roles/common: Add firewall task for Alpine

roles/common: Add TODO about tarsnap on Alpine
roles/common: Add Alpine packages
2021-02-13 12:18:58 +02:00 · 2021-02-13 12:18:58 +02:00 · 2021-02-13 12:18:58 +02:00 · 2021-02-13 12:18:58 +02:00 · 2021-02-13 12:18:58 +02:00
71 changed files with 9312 additions and 20336 deletions
--- a/Pipfile.lock
+++ b/Pipfile.lock
@ -18,166 +18,153 @@
    "default": {
        "ansible": {
            "hashes": [
-                "sha256:cc5352b2351a381015ece79eab783a1b0668f97b377810fed3c746e2f1d50db1"
+                "sha256:ae97002e4fb1ed3de947428ff43906c76c66751fe104721cf6b25fa115dbbe8d"
            ],
            "index": "pypi",
-            "version": "==4.5.0"
+            "version": "==2.10.6"
        },
-        "ansible-core": {
+        "ansible-base": {
            "hashes": [
-                "sha256:22eaa7c2dfe6c875e9ae380323f1cba6259c6050a5e4c8819f85f92b3683ea49"
+                "sha256:33ae323923b841f3d822f355380ce7c92610440362efeed67b4b39db41e555af"
            ],
            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
-            "version": "==2.11.4"
+            "version": "==2.10.5"
        },
        "cffi": {
            "hashes": [
-                "sha256:06c54a68935738d206570b20da5ef2b6b6d92b38ef3ec45c5422c0ebaf338d4d",
-                "sha256:0c0591bee64e438883b0c92a7bed78f6290d40bf02e54c5bf0978eaf36061771",
-                "sha256:19ca0dbdeda3b2615421d54bef8985f72af6e0c47082a8d26122adac81a95872",
-                "sha256:22b9c3c320171c108e903d61a3723b51e37aaa8c81255b5e7ce102775bd01e2c",
-                "sha256:26bb2549b72708c833f5abe62b756176022a7b9a7f689b571e74c8478ead51dc",
-                "sha256:33791e8a2dc2953f28b8d8d300dde42dd929ac28f974c4b4c6272cb2955cb762",
-                "sha256:3c8d896becff2fa653dc4438b54a5a25a971d1f4110b32bd3068db3722c80202",
-                "sha256:4373612d59c404baeb7cbd788a18b2b2a8331abcc84c3ba40051fcd18b17a4d5",
-                "sha256:487d63e1454627c8e47dd230025780e91869cfba4c753a74fda196a1f6ad6548",
-                "sha256:48916e459c54c4a70e52745639f1db524542140433599e13911b2f329834276a",
-                "sha256:4922cd707b25e623b902c86188aca466d3620892db76c0bdd7b99a3d5e61d35f",
-                "sha256:55af55e32ae468e9946f741a5d51f9896da6b9bf0bbdd326843fec05c730eb20",
-                "sha256:57e555a9feb4a8460415f1aac331a2dc833b1115284f7ded7278b54afc5bd218",
-                "sha256:5d4b68e216fc65e9fe4f524c177b54964af043dde734807586cf5435af84045c",
-                "sha256:64fda793737bc4037521d4899be780534b9aea552eb673b9833b01f945904c2e",
-                "sha256:6d6169cb3c6c2ad50db5b868db6491a790300ade1ed5d1da29289d73bbe40b56",
-                "sha256:7bcac9a2b4fdbed2c16fa5681356d7121ecabf041f18d97ed5b8e0dd38a80224",
-                "sha256:80b06212075346b5546b0417b9f2bf467fea3bfe7352f781ffc05a8ab24ba14a",
-                "sha256:818014c754cd3dba7229c0f5884396264d51ffb87ec86e927ef0be140bfdb0d2",
-                "sha256:8eb687582ed7cd8c4bdbff3df6c0da443eb89c3c72e6e5dcdd9c81729712791a",
-                "sha256:99f27fefe34c37ba9875f224a8f36e31d744d8083e00f520f133cab79ad5e819",
-                "sha256:9f3e33c28cd39d1b655ed1ba7247133b6f7fc16fa16887b120c0c670e35ce346",
-                "sha256:a8661b2ce9694ca01c529bfa204dbb144b275a31685a075ce123f12331be790b",
-                "sha256:a9da7010cec5a12193d1af9872a00888f396aba3dc79186604a09ea3ee7c029e",
-                "sha256:aedb15f0a5a5949ecb129a82b72b19df97bbbca024081ed2ef88bd5c0a610534",
-                "sha256:b315d709717a99f4b27b59b021e6207c64620790ca3e0bde636a6c7f14618abb",
-                "sha256:ba6f2b3f452e150945d58f4badd92310449876c4c954836cfb1803bdd7b422f0",
-                "sha256:c33d18eb6e6bc36f09d793c0dc58b0211fccc6ae5149b808da4a62660678b156",
-                "sha256:c9a875ce9d7fe32887784274dd533c57909b7b1dcadcc128a2ac21331a9765dd",
-                "sha256:c9e005e9bd57bc987764c32a1bee4364c44fdc11a3cc20a40b93b444984f2b87",
-                "sha256:d2ad4d668a5c0645d281dcd17aff2be3212bc109b33814bbb15c4939f44181cc",
-                "sha256:d950695ae4381ecd856bcaf2b1e866720e4ab9a1498cba61c602e56630ca7195",
-                "sha256:e22dcb48709fc51a7b58a927391b23ab37eb3737a98ac4338e2448bef8559b33",
-                "sha256:e8c6a99be100371dbb046880e7a282152aa5d6127ae01783e37662ef73850d8f",
-                "sha256:e9dc245e3ac69c92ee4c167fbdd7428ec1956d4e754223124991ef29eb57a09d",
-                "sha256:eb687a11f0a7a1839719edd80f41e459cc5366857ecbed383ff376c4e3cc6afd",
-                "sha256:eb9e2a346c5238a30a746893f23a9535e700f8192a68c07c0258e7ece6ff3728",
-                "sha256:ed38b924ce794e505647f7c331b22a693bee1538fdf46b0222c4717b42f744e7",
-                "sha256:f0010c6f9d1a4011e429109fda55a225921e3206e7f62a0c22a35344bfd13cca",
-                "sha256:f0c5d1acbfca6ebdd6b1e3eded8d261affb6ddcf2186205518f1428b8569bb99",
-                "sha256:f10afb1004f102c7868ebfe91c28f4a712227fe4cb24974350ace1f90e1febbf",
-                "sha256:f174135f5609428cc6e1b9090f9268f5c8935fddb1b25ccb8255a2d50de6789e",
-                "sha256:f3ebe6e73c319340830a9b2825d32eb6d8475c1dac020b4f0aa774ee3b898d1c",
-                "sha256:f627688813d0a4140153ff532537fbe4afea5a3dffce1f9deb7f91f848a832b5",
-                "sha256:fd4305f86f53dfd8cd3522269ed7fc34856a8ee3709a5e28b2836b2db9d4cd69"
+                "sha256:00a1ba5e2e95684448de9b89888ccd02c98d512064b4cb987d48f4b40aa0421e",
+                "sha256:00e28066507bfc3fe865a31f325c8391a1ac2916219340f87dfad602c3e48e5d",
+                "sha256:045d792900a75e8b1e1b0ab6787dd733a8190ffcf80e8c8ceb2fb10a29ff238a",
+                "sha256:0638c3ae1a0edfb77c6765d487fee624d2b1ee1bdfeffc1f0b58c64d149e7eec",
+                "sha256:105abaf8a6075dc96c1fe5ae7aae073f4696f2905fde6aeada4c9d2926752362",
+                "sha256:155136b51fd733fa94e1c2ea5211dcd4c8879869008fc811648f16541bf99668",
+                "sha256:1a465cbe98a7fd391d47dce4b8f7e5b921e6cd805ef421d04f5f66ba8f06086c",
+                "sha256:1d2c4994f515e5b485fd6d3a73d05526aa0fcf248eb135996b088d25dfa1865b",
+                "sha256:2c24d61263f511551f740d1a065eb0212db1dbbbbd241db758f5244281590c06",
+                "sha256:51a8b381b16ddd370178a65360ebe15fbc1c71cf6f584613a7ea08bfad946698",
+                "sha256:594234691ac0e9b770aee9fcdb8fa02c22e43e5c619456efd0d6c2bf276f3eb2",
+                "sha256:5cf4be6c304ad0b6602f5c4e90e2f59b47653ac1ed9c662ed379fe48a8f26b0c",
+                "sha256:64081b3f8f6f3c3de6191ec89d7dc6c86a8a43911f7ecb422c60e90c70be41c7",
+                "sha256:6bc25fc545a6b3d57b5f8618e59fc13d3a3a68431e8ca5fd4c13241cd70d0009",
+                "sha256:798caa2a2384b1cbe8a2a139d80734c9db54f9cc155c99d7cc92441a23871c03",
+                "sha256:7c6b1dece89874d9541fc974917b631406233ea0440d0bdfbb8e03bf39a49b3b",
+                "sha256:7ef7d4ced6b325e92eb4d3502946c78c5367bc416398d387b39591532536734e",
+                "sha256:840793c68105fe031f34d6a086eaea153a0cd5c491cde82a74b420edd0a2b909",
+                "sha256:8d6603078baf4e11edc4168a514c5ce5b3ba6e3e9c374298cb88437957960a53",
+                "sha256:9cc46bc107224ff5b6d04369e7c595acb700c3613ad7bcf2e2012f62ece80c35",
+                "sha256:9f7a31251289b2ab6d4012f6e83e58bc3b96bd151f5b5262467f4bb6b34a7c26",
+                "sha256:9ffb888f19d54a4d4dfd4b3f29bc2c16aa4972f1c2ab9c4ab09b8ab8685b9c2b",
+                "sha256:a5ed8c05548b54b998b9498753fb9cadbfd92ee88e884641377d8a8b291bcc01",
+                "sha256:a7711edca4dcef1a75257b50a2fbfe92a65187c47dab5a0f1b9b332c5919a3fb",
+                "sha256:af5c59122a011049aad5dd87424b8e65a80e4a6477419c0c1015f73fb5ea0293",
+                "sha256:b18e0a9ef57d2b41f5c68beefa32317d286c3d6ac0484efd10d6e07491bb95dd",
+                "sha256:b4e248d1087abf9f4c10f3c398896c87ce82a9856494a7155823eb45a892395d",
+                "sha256:ba4e9e0ae13fc41c6b23299545e5ef73055213e466bd107953e4a013a5ddd7e3",
+                "sha256:c6332685306b6417a91b1ff9fae889b3ba65c2292d64bd9245c093b1b284809d",
+                "sha256:d5ff0621c88ce83a28a10d2ce719b2ee85635e85c515f12bac99a95306da4b2e",
+                "sha256:d9efd8b7a3ef378dd61a1e77367f1924375befc2eba06168b6ebfa903a5e59ca",
+                "sha256:df5169c4396adc04f9b0a05f13c074df878b6052430e03f50e68adf3a57aa28d",
+                "sha256:ebb253464a5d0482b191274f1c8bf00e33f7e0b9c66405fbffc61ed2c839c775",
+                "sha256:ec80dc47f54e6e9a78181ce05feb71a0353854cc26999db963695f950b5fb375",
+                "sha256:f032b34669220030f905152045dfa27741ce1a6db3324a5bc0b96b6c7420c87b",
+                "sha256:f60567825f791c6f8a592f3c6e3bd93dd2934e3f9dac189308426bd76b00ef3b",
+                "sha256:f803eaa94c2fcda012c047e62bc7a51b0bdabda1cad7a92a522694ea2d76e49f"
            ],
-            "version": "==1.14.6"
+            "version": "==1.14.4"
        },
        "cryptography": {
            "hashes": [
-                "sha256:0a7dcbcd3f1913f664aca35d47c1331fce738d44ec34b7be8b9d332151b0b01e",
-                "sha256:1eb7bb0df6f6f583dd8e054689def236255161ebbcf62b226454ab9ec663746b",
-                "sha256:21ca464b3a4b8d8e86ba0ee5045e103a1fcfac3b39319727bc0fc58c09c6aff7",
-                "sha256:34dae04a0dce5730d8eb7894eab617d8a70d0c97da76b905de9efb7128ad7085",
-                "sha256:3520667fda779eb788ea00080124875be18f2d8f0848ec00733c0ec3bb8219fc",
-                "sha256:3fa3a7ccf96e826affdf1a0a9432be74dc73423125c8f96a909e3835a5ef194a",
-                "sha256:5b0fbfae7ff7febdb74b574055c7466da334a5371f253732d7e2e7525d570498",
-                "sha256:8695456444f277af73a4877db9fc979849cd3ee74c198d04fc0776ebc3db52b9",
-                "sha256:94cc5ed4ceaefcbe5bf38c8fba6a21fc1d365bb8fb826ea1688e3370b2e24a1c",
-                "sha256:94fff993ee9bc1b2440d3b7243d488c6a3d9724cc2b09cdb297f6a886d040ef7",
-                "sha256:9965c46c674ba8cc572bc09a03f4c649292ee73e1b683adb1ce81e82e9a6a0fb",
-                "sha256:a00cf305f07b26c351d8d4e1af84ad7501eca8a342dedf24a7acb0e7b7406e14",
-                "sha256:a305600e7a6b7b855cd798e00278161b681ad6e9b7eca94c721d5f588ab212af",
-                "sha256:cd65b60cfe004790c795cc35f272e41a3df4631e2fb6b35aa7ac6ef2859d554e",
-                "sha256:d2a6e5ef66503da51d2110edf6c403dc6b494cc0082f85db12f54e9c5d4c3ec5",
-                "sha256:d9ec0e67a14f9d1d48dd87a2531009a9b251c02ea42851c060b25c782516ff06",
-                "sha256:f44d141b8c4ea5eb4dbc9b3ad992d45580c1d22bf5e24363f2fbf50c2d7ae8a7"
+                "sha256:0003a52a123602e1acee177dc90dd201f9bb1e73f24a070db7d36c588e8f5c7d",
+                "sha256:0e85aaae861d0485eb5a79d33226dd6248d2a9f133b81532c8f5aae37de10ff7",
+                "sha256:594a1db4511bc4d960571536abe21b4e5c3003e8750ab8365fafce71c5d86901",
+                "sha256:69e836c9e5ff4373ce6d3ab311c1a2eed274793083858d3cd4c7d12ce20d5f9c",
+                "sha256:788a3c9942df5e4371c199d10383f44a105d67d401fb4304178020142f020244",
+                "sha256:7e177e4bea2de937a584b13645cab32f25e3d96fc0bc4a4cf99c27dc77682be6",
+                "sha256:83d9d2dfec70364a74f4e7c70ad04d3ca2e6a08b703606993407bf46b97868c5",
+                "sha256:84ef7a0c10c24a7773163f917f1cb6b4444597efd505a8aed0a22e8c4780f27e",
+                "sha256:9e21301f7a1e7c03dbea73e8602905a4ebba641547a462b26dd03451e5769e7c",
+                "sha256:9f6b0492d111b43de5f70052e24c1f0951cb9e6022188ebcb1cc3a3d301469b0",
+                "sha256:a69bd3c68b98298f490e84519b954335154917eaab52cf582fa2c5c7efc6e812",
+                "sha256:b4890d5fb9b7a23e3bf8abf5a8a7da8e228f1e97dc96b30b95685df840b6914a",
+                "sha256:c366df0401d1ec4e548bebe8f91d55ebcc0ec3137900d214dd7aac8427ef3030",
+                "sha256:dc42f645f8f3a489c3dd416730a514e7a91a59510ddaadc09d04224c098d3302"
            ],
-            "markers": "python_version >= '3.6'",
-            "version": "==3.4.8"
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
+            "version": "==3.3.1"
        },
        "jinja2": {
            "hashes": [
-                "sha256:1f06f2da51e7b56b8f238affdd6b4e2c61e39598a378cc49345bc1bd42a978a4",
-                "sha256:703f484b47a6af502e743c9122595cc812b0271f661722403114f71a79d0f5a4"
+                "sha256:03e47ad063331dd6a3f04a43eddca8a966a26ba0c5b7207a9a9e4e08f1b29419",
+                "sha256:a6d58433de0ae800347cab1fa3043cebbabe8baa9d29e668f1c768cb87a333c6"
            ],
-            "markers": "python_version >= '3.6'",
-            "version": "==3.0.1"
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
+            "version": "==2.11.3"
        },
        "markupsafe": {
            "hashes": [
-                "sha256:01a9b8ea66f1658938f65b93a85ebe8bc016e6769611be228d797c9d998dd298",
-                "sha256:023cb26ec21ece8dc3907c0e8320058b2e0cb3c55cf9564da612bc325bed5e64",
-                "sha256:0446679737af14f45767963a1a9ef7620189912317d095f2d9ffa183a4d25d2b",
-                "sha256:0717a7390a68be14b8c793ba258e075c6f4ca819f15edfc2a3a027c823718567",
-                "sha256:0955295dd5eec6cb6cc2fe1698f4c6d84af2e92de33fbcac4111913cd100a6ff",
-                "sha256:0d4b31cc67ab36e3392bbf3862cfbadac3db12bdd8b02a2731f509ed5b829724",
-                "sha256:10f82115e21dc0dfec9ab5c0223652f7197feb168c940f3ef61563fc2d6beb74",
-                "sha256:168cd0a3642de83558a5153c8bd34f175a9a6e7f6dc6384b9655d2697312a646",
-                "sha256:1d609f577dc6e1aa17d746f8bd3c31aa4d258f4070d61b2aa5c4166c1539de35",
-                "sha256:1f2ade76b9903f39aa442b4aadd2177decb66525062db244b35d71d0ee8599b6",
-                "sha256:2a7d351cbd8cfeb19ca00de495e224dea7e7d919659c2841bbb7f420ad03e2d6",
-                "sha256:2d7d807855b419fc2ed3e631034685db6079889a1f01d5d9dac950f764da3dad",
-                "sha256:2ef54abee730b502252bcdf31b10dacb0a416229b72c18b19e24a4509f273d26",
-                "sha256:36bc903cbb393720fad60fc28c10de6acf10dc6cc883f3e24ee4012371399a38",
-                "sha256:37205cac2a79194e3750b0af2a5720d95f786a55ce7df90c3af697bfa100eaac",
-                "sha256:3c112550557578c26af18a1ccc9e090bfe03832ae994343cfdacd287db6a6ae7",
-                "sha256:3dd007d54ee88b46be476e293f48c85048603f5f516008bee124ddd891398ed6",
-                "sha256:47ab1e7b91c098ab893b828deafa1203de86d0bc6ab587b160f78fe6c4011f75",
-                "sha256:49e3ceeabbfb9d66c3aef5af3a60cc43b85c33df25ce03d0031a608b0a8b2e3f",
-                "sha256:4efca8f86c54b22348a5467704e3fec767b2db12fc39c6d963168ab1d3fc9135",
-                "sha256:53edb4da6925ad13c07b6d26c2a852bd81e364f95301c66e930ab2aef5b5ddd8",
-                "sha256:5855f8438a7d1d458206a2466bf82b0f104a3724bf96a1c781ab731e4201731a",
-                "sha256:594c67807fb16238b30c44bdf74f36c02cdf22d1c8cda91ef8a0ed8dabf5620a",
-                "sha256:5bb28c636d87e840583ee3adeb78172efc47c8b26127267f54a9c0ec251d41a9",
-                "sha256:60bf42e36abfaf9aff1f50f52644b336d4f0a3fd6d8a60ca0d054ac9f713a864",
-                "sha256:611d1ad9a4288cf3e3c16014564df047fe08410e628f89805e475368bd304914",
-                "sha256:6557b31b5e2c9ddf0de32a691f2312a32f77cd7681d8af66c2692efdbef84c18",
-                "sha256:693ce3f9e70a6cf7d2fb9e6c9d8b204b6b39897a2c4a1aa65728d5ac97dcc1d8",
-                "sha256:6a7fae0dd14cf60ad5ff42baa2e95727c3d81ded453457771d02b7d2b3f9c0c2",
-                "sha256:6c4ca60fa24e85fe25b912b01e62cb969d69a23a5d5867682dd3e80b5b02581d",
-                "sha256:6fcf051089389abe060c9cd7caa212c707e58153afa2c649f00346ce6d260f1b",
-                "sha256:7d91275b0245b1da4d4cfa07e0faedd5b0812efc15b702576d103293e252af1b",
-                "sha256:905fec760bd2fa1388bb5b489ee8ee5f7291d692638ea5f67982d968366bef9f",
-                "sha256:97383d78eb34da7e1fa37dd273c20ad4320929af65d156e35a5e2d89566d9dfb",
-                "sha256:984d76483eb32f1bcb536dc27e4ad56bba4baa70be32fa87152832cdd9db0833",
-                "sha256:99df47edb6bda1249d3e80fdabb1dab8c08ef3975f69aed437cb69d0a5de1e28",
-                "sha256:a30e67a65b53ea0a5e62fe23682cfe22712e01f453b95233b25502f7c61cb415",
-                "sha256:ab3ef638ace319fa26553db0624c4699e31a28bb2a835c5faca8f8acf6a5a902",
-                "sha256:add36cb2dbb8b736611303cd3bfcee00afd96471b09cda130da3581cbdc56a6d",
-                "sha256:b2f4bf27480f5e5e8ce285a8c8fd176c0b03e93dcc6646477d4630e83440c6a9",
-                "sha256:b7f2d075102dc8c794cbde1947378051c4e5180d52d276987b8d28a3bd58c17d",
-                "sha256:baa1a4e8f868845af802979fcdbf0bb11f94f1cb7ced4c4b8a351bb60d108145",
-                "sha256:be98f628055368795d818ebf93da628541e10b75b41c559fdf36d104c5787066",
-                "sha256:bf5d821ffabf0ef3533c39c518f3357b171a1651c1ff6827325e4489b0e46c3c",
-                "sha256:c47adbc92fc1bb2b3274c4b3a43ae0e4573d9fbff4f54cd484555edbf030baf1",
-                "sha256:d7f9850398e85aba693bb640262d3611788b1f29a79f0c93c565694658f4071f",
-                "sha256:d8446c54dc28c01e5a2dbac5a25f071f6653e6e40f3a8818e8b45d790fe6ef53",
-                "sha256:e0f138900af21926a02425cf736db95be9f4af72ba1bb21453432a07f6082134",
-                "sha256:e9936f0b261d4df76ad22f8fee3ae83b60d7c3e871292cd42f40b81b70afae85",
-                "sha256:f5653a225f31e113b152e56f154ccbe59eeb1c7487b39b9d9f9cdb58e6c79dc5",
-                "sha256:f826e31d18b516f653fe296d967d700fddad5901ae07c622bb3705955e1faa94",
-                "sha256:f8ba0e8349a38d3001fae7eadded3f6606f0da5d748ee53cc1dab1d6527b9509",
-                "sha256:f9081981fe268bd86831e5c75f7de206ef275defcb82bc70740ae6dc507aee51",
-                "sha256:fa130dd50c57d53368c9d59395cb5526eda596d3ffe36666cd81a44d56e48872"
+                "sha256:00bc623926325b26bb9605ae9eae8a215691f33cae5df11ca5424f06f2d1f473",
+                "sha256:09027a7803a62ca78792ad89403b1b7a73a01c8cb65909cd876f7fcebd79b161",
+                "sha256:09c4b7f37d6c648cb13f9230d847adf22f8171b1ccc4d5682398e77f40309235",
+                "sha256:1027c282dad077d0bae18be6794e6b6b8c91d58ed8a8d89a89d59693b9131db5",
+                "sha256:13d3144e1e340870b25e7b10b98d779608c02016d5184cfb9927a9f10c689f42",
+                "sha256:195d7d2c4fbb0ee8139a6cf67194f3973a6b3042d742ebe0a9ed36d8b6f0c07f",
+                "sha256:22c178a091fc6630d0d045bdb5992d2dfe14e3259760e713c490da5323866c39",
+                "sha256:24982cc2533820871eba85ba648cd53d8623687ff11cbb805be4ff7b4c971aff",
+                "sha256:29872e92839765e546828bb7754a68c418d927cd064fd4708fab9fe9c8bb116b",
+                "sha256:2beec1e0de6924ea551859edb9e7679da6e4870d32cb766240ce17e0a0ba2014",
+                "sha256:3b8a6499709d29c2e2399569d96719a1b21dcd94410a586a18526b143ec8470f",
+                "sha256:43a55c2930bbc139570ac2452adf3d70cdbb3cfe5912c71cdce1c2c6bbd9c5d1",
+                "sha256:46c99d2de99945ec5cb54f23c8cd5689f6d7177305ebff350a58ce5f8de1669e",
+                "sha256:500d4957e52ddc3351cabf489e79c91c17f6e0899158447047588650b5e69183",
+                "sha256:535f6fc4d397c1563d08b88e485c3496cf5784e927af890fb3c3aac7f933ec66",
+                "sha256:596510de112c685489095da617b5bcbbac7dd6384aeebeda4df6025d0256a81b",
+                "sha256:62fe6c95e3ec8a7fad637b7f3d372c15ec1caa01ab47926cfdf7a75b40e0eac1",
+                "sha256:6788b695d50a51edb699cb55e35487e430fa21f1ed838122d722e0ff0ac5ba15",
+                "sha256:6dd73240d2af64df90aa7c4e7481e23825ea70af4b4922f8ede5b9e35f78a3b1",
+                "sha256:6f1e273a344928347c1290119b493a1f0303c52f5a5eae5f16d74f48c15d4a85",
+                "sha256:6fffc775d90dcc9aed1b89219549b329a9250d918fd0b8fa8d93d154918422e1",
+                "sha256:717ba8fe3ae9cc0006d7c451f0bb265ee07739daf76355d06366154ee68d221e",
+                "sha256:79855e1c5b8da654cf486b830bd42c06e8780cea587384cf6545b7d9ac013a0b",
+                "sha256:7c1699dfe0cf8ff607dbdcc1e9b9af1755371f92a68f706051cc8c37d447c905",
+                "sha256:7fed13866cf14bba33e7176717346713881f56d9d2bcebab207f7a036f41b850",
+                "sha256:84dee80c15f1b560d55bcfe6d47b27d070b4681c699c572af2e3c7cc90a3b8e0",
+                "sha256:88e5fcfb52ee7b911e8bb6d6aa2fd21fbecc674eadd44118a9cc3863f938e735",
+                "sha256:8defac2f2ccd6805ebf65f5eeb132adcf2ab57aa11fdf4c0dd5169a004710e7d",
+                "sha256:98bae9582248d6cf62321dcb52aaf5d9adf0bad3b40582925ef7c7f0ed85fceb",
+                "sha256:98c7086708b163d425c67c7a91bad6e466bb99d797aa64f965e9d25c12111a5e",
+                "sha256:9add70b36c5666a2ed02b43b335fe19002ee5235efd4b8a89bfcf9005bebac0d",
+                "sha256:9bf40443012702a1d2070043cb6291650a0841ece432556f784f004937f0f32c",
+                "sha256:a6a744282b7718a2a62d2ed9d993cad6f5f585605ad352c11de459f4108df0a1",
+                "sha256:acf08ac40292838b3cbbb06cfe9b2cb9ec78fce8baca31ddb87aaac2e2dc3bc2",
+                "sha256:ade5e387d2ad0d7ebf59146cc00c8044acbd863725f887353a10df825fc8ae21",
+                "sha256:b00c1de48212e4cc9603895652c5c410df699856a2853135b3967591e4beebc2",
+                "sha256:b1282f8c00509d99fef04d8ba936b156d419be841854fe901d8ae224c59f0be5",
+                "sha256:b1dba4527182c95a0db8b6060cc98ac49b9e2f5e64320e2b56e47cb2831978c7",
+                "sha256:b2051432115498d3562c084a49bba65d97cf251f5a331c64a12ee7e04dacc51b",
+                "sha256:b7d644ddb4dbd407d31ffb699f1d140bc35478da613b441c582aeb7c43838dd8",
+                "sha256:ba59edeaa2fc6114428f1637ffff42da1e311e29382d81b339c1817d37ec93c6",
+                "sha256:bf5aa3cbcfdf57fa2ee9cd1822c862ef23037f5c832ad09cfea57fa846dec193",
+                "sha256:c8716a48d94b06bb3b2524c2b77e055fb313aeb4ea620c8dd03a105574ba704f",
+                "sha256:caabedc8323f1e93231b52fc32bdcde6db817623d33e100708d9a68e1f53b26b",
+                "sha256:cd5df75523866410809ca100dc9681e301e3c27567cf498077e8551b6d20e42f",
+                "sha256:cdb132fc825c38e1aeec2c8aa9338310d29d337bebbd7baa06889d09a60a1fa2",
+                "sha256:d53bc011414228441014aa71dbec320c66468c1030aae3a6e29778a3382d96e5",
+                "sha256:d73a845f227b0bfe8a7455ee623525ee656a9e2e749e4742706d80a6065d5e2c",
+                "sha256:d9be0ba6c527163cbed5e0857c451fcd092ce83947944d6c14bc95441203f032",
+                "sha256:e249096428b3ae81b08327a63a485ad0878de3fb939049038579ac0ef61e17e7",
+                "sha256:e8313f01ba26fbbe36c7be1966a7b7424942f670f38e666995b88d012765b9be",
+                "sha256:feb7b34d6325451ef96bc0e36e1a6c0c1c64bc1fbec4b854f4529e51887b1621"
            ],
-            "markers": "python_version >= '3.6'",
-            "version": "==2.0.1"
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==1.1.1"
        },
        "packaging": {
            "hashes": [
-                "sha256:7dc96269f53a4ccec5c0670940a4281106dd0bb343f47b7471f779df49c2fbe7",
-                "sha256:c86254f9220d55e31cc94d69bade760f0847da8000def4dfe1c6b872fd14ff14"
+                "sha256:5b327ac1320dc863dca72f4514ecc086f31186744b84a230374cc1fd776feae5",
+                "sha256:67714da7f7bc052e064859c05c595155bd1ee9f69f76557e21f051443c20947a"
            ],
-            "markers": "python_version >= '3.6'",
-            "version": "==21.0"
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==20.9"
        },
        "pycparser": {
            "hashes": [
@ -209,33 +196,26 @@
                "sha256:5accb17103e43963b80e6f837831f38d314a0495500067cb25afab2e8d7a4018",
                "sha256:607774cbba28732bfa802b54baa7484215f530991055bb562efbed5b2f20a45e",
                "sha256:6c78645d400265a062508ae399b60b8c167bf003db364ecb26dcab2bda048253",
-                "sha256:72a01f726a9c7851ca9bfad6fd09ca4e090a023c00945ea05ba1638c09dc3347",
                "sha256:74c1485f7707cf707a7aef42ef6322b8f97921bd89be2ab6317fd782c2d53183",
-                "sha256:895f61ef02e8fed38159bb70f7e100e00f471eae2bc838cd0f4ebb21e28f8541",
                "sha256:8c1be557ee92a20f184922c7b6424e8ab6691788e6d86137c5d93c1a6ec1b8fb",
                "sha256:bb4191dfc9306777bc594117aee052446b3fa88737cd13b7188d0e7aa8162185",
-                "sha256:bfb51918d4ff3d77c1c856a9699f8492c612cde32fd3bcd344af9be34999bfdc",
                "sha256:c20cfa2d49991c8b4147af39859b167664f2ad4561704ee74c1de03318e898db",
-                "sha256:cb333c16912324fd5f769fff6bc5de372e9e7a202247b48870bc251ed40239aa",
                "sha256:d2d9808ea7b4af864f35ea216be506ecec180628aced0704e34aca0b040ffe46",
-                "sha256:d483ad4e639292c90170eb6f7783ad19490e7a8defb3e46f97dfe4bacae89122",
                "sha256:dd5de0646207f053eb0d6c74ae45ba98c3395a571a2891858e87df7c9b9bd51b",
                "sha256:e1d4970ea66be07ae37a3c2e48b5ec63f7ba6804bdddfdbd3cfd954d25a82e63",
                "sha256:e4fac90784481d221a8e4b1162afa7c47ed953be40d31ab4629ae917510051df",
-                "sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc",
-                "sha256:fd7f6999a8070df521b6384004ef42833b9bd62cfee11a09bda1079b4b704247",
-                "sha256:fdc842473cd33f45ff6bce46aea678a54e3d21f1b61a7750ce3c498eedfe25d6",
-                "sha256:fe69978f3f768926cfa37b867e3843918e012cf83f680806599ddce33c2c68b0"
+                "sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc"
            ],
            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
            "version": "==5.4.1"
        },
-        "resolvelib": {
+        "six": {
            "hashes": [
-                "sha256:8113ae3ed6d33c6be0bcbf03ffeb06c0995c099b7b8aaa5ddf2e9b3b3df4e915",
-                "sha256:9b9b80d5c60e4c2a8b7fbf0712c3449dc01d74e215632e5199850c9eca687628"
+                "sha256:30639c035cdb23534cd4aa2dd52c3bf48f06e5f4a941509c8bafd8ce11080259",
+                "sha256:8b74bedcbbbaca38ff6d7491d76f2b06b3592611af620f8426e82dddb04a5ced"
            ],
-            "version": "==0.5.4"
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==1.15.0"
        }
    },
    "develop": {}
--- a/README.md
+++ b/README.md
@ -25,7 +25,7 @@ Once you've satisfied the the above assumptions, you can execute:
 - Switch from `cron-apt` to [`unattended-upgrades`](https://wiki.debian.org/UnattendedUpgrades)

 ## License
-Copyright (C) 2014–2021 Alan Orth
+Copyright (C) 2014–2020 Alan Orth

 The contents of this repository are free software: you can redistribute
 it and/or modify it under the terms of the GNU General Public License
--- a/ansible.cfg
+++ b/ansible.cfg
@ -5,7 +5,6 @@ inventory=hosts
 # instead of using --ask-vault-pass
 ask_vault_pass=True
 remote_user = provisioning
-interpreter_python=auto

 ansible_managed = This file is managed by Ansible.%n
  template: {file}
--- a/group_vars/web
+++ b/group_vars/web
@ -1,8 +0,0 @@
---
-# file: group_vars/web
-
-# all hosts run fail2ban with the sshd filter, but some can use other filters
-extra_fail2ban_filters:
-  - nginx
-
-# vim: set ts=2 sw=2:
--- a/host_vars/nomad01
+++ b/host_vars/nomad01
@ -1,71 +1,87 @@
 $ANSIBLE_VAULT;1.1;AES256
-39303965636262373331663530663562363864636132363362616636346166303835336463326261
-6435316332636438363630386231326231666163626335350a353662623034313766383035636237
-38346531313235613266646665363135393735613836393838313164356561663431333864353237
-6230666363363738370a306432643732626337376638383564323032626465306263643533653561
-63326261323032303466656162303132633933643232656238643936306235316436616237333963
-32633363333636303564383062636463393531326565643732396539386230393434633134306433
-38363130626139616631373336653530343762336165666131303464386561646434363163333034
-65323837313164343238623766373431656462376262393737323166306537353365663163383032
-61393662393433653937313533313537336132663432383634343163653866306232326464626131
-33356630666130376565663666613032333637633061663433623363626632356531313231393136
-64343463396632633061353861613438613537666466613132316265326530343733343535333836
-39376632373137383636623637373639653933623639646266336331353337343166313132613131
-32373632323363616333303863656537613264346439326662383265323731613263396138366161
-62393838376435393036383836646433346365306239666335356265616237336138373632313139
-63613236613166343332363730356262373131646462373561663964343438623863636539633030
-38353430363435616139353165633330396135383939396531333436663533666564653765336330
-39303832633931653461363766616562323865383832663434356534386337386262653730663838
-65623234356134393963376431653965353566303261386533383736316439636536363463633339
-35323939373939386436336233333664313735376439353062306562353435323031346335666334
-36306537643734316131373335613234363135393866333231343533623961333562646333663332
-64643036386237626138633561613966373831326331636437636564616662326563393336636138
-62643034333831333765636532633235653733303838393430363830346436646632373364353832
-33376635336338303230343833313936633832653235353836633932393230376435353739646563
-31653765393631316135366466353162633261386132633433313866363563386563383437623538
-33636134646531383130663038343939333565613736363162366132303535336663646265353138
-32376536623864656531346434383537396563383130386231336431653464326461326531393861
-62356361636434623133383264326433333163633964316262633138633838393234343538316465
-32656534623839343132313662636464333963306138356162623462353933633436333930346430
-33636235303339353236646438666233653736653566356638653538366131646432373338303535
-38643630363231656334623539633235393062656165316266626538663339363538343031323835
-34383865663936383161326664353464393263626262383463616336623662613233656630303037
-35633461643439666233666136626462353838323162653730646632636132323632663666316166
-34373237343931363331653966306535396635306364643135336234366364303062383332376532
-61623337326236623861326433653739613133666538396438643937353730363062626136333034
-35353733633234313965616439326666623936303464323462313037303230346164353366373661
-33613231316461386636383030643862616165623565623337346264656531393232323030306464
-37393065386161383532663862333263626338393832343566383065316434656564613831636535
-30653330393936323733373938353763643431366134636263616535343565656164343931326464
-65653464373231636337313932636238376130323566323637376634626439366635363537623234
-34656466366435666162643237383163303936383061393939356438303765313566343162303038
-37383531326436373336363134663838346463613462333265663363323538663437623830363831
-39333934316634386562333330613831386530633365613939393638373063323830636363356432
-62626562366634636266333737343238363235613366313737383335383264343435623434353838
-63633964333262616439623266643938313466396339343237666239363730393935626466366434
-66333739373662656237386663373465303336343432393735376463643562303431383832313934
-61396134393830303234383162633533336436346334393265363766386638303831613036343163
-33663638323235613465363539373965326430323035656564633830656365663537393233626365
-61646162383439626638633137656639653830366162636532616634313738353166633438346433
-64633037343864343939383865333737366638386331623230303830343636363938366432366265
-37313963633536396433376331663132643435376164393138653738376338623239323966363430
-63346464303162306332303036346362626134363666396130326163613730633966393438316333
-30626365623532636436646138373434343031643131343238353661623636623138346333663866
-62393937376538343135353030653838346239393633343239313137663464353165653961336237
-36646332663539363438343939643335613236666630616636623837386133396262303033333435
-36336566333333393137666533323439303036653362333832346537356663656635356635363761
-62363638316435633563396662323131383736663939633133626131616638653665633963623439
-33343038326339356634366461346132393537613232623334326561366164333862343766386137
-66636437613661616261336232316436353739316463383063363663383230613934663334333538
-39623037646638386263643438623137346137616664396638366436383561313933633039393936
-32383432363363666466363364376631346365373239353339633532666134396138373765643031
-64333061343237616135643439396266616161333537333837643530633136313932623531653163
-36373165393238306264353461383765343938393635633236313565393733306536386464373639
-38386131623133376230653134316536356238336162356331376465613962356231316666643661
-65616138333731313961316463643137373831616266623631376266643864656164356531316238
-34376264373432356162363962353338393362386434313465643533396330386666636430663530
-66396665383431333534383038333163336639613435333039633136366235636638393337613232
-35636336383333376138306630383230383861396164386162323264376234396130323933666437
-38343036656562636130366663663565666530623765353265363833303634643862313634326461
-62643864613762386366633634343964396631356462346665663131623034303133346438613433
-6336623030393661663631303038366630353638613337653365
+37356463383831623061363666396235346361663734326234323239633332383431656534636337
+3238613566336363636235393535373330363562333135630a626531343430396666323139633833
+37656533353537393335393966323637326335666134613633643330313334383237383736623637
+6533343338396536640a376466633436643162393533646464343930346665616165613835373630
+66353037653339633038353033316463393234313630646138636633643066653636343739383730
+65343161306339343931323737336531646131363034343163366137616231363638313330343365
+31663932343436313364326331373733373830646637313733323335306161626135616438656363
+32623333646637633636316139613234613232393462306364633966666639623231643735663266
+35396266313936326532383139346361626532323263633662373139363638303961616638636535
+65343862623865386436643930353834323566356164386432373434336536363262356638313333
+64626633353565303538353634626438363131633164636263643938386538323932346337343730
+31336266343532306531626234323962353930343333656436356436343666336335633233386462
+34623332393734633761303762306336656232326533313131316331326639376338393437363834
+32663766633037316266373064376638643237343434356166613862383963633231353531646432
+36393438653234326330316438333862396163383231623034383963336435393533393263653739
+38373764373034313231373536653233666230333437626431383161346636376434383135393434
+30353361343136663135356536316630643163613930306363343830323932393635343936396535
+38366638353737336637356237646332353438303632396238356364343464323064373031656331
+31346134323965646336666336303835326463656339356131613633336539613234653332353539
+35613362653335663863626532363433663634393036373462663833636333646661643865353533
+39376535313635373434633466643135323762613539366135376536653761303134303964343534
+65333934396638373239646339343732623139303037336133363533653330383261383437393061
+37336334363237333437633664313637366566396232336337303235366337616530333261356662
+39666531653762326364353534623431333530653935316161383535663762636136316239336233
+35373962623934633663656337306439616431316165666563336532373135323566386431303733
+36313264323066653164346338653433393337623666646162383666303930613939396662373965
+38653863623935336632666366373764383136376163663137313234663761343066336235626232
+35303532376537643663653431323830623364623362346437396664386363396632646364666130
+62663265363334383663626661363632646432393463373564396633393235353434636437623261
+30323866636332356136396662363930613961613961343963313733343033616539316131323262
+65666665663731636633623464353430623135373430313065626438396363366335363466316132
+64353730383761386563353133396262366265343637643931643565386461303138613565303239
+37646339316366316431663237653230346464643433376639356462643133643234386131613965
+66333831663832326131343134633231636633373735333634663861393531633738366136356130
+38653534666662303539353534636537343665366231346565376437313037646162663365666630
+33366631653530326234326333623333346535343362666263376561333334633533356264393637
+64633864616430653663366133343962376233656562643335633336326335626664653861323334
+65653864323062616234343636633435396332636635653266353032623637356133383538383034
+36383936666238333366386637313434656332626266346439346566666537623039323936303936
+62353130663632636636623466326663623639313433353766346230383138323461643962666562
+65646234346631613139393265666663663537323236383832373532393662643566636164653364
+39636133613937393433636231626238386463376434666166643662313661663635356436636165
+38333830313638643863373162636530346433613366613437643932383035643464363732663633
+38633065366638656635356462393935383665386532633936366437333233316563366231393935
+32393736343365383164346634326336373436386630386630616436373139646531353038333562
+39646132643332373563613664303931633735656135376561646166343934396130343834653461
+62343662386239313731336538393430316263333966306530616161633763306331633834323633
+35633237333136366439376666636461356131663830323832646462653035643561396337633362
+64323532663637323966663262353266316361353931333738323762656532343165626266653035
+36353462306361383233303464353766323466393862313037386139326231656230343630616139
+34626533323065646636643736323535356461623063663262656562333466666634376239356633
+38373362363030346434316261643236363337663237323032623339393936303130393662666434
+33386134386633623930376334333466666137356432636131373562306533333836353332316136
+63653533336232336632353465373263363037313933663131633763343366663034353364373661
+63333166306332663837313334623231653561363964306337353564326266353366343538366433
+63383335336566366564333735383337353765613035383135616135653662346133333338303730
+36303334623335613836333938646366376634353664633731666235346638346662656634393631
+35396262323939393562306530323763353939363264666331373266363937653063366138636364
+36623835383961336331303439613731633734343135323938306263363637616235336461333732
+65303636623766313038356266363666316665343832623662643263623233356232333062333933
+65373763376430366565363161333330376138313130363534623364653434616438363732643333
+61336631653762613231373236613164623566663730396163383136366430353439346637623965
+39356138633037313165333034633234353666646132656532386332393962626239383633383833
+64396430343535346438623233326632663839336233316336383261346330353739633331396362
+65643161396430646436376636613061656566623038633665623938656232633665633365613837
+36386633313032306238373063346662333539313931366232323931613165343639666437386630
+63343766633336346632393231303566323562373236656135366135376262613163646235646635
+31356264393231353335363331663666623832643638653064366438373063623462333631663631
+32356664663332356538636462383364633036303733393161366565393361363530626431623532
+34303538653032313138373339663833613637356364376561316535643238356633356130376665
+37643231333037626164663634383666323333316235353832333335393262366235613461623166
+30343933643637656262613337313962666432656632323631353066353838373864383734646361
+35393966646331633466316636326162343831393639383034396133383537313138646339646163
+37363736613135326634363031626132326664343732646161623362373036323337623063653064
+37373839396261653764626338393438643634666463336263346566653366336536376464643934
+31366261353734383064346433363730623762636463613432373338356337656665376338353965
+34353866343734633661633466313132663463323962653431316536643565666364386438336236
+35376163313462383130366337653239623866663837666238346262636238623932333435623634
+65333132373436353533333834653131656638336362623535613366346266653863326431666137
+32613563316138333837333131663637346634663962616230623534383239616132623130646137
+62613863626632323838343736633765393666336664313563316535346130333462353063656166
+62376237663566396665366238323937343434363964653133393163343932353761353038373234
+33303462613837653730646462643765396631656536353335353532663033663433613032623833
+36656534646163353266316531343137626131316536396338666262336136653734613838333133
+62663937346566626131323033313432333562633337326634623866656363393165363235386265
+6332653639336330336135333865633662363738613565303766
--- a/host_vars/nomad02
+++ b/host_vars/nomad02
@ -1,163 +1,127 @@
 $ANSIBLE_VAULT;1.1;AES256
-36643866316634653430343333316233346137663238373035376232643132663036343736376464
-3033313234383933656361343938653362623265653030360a396638643333633137376231663538
-65313537316564303330663730333131633165633238643532646435386436623163346366383533
-3965636630393834620a343531623964626135636337313861653361393733333463633234363435
-64643934346466663934613962613230623562323666353231326363343430336637323666383634
-36626136643432343332343665343734653435383336313862383863626466663633363738313563
-30303666306439333836306161633432346636396333653434666531353966353430666436623531
-31636562656161333830313362653764306137396231346334613336346538306432636639386561
-65323737383865313264623934613365373465323065616130333837386665666333623832626239
-33333230643332373238363432306466613737373132643134363563613535376365616130333433
-35653262356233626331643432396237306237363135623830643536653938363461303738613130
-66613036393338393037386162383831663866323233383736303532363837663039376166363639
-34666237333562643665653165393730646632316237663337383937353365333532336462656362
-31353934393363363765616335626565343238336262653361306164383030303835303666326532
-31386332346362633433356161643536333862373030306364393935663061396538616637623230
-66383163396139306430343639346264336464646233316636666239643132376164613666363538
-33356365643430383732396235623038643566623131616461376261343563353236306663656634
-64643035373039383031303464346264383066623762323161643561366164313461613038633531
-36383161363065366164383932623231626633646166313835343264373366393236626336353039
-66646338303731346337363962353135346239306562663737363038306433386230326636336162
-65313132626564663738633531333662666661326463643032656136376564643938623061346464
-66653239663464306430613563666336643839323537626338666435336138613763313364323637
-30666566326463623438316263623233333434623366306330656564636163336636623433646631
-65316562616136626330333166646332366537666664303766346239316535333031396235303466
-34393664373361356231333530323865646333653237613636386632393730623330653437393164
-65343266373237386364373862656138633263666633333465623836366233663537393539393638
-34643963363865383434633163623832646632393234636136346137366361393638393461306337
-64653436313065326637363632336565306137613131306364336537613835306332633366313130
-34393732643361663731383661646631353035353064613931333330653031626435353163323633
-65326135376462666435643837333131313863313630336566333835613132383365343234366133
-39336131363366616136663636663334386361646465336331343836626439316532376566353565
-37643361646435643133336333643837633331316432303062623062396564373137613235363762
-32363838333337363035343631353261653063316138626133303937623233326531333837383033
-39366536333434303864616164313137613337643730306261626138343764663662393161613730
-36303736306631636266336131396336646635653131336265623364633038363339353933636632
-39626134353866313439333962376663393831303261633431303035663130613265333739616135
-62623138386235653935383364623230343662333138653562633266336534383963326237663132
-38646335623532383565303466386261613931666438313261653434633934353739613431636132
-39633133656230666231383936396264313630353434313035643565333661393736386637313264
-63636337373334313937643261313564333564383566633730396364653533666236643433643436
-33363061356362386535323038383637613364393639646363366630373735353234333134636565
-37653064636536376638626135393332626539346365353661636439323338653137383866663734
-62303139363436646464383266396464313565376132393937356665396536623332376134393366
-30346435313566313237326461346362353633353261373038656130323365383765613739323239
-38633934643531633037623036623839386637663762366631633033646138323936353433326430
-34396466653230643766636636393735373363616637386662333535643536626261653264346332
-34336337646133646261353939353166393530323730333063393365626365383366633464633236
-64656535613838313461623864666362373030636366373038373863616462373939356238353362
-36363535653734343533666532343166313964303236313135386134623963386535306435656330
-38386430303330303837326138356364373439313836636234656331643131646363386138653065
-64353837396533303463643130613339663166333933643362303565623432643064353865393635
-65663362666130623933623733323933343065633432613965373764383035316338316338373934
-65383061386635316331366532626437303664636436306535663365373064346136393063623335
-35643062363536633332313531356637313032666262366466626462666663303161653635666331
-32343130383231323239363235313031346438323330383938303733323436646336353163356132
-30336136646261323866663530336335636464623035626635333961623363396239353935636531
-64373231386163663962313834333538333133376433623363306239393462383930306432396562
-65393761633834663431353032393032396330393338343863333939323632393438646331613463
-35363530653161653266616331356531666434353663643364316564623438316132383463356437
-38626365343733383735383939646331376531376563623231323535323735356630336130383835
-39633335373163656431336130333664306164336536356431323438333933636365303330393233
-32353437393133646632373234376431626332626333343866643463653662373861346539663131
-32393333633766633738393937356134313236343633636533376665316134653632623061353866
-36373761366264653737386331383235306137323965363265653937353833343362633433313462
-32316466356335366630373635376561636233336165666661653632323835336563313134343064
-30333033333331303164323133613536613636373333663131633162616235316636346337333462
-64306336636562353733613538343462626233303661363131333665366135306332346135323136
-31306535643539303936346632623930333339353439376462633462626165633437393830373739
-61653230646366623830353630336661623466316136373264353762313065346632366164653261
-64313830303466306135313964613537633236383535343132613332613733316161623365333163
-38633930323439303030316433343764356538313632366635653437346161646439663563323832
-38363731353734303932653662326138646239306261383232643537313365393061383663643632
-31343736373739643164623437663239616663373335643262336664326365656137643066383463
-37356666306666353339626662326135636530386462613061326631366535383034303830323237
-65316135343135383230656638363564303635363333623833373163326365393430663235623231
-35646632643735363730613462656562356139323863616266343566343861356238623564326430
-31306366366330363036616137363163663136316565313334616164346639663465666338316439
-33643732343062313536313233333039366435386235333736333937633266653761616262346566
-32636337623266656464636634643632316134376334653932363134613336346539656438633137
-31306439663834663431346133653532636664636463376337616539393239316465636537633630
-30363461343733653465666332646236386633396530333863616236383437333931643731626364
-38393337656130666237373538393430306333333033306466343866303038643234646339306233
-32336364363838636563643939626665643231636633666166653539313461393238333461383262
-62346634633236343433336531396361323238386262313565396265663162353765343037303862
-63633034363664313733633433356332333633366530643863316364653065623161663932323831
-31646530613933613735333834373532616136393662346431656363346364353031303262326134
-31343332386166646530373635343039323163323366616263346431353765303430353636373539
-36346461303730313630373637346266323331373733383465323037343633313739306233336339
-63646137643332623834343462333263356432366631663065383962373634366639656133323964
-64343035323863373139313163323562643066306139363235626532396436663137653635353035
-31396334346137626461633436343539366635356537306231353961333963616334323037346637
-33626161333264643261656661643933653835356236333831343563653938303266323730363865
-31363562383666633636343935386535306361386234346535613363613363393065363832306363
-63643238383363646137306361306265666435363739306463663637343761643831633261633531
-36626562636333336434613365316232343832646163396338613839643064653834633832376230
-33343265386162303266373033353332393931633663623734396133326232303465666432356363
-66306338616634616631363662313963386638343266383063313166353437373433623736333361
-36333163386630376262616362613530346563383637656130363365366634633135323863646363
-35323430343033323734363533326334303438663065656535666432376661613435623365316139
-30623835373535623662633131393831376231623663316331313661646531393338613532623063
-66343665356338636438646339663761336636653332646233326264373435346263386130383861
-34623265373463653165383665306334643233373066356231343666663866373739336436653933
-65623134306536333538333061303066636339376636333438623666366362666137653261376539
-31346435613134303866333065306237343162333138643339313461663934643234303132613961
-65393037396463663034636534323566366161623365666466393634373764333437383263656535
-33643461636362646135626164373335386130303766633434633062356630336463623661396639
-32646565623164363631383731666161343762393639343839373234326337643766336263353166
-62633964303733643035326535656561366139626565643938356264646239336166316534373261
-30623765623338616537353062666338376262393966373033346233383132653839323731626663
-66393938313132653538313031323538333263333361303661646633366633353534373837313935
-37323635633431623365643738623834653631323564393436326562326439666462306263653331
-66316134616432323939373366343564623264336632376132663462396362663134643236643832
-31393366653961323763333335303135383934633538636335303435636334343737306232373561
-31343139363863326536613163663862343263313630336438666132306162646130613233393935
-37336330643361323032366433313939616134366134393032613862616136393339643232356139
-35326534623263353766326132623330323639303230616263636536366263643339663838376238
-35323731303163616236306439343632353561646339663933313937363739303864336438626638
-64633139633338623431343236333534373835356365343536636261386437613538303334663739
-62396532353832323262343763353365333561643633353638313534393164366539353431396336
-36653563633237333730376331326432663561343463616135613738663130323936373136393538
-65636634363631313364326665336164653939356133333031633632373030623666373562623564
-64616365616435393231646236623333333037346363666664666233306661353337343066626136
-35666164356537323735636131383266393064373538303966353531636561623032643233346566
-61633465376631656636366662373865623764336135323865316336663731383335303330616231
-64313836373063313061626365316538653831316562333165616531643434633964333438333665
-66376634323531356538343837326636636636393639396535346264656531613733386337353966
-31363730646365313834316234626532663563613234643563366566373662616335623035393536
-61653334346336613539313732383438313132653738393339373661336531633565303635353665
-31383939643261666538356633326666363934643738636430383537636165623264616236633863
-35336134386437383539303061343261313530313366316338663539383238663966653837663331
-33386464653161376335316536633532383035363066653234626363343232393165313463343930
-63323435613932626435363235396236313365636166663238323534623038663034303365326566
-66306635373433313730343536633931643935323062643136383434643138306138363366663834
-66613964303634616139323832363633363063653237366135613964663733376161373937323462
-30313833623733336366356635323261613132393734613735393062333232313236326264323366
-32376535616334376137663636633333323665333939363366313432633436653864306532393966
-61636337356534373164653637633162613235623364396539623961353466303036383031363162
-37313364613939613939343538633665666136363135656330623332656466383139656234336133
-62366262663064623137626363613066366666313733623463623562636131323435346264653564
-31323431663339653966336230356339303534353139663739363263633564373364323937386434
-37306462653630326366316530656462316539373263366262313930356663376334343562303361
-61623161613939616666386336626537333135346136643537326635383939663863623332373033
-32643730313861636163623133323061333631333332373838636163326562633936363631653062
-37336661626336623462616562333264373330323363363630313739363962323735393332303562
-62393161323962393039346432353066646162336332663636343739343566363833333738316437
-64333337363137643931366536396333633538633830353865323765616264356335383031353534
-33376363386630303332643263383738386532373434613963613764326636333133303262393832
-35373930383662383064333465633736363063363434333662396331633032353733353334363162
-32393361643562623362333963663262363235326536396131643435306665343438333933616466
-34326634373965313638666337326633653938343561663739333464343135346437636436633034
-62333039373136656664363531373430356363363736306533386135323061316339326636643739
-38363763653331646638613963646138666165666439643065363335343132613731623264376536
-37366533636564346661343966373964353731623861633463363638356163346165643164373535
-30373564326263393436326337653631383731313139636339356433333830666265343165323330
-36616538616534626237623862636536303336343331383237333333656637303266616137336439
-61653631636632366563373034346365313337356266636338336663643538303063613036383831
-65613635336366316263336131666238386237366264396438383966313762626639643236313532
-30663235666662396231376631366139653937646132343639396430643339393165656266636235
-38356135666433323434613238356537306630643861353436323037353461326534313632386232
-63643261373263646437373535333036336634396331616330353233613564363361396437326435
-38396462643833313362633436303637323163663166653231653866643733616432323663316362
-3037356363643462356137346638313963376637643162623062
+35356461313263333464373365643730653766393437316133336138313761343130646131363861
+3834623038366139376261326439633334393565346666650a323963393665366134386535316530
+61316264343737383331663361353838656333623335393635393762303533313036373161393462
+6664616164633039360a613766323932323266613166646635376333626333356364316233633931
+37646436383339343938356164646262363032663063393038616535346139633435623265343762
+33663036393761643861386538336665366537626464373931386535666237636439383133393636
+31383938376331313531366237336463323563323134313037393435333239613663663234376239
+62346163663061316666636138353962383336623133333030396534323033626632343561386466
+30356266313566316565626562376364643238386561323165633730383262343638326337636264
+35636264386262363264633833653265393962373435653639363733636562343238363931663031
+63666135613437366166643130623034616636616632633838653464666130383365326434666234
+32643164353766323131343137373438613663646635326338303934613065653466613036323961
+38353034636434663061353138393130316432366539643937623935643834633964653630326564
+31636563336138623433366536663632313863313435333531353865623066656631343032383937
+65313535303563653762646261396366333737306331643037366433323030303265613638616164
+36336338333837393235326539303964323261393039393533643538623634613432643532333863
+66376166336662306564323433356330336662333433633061313266323638396165656665663965
+38376465383662626633396366326466333436333338373361363039306539396337333061643264
+37356562623130373765366331643332376337353065366561656261353131666533636466386432
+31643438633464356464333065316139626166326164616666363666393562356239343637333030
+39366231316462663265346464613333306336316163643131303235616432613565613733333466
+33343036326435643736336465303861643739663536343965346433363231323065643733336634
+63646133633037613964393935373161666161383862616333376638616336616537616363643661
+36326665316332303537663935633431626533323838393638653661343665306332396130393866
+66303231666533393132396538393963626132643366373539656437386663653261323465613366
+39633964366362353866326562313834313266656265363161316261386638623737393034663665
+66303966623830366431316432323863386332383362396534396166343238616534346335323761
+31366164623465643331323330323736336337653230623362626230623365636364633261653765
+38613566626537386134373133376139623062383736356634393739353665326164343131323833
+31313038363663316636356431613032636131303964373564633462303735323364636131373033
+30623336306663346639326638303930383466323938356163633964623565313261363139303238
+31326666363164376261393062616339643039316163346362633865356433346636323664656262
+65323565346137333338363864346437373261383936626531316330316539653339303464623462
+32616635373631323465646632323732323432316332353033656339366639663732313939303733
+37306130656662383237613361326161313039326561396538396333373362633365353130343963
+35613833616635353266636265313766323635303764346236306664346432366632376132333034
+65303235366137356634666138343232366533613966363030376537386162396638656637663932
+66663939393737313634383430323339663634333533653265656163326637636635386163313333
+38666236626131333139633834373534316638303364666135396361616130303061313431643936
+64666134623666363937356334356134306463386466613365363136663136393833616430623836
+65373663363664333766373136336636393663376535623532626632396665366436623661636665
+62333961383034353664323333353766343939666636616539653236646634313333373639643765
+32353161633665306463386633616131333130303139306134646134663865306463353838323565
+39313538393034323065333031386634396261336131333763393466633335666238373663623564
+38316633663536383730376532633830623939633662346636356632653031633335313732666663
+33613133653666313564626261353730373637396137323964363866653964373838613130643337
+32376165356236663332366566626639313038363138343061306438313435613862626564613830
+61306262613262366539663338643962313066613665353063306537643561666462333763623866
+30643230313334646535336662616137326437323438336361376562663361376230316362323235
+65363630666464323638323761343033313763633866623361376636653631396263626239613764
+64656163343435643838353033316364306134663833616231343831613338653330643466643630
+62323039396231366136353432373732613465336163326132353731313765356163323866633736
+35326665613165373339353165613036646665313065343432663563306664323163306535613338
+31663138333639666133323139326339313733663334336637373866636661636538666630346233
+31393364313433626565616661313265336165613534666232333835383963646433316632303533
+62626134623830363533393833633439313034633965346163393932636464326664653335643833
+35386332663736343766656232313031306534653434363164623530613232306531336561373534
+37333763626135373538313561303737623035653832333533663534313035313530373037616634
+30613937626664373333643735633164663930316235336663376132353338356333623431343535
+37623138363937646665626535303463643330333233363136313134383939343535646539346363
+61633966396234393961663735646634373266373264626635306162386632376262646336316266
+36363166393332626533613736353038656266323263333036303964656662663436616532396665
+64366638386164313466313630663138333066653061666362336661336539653339616234646538
+30316334346162363065313438663865346434313564363863613532313637313430653439333962
+34643039383030623564666230623264303338343564643961653531366463623166333661653630
+38613062626464663963626233663837653533626532653239343065383036663162646261386535
+36356231383263396365653639613664346361643666336463623136616330336161373336643535
+36613530396266633861643530633732333436373966613437343736653537333531663466383438
+64323064356262646133363463316639353630653766663731653030616461393139396265343033
+31336662366465633264643065386432376435346236323565326562663161396435373762613839
+36316365633937636330643837646335613262363734396261313633373731363466356632636532
+37653036336665393733343832363739323739383730306635306666333566366663396230623433
+64663338626239313265623838383933653539666666383633623939343461393036303230663562
+35363232636635613739356536386439326537363965626261363962383231386532623565343662
+61633931613131303836356366653030656333623235663266636535666632353666386666386630
+36303134613262663335623330356639383432353133333137363665633565363037333136653933
+64396230613837396435333835343265633638346232303738663764663032343061346539393135
+63303064366130333030663739326331633762386332333162393631346234306363313737663261
+31303437376339353634393438316139663862333530653339393030633932343765326435303530
+30326566336361646563313433663063396338663661353832666561393437306131336465343332
+63316533623362613062626337306530633833323132616662613366653566396136643936653435
+33323938333666333439653037383335353763386132643362643361386232383964366237326538
+32343061643462343265383234366465366232666434623634383132303138643333343663613039
+65663339663030326364663561383833333432633437313232356265396532303735316234353565
+39313532306437333238373064643238666632383166313832326662663762316165323936623239
+62366239393530366666343866376566623863373333666266316334346138396566613263333539
+38373438653663353537323961373434363735303838306262323330616538636333306366373663
+62666462336331623761363036353331356632643664373665656332663530613931376666353261
+64346531363265316439393633346334383439623338653334343739353464316436626635653139
+39633232626463303463646162633131626538353232646663356335363663613234376338623539
+30303765636635633331326337373334626664343063623130393438633863306531653631323763
+63323661356362346536646430623864306135663766313833366165653066343439663064336331
+33353135383830373831623463646461616665326139623565666464363961306461343361343665
+30633331666533383161623130613963376266613533366334393262313730313630323836623162
+33613637363431306632366230336537373732613337613830666635353632383834383465303261
+39633334616561386163353661306564333632653731363434666562353561363462376563626563
+63353666653637336666376138333966643237633434396561386164623435333836653238383261
+30643331373138313062616532366265313831613938373865336435383564636266663462636461
+63663230626532613130623566376437356337653564303033393737663735316130633234643163
+30373264363331366435383837303762363531333335613738613463336139643333626239346232
+31393631663861623330353536313731353332313135363436643161353435653865313666373639
+37313734306461633338363033623535653066633135666463303261383366333266613830623138
+37303963666139306632666537633137326434366231333435323335623130356332313165353733
+37656238613138396635303765376666303631633034306133393639363662313066653062373638
+63313961343932393964643538663863313664616164363264663438393639306161373539653265
+34346535373939316563353437663066656439353161623337343935396463363231636262656565
+61653766616238393030333837616631373736323837363136623337623539336661633533653663
+37376530303630313861376261323231303464653666323237373466353037313230333861373366
+61323964636235373030343462326166323533343266353236653138326639363664633066346239
+66636439373262646536333134306363313531333437316536656337633764356339633933336131
+64366565323438343864666462356232616263623530613631303265313861383135333562343263
+39633938313435313266386538346132336638303938373964616535313035653063636435643538
+31636134393930363635613733343538326637366661623833396531623832616238323637633866
+35666266656465323830356432653839633763643430363431326632393664656464363238363364
+64356132326561376330316434393765663661356466346463366538323439393531343632316134
+65313436623664613230616562323138343831623033643338363839343837303334346361356433
+63356163626432343733336531366333636466613863613438373662643266636134633934326432
+31386634363161653965303230306336373434613232613237343836353061613533616237666462
+35393935383431323764646465636563363633336463353064346631363531383061333135386161
+64363366303262336464646232316231613332333732373932643562626534666634316565343164
+39336436366163326137396236393034363162366634616233376465303063663330386137343733
+65393231343634316365326663666532646162623633373530393563313861653638353932396137
+38666161336432303666316263396538663665353334376637343762613262303062313932363831
+65346637366163333233633562393535306263666330666636613363383939393035643132326162
+35656130366237363136643938633931363731623662343536623136313436616265333138646239
+3765356139356136346264386137316437303865646335643530
--- a/host_vars/web19
+++ b/host_vars/web19
@ -1,82 +1,111 @@
 $ANSIBLE_VAULT;1.1;AES256
-32316564336430646233343166663333653363613837643863373531333737353431383233653733
-6535373830313135623134666430656164386365343738650a383239383839323032383363613938
-32383630373834633564336532343634336130303330323266373930623033663234306232656136
-6566666131306666310a636163366161373436326461626661353130386538313361666538663531
-37393336316638663065393338356535343732363765633762343536393662313539326432383337
-33613438383134393535663435333364363836346266383262336439356133343464313736636134
-35626530303836663834396266333461613463313634643661303430356633613137383634613038
-31646632326330633430653435353431646131363466316231636333663430636531376133623935
-65346466616433653463613538363630306338393632356365346330643463383835326466613930
-39323766653730373763333161303564306165316336393164343235613831333762646532333139
-31336561316337366537343464373735303138303763623632316235613333313230303433303337
-64333065626434333831613239363831356565363231656466623830613138616438633164393337
-39343634326461303839356231616336376430383639653535323538303364633761666432386230
-31653037666630663434303032333163643336326563623661326536653839323263623838646366
-37353566313737616337356165636234373835366236383661316331306530646165633037303866
-64646639366366353534376238333435613934316666396434346336353533626131646239376634
-63663064666434633265343432376337343533636566613930303930633861356234303838333138
-66323063386362373930306338636463663865353339376663323936613365336533373666323465
-31666634353034366236306562363361373664623634663837396162393738613536636165366332
-34643935626164633436333930373535623863303331663334376434643236353462666362303963
-39313139303731316264383434333863323764343737303733383535393763356130316337383564
-38656434303663333534376336613036653963306363303661336464346362656563303333303566
-39366163636439313030366461353064303233636364633064343664646339346365383465633038
-35353234353430623830623036383466663236663964316530333964643238626562396366623763
-35636439633064613931653963663331343961613764643364663336643264643535316634393834
-65393932343333326166643765623266313135363362656431633933656131336163653663373335
-37323531376438343561623237623433323234663531326436663162396562623963663936633837
-62336139623231663339303439353362306466663834626364326466336435323764373661616437
-62613664356633396264643766323535666562343336313033333632366231626666333630313261
-39663365316161316261633734663063633539333535393830653034663362323764643330653539
-37393832303435366639643730616239613935376233636537306232653034626532636563393336
-63323633366631623738393161373037623865633039386566653239663638343864643561346534
-33346238306434343639623135373861333830376561663433306139383864653333356264376631
-39633437393538356565623962643465666538343031383737616532316230383466346261383762
-33613535336663386434366365336330353337653365663132336130366338343433333863306135
-62303738353634613462313866366231386430373566653339316333353364373761663161623736
-64313262303963336364376534336462373939623033666163633337323837363138363937663665
-39613263633463376362626565306564353864393965333663663334643931363862306635353061
-31633063303839633030306363646161646466323734616536343965636539633630326664636139
-61653832386339326132303334616136393731393263313034643037383063326566343936666562
-38393363306231306436636235633533373731616137653965316133303661663163313661373466
-36653864666232313064353066386133613764623562623035386263363962653432633633366230
-32373033303234666264356665363031343633663236313738636238306535313536353232663037
-38316237353433396166636165643261643464313762666333393265376465323630313463333465
-61613735613864313662383735306638363436316162353536633836653637613439373635376566
-36613162393638313363396237313466646166346139373230336533346234356665646432646562
-32343863343435643462663362396564626536323665343230343632396135303930306334383534
-39356166303230643465643737386634633531393238313631393664663237316236356465383532
-32353263326364383465623733326532633330663738633564313264306636623137323433396264
-33623164333662383335623964393330373264646265366662613236613033653035623932666264
-34373639666432656464363433356466653331633238373863343064656431666561636236376332
-30333930623539376636316263663663303130616537356632383036386438663630623261636239
-63623238646364323431613936646337306361373539346465303635383065306664643566363137
-37643163373833343162653563623432656132653462313334333439303236383563326465323038
-31353936636563613865383730363462626636383430336536656436656136333764353133663936
-38623330303531373461396163366237656632666538303034343961396631313966653532373465
-62393562303330613164346464373764633933323539353861326239343133613236613663366265
-38623138316138383832353931626530303538346433303035313266366638313437356264626661
-30363631316234303634343561656431633632666139363330396465316564323864653434643730
-39646531353233313639323365353736613262646164343664656162386536666361646666643238
-34333462333632643236343665316534626537393362353633383539633131613233646262313961
-66656131323333303939316239643739323665306433626366656538366438653934656336303130
-36613430613565666437323233343132303432383533396533373439306630343430353535343333
-35616361376539376661336637346562636438646534623265393635313466633937363135316238
-65616265396337303431333262306330383365643035303639303538303266323932613466363336
-31366565653731393661616132353235386162346338343734356633303433366666303332626662
-35353261306264346534333161333165633163376534303861663863326638623761343733303433
-63343365626463613965363134663137373538633533616635356561646235623365373633303064
-31666562613134306632356564383166336464343833633037623663656338623637336135663562
-38326538643961333363353831303266326262333730633565383666326137393430373966316161
-66376230323633333562623564636264353138303039306537383930376464333233643862613038
-38313231386161343438303433646566633236353232313737613563613932373035623034653066
-63643330316462303832306533376330383466373566643233373334336330666362653337316137
-38353930343338393162313135616165373437633737376131346662306438643537316537653330
-65643731383435393530383038316431663638396538313131306661663934313535616261356532
-36626435656332633861616465326231386635383838633232653432336362313164633839326339
-65303834613235326436386539613537646363633733323735646630343631636235393533656266
-65656639356337623464346337326232616234313664306165376437633562643861373231636131
-37623735333165633762346238326430323336653962643731333166616137376562643430376531
-30303164333761333161323730656430356534376166326431373137636438303636386330393435
-37336533663762303230653839336534316636373238623934663934646133646135
+66313066303030333063353236313063303262626561316535646263633936336534356437353265
+3432356362393665303438333166643066666164363861610a643434356531666366393936353233
+37353036656435616361613164323038663364666464373964653337396465373061666533373938
+6536323936393135370a666134613830306533623365363933376631313534326265666634366235
+36623637383636396437333735336238343434353733303764326237303033303562353237353165
+31653866633363623764353533356262643239613531643039393335313731383038343638663830
+36356139336363343437666230656366636132613531613339353962373435643563313734646135
+61613330323938363063313430343738306536636233353963636665393132643162303562666531
+61343365326634303730656133633632353936386431303631363731313730666132656334353731
+33616537313230666462653165643535386134663166346262363535383365616431613838383863
+65326163303966373938653033613238326634393166643630316230613065353437306237313933
+65366131396266393236373162343866383565633030356465613461353131643562343630336566
+30633534636634616666616462383136373830623137396366626639373230373834316563343464
+38303333366166323238346237646165383633383264333431663530326462323432366332333630
+62633132666439313034616465663861323064646564303963633565353734353665313138373636
+34653639353333373737613238626535356333633833363737646330643163326131386364646365
+64356435636635663737376239313236356361363061313731626230366336326535663866373231
+37623262613135636538343934336262633662383266653238613965356639626339303437306633
+38373837653737313465376231363637353561303937336138343465376638326163643065336462
+61633236373737363633646135396565303835643336393763393933613964663435306336346636
+38316231383363616533616437366362376664393135623765646330323161366134323263376466
+31386332333565643764343863353039313466643962373736643533666562353766383862326134
+31633366636365313231366337313334333130373833656135396262373136393135353039623739
+63626463636237633963323739303961663632376330336236663134666461383965303861333835
+38663337393930383834653936636365663966333033346562356331306430306338333761353762
+38363733356262363161353135633836336363376232326261623264623338663230663838386330
+35353762393839646338366365313763346339666433306532353530353261363838356639623436
+62306437616630663039653862393466353933333763386163373035373335343834663439633039
+34613463303436366631396462363866656533343063356265333539353038326637613063326164
+62663833363165643436343538666565386561383335393964313839626237623031343564656632
+35613534636437306463373466653431336562303132313462326233663561343837323331353035
+33303336356237306464363564666136633230396635623066376564373737353335356432343231
+66633735316466633039663338316566343739373664316335366462356237366139363731643366
+33353039373665333232383235303932623435366638313465396333316565646134343463336330
+65306334623631386364353364313638643930306265343363666366663164643435333834376439
+64396434366362343733323366343232653930646565313762376436663965626562636238623066
+63303236326362323966666630343136336563343564393833636465333832396666396638653661
+61323561393563326437386462656266303830353730313839613136656331323938616631386235
+30633730303838313038313263363363633136623861326662623366613461343133356261633030
+34333732343037396131343764366535343639326333353036353038656533333339306363653435
+39656166393265356338656631353065653630303237663761386332323530663966343864663438
+65356365386131333236396234623537323062363539383061323832363563326435306465663234
+66316638376436613265353662646264666138666165343763393330613765346163356138616633
+66373338393163333435666236386239663735653135386532633135646539316665313036323763
+38666464363432656534313263306266323066646133353765386463343264633131633936373036
+31326138633131393962633861333036373537366163613562383033336333616130636435326331
+66653766653065306164613335623933616135393335383438356337633239363131303237653566
+62636263383236656136376237646363363234363232643636623333396531363461303538373662
+36313537393238626337613964623731666261316366346666323261386661643035353164613637
+32303061336363306335306431613263646266303038323739636662326465303961616339333461
+65626263366333333562386461636231636438623966626136663932303035343531363234356663
+37313661353764343764396666633666613238323638646233353138383638353938303933396431
+65366564353533363039383838313562663561633434393833636365303561333534393930653630
+63663464613334623864313663383630353166363862373132343532393135313666626464376436
+34616566663764363566663530646638363338653538353661393835383035346236646233363564
+34656165303737326261353032363435333731363031343366353863313138653865346535636564
+31393134336534616161303132353764343833636465356661376638633163643739383830616534
+65386262663734356134303039623265303935363764623537326565633030613465666435636232
+61623334393734616262613232306339396639643636373762653738333463616361653430656438
+63316265303634323033303330353232636136333863366261656532383065313334386335666636
+34303564636333356364663565333932343064333266383638663365366636643866353132373966
+66336563346233656531643735663062393630616537656264323136353266623161353261333239
+33636563376566333331366336353338343730383962653138636535623039643461303763333961
+63373264333037653563643937373664373665343136396635316634613632653232353033666266
+31333064623765326536386630353435333438326232633565663531303730636530386564366633
+63326335333639376266396562343838636430643664303737373565363635643037616231393665
+36636337633564373561343266666632656235646662633965663733383731633832373334646335
+34396163636635633637393834396566663062633135383330396564656536333330623737636332
+36646362623131366166626639386238616566323135323334636638393934663336663532306336
+38396634393433623963316261303061616634333566306239366666373238376466633166623464
+33313538663838373465626638316432613135386262376233633362616463623363646433353666
+32633838303837656335333336353564343461373236353736623032663139333338646463323533
+65326131616433666563343163663462393235366135633661366564623662303932626164366632
+38306430356238633162656337303536663065653639353562343965663366373861646162653562
+62306236326163393336643232663336656637623539353835613536653164393038623966316433
+32623462343037616465623736306530633736623061343430356638633530313331306363323837
+63396263393136363137643632623938316363386238346237333862303735363065386633366263
+31313834646239323631393335633534383930373630663538653864383930666465653731616263
+35333830633430343436646266663231303466343138643338343634346133613666613734313037
+34383931643631633539346262653631336565623366343564303332333831346436373162356362
+66383864313732303962653662333036373239343335623765616536306465623030393138663838
+30313861636631393462653836626164373034666533323338383262393132396436666639363262
+39356132343939366534666665393231346566663432653236376333323363643166393431316161
+33343666316138353333346263346266343731613065356631336231373266343338393939663038
+35343235393563623434313266306163323266346662623063353631663433646436613130636663
+38356335616438633638383236333131663163613436303934386335363432323063303234383331
+34636432653262643438653931313233626462623034346137303738643932353334373531303439
+30366233373535343431373365393566383538363763313036623262343066346236303061326631
+64376463336538363132656464666365343861393330313637356237666361343666633436346534
+33636332386336646333616330613738343264626438613135313962336534373130316330366233
+30316333636564326165663565666361643430656366393939616538323530383632636661326331
+35366663646533313034333764626237623637363164356163636432653765656439326438383134
+62623638633934336334393636333336633164343066336161333138653637333435306230653865
+35363032393633623331363933373463623032333361616365373037666333643634343963663835
+34363033363731346663643363383965336536353332646262326136353965353137383737336165
+33613733656463376333376264633935373239363337323538356636636439393564373332323031
+31623733663530326632373235313830396133373430613061613438653336653462316336623438
+30343032346133363830656231663966653734326635333831626639393666303033653437326238
+65333566643066393331323466366662383135383734313537663664376161323265613436653535
+63643832616663303632623433636161333339376635333635626137326662396562633830343337
+65376165376564396433343736313134656332383533356138383039386266636238613936653962
+32373337346335383136303838343034376432363436356465613836366230313463303239373531
+65383334646431346565656638353537333765623430333133663663326134646566306137643663
+65643338386439666636376461356466396261326165333030623633613364343631343830653939
+64323266626131666332666433386434313936306361633164373532626231366234623735333932
+62306362346164336433336139313561366162303666353635653634396139313734626463663735
+38306466626237626634666138363665326636316563356431333432313534363638613833613539
+38306237353764376462323238663034646662393433623830616361623735343162666465626230
+30633731323939633265323338373537383261333235303262633336636433316339383433653861
+3861653261646632636364623830626561393864666135346634
--- a/host_vars/web20
+++ b/host_vars/web20
@ -0,0 +1,49 @@
+$ANSIBLE_VAULT;1.1;AES256
+30313139316131383630353236343338323465653163323838616464396137656365393639613766
+3733323562386139353933626339663039653437363037350a356263643762313634613736356363
+30383534346664353030346233653163616330376562346164613731346566393330623165306234
+3833306632616536650a386239363931326463663665346363313462646464646632643961343631
+63393164366163353461633038653833623963363233396464663839653330386231303461636564
+39613265343765323636373736646462333665303333373737633632346465343439386335623334
+35333933363966623730643632313361356661303562393535646230626639363335623861323033
+32356664663539343262336535623233326234356463373031356361633536366430346338393831
+34666232373761643430356662653431646661646165663134633135663933616262393763356133
+61323063383036313166643866303136656164386239326437303238623338306433633762303630
+39396438396639666433376533333765313431383862383031333031616334656136643262636438
+65626565333939616631336237633063396430376434626437313666646165333239376463383837
+64656635343661353735666666306134653530303033326662613230663061613034383461326534
+65306131326634643732326530336136623731663336656138383635383730653633373737386335
+31316136643634613536366439393565633964643735333336613865366138396539663534646435
+61626530353836366337643062366532323538326161633137353336626537633739393464646632
+32343730356362393336313535303034363531373961616265623934393161306261663562653464
+63336164366531636130343939353235343261316534613665316363346266396332633763346536
+65633038366530356138373661306234316161343762343638366639653132333438613766343939
+61316232386465643236326430396130333831666363313032623537383032646663396239663338
+38313939306465353033663066633435626635353138336330336333616231363634653665386532
+65326463663933343966356437353433313565316139366365323934643131346636323737626437
+36343435643231366663323134656561666133303030383734316237386532396662366461646365
+38303434363763363866383761386535383262323432333730323236353439653163613966333032
+39306533333132373736313834326464643134393432303537643835336438393461663233333239
+32333365663337653436303662393263366161326465663036373934373764363438656436666232
+32326134393161656133613266633966396663353631616537363361396537623164373964636666
+61613731306333303336316337343635316134363431646433333932633336363065393637343030
+39366537656430663932616335323661316533643763643161613463646363656232346333303331
+38363234333261653135316266313736366439343138666165366533353035613731633466396363
+31663166336431653461663463383333623664356365396230353130386138363261356331663965
+66636338336466366132633437396535643736333733633430373964343533366338666532346263
+38353233303437663339616532636662373761393461666439663133373633653139613531393738
+32383937373833323938356333343963306534633734393162363965356163643862643037636231
+65366461663161353939633866323162613761663836626232346236343263386364303233313161
+32313265366562313731656630393166336662616661313964666661616439343265383566383332
+33386266366534383934363839636636316532613133636664323136373130363534333531613663
+35333964626634643135663639373339626335643366333766386631363439393435626439636166
+37616339313336656634393538323935383964343437646433636636383061366437386330643334
+34383237353036396563643730373663383165623633326336313031326435623538376130393130
+64636538663963303938623866626431313238646465633437333863363865666435636564323764
+39303638663830656162393836366262663161633763656630663434386435643462353661353035
+63336461333464363838313765653037393964633536636435666162346461633561386364333966
+32623761373435366665363239626632646364323934383163346637356562653332373536343462
+31323036356132373930656364393061306130353632623661663032343230633635336664376134
+38363239396139333230346138386337313364353934396362373233376266383537346431653234
+34323835306165613739383336303964656565373636343639303831386466623031396665343234
+33373164663339653839
--- a/host_vars/web21
+++ b/host_vars/web21
@ -1,46 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-65653532333862366436303432656664373261323934306234623534633335356466623330373063
-3164363863313131303330363564326130383433646332640a373233653965653164353663633038
-63363966646361366637643261613062393736366361356235633139323537636638396264316534
-6366313732323066620a333738656661656537646632326262663862393434663435313037653564
-66303732396261373436373538396466643330633336623066313933323266386438363566343834
-38616661303931376136616532386637386130326264336430613336613836323666326261643838
-36613565323062626662313864633539323538316562346533363437373766343764346132333631
-66336135383732393939383133626662343335376531336364303662356566393034326635333066
-64333635303633306639656161623631333139653034633939303565386330383236616364353136
-62663536613565383064633235613539313933373530306164356462353861383761363931613430
-37373939616564663562376635333862646234353133663331396661626234356665633835323137
-39343462303438376131626335346637316238626462333430346539313838386662363031336636
-34366132363439653137393662653661663262346632306533376565353037616362316161333566
-30393530656566643136613039363537613035666465656530366637393664343665666534383837
-63393133336664313466636538386338653937643563633737633962626562326637356661633463
-61613231346532306265623361636330376563396266393330393166643833353165363934313533
-66333832373035376334326336616534326566666361616665633363383032393236336634303232
-36656336316635376431396233626539633839386533333436633264613761353361333565656233
-65373331306434363938393339333133336461646130666535343965646536656263623530666333
-36353664643132623465353661656466383363376261363534303462306661623564663561656664
-37633936636263623065366666666530616264396334623766613036313735353264356162613836
-35643737346530393933643537333561356465363239353630343333373038373836623231336437
-30343932363864663435656634343138353638343461623665336461326565636164643231323133
-65383664633665343365363764353566653635663137633033303731303030613565653565303433
-35373930396166646134326165653436613137383630653338613634633361623432373839376430
-38376630633363613632316530663839326538366366626230356337323536306665616661373261
-36653965623936663963353836653636306362663062636466613034333532633534646635313737
-33313962323636643132396166626566366466336238323163656332383530363833613633383165
-66366239613530613264313739396661386165343162633237303034373765643037656564653061
-63373036356134353633633532663365323932633531616261373735313737333033353532656434
-36316339303930336464393261323035626330366133626137373034396166336263333964333963
-62636432386531306133623163643461336137653331653861383139373938353162636566623566
-35616637663638313566653832343634613632663861333162333932336264613730313864663663
-38396563373339626365353766646565336335656539393738376331383038353436313963633438
-33373433613034373763643434613365303938373764306662363635626636633266643035663836
-65353632313137366231323764313036613134643830326330653763656362343561643964623361
-64336565666630626339346563663931393035363938663734616666356435326638353131383434
-65623539613662393936653161663264343132333936303661643534343536363165313564333037
-39343561656461313265393466346662343530313230386266646662633262643464366661363630
-63376463396631666366313266633964396137373661643764666537366539373337333731343933
-31613232363436643236623935326265353666313861303531633462623363373536636534623532
-66636533356363353735653839646263663631316239326164646463396532343038373861393033
-36623962396231633164356335623865326632303237643864656335326435373234366536313565
-34313638373063303434613663323136646263393036356336323532373130386536306235343165
-6462
--- a/host_vars/web22
+++ b/host_vars/web22
@ -1,130 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-30653064396464333266346335623639626664323437633033643334333131666533373636346562
-3064356161636364306236663237383737373437613335390a386266376130303236333635356530
-62393236356533383061323034646466323464636635643336346533363362366130343637353234
-3438313633323564380a383963353238303663313061316135383530366161386334363836316530
-36383038323835343432393735366233363561633034623961646364386539643864303533613439
-32613561343837613565386235323932363664323665386232656532616638386565653835386333
-64616164303332323565306161303936373530323761343235363334363330313564316635343737
-63333566646262613339333130333165353037636330666232633963666335333161313562636339
-64653034363136323431333137653736646463323762323866303965626565363934373834633034
-39616562353138653834636233333665316461623335616136313534343933613065343962316163
-33363464623233313336386134303764623338616464623735653836623565316330333561393439
-62666332653863656537326235376532613135623435353762316261393162383732393463303231
-64316138623466643331326464633932386636636639646434633261303564653665353530646661
-63363337373939626535393963386364393862343039623633316364323863616236616464376630
-31356531363535336639303863633430626130613238663237366131663738343330396665626333
-35633032663333366131626331363964613530616333383031633937316663663930666433643662
-63376431396538333566383234666163323734653965326466656137336362643862366530316164
-65663436383239613931383138646363623037666338633132353034663231653466363735313834
-39363131653232356137343532613664353438616566646339623334306234346132656436343663
-32366466623637613366333866316432643763616465633639383165366462656131343331306635
-66336264326661313136663665336366616633323834646336633266653961613635353337303031
-30393531383631303734373162323233633032353730616536373033643861393039613164656336
-30396132313432363230373663386534646361636430336138333735393366643962326130396637
-66313966393863313134386335653435613037353061656366373862323865633630386162613437
-33623631303363666538373864353365616666393139386330373130376531323132393034333930
-30333231316462393035663330333036383234613962346633616538363962303733643935333930
-32356330663639663135623738356265393431323937633162663166303335663464323332373931
-31376533303861383662623638346566313231393465346139646230306563353334343262316664
-62303439323630623965666162396636373162356261663063646636633662363530356666653862
-64323637313435316362616432363038306634353464306162333562643063373938363239653666
-62616435316230306637383365383665313561383139633961623636336433316365313131613465
-33333561656435653630353139363233616363616234353538336564626566633135396131383434
-37633165643637333539323935663561316161343431306233386439306638373130316365333234
-66653762636163393030396330663365646538363533643366643164383332306135323935313938
-65373331386361373337663466313331333234376533366661666435383931306466373162623837
-34376136336631366464623630373264653931303038623262353130376635626365353166326535
-63643865656333376265656464666332343830393234633265386234623731333635653762313639
-64616634346137656634613831383733326334343466646233663832303331653866323937383334
-37373635616538323931666434626632623635336432623266346662663966663862623636373338
-39666565633232643333626234306466313662316563353939653435663039333362326263633230
-31646637383337333538376266333239356637383735303161646237346537376638653931333863
-32346464336664313134616530623564356230316132633433346262653438303966643932343633
-61653830303334356534626632633839346666313330343636363530316261346534653436326339
-33343338656636313139383536313366653234326165306130653431396433656434303432656537
-36393632373330323439663930396432323539306235623532326238323937386433383664656263
-66353237313435383933623730646663343064336532356232643234636234356130666166396530
-66663434383763323135363161306161373336303364626438383066376130666535623438336536
-38343862386636343337613130363531656163346538376262653866613962343663373931343131
-32366163306436353566613135346433666630633837666563343636303465663162623164636463
-63653534353561393533656432326237323937636339613063333964343534303165353335653239
-64643466366461373166633831373838323533613631653830336538626136616161623462346366
-35333966666231626336323239643966323538366666646335333537663461323763343361633339
-66366266313134333461623130396434343261623236616231633533656334373138316434646139
-32396639623139383565303261643165366662633065343461613437353765636333303061326534
-32616539316631666165336364333264386239326466373534313638336630306439653132663962
-30353863346331366564376536633834656134386265303265366233373933616235623432343834
-62313530663038633665653235386534306130326639386231616233326433366463663361366231
-30356638363639393130383564303538623831653230653338633633366666383439353132363032
-61353134376335633461303138333863666135323138616464333438623536363734656438316231
-64663030326361396365346339393235373636313763623865393163333238646536663066356361
-61656261323566306433626432393339306437323233663762323232333735323033626236633666
-34326434633437336238646663633863626536653230386436626130373434346231396263313166
-65313961393732333431353865313530356365333462653666663865313034366462376330366439
-63616261386664633963393864633538366662653239356261663561653139326665666335306138
-35326232363166653638383830356565303337323833323233396634353931626331313039306433
-65346666373334376661353463323434636235636234313764323330353665373339653866646239
-63346636613065623233643537343237356538363230326431326130303464336637643338666562
-63653266623138653165316635643235303131323861306235353135623564366337646166363830
-39643431356464376238366134303231323031326437363330343130326136383065626438623930
-64623630346230343662626133313332623661353663383863626565373033323065396633636430
-65613861303964616633373038646162326634376363623432363161613632376361613065613234
-35363963366662386334306233363233643465366164316434373538643732663236616539323133
-64383761336233656534653266333832383632343939366662643830643065316464356563376666
-31653762616163396134363238346563623961653738383132646264306339623961306561393732
-32633635336436663435303731306666336365613030646236363634663731353366366337396435
-37316339316534346235666664646335373335306634336262663566386336366235646635336238
-30323861663239366438353339633863363536616363396365643361363331633463366162636438
-33633364353333663538393430323434373531373536613837353833646336356332313837326431
-36666335313163303933333734336532303832373465393939313636343635313737653433323531
-33646636373431346432343630633034383936613336353839616632343339643262656330313436
-36363538323038623765616636366537633332343465326564323830656333383330393461333638
-31633561626265613839303265663164306166313331353739613661313234626563396133353430
-63343664633238316263303662633032323965363939393238313062316166663563366534646233
-36393233643635353333376462353563333536366533643664303232626564623461643266303530
-33616333306262656136646238366631643963356266306533623962653462366335656333383862
-63623535316439663664653862386565383737333035653732336266393266323437383666313165
-38623336653731303464643363643034623333306362636536323137626462326632346332343762
-31393235303962653533306431363062386331666461366235396337646532316231373136396562
-30333734666134623430623030646166653831303963303837353664646561653031333935353931
-32383936633432313964616166646664633330656637333133363735613631616264613034623237
-32623563313164663563633263383839646231363931363136333361613537633439333564373934
-39646639613131626430326534346639306136626236303635626438343963666262643330626563
-33666262393363373237336531653236323161613237613636663736373331393734613661633332
-64353939383463383261626537653637363134393839623434383066663432393361643666336364
-35333266343261663963313064623932353133613163663231663565663765343630363139636636
-32613463363932333166666364646235656661343161633764323831306337636666363565323831
-63303935353933363265386361653863313734353366613430326536393761343262323632313332
-64633635303261313931386165316161326164613635613537663466646430376139306333373366
-38326136356333633432623237643266633361376363393034383330613034353830313039646237
-64346666616363316361356466383234646436663863373961666636373863373436373334383031
-38653836653563383666663139633164643361303732356239323435356630613239623962366462
-34316166326334613131626230613363303334373537393134633930663636626135663162336636
-61363633653666323832656362363532663833623835613732363339336638323662353130653136
-62393338646662303934633438633935316563386135663862323438613234313138393364343461
-31373963613431313966303339666531626161633361383836303534333931363135353062613633
-37336637623731623838303639653832633866613564393232326261336137363862303731626332
-36643438663564333865326263643834373730316136376538393731353165316331346331366532
-63633233663966373934663532656530623765616336376634613366376136613831313239656563
-35343464376364333035356639343966326335663432636363323339363335656437336439663161
-66343434383334616535313330396165316262393962383232343564623833313964346635326264
-31303139386463663539623862643431396130666537663137643439646535346631396530383134
-36333663316434613933623965346264343164316132346466643262616235653266663765653864
-32643139396430656136313235633538313334383538626532356664386539313161376662303837
-64393230623732643335363164393733386131323235613065633530383864343161643562323735
-30333766383030666463363535613138373735373833366661366563616532316132363233333737
-30353137303439383038663063666631666264633062333837353837363731316662313636326431
-37613939333766353530646330653532353965323864353434383035613639643263663762666663
-37636463396161656335376539356638643539336330396432356338393665616637623039346433
-30656161666135376130303566623132303738323038363939363733376666646431643465303065
-63636263653262376533646636373536373661353063323431373537323930626638613735643338
-33346565363462326236373137306332616562666631313131356634353961383165383939313665
-32613438333061613139666530313962366536323531663866313638626433623736613536633965
-32353635626161363930333562613536393238366333366365616435353164663265643831303566
-61643333313635626231373564363730313731646464373566363961396439333433313432383138
-32666438333637613633373537326139343266393335616634353961646535616237613764336663
-63653437396538353238383138656535646539303864633235363535376635643362663064666366
-62623165333234393435343233373430363161663936343165346662336366623532383730353136
-66643739626538353036663739326132336161623363393130346365666265323765346232633264
-6337
--- a/roles/common/defaults/main.yml
+++ b/roles/common/defaults/main.yml
@ -1,13 +1,11 @@
 ---
 #file - roles/common/defaults/main.yml

-# add a dummy API key for AbuseIPDB.com (override with real one in host_vars)
-abuseipdb_api_key: dummy
 fail2ban_maxretry: 6
 # 1 hour in seconds
 fail2ban_findtime: 3600
 # 2 weeks in seconds
 fail2ban_bantime: 1209600
-fail2ban_ignoreip: 127.0.0.1/8 172.26.0.0/16 192.168.5.0/24
+fail2ban_ignoreip: 127.0.0.1/8,172.26.0.0/16,192.168.5.0/24

 # vim: set ts=2 sw=2:
--- a/roles/common/files/00-persistent-journal.conf
+++ b/roles/common/files/00-persistent-journal.conf
@ -0,0 +1,2 @@
+[Journal]
+Storage=persistent
--- a/roles/common/files/abusech-ipv4.nft
+++ b/roles/common/files/abusech-ipv4.nft
@ -1,5 +0,0 @@
-#!/usr/sbin/nft -f
-
-define ABUSECH_IPV4 = {
-192.168.254.254
-}
--- a/roles/common/files/abuseipdb-ipv4.nft
+++ b/roles/common/files/abuseipdb-ipv4.nft
--- a/roles/common/files/abuseipdb-ipv6.nft
+++ b/roles/common/files/abuseipdb-ipv6.nft
@ -1,7 +0,0 @@
-#!/usr/sbin/nft -f
-
-define ABUSEIPDB_IPV6 = {
-2400:6180:0:d1::4ce:d001,
-2607:5300:60:232d::,
-2607:f298:6:a066::1bf:e80e,
-}
--- a/roles/common/files/abusers-ipv4.xml
+++ b/roles/common/files/abusers-ipv4.xml
--- a/roles/common/files/abusers-ipv6.xml
+++ b/roles/common/files/abusers-ipv6.xml
@ -3,7 +3,12 @@
  <option name="family" value="inet6" />
  <short>abusers-ipv6</short>
  <description>A list of abusive IPv6 addresses.</description>
-  <entry>2400:6180:0:d1::4ce:d001</entry>
-  <entry>2607:5300:60:232d::</entry>
-  <entry>2607:f298:6:a066::1bf:e80e</entry>
+  <entry>2001:41d0:1:f934::1</entry>
+  <entry>2001:41d0:602:238d::</entry>
+  <entry>2001:41d0:a:2a31::</entry>
+  <entry>2400:6180:0:d1::476:7001</entry>
+  <entry>2402:1f00:8001:8bd::</entry>
+  <entry>2604:a880:800:10::5bf:2001</entry>
+  <entry>2a00:d680:20:50::bcb2</entry>
+  <entry>2a02:2168:a01:33ee::1</entry>
 </ipset>
--- a/roles/common/files/aggregate-cidr-addresses.pl
+++ b/roles/common/files/aggregate-cidr-addresses.pl
@ -1,89 +0,0 @@
-#!/usr/bin/perl
-#
-# aggregate-cidr-addresses - combine a list of CIDR address blocks
-# Copyright (C) 2001,2007 Mark Suter <suter@zwitterion.org>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see L<http://www.gnu.org/licenses/>.
-#
-# [MJS 22 Oct 2001] Aggregate CIDR addresses
-# [MJS  9 Oct 2007] Overlap idea from Anthony Ledesma at theplanet dot com.
-# [MJS 16 Feb 2012] Prompted to clarify license by Alexander Talos-Zens - at at univie dot ac dot at
-# [MJS 21 Feb 2012] IPv6 fixes by Alexander Talos-Zens
-# [MJS 21 Feb 2012] Split ranges into prefixes (fixes a 10+ year old bug)
-
-use strict;
-use warnings;
-use English qw( -no_match_vars );
-use Net::IP;
-
-## Read in all the IP addresses
-my @addrs = map { Net::IP->new($_) or die "$PROGRAM_NAME: Not an IP: \"$_\"."; }
-    map { / \A \s* (.+?) \s* \Z /msix and $1; } <>;
-
-## Split any ranges into prefixes
-@addrs = map {
-    defined $_->prefixlen ? $_ : map { Net::IP->new($_) }
-        $_->find_prefixes
-} @addrs;
-
-## Sort the IP addresses
-@addrs = sort { $a->version <=> $b->version or $a->bincomp( 'lt', $b ) ? -1 : $a->bincomp( 'gt', $b ) ? 1 : 0 } @addrs;
-
-## Handle overlaps
-my $count   = 0;
-my $current = $addrs[0];
-foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
-    my $r = $current->overlaps($next);
-    if ( $current->version != $next->version or $r == $IP_NO_OVERLAP ) {
-        $current = $next;
-        $count++;
-    }
-    elsif ( $r == $IP_A_IN_B_OVERLAP ) {
-        $current = $next;
-        splice @addrs, $count, 1;
-    }
-    elsif ( $r == $IP_B_IN_A_OVERLAP or $r == $IP_IDENTICAL ) {
-        splice @addrs, $count + 1, 1;
-    }
-    else {
-        die "$PROGRAM_NAME: internal error - overlaps() returned an unexpected value!\n";
-    }
-}
-
-## Keep aggregating until we don't change anything
-my $change = 1;
-while ($change) {
-    $change = 0;
-    my @new_addrs = ();
-    $current = $addrs[0];
-    foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
-        if ( my $total = $current->aggregate($next) ) {
-            $current = $total;
-            $change  = 1;
-        }
-        else {
-            push @new_addrs, $current;
-            $current = $next;
-        }
-    }
-    push @new_addrs, $current;
-    @addrs = @new_addrs;
-}
-
-## Print out the IP addresses
-foreach (@addrs) {
-    print $_->prefix(), "\n";
-}
-
-# $Id: aggregate-cidr-addresses,v 1.9 2012/02/21 10:14:22 suter Exp suter $
--- a/roles/common/files/spamhaus-ipv4.nft
+++ b/roles/common/files/spamhaus-ipv4.nft
@ -1,5 +0,0 @@
-#!/usr/sbin/nft -f
-
-define SPAMHAUS_IPV4 = {
-192.168.254.254/32
-}
--- a/roles/common/files/spamhaus-ipv4.xml
+++ b/roles/common/files/spamhaus-ipv4.xml
@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<ipset type="hash:net">
-  <option name="family" value="inet" />
-  <short>spamhaus-ipv4</short>
-  <description>Spamhaus DROP and EDROP lists placeholder (IPv4).</description>
-</ipset>
--- a/roles/common/files/spamhaus-ipv6.nft
+++ b/roles/common/files/spamhaus-ipv6.nft
@ -1,5 +0,0 @@
-#!/usr/sbin/nft -f
-
-define SPAMHAUS_IPV6 = {
-fd21:3523:74e0:7301::/64
-}
--- a/roles/common/files/spamhaus-ipv6.xml
+++ b/roles/common/files/spamhaus-ipv6.xml
@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<ipset type="hash:net">
-  <option name="family" value="inet6" />
-  <short>spamhaus-ipv6</short>
-  <description>Spamhaus DROP list placeholder (IPv6).</description>
-</ipset>
--- a/roles/common/files/update-abusech-nftables.service
+++ b/roles/common/files/update-abusech-nftables.service
@ -1,27 +0,0 @@
-[Unit]
-Description=Update Abuse.ch SSL Blacklist IPs
-# This service will fail if nftables is not running so we use Requires to make
-# sure that nftables is started.
-Requires=nftables.service
-# Make sure the network is up and nftables is started
-After=network-online.target nftables.service
-Wants=network-online.target update-abusech-nftables.timer
-
-[Service]
-# https://www.ctrl.blog/entry/systemd-service-hardening.html
-# Doesn't need access to /home or /root
-ProtectHome=true
-# Possibly only works on Ubuntu 18.04+
-ProtectKernelTunables=true
-ProtectSystem=full
-# Newer systemd can use ReadWritePaths to list files, but this works everywhere
-ReadWriteDirectories=/etc/nftables
-PrivateTmp=true
-WorkingDirectory=/var/tmp
-
-SyslogIdentifier=update-abusech-nftables
-ExecStart=/usr/bin/flock -x update-abusech-nftables.lck \
-          /usr/local/bin/update-abusech-nftables.sh
-
-[Install]
-WantedBy=multi-user.target
--- a/roles/common/files/update-abusech-nftables.sh
+++ b/roles/common/files/update-abusech-nftables.sh
@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-#
-# update-abuseipdb-nftables.sh v0.0.1
-#
-# Download IP addresses seen using a blacklisted SSL certificate and load them
-# into nftables sets. As of 2021-07-28 these appear to only be IPv4.
-# 
-# See: https://sslbl.abuse.ch/blacklist
-#
-# Copyright (C) 2021 Alan Orth
-#
-# SPDX-License-Identifier: GPL-3.0-only
-
-# Exit on first error
-set -o errexit
-
-abusech_ipv4_set_path=/etc/nftables/abusech-ipv4.nft
-abusech_list_temp=$(mktemp)
-
-echo "Downloading Abuse.sh SSL Blacklist IPs"
-
-abusech_response=$(curl -s -G -w "%{http_code}\n" https://sslbl.abuse.ch/blacklist/sslipblacklist.txt --output "$abusech_list_temp")
-
-if [[ $abusech_response -ne 200 ]]; then
-	echo "Abuse.ch responded: HTTP $abusech_response"
-
-	exit 1
-fi
-
-if [[ -f "$abusech_list_temp" ]]; then
-    echo "Processing IPv4 list"
-
-    abusech_ipv4_list_temp=$(mktemp)
-    abusech_ipv4_set_temp=$(mktemp)
-
-    # Remove comments, DOS carriage returns, and IPv6 addresses (even though
-    # Abuse.ch seems to only have IPv4 addresses, let's not break our shit on
-    # that assumption some time down the line).
-    sed -e '/#/d' -e 's/
-//' -e '/:/d' "$abusech_list_temp" > "$abusech_ipv4_list_temp"
-
-    echo "Building abusech-ipv4 set"
-    cat << NFT_HEAD > "$abusech_ipv4_set_temp"
-#!/usr/sbin/nft -f
-
-define ABUSECH_IPV4 = {
-NFT_HEAD
-
-    while read -r network; do
-        # nftables doesn't mind if the last element in the set has a trailing
-        # comma so we don't need to do anything special here.
-        echo "$network," >> "$abusech_ipv4_set_temp"
-    done < $abusech_ipv4_list_temp
-
-    echo "}" >> "$abusech_ipv4_set_temp"
-
-    install -m 0600 "$abusech_ipv4_set_temp" "$abusech_ipv4_set_path"
-
-    rm -f "$abusech_list_temp" "$abusech_ipv4_list_temp" "$abusech_ipv4_set_temp"
-fi
-
-echo "Reloading nftables"
-# The abusech nftables sets are included by nftables.conf
--- a/roles/common/files/update-abusech-nftables.timer
+++ b/roles/common/files/update-abusech-nftables.timer
@ -1,12 +0,0 @@
-[Unit]
-Description=Update Abuse.ch SSL Blacklist IPs
-
-[Timer]
-# Once a day at midnight
-OnCalendar=*-*-* 00:00:00
-# Add a random delay of 0–3600 seconds
-RandomizedDelaySec=3600
-Persistent=true
-
-[Install]
-WantedBy=timers.target
--- a/roles/common/files/update-spamhaus-lists.service
+++ b/roles/common/files/update-spamhaus-lists.service
@ -1,27 +0,0 @@
-[Unit]
-Description=Update Spamhaus lists
-# This service will fail if firewalld is not running so we use Requires to make
-# sure that firewalld is started.
-Requires=firewalld.service
-# Make sure the network is up and firewalld is started
-After=network-online.target firewalld.service
-Wants=network-online.target update-spamhaus-lists.timer
-
-[Service]
-# https://www.ctrl.blog/entry/systemd-service-hardening.html
-# Doesn't need access to /home or /root
-ProtectHome=true
-# Possibly only works on Ubuntu 18.04+
-ProtectKernelTunables=true
-ProtectSystem=full
-# Newer systemd can use ReadWritePaths to list files, but this works everywhere
-ReadWriteDirectories=/etc/firewalld/ipsets
-PrivateTmp=true
-WorkingDirectory=/var/tmp
-
-SyslogIdentifier=update-spamhaus-lists
-ExecStart=/usr/bin/flock -x update-spamhaus-lists.lck \
-          /usr/local/bin/update-spamhaus-lists.sh
-
-[Install]
-WantedBy=multi-user.target
--- a/roles/common/files/update-spamhaus-lists.sh
+++ b/roles/common/files/update-spamhaus-lists.sh
@ -1,107 +0,0 @@
-#!/usr/bin/env bash
-#
-# update-spamhaus-lists.sh v0.0.5
-#
-# Download Spamhaus DROP lists and load them into firewalld ipsets. Should work
-# with both the iptables and nftables backends.
-# 
-# See: https://www.spamhaus.org/drop/
-#
-# Copyright (C) 2021 Alan Orth
-#
-# SPDX-License-Identifier: GPL-3.0-only
-
-# Exit on first error
-set -o errexit
-
-firewalld_ipsets=$(firewall-cmd --get-ipsets)
-xml_temp=$(mktemp)
-spamhaus_ipv4_ipset_path=/etc/firewalld/ipsets/spamhaus-ipv4.xml
-spamhaus_ipv6_ipset_path=/etc/firewalld/ipsets/spamhaus-ipv6.xml
-
-function download() {
-    echo "Downloading $1"
-    wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
-}
-
-download drop.txt
-download edrop.txt
-download dropv6.txt
-
-if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
-    echo "Processing IPv4 DROP lists"
-
-    # Extract all networks from drop.txt and edrop.txt, skipping blank lines and
-    # comments.
-    networks=$(cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//')
-
-    # If firewalld already has this ipset we should delete it first to emulate
-    # `ipset flush` (but I don't want to use that because newer hosts might be
-    # using nftables and firewalld will handle that for us).
-    if [[ "$firewalld_ipsets" =~ spamhaus-ipv4 ]]; then
-        echo "Deleting existing spamhaus-ipv4 ipset"
-        # This deletes the firewalld ipset XML file as well as the ipset itself
-        firewall-cmd --permanent --delete-ipset=spamhaus-ipv4
-    else
-        echo "Creating placeholder spamhaus-ipv4 ipset"
-        # Create a placeholder ipset so firewalld doesn't complain when we try
-        # to reload the ipset later after having added a new XML definition. I
-        # don't know why, but depending on the system state there may not be a
-        # ipset defined and firewalld errors on INVALID_IPSET.
-        firewall-cmd --permanent --new-ipset=spamhaus-ipv4 --type=hash:net --option=family=inet
-    fi
-
-    # I'm not proud of this, but writing the XML directly is WAY faster than
-    # using firewall-cmd to add each entry one by one (and we can't add from
-    # a file because many of our hosts are using old firewalld).
-    cat << XML_HEAD > "$xml_temp"
-<?xml version="1.0" encoding="utf-8"?>
-<ipset type="hash:net">
-  <option name="family" value="inet" />
-  <short>spamhaus-ipv4</short>
-  <description>Spamhaus DROP and EDROP lists (IPv4).</description>
-XML_HEAD
-
-    for network in $networks; do
-		echo "    <entry>$network</entry>" >> "$xml_temp"
-    done
-
-    echo "</ipset>" >> "$xml_temp"
-
-    install -m 0600 "$xml_temp" "$spamhaus_ipv4_ipset_path"
-fi
-
-if [[ -f "dropv6.txt" ]]; then
-    echo "Processing IPv6 DROP list"
-
-    networks=$(sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt)
-
-    if [[ "$firewalld_ipsets" =~ spamhaus-ipv6 ]]; then
-        echo "Deleting existing spamhaus-ipv6 ipset"
-        firewall-cmd --permanent --delete-ipset=spamhaus-ipv6
-    else
-        echo "Creating placeholder spamhaus-ipv6 ipset"
-        firewall-cmd --permanent --new-ipset=spamhaus-ipv6 --type=hash:net --option=family=inet6
-    fi
-
-    cat << XML_HEAD > "$xml_temp"
-<?xml version="1.0" encoding="utf-8"?>
-<ipset type="hash:net">
-  <option name="family" value="inet6" />
-  <short>spamhaus-ipv6</short>
-  <description>Spamhaus DROP lists (IPv6).</description>
-XML_HEAD
-
-    for network in $networks; do
-		echo "    <entry>$network</entry>" >> "$xml_temp"
-    done
-
-    echo "</ipset>" >> "$xml_temp"
-
-    install -m 0600 "$xml_temp" "$spamhaus_ipv6_ipset_path"
-fi
-
-echo "Reloading firewalld"
-firewall-cmd --reload
-
-rm -v drop.txt edrop.txt dropv6.txt "$xml_temp"
--- a/roles/common/files/update-spamhaus-lists.timer
+++ b/roles/common/files/update-spamhaus-lists.timer
@ -1,12 +0,0 @@
-[Unit]
-Description=Update Spamhaus lists
-
-[Timer]
-# Once a day at midnight
-OnCalendar=*-*-* 00:00:00
-# Add a random delay of 0–3600 seconds
-RandomizedDelaySec=3600
-Persistent=true
-
-[Install]
-WantedBy=timers.target
--- a/roles/common/files/update-spamhaus-nftables.service
+++ b/roles/common/files/update-spamhaus-nftables.service
@ -1,27 +0,0 @@
-[Unit]
-Description=Update Spamhaus lists
-# This service will fail if nftables is not running so we use Requires to make
-# sure that nftables is started.
-Requires=nftables.service
-# Make sure the network is up and nftables is started
-After=network-online.target nftables.service
-Wants=network-online.target update-spamhaus-nftables.timer
-
-[Service]
-# https://www.ctrl.blog/entry/systemd-service-hardening.html
-# Doesn't need access to /home or /root
-ProtectHome=true
-# Possibly only works on Ubuntu 18.04+
-ProtectKernelTunables=true
-ProtectSystem=full
-# Newer systemd can use ReadWritePaths to list files, but this works everywhere
-ReadWriteDirectories=/etc/nftables
-PrivateTmp=true
-WorkingDirectory=/var/tmp
-
-SyslogIdentifier=update-spamhaus-nftables
-ExecStart=/usr/bin/flock -x update-spamhaus-nftables.lck \
-          /usr/local/bin/update-spamhaus-nftables.sh
-
-[Install]
-WantedBy=multi-user.target
--- a/roles/common/files/update-spamhaus-nftables.sh
+++ b/roles/common/files/update-spamhaus-nftables.sh
@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-#
-# update-spamhaus-nftables.sh v0.0.1
-#
-# Download Spamhaus DROP lists and load them into nftables sets.
-# 
-# See: https://www.spamhaus.org/drop/
-#
-# Copyright (C) 2021 Alan Orth
-#
-# SPDX-License-Identifier: GPL-3.0-only
-
-# Exit on first error
-set -o errexit
-
-spamhaus_ipv4_set_path=/etc/nftables/spamhaus-ipv4.nft
-spamhaus_ipv6_set_path=/etc/nftables/spamhaus-ipv6.nft
-
-function download() {
-    echo "Downloading $1"
-    wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
-}
-
-download drop.txt
-download edrop.txt
-download dropv6.txt
-
-if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
-    echo "Processing IPv4 DROP lists"
-
-    spamhaus_ipv4_list_temp=$(mktemp)
-    spamhaus_ipv4_set_temp=$(mktemp)
-
-    # Extract all networks from drop.txt and edrop.txt, skipping blank lines and
-    # comments. Use aggregate-cidr-addresses.pl to merge overlapping IPv4 CIDR
-    # ranges to work around a firewalld bug.
-    #
-    # See: https://bugzilla.redhat.com/show_bug.cgi?id=1836571
-    cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' | aggregate-cidr-addresses.pl > "$spamhaus_ipv4_list_temp"
-
-    echo "Building spamhaus-ipv4 set"
-    cat << NFT_HEAD > "$spamhaus_ipv4_set_temp"
-#!/usr/sbin/nft -f
-
-define SPAMHAUS_IPV4 = {
-NFT_HEAD
-
-    while read -r network; do
-        # nftables doesn't mind if the last element in the set has a trailing
-        # comma so we don't need to do anything special here.
-        echo "$network," >> "$spamhaus_ipv4_set_temp"
-    done < $spamhaus_ipv4_list_temp
-
-    echo "}" >> "$spamhaus_ipv4_set_temp"
-
-    install -m 0600 "$spamhaus_ipv4_set_temp" "$spamhaus_ipv4_set_path"
-
-    rm -f "$spamhaus_ipv4_list_temp" "$spamhaus_ipv4_set_temp"
-fi
-
-if [[ -f "dropv6.txt" ]]; then
-    echo "Processing IPv6 DROP lists"
-
-    spamhaus_ipv6_list_temp=$(mktemp)
-    spamhaus_ipv6_set_temp=$(mktemp)
-
-    sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt > "$spamhaus_ipv6_list_temp"
-
-    echo "Building spamhaus-ipv6 set"
-    cat << NFT_HEAD > "$spamhaus_ipv6_set_temp"
-#!/usr/sbin/nft -f
-
-define SPAMHAUS_IPV6 = {
-NFT_HEAD
-
-    while read -r network; do
-        echo "$network," >> "$spamhaus_ipv6_set_temp"
-    done < $spamhaus_ipv6_list_temp
-
-    echo "}" >> "$spamhaus_ipv6_set_temp"
-
-    install -m 0600 "$spamhaus_ipv6_set_temp" "$spamhaus_ipv6_set_path"
-
-    rm -f "$spamhaus_ipv6_list_temp" "$spamhaus_ipv6_set_temp"
-fi
-
-echo "Reloading nftables"
-# The spamhaus nftables sets are included by nftables.conf
-/usr/sbin/nft -f /etc/nftables.conf
-
-rm -v drop.txt edrop.txt dropv6.txt
--- a/roles/common/files/update-spamhaus-nftables.timer
+++ b/roles/common/files/update-spamhaus-nftables.timer
@ -1,12 +0,0 @@
-[Unit]
-Description=Update Spamhaus lists
-
-[Timer]
-# Once a day at midnight
-OnCalendar=*-*-* 00:00:00
-# Add a random delay of 0–3600 seconds
-RandomizedDelaySec=3600
-Persistent=true
-
-[Install]
-WantedBy=timers.target
--- a/roles/common/handlers/main.yml
+++ b/roles/common/handlers/main.yml
@ -15,6 +15,3 @@

 - name: reload systemd
  systemd: daemon_reload=yes
-
- name: restart nftables
-  systemd: name=nftables state=restarted
--- a/roles/common/tasks/fail2ban.yml
+++ b/roles/common/tasks/fail2ban.yml
@ -4,11 +4,6 @@
  template: src=etc/fail2ban/jail.d/sshd.local.j2 dest=/etc/fail2ban/jail.d/sshd.local owner=root mode=0644
  notify: restart fail2ban

- name: Configure fail2ban nginx filter
-  when: "extra_fail2ban_filters is defined and 'nginx' in extra_fail2ban_filters"
-  template: src=etc/fail2ban/jail.d/nginx.local.j2 dest=/etc/fail2ban/jail.d/nginx.local owner=root mode=0644
-  notify: restart fail2ban
-
 - name: Create fail2ban service override directory
  file: path=/etc/systemd/system/fail2ban.service.d state=directory owner=root mode=0755

--- a/roles/common/tasks/firewall_Alpine.yml
+++ b/roles/common/tasks/firewall_Alpine.yml
@ -0,0 +1,15 @@
+---
+# TODO: configure awall (ipsets?)
+# TODO: configure fail2ban
+
+- block:
+  - name: Set Alpine firewall packages
+    set_fact:
+      alpine_firewall_packages:
+        - awall
+        - fail2ban
+
+  - name: Install Alpine firewall packages
+    apk: name={{ alpine_firewall_packages }} state=present
+
+# vim: set sw=2 ts=2:
--- a/roles/common/tasks/firewall_Debian.yml
+++ b/roles/common/tasks/firewall_Debian.yml
@ -1,9 +1,7 @@
 ---
-# Debian 11 will use nftables directly, with no firewalld.

 - block:
  - name: Set Debian firewall packages
-    when: ansible_distribution_major_version is version('10', '<=')
    set_fact:
      debian_firewall_packages:
        - firewalld
@ -11,43 +9,12 @@
        - fail2ban
        - python3-systemd # for fail2ban systemd backend

-  - name: Set Debian firewall packages
-    when: ansible_distribution_major_version is version('11', '>=')
-    set_fact:
-      debian_firewall_packages:
-        - fail2ban
-        - libnet-ip-perl # for aggregate-cidr-addresses.pl
-        - nftables
-        - python3-systemd
-        - curl # for nftables update scripts
-
-  - name: Install firewall packages
-    apt: pkg={{ debian_firewall_packages }} state=present cache_valid_time=3600
-
-  - name: Copy nftables.conf
-    when: ansible_distribution_major_version is version('11', '>=')
-    template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
-    notify:
-      - restart nftables
-
-  - name: Create /etc/nftables extra config directory
-    when: ansible_distribution_major_version is version('11', '>=')
-    file: path=/etc/nftables state=directory owner=root mode=0755
-
-  - name: Copy extra nftables configuration files
-    when: ansible_distribution_major_version is version('11', '>=')
-    copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
-    loop:
-      - { src: "spamhaus-ipv4.nft", force: "no" }
-      - { src: "spamhaus-ipv6.nft", force: "no" }
-      - { src: "abusech-ipv4.nft", force: "no" }
-      - { src: "abuseipdb-ipv4.nft", force: "yes" }
-      - { src: "abuseipdb-ipv6.nft", force: "yes" }
-    notify:
-      - restart nftables
+  - name: Install firewalld and deps
+    when: ansible_distribution_major_version is version('9', '>=')
+    apt: pkg={{ debian_firewall_packages }} state=present

  - name: Use iptables backend in firewalld
-    when: ansible_distribution_major_version is version('10', '==')
+    when: ansible_distribution_major_version is version('10', '>=')
    lineinfile:
      dest: /etc/firewalld/firewalld.conf
      regexp: '^FirewallBackend=nftables$'
@ -59,7 +26,7 @@
 # backend. Using individual calls seems to work around it.
 # See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931722
  - name: Use individual iptables calls
-    when: ansible_distribution_major_version is version('10', '==')
+    when: ansible_distribution_major_version is version('10', '>=')
    lineinfile:
      dest: /etc/firewalld/firewalld.conf
      regexp: '^IndividualCalls=no$'
@ -68,79 +35,24 @@
      - restart firewalld

  - name: Copy firewalld public zone file
-    when: ansible_distribution_major_version is version('10', '<=')
+    when: ansible_distribution_major_version is version('9', '>=')
    template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600

  - name: Format public.xml firewalld zone file
-    when: ansible_distribution_major_version is version('10', '<=')
+    when: ansible_distribution_major_version is version('9', '>=')
    command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
    notify:
      - restart firewalld

-  - name: Copy firewalld ipsets of abusive IPs
-    when: ansible_distribution_major_version is version('10', '<=')
+  - name: Copy ipsets of abusive IPs
+    when: ansible_distribution_major_version is version('9', '>=')
    copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
    loop:
      - abusers-ipv4.xml
      - abusers-ipv6.xml
-      - spamhaus-ipv4.xml
-      - spamhaus-ipv6.xml
    notify:
      - restart firewalld

-  - name: Copy Spamhaus firewalld update script
-    when: ansible_distribution_version is version('10', '<=')
-    copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
-
-  - name: Copy Spamhaus firewalld systemd units
-    when: ansible_distribution_version is version('10', '<=')
-    copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-    loop:
-        - update-spamhaus-lists.service
-        - update-spamhaus-lists.timer
-    register: spamhaus_firewalld_systemd_units
-
-  - name: Copy Spamhaus nftables update scripts
-    when: ansible_distribution_version is version('11', '>=')
-    copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
-    loop:
-      - update-spamhaus-nftables.sh
-      - aggregate-cidr-addresses.pl
-      - update-abusech-nftables.sh
-
-  - name: Copy nftables systemd units
-    when: ansible_distribution_version is version('11', '>=')
-    copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-    loop:
-        - update-spamhaus-nftables.service
-        - update-spamhaus-nftables.timer
-        - update-abusech-nftables.service
-        - update-abusech-nftables.timer
-    register: nftables_systemd_units
-
-  # need to reload to pick up service/timer/environment changes
-  - name: Reload systemd daemon
-    systemd: daemon_reload=yes
-    when: spamhaus_firewalld_systemd_units is changed or
-          nftables_systemd_units is changed
-
-  - name: Start and enable Spamhaus firewalld update timer
-    when: ansible_distribution_version is version('10', '<=')
-    systemd: name=update-spamhaus-lists.timer state=started enabled=yes
-    notify:
-      - restart firewalld
-
-  - name: Start and enable nftables update timers
-    when: ansible_distribution_version is version('11', '>=')
-    systemd: name={{ item }} state=started enabled=yes
-    loop:
-      - update-spamhaus-nftables.timer
-      - update-abusech-nftables.timer
-
-  - name: Start and enable nftables
-    when: ansible_distribution_major_version is version('11', '>=')
-    systemd: name=nftables state=started enabled=yes
-
  - include_tasks: fail2ban.yml
    when: ansible_distribution_major_version is version('9', '>=')
  tags: firewall
--- a/roles/common/tasks/firewall_Ubuntu.yml
+++ b/roles/common/tasks/firewall_Ubuntu.yml
@ -1,11 +1,7 @@
 ---
-# Ubuntu 20.04 will use nftables directly, with no firewalld.
-# Ubuntu 18.04 will use firewalld with the nftables backend.
-# Ubuntu 16.04 will use firewalld with the iptables backend.

 - block:
  - name: Set Ubuntu firewall packages
-    when: ansible_distribution_version is version('20.04', '<')
    set_fact:
      ubuntu_firewall_packages:
        - firewalld
@ -13,119 +9,54 @@
        - fail2ban
        - python3-systemd # for fail2ban systemd backend

-  - name: Set Ubuntu firewall packages
-    when: ansible_distribution_version is version('20.04', '>=')
-    set_fact:
-      ubuntu_firewall_packages:
-        - fail2ban
-        - libnet-ip-perl # for aggregate-cidr-addresses.pl
-        - nftables
-        - python3-systemd
-        - curl # for nftables update scripts
-
-  - name: Install firewall packages
-    apt: pkg={{ ubuntu_firewall_packages }} state=present cache_valid_time=3600
+  - name: Install firewalld and deps
+    when: ansible_distribution_version is version('16.04', '>=')
+    apt: pkg={{ ubuntu_firewall_packages }} state=present

  - name: Remove ufw
    when: ansible_distribution_version is version('16.04', '>=')
    apt: pkg=ufw state=absent

-  - name: Copy nftables.conf
-    when: ansible_distribution_version is version('20.04', '>=')
-    template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
-    notify:
-      - restart nftables
+  # I'm not sure why, but you can use firewalld with the nftables backend even
+  # if nftables itself is not installed. In that case the only way to see the
+  # currently active rules is with firewall-cmd. I prefer installing nftables
+  # so that we can have somewhat of a parallel with iptables:
+  #
+  #   nft list ruleset
+  #
+  # See: https://firewalld.org/2018/07/nftables-backend
+  - name: Install nftables
+    when: ansible_distribution_version is version('20.04', '==')
+    apt: pkg=nftables state=present

-  - name: Create /etc/nftables extra config directory
-    when: ansible_distribution_version is version('20.04', '>=')
-    file: path=/etc/nftables state=directory owner=root mode=0755
-
-  - name: Copy extra nftables configuration files
-    when: ansible_distribution_version is version('20.04', '>=')
-    copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
-    loop:
-      - { src: "spamhaus-ipv4.nft", force: "no" }
-      - { src: "spamhaus-ipv6.nft", force: "no" }
-      - { src: "abusech-ipv4.nft", force: "no" }
-      - { src: "abuseipdb-ipv4.nft", force: "yes" }
-      - { src: "abuseipdb-ipv6.nft", force: "yes" }
+  - name: Use nftables backend in firewalld
+    when: ansible_distribution_version is version('20.04', '==')
+    lineinfile:
+      dest: /etc/firewalld/firewalld.conf
+      regexp: '^FirewallBackend=iptables$'
+      line: 'FirewallBackend=nftables'
    notify:
-      - restart nftables
+      - restart firewalld

  - name: Copy firewalld public zone file
-    when: ansible_distribution_version is version('18.04', '<=')
+    when: ansible_distribution_version is version('16.04', '>=')
    template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600

  - name: Format public.xml firewalld zone file
-    when: ansible_distribution_version is version('18.04', '<=')
+    when: ansible_distribution_version is version('16.04', '>=')
    command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
    notify:
      - restart firewalld

-  - name: Copy firewalld ipsets of abusive IPs
-    when: ansible_distribution_version is version('18.04', '<=')
+  - name: Copy ipsets of abusive IPs
+    when: ansible_distribution_version is version('16.04', '>=')
    copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
    loop:
      - abusers-ipv4.xml
      - abusers-ipv6.xml
-      - spamhaus-ipv4.xml
-      - spamhaus-ipv6.xml
    notify:
      - restart firewalld

-  - name: Copy Spamhaus firewalld update script
-    when: ansible_distribution_version is version('18.04', '<=')
-    copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
-
-  - name: Copy Spamhaus firewalld systemd units
-    when: ansible_distribution_version is version('18.04', '<=')
-    copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-    loop:
-        - update-spamhaus-lists.service
-        - update-spamhaus-lists.timer
-    register: spamhaus_firewalld_systemd_units
-
-  - name: Copy nftables update scripts
-    when: ansible_distribution_version is version('20.04', '>=')
-    copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
-    loop:
-      - update-spamhaus-nftables.sh
-      - aggregate-cidr-addresses.pl
-      - update-abusech-nftables.sh
-
-  - name: Copy nftables systemd units
-    when: ansible_distribution_version is version('20.04', '>=')
-    copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-    loop:
-        - update-spamhaus-nftables.service
-        - update-spamhaus-nftables.timer
-        - update-abusech-nftables.service
-        - update-abusech-nftables.timer
-    register: nftables_systemd_units
-
-  # need to reload to pick up service/timer/environment changes
-  - name: Reload systemd daemon
-    systemd: daemon_reload=yes
-    when: spamhaus_firewalld_systemd_units is changed or
-          nftables_systemd_units is changed
-
-  - name: Start and enable Spamhaus firewalld update timer
-    when: ansible_distribution_version is version('18.04', '<=')
-    systemd: name=update-spamhaus-lists.timer state=started enabled=yes
-    notify:
-      - restart firewalld
-
-  - name: Start and enable nftables update timers
-    when: ansible_distribution_version is version('20.04', '>=')
-    systemd: name={{ item }} state=started enabled=yes
-    loop:
-      - update-spamhaus-nftables.timer
-      - update-abusech-nftables.timer
-
-  - name: Start and enable nftables
-    when: ansible_distribution_version is version('20.04', '>=')
-    systemd: name=nftables state=started enabled=yes
-
  - include_tasks: fail2ban.yml
    when: ansible_distribution_version is version('16.04', '>=')
  tags: firewall
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@ -17,6 +17,11 @@
  when: ansible_distribution == 'Ubuntu'
  tags: packages

+- name: Install common packages
+  include_tasks: packages_Alpine.yml
+  when: ansible_distribution == 'Alpine'
+  tags: packages
+
 - name: Configure firewall
  include_tasks: firewall_Debian.yml
  when: ansible_distribution == 'Debian'
--- a/roles/common/tasks/ntp.yml
+++ b/roles/common/tasks/ntp.yml
@ -1,27 +1,23 @@
 ---
 # Hosts running Ubuntu 16.04+ and Debian 9+ use systemd init system and should
-# use systemd-timesyncd as a network time client instead of the standalone ntp
-# client.
+# use timedatectl as a network time client instead of the standalone ntp client.
+# Alpine can use chrony.

 - name: Set timezone
  when: timezone is defined and ansible_service_mgr == 'systemd'
  command: /usr/bin/timedatectl set-timezone {{ timezone }}
  tags: timezone

-# Apparently some cloud images don't have this installed by default. From what
-# I can see on existing servers, systemd-timesyncd is a standalone package on
-# Ubuntu 20.04 and Debian 11.
- name: Install systemd-timesyncd
-  when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or
-        (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
-  apt: name=systemd-timesyncd state=present cache_valid_time=3600
-
 - name: Start and enable systemd's NTP client
  when: ansible_service_mgr == 'systemd'
  systemd: name=systemd-timesyncd state=started enabled=yes

 - name: Uninstall ntp on modern Ubuntu/Debian
-  apt: name=ntp state=absent
+  apt: name=ntp state=absent update_cache=yes
  when: ansible_service_mgr == 'systemd'

+- name: Install chronyd on Alpine
+  apt: name=chrony state=present
+  when: ansible_distribution == 'Alpine'
+
 # vim: set ts=2 sw=2:
--- a/roles/common/tasks/packages_Alpine.yml
+++ b/roles/common/tasks/packages_Alpine.yml
@ -0,0 +1,28 @@
+---
+# requires: ansible-galaxy collection install community.general
+# TODO: configure tarsnap
+
+- block:
+  - name: Upgrade base OS
+    apk: upgrade=yes update_cache=yes
+
+  - name: Set Alpine base packages
+    set_fact:
+      alpine_base_packages:
+      - git
+      - tmux
+      - htop
+      - strace
+      - mosh
+      - vim
+      - unzip
+      - zstd
+
+  - name: Install Alpine base packages
+    apk: name={{ alpine_base_packages }} state=present update_cache=yes
+
+  #- name: Install tarsnap
+  #  import_tasks: tarsnap.yml
+  tags: packages
+
+# vim: set sw=2 ts=2:
--- a/roles/common/tasks/packages_Debian.yml
+++ b/roles/common/tasks/packages_Debian.yml
@ -3,13 +3,11 @@
 - block:
  - name: Configure apt mirror
    template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
-    when: ansible_architecture != 'armv7l'

  - name: Set fact for base packages
    set_fact:
      base_packages:
        - git
-        - git-lfs
        - tmux
        - iotop
        - htop
@ -26,7 +24,7 @@
        - zstd

  - name: Install base packages
-    apt: name={{ base_packages }} state=present cache_valid_time=3600
+    apt: name={{ base_packages }} state=present update_cache=yes cache_valid_time=3600

  - name: Configure cron-apt
    import_tasks: cron-apt.yml
--- a/roles/common/tasks/packages_Ubuntu.yml
+++ b/roles/common/tasks/packages_Ubuntu.yml
@ -6,13 +6,12 @@
    when: ansible_architecture != 'armv7l'

  - name: Upgrade base OS
-    apt: upgrade=dist cache_valid_time=3600
+    apt: upgrade=dist update_cache=yes cache_valid_time=3600

  - name: Set Ubuntu base packages
    set_fact:
      ubuntu_base_packages:
      - git
-      - git-lfs
      - tmux
      - iotop
      - htop
@ -28,7 +27,7 @@
      - zstd

  - name: Install base packages
-    apt: pkg={{ ubuntu_base_packages }} state=present cache_valid_time=3600
+    apt: pkg={{ ubuntu_base_packages }} state=present update_cache=yes cache_valid_time=3600

  # We have to remove snaps one by one in a specific order because some depend
  # on others. Only after that can we remove the corresponding system packages.
--- a/roles/common/tasks/tarsnap.yml
+++ b/roles/common/tasks/tarsnap.yml
@ -5,7 +5,7 @@
  when: ansible_architecture != 'armv7l'

 - name: Add GPG key for Tarsnap
-  apt_key: id=0xBF75EEAB040E447C url=https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc state=present
+  apt_key: id=0xFC72A10BF6B692AA url=https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc state=present
  register: add_tarsnap_apt_key

 - name: Update apt cache
--- a/roles/common/templates/etc/fail2ban/jail.d/nginx.local.j2
+++ b/roles/common/templates/etc/fail2ban/jail.d/nginx.local.j2
@ -1,17 +0,0 @@
-[nginx]
-enabled   = true
-# See: /etc/fail2ban/filter.d/nginx-botsearch.conf
-filter    = nginx-botsearch
-{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
-# Integrate with nftables
-banaction=nftables[type=allports]
-{% else %}
-# Integrate with firewalld and ipsets
-banaction = firewallcmd-ipset
-{% endif %}
-logpath   = /var/log/nginx/*-access.log
-# Try to find a non-existent wp-login.php once and get banned. Tough luck.
-maxretry  = 1
-findtime  = {{ fail2ban_findtime }}
-bantime   = {{ fail2ban_bantime }}
-ignoreip  = {{ fail2ban_ignoreip }}
--- a/roles/common/templates/etc/fail2ban/jail.d/sshd.local.j2
+++ b/roles/common/templates/etc/fail2ban/jail.d/sshd.local.j2
@ -2,13 +2,8 @@
 enabled   = true
 # See: /etc/fail2ban/filter.d/sshd.conf
 filter    = sshd
-{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
-# Integrate with nftables
-banaction=nftables[type=allports]
-{% else %}
 # Integrate with firewalld and ipsets
 banaction = firewallcmd-ipset
-{% endif %}
 backend   = systemd
 maxretry  = {{ fail2ban_maxretry }}
 findtime  = {{ fail2ban_findtime }}
--- a/roles/common/templates/etc/systemd/system/fail2ban.service.d/override.conf.j2
+++ b/roles/common/templates/etc/systemd/system/fail2ban.service.d/override.conf.j2
@ -2,14 +2,14 @@
 PrivateDevices=yes
 PrivateTmp=yes
 ProtectHome=read-only
-{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
+{% if ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=') %}
 ProtectSystem=strict
 {% else %}
 {# Older systemd versions don't have ProtectSystem=strict #}
 ProtectSystem=full
 {% endif %}
 NoNewPrivileges=yes
-{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
+{% if ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=') %}
 ReadWritePaths=-/var/run/fail2ban
 ReadWritePaths=-/var/lib/fail2ban
 ReadWritePaths=-/var/log/fail2ban.log
--- a/roles/common/templates/nftables.conf.j2
+++ b/roles/common/templates/nftables.conf.j2
@ -1,120 +0,0 @@
-#!/usr/sbin/nft -f
-#
-# Initially based on: https://wiki.nftables.org/wiki-nftables/index.php/Simple_ruleset_for_a_server
-#
-
-flush ruleset
-
-# Lists updated daily by update-spamhaus-nftables.sh
-include "/etc/nftables/spamhaus-ipv4.nft"
-include "/etc/nftables/spamhaus-ipv6.nft"
-
-# Lists updated monthly (manually)
-include "/etc/nftables/abuseipdb-ipv4.nft"
-include "/etc/nftables/abuseipdb-ipv6.nft"
-
-# Lists updated daily by update-abusech-nftables.sh
-include "/etc/nftables/abusech-ipv4.nft"
-
-# Notes:
-#   - tables hold chains, chains hold rules
-#   - inet is for both ipv4 and ipv6
-table inet filter {
-    set spamhaus-ipv4 {
-        type ipv4_addr
-        # if the set contains prefixes we need to use the interval flag
-        flags interval
-        elements = $SPAMHAUS_IPV4
-    }
-
-    set spamhaus-ipv6 {
-        type ipv6_addr
-        flags interval
-        elements = $SPAMHAUS_IPV6
-    }
-
-    set abusech-ipv4 {
-        type ipv4_addr
-        elements = $ABUSECH_IPV4
-    }
-
-    set abuseipdb-ipv4 {
-        type ipv4_addr
-        elements = $ABUSEIPDB_IPV4
-    }
-
-    set abuseipdb-ipv6 {
-        type ipv6_addr
-        elements = $ABUSEIPDB_IPV6
-    }
-
-    chain input {
-        type filter hook input priority 0;
-
-        ct state {established, related} accept comment "Allow traffic from established and related packets"
-
-        ct state invalid counter drop comment "Early drop of invalid connections"
-
-        ip saddr @spamhaus-ipv4 counter drop comment "Early drop of incoming packets matching spamhaus-ipv4 list"
-        ip6 saddr @spamhaus-ipv6 counter drop comment "Early drop of incoming packets matching spamhaus-ipv6 list"
-
-        ip saddr @abusech-ipv4 counter drop comment "Early drop of packets matching abusech-ipv4 list"
-
-        ip saddr @abuseipdb-ipv4 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv4 list"
-        ip6 saddr @abuseipdb-ipv6 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv6 list"
-
-        iifname lo accept comment "Allow from loopback"
-
-        ip protocol icmp limit rate 4/second accept comment "Allow ICMP"
-        ip6 nexthdr ipv6-icmp limit rate 4/second accept comment "Allow IPv6 ICMP"
-        ip protocol igmp limit rate 4/second accept comment "Allow IGMP"
-
-        {# SSH rules #}
-        ip saddr 0.0.0.0/0 ct state new tcp dport 22 counter accept comment "Allow SSH"
-        ip6 saddr ::/0 ct state new tcp dport 22 counter accept comment "Allow SSH"
-
-        {# Web rules #}
-        {% if 'web' in group_names %}
-        ip saddr 0.0.0.0/0 ct state new tcp dport 80 counter accept comment "Allow HTTP"
-        ip saddr 0.0.0.0/0 ct state new tcp dport 443 counter accept comment "Allow HTTPS"
-        ip6 saddr ::/0 ct state new tcp dport 80 counter accept comment "Allow HTTP"
-        ip6 saddr ::/0 ct state new tcp dport 443 counter accept comment "Allow HTTPS"
-        {% endif %}
-
-        ip saddr 0.0.0.0/0 ct state new udp dport 60001 counter accept comment "Allow mosh"
-        ip saddr 0.0.0.0/0 ct state new udp dport 60002 counter accept comment "Allow mosh"
-        ip saddr 0.0.0.0/0 ct state new udp dport 60003 counter accept comment "Allow mosh"
-        ip6 saddr ::/0 ct state new udp dport 60001 counter accept comment "Allow mosh"
-        ip6 saddr ::/0 ct state new udp dport 60002 counter accept comment "Allow mosh"
-        ip6 saddr ::/0 ct state new udp dport 60003 counter accept comment "Allow mosh"
-
-        {# Extra rules #}
-        {% if extra_iptables_rules is defined %}
-        {% for rule in extra_iptables_rules %}
-        ip saddr {{ ghetto_ipsets[rule.acl].src }} ct state new {{ rule.protocol }} dport {{ rule.port }} counter accept
-
-        {% if ghetto_ipsets[rule.acl].ipv6src is defined %}
-        ip6 saddr {{ ghetto_ipsets[rule.acl].ipv6src }} ct state new {{ rule.protocol }} dport {{ rule.port }} counter accept
-        {% endif %}
-
-        {% endfor %}
-        {% endif %}
-
-        # everything else
-        reject with icmpx type port-unreachable
-    }
-    chain forward {
-        type filter hook forward priority 0;
-    }
-    chain output {
-        type filter hook output priority 0;
-
-        ip daddr @spamhaus-ipv4 counter drop comment "Drop outgoing packets matching spamhaus-ipv4 list"
-        ip6 daddr @spamhaus-ipv6 counter drop comment "Drop outgoing packets matching spamhaus-ipv6 list"
-
-        ip daddr @abusech-ipv4 counter drop comment "Drop outgoing packets matching abusech-ipv4 list"
-
-        ip daddr @abuseipdb-ipv4 counter drop comment "Drop outgoing packets matching abuseipdb-ipv4 list"
-        ip6 daddr @abuseipdb-ipv6 counter drop comment "Drop outgoing packets matching abuseipdb-ipv6 list"
-    }
-}
--- a/roles/common/templates/public.xml.j2
+++ b/roles/common/templates/public.xml.j2
@ -69,13 +69,4 @@
      <source ipset="abusers-ipv6"/>
      <drop/>
    </rule>
-    <rule>
-      <source ipset="spamhaus-ipv4"/>
-      <drop/>
-    </rule>
-    <rule>
-      <source ipset="spamhaus-ipv6"/>
-      <drop/>
-    </rule>
-
 </zone>
--- a/roles/common/templates/sources.list.j2
+++ b/roles/common/templates/sources.list.j2
@ -9,7 +9,7 @@ deb http://security.ubuntu.com/ubuntu/ {{ ansible_distribution_release }}-securi
 {% set apt_mirror    = apt_mirror | default('deb.debian.org') %}
 deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }} main contrib non-free

-deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main contrib non-free
+deb http://security.debian.org/debian-security {{ ansible_distribution_release }}/updates main contrib non-free

 deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }}-updates main contrib non-free

--- a/roles/common/templates/sshd_config_Debian-11.j2
+++ b/roles/common/templates/sshd_config_Debian-11.j2
@ -1,138 +0,0 @@
-#	$OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
-
-# This is the sshd server system-wide configuration file.  See
-# sshd_config(5) for more information.
-
-# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
-
-# The strategy used for options in the default sshd_config shipped with
-# OpenSSH is to specify options with their default value where
-# possible, but leave them commented.  Uncommented options override the
-# default value.
-
-Include /etc/ssh/sshd_config.d/*.conf
-
-#Port 22
-#AddressFamily any
-#ListenAddress 0.0.0.0
-#ListenAddress ::
-
-#HostKey /etc/ssh/ssh_host_rsa_key
-HostKey /etc/ssh/ssh_host_ed25519_key
-
-# Ciphers and keying
-#RekeyLimit default none
-
-# Logging
-#SyslogFacility AUTH
-# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear audit track of which key was using to log in.
-LogLevel VERBOSE
-
-# Authentication:
-
-#LoginGraceTime 2m
-PermitRootLogin prohibit-password
-#StrictModes yes
-MaxAuthTries 4
-#MaxSessions 10
-
-#PubkeyAuthentication yes
-
-# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
-# but this is overridden so installations will only check .ssh/authorized_keys
-AuthorizedKeysFile	.ssh/authorized_keys
-
-#AuthorizedPrincipalsFile none
-
-#AuthorizedKeysCommand none
-#AuthorizedKeysCommandUser nobody
-
-# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
-#HostbasedAuthentication no
-# Change to yes if you don't trust ~/.ssh/known_hosts for
-# HostbasedAuthentication
-#IgnoreUserKnownHosts no
-# Don't read the user's ~/.rhosts and ~/.shosts files
-#IgnoreRhosts yes
-
-# To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
-#PermitEmptyPasswords no
-
-# Change to yes to enable challenge-response passwords (beware issues with
-# some PAM modules and threads)
-ChallengeResponseAuthentication no
-
-# Kerberos options
-#KerberosAuthentication no
-#KerberosOrLocalPasswd yes
-#KerberosTicketCleanup yes
-#KerberosGetAFSToken no
-
-# GSSAPI options
-#GSSAPIAuthentication no
-#GSSAPICleanupCredentials yes
-#GSSAPIStrictAcceptorCheck yes
-#GSSAPIKeyExchange no
-
-# Set this to 'yes' to enable PAM authentication, account processing,
-# and session processing. If this is enabled, PAM authentication will
-# be allowed through the ChallengeResponseAuthentication and
-# PasswordAuthentication.  Depending on your PAM configuration,
-# PAM authentication via ChallengeResponseAuthentication may bypass
-# the setting of "PermitRootLogin without-password".
-# If you just want the PAM account and session checks to run without
-# PAM authentication, then enable this but set PasswordAuthentication
-# and ChallengeResponseAuthentication to 'no'.
-UsePAM yes
-
-#AllowAgentForwarding yes
-#AllowTcpForwarding yes
-#GatewayPorts no
-X11Forwarding no
-#X11DisplayOffset 10
-#X11UseLocalhost yes
-#PermitTTY yes
-PrintMotd no
-#PrintLastLog yes
-#TCPKeepAlive yes
-#PermitUserEnvironment no
-#Compression delayed
-#ClientAliveInterval 0
-#ClientAliveCountMax 3
-#UseDNS no
-#PidFile /var/run/sshd.pid
-#MaxStartups 10:30:100
-#PermitTunnel no
-#ChrootDirectory none
-#VersionAddendum none
-
-# no default banner path
-#Banner none
-
-# Allow client to pass locale environment variables
-AcceptEnv LANG LC_*
-
-# override default of no subsystems
-Subsystem	sftp	/usr/lib/openssh/sftp-server
-
-# Example of overriding settings on a per-user basis
-#Match User anoncvs
-#	X11Forwarding no
-#	AllowTcpForwarding no
-#	PermitTTY no
-#	ForceCommand cvs server
- 
-# Based on the ssh-audit profile for OpenSSH 8.4, but with but with all algos
-# with less than 256 bits removed, as NSA's Suite B removed them years ago and
-# the new (2018) CNSA suite is 256 bits and up.
-#
-# See: https://github.com/jtesta/ssh-audit/blob/master/src/ssh_audit/policy.py
-# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
-KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
-
-# only allow shell access by provisioning user
-AllowUsers {{ provisioning_user.name }}
--- a/roles/common/templates/sshd_config_Ubuntu-20.04.j2
+++ b/roles/common/templates/sshd_config_Ubuntu-20.04.j2
@ -128,8 +128,8 @@ PasswordAuthentication yes
 # ... but with ciphers and MACs with < 256 bits removed, as NSA's Suite B now
 # does away with these! See: https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
-KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
+KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256

 {% if ssh_allowed_users is defined and ssh_allowed_users %}
 # Is there a list of allowed users?
--- a/roles/mariadb/defaults/main.yml
+++ b/roles/mariadb/defaults/main.yml
@ -17,7 +17,7 @@ innodb_buffer_pool_size: 256M
 # Ansible 2.7.x with PyMySQL seems to default to TCP connection so we should
 # force it to use a Unix socket.
 # See: https://github.com/ansible/ansible/issues/47736
-mariadb_login_unix_socket: /run/mysqld/mysqld.sock
+mariadb_login_unix_socket: /var/run/mysqld/mysqld.sock

 # default is 100 but the max I've seen used is 5, so let's reduce it
 max_connections: 33
--- a/roles/mariadb/tasks/main.yml
+++ b/roles/mariadb/tasks/main.yml
@ -29,27 +29,29 @@
    - restart mariadb
  tags: mariadb

-# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_user_module.html
+# 'localhost' needs to be the last item for idempotency, see
+# https://docs.ansible.com/ansible/latest/mysql_user_module.html
 - name: Update MariaDB root password for all root accounts
  mysql_user: name=root host={{ item }} password={{ mariadb_root_password }} login_unix_socket={{ mariadb_login_unix_socket }}
  loop:
+    - "{{ inventory_hostname }}"
    - 127.0.0.1
    - ::1
+    - localhost
  tags: mariadb

 - name: Create .my.conf file with root credentials
  template: src=.my.cnf.j2 dest=/root/.my.cnf owner=root mode=0600
  tags: mariadb

-# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_db_module.html
 - name: Create MariaDB database(s)
-  mysql_db: db={{ item.name }} state=present encoding=utf8mb4 login_unix_socket={{ mariadb_login_unix_socket }}
+  mysql_db: db={{ item.name }} state=present encoding=utf8mb4
  loop: "{{ mariadb_databases }}"
  when: mariadb_databases is defined
  tags: mariadb

 - name: Create MariaDB user(s)
-  mysql_user: name={{ item.user }} password={{ item.pass }} priv={{ item.name }}.*:ALL host=127.0.0.1 state=present login_unix_socket={{ mariadb_login_unix_socket }}
+  mysql_user: name={{ item.user }} password={{ item.pass }} priv={{ item.name }}.*:ALL host=127.0.0.1 state=present
  loop: "{{ mariadb_databases }}"
  when: mariadb_databases is defined
  tags: mariadb
--- a/roles/mariadb/templates/my.cnf.j2
+++ b/roles/mariadb/templates/my.cnf.j2
@ -19,14 +19,14 @@
 # Remember to edit /etc/mysql/debian.cnf when changing the socket location.
 [client]
 port		= 3306
-socket		= /run/mysqld/mysqld.sock
+socket		= /var/run/mysqld/mysqld.sock

 # Here is entries for some specific programs
 # The following values assume you have at least 32M ram

 # This was formally known as [safe_mysqld]. Both versions are currently parsed.
 [mysqld_safe]
-socket		= /run/mysqld/mysqld.sock
+socket		= /var/run/mysqld/mysqld.sock
 nice		= 0

 [mysqld]
@ -34,8 +34,8 @@ nice		= 0
 # * Basic Settings
 #
 user		= mysql
-pid-file	= /run/mysqld/mysqld.pid
-socket		= /run/mysqld/mysqld.sock
+pid-file	= /var/run/mysqld/mysqld.pid
+socket		= /var/run/mysqld/mysqld.sock
 port		= 3306
 basedir		= /usr
 datadir		= /var/lib/mysql
--- a/roles/nginx/defaults/main.yml
+++ b/roles/nginx/defaults/main.yml
@ -20,25 +20,18 @@ nginx_ssl_protocols: 'TLSv1.2 TLSv1.3'
 # See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
 nginx_ssl_stapling_resolver: '1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]'

-# HTTP Strict-Transport-Security header, recommended by Google to be ~1 year
-# in seconds, see: https://hstspreload.org/
-nginx_hsts_max_age: 31536000
-
-# install acme.sh?
+# install certbot + dependencies?
 # True unless you're in development and using "localhost" + snakeoil certs
 use_letsencrypt: True

 # Directory root for Let's Encrypt certs
-letsencrypt_root: /etc/ssl
+letsencrypt_root: /etc/letsencrypt/live

-# Location where to save initial acme.sh script. After installation the script
-# will automatically create its home in the /root/.acme.sh directory (including
-# a copy of the script itself).
-letsencrypt_acme_script: /root/acme.sh
-letsencrypt_acme_home: /root/.acme.sh
+# Location of Let's Encrypt's certbot script
+letsencrypt_certbot_dest: /opt/certbot-auto

-# stable is 1.20.x
-# mainline is 1.21.x
+# stable is 1.18.x
+# mainline is 1.19.x
 nginx_version: mainline

 # vim: set ts=2 sw=2:
--- a/roles/nginx/files/extra-security.conf
+++ b/roles/nginx/files/extra-security.conf
@ -15,6 +15,3 @@ add_header X-XSS-Protection "1; mode=block" always;
 # CSP can be quite difficult to configure, and cause real issues if you get it wrong
 # There is website that helps you generate a policy here http://cspisawesome.com/
 # add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' https://www.google-analytics.com;" always;
-
-# Opt this site out of Google Chrome's Federated Learning of Cohorts (FLoC)
-add_header Permissions-Policy interest-cohort=() always;
--- a/roles/nginx/files/start-nginx.sh
+++ b/roles/nginx/files/start-nginx.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+/bin/systemctl start nginx
--- a/roles/nginx/files/stop-nginx.sh
+++ b/roles/nginx/files/stop-nginx.sh
@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+/bin/systemctl stop nginx
--- a/roles/nginx/tasks/letsencrypt.yml
+++ b/roles/nginx/tasks/letsencrypt.yml
@ -1,61 +1,137 @@
 ---

-# Use acme.sh instead of certbot because they only support installation via
-# snap now.
 - block:
-  - name: Remove certbot
-    apt:
-      name: certbot
-      state: absent
-
-  - name: Remove old certbot post and pre hooks for nginx
-    file:
-      dest: "{{ item }}"
-      state: absent
-    with_items:
-      - /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
-      - /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
-
-  - name: Download acme.sh
-    get_url:
-      url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
-      dest: "{{ letsencrypt_acme_script }}"
-      mode: 0700
-
-  - name: Prepare Let's Encrypt well-known directory
-    file:
-      state: directory
-      path: /var/lib/letsencrypt/.well-known
-      owner: root
-      group: nginx
-      mode: g+s
-
  - name: Copy systemd service to renew Let's Encrypt certs
-    template:
-      src: renew-letsencrypt.service.j2
-      dest: /etc/systemd/system/renew-letsencrypt.service
-      mode: 0644
-      owner: root
-      group: root
+    template: src=renew-letsencrypt.service.j2 dest=/etc/systemd/system/renew-letsencrypt.service mode=0644 owner=root group=root

  - name: Copy systemd timer to renew Let's Encrypt certs
-    copy:
-      src: renew-letsencrypt.timer
-      dest: /etc/systemd/system/renew-letsencrypt.timer
-      mode: 0644
-      owner: root
-      group: root
+    copy: src=renew-letsencrypt.timer dest=/etc/systemd/system/renew-letsencrypt.timer mode=0644 owner=root group=root

-  # always issues daemon-reload just in case the service/timer changed
+  # always issues daemon-reload just in case the server/timer changed
  - name: Start and enable systemd timer to renew Let's Encrypt certs
-    systemd:
-      name: renew-letsencrypt.timer
-      state: started
-      enabled: yes
-      daemon_reload: yes
+    systemd: name=renew-letsencrypt.timer state=started enabled=yes daemon_reload=yes

-  when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '=='))
-        or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
+  - name: Download certbot
+    get_url: dest={{ letsencrypt_certbot_dest }} url=https://dl.eff.org/certbot-auto mode=700
+
+  # Dependencies certbot checks for on its first run. I set them in a fact so that
+  # I can pass the list directly to the apt module to install in one transaction.
+  - name: Set certbot dependencies (Debian 10)
+    when: ansible_distribution == 'Debian' and ansible_distribution_major_version is version('10', '==')
+    set_fact:
+      certbot_dependencies:
+        - augeas-lenses
+        - binutils
+        - binutils-common
+        - binutils-x86-64-linux-gnu
+        - cpp
+        - cpp-8
+        - gcc
+        - gcc-8
+        - libasan5
+        - libatomic1
+        - libaugeas0
+        - libbinutils
+        - libc-dev-bin
+        - libc6-dev
+        - libcc1-0
+        - libexpat1-dev
+        - libffi-dev
+        - libgcc-8-dev
+        - libgomp1
+        - libisl19
+        - libitm1
+        - liblsan0
+        - libmpc3
+        - libmpfr6
+        - libmpx2
+        - libpython-dev
+        - libpython2-dev
+        - libpython2.7
+        - libpython2.7-dev
+        - libquadmath0
+        - libssl-dev
+        - libtsan0
+        - libubsan1
+        - linux-libc-dev
+        - python-dev
+        - python-pip-whl
+        - python-pkg-resources
+        - python-virtualenv
+        - python2-dev
+        - python2.7-dev
+        - python3-distutils
+        - python3-lib2to3
+        - python3-virtualenv
+        - virtualenv
+
+  # Dependencies certbot checks for on its first run. I set them in a fact so that
+  # I can pass the list directly to the apt module to install in one transaction.
+  - name: Set certbot dependencies (Ubuntu 18.04)
+    when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==')
+    set_fact:
+      certbot_dependencies:
+        - augeas-lenses
+        - binutils
+        - binutils-common
+        - binutils-x86-64-linux-gnu
+        - cpp
+        - cpp-7
+        - gcc
+        - gcc-7
+        - gcc-7-base
+        - libasan4
+        - libatomic1
+        - libaugeas0
+        - libbinutils
+        - libc-dev-bin
+        - libc6-dev
+        - libcc1-0
+        - libcilkrts5
+        - libexpat1-dev
+        - libffi-dev
+        - libgcc-7-dev
+        - libgomp1
+        - libisl19
+        - libitm1
+        - liblsan0
+        - libmpc3
+        - libmpx2
+        - libpython-dev
+        - libpython2.7
+        - libpython2.7-dev
+        - libquadmath0
+        - libssl-dev
+        - libtsan0
+        - libubsan0
+        - linux-libc-dev
+        - python-dev
+        - python-pip-whl
+        - python-pkg-resources
+        - python-virtualenv
+        - python2.7-dev
+        - python3-virtualenv
+        - virtualenv
+
+  - name: Install certbot dependencies
+    apt: name={{ certbot_dependencies }} state=present update_cache=yes
+
+  when: ansible_distribution != 'Ubuntu' and ansible_distribution_major_version is version('20.04', '!=')
+  tags: letsencrypt
+
+# On Ubuntu 20.04 it is no longer recommended/supported to use the standalone
+# certbot-auto so I guess we need to use the one from the repositories.
+- block:
+  - name: Install certbot (Ubuntu 20.04)
+    apt: name=certbot state=present update_cache=yes
+
+  - name: Copy certbot post and pre hooks for nginx
+    copy: src={{ item.src }} dest={{ item.dest }} owner=root group=root mode=0755
+    with_items:
+      - { src: 'stop-nginx.sh', dest: '/etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh' }
+      - { src: 'start-nginx.sh', dest: '/etc/letsencrypt/renewal-hooks/post/start-nginx.sh' }
+
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')
  tags: letsencrypt

 # vim: set ts=2 sw=2:
--- a/roles/nginx/tasks/main.yml
+++ b/roles/nginx/tasks/main.yml
@ -16,15 +16,8 @@
    add_nginx_apt_key is changed or
    add_nginx_apt_repository is changed

- name: Set nginx packages
-  set_fact:
-    nginx_packages:
-      - nginx
-      - ssl-cert # for ssl-cert-snakeoil.pem in nginx
-  tags: nginx, packages
-
- name: Install nginx packages
-  apt: pkg={{ nginx_packages }} cache_valid_time=3600 state=present
+- name: Install nginx
+  apt: pkg=nginx cache_valid_time=3600 state=present
  tags: nginx, packages

 - name: Copy nginx.conf
@ -78,6 +71,7 @@

 - name: Configure Let's Encrypt
  include_tasks: letsencrypt.yml
+  when: use_letsencrypt is defined and use_letsencrypt
  tags: letsencrypt

 # vim: set ts=2 sw=2:
--- a/roles/nginx/tasks/vhosts.yml
+++ b/roles/nginx/tasks/vhosts.yml
@ -7,11 +7,13 @@
    notify:
      - reload nginx

-  - name: Download 4096-bit RFC 7919 dhparams
-    get_url:
-      url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
-      checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
-      dest: "{{ nginx_ssl_dhparam }}"
+  - name: Generate self-signed TLS cert
+    command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
+    notify:
+      - reload nginx
+
+  - name: Generate 2048-bit dhparam
+    command: openssl dhparam -out dhparam.pem 2048 chdir=/etc/ssl/certs creates=dhparam.pem
    notify:
      - reload nginx

--- a/roles/nginx/templates/blank-vhost.conf.j2
+++ b/roles/nginx/templates/blank-vhost.conf.j2
@ -16,9 +16,9 @@ server {
    listen [::]:443 ssl http2 default_server;
    server_name _;

-    # self-signed "snakeoil" certificate from ssl-cert package
-    ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
-    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+    # "snakeoil" certificate (self signed!)
+    ssl_certificate /etc/ssl/certs/nginx-snakeoil.crt;
+    ssl_certificate_key /etc/ssl/private/nginx-snakeoil.key;

    ssl_session_timeout {{ nginx_ssl_session_timeout }};
    ssl_session_cache {{ nginx_ssl_session_cache }};
--- a/roles/nginx/templates/https.j2
+++ b/roles/nginx/templates/https.j2
@ -16,8 +16,8 @@

    # concatenated key + cert
    # See: http://nginx.org/en/docs/http/configuring_https_servers.html
-    ssl_certificate {{ letsencrypt_root }}/certs/{{ domain_name }}.fullchain.pem;
-    ssl_certificate_key {{ letsencrypt_root }}/private/{{ domain_name }}.key.pem;
+    ssl_certificate {{ letsencrypt_root }}/{{ domain_name }}/fullchain.pem;
+    ssl_certificate_key {{ letsencrypt_root }}/{{ domain_name }}/privkey.pem;

    {% endif %}

@ -51,5 +51,5 @@
    # Enable this if you want HSTS (recommended, but be careful)
    # Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
    # See: https://hstspreload.appspot.com/
-    add_header Strict-Transport-Security "max-age={{ nginx_hsts_max_age }}; includeSubDomains; preload" always;
+    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
    {% endif %}
--- a/roles/nginx/templates/renew-letsencrypt.service.j2
+++ b/roles/nginx/templates/renew-letsencrypt.service.j2
@ -1,9 +1,7 @@
 [Unit]
 Description=Renew Let's Encrypt certificates
-ConditionFileIsExecutable={{ letsencrypt_acme_home }}/acme.sh
+ConditionFileIsExecutable={{ letsencrypt_certbot_dest }}

 [Service]
 Type=oneshot
-ExecStart={{ letsencrypt_acme_home }}/acme.sh --cron --home {{ letsencrypt_acme_home }} --reloadcmd "/bin/systemctl reload nginx" -w /var/lib/letsencrypt
-
-SuccessExitStatus=0 2
+ExecStart={{ letsencrypt_certbot_dest }} renew --standalone --pre-hook "/bin/systemctl stop nginx" --post-hook "/bin/systemctl start nginx"
--- a/roles/nginx/templates/vhost.conf.j2
+++ b/roles/nginx/templates/vhost.conf.j2
@ -14,8 +14,6 @@ server {
    listen [::]:80;
    server_name {{ domain_name }} {{ domain_aliases }};

-    {% include 'well-known.j2' %}
-
    # redirect http -> https
    location / {
        # ? in rewrite makes sure nginx doesn't append query string again
@ -77,7 +75,7 @@ server {
        fastcgi_pass unix:/run/php/php7.2-fpm-{{ domain_name }}.sock;
        {% elif ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==') %}
        fastcgi_pass unix:/run/php/php7.3-fpm-{{ domain_name }}.sock;
-        {% elif (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==')) %}
+        {% elif ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==') %}
        fastcgi_pass unix:/run/php/php7.4-fpm-{{ domain_name }}.sock;
        {% else %}
        fastcgi_pass unix:/var/run/php5-fpm-{{ domain_name }}.sock;
@ -98,7 +96,7 @@ server {
        # Enable this if you want HSTS (recommended, but be careful)
        # Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
        # See: https://hstspreload.appspot.com/
-        add_header Strict-Transport-Security "max-age={{ nginx_hsts_max_age }}; includeSubDomains; preload" always;
+        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
        {% endif %}

        include extra-security.conf;
--- a/roles/nginx/templates/well-known.j2
+++ b/roles/nginx/templates/well-known.j2
@ -1,6 +0,0 @@
-location ^~ /.well-known/acme-challenge/ {
-  allow all;
-  root /var/lib/letsencrypt/;
-  default_type "text/plain";
-  try_files $uri =404;
-}
--- a/roles/nginx/templates/wordpress.j2
+++ b/roles/nginx/templates/wordpress.j2
@ -9,7 +9,7 @@
        # Enable this if you want HSTS (recommended, but be careful)
        # Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
        # See: https://hstspreload.appspot.com/
-        add_header Strict-Transport-Security "max-age={{ nginx_hsts_max_age }}; includeSubDomains; preload" always;
+        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
        {% endif %}
    }

@ -20,7 +20,7 @@
        # Enable this if you want HSTS (recommended, but be careful)
        # Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
        # See: https://hstspreload.appspot.com/
-        add_header Strict-Transport-Security "max-age={{ nginx_hsts_max_age }}; includeSubDomains; preload" always;
+        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
        {% endif %}
    }   

--- a/roles/php-fpm/tasks/Debian_10.yml
+++ b/roles/php-fpm/tasks/Debian_10.yml
@ -28,8 +28,7 @@
  - name: Update php.ini
    template: src=php7.3-php.ini.j2 dest=/etc/php/7.3/fpm/php.ini owner=root group=root mode=0644
    notify: reload php7.3-fpm
-
  tags: php-fpm
-  when: install_php
+  when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)

 # vim: set ts=2 sw=2:
--- a/roles/php-fpm/tasks/Ubuntu_18.04.yml
+++ b/roles/php-fpm/tasks/Ubuntu_18.04.yml
@ -28,8 +28,7 @@
  - name: Update php.ini
    template: src=php7.2-php.ini.j2 dest=/etc/php/7.2/fpm/php.ini owner=root group=root mode=0644
    notify: reload php7.2-fpm
-
  tags: php-fpm
-  when: install_php
+  when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)

 # vim: set ts=2 sw=2:
--- a/roles/php-fpm/tasks/Ubuntu_20.04.yml
+++ b/roles/php-fpm/tasks/Ubuntu_20.04.yml
@ -28,8 +28,7 @@
  - name: Update php.ini
    template: src=php7.4-php.ini.j2 dest=/etc/php/7.4/fpm/php.ini owner=root group=root mode=0644
    notify: reload php7.4-fpm
-
  tags: php-fpm
-  when: install_php
+  when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)

 # vim: set ts=2 sw=2:
--- a/roles/php-fpm/tasks/main.yml
+++ b/roles/php-fpm/tasks/main.yml
@ -2,49 +2,20 @@
 # Ubuntu 18.04 uses php-fpm 7.2
 # Debian 10 uses php-fpm 7.3
 # Ubuntu 20.04 uses PHP 7.4
-# Debian 11 uses PHP 7.4
-
-# If any of the vhosts on this host need WordPress then we need to install PHP.
-# This uses selectattr to filter the list of dicts in nginx_vhosts, selecting
-# any that have has_wordpress defined, and has_wordpress set to True.
-#
-# See: https://stackoverflow.com/a/31896249
- name: Check if any vhost needs WordPress
-  set_fact:
-    install_php: True
-  when: "nginx_vhosts | selectattr('has_wordpress', 'defined') | selectattr('has_wordpress', 'equalto', True) | list | length > 0"
-
-# Legacy, was only for Piwik, but leaving for now.
- name: Check if any vhost needs PHP
-  set_fact:
-    install_php: True
-  when: "nginx_vhosts | selectattr('needs_php', 'defined') | selectattr('needs_php', 'equalto', True) | list | length > 0"
-
-# If install_php has not been set, then we assume no vhosts need PHP. This is
-# a bit hacky, but it's the closest we come to an if/then/else.
- name: Set install_php to False
-  set_fact:
-    install_php: False
-  when: install_php is not defined

 - name: Configure php-fpm on Ubuntu 18.04
  include_tasks: Ubuntu_18.04.yml
-  when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==') and install_php
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==')
  tags: php-fpm

 - name: Configure php-fpm on Debian 10
  include_tasks: Debian_10.yml
-  when: ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==') and install_php
+  when: ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==')
  tags: php-fpm

 - name: Configure php-fpm on Ubuntu 20.04
  include_tasks: Ubuntu_20.04.yml
-  when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==') and install_php
-  tags: php-fpm
-
- name: Configure php-fpm on Debian 11
-  include_tasks: Ubuntu_20.04.yml
-  when: ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==') and install_php
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')
  tags: php-fpm

 # vim: set ts=2 sw=2:
--- a/vars/Alpine.yml
+++ b/vars/Alpine.yml
@ -0,0 +1,10 @@
+---
+
+# sshd service name is `ssh` on Debian/Ubuntu, but it's
+# `sshd` on CentOS and Alpine
+sshd_service_name: sshd
+
+# provisioning user vars
+provisioning_user: { name: 'provisioning', home: '/home/provisioning' }
+
+# vim: set ts=2 sw=2:
Author	SHA1	Message	Date
Alan Orth	4846cbd968	roles/common: Add firewall task for Alpine	2021-02-13 12:18:58 +02:00
Alan Orth	aa63f5946c	roles/common: Add TODO about tarsnap on Alpine	2021-02-13 12:18:58 +02:00
Alan Orth	53d574dd12	roles/common: Add Alpine packages	2021-02-13 12:18:58 +02:00
Alan Orth	92c23bc2b5	roles/common: Use chrony for NTP on Alpine	2021-02-13 12:18:58 +02:00
Alan Orth	e93b8af949	Add vars/Alpine.yml	2021-02-13 12:18:58 +02:00