938353437663062623465303262316434373161326462326535616362
|
||||
31613934363836613961363637303161303833646165313462323938623664326231623662616664
|
||||
66613665326162373363303165613131343731323330326266336132323039306338343064663831
|
||||
35303832336132633061363664633166313963336563323130663735646662636362386461623930
|
||||
36356131646332336562383536626137303031323861663635393234393737353638623063363163
|
||||
35643965376632383430633232343861373335373132373738383032646138303862353562333533
|
||||
66306530646666363239383239616433376663303131366431666639323766616333313165313237
|
||||
626437356166333063393265353264346565
|
||||
@@ -1,82 +0,0 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
32316564336430646233343166663333653363613837643863373531333737353431383233653733
|
||||
6535373830313135623134666430656164386365343738650a383239383839323032383363613938
|
||||
32383630373834633564336532343634336130303330323266373930623033663234306232656136
|
||||
6566666131306666310a636163366161373436326461626661353130386538313361666538663531
|
||||
37393336316638663065393338356535343732363765633762343536393662313539326432383337
|
||||
33613438383134393535663435333364363836346266383262336439356133343464313736636134
|
||||
35626530303836663834396266333461613463313634643661303430356633613137383634613038
|
||||
31646632326330633430653435353431646131363466316231636333663430636531376133623935
|
||||
65346466616433653463613538363630306338393632356365346330643463383835326466613930
|
||||
39323766653730373763333161303564306165316336393164343235613831333762646532333139
|
||||
31336561316337366537343464373735303138303763623632316235613333313230303433303337
|
||||
64333065626434333831613239363831356565363231656466623830613138616438633164393337
|
||||
39343634326461303839356231616336376430383639653535323538303364633761666432386230
|
||||
31653037666630663434303032333163643336326563623661326536653839323263623838646366
|
||||
37353566313737616337356165636234373835366236383661316331306530646165633037303866
|
||||
64646639366366353534376238333435613934316666396434346336353533626131646239376634
|
||||
63663064666434633265343432376337343533636566613930303930633861356234303838333138
|
||||
66323063386362373930306338636463663865353339376663323936613365336533373666323465
|
||||
31666634353034366236306562363361373664623634663837396162393738613536636165366332
|
||||
34643935626164633436333930373535623863303331663334376434643236353462666362303963
|
||||
39313139303731316264383434333863323764343737303733383535393763356130316337383564
|
||||
38656434303663333534376336613036653963306363303661336464346362656563303333303566
|
||||
39366163636439313030366461353064303233636364633064343664646339346365383465633038
|
||||
35353234353430623830623036383466663236663964316530333964643238626562396366623763
|
||||
35636439633064613931653963663331343961613764643364663336643264643535316634393834
|
||||
65393932343333326166643765623266313135363362656431633933656131336163653663373335
|
||||
37323531376438343561623237623433323234663531326436663162396562623963663936633837
|
||||
62336139623231663339303439353362306466663834626364326466336435323764373661616437
|
||||
62613664356633396264643766323535666562343336313033333632366231626666333630313261
|
||||
39663365316161316261633734663063633539333535393830653034663362323764643330653539
|
||||
37393832303435366639643730616239613935376233636537306232653034626532636563393336
|
||||
63323633366631623738393161373037623865633039386566653239663638343864643561346534
|
||||
33346238306434343639623135373861333830376561663433306139383864653333356264376631
|
||||
39633437393538356565623962643465666538343031383737616532316230383466346261383762
|
||||
33613535336663386434366365336330353337653365663132336130366338343433333863306135
|
||||
62303738353634613462313866366231386430373566653339316333353364373761663161623736
|
||||
64313262303963336364376534336462373939623033666163633337323837363138363937663665
|
||||
39613263633463376362626565306564353864393965333663663334643931363862306635353061
|
||||
31633063303839633030306363646161646466323734616536343965636539633630326664636139
|
||||
61653832386339326132303334616136393731393263313034643037383063326566343936666562
|
||||
38393363306231306436636235633533373731616137653965316133303661663163313661373466
|
||||
36653864666232313064353066386133613764623562623035386263363962653432633633366230
|
||||
32373033303234666264356665363031343633663236313738636238306535313536353232663037
|
||||
38316237353433396166636165643261643464313762666333393265376465323630313463333465
|
||||
61613735613864313662383735306638363436316162353536633836653637613439373635376566
|
||||
36613162393638313363396237313466646166346139373230336533346234356665646432646562
|
||||
32343863343435643462663362396564626536323665343230343632396135303930306334383534
|
||||
39356166303230643465643737386634633531393238313631393664663237316236356465383532
|
||||
32353263326364383465623733326532633330663738633564313264306636623137323433396264
|
||||
33623164333662383335623964393330373264646265366662613236613033653035623932666264
|
||||
34373639666432656464363433356466653331633238373863343064656431666561636236376332
|
||||
30333930623539376636316263663663303130616537356632383036386438663630623261636239
|
||||
63623238646364323431613936646337306361373539346465303635383065306664643566363137
|
||||
37643163373833343162653563623432656132653462313334333439303236383563326465323038
|
||||
31353936636563613865383730363462626636383430336536656436656136333764353133663936
|
||||
38623330303531373461396163366237656632666538303034343961396631313966653532373465
|
||||
62393562303330613164346464373764633933323539353861326239343133613236613663366265
|
||||
38623138316138383832353931626530303538346433303035313266366638313437356264626661
|
||||
30363631316234303634343561656431633632666139363330396465316564323864653434643730
|
||||
39646531353233313639323365353736613262646164343664656162386536666361646666643238
|
||||
34333462333632643236343665316534626537393362353633383539633131613233646262313961
|
||||
66656131323333303939316239643739323665306433626366656538366438653934656336303130
|
||||
36613430613565666437323233343132303432383533396533373439306630343430353535343333
|
||||
35616361376539376661336637346562636438646534623265393635313466633937363135316238
|
||||
65616265396337303431333262306330383365643035303639303538303266323932613466363336
|
||||
31366565653731393661616132353235386162346338343734356633303433366666303332626662
|
||||
35353261306264346534333161333165633163376534303861663863326638623761343733303433
|
||||
63343365626463613965363134663137373538633533616635356561646235623365373633303064
|
||||
31666562613134306632356564383166336464343833633037623663656338623637336135663562
|
||||
38326538643961333363353831303266326262333730633565383666326137393430373966316161
|
||||
66376230323633333562623564636264353138303039306537383930376464333233643862613038
|
||||
38313231386161343438303433646566633236353232313737613563613932373035623034653066
|
||||
63643330316462303832306533376330383466373566643233373334336330666362653337316137
|
||||
38353930343338393162313135616165373437633737376131346662306438643537316537653330
|
||||
65643731383435393530383038316431663638396538313131306661663934313535616261356532
|
||||
36626435656332633861616465326231386635383838633232653432336362313164633839326339
|
||||
65303834613235326436386539613537646363633733323735646630343631636235393533656266
|
||||
65656639356337623464346337326232616234313664306165376437633562643861373231636131
|
||||
37623735333165633762346238326430323336653962643731333166616137376562643430376531
|
||||
30303164333761333161323730656430356534376166326431373137636438303636386330393435
|
||||
37336533663762303230653839336534316636373238623934663934646133646135
|
||||
@@ -1,30 +0,0 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
61383435623932316663346635303034346139313361643231656664633338346638616462626638
|
||||
3731383930363865623931323633643436316239376137390a653062623434623833303932646632
|
||||
61383532613363623334336634616530323865343866643235343261306433616434383838643061
|
||||
3830623365313338650a383838656636623331346630343130643936346165313534313439646636
|
||||
61643565316638633830303163383862663361613333666637326261366633333066646361376163
|
||||
30663562656266306363393038393261313132663031663434373733646132366330613866393832
|
||||
35633565613736396139303062353439303533653732346461386638653131616136303331613464
|
||||
39663763613566393964653766343637646163626638646538313530323832383338656137306335
|
||||
65633237646237383137303666633038643135346637373037636139623466356264303665346431
|
||||
64333731396265383839643036393063393465333530373139643035303663656237366237356664
|
||||
30323061313235383130336439373434323261663134643962313765386333393031643965663939
|
||||
36663337626135366564626430646564393932393363313964663663303966633162616365616264
|
||||
36653330376530316336653763643835393537383137303564643762633039643436656234613535
|
||||
62616236313139323035393763656564353738616565653264303464613565306630346663316565
|
||||
35343138393764323831376237393636393062653165346664613034386334343764343836316261
|
||||
35373033383738393730353637666562636463353739326364313966666534393936313537336638
|
||||
39643937323263636435643438386339383362326534326165626336373530326336643862383766
|
||||
37313862626133336433373535326535373138666662663864613231653433313433636638353833
|
||||
61643339643537636262333963333439336439353836356432636534663061633465626264643232
|
||||
36656231366566666466633166356235313264363561383234383330666539653566636130386538
|
||||
36336164656130616565393463326135366164633062613435306365323333336165326338336266
|
||||
32393166306364376662616236386539333766633733313035363265663230323262303831393161
|
||||
62313264343632636134323635376632333730336235363565333732366261393034326264386331
|
||||
66343166393463653561383766306265636236663866323838373863323466616637613430346339
|
||||
38663437303635646433663062373864366365323834636533326166306466396237313864313434
|
||||
38663630373738333465303664643435636237303861343338653637303663313663343661323730
|
||||
32663031313764613530336536376332626161333233613736363563636363656137666438323237
|
||||
34663366383836326234616461306164303633613439653232366662613435623833623133663963
|
||||
6433
|
||||
27
host_vars/web21
Normal file
27
host_vars/web21
Normal file
@@ -0,0 +1,27 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
38663333313561616264323430323162323837623430363739623561633331656664613936666665
|
||||
6364373033623163393239663035306337383066343438310a383666313434323036643037363065
|
||||
30396333626130303633663930663965666662646233393439376661346265616565616236623366
|
||||
3930373433646231610a336233663132306263656465633034333030316362643939316465666534
|
||||
38353961393038613961353732613434663565633466303265383231343336386330333464376363
|
||||
33616330643364376332623634363766656366666239633964316439376463313063333162343963
|
||||
61356634393438313063666434626338616264613639656462626639616263366531663135393466
|
||||
66346635616439306364356133303664376134626636616131373138656562363363306633333164
|
||||
62623135343633393834393165383231316562643062343165663235313930663039623135373263
|
||||
61343336643235303962333938613230356465346436376334373438386461366231383737643137
|
||||
36343832353730366131653430633465383163396336353065306638373166386438356264616139
|
||||
65346635663338366463343932336231386235393836616238373864626235623935663661396663
|
||||
31633565356465333737303339333435383162316530396563333335613062623138333232336162
|
||||
62376363666431363931663231643561616562383230643737393261623934363633313231333137
|
||||
39383238656237343661626662366465356463396336386261326334613436396364633062646532
|
||||
61313136366636363861316166396134316562666435653437326331363563653035343138636163
|
||||
66336139636533656334643966383962383734623565323435333665666164353732663736326364
|
||||
35616264383237316330386539363065376334643432393636643464646238633034333166663665
|
||||
33313166393738626133636136346637646437306335326263393634363133663736666338313838
|
||||
64623139613037653461643563666539613237323934376534376461313833336338623032616661
|
||||
64643062663633366436383232366137373936383430306332616634636331326361383931363961
|
||||
62313236313563326438303935373837666434313435653236643135303739373763656562393537
|
||||
31653265653739346433663937343439656231663963333633373066356231623762313438393763
|
||||
36306336656566633034373834316363333233326130626639313130643935333437653934313636
|
||||
32383034346234333561333466653561323834346166633831303566376266373933356536383031
|
||||
6236303934323963336662386666653138313165366133303434
|
||||
141
host_vars/web22
Normal file
141
host_vars/web22
Normal file
@@ -0,0 +1,141 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
38353762626535363837346634333565643931386536313339336365663162656533363636383931
|
||||
3737373161623364396366323338613062386466313539640a653334643937326338386262623261
|
||||
65643635373532636439396235373964303537646334343633633531633435323037313433346636
|
||||
3866306363303338360a356166353265386130616163616662623764313536616666656237636563
|
||||
30323036353635303438363234646234656530373365396530666539393132643831653039666562
|
||||
65383962306465363862333131383263353736623264616465336139313638343462653361333239
|
||||
64363562653366396664623662376433663335313231653935626237663430303734326433333739
|
||||
62616265373732316530366331323664373637386661353664626464646264356465346466663539
|
||||
31613435366362343564313732616639376664613630316236373333653634386130663463626231
|
||||
31396631623466666364316237313363366439326231653035316437616134643035393138383364
|
||||
35313738373562353632366637663232393638396330626165323535343538633264353366663738
|
||||
30663135646162396331623837343661613333313437313434313365623664316135626239636230
|
||||
65376137303439323166346536353831653537326662356330393362666430633831323537623830
|
||||
65326164663136383339353138663936306166633662346363353063663435323266653137666630
|
||||
61353263653735626236373233313436343466653238376634623366356431333439323932343938
|
||||
33303432613063383135633261653837633961643737623462626439373335613430356532353031
|
||||
31626666663963643736323731613735376239663530373166626365666339346435323761333637
|
||||
35383464626437646665653931653932653033376464386132383038633734373138313830303466
|
||||
39313532333866303565353161636435646231313461646639316566386639323561363633636139
|
||||
37613661626162306431313266383964323434343039386533333535646565373933396565613565
|
||||
34666136633265663035306261623531333665636336303665613635333232316331643935353461
|
||||
32643735623532313363663530656630653531666335323565353063316537396334383230386462
|
||||
33333565616634356537376466373332356663376363353166656139623336396130653564333739
|
||||
39303733303939313838363331356437646632386631343466383332313037616430313566396335
|
||||
31363038373437643266656463373662653966653832613935303462303031653761336165646162
|
||||
31646631373335336435383638666562373236656231613662646161613533376237366463383630
|
||||
36393532316336303531353032303937353963306164663162386137393664353962323865616532
|
||||
63326462626130386234643639363762323863326134623063343731366433306431303763363233
|
||||
36366334386266616261616266386439623665326339653562373836306165353137353137376337
|
||||
37316363653935623736613138356333653936363866356665303737363032363564643532303234
|
||||
37656432656363336564393263353430373437303337303461613763346461646565646535366638
|
||||
34366337343033666134383966646563356533626665373337646231313431346239303635353261
|
||||
62313939383762303235373537643531623465353062303939383666323139396630346461626136
|
||||
38656632373637616532666433626564376338363239326234656561636239653536366331633234
|
||||
65366139623238336234363564616430646435666562616636303064663437663731303839313365
|
||||
38636438386162623862363865646233346336636439663833343136316165343564393339653565
|
||||
38346166346434386338303032303430303535373635336562663030336566666435623537363137
|
||||
61373161343138656365376531633830313561336632633330323035346431643837383062343537
|
||||
66663961306666333535656432393134363565656635333633363732626665656365356138623164
|
||||
65303936633666643034313636663262616661313739663135653335366261613133643630343362
|
||||
66343033363835613031626635336538303362393561313032336136306465316231366137373736
|
||||
62303335393333306132326135393562666431303631306538326433613362306131316139386361
|
||||
31383665386466653066613038633335636233396335383764336462636138333034383836386365
|
||||
38323739346630643532346161383336646165333336393961663930623531303434366265313861
|
||||
39613231373335373338656434636134663036636234393534353033613133383034343437626434
|
||||
31646339613430343265333833303231333739666266646436336161363330396264313636616461
|
||||
61396332363537636162316261363030393466356263353938343236323932306366316535366533
|
||||
38633165393339356339383939666161336461653438353632653530326639313238323761386461
|
||||
63653765313532646166306237386435663432633934343039666637323362626338313135623034
|
||||
30356438633635363738383932393861376235353962303663313963313964383530306530316363
|
||||
64656638363436326562323234303961396333323931666365656433663865616439336138656232
|
||||
66653964383034343837663936306632336562373637346132333063663263306237303461333732
|
||||
65363661623064643663623661393563353739373535373764356163666639376236313839336438
|
||||
35386265646331313663653761353864663934663261313037396135373938343265353934353361
|
||||
30343564623631316366343838656135393364353836613330393536623662383637333039383133
|
||||
37653733626662646631616563306638366263323634303636616331323964393962643061646361
|
||||
39363562396634656637626630653533396236613334343332326439656165306537326464613436
|
||||
37333632663731316165613432353339356561316431623038303365303663326666303666646363
|
||||
66656630396661353765666131393737636630366666373136313837373165303437316233656261
|
||||
38346463303964343132393162663762346163363739383733326635643264616166393264633934
|
||||
64333137373532343032303431316633613836323631613231346133366635616435366436316239
|
||||
64353633366431386664623239353735623037623364346431633733336563303430653233313637
|
||||
35353138616164643834343339653739373038633531303039333632663566323565383637646561
|
||||
31383965396365653364343761363161656432656665383963656463613637633938376234353532
|
||||
33653837613266666661613165376665626432643439363637623333336234313836373232333736
|
||||
65313232373233613763376463663161643636663162643864363962376232326462643936383131
|
||||
39366164323038376633376238363663313238336166386663616261306532633331643537376631
|
||||
31376663393036363566653061353636326565376636346466656263663266326332656461336437
|
||||
32646162313932646632663738646532663439313630393038383530653562313439336631663535
|
||||
36396265353231373435353137303164356633653938373166363663616632303764633738333439
|
||||
62626533346561333565626163643235393164353861636662636531333834623965323034363735
|
||||
33336138356663303462393864343434636364346432383665313931653062363138623261326438
|
||||
31616533643163363261386635653732343939633965363362643536626264323537656238633539
|
||||
62393935386433313366656133633532353131343237623466376632623434626362363062326531
|
||||
33346165643164363365626432333631393664316266613731663162313764386336333231396632
|
||||
36666536336333623063346166306164376138343566353063343866316432333266366337623866
|
||||
61313039663661643863663434343732313139653037373065333463383635393061323938643162
|
||||
61383064303461366162636439343438376266313931323934313563623435346634663739666565
|
||||
62333035346634303139626432313262383262633437663436323763313361633235393037343665
|
||||
62316564376464333133343134333230383765303834613233613232626131343631326433373062
|
||||
36343466396430313534336332636233623337613134333861646334326633396434353765636163
|
||||
37343638363234313030363661306337393361333332306331396164346633336130336366396430
|
||||
62306539656332313162626239303066656664383639353730633738643132386662643733393761
|
||||
62666339346130626163656237623730363066343838303036613038613763356263363365366238
|
||||
62623435303838623630333231663137393362323234383533393763623235376164626461373736
|
||||
36343761353362623433663936623433353439646463613233363732613435373564616239626564
|
||||
61313066333939326435656535333963313831316231356232346534633531613963353130333432
|
||||
37656163663230626632393939363532356366643764323330366630656334623261656334633865
|
||||
61303066333566363061626437643132353664383061383364333338666230313034373535613063
|
||||
63386237383638333263323337313336373830303865303466363965303839316162663431656538
|
||||
33376332643335366537306133613761613132643232316438623939356331656263633933613935
|
||||
65653465383434386561323462626362623566663330656439386361616562353430303938636436
|
||||
66636531343063633561363330663436383930613438323764356562383536393933646264323135
|
||||
64633764356166343965346362323466306636363633656466653934313230326435336536306230
|
||||
38353432323537393131313239373861386237313530366139313338313330326632313536353837
|
||||
63386161336335363834356437326630353031373435316462613634633039336132646134653236
|
||||
31346664353932323339366464356161333637313761666138386164313163333531626235663338
|
||||
62386333303264306363646136646463393134373939346438383465393439343337643336633039
|
||||
62316464663038326439656334373331303165346534346466663538313632633561393335333931
|
||||
65363964363335616639643462393463343437626539363838626439386164303464316666633663
|
||||
63656639626133653266306266306531646331386366343936316136363935323662336335326338
|
||||
30666130316265666631306635646565363039306138313462376662626161313134383633653834
|
||||
32376163383763306165323466306264616366343332636564636162666434333732643635336163
|
||||
61626162626331613438373464336465303739316130343965633532336531313661613961313164
|
||||
39636165316638616338653965373833333732396363393463383433383930353361636166346232
|
||||
61323935663536306533336137356566383130393564623938666231393431626136396137633066
|
||||
36633133313861353338616561373838363833353531633465363731336237663561383561326635
|
||||
62306338643965613635353536613335363934666362366466663461646135346436336164346536
|
||||
62666631303638386137356233303235613636346661303834613335616161396238663530643165
|
||||
65366364336139303766303938643038303461656335303438396565346330313665636165626432
|
||||
64326666313562646239356231663834326566313331303363343064346539626636346438313266
|
||||
65643364656164336166353435343730376266333633666230316464356439336463316464653137
|
||||
66303865613961373732323439326535373933393537656462303831333432636261613564636330
|
||||
63323361366332386331376437666234346661373233653432343733346363306130383665626437
|
||||
33313330336365633464643563643465393935653132376135663163393161616462353838336664
|
||||
35393833656135643733623765626639386561333336623930303465323963613164666531396632
|
||||
35326365386566353966383635643132316230383363393539653335633934646239316131653536
|
||||
66656161653030343462346337653434313062343663633665363838393865336536626532623132
|
||||
66643636656134353363636433636538623930396262663864343332303066333566653063336464
|
||||
32303030396137346636636164323133396364623532643332363638643761323938616530353836
|
||||
65366331633561623331393231323534343239323565333330636136383836616230343034633036
|
||||
38373530616532653166653932643665396434373465376530313663646236336238656266616261
|
||||
33396463303963646633373038336662623161643135656136326533646337316562323932613833
|
||||
65616434316239353531666131383335383733333830613934393465663138353662613063323537
|
||||
31393337343737646537666430323666366338303731623339323063393636353132636233343436
|
||||
61653862333837623666343061633531396235633565313631663937393337303764316466613130
|
||||
33653732373034613639326338353438643664653461616133646235393864386564353765313932
|
||||
36613165323465333937626165316632313334313364353463366239356630653530313761373261
|
||||
35326331313438656238646535643131656634396238363734626431633734336238616538383636
|
||||
32303331666531653331306263303534613332653535643833303062653566393632333030383263
|
||||
63393636643264656439373165383861323534333462353763343931363065393738323433323839
|
||||
33333530323434363662633939303261636465356663326565633238663333656131376130396561
|
||||
63363636613161383465323233626630613265346162386439353665393832383961616564636538
|
||||
65333635336638646436623033343831356339656638333231666439643337306636313931643466
|
||||
32393765303361323735646130613035346564356562656631373435653832663165313131336236
|
||||
31636634663466366234386262623234626161663461386661656435656133616339383633386230
|
||||
34313065396335636630333066633339646432313632373131306235333164336534363630313939
|
||||
32623062393230633732323130613338363833356533306662616637326337343330303635343532
|
||||
38396665633938313932656130303263396631343761616631616637633831666139343130313236
|
||||
62356630346264376432
|
||||
67
host_vars/web23
Normal file
67
host_vars/web23
Normal file
@@ -0,0 +1,67 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
64326662336532386161646564656439396461666266656463393335663130323930326139386562
|
||||
3639653630336132663666646161363938386334323064320a663564613066313533353433333434
|
||||
30346561616465646163646534356339666639333862623637613435376361323032636439633930
|
||||
3731313063363337380a373961353530383764623830363935626231333734303364313565626633
|
||||
37343037633862633632613165323136373662396438613663636433346566653064653632313338
|
||||
36396333393334336434326630646164333531306432386133353664336535343363343939393464
|
||||
34626335626436353239366138323863656336636536383733363931633933636331643263653566
|
||||
30613931616462373336393337363430353962613665353936383533326364353365623333316664
|
||||
62383439396131303831326562323264336638623461643361663763356236373464346464316237
|
||||
65393232343733643338653734326562626166366562303037613862396564636662363066356664
|
||||
32656363616637303039373732396533643432343961666365313963383131643464333765643737
|
||||
32386165666131626365313938633530346361383734323334613464353862393931323836626563
|
||||
62656531346532646530306463653364326362613162323536643836643839663933343132613435
|
||||
63303234646335306632316166626266313635303566396363333464363631353834373761353837
|
||||
65643461623135363139646564336430353461336433633765303138313730613630346465326666
|
||||
61393133636262653836333664623333656164663361353130623863653863323131326136373238
|
||||
33376333316433653337373834666136363130373261333330643439313734343036636364306532
|
||||
63343662383539633235356162656366323965383331343139616361653466633865626337326562
|
||||
63643761613536613334333065643533323066393764633931633066353064393966646161376361
|
||||
37623939386636346161346164303832303534323038626335336665653634386132343031303861
|
||||
61323765306366333936303765636436633465356539316631343562363535663932333666363035
|
||||
30386233623265636464393662386464333430396337626230306438396563303437363938303061
|
||||
32653939383136376365343934613339383563303935623664633639326137353437363261393637
|
||||
66613331643530623862636665396536613730306537373666623135663837393466343261646461
|
||||
62376162613861643633656334303132353034333834626664666237393534386439313638393933
|
||||
35643663613432323432646466386434363335353234643264643463613334356462313766643030
|
||||
30336364396235663230356235303264323339643761333036333537633862343862386130626533
|
||||
36626536396663393031303533313238616133323239356634303830353439363133353839663266
|
||||
36306539636563633734623162356230383232306138393831393336626336383966643335376564
|
||||
36303730313936633361643736613736303163363536313038316432323039643362636538333037
|
||||
65613663333032623035656665393565366363396134363832363163656532363537373435623233
|
||||
36373961333237373264326634353363356537356538343663613034396132396366626330303365
|
||||
62353461616434343938386237373365633861333733613631633234623034366364363761613636
|
||||
34393532316466323264363363653335366639613731326131393335313039646538626665356333
|
||||
62663435633539643237326631636563363833633130363535653336333538366137306235663730
|
||||
36633934636536633865376262356239303966646638626638386536366662386432343466366161
|
||||
36646436636538643366623864326630396565373462393132343834626638313437316137353564
|
||||
34646138616438323065336266366434316135613938643131353034646230396632386433366365
|
||||
38616436346232363563336439613939313464323861616530633962316634363462373530613665
|
||||
63653636646565303664326631363535373037663734663965346430363831613431613365393832
|
||||
62373030336262643430313635626261613232656236333130396537633238623265363932333966
|
||||
34326135363762396564613064323135313663613565646461376162306532643433333336666532
|
||||
65383661303137613335653336663666653463623565386137326662653839633536326135633764
|
||||
33623437333931393737363061356235336232376437643131373531356566323336306138353561
|
||||
66333863313461613930383231663162616261616639323238646439656166666261626533636161
|
||||
38333362393033316266633364313739366262636530363937386137616234326638303137613433
|
||||
65313962653566333364383732386165396136303666383439303064326463346563663434646364
|
||||
62396130646632653039383661613638303162363538376236666338623865366639663138363636
|
||||
36373766386234383465316635323931356233366262386135363238366538623135623361386436
|
||||
64653533646233653463656334633566373433303365353965663732636566663332343337626337
|
||||
34623861373562386264346430333133343631653631376366373735626664363965666561306262
|
||||
35666235653235346233636361383566616533646662333662323139313865383264633734643263
|
||||
63656431393834633935613430643839613433326431666665323136376562333737383862313261
|
||||
65656431336439303563373833343965323965346439636131633366633431393032613963666539
|
||||
38326539343132326334316233323362633835356265333031663066643535363639623031336362
|
||||
64346230383638363763323462386261666266623134393139303264343234623132323437396630
|
||||
66363738376133393731616535653230303262313937373333353932303038626166346366303163
|
||||
66613831353731373165636532363165356561383137626437333563616561386666623234313438
|
||||
37333435306530323235393164383138346131653235633536383636316161316238313064636261
|
||||
33353963333430383236303038333939316637326130396430623964633338353863613534653663
|
||||
30333839393230626261663966616230303330636335323565663938343562666663303536636332
|
||||
34336665323764663163653161373166313631393534326532613538313637313136356336313433
|
||||
34353036653738343433613763383137336562373332333062326134626638633938336364376131
|
||||
61303435333163663636653135363162303663663266393438656430306532343438386436343735
|
||||
31343231653263373532386263653263386435363633396638396164323539306233303562303862
|
||||
3339306136613431636138333266633739323666633431363039
|
||||
@@ -13,13 +13,13 @@
|
||||
|
||||
- hosts: all
|
||||
user: provisioning
|
||||
become: yes
|
||||
become: true
|
||||
vars_files:
|
||||
- "../vars/{{ ansible_distribution }}.yml"
|
||||
|
||||
tasks:
|
||||
- name: Set password, shell, homedir for provisioning user
|
||||
when: provisioning_user is defined
|
||||
user: name={{ provisioning_user.name }} password={{ provisioning_user.password }} shell={{ provisioning_user.shell }} state={{ provisioning_user.state }} createhome=no
|
||||
user: name={{ provisioning_user.name }} password={{ provisioning_user.password }} shell={{ provisioning_user.shell }} state={{ provisioning_user.state }} createhome=false
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
# file: nomads.yml
|
||||
|
||||
- hosts: nomads
|
||||
become: yes
|
||||
become: true
|
||||
roles:
|
||||
- common
|
||||
- munin
|
||||
|
||||
11
roles/caddy/defaults/main.yml
Normal file
11
roles/caddy/defaults/main.yml
Normal file
@@ -0,0 +1,11 @@
|
||||
---
|
||||
# file: roles/caddy/defaults/main.yml
|
||||
|
||||
# parent directory of vhost document roots
|
||||
caddy_root_prefix: "{{ web_root_prefix }}"
|
||||
|
||||
# Email address to use for the ACME account managing the site's certificates.
|
||||
# Not sure what Caddy does if this doesn't exist.
|
||||
caddy_email: foo@example.com
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
10
roles/caddy/handlers/main.yml
Normal file
10
roles/caddy/handlers/main.yml
Normal file
@@ -0,0 +1,10 @@
|
||||
---
|
||||
# file: roles/caddy/handlers/main.yml
|
||||
|
||||
# I'm currently not sure when we need to restart versus reload
|
||||
- name: reload caddy
|
||||
ansible.builtin.systemd_service:
|
||||
name: caddy
|
||||
state: reloaded
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
82
roles/caddy/tasks/main.yml
Normal file
82
roles/caddy/tasks/main.yml
Normal file
@@ -0,0 +1,82 @@
|
||||
---
|
||||
# file: roles/caddy/tasks/main.yml
|
||||
#
|
||||
# Configure Caddy.
|
||||
|
||||
- name: Check Caddy package signing key
|
||||
ansible.builtin.stat:
|
||||
path: /etc/apt/keyrings/caddy-stable-archive-keyring.key
|
||||
register: caddy_signing_key_stat
|
||||
tags:
|
||||
- packages
|
||||
- caddy
|
||||
|
||||
# See: https://caddyserver.com/docs/install#debian-ubuntu-raspbian
|
||||
- name: Download Caddy package signing key
|
||||
ansible.builtin.get_url:
|
||||
url: https://dl.cloudsmith.io/public/caddy/stable/gpg.key
|
||||
dest: /etc/apt/keyrings/caddy-stable-archive-keyring.key
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: download_caddy_signing_key
|
||||
when: not caddy_signing_key_stat.stat.exists
|
||||
tags:
|
||||
- packages
|
||||
- caddy
|
||||
|
||||
- name: Add Caddy stable repo
|
||||
ansible.builtin.apt_repository:
|
||||
repo: deb [signed-by=/etc/apt/keyrings/caddy-stable-archive-keyring.key] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main
|
||||
filename: caddy-stable
|
||||
state: present
|
||||
register: add_caddy_apt_repository
|
||||
tags:
|
||||
- packages
|
||||
- caddy
|
||||
|
||||
- name: Update apt cache
|
||||
ansible.builtin.apt: # noqa no-handler
|
||||
update_cache: true
|
||||
when: (download_caddy_signing_key.status_code is defined and download_caddy_signing_key.status_code == 200) or add_caddy_apt_repository is changed
|
||||
tags:
|
||||
- packages
|
||||
- caddy
|
||||
|
||||
- name: Install Caddy
|
||||
ansible.builtin.apt:
|
||||
name: caddy
|
||||
state: present
|
||||
install_recommends: false
|
||||
cache_valid_time: 3600
|
||||
tags:
|
||||
- caddy
|
||||
- packages
|
||||
|
||||
- name: Create Caddyfile
|
||||
ansible.builtin.template:
|
||||
src: etc/caddy/Caddyfile.j2
|
||||
dest: /etc/caddy/Caddyfile
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- reload caddy
|
||||
tags: caddy
|
||||
|
||||
- name: Create Caddy conf.d directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/caddy/conf.d
|
||||
state: directory
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
tags: caddy
|
||||
|
||||
# TODO: the variable is still named nginx_vhosts
|
||||
- name: Configure Caddy virtual hosts
|
||||
ansible.builtin.include_tasks: vhosts.yml
|
||||
when: nginx_vhosts is defined
|
||||
tags: caddy
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
14
roles/caddy/tasks/vhosts.yml
Normal file
14
roles/caddy/tasks/vhosts.yml
Normal file
@@ -0,0 +1,14 @@
|
||||
---
|
||||
- name: Configure vhosts
|
||||
ansible.builtin.template:
|
||||
src: etc/caddy/conf.d/vhost.j2
|
||||
dest: /etc/caddy/conf.d/{{ item.domain_name }}
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
notify:
|
||||
- reload caddy
|
||||
tags: caddy
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
29
roles/caddy/templates/etc/caddy/Caddyfile.j2
Normal file
29
roles/caddy/templates/etc/caddy/Caddyfile.j2
Normal file
@@ -0,0 +1,29 @@
|
||||
# Global options
|
||||
{
|
||||
email {{ caddy_email }}
|
||||
}
|
||||
|
||||
# Common security response headers
|
||||
(security-headers) {
|
||||
header {
|
||||
# disable Google FLoC tracking
|
||||
Permissions-Policy interest-cohort=()
|
||||
|
||||
# enable HSTS
|
||||
Strict-Transport-Security max-age=31536000
|
||||
|
||||
# disable clients from sniffing the media type
|
||||
X-Content-Type-Options nosniff
|
||||
|
||||
# clickjacking protection: refuse to allow rendering this page
|
||||
# in a frame, iframe, etc.
|
||||
X-Frame-Options DENY
|
||||
|
||||
# keep referrer data off of HTTP connections
|
||||
Referrer-Policy no-referrer-when-downgrade
|
||||
}
|
||||
}
|
||||
|
||||
# Import additional caddy config files in /etc/caddy/conf.d/
|
||||
# Note: these are imported in lexical sort order!
|
||||
import /etc/caddy/conf.d/*
|
||||
46
roles/caddy/templates/etc/caddy/conf.d/vhost.j2
Normal file
46
roles/caddy/templates/etc/caddy/conf.d/vhost.j2
Normal file
@@ -0,0 +1,46 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
{# helper variables and per-site defaults that we can't set in role defaults #}
|
||||
{% set domain_name = item.domain_name %}
|
||||
{% set domain_aliases = item.domain_aliases | default("") %}
|
||||
{# assume optional features are off unless a vhost explicitly sets them #}
|
||||
{% set has_wordpress = item.has_wordpress | default(false) %}
|
||||
{% set needs_php = item.needs_php | default(false) %}
|
||||
{% set has_gitea = item.has_gitea | default(false) %}
|
||||
{% set static_site = item.static_site | default(false) %}
|
||||
{# Allow sites to override the document root #}
|
||||
{% if item.document_root is defined %}
|
||||
{% set document_root = item.document_root %}
|
||||
{% else %}
|
||||
{% set document_root = (caddy_root_prefix, domain_name) | ansible.builtin.path_join %}
|
||||
{% endif %}
|
||||
|
||||
{% if domain_aliases %}
|
||||
{# domain_aliases is a string, so we split on space #}
|
||||
{% for domain in domain_aliases | split (' ') %}
|
||||
{{ domain }} {
|
||||
redir https://{{domain_name}}{uri}
|
||||
}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{{ domain_name }} {
|
||||
{% if has_gitea %}
|
||||
reverse_proxy :3000
|
||||
{% elif static_site -%}
|
||||
root * {{ document_root }}
|
||||
|
||||
encode
|
||||
|
||||
file_server
|
||||
{% elif has_wordpress -%}
|
||||
root * {{ document_root }}
|
||||
encode
|
||||
{% if ansible_distribution_major_version is version('12', '==') -%}
|
||||
php_fastcgi unix//run/php/php8.2-fpm-{{ domain_name }}.sock
|
||||
{% endif -%}
|
||||
file_server
|
||||
{% endif -%}
|
||||
|
||||
import security-headers
|
||||
}
|
||||
@@ -8,6 +8,10 @@ fail2ban_maxretry: 6
|
||||
fail2ban_findtime: 3600
|
||||
# 2 weeks in seconds
|
||||
fail2ban_bantime: 1209600
|
||||
fail2ban_ignoreip: 127.0.0.1/8 172.26.0.0/16 192.168.5.0/24
|
||||
fail2ban_ignoreip: 127.0.0.0/8
|
||||
|
||||
# Disable SSH passwords. Must use SSH keys. This is OK because we add the keys
|
||||
# before re-configuring the SSH daemon to disable passwords.
|
||||
ssh_password_authentication: disabled
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,14 +0,0 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define ABUSEIPDB_IPV6 = {
|
||||
2001:41d0:8:8c1::,
|
||||
2400:6180:0:d1::8c9:8001,
|
||||
2607:5300:203:3b58::,
|
||||
2607:f298:5:102f::97c:9b51,
|
||||
2607:f298:5:103f::cf7:8a8e,
|
||||
2607:f298:5:6000::f25:8518,
|
||||
2607:f298:6:a016::448:ebe6,
|
||||
2607:f298:6:a034::eb5:2e70,
|
||||
2a00:d680:20:50::68b6,
|
||||
2a06:41c0:0:1::e4ca:8524,
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,23 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:ip">
|
||||
<option name="family" value="inet6" />
|
||||
<short>abusers-ipv6</short>
|
||||
<description>A list of abusive IPv6 addresses.</description>
|
||||
<entry>2001:41d0:700:1a2c::</entry>
|
||||
<entry>2400:6180:0:d0::63:e001</entry>
|
||||
<entry>2400:6180:0:d0::6a:4001</entry>
|
||||
<entry>2604:a880:2:d0::22d5:c001</entry>
|
||||
<entry>2604:a880:2:d1::19c:1001</entry>
|
||||
<entry>2604:a880:cad:d0::169:3001</entry>
|
||||
<entry>2607:5300:203:2519::</entry>
|
||||
<entry>2607:5300:203:4418::</entry>
|
||||
<entry>2607:5300:203:d86::</entry>
|
||||
<entry>2607:5300:60:1e52::</entry>
|
||||
<entry>2607:5300:61:404::</entry>
|
||||
<entry>2607:f298:5:115b::bcf:e319</entry>
|
||||
<entry>2607:f298:5:6000::864:52c7</entry>
|
||||
<entry>2607:f298:6:a044::d7d:2305</entry>
|
||||
<entry>2607:f298:6:a077::491:e10b</entry>
|
||||
<entry>2a00:d680:20:50::4a10</entry>
|
||||
<entry>2a03:6f00:6:1::b972:f5c1</entry>
|
||||
</ipset>
|
||||
@@ -1,89 +0,0 @@
|
||||
#!/usr/bin/perl
|
||||
#
|
||||
# aggregate-cidr-addresses - combine a list of CIDR address blocks
|
||||
# Copyright (C) 2001,2007 Mark Suter <suter@zwitterion.org>
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see L<http://www.gnu.org/licenses/>.
|
||||
#
|
||||
# [MJS 22 Oct 2001] Aggregate CIDR addresses
|
||||
# [MJS 9 Oct 2007] Overlap idea from Anthony Ledesma at theplanet dot com.
|
||||
# [MJS 16 Feb 2012] Prompted to clarify license by Alexander Talos-Zens - at at univie dot ac dot at
|
||||
# [MJS 21 Feb 2012] IPv6 fixes by Alexander Talos-Zens
|
||||
# [MJS 21 Feb 2012] Split ranges into prefixes (fixes a 10+ year old bug)
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
use English qw( -no_match_vars );
|
||||
use Net::IP;
|
||||
|
||||
## Read in all the IP addresses
|
||||
my @addrs = map { Net::IP->new($_) or die "$PROGRAM_NAME: Not an IP: \"$_\"."; }
|
||||
map { / \A \s* (.+?) \s* \Z /msix and $1; } <>;
|
||||
|
||||
## Split any ranges into prefixes
|
||||
@addrs = map {
|
||||
defined $_->prefixlen ? $_ : map { Net::IP->new($_) }
|
||||
$_->find_prefixes
|
||||
} @addrs;
|
||||
|
||||
## Sort the IP addresses
|
||||
@addrs = sort { $a->version <=> $b->version or $a->bincomp( 'lt', $b ) ? -1 : $a->bincomp( 'gt', $b ) ? 1 : 0 } @addrs;
|
||||
|
||||
## Handle overlaps
|
||||
my $count = 0;
|
||||
my $current = $addrs[0];
|
||||
foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
|
||||
my $r = $current->overlaps($next);
|
||||
if ( $current->version != $next->version or $r == $IP_NO_OVERLAP ) {
|
||||
$current = $next;
|
||||
$count++;
|
||||
}
|
||||
elsif ( $r == $IP_A_IN_B_OVERLAP ) {
|
||||
$current = $next;
|
||||
splice @addrs, $count, 1;
|
||||
}
|
||||
elsif ( $r == $IP_B_IN_A_OVERLAP or $r == $IP_IDENTICAL ) {
|
||||
splice @addrs, $count + 1, 1;
|
||||
}
|
||||
else {
|
||||
die "$PROGRAM_NAME: internal error - overlaps() returned an unexpected value!\n";
|
||||
}
|
||||
}
|
||||
|
||||
## Keep aggregating until we don't change anything
|
||||
my $change = 1;
|
||||
while ($change) {
|
||||
$change = 0;
|
||||
my @new_addrs = ();
|
||||
$current = $addrs[0];
|
||||
foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
|
||||
if ( my $total = $current->aggregate($next) ) {
|
||||
$current = $total;
|
||||
$change = 1;
|
||||
}
|
||||
else {
|
||||
push @new_addrs, $current;
|
||||
$current = $next;
|
||||
}
|
||||
}
|
||||
push @new_addrs, $current;
|
||||
@addrs = @new_addrs;
|
||||
}
|
||||
|
||||
## Print out the IP addresses
|
||||
foreach (@addrs) {
|
||||
print $_->prefix(), "\n";
|
||||
}
|
||||
|
||||
# $Id: aggregate-cidr-addresses,v 1.9 2012/02/21 10:14:22 suter Exp suter $
|
||||
@@ -1,2 +0,0 @@
|
||||
autoclean -y
|
||||
upgrade -y -o APT::Get::Show-Upgraded=true
|
||||
@@ -1,5 +0,0 @@
|
||||
# Configuration for cron-apt. For further information about the possible
|
||||
# configuration settings see the README file.
|
||||
|
||||
MAILON="never"
|
||||
OPTIONS="-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list -o Dir::Etc::SourceParts=\"/dev/null\""
|
||||
@@ -1 +0,0 @@
|
||||
provisioning ALL=(ALL) ALL
|
||||
@@ -1,5 +1,5 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV4 = {
|
||||
define FIREHOL_LEVEL1_IPV4 = {
|
||||
192.168.254.254/32
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet" />
|
||||
<short>spamhaus-ipv4</short>
|
||||
<description>Spamhaus DROP and EDROP lists placeholder (IPv4).</description>
|
||||
</ipset>
|
||||
@@ -1,5 +0,0 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV6 = {
|
||||
fd21:3523:74e0:7301::/64
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet6" />
|
||||
<short>spamhaus-ipv6</short>
|
||||
<description>Spamhaus DROP list placeholder (IPv6).</description>
|
||||
</ipset>
|
||||
@@ -0,0 +1 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmRO6E0G4Ls3TifVfJ+mQjlfWiBZNJfsSXGhwQ/HA1M aorth@balozi
|
||||
@@ -1,27 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Abuse.ch SSL Blacklist IPs
|
||||
# This service will fail if nftables is not running so we use Requires to make
|
||||
# sure that nftables is started.
|
||||
Requires=nftables.service
|
||||
# Make sure the network is up and nftables is started
|
||||
After=network-online.target nftables.service
|
||||
Wants=network-online.target update-abusech-nftables.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/nftables
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-abusech-nftables
|
||||
ExecStart=/usr/bin/flock -x update-abusech-nftables.lck \
|
||||
/usr/local/bin/update-abusech-nftables.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,63 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-abuseipdb-nftables.sh v0.0.1
|
||||
#
|
||||
# Download IP addresses seen using a blacklisted SSL certificate and load them
|
||||
# into nftables sets. As of 2021-07-28 these appear to only be IPv4.
|
||||
#
|
||||
# See: https://sslbl.abuse.ch/blacklist
|
||||
#
|
||||
# Copyright (C) 2021 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
abusech_ipv4_set_path=/etc/nftables/abusech-ipv4.nft
|
||||
abusech_list_temp=$(mktemp)
|
||||
|
||||
echo "Downloading Abuse.sh SSL Blacklist IPs"
|
||||
|
||||
abusech_response=$(curl -s -G -w "%{http_code}\n" https://sslbl.abuse.ch/blacklist/sslipblacklist.txt --output "$abusech_list_temp")
|
||||
|
||||
if [[ $abusech_response -ne 200 ]]; then
|
||||
echo "Abuse.ch responded: HTTP $abusech_response"
|
||||
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -f "$abusech_list_temp" ]]; then
|
||||
echo "Processing IPv4 list"
|
||||
|
||||
abusech_ipv4_list_temp=$(mktemp)
|
||||
abusech_ipv4_set_temp=$(mktemp)
|
||||
|
||||
# Remove comments, DOS carriage returns, and IPv6 addresses (even though
|
||||
# Abuse.ch seems to only have IPv4 addresses, let's not break our shit on
|
||||
# that assumption some time down the line).
|
||||
sed -e '/#/d' -e 's/
|
||||
//' -e '/:/d' "$abusech_list_temp" > "$abusech_ipv4_list_temp"
|
||||
|
||||
echo "Building abusech-ipv4 set"
|
||||
cat << NFT_HEAD > "$abusech_ipv4_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define ABUSECH_IPV4 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
# nftables doesn't mind if the last element in the set has a trailing
|
||||
# comma so we don't need to do anything special here.
|
||||
echo "$network," >> "$abusech_ipv4_set_temp"
|
||||
done < $abusech_ipv4_list_temp
|
||||
|
||||
echo "}" >> "$abusech_ipv4_set_temp"
|
||||
|
||||
install -m 0600 "$abusech_ipv4_set_temp" "$abusech_ipv4_set_path"
|
||||
|
||||
rm -f "$abusech_list_temp" "$abusech_ipv4_list_temp" "$abusech_ipv4_set_temp"
|
||||
fi
|
||||
|
||||
echo "Reloading nftables"
|
||||
# The abusech nftables sets are included by nftables.conf
|
||||
@@ -1,12 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Abuse.ch SSL Blacklist IPs
|
||||
|
||||
[Timer]
|
||||
# Once a day at midnight
|
||||
OnCalendar=*-*-* 00:00:00
|
||||
# Add a random delay of 0–3600 seconds
|
||||
RandomizedDelaySec=3600
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
24
roles/common/files/update-firehol-nftables.service
Normal file
24
roles/common/files/update-firehol-nftables.service
Normal file
@@ -0,0 +1,24 @@
|
||||
[Unit]
|
||||
Description=Update FireHOL lists
|
||||
# Make sure the network is up
|
||||
After=network-online.target
|
||||
Wants=network-online.target update-firehol-nftables.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/nftables
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-firehol-nftables
|
||||
ExecStart=/usr/bin/flock -x update-firehol-nftables.lck \
|
||||
/usr/local/bin/update-firehol-nftables.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,5 +1,5 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
Description=Update FireHOL lists
|
||||
|
||||
[Timer]
|
||||
# Once a day at midnight
|
||||
@@ -1,27 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
# This service will fail if firewalld is not running so we use Requires to make
|
||||
# sure that firewalld is started.
|
||||
Requires=firewalld.service
|
||||
# Make sure the network is up and firewalld is started
|
||||
After=network-online.target firewalld.service
|
||||
Wants=network-online.target update-spamhaus-lists.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/firewalld/ipsets
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-spamhaus-lists
|
||||
ExecStart=/usr/bin/flock -x update-spamhaus-lists.lck \
|
||||
/usr/local/bin/update-spamhaus-lists.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,107 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-spamhaus-lists.sh v0.0.5
|
||||
#
|
||||
# Download Spamhaus DROP lists and load them into firewalld ipsets. Should work
|
||||
# with both the iptables and nftables backends.
|
||||
#
|
||||
# See: https://www.spamhaus.org/drop/
|
||||
#
|
||||
# Copyright (C) 2021 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
firewalld_ipsets=$(firewall-cmd --get-ipsets)
|
||||
xml_temp=$(mktemp)
|
||||
spamhaus_ipv4_ipset_path=/etc/firewalld/ipsets/spamhaus-ipv4.xml
|
||||
spamhaus_ipv6_ipset_path=/etc/firewalld/ipsets/spamhaus-ipv6.xml
|
||||
|
||||
function download() {
|
||||
echo "Downloading $1"
|
||||
wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
|
||||
}
|
||||
|
||||
download drop.txt
|
||||
download edrop.txt
|
||||
download dropv6.txt
|
||||
|
||||
if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
|
||||
echo "Processing IPv4 DROP lists"
|
||||
|
||||
# Extract all networks from drop.txt and edrop.txt, skipping blank lines and
|
||||
# comments.
|
||||
networks=$(cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//')
|
||||
|
||||
# If firewalld already has this ipset we should delete it first to emulate
|
||||
# `ipset flush` (but I don't want to use that because newer hosts might be
|
||||
# using nftables and firewalld will handle that for us).
|
||||
if [[ "$firewalld_ipsets" =~ spamhaus-ipv4 ]]; then
|
||||
echo "Deleting existing spamhaus-ipv4 ipset"
|
||||
# This deletes the firewalld ipset XML file as well as the ipset itself
|
||||
firewall-cmd --permanent --delete-ipset=spamhaus-ipv4
|
||||
else
|
||||
echo "Creating placeholder spamhaus-ipv4 ipset"
|
||||
# Create a placeholder ipset so firewalld doesn't complain when we try
|
||||
# to reload the ipset later after having added a new XML definition. I
|
||||
# don't know why, but depending on the system state there may not be a
|
||||
# ipset defined and firewalld errors on INVALID_IPSET.
|
||||
firewall-cmd --permanent --new-ipset=spamhaus-ipv4 --type=hash:net --option=family=inet
|
||||
fi
|
||||
|
||||
# I'm not proud of this, but writing the XML directly is WAY faster than
|
||||
# using firewall-cmd to add each entry one by one (and we can't add from
|
||||
# a file because many of our hosts are using old firewalld).
|
||||
cat << XML_HEAD > "$xml_temp"
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet" />
|
||||
<short>spamhaus-ipv4</short>
|
||||
<description>Spamhaus DROP and EDROP lists (IPv4).</description>
|
||||
XML_HEAD
|
||||
|
||||
for network in $networks; do
|
||||
echo " <entry>$network</entry>" >> "$xml_temp"
|
||||
done
|
||||
|
||||
echo "</ipset>" >> "$xml_temp"
|
||||
|
||||
install -m 0600 "$xml_temp" "$spamhaus_ipv4_ipset_path"
|
||||
fi
|
||||
|
||||
if [[ -f "dropv6.txt" ]]; then
|
||||
echo "Processing IPv6 DROP list"
|
||||
|
||||
networks=$(sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt)
|
||||
|
||||
if [[ "$firewalld_ipsets" =~ spamhaus-ipv6 ]]; then
|
||||
echo "Deleting existing spamhaus-ipv6 ipset"
|
||||
firewall-cmd --permanent --delete-ipset=spamhaus-ipv6
|
||||
else
|
||||
echo "Creating placeholder spamhaus-ipv6 ipset"
|
||||
firewall-cmd --permanent --new-ipset=spamhaus-ipv6 --type=hash:net --option=family=inet6
|
||||
fi
|
||||
|
||||
cat << XML_HEAD > "$xml_temp"
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet6" />
|
||||
<short>spamhaus-ipv6</short>
|
||||
<description>Spamhaus DROP lists (IPv6).</description>
|
||||
XML_HEAD
|
||||
|
||||
for network in $networks; do
|
||||
echo " <entry>$network</entry>" >> "$xml_temp"
|
||||
done
|
||||
|
||||
echo "</ipset>" >> "$xml_temp"
|
||||
|
||||
install -m 0600 "$xml_temp" "$spamhaus_ipv6_ipset_path"
|
||||
fi
|
||||
|
||||
echo "Reloading firewalld"
|
||||
firewall-cmd --reload
|
||||
|
||||
rm -v drop.txt edrop.txt dropv6.txt "$xml_temp"
|
||||
@@ -1,12 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
|
||||
[Timer]
|
||||
# Once a day at midnight
|
||||
OnCalendar=*-*-* 00:00:00
|
||||
# Add a random delay of 0–3600 seconds
|
||||
RandomizedDelaySec=3600
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@@ -1,27 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
# This service will fail if nftables is not running so we use Requires to make
|
||||
# sure that nftables is started.
|
||||
Requires=nftables.service
|
||||
# Make sure the network is up and nftables is started
|
||||
After=network-online.target nftables.service
|
||||
Wants=network-online.target update-spamhaus-nftables.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/nftables
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-spamhaus-nftables
|
||||
ExecStart=/usr/bin/flock -x update-spamhaus-nftables.lck \
|
||||
/usr/local/bin/update-spamhaus-nftables.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,91 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-spamhaus-nftables.sh v0.0.1
|
||||
#
|
||||
# Download Spamhaus DROP lists and load them into nftables sets.
|
||||
#
|
||||
# See: https://www.spamhaus.org/drop/
|
||||
#
|
||||
# Copyright (C) 2021 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
spamhaus_ipv4_set_path=/etc/nftables/spamhaus-ipv4.nft
|
||||
spamhaus_ipv6_set_path=/etc/nftables/spamhaus-ipv6.nft
|
||||
|
||||
function download() {
|
||||
echo "Downloading $1"
|
||||
wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
|
||||
}
|
||||
|
||||
download drop.txt
|
||||
download edrop.txt
|
||||
download dropv6.txt
|
||||
|
||||
if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
|
||||
echo "Processing IPv4 DROP lists"
|
||||
|
||||
spamhaus_ipv4_list_temp=$(mktemp)
|
||||
spamhaus_ipv4_set_temp=$(mktemp)
|
||||
|
||||
# Extract all networks from drop.txt and edrop.txt, skipping blank lines and
|
||||
# comments. Use aggregate-cidr-addresses.pl to merge overlapping IPv4 CIDR
|
||||
# ranges to work around a firewalld bug.
|
||||
#
|
||||
# See: https://bugzilla.redhat.com/show_bug.cgi?id=1836571
|
||||
cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' | aggregate-cidr-addresses.pl > "$spamhaus_ipv4_list_temp"
|
||||
|
||||
echo "Building spamhaus-ipv4 set"
|
||||
cat << NFT_HEAD > "$spamhaus_ipv4_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV4 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
# nftables doesn't mind if the last element in the set has a trailing
|
||||
# comma so we don't need to do anything special here.
|
||||
echo "$network," >> "$spamhaus_ipv4_set_temp"
|
||||
done < $spamhaus_ipv4_list_temp
|
||||
|
||||
echo "}" >> "$spamhaus_ipv4_set_temp"
|
||||
|
||||
install -m 0600 "$spamhaus_ipv4_set_temp" "$spamhaus_ipv4_set_path"
|
||||
|
||||
rm -f "$spamhaus_ipv4_list_temp" "$spamhaus_ipv4_set_temp"
|
||||
fi
|
||||
|
||||
if [[ -f "dropv6.txt" ]]; then
|
||||
echo "Processing IPv6 DROP lists"
|
||||
|
||||
spamhaus_ipv6_list_temp=$(mktemp)
|
||||
spamhaus_ipv6_set_temp=$(mktemp)
|
||||
|
||||
sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt > "$spamhaus_ipv6_list_temp"
|
||||
|
||||
echo "Building spamhaus-ipv6 set"
|
||||
cat << NFT_HEAD > "$spamhaus_ipv6_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV6 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
echo "$network," >> "$spamhaus_ipv6_set_temp"
|
||||
done < $spamhaus_ipv6_list_temp
|
||||
|
||||
echo "}" >> "$spamhaus_ipv6_set_temp"
|
||||
|
||||
install -m 0600 "$spamhaus_ipv6_set_temp" "$spamhaus_ipv6_set_path"
|
||||
|
||||
rm -f "$spamhaus_ipv6_list_temp" "$spamhaus_ipv6_set_temp"
|
||||
fi
|
||||
|
||||
echo "Reloading nftables"
|
||||
# The spamhaus nftables sets are included by nftables.conf
|
||||
/usr/sbin/nft -f /etc/nftables.conf
|
||||
|
||||
rm -v drop.txt edrop.txt dropv6.txt
|
||||
@@ -1,20 +1,27 @@
|
||||
---
|
||||
# file: roles/common/handlers/main.yml
|
||||
# ansible.builtin.file: roles/common/handlers/main.yml
|
||||
|
||||
- name: reload sshd
|
||||
systemd: name={{ sshd_service_name }} state=reloaded
|
||||
- name: Reload sshd
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ sshd_service_name }}"
|
||||
state: reloaded
|
||||
|
||||
- name: reload sysctl
|
||||
command: sysctl -p /etc/sysctl.conf
|
||||
- name: Reload sysctl
|
||||
ansible.builtin.command: sysctl -p /etc/sysctl.conf
|
||||
|
||||
- name: restart firewalld
|
||||
systemd: name=firewalld state=restarted
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd_service:
|
||||
daemon_reload: true
|
||||
|
||||
- name: restart fail2ban
|
||||
systemd: name=fail2ban state=restarted
|
||||
- name: Restart nftables
|
||||
ansible.builtin.systemd_service:
|
||||
name: nftables
|
||||
state: restarted
|
||||
|
||||
- name: reload systemd
|
||||
systemd: daemon_reload=yes
|
||||
|
||||
- name: restart nftables
|
||||
systemd: name=nftables state=restarted
|
||||
# 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed
|
||||
# in the order they are defined, not in the order they are listed in the task's
|
||||
# notify statement and we must restart fail2ban after updating the firewall.
|
||||
- name: Restart fail2ban
|
||||
ansible.builtin.systemd_service:
|
||||
name: fail2ban
|
||||
state: restarted
|
||||
|
||||
@@ -1,12 +1,17 @@
|
||||
---
|
||||
- name: Remove cron-apt
|
||||
ansible.builtin.apt:
|
||||
name: cron-apt
|
||||
state: absent
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Configure cron-apt (config)
|
||||
copy: src={{ item.src }} dest={{ item.dest }} mode={{ item.mode }} owner={{ item.owner }} group={{ item.group }}
|
||||
- name: Remove cron-apt configs
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- { src: 'etc/cron-apt/config', dest: '/etc/cron-apt/config', mode: '0644', owner: 'root', group: 'root' }
|
||||
- { src: 'etc/cron-apt/3-download', dest: '/etc/cron-apt/action.d/3-download', mode: '0644', owner: 'root', group: 'root' }
|
||||
|
||||
- name: Configure cron-apt (security)
|
||||
template: src=security.sources.list.j2 dest=/etc/apt/security.sources.list mode=0644 owner=root group=root
|
||||
- /etc/cron-apt/config
|
||||
- /etc/cron-apt/action.d/3-download
|
||||
- /etc/apt/security.sources.list
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,25 +1,55 @@
|
||||
---
|
||||
- name: Install fail2ban
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- fail2ban
|
||||
- python3-systemd
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Configure fail2ban sshd filter
|
||||
template: src=etc/fail2ban/jail.d/sshd.local.j2 dest=/etc/fail2ban/jail.d/sshd.local owner=root mode=0644
|
||||
notify: restart fail2ban
|
||||
ansible.builtin.template:
|
||||
src: etc/fail2ban/jail.d/sshd.local.j2
|
||||
dest: /etc/fail2ban/jail.d/sshd.local
|
||||
owner: root
|
||||
mode: "0644"
|
||||
notify: Restart fail2ban
|
||||
|
||||
- name: Configure fail2ban nginx filter
|
||||
when: "extra_fail2ban_filters is defined and 'nginx' in extra_fail2ban_filters"
|
||||
template: src=etc/fail2ban/jail.d/nginx.local.j2 dest=/etc/fail2ban/jail.d/nginx.local owner=root mode=0644
|
||||
notify: restart fail2ban
|
||||
when:
|
||||
- webserver is defined and webserver == 'nginx'
|
||||
- extra_fail2ban_filters is defined
|
||||
- "'nginx' in extra_fail2ban_filters"
|
||||
ansible.builtin.template:
|
||||
src: etc/fail2ban/jail.d/nginx.local.j2
|
||||
dest: /etc/fail2ban/jail.d/nginx.local
|
||||
owner: root
|
||||
mode: "0644"
|
||||
notify: Restart fail2ban
|
||||
|
||||
- name: Create fail2ban service override directory
|
||||
file: path=/etc/systemd/system/fail2ban.service.d state=directory owner=root mode=0755
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/fail2ban.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
mode: "0755"
|
||||
|
||||
# See Arch Linux's example: https://wiki.archlinux.org/index.php/Fail2ban
|
||||
- name: Configure fail2ban service override
|
||||
template: src=etc/systemd/system/fail2ban.service.d/override.conf.j2 dest=/etc/systemd/system/fail2ban.service.d/override.conf owner=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/system/fail2ban.service.d/override.conf.j2
|
||||
dest: /etc/systemd/system/fail2ban.service.d/override.conf
|
||||
owner: root
|
||||
mode: "0644"
|
||||
notify:
|
||||
- reload systemd
|
||||
- restart fail2ban
|
||||
- Reload systemd
|
||||
- Restart fail2ban
|
||||
|
||||
- name: Start and enable fail2ban service
|
||||
systemd: name=fail2ban state=started enabled=yes
|
||||
ansible.builtin.systemd_service:
|
||||
name: fail2ban
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
||||
25
roles/common/tasks/firewall.yml
Normal file
25
roles/common/tasks/firewall.yml
Normal file
@@ -0,0 +1,25 @@
|
||||
---
|
||||
# Debian 11+ will use nftables directly, with no firewalld.
|
||||
|
||||
- name: Install Debian firewall packages
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
ansible.builtin.apt:
|
||||
name: nftables
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Remove iptables on newer Debian
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
ansible.builtin.apt:
|
||||
pkg: iptables
|
||||
state: absent
|
||||
|
||||
- name: Configure nftables
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
ansible.builtin.include_tasks: nftables.yml
|
||||
|
||||
- name: Configure fail2ban
|
||||
when: ansible_distribution_version is version('9', '>=')
|
||||
ansible.builtin.include_tasks: fail2ban.yml
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,148 +0,0 @@
|
||||
---
|
||||
# Debian 11 will use nftables directly, with no firewalld.
|
||||
|
||||
- block:
|
||||
- name: Set Debian firewall packages
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
set_fact:
|
||||
debian_firewall_packages:
|
||||
- firewalld
|
||||
- tidy
|
||||
- fail2ban
|
||||
- python3-systemd # for fail2ban systemd backend
|
||||
|
||||
- name: Set Debian firewall packages
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
set_fact:
|
||||
debian_firewall_packages:
|
||||
- fail2ban
|
||||
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
||||
- nftables
|
||||
- python3-systemd
|
||||
- curl # for nftables update scripts
|
||||
|
||||
- name: Install firewall packages
|
||||
apt: pkg={{ debian_firewall_packages }} state=present cache_valid_time=3600
|
||||
|
||||
- name: Copy nftables.conf
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
|
||||
notify:
|
||||
- reload nftables
|
||||
|
||||
- name: Create /etc/nftables extra config directory
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
file: path=/etc/nftables state=directory owner=root mode=0755
|
||||
|
||||
- name: Copy extra nftables configuration files
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
copy: src={{ item }} dest=/etc/nftables/{{ item }} owner=root group=root mode=0644 force=no
|
||||
loop:
|
||||
- spamhaus-ipv4.nft
|
||||
- spamhaus-ipv6.nft
|
||||
- abusech-ipv4.nft
|
||||
- abuseipdb-ipv4.nft
|
||||
- abuseipdb-ipv6.nft
|
||||
notify:
|
||||
- reload nftables
|
||||
|
||||
- name: Use iptables backend in firewalld
|
||||
when: ansible_distribution_major_version is version('10', '==')
|
||||
lineinfile:
|
||||
dest: /etc/firewalld/firewalld.conf
|
||||
regexp: '^FirewallBackend=nftables$'
|
||||
line: 'FirewallBackend=iptables'
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
# firewalld seems to have an issue with iptables 1.8.2 when using the nftables
|
||||
# backend. Using individual calls seems to work around it.
|
||||
# See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931722
|
||||
- name: Use individual iptables calls
|
||||
when: ansible_distribution_major_version is version('10', '==')
|
||||
lineinfile:
|
||||
dest: /etc/firewalld/firewalld.conf
|
||||
regexp: '^IndividualCalls=no$'
|
||||
line: 'IndividualCalls=yes'
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy firewalld public zone file
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
|
||||
|
||||
- name: Format public.xml firewalld zone file
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy firewalld ipsets of abusive IPs
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
|
||||
loop:
|
||||
- abusers-ipv4.xml
|
||||
- abusers-ipv6.xml
|
||||
- spamhaus-ipv4.xml
|
||||
- spamhaus-ipv6.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy Spamhaus firewalld update script
|
||||
when: ansible_distribution_version is version('10', '<=')
|
||||
copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
|
||||
|
||||
- name: Copy Spamhaus firewalld systemd units
|
||||
when: ansible_distribution_version is version('10', '<=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-lists.service
|
||||
- update-spamhaus-lists.timer
|
||||
register: spamhaus_firewalld_systemd_units
|
||||
|
||||
- name: Copy Spamhaus nftables update scripts
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.sh
|
||||
- aggregate-cidr-addresses.pl
|
||||
- update-abusech-nftables.sh
|
||||
|
||||
- name: Copy nftables systemd units
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.service
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.service
|
||||
- update-abusech-nftables.timer
|
||||
register: nftables_systemd_units
|
||||
|
||||
# need to reload to pick up service/timer/environment changes
|
||||
- name: Reload systemd daemon
|
||||
systemd: daemon_reload=yes
|
||||
when: spamhaus_firewalld_systemd_units is changed or
|
||||
nftables_systemd_units is changed
|
||||
|
||||
- name: Start and enable Spamhaus firewalld update timer
|
||||
when: ansible_distribution_version is version('10', '<=')
|
||||
systemd: name=update-spamhaus-lists.timer state=started enabled=yes
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Start and enable nftables update timers
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
systemd: name={{ item }} state=started enabled=yes
|
||||
loop:
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.timer
|
||||
|
||||
- name: Start and enable nftables
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
systemd: name=nftables state=started enabled=yes
|
||||
|
||||
- include_tasks: fail2ban.yml
|
||||
when: ansible_distribution_major_version is version('9', '>=')
|
||||
tags: firewall
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,133 +0,0 @@
|
||||
---
|
||||
# Ubuntu 20.04 will use nftables directly, with no firewalld.
|
||||
# Ubuntu 18.04 will use firewalld with the nftables backend.
|
||||
# Ubuntu 16.04 will use firewalld with the iptables backend.
|
||||
|
||||
- block:
|
||||
- name: Set Ubuntu firewall packages
|
||||
when: ansible_distribution_version is version('20.04', '<')
|
||||
set_fact:
|
||||
ubuntu_firewall_packages:
|
||||
- firewalld
|
||||
- tidy
|
||||
- fail2ban
|
||||
- python3-systemd # for fail2ban systemd backend
|
||||
|
||||
- name: Set Ubuntu firewall packages
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
set_fact:
|
||||
ubuntu_firewall_packages:
|
||||
- fail2ban
|
||||
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
||||
- nftables
|
||||
- python3-systemd
|
||||
- curl # for nftables update scripts
|
||||
|
||||
- name: Install firewall packages
|
||||
apt: pkg={{ ubuntu_firewall_packages }} state=present cache_valid_time=3600
|
||||
|
||||
- name: Remove ufw
|
||||
when: ansible_distribution_version is version('16.04', '>=')
|
||||
apt: pkg=ufw state=absent
|
||||
|
||||
- name: Copy nftables.conf
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
|
||||
notify:
|
||||
- restart nftables
|
||||
|
||||
- name: Create /etc/nftables extra config directory
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
file: path=/etc/nftables state=directory owner=root mode=0755
|
||||
|
||||
- name: Copy extra nftables configuration files
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
copy: src={{ item }} dest=/etc/nftables/{{ item }} owner=root group=root mode=0644 force=no
|
||||
loop:
|
||||
- spamhaus-ipv4.nft
|
||||
- spamhaus-ipv6.nft
|
||||
- abusech-ipv4.nft
|
||||
- abuseipdb-ipv4.nft
|
||||
- abuseipdb-ipv6.nft
|
||||
notify:
|
||||
- restart nftables
|
||||
|
||||
- name: Copy firewalld public zone file
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
|
||||
|
||||
- name: Format public.xml firewalld zone file
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy firewalld ipsets of abusive IPs
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
|
||||
loop:
|
||||
- abusers-ipv4.xml
|
||||
- abusers-ipv6.xml
|
||||
- spamhaus-ipv4.xml
|
||||
- spamhaus-ipv6.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy Spamhaus firewalld update script
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
|
||||
|
||||
- name: Copy Spamhaus firewalld systemd units
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-lists.service
|
||||
- update-spamhaus-lists.timer
|
||||
register: spamhaus_firewalld_systemd_units
|
||||
|
||||
- name: Copy nftables update scripts
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.sh
|
||||
- aggregate-cidr-addresses.pl
|
||||
- update-abusech-nftables.sh
|
||||
|
||||
- name: Copy nftables systemd units
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.service
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.service
|
||||
- update-abusech-nftables.timer
|
||||
register: nftables_systemd_units
|
||||
|
||||
# need to reload to pick up service/timer/environment changes
|
||||
- name: Reload systemd daemon
|
||||
systemd: daemon_reload=yes
|
||||
when: spamhaus_firewalld_systemd_units is changed or
|
||||
nftables_systemd_units is changed
|
||||
|
||||
- name: Start and enable Spamhaus firewalld update timer
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
systemd: name=update-spamhaus-lists.timer state=started enabled=yes
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Start and enable nftables update timers
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
systemd: name={{ item }} state=started enabled=yes
|
||||
loop:
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.timer
|
||||
|
||||
- name: Start and enable nftables
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
systemd: name=nftables state=started enabled=yes
|
||||
|
||||
- include_tasks: fail2ban.yml
|
||||
when: ansible_distribution_version is version('16.04', '>=')
|
||||
tags: firewall
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,54 +1,48 @@
|
||||
---
|
||||
- name: Import OS-specific variables
|
||||
include_vars: "vars/{{ ansible_distribution }}.yml"
|
||||
ansible.builtin.include_vars: vars/{{ ansible_distribution }}.yml
|
||||
tags: always
|
||||
|
||||
- name: Configure network time
|
||||
import_tasks: ntp.yml
|
||||
ansible.builtin.import_tasks: ntp.yml
|
||||
tags: ntp
|
||||
|
||||
- name: Install common packages
|
||||
include_tasks: packages_Debian.yml
|
||||
when: ansible_distribution == 'Debian'
|
||||
tags: packages
|
||||
|
||||
- name: Install common packages
|
||||
include_tasks: packages_Ubuntu.yml
|
||||
when: ansible_distribution == 'Ubuntu'
|
||||
ansible.builtin.include_tasks: packages.yml
|
||||
tags: packages
|
||||
|
||||
- name: Configure firewall
|
||||
include_tasks: firewall_Debian.yml
|
||||
when: ansible_distribution == 'Debian'
|
||||
tags: firewall
|
||||
|
||||
- name: Configure firewall
|
||||
include_tasks: firewall_Ubuntu.yml
|
||||
when: ansible_distribution == 'Ubuntu'
|
||||
ansible.builtin.import_tasks: firewall.yml
|
||||
tags: firewall
|
||||
|
||||
- name: Configure secure shell daemon
|
||||
import_tasks: sshd.yml
|
||||
ansible.builtin.import_tasks: sshd.yml
|
||||
tags: sshd
|
||||
|
||||
# containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!
|
||||
- name: Reconfigure /etc/sysctl.conf
|
||||
when: ansible_virtualization_role != 'host'
|
||||
template: src=sysctl_{{ ansible_distribution }}.j2 dest=/etc/sysctl.conf owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: "sysctl_{{ ansible_distribution }}.j2"
|
||||
dest: /etc/sysctl.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify:
|
||||
- reload sysctl
|
||||
- Reload sysctl
|
||||
tags: sysctl
|
||||
|
||||
- name: Reconfigure /etc/rc.local
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('19.04', '<=')
|
||||
template: src=rc.local_Ubuntu.j2 dest=/etc/rc.local owner=root group=root mode=0755
|
||||
|
||||
- name: Set I/O scheduler
|
||||
template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: etc/udev/rules.d/60-scheduler.rules.j2
|
||||
dest: /etc/udev/rules.d/60-scheduler.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
tags: udev
|
||||
|
||||
- name: Copy admin SSH keys
|
||||
import_tasks: ssh-keys.yml
|
||||
ansible.builtin.import_tasks: ssh-keys.yml
|
||||
tags: ssh-keys
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
||||
96
roles/common/tasks/nftables.yml
Normal file
96
roles/common/tasks/nftables.yml
Normal file
@@ -0,0 +1,96 @@
|
||||
---
|
||||
# Common nftables tasks for Debian 11 and Debian 12.
|
||||
|
||||
- name: Copy nftables.conf
|
||||
ansible.builtin.template:
|
||||
src: nftables.conf.j2
|
||||
dest: /etc/nftables.conf
|
||||
owner: root
|
||||
mode: "0644"
|
||||
notify:
|
||||
- Restart nftables
|
||||
- Restart fail2ban
|
||||
|
||||
- name: Create /etc/nftables extra config directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/nftables
|
||||
state: directory
|
||||
owner: root
|
||||
mode: "0755"
|
||||
|
||||
- name: Copy extra nftables configuration files
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src }}"
|
||||
dest: /etc/nftables/{{ item.src }}
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
force: "{{ item.force }}"
|
||||
loop:
|
||||
- { src: firehol_level1-ipv4.nft, force: false }
|
||||
notify:
|
||||
- Restart nftables
|
||||
- Restart fail2ban
|
||||
|
||||
- name: Copy nftables update scripts
|
||||
ansible.builtin.template:
|
||||
src: update-firehol-nftables.sh.j2
|
||||
dest: /usr/local/bin/update-firehol-nftables.sh
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Remove deprecated data and scripts
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- /etc/nftables/spamhaus-ipv4.nft
|
||||
- /etc/nftables/spamhaus-ipv6.nft
|
||||
- /etc/nftables/abuseipdb-ipv4.nft
|
||||
- /etc/nftables/abuseipdb-ipv6.nft
|
||||
- /etc/nftables/abusech-ipv4.nft
|
||||
- /usr/local/bin/update-abusech-nftables.sh
|
||||
- /usr/local/bin/update-spamhaus-nftables.sh
|
||||
- /etc/systemd/system/update-abusech-nftables.service
|
||||
- /etc/systemd/system/update-abusech-nftables.timer
|
||||
- /etc/systemd/system/update-spamhaus-nftables.service
|
||||
- /etc/systemd/system/update-spamhaus-nftables.timer
|
||||
- /usr/local/bin/aggregate-cidr-addresses.pl
|
||||
notify:
|
||||
- Restart nftables
|
||||
- Restart fail2ban
|
||||
|
||||
- name: Copy nftables systemd units
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item }}"
|
||||
dest: /etc/systemd/system/{{ item }}
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
loop:
|
||||
- update-firehol-nftables.service
|
||||
- update-firehol-nftables.timer
|
||||
register: nftables_systemd_units
|
||||
|
||||
# need to reload to pick up service/timer/environment changes
|
||||
- name: Reload systemd daemon
|
||||
when: nftables_systemd_units is changed
|
||||
ansible.builtin.systemd_service: # noqa no-handler
|
||||
daemon_reload: true
|
||||
|
||||
- name: Start and enable nftables update timers
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ item }}"
|
||||
state: started
|
||||
enabled: true
|
||||
loop:
|
||||
- update-firehol-nftables.timer
|
||||
|
||||
- name: Start and enable nftables
|
||||
ansible.builtin.systemd_service:
|
||||
name: nftables
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,18 +1,40 @@
|
||||
---
|
||||
# Hosts running Ubuntu 16.04+ and Debian 9+ use systemd init system and should
|
||||
# use timedatectl as a network time client instead of the standalone ntp client.
|
||||
# Hosts running Debian 9+ use systemd init system and can use systemd-timesyncd
|
||||
# as a network time client instead of the standalone ntp client.
|
||||
|
||||
- name: Set timezone
|
||||
when: timezone is defined and ansible_service_mgr == 'systemd'
|
||||
command: /usr/bin/timedatectl set-timezone {{ timezone }}
|
||||
when:
|
||||
- timezone is defined
|
||||
- ansible_service_mgr == 'systemd'
|
||||
community.general.timezone:
|
||||
name: "{{ timezone }}"
|
||||
tags: timezone
|
||||
|
||||
# Apparently some cloud images don't have this installed by default. From what
|
||||
# I can see on existing servers, systemd-timesyncd is a standalone package on
|
||||
# Debian 11 and Debian 12.
|
||||
- name: Install systemd-timesyncd
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
ansible.builtin.apt:
|
||||
name: systemd-timesyncd
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Start and enable systemd's NTP client
|
||||
when: ansible_service_mgr == 'systemd'
|
||||
systemd: name=systemd-timesyncd state=started enabled=yes
|
||||
ansible.builtin.systemd_service:
|
||||
name: systemd-timesyncd
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Uninstall ntp on modern Ubuntu/Debian
|
||||
apt: name=ntp state=absent update_cache=yes
|
||||
when: ansible_service_mgr == 'systemd'
|
||||
# On Debian 12 ntp doesn't conflict with systemd-timesyncd so we should try to
|
||||
# remove it to be sure.
|
||||
- name: Uninstall ntp on Debian 12
|
||||
when:
|
||||
- ansible_service_mgr == 'systemd'
|
||||
- ansible_distribution_major_version is version('12', '==')
|
||||
ansible.builtin.apt:
|
||||
name: ntp
|
||||
state: absent
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
57
roles/common/tasks/packages.yml
Normal file
57
roles/common/tasks/packages.yml
Normal file
@@ -0,0 +1,57 @@
|
||||
---
|
||||
- name: Configure Debian packages
|
||||
tags: packages
|
||||
block:
|
||||
# Scaleway seems to use a weird sources.list format as of Debian 12?
|
||||
- name: Check for weird Debian sources
|
||||
ansible.builtin.stat:
|
||||
path: /etc/apt/sources.list.d/debian.sources
|
||||
register: weird_debian_sources_stat
|
||||
|
||||
- name: Configure apt mirror
|
||||
when:
|
||||
- ansible_architecture != 'armv7l'
|
||||
- not weird_debian_sources_stat
|
||||
ansible.builtin.template:
|
||||
src: sources.list.j2
|
||||
dest: /etc/apt/sources.list
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Set fact for base packages
|
||||
ansible.builtin.set_fact:
|
||||
base_packages:
|
||||
- git
|
||||
- git-lfs
|
||||
- tmux
|
||||
- iotop
|
||||
- htop
|
||||
- strace
|
||||
- safe-rm
|
||||
- debian-goodies
|
||||
- mosh
|
||||
- python3-pycurl # for ansible's apt_repository
|
||||
- vim
|
||||
- unzip
|
||||
- apt-transport-https # for https support in apt
|
||||
- gnupg2
|
||||
- zstd
|
||||
- rsync
|
||||
- lsof
|
||||
- unattended-upgrades
|
||||
|
||||
- name: Install base packages
|
||||
ansible.builtin.apt:
|
||||
name: "{{ base_packages }}"
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Remove cron-apt
|
||||
tags: cron-apt
|
||||
ansible.builtin.import_tasks: cron-apt.yml
|
||||
|
||||
- name: Install tarsnap
|
||||
ansible.builtin.import_tasks: tarsnap.yml
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,38 +0,0 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Configure apt mirror
|
||||
template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
|
||||
when: ansible_architecture != 'armv7l'
|
||||
|
||||
- name: Set fact for base packages
|
||||
set_fact:
|
||||
base_packages:
|
||||
- git
|
||||
- tmux
|
||||
- iotop
|
||||
- htop
|
||||
- strace
|
||||
- cron-apt
|
||||
- safe-rm
|
||||
- debian-goodies
|
||||
- mosh
|
||||
- python3-pycurl # for ansible's apt_repository
|
||||
- vim
|
||||
- unzip
|
||||
- apt-transport-https # for https support in apt
|
||||
- gnupg2
|
||||
- zstd
|
||||
|
||||
- name: Install base packages
|
||||
apt: name={{ base_packages }} state=present update_cache=yes cache_valid_time=3600
|
||||
|
||||
- name: Configure cron-apt
|
||||
import_tasks: cron-apt.yml
|
||||
tags: cron-apt
|
||||
|
||||
- name: Install tarsnap
|
||||
import_tasks: tarsnap.yml
|
||||
tags: packages
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,105 +0,0 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Configure apt mirror
|
||||
template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
|
||||
when: ansible_architecture != 'armv7l'
|
||||
|
||||
- name: Upgrade base OS
|
||||
apt: upgrade=dist update_cache=yes cache_valid_time=3600
|
||||
|
||||
- name: Set Ubuntu base packages
|
||||
set_fact:
|
||||
ubuntu_base_packages:
|
||||
- git
|
||||
- tmux
|
||||
- iotop
|
||||
- htop
|
||||
- strace
|
||||
- cron-apt
|
||||
- safe-rm
|
||||
- debian-goodies
|
||||
- mosh
|
||||
- python-pycurl # for ansible's apt_repository
|
||||
- vim
|
||||
- unzip
|
||||
- apt-transport-https # for https support in apt
|
||||
- zstd
|
||||
|
||||
- name: Install base packages
|
||||
apt: pkg={{ ubuntu_base_packages }} state=present update_cache=yes cache_valid_time=3600
|
||||
|
||||
# We have to remove snaps one by one in a specific order because some depend
|
||||
# on others. Only after that can we remove the corresponding system packages.
|
||||
- name: Remove lxd snap
|
||||
snap: name=lxd state=absent
|
||||
when: ansible_distribution_version is version('20.04', '==')
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Remove core18 snap
|
||||
snap: name=core18 state=absent
|
||||
when: ansible_distribution_version is version('20.04', '==')
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Remove snapd snap
|
||||
snap: name=snapd state=absent
|
||||
when: ansible_distribution_version is version('20.04', '==')
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Set fact for packages to remove (Ubuntu <= 18.04)
|
||||
set_fact:
|
||||
ubuntu_annoying_packages:
|
||||
- whoopsie # security (CIS 4.1)
|
||||
- apport # security (CIS 4.1)
|
||||
- command-not-found # annoying
|
||||
- command-not-found-data # annoying
|
||||
- python3-commandnotfound # annoying
|
||||
- snapd # annoying (Ubuntu >= 16.04)
|
||||
- lxd # annoying (Ubuntu >= 16.04)
|
||||
- lxd-client # annoying (Ubuntu >= 16.04)
|
||||
- liblxc1 # annoying (Ubuntu >= 16.04)
|
||||
- lxc-common # annoying (Ubuntu >= 16.04)
|
||||
- lxcfs #annoying (Ubuntu >= 16.04)
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
|
||||
- name: Set fact for packages to remove (Ubuntu 20.04)
|
||||
set_fact:
|
||||
ubuntu_annoying_packages:
|
||||
- whoopsie # security (CIS 4.1)
|
||||
- apport # security (CIS 4.1)
|
||||
- command-not-found # annoying
|
||||
- command-not-found-data # annoying
|
||||
- python3-commandnotfound # annoying
|
||||
- snapd # annoying (Ubuntu >= 16.04)
|
||||
- lxd-agent-loader # annoying (Ubuntu 20.04)
|
||||
when: ansible_distribution_version is version('20.04', '==')
|
||||
|
||||
- name: Remove packages
|
||||
apt: name={{ ubuntu_annoying_packages }} state=absent purge=yes
|
||||
|
||||
- name: Disable annoying Canonical spam in MOTD
|
||||
file: path={{ item }} mode=0644 state=absent
|
||||
loop:
|
||||
- /etc/update-motd.d/99-esm # Ubuntu 14.04
|
||||
- /etc/update-motd.d/10-help-text # Ubuntu 14.04+
|
||||
- /etc/update-motd.d/50-motd-news # Ubuntu 18.04+
|
||||
- /etc/update-motd.d/80-esm # Ubuntu 18.04+
|
||||
- /etc/update-motd.d/80-livepatch # Ubuntu 18.04+
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Disable annoying Canonical spam in MOTD
|
||||
systemd: name={{ item }} state=stopped enabled=no
|
||||
when: ansible_service_mgr == 'systemd'
|
||||
loop:
|
||||
- motd-news.service
|
||||
- motd-news.timer
|
||||
|
||||
- name: Configure cron-apt
|
||||
import_tasks: cron-apt.yml
|
||||
tags: cron-apt
|
||||
|
||||
- name: Install tarsnap
|
||||
import_tasks: tarsnap.yml
|
||||
tags: packages
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,9 +1,11 @@
|
||||
---
|
||||
- name: Zero .ssh/authorized_keys for provisioning user
|
||||
file: dest={{ provisioning_user.home }}/.ssh/authorized_keys state=absent
|
||||
ansible.builtin.file:
|
||||
dest: "{{ provisioning_user.home }}/.ssh/authorized_keys"
|
||||
state: absent
|
||||
|
||||
- name: Add public keys to authorized_keys
|
||||
authorized_key: { user: '{{ provisioning_user.name }}', key: "{{ lookup('file',item) }}" }
|
||||
ansible.posix.authorized_key: { user: "{{ provisioning_user.name }}", key: "{{ lookup('file', item) }}" }
|
||||
with_fileglob:
|
||||
# use descriptive names for keys, like: aorth-mzito-rsa.pub
|
||||
- ssh-pub-keys/*.pub
|
||||
|
||||
@@ -1,25 +1,62 @@
|
||||
---
|
||||
|
||||
# SSH configs don't change in Debian minor versions
|
||||
# Only override the system sshd configuration on older Debian.
|
||||
- name: Reconfigure /etc/ssh/sshd_config
|
||||
template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
|
||||
when: ansible_distribution == 'Debian'
|
||||
notify: reload sshd
|
||||
when: ansible_distribution_version is version('12', '<=')
|
||||
ansible.builtin.template:
|
||||
src: "sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2"
|
||||
dest: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
notify: Reload sshd
|
||||
|
||||
# Ubuntu is the only distro we have where SSH version is very different from 14.04 -> 14.10,
|
||||
# ie with new ciphers supported etc.
|
||||
- name: Reconfigure /etc/ssh/sshd_config
|
||||
template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
|
||||
when: ansible_distribution == 'Ubuntu'
|
||||
notify: reload sshd
|
||||
# Newer OpenSSH versions support including extra configuration. The includes
|
||||
# happen at the beginning of the file and the first value to be read is used.
|
||||
- name: Configure sshd_config.d overrides
|
||||
when: ansible_distribution_version is version('13', '>=')
|
||||
ansible.builtin.template:
|
||||
src: etc/ssh/sshd_config.d/01-{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.conf.j2
|
||||
dest: /etc/ssh/sshd_config.d/01-custom.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
notify: Reload sshd
|
||||
|
||||
# See: WeakDH (2015): https://weakdh.org/sysadmin.html
|
||||
- name: Remove small Diffie-Hellman SSH moduli
|
||||
block:
|
||||
- name: Check unsafe Diffie-Hellman SSH moduli
|
||||
ansible.builtin.shell:
|
||||
cmd: awk '$5 < 3071' moduli
|
||||
chdir: /etc/ssh
|
||||
creates: moduli.safe
|
||||
register: check_unsafe_moduli
|
||||
|
||||
- name: Extract safe Diffie-Hellman SSH moduli
|
||||
when: check_unsafe_moduli.stdout | length > 0
|
||||
ansible.builtin.shell:
|
||||
cmd: awk '$5 >= 3071' moduli > moduli.safe
|
||||
chdir: /etc/ssh
|
||||
creates: moduli.safe
|
||||
register: extract_safe_moduli
|
||||
|
||||
- name: Replace unsafe Diffie-Hellman SSH moduli
|
||||
when: extract_safe_moduli is changed
|
||||
ansible.builtin.command:
|
||||
cmd: mv moduli.safe moduli
|
||||
chdir: /etc/ssh
|
||||
register: replace_small_moduli
|
||||
notify: Reload sshd
|
||||
|
||||
- name: Remove DSA and ECDSA host keys
|
||||
file: name=/etc/ssh/{{ item }} state=absent
|
||||
ansible.builtin.file:
|
||||
name: "/etc/ssh/{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- ssh_host_dsa_key
|
||||
- ssh_host_dsa_key.pub
|
||||
- ssh_host_ecdsa_key
|
||||
- ssh_host_ecdsa_key.pub
|
||||
notify: reload sshd
|
||||
notify: Reload sshd
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
||||
@@ -1,24 +1,45 @@
|
||||
---
|
||||
- name: Add Tarsnap apt mirror
|
||||
template: src=tarsnap_sources.list.j2 dest=/etc/apt/sources.list.d/tarsnap.list owner=root group=root mode=0644
|
||||
register: add_tarsnap_apt_repository
|
||||
when: ansible_architecture != 'armv7l'
|
||||
- name: Check tarsnap apt signing key
|
||||
ansible.builtin.stat:
|
||||
path: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
|
||||
register: tarsnap_signing_key_stat
|
||||
|
||||
- name: Add GPG key for Tarsnap
|
||||
apt_key: id=0xBF75EEAB040E447C url=https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc state=present
|
||||
register: add_tarsnap_apt_key
|
||||
- name: Download tarsnap apt signing key
|
||||
when: not tarsnap_signing_key_stat.stat.exists
|
||||
ansible.builtin.get_url:
|
||||
url: https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc
|
||||
dest: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: download_tarsnap_signing_key
|
||||
|
||||
- name: Add tarsnap.org repo
|
||||
when: ansible_architecture != 'armv7l'
|
||||
ansible.builtin.template:
|
||||
src: tarsnap_sources.list.j2
|
||||
dest: /etc/apt/sources.list.d/tarsnap.list
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: add_tarsnap_apt_repository
|
||||
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
when:
|
||||
add_tarsnap_apt_key is changed or
|
||||
add_tarsnap_apt_repository is changed
|
||||
when: (download_tarsnap_signing_key.status_code is defined and download_tarsnap_signing_key.status_code == 200) or add_tarsnap_apt_repository is changed
|
||||
ansible.builtin.apt: # noqa no-handler
|
||||
update_cache: true
|
||||
|
||||
- name: Install tarsnap
|
||||
apt: pkg=tarsnap cache_valid_time=3600
|
||||
ansible.builtin.apt:
|
||||
pkg: tarsnap
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Copy tarsnaprc
|
||||
copy: src=tarsnaprc dest=/root/.tarsnaprc owner=root group=root mode=0600
|
||||
ansible.builtin.copy:
|
||||
src: tarsnaprc
|
||||
dest: /root/.tarsnaprc
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
||||
@@ -2,13 +2,9 @@
|
||||
enabled = true
|
||||
# See: /etc/fail2ban/filter.d/nginx-botsearch.conf
|
||||
filter = nginx-botsearch
|
||||
{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
|
||||
# Integrate with nftables
|
||||
banaction=nftables[type=allports]
|
||||
{% else %}
|
||||
# Integrate with firewalld and ipsets
|
||||
banaction = firewallcmd-ipset
|
||||
{% endif %}
|
||||
backend = pyinotify
|
||||
logpath = /var/log/nginx/*-access.log
|
||||
# Try to find a non-existent wp-login.php once and get banned. Tough luck.
|
||||
maxretry = 1
|
||||
|
||||
@@ -2,13 +2,8 @@
|
||||
enabled = true
|
||||
# See: /etc/fail2ban/filter.d/sshd.conf
|
||||
filter = sshd
|
||||
{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
|
||||
# Integrate with nftables
|
||||
banaction=nftables[type=allports]
|
||||
{% else %}
|
||||
# Integrate with firewalld and ipsets
|
||||
banaction = firewallcmd-ipset
|
||||
{% endif %}
|
||||
backend = systemd
|
||||
maxretry = {{ fail2ban_maxretry }}
|
||||
findtime = {{ fail2ban_findtime }}
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear
|
||||
# audit track of which key was using to log in.
|
||||
LogLevel VERBOSE
|
||||
|
||||
MaxAuthTries 4
|
||||
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
{% if ssh_password_authentication == 'disabled' %}
|
||||
PasswordAuthentication no
|
||||
{% else %}
|
||||
PasswordAuthentication yes
|
||||
{% endif %}
|
||||
|
||||
X11Forwarding no
|
||||
|
||||
# Based on the ssh-audit profile for Debian 13, but with but with all algos with
|
||||
# less than 256 bits removed, as NSA's Suite B removed them years ago and the
|
||||
# new (2018) CNSA suite is 256 bits and up.
|
||||
#
|
||||
# See: ssh-audit.py -P "Hardened Debian 13 (version 1)"
|
||||
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com
|
||||
|
||||
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
||||
AllowUsers {{ ssh_allowed_users|join(" ") }} {{ provisioning_user.name }}
|
||||
{% endif %}
|
||||
|
||||
PerSourcePenaltyExemptList {{ fail2ban_ignoreip | replace(" ", ",") }}
|
||||
|
||||
# Mask to use for IPv4 and IPv6 respectively when applying network penalties.
|
||||
# The default is 32:128.
|
||||
PerSourceNetBlockSize 24:56
|
||||
@@ -1,15 +1,19 @@
|
||||
[Unit]
|
||||
# If nftables is stopped or restarted, propagate to fail2ban as well
|
||||
PartOf=nftables.service
|
||||
|
||||
[Service]
|
||||
PrivateDevices=yes
|
||||
PrivateTmp=yes
|
||||
ProtectHome=read-only
|
||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
|
||||
{% if ansible_distribution_version is version('11','>=') %}
|
||||
ProtectSystem=strict
|
||||
{% else %}
|
||||
{# Older systemd versions don't have ProtectSystem=strict #}
|
||||
ProtectSystem=full
|
||||
{% endif %}
|
||||
NoNewPrivileges=yes
|
||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
|
||||
{% if ansible_distribution_version is version('11','>=') %}
|
||||
ReadWritePaths=-/var/run/fail2ban
|
||||
ReadWritePaths=-/var/lib/fail2ban
|
||||
ReadWritePaths=-/var/log/fail2ban.log
|
||||
|
||||
@@ -5,47 +5,18 @@
|
||||
|
||||
flush ruleset
|
||||
|
||||
# Lists updated daily by update-spamhaus-nftables.sh
|
||||
include "/etc/nftables/spamhaus-ipv4.nft"
|
||||
include "/etc/nftables/spamhaus-ipv6.nft"
|
||||
|
||||
# Lists updated monthly (manually)
|
||||
include "/etc/nftables/abuseipdb-ipv4.nft"
|
||||
include "/etc/nftables/abuseipdb-ipv6.nft"
|
||||
|
||||
# Lists updated daily by update-abusech-nftables.sh
|
||||
include "/etc/nftables/abusech-ipv4.nft"
|
||||
# List updated daily by update-firehol-nftables.sh
|
||||
include "/etc/nftables/firehol_level1-ipv4.nft"
|
||||
|
||||
# Notes:
|
||||
# - tables hold chains, chains hold rules
|
||||
# - inet is for both ipv4 and ipv6
|
||||
table inet filter {
|
||||
set spamhaus-ipv4 {
|
||||
set firehol_level1-ipv4 {
|
||||
type ipv4_addr
|
||||
# if the set contains prefixes we need to use the interval flag
|
||||
flags interval
|
||||
elements = $SPAMHAUS_IPV4
|
||||
}
|
||||
|
||||
set spamhaus-ipv6 {
|
||||
type ipv6_addr
|
||||
flags interval
|
||||
elements = $SPAMHAUS_IPV6
|
||||
}
|
||||
|
||||
set abusech-ipv4 {
|
||||
type ipv4_addr
|
||||
elements = $ABUSECH_IPV4
|
||||
}
|
||||
|
||||
set abuseipdb-ipv4 {
|
||||
type ipv4_addr
|
||||
elements = $ABUSEIPDB_IPV4
|
||||
}
|
||||
|
||||
set abuseipdb-ipv6 {
|
||||
type ipv6_addr
|
||||
elements = $ABUSEIPDB_IPV6
|
||||
elements = $FIREHOL_LEVEL1_IPV4
|
||||
}
|
||||
|
||||
chain input {
|
||||
@@ -55,13 +26,7 @@ table inet filter {
|
||||
|
||||
ct state invalid counter drop comment "Early drop of invalid connections"
|
||||
|
||||
ip saddr @spamhaus-ipv4 counter drop comment "Early drop of incoming packets matching spamhaus-ipv4 list"
|
||||
ip6 saddr @spamhaus-ipv6 counter drop comment "Early drop of incoming packets matching spamhaus-ipv6 list"
|
||||
|
||||
ip saddr @abusech-ipv4 counter drop comment "Early drop of packets matching abusech-ipv4 list"
|
||||
|
||||
ip saddr @abuseipdb-ipv4 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv4 list"
|
||||
ip6 saddr @abuseipdb-ipv6 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv6 list"
|
||||
ip saddr @firehol_level1-ipv4 counter drop comment "Early drop of incoming packets matching firehol_level1-ipv4 list"
|
||||
|
||||
iifname lo accept comment "Allow from loopback"
|
||||
|
||||
@@ -81,12 +46,8 @@ table inet filter {
|
||||
ip6 saddr ::/0 ct state new tcp dport 443 counter accept comment "Allow HTTPS"
|
||||
{% endif %}
|
||||
|
||||
ip saddr 0.0.0.0/0 ct state new udp dport 60001 counter accept comment "Allow mosh"
|
||||
ip saddr 0.0.0.0/0 ct state new udp dport 60002 counter accept comment "Allow mosh"
|
||||
ip saddr 0.0.0.0/0 ct state new udp dport 60003 counter accept comment "Allow mosh"
|
||||
ip6 saddr ::/0 ct state new udp dport 60001 counter accept comment "Allow mosh"
|
||||
ip6 saddr ::/0 ct state new udp dport 60002 counter accept comment "Allow mosh"
|
||||
ip6 saddr ::/0 ct state new udp dport 60003 counter accept comment "Allow mosh"
|
||||
ip saddr 0.0.0.0/0 ct state new udp dport 60001-60003 counter accept comment "Allow mosh"
|
||||
ip6 saddr ::/0 ct state new udp dport 60001-60003 counter accept comment "Allow mosh"
|
||||
|
||||
{# Extra rules #}
|
||||
{% if extra_iptables_rules is defined %}
|
||||
@@ -109,12 +70,6 @@ table inet filter {
|
||||
chain output {
|
||||
type filter hook output priority 0;
|
||||
|
||||
ip daddr @spamhaus-ipv4 counter drop comment "Drop outgoing packets matching spamhaus-ipv4 list"
|
||||
ip6 daddr @spamhaus-ipv6 counter drop comment "Drop outgoing packets matching spamhaus-ipv6 list"
|
||||
|
||||
ip daddr @abusech-ipv4 counter drop comment "Drop outgoing packets matching abusech-ipv4 list"
|
||||
|
||||
ip daddr @abuseipdb-ipv4 counter drop comment "Drop outgoing packets matching abuseipdb-ipv4 list"
|
||||
ip6 daddr @abuseipdb-ipv6 counter drop comment "Drop outgoing packets matching abuseipdb-ipv6 list"
|
||||
ip daddr @firehol_level1-ipv4 counter drop comment "Drop outgoing packets matching firehol_level1-ipv4 list"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,81 +0,0 @@
|
||||
<zone>
|
||||
<short>Public</short>
|
||||
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
|
||||
<interface name="{{ ansible_default_ipv4.interface }}"/>
|
||||
|
||||
{# ssh rules #}
|
||||
<rule family="ipv4">
|
||||
<source address="0.0.0.0/0"/>
|
||||
<port protocol="tcp" port="22"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
|
||||
{# ipv6 ssh rules #}
|
||||
<rule family="ipv6">
|
||||
<source address="::/0"/>
|
||||
<port protocol="tcp" port="22"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
|
||||
{# web rules #}
|
||||
<rule family="ipv4">
|
||||
<source address="0.0.0.0/0"/>
|
||||
<port protocol="tcp" port="80"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
|
||||
{# ipv6 web rules #}
|
||||
<rule family="ipv6">
|
||||
<source address="::/0"/>
|
||||
<port protocol="tcp" port="80"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
|
||||
{# munin rules #}
|
||||
{% if munin_master_host is defined %}
|
||||
<rule family="ipv4">
|
||||
<source address="{{ ghetto_ipsets[munin_master_host].src }}"/>
|
||||
<port protocol="tcp" port="{{ munin_node_port }}"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
{% endif %}
|
||||
|
||||
{# extra rules #}
|
||||
{% if extra_iptables_rules is defined %}
|
||||
{% for rule in extra_iptables_rules %}
|
||||
<rule family="ipv4">
|
||||
<source address="{{ ghetto_ipsets[rule.acl].src }}"/>
|
||||
<port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
|
||||
{# ipv6 extra rules #}
|
||||
{% if ghetto_ipsets[rule.acl].ipv6src is defined %}
|
||||
<rule family="ipv6">
|
||||
<source address="{{ ghetto_ipsets[rule.acl].ipv6src }}"/>
|
||||
<port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<rule>
|
||||
<source ipset="abusers-ipv4"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
<rule>
|
||||
<source ipset="abusers-ipv6"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
<rule>
|
||||
<source ipset="spamhaus-ipv4"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
<rule>
|
||||
<source ipset="spamhaus-ipv6"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
|
||||
</zone>
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh -e
|
||||
#
|
||||
# rc.local
|
||||
#
|
||||
# This script is executed at the end of each multiuser runlevel.
|
||||
# Make sure that the script will "exit 0" on success or any other
|
||||
# value on error.
|
||||
#
|
||||
# In order to enable or disable this script just change the execution
|
||||
# bits.
|
||||
#
|
||||
# By default this script does nothing.
|
||||
|
||||
exit 0
|
||||
@@ -1,5 +0,0 @@
|
||||
{% if ansible_distribution == 'Ubuntu' %}
|
||||
deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security main restricted universe multiverse
|
||||
{% elif ansible_distribution == 'Debian' %}
|
||||
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}/updates main contrib non-free
|
||||
{% endif %}
|
||||
@@ -1,16 +1,6 @@
|
||||
{% if ansible_distribution == 'Ubuntu' %}
|
||||
{% set apt_mirror = apt_mirror | default("ubuntu.mirror.ac.ke") %}
|
||||
|
||||
deb http://{{ apt_mirror }}/ubuntu/ {{ ansible_distribution_release }} main restricted universe multiverse
|
||||
deb http://{{ apt_mirror }}/ubuntu/ {{ ansible_distribution_release }}-updates main restricted universe multiverse
|
||||
deb http://security.ubuntu.com/ubuntu/ {{ ansible_distribution_release }}-security main restricted universe multiverse
|
||||
|
||||
{% else %}
|
||||
{% set apt_mirror = apt_mirror | default('deb.debian.org') %}
|
||||
deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }} main contrib non-free
|
||||
|
||||
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main contrib non-free
|
||||
|
||||
deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }}-updates main contrib non-free
|
||||
|
||||
{% endif %} {# ansible_distribution #}
|
||||
|
||||
@@ -56,7 +56,11 @@ AuthorizedKeysFile .ssh/authorized_keys
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
{% if ssh_password_authentication == 'disabled' %}
|
||||
PasswordAuthentication no
|
||||
{% else %}
|
||||
PasswordAuthentication yes
|
||||
{% endif %}
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
@@ -122,7 +126,7 @@ Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
|
||||
|
||||
# Based on the ssh-audit profile for OpenSSH 8.4, but with but with all algos
|
||||
# with less than 256 bits removed, as NSA's Suite B removed them years ago and
|
||||
# the new (2018) CNSA suite is 256 bits and up.
|
||||
@@ -131,8 +135,12 @@ Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
|
||||
|
||||
# only allow shell access by provisioning user
|
||||
AllowUsers {{ provisioning_user.name }}
|
||||
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
||||
# Is there a list of allowed users?
|
||||
# Is it populated? (An empty list is 'None', which evaluates as False in Python)
|
||||
# merge the items of a list into one string using a space as a separator
|
||||
# http://jinja.pocoo.org/docs/dev/templates/#join
|
||||
AllowUsers {{ ssh_allowed_users|join(" ") }} {{ provisioning_user.name }}
|
||||
{% endif %}
|
||||
|
||||
@@ -1,9 +1,8 @@
|
||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
||||
# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
@@ -18,6 +17,7 @@ Include /etc/ssh/sshd_config.d/*.conf
|
||||
#ListenAddress ::
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
@@ -56,12 +56,16 @@ AuthorizedKeysFile .ssh/authorized_keys
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
{% if ssh_password_authentication == 'disabled' %}
|
||||
PasswordAuthentication no
|
||||
{% else %}
|
||||
PasswordAuthentication yes
|
||||
{% endif %}
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication no
|
||||
KbdInteractiveAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
@@ -77,13 +81,13 @@ ChallengeResponseAuthentication no
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# be allowed through the KbdInteractiveAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# PAM authentication via KbdInteractiveAuthentication may bypass
|
||||
# the setting of "PermitRootLogin prohibit-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
# and KbdInteractiveAuthentication to 'no'.
|
||||
UsePAM yes
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
@@ -101,7 +105,7 @@ PrintMotd no
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
#PidFile /var/run/sshd.pid
|
||||
#PidFile /run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
@@ -114,7 +118,7 @@ PrintMotd no
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
@@ -122,14 +126,16 @@ Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
PasswordAuthentication yes
|
||||
|
||||
# Originally from: https://stribika.github.io/2015/01/04/secure-secure-shell.html
|
||||
# ... but with ciphers and MACs with < 256 bits removed, as NSA's Suite B now
|
||||
# does away with these! See: https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
|
||||
# Based on the ssh-audit profile for OpenSSH 9.2, but with but with all algos
|
||||
# with less than 256 bits removed, as NSA's Suite B removed them years ago and
|
||||
# the new (2018) CNSA suite is 256 bits and up.
|
||||
#
|
||||
# See: https://github.com/jtesta/ssh-audit/blob/master/src/ssh_audit/policy.py
|
||||
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
|
||||
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
|
||||
|
||||
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
||||
# Is there a list of allowed users?
|
||||
@@ -1,133 +0,0 @@
|
||||
# $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
# possible, but leave them commented. Uncommented options override the
|
||||
# default value.
|
||||
|
||||
#Port 22
|
||||
#AddressFamily any
|
||||
#ListenAddress 0.0.0.0
|
||||
#ListenAddress ::
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
#RekeyLimit default none
|
||||
|
||||
# Logging
|
||||
#SyslogFacility AUTH
|
||||
# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear audit track of which key was using to log in.
|
||||
LogLevel VERBOSE
|
||||
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
PermitRootLogin prohibit-password
|
||||
#StrictModes yes
|
||||
MaxAuthTries 4
|
||||
#MaxSessions 10
|
||||
|
||||
#PubkeyAuthentication yes
|
||||
|
||||
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
|
||||
# but this is overridden so installations will only check .ssh/authorized_keys
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
|
||||
#AuthorizedPrincipalsFile none
|
||||
|
||||
#AuthorizedKeysCommand none
|
||||
#AuthorizedKeysCommandUser nobody
|
||||
|
||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||
#HostbasedAuthentication no
|
||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||
# HostbasedAuthentication
|
||||
#IgnoreUserKnownHosts no
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
#KerberosGetAFSToken no
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
#GSSAPIStrictAcceptorCheck yes
|
||||
#GSSAPIKeyExchange no
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
UsePAM yes
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
#AllowTcpForwarding yes
|
||||
#GatewayPorts no
|
||||
X11Forwarding no
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
PrintMotd no
|
||||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#UseLogin no
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
|
||||
# Allow client to pass locale environment variables
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
|
||||
# Originally from: https://stribika.github.io/2015/01/04/secure-secure-shell.html
|
||||
# ... but with ciphers and MACs with < 256 bits removed, as NSA's Suite B now
|
||||
# does away with these! See: https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
|
||||
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
|
||||
|
||||
# only allow shell access by provisioning user
|
||||
AllowUsers {{ provisioning_user.name }}
|
||||
@@ -1,100 +0,0 @@
|
||||
#
|
||||
# /etc/sysctl.conf - Configuration file for setting system variables
|
||||
# See /etc/sysctl.d/ for additional system variables
|
||||
# See sysctl.conf (5) for information.
|
||||
#
|
||||
|
||||
#kernel.domainname = example.com
|
||||
|
||||
# Uncomment the following to stop low-level messages on console
|
||||
#kernel.printk = 3 4 1 3
|
||||
|
||||
##############################################################3
|
||||
# Functions previously found in netbase
|
||||
#
|
||||
|
||||
# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
|
||||
# Turn on Source Address Verification in all interfaces to
|
||||
# prevent some spoofing attacks
|
||||
#net.ipv4.conf.default.rp_filter=1
|
||||
#net.ipv4.conf.all.rp_filter=1
|
||||
|
||||
# Uncomment the next line to enable TCP/IP SYN cookies
|
||||
# See http://lwn.net/Articles/277146/
|
||||
# Note: This may impact IPv6 TCP sessions too
|
||||
#net.ipv4.tcp_syncookies=1
|
||||
|
||||
# Uncomment the next line to enable packet forwarding for IPv4
|
||||
#net.ipv4.ip_forward=1
|
||||
|
||||
# Uncomment the next line to enable packet forwarding for IPv6
|
||||
# Enabling this option disables Stateless Address Autoconfiguration
|
||||
# based on Router Advertisements for this host
|
||||
#net.ipv6.conf.all.forwarding=1
|
||||
|
||||
|
||||
###################################################################
|
||||
# Additional settings - these settings can improve the network
|
||||
# security of the host and prevent against some network attacks
|
||||
# including spoofing attacks and man in the middle attacks through
|
||||
# redirection. Some network environments, however, require that these
|
||||
# settings are disabled so review and enable them as needed.
|
||||
#
|
||||
# Do not accept ICMP redirects (prevent MITM attacks)
|
||||
#net.ipv4.conf.all.accept_redirects = 0
|
||||
#net.ipv6.conf.all.accept_redirects = 0
|
||||
# _or_
|
||||
# Accept ICMP redirects only for gateways listed in our default
|
||||
# gateway list (enabled by default)
|
||||
# net.ipv4.conf.all.secure_redirects = 1
|
||||
#
|
||||
# Do not send ICMP redirects (we are not a router)
|
||||
#net.ipv4.conf.all.send_redirects = 0
|
||||
#
|
||||
# Do not accept IP source route packets (we are not a router)
|
||||
#net.ipv4.conf.all.accept_source_route = 0
|
||||
#net.ipv6.conf.all.accept_source_route = 0
|
||||
#
|
||||
# Log Martian Packets
|
||||
#net.ipv4.conf.all.log_martians = 1
|
||||
#
|
||||
|
||||
# CIS Benchmark Adjustments
|
||||
# See: https://github.com/alanorth/securekickstarts
|
||||
kernel.randomize_va_space = 2
|
||||
net.ipv4.ip_forward = 0
|
||||
net.ipv4.conf.all.send_redirects = 0
|
||||
net.ipv4.conf.default.send_redirects = 0
|
||||
net.ipv4.conf.all.accept_source_route = 0
|
||||
net.ipv4.conf.default.accept_source_route = 0
|
||||
net.ipv4.conf.all.accept_redirects = 0
|
||||
net.ipv4.conf.default.accept_redirects = 0
|
||||
net.ipv4.conf.all.secure_redirects = 0
|
||||
net.ipv4.conf.default.secure_redirects = 0
|
||||
net.ipv4.conf.all.log_martians = 1
|
||||
net.ipv4.conf.default.log_martians = 1
|
||||
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
||||
net.ipv4.icmp_ignore_bogus_error_responses = 1
|
||||
net.ipv4.conf.all.rp_filter = 1
|
||||
net.ipv4.conf.default.rp_filter = 1
|
||||
net.ipv4.tcp_syncookies = 1
|
||||
|
||||
# TCP stuff
|
||||
# See: http://fasterdata.es.net/host-tuning/linux/
|
||||
# increase TCP max buffer size settable using setsockopt()
|
||||
net.core.rmem_max = 16777216
|
||||
net.core.wmem_max = 16777216
|
||||
# increase Linux autotuning TCP buffer limit
|
||||
net.ipv4.tcp_rmem = 4096 87380 16777216
|
||||
net.ipv4.tcp_wmem = 4096 65536 16777216
|
||||
# increase the length of the processor input queue
|
||||
net.core.netdev_max_backlog = 30000
|
||||
# recommended for hosts with jumbo frames enabled
|
||||
#net.ipv4.tcp_mtu_probing=1
|
||||
|
||||
# increase quadruplets (src ip, src port, dest ip, dest port)
|
||||
# see: http://vincent.bernat.im/en/blog/2014-tcp-time-wait-state-linux.html
|
||||
net.ipv4.ip_local_port_range = 10240 65535
|
||||
# recommended for web servers, especially if running SPDY
|
||||
# see: http://www.chromium.org/spdy/spdy-best-practices
|
||||
net.ipv4.tcp_slow_start_after_idle = 0
|
||||
@@ -1 +1 @@
|
||||
deb [arch=amd64] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./
|
||||
deb [arch=amd64 signed-by=/etc/apt/keyrings/tarsnap-deb-packaging-key.asc] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./
|
||||
|
||||
65
roles/common/templates/update-firehol-nftables.sh.j2
Executable file
65
roles/common/templates/update-firehol-nftables.sh.j2
Executable file
@@ -0,0 +1,65 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-firehol-nftables.sh v0.0.1
|
||||
#
|
||||
# Download FireHOL lists and load them into nftables sets.
|
||||
#
|
||||
# See: https://iplists.firehol.org/
|
||||
#
|
||||
# Copyright (C) 2025 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
firehol_level1_ipv4_set_path=/etc/nftables/firehol_level1-ipv4.nft
|
||||
|
||||
function download() {
|
||||
echo "Downloading $1"
|
||||
wget -q -O - "https://iplists.firehol.org/files/$1" > "$1"
|
||||
}
|
||||
|
||||
download firehol_level1.netset
|
||||
|
||||
if [[ -f "firehol_level1.netset" ]]; then
|
||||
echo "Processing FireHOL Level 1 list"
|
||||
|
||||
firehol_level1_ipv4_list_temp=$(mktemp)
|
||||
firehol_level1_ipv4_set_temp=$(mktemp)
|
||||
|
||||
# Filter blank lines, comments, and bogons we use inside the LAN, DMZ, and
|
||||
# for local services like systemd-resolved and others on localhost. Ideally
|
||||
# these are blocked already at the WAN side by network administrators.
|
||||
cat firehol_level1.netset \
|
||||
| sed \
|
||||
-e '/^$/d' \
|
||||
-e '/^#.*/d' \
|
||||
-e '/^127\.0\.0\.0\/8/d' \
|
||||
> "$firehol_level1_ipv4_list_temp"
|
||||
|
||||
echo "Building firehol_level1-ipv4 set"
|
||||
cat << NFT_HEAD > "$firehol_level1_ipv4_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define FIREHOL_LEVEL1_IPV4 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
# nftables doesn't mind if the last element in the set has a trailing
|
||||
# comma so we don't need to do anything special here.
|
||||
echo "$network," >> "$firehol_level1_ipv4_set_temp"
|
||||
done < $firehol_level1_ipv4_list_temp
|
||||
|
||||
echo "}" >> "$firehol_level1_ipv4_set_temp"
|
||||
|
||||
install -m 0600 "$firehol_level1_ipv4_set_temp" "$firehol_level1_ipv4_set_path"
|
||||
|
||||
rm -f "$firehol_level1_ipv4_list_temp" "$firehol_level1_ipv4_set_temp"
|
||||
fi
|
||||
|
||||
echo "Restarting nftables"
|
||||
|
||||
/usr/bin/systemctl restart nftables.service
|
||||
|
||||
rm -v firehol_level1.netset
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
# file: roles/mariadb/defaults/main.yml
|
||||
# ansible.builtin.file: roles/mariadb/defaults/main.yml
|
||||
#
|
||||
# Based on my running of mysqltuner.pl on a host with three WordPress databases
|
||||
#
|
||||
@@ -17,7 +17,7 @@ innodb_buffer_pool_size: 256M
|
||||
# Ansible 2.7.x with PyMySQL seems to default to TCP connection so we should
|
||||
# force it to use a Unix socket.
|
||||
# See: https://github.com/ansible/ansible/issues/47736
|
||||
mariadb_login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||
mariadb_login_unix_socket: /run/mysqld/mysqld.sock
|
||||
|
||||
# default is 100 but the max I've seen used is 5, so let's reduce it
|
||||
max_connections: 33
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
---
|
||||
- name: restart mariadb
|
||||
systemd: name=mariadb state=restarted
|
||||
ansible.builtin.systemd_service:
|
||||
name: mariadb
|
||||
state: restarted
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,57 +1,111 @@
|
||||
---
|
||||
- name: Add GPG key for MariaDB repo
|
||||
apt_key: id=0x177F4010FE56CA3336300305F1656F24C74CD1D8 url=https://mariadb.org/mariadb_release_signing_key.asc
|
||||
register: add_mariadb_apt_key
|
||||
tags: mariadb, packages
|
||||
- name: Remove MariaDB key from apt-key
|
||||
ansible.builtin.apt_key:
|
||||
id: "013577200103762554506315430003013705453362230723150730"
|
||||
state: absent
|
||||
tags:
|
||||
- packages
|
||||
- mariadb
|
||||
|
||||
- name: Add MariaDB 10.5 repo
|
||||
template: src=mariadb.list.j2 dest=/etc/apt/sources.list.d/mariadb.list owner=root group=root mode=0644
|
||||
- name: Check MariaDB package signing key
|
||||
ansible.builtin.stat:
|
||||
path: /etc/apt/keyrings/mariadb_release_signing_key.asc
|
||||
register: mariadb_signing_key_stat
|
||||
tags:
|
||||
- packages
|
||||
- mariadb
|
||||
|
||||
- name: Download MariaDB package signing key
|
||||
when: not mariadb_signing_key_stat.stat.exists
|
||||
ansible.builtin.get_url:
|
||||
url: https://mariadb.org/mariadb_release_signing_key.asc
|
||||
dest: /etc/apt/keyrings/mariadb_release_signing_key.asc
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: download_mariadb_signing_key
|
||||
tags:
|
||||
- packages
|
||||
- mariadb
|
||||
|
||||
- name: Add MariaDB 10.11 repo
|
||||
ansible.builtin.apt_repository:
|
||||
repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/mariadb_release_signing_key.asc] https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/debian {{ ansible_distribution_release
|
||||
}} main
|
||||
filename: mariadb
|
||||
state: present
|
||||
register: add_mariadb_apt_repository
|
||||
tags: mariadb, packages
|
||||
tags:
|
||||
- packages
|
||||
- mariadb
|
||||
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
when:
|
||||
add_mariadb_apt_key is changed or
|
||||
add_mariadb_apt_repository is changed
|
||||
when: (download_mariadb_signing_key.status_code is defined and download_mariadb_signing_key.status_code == 200) or add_mariadb_apt_repository is changed
|
||||
ansible.builtin.apt: # noqa no-handler
|
||||
update_cache: true
|
||||
tags:
|
||||
- packages
|
||||
- mariadb
|
||||
|
||||
- name: Install mariadb-server
|
||||
apt: name={{ item }} state=present cache_valid_time=3600
|
||||
loop:
|
||||
- mariadb-server
|
||||
- python3-pymysql # for ansible
|
||||
ansible.builtin.apt:
|
||||
name: [mariadb-server, python3-pymysql]
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
tags: mariadb, packages
|
||||
|
||||
- name: Create system my.cnf
|
||||
template: src=my.cnf.j2 dest=/etc/mysql/my.cnf owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: my.cnf.j2
|
||||
dest: /etc/mysql/my.cnf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify:
|
||||
- restart mariadb
|
||||
tags: mariadb
|
||||
|
||||
# 'localhost' needs to be the last item for idempotency, see
|
||||
# https://docs.ansible.com/ansible/latest/mysql_user_module.html
|
||||
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_user_module.html
|
||||
- name: Update MariaDB root password for all root accounts
|
||||
mysql_user: name=root host={{ item }} password={{ mariadb_root_password }} login_unix_socket={{ mariadb_login_unix_socket }}
|
||||
community.mysql.mysql_user:
|
||||
name: root
|
||||
host: "{{ item }}"
|
||||
password: "{{ mariadb_root_password }}"
|
||||
login_unix_socket: "{{ mariadb_login_unix_socket }}"
|
||||
loop:
|
||||
- 127.0.0.1
|
||||
- ::1
|
||||
tags: mariadb
|
||||
|
||||
- name: Create .my.conf file with root credentials
|
||||
template: src=.my.cnf.j2 dest=/root/.my.cnf owner=root mode=0600
|
||||
ansible.builtin.template:
|
||||
src: .my.cnf.j2
|
||||
dest: /root/.my.cnf
|
||||
owner: root
|
||||
mode: "0600"
|
||||
tags: mariadb
|
||||
|
||||
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_db_module.html
|
||||
- name: Create MariaDB database(s)
|
||||
mysql_db: db={{ item.name }} state=present encoding=utf8mb4
|
||||
loop: "{{ mariadb_databases }}"
|
||||
when: mariadb_databases is defined
|
||||
community.mysql.mysql_db:
|
||||
db: "{{ item.name }}"
|
||||
state: present
|
||||
encoding: utf8mb4
|
||||
login_unix_socket: "{{ mariadb_login_unix_socket }}"
|
||||
loop: "{{ mariadb_databases }}"
|
||||
tags: mariadb
|
||||
|
||||
- name: Create MariaDB user(s)
|
||||
mysql_user: name={{ item.user }} password={{ item.pass }} priv={{ item.name }}.*:ALL host=127.0.0.1 state=present
|
||||
loop: "{{ mariadb_databases }}"
|
||||
when: mariadb_databases is defined
|
||||
community.mysql.mysql_user:
|
||||
name: "{{ item.user }}"
|
||||
password: "{{ item.pass }}"
|
||||
priv: "{{ item.name }}.*:ALL"
|
||||
host: 127.0.0.1
|
||||
state: present
|
||||
login_unix_socket: "{{ mariadb_login_unix_socket }}"
|
||||
loop: "{{ mariadb_databases }}"
|
||||
tags: mariadb
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
deb [arch=amd64] http://mirror.23media.de/mariadb/repo/10.5/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} main
|
||||
@@ -19,14 +19,14 @@
|
||||
# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
|
||||
[client]
|
||||
port = 3306
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
socket = /run/mysqld/mysqld.sock
|
||||
|
||||
# Here is entries for some specific programs
|
||||
# The following values assume you have at least 32M ram
|
||||
|
||||
# This was formally known as [safe_mysqld]. Both versions are currently parsed.
|
||||
[mysqld_safe]
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
socket = /run/mysqld/mysqld.sock
|
||||
nice = 0
|
||||
|
||||
[mysqld]
|
||||
@@ -34,8 +34,8 @@ nice = 0
|
||||
# * Basic Settings
|
||||
#
|
||||
user = mysql
|
||||
pid-file = /var/run/mysqld/mysqld.pid
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
pid-file = /run/mysqld/mysqld.pid
|
||||
socket = /run/mysqld/mysqld.sock
|
||||
port = 3306
|
||||
basedir = /usr
|
||||
datadir = /var/lib/mysql
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
---
|
||||
# file: roles/munin/handlers/main.yml
|
||||
# ansible.builtin.file: roles/munin/handlers/main.yml
|
||||
- name: restart munin-node
|
||||
systemd: name=munin-node state=restarted
|
||||
ansible.builtin.systemd_service: name=munin-node state=restarted
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: Configure munin scraper
|
||||
import_tasks: munin.yml
|
||||
ansible.builtin.import_tasks: munin.yml
|
||||
tags: munin
|
||||
|
||||
- name: Configure munin listener
|
||||
import_tasks: munin-node.yml
|
||||
ansible.builtin.import_tasks: munin-node.yml
|
||||
tags: munin-node
|
||||
|
||||
@@ -1,25 +1,34 @@
|
||||
---
|
||||
- name: Install munin-node
|
||||
apt: name=munin-node state=present
|
||||
ansible.builtin.apt:
|
||||
name: munin-node
|
||||
state: present
|
||||
tags: packages
|
||||
|
||||
# some nice things to have for munin-node on Ubuntu
|
||||
# libwww-perl: for munin's nginx_status check
|
||||
- name: Install munin-node deps
|
||||
apt: name=libwww-perl state=present
|
||||
ansible.builtin.apt:
|
||||
name: libwww-perl
|
||||
state: present
|
||||
tags: packages
|
||||
|
||||
- name: Create munin-node.conf
|
||||
template: src=munin-node.conf.j2 dest=/etc/munin/munin-node.conf
|
||||
ansible.builtin.template:
|
||||
src: munin-node.conf.j2
|
||||
dest: /etc/munin/munin-node.conf
|
||||
notify:
|
||||
- restart munin-node
|
||||
|
||||
- name: Configure munin-node
|
||||
shell: munin-node-configure --shell --families=contrib,auto | sh -x
|
||||
ansible.builtin.shell: munin-node-configure --shell --families=contrib,auto | sh -x
|
||||
notify:
|
||||
- restart munin-node
|
||||
|
||||
- name: Start munin-node
|
||||
systemd: name=munin-node state=started enabled=true
|
||||
ansible.builtin.systemd_service:
|
||||
name: munin-node
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,9 +1,16 @@
|
||||
---
|
||||
- name: Install munin package
|
||||
apt: name=munin state=present
|
||||
ansible.builtin.apt:
|
||||
name: munin
|
||||
state: present
|
||||
tags: packages
|
||||
|
||||
- name: Create munin configuration file
|
||||
template: src=munin.conf.j2 dest=/etc/munin/munin.conf owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: munin.conf.j2
|
||||
dest: /etc/munin/munin.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,44 +1,44 @@
|
||||
---
|
||||
# file: roles/nginx/defaults/main.yml
|
||||
# ansible.builtin.file: roles/nginx/defaults/main.yml
|
||||
|
||||
# path config
|
||||
nginx_confd_path: /etc/nginx/conf.d
|
||||
|
||||
# parent directory of vhost roots
|
||||
nginx_root_prefix: /var/www
|
||||
nginx_root_prefix: "{{ web_root_prefix }}"
|
||||
|
||||
# 1 hour timeout
|
||||
nginx_ssl_session_timeout: 1h
|
||||
# 1 day timeout
|
||||
nginx_ssl_session_timeout: 1d
|
||||
# 10MB -> 40,000 sessions
|
||||
nginx_ssl_session_cache: shared:SSL:10m
|
||||
# 1400 bytes to fit in one MTU (default is 16k!)
|
||||
nginx_ssl_buffer_size: 1400
|
||||
nginx_ssl_buffer_size: 4k
|
||||
nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
|
||||
nginx_ssl_protocols: 'TLSv1.2 TLSv1.3'
|
||||
nginx_ssl_protocols: TLSv1.2 TLSv1.3
|
||||
nginx_ssl_ecdh_curve: X25519:prime256v1:secp384r1
|
||||
|
||||
# DNS resolvers for OCSP stapling (default to Cloudflare public DNS)
|
||||
# See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
|
||||
nginx_ssl_stapling_resolver: '1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]'
|
||||
nginx_ssl_stapling_resolver: 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]
|
||||
|
||||
# HTTP Strict-Transport-Security header, recommended by Google to be ~1 year
|
||||
# in seconds, see: https://hstspreload.org/
|
||||
nginx_hsts_max_age: 31536000
|
||||
|
||||
# install acme.sh?
|
||||
# True unless you're in development and using "localhost" + snakeoil certs
|
||||
use_letsencrypt: True
|
||||
# true unless you're in development and using "localhost" + snakeoil certs
|
||||
use_letsencrypt: true
|
||||
|
||||
# Directory root for Let's Encrypt certs
|
||||
letsencrypt_root: /etc/ssl
|
||||
|
||||
# Location where to save initial acme.sh script. After installation the script
|
||||
# will automatically create its home in the /root/.acme.sh directory (including
|
||||
# a copy of the script itself).
|
||||
letsencrypt_acme_script: /root/acme.sh
|
||||
# a copy of the script itself). The initial script is not needed after.
|
||||
letsencrypt_acme_script_temp: /root/acme.sh
|
||||
letsencrypt_acme_home: /root/.acme.sh
|
||||
|
||||
# stable is 1.20.x
|
||||
# mainline is 1.21.x
|
||||
# stable is 1.26.x
|
||||
# mainline is 1.27.x
|
||||
nginx_version: mainline
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
---
|
||||
- name: reload nginx
|
||||
systemd: name=nginx state=reloaded
|
||||
- name: Reload nginx
|
||||
ansible.builtin.systemd_service:
|
||||
name: nginx
|
||||
state: reloaded
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,59 +1,91 @@
|
||||
---
|
||||
|
||||
# Use acme.sh instead of certbot because they only support installation via
|
||||
# snap now.
|
||||
- block:
|
||||
- name: Remove certbot
|
||||
apt:
|
||||
name: certbot
|
||||
state: absent
|
||||
|
||||
- name: Remove old certbot post and pre hooks for nginx
|
||||
file:
|
||||
dest: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
|
||||
- /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
|
||||
|
||||
- name: Download acme.sh
|
||||
get_url:
|
||||
url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
|
||||
dest: "{{ letsencrypt_acme_script }}"
|
||||
|
||||
- name: Prepare Let's Encrypt well-known directory
|
||||
file:
|
||||
state: directory
|
||||
path: /var/lib/letsencrypt/.well-known
|
||||
owner: root
|
||||
group: nginx
|
||||
mode: g+s
|
||||
|
||||
- name: Copy systemd service to renew Let's Encrypt certs
|
||||
template:
|
||||
src: renew-letsencrypt.service.j2
|
||||
dest: /etc/systemd/system/renew-letsencrypt.service
|
||||
mode: 0644
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Copy systemd timer to renew Let's Encrypt certs
|
||||
copy:
|
||||
src: renew-letsencrypt.timer
|
||||
dest: /etc/systemd/system/renew-letsencrypt.timer
|
||||
mode: 0644
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
# always issues daemon-reload just in case the service/timer changed
|
||||
- name: Start and enable systemd timer to renew Let's Encrypt certs
|
||||
systemd:
|
||||
name: renew-letsencrypt.timer
|
||||
state: started
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')
|
||||
- name: Install and configure Let's Encrypt
|
||||
tags: letsencrypt
|
||||
when:
|
||||
- ansible_distribution == 'Debian'
|
||||
- ansible_distribution_version is version('11', '>='))
|
||||
block:
|
||||
- name: Remove certbot
|
||||
ansible.builtin.apt:
|
||||
name: certbot
|
||||
state: absent
|
||||
|
||||
- name: Remove old certbot post and pre hooks for nginx
|
||||
ansible.builtin.file:
|
||||
dest: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
|
||||
- /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
|
||||
|
||||
- name: Check if acme.sh is installed
|
||||
ansible.builtin.stat:
|
||||
path: "{{ letsencrypt_acme_home }}"
|
||||
register: acme_home
|
||||
|
||||
- name: Download acme.sh
|
||||
when: not acme_home.stat.exists
|
||||
ansible.builtin.get_url:
|
||||
url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
|
||||
dest: "{{ letsencrypt_acme_script_temp }}"
|
||||
mode: "0700"
|
||||
register: acme_download
|
||||
|
||||
# Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
|
||||
# have to chdir to the /root directory where the script exists or else it
|
||||
# fails. Ansible runs it, but the script can't find itself...).
|
||||
- name: Install acme.sh
|
||||
when: acme_download is changed
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
|
||||
creates: "{{ letsencrypt_acme_home }}/acme.sh"
|
||||
chdir: /root
|
||||
register: acme_install
|
||||
|
||||
- name: Remove temporary acme.sh script
|
||||
when:
|
||||
- acme_install.rc is defined
|
||||
- acme_install.rc == 0
|
||||
ansible.builtin.file:
|
||||
dest: "{{ letsencrypt_acme_script_temp }}"
|
||||
state: absent
|
||||
|
||||
- name: Set default certificate authority for acme.sh
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"
|
||||
|
||||
- name: Prepare Let's Encrypt well-known directory
|
||||
ansible.builtin.file:
|
||||
state: directory
|
||||
path: /var/lib/letsencrypt/.well-known
|
||||
owner: root
|
||||
group: nginx
|
||||
mode: g+s
|
||||
|
||||
- name: Copy systemd service to renew Let's Encrypt certs
|
||||
ansible.builtin.template:
|
||||
src: renew-letsencrypt.service.j2
|
||||
dest: /etc/systemd/system/renew-letsencrypt.service
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Copy systemd timer to renew Let's Encrypt certs
|
||||
ansible.builtin.copy:
|
||||
src: renew-letsencrypt.timer
|
||||
dest: /etc/systemd/system/renew-letsencrypt.timer
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
# always issues daemon-reload just in case the service/timer changed
|
||||
- name: Start and enable systemd timer to renew Let's Encrypt certs
|
||||
ansible.builtin.systemd_service:
|
||||
name: renew-letsencrypt.timer
|
||||
state: started
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,84 +1,132 @@
|
||||
---
|
||||
- name: Add nginx.org apt signing key
|
||||
apt_key: id=0x573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 url=https://nginx.org/keys/nginx_signing.key state=present
|
||||
register: add_nginx_apt_key
|
||||
tags: nginx, packages
|
||||
- name: Remove nginx apt signing key from apt-key
|
||||
ansible.builtin.apt_key:
|
||||
id: "053473772654754373614404074646527257655730117366337542"
|
||||
state: absent
|
||||
tags:
|
||||
- packages
|
||||
- nginx
|
||||
|
||||
- name: Download nginx apt signing key
|
||||
ansible.builtin.get_url:
|
||||
url: https://nginx.org/keys/nginx_signing.key
|
||||
dest: /usr/share/keyrings/nginx_signing.key
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
checksum: sha256:55385da31d198fa6a5012d40ae98ecb272a6c4e8fffffba94719ffd3e87de37a
|
||||
register: download_nginx_signing_key
|
||||
tags:
|
||||
- packages
|
||||
- nginx
|
||||
|
||||
- name: Add nginx.org repo
|
||||
template: src=nginx_org_sources.list.j2 dest=/etc/apt/sources.list.d/nginx_org_sources.list owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: nginx_org_sources.list.j2
|
||||
dest: /etc/apt/sources.list.d/nginx_org_sources.list
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: add_nginx_apt_repository
|
||||
tags: nginx, packages
|
||||
tags:
|
||||
- nginx
|
||||
- packages
|
||||
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
when:
|
||||
add_nginx_apt_key is changed or
|
||||
add_nginx_apt_repository is changed
|
||||
when: (download_nginx_signing_key.status_code is defined and download_nginx_signing_key.status_code == 200) or add_nginx_apt_repository is changed
|
||||
ansible.builtin.apt: # noqa no-handler
|
||||
update_cache: true
|
||||
|
||||
- name: Set nginx packages
|
||||
set_fact:
|
||||
nginx_packages:
|
||||
- nginx
|
||||
- ssl-cert # for ssl-cert-snakeoil.pem in nginx
|
||||
tags: nginx, packages
|
||||
|
||||
- name: Install nginx packages
|
||||
apt: pkg={{ nginx_packages }} cache_valid_time=3600 state=present
|
||||
tags: nginx, packages
|
||||
- name: Install nginx
|
||||
ansible.builtin.apt:
|
||||
pkg: nginx
|
||||
cache_valid_time: 3600
|
||||
state: present
|
||||
tags:
|
||||
- nginx
|
||||
- packages
|
||||
|
||||
- name: Copy nginx.conf
|
||||
template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf mode=0644 owner=root group=root
|
||||
ansible.builtin.template:
|
||||
src: nginx.conf.j2
|
||||
dest: /etc/nginx/nginx.conf
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- reload nginx
|
||||
- Reload nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Copy extra nginx configs
|
||||
copy: src={{ item }} dest=/etc/nginx/{{ item }} mode=0644 owner=root group=root
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item }}"
|
||||
dest: /etc/nginx/{{ item }}
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
loop:
|
||||
- extra-security.conf
|
||||
- fastcgi_cache
|
||||
notify:
|
||||
- reload nginx
|
||||
- Reload nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Remove default nginx vhost
|
||||
file: path=/etc/nginx/conf.d/default.conf state=absent
|
||||
ansible.builtin.file:
|
||||
path: /etc/nginx/conf.d/default.conf
|
||||
state: absent
|
||||
tags: nginx
|
||||
|
||||
- name: Create fastcgi cache dir
|
||||
file: path=/var/cache/nginx/cached/fastcgi state=directory owner=nginx group=nginx mode=0755
|
||||
ansible.builtin.file:
|
||||
path: /var/cache/nginx/cached/fastcgi
|
||||
state: directory
|
||||
owner: nginx
|
||||
group: nginx
|
||||
mode: "0755"
|
||||
tags: nginx
|
||||
|
||||
- name: Configure nginx virtual hosts
|
||||
include_tasks: vhosts.yml
|
||||
when: nginx_vhosts is defined
|
||||
ansible.builtin.include_tasks: vhosts.yml
|
||||
tags: nginx
|
||||
|
||||
- name: Configure WordPress
|
||||
include_tasks: wordpress.yml
|
||||
when: nginx_vhosts is defined
|
||||
ansible.builtin.include_tasks: wordpress.yml
|
||||
tags: wordpress
|
||||
|
||||
- name: Configure blank nginx vhost
|
||||
template: src=blank-vhost.conf.j2 dest={{ nginx_confd_path }}/blank-vhost.conf mode=0644 owner=root group=root
|
||||
ansible.builtin.template:
|
||||
src: blank-vhost.conf.j2
|
||||
dest: "{{ nginx_confd_path }}/blank-vhost.conf"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- reload nginx
|
||||
- Reload nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Configure munin vhost
|
||||
copy: src=munin.conf dest=/etc/nginx/conf.d/munin.conf mode=0644 owner=root group=root
|
||||
ansible.builtin.copy:
|
||||
src: munin.conf
|
||||
dest: /etc/nginx/conf.d/munin.conf
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- reload nginx
|
||||
- Reload nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Start and enable nginx service
|
||||
systemd: name=nginx state=started enabled=yes
|
||||
ansible.builtin.systemd_service:
|
||||
name: nginx
|
||||
state: started
|
||||
enabled: true
|
||||
tags: nginx
|
||||
|
||||
- name: Configure Let's Encrypt
|
||||
include_tasks: letsencrypt.yml
|
||||
#when: use_letsencrypt is defined and use_letsencrypt
|
||||
ansible.builtin.include_tasks: letsencrypt.yml
|
||||
tags: letsencrypt
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,23 +1,40 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Configure https vhosts
|
||||
template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
notify:
|
||||
- reload nginx
|
||||
|
||||
- name: Download 4096-bit RFC 7919 dhparams
|
||||
get_url:
|
||||
url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
|
||||
checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
|
||||
dest: "{{ nginx_ssl_dhparam }}"
|
||||
notify:
|
||||
- reload nginx
|
||||
|
||||
- name: Create vhost document roots
|
||||
file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
- name: Configure https vhosts
|
||||
tags: nginx
|
||||
block:
|
||||
- name: Configure https vhosts
|
||||
ansible.builtin.template:
|
||||
src: vhost.conf.j2
|
||||
dest: "{{ nginx_confd_path }}/{{ item.domain_name }}.conf"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
notify:
|
||||
- Reload nginx
|
||||
|
||||
- name: Generate self-signed TLS cert
|
||||
ansible.builtin.command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key
|
||||
-out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
|
||||
notify:
|
||||
- Reload nginx
|
||||
|
||||
- name: Download 4096-bit RFC 7919 dhparams
|
||||
ansible.builtin.get_url:
|
||||
url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
|
||||
checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
|
||||
dest: "{{ nginx_ssl_dhparam }}"
|
||||
notify:
|
||||
- Reload nginx
|
||||
|
||||
# TODO: this could break because we can override the document root in host vars
|
||||
- name: Create vhost document roots
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_root_prefix }}/{{ item.domain_name }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
owner: nginx
|
||||
group: nginx
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,15 +1,29 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Install WordPress
|
||||
git: repo=https://github.com/WordPress/WordPress.git dest={{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress version={{ item.wordpress_version }} depth=1 force=yes
|
||||
when: item.has_wordpress is defined and item.has_wordpress
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
|
||||
- name: Fix WordPress directory permissions
|
||||
file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory owner=nginx group=nginx recurse=yes
|
||||
when: item.has_wordpress is defined and item.has_wordpress
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
- name: Install and configure WordPress
|
||||
tags: wordpress
|
||||
block:
|
||||
- name: Install WordPress
|
||||
when:
|
||||
- item.has_wordpress is defined
|
||||
- item.has_wordpress
|
||||
ansible.builtin.git:
|
||||
repo: https://github.com/WordPress/WordPress.git
|
||||
dest: "{{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress"
|
||||
version: "{{ item.wordpress_version }}"
|
||||
depth: 1
|
||||
force: true
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
|
||||
- name: Fix WordPress directory permissions
|
||||
when:
|
||||
- item.has_wordpress is defined
|
||||
- item.has_wordpress
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_root_prefix }}/{{ item.domain_name }}"
|
||||
state: directory
|
||||
owner: nginx
|
||||
group: nginx
|
||||
recurse: true
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -11,14 +11,16 @@ server {
|
||||
|
||||
return 444;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2 default_server;
|
||||
listen [::]:443 ssl http2 default_server;
|
||||
listen 443 ssl default_server;
|
||||
listen [::]:443 ssl default_server;
|
||||
http2 on;
|
||||
server_name _;
|
||||
|
||||
# self-signed "snakeoil" certificate from ssl-cert package
|
||||
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
|
||||
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
|
||||
# self-signed "snakeoil" certificate
|
||||
ssl_certificate /etc/ssl/certs/nginx-snakeoil.crt;
|
||||
ssl_certificate_key /etc/ssl/private/nginx-snakeoil.key;
|
||||
|
||||
ssl_session_timeout {{ nginx_ssl_session_timeout }};
|
||||
ssl_session_cache {{ nginx_ssl_session_cache }};
|
||||
|
||||
5
roles/nginx/templates/gitea.j2
Normal file
5
roles/nginx/templates/gitea.j2
Normal file
@@ -0,0 +1,5 @@
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:3000;
|
||||
}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{# helper variables and per-site defaults that we can't set in role defaults #}
|
||||
{% set domain_name = item.domain_name %}
|
||||
{# assume HSTS is off unless a vhost explicitly sets it to True #}
|
||||
{% set enable_hsts = item.enable_hsts | default(False) %}
|
||||
{# assume HSTS is off unless a vhost explicitly sets it to true #}
|
||||
{% set enable_hsts = item.enable_hsts | default(false) %}
|
||||
|
||||
{# first, check if the current vhost has a custom cert (perhaps self-signed) #}
|
||||
{% if item.tls_certificate_path is defined and item.tls_key_path is defined %}
|
||||
@@ -27,27 +27,19 @@
|
||||
|
||||
ssl_dhparam {{ nginx_ssl_dhparam }};
|
||||
ssl_protocols {{ nginx_ssl_protocols }};
|
||||
ssl_ecdh_curve {{ nginx_ssl_ecdh_curve }};
|
||||
ssl_ciphers "{{ tls_cipher_suite }}";
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
{# OSCP stapling only works with real certs #}
|
||||
{% if use_letsencrypt == True or item.tls_certificate_path %}
|
||||
{% if use_letsencrypt == true or item.tls_certificate_path %}
|
||||
# OCSP stapling...
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
resolver {{ nginx_ssl_stapling_resolver }};
|
||||
{% endif %} {# end: use_letsencrypt #}
|
||||
|
||||
# nginx does not auto-rotate session ticket keys: only a HUP / restart will do so and
|
||||
# when a restart is performed the previous key is lost, which resets all previous
|
||||
# sessions. The fix for this is to setup a manual rotation mechanism:
|
||||
# http://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx
|
||||
#
|
||||
# Note that you'll have to define and rotate the keys securely by yourself. In absence
|
||||
# of such infrastructure, consider turning off session tickets:
|
||||
ssl_session_tickets off;
|
||||
|
||||
{% if enable_hsts == True %}
|
||||
{% if enable_hsts == true %}
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
|
||||
@@ -1,19 +1,7 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
{% if ansible_distribution == 'Ubuntu' %}
|
||||
|
||||
{% if nginx_version == "stable" %}
|
||||
deb [arch=amd64] https://nginx.org/packages/ubuntu/ {{ ansible_distribution_release }} nginx
|
||||
deb [arch=amd64 signed-by=/usr/share/keyrings/nginx_signing.key] https://nginx.org/packages/debian/ {{ ansible_distribution_release }} nginx
|
||||
{% elif nginx_version == "mainline" %}
|
||||
deb [arch=amd64] https://nginx.org/packages/mainline/ubuntu/ {{ ansible_distribution_release }} nginx
|
||||
{% endif %}
|
||||
|
||||
{% elif ansible_distribution == 'Debian' %}
|
||||
|
||||
{% if nginx_version == "stable" %}
|
||||
deb [arch=amd64] https://nginx.org/packages/debian/ {{ ansible_distribution_release }} nginx
|
||||
{% elif nginx_version == "mainline" %}
|
||||
deb [arch=amd64] https://nginx.org/packages/mainline/debian/ {{ ansible_distribution_release }} nginx
|
||||
{% endif %}
|
||||
|
||||
deb [arch=amd64 signed-by=/usr/share/keyrings/nginx_signing.key] https://nginx.org/packages/mainline/debian/ {{ ansible_distribution_release }} nginx
|
||||
{% endif %}
|
||||
|
||||
@@ -4,9 +4,16 @@
|
||||
{% set domain_name = item.domain_name %}
|
||||
{% set domain_aliases = item.domain_aliases | default("") %}
|
||||
{# assume optional features are off unless a vhost explicitly sets them #}
|
||||
{% set enable_hsts = item.enable_hsts | default(False) %}
|
||||
{% set has_wordpress = item.has_wordpress | default(False) %}
|
||||
{% set needs_php = item.needs_php | default(False) %}
|
||||
{% set enable_hsts = item.enable_hsts | default(false) %}
|
||||
{% set has_wordpress = item.has_wordpress | default(false) %}
|
||||
{% set needs_php = item.needs_php | default(false) %}
|
||||
{% set has_gitea = item.has_gitea | default(false) %}
|
||||
{# Allow sites to override the document root #}
|
||||
{% if item.document_root is defined %}
|
||||
{% set document_root = item.document_root %}
|
||||
{% else %}
|
||||
{% set document_root = (nginx_root_prefix, domain_name) | ansible.builtin.path_join %}
|
||||
{% endif %}
|
||||
|
||||
# http -> https vhost
|
||||
server {
|
||||
@@ -25,36 +32,36 @@ server {
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
http2 on;
|
||||
|
||||
{# Allow sites to override the nginx document root #}
|
||||
{% if item.document_root is defined %}
|
||||
root {{ item.document_root }};
|
||||
{% else %}
|
||||
root {{ nginx_root_prefix }}/{{ domain_name }};
|
||||
{% endif %}
|
||||
root {{ document_root }};
|
||||
|
||||
{# will only work if the TLS cert covers the domain + aliases, like example.com and www.example.com #}
|
||||
server_name {{ domain_name }} {{ domain_aliases }};
|
||||
|
||||
index {% if has_wordpress == True or needs_php == True %}index.php{% else %}index.html{% endif %};
|
||||
index {% if has_wordpress == true or needs_php == true %}index.php{% else %}index.html{% endif %};
|
||||
|
||||
access_log /var/log/nginx/{{ domain_name }}-access.log;
|
||||
error_log /var/log/nginx/{{ domain_name }}-error.log;
|
||||
|
||||
{% include 'https.j2' %}
|
||||
|
||||
{% if has_wordpress == True %}
|
||||
{% if has_wordpress == true %}
|
||||
{% include 'wordpress.j2' %}
|
||||
{% endif %}
|
||||
|
||||
{% if has_gitea == true %}
|
||||
{% include 'gitea.j2' %}
|
||||
{% endif %}
|
||||
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location = /50x.html {
|
||||
root /usr/share/nginx/html;
|
||||
}
|
||||
|
||||
{% if has_wordpress == True or needs_php == True %}
|
||||
{% if has_wordpress == true or needs_php == true %}
|
||||
location ~ [^/]\.php(/|$) {
|
||||
# Zero-day exploit defense.
|
||||
# http://forum.nginx.org/read.php?2,88845,page=3
|
||||
@@ -70,17 +77,8 @@ server {
|
||||
# See: https://httpoxy.org/
|
||||
fastcgi_param HTTP_PROXY "";
|
||||
|
||||
{# As of Ubuntu 16.04 and Debian 9, the PHP-FPM configs are the same #}
|
||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('16.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('9', '==')) %}
|
||||
fastcgi_pass unix:/run/php/php7.0-fpm-{{ domain_name }}.sock;
|
||||
{% elif ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==') %}
|
||||
fastcgi_pass unix:/run/php/php7.2-fpm-{{ domain_name }}.sock;
|
||||
{% elif ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==') %}
|
||||
fastcgi_pass unix:/run/php/php7.3-fpm-{{ domain_name }}.sock;
|
||||
{% elif ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==') %}
|
||||
fastcgi_pass unix:/run/php/php7.4-fpm-{{ domain_name }}.sock;
|
||||
{% else %}
|
||||
fastcgi_pass unix:/var/run/php5-fpm-{{ domain_name }}.sock;
|
||||
{% if ansible_distribution_major_version is version('12', '==') %}
|
||||
fastcgi_pass unix:/run/php/php8.2-fpm-{{ domain_name }}.sock;
|
||||
{% endif %}
|
||||
fastcgi_index index.php;
|
||||
# set script path relative to document root in server block
|
||||
@@ -94,7 +92,7 @@ server {
|
||||
fastcgi_cache_bypass $http_pragma $wordpress_logged_in;
|
||||
fastcgi_no_cache $http_pragma $wordpress_logged_in;
|
||||
|
||||
{% if enable_hsts == True %}
|
||||
{% if enable_hsts == true %}
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
@@ -108,7 +106,7 @@ server {
|
||||
include extra-security.conf;
|
||||
}
|
||||
|
||||
{% if has_wordpress == True %}
|
||||
{% if has_wordpress == true %}
|
||||
# Check if a user is logged in
|
||||
# if so, set $wordpress_logged_in = 1
|
||||
# otherwise, set $wordpress_logged_in = 0
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?$args;
|
||||
|
||||
{% if enable_hsts == True %}
|
||||
{% if enable_hsts == true %}
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
@@ -16,7 +16,7 @@
|
||||
location ~* \.(?:ico|css|js|gif|jpe?g|png|svg)$ {
|
||||
add_header Cache-Control "max-age=604800";
|
||||
|
||||
{% if enable_hsts == True %}
|
||||
{% if enable_hsts == true %}
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
---
|
||||
# For Ubuntu 18.04
|
||||
- name: reload php7.2-fpm
|
||||
systemd: name=php7.2-fpm state=reloaded
|
||||
|
||||
# For Debian 10
|
||||
- name: reload php7.3-fpm
|
||||
systemd: name=php7.3-fpm state=reloaded
|
||||
|
||||
# For Ubuntu 20.04
|
||||
- name: reload php7.4-fpm
|
||||
systemd: name=php7.4-fpm state=reloaded
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Set php-fpm packages
|
||||
set_fact:
|
||||
php_fpm_packages:
|
||||
- php-fpm
|
||||
# for WordPress
|
||||
- php-mysql
|
||||
- php-gd
|
||||
- php-curl
|
||||
|
||||
- name: Install php-fpm and deps
|
||||
apt: name={{ php_fpm_packages }} state=present update_cache=yes
|
||||
|
||||
# only copy php-fpm config for vhosts that need WordPress or PHP
|
||||
- name: Copy php-fpm pool config
|
||||
template: src=php7.3-pool.conf.j2 dest=/etc/php/7.3/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
notify: reload php7.3-fpm
|
||||
|
||||
- name: Remove default www pool
|
||||
file: path=/etc/php/7.3/fpm/pool.d/www.conf state=absent
|
||||
notify: reload php7.3-fpm
|
||||
|
||||
# re-configure php.ini
|
||||
- name: Update php.ini
|
||||
template: src=php7.3-php.ini.j2 dest=/etc/php/7.3/fpm/php.ini owner=root group=root mode=0644
|
||||
notify: reload php7.3-fpm
|
||||
tags: php-fpm
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Set php-fpm packages
|
||||
set_fact:
|
||||
php_fpm_packages:
|
||||
- php-fpm
|
||||
# for WordPress
|
||||
- php-mysql
|
||||
- php-gd
|
||||
- php-curl
|
||||
|
||||
- name: Install php-fpm and deps
|
||||
apt: name={{ php_fpm_packages }} state=present update_cache=yes
|
||||
|
||||
# only copy php-fpm config for vhosts that need WordPress or PHP
|
||||
- name: Copy php-fpm pool config
|
||||
template: src=php7.2-pool.conf.j2 dest=/etc/php/7.2/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
notify: reload php7.2-fpm
|
||||
|
||||
- name: Remove default www pool
|
||||
file: path=/etc/php/7.2/fpm/pool.d/www.conf state=absent
|
||||
notify: reload php7.2-fpm
|
||||
|
||||
# re-configure php.ini
|
||||
- name: Update php.ini
|
||||
template: src=php7.2-php.ini.j2 dest=/etc/php/7.2/fpm/php.ini owner=root group=root mode=0644
|
||||
notify: reload php7.2-fpm
|
||||
tags: php-fpm
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Set php-fpm packages
|
||||
set_fact:
|
||||
php_fpm_packages:
|
||||
- php-fpm
|
||||
# for WordPress
|
||||
- php-mysql
|
||||
- php-gd
|
||||
- php-curl
|
||||
|
||||
- name: Install php-fpm and deps
|
||||
apt: name={{ php_fpm_packages }} state=present update_cache=yes
|
||||
|
||||
# only copy php-fpm config for vhosts that need WordPress or PHP
|
||||
- name: Copy php-fpm pool config
|
||||
template: src=php7.4-pool.conf.j2 dest=/etc/php/7.4/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
notify: reload php7.4-fpm
|
||||
|
||||
- name: Remove default www pool
|
||||
file: path=/etc/php/7.4/fpm/pool.d/www.conf state=absent
|
||||
notify: reload php7.4-fpm
|
||||
|
||||
# re-configure php.ini
|
||||
- name: Update php.ini
|
||||
template: src=php7.4-php.ini.j2 dest=/etc/php/7.4/fpm/php.ini owner=root group=root mode=0644
|
||||
notify: reload php7.4-fpm
|
||||
tags: php-fpm
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user