roles/common: remove cron-apt

Use unattended-upgrades instead. It has sane defaults on Debian at
least (I haven't checked Ubuntu).

Pipfile

@@ -10,4 +10,4 @@ ansible = "*"
 ansible-lint = "*"
 
 [requires]
-python_version = "3.10"
+python_version = "3.13"

README.md

@@ -4,7 +4,7 @@ Ansible playbook for base and initial configuration of the web server hosting my
 ## Assumptions
 Before you can run this, a few things are assumed:
 
-- You have a clean, minimal Ubuntu 20.04 or Debian 11/12 host up and running
+- You have a clean, minimal Debian 12 host up and running
 - Python 3 is installed on the remote server (requirement of Ansible)
 - You have a user account with password-less SSH access to the machine
 - You have sudo privileges on the remote host

group_vars/web

@@ -8,4 +8,7 @@ webserver: nginx
 extra_fail2ban_filters:
   - nginx
 
+# root prefix for all web servers
+web_root_prefix: /var/www
+
 # vim: set ts=2 sw=2:

host_vars/nomad03

@@ -1,88 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-30626135313830363339656165316536336564353362383439346465373932326136363337343762
-3566343231306635313739303335616162396232303139620a323764663132323135663063393334
-62656434643333663062356266626235363439393231333734343432333363643934393636373935
-6332353333303231370a373839636135363730636539326335343533316633623366663230353262
-37396264313763366438663139376638613337336634393665663032623035646631653564353966
-30353165333638363864656531396165363430653438376465656233306639353336353237343532
-62363330333662316630656662633333626462363062366637386163336230386634353933316238
-36373365323735373435616262613933333964323033633233333766396362616534316166386432
-31333831353130616166633735366131653137363361313333363763623364303435346338643838
-63323831616135643830653839323663386239343430356437346665343937306666333836363163
-37386663616136653861663530383865343930306263663366633438363332336561326330353235
-64613332643962323930323436393934636263396239366364306136303437323739343237656263
-33613964363139363862396235636435626432326432663166633765613635666165363165663539
-62366232316632356233326564633737643466343535656564653833623766373637313833373331
-38356336396461666535386363633437376232396330623162333936366434376361326261343336
-35396237346663646334306663306633383061353333643639613335643661633835313732353963
-64623234373033656366613566363639663762646663396462323361363463373961383530653962
-61613962316336653266383638393630323338383161303565333862633932646463313134613232
-31326262336561383066633430383833353835373363623163303830663837313265663662313862
-39353062333234663631653565613135396337626664626264366534633566386236393562303861
-66316335343638356261396339353932633331356363343231363862333066366438323764633331
-39316236343262666337303839356138666338306130323462646633373464646163613734366132
-37623739333435396266316131383238323365646632636339353631376166613532386133393165
-64633933393062623230346430653961646366316662356336646162313466393964323332616431
-34336562343337636138616431313736613539373137303666666435373238346233383438383963
-39346138393635626263376137643436393736636435393234646439353932386136653034393961
-65336230356336386539386334653236303964623632323738383333623361643235656530363731
-39306538353533663538366362613739386463336632653665636533616462363530636466626165
-32623762616266623231393938663931306231626139663736613862363234643861366563633532
-31393934333433316138323131373836306135333061363231363461643933303836633231343266
-37323732383036326664376438343261333733636532303664613965353561376337633564373062
-64316133333263393138333261323062626363343765393161363935386232353862353762626334
-31346661303239383832343637376663316537353938346534306134626534363438386162653133
-66616237663864633837356132663139633734303532653637366138386534653462323163313836
-34633337643661656465653839316362633236633833646632393930656136313730646566316537
-39653935633636363635386435373062333031356363633661366530616537356533323133366339
-34336139323138336532313833633364363566613833636339396462326530313961613133613761
-63356231313363303862663032373663626262646565353933663963363633363663373238656632
-31393264333732366565376164623766663162386365356233383132303835643932386436333631
-65663334336434663562326238326338376662303339616233616464313139363864623463613761
-36326235396433633435366263393964383936616433653861326431343133346435663832363437
-33333232636536363863373037616436313335393639393966653062303330366463323861376661
-39383665316665303363636331373461623339323031393333323465313733336236303037313132
-37613163373432316132306235343061393530366237626134323431323836316261326237323965
-33643662663361356164653430323566666230656561633434333538303365663334373537306164
-65633264323836656537623766316533386564663765376661663537303835393438623430343263
-64353031633436343938383263313439383033326532313466653766616164653463333434353664
-30653034353632373561346565616631656235323637333562613538663538363936663464383064
-31336365613037626331363731376663653537613639313839303934633462666430306635613434
-65333736653430363936663566666535346231383563366630653535313038383964326630616264
-63616563356361313439303833646438386163313865356634636536336661626664316163333739
-63303465643861656362386530353363383836396534373461663630636461633336333862353830
-38666536353663386466313066376562383366643062343965386132666435376433626165353735
-61666432613133646130373839336261333565303532643164306264633736346637373835393266
-33306133346531333835303238393361663463346162636161646565313266616133623735653838
-62396531313634343936363861373031383830636538376334316161326364303930383435653936
-36653233343935646337376232396638343033613130663563326135633231636362373162623565
-39323762623966393332376235643666383461356263346332663939616235346564636233333463
-35356161616536613939313436616233386563343764643335653961643366656632646338313536
-35323732333539326239386436306230646230663336623566633763383534626162386463613961
-62353737363435653866383633343830356536633462373636323734656231636466336235306162
-62666133656166633838363262613930396236393862306438316135643131393737363531373631
-31626635613233313063326463663738393632373135373632323731396332323138633962356364
-39396565393038623532313230383539656564383134363161393663373539393837313335303636
-38626138613932643265643231366364373964623436663566623838643939323331646661653435
-37373765393736303861346164373938393532636637353737326539333435666562643664363365
-65646662626630663238336264663665663762666439626336376434386436653965363832346339
-30396630343430323762666232366336376563616430643136336630373864623132386465393761
-66396439346563393539616335383562633237353962383033356230323339353336343964366134
-38623661326336376561633937613565386164656462313863336339643733663834373732643266
-61666438666635656236376239393433306239613936613731636235353638396432326438396432
-63333237333633333761666630663339613232313136316232346234363562333937363463333137
-39653336343732303536616662643961623932643330653936343337316135366535363964616439
-37376433326332386339363961656537326632333830346435353234333661636434343730356139
-37346131303930306364623334313335323563333631653539383637376433623439386564633035
-38346436376661333233663334623762646633346530643466336664386134353662363430316438
-63393333333034623537303030353136633035353865383366613961373766646463366131623564
-34646630666233333834383761363566373935333037633666336261313566613762616531653739
-34643162323438646165643433333438656664383232376233306233623539366233633337663565
-35323636633533343064376434666435666564666134343839653630326236343262633431326133
-36663432396666306631613162643065313135373332303863326234356537366436333938303637
-36636334396231316564643733646662376138313637643232373836373632643362383363363530
-32363736646162303532356132373337616162636464643164323432623338363463663736373433
-34343136646339376132383434623261356163393032306134633665323130623766333738656639
-64306632346162396533316431343339366664333335643464386266376464393039633439653837
-36303363326239316663346434613336636239653331626661393962356166383339333234376135
-653361363631363366323165353538313438

host_vars/web22

@@ -1,137 +1,141 @@
 $ANSIBLE_VAULT;1.1;AES256
-63356538383464316265363339393262623161313332333136363039613462393065323039333839
-3437666230393631643932373532646537376132643736310a376432616165386434306637356530
-34643036663438363264346130653636623930643462343566313365393161623033663632376331
-3934336365366334620a613436336239303131353165663562343865336631303433656630636266
-36366433623938643932643765393238653935623861303939326637306439313039613566396336
-35666638396239356630353762356463353137393462336532643930343366336233343730656334
-32373335623539333339666662633965363061613434366463613239353466333462646234643635
-34383866623936396437396361363761363337326539393439663830303663643163636137656565
-64633961373835373739666162643233373036656134303863316166323061663362626431323331
-33643763363563373332613131363166616432376230356636623530313463636337363235626532
-61343465656534623965636638303032363261613430343030656330653239656465386434383234
-31636336343162616134333536373632353733373136356165313662623063306661306131646533
-37626138393035613864316539396338386563333338633834356334313766346161363130313231
-66336131323931633963653464636361653739623537616563663533313734343666623237333036
-39616564333334366361356135353132363033323461383166663531306135626135353766343361
-33393939333532363465383632353031383065353830643038303665613430313334343630616566
-38663963356631613234623435636361333935613964626330636331346432663733303561336166
-31633436363438373966666431366232323136356139643333393363323232363261356433353333
-31336332623038323130303938356131396131386335646466366263346530616439363539306165
-37343834656333343034653435323934623462333330613764336361323535663563653835643535
-61386630306465353037386531353263656238333461313063626164343231303163663030363165
-32653332383931653535663266393631373236643236616432303166646634363637346539626263
-36396666653730333962366265663334323765623137643130653335613861313163656339663263
-64303261353062376536343830353236653163386339373534323934343861323231303733303733
-62393439626566373230383734396137346436623932363564383030626638643330666264306564
-63656236356535613362346137653438623765656437313137666365346464326161646262346136
-65636363316530346130343237383161643539616536373266343865323832343634623761616335
-39626632373865313661316335336130303462383266623135646437643736616561326266396332
-35663339326531626366376530326134303363343930656539326433366662393662653764323133
-34643364343637383930353036613339393639363534663938623966633833346666616536616134
-63643031383464663139313066656335623164636666346265396564626665653935333833353730
-63393062363439303435623663363331343732656563663233366630646163323564666437346566
-61303736653536663662326430366330313239353535613135663336653334316435323262396634
-36313761613836353937356665346135633162653239383033613438356435313234373638656339
-33366462613432346533663231313535333665646635333436343237373935373838376533363165
-63303735663564333732363363393038636531653264613965666235333331623663346534366566
-33333764356665363638616561656537613039626631363066316133623963626338343231616361
-34373266313863663831363639663439643936303931666532653962323733366635653035646664
-32666239663062316437313737346161376562663630636466623431386266363263623633373963
-35666665383738656437313438303832326137343033633562666436303535613538343832613839
-35383330613538383164353233336335376266343336616430303638363365613065393262356435
-30346537616335316661333533363763393633616438633066316232623738366230646364353735
-38386236316539343063633765386235663866323433666531613666646365376330333539376562
-66653762633630366638323334393132383635373663343830653431363534353961303139373734
-38346438663966363166363464393863393861643936333536343035626239326238363131343966
-64646435663863303937646364616630633266326237326330323733396165663134383432343862
-39666238346336353531653165313066343039653430373833323832326631386430326435646530
-33343233353331626533383864303235366538663338376465316161653664386361373761376134
-65333437306165346331376664646161616230316530373630383965333434313937333637393530
-39373334653164646233323064623431313832313662313832613837646561373534623535656239
-31663939616634613235386564333962626333616164326466656163376362346437396532616238
-65656138323430633137373030376661653231303237396331333839626365376533313038316132
-35623464323934616361663164323137316135326566393339316161666437343238333031633832
-34356561333565623532656332353463343430336531383364383733323664383365356263393539
-33666332623665343336353365396163386334613232663962663131383734353762396466313464
-61396265333037636232323738373462313638663033343437376431656464636137306661636561
-39646537393131613539633032616338333265386562326532636136303039383034626465373139
-66636363316461643537356439303861356439656661643663653335383565616532623435383634
-66313436366663656464643061643531633161626635643235633930353339386663346232366235
-62386161323934343730646439353163663538633562626232323333373839363430323239366131
-62343832346235643863353134636261616262386364623236643966333636323637646532333634
-33643932656165383031303931383634623231663335613035316537373731323963376565333962
-34363939616334326134363661633833386433373430363766383461663136376466306661386639
-64343236393738326339663963396635393739623232313463333063653133343461633564393735
-61353562626362383432636430343062643166353035633232613035636634383064663734633934
-65633430613138643837346535623865613931383338306663633466343932393837333333313836
-61346163316630353133616661346133346239623763303262373637303030336639643563646665
-35646462643531356635376331303565663630356161323565333737363462666161633761623431
-63666161353639393734613631396566336137333830653531643436623462316535333537666365
-36643662353664383233613131643761346433356265333761326361303439326535396438613061
-63633335326339323437316331613033643934323238663636636431653632363165666232363631
-35363231363165306236326662656166373739373761316466353663393836336631326465646265
-66363766663333333765653032366161363437383735646664633635306562323363343863643936
-64656536333531393564303864386631663635613263316137653435303962313561646334383664
-63623133383531303563386562633233636436323236643764646336663038363062663032313232
-65643136666664306537343433393262306534356536383038323337623835326632636464656138
-39613237616365303333303737333431343361303563326266663533353639623636393961363531
-33393737643062373365633431613564383962616337666631376264356431633035303665626136
-30373731383361333035356138626162656238373337613334343739383064666133383432646665
-65396466663762613036346137636538336130326334656634656238656664343431363365376664
-63386264313665363464623335343862353432366336393032666434363131656339326632316538
-63363864373462303136323133383136653732343639343964376137613337353934353061303966
-30363433333631306432316462393137636361393535303938646662306263636639663637313037
-63616363366139303036353633663031353366373462303234343264643136393736623735393966
-32636131633065383530316336663463653134323566633262666635303831343035333433623235
-37616331366263643231383264386336316264343531663736383736643235376532363736323637
-62343831636636663137313032303837663331633135633632366337386161633631393438653862
-64326161626131646536313830383166613163373134623532663164656265306138313766313438
-61376635326165366335393730343736366536623566373866363730626434343931636531343166
-34383830396530393631326135386262323037303162343665663339616266343565363433363630
-31656238383533366333376463303538646538333735306435326565303833353333636439626438
-62343232303863663733623231633439613333313336303733373032613862363736336137663935
-37373230356234636438303966323934633530396335653463333137366533333930343236666336
-35333030623835376635353936343437653563383031663133663264366530303830376336373731
-37326334616538623931346462623130333165643232386566356366313431393736633765396334
-39376564323431303630363836613963323532386234656431363165393439373532613139373734
-61363434633363356165616664316336373335383030393732306432633765326161313934343038
-33323065356539633761643032383132656466646235623131663830346535613130313964373033
-34343134666463633135313036323237386235616636613237376630303536376166303137653534
-38316238366665653166613937623465376332386238643066643161363666303338386366323164
-64663531383162373865623063396562336639393837623062356631303266643533346232613234
-62623430346165373139343562373463623166623138396435616234623961656663633163626466
-31663061666630653664356463336363383462343766616162313866623734376337346533623762
-32643330393161633262333230363366613837386138636536316665656435383336373835393039
-62363436663435633462633761396439306264666638636230383038396635393037353134306566
-39373661633030323332333733343366343333303263323861383365663132356334373465336539
-65316530626663333665663338346430333032333933353839333165356465373361343765613833
-31303265303538396662613164393038366261383739623963613562363234363035643166343164
-63346336323737643732643863633138373831393735313036316632646138363032616462626337
-35386631303266313932346466383533356634643733376536636535623063653632356362376566
-64313963643461326533363164373634663663303233666136336535366539633135323335386539
-31323265633234323563396666323065623236623837616362353261663235623836663566616232
-31326666653533383838346565386131373238333630613634386662343630323136333438333866
-39343030326632373334636430353538396237653366663434396531303031326331626633316436
-31626165316333343266343764666138663034316139366332663165393264663136363866363239
-35393032666638333130356666613862643761313065666430663332306561663734373061363438
-31623433383162333066303362653966383638616364623262623062623539303336646333326363
-62616433643731643462663362663030306264616365653531633138316361363865306237333636
-32323732613364393232343833343731323037623331333739613538646361363064383736646336
-35646331323265313166653232393731646562333962333339336630316538333834383366663466
-61663033636636626166623861393433366261336139656136316366343264363735666132633632
-34363539336662656661326139346561303061366262616130626232313030313664623130306238
-31663062653734303136336634313736346437326266346537633533316238356464643534623766
-61383934636636366565393330363666363131646330343434393938663231333435323062636464
-38363265663566313535353565623733323363666132636139383638306635363661306463653537
-36343734356562323164396136383261623464646534643738333864653035336266383131353866
-37363436393039653431336562363263363536336639396632323937323431366139313235663839
-63663263326232333162326633623863623333653932643339626263326337646264656134383733
-38613065393931393862633732306139646663346136393765343432313131636165336630616537
-37646461313764666138386538303937623034336163376130623365383566653463313930653333
-64316134663438636664313339393734383464663631346465666363363961313562376336373965
-65373430343962303339626164656234346234363033636339656362333136626631356233363365
-31313131643030633364306162303238303163663934366262636639353636326339616530316563
-36626530336335333338343535633137663961363363613933336230306533353434643534306166
-37663334626263316538366637376562316537386632366637623235343838626639306131313138
-38393636313037393535
+64313136396662396631396561646634386134313337316166376264346466386533383934393130
+6339663736653462613737323932396664643132383036370a343032653931343063326337626336
+38383332346637633636663865333031636166643161323335363663653033646234656332333462
+3833643037313134320a613332303261356363363138636138323661633233353365623665663632
+30616166383161663534666337303632663532343866366261393935373935666536616530373862
+66653836393966346463393061646431336666316537613364643939663938303135386463616661
+31633330663364353663646338386338323039646530373165386663646235303963623837646533
+30316236313736303837353536633161326564643566643533363431303130376338383034623365
+34303861356264333463613739373635616363366362333738383838326162313238313966313765
+35356637623833663437373765333237323961383133336161363439316632363634623734373962
+32326466303536363164666532313264343661336364396562383630653865316132366538313066
+65666661343632383434346639353462623735373933303263613938363635353666656139663832
+66333638636136393166636332623934613938656336663431323032333339336165366664636334
+65363166616462303939383838363363623530313539386635313664333136643035623262663333
+35643335346639623363323535633735613965333133323639383339323166366635303536376265
+35613939376135393165653466366462656162353632393139376666666334386166366162643438
+31313033353661313031303961313032613539396561303734356533373234633233613465306431
+31303332643931333037343164643162663738393466346639306632306534613065376138323564
+31326462666336633938396230666231356439343630336132313064363636333563373637313666
+32303230616235653733323032343238303230396232623364643765613764336137646630363462
+64343239343530636333663764643338623630366163636232353734616333306339626136313338
+35616632326436663734376263366437356236343339663430323632646136373066373961666135
+38313838316266313830626234366262383037646661386537663534633263633239306461346535
+32643032316266373931346232356162336437623137623365616132643731666361313637316536
+39656332383466346236633461366437386538373734646337393666346562323139663734326436
+65623633363266323563666437633666326363626561313133633031623632633333346332623334
+31396365333336313939633161613639383963633136616562333236636666306139663430363265
+63353261306332346439313534393363626638633531633532363365663265353331336231316238
+37323439383930346136383036303833316565306139613235333633373832313130316534666435
+30323262623037623939336265303866356532653064303436653131633162616630326362616430
+33343538353139326663653735343436623834653264376264363761313835376433653531623266
+34386266613733653634363135616335303138303062316664623666643263323939643939303133
+32393564323833666132626664646436333733396565623164646363343065343464363465383330
+33636562613734303665343366656630303732323739363339306337316266356635323262643031
+63393261363764613638666231663837373263353137643265336134646364343130353237336463
+62306363373339363235343034393230623035373366656531666663323936323366643938646135
+62643135383734663766353230356463373337613936633037396538643365393738363234313166
+62303038326236656332663939333364633132386266383665363632386235643731616631313431
+37613566616463613662633734316461386261646464636539353439373431323133663435333763
+63333230663431323136373564613239386531356463646366313537303861616234626561663133
+32643134666337633938633530323034653131663663643732623636633834323064633832396339
+35613738366666653765333434616336383635323765626561376232363062373761383665313735
+30643165633930656566633339383439353931303836333537343634353434653433333933386338
+64393566616166353731313261386239646531316563623363646537653964366631663266353366
+65666638393337663633366132663933376135396334303461653232353765626365303464626338
+30653334393439373632393662653032633264363238626431326136653561636164646237373033
+32646464616137366163313634623864656666346336383037373562633333633432313439323631
+34646132643834323261316166303531666238333964396165313936393937366533396436633832
+34663538613139623063346666306165306530646363353732353431343831303161343535623539
+38663537323132653034393335623232623530343432336531643538356430636262313132356430
+33363062333931306633643733313239373934313635336465643139616266613237353166626334
+35643138633561393531313835623665303531313437323664616561633764316332393435373065
+38633766623633666362633336326466343938623461393736666137313965386133396433303236
+34366339326637323934323236346239373565623565313433376433303061353763383732663239
+65313636646539623037653761316662303565636262376262333332316136623737613338303036
+37623837313636333464626664323163633136343762306462323339646535636237326138613132
+33613761646237396265616135346639636566316633646165616332656333383233343836316163
+36313736343263343534656533646463343933333031666433393635623461633639356430303434
+34663033333933333439386532623664316364343066646232353335643536353733326165623231
+66306661343939616235313238353761643034623062326632393161336462333365636536343934
+63343866666237636563363561366339623161643362326632333532613562336238653562346231
+33623337386233636331326232393465346362336439303336303638643430623864323434633333
+63623036623764646234636433383364333763613866626230316533643535356662306136346664
+36353734663866306336303439623537336266383131303365383439356462306237363030306432
+38623738643434396138373837386334616435383662363032663930363038666536653334613261
+36623730666333393564346539653533656434346439346632643730356665313865396463343737
+31326633646661666461396365643061333361643638363835343235646231633637616464343265
+36646439383737336531303236666136313063653563653433306563643362353536663863653266
+38613461363432333666343264333461396461653231646133383861363763353763626334373635
+35313431346465336636363531363766633234653066376366636263306238393361343936663066
+61653739303230316232626335383865636235363638663463396435623737616661346666613037
+32666436333937356530326566626237303065363834313837383837306432383833643632376564
+39623937653631656562306565376232333463626563336630633331663764346138323466303433
+38303965386635386565653035666631616239306231616530363965306134633034623936396135
+32366430333763333039613734343563663065636538616139646239303533336437616162366532
+38343137366563333866343537393532353835386230623536663966643730663031636639313232
+33636133303432343531626539633862646466653864393737363333366238666536303663343837
+39363330383432353465633132346165333564646262383736366664303239366365643533353738
+65656163313966306464633237383530316338666665666236656164636433653735353739393363
+30633462393933646436356365323864383239633963306366356534333036663438643438303365
+37366638383066653965383764323436336230363336303233303433656563656563343630613935
+64373965366662323137353631323233643463366338393639663833633635313531616539366333
+30656663666561353938393761353266386533383361326439383338363762633538396638386630
+31383131316137346234336462333032366337393438343237613231323164306132373136323233
+38643133356166303661363761646430363734373130363334376535356565386638366630306362
+63626539336134356539366166616331626361356335616665336564636638316137316230643961
+65623465336232326533616538653561646263626536333738346531366661336134366362386239
+39643665663566376264356332653062313536353635656231656566386333636330353765373664
+34616338623161333232653832386436343361636461653338363932633337623537303261396334
+30386663613335303438376234333138363432633234646133646466323930656330623161373530
+36383261373139663932623933626164313765613930323035326334373231303033616665346337
+32353235663465336433666539333032376365373266363436353063366139616232373037383664
+31323062383063373932623030356461353039326363336165326138353335326436363165393639
+33643830353734616164653833613830333066626161636130323861643866386234383136313336
+37333337363462313831633437636633383137303736303264393236333633383933303939383533
+38626138396537663463633961303766663636353737336365393638383832303735323266646337
+62643665353431326465386162633737613935353261633963616531306233613966643862316166
+38316164383433333263363630386462313639336464653061373239633235346633613237646563
+62383836393063613365653635663136356538623962623961326434646635633464313932626333
+36383666653264366236396638626265356338653630303930383861386534393732633437363663
+38623739313131643038396335326437323231636661346164353433303235356432306532353066
+63373662313366376363653039316361366266616466663663313732303962336339616235366432
+32643832366231396132333236313962313932343230333832616664356333646533323732656466
+34393862393434383362303531653638303366323530656661623236336630383064663135373862
+61313761643038333035376535633964303564616532646139393964353165353763626235303662
+65633465626365393033376437633134333532656262366462323365653466616462316664323837
+64346533366238656637366665303339666433623261623635383631303862616438353166353866
+66346366316562316230306233323937313364656537393063306537353237353737626164663365
+38636331363138326336646434653238636463633138343134373937373835373232356363663366
+37386633353439656162613736303932633333313131653364616364343761363335343430396432
+39636630343066616633376237643062616666666135363232376632666132396333363334623036
+63323531626632383062353162346536663233656132383734643761396264623165663738616564
+61316234386135656538363861363531373232303163643364366136616130643737346438353334
+63653234376562663937663135363763656236346663363738313836383466656162643131636138
+63383430653030383232333830656333373765333639303265643938323833613262643863643835
+66326466313730323666643939623539326639663838663737326665326164366262323731623037
+33383631616530383238626431333033366134383839613761656264366331663539363131396361
+64316333373134636163666634656561306130616337383030653063626161303930653730623130
+33653730656332616135663631653336386166363866303932643163353963396466646662626439
+39653562613461353633313533356336393334643066626137306164643530343331666430636330
+63613763336663613639343036363332626232346530366633646536396338613164666163663235
+37333334313436326233653866316438626366633632653336393633333931353961353132376639
+66343362646630376537356638396263623262363138323630363834386162656236313365393766
+39616135303337303166313663383635636165373333313463623731346561356430326164663164
+30333839386564616133393630396538633032616332646639616161643739626437306532356136
+34383432626136336261666166633739313663333664663035333533626334623132373037663239
+38393638323833643730353432656365396161353161613733653562303731616462623436643832
+35376133653665333432303132383966333362313262393931373264616664643438346566333764
+34303439633538376439646435646631336361316436306330653838363665366461333366656239
+33303038643139643431613764333864306134666166376164623038333330613933333766643830
+30653637666533363234626465353734303538623233623532393936303566306434346537343932
+39393863373635626530326139376339653764623265636530323330376633363265636439353738
+32353634316162656461353666666338633233393039343935613539623766363237656161383364
+61356165313637343134363932333136643464353436323333653939613666653164303363656637
+32386561326461353665633339373038616464633430303763666234313032653735373832393539
+33333334663336346139373064633364353530366166636465343734633465623065666563383539
+30316166356239316530633239313765623438306234666235616464313765356165363435303336
+39633532393965646539356439396132616637383430653762616562323065343233383034363130
+32623331343035306165313637356131633963353035313838363439343133636631626532613366
+33323364616262303962

roles/caddy/defaults/main.yml

@@ -2,7 +2,7 @@
 # file: roles/caddy/defaults/main.yml
 
 # parent directory of vhost document roots
-caddy_root_prefix: /var/www
+caddy_root_prefix: "{{ web_root_prefix }}"
 
 # Email address to use for the ACME account managing the site's certificates.
 # Not sure what Caddy does if this doesn't exist.

roles/caddy/tasks/main.yml

@@ -18,7 +18,7 @@
     dest: /etc/apt/keyrings/caddy-stable-archive-keyring.key
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   register: download_caddy_signing_key
   when: not caddy_signing_key_stat.stat.exists
   tags:
@@ -27,7 +27,7 @@
 
 - name: Add Caddy stable repo
   ansible.builtin.apt_repository:
-    repo: 'deb [signed-by=/etc/apt/keyrings/caddy-stable-archive-keyring.key] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main'
+    repo: deb [signed-by=/etc/apt/keyrings/caddy-stable-archive-keyring.key] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main
     filename: caddy-stable
     state: present
   register: add_caddy_apt_repository
@@ -38,9 +38,7 @@
 - name: Update apt cache
   ansible.builtin.apt: # noqa no-handler
     update_cache: true
-  when:
-    (download_caddy_signing_key.status_code is defined and download_caddy_signing_key.status_code == 200) or
-    add_caddy_apt_repository is changed
+  when: (download_caddy_signing_key.status_code is defined and download_caddy_signing_key.status_code == 200) or add_caddy_apt_repository is changed
   tags:
     - packages
     - caddy
@@ -59,7 +57,7 @@
   ansible.builtin.template:
     src: etc/caddy/Caddyfile.j2
     dest: /etc/caddy/Caddyfile
-    mode: 0755
+    mode: "0755"
     owner: root
     group: root
   notify:
@@ -70,9 +68,10 @@
   ansible.builtin.file:
     path: /etc/caddy/conf.d
     state: directory
-    mode: 0755
+    mode: "0755"
     owner: root
     group: root
+  tags: caddy
 
 # TODO: the variable is still named nginx_vhosts
 - name: Configure Caddy virtual hosts

roles/caddy/tasks/vhosts.yml

@@ -1,10 +1,9 @@
 ---
-
 - name: Configure vhosts
   ansible.builtin.template:
     src: etc/caddy/conf.d/vhost.j2
     dest: /etc/caddy/conf.d/{{ item.domain_name }}
-    mode: 0644
+    mode: "0644"
     owner: root
     group: root
   loop: "{{ nginx_vhosts }}"

roles/caddy/templates/etc/caddy/conf.d/vhost.j2

@@ -8,6 +8,12 @@
 {% set needs_php      = item.needs_php | default(false) %}
 {% set has_gitea      = item.has_gitea | default(false) %}
 {% set static_site    = item.static_site | default(false) %}
+{# Allow sites to override the document root #}
+{% if item.document_root is defined %}
+{%   set document_root = item.document_root %}
+{% else %}
+{%   set document_root = (caddy_root_prefix, domain_name) | ansible.builtin.path_join %}
+{% endif %}
 
 {% if domain_aliases %}
 {#   domain_aliases is a string, so we split on space #}
@@ -21,15 +27,20 @@
 {{ domain_name }} {
     {% if has_gitea %}
     reverse_proxy :3000
-    {% endif %}
+    {% elif static_site -%}
+    root * {{ document_root }}
 
-    {% if static_site -%}
-    root * {{ item.document_root }}
-
-    encode zstd gzip
+    encode
 
     file_server
-    {% endif %}
+    {% elif has_wordpress -%}
+    root * {{ document_root }}
+    encode
+    {%   if ansible_distribution == 'Debian' and ansible_distribution_major_version is version('12', '==') -%}
+    php_fastcgi unix//run/php/php8.2-fpm-{{ domain_name }}.sock
+    {%   endif -%}
+    file_server
+    {% endif -%}
 
     import security-headers
 }

roles/common/files/abuseipdb-ipv6.nft

@@ -1,5 +0,0 @@
-#!/usr/sbin/nft -f
-
-define ABUSEIPDB_IPV6 = {
-fd21:3523:74e0:7301::
-}

roles/common/files/aggregate-cidr-addresses.pl

@@ -1,89 +0,0 @@
-#!/usr/bin/perl
-#
-# aggregate-cidr-addresses - combine a list of CIDR address blocks
-# Copyright (C) 2001,2007 Mark Suter <suter@zwitterion.org>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see L<http://www.gnu.org/licenses/>.
-#
-# [MJS 22 Oct 2001] Aggregate CIDR addresses
-# [MJS  9 Oct 2007] Overlap idea from Anthony Ledesma at theplanet dot com.
-# [MJS 16 Feb 2012] Prompted to clarify license by Alexander Talos-Zens - at at univie dot ac dot at
-# [MJS 21 Feb 2012] IPv6 fixes by Alexander Talos-Zens
-# [MJS 21 Feb 2012] Split ranges into prefixes (fixes a 10+ year old bug)
-
-use strict;
-use warnings;
-use English qw( -no_match_vars );
-use Net::IP;
-
-## Read in all the IP addresses
-my @addrs = map { Net::IP->new($_) or die "$PROGRAM_NAME: Not an IP: \"$_\"."; }
-    map { / \A \s* (.+?) \s* \Z /msix and $1; } <>;
-
-## Split any ranges into prefixes
-@addrs = map {
-    defined $_->prefixlen ? $_ : map { Net::IP->new($_) }
-        $_->find_prefixes
-} @addrs;
-
-## Sort the IP addresses
-@addrs = sort { $a->version <=> $b->version or $a->bincomp( 'lt', $b ) ? -1 : $a->bincomp( 'gt', $b ) ? 1 : 0 } @addrs;
-
-## Handle overlaps
-my $count   = 0;
-my $current = $addrs[0];
-foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
-    my $r = $current->overlaps($next);
-    if ( $current->version != $next->version or $r == $IP_NO_OVERLAP ) {
-        $current = $next;
-        $count++;
-    }
-    elsif ( $r == $IP_A_IN_B_OVERLAP ) {
-        $current = $next;
-        splice @addrs, $count, 1;
-    }
-    elsif ( $r == $IP_B_IN_A_OVERLAP or $r == $IP_IDENTICAL ) {
-        splice @addrs, $count + 1, 1;
-    }
-    else {
-        die "$PROGRAM_NAME: internal error - overlaps() returned an unexpected value!\n";
-    }
-}
-
-## Keep aggregating until we don't change anything
-my $change = 1;
-while ($change) {
-    $change = 0;
-    my @new_addrs = ();
-    $current = $addrs[0];
-    foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
-        if ( my $total = $current->aggregate($next) ) {
-            $current = $total;
-            $change  = 1;
-        }
-        else {
-            push @new_addrs, $current;
-            $current = $next;
-        }
-    }
-    push @new_addrs, $current;
-    @addrs = @new_addrs;
-}
-
-## Print out the IP addresses
-foreach (@addrs) {
-    print $_->prefix(), "\n";
-}
-
-# $Id: aggregate-cidr-addresses,v 1.9 2012/02/21 10:14:22 suter Exp suter $

roles/common/files/etc/cron-apt/3-download

@@ -1,2 +0,0 @@
-autoclean -y
-upgrade -y -o APT::Get::Show-Upgraded=true

roles/common/files/etc/cron-apt/config

@@ -1,5 +0,0 @@
-# Configuration for cron-apt. For further information about the possible
-# configuration settings see the README file.
-
-MAILON="never"
-OPTIONS="-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list -o Dir::Etc::SourceParts=\"/dev/null\""

roles/common/files/firehol_level1-ipv4.nft

@@ -1,5 +1,5 @@
 #!/usr/sbin/nft -f
 
-define SPAMHAUS_IPV4 = {
+define FIREHOL_LEVEL1_IPV4 = {
 192.168.254.254/32
 }

roles/common/files/spamhaus-ipv6.nft

@@ -1,5 +0,0 @@
-#!/usr/sbin/nft -f
-
-define SPAMHAUS_IPV6 = {
-fd21:3523:74e0:7301::/64
-}

roles/common/files/update-abusech-nftables.service

@@ -1,27 +0,0 @@
-[Unit]
-Description=Update Abuse.ch SSL Blacklist IPs
-# This service will fail if nftables is not running so we use Requires to make
-# sure that nftables is started.
-Requires=nftables.service
-# Make sure the network is up and nftables is started
-After=network-online.target nftables.service
-Wants=network-online.target update-abusech-nftables.timer
-
-[Service]
-# https://www.ctrl.blog/entry/systemd-service-hardening.html
-# Doesn't need access to /home or /root
-ProtectHome=true
-# Possibly only works on Ubuntu 18.04+
-ProtectKernelTunables=true
-ProtectSystem=full
-# Newer systemd can use ReadWritePaths to list files, but this works everywhere
-ReadWriteDirectories=/etc/nftables
-PrivateTmp=true
-WorkingDirectory=/var/tmp
-
-SyslogIdentifier=update-abusech-nftables
-ExecStart=/usr/bin/flock -x update-abusech-nftables.lck \
-          /usr/local/bin/update-abusech-nftables.sh
-
-[Install]
-WantedBy=multi-user.target

roles/common/files/update-abusech-nftables.sh

@@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-#
-# update-abuseipdb-nftables.sh v0.0.1
-#
-# Download IP addresses seen using a blacklisted SSL certificate and load them
-# into nftables sets. As of 2021-07-28 these appear to only be IPv4.
-# 
-# See: https://sslbl.abuse.ch/blacklist
-#
-# Copyright (C) 2021 Alan Orth
-#
-# SPDX-License-Identifier: GPL-3.0-only
-
-# Exit on first error
-set -o errexit
-
-abusech_ipv4_set_path=/etc/nftables/abusech-ipv4.nft
-abusech_list_temp=$(mktemp)
-
-echo "Downloading Abuse.sh SSL Blacklist IPs"
-
-abusech_response=$(curl -s -G -w "%{http_code}\n" https://sslbl.abuse.ch/blacklist/sslipblacklist.txt --output "$abusech_list_temp")
-
-if [[ $abusech_response -ne 200 ]]; then
-	echo "Abuse.ch responded: HTTP $abusech_response"
-
-	exit 1
-fi
-
-if [[ -f "$abusech_list_temp" ]]; then
-    echo "Processing IPv4 list"
-
-    abusech_ipv4_list_temp=$(mktemp)
-    abusech_ipv4_set_temp=$(mktemp)
-
-    # Remove comments, DOS carriage returns, and IPv6 addresses (even though
-    # Abuse.ch seems to only have IPv4 addresses, let's not break our shit on
-    # that assumption some time down the line).
-    sed -e '/#/d' -e 's/
-//' -e '/:/d' "$abusech_list_temp" > "$abusech_ipv4_list_temp"
-
-    echo "Building abusech-ipv4 set"
-    cat << NFT_HEAD > "$abusech_ipv4_set_temp"
-#!/usr/sbin/nft -f
-
-define ABUSECH_IPV4 = {
-NFT_HEAD
-
-    while read -r network; do
-        # nftables doesn't mind if the last element in the set has a trailing
-        # comma so we don't need to do anything special here.
-        echo "$network," >> "$abusech_ipv4_set_temp"
-    done < $abusech_ipv4_list_temp
-
-    echo "}" >> "$abusech_ipv4_set_temp"
-
-    install -m 0600 "$abusech_ipv4_set_temp" "$abusech_ipv4_set_path"
-
-    rm -f "$abusech_list_temp" "$abusech_ipv4_list_temp" "$abusech_ipv4_set_temp"
-fi
-
-echo "Reloading nftables"
-# The abusech nftables sets are included by nftables.conf

roles/common/files/update-abusech-nftables.timer

@@ -1,12 +0,0 @@
-[Unit]
-Description=Update Abuse.ch SSL Blacklist IPs
-
-[Timer]
-# Once a day at midnight
-OnCalendar=*-*-* 00:00:00
-# Add a random delay of 0–3600 seconds
-RandomizedDelaySec=3600
-Persistent=true
-
-[Install]
-WantedBy=timers.target

roles/common/files/update-firehol-nftables.service

@@ -1,11 +1,11 @@
 [Unit]
-Description=Update Spamhaus lists
+Description=Update FireHOL lists
 # This service will fail if nftables is not running so we use Requires to make
 # sure that nftables is started.
 Requires=nftables.service
 # Make sure the network is up and nftables is started
 After=network-online.target nftables.service
-Wants=network-online.target update-spamhaus-nftables.timer
+Wants=network-online.target update-firehol-nftables.timer
 
 [Service]
 # https://www.ctrl.blog/entry/systemd-service-hardening.html
@@ -19,9 +19,9 @@ ReadWriteDirectories=/etc/nftables
 PrivateTmp=true
 WorkingDirectory=/var/tmp
 
-SyslogIdentifier=update-spamhaus-nftables
-ExecStart=/usr/bin/flock -x update-spamhaus-nftables.lck \
-          /usr/local/bin/update-spamhaus-nftables.sh
+SyslogIdentifier=update-firehol-nftables
+ExecStart=/usr/bin/flock -x update-firehol-nftables.lck \
+          /usr/local/bin/update-firehol-nftables.sh
 
 [Install]
 WantedBy=multi-user.target

roles/common/files/update-firehol-nftables.timer

@@ -1,5 +1,5 @@
 [Unit]
-Description=Update Spamhaus lists
+Description=Update FireHOL lists
 
 [Timer]
 # Once a day at midnight

roles/common/files/update-spamhaus-nftables.sh

@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-#
-# update-spamhaus-nftables.sh v0.0.1
-#
-# Download Spamhaus DROP lists and load them into nftables sets.
-# 
-# See: https://www.spamhaus.org/drop/
-#
-# Copyright (C) 2021 Alan Orth
-#
-# SPDX-License-Identifier: GPL-3.0-only
-
-# Exit on first error
-set -o errexit
-
-spamhaus_ipv4_set_path=/etc/nftables/spamhaus-ipv4.nft
-spamhaus_ipv6_set_path=/etc/nftables/spamhaus-ipv6.nft
-
-function download() {
-    echo "Downloading $1"
-    wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
-}
-
-download drop.txt
-download edrop.txt
-download dropv6.txt
-
-if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
-    echo "Processing IPv4 DROP lists"
-
-    spamhaus_ipv4_list_temp=$(mktemp)
-    spamhaus_ipv4_set_temp=$(mktemp)
-
-    # Extract all networks from drop.txt and edrop.txt, skipping blank lines and
-    # comments. Use aggregate-cidr-addresses.pl to merge overlapping IPv4 CIDR
-    # ranges to work around a firewalld bug.
-    #
-    # See: https://bugzilla.redhat.com/show_bug.cgi?id=1836571
-    cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' | aggregate-cidr-addresses.pl > "$spamhaus_ipv4_list_temp"
-
-    echo "Building spamhaus-ipv4 set"
-    cat << NFT_HEAD > "$spamhaus_ipv4_set_temp"
-#!/usr/sbin/nft -f
-
-define SPAMHAUS_IPV4 = {
-NFT_HEAD
-
-    while read -r network; do
-        # nftables doesn't mind if the last element in the set has a trailing
-        # comma so we don't need to do anything special here.
-        echo "$network," >> "$spamhaus_ipv4_set_temp"
-    done < $spamhaus_ipv4_list_temp
-
-    echo "}" >> "$spamhaus_ipv4_set_temp"
-
-    install -m 0600 "$spamhaus_ipv4_set_temp" "$spamhaus_ipv4_set_path"
-
-    rm -f "$spamhaus_ipv4_list_temp" "$spamhaus_ipv4_set_temp"
-fi
-
-if [[ -f "dropv6.txt" ]]; then
-    echo "Processing IPv6 DROP lists"
-
-    spamhaus_ipv6_list_temp=$(mktemp)
-    spamhaus_ipv6_set_temp=$(mktemp)
-
-    sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt > "$spamhaus_ipv6_list_temp"
-
-    echo "Building spamhaus-ipv6 set"
-    cat << NFT_HEAD > "$spamhaus_ipv6_set_temp"
-#!/usr/sbin/nft -f
-
-define SPAMHAUS_IPV6 = {
-NFT_HEAD
-
-    while read -r network; do
-        echo "$network," >> "$spamhaus_ipv6_set_temp"
-    done < $spamhaus_ipv6_list_temp
-
-    echo "}" >> "$spamhaus_ipv6_set_temp"
-
-    install -m 0600 "$spamhaus_ipv6_set_temp" "$spamhaus_ipv6_set_path"
-
-    rm -f "$spamhaus_ipv6_list_temp" "$spamhaus_ipv6_set_temp"
-fi
-
-echo "Reloading nftables"
-# The spamhaus nftables sets are included by nftables.conf
-/usr/sbin/nft -f /etc/nftables.conf
-
-rm -v drop.txt edrop.txt dropv6.txt

roles/common/handlers/main.yml

@@ -2,19 +2,26 @@
 # ansible.builtin.file: roles/common/handlers/main.yml
 
 - name: reload sshd
-  ansible.builtin.systemd: name={{ sshd_service_name }} state=reloaded
+  ansible.builtin.systemd:
+    name: "{{ sshd_service_name }}"
+    state: reloaded
 
 - name: reload sysctl
   command: sysctl -p /etc/sysctl.conf
 
 - name: reload systemd
-  ansible.builtin.systemd: daemon_reload=true
+  ansible.builtin.systemd:
+    daemon_reload: true
 
 - name: restart nftables
-  ansible.builtin.systemd: name=nftables state=restarted
+  ansible.builtin.systemd:
+    name: nftables
+    state: restarted
 
 # 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed
 # in the order they are defined, not in the order they are listed in the task's
 # notify statement and we must restart fail2ban after updating the firewall.
 - name: restart fail2ban
-  ansible.builtin.systemd: name=fail2ban state=restarted
+  ansible.builtin.systemd:
+    name: fail2ban
+    state: restarted

roles/common/tasks/cron-apt.yml

@@ -1,12 +1,17 @@
 ---
+- name: Remove cron-apt
+  ansible.builtin.apt:
+    name: cron-apt
+    state: absent
+    cache_valid_time: 3600
 
-- name: Configure cron-apt (config)
-  ansible.builtin.copy: src={{ item.src }} dest={{ item.dest }} mode={{ item.mode }} owner={{ item.owner }} group={{ item.group }}
+- name: Remove cron-apt configs
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
   loop:
-    - { src: 'etc/cron-apt/config', dest: '/etc/cron-apt/config', mode: '0644', owner: 'root', group: 'root' }
-    - { src: 'etc/cron-apt/3-download', dest: '/etc/cron-apt/action.d/3-download', mode: '0644', owner: 'root', group: 'root' }
-
-- name: Configure cron-apt (security)
-  ansible.builtin.template: src=security.sources.list.j2 dest=/etc/apt/security.sources.list mode=0644 owner=root group=root
+    - /etc/cron-apt/config
+    - /etc/cron-apt/action.d/3-download
+    - /etc/apt/security.sources.list
 
 # vim: set ts=2 sw=2:

roles/common/tasks/fail2ban.yml

@@ -1,21 +1,32 @@
 ---
+- name: Install fail2ban
+  when:
+    - ansible_distribution_major_version is version('11', '>=')
+  ansible.builtin.package:
+    name:
+      - fail2ban
+      - python3-systemd
+    state: present
+    cache_valid_time: 3600
+
 - name: Configure fail2ban sshd filter
   ansible.builtin.template:
     src: etc/fail2ban/jail.d/sshd.local.j2
     dest: /etc/fail2ban/jail.d/sshd.local
     owner: root
-    mode: 0644
+    mode: "0644"
   notify: restart fail2ban
 
 - name: Configure fail2ban nginx filter
   when:
+    - webserver is defined and webserver == 'nginx'
     - extra_fail2ban_filters is defined
     - "'nginx' in extra_fail2ban_filters"
   ansible.builtin.template:
     src: etc/fail2ban/jail.d/nginx.local.j2
     dest: /etc/fail2ban/jail.d/nginx.local
     owner: root
-    mode: 0644
+    mode: "0644"
   notify: restart fail2ban
 
 - name: Create fail2ban service override directory
@@ -23,7 +34,7 @@
     path: /etc/systemd/system/fail2ban.service.d
     state: directory
     owner: root
-    mode: 0755
+    mode: "0755"
 
 # See Arch Linux's example: https://wiki.archlinux.org/index.php/Fail2ban
 - name: Configure fail2ban service override
@@ -31,7 +42,7 @@
     src: etc/systemd/system/fail2ban.service.d/override.conf.j2
     dest: /etc/systemd/system/fail2ban.service.d/override.conf
     owner: root
-    mode: 0644
+    mode: "0644"
   notify:
     - reload systemd
     - restart fail2ban

roles/common/tasks/firewall.yml

@@ -0,0 +1,20 @@
+---
+- name: Configure firewall (Debian)
+  when: ansible_distribution == 'Debian'
+  ansible.builtin.include_tasks:
+    file: firewall_Debian.yml
+    apply:
+      tags:
+        - firewall
+  tags: firewall
+
+- name: Configure firewall (Ubuntu)
+  when: ansible_distribution == 'Ubuntu'
+  ansible.builtin.include_tasks:
+    file: firewall_Ubuntu.yml
+    apply:
+      tags:
+        - firewall
+  tags: firewall
+
+

roles/common/tasks/firewall_Debian.yml

@@ -1,116 +1,28 @@
 ---
 # Debian 11+ will use nftables directly, with no firewalld.
 
-- block:
-  - name: Install Debian firewall packages
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.package:
-      name:
-        - fail2ban
-        - libnet-ip-perl # for aggregate-cidr-addresses.pl
-        - nftables
-        - python3-systemd
-        - curl # for nftables update scripts
-      state: present
-      cache_valid_time: 3600
+- name: Install Debian firewall packages
+  when: ansible_distribution_major_version is version('11', '>=')
+  ansible.builtin.package:
+    name:
+      - libnet-ip-perl # for aggregate-cidr-addresses.pl
+      - nftables
+      - curl # for nftables update scripts
+    state: present
+    cache_valid_time: 3600
 
-  - name: Remove iptables on newer Debian
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.apt:
-      pkg: iptables
-      state: absent
+- name: Remove iptables on newer Debian
+  when: ansible_distribution_major_version is version('11', '>=')
+  ansible.builtin.apt:
+    pkg: iptables
+    state: absent
 
-  - name: Copy nftables.conf
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.template:
-      src: nftables.conf.j2
-      dest: /etc/nftables.conf
-      owner: root
-      mode: 0644
-    notify:
-      - restart nftables
-      - restart fail2ban
+- name: Configure nftables
+  ansible.builtin.include_tasks: nftables.yml
+  when: ansible_distribution_version is version('11', '>=')
 
-  - name: Create /etc/nftables extra config directory
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.file:
-      path: /etc/nftables
-      state: directory
-      owner: root
-      mode: 0755
-
-  - name: Copy extra nftables configuration files
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.copy:
-      src: "{{ item.src }}"
-      dest: "/etc/nftables/{{ item.src }}"
-      owner: root
-      group: root
-      mode: 0644
-      force: "{{ item.force }}"
-    loop:
-      - { src: "spamhaus-ipv4.nft", force: "no" }
-      - { src: "spamhaus-ipv6.nft", force: "no" }
-      - { src: "abusech-ipv4.nft", force: "no" }
-      - { src: "abuseipdb-ipv4.nft", force: "yes" }
-      - { src: "abuseipdb-ipv6.nft", force: "yes" }
-    notify:
-      - restart nftables
-      - restart fail2ban
-
-  - name: Copy nftables update scripts
-    when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.copy:
-      src: "{{ item }}"
-      dest: "/usr/local/bin/{{ item }}"
-      mode: 0755
-      owner: root
-      group: root
-    loop:
-      - update-spamhaus-nftables.sh
-      - aggregate-cidr-addresses.pl
-      - update-abusech-nftables.sh
-
-  - name: Copy nftables systemd units
-    when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.copy:
-      src: "{{ item }}"
-      dest: "/etc/systemd/system/{{ item }}"
-      mode: 0644
-      owner: root
-      group: root
-    loop:
-      - update-spamhaus-nftables.service
-      - update-spamhaus-nftables.timer
-      - update-abusech-nftables.service
-      - update-abusech-nftables.timer
-    register: nftables_systemd_units
-
-  # need to reload to pick up service/timer/environment changes
-  - name: Reload systemd daemon
-    ansible.builtin.systemd:
-      daemon_reload: true
-    when: nftables_systemd_units is changed
-
-  - name: Start and enable nftables update timers
-    when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.systemd:
-      name: "{{ item }}"
-      state: started
-      enabled: true
-    loop:
-      - update-spamhaus-nftables.timer
-      - update-abusech-nftables.timer
-
-  - name: Start and enable nftables
-    when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.systemd:
-      name: nftables
-      state: started
-      enabled: true
-
-  - ansible.builtin.include_tasks: fail2ban.yml
-    when: ansible_distribution_major_version is version('9', '>=')
-  tags: firewall
+- ansible.builtin.include_tasks: fail2ban.yml
+  when:
+    - ansible_distribution_major_version is version('9', '>=')
 
 # vim: set sw=2 ts=2:

roles/common/tasks/firewall_Ubuntu.yml

@@ -1,114 +1,27 @@
 ---
 # Ubuntu 20.04 will use nftables directly, with no firewalld.
 
-- block:
-  - name: Install Ubuntu firewall packages
-    ansible.builtin.package:
-      name:
-        - fail2ban
-        - libnet-ip-perl # for aggregate-cidr-addresses.pl
-        - nftables
-        - python3-systemd
-        - curl # for nftables update scripts
-      state: present
-      cache_valid_time: 3600
+- name: Install Ubuntu firewall packages
+  when: ansible_distribution_version is version('20.04', '>=')
+  ansible.builtin.package:
+    name:
+      - libnet-ip-perl # for aggregate-cidr-addresses.pl
+      - nftables
+      - curl # for nftables update scripts
+    state: present
+    cache_valid_time: 3600
 
-  - name: Remove ufw
-    ansible.builtin.package:
-      name: ufw
-      state: absent
+- name: Remove ufw
+  ansible.builtin.package:
+    name: ufw
+    state: absent
 
-  - name: Copy nftables.conf
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.template:
-      src: nftables.conf.j2
-      dest: /etc/nftables.conf
-      owner: root
-      mode: 0644
-    notify:
-      - restart nftables
-      - restart fail2ban
+- name: Configure nftables
+  ansible.builtin.include_tasks: nftables.yml
+  when: ansible_distribution_version is version('20.04', '>=')
 
-  - name: Create /etc/nftables extra config directory
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.file:
-      path: /etc/nftables
-      state: directory
-      owner: root
-      mode: 0755
-
-  - name: Copy extra nftables configuration files
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy:
-      src: "{{ item.src }}"
-      dest: "/etc/nftables/{{ item.src }}"
-      owner: root
-      group: root
-      mode: 0644
-      force: "{{ item.force }}"
-    loop:
-      - { src: "spamhaus-ipv4.nft", force: "no" }
-      - { src: "spamhaus-ipv6.nft", force: "no" }
-      - { src: "abusech-ipv4.nft", force: "no" }
-      - { src: "abuseipdb-ipv4.nft", force: "yes" }
-      - { src: "abuseipdb-ipv6.nft", force: "yes" }
-    notify:
-      - restart nftables
-      - restart fail2ban
-
-  - name: Copy nftables update scripts
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy:
-      src: "{{ item }}"
-      dest: "/usr/local/bin/{{ item }}"
-      mode: 0755
-      owner: root
-      group: root
-    loop:
-      - update-spamhaus-nftables.sh
-      - aggregate-cidr-addresses.pl
-      - update-abusech-nftables.sh
-
-  - name: Copy nftables systemd units
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy:
-      src: "{{ item }}"
-      dest: "/etc/systemd/system/{{ item }}"
-      mode: 0644
-      owner: root
-      group: root
-    loop:
-        - update-spamhaus-nftables.service
-        - update-spamhaus-nftables.timer
-        - update-abusech-nftables.service
-        - update-abusech-nftables.timer
-    register: nftables_systemd_units
-
-  # need to reload to pick up service/timer/environment changes
-  - name: Reload systemd daemon
-    ansible.builtin.systemd:
-      daemon_reload: true
-    when: nftables_systemd_units is changed
-
-  - name: Start and enable nftables update timers
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.systemd:
-      name: "{{ item }}"
-      state: started
-      enabled: true
-    loop:
-      - update-spamhaus-nftables.timer
-      - update-abusech-nftables.timer
-
-  - name: Start and enable nftables
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.systemd:
-      name: nftables
-      state: started
-      enabled: true
-
-  - ansible.builtin.include_tasks: fail2ban.yml
-    when: ansible_distribution_version is version('16.04', '>=')
-  tags: firewall
+- ansible.builtin.include_tasks: fail2ban.yml
+  when:
+    - ansible_distribution_version is version('16.04', '>=')
 
 # vim: set sw=2 ts=2:

roles/common/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 - name: Import OS-specific variables
-  ansible.builtin.include_vars: "vars/{{ ansible_distribution }}.yml"
+  ansible.builtin.include_vars: vars/{{ ansible_distribution }}.yml
   tags: always
 
 - name: Configure network time
@@ -18,13 +18,7 @@
   tags: packages
 
 - name: Configure firewall
-  ansible.builtin.include_tasks: firewall_Debian.yml
-  when: ansible_distribution == 'Debian'
-  tags: firewall
-
-- name: Configure firewall
-  ansible.builtin.include_tasks: firewall_Ubuntu.yml
-  when: ansible_distribution == 'Ubuntu'
+  ansible.builtin.import_tasks: firewall.yml
   tags: firewall
 
 - name: Configure secure shell daemon

roles/common/tasks/nftables.yml

@@ -0,0 +1,97 @@
+---
+# Common nftables tasks for Ubuntu 20.04, Ubuntu 22.04, Ubuntu 24.04, Debian 11,
+# and Debian 12.
+
+- name: Copy nftables.conf
+  ansible.builtin.template:
+    src: nftables.conf.j2
+    dest: /etc/nftables.conf
+    owner: root
+    mode: "0644"
+  notify:
+    - restart nftables
+    - restart fail2ban
+
+- name: Create /etc/nftables extra config directory
+  ansible.builtin.file:
+    path: /etc/nftables
+    state: directory
+    owner: root
+    mode: "0755"
+
+- name: Copy extra nftables configuration files
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: /etc/nftables/{{ item.src }}
+    owner: root
+    group: root
+    mode: "0644"
+    force: "{{ item.force }}"
+  loop:
+    - { src: firehol_level1-ipv4.nft, force: false }
+  notify:
+    - restart nftables
+    - restart fail2ban
+
+- name: Copy nftables update scripts
+  ansible.builtin.template:
+    src: update-firehol-nftables.sh.j2
+    dest: /usr/local/bin/update-firehol-nftables.sh
+    mode: "0755"
+    owner: root
+    group: root
+
+- name: Remove deprecated data and scripts
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /etc/nftables/spamhaus-ipv4.nft
+    - /etc/nftables/spamhaus-ipv6.nft
+    - /etc/nftables/abuseipdb-ipv4.nft
+    - /etc/nftables/abuseipdb-ipv6.nft
+    - /etc/nftables/abusech-ipv4.nft
+    - /usr/local/bin/update-abusech-nftables.sh
+    - /usr/local/bin/update-spamhaus-nftables.sh
+    - /etc/systemd/system/update-abusech-nftables.service
+    - /etc/systemd/system/update-abusech-nftables.timer
+    - /etc/systemd/system/update-spamhaus-nftables.service
+    - /etc/systemd/system/update-spamhaus-nftables.timer
+    - /usr/local/bin/aggregate-cidr-addresses.pl
+  notify:
+    - restart nftables
+    - restart fail2ban
+
+- name: Copy nftables systemd units
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: /etc/systemd/system/{{ item }}
+    mode: "0644"
+    owner: root
+    group: root
+  loop:
+    - update-firehol-nftables.service
+    - update-firehol-nftables.timer
+  register: nftables_systemd_units
+
+# need to reload to pick up service/timer/environment changes
+- name: Reload systemd daemon
+  ansible.builtin.systemd: # noqa no-handler
+    daemon_reload: true
+  when: nftables_systemd_units is changed
+
+- name: Start and enable nftables update timers
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    state: started
+    enabled: true
+  loop:
+    - update-firehol-nftables.timer
+
+- name: Start and enable nftables
+  ansible.builtin.systemd:
+    name: nftables
+    state: started
+    enabled: true
+
+# vim: set sw=2 ts=2:

roles/common/tasks/ntp.yml

@@ -4,16 +4,19 @@
 # client.
 
 - name: Set timezone
-  when: timezone is defined and ansible_service_mgr == 'systemd'
-  command: /usr/bin/timedatectl set-timezone {{ timezone }}
+  when:
+    - timezone is defined
+    - ansible_service_mgr == 'systemd'
+  community.general.timezone:
+    name: "{{ timezone }}"
   tags: timezone
 
 # Apparently some cloud images don't have this installed by default. From what
 # I can see on existing servers, systemd-timesyncd is a standalone package on
 # Ubuntu 20.04 and Debian 11.
 - name: Install systemd-timesyncd
-  when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or
-        (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '>='))
+  when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_version
+    is version('11', '>='))
   ansible.builtin.apt: name=systemd-timesyncd state=present cache_valid_time=3600
 
 - name: Start and enable systemd's NTP client

roles/common/tasks/packages_Debian.yml

@@ -1,20 +1,6 @@
 ---
-
 - name: Configure Debian packages
   block:
-    # Create directory for third-party package signing keys. Required on distros
-    # older than Debian 12 / Ubuntu 22.04.
-    #
-    # See: https://wiki.debian.org/DebianRepository/UseThirdParty
-    - name: Create /etc/apt/keyrings
-      file:
-        path: /etc/apt/keyrings
-        mode: 0755
-        owner: root
-        group: root
-        state: directory
-      when: ansible_distribution_major_version is version('12', '<')
-
     # Scaleway seems to use a weird sources.list format as of Debian 12?
     - name: Check for weird Debian sources
       ansible.builtin.stat:
@@ -36,7 +22,6 @@
           - iotop
           - htop
           - strace
-          - cron-apt
           - safe-rm
           - debian-goodies
           - mosh
@@ -48,11 +33,12 @@
           - zstd
           - rsync
           - lsof
+          - unattended-upgrades
 
     - name: Install base packages
       ansible.builtin.apt: name={{ base_packages }} state=present cache_valid_time=3600
 
-    - name: Configure cron-apt
+    - name: Remove cron-apt
       ansible.builtin.import_tasks: cron-apt.yml
       tags: cron-apt
 

roles/common/tasks/packages_Ubuntu.yml

@@ -1,20 +1,6 @@
 ---
-
 - name: Configure Ubuntu packages
   block:
-    # Create directory for third-party package signing keys. Required on distros
-    # older than Debian 12 / Ubuntu 22.04.
-    #
-    # See: https://wiki.debian.org/DebianRepository/UseThirdParty
-    - name: Create /etc/apt/keyrings
-      file:
-        path: /etc/apt/keyrings
-        mode: 0755
-        owner: root
-        group: root
-        state: directory
-      when: ansible_distribution_major_version is version('22.04', '<')
-
     - name: Configure apt mirror
       ansible.builtin.template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
       when: ansible_architecture != 'armv7l'
@@ -25,59 +11,27 @@
     - name: Set Ubuntu base packages
       ansible.builtin.set_fact:
         ubuntu_base_packages:
-        - git
-        - git-lfs
-        - tmux
-        - iotop
-        - htop
-        - strace
-        - cron-apt
-        - safe-rm
-        - debian-goodies
-        - mosh
-        - python-pycurl # for ansible's apt_repository
-        - vim
-        - unzip
-        - apt-transport-https # for https support in apt
-        - zstd
-        - rsync
-        - lsof
+          - git
+          - git-lfs
+          - tmux
+          - iotop
+          - htop
+          - strace
+          - cron-apt
+          - safe-rm
+          - debian-goodies
+          - mosh
+          - python-pycurl # for ansible's apt_repository
+          - vim
+          - unzip
+          - apt-transport-https # for https support in apt
+          - zstd
+          - rsync
+          - lsof
 
     - name: Install base packages
       ansible.builtin.apt: pkg={{ ubuntu_base_packages }} state=present cache_valid_time=3600
 
-    # We have to remove snaps one by one in a specific order because some depend
-    # on others. Only after that can we remove the corresponding system packages.
-    - name: Remove lxd snap
-      community.general.snap: name=lxd state=absent
-      when: ansible_distribution_version is version('20.04', '==')
-      ignore_errors: true
-
-    - name: Remove core18 snap
-      community.general.snap: name=core18 state=absent
-      when: ansible_distribution_version is version('20.04', '==')
-      ignore_errors: true
-
-    - name: Remove snapd snap
-      community.general.snap: name=snapd state=absent
-      when: ansible_distribution_version is version('20.04', '==')
-      ignore_errors: true
-
-    - name: Set fact for packages to remove (Ubuntu 20.04)
-      ansible.builtin.set_fact:
-        ubuntu_annoying_packages:
-          - whoopsie # security (CIS 4.1)
-          - apport   # security (CIS 4.1)
-          - command-not-found # annoying
-          - command-not-found-data # annoying
-          - python3-commandnotfound # annoying
-          - snapd # annoying (Ubuntu >= 16.04)
-          - lxd-agent-loader # annoying (Ubuntu 20.04)
-      when: ansible_distribution_version is version('20.04', '==')
-
-    - name: Remove packages
-      ansible.builtin.apt: name={{ ubuntu_annoying_packages }} state=absent purge=true
-
     - name: Disable annoying Canonical spam in MOTD
       ansible.builtin.file: path={{ item }} mode=0644 state=absent
       loop:

roles/common/tasks/ssh-keys.yml

@@ -3,7 +3,7 @@
   ansible.builtin.file: dest={{ provisioning_user.home }}/.ssh/authorized_keys state=absent
 
 - name: Add public keys to authorized_keys
-  ansible.posix.authorized_key: { user: '{{ provisioning_user.name }}', key: "{{ lookup('file',item) }}" }
+  ansible.posix.authorized_key: { user: "{{ provisioning_user.name }}", key: "{{ lookup('file',item) }}" }
   with_fileglob:
     # use descriptive names for keys, like: aorth-mzito-rsa.pub
     - ssh-pub-keys/*.pub

roles/common/tasks/sshd.yml

@@ -1,8 +1,8 @@
 ---
-
 # SSH configs don't change in Debian minor versions
 - name: Reconfigure /etc/ssh/sshd_config
-  ansible.builtin.template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
+  ansible.builtin.template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root
+    mode=0600
   when: ansible_distribution == 'Debian'
   notify: reload sshd
 

roles/common/tasks/tarsnap.yml

@@ -1,24 +1,45 @@
 ---
-- name: Add Tarsnap apt mirror
-  ansible.builtin.template: src=tarsnap_sources.list.j2 dest=/etc/apt/sources.list.d/tarsnap.list owner=root group=root mode=0644
+- name: Check tarsnap apt signing key
+  ansible.builtin.stat:
+    path: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
+  register: tarsnap_signing_key_stat
+
+- name: Download tarsnap apt signing key
+  ansible.builtin.get_url:
+    url: https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc
+    dest: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
+    owner: root
+    group: root
+    mode: "0644"
+  register: download_tarsnap_signing_key
+  when: not tarsnap_signing_key_stat.stat.exists
+
+- name: Add tarsnap.org repo
+  ansible.builtin.template:
+    src: tarsnap_sources.list.j2
+    dest: /etc/apt/sources.list.d/tarsnap.list
+    owner: root
+    group: root
+    mode: "0644"
   register: add_tarsnap_apt_repository
   when: ansible_architecture != 'armv7l'
 
-- name: Add GPG key for Tarsnap
-  ansible.builtin.apt_key: id=0xF608BA1BFB5CE8F8CAB088359F084BEE7F938A76 url=https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc state=present
-  register: add_tarsnap_apt_key
-
 - name: Update apt cache
-  ansible.builtin.apt:
+  ansible.builtin.apt: # noqa no-handler
     update_cache: true
-  when:
-    add_tarsnap_apt_key is changed or
-    add_tarsnap_apt_repository is changed
+  when: (download_tarsnap_signing_key.status_code is defined and download_tarsnap_signing_key.status_code == 200) or add_tarsnap_apt_repository is changed
 
 - name: Install tarsnap
-  ansible.builtin.apt: pkg=tarsnap cache_valid_time=3600
+  ansible.builtin.apt:
+    pkg: tarsnap
+    cache_valid_time: 3600
 
 - name: Copy tarsnaprc
-  ansible.builtin.copy: src=tarsnaprc dest=/root/.tarsnaprc owner=root group=root mode=0600
+  ansible.builtin.copy:
+    src: tarsnaprc
+    dest: /root/.tarsnaprc
+    owner: root
+    group: root
+    mode: "0600"
 
 # vim: set sw=2 ts=2:

roles/common/templates/nftables.conf.j2

@@ -5,47 +5,18 @@
 
 flush ruleset
 
-# Lists updated daily by update-spamhaus-nftables.sh
-include "/etc/nftables/spamhaus-ipv4.nft"
-include "/etc/nftables/spamhaus-ipv6.nft"
-
-# Lists updated monthly (manually)
-include "/etc/nftables/abuseipdb-ipv4.nft"
-include "/etc/nftables/abuseipdb-ipv6.nft"
-
-# Lists updated daily by update-abusech-nftables.sh
-include "/etc/nftables/abusech-ipv4.nft"
+# List updated daily by update-firehol-nftables.sh
+include "/etc/nftables/firehol_level1-ipv4.nft"
 
 # Notes:
 #   - tables hold chains, chains hold rules
 #   - inet is for both ipv4 and ipv6
 table inet filter {
-    set spamhaus-ipv4 {
+    set firehol_level1-ipv4 {
         type ipv4_addr
         # if the set contains prefixes we need to use the interval flag
         flags interval
-        elements = $SPAMHAUS_IPV4
-    }
-
-    set spamhaus-ipv6 {
-        type ipv6_addr
-        flags interval
-        elements = $SPAMHAUS_IPV6
-    }
-
-    set abusech-ipv4 {
-        type ipv4_addr
-        elements = $ABUSECH_IPV4
-    }
-
-    set abuseipdb-ipv4 {
-        type ipv4_addr
-        elements = $ABUSEIPDB_IPV4
-    }
-
-    set abuseipdb-ipv6 {
-        type ipv6_addr
-        elements = $ABUSEIPDB_IPV6
+        elements = $FIREHOL_LEVEL1_IPV4
     }
 
     chain input {
@@ -55,13 +26,7 @@ table inet filter {
 
         ct state invalid counter drop comment "Early drop of invalid connections"
 
-        ip saddr @spamhaus-ipv4 counter drop comment "Early drop of incoming packets matching spamhaus-ipv4 list"
-        ip6 saddr @spamhaus-ipv6 counter drop comment "Early drop of incoming packets matching spamhaus-ipv6 list"
-
-        ip saddr @abusech-ipv4 counter drop comment "Early drop of packets matching abusech-ipv4 list"
-
-        ip saddr @abuseipdb-ipv4 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv4 list"
-        ip6 saddr @abuseipdb-ipv6 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv6 list"
+        ip saddr @firehol_level1-ipv4 counter drop comment "Early drop of incoming packets matching firehol_level1-ipv4 list"
 
         iifname lo accept comment "Allow from loopback"
 
@@ -105,12 +70,6 @@ table inet filter {
     chain output {
         type filter hook output priority 0;
 
-        ip daddr @spamhaus-ipv4 counter drop comment "Drop outgoing packets matching spamhaus-ipv4 list"
-        ip6 daddr @spamhaus-ipv6 counter drop comment "Drop outgoing packets matching spamhaus-ipv6 list"
-
-        ip daddr @abusech-ipv4 counter drop comment "Drop outgoing packets matching abusech-ipv4 list"
-
-        ip daddr @abuseipdb-ipv4 counter drop comment "Drop outgoing packets matching abuseipdb-ipv4 list"
-        ip6 daddr @abuseipdb-ipv6 counter drop comment "Drop outgoing packets matching abuseipdb-ipv6 list"
+        ip daddr @firehol_level1-ipv4 counter drop comment "Drop outgoing packets matching firehol_level1-ipv4 list"
     }
 }

roles/common/templates/security.sources.list.j2

@@ -1,5 +0,0 @@
-{% if ansible_distribution == 'Ubuntu' %}
-deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security main restricted universe multiverse
-{% elif ansible_distribution == 'Debian' %}
-deb http://security.debian.org/debian-security {{ ansible_distribution_release }}/updates main contrib non-free
-{% endif %}

roles/common/templates/tarsnap_sources.list.j2

@@ -1 +1 @@
-deb [arch=amd64] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./
+deb [arch=amd64 signed-by=/etc/apt/keyrings/tarsnap-deb-packaging-key.asc] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./

roles/common/templates/update-firehol-nftables.sh.j2

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+#
+# update-firehol-nftables.sh v0.0.1
+#
+# Download FireHOL lists and load them into nftables sets.
+# 
+# See: https://iplists.firehol.org/
+#
+# Copyright (C) 2025 Alan Orth
+#
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Exit on first error
+set -o errexit
+
+firehol_level1_ipv4_set_path=/etc/nftables/firehol_level1-ipv4.nft
+
+function download() {
+    echo "Downloading $1"
+    wget -q -O - "https://iplists.firehol.org/files/$1" > "$1"
+}
+
+download firehol_level1.netset
+
+if [[ -f "firehol_level1.netset" ]]; then
+    echo "Processing FireHOL Level 1 list"
+
+    firehol_level1_ipv4_list_temp=$(mktemp)
+    firehol_level1_ipv4_set_temp=$(mktemp)
+
+    # Filter blank lines, comments, and bogons we use inside the LAN, DMZ, and
+    # for local services like systemd-resolved and others on localhost. Ideally
+    # these are blocked already at the WAN side by network administrators.
+    cat firehol_level1.netset \
+        | sed \
+            -e '/^$/d' \
+            -e '/^#.*/d' \
+            -e '/^127\.0\.0\.0\/8/d' \
+        > "$firehol_level1_ipv4_list_temp"
+
+    echo "Building firehol_level1-ipv4 set"
+    cat << NFT_HEAD > "$firehol_level1_ipv4_set_temp"
+#!/usr/sbin/nft -f
+
+define FIREHOL_LEVEL1_IPV4 = {
+NFT_HEAD
+
+    while read -r network; do
+        # nftables doesn't mind if the last element in the set has a trailing
+        # comma so we don't need to do anything special here.
+        echo "$network," >> "$firehol_level1_ipv4_set_temp"
+    done < $firehol_level1_ipv4_list_temp
+
+    echo "}" >> "$firehol_level1_ipv4_set_temp"
+
+    install -m 0600 "$firehol_level1_ipv4_set_temp" "$firehol_level1_ipv4_set_path"
+
+    rm -f "$firehol_level1_ipv4_list_temp" "$firehol_level1_ipv4_set_temp"
+fi
+
+echo "Reloading nftables"
+
+/usr/bin/systemctl reload nftables.service
+
+rm -v firehol_level1.netset

roles/mariadb/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 - name: Remove MariaDB key from apt-key
   ansible.builtin.apt_key:
-    id: 0x177F4010FE56CA3336300305F1656F24C74CD1D8
+    id: "013577200103762554506315430003013705453362230723150730"
     state: absent
   tags:
     - packages
@@ -21,16 +21,17 @@
     dest: /etc/apt/keyrings/mariadb_release_signing_key.asc
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   register: download_mariadb_signing_key
   when: not mariadb_signing_key_stat.stat.exists
   tags:
     - packages
     - mariadb
 
-- name: Add MariaDB 10.6 repo
+- name: Add MariaDB 10.11 repo
   ansible.builtin.apt_repository:
-    repo: 'deb [arch=amd64 signed-by=/etc/apt/keyrings/mariadb_release_signing_key.asc] https://dlm.mariadb.com/repo/mariadb-server/10.6/repo/debian {{ ansible_distribution_release }} main'
+    repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/mariadb_release_signing_key.asc] https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/debian {{ ansible_distribution_release
+      }} main
     filename: mariadb
     state: present
   register: add_mariadb_apt_repository
@@ -41,16 +42,14 @@
 - name: Update apt cache
   ansible.builtin.apt: # noqa no-handler
     update_cache: true
-  when:
-    (download_mariadb_signing_key.status_code is defined and download_mariadb_signing_key.status_code == 200) or
-    add_mariadb_apt_repository is changed
+  when: (download_mariadb_signing_key.status_code is defined and download_mariadb_signing_key.status_code == 200) or add_mariadb_apt_repository is changed
   tags:
     - packages
     - mariadb
 
 - name: Install mariadb-server
   ansible.builtin.apt:
-    name: ['mariadb-server', 'python3-pymysql']
+    name: [mariadb-server, python3-pymysql]
     state: present
     cache_valid_time: 3600
   tags: mariadb, packages
@@ -61,7 +60,7 @@
     dest: /etc/mysql/my.cnf
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   notify:
     - restart mariadb
   tags: mariadb
@@ -83,7 +82,7 @@
     src: .my.cnf.j2
     dest: /root/.my.cnf
     owner: root
-    mode: 0600
+    mode: "0600"
   tags: mariadb
 
 # See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_db_module.html

roles/nginx/defaults/main.yml

@@ -5,20 +5,20 @@
 nginx_confd_path: /etc/nginx/conf.d
 
 # parent directory of vhost roots
-nginx_root_prefix: /var/www
+nginx_root_prefix: "{{ web_root_prefix }}"
 
-# 1 hour timeout
-nginx_ssl_session_timeout: 1h
+# 1 day timeout
+nginx_ssl_session_timeout: 1d
 # 10MB -> 40,000 sessions
 nginx_ssl_session_cache: shared:SSL:10m
-# 1400 bytes to fit in one MTU (default is 16k!)
-nginx_ssl_buffer_size: 1400
+nginx_ssl_buffer_size: 4k
 nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
-nginx_ssl_protocols: 'TLSv1.2 TLSv1.3'
+nginx_ssl_protocols: TLSv1.2 TLSv1.3
+nginx_ssl_ecdh_curve: X25519:prime256v1:secp384r1
 
 # DNS resolvers for OCSP stapling (default to Cloudflare public DNS)
 # See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
-nginx_ssl_stapling_resolver: '1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]'
+nginx_ssl_stapling_resolver: 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]
 
 # HTTP Strict-Transport-Security header, recommended by Google to be ~1 year
 # in seconds, see: https://hstspreload.org/
@@ -37,8 +37,8 @@ letsencrypt_root: /etc/ssl
 letsencrypt_acme_script_temp: /root/acme.sh
 letsencrypt_acme_home: /root/.acme.sh
 
-# stable is 1.20.x
-# mainline is 1.21.x
+# stable is 1.26.x
+# mainline is 1.27.x
 nginx_version: mainline
 
 # vim: set ts=2 sw=2:

roles/nginx/tasks/letsencrypt.yml

@@ -1,91 +1,90 @@
 ---
-
 # Use acme.sh instead of certbot because they only support installation via
 # snap now.
 - block:
-  - name: Remove certbot
-    ansible.builtin.apt:
-      name: certbot
-      state: absent
+    - name: Remove certbot
+      ansible.builtin.apt:
+        name: certbot
+        state: absent
 
-  - name: Remove old certbot post and pre hooks for nginx
-    ansible.builtin.file:
-      dest: "{{ item }}"
-      state: absent
-    with_items:
-      - /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
-      - /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
+    - name: Remove old certbot post and pre hooks for nginx
+      ansible.builtin.file:
+        dest: "{{ item }}"
+        state: absent
+      with_items:
+        - /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
+        - /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
 
-  - name: Check if acme.sh is installed
-    ansible.builtin.stat:
-      path: "{{ letsencrypt_acme_home }}"
-    register: acme_home
+    - name: Check if acme.sh is installed
+      ansible.builtin.stat:
+        path: "{{ letsencrypt_acme_home }}"
+      register: acme_home
 
-  - name: Download acme.sh
-    ansible.builtin.get_url:
-      url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
-      dest: "{{ letsencrypt_acme_script_temp }}"
-      mode: 0700
-    register: acme_download
-    when: not acme_home.stat.exists
+    - name: Download acme.sh
+      ansible.builtin.get_url:
+        url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
+        dest: "{{ letsencrypt_acme_script_temp }}"
+        mode: "0700"
+      register: acme_download
+      when: not acme_home.stat.exists
 
-  # Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
-  # have to chdir to the /root directory where the script exists or else it
-  # fails. Ansible runs it, but the script can't find itself...).
-  - name: Install acme.sh
-    ansible.builtin.command:
-      cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
-      creates: "{{ letsencrypt_acme_home }}/acme.sh"
-      chdir: /root
-    register: acme_install
-    when: acme_download is changed
+    # Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
+    # have to chdir to the /root directory where the script exists or else it
+    # fails. Ansible runs it, but the script can't find itself...).
+    - name: Install acme.sh
+      ansible.builtin.command:
+        cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
+        creates: "{{ letsencrypt_acme_home }}/acme.sh"
+        chdir: /root
+      register: acme_install
+      when: acme_download is changed
 
-  - name: Remove temporary acme.sh script
-    ansible.builtin.file:
-      dest: "{{ letsencrypt_acme_script_temp }}"
-      state: absent
-    when:
-      - acme_install.rc is defined
-      - acme_install.rc == 0
+    - name: Remove temporary acme.sh script
+      ansible.builtin.file:
+        dest: "{{ letsencrypt_acme_script_temp }}"
+        state: absent
+      when:
+        - acme_install.rc is defined
+        - acme_install.rc == 0
 
-  - name: Set default certificate authority for acme.sh
-    ansible.builtin.command:
-      cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"
+    - name: Set default certificate authority for acme.sh
+      ansible.builtin.command:
+        cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"
 
-  - name: Prepare Let's Encrypt well-known directory
-    ansible.builtin.file:
-      state: directory
-      path: /var/lib/letsencrypt/.well-known
-      owner: root
-      group: nginx
-      mode: g+s
+    - name: Prepare Let's Encrypt well-known directory
+      ansible.builtin.file:
+        state: directory
+        path: /var/lib/letsencrypt/.well-known
+        owner: root
+        group: nginx
+        mode: g+s
 
-  - name: Copy systemd service to renew Let's Encrypt certs
-    ansible.builtin.template:
-      src: renew-letsencrypt.service.j2
-      dest: /etc/systemd/system/renew-letsencrypt.service
-      mode: 0644
-      owner: root
-      group: root
+    - name: Copy systemd service to renew Let's Encrypt certs
+      ansible.builtin.template:
+        src: renew-letsencrypt.service.j2
+        dest: /etc/systemd/system/renew-letsencrypt.service
+        mode: "0644"
+        owner: root
+        group: root
 
-  - name: Copy systemd timer to renew Let's Encrypt certs
-    ansible.builtin.copy:
-      src: renew-letsencrypt.timer
-      dest: /etc/systemd/system/renew-letsencrypt.timer
-      mode: 0644
-      owner: root
-      group: root
+    - name: Copy systemd timer to renew Let's Encrypt certs
+      ansible.builtin.copy:
+        src: renew-letsencrypt.timer
+        dest: /etc/systemd/system/renew-letsencrypt.timer
+        mode: "0644"
+        owner: root
+        group: root
 
-  # always issues daemon-reload just in case the service/timer changed
-  - name: Start and enable systemd timer to renew Let's Encrypt certs
-    ansible.builtin.systemd:
-      name: renew-letsencrypt.timer
-      state: started
-      enabled: true
-      daemon_reload: true
+    # always issues daemon-reload just in case the service/timer changed
+    - name: Start and enable systemd timer to renew Let's Encrypt certs
+      ansible.builtin.systemd:
+        name: renew-letsencrypt.timer
+        state: started
+        enabled: true
+        daemon_reload: true
 
-  when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '=='))
-        or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
+  when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_version
+    is version('11', '>='))
   tags: letsencrypt
 
 # vim: set ts=2 sw=2:

roles/nginx/tasks/main.yml

@@ -1,29 +1,21 @@
 ---
 - name: Remove nginx apt signing key from apt-key
   ansible.builtin.apt_key:
-    id: 0x573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62
+    id: "053473772654754373614404074646527257655730117366337542"
     state: absent
   tags:
     - packages
     - nginx
 
-- name: Check nginx apt signing key
-  ansible.builtin.stat:
-    path: /usr/share/keyrings/nginx_signing.key
-  register: nginx_signing_key_stat
-  tags:
-    - packages
-    - nginx
-
 - name: Download nginx apt signing key
   ansible.builtin.get_url:
     url: https://nginx.org/keys/nginx_signing.key
     dest: /usr/share/keyrings/nginx_signing.key
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
+    checksum: sha256:55385da31d198fa6a5012d40ae98ecb272a6c4e8fffffba94719ffd3e87de37a
   register: download_nginx_signing_key
-  when: not nginx_signing_key_stat.stat.exists
   tags:
     - packages
     - nginx
@@ -34,7 +26,7 @@
     dest: /etc/apt/sources.list.d/nginx_org_sources.list
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   register: add_nginx_apt_repository
   tags:
     - nginx
@@ -43,9 +35,7 @@
 - name: Update apt cache
   ansible.builtin.apt: # noqa no-handler
     update_cache: true
-  when:
-    (download_nginx_signing_key.status_code is defined and download_nginx_signing_key.status_code == 200) or
-    add_nginx_apt_repository is changed
+  when: (download_nginx_signing_key.status_code is defined and download_nginx_signing_key.status_code == 200) or add_nginx_apt_repository is changed
 
 - name: Install nginx
   ansible.builtin.apt:
@@ -60,7 +50,7 @@
   ansible.builtin.template:
     src: nginx.conf.j2
     dest: /etc/nginx/nginx.conf
-    mode: 0644
+    mode: "0644"
     owner: root
     group: root
   notify:
@@ -70,8 +60,8 @@
 - name: Copy extra nginx configs
   ansible.builtin.copy:
     src: "{{ item }}"
-    dest: "/etc/nginx/{{ item }}"
-    mode: 0644
+    dest: /etc/nginx/{{ item }}
+    mode: "0644"
     owner: root
     group: root
   loop:
@@ -93,7 +83,7 @@
     state: directory
     owner: nginx
     group: nginx
-    mode: 0755
+    mode: "0755"
   tags: nginx
 
 - name: Configure nginx virtual hosts
@@ -110,7 +100,7 @@
   ansible.builtin.template:
     src: blank-vhost.conf.j2
     dest: "{{ nginx_confd_path }}/blank-vhost.conf"
-    mode: 0644
+    mode: "0644"
     owner: root
     group: root
   notify:
@@ -121,7 +111,7 @@
   ansible.builtin.copy:
     src: munin.conf
     dest: /etc/nginx/conf.d/munin.conf
-    mode: 0644
+    mode: "0644"
     owner: root
     group: root
   notify:

roles/nginx/tasks/vhosts.yml

@@ -1,29 +1,29 @@
 ---
-
 - block:
-  - name: Configure https vhosts
-    ansible.builtin.template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root
-    loop: "{{ nginx_vhosts }}"
-    notify:
-      - reload nginx
+    - name: Configure https vhosts
+      ansible.builtin.template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root
+      loop: "{{ nginx_vhosts }}"
+      notify:
+        - reload nginx
 
-  - name: Generate self-signed TLS cert
-    ansible.builtin.command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
-    notify:
-      - reload nginx
+    - name: Generate self-signed TLS cert
+      ansible.builtin.command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key
+        -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
+      notify:
+        - reload nginx
 
-  - name: Download 4096-bit RFC 7919 dhparams
-    ansible.builtin.get_url:
-      url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
-      checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
-      dest: "{{ nginx_ssl_dhparam }}"
-    notify:
-      - reload nginx
+    - name: Download 4096-bit RFC 7919 dhparams
+      ansible.builtin.get_url:
+        url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
+        checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
+        dest: "{{ nginx_ssl_dhparam }}"
+      notify:
+        - reload nginx
 
-  # TODO: this could break because we can override the document root in host vars
-  - name: Create vhost document roots
-    ansible.builtin.file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx
-    loop: "{{ nginx_vhosts }}"
+    # TODO: this could break because we can override the document root in host vars
+    - name: Create vhost document roots
+      ansible.builtin.file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx
+      loop: "{{ nginx_vhosts }}"
   tags: nginx
 
 # vim: set ts=2 sw=2:

roles/nginx/tasks/wordpress.yml

@@ -1,19 +1,19 @@
 ---
-
 - block:
-  - name: Install WordPress
-    ansible.builtin.git: repo=https://github.com/WordPress/WordPress.git dest={{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress version={{ item.wordpress_version }} depth=1 force=true
-    when:
-      - item.has_wordpress is defined
-      - item.has_wordpress
-    loop: "{{ nginx_vhosts }}"
+    - name: Install WordPress
+      ansible.builtin.git: repo=https://github.com/WordPress/WordPress.git dest={{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress version={{ item.wordpress_version
+        }} depth=1 force=true
+      when:
+        - item.has_wordpress is defined
+        - item.has_wordpress
+      loop: "{{ nginx_vhosts }}"
 
-  - name: Fix WordPress directory permissions
-    ansible.builtin.file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory owner=nginx group=nginx recurse=true
-    when:
-      - item.has_wordpress is defined
-      - item.has_wordpress
-    loop: "{{ nginx_vhosts }}"
+    - name: Fix WordPress directory permissions
+      ansible.builtin.file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory owner=nginx group=nginx recurse=true
+      when:
+        - item.has_wordpress is defined
+        - item.has_wordpress
+      loop: "{{ nginx_vhosts }}"
   tags: wordpress
 
 # vim: set ts=2 sw=2:

roles/nginx/templates/blank-vhost.conf.j2

@@ -11,9 +11,11 @@ server {
 
     return 444;
 }
+
 server {
-    listen 443 ssl http2 default_server;
-    listen [::]:443 ssl http2 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    http2 on;
     server_name _;
 
     # self-signed "snakeoil" certificate

roles/nginx/templates/https.j2

@@ -27,8 +27,9 @@
 
     ssl_dhparam {{ nginx_ssl_dhparam }};
     ssl_protocols {{ nginx_ssl_protocols }};
+    ssl_ecdh_curve {{ nginx_ssl_ecdh_curve }};
     ssl_ciphers "{{ tls_cipher_suite }}";
-    ssl_prefer_server_ciphers on;
+    ssl_prefer_server_ciphers off;
 
     {# OSCP stapling only works with real certs #}
     {% if use_letsencrypt == true or item.tls_certificate_path %}
@@ -38,15 +39,6 @@
     resolver {{ nginx_ssl_stapling_resolver }};
     {% endif %} {# end: use_letsencrypt #}
 
-    # nginx does not auto-rotate session ticket keys: only a HUP / restart will do so and
-    # when a restart is performed the previous key is lost, which resets all previous
-    # sessions. The fix for this is to setup a manual rotation mechanism:
-    # http://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx
-    #
-    # Note that you'll have to define and rotate the keys securely by yourself. In absence
-    # of such infrastructure, consider turning off session tickets:
-    ssl_session_tickets off;
-
     {% if enable_hsts == true %}
     # Enable this if you want HSTS (recommended, but be careful)
     # Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store

roles/nginx/templates/vhost.conf.j2

@@ -8,6 +8,12 @@
 {% set has_wordpress  = item.has_wordpress | default(false) %}
 {% set needs_php      = item.needs_php | default(false) %}
 {% set has_gitea      = item.has_gitea | default(false) %}
+{# Allow sites to override the document root #}
+{% if item.document_root is defined %}
+{%   set document_root = item.document_root %}
+{% else %}
+{%   set document_root = (nginx_root_prefix, domain_name) | ansible.builtin.path_join %}
+{% endif %}
 
 # http -> https vhost
 server {
@@ -26,15 +32,11 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
 
-    {# Allow sites to override the nginx document root #}
-    {% if item.document_root is defined %}
-    root {{ item.document_root }};
-    {% else %}
-    root {{ nginx_root_prefix }}/{{ domain_name }};
-    {% endif %}
+    root {{ document_root }};
 
     {# will only work if the TLS cert covers the domain + aliases, like example.com and www.example.com #}
     server_name {{ domain_name }} {{ domain_aliases }};
@@ -75,10 +77,8 @@ server {
         # See: https://httpoxy.org/
         fastcgi_param HTTP_PROXY "";
 
-        {% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '==')) %}
-        fastcgi_pass unix:/run/php/php7.4-fpm-{{ domain_name }}.sock;
-        {% else %}
-        fastcgi_pass unix:/var/run/php5-fpm-{{ domain_name }}.sock;
+        {% if ansible_distribution == 'Debian' and ansible_distribution_major_version is version('12', '==') %}
+        fastcgi_pass unix:/run/php/php8.2-fpm-{{ domain_name }}.sock;
         {% endif %}
         fastcgi_index index.php;
         # set script path relative to document root in server block

roles/php-fpm/handlers/main.yml

@@ -1,6 +1,8 @@
 ---
-# For Ubuntu 20.04 and Debian 11
-- name: reload php7.4-fpm
-  ansible.builtin.systemd: name=php7.4-fpm state=reloaded
+# For Debian 12
+- name: reload php8.2-fpm
+  ansible.builtin.systemd:
+    name: php8.2-fpm
+    state: reloaded
 
 # vim: set ts=2 sw=2:

roles/php-fpm/tasks/Debian_12.yml

@@ -0,0 +1,50 @@
+---
+- block:
+    - name: Set php-fpm packages
+      ansible.builtin.set_fact:
+        php_fpm_packages:
+          - php8.2-fpm
+          # for WordPress
+          - php8.2-mysql
+          - php8.2-gd
+          - php8.2-curl
+          - php8.2-xml
+
+    - name: Install php-fpm and deps
+      ansible.builtin.apt:
+        name: "{{ php_fpm_packages }}"
+        state: present
+        update_cache: true
+
+    # only copy php-fpm config for vhosts that need WordPress or PHP
+    - name: Copy php-fpm pool config
+      ansible.builtin.template:
+        src: php8.2-pool.conf.j2
+        dest: /etc/php/8.2/fpm/pool.d/{{ item.domain_name }}.conf
+        owner: root
+        group: root
+        mode: "0644"
+      loop: "{{ nginx_vhosts }}"
+      when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
+      notify: reload php8.2-fpm
+
+    - name: Remove default www pool
+      ansible.builtin.file:
+        path: /etc/php/8.2/fpm/pool.d/www.conf
+        state: absent
+      notify: reload php8.2-fpm
+
+    # re-configure php.ini
+    - name: Update php.ini
+      ansible.builtin.template:
+        src: php8.2-php.ini.j2
+        dest: /etc/php/8.2/fpm/php.ini
+        owner: root
+        group: root
+        mode: "0644"
+      notify: reload php8.2-fpm
+
+  tags: php-fpm
+  when: install_php
+
+# vim: set ts=2 sw=2:

roles/php-fpm/tasks/Ubuntu_20.04.yml

@@ -1,36 +0,0 @@
----
-
-- block:
-  - name: Set php-fpm packages
-    ansible.builtin.set_fact:
-      php_fpm_packages:
-        - php7.4-fpm
-        # for WordPress
-        - php7.4-mysql
-        - php7.4-gd
-        - php7.4-curl
-        - php7.4-xml
-
-  - name: Install php-fpm and deps
-    ansible.builtin.apt: name={{ php_fpm_packages }} state=present update_cache=true
-
-  # only copy php-fpm config for vhosts that need WordPress or PHP
-  - name: Copy php-fpm pool config
-    ansible.builtin.template: src=php7.4-pool.conf.j2 dest=/etc/php/7.4/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
-    loop: "{{ nginx_vhosts }}"
-    when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
-    notify: reload php7.4-fpm
-
-  - name: Remove default www pool
-    ansible.builtin.file: path=/etc/php/7.4/fpm/pool.d/www.conf state=absent
-    notify: reload php7.4-fpm
-
-  # re-configure php.ini
-  - name: Update php.ini
-    ansible.builtin.template: src=php7.4-php.ini.j2 dest=/etc/php/7.4/fpm/php.ini owner=root group=root mode=0644
-    notify: reload php7.4-fpm
-
-  tags: php-fpm
-  when: install_php
-
-# vim: set ts=2 sw=2:

roles/php-fpm/tasks/main.yml

@@ -1,6 +1,5 @@
 ---
-# Ubuntu 20.04 uses PHP 7.4
-# Debian 11 uses PHP 7.4
+# Debian 12 uses PHP 8.2
 
 # If any of the vhosts on this host need WordPress then we need to install PHP.
 # This uses selectattr to filter the list of dicts in nginx_vhosts, selecting
@@ -10,13 +9,13 @@
 - name: Check if any vhost needs WordPress
   ansible.builtin.set_fact:
     install_php: true
-  when: "nginx_vhosts | selectattr('has_wordpress', 'defined') | selectattr('has_wordpress', 'equalto', true) | list | length > 0"
+  when: nginx_vhosts | selectattr('has_wordpress', 'defined') | selectattr('has_wordpress', 'equalto', true) | list | length > 0
 
 # Legacy, was only for Piwik, but leaving for now.
 - name: Check if any vhost needs PHP
   ansible.builtin.set_fact:
     install_php: true
-  when: "nginx_vhosts | selectattr('needs_php', 'defined') | selectattr('needs_php', 'equalto', true) | list | length > 0"
+  when: nginx_vhosts | selectattr('needs_php', 'defined') | selectattr('needs_php', 'equalto', true) | list | length > 0
 
 # If install_php has not been set, then we assume no vhosts need PHP. This is
 # a bit hacky, but it's the closest we come to an if/then/else.
@@ -25,20 +24,12 @@
     install_php: false
   when: install_php is not defined
 
-- name: Configure php-fpm on Ubuntu 20.04
-  ansible.builtin.include_tasks: Ubuntu_20.04.yml
-  when:
-    - ansible_distribution == 'Ubuntu'
-    - ansible_distribution_version is version('20.04', '==')
-    - install_php == true
-  tags: php-fpm
-
-- name: Configure php-fpm on Debian 11
-  ansible.builtin.include_tasks: Ubuntu_20.04.yml
+- name: Configure php-fpm on Debian 12
+  ansible.builtin.include_tasks: Debian_12.yml
   when:
     - ansible_distribution == 'Debian'
-    - ansible_distribution_major_version is version('11', '==')
-    - install_php == true
+    - ansible_distribution_major_version is version('12', '==')
+    - install_php
   tags: php-fpm
 
 # vim: set ts=2 sw=2:

roles/php-fpm/templates/php8.2-pool.conf.j2

@@ -19,11 +19,16 @@
 ; Default Value: none
 ;prefix = /path/to/pools/$pool
 
-; Unix user/group of processes
-; Note: The user is mandatory. If the group is not set, the default user's group
-;       will be used.
-user = nginx
-group = nginx
+; Unix user/group of the child processes. This can be used only if the master
+; process running user is root. It is set after the child process is created.
+; The user and group can be specified either by their name or by their numeric
+; IDs.
+; Note: If the user is root, the executable needs to be started with
+;       --allow-to-run-as-root option to work.
+; Default Values: The user is set to master process running user by default.
+;                 If the group is not set, the user's group is used.
+user = {{ webserver }}
+group = {{ webserver }}
 
 ; The address on which to accept FastCGI requests.
 ; Valid syntaxes are:
@@ -35,20 +40,22 @@ group = nginx
 ;                            (IPv6 and IPv4-mapped) on a specific port;
 ;   '/path/to/unix/socket' - to listen on a unix socket.
 ; Note: This value is mandatory.
-listen = /run/php/php7.4-fpm-{{ domain_name }}.sock
+listen = /run/php/php8.2-fpm-{{ domain_name }}.sock
 
 ; Set listen(2) backlog.
-; Default Value: 511 (-1 on FreeBSD and OpenBSD)
+; Default Value: 511 (-1 on Linux, FreeBSD and OpenBSD)
 ;listen.backlog = 511
 
 ; Set permissions for unix socket, if one is used. In Linux, read/write
 ; permissions must be set in order to allow connections from a web server. Many
-; BSD-derived systems allow connections regardless of permissions.
-; Default Values: user and group are set as the running user
-;                 mode is set to 0660
-listen.owner = nginx
-listen.group = nginx
+; BSD-derived systems allow connections regardless of permissions. The owner
+; and group can be specified either by name or by their numeric IDs.
+; Default Values: Owner is set to the master process running user. If the group
+;                 is not set, the owner's group is used. Mode is set to 0660.
+listen.owner = {{ webserver }}
+listen.group = {{ webserver }}
 ;listen.mode = 0660
+
 ; When POSIX Access Control Lists are supported you can set them using
 ; these options, value is a comma separated list of user/group names.
 ; When set, listen.owner and listen.group are ignored
@@ -63,6 +70,10 @@ listen.group = nginx
 ; Default Value: any
 ;listen.allowed_clients = 127.0.0.1
 
+; Set the associated the route table (FIB). FreeBSD only
+; Default Value: -1
+;listen.setfib = 1
+
 ; Specify the nice(2) priority to apply to the pool processes (only if set)
 ; The value can vary from -19 (highest priority) to 20 (lower priority)
 ; Note: - It will only work if the FPM master process is launched as root
@@ -71,8 +82,9 @@ listen.group = nginx
 ; Default Value: no set
 ; process.priority = -19
 
-; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user
-; or group is differrent than the master process user. It allows to create process
+; Set the process dumpable flag (PR_SET_DUMPABLE prctl for Linux or
+; PROC_TRACE_CTL procctl for FreeBSD) even if the process user
+; or group is different than the master process user. It allows to create process
 ; core dump and ptrace the process for the pool user.
 ; Default Value: no
 ; process.dumpable = yes
@@ -94,6 +106,8 @@ listen.group = nginx
 ;                                    state (waiting to process). If the number
 ;                                    of 'idle' processes is greater than this
 ;                                    number then some children will be killed.
+;             pm.max_spawn_rate    - the maximum number of rate to spawn child
+;                                    processes at once.
 ;  ondemand - no children are created at startup. Children will be forked when
 ;             new requests will connect. The following parameter are used:
 ;             pm.max_children           - the maximum number of children that
@@ -129,6 +143,12 @@ pm.min_spare_servers = 1
 ; Note: Mandatory when pm is set to 'dynamic'
 pm.max_spare_servers = 3
 
+; The number of rate to spawn child processes at once.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+; Default Value: 32
+;pm.max_spawn_rate = 32
+
 ; The number of seconds after which an idle process will be killed.
 ; Note: Used only when pm is set to 'ondemand'
 ; Default Value: 10s
@@ -141,7 +161,7 @@ pm.max_spare_servers = 3
 ;pm.max_requests = 500
 
 ; The URI to view the FPM status page. If this value is not set, no URI will be
-; recognized as a status page. It shows the following informations:
+; recognized as a status page. It shows the following information:
 ;   pool                 - the name of the pool;
 ;   process manager      - static, dynamic or ondemand;
 ;   start time           - the date and time FPM has started;
@@ -231,7 +251,7 @@ pm.max_spare_servers = 3
 ;   last request memory:  0
 ;
 ; Note: There is a real-time FPM status monitoring sample web page available
-;       It's available in: /usr/share/php/7.4/fpm/status.html
+;       It's available in: /usr/share/php/8.2/fpm/status.html
 ;
 ; Note: The value must start with a leading slash (/). The value can be
 ;       anything, but it may not be a good idea to use the .php extension or it
@@ -239,6 +259,22 @@ pm.max_spare_servers = 3
 ; Default Value: not set
 ;pm.status_path = /status
 
+; The address on which to accept FastCGI status request. This creates a new
+; invisible pool that can handle requests independently. This is useful
+; if the main pool is busy with long running requests because it is still possible
+; to get the status before finishing the long running requests.
+;
+; Valid syntaxes are:
+;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
+;                            a specific port;
+;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
+;                            a specific port;
+;   'port'                 - to listen on a TCP socket to all addresses
+;                            (IPv6 and IPv4-mapped) on a specific port;
+;   '/path/to/unix/socket' - to listen on a unix socket.
+; Default Value: value of the listen option
+;pm.status_listen = 127.0.0.1:9001
+
 ; The ping URI to call the monitoring page of FPM. If this value is not set, no
 ; URI will be recognized as a ping page. This could be used to test from outside
 ; that FPM is alive and responding, or to
@@ -271,13 +307,13 @@ pm.max_spare_servers = 3
 ;  %d: time taken to serve the request
 ;      it can accept the following format:
 ;      - %{seconds}d (default)
-;      - %{miliseconds}d
-;      - %{mili}d
+;      - %{milliseconds}d
+;      - %{milli}d
 ;      - %{microseconds}d
 ;      - %{micro}d
 ;  %e: an environment variable (same as $_ENV or $_SERVER)
 ;      it must be associated with embraces to specify the name of the env
-;      variable. Some exemples:
+;      variable. Some examples:
 ;      - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
 ;      - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
 ;  %f: script filename
@@ -306,14 +342,30 @@ pm.max_spare_servers = 3
 ;  %s: status (response code)
 ;  %t: server time the request was received
 ;      it can accept a strftime(3) format:
-;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      The strftime(3) format must be encapsulated in a %{<strftime_format>}t tag
 ;  %T: time the log has been written (the request has finished)
 ;      it can accept a strftime(3) format:
-;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      The strftime(3) format must be encapsulated in a %{<strftime_format>}t tag
 ;  %u: remote user
 ;
 ; Default: "%R - %u %t \"%m %r\" %s"
-;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
+;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{milli}d %{kilo}M %C%%"
+
+; A list of request_uri values which should be filtered from the access log.
+;
+; As a security precuation, this setting will be ignored if:
+;     - the request method is not GET or HEAD; or
+;     - there is a request body; or
+;     - there are query parameters; or
+;     - the response code is outwith the successful range of 200 to 299
+;
+; Note: The paths are matched against the output of the access.format tag "%r".
+;       On common configurations, this may look more like SCRIPT_NAME than the
+;       expected pre-rewrite URI.
+;
+; Default Value: not set
+;access.suppress_path[] = /ping
+;access.suppress_path[] = /health_check.php
 
 ; The log file for slow requests
 ; Default Value: not set
@@ -372,7 +424,7 @@ pm.max_spare_servers = 3
 
 ; Redirect worker stdout and stderr into main error log. If not set, stdout and
 ; stderr will be redirected to /dev/null according to FastCGI specs.
-; Note: on highloaded environement, this can cause some delay in the page
+; Note: on highloaded environment, this can cause some delay in the page
 ; process time (several ms).
 ; Default Value: no
 ;catch_workers_output = yes