Compare commits
167 Commits
de75b2ffb6
...
debian13
| Author | SHA1 | Date | |
|---|---|---|---|
d51f8fefaa
|
|||
|
9ff6e19135
|
|||
|
4680999680
|
|||
|
602734acce
|
|||
|
0db7911b70
|
|||
|
ee4c62e5f9
|
|||
|
a315db8a7c
|
|||
|
5f00892df3
|
|||
|
9357265d27
|
|||
|
dd62266340
|
|||
|
a1bec20824
|
|||
|
8e91c44529
|
|||
|
02d4135c79
|
|||
|
37e148d009
|
|||
|
73dbbd23b6
|
|||
|
b84283aa38
|
|||
|
1695fdf8d1
|
|||
|
9f1f7b1c69
|
|||
|
7d725f2084
|
|||
|
4c39b0d48c
|
|||
|
f4023d0b20
|
|||
|
6aaface4a2
|
|||
|
333e1cbeb9
|
|||
|
0c62f4bdf0
|
|||
|
26f22c0447
|
|||
|
05881e2585
|
|||
|
d4d326c2f7
|
|||
|
1d4a6f208b
|
|||
|
8b22076d4a
|
|||
|
38176cb34c
|
|||
|
da737b71f7
|
|||
|
c28189a1a5
|
|||
|
b600141e89
|
|||
|
4be98d1a33
|
|||
|
2bb018a40c
|
|||
|
89a1e11b7a
|
|||
|
0c0cad9084
|
|||
|
9dce701a19
|
|||
|
3e9ee44d5b
|
|||
|
599b5e5e83
|
|||
|
bc700ea532
|
|||
|
8016701b57
|
|||
|
00558c7dea
|
|||
|
c927186837
|
|||
|
690774c862
|
|||
|
cc021bd14a
|
|||
|
73fd06fe3a
|
|||
|
88cb3a370e
|
|||
|
027a43ddbe
|
|||
|
bb30c3be20
|
|||
|
d8d9790d21
|
|||
|
9a500ebc0d
|
|||
|
4bae942585
|
|||
|
99866c0c90
|
|||
|
0afb8a4493
|
|||
|
506695da31
|
|||
|
f67ed7762c
|
|||
|
014f4d9502
|
|||
|
22c16e1ed3
|
|||
|
5aa6a33e51
|
|||
|
7f9b06af9c
|
|||
|
84db337fea
|
|||
|
7b23f5f94f
|
|||
|
9830338be3
|
|||
|
e3eed26765
|
|||
|
8b31c7e148
|
|||
|
3ff8043aaf
|
|||
|
cb79f7ef70
|
|||
|
bb14f05d2a
|
|||
|
5b1530fa91
|
|||
|
5312dc6bd5
|
|||
|
d6e060d3af
|
|||
|
b873af004a
|
|||
|
7ea3ab46f8
|
|||
|
0561bd5b52
|
|||
|
d62572f02c
|
|||
|
2ffe5e87d9
|
|||
|
38d4f1a303
|
|||
|
ed8cb88038
|
|||
|
c31e447861
|
|||
|
545684467c
|
|||
|
24ae5eaab1
|
|||
|
dac23f1427
|
|||
|
41fbc73dd1
|
|||
|
fee794bcf0
|
|||
|
8bce1d8b1b
|
|||
|
6dc2ea36b6
|
|||
|
af71a9b5f8
|
|||
|
4dd57803e2
|
|||
|
18d4245fc0
|
|||
|
1bddf3cccd
|
|||
|
20dbe61fe1
|
|||
|
899e87321b
|
|||
|
06416a3b64
|
|||
|
7a9a24ef5d
|
|||
|
067adcd9f5
|
|||
|
84d210cfab
|
|||
|
17736a4f14
|
|||
|
b9e91c4a3d
|
|||
|
51c95e5d4c
|
|||
|
8dbec29d2a
|
|||
|
d3bf3dab04
|
|||
|
8f50b7756b
|
|||
|
e86ccc9979
|
|||
|
cea8529f49
|
|||
|
d77718edae
|
|||
|
14d57fc477
|
|||
|
5c39f1abd8
|
|||
|
6794eb0432
|
|||
|
11614e3725
|
|||
|
b106f9d9e5
|
|||
|
3c8250e6ac
|
|||
|
d280859b0d
|
|||
|
bca1629d2f
|
|||
|
4fa82faf18
|
|||
|
b8f0b4b1fb
|
|||
|
68e5d05bbb
|
|||
|
446d402778
|
|||
|
67379fc2e4
|
|||
|
73546967b6
|
|||
|
16b661efe1
|
|||
|
fdb9a75489
|
|||
|
232d7a0348
|
|||
|
6e4bb5bc34
|
|||
|
c840ffe018
|
|||
|
45c9d7ea0a
|
|||
|
a62bc446e8
|
|||
|
62a6a491db
|
|||
|
4867d6da6a
|
|||
|
d9f7c7a93b
|
|||
|
bc8c030700
|
|||
|
f7598d8f1c
|
|||
|
c353e84a84
|
|||
|
99ca23f258
|
|||
|
b663d27fd8
|
|||
|
67c99dacf6
|
|||
|
4abf2b10e4
|
|||
|
f5199264f9
|
|||
|
b259f09cbd
|
|||
|
f4b32e516b
|
|||
|
fcb12ecee0
|
|||
|
5bc03ceacc
|
|||
|
c317429f6d
|
|||
|
b512a7f765
|
|||
|
e3a87d4f79
|
|||
|
dec2d50fbc
|
|||
|
34be0013b7
|
|||
|
399585f4e7
|
|||
|
0240897b1b
|
|||
|
1da0da53ec
|
|||
|
677cc9f160
|
|||
|
ffe7a872dd
|
|||
|
95d0005978
|
|||
|
498766fdc4
|
|||
| fc0fcc5742 | |||
| 587bd6dcdd | |||
|
92a4c72809
|
|||
|
a2d61abba2
|
|||
|
d2a5a28809
|
|||
|
84c0589aee
|
|||
|
2961578a54
|
|||
|
4d74f76b3c
|
|||
|
9e737466c5
|
|||
|
0ffb1b1a36
|
|||
|
68f0b85eb3
|
|||
|
ebbde530d2
|
|||
|
ab47df6031
|
3
Pipfile
3
Pipfile
@@ -7,6 +7,7 @@ verify_ssl = true
|
||||
|
||||
[packages]
|
||||
ansible = "*"
|
||||
ansible-lint = "*"
|
||||
|
||||
[requires]
|
||||
python_version = "3.9"
|
||||
python_version = "3.13"
|
||||
|
||||
888
Pipfile.lock
generated
888
Pipfile.lock
generated
@@ -1,11 +1,11 @@
|
||||
{
|
||||
"_meta": {
|
||||
"hash": {
|
||||
"sha256": "65b615b857250757470e21fc3a4b1cdfe75b4b012c0d1d633a5ebf1988d9cb91"
|
||||
"sha256": "47970866f4ffc7775e3a95dd04ee8b75f9784c457baadd8a31fe1783584fa73f"
|
||||
},
|
||||
"pipfile-spec": 6,
|
||||
"requires": {
|
||||
"python_version": "3.9"
|
||||
"python_version": "3.13"
|
||||
},
|
||||
"sources": [
|
||||
{
|
||||
@@ -18,252 +18,730 @@
|
||||
"default": {
|
||||
"ansible": {
|
||||
"hashes": [
|
||||
"sha256:006504b4ba5f355073e0b3f10f317a5684c0ce7a35798b18fa18fbffaedab2a6"
|
||||
"sha256:1a17f8c593a973e6d81f10ebfe7eac53e799616f745d57b99bd36b34f79f16a2",
|
||||
"sha256:1b3ad8158dd2597ce45a864a55ca09e5be1807cc97f44a00c39d7bb9e1520aa6"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==5.0.0"
|
||||
"markers": "python_version >= '3.11'",
|
||||
"version": "==12.0.0"
|
||||
},
|
||||
"ansible-compat": {
|
||||
"hashes": [
|
||||
"sha256:5bb843838414b75efff24dae5ff5b332cd503a596143d471980243cec4b46c9c",
|
||||
"sha256:f29ab81264b3f04fb94ac2d7f68fe73efc2eb3cbe4ecf00f9b4742e77c41756f"
|
||||
],
|
||||
"markers": "python_version >= '3.10'",
|
||||
"version": "==25.8.1"
|
||||
},
|
||||
"ansible-core": {
|
||||
"hashes": [
|
||||
"sha256:0e9049a1ab8b8c54ddc80738dc0ab2b57870be6fe4cd4e5585d471547ab74b13"
|
||||
"sha256:1fe6ca533951b5ba4a619e763ea4f6725f68c36677c7d5aaa467b59aa449bdc8",
|
||||
"sha256:87fcbbc492ed16eb6adb0379bae0adbf69f3ce88a8440e7e88e0dcefa9f8a54c"
|
||||
],
|
||||
"markers": "python_version >= '3.11'",
|
||||
"version": "==2.19.2"
|
||||
},
|
||||
"ansible-lint": {
|
||||
"hashes": [
|
||||
"sha256:2d5a8a2b01c46966591a17769a129142181515aac19c27742ecb8c94e84bf692",
|
||||
"sha256:b8fe138a1257c6e58a755febd726b3186820f6dcb23a5bb062538c939a7277bb"
|
||||
],
|
||||
"index": "pypi",
|
||||
"markers": "python_version >= '3.10'",
|
||||
"version": "==25.9.0"
|
||||
},
|
||||
"attrs": {
|
||||
"hashes": [
|
||||
"sha256:427318ce031701fea540783410126f03899a97ffc6f61596ad581ac2e40e3bc3",
|
||||
"sha256:75d7cefc7fb576747b2c81b4442d4d4a1ce0900973527c011d1030fd3bf4af1b"
|
||||
],
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==2.12.0"
|
||||
"version": "==25.3.0"
|
||||
},
|
||||
"black": {
|
||||
"hashes": [
|
||||
"sha256:0172a012f725b792c358d57fe7b6b6e8e67375dd157f64fa7a3097b3ed3e2175",
|
||||
"sha256:0474bca9a0dd1b51791fcc507a4e02078a1c63f6d4e4ae5544b9848c7adfb619",
|
||||
"sha256:154b06d618233fe468236ba1f0e40823d4eb08b26f5e9261526fde34916b9140",
|
||||
"sha256:1b9dc70c21ef8b43248f1d86aedd2aaf75ae110b958a7909ad8463c4aa0880b0",
|
||||
"sha256:2ab0ce111ef026790e9b13bd216fa7bc48edd934ffc4cbf78808b235793cbc92",
|
||||
"sha256:3bec74ee60f8dfef564b573a96b8930f7b6a538e846123d5ad77ba14a8d7a64f",
|
||||
"sha256:456386fe87bad41b806d53c062e2974615825c7a52159cde7ccaeb0695fa28fa",
|
||||
"sha256:474b34c1342cdc157d307b56c4c65bce916480c4a8f6551fdc6bf9b486a7c4ae",
|
||||
"sha256:77e7060a00c5ec4b3367c55f39cf9b06e68965a4f2e61cecacd6d0d9b7ec945a",
|
||||
"sha256:846d58e3ce7879ec1ffe816bb9df6d006cd9590515ed5d17db14e17666b2b357",
|
||||
"sha256:8e46eecf65a095fa62e53245ae2795c90bdecabd53b50c448d0a8bcd0d2e74c4",
|
||||
"sha256:9101ee58ddc2442199a25cb648d46ba22cd580b00ca4b44234a324e3ec7a0f7e",
|
||||
"sha256:a16b14a44c1af60a210d8da28e108e13e75a284bf21a9afa6b4571f96ab8bb9d",
|
||||
"sha256:aaf319612536d502fdd0e88ce52d8f1352b2c0a955cc2798f79eeca9d3af0608",
|
||||
"sha256:b756fc75871cb1bcac5499552d771822fd9db5a2bb8db2a7247936ca48f39831",
|
||||
"sha256:c0372a93e16b3954208417bfe448e09b0de5cc721d521866cd9e0acac3c04a1f",
|
||||
"sha256:ce41ed2614b706fd55fd0b4a6909d06b5bab344ffbfadc6ef34ae50adba3d4f7",
|
||||
"sha256:d119957b37cc641596063cd7db2656c5be3752ac17877017b2ffcdb9dfc4d2b1",
|
||||
"sha256:e3c1f4cd5e93842774d9ee4ef6cd8d17790e65f44f7cdbaab5f2cf8ccf22a823",
|
||||
"sha256:e593466de7b998374ea2585a471ba90553283fb9beefcfa430d84a2651ed5933",
|
||||
"sha256:ef69351df3c84485a8beb6f7b8f9721e2009e20ef80a8d619e2d1788b7816d47",
|
||||
"sha256:f96b6726d690c96c60ba682955199f8c39abc1ae0c3a494a9c62c0184049a713"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==25.9.0"
|
||||
},
|
||||
"bracex": {
|
||||
"hashes": [
|
||||
"sha256:0b0049264e7340b3ec782b5cb99beb325f36c3782a32e36e876452fd49a09952",
|
||||
"sha256:98f1347cd77e22ee8d967a30ad4e310b233f7754dbf31ff3fceb76145ba47dc7"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==2.6"
|
||||
},
|
||||
"cffi": {
|
||||
"hashes": [
|
||||
"sha256:00c878c90cb53ccfaae6b8bc18ad05d2036553e6d9d1d9dbcf323bbe83854ca3",
|
||||
"sha256:0104fb5ae2391d46a4cb082abdd5c69ea4eab79d8d44eaaf79f1b1fd806ee4c2",
|
||||
"sha256:06c48159c1abed75c2e721b1715c379fa3200c7784271b3c46df01383b593636",
|
||||
"sha256:0808014eb713677ec1292301ea4c81ad277b6cdf2fdd90fd540af98c0b101d20",
|
||||
"sha256:10dffb601ccfb65262a27233ac273d552ddc4d8ae1bf93b21c94b8511bffe728",
|
||||
"sha256:14cd121ea63ecdae71efa69c15c5543a4b5fbcd0bbe2aad864baca0063cecf27",
|
||||
"sha256:17771976e82e9f94976180f76468546834d22a7cc404b17c22df2a2c81db0c66",
|
||||
"sha256:181dee03b1170ff1969489acf1c26533710231c58f95534e3edac87fff06c443",
|
||||
"sha256:23cfe892bd5dd8941608f93348c0737e369e51c100d03718f108bf1add7bd6d0",
|
||||
"sha256:263cc3d821c4ab2213cbe8cd8b355a7f72a8324577dc865ef98487c1aeee2bc7",
|
||||
"sha256:2756c88cbb94231c7a147402476be2c4df2f6078099a6f4a480d239a8817ae39",
|
||||
"sha256:27c219baf94952ae9d50ec19651a687b826792055353d07648a5695413e0c605",
|
||||
"sha256:2a23af14f408d53d5e6cd4e3d9a24ff9e05906ad574822a10563efcef137979a",
|
||||
"sha256:31fb708d9d7c3f49a60f04cf5b119aeefe5644daba1cd2a0fe389b674fd1de37",
|
||||
"sha256:3415c89f9204ee60cd09b235810be700e993e343a408693e80ce7f6a40108029",
|
||||
"sha256:3773c4d81e6e818df2efbc7dd77325ca0dcb688116050fb2b3011218eda36139",
|
||||
"sha256:3b96a311ac60a3f6be21d2572e46ce67f09abcf4d09344c49274eb9e0bf345fc",
|
||||
"sha256:3f7d084648d77af029acb79a0ff49a0ad7e9d09057a9bf46596dac9514dc07df",
|
||||
"sha256:41d45de54cd277a7878919867c0f08b0cf817605e4eb94093e7516505d3c8d14",
|
||||
"sha256:4238e6dab5d6a8ba812de994bbb0a79bddbdf80994e4ce802b6f6f3142fcc880",
|
||||
"sha256:45db3a33139e9c8f7c09234b5784a5e33d31fd6907800b316decad50af323ff2",
|
||||
"sha256:45e8636704eacc432a206ac7345a5d3d2c62d95a507ec70d62f23cd91770482a",
|
||||
"sha256:4958391dbd6249d7ad855b9ca88fae690783a6be9e86df65865058ed81fc860e",
|
||||
"sha256:4a306fa632e8f0928956a41fa8e1d6243c71e7eb59ffbd165fc0b41e316b2474",
|
||||
"sha256:57e9ac9ccc3101fac9d6014fba037473e4358ef4e89f8e181f8951a2c0162024",
|
||||
"sha256:59888172256cac5629e60e72e86598027aca6bf01fa2465bdb676d37636573e8",
|
||||
"sha256:5e069f72d497312b24fcc02073d70cb989045d1c91cbd53979366077959933e0",
|
||||
"sha256:64d4ec9f448dfe041705426000cc13e34e6e5bb13736e9fd62e34a0b0c41566e",
|
||||
"sha256:6dc2737a3674b3e344847c8686cf29e500584ccad76204efea14f451d4cc669a",
|
||||
"sha256:74fdfdbfdc48d3f47148976f49fab3251e550a8720bebc99bf1483f5bfb5db3e",
|
||||
"sha256:75e4024375654472cc27e91cbe9eaa08567f7fbdf822638be2814ce059f58032",
|
||||
"sha256:786902fb9ba7433aae840e0ed609f45c7bcd4e225ebb9c753aa39725bb3e6ad6",
|
||||
"sha256:8b6c2ea03845c9f501ed1313e78de148cd3f6cad741a75d43a29b43da27f2e1e",
|
||||
"sha256:91d77d2a782be4274da750752bb1650a97bfd8f291022b379bb8e01c66b4e96b",
|
||||
"sha256:91ec59c33514b7c7559a6acda53bbfe1b283949c34fe7440bcf917f96ac0723e",
|
||||
"sha256:920f0d66a896c2d99f0adbb391f990a84091179542c205fa53ce5787aff87954",
|
||||
"sha256:a5263e363c27b653a90078143adb3d076c1a748ec9ecc78ea2fb916f9b861962",
|
||||
"sha256:abb9a20a72ac4e0fdb50dae135ba5e77880518e742077ced47eb1499e29a443c",
|
||||
"sha256:c2051981a968d7de9dd2d7b87bcb9c939c74a34626a6e2f8181455dd49ed69e4",
|
||||
"sha256:c21c9e3896c23007803a875460fb786118f0cdd4434359577ea25eb556e34c55",
|
||||
"sha256:c2502a1a03b6312837279c8c1bd3ebedf6c12c4228ddbad40912d671ccc8a962",
|
||||
"sha256:d4d692a89c5cf08a8557fdeb329b82e7bf609aadfaed6c0d79f5a449a3c7c023",
|
||||
"sha256:da5db4e883f1ce37f55c667e5c0de439df76ac4cb55964655906306918e7363c",
|
||||
"sha256:e7022a66d9b55e93e1a845d8c9eba2a1bebd4966cd8bfc25d9cd07d515b33fa6",
|
||||
"sha256:ef1f279350da2c586a69d32fc8733092fd32cc8ac95139a00377841f59a3f8d8",
|
||||
"sha256:f54a64f8b0c8ff0b64d18aa76675262e1700f3995182267998c31ae974fbc382",
|
||||
"sha256:f5c7150ad32ba43a07c4479f40241756145a1f03b43480e058cfd862bf5041c7",
|
||||
"sha256:f6f824dc3bce0edab5f427efcfb1d63ee75b6fcb7282900ccaf925be84efb0fc",
|
||||
"sha256:fd8a250edc26254fe5b33be00402e6d287f562b6a5b2152dec302fa15bb3e997",
|
||||
"sha256:ffaa5c925128e29efbde7301d8ecaf35c8c60ffbcd6a1ffd3a552177c8e5e796"
|
||||
"sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb",
|
||||
"sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b",
|
||||
"sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f",
|
||||
"sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9",
|
||||
"sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44",
|
||||
"sha256:0f6084a0ea23d05d20c3edcda20c3d006f9b6f3fefeac38f59262e10cef47ee2",
|
||||
"sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c",
|
||||
"sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75",
|
||||
"sha256:1cd13c99ce269b3ed80b417dcd591415d3372bcac067009b6e0f59c7d4015e65",
|
||||
"sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e",
|
||||
"sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a",
|
||||
"sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e",
|
||||
"sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25",
|
||||
"sha256:2081580ebb843f759b9f617314a24ed5738c51d2aee65d31e02f6f7a2b97707a",
|
||||
"sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe",
|
||||
"sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b",
|
||||
"sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91",
|
||||
"sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592",
|
||||
"sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187",
|
||||
"sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c",
|
||||
"sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1",
|
||||
"sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94",
|
||||
"sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba",
|
||||
"sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb",
|
||||
"sha256:3f4d46d8b35698056ec29bca21546e1551a205058ae1a181d871e278b0b28165",
|
||||
"sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529",
|
||||
"sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca",
|
||||
"sha256:4647afc2f90d1ddd33441e5b0e85b16b12ddec4fca55f0d9671fef036ecca27c",
|
||||
"sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6",
|
||||
"sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c",
|
||||
"sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0",
|
||||
"sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743",
|
||||
"sha256:61d028e90346df14fedc3d1e5441df818d095f3b87d286825dfcbd6459b7ef63",
|
||||
"sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5",
|
||||
"sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5",
|
||||
"sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4",
|
||||
"sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d",
|
||||
"sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b",
|
||||
"sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93",
|
||||
"sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205",
|
||||
"sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27",
|
||||
"sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512",
|
||||
"sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d",
|
||||
"sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c",
|
||||
"sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037",
|
||||
"sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26",
|
||||
"sha256:89472c9762729b5ae1ad974b777416bfda4ac5642423fa93bd57a09204712322",
|
||||
"sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb",
|
||||
"sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c",
|
||||
"sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8",
|
||||
"sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4",
|
||||
"sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414",
|
||||
"sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9",
|
||||
"sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664",
|
||||
"sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9",
|
||||
"sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775",
|
||||
"sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739",
|
||||
"sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc",
|
||||
"sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062",
|
||||
"sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe",
|
||||
"sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9",
|
||||
"sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92",
|
||||
"sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5",
|
||||
"sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13",
|
||||
"sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d",
|
||||
"sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26",
|
||||
"sha256:cb527a79772e5ef98fb1d700678fe031e353e765d1ca2d409c92263c6d43e09f",
|
||||
"sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495",
|
||||
"sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b",
|
||||
"sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6",
|
||||
"sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c",
|
||||
"sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef",
|
||||
"sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5",
|
||||
"sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18",
|
||||
"sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad",
|
||||
"sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3",
|
||||
"sha256:de8dad4425a6ca6e4e5e297b27b5c824ecc7581910bf9aee86cb6835e6812aa7",
|
||||
"sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5",
|
||||
"sha256:e6e73b9e02893c764e7e8d5bb5ce277f1a009cd5243f8228f75f842bf937c534",
|
||||
"sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49",
|
||||
"sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2",
|
||||
"sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5",
|
||||
"sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453",
|
||||
"sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf"
|
||||
],
|
||||
"version": "==1.15.0"
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==2.0.0"
|
||||
},
|
||||
"click": {
|
||||
"hashes": [
|
||||
"sha256:9b9f285302c6e3064f4330c05f05b81945b2a39544279343e6e7c5f27a9baddc",
|
||||
"sha256:e7b8232224eba16f4ebe410c25ced9f7875cb5f3263ffc93cc3e8da705e229c4"
|
||||
],
|
||||
"markers": "python_version >= '3.10'",
|
||||
"version": "==8.3.0"
|
||||
},
|
||||
"cryptography": {
|
||||
"hashes": [
|
||||
"sha256:2049f8b87f449fc6190350de443ee0c1dd631f2ce4fa99efad2984de81031681",
|
||||
"sha256:231c4a69b11f6af79c1495a0e5a85909686ea8db946935224b7825cfb53827ed",
|
||||
"sha256:24469d9d33217ffd0ce4582dfcf2a76671af115663a95328f63c99ec7ece61a4",
|
||||
"sha256:2deab5ec05d83ddcf9b0916319674d3dae88b0e7ee18f8962642d3cde0496568",
|
||||
"sha256:494106e9cd945c2cadfce5374fa44c94cfadf01d4566a3b13bb487d2e6c7959e",
|
||||
"sha256:4c702855cd3174666ef0d2d13dcc879090aa9c6c38f5578896407a7028f75b9f",
|
||||
"sha256:52f769ecb4ef39865719aedc67b4b7eae167bafa48dbc2a26dd36fa56460507f",
|
||||
"sha256:5c49c9e8fb26a567a2b3fa0343c89f5d325447956cc2fc7231c943b29a973712",
|
||||
"sha256:684993ff6f67000a56454b41bdc7e015429732d65a52d06385b6e9de6181c71e",
|
||||
"sha256:6fbbbb8aab4053fa018984bb0e95a16faeb051dd8cca15add2a27e267ba02b58",
|
||||
"sha256:8982c19bb90a4fa2aad3d635c6d71814e38b643649b4000a8419f8691f20ac44",
|
||||
"sha256:9511416e85e449fe1de73f7f99b21b3aa04fba4c4d335d30c486ba3756e3a2a6",
|
||||
"sha256:97199a13b772e74cdcdb03760c32109c808aff7cd49c29e9cf4b7754bb725d1d",
|
||||
"sha256:a776bae1629c8d7198396fd93ec0265f8dd2341c553dc32b976168aaf0e6a636",
|
||||
"sha256:aa94d617a4cd4cdf4af9b5af65100c036bce22280ebb15d8b5262e8273ebc6ba",
|
||||
"sha256:b17d83b3d1610e571fedac21b2eb36b816654d6f7496004d6a0d32f99d1d8120",
|
||||
"sha256:d73e3a96c38173e0aa5646c31bf8473bc3564837977dd480f5cbeacf1d7ef3a3",
|
||||
"sha256:d91bc9f535599bed58f6d2e21a2724cb0c3895bf41c6403fe881391d29096f1d",
|
||||
"sha256:ef216d13ac8d24d9cd851776662f75f8d29c9f2d05cdcc2d34a18d32463a9b0b",
|
||||
"sha256:f6a5a85beb33e57998dc605b9dbe7deaa806385fdf5c4810fb849fcd04640c81",
|
||||
"sha256:f92556f94e476c1b616e6daec5f7ddded2c082efa7cee7f31c7aeda615906ed8"
|
||||
"sha256:0a17377fa52563d730248ba1f68185461fff36e8bc75d8787a7dd2e20a802b7a",
|
||||
"sha256:0ca4be2af48c24df689a150d9cd37404f689e2968e247b6b8ff09bff5bcd786f",
|
||||
"sha256:0d1922d9280e08cde90b518a10cd66831f632960a8d08cb3418922d83fce6f12",
|
||||
"sha256:0dfb7c88d4462a0cfdd0d87a3c245a7bc3feb59de101f6ff88194f740f72eda6",
|
||||
"sha256:0ff483716be32690c14636e54a1f6e2e1b7bf8e22ca50b989f88fa1b2d287080",
|
||||
"sha256:13e67c4d3fb8b6bc4ef778a7ccdd8df4cd15b4bcc18f4239c8440891a11245cc",
|
||||
"sha256:15b5fd9358803b0d1cc42505a18d8bca81dabb35b5cfbfea1505092e13a9d96d",
|
||||
"sha256:1cd6d50c1a8b79af1a6f703709d8973845f677c8e97b1268f5ff323d38ce8475",
|
||||
"sha256:2dd339ba3345b908fa3141ddba4025568fa6fd398eabce3ef72a29ac2d73ad75",
|
||||
"sha256:341fb7a26bc9d6093c1b124b9f13acc283d2d51da440b98b55ab3f79f2522ead",
|
||||
"sha256:34f04b7311174469ab3ac2647469743720f8b6c8b046f238e5cb27905695eb2a",
|
||||
"sha256:41c281a74df173876da1dc9a9b6953d387f06e3d3ed9284e3baae3ab3f40883a",
|
||||
"sha256:449ef2b321bec7d97ef2c944173275ebdab78f3abdd005400cc409e27cd159ab",
|
||||
"sha256:45f790934ac1018adeba46a0f7289b2b8fe76ba774a88c7f1922213a56c98bc1",
|
||||
"sha256:48948940d0ae00483e85e9154bb42997d0b77c21e43a77b7773c8c80de532ac5",
|
||||
"sha256:4c49eda9a23019e11d32a0eb51a27b3e7ddedde91e099c0ac6373e3aacc0d2ee",
|
||||
"sha256:504e464944f2c003a0785b81668fe23c06f3b037e9cb9f68a7c672246319f277",
|
||||
"sha256:534b96c0831855e29fc3b069b085fd185aa5353033631a585d5cd4dd5d40d657",
|
||||
"sha256:6ef1488967e729948d424d09c94753d0167ce59afba8d0f6c07a22b629c557b2",
|
||||
"sha256:7176a5ab56fac98d706921f6416a05e5aff7df0e4b91516f450f8627cda22af3",
|
||||
"sha256:7411c910fb2a412053cf33cfad0153ee20d27e256c6c3f14d7d7d1d9fec59fd5",
|
||||
"sha256:757af4f6341ce7a1e47c326ca2a81f41d236070217e5fbbad61bbfe299d55d28",
|
||||
"sha256:7823bc7cdf0b747ecfb096d004cc41573c2f5c7e3a29861603a2871b43d3ef32",
|
||||
"sha256:7fab1187b6c6b2f11a326f33b036f7168f5b996aedd0c059f9738915e4e8f53a",
|
||||
"sha256:84ef1f145de5aee82ea2447224dc23f065ff4cc5791bb3b506615957a6ba8128",
|
||||
"sha256:92e8cfe8bd7dd86eac0a677499894862cd5cc2fd74de917daa881d00871ac8e7",
|
||||
"sha256:9394c7d5a7565ac5f7d9ba38b2617448eba384d7b107b262d63890079fad77ca",
|
||||
"sha256:9495d78f52c804b5ec8878b5b8c7873aa8e63db9cd9ee387ff2db3fffe4df784",
|
||||
"sha256:9873bf7c1f2a6330bdfe8621e7ce64b725784f9f0c3a6a55c3047af5849f920e",
|
||||
"sha256:9babb7818fdd71394e576cf26c5452df77a355eac1a27ddfa24096665a27f8fd",
|
||||
"sha256:9e8776dac9e660c22241b6587fae51a67b4b0147daa4d176b172c3ff768ad736",
|
||||
"sha256:9ed64e5083fa806709e74fc5ea067dfef9090e5b7a2320a49be3c9df3583a2d8",
|
||||
"sha256:9f2c4cc63be3ef43c0221861177cee5d14b505cd4d4599a89e2cd273c4d3542a",
|
||||
"sha256:9f40642a140c0c8649987027867242b801486865277cbabc8c6059ddef16dc8b",
|
||||
"sha256:af84e8e99f1a82cea149e253014ea9dc89f75b82c87bb6c7242203186f465129",
|
||||
"sha256:b9c79af2c3058430d911ff1a5b2b96bbfe8da47d5ed961639ce4681886614e70",
|
||||
"sha256:c52fded6383f7e20eaf70a60aeddd796b3677c3ad2922c801be330db62778e05",
|
||||
"sha256:cbb8e769d4cac884bb28e3ff620ef1001b75588a5c83c9c9f1fdc9afbe7f29b0",
|
||||
"sha256:d84c40bdb8674c29fa192373498b6cb1e84f882889d21a471b45d1f868d8d44b",
|
||||
"sha256:db5597a4c7353b2e5fb05a8e6cb74b56a4658a2b7bf3cb6b1821ae7e7fd6eaa0",
|
||||
"sha256:e22801b61613ebdebf7deb18b507919e107547a1d39a3b57f5f855032dd7cfb8",
|
||||
"sha256:e34da95e29daf8a71cb2841fd55df0511539a6cdf33e6f77c1e95e44006b9b46",
|
||||
"sha256:e46710a240a41d594953012213ea8ca398cd2448fbc5d0f1be8160b5511104a0",
|
||||
"sha256:e94eb5fa32a8a9f9bf991f424f002913e3dd7c699ef552db9b14ba6a76a6313b",
|
||||
"sha256:ec13b7105117dbc9afd023300fb9954d72ca855c274fe563e72428ece10191c0",
|
||||
"sha256:ed570874e88f213437f5cf758f9ef26cbfc3f336d889b1e592ee11283bb8d1c7",
|
||||
"sha256:ed957044e368ed295257ae3d212b95456bd9756df490e1ac4538857f67531fcc",
|
||||
"sha256:ef648d2c690703501714588b2ba640facd50fd16548133b11b2859e8655a69da",
|
||||
"sha256:efc9e51c3e595267ff84adf56e9b357db89ab2279d7e375ffcaf8f678606f3d9",
|
||||
"sha256:f736ab8036796f5a119ff8211deda416f8c15ce03776db704a7a4e17381cb2ef",
|
||||
"sha256:f7a24ea78de345cfa7f6a8d3bde8b242c7fac27f2bd78fa23474ca38dfaeeab9",
|
||||
"sha256:f7de12fa0eee6234de9a9ce0ffcfa6ce97361db7a50b09b65c63ac58e5f22fc7",
|
||||
"sha256:f9b55038b5c6c47559aa33626d8ecd092f354e23de3c6975e4bb205df128a2a0",
|
||||
"sha256:fd4b5e2ee4e60425711ec65c33add4e7a626adef79d66f62ba0acfd493af282d"
|
||||
],
|
||||
"markers": "python_version >= '3.8' and python_full_version not in '3.9.0, 3.9.1'",
|
||||
"version": "==46.0.1"
|
||||
},
|
||||
"distro": {
|
||||
"hashes": [
|
||||
"sha256:2fa77c6fd8940f116ee1d6b94a2f90b13b5ea8d019b98bc8bafdcabcdd9bdbed",
|
||||
"sha256:7bffd925d65168f85027d8da9af6bddab658135b840670a223589bc0c8ef02b2"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==36.0.0"
|
||||
"version": "==1.9.0"
|
||||
},
|
||||
"filelock": {
|
||||
"hashes": [
|
||||
"sha256:66eda1888b0171c998b35be2bcc0f6d75c388a7ce20c3f3f37aa8e96c2dddf58",
|
||||
"sha256:d38e30481def20772f5baf097c122c3babc4fcdb7e14e57049eb9d88c6dc017d"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==3.19.1"
|
||||
},
|
||||
"importlib-metadata": {
|
||||
"hashes": [
|
||||
"sha256:d13b81ad223b890aa16c5471f2ac3056cf76c5f10f82d6f9292f0b415f389000",
|
||||
"sha256:e5dd1551894c77868a30651cef00984d50e1002d06942a7101d34870c5f02afd"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==8.7.0"
|
||||
},
|
||||
"jinja2": {
|
||||
"hashes": [
|
||||
"sha256:077ce6014f7b40d03b47d1f1ca4b0fc8328a692bd284016f806ed0eaca390ad8",
|
||||
"sha256:611bb273cd68f3b993fabdc4064fc858c5b47a973cb5aa7999ec1ba405c87cd7"
|
||||
"sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d",
|
||||
"sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==3.0.3"
|
||||
"markers": "python_version >= '3.7'",
|
||||
"version": "==3.1.6"
|
||||
},
|
||||
"jsonschema": {
|
||||
"hashes": [
|
||||
"sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63",
|
||||
"sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==4.25.1"
|
||||
},
|
||||
"jsonschema-specifications": {
|
||||
"hashes": [
|
||||
"sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe",
|
||||
"sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==2025.9.1"
|
||||
},
|
||||
"markupsafe": {
|
||||
"hashes": [
|
||||
"sha256:01a9b8ea66f1658938f65b93a85ebe8bc016e6769611be228d797c9d998dd298",
|
||||
"sha256:023cb26ec21ece8dc3907c0e8320058b2e0cb3c55cf9564da612bc325bed5e64",
|
||||
"sha256:0446679737af14f45767963a1a9ef7620189912317d095f2d9ffa183a4d25d2b",
|
||||
"sha256:04635854b943835a6ea959e948d19dcd311762c5c0c6e1f0e16ee57022669194",
|
||||
"sha256:0717a7390a68be14b8c793ba258e075c6f4ca819f15edfc2a3a027c823718567",
|
||||
"sha256:0955295dd5eec6cb6cc2fe1698f4c6d84af2e92de33fbcac4111913cd100a6ff",
|
||||
"sha256:0d4b31cc67ab36e3392bbf3862cfbadac3db12bdd8b02a2731f509ed5b829724",
|
||||
"sha256:10f82115e21dc0dfec9ab5c0223652f7197feb168c940f3ef61563fc2d6beb74",
|
||||
"sha256:168cd0a3642de83558a5153c8bd34f175a9a6e7f6dc6384b9655d2697312a646",
|
||||
"sha256:1d609f577dc6e1aa17d746f8bd3c31aa4d258f4070d61b2aa5c4166c1539de35",
|
||||
"sha256:1f2ade76b9903f39aa442b4aadd2177decb66525062db244b35d71d0ee8599b6",
|
||||
"sha256:20dca64a3ef2d6e4d5d615a3fd418ad3bde77a47ec8a23d984a12b5b4c74491a",
|
||||
"sha256:2a7d351cbd8cfeb19ca00de495e224dea7e7d919659c2841bbb7f420ad03e2d6",
|
||||
"sha256:2d7d807855b419fc2ed3e631034685db6079889a1f01d5d9dac950f764da3dad",
|
||||
"sha256:2ef54abee730b502252bcdf31b10dacb0a416229b72c18b19e24a4509f273d26",
|
||||
"sha256:36bc903cbb393720fad60fc28c10de6acf10dc6cc883f3e24ee4012371399a38",
|
||||
"sha256:37205cac2a79194e3750b0af2a5720d95f786a55ce7df90c3af697bfa100eaac",
|
||||
"sha256:3c112550557578c26af18a1ccc9e090bfe03832ae994343cfdacd287db6a6ae7",
|
||||
"sha256:3dd007d54ee88b46be476e293f48c85048603f5f516008bee124ddd891398ed6",
|
||||
"sha256:4296f2b1ce8c86a6aea78613c34bb1a672ea0e3de9c6ba08a960efe0b0a09047",
|
||||
"sha256:47ab1e7b91c098ab893b828deafa1203de86d0bc6ab587b160f78fe6c4011f75",
|
||||
"sha256:49e3ceeabbfb9d66c3aef5af3a60cc43b85c33df25ce03d0031a608b0a8b2e3f",
|
||||
"sha256:4dc8f9fb58f7364b63fd9f85013b780ef83c11857ae79f2feda41e270468dd9b",
|
||||
"sha256:4efca8f86c54b22348a5467704e3fec767b2db12fc39c6d963168ab1d3fc9135",
|
||||
"sha256:53edb4da6925ad13c07b6d26c2a852bd81e364f95301c66e930ab2aef5b5ddd8",
|
||||
"sha256:5855f8438a7d1d458206a2466bf82b0f104a3724bf96a1c781ab731e4201731a",
|
||||
"sha256:594c67807fb16238b30c44bdf74f36c02cdf22d1c8cda91ef8a0ed8dabf5620a",
|
||||
"sha256:5b6d930f030f8ed98e3e6c98ffa0652bdb82601e7a016ec2ab5d7ff23baa78d1",
|
||||
"sha256:5bb28c636d87e840583ee3adeb78172efc47c8b26127267f54a9c0ec251d41a9",
|
||||
"sha256:60bf42e36abfaf9aff1f50f52644b336d4f0a3fd6d8a60ca0d054ac9f713a864",
|
||||
"sha256:611d1ad9a4288cf3e3c16014564df047fe08410e628f89805e475368bd304914",
|
||||
"sha256:6300b8454aa6930a24b9618fbb54b5a68135092bc666f7b06901f897fa5c2fee",
|
||||
"sha256:63f3268ba69ace99cab4e3e3b5840b03340efed0948ab8f78d2fd87ee5442a4f",
|
||||
"sha256:6557b31b5e2c9ddf0de32a691f2312a32f77cd7681d8af66c2692efdbef84c18",
|
||||
"sha256:693ce3f9e70a6cf7d2fb9e6c9d8b204b6b39897a2c4a1aa65728d5ac97dcc1d8",
|
||||
"sha256:6a7fae0dd14cf60ad5ff42baa2e95727c3d81ded453457771d02b7d2b3f9c0c2",
|
||||
"sha256:6c4ca60fa24e85fe25b912b01e62cb969d69a23a5d5867682dd3e80b5b02581d",
|
||||
"sha256:6fcf051089389abe060c9cd7caa212c707e58153afa2c649f00346ce6d260f1b",
|
||||
"sha256:7d91275b0245b1da4d4cfa07e0faedd5b0812efc15b702576d103293e252af1b",
|
||||
"sha256:89c687013cb1cd489a0f0ac24febe8c7a666e6e221b783e53ac50ebf68e45d86",
|
||||
"sha256:8d206346619592c6200148b01a2142798c989edcb9c896f9ac9722a99d4e77e6",
|
||||
"sha256:905fec760bd2fa1388bb5b489ee8ee5f7291d692638ea5f67982d968366bef9f",
|
||||
"sha256:97383d78eb34da7e1fa37dd273c20ad4320929af65d156e35a5e2d89566d9dfb",
|
||||
"sha256:984d76483eb32f1bcb536dc27e4ad56bba4baa70be32fa87152832cdd9db0833",
|
||||
"sha256:99df47edb6bda1249d3e80fdabb1dab8c08ef3975f69aed437cb69d0a5de1e28",
|
||||
"sha256:9f02365d4e99430a12647f09b6cc8bab61a6564363f313126f775eb4f6ef798e",
|
||||
"sha256:a30e67a65b53ea0a5e62fe23682cfe22712e01f453b95233b25502f7c61cb415",
|
||||
"sha256:ab3ef638ace319fa26553db0624c4699e31a28bb2a835c5faca8f8acf6a5a902",
|
||||
"sha256:aca6377c0cb8a8253e493c6b451565ac77e98c2951c45f913e0b52facdcff83f",
|
||||
"sha256:add36cb2dbb8b736611303cd3bfcee00afd96471b09cda130da3581cbdc56a6d",
|
||||
"sha256:b2f4bf27480f5e5e8ce285a8c8fd176c0b03e93dcc6646477d4630e83440c6a9",
|
||||
"sha256:b7f2d075102dc8c794cbde1947378051c4e5180d52d276987b8d28a3bd58c17d",
|
||||
"sha256:baa1a4e8f868845af802979fcdbf0bb11f94f1cb7ced4c4b8a351bb60d108145",
|
||||
"sha256:be98f628055368795d818ebf93da628541e10b75b41c559fdf36d104c5787066",
|
||||
"sha256:bf5d821ffabf0ef3533c39c518f3357b171a1651c1ff6827325e4489b0e46c3c",
|
||||
"sha256:c47adbc92fc1bb2b3274c4b3a43ae0e4573d9fbff4f54cd484555edbf030baf1",
|
||||
"sha256:cdfba22ea2f0029c9261a4bd07e830a8da012291fbe44dc794e488b6c9bb353a",
|
||||
"sha256:d6c7ebd4e944c85e2c3421e612a7057a2f48d478d79e61800d81468a8d842207",
|
||||
"sha256:d7f9850398e85aba693bb640262d3611788b1f29a79f0c93c565694658f4071f",
|
||||
"sha256:d8446c54dc28c01e5a2dbac5a25f071f6653e6e40f3a8818e8b45d790fe6ef53",
|
||||
"sha256:deb993cacb280823246a026e3b2d81c493c53de6acfd5e6bfe31ab3402bb37dd",
|
||||
"sha256:e0f138900af21926a02425cf736db95be9f4af72ba1bb21453432a07f6082134",
|
||||
"sha256:e9936f0b261d4df76ad22f8fee3ae83b60d7c3e871292cd42f40b81b70afae85",
|
||||
"sha256:f0567c4dc99f264f49fe27da5f735f414c4e7e7dd850cfd8e69f0862d7c74ea9",
|
||||
"sha256:f5653a225f31e113b152e56f154ccbe59eeb1c7487b39b9d9f9cdb58e6c79dc5",
|
||||
"sha256:f826e31d18b516f653fe296d967d700fddad5901ae07c622bb3705955e1faa94",
|
||||
"sha256:f8ba0e8349a38d3001fae7eadded3f6606f0da5d748ee53cc1dab1d6527b9509",
|
||||
"sha256:f9081981fe268bd86831e5c75f7de206ef275defcb82bc70740ae6dc507aee51",
|
||||
"sha256:fa130dd50c57d53368c9d59395cb5526eda596d3ffe36666cd81a44d56e48872"
|
||||
"sha256:0bff5e0ae4ef2e1ae4fdf2dfd5b76c75e5c2fa4132d05fc1b0dabcd20c7e28c4",
|
||||
"sha256:0f4ca02bea9a23221c0182836703cbf8930c5e9454bacce27e767509fa286a30",
|
||||
"sha256:1225beacc926f536dc82e45f8a4d68502949dc67eea90eab715dea3a21c1b5f0",
|
||||
"sha256:131a3c7689c85f5ad20f9f6fb1b866f402c445b220c19fe4308c0b147ccd2ad9",
|
||||
"sha256:15ab75ef81add55874e7ab7055e9c397312385bd9ced94920f2802310c930396",
|
||||
"sha256:1a9d3f5f0901fdec14d8d2f66ef7d035f2157240a433441719ac9a3fba440b13",
|
||||
"sha256:1c99d261bd2d5f6b59325c92c73df481e05e57f19837bdca8413b9eac4bd8028",
|
||||
"sha256:1e084f686b92e5b83186b07e8a17fc09e38fff551f3602b249881fec658d3eca",
|
||||
"sha256:2181e67807fc2fa785d0592dc2d6206c019b9502410671cc905d132a92866557",
|
||||
"sha256:2cb8438c3cbb25e220c2ab33bb226559e7afb3baec11c4f218ffa7308603c832",
|
||||
"sha256:3169b1eefae027567d1ce6ee7cae382c57fe26e82775f460f0b2778beaad66c0",
|
||||
"sha256:3809ede931876f5b2ec92eef964286840ed3540dadf803dd570c3b7e13141a3b",
|
||||
"sha256:38a9ef736c01fccdd6600705b09dc574584b89bea478200c5fbf112a6b0d5579",
|
||||
"sha256:3d79d162e7be8f996986c064d1c7c817f6df3a77fe3d6859f6f9e7be4b8c213a",
|
||||
"sha256:444dcda765c8a838eaae23112db52f1efaf750daddb2d9ca300bcae1039adc5c",
|
||||
"sha256:48032821bbdf20f5799ff537c7ac3d1fba0ba032cfc06194faffa8cda8b560ff",
|
||||
"sha256:4aa4e5faecf353ed117801a068ebab7b7e09ffb6e1d5e412dc852e0da018126c",
|
||||
"sha256:52305740fe773d09cffb16f8ed0427942901f00adedac82ec8b67752f58a1b22",
|
||||
"sha256:569511d3b58c8791ab4c2e1285575265991e6d8f8700c7be0e88f86cb0672094",
|
||||
"sha256:57cb5a3cf367aeb1d316576250f65edec5bb3be939e9247ae594b4bcbc317dfb",
|
||||
"sha256:5b02fb34468b6aaa40dfc198d813a641e3a63b98c2b05a16b9f80b7ec314185e",
|
||||
"sha256:6381026f158fdb7c72a168278597a5e3a5222e83ea18f543112b2662a9b699c5",
|
||||
"sha256:6af100e168aa82a50e186c82875a5893c5597a0c1ccdb0d8b40240b1f28b969a",
|
||||
"sha256:6c89876f41da747c8d3677a2b540fb32ef5715f97b66eeb0c6b66f5e3ef6f59d",
|
||||
"sha256:6e296a513ca3d94054c2c881cc913116e90fd030ad1c656b3869762b754f5f8a",
|
||||
"sha256:70a87b411535ccad5ef2f1df5136506a10775d267e197e4cf531ced10537bd6b",
|
||||
"sha256:7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8",
|
||||
"sha256:846ade7b71e3536c4e56b386c2a47adf5741d2d8b94ec9dc3e92e5e1ee1e2225",
|
||||
"sha256:88416bd1e65dcea10bc7569faacb2c20ce071dd1f87539ca2ab364bf6231393c",
|
||||
"sha256:88b49a3b9ff31e19998750c38e030fc7bb937398b1f78cfa599aaef92d693144",
|
||||
"sha256:8c4e8c3ce11e1f92f6536ff07154f9d49677ebaaafc32db9db4620bc11ed480f",
|
||||
"sha256:8e06879fc22a25ca47312fbe7c8264eb0b662f6db27cb2d3bbbc74b1df4b9b87",
|
||||
"sha256:9025b4018f3a1314059769c7bf15441064b2207cb3f065e6ea1e7359cb46db9d",
|
||||
"sha256:93335ca3812df2f366e80509ae119189886b0f3c2b81325d39efdb84a1e2ae93",
|
||||
"sha256:9778bd8ab0a994ebf6f84c2b949e65736d5575320a17ae8984a77fab08db94cf",
|
||||
"sha256:9e2d922824181480953426608b81967de705c3cef4d1af983af849d7bd619158",
|
||||
"sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84",
|
||||
"sha256:a904af0a6162c73e3edcb969eeeb53a63ceeb5d8cf642fade7d39e7963a22ddb",
|
||||
"sha256:ad10d3ded218f1039f11a75f8091880239651b52e9bb592ca27de44eed242a48",
|
||||
"sha256:b424c77b206d63d500bcb69fa55ed8d0e6a3774056bdc4839fc9298a7edca171",
|
||||
"sha256:b5a6b3ada725cea8a5e634536b1b01c30bcdcd7f9c6fff4151548d5bf6b3a36c",
|
||||
"sha256:ba8062ed2cf21c07a9e295d5b8a2a5ce678b913b45fdf68c32d95d6c1291e0b6",
|
||||
"sha256:ba9527cdd4c926ed0760bc301f6728ef34d841f405abf9d4f959c478421e4efd",
|
||||
"sha256:bbcb445fa71794da8f178f0f6d66789a28d7319071af7a496d4d507ed566270d",
|
||||
"sha256:bcf3e58998965654fdaff38e58584d8937aa3096ab5354d493c77d1fdd66d7a1",
|
||||
"sha256:c0ef13eaeee5b615fb07c9a7dadb38eac06a0608b41570d8ade51c56539e509d",
|
||||
"sha256:cabc348d87e913db6ab4aa100f01b08f481097838bdddf7c7a84b7575b7309ca",
|
||||
"sha256:cdb82a876c47801bb54a690c5ae105a46b392ac6099881cdfb9f6e95e4014c6a",
|
||||
"sha256:cfad01eed2c2e0c01fd0ecd2ef42c492f7f93902e39a42fc9ee1692961443a29",
|
||||
"sha256:d16a81a06776313e817c951135cf7340a3e91e8c1ff2fac444cfd75fffa04afe",
|
||||
"sha256:d8213e09c917a951de9d09ecee036d5c7d36cb6cb7dbaece4c71a60d79fb9798",
|
||||
"sha256:e07c3764494e3776c602c1e78e298937c3315ccc9043ead7e685b7f2b8d47b3c",
|
||||
"sha256:e17c96c14e19278594aa4841ec148115f9c7615a47382ecb6b82bd8fea3ab0c8",
|
||||
"sha256:e444a31f8db13eb18ada366ab3cf45fd4b31e4db1236a4448f68778c1d1a5a2f",
|
||||
"sha256:e6a2a455bd412959b57a172ce6328d2dd1f01cb2135efda2e4576e8a23fa3b0f",
|
||||
"sha256:eaa0a10b7f72326f1372a713e73c3f739b524b3af41feb43e4921cb529f5929a",
|
||||
"sha256:eb7972a85c54febfb25b5c4b4f3af4dcc731994c7da0d8a0b4a6eb0640e1d178",
|
||||
"sha256:ee55d3edf80167e48ea11a923c7386f4669df67d7994554387f84e7d8b0a2bf0",
|
||||
"sha256:f3818cb119498c0678015754eba762e0d61e5b52d34c8b13d770f0719f7b1d79",
|
||||
"sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430",
|
||||
"sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==2.0.1"
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==3.0.2"
|
||||
},
|
||||
"mypy-extensions": {
|
||||
"hashes": [
|
||||
"sha256:1be4cccdb0f2482337c4743e60421de3a356cd97508abadd57d47403e94f5505",
|
||||
"sha256:52e68efc3284861e772bbcd66823fde5ae21fd2fdb51c62a211403730b916558"
|
||||
],
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==1.1.0"
|
||||
},
|
||||
"packaging": {
|
||||
"hashes": [
|
||||
"sha256:dd47c42927d89ab911e606518907cc2d3a1f38bbd026385970643f9c5b8ecfeb",
|
||||
"sha256:ef103e05f519cdc783ae24ea4e2e0f508a9c99b2d4969652eed6a2e1ea5bd522"
|
||||
"sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484",
|
||||
"sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==21.3"
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==25.0"
|
||||
},
|
||||
"pathspec": {
|
||||
"hashes": [
|
||||
"sha256:a0d503e138a4c123b27490a4f7beda6a01c6f288df0e4a8b79c7eb0dc7b4cc08",
|
||||
"sha256:a482d51503a1ab33b1c67a6c3813a26953dbdc71c31dacaef9a838c4e29f5712"
|
||||
],
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==0.12.1"
|
||||
},
|
||||
"platformdirs": {
|
||||
"hashes": [
|
||||
"sha256:abd01743f24e5287cd7a5db3752faf1a2d65353f38ec26d98e25a6db65958c85",
|
||||
"sha256:ca753cf4d81dc309bc67b0ea38fd15dc97bc30ce419a7f58d13eb3bf14c4febf"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==4.4.0"
|
||||
},
|
||||
"pycparser": {
|
||||
"hashes": [
|
||||
"sha256:8ee45429555515e1f6b185e78100aea234072576aa43ab53aefcae078162fca9",
|
||||
"sha256:e644fdec12f7872f86c58ff790da456218b10f863970249516d60a5eaca77206"
|
||||
"sha256:78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2",
|
||||
"sha256:e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934"
|
||||
],
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
|
||||
"version": "==2.21"
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==2.23"
|
||||
},
|
||||
"pyparsing": {
|
||||
"pytokens": {
|
||||
"hashes": [
|
||||
"sha256:04ff808a5b90911829c55c4e26f75fa5ca8a2f5f36aa3a51f68e27033341d3e4",
|
||||
"sha256:d9bdec0013ef1eb5a84ab39a3b3868911598afa494f5faa038647101504e2b81"
|
||||
"sha256:c9a4bfa0be1d26aebce03e6884ba454e842f186a59ea43a6d3b25af58223c044",
|
||||
"sha256:db7b72284e480e69fb085d9f251f66b3d2df8b7166059261258ff35f50fb711b"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==3.0.6"
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==0.1.10"
|
||||
},
|
||||
"pyyaml": {
|
||||
"hashes": [
|
||||
"sha256:0283c35a6a9fbf047493e3a0ce8d79ef5030852c51e9d911a27badfde0605293",
|
||||
"sha256:055d937d65826939cb044fc8c9b08889e8c743fdc6a32b33e2390f66013e449b",
|
||||
"sha256:07751360502caac1c067a8132d150cf3d61339af5691fe9e87803040dbc5db57",
|
||||
"sha256:0b4624f379dab24d3725ffde76559cff63d9ec94e1736b556dacdfebe5ab6d4b",
|
||||
"sha256:0ce82d761c532fe4ec3f87fc45688bdd3a4c1dc5e0b4a19814b9009a29baefd4",
|
||||
"sha256:1e4747bc279b4f613a09eb64bba2ba602d8a6664c6ce6396a4d0cd413a50ce07",
|
||||
"sha256:213c60cd50106436cc818accf5baa1aba61c0189ff610f64f4a3e8c6726218ba",
|
||||
"sha256:231710d57adfd809ef5d34183b8ed1eeae3f76459c18fb4a0b373ad56bedcdd9",
|
||||
"sha256:277a0ef2981ca40581a47093e9e2d13b3f1fbbeffae064c1d21bfceba2030287",
|
||||
"sha256:2cd5df3de48857ed0544b34e2d40e9fac445930039f3cfe4bcc592a1f836d513",
|
||||
"sha256:40527857252b61eacd1d9af500c3337ba8deb8fc298940291486c465c8b46ec0",
|
||||
"sha256:473f9edb243cb1935ab5a084eb238d842fb8f404ed2193a915d1784b5a6b5fc0",
|
||||
"sha256:48c346915c114f5fdb3ead70312bd042a953a8ce5c7106d5bfb1a5254e47da92",
|
||||
"sha256:50602afada6d6cbfad699b0c7bb50d5ccffa7e46a3d738092afddc1f9758427f",
|
||||
"sha256:68fb519c14306fec9720a2a5b45bc9f0c8d1b9c72adf45c37baedfcd949c35a2",
|
||||
"sha256:77f396e6ef4c73fdc33a9157446466f1cff553d979bd00ecb64385760c6babdc",
|
||||
"sha256:819b3830a1543db06c4d4b865e70ded25be52a2e0631ccd2f6a47a2822f2fd7c",
|
||||
"sha256:897b80890765f037df3403d22bab41627ca8811ae55e9a722fd0392850ec4d86",
|
||||
"sha256:98c4d36e99714e55cfbaaee6dd5badbc9a1ec339ebfc3b1f52e293aee6bb71a4",
|
||||
"sha256:9df7ed3b3d2e0ecfe09e14741b857df43adb5a3ddadc919a2d94fbdf78fea53c",
|
||||
"sha256:9fa600030013c4de8165339db93d182b9431076eb98eb40ee068700c9c813e34",
|
||||
"sha256:a80a78046a72361de73f8f395f1f1e49f956c6be882eed58505a15f3e430962b",
|
||||
"sha256:b3d267842bf12586ba6c734f89d1f5b871df0273157918b0ccefa29deb05c21c",
|
||||
"sha256:b5b9eccad747aabaaffbc6064800670f0c297e52c12754eb1d976c57e4f74dcb",
|
||||
"sha256:c5687b8d43cf58545ade1fe3e055f70eac7a5a1a0bf42824308d868289a95737",
|
||||
"sha256:cba8c411ef271aa037d7357a2bc8f9ee8b58b9965831d9e51baf703280dc73d3",
|
||||
"sha256:d15a181d1ecd0d4270dc32edb46f7cb7733c7c508857278d3d378d14d606db2d",
|
||||
"sha256:d4db7c7aef085872ef65a8fd7d6d09a14ae91f691dec3e87ee5ee0539d516f53",
|
||||
"sha256:d4eccecf9adf6fbcc6861a38015c2a64f38b9d94838ac1810a9023a0609e1b78",
|
||||
"sha256:d67d839ede4ed1b28a4e8909735fc992a923cdb84e618544973d7dfc71540803",
|
||||
"sha256:daf496c58a8c52083df09b80c860005194014c3698698d1a57cbcfa182142a3a",
|
||||
"sha256:e61ceaab6f49fb8bdfaa0f92c4b57bcfbea54c09277b1b4f7ac376bfb7a7c174",
|
||||
"sha256:f84fbc98b019fef2ee9a1cb3ce93e3187a6df0b2538a651bfb890254ba9f90b5"
|
||||
"sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff",
|
||||
"sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48",
|
||||
"sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086",
|
||||
"sha256:0b69e4ce7a131fe56b7e4d770c67429700908fc0752af059838b1cfb41960e4e",
|
||||
"sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133",
|
||||
"sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5",
|
||||
"sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484",
|
||||
"sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee",
|
||||
"sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5",
|
||||
"sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68",
|
||||
"sha256:24471b829b3bf607e04e88d79542a9d48bb037c2267d7927a874e6c205ca7e9a",
|
||||
"sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf",
|
||||
"sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99",
|
||||
"sha256:39693e1f8320ae4f43943590b49779ffb98acb81f788220ea932a6b6c51004d8",
|
||||
"sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85",
|
||||
"sha256:3b1fdb9dc17f5a7677423d508ab4f243a726dea51fa5e70992e59a7411c89d19",
|
||||
"sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc",
|
||||
"sha256:43fa96a3ca0d6b1812e01ced1044a003533c47f6ee8aca31724f78e93ccc089a",
|
||||
"sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1",
|
||||
"sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317",
|
||||
"sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c",
|
||||
"sha256:6395c297d42274772abc367baaa79683958044e5d3835486c16da75d2a694631",
|
||||
"sha256:688ba32a1cffef67fd2e9398a2efebaea461578b0923624778664cc1c914db5d",
|
||||
"sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652",
|
||||
"sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5",
|
||||
"sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e",
|
||||
"sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b",
|
||||
"sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8",
|
||||
"sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476",
|
||||
"sha256:82d09873e40955485746739bcb8b4586983670466c23382c19cffecbf1fd8706",
|
||||
"sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563",
|
||||
"sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237",
|
||||
"sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b",
|
||||
"sha256:9056c1ecd25795207ad294bcf39f2db3d845767be0ea6e6a34d856f006006083",
|
||||
"sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180",
|
||||
"sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425",
|
||||
"sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e",
|
||||
"sha256:a8786accb172bd8afb8be14490a16625cbc387036876ab6ba70912730faf8e1f",
|
||||
"sha256:a9f8c2e67970f13b16084e04f134610fd1d374bf477b17ec1599185cf611d725",
|
||||
"sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183",
|
||||
"sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab",
|
||||
"sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774",
|
||||
"sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725",
|
||||
"sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e",
|
||||
"sha256:d7fded462629cfa4b685c5416b949ebad6cec74af5e2d42905d41e257e0869f5",
|
||||
"sha256:d84a1718ee396f54f3a086ea0a66d8e552b2ab2017ef8b420e92edbc841c352d",
|
||||
"sha256:d8e03406cac8513435335dbab54c0d385e4a49e4945d2909a581c83647ca0290",
|
||||
"sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44",
|
||||
"sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed",
|
||||
"sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4",
|
||||
"sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba",
|
||||
"sha256:f753120cb8181e736c57ef7636e83f31b9c0d1722c516f7e86cf15b7aa57ff12",
|
||||
"sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==6.0"
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==6.0.2"
|
||||
},
|
||||
"referencing": {
|
||||
"hashes": [
|
||||
"sha256:df2e89862cd09deabbdba16944cc3f10feb6b3e6f18e902f7cc25609a34775aa",
|
||||
"sha256:e8699adbbf8b5c7de96d8ffa0eb5c158b3beafce084968e2ea8bb08c6794dcd0"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==0.36.2"
|
||||
},
|
||||
"resolvelib": {
|
||||
"hashes": [
|
||||
"sha256:8113ae3ed6d33c6be0bcbf03ffeb06c0995c099b7b8aaa5ddf2e9b3b3df4e915",
|
||||
"sha256:9b9b80d5c60e4c2a8b7fbf0712c3449dc01d74e215632e5199850c9eca687628"
|
||||
"sha256:8e3e2000beaf53fdfd8772fda1a7b1df97e803ab7c8925621bbb87c4d187a94d",
|
||||
"sha256:c27fbb5098acd7dfc01fb2be3724bd0881168edc2bd3b4dc876ca3f46b8e4a3d"
|
||||
],
|
||||
"version": "==0.5.4"
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==1.2.0"
|
||||
},
|
||||
"rpds-py": {
|
||||
"hashes": [
|
||||
"sha256:008b839781d6c9bf3b6a8984d1d8e56f0ec46dc56df61fd669c49b58ae800400",
|
||||
"sha256:037a2361db72ee98d829bc2c5b7cc55598ae0a5e0ec1823a56ea99374cfd73c1",
|
||||
"sha256:079bc583a26db831a985c5257797b2b5d3affb0386e7ff886256762f82113b5e",
|
||||
"sha256:08f1e20bccf73b08d12d804d6e1c22ca5530e71659e6673bce31a6bb71c1e73f",
|
||||
"sha256:0b08d152555acf1f455154d498ca855618c1378ec810646fcd7c76416ac6dc60",
|
||||
"sha256:0d807710df3b5faa66c731afa162ea29717ab3be17bdc15f90f2d9f183da4059",
|
||||
"sha256:0dc5dceeaefcc96dc192e3a80bbe1d6c410c469e97bdd47494a7d930987f18b2",
|
||||
"sha256:12ed005216a51b1d6e2b02a7bd31885fe317e45897de81d86dcce7d74618ffff",
|
||||
"sha256:134fae0e36022edad8290a6661edf40c023562964efea0cc0ec7f5d392d2aaef",
|
||||
"sha256:13e608ac9f50a0ed4faec0e90ece76ae33b34c0e8656e3dceb9a7db994c692cd",
|
||||
"sha256:1441811a96eadca93c517d08df75de45e5ffe68aa3089924f963c782c4b898cf",
|
||||
"sha256:15d3b4d83582d10c601f481eca29c3f138d44c92187d197aff663a269197c02d",
|
||||
"sha256:16323f674c089b0360674a4abd28d5042947d54ba620f72514d69be4ff64845e",
|
||||
"sha256:168b025f8fd8d8d10957405f3fdcef3dc20f5982d398f90851f4abc58c566c52",
|
||||
"sha256:1b207d881a9aef7ba753d69c123a35d96ca7cb808056998f6b9e8747321f03b8",
|
||||
"sha256:1fea2b1a922c47c51fd07d656324531adc787e415c8b116530a1d29c0516c62d",
|
||||
"sha256:23f6b69d1c26c4704fec01311963a41d7de3ee0570a84ebde4d544e5a1859ffc",
|
||||
"sha256:2643400120f55c8a96f7c9d858f7be0c88d383cd4653ae2cf0d0c88f668073e5",
|
||||
"sha256:26a1c73171d10b7acccbded82bf6a586ab8203601e565badc74bbbf8bc5a10f8",
|
||||
"sha256:2bde09cbcf2248b73c7c323be49b280180ff39fadcfe04e7b6f54a678d02a7cf",
|
||||
"sha256:2c426b99a068601b5f4623573df7a7c3d72e87533a2dd2253353a03e7502566c",
|
||||
"sha256:2efe4eb1d01b7f5f1939f4ef30ecea6c6b3521eec451fb93191bf84b2a522418",
|
||||
"sha256:2f57af9b4d0793e53266ee4325535a31ba48e2f875da81a9177c9926dfa60746",
|
||||
"sha256:2fd50659a069c15eef8aa3d64bbef0d69fd27bb4a50c9ab4f17f83a16cbf8905",
|
||||
"sha256:3020724ade63fe320a972e2ffd93b5623227e684315adce194941167fee02688",
|
||||
"sha256:3182af66048c00a075010bc7f4860f33913528a4b6fc09094a6e7598e462fe39",
|
||||
"sha256:31d3ebadefcd73b73928ed0b2fd696f7fefda8629229f81929ac9c1854d0cffb",
|
||||
"sha256:33aa65b97826a0e885ef6e278fbd934e98cdcfed80b63946025f01e2f5b29502",
|
||||
"sha256:387ce8c44ae94e0ec50532d9cb0edce17311024c9794eb196b90e1058aadeb66",
|
||||
"sha256:3adc388fc3afb6540aec081fa59e6e0d3908722771aa1e37ffe22b220a436f0b",
|
||||
"sha256:3c64d07e95606ec402a0a1c511fe003873fa6af630bda59bac77fac8b4318ebc",
|
||||
"sha256:3ce0cac322b0d69b63c9cdb895ee1b65805ec9ffad37639f291dd79467bee675",
|
||||
"sha256:3d905d16f77eb6ab2e324e09bfa277b4c8e5e6b8a78a3e7ff8f3cdf773b4c013",
|
||||
"sha256:3deab27804d65cd8289eb814c2c0e807c4b9d9916c9225e363cb0cf875eb67c1",
|
||||
"sha256:3e039aabf6d5f83c745d5f9a0a381d031e9ed871967c0a5c38d201aca41f3ba1",
|
||||
"sha256:41e532bbdcb57c92ba3be62c42e9f096431b4cf478da9bc3bc6ce5c38ab7ba7a",
|
||||
"sha256:42a89282d711711d0a62d6f57d81aa43a1368686c45bc1c46b7f079d55692734",
|
||||
"sha256:466bfe65bd932da36ff279ddd92de56b042f2266d752719beb97b08526268ec5",
|
||||
"sha256:4708c5c0ceb2d034f9991623631d3d23cb16e65c83736ea020cdbe28d57c0a0e",
|
||||
"sha256:47162fdab9407ec3f160805ac3e154df042e577dd53341745fc7fb3f625e6d92",
|
||||
"sha256:4848ca84d6ded9b58e474dfdbad4b8bfb450344c0551ddc8d958bf4b36aa837c",
|
||||
"sha256:4b507d19f817ebaca79574b16eb2ae412e5c0835542c93fe9983f1e432aca195",
|
||||
"sha256:4e44099bd522cba71a2c6b97f68e19f40e7d85399de899d66cdb67b32d7cb786",
|
||||
"sha256:4ed2e16abbc982a169d30d1a420274a709949e2cbdef119fe2ec9d870b42f274",
|
||||
"sha256:4f75e4bd8ab8db624e02c8e2fc4063021b58becdbe6df793a8111d9343aec1e3",
|
||||
"sha256:4fc9b7fe29478824361ead6e14e4f5aed570d477e06088826537e202d25fe859",
|
||||
"sha256:50c946f048209e6362e22576baea09193809f87687a95a8db24e5fbdb307b93a",
|
||||
"sha256:5281ed1cc1d49882f9997981c88df1a22e140ab41df19071222f7e5fc4e72125",
|
||||
"sha256:530064db9146b247351f2a0250b8f00b289accea4596a033e94be2389977de71",
|
||||
"sha256:55266dafa22e672f5a4f65019015f90336ed31c6383bd53f5e7826d21a0e0b83",
|
||||
"sha256:5b640501be9288c77738b5492b3fd3abc4ba95c50c2e41273c8a1459f08298d3",
|
||||
"sha256:62ac3d4e3e07b58ee0ddecd71d6ce3b1637de2d373501412df395a0ec5f9beb5",
|
||||
"sha256:62f85b665cedab1a503747617393573995dac4600ff51869d69ad2f39eb5e817",
|
||||
"sha256:639fd5efec029f99b79ae47e5d7e00ad8a773da899b6309f6786ecaf22948c48",
|
||||
"sha256:6567d2bb951e21232c2f660c24cf3470bb96de56cdcb3f071a83feeaff8a2772",
|
||||
"sha256:67ce7620704745881a3d4b0ada80ab4d99df390838839921f99e63c474f82cf2",
|
||||
"sha256:689fb5200a749db0415b092972e8eba85847c23885c8543a8b0f5c009b1a5948",
|
||||
"sha256:68afeec26d42ab3b47e541b272166a0b4400313946871cba3ed3a4fc0cab1cef",
|
||||
"sha256:6e5e54da1e74b91dbc7996b56640f79b195d5925c2b78efaa8c5d53e1d88edde",
|
||||
"sha256:6f4461bf931108c9fa226ffb0e257c1b18dc2d44cd72b125bec50ee0ab1248a9",
|
||||
"sha256:6f5b7bd8e219ed50299e58551a410b64daafb5017d54bbe822e003856f06a802",
|
||||
"sha256:70d0738ef8fee13c003b100c2fbd667ec4f133468109b3472d249231108283a3",
|
||||
"sha256:71108900c9c3c8590697244b9519017a400d9ba26a36c48381b3f64743a44aab",
|
||||
"sha256:74e5b2f7bb6fa38b1b10546d27acbacf2a022a8b5543efb06cfebc72a59c85be",
|
||||
"sha256:78af06ddc7fe5cc0e967085a9115accee665fb912c22a3f54bad70cc65b05fe6",
|
||||
"sha256:7b002cab05d6339716b03a4a3a2ce26737f6231d7b523f339fa061d53368c9d8",
|
||||
"sha256:7b90b0496570bd6b0321724a330d8b545827c4df2034b6ddfc5f5275f55da2ad",
|
||||
"sha256:7ba22cb9693df986033b91ae1d7a979bc399237d45fccf875b76f62bb9e52ddf",
|
||||
"sha256:7ba32c16b064267b22f1850a34051121d423b6f7338a12b9459550eb2096e7ec",
|
||||
"sha256:7e32721e5d4922deaaf963469d795d5bde6093207c52fec719bd22e5d1bedbc4",
|
||||
"sha256:7ee6521b9baf06085f62ba9c7a3e5becffbc32480d2f1b351559c001c38ce4c1",
|
||||
"sha256:80c60cfb5310677bd67cb1e85a1e8eb52e12529545441b43e6f14d90b878775a",
|
||||
"sha256:8177002868d1426305bb5de1e138161c2ec9eb2d939be38291d7c431c4712df8",
|
||||
"sha256:819064fa048ba01b6dadc5116f3ac48610435ac9a0058bbde98e569f9e785c39",
|
||||
"sha256:84f7d509870098de0e864cad0102711c1e24e9b1a50ee713b65928adb22269e4",
|
||||
"sha256:879b0e14a2da6a1102a3fc8af580fc1ead37e6d6692a781bd8c83da37429b5ab",
|
||||
"sha256:8a3f29aba6e2d7d90528d3c792555a93497fe6538aa65eb675b44505be747808",
|
||||
"sha256:8a63b640a7845f2bdd232eb0d0a4a2dd939bcdd6c57e6bb134526487f3160ec5",
|
||||
"sha256:8b61097f7488de4be8244c89915da8ed212832ccf1e7c7753a25a394bf9b1f10",
|
||||
"sha256:8ee50c3e41739886606388ba3ab3ee2aae9f35fb23f833091833255a31740797",
|
||||
"sha256:8fabb8fd848a5f75a2324e4a84501ee3a5e3c78d8603f83475441866e60b94a3",
|
||||
"sha256:9024de74731df54546fab0bfbcdb49fae19159ecaecfc8f37c18d2c7e2c0bd61",
|
||||
"sha256:92022bbbad0d4426e616815b16bc4127f83c9a74940e1ccf3cfe0b387aba0228",
|
||||
"sha256:93a2ed40de81bcff59aabebb626562d48332f3d028ca2036f1d23cbb52750be4",
|
||||
"sha256:94c44ee01fd21c9058f124d2d4f0c9dc7634bec93cd4b38eefc385dabe71acbf",
|
||||
"sha256:9a1f4814b65eacac94a00fc9a526e3fdafd78e439469644032032d0d63de4881",
|
||||
"sha256:9d992ac10eb86d9b6f369647b6a3f412fc0075cfd5d799530e84d335e440a002",
|
||||
"sha256:9e71f5a087ead99563c11fdaceee83ee982fd39cf67601f4fd66cb386336ee52",
|
||||
"sha256:a205fdfe55c90c2cd8e540ca9ceba65cbe6629b443bc05db1f590a3db8189ff9",
|
||||
"sha256:a46fdec0083a26415f11d5f236b79fa1291c32aaa4a17684d82f7017a1f818b1",
|
||||
"sha256:a50431bf02583e21bf273c71b89d710e7a710ad5e39c725b14e685610555926f",
|
||||
"sha256:a512c8263249a9d68cac08b05dd59d2b3f2061d99b322813cbcc14c3c7421998",
|
||||
"sha256:a55b9132bb1ade6c734ddd2759c8dc132aa63687d259e725221f106b83a0e485",
|
||||
"sha256:a6e57b0abfe7cc513450fcf529eb486b6e4d3f8aee83e92eb5f1ef848218d456",
|
||||
"sha256:a75f305c9b013289121ec0f1181931975df78738cdf650093e6b86d74aa7d8dd",
|
||||
"sha256:a9e960fc78fecd1100539f14132425e1d5fe44ecb9239f8f27f079962021523e",
|
||||
"sha256:aa8933159edc50be265ed22b401125c9eebff3171f570258854dbce3ecd55475",
|
||||
"sha256:aaf94f812c95b5e60ebaf8bfb1898a7d7cb9c1af5744d4a67fa47796e0465d4e",
|
||||
"sha256:abfa1171a9952d2e0002aba2ad3780820b00cc3d9c98c6630f2e93271501f66c",
|
||||
"sha256:acb9aafccaae278f449d9c713b64a9e68662e7799dbd5859e2c6b3c67b56d334",
|
||||
"sha256:ae2775c1973e3c30316892737b91f9283f9908e3cc7625b9331271eaaed7dc90",
|
||||
"sha256:ae92443798a40a92dc5f0b01d8a7c93adde0c4dc965310a29ae7c64d72b9fad2",
|
||||
"sha256:b2e7f8f169d775dd9092a1743768d771f1d1300453ddfe6325ae3ab5332b4657",
|
||||
"sha256:b4938466c6b257b2f5c4ff98acd8128ec36b5059e5c8f8372d79316b1c36bb15",
|
||||
"sha256:b6dfb0e058adb12d8b1d1b25f686e94ffa65d9995a5157afe99743bf7369d62b",
|
||||
"sha256:b7fb801aa7f845ddf601c49630deeeccde7ce10065561d92729bfe81bd21fb33",
|
||||
"sha256:ba81d2b56b6d4911ce735aad0a1d4495e808b8ee4dc58715998741a26874e7c2",
|
||||
"sha256:bbf94c58e8e0cd6b6f38d8de67acae41b3a515c26169366ab58bdca4a6883bb8",
|
||||
"sha256:be898f271f851f68b318872ce6ebebbc62f303b654e43bf72683dbdc25b7c881",
|
||||
"sha256:bf876e79763eecf3e7356f157540d6a093cef395b65514f17a356f62af6cc136",
|
||||
"sha256:c1476d6f29eb81aa4151c9a31219b03f1f798dc43d8af1250a870735516a1212",
|
||||
"sha256:c2a8fed130ce946d5c585eddc7c8eeef0051f58ac80a8ee43bd17835c144c2cc",
|
||||
"sha256:c46c9dd2403b66a2a3b9720ec4b74d4ab49d4fabf9f03dfdce2d42af913fe8d0",
|
||||
"sha256:c4b676c4ae3921649a15d28ed10025548e9b561ded473aa413af749503c6737e",
|
||||
"sha256:c796c0c1cc68cb08b0284db4229f5af76168172670c74908fdbd4b7d7f515819",
|
||||
"sha256:c918c65ec2e42c2a78d19f18c553d77319119bf43aa9e2edf7fb78d624355527",
|
||||
"sha256:cb56c6210ef77caa58e16e8c17d35c63fe3f5b60fd9ba9d424470c3400bcf9ed",
|
||||
"sha256:cdfe4bb2f9fe7458b7453ad3c33e726d6d1c7c0a72960bcc23800d77384e42df",
|
||||
"sha256:cf9931f14223de59551ab9d38ed18d92f14f055a5f78c1d8ad6493f735021bbb",
|
||||
"sha256:d252f2d8ca0195faa707f8eb9368955760880b2b42a8ee16d382bf5dd807f89a",
|
||||
"sha256:d5fa0ee122dc09e23607a28e6d7b150da16c662e66409bbe85230e4c85bb528a",
|
||||
"sha256:d76f9cc8665acdc0c9177043746775aa7babbf479b5520b78ae4002d889f5c21",
|
||||
"sha256:d78827d7ac08627ea2c8e02c9e5b41180ea5ea1f747e9db0915e3adf36b62dcf",
|
||||
"sha256:d7ff07d696a7a38152ebdb8212ca9e5baab56656749f3d6004b34ab726b550b8",
|
||||
"sha256:d9199717881f13c32c4046a15f024971a3b78ad4ea029e8da6b86e5aa9cf4594",
|
||||
"sha256:dc23e6820e3b40847e2f4a7726462ba0cf53089512abe9ee16318c366494c17a",
|
||||
"sha256:dce51c828941973a5684d458214d3a36fcd28da3e1875d659388f4f9f12cc33e",
|
||||
"sha256:dd2135527aa40f061350c3f8f89da2644de26cd73e4de458e79606384f4f68e7",
|
||||
"sha256:dd6cd0485b7d347304067153a6dc1d73f7d4fd995a396ef32a24d24b8ac63ac8",
|
||||
"sha256:df8b74962e35c9249425d90144e721eed198e6555a0e22a563d29fe4486b51f6",
|
||||
"sha256:dfbfac137d2a3d0725758cd141f878bf4329ba25e34979797c89474a89a8a3a3",
|
||||
"sha256:e202e6d4188e53c6661af813b46c37ca2c45e497fc558bacc1a7630ec2695aec",
|
||||
"sha256:e2f6fd8a1cea5bbe599b6e78a6e5ee08db434fc8ffea51ff201c8765679698b3",
|
||||
"sha256:e48af21883ded2b3e9eb48cb7880ad8598b31ab752ff3be6457001d78f416723",
|
||||
"sha256:e4b9fcfbc021633863a37e92571d6f91851fa656f0180246e84cbd8b3f6b329b",
|
||||
"sha256:e5c20f33fd10485b80f65e800bbe5f6785af510b9f4056c5a3c612ebc83ba6cb",
|
||||
"sha256:eb11a4f1b2b63337cfd3b4d110af778a59aae51c81d195768e353d8b52f88081",
|
||||
"sha256:ed090ccd235f6fa8bb5861684567f0a83e04f52dfc2e5c05f2e4b1309fcf85e7",
|
||||
"sha256:ed10dc32829e7d222b7d3b93136d25a406ba9788f6a7ebf6809092da1f4d279d",
|
||||
"sha256:eda8719d598f2f7f3e0f885cba8646644b55a187762bec091fa14a2b819746a9",
|
||||
"sha256:ee4308f409a40e50593c7e3bb8cbe0b4d4c66d1674a316324f0c2f5383b486f9",
|
||||
"sha256:ee5422d7fb21f6a00c1901bf6559c49fee13a5159d0288320737bbf6585bd3e4",
|
||||
"sha256:f149826d742b406579466283769a8ea448eed82a789af0ed17b0cd5770433444",
|
||||
"sha256:f2729615f9d430af0ae6b36cf042cb55c0936408d543fb691e1a9e36648fd35a",
|
||||
"sha256:f39f58a27cc6e59f432b568ed8429c7e1641324fbe38131de852cd77b2d534b0",
|
||||
"sha256:f41f814b8eaa48768d1bb551591f6ba45f87ac76899453e8ccd41dba1289b04b",
|
||||
"sha256:f9025faafc62ed0b75a53e541895ca272815bec18abe2249ff6501c8f2e12b83",
|
||||
"sha256:faf8d146f3d476abfee026c4ae3bdd9ca14236ae4e4c310cbd1cf75ba33d24a3",
|
||||
"sha256:fb08b65b93e0c6dd70aac7f7890a9c0938d5ec71d5cb32d45cf844fb8ae47636",
|
||||
"sha256:fb7c72262deae25366e3b6c0c0ba46007967aea15d1eea746e44ddba8ec58dcc",
|
||||
"sha256:fb89bec23fddc489e5d78b550a7b773557c9ab58b7946154a10a6f7a214a48b2",
|
||||
"sha256:fe0dd05afb46597b9a2e11c351e5e4283c741237e7f617ffb3252780cca9336a",
|
||||
"sha256:fecc80cb2a90e28af8a9b366edacf33d7a91cbfe4c2c4544ea1246e949cfebeb",
|
||||
"sha256:fed467af29776f6556250c9ed85ea5a4dd121ab56a5f8b206e3e7a4c551e48ec",
|
||||
"sha256:ffce0481cc6e95e5b3f0a47ee17ffbd234399e6d532f394c8dce320c3b089c21"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==0.27.1"
|
||||
},
|
||||
"ruamel-yaml": {
|
||||
"hashes": [
|
||||
"sha256:148f6488d698b7a5eded5ea793a025308b25eca97208181b6a026037f391f701",
|
||||
"sha256:dbfca74b018c4c3fba0b9cc9ee33e53c371194a9000e694995e620490fd40700"
|
||||
],
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==0.18.15"
|
||||
},
|
||||
"ruamel-yaml-clib": {
|
||||
"hashes": [
|
||||
"sha256:040ae85536960525ea62868b642bdb0c2cc6021c9f9d507810c0c604e66f5a7b",
|
||||
"sha256:0467c5965282c62203273b838ae77c0d29d7638c8a4e3a1c8bdd3602c10904e4",
|
||||
"sha256:0b7e75b4965e1d4690e93021adfcecccbca7d61c7bddd8e22406ef2ff20d74ef",
|
||||
"sha256:11f891336688faf5156a36293a9c362bdc7c88f03a8a027c2c1d8e0bcde998e5",
|
||||
"sha256:1492a6051dab8d912fc2adeef0e8c72216b24d57bd896ea607cb90bb0c4981d3",
|
||||
"sha256:20b0f8dc160ba83b6dcc0e256846e1a02d044e13f7ea74a3d1d56ede4e48c632",
|
||||
"sha256:22353049ba4181685023b25b5b51a574bce33e7f51c759371a7422dcae5402a6",
|
||||
"sha256:2c59aa6170b990d8d2719323e628aaf36f3bfbc1c26279c0eeeb24d05d2d11c7",
|
||||
"sha256:32621c177bbf782ca5a18ba4d7af0f1082a3f6e517ac2a18b3974d4edf349680",
|
||||
"sha256:3bc2a80e6420ca8b7d3590791e2dfc709c88ab9152c00eeb511c9875ce5778bf",
|
||||
"sha256:3eac5a91891ceb88138c113f9db04f3cebdae277f5d44eaa3651a4f573e6a5da",
|
||||
"sha256:4a6679521a58256a90b0d89e03992c15144c5f3858f40d7c18886023d7943db6",
|
||||
"sha256:4c8c5d82f50bb53986a5e02d1b3092b03622c02c2eb78e29bec33fd9593bae1a",
|
||||
"sha256:4f6f3eac23941b32afccc23081e1f50612bdbe4e982012ef4f5797986828cd01",
|
||||
"sha256:5a0e060aace4c24dcaf71023bbd7d42674e3b230f7e7b97317baf1e953e5b519",
|
||||
"sha256:6442cb36270b3afb1b4951f060eccca1ce49f3d087ca1ca4563a6eb479cb3de6",
|
||||
"sha256:6c8fbb13ec503f99a91901ab46e0b07ae7941cd527393187039aec586fdfd36f",
|
||||
"sha256:749c16fcc4a2b09f28843cda5a193e0283e47454b63ec4b81eaa2242f50e4ccd",
|
||||
"sha256:7dd5adc8b930b12c8fc5b99e2d535a09889941aa0d0bd06f4749e9a9397c71d2",
|
||||
"sha256:811ea1594b8a0fb466172c384267a4e5e367298af6b228931f273b111f17ef52",
|
||||
"sha256:932205970b9f9991b34f55136be327501903f7c66830e9760a8ffb15b07f05cd",
|
||||
"sha256:943f32bc9dedb3abff9879edc134901df92cfce2c3d5c9348f172f62eb2d771d",
|
||||
"sha256:95c3829bb364fdb8e0332c9931ecf57d9be3519241323c5274bd82f709cebc0c",
|
||||
"sha256:96777d473c05ee3e5e3c3e999f5d23c6f4ec5b0c38c098b3a5229085f74236c6",
|
||||
"sha256:a274fb2cb086c7a3dea4322ec27f4cb5cc4b6298adb583ab0e211a4682f241eb",
|
||||
"sha256:a52d48f4e7bf9005e8f0a89209bf9a73f7190ddf0489eee5eb51377385f59f2a",
|
||||
"sha256:a606ef75a60ecf3d924613892cc603b154178ee25abb3055db5062da811fd969",
|
||||
"sha256:ab007f2f5a87bd08ab1499bdf96f3d5c6ad4dcfa364884cb4549aa0154b13a28",
|
||||
"sha256:b82a7c94a498853aa0b272fd5bc67f29008da798d4f93a2f9f289feb8426a58d",
|
||||
"sha256:bb43a269eb827806502c7c8efb7ae7e9e9d0573257a46e8e952f4d4caba4f31e",
|
||||
"sha256:bc5f1e1c28e966d61d2519f2a3d451ba989f9ea0f2307de7bc45baa526de9e45",
|
||||
"sha256:bd0a08f0bab19093c54e18a14a10b4322e1eacc5217056f3c063bd2f59853ce4",
|
||||
"sha256:beffaed67936fbbeffd10966a4eb53c402fafd3d6833770516bf7314bc6ffa12",
|
||||
"sha256:bf165fef1f223beae7333275156ab2022cffe255dcc51c27f066b4370da81e31",
|
||||
"sha256:cf12567a7b565cbf65d438dec6cfbe2917d3c1bdddfce84a9930b7d35ea59642",
|
||||
"sha256:d84318609196d6bd6da0edfa25cedfbabd8dbde5140a0a23af29ad4b8f91fb1e",
|
||||
"sha256:d85252669dc32f98ebcd5d36768f5d4faeaeaa2d655ac0473be490ecdae3c285",
|
||||
"sha256:e143ada795c341b56de9418c58d028989093ee611aa27ffb9b7f609c00d813ed",
|
||||
"sha256:e188d2699864c11c36cdfdada94d781fd5d6b0071cd9c427bceb08ad3d7c70e1",
|
||||
"sha256:e2f1c3765db32be59d18ab3953f43ab62a761327aafc1594a2a1fbe038b8b8a7",
|
||||
"sha256:e5b8daf27af0b90da7bb903a876477a9e6d7270be6146906b276605997c7e9a3",
|
||||
"sha256:e7e3736715fbf53e9be2a79eb4db68e4ed857017344d697e8b9749444ae57475",
|
||||
"sha256:e8c4ebfcfd57177b572e2040777b8abc537cdef58a2120e830124946aa9b42c5",
|
||||
"sha256:f66efbc1caa63c088dead1c4170d148eabc9b80d95fb75b6c92ac0aad2437d76",
|
||||
"sha256:fc4b630cd3fa2cf7fce38afa91d7cfe844a9f75d7f0f36393fa98815e911d987",
|
||||
"sha256:fd5415dded15c3822597455bc02bcd66e81ef8b7a48cb71a33628fc9fdde39df"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==0.2.12"
|
||||
},
|
||||
"subprocess-tee": {
|
||||
"hashes": [
|
||||
"sha256:21942e976715af4a19a526918adb03a8a27a8edab959f2d075b777e3d78f532d",
|
||||
"sha256:91b2b4da3aae9a7088d84acaf2ea0abee3f4fd9c0d2eae69a9b9122a71476590"
|
||||
],
|
||||
"markers": "python_version >= '3.8'",
|
||||
"version": "==0.4.2"
|
||||
},
|
||||
"wcmatch": {
|
||||
"hashes": [
|
||||
"sha256:5848ace7dbb0476e5e55ab63c6bbd529745089343427caa5537f230cc01beb8a",
|
||||
"sha256:f11f94208c8c8484a16f4f48638a85d771d9513f4ab3f37595978801cb9465af"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==10.1"
|
||||
},
|
||||
"yamllint": {
|
||||
"hashes": [
|
||||
"sha256:364f0d79e81409f591e323725e6a9f4504c8699ddf2d7263d8d2b539cd66a583",
|
||||
"sha256:81f7c0c5559becc8049470d86046b36e96113637bcbe4753ecef06977c00245d"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==1.37.1"
|
||||
},
|
||||
"zipp": {
|
||||
"hashes": [
|
||||
"sha256:071652d6115ed432f5ce1d34c336c0adfd6a884660d1e9712a256d3d3bd4b14e",
|
||||
"sha256:a07157588a12518c9d4034df3fbbee09c814741a33ff63c05fa29d26a2404166"
|
||||
],
|
||||
"markers": "python_version >= '3.9'",
|
||||
"version": "==3.23.0"
|
||||
}
|
||||
},
|
||||
"develop": {}
|
||||
|
||||
@@ -4,7 +4,7 @@ Ansible playbook for base and initial configuration of the web server hosting my
|
||||
## Assumptions
|
||||
Before you can run this, a few things are assumed:
|
||||
|
||||
- You have a clean, minimal Ubuntu 18.04/20.04 or Debian 10/11 host up and running
|
||||
- You have a clean, minimal Debian 12 host up and running
|
||||
- Python 3 is installed on the remote server (requirement of Ansible)
|
||||
- You have a user account with password-less SSH access to the machine
|
||||
- You have sudo privileges on the remote host
|
||||
|
||||
12
ansible.cfg
12
ansible.cfg
@@ -2,16 +2,16 @@
|
||||
retry_files_enabled=False
|
||||
force_handlers=True
|
||||
inventory=hosts
|
||||
gathering = smart
|
||||
# instead of using --ask-vault-pass
|
||||
ask_vault_pass=True
|
||||
remote_user = provisioning
|
||||
interpreter_python=auto
|
||||
|
||||
ansible_managed = This file is managed by Ansible.%n
|
||||
template: {file}
|
||||
date: %Y-%m-%d %H:%M:%S
|
||||
user: {uid}
|
||||
host: {host}
|
||||
# Don't warn on unknown SSH host keys because it's super annoying for new hosts
|
||||
# or if you get a new laptop and run Ansible there!
|
||||
#
|
||||
# See: https://docs.ansible.com/ansible/latest/user_guide/connection_details.html#managing-host-key-checking
|
||||
host_key_checking = False
|
||||
|
||||
[privilege_escalation]
|
||||
# instead of using -K
|
||||
|
||||
@@ -3,4 +3,12 @@
|
||||
|
||||
tls_cipher_suite: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
|
||||
|
||||
ansible_managed: |-
|
||||
This file is managed by Ansible.
|
||||
|
||||
{{ 'template: ' + template_path }}
|
||||
{{ 'date: ' + (template_mtime | string) }}
|
||||
{{ 'user: ' + template_uid }}
|
||||
{{ 'host: ' + template_host }}
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,8 +1,14 @@
|
||||
---
|
||||
# file: group_vars/web
|
||||
|
||||
# run nginx by default
|
||||
webserver: nginx
|
||||
|
||||
# all hosts run fail2ban with the sshd filter, but some can use other filters
|
||||
extra_fail2ban_filters:
|
||||
- nginx
|
||||
|
||||
# root prefix for all web servers
|
||||
web_root_prefix: /var/www
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,163 +0,0 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
36643866316634653430343333316233346137663238373035376232643132663036343736376464
|
||||
3033313234383933656361343938653362623265653030360a396638643333633137376231663538
|
||||
65313537316564303330663730333131633165633238643532646435386436623163346366383533
|
||||
3965636630393834620a343531623964626135636337313861653361393733333463633234363435
|
||||
64643934346466663934613962613230623562323666353231326363343430336637323666383634
|
||||
36626136643432343332343665343734653435383336313862383863626466663633363738313563
|
||||
30303666306439333836306161633432346636396333653434666531353966353430666436623531
|
||||
31636562656161333830313362653764306137396231346334613336346538306432636639386561
|
||||
65323737383865313264623934613365373465323065616130333837386665666333623832626239
|
||||
33333230643332373238363432306466613737373132643134363563613535376365616130333433
|
||||
35653262356233626331643432396237306237363135623830643536653938363461303738613130
|
||||
66613036393338393037386162383831663866323233383736303532363837663039376166363639
|
||||
34666237333562643665653165393730646632316237663337383937353365333532336462656362
|
||||
31353934393363363765616335626565343238336262653361306164383030303835303666326532
|
||||
31386332346362633433356161643536333862373030306364393935663061396538616637623230
|
||||
66383163396139306430343639346264336464646233316636666239643132376164613666363538
|
||||
33356365643430383732396235623038643566623131616461376261343563353236306663656634
|
||||
64643035373039383031303464346264383066623762323161643561366164313461613038633531
|
||||
36383161363065366164383932623231626633646166313835343264373366393236626336353039
|
||||
66646338303731346337363962353135346239306562663737363038306433386230326636336162
|
||||
65313132626564663738633531333662666661326463643032656136376564643938623061346464
|
||||
66653239663464306430613563666336643839323537626338666435336138613763313364323637
|
||||
30666566326463623438316263623233333434623366306330656564636163336636623433646631
|
||||
65316562616136626330333166646332366537666664303766346239316535333031396235303466
|
||||
34393664373361356231333530323865646333653237613636386632393730623330653437393164
|
||||
65343266373237386364373862656138633263666633333465623836366233663537393539393638
|
||||
34643963363865383434633163623832646632393234636136346137366361393638393461306337
|
||||
64653436313065326637363632336565306137613131306364336537613835306332633366313130
|
||||
34393732643361663731383661646631353035353064613931333330653031626435353163323633
|
||||
65326135376462666435643837333131313863313630336566333835613132383365343234366133
|
||||
39336131363366616136663636663334386361646465336331343836626439316532376566353565
|
||||
37643361646435643133336333643837633331316432303062623062396564373137613235363762
|
||||
32363838333337363035343631353261653063316138626133303937623233326531333837383033
|
||||
39366536333434303864616164313137613337643730306261626138343764663662393161613730
|
||||
36303736306631636266336131396336646635653131336265623364633038363339353933636632
|
||||
39626134353866313439333962376663393831303261633431303035663130613265333739616135
|
||||
62623138386235653935383364623230343662333138653562633266336534383963326237663132
|
||||
38646335623532383565303466386261613931666438313261653434633934353739613431636132
|
||||
39633133656230666231383936396264313630353434313035643565333661393736386637313264
|
||||
63636337373334313937643261313564333564383566633730396364653533666236643433643436
|
||||
33363061356362386535323038383637613364393639646363366630373735353234333134636565
|
||||
37653064636536376638626135393332626539346365353661636439323338653137383866663734
|
||||
62303139363436646464383266396464313565376132393937356665396536623332376134393366
|
||||
30346435313566313237326461346362353633353261373038656130323365383765613739323239
|
||||
38633934643531633037623036623839386637663762366631633033646138323936353433326430
|
||||
34396466653230643766636636393735373363616637386662333535643536626261653264346332
|
||||
34336337646133646261353939353166393530323730333063393365626365383366633464633236
|
||||
64656535613838313461623864666362373030636366373038373863616462373939356238353362
|
||||
36363535653734343533666532343166313964303236313135386134623963386535306435656330
|
||||
38386430303330303837326138356364373439313836636234656331643131646363386138653065
|
||||
64353837396533303463643130613339663166333933643362303565623432643064353865393635
|
||||
65663362666130623933623733323933343065633432613965373764383035316338316338373934
|
||||
65383061386635316331366532626437303664636436306535663365373064346136393063623335
|
||||
35643062363536633332313531356637313032666262366466626462666663303161653635666331
|
||||
32343130383231323239363235313031346438323330383938303733323436646336353163356132
|
||||
30336136646261323866663530336335636464623035626635333961623363396239353935636531
|
||||
64373231386163663962313834333538333133376433623363306239393462383930306432396562
|
||||
65393761633834663431353032393032396330393338343863333939323632393438646331613463
|
||||
35363530653161653266616331356531666434353663643364316564623438316132383463356437
|
||||
38626365343733383735383939646331376531376563623231323535323735356630336130383835
|
||||
39633335373163656431336130333664306164336536356431323438333933636365303330393233
|
||||
32353437393133646632373234376431626332626333343866643463653662373861346539663131
|
||||
32393333633766633738393937356134313236343633636533376665316134653632623061353866
|
||||
36373761366264653737386331383235306137323965363265653937353833343362633433313462
|
||||
32316466356335366630373635376561636233336165666661653632323835336563313134343064
|
||||
30333033333331303164323133613536613636373333663131633162616235316636346337333462
|
||||
64306336636562353733613538343462626233303661363131333665366135306332346135323136
|
||||
31306535643539303936346632623930333339353439376462633462626165633437393830373739
|
||||
61653230646366623830353630336661623466316136373264353762313065346632366164653261
|
||||
64313830303466306135313964613537633236383535343132613332613733316161623365333163
|
||||
38633930323439303030316433343764356538313632366635653437346161646439663563323832
|
||||
38363731353734303932653662326138646239306261383232643537313365393061383663643632
|
||||
31343736373739643164623437663239616663373335643262336664326365656137643066383463
|
||||
37356666306666353339626662326135636530386462613061326631366535383034303830323237
|
||||
65316135343135383230656638363564303635363333623833373163326365393430663235623231
|
||||
35646632643735363730613462656562356139323863616266343566343861356238623564326430
|
||||
31306366366330363036616137363163663136316565313334616164346639663465666338316439
|
||||
33643732343062313536313233333039366435386235333736333937633266653761616262346566
|
||||
32636337623266656464636634643632316134376334653932363134613336346539656438633137
|
||||
31306439663834663431346133653532636664636463376337616539393239316465636537633630
|
||||
30363461343733653465666332646236386633396530333863616236383437333931643731626364
|
||||
38393337656130666237373538393430306333333033306466343866303038643234646339306233
|
||||
32336364363838636563643939626665643231636633666166653539313461393238333461383262
|
||||
62346634633236343433336531396361323238386262313565396265663162353765343037303862
|
||||
63633034363664313733633433356332333633366530643863316364653065623161663932323831
|
||||
31646530613933613735333834373532616136393662346431656363346364353031303262326134
|
||||
31343332386166646530373635343039323163323366616263346431353765303430353636373539
|
||||
36346461303730313630373637346266323331373733383465323037343633313739306233336339
|
||||
63646137643332623834343462333263356432366631663065383962373634366639656133323964
|
||||
64343035323863373139313163323562643066306139363235626532396436663137653635353035
|
||||
31396334346137626461633436343539366635356537306231353961333963616334323037346637
|
||||
33626161333264643261656661643933653835356236333831343563653938303266323730363865
|
||||
31363562383666633636343935386535306361386234346535613363613363393065363832306363
|
||||
63643238383363646137306361306265666435363739306463663637343761643831633261633531
|
||||
36626562636333336434613365316232343832646163396338613839643064653834633832376230
|
||||
33343265386162303266373033353332393931633663623734396133326232303465666432356363
|
||||
66306338616634616631363662313963386638343266383063313166353437373433623736333361
|
||||
36333163386630376262616362613530346563383637656130363365366634633135323863646363
|
||||
35323430343033323734363533326334303438663065656535666432376661613435623365316139
|
||||
30623835373535623662633131393831376231623663316331313661646531393338613532623063
|
||||
66343665356338636438646339663761336636653332646233326264373435346263386130383861
|
||||
34623265373463653165383665306334643233373066356231343666663866373739336436653933
|
||||
65623134306536333538333061303066636339376636333438623666366362666137653261376539
|
||||
31346435613134303866333065306237343162333138643339313461663934643234303132613961
|
||||
65393037396463663034636534323566366161623365666466393634373764333437383263656535
|
||||
33643461636362646135626164373335386130303766633434633062356630336463623661396639
|
||||
32646565623164363631383731666161343762393639343839373234326337643766336263353166
|
||||
62633964303733643035326535656561366139626565643938356264646239336166316534373261
|
||||
30623765623338616537353062666338376262393966373033346233383132653839323731626663
|
||||
66393938313132653538313031323538333263333361303661646633366633353534373837313935
|
||||
37323635633431623365643738623834653631323564393436326562326439666462306263653331
|
||||
66316134616432323939373366343564623264336632376132663462396362663134643236643832
|
||||
31393366653961323763333335303135383934633538636335303435636334343737306232373561
|
||||
31343139363863326536613163663862343263313630336438666132306162646130613233393935
|
||||
37336330643361323032366433313939616134366134393032613862616136393339643232356139
|
||||
35326534623263353766326132623330323639303230616263636536366263643339663838376238
|
||||
35323731303163616236306439343632353561646339663933313937363739303864336438626638
|
||||
64633139633338623431343236333534373835356365343536636261386437613538303334663739
|
||||
62396532353832323262343763353365333561643633353638313534393164366539353431396336
|
||||
36653563633237333730376331326432663561343463616135613738663130323936373136393538
|
||||
65636634363631313364326665336164653939356133333031633632373030623666373562623564
|
||||
64616365616435393231646236623333333037346363666664666233306661353337343066626136
|
||||
35666164356537323735636131383266393064373538303966353531636561623032643233346566
|
||||
61633465376631656636366662373865623764336135323865316336663731383335303330616231
|
||||
64313836373063313061626365316538653831316562333165616531643434633964333438333665
|
||||
66376634323531356538343837326636636636393639396535346264656531613733386337353966
|
||||
31363730646365313834316234626532663563613234643563366566373662616335623035393536
|
||||
61653334346336613539313732383438313132653738393339373661336531633565303635353665
|
||||
31383939643261666538356633326666363934643738636430383537636165623264616236633863
|
||||
35336134386437383539303061343261313530313366316338663539383238663966653837663331
|
||||
33386464653161376335316536633532383035363066653234626363343232393165313463343930
|
||||
63323435613932626435363235396236313365636166663238323534623038663034303365326566
|
||||
66306635373433313730343536633931643935323062643136383434643138306138363366663834
|
||||
66613964303634616139323832363633363063653237366135613964663733376161373937323462
|
||||
30313833623733336366356635323261613132393734613735393062333232313236326264323366
|
||||
32376535616334376137663636633333323665333939363366313432633436653864306532393966
|
||||
61636337356534373164653637633162613235623364396539623961353466303036383031363162
|
||||
37313364613939613939343538633665666136363135656330623332656466383139656234336133
|
||||
62366262663064623137626363613066366666313733623463623562636131323435346264653564
|
||||
31323431663339653966336230356339303534353139663739363263633564373364323937386434
|
||||
37306462653630326366316530656462316539373263366262313930356663376334343562303361
|
||||
61623161613939616666386336626537333135346136643537326635383939663863623332373033
|
||||
32643730313861636163623133323061333631333332373838636163326562633936363631653062
|
||||
37336661626336623462616562333264373330323363363630313739363962323735393332303562
|
||||
62393161323962393039346432353066646162336332663636343739343566363833333738316437
|
||||
64333337363137643931366536396333633538633830353865323765616264356335383031353534
|
||||
33376363386630303332643263383738386532373434613963613764326636333133303262393832
|
||||
35373930383662383064333465633736363063363434333662396331633032353733353334363162
|
||||
32393361643562623362333963663262363235326536396131643435306665343438333933616466
|
||||
34326634373965313638666337326633653938343561663739333464343135346437636436633034
|
||||
62333039373136656664363531373430356363363736306533386135323061316339326636643739
|
||||
38363763653331646638613963646138666165666439643065363335343132613731623264376536
|
||||
37366533636564346661343966373964353731623861633463363638356163346165643164373535
|
||||
30373564326263393436326337653631383731313139636339356433333830666265343165323330
|
||||
36616538616534626237623862636536303336343331383237333333656637303266616137336439
|
||||
61653631636632366563373034346365313337356266636338336663643538303063613036383831
|
||||
65613635336366316263336131666238386237366264396438383966313762626639643236313532
|
||||
30663235666662396231376631366139653937646132343639396430643339393165656266636235
|
||||
38356135666433323434613238356537306630643861353436323037353461326534313632386232
|
||||
63643261373263646437373535333036336634396331616330353233613564363361396437326435
|
||||
38396462643833313362633436303637323163663166653231653866643733616432323663316362
|
||||
3037356363643462356137346638313963376637643162623062
|
||||
@@ -1,46 +1,27 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
65653532333862366436303432656664373261323934306234623534633335356466623330373063
|
||||
3164363863313131303330363564326130383433646332640a373233653965653164353663633038
|
||||
63363966646361366637643261613062393736366361356235633139323537636638396264316534
|
||||
6366313732323066620a333738656661656537646632326262663862393434663435313037653564
|
||||
66303732396261373436373538396466643330633336623066313933323266386438363566343834
|
||||
38616661303931376136616532386637386130326264336430613336613836323666326261643838
|
||||
36613565323062626662313864633539323538316562346533363437373766343764346132333631
|
||||
66336135383732393939383133626662343335376531336364303662356566393034326635333066
|
||||
64333635303633306639656161623631333139653034633939303565386330383236616364353136
|
||||
62663536613565383064633235613539313933373530306164356462353861383761363931613430
|
||||
37373939616564663562376635333862646234353133663331396661626234356665633835323137
|
||||
39343462303438376131626335346637316238626462333430346539313838386662363031336636
|
||||
34366132363439653137393662653661663262346632306533376565353037616362316161333566
|
||||
30393530656566643136613039363537613035666465656530366637393664343665666534383837
|
||||
63393133336664313466636538386338653937643563633737633962626562326637356661633463
|
||||
61613231346532306265623361636330376563396266393330393166643833353165363934313533
|
||||
66333832373035376334326336616534326566666361616665633363383032393236336634303232
|
||||
36656336316635376431396233626539633839386533333436633264613761353361333565656233
|
||||
65373331306434363938393339333133336461646130666535343965646536656263623530666333
|
||||
36353664643132623465353661656466383363376261363534303462306661623564663561656664
|
||||
37633936636263623065366666666530616264396334623766613036313735353264356162613836
|
||||
35643737346530393933643537333561356465363239353630343333373038373836623231336437
|
||||
30343932363864663435656634343138353638343461623665336461326565636164643231323133
|
||||
65383664633665343365363764353566653635663137633033303731303030613565653565303433
|
||||
35373930396166646134326165653436613137383630653338613634633361623432373839376430
|
||||
38376630633363613632316530663839326538366366626230356337323536306665616661373261
|
||||
36653965623936663963353836653636306362663062636466613034333532633534646635313737
|
||||
33313962323636643132396166626566366466336238323163656332383530363833613633383165
|
||||
66366239613530613264313739396661386165343162633237303034373765643037656564653061
|
||||
63373036356134353633633532663365323932633531616261373735313737333033353532656434
|
||||
36316339303930336464393261323035626330366133626137373034396166336263333964333963
|
||||
62636432386531306133623163643461336137653331653861383139373938353162636566623566
|
||||
35616637663638313566653832343634613632663861333162333932336264613730313864663663
|
||||
38396563373339626365353766646565336335656539393738376331383038353436313963633438
|
||||
33373433613034373763643434613365303938373764306662363635626636633266643035663836
|
||||
65353632313137366231323764313036613134643830326330653763656362343561643964623361
|
||||
64336565666630626339346563663931393035363938663734616666356435326638353131383434
|
||||
65623539613662393936653161663264343132333936303661643534343536363165313564333037
|
||||
39343561656461313265393466346662343530313230386266646662633262643464366661363630
|
||||
63376463396631666366313266633964396137373661643764666537366539373337333731343933
|
||||
31613232363436643236623935326265353666313861303531633462623363373536636534623532
|
||||
66636533356363353735653839646263663631316239326164646463396532343038373861393033
|
||||
36623962396231633164356335623865326632303237643864656335326435373234366536313565
|
||||
34313638373063303434613663323136646263393036356336323532373130386536306235343165
|
||||
6462
|
||||
38663333313561616264323430323162323837623430363739623561633331656664613936666665
|
||||
6364373033623163393239663035306337383066343438310a383666313434323036643037363065
|
||||
30396333626130303633663930663965666662646233393439376661346265616565616236623366
|
||||
3930373433646231610a336233663132306263656465633034333030316362643939316465666534
|
||||
38353961393038613961353732613434663565633466303265383231343336386330333464376363
|
||||
33616330643364376332623634363766656366666239633964316439376463313063333162343963
|
||||
61356634393438313063666434626338616264613639656462626639616263366531663135393466
|
||||
66346635616439306364356133303664376134626636616131373138656562363363306633333164
|
||||
62623135343633393834393165383231316562643062343165663235313930663039623135373263
|
||||
61343336643235303962333938613230356465346436376334373438386461366231383737643137
|
||||
36343832353730366131653430633465383163396336353065306638373166386438356264616139
|
||||
65346635663338366463343932336231386235393836616238373864626235623935663661396663
|
||||
31633565356465333737303339333435383162316530396563333335613062623138333232336162
|
||||
62376363666431363931663231643561616562383230643737393261623934363633313231333137
|
||||
39383238656237343661626662366465356463396336386261326334613436396364633062646532
|
||||
61313136366636363861316166396134316562666435653437326331363563653035343138636163
|
||||
66336139636533656334643966383962383734623565323435333665666164353732663736326364
|
||||
35616264383237316330386539363065376334643432393636643464646238633034333166663665
|
||||
33313166393738626133636136346637646437306335326263393634363133663736666338313838
|
||||
64623139613037653461643563666539613237323934376534376461313833336338623032616661
|
||||
64643062663633366436383232366137373936383430306332616634636331326361383931363961
|
||||
62313236313563326438303935373837666434313435653236643135303739373763656562393537
|
||||
31653265653739346433663937343439656231663963333633373066356231623762313438393763
|
||||
36306336656566633034373834316363333233326130626639313130643935333437653934313636
|
||||
32383034346234333561333466653561323834346166633831303566376266373933356536383031
|
||||
6236303934323963336662386666653138313165366133303434
|
||||
|
||||
269
host_vars/web22
269
host_vars/web22
@@ -1,130 +1,141 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
36373430623764356339336538363637613761656163316533356331373837303939376237393137
|
||||
3030626231376566333735303532346164363663353534630a633961333162663333303263643061
|
||||
32353530376330353162663434316464373365353138363831386530326335663665336566376361
|
||||
3766316665663038650a623730616333326534623431383833616438343964646538306437393634
|
||||
61356439633731333932373532613132636134613366333338313235636331313336383165626362
|
||||
31353265663461623937653636326430663239373061386336393435376336373461633263663834
|
||||
31346635366538666466393763363663366332336561396238386334306265356363363366396466
|
||||
36656438343536383433633465383630343539356538616134366163643837366563623365633763
|
||||
62376532613337333938373533633361393834373462653238613565623263333034633664353861
|
||||
37613231373638306633613662326437393933663961353062366164363862303031383339643036
|
||||
31623533373338333462363266656232643136626435643563356332613231613635633861303664
|
||||
36633962303435343138373530393339353339666234613839333161346263616634633466303861
|
||||
62643061353835626535326630666330616563626133383861626537303633633639343730623634
|
||||
32323733363165616366616635646233336164323464613332323733396464383834333832343532
|
||||
31373466623465313838663163356435326533666532646436383063353565393339646366663964
|
||||
66346131663832303532346666643538636334633238313538383463303933646462356430323461
|
||||
38303833323036663835636637633335626239616531636231653465646332643064333264366362
|
||||
31383039396237363936346262636331383334363665313535316262646433653430356537626139
|
||||
30636135663638633462656363333262613362303363313565663538366333636632306339616630
|
||||
35643262653131303935363630323530376263303037643861386366323533313936316239633635
|
||||
30366436323033626638633366386637343661633666313037366633326331303462666633383566
|
||||
34363135336632636434666262306638663762646130393462396565313563383732643961656638
|
||||
62386137616430333162613062316432356432323934376536313537356361383334346531373932
|
||||
62663232373265343464343766646239383064653333636431313030343334366264386436613666
|
||||
66633966343637303064366165336566353338333432623631343038636631656338623936323833
|
||||
64386234386164366539303530336265383536633937353462663530316264393637626239303732
|
||||
61306465666431353334393663323932343836633837343231306165336330626362383238623962
|
||||
34653235623861646132306136633630653864663366663063653430623032366462323637646362
|
||||
62636537373563663435616630313532326465636466663766333038373337643432393839383738
|
||||
30336633613863666539633734643137636331383932633833386330626363303539663938383136
|
||||
36303037373965333334303564663131353039306538623934303566323338636237323734663435
|
||||
39376431643235633134646665393035666561373864343364643536633461306638656535336435
|
||||
35613066613465343632653234353735323735623864323736383066383432333333303737346131
|
||||
63346164646630623735636563613432396463313266373635303339643834623463643133396364
|
||||
39346532306336306333303163346137666130633338633366646431346363633961646430633636
|
||||
33373462306636353962383537356435303134306663323834623132616264373539343038386537
|
||||
34353561353636353131373139386639326534613337643535653536363531653534303434346433
|
||||
65633638346538663265663038643939306463346438383966653961343832386562326662336137
|
||||
37663733653836666435336466333438373230356336316231353635643465353039666432376433
|
||||
33343130376238616538653366623637366432363333643163613239376439643461313961386166
|
||||
37336238346137653435663361343666346662343465356139343062363631333839636361643433
|
||||
66363039636165623739363762633464303932633564613336353537643964353336666566626165
|
||||
63363130643330386465356663346138396637363732616436383365363037643261373536663765
|
||||
65666338346431653539316366626565616263376433646635326138633935646165663664353735
|
||||
31633939353534303266653838386466343761323235666237313732376364376566396639636236
|
||||
39383332336663363139373562393665306462623964373864356365383864313336383364346338
|
||||
36663637633437303232636335616538343737393034616632333732646634346634666665333930
|
||||
36313334343162353865386630646138656539393064356233336636613863653233323330323237
|
||||
34643039663265356230623432613733313162653230393539353362613365393763646536366330
|
||||
65646638613064633330356536616266653834636362663466316235313235653732383333633066
|
||||
35306337386238336633646631303165333039616161343633343539613937613733366231326561
|
||||
62623038393337616330616639326638393034656233656262623630356138376233356562383337
|
||||
34326431383438643162303236396563393266306362666135613565393930663263393635393332
|
||||
32343733333134656337653362653337316561366438613662663535623865653166633637326538
|
||||
36656532316235396461343235636139373361613339386163306464646339613036363564623438
|
||||
61666630333234623236386536653862653766646132303332366536653165353466366366643239
|
||||
31383139303638623435343362373431386139313836623366666364623037303038386633316561
|
||||
30653238656633616662393566386464316134656465393333346438356432386230623431386661
|
||||
31636538356335633961656261393034646437626135363430636233633035336332376165313539
|
||||
61353365346263623639633262303265646637303339353739643734333732643365353739653630
|
||||
33616266613664663932626633663638636237323463333634373630333432376334333136383164
|
||||
65663630396262303936663438646465313032336632623365386134383661663938653631623230
|
||||
33333466633033333963313239626463623765623931663430636131323036316161646562396561
|
||||
39393066616366333237373138643163326132356135643639653633363131376235373631636466
|
||||
62326433316131626266666131363361376532653833343262313435623164373832366133303065
|
||||
38333233393663373831363064626463363662643364623737353939373263393338373265376661
|
||||
32353462303234303034356233363235393632616261303236623330303632363839313138303761
|
||||
66636436316163353765363331636438343666366630363265623536633963346133366662373664
|
||||
36346234393432656436333563633333663135336262396262396135633765616237333730646239
|
||||
32363037663830613864303636636564316161386561633030656164316639663065346665613463
|
||||
62386266656564666334316333356436356234393431613436396263393139633066633230646439
|
||||
66353836303332356136393565303163613363366538366165326434326137623535316636626533
|
||||
32333733343831316538366637396138623832656138393033363533663461656436313630383965
|
||||
31633533316134623262366133356331316134353233633466363738343362343366333834326566
|
||||
30356161356630303431643762343062376437386337613737356264626566666562393139363437
|
||||
39646664356438396239643739333631393561386666613764303962633039323161303063326131
|
||||
64663437646236356332363936316235353062363336366166363461383339653565666336623363
|
||||
33363335623161393337656466313130653061306533316266636463643032653139303232396564
|
||||
62396364346436363930316266636437353433336534313066363834323962313636303264353765
|
||||
62313366356237313461323763663939616561666262333739363231613838356161623163643234
|
||||
38363633343763653733316361353364663339326330363865613163363537643331663231376239
|
||||
62383034333039336162636235663631306435613063653633623466306430383062663161643636
|
||||
32346264386663623530356132643862623233646461333564306165643537303233643535666237
|
||||
38363365623037333630356165653730313533663263386161396132323361666165656639643235
|
||||
31303737653034393862333933353233383830633438663133393237373964373162316439633636
|
||||
32356433613537343537326465643466343632626164616332316232303838306566353838646566
|
||||
65636236343966626532623932346265633433353937373366363563623035326365343031356566
|
||||
36316462306437666633613562343137623430623435393261343437653531326565386634666539
|
||||
32343363663831653437626139373564643334306633643035626333393035376364636232326461
|
||||
35643335613865346437333035626433373331303038663136373030373236306165333465346537
|
||||
31646365356638646464353336326132386537343534336335663962666261303138666333613537
|
||||
36313133383061373032376634343632356437383436373763393933316634643266366536643734
|
||||
62343531376165613933393266373131633165653434346635333433333866386634633564393331
|
||||
62323932333438306565356435323035656330343861343031356634363535646131383232356465
|
||||
34623433636331636633653333346261663933613437343533346364613262383432663139663530
|
||||
31383035643239346333313532376139653937383262336530383664383563653865373532323934
|
||||
62656134616363616236356430346239653138666339356365383336343965323265346333316566
|
||||
66636565336230623962626365653636393363323134653866303234336637656563363162313038
|
||||
65306134623963353135333436623662346265653035646438343737653733373666633532336464
|
||||
65356561616633366437353037326164366335386165316339323162313231616338303235363338
|
||||
63313062396264373038353263323736363838396330313738383933343033303665323731343834
|
||||
38633734633332643833636238333462633039333731303936336130353830323639646437383538
|
||||
30306632396161613163653734633962613037323536393330373364626134363832313566623631
|
||||
34393038626235373734346538616538306130646136353262353930393262326336323366323662
|
||||
62643465326338386633633338333439363064623637303535653532373933626462363433666563
|
||||
35363430626533616434613436636330643565313466323665366562653034316536643135353839
|
||||
36303731366534363539383730303134656535373365653633616530353134306561326562366666
|
||||
37383436333936383630393433336262363436643664616366386636323632383661303035653065
|
||||
31323964336136383332353434653933623939323437313734393534373731396631366532653963
|
||||
32666136333034346263633533373634396334616137373935656136393331613562316462613737
|
||||
66663831303539636433613334353137313536333134633831376338633463376162376663306335
|
||||
63376565626334383030366366613061646238376432326239633230303763396163666535343336
|
||||
38633034646334666365613363303536613936316539366333386166313863363562613135663233
|
||||
35303038623364663462393364303538666262616336376534336235663736363535653661346262
|
||||
39356163373435313933373234363032653861363834623033653665393730323138653534343962
|
||||
33373837346265633536336234616637306536383866316162663133363239663036663932663030
|
||||
39323536356635326162316361356261373737663939353266663337393334323132636564383764
|
||||
37366237623836613062643134363536613239313564636665373437626533613732383731373961
|
||||
36386139386665653532346361386238643038353731653864393166363964353463643331363562
|
||||
32343165633964343630656439653965306432626134326232336634313562306539643364616264
|
||||
35653966636166666364656336663632663036333034316261393835336466616262313434323634
|
||||
33376635616466663865373639376466623935663836373565333835326163656531616531376665
|
||||
64653733633735333464643962373731396563643437306161646332393864346364373463323166
|
||||
35343139386162393762643131386132363536353163663464336437626266343132633464653339
|
||||
63626634323564373838333636663161333261326436353963346133646533333933393939343438
|
||||
62386264353061326533663038383039363838363138373030393561386638356266366436323762
|
||||
38353933396535363336356238626664653461383865313362323034393232383832343635653239
|
||||
31353438643139326631633332363736333932656534353366376464653266643039313364623365
|
||||
3335
|
||||
38353762626535363837346634333565643931386536313339336365663162656533363636383931
|
||||
3737373161623364396366323338613062386466313539640a653334643937326338386262623261
|
||||
65643635373532636439396235373964303537646334343633633531633435323037313433346636
|
||||
3866306363303338360a356166353265386130616163616662623764313536616666656237636563
|
||||
30323036353635303438363234646234656530373365396530666539393132643831653039666562
|
||||
65383962306465363862333131383263353736623264616465336139313638343462653361333239
|
||||
64363562653366396664623662376433663335313231653935626237663430303734326433333739
|
||||
62616265373732316530366331323664373637386661353664626464646264356465346466663539
|
||||
31613435366362343564313732616639376664613630316236373333653634386130663463626231
|
||||
31396631623466666364316237313363366439326231653035316437616134643035393138383364
|
||||
35313738373562353632366637663232393638396330626165323535343538633264353366663738
|
||||
30663135646162396331623837343661613333313437313434313365623664316135626239636230
|
||||
65376137303439323166346536353831653537326662356330393362666430633831323537623830
|
||||
65326164663136383339353138663936306166633662346363353063663435323266653137666630
|
||||
61353263653735626236373233313436343466653238376634623366356431333439323932343938
|
||||
33303432613063383135633261653837633961643737623462626439373335613430356532353031
|
||||
31626666663963643736323731613735376239663530373166626365666339346435323761333637
|
||||
35383464626437646665653931653932653033376464386132383038633734373138313830303466
|
||||
39313532333866303565353161636435646231313461646639316566386639323561363633636139
|
||||
37613661626162306431313266383964323434343039386533333535646565373933396565613565
|
||||
34666136633265663035306261623531333665636336303665613635333232316331643935353461
|
||||
32643735623532313363663530656630653531666335323565353063316537396334383230386462
|
||||
33333565616634356537376466373332356663376363353166656139623336396130653564333739
|
||||
39303733303939313838363331356437646632386631343466383332313037616430313566396335
|
||||
31363038373437643266656463373662653966653832613935303462303031653761336165646162
|
||||
31646631373335336435383638666562373236656231613662646161613533376237366463383630
|
||||
36393532316336303531353032303937353963306164663162386137393664353962323865616532
|
||||
63326462626130386234643639363762323863326134623063343731366433306431303763363233
|
||||
36366334386266616261616266386439623665326339653562373836306165353137353137376337
|
||||
37316363653935623736613138356333653936363866356665303737363032363564643532303234
|
||||
37656432656363336564393263353430373437303337303461613763346461646565646535366638
|
||||
34366337343033666134383966646563356533626665373337646231313431346239303635353261
|
||||
62313939383762303235373537643531623465353062303939383666323139396630346461626136
|
||||
38656632373637616532666433626564376338363239326234656561636239653536366331633234
|
||||
65366139623238336234363564616430646435666562616636303064663437663731303839313365
|
||||
38636438386162623862363865646233346336636439663833343136316165343564393339653565
|
||||
38346166346434386338303032303430303535373635336562663030336566666435623537363137
|
||||
61373161343138656365376531633830313561336632633330323035346431643837383062343537
|
||||
66663961306666333535656432393134363565656635333633363732626665656365356138623164
|
||||
65303936633666643034313636663262616661313739663135653335366261613133643630343362
|
||||
66343033363835613031626635336538303362393561313032336136306465316231366137373736
|
||||
62303335393333306132326135393562666431303631306538326433613362306131316139386361
|
||||
31383665386466653066613038633335636233396335383764336462636138333034383836386365
|
||||
38323739346630643532346161383336646165333336393961663930623531303434366265313861
|
||||
39613231373335373338656434636134663036636234393534353033613133383034343437626434
|
||||
31646339613430343265333833303231333739666266646436336161363330396264313636616461
|
||||
61396332363537636162316261363030393466356263353938343236323932306366316535366533
|
||||
38633165393339356339383939666161336461653438353632653530326639313238323761386461
|
||||
63653765313532646166306237386435663432633934343039666637323362626338313135623034
|
||||
30356438633635363738383932393861376235353962303663313963313964383530306530316363
|
||||
64656638363436326562323234303961396333323931666365656433663865616439336138656232
|
||||
66653964383034343837663936306632336562373637346132333063663263306237303461333732
|
||||
65363661623064643663623661393563353739373535373764356163666639376236313839336438
|
||||
35386265646331313663653761353864663934663261313037396135373938343265353934353361
|
||||
30343564623631316366343838656135393364353836613330393536623662383637333039383133
|
||||
37653733626662646631616563306638366263323634303636616331323964393962643061646361
|
||||
39363562396634656637626630653533396236613334343332326439656165306537326464613436
|
||||
37333632663731316165613432353339356561316431623038303365303663326666303666646363
|
||||
66656630396661353765666131393737636630366666373136313837373165303437316233656261
|
||||
38346463303964343132393162663762346163363739383733326635643264616166393264633934
|
||||
64333137373532343032303431316633613836323631613231346133366635616435366436316239
|
||||
64353633366431386664623239353735623037623364346431633733336563303430653233313637
|
||||
35353138616164643834343339653739373038633531303039333632663566323565383637646561
|
||||
31383965396365653364343761363161656432656665383963656463613637633938376234353532
|
||||
33653837613266666661613165376665626432643439363637623333336234313836373232333736
|
||||
65313232373233613763376463663161643636663162643864363962376232326462643936383131
|
||||
39366164323038376633376238363663313238336166386663616261306532633331643537376631
|
||||
31376663393036363566653061353636326565376636346466656263663266326332656461336437
|
||||
32646162313932646632663738646532663439313630393038383530653562313439336631663535
|
||||
36396265353231373435353137303164356633653938373166363663616632303764633738333439
|
||||
62626533346561333565626163643235393164353861636662636531333834623965323034363735
|
||||
33336138356663303462393864343434636364346432383665313931653062363138623261326438
|
||||
31616533643163363261386635653732343939633965363362643536626264323537656238633539
|
||||
62393935386433313366656133633532353131343237623466376632623434626362363062326531
|
||||
33346165643164363365626432333631393664316266613731663162313764386336333231396632
|
||||
36666536336333623063346166306164376138343566353063343866316432333266366337623866
|
||||
61313039663661643863663434343732313139653037373065333463383635393061323938643162
|
||||
61383064303461366162636439343438376266313931323934313563623435346634663739666565
|
||||
62333035346634303139626432313262383262633437663436323763313361633235393037343665
|
||||
62316564376464333133343134333230383765303834613233613232626131343631326433373062
|
||||
36343466396430313534336332636233623337613134333861646334326633396434353765636163
|
||||
37343638363234313030363661306337393361333332306331396164346633336130336366396430
|
||||
62306539656332313162626239303066656664383639353730633738643132386662643733393761
|
||||
62666339346130626163656237623730363066343838303036613038613763356263363365366238
|
||||
62623435303838623630333231663137393362323234383533393763623235376164626461373736
|
||||
36343761353362623433663936623433353439646463613233363732613435373564616239626564
|
||||
61313066333939326435656535333963313831316231356232346534633531613963353130333432
|
||||
37656163663230626632393939363532356366643764323330366630656334623261656334633865
|
||||
61303066333566363061626437643132353664383061383364333338666230313034373535613063
|
||||
63386237383638333263323337313336373830303865303466363965303839316162663431656538
|
||||
33376332643335366537306133613761613132643232316438623939356331656263633933613935
|
||||
65653465383434386561323462626362623566663330656439386361616562353430303938636436
|
||||
66636531343063633561363330663436383930613438323764356562383536393933646264323135
|
||||
64633764356166343965346362323466306636363633656466653934313230326435336536306230
|
||||
38353432323537393131313239373861386237313530366139313338313330326632313536353837
|
||||
63386161336335363834356437326630353031373435316462613634633039336132646134653236
|
||||
31346664353932323339366464356161333637313761666138386164313163333531626235663338
|
||||
62386333303264306363646136646463393134373939346438383465393439343337643336633039
|
||||
62316464663038326439656334373331303165346534346466663538313632633561393335333931
|
||||
65363964363335616639643462393463343437626539363838626439386164303464316666633663
|
||||
63656639626133653266306266306531646331386366343936316136363935323662336335326338
|
||||
30666130316265666631306635646565363039306138313462376662626161313134383633653834
|
||||
32376163383763306165323466306264616366343332636564636162666434333732643635336163
|
||||
61626162626331613438373464336465303739316130343965633532336531313661613961313164
|
||||
39636165316638616338653965373833333732396363393463383433383930353361636166346232
|
||||
61323935663536306533336137356566383130393564623938666231393431626136396137633066
|
||||
36633133313861353338616561373838363833353531633465363731336237663561383561326635
|
||||
62306338643965613635353536613335363934666362366466663461646135346436336164346536
|
||||
62666631303638386137356233303235613636346661303834613335616161396238663530643165
|
||||
65366364336139303766303938643038303461656335303438396565346330313665636165626432
|
||||
64326666313562646239356231663834326566313331303363343064346539626636346438313266
|
||||
65643364656164336166353435343730376266333633666230316464356439336463316464653137
|
||||
66303865613961373732323439326535373933393537656462303831333432636261613564636330
|
||||
63323361366332386331376437666234346661373233653432343733346363306130383665626437
|
||||
33313330336365633464643563643465393935653132376135663163393161616462353838336664
|
||||
35393833656135643733623765626639386561333336623930303465323963613164666531396632
|
||||
35326365386566353966383635643132316230383363393539653335633934646239316131653536
|
||||
66656161653030343462346337653434313062343663633665363838393865336536626532623132
|
||||
66643636656134353363636433636538623930396262663864343332303066333566653063336464
|
||||
32303030396137346636636164323133396364623532643332363638643761323938616530353836
|
||||
65366331633561623331393231323534343239323565333330636136383836616230343034633036
|
||||
38373530616532653166653932643665396434373465376530313663646236336238656266616261
|
||||
33396463303963646633373038336662623161643135656136326533646337316562323932613833
|
||||
65616434316239353531666131383335383733333830613934393465663138353662613063323537
|
||||
31393337343737646537666430323666366338303731623339323063393636353132636233343436
|
||||
61653862333837623666343061633531396235633565313631663937393337303764316466613130
|
||||
33653732373034613639326338353438643664653461616133646235393864386564353765313932
|
||||
36613165323465333937626165316632313334313364353463366239356630653530313761373261
|
||||
35326331313438656238646535643131656634396238363734626431633734336238616538383636
|
||||
32303331666531653331306263303534613332653535643833303062653566393632333030383263
|
||||
63393636643264656439373165383861323534333462353763343931363065393738323433323839
|
||||
33333530323434363662633939303261636465356663326565633238663333656131376130396561
|
||||
63363636613161383465323233626630613265346162386439353665393832383961616564636538
|
||||
65333635336638646436623033343831356339656638333231666439643337306636313931643466
|
||||
32393765303361323735646130613035346564356562656631373435653832663165313131336236
|
||||
31636634663466366234386262623234626161663461386661656435656133616339383633386230
|
||||
34313065396335636630333066633339646432313632373131306235333164336534363630313939
|
||||
32623062393230633732323130613338363833356533306662616637326337343330303635343532
|
||||
38396665633938313932656130303263396631343761616631616637633831666139343130313236
|
||||
62356630346264376432
|
||||
|
||||
150
host_vars/web23
150
host_vars/web23
@@ -1,85 +1,67 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
34643866316432643663656661633339313239653763623430356538363761393162626338336433
|
||||
6535353761396539323630396230316637363536396631350a343338396638613636396364323762
|
||||
62306431363961393937633033373963623064333363633034623430613031383032363562663536
|
||||
3566646634303639340a366236343164666563366130636433383832656563376463333431303861
|
||||
34323164323161303762616164366632663761626665323832366166386166636130383830633065
|
||||
64646563396264303035636661663162393332613661663564316466313363656263646533633861
|
||||
30366136316131643734356431633064373062613539643937626539373536666663646331643862
|
||||
39366666386438373335396136616662346230363631326465373065333633313638303564336165
|
||||
62323164373933396166363236396461623432363931636637613235636663613432636136616664
|
||||
64643130373337353936663863356363653630633033343538623133616662386430343632303031
|
||||
61386331346561346138643735393162616135633333343135653238366533663733626361656666
|
||||
61616130313031646365613638633463353861353935623562646666393733656266643834396361
|
||||
38333363633162636561323331646262643139643135666261343364333634613138343431623637
|
||||
39383635393565656139666535386336616165623333386266383431663936313034393439626234
|
||||
30386263323630303563613334393538306430396537613436613264646664616261323336366432
|
||||
62333061333730393064666131346339623061306637633261333635336233363831353662653437
|
||||
33626333333130386161323038333465613737393835656632346436396361383761303865333339
|
||||
36613062353630316633336464336463633230633762366663396463303234343266323233326165
|
||||
30303637353163613464633930336463326535623662636638643066333733623032353564393164
|
||||
66363732393438393462353034626363636664316464356432363235366134326261326335306462
|
||||
61623330656538633364373561336436353362303638356539393031336531396139343539353936
|
||||
66323332336235393162376436346330386537336239636434346565386565373365343462323164
|
||||
63373462313861653561313762363338623664333233316632303562393736346665626530643061
|
||||
65353337623230643136616262623430323235346439626364376362653337303735646663326535
|
||||
63393937366232623663623165323965303563323137383462623339396163353433343836383666
|
||||
39633065373839646235326130633635316237366631333765343333613564333461326465356134
|
||||
37663735393537333532363062633161313437623831356332663765613936383338343634386239
|
||||
37303137623138396261663230303530343132346665386363346230663836656634316364373064
|
||||
61666262363638376162393339636138353634633630333435383437313433316564663963323532
|
||||
30383835336565346337613464343561343832653263663465393133343566333864633766613531
|
||||
39653238633237373736663635306563323631346331353362343031303636366439356362306138
|
||||
64656166653232633239633037373330343139636261646238613662613364656632643334343233
|
||||
31633438386433633736663564613230393662316534336132333636326137353831373335396666
|
||||
63636530633037643339326466386638323733363732323939323862326432303231393435616630
|
||||
63303461616338386230303933636161306238613861326633636331376464643531333939303735
|
||||
38653165303832313739363136616266363837613337306230336433643237326232356333343963
|
||||
62316139393661323965313066636530393433613438633430373864343438623631666564386639
|
||||
34656461643530636537383264313266653465333764623166383838373366323662653939613439
|
||||
38386339393164363863373838303839353532346238643163616635363064343435393933303234
|
||||
64306431623738656434333766343263653865393935626466353433386463623739393130386332
|
||||
32623762353665393863383762643035313266643863363062626332316439616639616333623730
|
||||
35373662316131393836333936656438316334363364323339343236376634323365386461373061
|
||||
38363335353965646563646231653434623531336465333231396530623365306137643931633238
|
||||
32663937616366393237623861323337623963353964313233353433643733313730666239373031
|
||||
62316338623734303839616639303539643439613062656438633563653337626364316535373661
|
||||
32313337366465656533653766356436623638316534623666346666646364633436656330663666
|
||||
38636439333834313639316663326630356531613432353837616465353763623335623464363734
|
||||
34366335656366323634636465353563633532616334636665396439326438656462386336326265
|
||||
32393131636362633230366330633564376165313830616134393931613566383433646632363536
|
||||
39636563313662656439613565353663613962653730313666636263373065613230313965336130
|
||||
30346637323565333139643332336239646636643037316436373134663232373738363564613633
|
||||
64396330316332616631346339323466376162336539656433353666643438323365663665623661
|
||||
33656162643163323161373931353963303934643532343561643838336236386139316334636161
|
||||
38316239356165373036306464313066623432383037613134633364373762313639366330306333
|
||||
66643139336436643535353466393830363136386431373962656165633465326135616430316634
|
||||
39333966373361613433333631353334343765643435353466626536636437333739353036346635
|
||||
64346235336132393030666531343761366562396233386236356332343963363438373535633065
|
||||
64643730333465316439363735396566636338303236623438393566316533613333396561353930
|
||||
66633631303336346333306332663639643138656636373266353061623234386339313266376564
|
||||
37376130336230366630396335343330663162396237366131306237663232316361633939333365
|
||||
36366234663735393664353934303930616566336133313664313538326136343363323530343865
|
||||
63663633383338323363353061393366353064346232623464333863666334616636333662323265
|
||||
35653761323965376364343362643734646439373237333632373736353436326133376663346132
|
||||
38373530333137323038653534623761353265313336303538376565626363626535663635313235
|
||||
35663765376334366661383764663066383232323431623262626662623138323431383863363736
|
||||
66366462303838656234373263653835373666623934633865353533316537363431646661636433
|
||||
30383862626636613636323639313063323632323731613134303863356166613137363538333466
|
||||
65666635666563616464616538343639363331336233663038616332663032616364393761343036
|
||||
61373636623331636136313038333661613339623763663132306131663665663237363730646339
|
||||
36363766376437643930663363333635666366343431376439613961353039663938303834316433
|
||||
34326235386164373130643533373566653061366636623565303361666234616530346561386239
|
||||
37346337336137663366353632323434343263636435313034646639376430633133626466343737
|
||||
61656334656639393239633361316635646665633532323461663432633135353264383666666438
|
||||
33306336343732643234623430653538613064653635363765303166303061316636393736663561
|
||||
66393935663835633437326265656239353730626262333038616633326138623261343864613161
|
||||
35333233613163666461323339663063646361646563653531356337373663343166613965366232
|
||||
65313839633730386436633962373434643636396264646431653639343361363335633633383062
|
||||
34356232366132346537313838663730323336613661376331636363353464316266633336383639
|
||||
30373564333265653839666161643366313163356161356237383133636130333330316430613632
|
||||
34376338383561613635323030613731636637653961646632363838316665313934646130663361
|
||||
65633232396539646337333061326234316534333866383830343632306331663631343864313236
|
||||
65613932643938313161353331613634656230303863653037343434373862353462336134646637
|
||||
32616266353730336663613865316164626364303262663461363436323133653663636665323134
|
||||
30306431336637663130
|
||||
64326662336532386161646564656439396461666266656463393335663130323930326139386562
|
||||
3639653630336132663666646161363938386334323064320a663564613066313533353433333434
|
||||
30346561616465646163646534356339666639333862623637613435376361323032636439633930
|
||||
3731313063363337380a373961353530383764623830363935626231333734303364313565626633
|
||||
37343037633862633632613165323136373662396438613663636433346566653064653632313338
|
||||
36396333393334336434326630646164333531306432386133353664336535343363343939393464
|
||||
34626335626436353239366138323863656336636536383733363931633933636331643263653566
|
||||
30613931616462373336393337363430353962613665353936383533326364353365623333316664
|
||||
62383439396131303831326562323264336638623461643361663763356236373464346464316237
|
||||
65393232343733643338653734326562626166366562303037613862396564636662363066356664
|
||||
32656363616637303039373732396533643432343961666365313963383131643464333765643737
|
||||
32386165666131626365313938633530346361383734323334613464353862393931323836626563
|
||||
62656531346532646530306463653364326362613162323536643836643839663933343132613435
|
||||
63303234646335306632316166626266313635303566396363333464363631353834373761353837
|
||||
65643461623135363139646564336430353461336433633765303138313730613630346465326666
|
||||
61393133636262653836333664623333656164663361353130623863653863323131326136373238
|
||||
33376333316433653337373834666136363130373261333330643439313734343036636364306532
|
||||
63343662383539633235356162656366323965383331343139616361653466633865626337326562
|
||||
63643761613536613334333065643533323066393764633931633066353064393966646161376361
|
||||
37623939386636346161346164303832303534323038626335336665653634386132343031303861
|
||||
61323765306366333936303765636436633465356539316631343562363535663932333666363035
|
||||
30386233623265636464393662386464333430396337626230306438396563303437363938303061
|
||||
32653939383136376365343934613339383563303935623664633639326137353437363261393637
|
||||
66613331643530623862636665396536613730306537373666623135663837393466343261646461
|
||||
62376162613861643633656334303132353034333834626664666237393534386439313638393933
|
||||
35643663613432323432646466386434363335353234643264643463613334356462313766643030
|
||||
30336364396235663230356235303264323339643761333036333537633862343862386130626533
|
||||
36626536396663393031303533313238616133323239356634303830353439363133353839663266
|
||||
36306539636563633734623162356230383232306138393831393336626336383966643335376564
|
||||
36303730313936633361643736613736303163363536313038316432323039643362636538333037
|
||||
65613663333032623035656665393565366363396134363832363163656532363537373435623233
|
||||
36373961333237373264326634353363356537356538343663613034396132396366626330303365
|
||||
62353461616434343938386237373365633861333733613631633234623034366364363761613636
|
||||
34393532316466323264363363653335366639613731326131393335313039646538626665356333
|
||||
62663435633539643237326631636563363833633130363535653336333538366137306235663730
|
||||
36633934636536633865376262356239303966646638626638386536366662386432343466366161
|
||||
36646436636538643366623864326630396565373462393132343834626638313437316137353564
|
||||
34646138616438323065336266366434316135613938643131353034646230396632386433366365
|
||||
38616436346232363563336439613939313464323861616530633962316634363462373530613665
|
||||
63653636646565303664326631363535373037663734663965346430363831613431613365393832
|
||||
62373030336262643430313635626261613232656236333130396537633238623265363932333966
|
||||
34326135363762396564613064323135313663613565646461376162306532643433333336666532
|
||||
65383661303137613335653336663666653463623565386137326662653839633536326135633764
|
||||
33623437333931393737363061356235336232376437643131373531356566323336306138353561
|
||||
66333863313461613930383231663162616261616639323238646439656166666261626533636161
|
||||
38333362393033316266633364313739366262636530363937386137616234326638303137613433
|
||||
65313962653566333364383732386165396136303666383439303064326463346563663434646364
|
||||
62396130646632653039383661613638303162363538376236666338623865366639663138363636
|
||||
36373766386234383465316635323931356233366262386135363238366538623135623361386436
|
||||
64653533646233653463656334633566373433303365353965663732636566663332343337626337
|
||||
34623861373562386264346430333133343631653631376366373735626664363965666561306262
|
||||
35666235653235346233636361383566616533646662333662323139313865383264633734643263
|
||||
63656431393834633935613430643839613433326431666665323136376562333737383862313261
|
||||
65656431336439303563373833343965323965346439636131633366633431393032613963666539
|
||||
38326539343132326334316233323362633835356265333031663066643535363639623031336362
|
||||
64346230383638363763323462386261666266623134393139303264343234623132323437396630
|
||||
66363738376133393731616535653230303262313937373333353932303038626166346366303163
|
||||
66613831353731373165636532363165356561383137626437333563616561386666623234313438
|
||||
37333435306530323235393164383138346131653235633536383636316161316238313064636261
|
||||
33353963333430383236303038333939316637326130396430623964633338353863613534653663
|
||||
30333839393230626261663966616230303330636335323565663938343562666663303536636332
|
||||
34336665323764663163653161373166313631393534326532613538313637313136356336313433
|
||||
34353036653738343433613763383137336562373332333062326134626638633938336364376131
|
||||
61303435333163663636653135363162303663663266393438656430306532343438386436343735
|
||||
31343231653263373532386263653263386435363633396638396164323539306233303562303862
|
||||
3339306136613431636138333266633739323666633431363039
|
||||
|
||||
@@ -13,13 +13,13 @@
|
||||
|
||||
- hosts: all
|
||||
user: provisioning
|
||||
become: yes
|
||||
become: true
|
||||
vars_files:
|
||||
- "../vars/{{ ansible_distribution }}.yml"
|
||||
|
||||
tasks:
|
||||
- name: Set password, shell, homedir for provisioning user
|
||||
when: provisioning_user is defined
|
||||
user: name={{ provisioning_user.name }} password={{ provisioning_user.password }} shell={{ provisioning_user.shell }} state={{ provisioning_user.state }} createhome=no
|
||||
user: name={{ provisioning_user.name }} password={{ provisioning_user.password }} shell={{ provisioning_user.shell }} state={{ provisioning_user.state }} createhome=false
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
# file: nomads.yml
|
||||
|
||||
- hosts: nomads
|
||||
become: yes
|
||||
become: true
|
||||
roles:
|
||||
- common
|
||||
- munin
|
||||
|
||||
11
roles/caddy/defaults/main.yml
Normal file
11
roles/caddy/defaults/main.yml
Normal file
@@ -0,0 +1,11 @@
|
||||
---
|
||||
# file: roles/caddy/defaults/main.yml
|
||||
|
||||
# parent directory of vhost document roots
|
||||
caddy_root_prefix: "{{ web_root_prefix }}"
|
||||
|
||||
# Email address to use for the ACME account managing the site's certificates.
|
||||
# Not sure what Caddy does if this doesn't exist.
|
||||
caddy_email: foo@example.com
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
10
roles/caddy/handlers/main.yml
Normal file
10
roles/caddy/handlers/main.yml
Normal file
@@ -0,0 +1,10 @@
|
||||
---
|
||||
# file: roles/caddy/handlers/main.yml
|
||||
|
||||
# I'm currently not sure when we need to restart versus reload
|
||||
- name: reload caddy
|
||||
ansible.builtin.systemd_service:
|
||||
name: caddy
|
||||
state: reloaded
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
82
roles/caddy/tasks/main.yml
Normal file
82
roles/caddy/tasks/main.yml
Normal file
@@ -0,0 +1,82 @@
|
||||
---
|
||||
# file: roles/caddy/tasks/main.yml
|
||||
#
|
||||
# Configure Caddy.
|
||||
|
||||
- name: Check Caddy package signing key
|
||||
ansible.builtin.stat:
|
||||
path: /etc/apt/keyrings/caddy-stable-archive-keyring.key
|
||||
register: caddy_signing_key_stat
|
||||
tags:
|
||||
- packages
|
||||
- caddy
|
||||
|
||||
# See: https://caddyserver.com/docs/install#debian-ubuntu-raspbian
|
||||
- name: Download Caddy package signing key
|
||||
ansible.builtin.get_url:
|
||||
url: https://dl.cloudsmith.io/public/caddy/stable/gpg.key
|
||||
dest: /etc/apt/keyrings/caddy-stable-archive-keyring.key
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: download_caddy_signing_key
|
||||
when: not caddy_signing_key_stat.stat.exists
|
||||
tags:
|
||||
- packages
|
||||
- caddy
|
||||
|
||||
- name: Add Caddy stable repo
|
||||
ansible.builtin.apt_repository:
|
||||
repo: deb [signed-by=/etc/apt/keyrings/caddy-stable-archive-keyring.key] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main
|
||||
filename: caddy-stable
|
||||
state: present
|
||||
register: add_caddy_apt_repository
|
||||
tags:
|
||||
- packages
|
||||
- caddy
|
||||
|
||||
- name: Update apt cache
|
||||
ansible.builtin.apt: # noqa no-handler
|
||||
update_cache: true
|
||||
when: (download_caddy_signing_key.status_code is defined and download_caddy_signing_key.status_code == 200) or add_caddy_apt_repository is changed
|
||||
tags:
|
||||
- packages
|
||||
- caddy
|
||||
|
||||
- name: Install Caddy
|
||||
ansible.builtin.apt:
|
||||
name: caddy
|
||||
state: present
|
||||
install_recommends: false
|
||||
cache_valid_time: 3600
|
||||
tags:
|
||||
- caddy
|
||||
- packages
|
||||
|
||||
- name: Create Caddyfile
|
||||
ansible.builtin.template:
|
||||
src: etc/caddy/Caddyfile.j2
|
||||
dest: /etc/caddy/Caddyfile
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- reload caddy
|
||||
tags: caddy
|
||||
|
||||
- name: Create Caddy conf.d directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/caddy/conf.d
|
||||
state: directory
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
tags: caddy
|
||||
|
||||
# TODO: the variable is still named nginx_vhosts
|
||||
- name: Configure Caddy virtual hosts
|
||||
ansible.builtin.include_tasks: vhosts.yml
|
||||
when: nginx_vhosts is defined
|
||||
tags: caddy
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
14
roles/caddy/tasks/vhosts.yml
Normal file
14
roles/caddy/tasks/vhosts.yml
Normal file
@@ -0,0 +1,14 @@
|
||||
---
|
||||
- name: Configure vhosts
|
||||
ansible.builtin.template:
|
||||
src: etc/caddy/conf.d/vhost.j2
|
||||
dest: /etc/caddy/conf.d/{{ item.domain_name }}
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
notify:
|
||||
- reload caddy
|
||||
tags: caddy
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
29
roles/caddy/templates/etc/caddy/Caddyfile.j2
Normal file
29
roles/caddy/templates/etc/caddy/Caddyfile.j2
Normal file
@@ -0,0 +1,29 @@
|
||||
# Global options
|
||||
{
|
||||
email {{ caddy_email }}
|
||||
}
|
||||
|
||||
# Common security response headers
|
||||
(security-headers) {
|
||||
header {
|
||||
# disable Google FLoC tracking
|
||||
Permissions-Policy interest-cohort=()
|
||||
|
||||
# enable HSTS
|
||||
Strict-Transport-Security max-age=31536000
|
||||
|
||||
# disable clients from sniffing the media type
|
||||
X-Content-Type-Options nosniff
|
||||
|
||||
# clickjacking protection: refuse to allow rendering this page
|
||||
# in a frame, iframe, etc.
|
||||
X-Frame-Options DENY
|
||||
|
||||
# keep referrer data off of HTTP connections
|
||||
Referrer-Policy no-referrer-when-downgrade
|
||||
}
|
||||
}
|
||||
|
||||
# Import additional caddy config files in /etc/caddy/conf.d/
|
||||
# Note: these are imported in lexical sort order!
|
||||
import /etc/caddy/conf.d/*
|
||||
46
roles/caddy/templates/etc/caddy/conf.d/vhost.j2
Normal file
46
roles/caddy/templates/etc/caddy/conf.d/vhost.j2
Normal file
@@ -0,0 +1,46 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
{# helper variables and per-site defaults that we can't set in role defaults #}
|
||||
{% set domain_name = item.domain_name %}
|
||||
{% set domain_aliases = item.domain_aliases | default("") %}
|
||||
{# assume optional features are off unless a vhost explicitly sets them #}
|
||||
{% set has_wordpress = item.has_wordpress | default(false) %}
|
||||
{% set needs_php = item.needs_php | default(false) %}
|
||||
{% set has_gitea = item.has_gitea | default(false) %}
|
||||
{% set static_site = item.static_site | default(false) %}
|
||||
{# Allow sites to override the document root #}
|
||||
{% if item.document_root is defined %}
|
||||
{% set document_root = item.document_root %}
|
||||
{% else %}
|
||||
{% set document_root = (caddy_root_prefix, domain_name) | ansible.builtin.path_join %}
|
||||
{% endif %}
|
||||
|
||||
{% if domain_aliases %}
|
||||
{# domain_aliases is a string, so we split on space #}
|
||||
{% for domain in domain_aliases | split (' ') %}
|
||||
{{ domain }} {
|
||||
redir https://{{domain_name}}{uri}
|
||||
}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{{ domain_name }} {
|
||||
{% if has_gitea %}
|
||||
reverse_proxy :3000
|
||||
{% elif static_site -%}
|
||||
root * {{ document_root }}
|
||||
|
||||
encode
|
||||
|
||||
file_server
|
||||
{% elif has_wordpress -%}
|
||||
root * {{ document_root }}
|
||||
encode
|
||||
{% if ansible_distribution_major_version is version('12', '==') -%}
|
||||
php_fastcgi unix//run/php/php8.2-fpm-{{ domain_name }}.sock
|
||||
{% endif -%}
|
||||
file_server
|
||||
{% endif -%}
|
||||
|
||||
import security-headers
|
||||
}
|
||||
@@ -8,6 +8,10 @@ fail2ban_maxretry: 6
|
||||
fail2ban_findtime: 3600
|
||||
# 2 weeks in seconds
|
||||
fail2ban_bantime: 1209600
|
||||
fail2ban_ignoreip: 127.0.0.1/8 172.26.0.0/16 192.168.5.0/24
|
||||
fail2ban_ignoreip: 127.0.0.0/8
|
||||
|
||||
# Disable SSH passwords. Must use SSH keys. This is OK because we add the keys
|
||||
# before re-configuring the SSH daemon to disable passwords.
|
||||
ssh_password_authentication: disabled
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,12 +0,0 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define ABUSEIPDB_IPV6 = {
|
||||
2001:1bb0:e000:1e::93a,
|
||||
2001:41d0:303:ac05::,
|
||||
2400:6180:0:d1::4dd:b001,
|
||||
2402:e280:3d00:1d1:a00:27ff:fe8c:e37c,
|
||||
2607:f1c0:842:3400::5c:29d,
|
||||
2607:fcd8:0:c:1::,
|
||||
2a00:d680:20:50::cdb4,
|
||||
2a01:4f8:210:138d::2
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,14 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:ip">
|
||||
<option name="family" value="inet6" />
|
||||
<short>abusers-ipv6</short>
|
||||
<description>A list of abusive IPv6 addresses.</description>
|
||||
<entry>2001:1bb0:e000:1e::93a</entry>
|
||||
<entry>2001:41d0:303:ac05::</entry>
|
||||
<entry>2400:6180:0:d1::4dd:b001</entry>
|
||||
<entry>2402:e280:3d00:1d1:a00:27ff:fe8c:e37c</entry>
|
||||
<entry>2607:f1c0:842:3400::5c:29d</entry>
|
||||
<entry>2607:fcd8:0:c:1::</entry>
|
||||
<entry>2a00:d680:20:50::cdb4</entry>
|
||||
<entry>2a01:4f8:210:138d::2</entry>
|
||||
</ipset>
|
||||
@@ -1,89 +0,0 @@
|
||||
#!/usr/bin/perl
|
||||
#
|
||||
# aggregate-cidr-addresses - combine a list of CIDR address blocks
|
||||
# Copyright (C) 2001,2007 Mark Suter <suter@zwitterion.org>
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see L<http://www.gnu.org/licenses/>.
|
||||
#
|
||||
# [MJS 22 Oct 2001] Aggregate CIDR addresses
|
||||
# [MJS 9 Oct 2007] Overlap idea from Anthony Ledesma at theplanet dot com.
|
||||
# [MJS 16 Feb 2012] Prompted to clarify license by Alexander Talos-Zens - at at univie dot ac dot at
|
||||
# [MJS 21 Feb 2012] IPv6 fixes by Alexander Talos-Zens
|
||||
# [MJS 21 Feb 2012] Split ranges into prefixes (fixes a 10+ year old bug)
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
use English qw( -no_match_vars );
|
||||
use Net::IP;
|
||||
|
||||
## Read in all the IP addresses
|
||||
my @addrs = map { Net::IP->new($_) or die "$PROGRAM_NAME: Not an IP: \"$_\"."; }
|
||||
map { / \A \s* (.+?) \s* \Z /msix and $1; } <>;
|
||||
|
||||
## Split any ranges into prefixes
|
||||
@addrs = map {
|
||||
defined $_->prefixlen ? $_ : map { Net::IP->new($_) }
|
||||
$_->find_prefixes
|
||||
} @addrs;
|
||||
|
||||
## Sort the IP addresses
|
||||
@addrs = sort { $a->version <=> $b->version or $a->bincomp( 'lt', $b ) ? -1 : $a->bincomp( 'gt', $b ) ? 1 : 0 } @addrs;
|
||||
|
||||
## Handle overlaps
|
||||
my $count = 0;
|
||||
my $current = $addrs[0];
|
||||
foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
|
||||
my $r = $current->overlaps($next);
|
||||
if ( $current->version != $next->version or $r == $IP_NO_OVERLAP ) {
|
||||
$current = $next;
|
||||
$count++;
|
||||
}
|
||||
elsif ( $r == $IP_A_IN_B_OVERLAP ) {
|
||||
$current = $next;
|
||||
splice @addrs, $count, 1;
|
||||
}
|
||||
elsif ( $r == $IP_B_IN_A_OVERLAP or $r == $IP_IDENTICAL ) {
|
||||
splice @addrs, $count + 1, 1;
|
||||
}
|
||||
else {
|
||||
die "$PROGRAM_NAME: internal error - overlaps() returned an unexpected value!\n";
|
||||
}
|
||||
}
|
||||
|
||||
## Keep aggregating until we don't change anything
|
||||
my $change = 1;
|
||||
while ($change) {
|
||||
$change = 0;
|
||||
my @new_addrs = ();
|
||||
$current = $addrs[0];
|
||||
foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
|
||||
if ( my $total = $current->aggregate($next) ) {
|
||||
$current = $total;
|
||||
$change = 1;
|
||||
}
|
||||
else {
|
||||
push @new_addrs, $current;
|
||||
$current = $next;
|
||||
}
|
||||
}
|
||||
push @new_addrs, $current;
|
||||
@addrs = @new_addrs;
|
||||
}
|
||||
|
||||
## Print out the IP addresses
|
||||
foreach (@addrs) {
|
||||
print $_->prefix(), "\n";
|
||||
}
|
||||
|
||||
# $Id: aggregate-cidr-addresses,v 1.9 2012/02/21 10:14:22 suter Exp suter $
|
||||
@@ -1,2 +0,0 @@
|
||||
autoclean -y
|
||||
upgrade -y -o APT::Get::Show-Upgraded=true
|
||||
@@ -1,5 +0,0 @@
|
||||
# Configuration for cron-apt. For further information about the possible
|
||||
# configuration settings see the README file.
|
||||
|
||||
MAILON="never"
|
||||
OPTIONS="-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list -o Dir::Etc::SourceParts=\"/dev/null\""
|
||||
@@ -1 +0,0 @@
|
||||
provisioning ALL=(ALL) ALL
|
||||
@@ -1,5 +1,5 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV4 = {
|
||||
define FIREHOL_LEVEL1_IPV4 = {
|
||||
192.168.254.254/32
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet" />
|
||||
<short>spamhaus-ipv4</short>
|
||||
<description>Spamhaus DROP and EDROP lists placeholder (IPv4).</description>
|
||||
</ipset>
|
||||
@@ -1,5 +0,0 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV6 = {
|
||||
fd21:3523:74e0:7301::/64
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet6" />
|
||||
<short>spamhaus-ipv6</short>
|
||||
<description>Spamhaus DROP list placeholder (IPv6).</description>
|
||||
</ipset>
|
||||
@@ -0,0 +1 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmRO6E0G4Ls3TifVfJ+mQjlfWiBZNJfsSXGhwQ/HA1M aorth@balozi
|
||||
@@ -1,27 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Abuse.ch SSL Blacklist IPs
|
||||
# This service will fail if nftables is not running so we use Requires to make
|
||||
# sure that nftables is started.
|
||||
Requires=nftables.service
|
||||
# Make sure the network is up and nftables is started
|
||||
After=network-online.target nftables.service
|
||||
Wants=network-online.target update-abusech-nftables.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/nftables
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-abusech-nftables
|
||||
ExecStart=/usr/bin/flock -x update-abusech-nftables.lck \
|
||||
/usr/local/bin/update-abusech-nftables.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,63 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-abuseipdb-nftables.sh v0.0.1
|
||||
#
|
||||
# Download IP addresses seen using a blacklisted SSL certificate and load them
|
||||
# into nftables sets. As of 2021-07-28 these appear to only be IPv4.
|
||||
#
|
||||
# See: https://sslbl.abuse.ch/blacklist
|
||||
#
|
||||
# Copyright (C) 2021 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
abusech_ipv4_set_path=/etc/nftables/abusech-ipv4.nft
|
||||
abusech_list_temp=$(mktemp)
|
||||
|
||||
echo "Downloading Abuse.sh SSL Blacklist IPs"
|
||||
|
||||
abusech_response=$(curl -s -G -w "%{http_code}\n" https://sslbl.abuse.ch/blacklist/sslipblacklist.txt --output "$abusech_list_temp")
|
||||
|
||||
if [[ $abusech_response -ne 200 ]]; then
|
||||
echo "Abuse.ch responded: HTTP $abusech_response"
|
||||
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -f "$abusech_list_temp" ]]; then
|
||||
echo "Processing IPv4 list"
|
||||
|
||||
abusech_ipv4_list_temp=$(mktemp)
|
||||
abusech_ipv4_set_temp=$(mktemp)
|
||||
|
||||
# Remove comments, DOS carriage returns, and IPv6 addresses (even though
|
||||
# Abuse.ch seems to only have IPv4 addresses, let's not break our shit on
|
||||
# that assumption some time down the line).
|
||||
sed -e '/#/d' -e 's/
|
||||
//' -e '/:/d' "$abusech_list_temp" > "$abusech_ipv4_list_temp"
|
||||
|
||||
echo "Building abusech-ipv4 set"
|
||||
cat << NFT_HEAD > "$abusech_ipv4_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define ABUSECH_IPV4 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
# nftables doesn't mind if the last element in the set has a trailing
|
||||
# comma so we don't need to do anything special here.
|
||||
echo "$network," >> "$abusech_ipv4_set_temp"
|
||||
done < $abusech_ipv4_list_temp
|
||||
|
||||
echo "}" >> "$abusech_ipv4_set_temp"
|
||||
|
||||
install -m 0600 "$abusech_ipv4_set_temp" "$abusech_ipv4_set_path"
|
||||
|
||||
rm -f "$abusech_list_temp" "$abusech_ipv4_list_temp" "$abusech_ipv4_set_temp"
|
||||
fi
|
||||
|
||||
echo "Reloading nftables"
|
||||
# The abusech nftables sets are included by nftables.conf
|
||||
@@ -1,12 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Abuse.ch SSL Blacklist IPs
|
||||
|
||||
[Timer]
|
||||
# Once a day at midnight
|
||||
OnCalendar=*-*-* 00:00:00
|
||||
# Add a random delay of 0–3600 seconds
|
||||
RandomizedDelaySec=3600
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
24
roles/common/files/update-firehol-nftables.service
Normal file
24
roles/common/files/update-firehol-nftables.service
Normal file
@@ -0,0 +1,24 @@
|
||||
[Unit]
|
||||
Description=Update FireHOL lists
|
||||
# Make sure the network is up
|
||||
After=network-online.target
|
||||
Wants=network-online.target update-firehol-nftables.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/nftables
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-firehol-nftables
|
||||
ExecStart=/usr/bin/flock -x update-firehol-nftables.lck \
|
||||
/usr/local/bin/update-firehol-nftables.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,5 +1,5 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
Description=Update FireHOL lists
|
||||
|
||||
[Timer]
|
||||
# Once a day at midnight
|
||||
@@ -1,27 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
# This service will fail if firewalld is not running so we use Requires to make
|
||||
# sure that firewalld is started.
|
||||
Requires=firewalld.service
|
||||
# Make sure the network is up and firewalld is started
|
||||
After=network-online.target firewalld.service
|
||||
Wants=network-online.target update-spamhaus-lists.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/firewalld/ipsets
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-spamhaus-lists
|
||||
ExecStart=/usr/bin/flock -x update-spamhaus-lists.lck \
|
||||
/usr/local/bin/update-spamhaus-lists.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,107 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-spamhaus-lists.sh v0.0.5
|
||||
#
|
||||
# Download Spamhaus DROP lists and load them into firewalld ipsets. Should work
|
||||
# with both the iptables and nftables backends.
|
||||
#
|
||||
# See: https://www.spamhaus.org/drop/
|
||||
#
|
||||
# Copyright (C) 2021 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
firewalld_ipsets=$(firewall-cmd --get-ipsets)
|
||||
xml_temp=$(mktemp)
|
||||
spamhaus_ipv4_ipset_path=/etc/firewalld/ipsets/spamhaus-ipv4.xml
|
||||
spamhaus_ipv6_ipset_path=/etc/firewalld/ipsets/spamhaus-ipv6.xml
|
||||
|
||||
function download() {
|
||||
echo "Downloading $1"
|
||||
wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
|
||||
}
|
||||
|
||||
download drop.txt
|
||||
download edrop.txt
|
||||
download dropv6.txt
|
||||
|
||||
if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
|
||||
echo "Processing IPv4 DROP lists"
|
||||
|
||||
# Extract all networks from drop.txt and edrop.txt, skipping blank lines and
|
||||
# comments.
|
||||
networks=$(cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//')
|
||||
|
||||
# If firewalld already has this ipset we should delete it first to emulate
|
||||
# `ipset flush` (but I don't want to use that because newer hosts might be
|
||||
# using nftables and firewalld will handle that for us).
|
||||
if [[ "$firewalld_ipsets" =~ spamhaus-ipv4 ]]; then
|
||||
echo "Deleting existing spamhaus-ipv4 ipset"
|
||||
# This deletes the firewalld ipset XML file as well as the ipset itself
|
||||
firewall-cmd --permanent --delete-ipset=spamhaus-ipv4
|
||||
else
|
||||
echo "Creating placeholder spamhaus-ipv4 ipset"
|
||||
# Create a placeholder ipset so firewalld doesn't complain when we try
|
||||
# to reload the ipset later after having added a new XML definition. I
|
||||
# don't know why, but depending on the system state there may not be a
|
||||
# ipset defined and firewalld errors on INVALID_IPSET.
|
||||
firewall-cmd --permanent --new-ipset=spamhaus-ipv4 --type=hash:net --option=family=inet
|
||||
fi
|
||||
|
||||
# I'm not proud of this, but writing the XML directly is WAY faster than
|
||||
# using firewall-cmd to add each entry one by one (and we can't add from
|
||||
# a file because many of our hosts are using old firewalld).
|
||||
cat << XML_HEAD > "$xml_temp"
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet" />
|
||||
<short>spamhaus-ipv4</short>
|
||||
<description>Spamhaus DROP and EDROP lists (IPv4).</description>
|
||||
XML_HEAD
|
||||
|
||||
for network in $networks; do
|
||||
echo " <entry>$network</entry>" >> "$xml_temp"
|
||||
done
|
||||
|
||||
echo "</ipset>" >> "$xml_temp"
|
||||
|
||||
install -m 0600 "$xml_temp" "$spamhaus_ipv4_ipset_path"
|
||||
fi
|
||||
|
||||
if [[ -f "dropv6.txt" ]]; then
|
||||
echo "Processing IPv6 DROP list"
|
||||
|
||||
networks=$(sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt)
|
||||
|
||||
if [[ "$firewalld_ipsets" =~ spamhaus-ipv6 ]]; then
|
||||
echo "Deleting existing spamhaus-ipv6 ipset"
|
||||
firewall-cmd --permanent --delete-ipset=spamhaus-ipv6
|
||||
else
|
||||
echo "Creating placeholder spamhaus-ipv6 ipset"
|
||||
firewall-cmd --permanent --new-ipset=spamhaus-ipv6 --type=hash:net --option=family=inet6
|
||||
fi
|
||||
|
||||
cat << XML_HEAD > "$xml_temp"
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet6" />
|
||||
<short>spamhaus-ipv6</short>
|
||||
<description>Spamhaus DROP lists (IPv6).</description>
|
||||
XML_HEAD
|
||||
|
||||
for network in $networks; do
|
||||
echo " <entry>$network</entry>" >> "$xml_temp"
|
||||
done
|
||||
|
||||
echo "</ipset>" >> "$xml_temp"
|
||||
|
||||
install -m 0600 "$xml_temp" "$spamhaus_ipv6_ipset_path"
|
||||
fi
|
||||
|
||||
echo "Reloading firewalld"
|
||||
firewall-cmd --reload
|
||||
|
||||
rm -v drop.txt edrop.txt dropv6.txt "$xml_temp"
|
||||
@@ -1,12 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
|
||||
[Timer]
|
||||
# Once a day at midnight
|
||||
OnCalendar=*-*-* 00:00:00
|
||||
# Add a random delay of 0–3600 seconds
|
||||
RandomizedDelaySec=3600
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@@ -1,27 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
# This service will fail if nftables is not running so we use Requires to make
|
||||
# sure that nftables is started.
|
||||
Requires=nftables.service
|
||||
# Make sure the network is up and nftables is started
|
||||
After=network-online.target nftables.service
|
||||
Wants=network-online.target update-spamhaus-nftables.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/nftables
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-spamhaus-nftables
|
||||
ExecStart=/usr/bin/flock -x update-spamhaus-nftables.lck \
|
||||
/usr/local/bin/update-spamhaus-nftables.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,91 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-spamhaus-nftables.sh v0.0.1
|
||||
#
|
||||
# Download Spamhaus DROP lists and load them into nftables sets.
|
||||
#
|
||||
# See: https://www.spamhaus.org/drop/
|
||||
#
|
||||
# Copyright (C) 2021 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
spamhaus_ipv4_set_path=/etc/nftables/spamhaus-ipv4.nft
|
||||
spamhaus_ipv6_set_path=/etc/nftables/spamhaus-ipv6.nft
|
||||
|
||||
function download() {
|
||||
echo "Downloading $1"
|
||||
wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
|
||||
}
|
||||
|
||||
download drop.txt
|
||||
download edrop.txt
|
||||
download dropv6.txt
|
||||
|
||||
if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
|
||||
echo "Processing IPv4 DROP lists"
|
||||
|
||||
spamhaus_ipv4_list_temp=$(mktemp)
|
||||
spamhaus_ipv4_set_temp=$(mktemp)
|
||||
|
||||
# Extract all networks from drop.txt and edrop.txt, skipping blank lines and
|
||||
# comments. Use aggregate-cidr-addresses.pl to merge overlapping IPv4 CIDR
|
||||
# ranges to work around a firewalld bug.
|
||||
#
|
||||
# See: https://bugzilla.redhat.com/show_bug.cgi?id=1836571
|
||||
cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' | aggregate-cidr-addresses.pl > "$spamhaus_ipv4_list_temp"
|
||||
|
||||
echo "Building spamhaus-ipv4 set"
|
||||
cat << NFT_HEAD > "$spamhaus_ipv4_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV4 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
# nftables doesn't mind if the last element in the set has a trailing
|
||||
# comma so we don't need to do anything special here.
|
||||
echo "$network," >> "$spamhaus_ipv4_set_temp"
|
||||
done < $spamhaus_ipv4_list_temp
|
||||
|
||||
echo "}" >> "$spamhaus_ipv4_set_temp"
|
||||
|
||||
install -m 0600 "$spamhaus_ipv4_set_temp" "$spamhaus_ipv4_set_path"
|
||||
|
||||
rm -f "$spamhaus_ipv4_list_temp" "$spamhaus_ipv4_set_temp"
|
||||
fi
|
||||
|
||||
if [[ -f "dropv6.txt" ]]; then
|
||||
echo "Processing IPv6 DROP lists"
|
||||
|
||||
spamhaus_ipv6_list_temp=$(mktemp)
|
||||
spamhaus_ipv6_set_temp=$(mktemp)
|
||||
|
||||
sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt > "$spamhaus_ipv6_list_temp"
|
||||
|
||||
echo "Building spamhaus-ipv6 set"
|
||||
cat << NFT_HEAD > "$spamhaus_ipv6_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV6 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
echo "$network," >> "$spamhaus_ipv6_set_temp"
|
||||
done < $spamhaus_ipv6_list_temp
|
||||
|
||||
echo "}" >> "$spamhaus_ipv6_set_temp"
|
||||
|
||||
install -m 0600 "$spamhaus_ipv6_set_temp" "$spamhaus_ipv6_set_path"
|
||||
|
||||
rm -f "$spamhaus_ipv6_list_temp" "$spamhaus_ipv6_set_temp"
|
||||
fi
|
||||
|
||||
echo "Reloading nftables"
|
||||
# The spamhaus nftables sets are included by nftables.conf
|
||||
/usr/sbin/nft -f /etc/nftables.conf
|
||||
|
||||
rm -v drop.txt edrop.txt dropv6.txt
|
||||
@@ -1,23 +1,27 @@
|
||||
---
|
||||
# file: roles/common/handlers/main.yml
|
||||
# ansible.builtin.file: roles/common/handlers/main.yml
|
||||
|
||||
- name: reload sshd
|
||||
systemd: name={{ sshd_service_name }} state=reloaded
|
||||
- name: Reload sshd
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ sshd_service_name }}"
|
||||
state: reloaded
|
||||
|
||||
- name: reload sysctl
|
||||
command: sysctl -p /etc/sysctl.conf
|
||||
- name: Reload sysctl
|
||||
ansible.builtin.command: sysctl -p /etc/sysctl.conf
|
||||
|
||||
- name: restart firewalld
|
||||
systemd: name=firewalld state=restarted
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd_service:
|
||||
daemon_reload: true
|
||||
|
||||
- name: reload systemd
|
||||
systemd: daemon_reload=yes
|
||||
|
||||
- name: restart nftables
|
||||
systemd: name=nftables state=restarted
|
||||
- name: Restart nftables
|
||||
ansible.builtin.systemd_service:
|
||||
name: nftables
|
||||
state: restarted
|
||||
|
||||
# 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed
|
||||
# in the order they are defined, not in the order they are listed in the task's
|
||||
# notify statement and we must restart fail2ban after updating the firewall.
|
||||
- name: restart fail2ban
|
||||
systemd: name=fail2ban state=restarted
|
||||
- name: Restart fail2ban
|
||||
ansible.builtin.systemd_service:
|
||||
name: fail2ban
|
||||
state: restarted
|
||||
|
||||
@@ -1,12 +1,17 @@
|
||||
---
|
||||
- name: Remove cron-apt
|
||||
ansible.builtin.apt:
|
||||
name: cron-apt
|
||||
state: absent
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Configure cron-apt (config)
|
||||
copy: src={{ item.src }} dest={{ item.dest }} mode={{ item.mode }} owner={{ item.owner }} group={{ item.group }}
|
||||
- name: Remove cron-apt configs
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- { src: 'etc/cron-apt/config', dest: '/etc/cron-apt/config', mode: '0644', owner: 'root', group: 'root' }
|
||||
- { src: 'etc/cron-apt/3-download', dest: '/etc/cron-apt/action.d/3-download', mode: '0644', owner: 'root', group: 'root' }
|
||||
|
||||
- name: Configure cron-apt (security)
|
||||
template: src=security.sources.list.j2 dest=/etc/apt/security.sources.list mode=0644 owner=root group=root
|
||||
- /etc/cron-apt/config
|
||||
- /etc/cron-apt/action.d/3-download
|
||||
- /etc/apt/security.sources.list
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,25 +1,55 @@
|
||||
---
|
||||
- name: Install fail2ban
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- fail2ban
|
||||
- python3-systemd
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Configure fail2ban sshd filter
|
||||
template: src=etc/fail2ban/jail.d/sshd.local.j2 dest=/etc/fail2ban/jail.d/sshd.local owner=root mode=0644
|
||||
notify: restart fail2ban
|
||||
ansible.builtin.template:
|
||||
src: etc/fail2ban/jail.d/sshd.local.j2
|
||||
dest: /etc/fail2ban/jail.d/sshd.local
|
||||
owner: root
|
||||
mode: "0644"
|
||||
notify: Restart fail2ban
|
||||
|
||||
- name: Configure fail2ban nginx filter
|
||||
when: "extra_fail2ban_filters is defined and 'nginx' in extra_fail2ban_filters"
|
||||
template: src=etc/fail2ban/jail.d/nginx.local.j2 dest=/etc/fail2ban/jail.d/nginx.local owner=root mode=0644
|
||||
notify: restart fail2ban
|
||||
when:
|
||||
- webserver is defined and webserver == 'nginx'
|
||||
- extra_fail2ban_filters is defined
|
||||
- "'nginx' in extra_fail2ban_filters"
|
||||
ansible.builtin.template:
|
||||
src: etc/fail2ban/jail.d/nginx.local.j2
|
||||
dest: /etc/fail2ban/jail.d/nginx.local
|
||||
owner: root
|
||||
mode: "0644"
|
||||
notify: Restart fail2ban
|
||||
|
||||
- name: Create fail2ban service override directory
|
||||
file: path=/etc/systemd/system/fail2ban.service.d state=directory owner=root mode=0755
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/fail2ban.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
mode: "0755"
|
||||
|
||||
# See Arch Linux's example: https://wiki.archlinux.org/index.php/Fail2ban
|
||||
- name: Configure fail2ban service override
|
||||
template: src=etc/systemd/system/fail2ban.service.d/override.conf.j2 dest=/etc/systemd/system/fail2ban.service.d/override.conf owner=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/system/fail2ban.service.d/override.conf.j2
|
||||
dest: /etc/systemd/system/fail2ban.service.d/override.conf
|
||||
owner: root
|
||||
mode: "0644"
|
||||
notify:
|
||||
- reload systemd
|
||||
- restart fail2ban
|
||||
- Reload systemd
|
||||
- Restart fail2ban
|
||||
|
||||
- name: Start and enable fail2ban service
|
||||
systemd: name=fail2ban state=started enabled=yes
|
||||
ansible.builtin.systemd_service:
|
||||
name: fail2ban
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
||||
25
roles/common/tasks/firewall.yml
Normal file
25
roles/common/tasks/firewall.yml
Normal file
@@ -0,0 +1,25 @@
|
||||
---
|
||||
# Debian 11+ will use nftables directly, with no firewalld.
|
||||
|
||||
- name: Install Debian firewall packages
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
ansible.builtin.apt:
|
||||
name: nftables
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Remove iptables on newer Debian
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
ansible.builtin.apt:
|
||||
pkg: iptables
|
||||
state: absent
|
||||
|
||||
- name: Configure nftables
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
ansible.builtin.include_tasks: nftables.yml
|
||||
|
||||
- name: Configure fail2ban
|
||||
when: ansible_distribution_version is version('9', '>=')
|
||||
ansible.builtin.include_tasks: fail2ban.yml
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,160 +0,0 @@
|
||||
---
|
||||
# Debian 10 will use firewalld with the iptables backend.
|
||||
# Debian 11 will use nftables directly, with no firewalld.
|
||||
|
||||
- block:
|
||||
- name: Set Debian firewall packages
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
set_fact:
|
||||
debian_firewall_packages:
|
||||
- firewalld
|
||||
- tidy
|
||||
- fail2ban
|
||||
- python3-systemd # for fail2ban systemd backend
|
||||
|
||||
- name: Set Debian firewall packages
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
set_fact:
|
||||
debian_firewall_packages:
|
||||
- fail2ban
|
||||
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
||||
- nftables
|
||||
- python3-systemd
|
||||
- curl # for nftables update scripts
|
||||
|
||||
- name: Install firewall packages
|
||||
apt: pkg={{ debian_firewall_packages }} state=present cache_valid_time=3600
|
||||
|
||||
- name: Remove iptables on newer Debian
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
apt: pkg=iptables state=absent
|
||||
|
||||
- name: Copy nftables.conf
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
|
||||
notify:
|
||||
- restart nftables
|
||||
- restart fail2ban
|
||||
|
||||
- name: Create /etc/nftables extra config directory
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
file: path=/etc/nftables state=directory owner=root mode=0755
|
||||
|
||||
- name: Copy extra nftables configuration files
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
|
||||
loop:
|
||||
- { src: "spamhaus-ipv4.nft", force: "no" }
|
||||
- { src: "spamhaus-ipv6.nft", force: "no" }
|
||||
- { src: "abusech-ipv4.nft", force: "no" }
|
||||
- { src: "abuseipdb-ipv4.nft", force: "yes" }
|
||||
- { src: "abuseipdb-ipv6.nft", force: "yes" }
|
||||
notify:
|
||||
- restart nftables
|
||||
- restart fail2ban
|
||||
|
||||
- name: Use iptables backend in firewalld
|
||||
when: ansible_distribution_major_version is version('10', '==')
|
||||
lineinfile:
|
||||
dest: /etc/firewalld/firewalld.conf
|
||||
regexp: '^FirewallBackend=nftables$'
|
||||
line: 'FirewallBackend=iptables'
|
||||
notify:
|
||||
- restart firewalld
|
||||
- restart fail2ban
|
||||
|
||||
# firewalld seems to have an issue with iptables 1.8.2 when using the nftables
|
||||
# backend. Using individual calls seems to work around it.
|
||||
# See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931722
|
||||
- name: Use individual iptables calls
|
||||
when: ansible_distribution_major_version is version('10', '==')
|
||||
lineinfile:
|
||||
dest: /etc/firewalld/firewalld.conf
|
||||
regexp: '^IndividualCalls=no$'
|
||||
line: 'IndividualCalls=yes'
|
||||
notify:
|
||||
- restart firewalld
|
||||
- restart fail2ban
|
||||
|
||||
- name: Copy firewalld public zone file
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
|
||||
|
||||
- name: Format public.xml firewalld zone file
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
- restart fail2ban
|
||||
|
||||
- name: Copy firewalld ipsets of abusive IPs
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
|
||||
loop:
|
||||
- abusers-ipv4.xml
|
||||
- abusers-ipv6.xml
|
||||
- spamhaus-ipv4.xml
|
||||
- spamhaus-ipv6.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
- restart fail2ban
|
||||
|
||||
- name: Copy Spamhaus firewalld update script
|
||||
when: ansible_distribution_version is version('10', '<=')
|
||||
copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
|
||||
|
||||
- name: Copy Spamhaus firewalld systemd units
|
||||
when: ansible_distribution_version is version('10', '<=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-lists.service
|
||||
- update-spamhaus-lists.timer
|
||||
register: spamhaus_firewalld_systemd_units
|
||||
|
||||
- name: Copy Spamhaus nftables update scripts
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.sh
|
||||
- aggregate-cidr-addresses.pl
|
||||
- update-abusech-nftables.sh
|
||||
|
||||
- name: Copy nftables systemd units
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.service
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.service
|
||||
- update-abusech-nftables.timer
|
||||
register: nftables_systemd_units
|
||||
|
||||
# need to reload to pick up service/timer/environment changes
|
||||
- name: Reload systemd daemon
|
||||
systemd: daemon_reload=yes
|
||||
when: spamhaus_firewalld_systemd_units is changed or
|
||||
nftables_systemd_units is changed
|
||||
|
||||
- name: Start and enable Spamhaus firewalld update timer
|
||||
when: ansible_distribution_version is version('10', '<=')
|
||||
systemd: name=update-spamhaus-lists.timer state=started enabled=yes
|
||||
notify:
|
||||
- restart firewalld
|
||||
- restart fail2ban
|
||||
|
||||
- name: Start and enable nftables update timers
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
systemd: name={{ item }} state=started enabled=yes
|
||||
loop:
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.timer
|
||||
|
||||
- name: Start and enable nftables
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
systemd: name=nftables state=started enabled=yes
|
||||
|
||||
- include_tasks: fail2ban.yml
|
||||
when: ansible_distribution_major_version is version('9', '>=')
|
||||
tags: firewall
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,138 +0,0 @@
|
||||
---
|
||||
# Ubuntu 20.04 will use nftables directly, with no firewalld.
|
||||
# Ubuntu 18.04 will use firewalld with the nftables backend.
|
||||
# Ubuntu 16.04 will use firewalld with the iptables backend.
|
||||
|
||||
- block:
|
||||
- name: Set Ubuntu firewall packages
|
||||
when: ansible_distribution_version is version('20.04', '<')
|
||||
set_fact:
|
||||
ubuntu_firewall_packages:
|
||||
- firewalld
|
||||
- tidy
|
||||
- fail2ban
|
||||
- python3-systemd # for fail2ban systemd backend
|
||||
|
||||
- name: Set Ubuntu firewall packages
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
set_fact:
|
||||
ubuntu_firewall_packages:
|
||||
- fail2ban
|
||||
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
||||
- nftables
|
||||
- python3-systemd
|
||||
- curl # for nftables update scripts
|
||||
|
||||
- name: Install firewall packages
|
||||
apt: pkg={{ ubuntu_firewall_packages }} state=present cache_valid_time=3600
|
||||
|
||||
- name: Remove ufw
|
||||
when: ansible_distribution_version is version('16.04', '>=')
|
||||
apt: pkg=ufw state=absent
|
||||
|
||||
- name: Copy nftables.conf
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
|
||||
notify:
|
||||
- restart nftables
|
||||
- restart fail2ban
|
||||
|
||||
- name: Create /etc/nftables extra config directory
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
file: path=/etc/nftables state=directory owner=root mode=0755
|
||||
|
||||
- name: Copy extra nftables configuration files
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
|
||||
loop:
|
||||
- { src: "spamhaus-ipv4.nft", force: "no" }
|
||||
- { src: "spamhaus-ipv6.nft", force: "no" }
|
||||
- { src: "abusech-ipv4.nft", force: "no" }
|
||||
- { src: "abuseipdb-ipv4.nft", force: "yes" }
|
||||
- { src: "abuseipdb-ipv6.nft", force: "yes" }
|
||||
notify:
|
||||
- restart nftables
|
||||
- restart fail2ban
|
||||
|
||||
- name: Copy firewalld public zone file
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
|
||||
|
||||
- name: Format public.xml firewalld zone file
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
- restart fail2ban
|
||||
|
||||
- name: Copy firewalld ipsets of abusive IPs
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
|
||||
loop:
|
||||
- abusers-ipv4.xml
|
||||
- abusers-ipv6.xml
|
||||
- spamhaus-ipv4.xml
|
||||
- spamhaus-ipv6.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
- restart fail2ban
|
||||
|
||||
- name: Copy Spamhaus firewalld update script
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
|
||||
|
||||
- name: Copy Spamhaus firewalld systemd units
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-lists.service
|
||||
- update-spamhaus-lists.timer
|
||||
register: spamhaus_firewalld_systemd_units
|
||||
|
||||
- name: Copy nftables update scripts
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.sh
|
||||
- aggregate-cidr-addresses.pl
|
||||
- update-abusech-nftables.sh
|
||||
|
||||
- name: Copy nftables systemd units
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.service
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.service
|
||||
- update-abusech-nftables.timer
|
||||
register: nftables_systemd_units
|
||||
|
||||
# need to reload to pick up service/timer/environment changes
|
||||
- name: Reload systemd daemon
|
||||
systemd: daemon_reload=yes
|
||||
when: spamhaus_firewalld_systemd_units is changed or
|
||||
nftables_systemd_units is changed
|
||||
|
||||
- name: Start and enable Spamhaus firewalld update timer
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
systemd: name=update-spamhaus-lists.timer state=started enabled=yes
|
||||
notify:
|
||||
- restart firewalld
|
||||
- restart fail2ban
|
||||
|
||||
- name: Start and enable nftables update timers
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
systemd: name={{ item }} state=started enabled=yes
|
||||
loop:
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.timer
|
||||
|
||||
- name: Start and enable nftables
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
systemd: name=nftables state=started enabled=yes
|
||||
|
||||
- include_tasks: fail2ban.yml
|
||||
when: ansible_distribution_version is version('16.04', '>=')
|
||||
tags: firewall
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,54 +1,48 @@
|
||||
---
|
||||
- name: Import OS-specific variables
|
||||
include_vars: "vars/{{ ansible_distribution }}.yml"
|
||||
ansible.builtin.include_vars: vars/{{ ansible_distribution }}.yml
|
||||
tags: always
|
||||
|
||||
- name: Configure network time
|
||||
import_tasks: ntp.yml
|
||||
ansible.builtin.import_tasks: ntp.yml
|
||||
tags: ntp
|
||||
|
||||
- name: Install common packages
|
||||
include_tasks: packages_Debian.yml
|
||||
when: ansible_distribution == 'Debian'
|
||||
tags: packages
|
||||
|
||||
- name: Install common packages
|
||||
include_tasks: packages_Ubuntu.yml
|
||||
when: ansible_distribution == 'Ubuntu'
|
||||
ansible.builtin.include_tasks: packages.yml
|
||||
tags: packages
|
||||
|
||||
- name: Configure firewall
|
||||
include_tasks: firewall_Debian.yml
|
||||
when: ansible_distribution == 'Debian'
|
||||
tags: firewall
|
||||
|
||||
- name: Configure firewall
|
||||
include_tasks: firewall_Ubuntu.yml
|
||||
when: ansible_distribution == 'Ubuntu'
|
||||
ansible.builtin.import_tasks: firewall.yml
|
||||
tags: firewall
|
||||
|
||||
- name: Configure secure shell daemon
|
||||
import_tasks: sshd.yml
|
||||
ansible.builtin.import_tasks: sshd.yml
|
||||
tags: sshd
|
||||
|
||||
# containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!
|
||||
- name: Reconfigure /etc/sysctl.conf
|
||||
when: ansible_virtualization_role != 'host'
|
||||
template: src=sysctl_{{ ansible_distribution }}.j2 dest=/etc/sysctl.conf owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: "sysctl_{{ ansible_distribution }}.j2"
|
||||
dest: /etc/sysctl.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify:
|
||||
- reload sysctl
|
||||
- Reload sysctl
|
||||
tags: sysctl
|
||||
|
||||
- name: Reconfigure /etc/rc.local
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('19.04', '<=')
|
||||
template: src=rc.local_Ubuntu.j2 dest=/etc/rc.local owner=root group=root mode=0755
|
||||
|
||||
- name: Set I/O scheduler
|
||||
template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: etc/udev/rules.d/60-scheduler.rules.j2
|
||||
dest: /etc/udev/rules.d/60-scheduler.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
tags: udev
|
||||
|
||||
- name: Copy admin SSH keys
|
||||
import_tasks: ssh-keys.yml
|
||||
ansible.builtin.import_tasks: ssh-keys.yml
|
||||
tags: ssh-keys
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
||||
96
roles/common/tasks/nftables.yml
Normal file
96
roles/common/tasks/nftables.yml
Normal file
@@ -0,0 +1,96 @@
|
||||
---
|
||||
# Common nftables tasks for Debian 11 and Debian 12.
|
||||
|
||||
- name: Copy nftables.conf
|
||||
ansible.builtin.template:
|
||||
src: nftables.conf.j2
|
||||
dest: /etc/nftables.conf
|
||||
owner: root
|
||||
mode: "0644"
|
||||
notify:
|
||||
- Restart nftables
|
||||
- Restart fail2ban
|
||||
|
||||
- name: Create /etc/nftables extra config directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/nftables
|
||||
state: directory
|
||||
owner: root
|
||||
mode: "0755"
|
||||
|
||||
- name: Copy extra nftables configuration files
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src }}"
|
||||
dest: /etc/nftables/{{ item.src }}
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
force: "{{ item.force }}"
|
||||
loop:
|
||||
- { src: firehol_level1-ipv4.nft, force: false }
|
||||
notify:
|
||||
- Restart nftables
|
||||
- Restart fail2ban
|
||||
|
||||
- name: Copy nftables update scripts
|
||||
ansible.builtin.template:
|
||||
src: update-firehol-nftables.sh.j2
|
||||
dest: /usr/local/bin/update-firehol-nftables.sh
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Remove deprecated data and scripts
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- /etc/nftables/spamhaus-ipv4.nft
|
||||
- /etc/nftables/spamhaus-ipv6.nft
|
||||
- /etc/nftables/abuseipdb-ipv4.nft
|
||||
- /etc/nftables/abuseipdb-ipv6.nft
|
||||
- /etc/nftables/abusech-ipv4.nft
|
||||
- /usr/local/bin/update-abusech-nftables.sh
|
||||
- /usr/local/bin/update-spamhaus-nftables.sh
|
||||
- /etc/systemd/system/update-abusech-nftables.service
|
||||
- /etc/systemd/system/update-abusech-nftables.timer
|
||||
- /etc/systemd/system/update-spamhaus-nftables.service
|
||||
- /etc/systemd/system/update-spamhaus-nftables.timer
|
||||
- /usr/local/bin/aggregate-cidr-addresses.pl
|
||||
notify:
|
||||
- Restart nftables
|
||||
- Restart fail2ban
|
||||
|
||||
- name: Copy nftables systemd units
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item }}"
|
||||
dest: /etc/systemd/system/{{ item }}
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
loop:
|
||||
- update-firehol-nftables.service
|
||||
- update-firehol-nftables.timer
|
||||
register: nftables_systemd_units
|
||||
|
||||
# need to reload to pick up service/timer/environment changes
|
||||
- name: Reload systemd daemon
|
||||
when: nftables_systemd_units is changed
|
||||
ansible.builtin.systemd_service: # noqa no-handler
|
||||
daemon_reload: true
|
||||
|
||||
- name: Start and enable nftables update timers
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ item }}"
|
||||
state: started
|
||||
enabled: true
|
||||
loop:
|
||||
- update-firehol-nftables.timer
|
||||
|
||||
- name: Start and enable nftables
|
||||
ansible.builtin.systemd_service:
|
||||
name: nftables
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,27 +1,40 @@
|
||||
---
|
||||
# Hosts running Ubuntu 16.04+ and Debian 9+ use systemd init system and should
|
||||
# use systemd-timesyncd as a network time client instead of the standalone ntp
|
||||
# client.
|
||||
# Hosts running Debian 9+ use systemd init system and can use systemd-timesyncd
|
||||
# as a network time client instead of the standalone ntp client.
|
||||
|
||||
- name: Set timezone
|
||||
when: timezone is defined and ansible_service_mgr == 'systemd'
|
||||
command: /usr/bin/timedatectl set-timezone {{ timezone }}
|
||||
when:
|
||||
- timezone is defined
|
||||
- ansible_service_mgr == 'systemd'
|
||||
community.general.timezone:
|
||||
name: "{{ timezone }}"
|
||||
tags: timezone
|
||||
|
||||
# Apparently some cloud images don't have this installed by default. From what
|
||||
# I can see on existing servers, systemd-timesyncd is a standalone package on
|
||||
# Ubuntu 20.04 and Debian 11.
|
||||
# Debian 11 and Debian 12.
|
||||
- name: Install systemd-timesyncd
|
||||
when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or
|
||||
(ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
|
||||
apt: name=systemd-timesyncd state=present cache_valid_time=3600
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
ansible.builtin.apt:
|
||||
name: systemd-timesyncd
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Start and enable systemd's NTP client
|
||||
when: ansible_service_mgr == 'systemd'
|
||||
systemd: name=systemd-timesyncd state=started enabled=yes
|
||||
ansible.builtin.systemd_service:
|
||||
name: systemd-timesyncd
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Uninstall ntp on modern Ubuntu/Debian
|
||||
apt: name=ntp state=absent
|
||||
when: ansible_service_mgr == 'systemd'
|
||||
# On Debian 12 ntp doesn't conflict with systemd-timesyncd so we should try to
|
||||
# remove it to be sure.
|
||||
- name: Uninstall ntp on Debian 12
|
||||
when:
|
||||
- ansible_service_mgr == 'systemd'
|
||||
- ansible_distribution_major_version is version('12', '==')
|
||||
ansible.builtin.apt:
|
||||
name: ntp
|
||||
state: absent
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
57
roles/common/tasks/packages.yml
Normal file
57
roles/common/tasks/packages.yml
Normal file
@@ -0,0 +1,57 @@
|
||||
---
|
||||
- name: Configure Debian packages
|
||||
tags: packages
|
||||
block:
|
||||
# Scaleway seems to use a weird sources.list format as of Debian 12?
|
||||
- name: Check for weird Debian sources
|
||||
ansible.builtin.stat:
|
||||
path: /etc/apt/sources.list.d/debian.sources
|
||||
register: weird_debian_sources_stat
|
||||
|
||||
- name: Configure apt mirror
|
||||
when:
|
||||
- ansible_architecture != 'armv7l'
|
||||
- not weird_debian_sources_stat
|
||||
ansible.builtin.template:
|
||||
src: sources.list.j2
|
||||
dest: /etc/apt/sources.list
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Set fact for base packages
|
||||
ansible.builtin.set_fact:
|
||||
base_packages:
|
||||
- git
|
||||
- git-lfs
|
||||
- tmux
|
||||
- iotop
|
||||
- htop
|
||||
- strace
|
||||
- safe-rm
|
||||
- debian-goodies
|
||||
- mosh
|
||||
- python3-pycurl # for ansible's apt_repository
|
||||
- vim
|
||||
- unzip
|
||||
- apt-transport-https # for https support in apt
|
||||
- gnupg2
|
||||
- zstd
|
||||
- rsync
|
||||
- lsof
|
||||
- unattended-upgrades
|
||||
|
||||
- name: Install base packages
|
||||
ansible.builtin.apt:
|
||||
name: "{{ base_packages }}"
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Remove cron-apt
|
||||
tags: cron-apt
|
||||
ansible.builtin.import_tasks: cron-apt.yml
|
||||
|
||||
- name: Install tarsnap
|
||||
ansible.builtin.import_tasks: tarsnap.yml
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Configure apt mirror
|
||||
template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
|
||||
when: ansible_architecture != 'armv7l'
|
||||
|
||||
- name: Set fact for base packages
|
||||
set_fact:
|
||||
base_packages:
|
||||
- git
|
||||
- git-lfs
|
||||
- tmux
|
||||
- iotop
|
||||
- htop
|
||||
- strace
|
||||
- cron-apt
|
||||
- safe-rm
|
||||
- debian-goodies
|
||||
- mosh
|
||||
- python3-pycurl # for ansible's apt_repository
|
||||
- vim
|
||||
- unzip
|
||||
- apt-transport-https # for https support in apt
|
||||
- gnupg2
|
||||
- zstd
|
||||
- rsync
|
||||
- lsof
|
||||
|
||||
- name: Install base packages
|
||||
apt: name={{ base_packages }} state=present cache_valid_time=3600
|
||||
|
||||
- name: Configure cron-apt
|
||||
import_tasks: cron-apt.yml
|
||||
tags: cron-apt
|
||||
|
||||
- name: Install tarsnap
|
||||
import_tasks: tarsnap.yml
|
||||
tags: packages
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,108 +0,0 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Configure apt mirror
|
||||
template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
|
||||
when: ansible_architecture != 'armv7l'
|
||||
|
||||
- name: Upgrade base OS
|
||||
apt: upgrade=dist cache_valid_time=3600
|
||||
|
||||
- name: Set Ubuntu base packages
|
||||
set_fact:
|
||||
ubuntu_base_packages:
|
||||
- git
|
||||
- git-lfs
|
||||
- tmux
|
||||
- iotop
|
||||
- htop
|
||||
- strace
|
||||
- cron-apt
|
||||
- safe-rm
|
||||
- debian-goodies
|
||||
- mosh
|
||||
- python-pycurl # for ansible's apt_repository
|
||||
- vim
|
||||
- unzip
|
||||
- apt-transport-https # for https support in apt
|
||||
- zstd
|
||||
- rsync
|
||||
- lsof
|
||||
|
||||
- name: Install base packages
|
||||
apt: pkg={{ ubuntu_base_packages }} state=present cache_valid_time=3600
|
||||
|
||||
# We have to remove snaps one by one in a specific order because some depend
|
||||
# on others. Only after that can we remove the corresponding system packages.
|
||||
- name: Remove lxd snap
|
||||
snap: name=lxd state=absent
|
||||
when: ansible_distribution_version is version('20.04', '==')
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Remove core18 snap
|
||||
snap: name=core18 state=absent
|
||||
when: ansible_distribution_version is version('20.04', '==')
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Remove snapd snap
|
||||
snap: name=snapd state=absent
|
||||
when: ansible_distribution_version is version('20.04', '==')
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Set fact for packages to remove (Ubuntu <= 18.04)
|
||||
set_fact:
|
||||
ubuntu_annoying_packages:
|
||||
- whoopsie # security (CIS 4.1)
|
||||
- apport # security (CIS 4.1)
|
||||
- command-not-found # annoying
|
||||
- command-not-found-data # annoying
|
||||
- python3-commandnotfound # annoying
|
||||
- snapd # annoying (Ubuntu >= 16.04)
|
||||
- lxd # annoying (Ubuntu >= 16.04)
|
||||
- lxd-client # annoying (Ubuntu >= 16.04)
|
||||
- liblxc1 # annoying (Ubuntu >= 16.04)
|
||||
- lxc-common # annoying (Ubuntu >= 16.04)
|
||||
- lxcfs #annoying (Ubuntu >= 16.04)
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
|
||||
- name: Set fact for packages to remove (Ubuntu 20.04)
|
||||
set_fact:
|
||||
ubuntu_annoying_packages:
|
||||
- whoopsie # security (CIS 4.1)
|
||||
- apport # security (CIS 4.1)
|
||||
- command-not-found # annoying
|
||||
- command-not-found-data # annoying
|
||||
- python3-commandnotfound # annoying
|
||||
- snapd # annoying (Ubuntu >= 16.04)
|
||||
- lxd-agent-loader # annoying (Ubuntu 20.04)
|
||||
when: ansible_distribution_version is version('20.04', '==')
|
||||
|
||||
- name: Remove packages
|
||||
apt: name={{ ubuntu_annoying_packages }} state=absent purge=yes
|
||||
|
||||
- name: Disable annoying Canonical spam in MOTD
|
||||
file: path={{ item }} mode=0644 state=absent
|
||||
loop:
|
||||
- /etc/update-motd.d/99-esm # Ubuntu 14.04
|
||||
- /etc/update-motd.d/10-help-text # Ubuntu 14.04+
|
||||
- /etc/update-motd.d/50-motd-news # Ubuntu 18.04+
|
||||
- /etc/update-motd.d/80-esm # Ubuntu 18.04+
|
||||
- /etc/update-motd.d/80-livepatch # Ubuntu 18.04+
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Disable annoying Canonical spam in MOTD
|
||||
systemd: name={{ item }} state=stopped enabled=no
|
||||
when: ansible_service_mgr == 'systemd'
|
||||
loop:
|
||||
- motd-news.service
|
||||
- motd-news.timer
|
||||
|
||||
- name: Configure cron-apt
|
||||
import_tasks: cron-apt.yml
|
||||
tags: cron-apt
|
||||
|
||||
- name: Install tarsnap
|
||||
import_tasks: tarsnap.yml
|
||||
tags: packages
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@@ -1,9 +1,11 @@
|
||||
---
|
||||
- name: Zero .ssh/authorized_keys for provisioning user
|
||||
file: dest={{ provisioning_user.home }}/.ssh/authorized_keys state=absent
|
||||
ansible.builtin.file:
|
||||
dest: "{{ provisioning_user.home }}/.ssh/authorized_keys"
|
||||
state: absent
|
||||
|
||||
- name: Add public keys to authorized_keys
|
||||
authorized_key: { user: '{{ provisioning_user.name }}', key: "{{ lookup('file',item) }}" }
|
||||
ansible.posix.authorized_key: { user: "{{ provisioning_user.name }}", key: "{{ lookup('file', item) }}" }
|
||||
with_fileglob:
|
||||
# use descriptive names for keys, like: aorth-mzito-rsa.pub
|
||||
- ssh-pub-keys/*.pub
|
||||
|
||||
@@ -1,17 +1,26 @@
|
||||
---
|
||||
|
||||
# SSH configs don't change in Debian minor versions
|
||||
# Only override the system sshd configuration on older Debian.
|
||||
- name: Reconfigure /etc/ssh/sshd_config
|
||||
template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
|
||||
when: ansible_distribution == 'Debian'
|
||||
notify: reload sshd
|
||||
when: ansible_distribution_version is version('12', '<=')
|
||||
ansible.builtin.template:
|
||||
src: "sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2"
|
||||
dest: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
notify: Reload sshd
|
||||
|
||||
# Ubuntu is the only distro we have where SSH version is very different from 14.04 -> 14.10,
|
||||
# ie with new ciphers supported etc.
|
||||
- name: Reconfigure /etc/ssh/sshd_config
|
||||
template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
|
||||
when: ansible_distribution == 'Ubuntu'
|
||||
notify: reload sshd
|
||||
# Newer OpenSSH versions support including extra configuration. The includes
|
||||
# happen at the beginning of the file and the first value to be read is used.
|
||||
- name: Configure sshd_config.d overrides
|
||||
when: ansible_distribution_version is version('13', '>=')
|
||||
ansible.builtin.template:
|
||||
src: etc/ssh/sshd_config.d/01-{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.conf.j2
|
||||
dest: /etc/ssh/sshd_config.d/01-custom.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
notify: Reload sshd
|
||||
|
||||
# See: WeakDH (2015): https://weakdh.org/sysadmin.html
|
||||
- name: Remove small Diffie-Hellman SSH moduli
|
||||
@@ -24,28 +33,30 @@
|
||||
register: check_unsafe_moduli
|
||||
|
||||
- name: Extract safe Diffie-Hellman SSH moduli
|
||||
when: check_unsafe_moduli.stdout | length > 0
|
||||
ansible.builtin.shell:
|
||||
cmd: awk '$5 >= 3071' moduli > moduli.safe
|
||||
chdir: /etc/ssh
|
||||
creates: moduli.safe
|
||||
when: check_unsafe_moduli.stdout | length > 0
|
||||
register: extract_safe_moduli
|
||||
|
||||
- name: Replace unsafe Diffie-Hellman SSH moduli
|
||||
when: extract_safe_moduli is changed
|
||||
ansible.builtin.command:
|
||||
cmd: mv moduli.safe moduli
|
||||
chdir: /etc/ssh
|
||||
register: replace_small_moduli
|
||||
when: extract_safe_moduli is changed
|
||||
notify: reload sshd
|
||||
notify: Reload sshd
|
||||
|
||||
- name: Remove DSA and ECDSA host keys
|
||||
file: name=/etc/ssh/{{ item }} state=absent
|
||||
ansible.builtin.file:
|
||||
name: "/etc/ssh/{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- ssh_host_dsa_key
|
||||
- ssh_host_dsa_key.pub
|
||||
- ssh_host_ecdsa_key
|
||||
- ssh_host_ecdsa_key.pub
|
||||
notify: reload sshd
|
||||
notify: Reload sshd
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
||||
@@ -1,24 +1,45 @@
|
||||
---
|
||||
- name: Add Tarsnap apt mirror
|
||||
template: src=tarsnap_sources.list.j2 dest=/etc/apt/sources.list.d/tarsnap.list owner=root group=root mode=0644
|
||||
register: add_tarsnap_apt_repository
|
||||
when: ansible_architecture != 'armv7l'
|
||||
- name: Check tarsnap apt signing key
|
||||
ansible.builtin.stat:
|
||||
path: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
|
||||
register: tarsnap_signing_key_stat
|
||||
|
||||
- name: Add GPG key for Tarsnap
|
||||
apt_key: id=0xBF75EEAB040E447C url=https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc state=present
|
||||
register: add_tarsnap_apt_key
|
||||
- name: Download tarsnap apt signing key
|
||||
when: not tarsnap_signing_key_stat.stat.exists
|
||||
ansible.builtin.get_url:
|
||||
url: https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc
|
||||
dest: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: download_tarsnap_signing_key
|
||||
|
||||
- name: Add tarsnap.org repo
|
||||
when: ansible_architecture != 'armv7l'
|
||||
ansible.builtin.template:
|
||||
src: tarsnap_sources.list.j2
|
||||
dest: /etc/apt/sources.list.d/tarsnap.list
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: add_tarsnap_apt_repository
|
||||
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
when:
|
||||
add_tarsnap_apt_key is changed or
|
||||
add_tarsnap_apt_repository is changed
|
||||
when: (download_tarsnap_signing_key.status_code is defined and download_tarsnap_signing_key.status_code == 200) or add_tarsnap_apt_repository is changed
|
||||
ansible.builtin.apt: # noqa no-handler
|
||||
update_cache: true
|
||||
|
||||
- name: Install tarsnap
|
||||
apt: pkg=tarsnap cache_valid_time=3600
|
||||
ansible.builtin.apt:
|
||||
pkg: tarsnap
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Copy tarsnaprc
|
||||
copy: src=tarsnaprc dest=/root/.tarsnaprc owner=root group=root mode=0600
|
||||
ansible.builtin.copy:
|
||||
src: tarsnaprc
|
||||
dest: /root/.tarsnaprc
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
||||
@@ -2,13 +2,9 @@
|
||||
enabled = true
|
||||
# See: /etc/fail2ban/filter.d/nginx-botsearch.conf
|
||||
filter = nginx-botsearch
|
||||
{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
|
||||
# Integrate with nftables
|
||||
banaction=nftables[type=allports]
|
||||
{% else %}
|
||||
# Integrate with firewalld and ipsets
|
||||
banaction = firewallcmd-ipset
|
||||
{% endif %}
|
||||
backend = pyinotify
|
||||
logpath = /var/log/nginx/*-access.log
|
||||
# Try to find a non-existent wp-login.php once and get banned. Tough luck.
|
||||
maxretry = 1
|
||||
|
||||
@@ -2,13 +2,8 @@
|
||||
enabled = true
|
||||
# See: /etc/fail2ban/filter.d/sshd.conf
|
||||
filter = sshd
|
||||
{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
|
||||
# Integrate with nftables
|
||||
banaction=nftables[type=allports]
|
||||
{% else %}
|
||||
# Integrate with firewalld and ipsets
|
||||
banaction = firewallcmd-ipset
|
||||
{% endif %}
|
||||
backend = systemd
|
||||
maxretry = {{ fail2ban_maxretry }}
|
||||
findtime = {{ fail2ban_findtime }}
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear
|
||||
# audit track of which key was using to log in.
|
||||
LogLevel VERBOSE
|
||||
|
||||
MaxAuthTries 4
|
||||
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
{% if ssh_password_authentication == 'disabled' %}
|
||||
PasswordAuthentication no
|
||||
{% else %}
|
||||
PasswordAuthentication yes
|
||||
{% endif %}
|
||||
|
||||
X11Forwarding no
|
||||
|
||||
# Based on the ssh-audit profile for Debian 13, but with but with all algos with
|
||||
# less than 256 bits removed, as NSA's Suite B removed them years ago and the
|
||||
# new (2018) CNSA suite is 256 bits and up.
|
||||
#
|
||||
# See: ssh-audit.py -P "Hardened Debian 13 (version 1)"
|
||||
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com
|
||||
|
||||
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
||||
AllowUsers {{ ssh_allowed_users|join(" ") }} {{ provisioning_user.name }}
|
||||
{% endif %}
|
||||
|
||||
PerSourcePenaltyExemptList {{ fail2ban_ignoreip | replace(" ", ",") }}
|
||||
|
||||
# Mask to use for IPv4 and IPv6 respectively when applying network penalties.
|
||||
# The default is 32:128.
|
||||
PerSourceNetBlockSize 24:56
|
||||
@@ -1,15 +1,19 @@
|
||||
[Unit]
|
||||
# If nftables is stopped or restarted, propagate to fail2ban as well
|
||||
PartOf=nftables.service
|
||||
|
||||
[Service]
|
||||
PrivateDevices=yes
|
||||
PrivateTmp=yes
|
||||
ProtectHome=read-only
|
||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
|
||||
{% if ansible_distribution_version is version('11','>=') %}
|
||||
ProtectSystem=strict
|
||||
{% else %}
|
||||
{# Older systemd versions don't have ProtectSystem=strict #}
|
||||
ProtectSystem=full
|
||||
{% endif %}
|
||||
NoNewPrivileges=yes
|
||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
|
||||
{% if ansible_distribution_version is version('11','>=') %}
|
||||
ReadWritePaths=-/var/run/fail2ban
|
||||
ReadWritePaths=-/var/lib/fail2ban
|
||||
ReadWritePaths=-/var/log/fail2ban.log
|
||||
|
||||
@@ -5,47 +5,18 @@
|
||||
|
||||
flush ruleset
|
||||
|
||||
# Lists updated daily by update-spamhaus-nftables.sh
|
||||
include "/etc/nftables/spamhaus-ipv4.nft"
|
||||
include "/etc/nftables/spamhaus-ipv6.nft"
|
||||
|
||||
# Lists updated monthly (manually)
|
||||
include "/etc/nftables/abuseipdb-ipv4.nft"
|
||||
include "/etc/nftables/abuseipdb-ipv6.nft"
|
||||
|
||||
# Lists updated daily by update-abusech-nftables.sh
|
||||
include "/etc/nftables/abusech-ipv4.nft"
|
||||
# List updated daily by update-firehol-nftables.sh
|
||||
include "/etc/nftables/firehol_level1-ipv4.nft"
|
||||
|
||||
# Notes:
|
||||
# - tables hold chains, chains hold rules
|
||||
# - inet is for both ipv4 and ipv6
|
||||
table inet filter {
|
||||
set spamhaus-ipv4 {
|
||||
set firehol_level1-ipv4 {
|
||||
type ipv4_addr
|
||||
# if the set contains prefixes we need to use the interval flag
|
||||
flags interval
|
||||
elements = $SPAMHAUS_IPV4
|
||||
}
|
||||
|
||||
set spamhaus-ipv6 {
|
||||
type ipv6_addr
|
||||
flags interval
|
||||
elements = $SPAMHAUS_IPV6
|
||||
}
|
||||
|
||||
set abusech-ipv4 {
|
||||
type ipv4_addr
|
||||
elements = $ABUSECH_IPV4
|
||||
}
|
||||
|
||||
set abuseipdb-ipv4 {
|
||||
type ipv4_addr
|
||||
elements = $ABUSEIPDB_IPV4
|
||||
}
|
||||
|
||||
set abuseipdb-ipv6 {
|
||||
type ipv6_addr
|
||||
elements = $ABUSEIPDB_IPV6
|
||||
elements = $FIREHOL_LEVEL1_IPV4
|
||||
}
|
||||
|
||||
chain input {
|
||||
@@ -55,13 +26,7 @@ table inet filter {
|
||||
|
||||
ct state invalid counter drop comment "Early drop of invalid connections"
|
||||
|
||||
ip saddr @spamhaus-ipv4 counter drop comment "Early drop of incoming packets matching spamhaus-ipv4 list"
|
||||
ip6 saddr @spamhaus-ipv6 counter drop comment "Early drop of incoming packets matching spamhaus-ipv6 list"
|
||||
|
||||
ip saddr @abusech-ipv4 counter drop comment "Early drop of packets matching abusech-ipv4 list"
|
||||
|
||||
ip saddr @abuseipdb-ipv4 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv4 list"
|
||||
ip6 saddr @abuseipdb-ipv6 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv6 list"
|
||||
ip saddr @firehol_level1-ipv4 counter drop comment "Early drop of incoming packets matching firehol_level1-ipv4 list"
|
||||
|
||||
iifname lo accept comment "Allow from loopback"
|
||||
|
||||
@@ -105,12 +70,6 @@ table inet filter {
|
||||
chain output {
|
||||
type filter hook output priority 0;
|
||||
|
||||
ip daddr @spamhaus-ipv4 counter drop comment "Drop outgoing packets matching spamhaus-ipv4 list"
|
||||
ip6 daddr @spamhaus-ipv6 counter drop comment "Drop outgoing packets matching spamhaus-ipv6 list"
|
||||
|
||||
ip daddr @abusech-ipv4 counter drop comment "Drop outgoing packets matching abusech-ipv4 list"
|
||||
|
||||
ip daddr @abuseipdb-ipv4 counter drop comment "Drop outgoing packets matching abuseipdb-ipv4 list"
|
||||
ip6 daddr @abuseipdb-ipv6 counter drop comment "Drop outgoing packets matching abuseipdb-ipv6 list"
|
||||
ip daddr @firehol_level1-ipv4 counter drop comment "Drop outgoing packets matching firehol_level1-ipv4 list"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,81 +0,0 @@
|
||||
<zone>
|
||||
<short>Public</short>
|
||||
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
|
||||
<interface name="{{ ansible_default_ipv4.interface }}"/>
|
||||
|
||||
{# ssh rules #}
|
||||
<rule family="ipv4">
|
||||
<source address="0.0.0.0/0"/>
|
||||
<port protocol="tcp" port="22"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
|
||||
{# ipv6 ssh rules #}
|
||||
<rule family="ipv6">
|
||||
<source address="::/0"/>
|
||||
<port protocol="tcp" port="22"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
|
||||
{# web rules #}
|
||||
<rule family="ipv4">
|
||||
<source address="0.0.0.0/0"/>
|
||||
<port protocol="tcp" port="80"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
|
||||
{# ipv6 web rules #}
|
||||
<rule family="ipv6">
|
||||
<source address="::/0"/>
|
||||
<port protocol="tcp" port="80"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
|
||||
{# munin rules #}
|
||||
{% if munin_master_host is defined %}
|
||||
<rule family="ipv4">
|
||||
<source address="{{ ghetto_ipsets[munin_master_host].src }}"/>
|
||||
<port protocol="tcp" port="{{ munin_node_port }}"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
{% endif %}
|
||||
|
||||
{# extra rules #}
|
||||
{% if extra_iptables_rules is defined %}
|
||||
{% for rule in extra_iptables_rules %}
|
||||
<rule family="ipv4">
|
||||
<source address="{{ ghetto_ipsets[rule.acl].src }}"/>
|
||||
<port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
|
||||
{# ipv6 extra rules #}
|
||||
{% if ghetto_ipsets[rule.acl].ipv6src is defined %}
|
||||
<rule family="ipv6">
|
||||
<source address="{{ ghetto_ipsets[rule.acl].ipv6src }}"/>
|
||||
<port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
|
||||
<accept/>
|
||||
</rule>
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<rule>
|
||||
<source ipset="abusers-ipv4"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
<rule>
|
||||
<source ipset="abusers-ipv6"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
<rule>
|
||||
<source ipset="spamhaus-ipv4"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
<rule>
|
||||
<source ipset="spamhaus-ipv6"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
|
||||
</zone>
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh -e
|
||||
#
|
||||
# rc.local
|
||||
#
|
||||
# This script is executed at the end of each multiuser runlevel.
|
||||
# Make sure that the script will "exit 0" on success or any other
|
||||
# value on error.
|
||||
#
|
||||
# In order to enable or disable this script just change the execution
|
||||
# bits.
|
||||
#
|
||||
# By default this script does nothing.
|
||||
|
||||
exit 0
|
||||
@@ -1,5 +0,0 @@
|
||||
{% if ansible_distribution == 'Ubuntu' %}
|
||||
deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security main restricted universe multiverse
|
||||
{% elif ansible_distribution == 'Debian' %}
|
||||
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}/updates main contrib non-free
|
||||
{% endif %}
|
||||
@@ -1,16 +1,6 @@
|
||||
{% if ansible_distribution == 'Ubuntu' %}
|
||||
{% set apt_mirror = apt_mirror | default("ubuntu.mirror.ac.ke") %}
|
||||
|
||||
deb http://{{ apt_mirror }}/ubuntu/ {{ ansible_distribution_release }} main restricted universe multiverse
|
||||
deb http://{{ apt_mirror }}/ubuntu/ {{ ansible_distribution_release }}-updates main restricted universe multiverse
|
||||
deb http://security.ubuntu.com/ubuntu/ {{ ansible_distribution_release }}-security main restricted universe multiverse
|
||||
|
||||
{% else %}
|
||||
{% set apt_mirror = apt_mirror | default('deb.debian.org') %}
|
||||
deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }} main contrib non-free
|
||||
|
||||
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main contrib non-free
|
||||
|
||||
deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }}-updates main contrib non-free
|
||||
|
||||
{% endif %} {# ansible_distribution #}
|
||||
|
||||
@@ -56,7 +56,11 @@ AuthorizedKeysFile .ssh/authorized_keys
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
{% if ssh_password_authentication == 'disabled' %}
|
||||
PasswordAuthentication no
|
||||
{% else %}
|
||||
PasswordAuthentication yes
|
||||
{% endif %}
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
@@ -131,8 +135,7 @@ Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
|
||||
|
||||
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
||||
# Is there a list of allowed users?
|
||||
|
||||
@@ -1,9 +1,8 @@
|
||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
||||
# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
@@ -18,6 +17,7 @@ Include /etc/ssh/sshd_config.d/*.conf
|
||||
#ListenAddress ::
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
@@ -56,12 +56,16 @@ AuthorizedKeysFile .ssh/authorized_keys
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
{% if ssh_password_authentication == 'disabled' %}
|
||||
PasswordAuthentication no
|
||||
{% else %}
|
||||
PasswordAuthentication yes
|
||||
{% endif %}
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication no
|
||||
KbdInteractiveAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
@@ -77,13 +81,13 @@ ChallengeResponseAuthentication no
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# be allowed through the KbdInteractiveAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# PAM authentication via KbdInteractiveAuthentication may bypass
|
||||
# the setting of "PermitRootLogin prohibit-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
# and KbdInteractiveAuthentication to 'no'.
|
||||
UsePAM yes
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
@@ -101,7 +105,7 @@ PrintMotd no
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
#PidFile /var/run/sshd.pid
|
||||
#PidFile /run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
@@ -114,7 +118,7 @@ PrintMotd no
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
@@ -122,14 +126,16 @@ Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
PasswordAuthentication yes
|
||||
|
||||
# Originally from: https://stribika.github.io/2015/01/04/secure-secure-shell.html
|
||||
# ... but with ciphers and MACs with < 256 bits removed, as NSA's Suite B now
|
||||
# does away with these! See: https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
|
||||
# Based on the ssh-audit profile for OpenSSH 9.2, but with but with all algos
|
||||
# with less than 256 bits removed, as NSA's Suite B removed them years ago and
|
||||
# the new (2018) CNSA suite is 256 bits and up.
|
||||
#
|
||||
# See: https://github.com/jtesta/ssh-audit/blob/master/src/ssh_audit/policy.py
|
||||
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
|
||||
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
|
||||
|
||||
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
||||
# Is there a list of allowed users?
|
||||
@@ -1,133 +0,0 @@
|
||||
# $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
# possible, but leave them commented. Uncommented options override the
|
||||
# default value.
|
||||
|
||||
#Port 22
|
||||
#AddressFamily any
|
||||
#ListenAddress 0.0.0.0
|
||||
#ListenAddress ::
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
#RekeyLimit default none
|
||||
|
||||
# Logging
|
||||
#SyslogFacility AUTH
|
||||
# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear audit track of which key was using to log in.
|
||||
LogLevel VERBOSE
|
||||
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
PermitRootLogin prohibit-password
|
||||
#StrictModes yes
|
||||
MaxAuthTries 4
|
||||
#MaxSessions 10
|
||||
|
||||
#PubkeyAuthentication yes
|
||||
|
||||
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
|
||||
# but this is overridden so installations will only check .ssh/authorized_keys
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
|
||||
#AuthorizedPrincipalsFile none
|
||||
|
||||
#AuthorizedKeysCommand none
|
||||
#AuthorizedKeysCommandUser nobody
|
||||
|
||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||
#HostbasedAuthentication no
|
||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||
# HostbasedAuthentication
|
||||
#IgnoreUserKnownHosts no
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
#KerberosGetAFSToken no
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
#GSSAPIStrictAcceptorCheck yes
|
||||
#GSSAPIKeyExchange no
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
UsePAM yes
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
#AllowTcpForwarding yes
|
||||
#GatewayPorts no
|
||||
X11Forwarding no
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
PrintMotd no
|
||||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#UseLogin no
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
|
||||
# Allow client to pass locale environment variables
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
|
||||
# Originally from: https://stribika.github.io/2015/01/04/secure-secure-shell.html
|
||||
# ... but with ciphers and MACs with < 256 bits removed, as NSA's Suite B now
|
||||
# does away with these! See: https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
|
||||
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
|
||||
|
||||
# only allow shell access by provisioning user
|
||||
AllowUsers {{ provisioning_user.name }}
|
||||
@@ -1,100 +0,0 @@
|
||||
#
|
||||
# /etc/sysctl.conf - Configuration file for setting system variables
|
||||
# See /etc/sysctl.d/ for additional system variables
|
||||
# See sysctl.conf (5) for information.
|
||||
#
|
||||
|
||||
#kernel.domainname = example.com
|
||||
|
||||
# Uncomment the following to stop low-level messages on console
|
||||
#kernel.printk = 3 4 1 3
|
||||
|
||||
##############################################################3
|
||||
# Functions previously found in netbase
|
||||
#
|
||||
|
||||
# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
|
||||
# Turn on Source Address Verification in all interfaces to
|
||||
# prevent some spoofing attacks
|
||||
#net.ipv4.conf.default.rp_filter=1
|
||||
#net.ipv4.conf.all.rp_filter=1
|
||||
|
||||
# Uncomment the next line to enable TCP/IP SYN cookies
|
||||
# See http://lwn.net/Articles/277146/
|
||||
# Note: This may impact IPv6 TCP sessions too
|
||||
#net.ipv4.tcp_syncookies=1
|
||||
|
||||
# Uncomment the next line to enable packet forwarding for IPv4
|
||||
#net.ipv4.ip_forward=1
|
||||
|
||||
# Uncomment the next line to enable packet forwarding for IPv6
|
||||
# Enabling this option disables Stateless Address Autoconfiguration
|
||||
# based on Router Advertisements for this host
|
||||
#net.ipv6.conf.all.forwarding=1
|
||||
|
||||
|
||||
###################################################################
|
||||
# Additional settings - these settings can improve the network
|
||||
# security of the host and prevent against some network attacks
|
||||
# including spoofing attacks and man in the middle attacks through
|
||||
# redirection. Some network environments, however, require that these
|
||||
# settings are disabled so review and enable them as needed.
|
||||
#
|
||||
# Do not accept ICMP redirects (prevent MITM attacks)
|
||||
#net.ipv4.conf.all.accept_redirects = 0
|
||||
#net.ipv6.conf.all.accept_redirects = 0
|
||||
# _or_
|
||||
# Accept ICMP redirects only for gateways listed in our default
|
||||
# gateway list (enabled by default)
|
||||
# net.ipv4.conf.all.secure_redirects = 1
|
||||
#
|
||||
# Do not send ICMP redirects (we are not a router)
|
||||
#net.ipv4.conf.all.send_redirects = 0
|
||||
#
|
||||
# Do not accept IP source route packets (we are not a router)
|
||||
#net.ipv4.conf.all.accept_source_route = 0
|
||||
#net.ipv6.conf.all.accept_source_route = 0
|
||||
#
|
||||
# Log Martian Packets
|
||||
#net.ipv4.conf.all.log_martians = 1
|
||||
#
|
||||
|
||||
# CIS Benchmark Adjustments
|
||||
# See: https://github.com/alanorth/securekickstarts
|
||||
kernel.randomize_va_space = 2
|
||||
net.ipv4.ip_forward = 0
|
||||
net.ipv4.conf.all.send_redirects = 0
|
||||
net.ipv4.conf.default.send_redirects = 0
|
||||
net.ipv4.conf.all.accept_source_route = 0
|
||||
net.ipv4.conf.default.accept_source_route = 0
|
||||
net.ipv4.conf.all.accept_redirects = 0
|
||||
net.ipv4.conf.default.accept_redirects = 0
|
||||
net.ipv4.conf.all.secure_redirects = 0
|
||||
net.ipv4.conf.default.secure_redirects = 0
|
||||
net.ipv4.conf.all.log_martians = 1
|
||||
net.ipv4.conf.default.log_martians = 1
|
||||
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
||||
net.ipv4.icmp_ignore_bogus_error_responses = 1
|
||||
net.ipv4.conf.all.rp_filter = 1
|
||||
net.ipv4.conf.default.rp_filter = 1
|
||||
net.ipv4.tcp_syncookies = 1
|
||||
|
||||
# TCP stuff
|
||||
# See: http://fasterdata.es.net/host-tuning/linux/
|
||||
# increase TCP max buffer size settable using setsockopt()
|
||||
net.core.rmem_max = 16777216
|
||||
net.core.wmem_max = 16777216
|
||||
# increase Linux autotuning TCP buffer limit
|
||||
net.ipv4.tcp_rmem = 4096 87380 16777216
|
||||
net.ipv4.tcp_wmem = 4096 65536 16777216
|
||||
# increase the length of the processor input queue
|
||||
net.core.netdev_max_backlog = 30000
|
||||
# recommended for hosts with jumbo frames enabled
|
||||
#net.ipv4.tcp_mtu_probing=1
|
||||
|
||||
# increase quadruplets (src ip, src port, dest ip, dest port)
|
||||
# see: http://vincent.bernat.im/en/blog/2014-tcp-time-wait-state-linux.html
|
||||
net.ipv4.ip_local_port_range = 10240 65535
|
||||
# recommended for web servers, especially if running SPDY
|
||||
# see: http://www.chromium.org/spdy/spdy-best-practices
|
||||
net.ipv4.tcp_slow_start_after_idle = 0
|
||||
@@ -1 +1 @@
|
||||
deb [arch=amd64] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./
|
||||
deb [arch=amd64 signed-by=/etc/apt/keyrings/tarsnap-deb-packaging-key.asc] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./
|
||||
|
||||
65
roles/common/templates/update-firehol-nftables.sh.j2
Executable file
65
roles/common/templates/update-firehol-nftables.sh.j2
Executable file
@@ -0,0 +1,65 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-firehol-nftables.sh v0.0.1
|
||||
#
|
||||
# Download FireHOL lists and load them into nftables sets.
|
||||
#
|
||||
# See: https://iplists.firehol.org/
|
||||
#
|
||||
# Copyright (C) 2025 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
firehol_level1_ipv4_set_path=/etc/nftables/firehol_level1-ipv4.nft
|
||||
|
||||
function download() {
|
||||
echo "Downloading $1"
|
||||
wget -q -O - "https://iplists.firehol.org/files/$1" > "$1"
|
||||
}
|
||||
|
||||
download firehol_level1.netset
|
||||
|
||||
if [[ -f "firehol_level1.netset" ]]; then
|
||||
echo "Processing FireHOL Level 1 list"
|
||||
|
||||
firehol_level1_ipv4_list_temp=$(mktemp)
|
||||
firehol_level1_ipv4_set_temp=$(mktemp)
|
||||
|
||||
# Filter blank lines, comments, and bogons we use inside the LAN, DMZ, and
|
||||
# for local services like systemd-resolved and others on localhost. Ideally
|
||||
# these are blocked already at the WAN side by network administrators.
|
||||
cat firehol_level1.netset \
|
||||
| sed \
|
||||
-e '/^$/d' \
|
||||
-e '/^#.*/d' \
|
||||
-e '/^127\.0\.0\.0\/8/d' \
|
||||
> "$firehol_level1_ipv4_list_temp"
|
||||
|
||||
echo "Building firehol_level1-ipv4 set"
|
||||
cat << NFT_HEAD > "$firehol_level1_ipv4_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define FIREHOL_LEVEL1_IPV4 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
# nftables doesn't mind if the last element in the set has a trailing
|
||||
# comma so we don't need to do anything special here.
|
||||
echo "$network," >> "$firehol_level1_ipv4_set_temp"
|
||||
done < $firehol_level1_ipv4_list_temp
|
||||
|
||||
echo "}" >> "$firehol_level1_ipv4_set_temp"
|
||||
|
||||
install -m 0600 "$firehol_level1_ipv4_set_temp" "$firehol_level1_ipv4_set_path"
|
||||
|
||||
rm -f "$firehol_level1_ipv4_list_temp" "$firehol_level1_ipv4_set_temp"
|
||||
fi
|
||||
|
||||
echo "Restarting nftables"
|
||||
|
||||
/usr/bin/systemctl restart nftables.service
|
||||
|
||||
rm -v firehol_level1.netset
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
# file: roles/mariadb/defaults/main.yml
|
||||
# ansible.builtin.file: roles/mariadb/defaults/main.yml
|
||||
#
|
||||
# Based on my running of mysqltuner.pl on a host with three WordPress databases
|
||||
#
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
---
|
||||
- name: restart mariadb
|
||||
systemd: name=mariadb state=restarted
|
||||
ansible.builtin.systemd_service:
|
||||
name: mariadb
|
||||
state: restarted
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,57 +1,111 @@
|
||||
---
|
||||
- name: Add GPG key for MariaDB repo
|
||||
apt_key: id=0x177F4010FE56CA3336300305F1656F24C74CD1D8 url=https://mariadb.org/mariadb_release_signing_key.asc
|
||||
register: add_mariadb_apt_key
|
||||
tags: mariadb, packages
|
||||
- name: Remove MariaDB key from apt-key
|
||||
ansible.builtin.apt_key:
|
||||
id: "013577200103762554506315430003013705453362230723150730"
|
||||
state: absent
|
||||
tags:
|
||||
- packages
|
||||
- mariadb
|
||||
|
||||
- name: Add MariaDB 10.5 repo
|
||||
template: src=mariadb.list.j2 dest=/etc/apt/sources.list.d/mariadb.list owner=root group=root mode=0644
|
||||
- name: Check MariaDB package signing key
|
||||
ansible.builtin.stat:
|
||||
path: /etc/apt/keyrings/mariadb_release_signing_key.asc
|
||||
register: mariadb_signing_key_stat
|
||||
tags:
|
||||
- packages
|
||||
- mariadb
|
||||
|
||||
- name: Download MariaDB package signing key
|
||||
when: not mariadb_signing_key_stat.stat.exists
|
||||
ansible.builtin.get_url:
|
||||
url: https://mariadb.org/mariadb_release_signing_key.asc
|
||||
dest: /etc/apt/keyrings/mariadb_release_signing_key.asc
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: download_mariadb_signing_key
|
||||
tags:
|
||||
- packages
|
||||
- mariadb
|
||||
|
||||
- name: Add MariaDB 10.11 repo
|
||||
ansible.builtin.apt_repository:
|
||||
repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/mariadb_release_signing_key.asc] https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/debian {{ ansible_distribution_release
|
||||
}} main
|
||||
filename: mariadb
|
||||
state: present
|
||||
register: add_mariadb_apt_repository
|
||||
tags: mariadb, packages
|
||||
tags:
|
||||
- packages
|
||||
- mariadb
|
||||
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
when:
|
||||
add_mariadb_apt_key is changed or
|
||||
add_mariadb_apt_repository is changed
|
||||
when: (download_mariadb_signing_key.status_code is defined and download_mariadb_signing_key.status_code == 200) or add_mariadb_apt_repository is changed
|
||||
ansible.builtin.apt: # noqa no-handler
|
||||
update_cache: true
|
||||
tags:
|
||||
- packages
|
||||
- mariadb
|
||||
|
||||
- name: Install mariadb-server
|
||||
apt: name={{ item }} state=present cache_valid_time=3600
|
||||
loop:
|
||||
- mariadb-server
|
||||
- python3-pymysql # for ansible
|
||||
ansible.builtin.apt:
|
||||
name: [mariadb-server, python3-pymysql]
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
tags: mariadb, packages
|
||||
|
||||
- name: Create system my.cnf
|
||||
template: src=my.cnf.j2 dest=/etc/mysql/my.cnf owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: my.cnf.j2
|
||||
dest: /etc/mysql/my.cnf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify:
|
||||
- restart mariadb
|
||||
tags: mariadb
|
||||
|
||||
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_user_module.html
|
||||
- name: Update MariaDB root password for all root accounts
|
||||
mysql_user: name=root host={{ item }} password={{ mariadb_root_password }} login_unix_socket={{ mariadb_login_unix_socket }}
|
||||
community.mysql.mysql_user:
|
||||
name: root
|
||||
host: "{{ item }}"
|
||||
password: "{{ mariadb_root_password }}"
|
||||
login_unix_socket: "{{ mariadb_login_unix_socket }}"
|
||||
loop:
|
||||
- 127.0.0.1
|
||||
- ::1
|
||||
tags: mariadb
|
||||
|
||||
- name: Create .my.conf file with root credentials
|
||||
template: src=.my.cnf.j2 dest=/root/.my.cnf owner=root mode=0600
|
||||
ansible.builtin.template:
|
||||
src: .my.cnf.j2
|
||||
dest: /root/.my.cnf
|
||||
owner: root
|
||||
mode: "0600"
|
||||
tags: mariadb
|
||||
|
||||
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_db_module.html
|
||||
- name: Create MariaDB database(s)
|
||||
mysql_db: db={{ item.name }} state=present encoding=utf8mb4 login_unix_socket={{ mariadb_login_unix_socket }}
|
||||
loop: "{{ mariadb_databases }}"
|
||||
when: mariadb_databases is defined
|
||||
community.mysql.mysql_db:
|
||||
db: "{{ item.name }}"
|
||||
state: present
|
||||
encoding: utf8mb4
|
||||
login_unix_socket: "{{ mariadb_login_unix_socket }}"
|
||||
loop: "{{ mariadb_databases }}"
|
||||
tags: mariadb
|
||||
|
||||
- name: Create MariaDB user(s)
|
||||
mysql_user: name={{ item.user }} password={{ item.pass }} priv={{ item.name }}.*:ALL host=127.0.0.1 state=present login_unix_socket={{ mariadb_login_unix_socket }}
|
||||
loop: "{{ mariadb_databases }}"
|
||||
when: mariadb_databases is defined
|
||||
community.mysql.mysql_user:
|
||||
name: "{{ item.user }}"
|
||||
password: "{{ item.pass }}"
|
||||
priv: "{{ item.name }}.*:ALL"
|
||||
host: 127.0.0.1
|
||||
state: present
|
||||
login_unix_socket: "{{ mariadb_login_unix_socket }}"
|
||||
loop: "{{ mariadb_databases }}"
|
||||
tags: mariadb
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
deb [arch=amd64] http://mirror.23media.de/mariadb/repo/10.5/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} main
|
||||
@@ -1,4 +1,4 @@
|
||||
---
|
||||
# file: roles/munin/handlers/main.yml
|
||||
# ansible.builtin.file: roles/munin/handlers/main.yml
|
||||
- name: restart munin-node
|
||||
systemd: name=munin-node state=restarted
|
||||
ansible.builtin.systemd_service: name=munin-node state=restarted
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
- name: Configure munin scraper
|
||||
import_tasks: munin.yml
|
||||
ansible.builtin.import_tasks: munin.yml
|
||||
tags: munin
|
||||
|
||||
- name: Configure munin listener
|
||||
import_tasks: munin-node.yml
|
||||
ansible.builtin.import_tasks: munin-node.yml
|
||||
tags: munin-node
|
||||
|
||||
@@ -1,25 +1,34 @@
|
||||
---
|
||||
- name: Install munin-node
|
||||
apt: name=munin-node state=present
|
||||
ansible.builtin.apt:
|
||||
name: munin-node
|
||||
state: present
|
||||
tags: packages
|
||||
|
||||
# some nice things to have for munin-node on Ubuntu
|
||||
# libwww-perl: for munin's nginx_status check
|
||||
- name: Install munin-node deps
|
||||
apt: name=libwww-perl state=present
|
||||
ansible.builtin.apt:
|
||||
name: libwww-perl
|
||||
state: present
|
||||
tags: packages
|
||||
|
||||
- name: Create munin-node.conf
|
||||
template: src=munin-node.conf.j2 dest=/etc/munin/munin-node.conf
|
||||
ansible.builtin.template:
|
||||
src: munin-node.conf.j2
|
||||
dest: /etc/munin/munin-node.conf
|
||||
notify:
|
||||
- restart munin-node
|
||||
|
||||
- name: Configure munin-node
|
||||
shell: munin-node-configure --shell --families=contrib,auto | sh -x
|
||||
ansible.builtin.shell: munin-node-configure --shell --families=contrib,auto | sh -x
|
||||
notify:
|
||||
- restart munin-node
|
||||
|
||||
- name: Start munin-node
|
||||
systemd: name=munin-node state=started enabled=true
|
||||
ansible.builtin.systemd_service:
|
||||
name: munin-node
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,9 +1,16 @@
|
||||
---
|
||||
- name: Install munin package
|
||||
apt: name=munin state=present
|
||||
ansible.builtin.apt:
|
||||
name: munin
|
||||
state: present
|
||||
tags: packages
|
||||
|
||||
- name: Create munin configuration file
|
||||
template: src=munin.conf.j2 dest=/etc/munin/munin.conf owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: munin.conf.j2
|
||||
dest: /etc/munin/munin.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,32 +1,32 @@
|
||||
---
|
||||
# file: roles/nginx/defaults/main.yml
|
||||
# ansible.builtin.file: roles/nginx/defaults/main.yml
|
||||
|
||||
# path config
|
||||
nginx_confd_path: /etc/nginx/conf.d
|
||||
|
||||
# parent directory of vhost roots
|
||||
nginx_root_prefix: /var/www
|
||||
nginx_root_prefix: "{{ web_root_prefix }}"
|
||||
|
||||
# 1 hour timeout
|
||||
nginx_ssl_session_timeout: 1h
|
||||
# 1 day timeout
|
||||
nginx_ssl_session_timeout: 1d
|
||||
# 10MB -> 40,000 sessions
|
||||
nginx_ssl_session_cache: shared:SSL:10m
|
||||
# 1400 bytes to fit in one MTU (default is 16k!)
|
||||
nginx_ssl_buffer_size: 1400
|
||||
nginx_ssl_buffer_size: 4k
|
||||
nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
|
||||
nginx_ssl_protocols: 'TLSv1.2 TLSv1.3'
|
||||
nginx_ssl_protocols: TLSv1.2 TLSv1.3
|
||||
nginx_ssl_ecdh_curve: X25519:prime256v1:secp384r1
|
||||
|
||||
# DNS resolvers for OCSP stapling (default to Cloudflare public DNS)
|
||||
# See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
|
||||
nginx_ssl_stapling_resolver: '1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]'
|
||||
nginx_ssl_stapling_resolver: 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]
|
||||
|
||||
# HTTP Strict-Transport-Security header, recommended by Google to be ~1 year
|
||||
# in seconds, see: https://hstspreload.org/
|
||||
nginx_hsts_max_age: 31536000
|
||||
|
||||
# install acme.sh?
|
||||
# True unless you're in development and using "localhost" + snakeoil certs
|
||||
use_letsencrypt: True
|
||||
# true unless you're in development and using "localhost" + snakeoil certs
|
||||
use_letsencrypt: true
|
||||
|
||||
# Directory root for Let's Encrypt certs
|
||||
letsencrypt_root: /etc/ssl
|
||||
@@ -37,8 +37,8 @@ letsencrypt_root: /etc/ssl
|
||||
letsencrypt_acme_script_temp: /root/acme.sh
|
||||
letsencrypt_acme_home: /root/.acme.sh
|
||||
|
||||
# stable is 1.20.x
|
||||
# mainline is 1.21.x
|
||||
# stable is 1.26.x
|
||||
# mainline is 1.27.x
|
||||
nginx_version: mainline
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
---
|
||||
- name: reload nginx
|
||||
systemd: name=nginx state=reloaded
|
||||
- name: Reload nginx
|
||||
ansible.builtin.systemd_service:
|
||||
name: nginx
|
||||
state: reloaded
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,89 +1,91 @@
|
||||
---
|
||||
|
||||
# Use acme.sh instead of certbot because they only support installation via
|
||||
# snap now.
|
||||
- block:
|
||||
- name: Remove certbot
|
||||
apt:
|
||||
name: certbot
|
||||
state: absent
|
||||
|
||||
- name: Remove old certbot post and pre hooks for nginx
|
||||
file:
|
||||
dest: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
|
||||
- /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
|
||||
|
||||
- name: Check if acme.sh is installed
|
||||
stat:
|
||||
path: "{{ letsencrypt_acme_home }}"
|
||||
register: acme_home
|
||||
|
||||
- name: Download acme.sh
|
||||
get_url:
|
||||
url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
|
||||
dest: "{{ letsencrypt_acme_script_temp }}"
|
||||
mode: 0700
|
||||
register: acme_download
|
||||
when: not acme_home.stat.exists
|
||||
|
||||
# Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
|
||||
# have to chdir to the /root directory where the script exists or else it
|
||||
# fails. Ansible runs it, but the script can't find itself...).
|
||||
- name: Install acme.sh
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
|
||||
creates: "{{ letsencrypt_acme_home }}/acme.sh"
|
||||
chdir: /root
|
||||
register: acme_install
|
||||
when: acme_download is changed
|
||||
|
||||
- name: Remove temporary acme.sh script
|
||||
file:
|
||||
dest: "{{ letsencrypt_acme_script_temp }}"
|
||||
state: absent
|
||||
when: acme_install.rc is defined and acme_install.rc == 0
|
||||
|
||||
- name: Set default certificate authority for acme.sh
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"
|
||||
|
||||
- name: Prepare Let's Encrypt well-known directory
|
||||
file:
|
||||
state: directory
|
||||
path: /var/lib/letsencrypt/.well-known
|
||||
owner: root
|
||||
group: nginx
|
||||
mode: g+s
|
||||
|
||||
- name: Copy systemd service to renew Let's Encrypt certs
|
||||
template:
|
||||
src: renew-letsencrypt.service.j2
|
||||
dest: /etc/systemd/system/renew-letsencrypt.service
|
||||
mode: 0644
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Copy systemd timer to renew Let's Encrypt certs
|
||||
copy:
|
||||
src: renew-letsencrypt.timer
|
||||
dest: /etc/systemd/system/renew-letsencrypt.timer
|
||||
mode: 0644
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
# always issues daemon-reload just in case the service/timer changed
|
||||
- name: Start and enable systemd timer to renew Let's Encrypt certs
|
||||
systemd:
|
||||
name: renew-letsencrypt.timer
|
||||
state: started
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
|
||||
when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '=='))
|
||||
or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
|
||||
- name: Install and configure Let's Encrypt
|
||||
tags: letsencrypt
|
||||
when:
|
||||
- ansible_distribution == 'Debian'
|
||||
- ansible_distribution_version is version('11', '>='))
|
||||
block:
|
||||
- name: Remove certbot
|
||||
ansible.builtin.apt:
|
||||
name: certbot
|
||||
state: absent
|
||||
|
||||
- name: Remove old certbot post and pre hooks for nginx
|
||||
ansible.builtin.file:
|
||||
dest: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
|
||||
- /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
|
||||
|
||||
- name: Check if acme.sh is installed
|
||||
ansible.builtin.stat:
|
||||
path: "{{ letsencrypt_acme_home }}"
|
||||
register: acme_home
|
||||
|
||||
- name: Download acme.sh
|
||||
when: not acme_home.stat.exists
|
||||
ansible.builtin.get_url:
|
||||
url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
|
||||
dest: "{{ letsencrypt_acme_script_temp }}"
|
||||
mode: "0700"
|
||||
register: acme_download
|
||||
|
||||
# Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
|
||||
# have to chdir to the /root directory where the script exists or else it
|
||||
# fails. Ansible runs it, but the script can't find itself...).
|
||||
- name: Install acme.sh
|
||||
when: acme_download is changed
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
|
||||
creates: "{{ letsencrypt_acme_home }}/acme.sh"
|
||||
chdir: /root
|
||||
register: acme_install
|
||||
|
||||
- name: Remove temporary acme.sh script
|
||||
when:
|
||||
- acme_install.rc is defined
|
||||
- acme_install.rc == 0
|
||||
ansible.builtin.file:
|
||||
dest: "{{ letsencrypt_acme_script_temp }}"
|
||||
state: absent
|
||||
|
||||
- name: Set default certificate authority for acme.sh
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"
|
||||
|
||||
- name: Prepare Let's Encrypt well-known directory
|
||||
ansible.builtin.file:
|
||||
state: directory
|
||||
path: /var/lib/letsencrypt/.well-known
|
||||
owner: root
|
||||
group: nginx
|
||||
mode: g+s
|
||||
|
||||
- name: Copy systemd service to renew Let's Encrypt certs
|
||||
ansible.builtin.template:
|
||||
src: renew-letsencrypt.service.j2
|
||||
dest: /etc/systemd/system/renew-letsencrypt.service
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Copy systemd timer to renew Let's Encrypt certs
|
||||
ansible.builtin.copy:
|
||||
src: renew-letsencrypt.timer
|
||||
dest: /etc/systemd/system/renew-letsencrypt.timer
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
# always issues daemon-reload just in case the service/timer changed
|
||||
- name: Start and enable systemd timer to renew Let's Encrypt certs
|
||||
ansible.builtin.systemd_service:
|
||||
name: renew-letsencrypt.timer
|
||||
state: started
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,76 +1,132 @@
|
||||
---
|
||||
- name: Add nginx.org apt signing key
|
||||
apt_key: id=0x573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 url=https://nginx.org/keys/nginx_signing.key state=present
|
||||
register: add_nginx_apt_key
|
||||
tags: nginx, packages
|
||||
- name: Remove nginx apt signing key from apt-key
|
||||
ansible.builtin.apt_key:
|
||||
id: "053473772654754373614404074646527257655730117366337542"
|
||||
state: absent
|
||||
tags:
|
||||
- packages
|
||||
- nginx
|
||||
|
||||
- name: Download nginx apt signing key
|
||||
ansible.builtin.get_url:
|
||||
url: https://nginx.org/keys/nginx_signing.key
|
||||
dest: /usr/share/keyrings/nginx_signing.key
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
checksum: sha256:55385da31d198fa6a5012d40ae98ecb272a6c4e8fffffba94719ffd3e87de37a
|
||||
register: download_nginx_signing_key
|
||||
tags:
|
||||
- packages
|
||||
- nginx
|
||||
|
||||
- name: Add nginx.org repo
|
||||
template: src=nginx_org_sources.list.j2 dest=/etc/apt/sources.list.d/nginx_org_sources.list owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: nginx_org_sources.list.j2
|
||||
dest: /etc/apt/sources.list.d/nginx_org_sources.list
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: add_nginx_apt_repository
|
||||
tags: nginx, packages
|
||||
tags:
|
||||
- nginx
|
||||
- packages
|
||||
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
when:
|
||||
add_nginx_apt_key is changed or
|
||||
add_nginx_apt_repository is changed
|
||||
when: (download_nginx_signing_key.status_code is defined and download_nginx_signing_key.status_code == 200) or add_nginx_apt_repository is changed
|
||||
ansible.builtin.apt: # noqa no-handler
|
||||
update_cache: true
|
||||
|
||||
- name: Install nginx
|
||||
apt: pkg=nginx cache_valid_time=3600 state=present
|
||||
tags: nginx, packages
|
||||
ansible.builtin.apt:
|
||||
pkg: nginx
|
||||
cache_valid_time: 3600
|
||||
state: present
|
||||
tags:
|
||||
- nginx
|
||||
- packages
|
||||
|
||||
- name: Copy nginx.conf
|
||||
template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf mode=0644 owner=root group=root
|
||||
ansible.builtin.template:
|
||||
src: nginx.conf.j2
|
||||
dest: /etc/nginx/nginx.conf
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- reload nginx
|
||||
- Reload nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Copy extra nginx configs
|
||||
copy: src={{ item }} dest=/etc/nginx/{{ item }} mode=0644 owner=root group=root
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item }}"
|
||||
dest: /etc/nginx/{{ item }}
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
loop:
|
||||
- extra-security.conf
|
||||
- fastcgi_cache
|
||||
notify:
|
||||
- reload nginx
|
||||
- Reload nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Remove default nginx vhost
|
||||
file: path=/etc/nginx/conf.d/default.conf state=absent
|
||||
ansible.builtin.file:
|
||||
path: /etc/nginx/conf.d/default.conf
|
||||
state: absent
|
||||
tags: nginx
|
||||
|
||||
- name: Create fastcgi cache dir
|
||||
file: path=/var/cache/nginx/cached/fastcgi state=directory owner=nginx group=nginx mode=0755
|
||||
ansible.builtin.file:
|
||||
path: /var/cache/nginx/cached/fastcgi
|
||||
state: directory
|
||||
owner: nginx
|
||||
group: nginx
|
||||
mode: "0755"
|
||||
tags: nginx
|
||||
|
||||
- name: Configure nginx virtual hosts
|
||||
include_tasks: vhosts.yml
|
||||
when: nginx_vhosts is defined
|
||||
ansible.builtin.include_tasks: vhosts.yml
|
||||
tags: nginx
|
||||
|
||||
- name: Configure WordPress
|
||||
include_tasks: wordpress.yml
|
||||
when: nginx_vhosts is defined
|
||||
ansible.builtin.include_tasks: wordpress.yml
|
||||
tags: wordpress
|
||||
|
||||
- name: Configure blank nginx vhost
|
||||
template: src=blank-vhost.conf.j2 dest={{ nginx_confd_path }}/blank-vhost.conf mode=0644 owner=root group=root
|
||||
ansible.builtin.template:
|
||||
src: blank-vhost.conf.j2
|
||||
dest: "{{ nginx_confd_path }}/blank-vhost.conf"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- reload nginx
|
||||
- Reload nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Configure munin vhost
|
||||
copy: src=munin.conf dest=/etc/nginx/conf.d/munin.conf mode=0644 owner=root group=root
|
||||
ansible.builtin.copy:
|
||||
src: munin.conf
|
||||
dest: /etc/nginx/conf.d/munin.conf
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- reload nginx
|
||||
- Reload nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Start and enable nginx service
|
||||
systemd: name=nginx state=started enabled=yes
|
||||
ansible.builtin.systemd_service:
|
||||
name: nginx
|
||||
state: started
|
||||
enabled: true
|
||||
tags: nginx
|
||||
|
||||
- name: Configure Let's Encrypt
|
||||
include_tasks: letsencrypt.yml
|
||||
ansible.builtin.include_tasks: letsencrypt.yml
|
||||
tags: letsencrypt
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,29 +1,40 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Configure https vhosts
|
||||
template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
notify:
|
||||
- reload nginx
|
||||
|
||||
- name: Generate self-signed TLS cert
|
||||
command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
|
||||
notify:
|
||||
- reload nginx
|
||||
|
||||
- name: Download 4096-bit RFC 7919 dhparams
|
||||
get_url:
|
||||
url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
|
||||
checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
|
||||
dest: "{{ nginx_ssl_dhparam }}"
|
||||
notify:
|
||||
- reload nginx
|
||||
|
||||
# TODO: this could break because we can override the document root in host vars
|
||||
- name: Create vhost document roots
|
||||
file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
- name: Configure https vhosts
|
||||
tags: nginx
|
||||
block:
|
||||
- name: Configure https vhosts
|
||||
ansible.builtin.template:
|
||||
src: vhost.conf.j2
|
||||
dest: "{{ nginx_confd_path }}/{{ item.domain_name }}.conf"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
notify:
|
||||
- Reload nginx
|
||||
|
||||
- name: Generate self-signed TLS cert
|
||||
ansible.builtin.command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key
|
||||
-out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
|
||||
notify:
|
||||
- Reload nginx
|
||||
|
||||
- name: Download 4096-bit RFC 7919 dhparams
|
||||
ansible.builtin.get_url:
|
||||
url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
|
||||
checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
|
||||
dest: "{{ nginx_ssl_dhparam }}"
|
||||
notify:
|
||||
- Reload nginx
|
||||
|
||||
# TODO: this could break because we can override the document root in host vars
|
||||
- name: Create vhost document roots
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_root_prefix }}/{{ item.domain_name }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
owner: nginx
|
||||
group: nginx
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -1,15 +1,29 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Install WordPress
|
||||
git: repo=https://github.com/WordPress/WordPress.git dest={{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress version={{ item.wordpress_version }} depth=1 force=yes
|
||||
when: item.has_wordpress is defined and item.has_wordpress
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
|
||||
- name: Fix WordPress directory permissions
|
||||
file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory owner=nginx group=nginx recurse=yes
|
||||
when: item.has_wordpress is defined and item.has_wordpress
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
- name: Install and configure WordPress
|
||||
tags: wordpress
|
||||
block:
|
||||
- name: Install WordPress
|
||||
when:
|
||||
- item.has_wordpress is defined
|
||||
- item.has_wordpress
|
||||
ansible.builtin.git:
|
||||
repo: https://github.com/WordPress/WordPress.git
|
||||
dest: "{{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress"
|
||||
version: "{{ item.wordpress_version }}"
|
||||
depth: 1
|
||||
force: true
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
|
||||
- name: Fix WordPress directory permissions
|
||||
when:
|
||||
- item.has_wordpress is defined
|
||||
- item.has_wordpress
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_root_prefix }}/{{ item.domain_name }}"
|
||||
state: directory
|
||||
owner: nginx
|
||||
group: nginx
|
||||
recurse: true
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@@ -11,9 +11,11 @@ server {
|
||||
|
||||
return 444;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2 default_server;
|
||||
listen [::]:443 ssl http2 default_server;
|
||||
listen 443 ssl default_server;
|
||||
listen [::]:443 ssl default_server;
|
||||
http2 on;
|
||||
server_name _;
|
||||
|
||||
# self-signed "snakeoil" certificate
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{# helper variables and per-site defaults that we can't set in role defaults #}
|
||||
{% set domain_name = item.domain_name %}
|
||||
{# assume HSTS is off unless a vhost explicitly sets it to True #}
|
||||
{% set enable_hsts = item.enable_hsts | default(False) %}
|
||||
{# assume HSTS is off unless a vhost explicitly sets it to true #}
|
||||
{% set enable_hsts = item.enable_hsts | default(false) %}
|
||||
|
||||
{# first, check if the current vhost has a custom cert (perhaps self-signed) #}
|
||||
{% if item.tls_certificate_path is defined and item.tls_key_path is defined %}
|
||||
@@ -27,27 +27,19 @@
|
||||
|
||||
ssl_dhparam {{ nginx_ssl_dhparam }};
|
||||
ssl_protocols {{ nginx_ssl_protocols }};
|
||||
ssl_ecdh_curve {{ nginx_ssl_ecdh_curve }};
|
||||
ssl_ciphers "{{ tls_cipher_suite }}";
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
{# OSCP stapling only works with real certs #}
|
||||
{% if use_letsencrypt == True or item.tls_certificate_path %}
|
||||
{% if use_letsencrypt == true or item.tls_certificate_path %}
|
||||
# OCSP stapling...
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
resolver {{ nginx_ssl_stapling_resolver }};
|
||||
{% endif %} {# end: use_letsencrypt #}
|
||||
|
||||
# nginx does not auto-rotate session ticket keys: only a HUP / restart will do so and
|
||||
# when a restart is performed the previous key is lost, which resets all previous
|
||||
# sessions. The fix for this is to setup a manual rotation mechanism:
|
||||
# http://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx
|
||||
#
|
||||
# Note that you'll have to define and rotate the keys securely by yourself. In absence
|
||||
# of such infrastructure, consider turning off session tickets:
|
||||
ssl_session_tickets off;
|
||||
|
||||
{% if enable_hsts == True %}
|
||||
{% if enable_hsts == true %}
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
|
||||
@@ -1,19 +1,7 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
{% if ansible_distribution == 'Ubuntu' %}
|
||||
|
||||
{% if nginx_version == "stable" %}
|
||||
deb [arch=amd64] https://nginx.org/packages/ubuntu/ {{ ansible_distribution_release }} nginx
|
||||
deb [arch=amd64 signed-by=/usr/share/keyrings/nginx_signing.key] https://nginx.org/packages/debian/ {{ ansible_distribution_release }} nginx
|
||||
{% elif nginx_version == "mainline" %}
|
||||
deb [arch=amd64] https://nginx.org/packages/mainline/ubuntu/ {{ ansible_distribution_release }} nginx
|
||||
{% endif %}
|
||||
|
||||
{% elif ansible_distribution == 'Debian' %}
|
||||
|
||||
{% if nginx_version == "stable" %}
|
||||
deb [arch=amd64] https://nginx.org/packages/debian/ {{ ansible_distribution_release }} nginx
|
||||
{% elif nginx_version == "mainline" %}
|
||||
deb [arch=amd64] https://nginx.org/packages/mainline/debian/ {{ ansible_distribution_release }} nginx
|
||||
{% endif %}
|
||||
|
||||
deb [arch=amd64 signed-by=/usr/share/keyrings/nginx_signing.key] https://nginx.org/packages/mainline/debian/ {{ ansible_distribution_release }} nginx
|
||||
{% endif %}
|
||||
|
||||
@@ -4,10 +4,16 @@
|
||||
{% set domain_name = item.domain_name %}
|
||||
{% set domain_aliases = item.domain_aliases | default("") %}
|
||||
{# assume optional features are off unless a vhost explicitly sets them #}
|
||||
{% set enable_hsts = item.enable_hsts | default(False) %}
|
||||
{% set has_wordpress = item.has_wordpress | default(False) %}
|
||||
{% set needs_php = item.needs_php | default(False) %}
|
||||
{% set has_gitea = item.has_gitea | default(False) %}
|
||||
{% set enable_hsts = item.enable_hsts | default(false) %}
|
||||
{% set has_wordpress = item.has_wordpress | default(false) %}
|
||||
{% set needs_php = item.needs_php | default(false) %}
|
||||
{% set has_gitea = item.has_gitea | default(false) %}
|
||||
{# Allow sites to override the document root #}
|
||||
{% if item.document_root is defined %}
|
||||
{% set document_root = item.document_root %}
|
||||
{% else %}
|
||||
{% set document_root = (nginx_root_prefix, domain_name) | ansible.builtin.path_join %}
|
||||
{% endif %}
|
||||
|
||||
# http -> https vhost
|
||||
server {
|
||||
@@ -26,31 +32,27 @@ server {
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
http2 on;
|
||||
|
||||
{# Allow sites to override the nginx document root #}
|
||||
{% if item.document_root is defined %}
|
||||
root {{ item.document_root }};
|
||||
{% else %}
|
||||
root {{ nginx_root_prefix }}/{{ domain_name }};
|
||||
{% endif %}
|
||||
root {{ document_root }};
|
||||
|
||||
{# will only work if the TLS cert covers the domain + aliases, like example.com and www.example.com #}
|
||||
server_name {{ domain_name }} {{ domain_aliases }};
|
||||
|
||||
index {% if has_wordpress == True or needs_php == True %}index.php{% else %}index.html{% endif %};
|
||||
index {% if has_wordpress == true or needs_php == true %}index.php{% else %}index.html{% endif %};
|
||||
|
||||
access_log /var/log/nginx/{{ domain_name }}-access.log;
|
||||
error_log /var/log/nginx/{{ domain_name }}-error.log;
|
||||
|
||||
{% include 'https.j2' %}
|
||||
|
||||
{% if has_wordpress == True %}
|
||||
{% if has_wordpress == true %}
|
||||
{% include 'wordpress.j2' %}
|
||||
{% endif %}
|
||||
|
||||
{% if has_gitea == True %}
|
||||
{% if has_gitea == true %}
|
||||
{% include 'gitea.j2' %}
|
||||
{% endif %}
|
||||
|
||||
@@ -59,7 +61,7 @@ server {
|
||||
root /usr/share/nginx/html;
|
||||
}
|
||||
|
||||
{% if has_wordpress == True or needs_php == True %}
|
||||
{% if has_wordpress == true or needs_php == true %}
|
||||
location ~ [^/]\.php(/|$) {
|
||||
# Zero-day exploit defense.
|
||||
# http://forum.nginx.org/read.php?2,88845,page=3
|
||||
@@ -75,17 +77,8 @@ server {
|
||||
# See: https://httpoxy.org/
|
||||
fastcgi_param HTTP_PROXY "";
|
||||
|
||||
{# As of Ubuntu 16.04 and Debian 9, the PHP-FPM configs are the same #}
|
||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('16.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('9', '==')) %}
|
||||
fastcgi_pass unix:/run/php/php7.0-fpm-{{ domain_name }}.sock;
|
||||
{% elif ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==') %}
|
||||
fastcgi_pass unix:/run/php/php7.2-fpm-{{ domain_name }}.sock;
|
||||
{% elif ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==') %}
|
||||
fastcgi_pass unix:/run/php/php7.3-fpm-{{ domain_name }}.sock;
|
||||
{% elif (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==')) %}
|
||||
fastcgi_pass unix:/run/php/php7.4-fpm-{{ domain_name }}.sock;
|
||||
{% else %}
|
||||
fastcgi_pass unix:/var/run/php5-fpm-{{ domain_name }}.sock;
|
||||
{% if ansible_distribution_major_version is version('12', '==') %}
|
||||
fastcgi_pass unix:/run/php/php8.2-fpm-{{ domain_name }}.sock;
|
||||
{% endif %}
|
||||
fastcgi_index index.php;
|
||||
# set script path relative to document root in server block
|
||||
@@ -99,7 +92,7 @@ server {
|
||||
fastcgi_cache_bypass $http_pragma $wordpress_logged_in;
|
||||
fastcgi_no_cache $http_pragma $wordpress_logged_in;
|
||||
|
||||
{% if enable_hsts == True %}
|
||||
{% if enable_hsts == true %}
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
@@ -113,7 +106,7 @@ server {
|
||||
include extra-security.conf;
|
||||
}
|
||||
|
||||
{% if has_wordpress == True %}
|
||||
{% if has_wordpress == true %}
|
||||
# Check if a user is logged in
|
||||
# if so, set $wordpress_logged_in = 1
|
||||
# otherwise, set $wordpress_logged_in = 0
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?$args;
|
||||
|
||||
{% if enable_hsts == True %}
|
||||
{% if enable_hsts == true %}
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
@@ -16,7 +16,7 @@
|
||||
location ~* \.(?:ico|css|js|gif|jpe?g|png|svg)$ {
|
||||
add_header Cache-Control "max-age=604800";
|
||||
|
||||
{% if enable_hsts == True %}
|
||||
{% if enable_hsts == true %}
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
---
|
||||
# For Ubuntu 18.04
|
||||
- name: reload php7.2-fpm
|
||||
systemd: name=php7.2-fpm state=reloaded
|
||||
|
||||
# For Debian 10
|
||||
- name: reload php7.3-fpm
|
||||
systemd: name=php7.3-fpm state=reloaded
|
||||
|
||||
# For Ubuntu 20.04
|
||||
- name: reload php7.4-fpm
|
||||
systemd: name=php7.4-fpm state=reloaded
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
@@ -1,35 +0,0 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Set php-fpm packages
|
||||
set_fact:
|
||||
php_fpm_packages:
|
||||
- php-fpm
|
||||
# for WordPress
|
||||
- php-mysql
|
||||
- php-gd
|
||||
- php-curl
|
||||
|
||||
- name: Install php-fpm and deps
|
||||
apt: name={{ php_fpm_packages }} state=present update_cache=yes
|
||||
|
||||
# only copy php-fpm config for vhosts that need WordPress or PHP
|
||||
- name: Copy php-fpm pool config
|
||||
template: src=php7.3-pool.conf.j2 dest=/etc/php/7.3/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
notify: reload php7.3-fpm
|
||||
|
||||
- name: Remove default www pool
|
||||
file: path=/etc/php/7.3/fpm/pool.d/www.conf state=absent
|
||||
notify: reload php7.3-fpm
|
||||
|
||||
# re-configure php.ini
|
||||
- name: Update php.ini
|
||||
template: src=php7.3-php.ini.j2 dest=/etc/php/7.3/fpm/php.ini owner=root group=root mode=0644
|
||||
notify: reload php7.3-fpm
|
||||
|
||||
tags: php-fpm
|
||||
when: install_php
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
@@ -1,35 +0,0 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Set php-fpm packages
|
||||
set_fact:
|
||||
php_fpm_packages:
|
||||
- php-fpm
|
||||
# for WordPress
|
||||
- php-mysql
|
||||
- php-gd
|
||||
- php-curl
|
||||
|
||||
- name: Install php-fpm and deps
|
||||
apt: name={{ php_fpm_packages }} state=present update_cache=yes
|
||||
|
||||
# only copy php-fpm config for vhosts that need WordPress or PHP
|
||||
- name: Copy php-fpm pool config
|
||||
template: src=php7.2-pool.conf.j2 dest=/etc/php/7.2/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
notify: reload php7.2-fpm
|
||||
|
||||
- name: Remove default www pool
|
||||
file: path=/etc/php/7.2/fpm/pool.d/www.conf state=absent
|
||||
notify: reload php7.2-fpm
|
||||
|
||||
# re-configure php.ini
|
||||
- name: Update php.ini
|
||||
template: src=php7.2-php.ini.j2 dest=/etc/php/7.2/fpm/php.ini owner=root group=root mode=0644
|
||||
notify: reload php7.2-fpm
|
||||
|
||||
tags: php-fpm
|
||||
when: install_php
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
@@ -1,36 +0,0 @@
|
||||
---
|
||||
|
||||
- block:
|
||||
- name: Set php-fpm packages
|
||||
set_fact:
|
||||
php_fpm_packages:
|
||||
- php7.4-fpm
|
||||
# for WordPress
|
||||
- php7.4-mysql
|
||||
- php7.4-gd
|
||||
- php7.4-curl
|
||||
- php7.4-xml
|
||||
|
||||
- name: Install php-fpm and deps
|
||||
apt: name={{ php_fpm_packages }} state=present update_cache=yes
|
||||
|
||||
# only copy php-fpm config for vhosts that need WordPress or PHP
|
||||
- name: Copy php-fpm pool config
|
||||
template: src=php7.4-pool.conf.j2 dest=/etc/php/7.4/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
|
||||
loop: "{{ nginx_vhosts }}"
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
notify: reload php7.4-fpm
|
||||
|
||||
- name: Remove default www pool
|
||||
file: path=/etc/php/7.4/fpm/pool.d/www.conf state=absent
|
||||
notify: reload php7.4-fpm
|
||||
|
||||
# re-configure php.ini
|
||||
- name: Update php.ini
|
||||
template: src=php7.4-php.ini.j2 dest=/etc/php/7.4/fpm/php.ini owner=root group=root mode=0644
|
||||
notify: reload php7.4-fpm
|
||||
|
||||
tags: php-fpm
|
||||
when: install_php
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
@@ -1,50 +0,0 @@
|
||||
---
|
||||
# Ubuntu 18.04 uses php-fpm 7.2
|
||||
# Debian 10 uses php-fpm 7.3
|
||||
# Ubuntu 20.04 uses PHP 7.4
|
||||
# Debian 11 uses PHP 7.4
|
||||
|
||||
# If any of the vhosts on this host need WordPress then we need to install PHP.
|
||||
# This uses selectattr to filter the list of dicts in nginx_vhosts, selecting
|
||||
# any that have has_wordpress defined, and has_wordpress set to True.
|
||||
#
|
||||
# See: https://stackoverflow.com/a/31896249
|
||||
- name: Check if any vhost needs WordPress
|
||||
set_fact:
|
||||
install_php: True
|
||||
when: "nginx_vhosts | selectattr('has_wordpress', 'defined') | selectattr('has_wordpress', 'equalto', True) | list | length > 0"
|
||||
|
||||
# Legacy, was only for Piwik, but leaving for now.
|
||||
- name: Check if any vhost needs PHP
|
||||
set_fact:
|
||||
install_php: True
|
||||
when: "nginx_vhosts | selectattr('needs_php', 'defined') | selectattr('needs_php', 'equalto', True) | list | length > 0"
|
||||
|
||||
# If install_php has not been set, then we assume no vhosts need PHP. This is
|
||||
# a bit hacky, but it's the closest we come to an if/then/else.
|
||||
- name: Set install_php to False
|
||||
set_fact:
|
||||
install_php: False
|
||||
when: install_php is not defined
|
||||
|
||||
- name: Configure php-fpm on Ubuntu 18.04
|
||||
include_tasks: Ubuntu_18.04.yml
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==') and install_php
|
||||
tags: php-fpm
|
||||
|
||||
- name: Configure php-fpm on Debian 10
|
||||
include_tasks: Debian_10.yml
|
||||
when: ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==') and install_php
|
||||
tags: php-fpm
|
||||
|
||||
- name: Configure php-fpm on Ubuntu 20.04
|
||||
include_tasks: Ubuntu_20.04.yml
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==') and install_php
|
||||
tags: php-fpm
|
||||
|
||||
- name: Configure php-fpm on Debian 11
|
||||
include_tasks: Ubuntu_20.04.yml
|
||||
when: ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==') and install_php
|
||||
tags: php-fpm
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,415 +0,0 @@
|
||||
{% set domain_name = item.domain_name %}
|
||||
|
||||
; Start a new pool named '{{ domain_name }}'.
|
||||
; the variable $pool can we used in any directive and will be replaced by the
|
||||
; pool name ('{{ domain_name }}' here)
|
||||
[{{ domain_name }}]
|
||||
|
||||
; Per pool prefix
|
||||
; It only applies on the following directives:
|
||||
; - 'access.log'
|
||||
; - 'slowlog'
|
||||
; - 'listen' (unixsocket)
|
||||
; - 'chroot'
|
||||
; - 'chdir'
|
||||
; - 'php_values'
|
||||
; - 'php_admin_values'
|
||||
; When not set, the global prefix (or /usr) applies instead.
|
||||
; Note: This directive can also be relative to the global prefix.
|
||||
; Default Value: none
|
||||
;prefix = /path/to/pools/$pool
|
||||
|
||||
; Unix user/group of processes
|
||||
; Note: The user is mandatory. If the group is not set, the default user's group
|
||||
; will be used.
|
||||
user = nginx
|
||||
group = nginx
|
||||
|
||||
; The address on which to accept FastCGI requests.
|
||||
; Valid syntaxes are:
|
||||
; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on
|
||||
; a specific port;
|
||||
; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
|
||||
; a specific port;
|
||||
; 'port' - to listen on a TCP socket to all addresses
|
||||
; (IPv6 and IPv4-mapped) on a specific port;
|
||||
; '/path/to/unix/socket' - to listen on a unix socket.
|
||||
; Note: This value is mandatory.
|
||||
listen = /run/php/php7.2-fpm-{{ domain_name }}.sock
|
||||
|
||||
; Set listen(2) backlog.
|
||||
; Default Value: 511 (-1 on FreeBSD and OpenBSD)
|
||||
;listen.backlog = 511
|
||||
|
||||
; Set permissions for unix socket, if one is used. In Linux, read/write
|
||||
; permissions must be set in order to allow connections from a web server. Many
|
||||
; BSD-derived systems allow connections regardless of permissions.
|
||||
; Default Values: user and group are set as the running user
|
||||
; mode is set to 0660
|
||||
listen.owner = nginx
|
||||
listen.group = nginx
|
||||
;listen.mode = 0660
|
||||
; When POSIX Access Control Lists are supported you can set them using
|
||||
; these options, value is a comma separated list of user/group names.
|
||||
; When set, listen.owner and listen.group are ignored
|
||||
;listen.acl_users =
|
||||
;listen.acl_groups =
|
||||
|
||||
; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
|
||||
; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
|
||||
; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
|
||||
; must be separated by a comma. If this value is left blank, connections will be
|
||||
; accepted from any ip address.
|
||||
; Default Value: any
|
||||
;listen.allowed_clients = 127.0.0.1
|
||||
|
||||
; Specify the nice(2) priority to apply to the pool processes (only if set)
|
||||
; The value can vary from -19 (highest priority) to 20 (lower priority)
|
||||
; Note: - It will only work if the FPM master process is launched as root
|
||||
; - The pool processes will inherit the master process priority
|
||||
; unless it specified otherwise
|
||||
; Default Value: no set
|
||||
; process.priority = -19
|
||||
|
||||
; Choose how the process manager will control the number of child processes.
|
||||
; Possible Values:
|
||||
; static - a fixed number (pm.max_children) of child processes;
|
||||
; dynamic - the number of child processes are set dynamically based on the
|
||||
; following directives. With this process management, there will be
|
||||
; always at least 1 children.
|
||||
; pm.max_children - the maximum number of children that can
|
||||
; be alive at the same time.
|
||||
; pm.start_servers - the number of children created on startup.
|
||||
; pm.min_spare_servers - the minimum number of children in 'idle'
|
||||
; state (waiting to process). If the number
|
||||
; of 'idle' processes is less than this
|
||||
; number then some children will be created.
|
||||
; pm.max_spare_servers - the maximum number of children in 'idle'
|
||||
; state (waiting to process). If the number
|
||||
; of 'idle' processes is greater than this
|
||||
; number then some children will be killed.
|
||||
; ondemand - no children are created at startup. Children will be forked when
|
||||
; new requests will connect. The following parameter are used:
|
||||
; pm.max_children - the maximum number of children that
|
||||
; can be alive at the same time.
|
||||
; pm.process_idle_timeout - The number of seconds after which
|
||||
; an idle process will be killed.
|
||||
; Note: This value is mandatory.
|
||||
pm = dynamic
|
||||
|
||||
; The number of child processes to be created when pm is set to 'static' and the
|
||||
; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
|
||||
; This value sets the limit on the number of simultaneous requests that will be
|
||||
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
|
||||
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
|
||||
; CGI. The below defaults are based on a server without much resources. Don't
|
||||
; forget to tweak pm.* to fit your needs.
|
||||
; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
|
||||
; Note: This value is mandatory.
|
||||
pm.max_children = 5
|
||||
|
||||
; The number of child processes created on startup.
|
||||
; Note: Used only when pm is set to 'dynamic'
|
||||
; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
|
||||
pm.start_servers = 2
|
||||
|
||||
; The desired minimum number of idle server processes.
|
||||
; Note: Used only when pm is set to 'dynamic'
|
||||
; Note: Mandatory when pm is set to 'dynamic'
|
||||
pm.min_spare_servers = 1
|
||||
|
||||
; The desired maximum number of idle server processes.
|
||||
; Note: Used only when pm is set to 'dynamic'
|
||||
; Note: Mandatory when pm is set to 'dynamic'
|
||||
pm.max_spare_servers = 3
|
||||
|
||||
; The number of seconds after which an idle process will be killed.
|
||||
; Note: Used only when pm is set to 'ondemand'
|
||||
; Default Value: 10s
|
||||
;pm.process_idle_timeout = 10s;
|
||||
|
||||
; The number of requests each child process should execute before respawning.
|
||||
; This can be useful to work around memory leaks in 3rd party libraries. For
|
||||
; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
|
||||
; Default Value: 0
|
||||
;pm.max_requests = 500
|
||||
|
||||
; The URI to view the FPM status page. If this value is not set, no URI will be
|
||||
; recognized as a status page. It shows the following informations:
|
||||
; pool - the name of the pool;
|
||||
; process manager - static, dynamic or ondemand;
|
||||
; start time - the date and time FPM has started;
|
||||
; start since - number of seconds since FPM has started;
|
||||
; accepted conn - the number of request accepted by the pool;
|
||||
; listen queue - the number of request in the queue of pending
|
||||
; connections (see backlog in listen(2));
|
||||
; max listen queue - the maximum number of requests in the queue
|
||||
; of pending connections since FPM has started;
|
||||
; listen queue len - the size of the socket queue of pending connections;
|
||||
; idle processes - the number of idle processes;
|
||||
; active processes - the number of active processes;
|
||||
; total processes - the number of idle + active processes;
|
||||
; max active processes - the maximum number of active processes since FPM
|
||||
; has started;
|
||||
; max children reached - number of times, the process limit has been reached,
|
||||
; when pm tries to start more children (works only for
|
||||
; pm 'dynamic' and 'ondemand');
|
||||
; Value are updated in real time.
|
||||
; Example output:
|
||||
; pool: www
|
||||
; process manager: static
|
||||
; start time: 01/Jul/2011:17:53:49 +0200
|
||||
; start since: 62636
|
||||
; accepted conn: 190460
|
||||
; listen queue: 0
|
||||
; max listen queue: 1
|
||||
; listen queue len: 42
|
||||
; idle processes: 4
|
||||
; active processes: 11
|
||||
; total processes: 15
|
||||
; max active processes: 12
|
||||
; max children reached: 0
|
||||
;
|
||||
; By default the status page output is formatted as text/plain. Passing either
|
||||
; 'html', 'xml' or 'json' in the query string will return the corresponding
|
||||
; output syntax. Example:
|
||||
; http://www.foo.bar/status
|
||||
; http://www.foo.bar/status?json
|
||||
; http://www.foo.bar/status?html
|
||||
; http://www.foo.bar/status?xml
|
||||
;
|
||||
; By default the status page only outputs short status. Passing 'full' in the
|
||||
; query string will also return status for each pool process.
|
||||
; Example:
|
||||
; http://www.foo.bar/status?full
|
||||
; http://www.foo.bar/status?json&full
|
||||
; http://www.foo.bar/status?html&full
|
||||
; http://www.foo.bar/status?xml&full
|
||||
; The Full status returns for each process:
|
||||
; pid - the PID of the process;
|
||||
; state - the state of the process (Idle, Running, ...);
|
||||
; start time - the date and time the process has started;
|
||||
; start since - the number of seconds since the process has started;
|
||||
; requests - the number of requests the process has served;
|
||||
; request duration - the duration in µs of the requests;
|
||||
; request method - the request method (GET, POST, ...);
|
||||
; request URI - the request URI with the query string;
|
||||
; content length - the content length of the request (only with POST);
|
||||
; user - the user (PHP_AUTH_USER) (or '-' if not set);
|
||||
; script - the main script called (or '-' if not set);
|
||||
; last request cpu - the %cpu the last request consumed
|
||||
; it's always 0 if the process is not in Idle state
|
||||
; because CPU calculation is done when the request
|
||||
; processing has terminated;
|
||||
; last request memory - the max amount of memory the last request consumed
|
||||
; it's always 0 if the process is not in Idle state
|
||||
; because memory calculation is done when the request
|
||||
; processing has terminated;
|
||||
; If the process is in Idle state, then informations are related to the
|
||||
; last request the process has served. Otherwise informations are related to
|
||||
; the current request being served.
|
||||
; Example output:
|
||||
; ************************
|
||||
; pid: 31330
|
||||
; state: Running
|
||||
; start time: 01/Jul/2011:17:53:49 +0200
|
||||
; start since: 63087
|
||||
; requests: 12808
|
||||
; request duration: 1250261
|
||||
; request method: GET
|
||||
; request URI: /test_mem.php?N=10000
|
||||
; content length: 0
|
||||
; user: -
|
||||
; script: /home/fat/web/docs/php/test_mem.php
|
||||
; last request cpu: 0.00
|
||||
; last request memory: 0
|
||||
;
|
||||
; Note: There is a real-time FPM status monitoring sample web page available
|
||||
; It's available in: /usr/share/php/7.2/fpm/status.html
|
||||
;
|
||||
; Note: The value must start with a leading slash (/). The value can be
|
||||
; anything, but it may not be a good idea to use the .php extension or it
|
||||
; may conflict with a real PHP file.
|
||||
; Default Value: not set
|
||||
;pm.status_path = /status
|
||||
|
||||
; The ping URI to call the monitoring page of FPM. If this value is not set, no
|
||||
; URI will be recognized as a ping page. This could be used to test from outside
|
||||
; that FPM is alive and responding, or to
|
||||
; - create a graph of FPM availability (rrd or such);
|
||||
; - remove a server from a group if it is not responding (load balancing);
|
||||
; - trigger alerts for the operating team (24/7).
|
||||
; Note: The value must start with a leading slash (/). The value can be
|
||||
; anything, but it may not be a good idea to use the .php extension or it
|
||||
; may conflict with a real PHP file.
|
||||
; Default Value: not set
|
||||
;ping.path = /ping
|
||||
|
||||
; This directive may be used to customize the response of a ping request. The
|
||||
; response is formatted as text/plain with a 200 response code.
|
||||
; Default Value: pong
|
||||
;ping.response = pong
|
||||
|
||||
; The access log file
|
||||
; Default: not set
|
||||
;access.log = log/$pool.access.log
|
||||
|
||||
; The access log format.
|
||||
; The following syntax is allowed
|
||||
; %%: the '%' character
|
||||
; %C: %CPU used by the request
|
||||
; it can accept the following format:
|
||||
; - %{user}C for user CPU only
|
||||
; - %{system}C for system CPU only
|
||||
; - %{total}C for user + system CPU (default)
|
||||
; %d: time taken to serve the request
|
||||
; it can accept the following format:
|
||||
; - %{seconds}d (default)
|
||||
; - %{miliseconds}d
|
||||
; - %{mili}d
|
||||
; - %{microseconds}d
|
||||
; - %{micro}d
|
||||
; %e: an environment variable (same as $_ENV or $_SERVER)
|
||||
; it must be associated with embraces to specify the name of the env
|
||||
; variable. Some exemples:
|
||||
; - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
|
||||
; - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
|
||||
; %f: script filename
|
||||
; %l: content-length of the request (for POST request only)
|
||||
; %m: request method
|
||||
; %M: peak of memory allocated by PHP
|
||||
; it can accept the following format:
|
||||
; - %{bytes}M (default)
|
||||
; - %{kilobytes}M
|
||||
; - %{kilo}M
|
||||
; - %{megabytes}M
|
||||
; - %{mega}M
|
||||
; %n: pool name
|
||||
; %o: output header
|
||||
; it must be associated with embraces to specify the name of the header:
|
||||
; - %{Content-Type}o
|
||||
; - %{X-Powered-By}o
|
||||
; - %{Transfert-Encoding}o
|
||||
; - ....
|
||||
; %p: PID of the child that serviced the request
|
||||
; %P: PID of the parent of the child that serviced the request
|
||||
; %q: the query string
|
||||
; %Q: the '?' character if query string exists
|
||||
; %r: the request URI (without the query string, see %q and %Q)
|
||||
; %R: remote IP address
|
||||
; %s: status (response code)
|
||||
; %t: server time the request was received
|
||||
; it can accept a strftime(3) format:
|
||||
; %d/%b/%Y:%H:%M:%S %z (default)
|
||||
; %T: time the log has been written (the request has finished)
|
||||
; it can accept a strftime(3) format:
|
||||
; %d/%b/%Y:%H:%M:%S %z (default)
|
||||
; %u: remote user
|
||||
;
|
||||
; Default: "%R - %u %t \"%m %r\" %s"
|
||||
;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
|
||||
|
||||
; The log file for slow requests
|
||||
; Default Value: not set
|
||||
; Note: slowlog is mandatory if request_slowlog_timeout is set
|
||||
;slowlog = log/$pool.log.slow
|
||||
|
||||
; The timeout for serving a single request after which a PHP backtrace will be
|
||||
; dumped to the 'slowlog' file. A value of '0s' means 'off'.
|
||||
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
|
||||
; Default Value: 0
|
||||
;request_slowlog_timeout = 0
|
||||
|
||||
; Depth of slow log stack trace.
|
||||
; Default Value: 20
|
||||
;request_slowlog_trace_depth = 20
|
||||
|
||||
; The timeout for serving a single request after which the worker process will
|
||||
; be killed. This option should be used when the 'max_execution_time' ini option
|
||||
; does not stop script execution for some reason. A value of '0' means 'off'.
|
||||
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
|
||||
; Default Value: 0
|
||||
;request_terminate_timeout = 0
|
||||
|
||||
; Set open file descriptor rlimit.
|
||||
; Default Value: system defined value
|
||||
;rlimit_files = 1024
|
||||
|
||||
; Set max core size rlimit.
|
||||
; Possible Values: 'unlimited' or an integer greater or equal to 0
|
||||
; Default Value: system defined value
|
||||
;rlimit_core = 0
|
||||
|
||||
; Chroot to this directory at the start. This value must be defined as an
|
||||
; absolute path. When this value is not set, chroot is not used.
|
||||
; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
|
||||
; of its subdirectories. If the pool prefix is not set, the global prefix
|
||||
; will be used instead.
|
||||
; Note: chrooting is a great security feature and should be used whenever
|
||||
; possible. However, all PHP paths will be relative to the chroot
|
||||
; (error_log, sessions.save_path, ...).
|
||||
; Default Value: not set
|
||||
;chroot =
|
||||
|
||||
; Chdir to this directory at the start.
|
||||
; Note: relative path can be used.
|
||||
; Default Value: current directory or / when chroot
|
||||
;chdir = /var/www
|
||||
|
||||
; Redirect worker stdout and stderr into main error log. If not set, stdout and
|
||||
; stderr will be redirected to /dev/null according to FastCGI specs.
|
||||
; Note: on highloaded environement, this can cause some delay in the page
|
||||
; process time (several ms).
|
||||
; Default Value: no
|
||||
catch_workers_output = yes
|
||||
|
||||
; Clear environment in FPM workers
|
||||
; Prevents arbitrary environment variables from reaching FPM worker processes
|
||||
; by clearing the environment in workers before env vars specified in this
|
||||
; pool configuration are added.
|
||||
; Setting to "no" will make all environment variables available to PHP code
|
||||
; via getenv(), $_ENV and $_SERVER.
|
||||
; Default Value: yes
|
||||
;clear_env = no
|
||||
|
||||
; Limits the extensions of the main script FPM will allow to parse. This can
|
||||
; prevent configuration mistakes on the web server side. You should only limit
|
||||
; FPM to .php extensions to prevent malicious users to use other extensions to
|
||||
; execute php code.
|
||||
; Note: set an empty value to allow all extensions.
|
||||
; Default Value: .php
|
||||
;security.limit_extensions = .php .php3 .php4 .php5 .php7
|
||||
|
||||
; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
|
||||
; the current environment.
|
||||
; Default Value: clean env
|
||||
;env[HOSTNAME] = $HOSTNAME
|
||||
;env[PATH] = /usr/local/bin:/usr/bin:/bin
|
||||
;env[TMP] = /tmp
|
||||
;env[TMPDIR] = /tmp
|
||||
;env[TEMP] = /tmp
|
||||
|
||||
; Additional php.ini defines, specific to this pool of workers. These settings
|
||||
; overwrite the values previously defined in the php.ini. The directives are the
|
||||
; same as the PHP SAPI:
|
||||
; php_value/php_flag - you can set classic ini defines which can
|
||||
; be overwritten from PHP call 'ini_set'.
|
||||
; php_admin_value/php_admin_flag - these directives won't be overwritten by
|
||||
; PHP call 'ini_set'
|
||||
; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
|
||||
|
||||
; Defining 'extension' will load the corresponding shared extension from
|
||||
; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
|
||||
; overwrite previously defined php.ini values, but will append the new value
|
||||
; instead.
|
||||
|
||||
; Note: path INI options can be relative and will be expanded with the prefix
|
||||
; (pool, global or /usr)
|
||||
|
||||
; Default Value: nothing is defined by default except the values in php.ini and
|
||||
; specified at startup with the -d argument
|
||||
;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
|
||||
;php_flag[display_errors] = off
|
||||
;php_admin_value[error_log] = /var/log/fpm-php.www.log
|
||||
;php_admin_flag[log_errors] = on
|
||||
;php_admin_value[memory_limit] = 32M
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,428 +0,0 @@
|
||||
{% set domain_name = item.domain_name %}
|
||||
|
||||
; Start a new pool named '{{ domain_name }}'.
|
||||
; the variable $pool can be used in any directive and will be replaced by the
|
||||
; pool name ('{{ domain_name }}' here)
|
||||
[{{ domain_name }}]
|
||||
|
||||
; Per pool prefix
|
||||
; It only applies on the following directives:
|
||||
; - 'access.log'
|
||||
; - 'slowlog'
|
||||
; - 'listen' (unixsocket)
|
||||
; - 'chroot'
|
||||
; - 'chdir'
|
||||
; - 'php_values'
|
||||
; - 'php_admin_values'
|
||||
; When not set, the global prefix (or /usr) applies instead.
|
||||
; Note: This directive can also be relative to the global prefix.
|
||||
; Default Value: none
|
||||
;prefix = /path/to/pools/$pool
|
||||
|
||||
; Unix user/group of processes
|
||||
; Note: The user is mandatory. If the group is not set, the default user's group
|
||||
; will be used.
|
||||
user = nginx
|
||||
group = nginx
|
||||
|
||||
; The address on which to accept FastCGI requests.
|
||||
; Valid syntaxes are:
|
||||
; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on
|
||||
; a specific port;
|
||||
; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
|
||||
; a specific port;
|
||||
; 'port' - to listen on a TCP socket to all addresses
|
||||
; (IPv6 and IPv4-mapped) on a specific port;
|
||||
; '/path/to/unix/socket' - to listen on a unix socket.
|
||||
; Note: This value is mandatory.
|
||||
listen = /run/php/php7.3-fpm-{{ domain_name }}.sock
|
||||
|
||||
; Set listen(2) backlog.
|
||||
; Default Value: 511 (-1 on FreeBSD and OpenBSD)
|
||||
;listen.backlog = 511
|
||||
|
||||
; Set permissions for unix socket, if one is used. In Linux, read/write
|
||||
; permissions must be set in order to allow connections from a web server. Many
|
||||
; BSD-derived systems allow connections regardless of permissions.
|
||||
; Default Values: user and group are set as the running user
|
||||
; mode is set to 0660
|
||||
listen.owner = nginx
|
||||
listen.group = nginx
|
||||
;listen.mode = 0660
|
||||
; When POSIX Access Control Lists are supported you can set them using
|
||||
; these options, value is a comma separated list of user/group names.
|
||||
; When set, listen.owner and listen.group are ignored
|
||||
;listen.acl_users =
|
||||
;listen.acl_groups =
|
||||
|
||||
; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
|
||||
; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
|
||||
; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
|
||||
; must be separated by a comma. If this value is left blank, connections will be
|
||||
; accepted from any ip address.
|
||||
; Default Value: any
|
||||
;listen.allowed_clients = 127.0.0.1
|
||||
|
||||
; Specify the nice(2) priority to apply to the pool processes (only if set)
|
||||
; The value can vary from -19 (highest priority) to 20 (lower priority)
|
||||
; Note: - It will only work if the FPM master process is launched as root
|
||||
; - The pool processes will inherit the master process priority
|
||||
; unless it specified otherwise
|
||||
; Default Value: no set
|
||||
; process.priority = -19
|
||||
|
||||
; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user
|
||||
; or group is differrent than the master process user. It allows to create process
|
||||
; core dump and ptrace the process for the pool user.
|
||||
; Default Value: no
|
||||
; process.dumpable = yes
|
||||
|
||||
; Choose how the process manager will control the number of child processes.
|
||||
; Possible Values:
|
||||
; static - a fixed number (pm.max_children) of child processes;
|
||||
; dynamic - the number of child processes are set dynamically based on the
|
||||
; following directives. With this process management, there will be
|
||||
; always at least 1 children.
|
||||
; pm.max_children - the maximum number of children that can
|
||||
; be alive at the same time.
|
||||
; pm.start_servers - the number of children created on startup.
|
||||
; pm.min_spare_servers - the minimum number of children in 'idle'
|
||||
; state (waiting to process). If the number
|
||||
; of 'idle' processes is less than this
|
||||
; number then some children will be created.
|
||||
; pm.max_spare_servers - the maximum number of children in 'idle'
|
||||
; state (waiting to process). If the number
|
||||
; of 'idle' processes is greater than this
|
||||
; number then some children will be killed.
|
||||
; ondemand - no children are created at startup. Children will be forked when
|
||||
; new requests will connect. The following parameter are used:
|
||||
; pm.max_children - the maximum number of children that
|
||||
; can be alive at the same time.
|
||||
; pm.process_idle_timeout - The number of seconds after which
|
||||
; an idle process will be killed.
|
||||
; Note: This value is mandatory.
|
||||
pm = dynamic
|
||||
|
||||
; The number of child processes to be created when pm is set to 'static' and the
|
||||
; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
|
||||
; This value sets the limit on the number of simultaneous requests that will be
|
||||
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
|
||||
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
|
||||
; CGI. The below defaults are based on a server without much resources. Don't
|
||||
; forget to tweak pm.* to fit your needs.
|
||||
; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
|
||||
; Note: This value is mandatory.
|
||||
pm.max_children = 5
|
||||
|
||||
; The number of child processes created on startup.
|
||||
; Note: Used only when pm is set to 'dynamic'
|
||||
; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
|
||||
pm.start_servers = 2
|
||||
|
||||
; The desired minimum number of idle server processes.
|
||||
; Note: Used only when pm is set to 'dynamic'
|
||||
; Note: Mandatory when pm is set to 'dynamic'
|
||||
pm.min_spare_servers = 1
|
||||
|
||||
; The desired maximum number of idle server processes.
|
||||
; Note: Used only when pm is set to 'dynamic'
|
||||
; Note: Mandatory when pm is set to 'dynamic'
|
||||
pm.max_spare_servers = 3
|
||||
|
||||
; The number of seconds after which an idle process will be killed.
|
||||
; Note: Used only when pm is set to 'ondemand'
|
||||
; Default Value: 10s
|
||||
;pm.process_idle_timeout = 10s;
|
||||
|
||||
; The number of requests each child process should execute before respawning.
|
||||
; This can be useful to work around memory leaks in 3rd party libraries. For
|
||||
; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
|
||||
; Default Value: 0
|
||||
;pm.max_requests = 500
|
||||
|
||||
; The URI to view the FPM status page. If this value is not set, no URI will be
|
||||
; recognized as a status page. It shows the following informations:
|
||||
; pool - the name of the pool;
|
||||
; process manager - static, dynamic or ondemand;
|
||||
; start time - the date and time FPM has started;
|
||||
; start since - number of seconds since FPM has started;
|
||||
; accepted conn - the number of request accepted by the pool;
|
||||
; listen queue - the number of request in the queue of pending
|
||||
; connections (see backlog in listen(2));
|
||||
; max listen queue - the maximum number of requests in the queue
|
||||
; of pending connections since FPM has started;
|
||||
; listen queue len - the size of the socket queue of pending connections;
|
||||
; idle processes - the number of idle processes;
|
||||
; active processes - the number of active processes;
|
||||
; total processes - the number of idle + active processes;
|
||||
; max active processes - the maximum number of active processes since FPM
|
||||
; has started;
|
||||
; max children reached - number of times, the process limit has been reached,
|
||||
; when pm tries to start more children (works only for
|
||||
; pm 'dynamic' and 'ondemand');
|
||||
; Value are updated in real time.
|
||||
; Example output:
|
||||
; pool: www
|
||||
; process manager: static
|
||||
; start time: 01/Jul/2011:17:53:49 +0200
|
||||
; start since: 62636
|
||||
; accepted conn: 190460
|
||||
; listen queue: 0
|
||||
; max listen queue: 1
|
||||
; listen queue len: 42
|
||||
; idle processes: 4
|
||||
; active processes: 11
|
||||
; total processes: 15
|
||||
; max active processes: 12
|
||||
; max children reached: 0
|
||||
;
|
||||
; By default the status page output is formatted as text/plain. Passing either
|
||||
; 'html', 'xml' or 'json' in the query string will return the corresponding
|
||||
; output syntax. Example:
|
||||
; http://www.foo.bar/status
|
||||
; http://www.foo.bar/status?json
|
||||
; http://www.foo.bar/status?html
|
||||
; http://www.foo.bar/status?xml
|
||||
;
|
||||
; By default the status page only outputs short status. Passing 'full' in the
|
||||
; query string will also return status for each pool process.
|
||||
; Example:
|
||||
; http://www.foo.bar/status?full
|
||||
; http://www.foo.bar/status?json&full
|
||||
; http://www.foo.bar/status?html&full
|
||||
; http://www.foo.bar/status?xml&full
|
||||
; The Full status returns for each process:
|
||||
; pid - the PID of the process;
|
||||
; state - the state of the process (Idle, Running, ...);
|
||||
; start time - the date and time the process has started;
|
||||
; start since - the number of seconds since the process has started;
|
||||
; requests - the number of requests the process has served;
|
||||
; request duration - the duration in µs of the requests;
|
||||
; request method - the request method (GET, POST, ...);
|
||||
; request URI - the request URI with the query string;
|
||||
; content length - the content length of the request (only with POST);
|
||||
; user - the user (PHP_AUTH_USER) (or '-' if not set);
|
||||
; script - the main script called (or '-' if not set);
|
||||
; last request cpu - the %cpu the last request consumed
|
||||
; it's always 0 if the process is not in Idle state
|
||||
; because CPU calculation is done when the request
|
||||
; processing has terminated;
|
||||
; last request memory - the max amount of memory the last request consumed
|
||||
; it's always 0 if the process is not in Idle state
|
||||
; because memory calculation is done when the request
|
||||
; processing has terminated;
|
||||
; If the process is in Idle state, then informations are related to the
|
||||
; last request the process has served. Otherwise informations are related to
|
||||
; the current request being served.
|
||||
; Example output:
|
||||
; ************************
|
||||
; pid: 31330
|
||||
; state: Running
|
||||
; start time: 01/Jul/2011:17:53:49 +0200
|
||||
; start since: 63087
|
||||
; requests: 12808
|
||||
; request duration: 1250261
|
||||
; request method: GET
|
||||
; request URI: /test_mem.php?N=10000
|
||||
; content length: 0
|
||||
; user: -
|
||||
; script: /home/fat/web/docs/php/test_mem.php
|
||||
; last request cpu: 0.00
|
||||
; last request memory: 0
|
||||
;
|
||||
; Note: There is a real-time FPM status monitoring sample web page available
|
||||
; It's available in: /usr/share/php/7.3/fpm/status.html
|
||||
;
|
||||
; Note: The value must start with a leading slash (/). The value can be
|
||||
; anything, but it may not be a good idea to use the .php extension or it
|
||||
; may conflict with a real PHP file.
|
||||
; Default Value: not set
|
||||
;pm.status_path = /status
|
||||
|
||||
; The ping URI to call the monitoring page of FPM. If this value is not set, no
|
||||
; URI will be recognized as a ping page. This could be used to test from outside
|
||||
; that FPM is alive and responding, or to
|
||||
; - create a graph of FPM availability (rrd or such);
|
||||
; - remove a server from a group if it is not responding (load balancing);
|
||||
; - trigger alerts for the operating team (24/7).
|
||||
; Note: The value must start with a leading slash (/). The value can be
|
||||
; anything, but it may not be a good idea to use the .php extension or it
|
||||
; may conflict with a real PHP file.
|
||||
; Default Value: not set
|
||||
;ping.path = /ping
|
||||
|
||||
; This directive may be used to customize the response of a ping request. The
|
||||
; response is formatted as text/plain with a 200 response code.
|
||||
; Default Value: pong
|
||||
;ping.response = pong
|
||||
|
||||
; The access log file
|
||||
; Default: not set
|
||||
;access.log = log/$pool.access.log
|
||||
|
||||
; The access log format.
|
||||
; The following syntax is allowed
|
||||
; %%: the '%' character
|
||||
; %C: %CPU used by the request
|
||||
; it can accept the following format:
|
||||
; - %{user}C for user CPU only
|
||||
; - %{system}C for system CPU only
|
||||
; - %{total}C for user + system CPU (default)
|
||||
; %d: time taken to serve the request
|
||||
; it can accept the following format:
|
||||
; - %{seconds}d (default)
|
||||
; - %{miliseconds}d
|
||||
; - %{mili}d
|
||||
; - %{microseconds}d
|
||||
; - %{micro}d
|
||||
; %e: an environment variable (same as $_ENV or $_SERVER)
|
||||
; it must be associated with embraces to specify the name of the env
|
||||
; variable. Some exemples:
|
||||
; - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
|
||||
; - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
|
||||
; %f: script filename
|
||||
; %l: content-length of the request (for POST request only)
|
||||
; %m: request method
|
||||
; %M: peak of memory allocated by PHP
|
||||
; it can accept the following format:
|
||||
; - %{bytes}M (default)
|
||||
; - %{kilobytes}M
|
||||
; - %{kilo}M
|
||||
; - %{megabytes}M
|
||||
; - %{mega}M
|
||||
; %n: pool name
|
||||
; %o: output header
|
||||
; it must be associated with embraces to specify the name of the header:
|
||||
; - %{Content-Type}o
|
||||
; - %{X-Powered-By}o
|
||||
; - %{Transfert-Encoding}o
|
||||
; - ....
|
||||
; %p: PID of the child that serviced the request
|
||||
; %P: PID of the parent of the child that serviced the request
|
||||
; %q: the query string
|
||||
; %Q: the '?' character if query string exists
|
||||
; %r: the request URI (without the query string, see %q and %Q)
|
||||
; %R: remote IP address
|
||||
; %s: status (response code)
|
||||
; %t: server time the request was received
|
||||
; it can accept a strftime(3) format:
|
||||
; The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
|
||||
; %T: time the log has been written (the request has finished)
|
||||
; it can accept a strftime(3) format:
|
||||
; The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
|
||||
; %u: remote user
|
||||
;
|
||||
; Default: "%R - %u %t \"%m %r\" %s"
|
||||
;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
|
||||
|
||||
; The log file for slow requests
|
||||
; Default Value: not set
|
||||
; Note: slowlog is mandatory if request_slowlog_timeout is set
|
||||
;slowlog = log/$pool.log.slow
|
||||
|
||||
; The timeout for serving a single request after which a PHP backtrace will be
|
||||
; dumped to the 'slowlog' file. A value of '0s' means 'off'.
|
||||
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
|
||||
; Default Value: 0
|
||||
;request_slowlog_timeout = 0
|
||||
|
||||
; Depth of slow log stack trace.
|
||||
; Default Value: 20
|
||||
;request_slowlog_trace_depth = 20
|
||||
|
||||
; The timeout for serving a single request after which the worker process will
|
||||
; be killed. This option should be used when the 'max_execution_time' ini option
|
||||
; does not stop script execution for some reason. A value of '0' means 'off'.
|
||||
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
|
||||
; Default Value: 0
|
||||
;request_terminate_timeout = 0
|
||||
|
||||
; Set open file descriptor rlimit.
|
||||
; Default Value: system defined value
|
||||
;rlimit_files = 1024
|
||||
|
||||
; Set max core size rlimit.
|
||||
; Possible Values: 'unlimited' or an integer greater or equal to 0
|
||||
; Default Value: system defined value
|
||||
;rlimit_core = 0
|
||||
|
||||
; Chroot to this directory at the start. This value must be defined as an
|
||||
; absolute path. When this value is not set, chroot is not used.
|
||||
; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
|
||||
; of its subdirectories. If the pool prefix is not set, the global prefix
|
||||
; will be used instead.
|
||||
; Note: chrooting is a great security feature and should be used whenever
|
||||
; possible. However, all PHP paths will be relative to the chroot
|
||||
; (error_log, sessions.save_path, ...).
|
||||
; Default Value: not set
|
||||
;chroot =
|
||||
|
||||
; Chdir to this directory at the start.
|
||||
; Note: relative path can be used.
|
||||
; Default Value: current directory or / when chroot
|
||||
;chdir = /var/www
|
||||
|
||||
; Redirect worker stdout and stderr into main error log. If not set, stdout and
|
||||
; stderr will be redirected to /dev/null according to FastCGI specs.
|
||||
; Note: on highloaded environement, this can cause some delay in the page
|
||||
; process time (several ms).
|
||||
; Default Value: no
|
||||
;catch_workers_output = yes
|
||||
|
||||
; Decorate worker output with prefix and suffix containing information about
|
||||
; the child that writes to the log and if stdout or stderr is used as well as
|
||||
; log level and time. This options is used only if catch_workers_output is yes.
|
||||
; Settings to "no" will output data as written to the stdout or stderr.
|
||||
; Default value: yes
|
||||
;decorate_workers_output = no
|
||||
|
||||
; Clear environment in FPM workers
|
||||
; Prevents arbitrary environment variables from reaching FPM worker processes
|
||||
; by clearing the environment in workers before env vars specified in this
|
||||
; pool configuration are added.
|
||||
; Setting to "no" will make all environment variables available to PHP code
|
||||
; via getenv(), $_ENV and $_SERVER.
|
||||
; Default Value: yes
|
||||
;clear_env = no
|
||||
|
||||
; Limits the extensions of the main script FPM will allow to parse. This can
|
||||
; prevent configuration mistakes on the web server side. You should only limit
|
||||
; FPM to .php extensions to prevent malicious users to use other extensions to
|
||||
; execute php code.
|
||||
; Note: set an empty value to allow all extensions.
|
||||
; Default Value: .php
|
||||
;security.limit_extensions = .php .php3 .php4 .php5 .php7
|
||||
|
||||
; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
|
||||
; the current environment.
|
||||
; Default Value: clean env
|
||||
;env[HOSTNAME] = $HOSTNAME
|
||||
;env[PATH] = /usr/local/bin:/usr/bin:/bin
|
||||
;env[TMP] = /tmp
|
||||
;env[TMPDIR] = /tmp
|
||||
;env[TEMP] = /tmp
|
||||
|
||||
; Additional php.ini defines, specific to this pool of workers. These settings
|
||||
; overwrite the values previously defined in the php.ini. The directives are the
|
||||
; same as the PHP SAPI:
|
||||
; php_value/php_flag - you can set classic ini defines which can
|
||||
; be overwritten from PHP call 'ini_set'.
|
||||
; php_admin_value/php_admin_flag - these directives won't be overwritten by
|
||||
; PHP call 'ini_set'
|
||||
; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
|
||||
|
||||
; Defining 'extension' will load the corresponding shared extension from
|
||||
; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
|
||||
; overwrite previously defined php.ini values, but will append the new value
|
||||
; instead.
|
||||
|
||||
; Note: path INI options can be relative and will be expanded with the prefix
|
||||
; (pool, global or /usr)
|
||||
|
||||
; Default Value: nothing is defined by default except the values in php.ini and
|
||||
; specified at startup with the -d argument
|
||||
;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
|
||||
;php_flag[display_errors] = off
|
||||
;php_admin_value[error_log] = /var/log/fpm-php.www.log
|
||||
;php_admin_flag[log_errors] = on
|
||||
;php_admin_value[memory_limit] = 32M
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user