Compare commits
5 Commits
eb80e797c6
...
alpine
| Author | SHA1 | Date | |
|---|---|---|---|
| 4846cbd968 | |||
| aa63f5946c | |||
| 53d574dd12 | |||
| 92c23bc2b5 | |||
| e93b8af949 |
274
Pipfile.lock
generated
274
Pipfile.lock
generated
@ -18,166 +18,153 @@
|
||||
"default": {
|
||||
"ansible": {
|
||||
"hashes": [
|
||||
"sha256:cc5352b2351a381015ece79eab783a1b0668f97b377810fed3c746e2f1d50db1"
|
||||
"sha256:ae97002e4fb1ed3de947428ff43906c76c66751fe104721cf6b25fa115dbbe8d"
|
||||
],
|
||||
"index": "pypi",
|
||||
"version": "==4.5.0"
|
||||
"version": "==2.10.6"
|
||||
},
|
||||
"ansible-core": {
|
||||
"ansible-base": {
|
||||
"hashes": [
|
||||
"sha256:22eaa7c2dfe6c875e9ae380323f1cba6259c6050a5e4c8819f85f92b3683ea49"
|
||||
"sha256:33ae323923b841f3d822f355380ce7c92610440362efeed67b4b39db41e555af"
|
||||
],
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
|
||||
"version": "==2.11.4"
|
||||
"version": "==2.10.5"
|
||||
},
|
||||
"cffi": {
|
||||
"hashes": [
|
||||
"sha256:06c54a68935738d206570b20da5ef2b6b6d92b38ef3ec45c5422c0ebaf338d4d",
|
||||
"sha256:0c0591bee64e438883b0c92a7bed78f6290d40bf02e54c5bf0978eaf36061771",
|
||||
"sha256:19ca0dbdeda3b2615421d54bef8985f72af6e0c47082a8d26122adac81a95872",
|
||||
"sha256:22b9c3c320171c108e903d61a3723b51e37aaa8c81255b5e7ce102775bd01e2c",
|
||||
"sha256:26bb2549b72708c833f5abe62b756176022a7b9a7f689b571e74c8478ead51dc",
|
||||
"sha256:33791e8a2dc2953f28b8d8d300dde42dd929ac28f974c4b4c6272cb2955cb762",
|
||||
"sha256:3c8d896becff2fa653dc4438b54a5a25a971d1f4110b32bd3068db3722c80202",
|
||||
"sha256:4373612d59c404baeb7cbd788a18b2b2a8331abcc84c3ba40051fcd18b17a4d5",
|
||||
"sha256:487d63e1454627c8e47dd230025780e91869cfba4c753a74fda196a1f6ad6548",
|
||||
"sha256:48916e459c54c4a70e52745639f1db524542140433599e13911b2f329834276a",
|
||||
"sha256:4922cd707b25e623b902c86188aca466d3620892db76c0bdd7b99a3d5e61d35f",
|
||||
"sha256:55af55e32ae468e9946f741a5d51f9896da6b9bf0bbdd326843fec05c730eb20",
|
||||
"sha256:57e555a9feb4a8460415f1aac331a2dc833b1115284f7ded7278b54afc5bd218",
|
||||
"sha256:5d4b68e216fc65e9fe4f524c177b54964af043dde734807586cf5435af84045c",
|
||||
"sha256:64fda793737bc4037521d4899be780534b9aea552eb673b9833b01f945904c2e",
|
||||
"sha256:6d6169cb3c6c2ad50db5b868db6491a790300ade1ed5d1da29289d73bbe40b56",
|
||||
"sha256:7bcac9a2b4fdbed2c16fa5681356d7121ecabf041f18d97ed5b8e0dd38a80224",
|
||||
"sha256:80b06212075346b5546b0417b9f2bf467fea3bfe7352f781ffc05a8ab24ba14a",
|
||||
"sha256:818014c754cd3dba7229c0f5884396264d51ffb87ec86e927ef0be140bfdb0d2",
|
||||
"sha256:8eb687582ed7cd8c4bdbff3df6c0da443eb89c3c72e6e5dcdd9c81729712791a",
|
||||
"sha256:99f27fefe34c37ba9875f224a8f36e31d744d8083e00f520f133cab79ad5e819",
|
||||
"sha256:9f3e33c28cd39d1b655ed1ba7247133b6f7fc16fa16887b120c0c670e35ce346",
|
||||
"sha256:a8661b2ce9694ca01c529bfa204dbb144b275a31685a075ce123f12331be790b",
|
||||
"sha256:a9da7010cec5a12193d1af9872a00888f396aba3dc79186604a09ea3ee7c029e",
|
||||
"sha256:aedb15f0a5a5949ecb129a82b72b19df97bbbca024081ed2ef88bd5c0a610534",
|
||||
"sha256:b315d709717a99f4b27b59b021e6207c64620790ca3e0bde636a6c7f14618abb",
|
||||
"sha256:ba6f2b3f452e150945d58f4badd92310449876c4c954836cfb1803bdd7b422f0",
|
||||
"sha256:c33d18eb6e6bc36f09d793c0dc58b0211fccc6ae5149b808da4a62660678b156",
|
||||
"sha256:c9a875ce9d7fe32887784274dd533c57909b7b1dcadcc128a2ac21331a9765dd",
|
||||
"sha256:c9e005e9bd57bc987764c32a1bee4364c44fdc11a3cc20a40b93b444984f2b87",
|
||||
"sha256:d2ad4d668a5c0645d281dcd17aff2be3212bc109b33814bbb15c4939f44181cc",
|
||||
"sha256:d950695ae4381ecd856bcaf2b1e866720e4ab9a1498cba61c602e56630ca7195",
|
||||
"sha256:e22dcb48709fc51a7b58a927391b23ab37eb3737a98ac4338e2448bef8559b33",
|
||||
"sha256:e8c6a99be100371dbb046880e7a282152aa5d6127ae01783e37662ef73850d8f",
|
||||
"sha256:e9dc245e3ac69c92ee4c167fbdd7428ec1956d4e754223124991ef29eb57a09d",
|
||||
"sha256:eb687a11f0a7a1839719edd80f41e459cc5366857ecbed383ff376c4e3cc6afd",
|
||||
"sha256:eb9e2a346c5238a30a746893f23a9535e700f8192a68c07c0258e7ece6ff3728",
|
||||
"sha256:ed38b924ce794e505647f7c331b22a693bee1538fdf46b0222c4717b42f744e7",
|
||||
"sha256:f0010c6f9d1a4011e429109fda55a225921e3206e7f62a0c22a35344bfd13cca",
|
||||
"sha256:f0c5d1acbfca6ebdd6b1e3eded8d261affb6ddcf2186205518f1428b8569bb99",
|
||||
"sha256:f10afb1004f102c7868ebfe91c28f4a712227fe4cb24974350ace1f90e1febbf",
|
||||
"sha256:f174135f5609428cc6e1b9090f9268f5c8935fddb1b25ccb8255a2d50de6789e",
|
||||
"sha256:f3ebe6e73c319340830a9b2825d32eb6d8475c1dac020b4f0aa774ee3b898d1c",
|
||||
"sha256:f627688813d0a4140153ff532537fbe4afea5a3dffce1f9deb7f91f848a832b5",
|
||||
"sha256:fd4305f86f53dfd8cd3522269ed7fc34856a8ee3709a5e28b2836b2db9d4cd69"
|
||||
"sha256:00a1ba5e2e95684448de9b89888ccd02c98d512064b4cb987d48f4b40aa0421e",
|
||||
"sha256:00e28066507bfc3fe865a31f325c8391a1ac2916219340f87dfad602c3e48e5d",
|
||||
"sha256:045d792900a75e8b1e1b0ab6787dd733a8190ffcf80e8c8ceb2fb10a29ff238a",
|
||||
"sha256:0638c3ae1a0edfb77c6765d487fee624d2b1ee1bdfeffc1f0b58c64d149e7eec",
|
||||
"sha256:105abaf8a6075dc96c1fe5ae7aae073f4696f2905fde6aeada4c9d2926752362",
|
||||
"sha256:155136b51fd733fa94e1c2ea5211dcd4c8879869008fc811648f16541bf99668",
|
||||
"sha256:1a465cbe98a7fd391d47dce4b8f7e5b921e6cd805ef421d04f5f66ba8f06086c",
|
||||
"sha256:1d2c4994f515e5b485fd6d3a73d05526aa0fcf248eb135996b088d25dfa1865b",
|
||||
"sha256:2c24d61263f511551f740d1a065eb0212db1dbbbbd241db758f5244281590c06",
|
||||
"sha256:51a8b381b16ddd370178a65360ebe15fbc1c71cf6f584613a7ea08bfad946698",
|
||||
"sha256:594234691ac0e9b770aee9fcdb8fa02c22e43e5c619456efd0d6c2bf276f3eb2",
|
||||
"sha256:5cf4be6c304ad0b6602f5c4e90e2f59b47653ac1ed9c662ed379fe48a8f26b0c",
|
||||
"sha256:64081b3f8f6f3c3de6191ec89d7dc6c86a8a43911f7ecb422c60e90c70be41c7",
|
||||
"sha256:6bc25fc545a6b3d57b5f8618e59fc13d3a3a68431e8ca5fd4c13241cd70d0009",
|
||||
"sha256:798caa2a2384b1cbe8a2a139d80734c9db54f9cc155c99d7cc92441a23871c03",
|
||||
"sha256:7c6b1dece89874d9541fc974917b631406233ea0440d0bdfbb8e03bf39a49b3b",
|
||||
"sha256:7ef7d4ced6b325e92eb4d3502946c78c5367bc416398d387b39591532536734e",
|
||||
"sha256:840793c68105fe031f34d6a086eaea153a0cd5c491cde82a74b420edd0a2b909",
|
||||
"sha256:8d6603078baf4e11edc4168a514c5ce5b3ba6e3e9c374298cb88437957960a53",
|
||||
"sha256:9cc46bc107224ff5b6d04369e7c595acb700c3613ad7bcf2e2012f62ece80c35",
|
||||
"sha256:9f7a31251289b2ab6d4012f6e83e58bc3b96bd151f5b5262467f4bb6b34a7c26",
|
||||
"sha256:9ffb888f19d54a4d4dfd4b3f29bc2c16aa4972f1c2ab9c4ab09b8ab8685b9c2b",
|
||||
"sha256:a5ed8c05548b54b998b9498753fb9cadbfd92ee88e884641377d8a8b291bcc01",
|
||||
"sha256:a7711edca4dcef1a75257b50a2fbfe92a65187c47dab5a0f1b9b332c5919a3fb",
|
||||
"sha256:af5c59122a011049aad5dd87424b8e65a80e4a6477419c0c1015f73fb5ea0293",
|
||||
"sha256:b18e0a9ef57d2b41f5c68beefa32317d286c3d6ac0484efd10d6e07491bb95dd",
|
||||
"sha256:b4e248d1087abf9f4c10f3c398896c87ce82a9856494a7155823eb45a892395d",
|
||||
"sha256:ba4e9e0ae13fc41c6b23299545e5ef73055213e466bd107953e4a013a5ddd7e3",
|
||||
"sha256:c6332685306b6417a91b1ff9fae889b3ba65c2292d64bd9245c093b1b284809d",
|
||||
"sha256:d5ff0621c88ce83a28a10d2ce719b2ee85635e85c515f12bac99a95306da4b2e",
|
||||
"sha256:d9efd8b7a3ef378dd61a1e77367f1924375befc2eba06168b6ebfa903a5e59ca",
|
||||
"sha256:df5169c4396adc04f9b0a05f13c074df878b6052430e03f50e68adf3a57aa28d",
|
||||
"sha256:ebb253464a5d0482b191274f1c8bf00e33f7e0b9c66405fbffc61ed2c839c775",
|
||||
"sha256:ec80dc47f54e6e9a78181ce05feb71a0353854cc26999db963695f950b5fb375",
|
||||
"sha256:f032b34669220030f905152045dfa27741ce1a6db3324a5bc0b96b6c7420c87b",
|
||||
"sha256:f60567825f791c6f8a592f3c6e3bd93dd2934e3f9dac189308426bd76b00ef3b",
|
||||
"sha256:f803eaa94c2fcda012c047e62bc7a51b0bdabda1cad7a92a522694ea2d76e49f"
|
||||
],
|
||||
"version": "==1.14.6"
|
||||
"version": "==1.14.4"
|
||||
},
|
||||
"cryptography": {
|
||||
"hashes": [
|
||||
"sha256:0a7dcbcd3f1913f664aca35d47c1331fce738d44ec34b7be8b9d332151b0b01e",
|
||||
"sha256:1eb7bb0df6f6f583dd8e054689def236255161ebbcf62b226454ab9ec663746b",
|
||||
"sha256:21ca464b3a4b8d8e86ba0ee5045e103a1fcfac3b39319727bc0fc58c09c6aff7",
|
||||
"sha256:34dae04a0dce5730d8eb7894eab617d8a70d0c97da76b905de9efb7128ad7085",
|
||||
"sha256:3520667fda779eb788ea00080124875be18f2d8f0848ec00733c0ec3bb8219fc",
|
||||
"sha256:3fa3a7ccf96e826affdf1a0a9432be74dc73423125c8f96a909e3835a5ef194a",
|
||||
"sha256:5b0fbfae7ff7febdb74b574055c7466da334a5371f253732d7e2e7525d570498",
|
||||
"sha256:8695456444f277af73a4877db9fc979849cd3ee74c198d04fc0776ebc3db52b9",
|
||||
"sha256:94cc5ed4ceaefcbe5bf38c8fba6a21fc1d365bb8fb826ea1688e3370b2e24a1c",
|
||||
"sha256:94fff993ee9bc1b2440d3b7243d488c6a3d9724cc2b09cdb297f6a886d040ef7",
|
||||
"sha256:9965c46c674ba8cc572bc09a03f4c649292ee73e1b683adb1ce81e82e9a6a0fb",
|
||||
"sha256:a00cf305f07b26c351d8d4e1af84ad7501eca8a342dedf24a7acb0e7b7406e14",
|
||||
"sha256:a305600e7a6b7b855cd798e00278161b681ad6e9b7eca94c721d5f588ab212af",
|
||||
"sha256:cd65b60cfe004790c795cc35f272e41a3df4631e2fb6b35aa7ac6ef2859d554e",
|
||||
"sha256:d2a6e5ef66503da51d2110edf6c403dc6b494cc0082f85db12f54e9c5d4c3ec5",
|
||||
"sha256:d9ec0e67a14f9d1d48dd87a2531009a9b251c02ea42851c060b25c782516ff06",
|
||||
"sha256:f44d141b8c4ea5eb4dbc9b3ad992d45580c1d22bf5e24363f2fbf50c2d7ae8a7"
|
||||
"sha256:0003a52a123602e1acee177dc90dd201f9bb1e73f24a070db7d36c588e8f5c7d",
|
||||
"sha256:0e85aaae861d0485eb5a79d33226dd6248d2a9f133b81532c8f5aae37de10ff7",
|
||||
"sha256:594a1db4511bc4d960571536abe21b4e5c3003e8750ab8365fafce71c5d86901",
|
||||
"sha256:69e836c9e5ff4373ce6d3ab311c1a2eed274793083858d3cd4c7d12ce20d5f9c",
|
||||
"sha256:788a3c9942df5e4371c199d10383f44a105d67d401fb4304178020142f020244",
|
||||
"sha256:7e177e4bea2de937a584b13645cab32f25e3d96fc0bc4a4cf99c27dc77682be6",
|
||||
"sha256:83d9d2dfec70364a74f4e7c70ad04d3ca2e6a08b703606993407bf46b97868c5",
|
||||
"sha256:84ef7a0c10c24a7773163f917f1cb6b4444597efd505a8aed0a22e8c4780f27e",
|
||||
"sha256:9e21301f7a1e7c03dbea73e8602905a4ebba641547a462b26dd03451e5769e7c",
|
||||
"sha256:9f6b0492d111b43de5f70052e24c1f0951cb9e6022188ebcb1cc3a3d301469b0",
|
||||
"sha256:a69bd3c68b98298f490e84519b954335154917eaab52cf582fa2c5c7efc6e812",
|
||||
"sha256:b4890d5fb9b7a23e3bf8abf5a8a7da8e228f1e97dc96b30b95685df840b6914a",
|
||||
"sha256:c366df0401d1ec4e548bebe8f91d55ebcc0ec3137900d214dd7aac8427ef3030",
|
||||
"sha256:dc42f645f8f3a489c3dd416730a514e7a91a59510ddaadc09d04224c098d3302"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==3.4.8"
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
|
||||
"version": "==3.3.1"
|
||||
},
|
||||
"jinja2": {
|
||||
"hashes": [
|
||||
"sha256:1f06f2da51e7b56b8f238affdd6b4e2c61e39598a378cc49345bc1bd42a978a4",
|
||||
"sha256:703f484b47a6af502e743c9122595cc812b0271f661722403114f71a79d0f5a4"
|
||||
"sha256:03e47ad063331dd6a3f04a43eddca8a966a26ba0c5b7207a9a9e4e08f1b29419",
|
||||
"sha256:a6d58433de0ae800347cab1fa3043cebbabe8baa9d29e668f1c768cb87a333c6"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==3.0.1"
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
|
||||
"version": "==2.11.3"
|
||||
},
|
||||
"markupsafe": {
|
||||
"hashes": [
|
||||
"sha256:01a9b8ea66f1658938f65b93a85ebe8bc016e6769611be228d797c9d998dd298",
|
||||
"sha256:023cb26ec21ece8dc3907c0e8320058b2e0cb3c55cf9564da612bc325bed5e64",
|
||||
"sha256:0446679737af14f45767963a1a9ef7620189912317d095f2d9ffa183a4d25d2b",
|
||||
"sha256:0717a7390a68be14b8c793ba258e075c6f4ca819f15edfc2a3a027c823718567",
|
||||
"sha256:0955295dd5eec6cb6cc2fe1698f4c6d84af2e92de33fbcac4111913cd100a6ff",
|
||||
"sha256:0d4b31cc67ab36e3392bbf3862cfbadac3db12bdd8b02a2731f509ed5b829724",
|
||||
"sha256:10f82115e21dc0dfec9ab5c0223652f7197feb168c940f3ef61563fc2d6beb74",
|
||||
"sha256:168cd0a3642de83558a5153c8bd34f175a9a6e7f6dc6384b9655d2697312a646",
|
||||
"sha256:1d609f577dc6e1aa17d746f8bd3c31aa4d258f4070d61b2aa5c4166c1539de35",
|
||||
"sha256:1f2ade76b9903f39aa442b4aadd2177decb66525062db244b35d71d0ee8599b6",
|
||||
"sha256:2a7d351cbd8cfeb19ca00de495e224dea7e7d919659c2841bbb7f420ad03e2d6",
|
||||
"sha256:2d7d807855b419fc2ed3e631034685db6079889a1f01d5d9dac950f764da3dad",
|
||||
"sha256:2ef54abee730b502252bcdf31b10dacb0a416229b72c18b19e24a4509f273d26",
|
||||
"sha256:36bc903cbb393720fad60fc28c10de6acf10dc6cc883f3e24ee4012371399a38",
|
||||
"sha256:37205cac2a79194e3750b0af2a5720d95f786a55ce7df90c3af697bfa100eaac",
|
||||
"sha256:3c112550557578c26af18a1ccc9e090bfe03832ae994343cfdacd287db6a6ae7",
|
||||
"sha256:3dd007d54ee88b46be476e293f48c85048603f5f516008bee124ddd891398ed6",
|
||||
"sha256:47ab1e7b91c098ab893b828deafa1203de86d0bc6ab587b160f78fe6c4011f75",
|
||||
"sha256:49e3ceeabbfb9d66c3aef5af3a60cc43b85c33df25ce03d0031a608b0a8b2e3f",
|
||||
"sha256:4efca8f86c54b22348a5467704e3fec767b2db12fc39c6d963168ab1d3fc9135",
|
||||
"sha256:53edb4da6925ad13c07b6d26c2a852bd81e364f95301c66e930ab2aef5b5ddd8",
|
||||
"sha256:5855f8438a7d1d458206a2466bf82b0f104a3724bf96a1c781ab731e4201731a",
|
||||
"sha256:594c67807fb16238b30c44bdf74f36c02cdf22d1c8cda91ef8a0ed8dabf5620a",
|
||||
"sha256:5bb28c636d87e840583ee3adeb78172efc47c8b26127267f54a9c0ec251d41a9",
|
||||
"sha256:60bf42e36abfaf9aff1f50f52644b336d4f0a3fd6d8a60ca0d054ac9f713a864",
|
||||
"sha256:611d1ad9a4288cf3e3c16014564df047fe08410e628f89805e475368bd304914",
|
||||
"sha256:6557b31b5e2c9ddf0de32a691f2312a32f77cd7681d8af66c2692efdbef84c18",
|
||||
"sha256:693ce3f9e70a6cf7d2fb9e6c9d8b204b6b39897a2c4a1aa65728d5ac97dcc1d8",
|
||||
"sha256:6a7fae0dd14cf60ad5ff42baa2e95727c3d81ded453457771d02b7d2b3f9c0c2",
|
||||
"sha256:6c4ca60fa24e85fe25b912b01e62cb969d69a23a5d5867682dd3e80b5b02581d",
|
||||
"sha256:6fcf051089389abe060c9cd7caa212c707e58153afa2c649f00346ce6d260f1b",
|
||||
"sha256:7d91275b0245b1da4d4cfa07e0faedd5b0812efc15b702576d103293e252af1b",
|
||||
"sha256:905fec760bd2fa1388bb5b489ee8ee5f7291d692638ea5f67982d968366bef9f",
|
||||
"sha256:97383d78eb34da7e1fa37dd273c20ad4320929af65d156e35a5e2d89566d9dfb",
|
||||
"sha256:984d76483eb32f1bcb536dc27e4ad56bba4baa70be32fa87152832cdd9db0833",
|
||||
"sha256:99df47edb6bda1249d3e80fdabb1dab8c08ef3975f69aed437cb69d0a5de1e28",
|
||||
"sha256:a30e67a65b53ea0a5e62fe23682cfe22712e01f453b95233b25502f7c61cb415",
|
||||
"sha256:ab3ef638ace319fa26553db0624c4699e31a28bb2a835c5faca8f8acf6a5a902",
|
||||
"sha256:add36cb2dbb8b736611303cd3bfcee00afd96471b09cda130da3581cbdc56a6d",
|
||||
"sha256:b2f4bf27480f5e5e8ce285a8c8fd176c0b03e93dcc6646477d4630e83440c6a9",
|
||||
"sha256:b7f2d075102dc8c794cbde1947378051c4e5180d52d276987b8d28a3bd58c17d",
|
||||
"sha256:baa1a4e8f868845af802979fcdbf0bb11f94f1cb7ced4c4b8a351bb60d108145",
|
||||
"sha256:be98f628055368795d818ebf93da628541e10b75b41c559fdf36d104c5787066",
|
||||
"sha256:bf5d821ffabf0ef3533c39c518f3357b171a1651c1ff6827325e4489b0e46c3c",
|
||||
"sha256:c47adbc92fc1bb2b3274c4b3a43ae0e4573d9fbff4f54cd484555edbf030baf1",
|
||||
"sha256:d7f9850398e85aba693bb640262d3611788b1f29a79f0c93c565694658f4071f",
|
||||
"sha256:d8446c54dc28c01e5a2dbac5a25f071f6653e6e40f3a8818e8b45d790fe6ef53",
|
||||
"sha256:e0f138900af21926a02425cf736db95be9f4af72ba1bb21453432a07f6082134",
|
||||
"sha256:e9936f0b261d4df76ad22f8fee3ae83b60d7c3e871292cd42f40b81b70afae85",
|
||||
"sha256:f5653a225f31e113b152e56f154ccbe59eeb1c7487b39b9d9f9cdb58e6c79dc5",
|
||||
"sha256:f826e31d18b516f653fe296d967d700fddad5901ae07c622bb3705955e1faa94",
|
||||
"sha256:f8ba0e8349a38d3001fae7eadded3f6606f0da5d748ee53cc1dab1d6527b9509",
|
||||
"sha256:f9081981fe268bd86831e5c75f7de206ef275defcb82bc70740ae6dc507aee51",
|
||||
"sha256:fa130dd50c57d53368c9d59395cb5526eda596d3ffe36666cd81a44d56e48872"
|
||||
"sha256:00bc623926325b26bb9605ae9eae8a215691f33cae5df11ca5424f06f2d1f473",
|
||||
"sha256:09027a7803a62ca78792ad89403b1b7a73a01c8cb65909cd876f7fcebd79b161",
|
||||
"sha256:09c4b7f37d6c648cb13f9230d847adf22f8171b1ccc4d5682398e77f40309235",
|
||||
"sha256:1027c282dad077d0bae18be6794e6b6b8c91d58ed8a8d89a89d59693b9131db5",
|
||||
"sha256:13d3144e1e340870b25e7b10b98d779608c02016d5184cfb9927a9f10c689f42",
|
||||
"sha256:195d7d2c4fbb0ee8139a6cf67194f3973a6b3042d742ebe0a9ed36d8b6f0c07f",
|
||||
"sha256:22c178a091fc6630d0d045bdb5992d2dfe14e3259760e713c490da5323866c39",
|
||||
"sha256:24982cc2533820871eba85ba648cd53d8623687ff11cbb805be4ff7b4c971aff",
|
||||
"sha256:29872e92839765e546828bb7754a68c418d927cd064fd4708fab9fe9c8bb116b",
|
||||
"sha256:2beec1e0de6924ea551859edb9e7679da6e4870d32cb766240ce17e0a0ba2014",
|
||||
"sha256:3b8a6499709d29c2e2399569d96719a1b21dcd94410a586a18526b143ec8470f",
|
||||
"sha256:43a55c2930bbc139570ac2452adf3d70cdbb3cfe5912c71cdce1c2c6bbd9c5d1",
|
||||
"sha256:46c99d2de99945ec5cb54f23c8cd5689f6d7177305ebff350a58ce5f8de1669e",
|
||||
"sha256:500d4957e52ddc3351cabf489e79c91c17f6e0899158447047588650b5e69183",
|
||||
"sha256:535f6fc4d397c1563d08b88e485c3496cf5784e927af890fb3c3aac7f933ec66",
|
||||
"sha256:596510de112c685489095da617b5bcbbac7dd6384aeebeda4df6025d0256a81b",
|
||||
"sha256:62fe6c95e3ec8a7fad637b7f3d372c15ec1caa01ab47926cfdf7a75b40e0eac1",
|
||||
"sha256:6788b695d50a51edb699cb55e35487e430fa21f1ed838122d722e0ff0ac5ba15",
|
||||
"sha256:6dd73240d2af64df90aa7c4e7481e23825ea70af4b4922f8ede5b9e35f78a3b1",
|
||||
"sha256:6f1e273a344928347c1290119b493a1f0303c52f5a5eae5f16d74f48c15d4a85",
|
||||
"sha256:6fffc775d90dcc9aed1b89219549b329a9250d918fd0b8fa8d93d154918422e1",
|
||||
"sha256:717ba8fe3ae9cc0006d7c451f0bb265ee07739daf76355d06366154ee68d221e",
|
||||
"sha256:79855e1c5b8da654cf486b830bd42c06e8780cea587384cf6545b7d9ac013a0b",
|
||||
"sha256:7c1699dfe0cf8ff607dbdcc1e9b9af1755371f92a68f706051cc8c37d447c905",
|
||||
"sha256:7fed13866cf14bba33e7176717346713881f56d9d2bcebab207f7a036f41b850",
|
||||
"sha256:84dee80c15f1b560d55bcfe6d47b27d070b4681c699c572af2e3c7cc90a3b8e0",
|
||||
"sha256:88e5fcfb52ee7b911e8bb6d6aa2fd21fbecc674eadd44118a9cc3863f938e735",
|
||||
"sha256:8defac2f2ccd6805ebf65f5eeb132adcf2ab57aa11fdf4c0dd5169a004710e7d",
|
||||
"sha256:98bae9582248d6cf62321dcb52aaf5d9adf0bad3b40582925ef7c7f0ed85fceb",
|
||||
"sha256:98c7086708b163d425c67c7a91bad6e466bb99d797aa64f965e9d25c12111a5e",
|
||||
"sha256:9add70b36c5666a2ed02b43b335fe19002ee5235efd4b8a89bfcf9005bebac0d",
|
||||
"sha256:9bf40443012702a1d2070043cb6291650a0841ece432556f784f004937f0f32c",
|
||||
"sha256:a6a744282b7718a2a62d2ed9d993cad6f5f585605ad352c11de459f4108df0a1",
|
||||
"sha256:acf08ac40292838b3cbbb06cfe9b2cb9ec78fce8baca31ddb87aaac2e2dc3bc2",
|
||||
"sha256:ade5e387d2ad0d7ebf59146cc00c8044acbd863725f887353a10df825fc8ae21",
|
||||
"sha256:b00c1de48212e4cc9603895652c5c410df699856a2853135b3967591e4beebc2",
|
||||
"sha256:b1282f8c00509d99fef04d8ba936b156d419be841854fe901d8ae224c59f0be5",
|
||||
"sha256:b1dba4527182c95a0db8b6060cc98ac49b9e2f5e64320e2b56e47cb2831978c7",
|
||||
"sha256:b2051432115498d3562c084a49bba65d97cf251f5a331c64a12ee7e04dacc51b",
|
||||
"sha256:b7d644ddb4dbd407d31ffb699f1d140bc35478da613b441c582aeb7c43838dd8",
|
||||
"sha256:ba59edeaa2fc6114428f1637ffff42da1e311e29382d81b339c1817d37ec93c6",
|
||||
"sha256:bf5aa3cbcfdf57fa2ee9cd1822c862ef23037f5c832ad09cfea57fa846dec193",
|
||||
"sha256:c8716a48d94b06bb3b2524c2b77e055fb313aeb4ea620c8dd03a105574ba704f",
|
||||
"sha256:caabedc8323f1e93231b52fc32bdcde6db817623d33e100708d9a68e1f53b26b",
|
||||
"sha256:cd5df75523866410809ca100dc9681e301e3c27567cf498077e8551b6d20e42f",
|
||||
"sha256:cdb132fc825c38e1aeec2c8aa9338310d29d337bebbd7baa06889d09a60a1fa2",
|
||||
"sha256:d53bc011414228441014aa71dbec320c66468c1030aae3a6e29778a3382d96e5",
|
||||
"sha256:d73a845f227b0bfe8a7455ee623525ee656a9e2e749e4742706d80a6065d5e2c",
|
||||
"sha256:d9be0ba6c527163cbed5e0857c451fcd092ce83947944d6c14bc95441203f032",
|
||||
"sha256:e249096428b3ae81b08327a63a485ad0878de3fb939049038579ac0ef61e17e7",
|
||||
"sha256:e8313f01ba26fbbe36c7be1966a7b7424942f670f38e666995b88d012765b9be",
|
||||
"sha256:feb7b34d6325451ef96bc0e36e1a6c0c1c64bc1fbec4b854f4529e51887b1621"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==2.0.1"
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
|
||||
"version": "==1.1.1"
|
||||
},
|
||||
"packaging": {
|
||||
"hashes": [
|
||||
"sha256:7dc96269f53a4ccec5c0670940a4281106dd0bb343f47b7471f779df49c2fbe7",
|
||||
"sha256:c86254f9220d55e31cc94d69bade760f0847da8000def4dfe1c6b872fd14ff14"
|
||||
"sha256:5b327ac1320dc863dca72f4514ecc086f31186744b84a230374cc1fd776feae5",
|
||||
"sha256:67714da7f7bc052e064859c05c595155bd1ee9f69f76557e21f051443c20947a"
|
||||
],
|
||||
"markers": "python_version >= '3.6'",
|
||||
"version": "==21.0"
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
|
||||
"version": "==20.9"
|
||||
},
|
||||
"pycparser": {
|
||||
"hashes": [
|
||||
@ -209,33 +196,26 @@
|
||||
"sha256:5accb17103e43963b80e6f837831f38d314a0495500067cb25afab2e8d7a4018",
|
||||
"sha256:607774cbba28732bfa802b54baa7484215f530991055bb562efbed5b2f20a45e",
|
||||
"sha256:6c78645d400265a062508ae399b60b8c167bf003db364ecb26dcab2bda048253",
|
||||
"sha256:72a01f726a9c7851ca9bfad6fd09ca4e090a023c00945ea05ba1638c09dc3347",
|
||||
"sha256:74c1485f7707cf707a7aef42ef6322b8f97921bd89be2ab6317fd782c2d53183",
|
||||
"sha256:895f61ef02e8fed38159bb70f7e100e00f471eae2bc838cd0f4ebb21e28f8541",
|
||||
"sha256:8c1be557ee92a20f184922c7b6424e8ab6691788e6d86137c5d93c1a6ec1b8fb",
|
||||
"sha256:bb4191dfc9306777bc594117aee052446b3fa88737cd13b7188d0e7aa8162185",
|
||||
"sha256:bfb51918d4ff3d77c1c856a9699f8492c612cde32fd3bcd344af9be34999bfdc",
|
||||
"sha256:c20cfa2d49991c8b4147af39859b167664f2ad4561704ee74c1de03318e898db",
|
||||
"sha256:cb333c16912324fd5f769fff6bc5de372e9e7a202247b48870bc251ed40239aa",
|
||||
"sha256:d2d9808ea7b4af864f35ea216be506ecec180628aced0704e34aca0b040ffe46",
|
||||
"sha256:d483ad4e639292c90170eb6f7783ad19490e7a8defb3e46f97dfe4bacae89122",
|
||||
"sha256:dd5de0646207f053eb0d6c74ae45ba98c3395a571a2891858e87df7c9b9bd51b",
|
||||
"sha256:e1d4970ea66be07ae37a3c2e48b5ec63f7ba6804bdddfdbd3cfd954d25a82e63",
|
||||
"sha256:e4fac90784481d221a8e4b1162afa7c47ed953be40d31ab4629ae917510051df",
|
||||
"sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc",
|
||||
"sha256:fd7f6999a8070df521b6384004ef42833b9bd62cfee11a09bda1079b4b704247",
|
||||
"sha256:fdc842473cd33f45ff6bce46aea678a54e3d21f1b61a7750ce3c498eedfe25d6",
|
||||
"sha256:fe69978f3f768926cfa37b867e3843918e012cf83f680806599ddce33c2c68b0"
|
||||
"sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc"
|
||||
],
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
|
||||
"version": "==5.4.1"
|
||||
},
|
||||
"resolvelib": {
|
||||
"six": {
|
||||
"hashes": [
|
||||
"sha256:8113ae3ed6d33c6be0bcbf03ffeb06c0995c099b7b8aaa5ddf2e9b3b3df4e915",
|
||||
"sha256:9b9b80d5c60e4c2a8b7fbf0712c3449dc01d74e215632e5199850c9eca687628"
|
||||
"sha256:30639c035cdb23534cd4aa2dd52c3bf48f06e5f4a941509c8bafd8ce11080259",
|
||||
"sha256:8b74bedcbbbaca38ff6d7491d76f2b06b3592611af620f8426e82dddb04a5ced"
|
||||
],
|
||||
"version": "==0.5.4"
|
||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
|
||||
"version": "==1.15.0"
|
||||
}
|
||||
},
|
||||
"develop": {}
|
||||
|
||||
@ -25,7 +25,7 @@ Once you've satisfied the the above assumptions, you can execute:
|
||||
- Switch from `cron-apt` to [`unattended-upgrades`](https://wiki.debian.org/UnattendedUpgrades)
|
||||
|
||||
## License
|
||||
Copyright (C) 2014–2021 Alan Orth
|
||||
Copyright (C) 2014–2020 Alan Orth
|
||||
|
||||
The contents of this repository are free software: you can redistribute
|
||||
it and/or modify it under the terms of the GNU General Public License
|
||||
|
||||
@ -5,7 +5,6 @@ inventory=hosts
|
||||
# instead of using --ask-vault-pass
|
||||
ask_vault_pass=True
|
||||
remote_user = provisioning
|
||||
interpreter_python=auto
|
||||
|
||||
ansible_managed = This file is managed by Ansible.%n
|
||||
template: {file}
|
||||
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
# file: group_vars/web
|
||||
|
||||
# all hosts run fail2ban with the sshd filter, but some can use other filters
|
||||
extra_fail2ban_filters:
|
||||
- nginx
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
@ -1,71 +1,87 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
39303965636262373331663530663562363864636132363362616636346166303835336463326261
|
||||
6435316332636438363630386231326231666163626335350a353662623034313766383035636237
|
||||
38346531313235613266646665363135393735613836393838313164356561663431333864353237
|
||||
6230666363363738370a306432643732626337376638383564323032626465306263643533653561
|
||||
63326261323032303466656162303132633933643232656238643936306235316436616237333963
|
||||
32633363333636303564383062636463393531326565643732396539386230393434633134306433
|
||||
38363130626139616631373336653530343762336165666131303464386561646434363163333034
|
||||
65323837313164343238623766373431656462376262393737323166306537353365663163383032
|
||||
61393662393433653937313533313537336132663432383634343163653866306232326464626131
|
||||
33356630666130376565663666613032333637633061663433623363626632356531313231393136
|
||||
64343463396632633061353861613438613537666466613132316265326530343733343535333836
|
||||
39376632373137383636623637373639653933623639646266336331353337343166313132613131
|
||||
32373632323363616333303863656537613264346439326662383265323731613263396138366161
|
||||
62393838376435393036383836646433346365306239666335356265616237336138373632313139
|
||||
63613236613166343332363730356262373131646462373561663964343438623863636539633030
|
||||
38353430363435616139353165633330396135383939396531333436663533666564653765336330
|
||||
39303832633931653461363766616562323865383832663434356534386337386262653730663838
|
||||
65623234356134393963376431653965353566303261386533383736316439636536363463633339
|
||||
35323939373939386436336233333664313735376439353062306562353435323031346335666334
|
||||
36306537643734316131373335613234363135393866333231343533623961333562646333663332
|
||||
64643036386237626138633561613966373831326331636437636564616662326563393336636138
|
||||
62643034333831333765636532633235653733303838393430363830346436646632373364353832
|
||||
33376635336338303230343833313936633832653235353836633932393230376435353739646563
|
||||
31653765393631316135366466353162633261386132633433313866363563386563383437623538
|
||||
33636134646531383130663038343939333565613736363162366132303535336663646265353138
|
||||
32376536623864656531346434383537396563383130386231336431653464326461326531393861
|
||||
62356361636434623133383264326433333163633964316262633138633838393234343538316465
|
||||
32656534623839343132313662636464333963306138356162623462353933633436333930346430
|
||||
33636235303339353236646438666233653736653566356638653538366131646432373338303535
|
||||
38643630363231656334623539633235393062656165316266626538663339363538343031323835
|
||||
34383865663936383161326664353464393263626262383463616336623662613233656630303037
|
||||
35633461643439666233666136626462353838323162653730646632636132323632663666316166
|
||||
34373237343931363331653966306535396635306364643135336234366364303062383332376532
|
||||
61623337326236623861326433653739613133666538396438643937353730363062626136333034
|
||||
35353733633234313965616439326666623936303464323462313037303230346164353366373661
|
||||
33613231316461386636383030643862616165623565623337346264656531393232323030306464
|
||||
37393065386161383532663862333263626338393832343566383065316434656564613831636535
|
||||
30653330393936323733373938353763643431366134636263616535343565656164343931326464
|
||||
65653464373231636337313932636238376130323566323637376634626439366635363537623234
|
||||
34656466366435666162643237383163303936383061393939356438303765313566343162303038
|
||||
37383531326436373336363134663838346463613462333265663363323538663437623830363831
|
||||
39333934316634386562333330613831386530633365613939393638373063323830636363356432
|
||||
62626562366634636266333737343238363235613366313737383335383264343435623434353838
|
||||
63633964333262616439623266643938313466396339343237666239363730393935626466366434
|
||||
66333739373662656237386663373465303336343432393735376463643562303431383832313934
|
||||
61396134393830303234383162633533336436346334393265363766386638303831613036343163
|
||||
33663638323235613465363539373965326430323035656564633830656365663537393233626365
|
||||
61646162383439626638633137656639653830366162636532616634313738353166633438346433
|
||||
64633037343864343939383865333737366638386331623230303830343636363938366432366265
|
||||
37313963633536396433376331663132643435376164393138653738376338623239323966363430
|
||||
63346464303162306332303036346362626134363666396130326163613730633966393438316333
|
||||
30626365623532636436646138373434343031643131343238353661623636623138346333663866
|
||||
62393937376538343135353030653838346239393633343239313137663464353165653961336237
|
||||
36646332663539363438343939643335613236666630616636623837386133396262303033333435
|
||||
36336566333333393137666533323439303036653362333832346537356663656635356635363761
|
||||
62363638316435633563396662323131383736663939633133626131616638653665633963623439
|
||||
33343038326339356634366461346132393537613232623334326561366164333862343766386137
|
||||
66636437613661616261336232316436353739316463383063363663383230613934663334333538
|
||||
39623037646638386263643438623137346137616664396638366436383561313933633039393936
|
||||
32383432363363666466363364376631346365373239353339633532666134396138373765643031
|
||||
64333061343237616135643439396266616161333537333837643530633136313932623531653163
|
||||
36373165393238306264353461383765343938393635633236313565393733306536386464373639
|
||||
38386131623133376230653134316536356238336162356331376465613962356231316666643661
|
||||
65616138333731313961316463643137373831616266623631376266643864656164356531316238
|
||||
34376264373432356162363962353338393362386434313465643533396330386666636430663530
|
||||
66396665383431333534383038333163336639613435333039633136366235636638393337613232
|
||||
35636336383333376138306630383230383861396164386162323264376234396130323933666437
|
||||
38343036656562636130366663663565666530623765353265363833303634643862313634326461
|
||||
62643864613762386366633634343964396631356462346665663131623034303133346438613433
|
||||
6336623030393661663631303038366630353638613337653365
|
||||
37356463383831623061363666396235346361663734326234323239633332383431656534636337
|
||||
3238613566336363636235393535373330363562333135630a626531343430396666323139633833
|
||||
37656533353537393335393966323637326335666134613633643330313334383237383736623637
|
||||
6533343338396536640a376466633436643162393533646464343930346665616165613835373630
|
||||
66353037653339633038353033316463393234313630646138636633643066653636343739383730
|
||||
65343161306339343931323737336531646131363034343163366137616231363638313330343365
|
||||
31663932343436313364326331373733373830646637313733323335306161626135616438656363
|
||||
32623333646637633636316139613234613232393462306364633966666639623231643735663266
|
||||
35396266313936326532383139346361626532323263633662373139363638303961616638636535
|
||||
65343862623865386436643930353834323566356164386432373434336536363262356638313333
|
||||
64626633353565303538353634626438363131633164636263643938386538323932346337343730
|
||||
31336266343532306531626234323962353930343333656436356436343666336335633233386462
|
||||
34623332393734633761303762306336656232326533313131316331326639376338393437363834
|
||||
32663766633037316266373064376638643237343434356166613862383963633231353531646432
|
||||
36393438653234326330316438333862396163383231623034383963336435393533393263653739
|
||||
38373764373034313231373536653233666230333437626431383161346636376434383135393434
|
||||
30353361343136663135356536316630643163613930306363343830323932393635343936396535
|
||||
38366638353737336637356237646332353438303632396238356364343464323064373031656331
|
||||
31346134323965646336666336303835326463656339356131613633336539613234653332353539
|
||||
35613362653335663863626532363433663634393036373462663833636333646661643865353533
|
||||
39376535313635373434633466643135323762613539366135376536653761303134303964343534
|
||||
65333934396638373239646339343732623139303037336133363533653330383261383437393061
|
||||
37336334363237333437633664313637366566396232336337303235366337616530333261356662
|
||||
39666531653762326364353534623431333530653935316161383535663762636136316239336233
|
||||
35373962623934633663656337306439616431316165666563336532373135323566386431303733
|
||||
36313264323066653164346338653433393337623666646162383666303930613939396662373965
|
||||
38653863623935336632666366373764383136376163663137313234663761343066336235626232
|
||||
35303532376537643663653431323830623364623362346437396664386363396632646364666130
|
||||
62663265363334383663626661363632646432393463373564396633393235353434636437623261
|
||||
30323866636332356136396662363930613961613961343963313733343033616539316131323262
|
||||
65666665663731636633623464353430623135373430313065626438396363366335363466316132
|
||||
64353730383761386563353133396262366265343637643931643565386461303138613565303239
|
||||
37646339316366316431663237653230346464643433376639356462643133643234386131613965
|
||||
66333831663832326131343134633231636633373735333634663861393531633738366136356130
|
||||
38653534666662303539353534636537343665366231346565376437313037646162663365666630
|
||||
33366631653530326234326333623333346535343362666263376561333334633533356264393637
|
||||
64633864616430653663366133343962376233656562643335633336326335626664653861323334
|
||||
65653864323062616234343636633435396332636635653266353032623637356133383538383034
|
||||
36383936666238333366386637313434656332626266346439346566666537623039323936303936
|
||||
62353130663632636636623466326663623639313433353766346230383138323461643962666562
|
||||
65646234346631613139393265666663663537323236383832373532393662643566636164653364
|
||||
39636133613937393433636231626238386463376434666166643662313661663635356436636165
|
||||
38333830313638643863373162636530346433613366613437643932383035643464363732663633
|
||||
38633065366638656635356462393935383665386532633936366437333233316563366231393935
|
||||
32393736343365383164346634326336373436386630386630616436373139646531353038333562
|
||||
39646132643332373563613664303931633735656135376561646166343934396130343834653461
|
||||
62343662386239313731336538393430316263333966306530616161633763306331633834323633
|
||||
35633237333136366439376666636461356131663830323832646462653035643561396337633362
|
||||
64323532663637323966663262353266316361353931333738323762656532343165626266653035
|
||||
36353462306361383233303464353766323466393862313037386139326231656230343630616139
|
||||
34626533323065646636643736323535356461623063663262656562333466666634376239356633
|
||||
38373362363030346434316261643236363337663237323032623339393936303130393662666434
|
||||
33386134386633623930376334333466666137356432636131373562306533333836353332316136
|
||||
63653533336232336632353465373263363037313933663131633763343366663034353364373661
|
||||
63333166306332663837313334623231653561363964306337353564326266353366343538366433
|
||||
63383335336566366564333735383337353765613035383135616135653662346133333338303730
|
||||
36303334623335613836333938646366376634353664633731666235346638346662656634393631
|
||||
35396262323939393562306530323763353939363264666331373266363937653063366138636364
|
||||
36623835383961336331303439613731633734343135323938306263363637616235336461333732
|
||||
65303636623766313038356266363666316665343832623662643263623233356232333062333933
|
||||
65373763376430366565363161333330376138313130363534623364653434616438363732643333
|
||||
61336631653762613231373236613164623566663730396163383136366430353439346637623965
|
||||
39356138633037313165333034633234353666646132656532386332393962626239383633383833
|
||||
64396430343535346438623233326632663839336233316336383261346330353739633331396362
|
||||
65643161396430646436376636613061656566623038633665623938656232633665633365613837
|
||||
36386633313032306238373063346662333539313931366232323931613165343639666437386630
|
||||
63343766633336346632393231303566323562373236656135366135376262613163646235646635
|
||||
31356264393231353335363331663666623832643638653064366438373063623462333631663631
|
||||
32356664663332356538636462383364633036303733393161366565393361363530626431623532
|
||||
34303538653032313138373339663833613637356364376561316535643238356633356130376665
|
||||
37643231333037626164663634383666323333316235353832333335393262366235613461623166
|
||||
30343933643637656262613337313962666432656632323631353066353838373864383734646361
|
||||
35393966646331633466316636326162343831393639383034396133383537313138646339646163
|
||||
37363736613135326634363031626132326664343732646161623362373036323337623063653064
|
||||
37373839396261653764626338393438643634666463336263346566653366336536376464643934
|
||||
31366261353734383064346433363730623762636463613432373338356337656665376338353965
|
||||
34353866343734633661633466313132663463323962653431316536643565666364386438336236
|
||||
35376163313462383130366337653239623866663837666238346262636238623932333435623634
|
||||
65333132373436353533333834653131656638336362623535613366346266653863326431666137
|
||||
32613563316138333837333131663637346634663962616230623534383239616132623130646137
|
||||
62613863626632323838343736633765393666336664313563316535346130333462353063656166
|
||||
62376237663566396665366238323937343434363964653133393163343932353761353038373234
|
||||
33303462613837653730646462643765396631656536353335353532663033663433613032623833
|
||||
36656534646163353266316531343137626131316536396338666262336136653734613838333133
|
||||
62663937346566626131323033313432333562633337326634623866656363393165363235386265
|
||||
6332653639336330336135333865633662363738613565303766
|
||||
|
||||
@ -1,112 +1,127 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
30376632333335323537323138636238323530386133633466623762316234336531396562613262
|
||||
6436623766616265346136633061383834323438303661350a373331386231633036313264616262
|
||||
64303263633334383736616133666330646666623936373762356131626637383939643739376563
|
||||
6137333439396337330a643631353338366666363135393635356333313232633638386366653163
|
||||
63643165356563383265333534303430363939643539396637303861396432633963653332653164
|
||||
33346537336434666333343733623464653565386630346131306538356238306537353037363139
|
||||
30383039346539356166313534666433393539633231356138303662386137626136623735303161
|
||||
62633036653531303837666331636165386164613766643764653664633361353431343139653266
|
||||
31393937656565303161646135376130613932376266616337633262613739333830356235633030
|
||||
32326230633536353938363032373165353737643631636662663333386561393262313866346530
|
||||
39376532633961376337613133636233366433623764666536616439643833316331633965616364
|
||||
30336135643639313531323538663337363930373630633238356663623366666539313161323839
|
||||
66656530333136663932643731663739636331633363623063646366353935666634636365653934
|
||||
62643461306163626632353732356133313563326163646661343134383064353966363933643033
|
||||
66346636363662656138326530366136303762326265636364323038653562366631366563613830
|
||||
34316130393030643136663263643934333731626361333932363338396661346330323234363135
|
||||
65663631333630303032373530363930333062643436303736303938656331373138623163396232
|
||||
36643838303038363736306639353238373234643162313233356463333764393031643865323033
|
||||
30353031363061643363623464376164636233623765343739613565336236626638393966396631
|
||||
66396262653535663365343434316139363235633333613438316162323538663562336164656438
|
||||
62653532636631653831663331353536633335376465653935313564333364363565323761636261
|
||||
63653565383837623936313535313063373336663337643837363831653235303530646464633935
|
||||
62663932373634356631633736656166356539346339656363613933656562323965633165613837
|
||||
35396330353861316562653166363931333362333863663231386538363932383361316439313561
|
||||
30313266626162633965316331633330616435376539626239356266313439653162613731323261
|
||||
36343961623763376664326137303866376562346438623739393665333539366537373461393739
|
||||
65336230623138336166376565643865626362323336343833653964643166613738363361353464
|
||||
31333832663234613035383731666130326461393063313933343132336432653439323439373131
|
||||
34376232323132623532646532306337373531316466303037326139666133613930666662373236
|
||||
31303031626532333133666133306337366530353139393433643432386132393662383363376335
|
||||
65623839313935613761303865313632303166343732343964393539313732333033613034306661
|
||||
30333832656636316232643439633831633530373866343866306432646534336634383830353335
|
||||
34303336303735386166653034346137643961363031336461653165376235323763346531353762
|
||||
38346230666138336333383537353132336665376163363032613639363830353634623662303564
|
||||
65373235646339386635353430623464336230313234363332656335346432313235373230643130
|
||||
33623761343635303131366239363837656262366364643162393036343630336232363032623466
|
||||
30663531343830613461393038353638666266623162653464643761323237616337633937353933
|
||||
61643666386536306664636237346231623764326536656537613535383038613365313332623964
|
||||
31306462626361653131666337653638313135663833386535366464333838333463326363306463
|
||||
32396338373361303736373135326230393330376539316564626362646166343362366465623232
|
||||
33623636653061653461303537613232346333396137313762663539623631636361303837336666
|
||||
62636638363735653965303532393130303733316231613134313637666166323238336333333966
|
||||
63353663326234663735336265643833626161623332373261376635633364613337396638666361
|
||||
63653435366135666162653739303032313438343031653561313739336135333937633933383966
|
||||
61336439656638616432383164376166356362333738373135386538613164373537396435323332
|
||||
37626530363437323765646561366437393562653839333964396538656265326563393863653662
|
||||
32646432383966363732386163376263373433633934623237636335363163386332633565636334
|
||||
36396330313761663237386165333465383033376330633461643666636136656635343365316266
|
||||
66643363663666343337313530663762303234643335326563656239613665373633393837643963
|
||||
35356263393566363362373965393331353439633431633539336565333565326631336631323833
|
||||
35656466626463663037386334343530356661663236646166353733333431656534376439646235
|
||||
31653564636264666137396362643763353364393132306432336164356366616533363937393665
|
||||
61353161343238316433363733636530633361316436303863666466666162363835643437653633
|
||||
31376561653266373863623266393464363433303436656563376561643237396436333462333365
|
||||
31656238383631643034363063633132343665663563656333613636636134383333343662313237
|
||||
32643839646363343162383536343066643862666439653462376231386538356430373263393865
|
||||
61663333373330316131653335643161626366333237383633363564316231633761323165313265
|
||||
32666137643236333561616331373236373137663866656539663738343862666534386531336661
|
||||
30643533633566326135333464316264636461376630363732336339373730663239356265663834
|
||||
33643933326231373464333263336632313633303431396539346238383761346363323230623832
|
||||
39623866306261373035633166656234313461306535383638386431666164313936356664616264
|
||||
65343934383931303962653536643031636235626234306164386531633535633139393835636435
|
||||
39616166363031396564373932376534383830313034333764333161316438396636383265643235
|
||||
66373332633037376138653230333664393164613136316439393531623134383261626262383432
|
||||
63313461373136616236656432343262663734663665623838383032666631636635656339353335
|
||||
61636531356131393665323164643561646334363737343434613930616333383465623832306235
|
||||
61396136313662663839613034633433396664336361353539633561616238623864346166356161
|
||||
66373736633239353233313531633939643065303530323031623735636539633834653162633262
|
||||
63633265316234653537376463636138393139643661393233303631373562393234626161343766
|
||||
66363265393930353733623363653434313765323532646665626563373563616536393938623465
|
||||
37326330636664386464653832306138313137616464386339366539623434333062623136353539
|
||||
36643631323863393934333266376362323430356665653863316163336563323865396132323836
|
||||
62346131336133643438633064326236666165386439663931636335306333396534383462356135
|
||||
63306130376634386462663139323439333066383331336163623665616665316162613130376433
|
||||
38333339636237326230643061386234643064656138396163396134613837666531383261333230
|
||||
30643262333530396563366233323338656364666461316134363532636537303832343361313364
|
||||
65626566373266643165623832626634653733383334396435616139346434393036323162373861
|
||||
31356137353032613831643037613239393061306565336435313431333738623338323766303139
|
||||
38333137656564386334333666636431323738623264633136663239346635386662313366336334
|
||||
37643465333336383739623235373064363662373937663330623132623236313432306533373937
|
||||
66623130626638333962386334633537643338376566323638373939323230643734313263386531
|
||||
63623966613832626136393734326639363262386531343862353631303834643837346164646232
|
||||
66623561613436326363363932373563363337343431356432633663383636356339616362366638
|
||||
38363532393832643665356461393661373838613764383061643364383962663535353531346365
|
||||
61366266326135663264323132353832386135383165646439633561313636373633316666353065
|
||||
38396665636239653038653634653831363933633531653965636135316136393532623561373539
|
||||
36333263306664633865653365363261643135633062356637343365656133656336323131313562
|
||||
39316639383432326632396135313064353834656265383537313866396439663865363134363066
|
||||
61646337363537323531306434646163623162333362343162316235323436386337623761666638
|
||||
36376336616665336334353661333237366638343436613839613761326336363435326630633234
|
||||
37303562333762393334663462633063623036343331323761393932336166363038383731363238
|
||||
35363639353134383637396463633263353735386263663535336139616230303863313362616464
|
||||
39303264363566346666326236643563643961333232626637356534343530356430366238336339
|
||||
37626233383230636234623532643739353162303562633537303536376535646235313837376666
|
||||
62376365623566666561333933346232316637326634343437363333666530326237663632356338
|
||||
39376333653436366439663439343639613661396562623661376538646532316432646266663566
|
||||
39306235616335313731396436363836643766333462393733363833303938346561613764343738
|
||||
38356261346332666564633333363566353465316133396362313135623463376133666661363133
|
||||
61626232383631353965336362623835616137323837333139653338663739346265633832396535
|
||||
39373436316434633539353137636633386562323034656663303834313538333063613437393131
|
||||
37616162653566346233386130363134343536363862626430313064393437363063663439383463
|
||||
39613530393838323064636263633464623234323137323831383232333561663563303561363836
|
||||
62383430663333613062326530346465636164393133313832626135663231353965303131323631
|
||||
31363165623431373637623938353437663062623465303262316434373161326462326535616362
|
||||
31613934363836613961363637303161303833646165313462323938623664326231623662616664
|
||||
66613665326162373363303165613131343731323330326266336132323039306338343064663831
|
||||
35303832336132633061363664633166313963336563323130663735646662636362386461623930
|
||||
36356131646332336562383536626137303031323861663635393234393737353638623063363163
|
||||
35643965376632383430633232343861373335373132373738383032646138303862353562333533
|
||||
66306530646666363239383239616433376663303131366431666639323766616333313165313237
|
||||
626437356166333063393265353264346565
|
||||
35356461313263333464373365643730653766393437316133336138313761343130646131363861
|
||||
3834623038366139376261326439633334393565346666650a323963393665366134386535316530
|
||||
61316264343737383331663361353838656333623335393635393762303533313036373161393462
|
||||
6664616164633039360a613766323932323266613166646635376333626333356364316233633931
|
||||
37646436383339343938356164646262363032663063393038616535346139633435623265343762
|
||||
33663036393761643861386538336665366537626464373931386535666237636439383133393636
|
||||
31383938376331313531366237336463323563323134313037393435333239613663663234376239
|
||||
62346163663061316666636138353962383336623133333030396534323033626632343561386466
|
||||
30356266313566316565626562376364643238386561323165633730383262343638326337636264
|
||||
35636264386262363264633833653265393962373435653639363733636562343238363931663031
|
||||
63666135613437366166643130623034616636616632633838653464666130383365326434666234
|
||||
32643164353766323131343137373438613663646635326338303934613065653466613036323961
|
||||
38353034636434663061353138393130316432366539643937623935643834633964653630326564
|
||||
31636563336138623433366536663632313863313435333531353865623066656631343032383937
|
||||
65313535303563653762646261396366333737306331643037366433323030303265613638616164
|
||||
36336338333837393235326539303964323261393039393533643538623634613432643532333863
|
||||
66376166336662306564323433356330336662333433633061313266323638396165656665663965
|
||||
38376465383662626633396366326466333436333338373361363039306539396337333061643264
|
||||
37356562623130373765366331643332376337353065366561656261353131666533636466386432
|
||||
31643438633464356464333065316139626166326164616666363666393562356239343637333030
|
||||
39366231316462663265346464613333306336316163643131303235616432613565613733333466
|
||||
33343036326435643736336465303861643739663536343965346433363231323065643733336634
|
||||
63646133633037613964393935373161666161383862616333376638616336616537616363643661
|
||||
36326665316332303537663935633431626533323838393638653661343665306332396130393866
|
||||
66303231666533393132396538393963626132643366373539656437386663653261323465613366
|
||||
39633964366362353866326562313834313266656265363161316261386638623737393034663665
|
||||
66303966623830366431316432323863386332383362396534396166343238616534346335323761
|
||||
31366164623465643331323330323736336337653230623362626230623365636364633261653765
|
||||
38613566626537386134373133376139623062383736356634393739353665326164343131323833
|
||||
31313038363663316636356431613032636131303964373564633462303735323364636131373033
|
||||
30623336306663346639326638303930383466323938356163633964623565313261363139303238
|
||||
31326666363164376261393062616339643039316163346362633865356433346636323664656262
|
||||
65323565346137333338363864346437373261383936626531316330316539653339303464623462
|
||||
32616635373631323465646632323732323432316332353033656339366639663732313939303733
|
||||
37306130656662383237613361326161313039326561396538396333373362633365353130343963
|
||||
35613833616635353266636265313766323635303764346236306664346432366632376132333034
|
||||
65303235366137356634666138343232366533613966363030376537386162396638656637663932
|
||||
66663939393737313634383430323339663634333533653265656163326637636635386163313333
|
||||
38666236626131333139633834373534316638303364666135396361616130303061313431643936
|
||||
64666134623666363937356334356134306463386466613365363136663136393833616430623836
|
||||
65373663363664333766373136336636393663376535623532626632396665366436623661636665
|
||||
62333961383034353664323333353766343939666636616539653236646634313333373639643765
|
||||
32353161633665306463386633616131333130303139306134646134663865306463353838323565
|
||||
39313538393034323065333031386634396261336131333763393466633335666238373663623564
|
||||
38316633663536383730376532633830623939633662346636356632653031633335313732666663
|
||||
33613133653666313564626261353730373637396137323964363866653964373838613130643337
|
||||
32376165356236663332366566626639313038363138343061306438313435613862626564613830
|
||||
61306262613262366539663338643962313066613665353063306537643561666462333763623866
|
||||
30643230313334646535336662616137326437323438336361376562663361376230316362323235
|
||||
65363630666464323638323761343033313763633866623361376636653631396263626239613764
|
||||
64656163343435643838353033316364306134663833616231343831613338653330643466643630
|
||||
62323039396231366136353432373732613465336163326132353731313765356163323866633736
|
||||
35326665613165373339353165613036646665313065343432663563306664323163306535613338
|
||||
31663138333639666133323139326339313733663334336637373866636661636538666630346233
|
||||
31393364313433626565616661313265336165613534666232333835383963646433316632303533
|
||||
62626134623830363533393833633439313034633965346163393932636464326664653335643833
|
||||
35386332663736343766656232313031306534653434363164623530613232306531336561373534
|
||||
37333763626135373538313561303737623035653832333533663534313035313530373037616634
|
||||
30613937626664373333643735633164663930316235336663376132353338356333623431343535
|
||||
37623138363937646665626535303463643330333233363136313134383939343535646539346363
|
||||
61633966396234393961663735646634373266373264626635306162386632376262646336316266
|
||||
36363166393332626533613736353038656266323263333036303964656662663436616532396665
|
||||
64366638386164313466313630663138333066653061666362336661336539653339616234646538
|
||||
30316334346162363065313438663865346434313564363863613532313637313430653439333962
|
||||
34643039383030623564666230623264303338343564643961653531366463623166333661653630
|
||||
38613062626464663963626233663837653533626532653239343065383036663162646261386535
|
||||
36356231383263396365653639613664346361643666336463623136616330336161373336643535
|
||||
36613530396266633861643530633732333436373966613437343736653537333531663466383438
|
||||
64323064356262646133363463316639353630653766663731653030616461393139396265343033
|
||||
31336662366465633264643065386432376435346236323565326562663161396435373762613839
|
||||
36316365633937636330643837646335613262363734396261313633373731363466356632636532
|
||||
37653036336665393733343832363739323739383730306635306666333566366663396230623433
|
||||
64663338626239313265623838383933653539666666383633623939343461393036303230663562
|
||||
35363232636635613739356536386439326537363965626261363962383231386532623565343662
|
||||
61633931613131303836356366653030656333623235663266636535666632353666386666386630
|
||||
36303134613262663335623330356639383432353133333137363665633565363037333136653933
|
||||
64396230613837396435333835343265633638346232303738663764663032343061346539393135
|
||||
63303064366130333030663739326331633762386332333162393631346234306363313737663261
|
||||
31303437376339353634393438316139663862333530653339393030633932343765326435303530
|
||||
30326566336361646563313433663063396338663661353832666561393437306131336465343332
|
||||
63316533623362613062626337306530633833323132616662613366653566396136643936653435
|
||||
33323938333666333439653037383335353763386132643362643361386232383964366237326538
|
||||
32343061643462343265383234366465366232666434623634383132303138643333343663613039
|
||||
65663339663030326364663561383833333432633437313232356265396532303735316234353565
|
||||
39313532306437333238373064643238666632383166313832326662663762316165323936623239
|
||||
62366239393530366666343866376566623863373333666266316334346138396566613263333539
|
||||
38373438653663353537323961373434363735303838306262323330616538636333306366373663
|
||||
62666462336331623761363036353331356632643664373665656332663530613931376666353261
|
||||
64346531363265316439393633346334383439623338653334343739353464316436626635653139
|
||||
39633232626463303463646162633131626538353232646663356335363663613234376338623539
|
||||
30303765636635633331326337373334626664343063623130393438633863306531653631323763
|
||||
63323661356362346536646430623864306135663766313833366165653066343439663064336331
|
||||
33353135383830373831623463646461616665326139623565666464363961306461343361343665
|
||||
30633331666533383161623130613963376266613533366334393262313730313630323836623162
|
||||
33613637363431306632366230336537373732613337613830666635353632383834383465303261
|
||||
39633334616561386163353661306564333632653731363434666562353561363462376563626563
|
||||
63353666653637336666376138333966643237633434396561386164623435333836653238383261
|
||||
30643331373138313062616532366265313831613938373865336435383564636266663462636461
|
||||
63663230626532613130623566376437356337653564303033393737663735316130633234643163
|
||||
30373264363331366435383837303762363531333335613738613463336139643333626239346232
|
||||
31393631663861623330353536313731353332313135363436643161353435653865313666373639
|
||||
37313734306461633338363033623535653066633135666463303261383366333266613830623138
|
||||
37303963666139306632666537633137326434366231333435323335623130356332313165353733
|
||||
37656238613138396635303765376666303631633034306133393639363662313066653062373638
|
||||
63313961343932393964643538663863313664616164363264663438393639306161373539653265
|
||||
34346535373939316563353437663066656439353161623337343935396463363231636262656565
|
||||
61653766616238393030333837616631373736323837363136623337623539336661633533653663
|
||||
37376530303630313861376261323231303464653666323237373466353037313230333861373366
|
||||
61323964636235373030343462326166323533343266353236653138326639363664633066346239
|
||||
66636439373262646536333134306363313531333437316536656337633764356339633933336131
|
||||
64366565323438343864666462356232616263623530613631303265313861383135333562343263
|
||||
39633938313435313266386538346132336638303938373964616535313035653063636435643538
|
||||
31636134393930363635613733343538326637366661623833396531623832616238323637633866
|
||||
35666266656465323830356432653839633763643430363431326632393664656464363238363364
|
||||
64356132326561376330316434393765663661356466346463366538323439393531343632316134
|
||||
65313436623664613230616562323138343831623033643338363839343837303334346361356433
|
||||
63356163626432343733336531366333636466613863613438373662643266636134633934326432
|
||||
31386634363161653965303230306336373434613232613237343836353061613533616237666462
|
||||
35393935383431323764646465636563363633336463353064346631363531383061333135386161
|
||||
64363366303262336464646232316231613332333732373932643562626534666634316565343164
|
||||
39336436366163326137396236393034363162366634616233376465303063663330386137343733
|
||||
65393231343634316365326663666532646162623633373530393563313861653638353932396137
|
||||
38666161336432303666316263396538663665353334376637343762613262303062313932363831
|
||||
65346637366163333233633562393535306263666330666636613363383939393035643132326162
|
||||
35656130366237363136643938633931363731623662343536623136313436616265333138646239
|
||||
3765356139356136346264386137316437303865646335643530
|
||||
|
||||
191
host_vars/web19
191
host_vars/web19
@ -1,82 +1,111 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
32316564336430646233343166663333653363613837643863373531333737353431383233653733
|
||||
6535373830313135623134666430656164386365343738650a383239383839323032383363613938
|
||||
32383630373834633564336532343634336130303330323266373930623033663234306232656136
|
||||
6566666131306666310a636163366161373436326461626661353130386538313361666538663531
|
||||
37393336316638663065393338356535343732363765633762343536393662313539326432383337
|
||||
33613438383134393535663435333364363836346266383262336439356133343464313736636134
|
||||
35626530303836663834396266333461613463313634643661303430356633613137383634613038
|
||||
31646632326330633430653435353431646131363466316231636333663430636531376133623935
|
||||
65346466616433653463613538363630306338393632356365346330643463383835326466613930
|
||||
39323766653730373763333161303564306165316336393164343235613831333762646532333139
|
||||
31336561316337366537343464373735303138303763623632316235613333313230303433303337
|
||||
64333065626434333831613239363831356565363231656466623830613138616438633164393337
|
||||
39343634326461303839356231616336376430383639653535323538303364633761666432386230
|
||||
31653037666630663434303032333163643336326563623661326536653839323263623838646366
|
||||
37353566313737616337356165636234373835366236383661316331306530646165633037303866
|
||||
64646639366366353534376238333435613934316666396434346336353533626131646239376634
|
||||
63663064666434633265343432376337343533636566613930303930633861356234303838333138
|
||||
66323063386362373930306338636463663865353339376663323936613365336533373666323465
|
||||
31666634353034366236306562363361373664623634663837396162393738613536636165366332
|
||||
34643935626164633436333930373535623863303331663334376434643236353462666362303963
|
||||
39313139303731316264383434333863323764343737303733383535393763356130316337383564
|
||||
38656434303663333534376336613036653963306363303661336464346362656563303333303566
|
||||
39366163636439313030366461353064303233636364633064343664646339346365383465633038
|
||||
35353234353430623830623036383466663236663964316530333964643238626562396366623763
|
||||
35636439633064613931653963663331343961613764643364663336643264643535316634393834
|
||||
65393932343333326166643765623266313135363362656431633933656131336163653663373335
|
||||
37323531376438343561623237623433323234663531326436663162396562623963663936633837
|
||||
62336139623231663339303439353362306466663834626364326466336435323764373661616437
|
||||
62613664356633396264643766323535666562343336313033333632366231626666333630313261
|
||||
39663365316161316261633734663063633539333535393830653034663362323764643330653539
|
||||
37393832303435366639643730616239613935376233636537306232653034626532636563393336
|
||||
63323633366631623738393161373037623865633039386566653239663638343864643561346534
|
||||
33346238306434343639623135373861333830376561663433306139383864653333356264376631
|
||||
39633437393538356565623962643465666538343031383737616532316230383466346261383762
|
||||
33613535336663386434366365336330353337653365663132336130366338343433333863306135
|
||||
62303738353634613462313866366231386430373566653339316333353364373761663161623736
|
||||
64313262303963336364376534336462373939623033666163633337323837363138363937663665
|
||||
39613263633463376362626565306564353864393965333663663334643931363862306635353061
|
||||
31633063303839633030306363646161646466323734616536343965636539633630326664636139
|
||||
61653832386339326132303334616136393731393263313034643037383063326566343936666562
|
||||
38393363306231306436636235633533373731616137653965316133303661663163313661373466
|
||||
36653864666232313064353066386133613764623562623035386263363962653432633633366230
|
||||
32373033303234666264356665363031343633663236313738636238306535313536353232663037
|
||||
38316237353433396166636165643261643464313762666333393265376465323630313463333465
|
||||
61613735613864313662383735306638363436316162353536633836653637613439373635376566
|
||||
36613162393638313363396237313466646166346139373230336533346234356665646432646562
|
||||
32343863343435643462663362396564626536323665343230343632396135303930306334383534
|
||||
39356166303230643465643737386634633531393238313631393664663237316236356465383532
|
||||
32353263326364383465623733326532633330663738633564313264306636623137323433396264
|
||||
33623164333662383335623964393330373264646265366662613236613033653035623932666264
|
||||
34373639666432656464363433356466653331633238373863343064656431666561636236376332
|
||||
30333930623539376636316263663663303130616537356632383036386438663630623261636239
|
||||
63623238646364323431613936646337306361373539346465303635383065306664643566363137
|
||||
37643163373833343162653563623432656132653462313334333439303236383563326465323038
|
||||
31353936636563613865383730363462626636383430336536656436656136333764353133663936
|
||||
38623330303531373461396163366237656632666538303034343961396631313966653532373465
|
||||
62393562303330613164346464373764633933323539353861326239343133613236613663366265
|
||||
38623138316138383832353931626530303538346433303035313266366638313437356264626661
|
||||
30363631316234303634343561656431633632666139363330396465316564323864653434643730
|
||||
39646531353233313639323365353736613262646164343664656162386536666361646666643238
|
||||
34333462333632643236343665316534626537393362353633383539633131613233646262313961
|
||||
66656131323333303939316239643739323665306433626366656538366438653934656336303130
|
||||
36613430613565666437323233343132303432383533396533373439306630343430353535343333
|
||||
35616361376539376661336637346562636438646534623265393635313466633937363135316238
|
||||
65616265396337303431333262306330383365643035303639303538303266323932613466363336
|
||||
31366565653731393661616132353235386162346338343734356633303433366666303332626662
|
||||
35353261306264346534333161333165633163376534303861663863326638623761343733303433
|
||||
63343365626463613965363134663137373538633533616635356561646235623365373633303064
|
||||
31666562613134306632356564383166336464343833633037623663656338623637336135663562
|
||||
38326538643961333363353831303266326262333730633565383666326137393430373966316161
|
||||
66376230323633333562623564636264353138303039306537383930376464333233643862613038
|
||||
38313231386161343438303433646566633236353232313737613563613932373035623034653066
|
||||
63643330316462303832306533376330383466373566643233373334336330666362653337316137
|
||||
38353930343338393162313135616165373437633737376131346662306438643537316537653330
|
||||
65643731383435393530383038316431663638396538313131306661663934313535616261356532
|
||||
36626435656332633861616465326231386635383838633232653432336362313164633839326339
|
||||
65303834613235326436386539613537646363633733323735646630343631636235393533656266
|
||||
65656639356337623464346337326232616234313664306165376437633562643861373231636131
|
||||
37623735333165633762346238326430323336653962643731333166616137376562643430376531
|
||||
30303164333761333161323730656430356534376166326431373137636438303636386330393435
|
||||
37336533663762303230653839336534316636373238623934663934646133646135
|
||||
66313066303030333063353236313063303262626561316535646263633936336534356437353265
|
||||
3432356362393665303438333166643066666164363861610a643434356531666366393936353233
|
||||
37353036656435616361613164323038663364666464373964653337396465373061666533373938
|
||||
6536323936393135370a666134613830306533623365363933376631313534326265666634366235
|
||||
36623637383636396437333735336238343434353733303764326237303033303562353237353165
|
||||
31653866633363623764353533356262643239613531643039393335313731383038343638663830
|
||||
36356139336363343437666230656366636132613531613339353962373435643563313734646135
|
||||
61613330323938363063313430343738306536636233353963636665393132643162303562666531
|
||||
61343365326634303730656133633632353936386431303631363731313730666132656334353731
|
||||
33616537313230666462653165643535386134663166346262363535383365616431613838383863
|
||||
65326163303966373938653033613238326634393166643630316230613065353437306237313933
|
||||
65366131396266393236373162343866383565633030356465613461353131643562343630336566
|
||||
30633534636634616666616462383136373830623137396366626639373230373834316563343464
|
||||
38303333366166323238346237646165383633383264333431663530326462323432366332333630
|
||||
62633132666439313034616465663861323064646564303963633565353734353665313138373636
|
||||
34653639353333373737613238626535356333633833363737646330643163326131386364646365
|
||||
64356435636635663737376239313236356361363061313731626230366336326535663866373231
|
||||
37623262613135636538343934336262633662383266653238613965356639626339303437306633
|
||||
38373837653737313465376231363637353561303937336138343465376638326163643065336462
|
||||
61633236373737363633646135396565303835643336393763393933613964663435306336346636
|
||||
38316231383363616533616437366362376664393135623765646330323161366134323263376466
|
||||
31386332333565643764343863353039313466643962373736643533666562353766383862326134
|
||||
31633366636365313231366337313334333130373833656135396262373136393135353039623739
|
||||
63626463636237633963323739303961663632376330336236663134666461383965303861333835
|
||||
38663337393930383834653936636365663966333033346562356331306430306338333761353762
|
||||
38363733356262363161353135633836336363376232326261623264623338663230663838386330
|
||||
35353762393839646338366365313763346339666433306532353530353261363838356639623436
|
||||
62306437616630663039653862393466353933333763386163373035373335343834663439633039
|
||||
34613463303436366631396462363866656533343063356265333539353038326637613063326164
|
||||
62663833363165643436343538666565386561383335393964313839626237623031343564656632
|
||||
35613534636437306463373466653431336562303132313462326233663561343837323331353035
|
||||
33303336356237306464363564666136633230396635623066376564373737353335356432343231
|
||||
66633735316466633039663338316566343739373664316335366462356237366139363731643366
|
||||
33353039373665333232383235303932623435366638313465396333316565646134343463336330
|
||||
65306334623631386364353364313638643930306265343363666366663164643435333834376439
|
||||
64396434366362343733323366343232653930646565313762376436663965626562636238623066
|
||||
63303236326362323966666630343136336563343564393833636465333832396666396638653661
|
||||
61323561393563326437386462656266303830353730313839613136656331323938616631386235
|
||||
30633730303838313038313263363363633136623861326662623366613461343133356261633030
|
||||
34333732343037396131343764366535343639326333353036353038656533333339306363653435
|
||||
39656166393265356338656631353065653630303237663761386332323530663966343864663438
|
||||
65356365386131333236396234623537323062363539383061323832363563326435306465663234
|
||||
66316638376436613265353662646264666138666165343763393330613765346163356138616633
|
||||
66373338393163333435666236386239663735653135386532633135646539316665313036323763
|
||||
38666464363432656534313263306266323066646133353765386463343264633131633936373036
|
||||
31326138633131393962633861333036373537366163613562383033336333616130636435326331
|
||||
66653766653065306164613335623933616135393335383438356337633239363131303237653566
|
||||
62636263383236656136376237646363363234363232643636623333396531363461303538373662
|
||||
36313537393238626337613964623731666261316366346666323261386661643035353164613637
|
||||
32303061336363306335306431613263646266303038323739636662326465303961616339333461
|
||||
65626263366333333562386461636231636438623966626136663932303035343531363234356663
|
||||
37313661353764343764396666633666613238323638646233353138383638353938303933396431
|
||||
65366564353533363039383838313562663561633434393833636365303561333534393930653630
|
||||
63663464613334623864313663383630353166363862373132343532393135313666626464376436
|
||||
34616566663764363566663530646638363338653538353661393835383035346236646233363564
|
||||
34656165303737326261353032363435333731363031343366353863313138653865346535636564
|
||||
31393134336534616161303132353764343833636465356661376638633163643739383830616534
|
||||
65386262663734356134303039623265303935363764623537326565633030613465666435636232
|
||||
61623334393734616262613232306339396639643636373762653738333463616361653430656438
|
||||
63316265303634323033303330353232636136333863366261656532383065313334386335666636
|
||||
34303564636333356364663565333932343064333266383638663365366636643866353132373966
|
||||
66336563346233656531643735663062393630616537656264323136353266623161353261333239
|
||||
33636563376566333331366336353338343730383962653138636535623039643461303763333961
|
||||
63373264333037653563643937373664373665343136396635316634613632653232353033666266
|
||||
31333064623765326536386630353435333438326232633565663531303730636530386564366633
|
||||
63326335333639376266396562343838636430643664303737373565363635643037616231393665
|
||||
36636337633564373561343266666632656235646662633965663733383731633832373334646335
|
||||
34396163636635633637393834396566663062633135383330396564656536333330623737636332
|
||||
36646362623131366166626639386238616566323135323334636638393934663336663532306336
|
||||
38396634393433623963316261303061616634333566306239366666373238376466633166623464
|
||||
33313538663838373465626638316432613135386262376233633362616463623363646433353666
|
||||
32633838303837656335333336353564343461373236353736623032663139333338646463323533
|
||||
65326131616433666563343163663462393235366135633661366564623662303932626164366632
|
||||
38306430356238633162656337303536663065653639353562343965663366373861646162653562
|
||||
62306236326163393336643232663336656637623539353835613536653164393038623966316433
|
||||
32623462343037616465623736306530633736623061343430356638633530313331306363323837
|
||||
63396263393136363137643632623938316363386238346237333862303735363065386633366263
|
||||
31313834646239323631393335633534383930373630663538653864383930666465653731616263
|
||||
35333830633430343436646266663231303466343138643338343634346133613666613734313037
|
||||
34383931643631633539346262653631336565623366343564303332333831346436373162356362
|
||||
66383864313732303962653662333036373239343335623765616536306465623030393138663838
|
||||
30313861636631393462653836626164373034666533323338383262393132396436666639363262
|
||||
39356132343939366534666665393231346566663432653236376333323363643166393431316161
|
||||
33343666316138353333346263346266343731613065356631336231373266343338393939663038
|
||||
35343235393563623434313266306163323266346662623063353631663433646436613130636663
|
||||
38356335616438633638383236333131663163613436303934386335363432323063303234383331
|
||||
34636432653262643438653931313233626462623034346137303738643932353334373531303439
|
||||
30366233373535343431373365393566383538363763313036623262343066346236303061326631
|
||||
64376463336538363132656464666365343861393330313637356237666361343666633436346534
|
||||
33636332386336646333616330613738343264626438613135313962336534373130316330366233
|
||||
30316333636564326165663565666361643430656366393939616538323530383632636661326331
|
||||
35366663646533313034333764626237623637363164356163636432653765656439326438383134
|
||||
62623638633934336334393636333336633164343066336161333138653637333435306230653865
|
||||
35363032393633623331363933373463623032333361616365373037666333643634343963663835
|
||||
34363033363731346663643363383965336536353332646262326136353965353137383737336165
|
||||
33613733656463376333376264633935373239363337323538356636636439393564373332323031
|
||||
31623733663530326632373235313830396133373430613061613438653336653462316336623438
|
||||
30343032346133363830656231663966653734326635333831626639393666303033653437326238
|
||||
65333566643066393331323466366662383135383734313537663664376161323265613436653535
|
||||
63643832616663303632623433636161333339376635333635626137326662396562633830343337
|
||||
65376165376564396433343736313134656332383533356138383039386266636238613936653962
|
||||
32373337346335383136303838343034376432363436356465613836366230313463303239373531
|
||||
65383334646431346565656638353537333765623430333133663663326134646566306137643663
|
||||
65643338386439666636376461356466396261326165333030623633613364343631343830653939
|
||||
64323266626131666332666433386434313936306361633164373532626231366234623735333932
|
||||
62306362346164336433336139313561366162303666353635653634396139313734626463663735
|
||||
38306466626237626634666138363665326636316563356431333432313534363638613833613539
|
||||
38306237353764376462323238663034646662393433623830616361623735343162666465626230
|
||||
30633731323939633265323338373537383261333235303262633336636433316339383433653861
|
||||
3861653261646632636364623830626561393864666135346634
|
||||
|
||||
49
host_vars/web20
Normal file
49
host_vars/web20
Normal file
@ -0,0 +1,49 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
30313139316131383630353236343338323465653163323838616464396137656365393639613766
|
||||
3733323562386139353933626339663039653437363037350a356263643762313634613736356363
|
||||
30383534346664353030346233653163616330376562346164613731346566393330623165306234
|
||||
3833306632616536650a386239363931326463663665346363313462646464646632643961343631
|
||||
63393164366163353461633038653833623963363233396464663839653330386231303461636564
|
||||
39613265343765323636373736646462333665303333373737633632346465343439386335623334
|
||||
35333933363966623730643632313361356661303562393535646230626639363335623861323033
|
||||
32356664663539343262336535623233326234356463373031356361633536366430346338393831
|
||||
34666232373761643430356662653431646661646165663134633135663933616262393763356133
|
||||
61323063383036313166643866303136656164386239326437303238623338306433633762303630
|
||||
39396438396639666433376533333765313431383862383031333031616334656136643262636438
|
||||
65626565333939616631336237633063396430376434626437313666646165333239376463383837
|
||||
64656635343661353735666666306134653530303033326662613230663061613034383461326534
|
||||
65306131326634643732326530336136623731663336656138383635383730653633373737386335
|
||||
31316136643634613536366439393565633964643735333336613865366138396539663534646435
|
||||
61626530353836366337643062366532323538326161633137353336626537633739393464646632
|
||||
32343730356362393336313535303034363531373961616265623934393161306261663562653464
|
||||
63336164366531636130343939353235343261316534613665316363346266396332633763346536
|
||||
65633038366530356138373661306234316161343762343638366639653132333438613766343939
|
||||
61316232386465643236326430396130333831666363313032623537383032646663396239663338
|
||||
38313939306465353033663066633435626635353138336330336333616231363634653665386532
|
||||
65326463663933343966356437353433313565316139366365323934643131346636323737626437
|
||||
36343435643231366663323134656561666133303030383734316237386532396662366461646365
|
||||
38303434363763363866383761386535383262323432333730323236353439653163613966333032
|
||||
39306533333132373736313834326464643134393432303537643835336438393461663233333239
|
||||
32333365663337653436303662393263366161326465663036373934373764363438656436666232
|
||||
32326134393161656133613266633966396663353631616537363361396537623164373964636666
|
||||
61613731306333303336316337343635316134363431646433333932633336363065393637343030
|
||||
39366537656430663932616335323661316533643763643161613463646363656232346333303331
|
||||
38363234333261653135316266313736366439343138666165366533353035613731633466396363
|
||||
31663166336431653461663463383333623664356365396230353130386138363261356331663965
|
||||
66636338336466366132633437396535643736333733633430373964343533366338666532346263
|
||||
38353233303437663339616532636662373761393461666439663133373633653139613531393738
|
||||
32383937373833323938356333343963306534633734393162363965356163643862643037636231
|
||||
65366461663161353939633866323162613761663836626232346236343263386364303233313161
|
||||
32313265366562313731656630393166336662616661313964666661616439343265383566383332
|
||||
33386266366534383934363839636636316532613133636664323136373130363534333531613663
|
||||
35333964626634643135663639373339626335643366333766386631363439393435626439636166
|
||||
37616339313336656634393538323935383964343437646433636636383061366437386330643334
|
||||
34383237353036396563643730373663383165623633326336313031326435623538376130393130
|
||||
64636538663963303938623866626431313238646465633437333863363865666435636564323764
|
||||
39303638663830656162393836366262663161633763656630663434386435643462353661353035
|
||||
63336461333464363838313765653037393964633536636435666162346461633561386364333966
|
||||
32623761373435366665363239626632646364323934383163346637356562653332373536343462
|
||||
31323036356132373930656364393061306130353632623661663032343230633635336664376134
|
||||
38363239396139333230346138386337313364353934396362373233376266383537346431653234
|
||||
34323835306165613739383336303964656565373636343639303831386466623031396665343234
|
||||
33373164663339653839
|
||||
@ -1,46 +0,0 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
38393933636634656238353339316465653462313762353035633934643835333732653032613264
|
||||
3065303932666635623363323332386166313435653961360a393931333363396336623639316263
|
||||
33393961383638623831346532353139313463326562336265346665306538616262363932333532
|
||||
3666323961656363350a616161376462626263353738626262326230346662383765613564643033
|
||||
37303336653431636131353230373736613436353536323863653465643139656566623539336665
|
||||
65663866653764366666303433373330343965376461396433336632336637343736613332366235
|
||||
32303932623532356661363634383035636138656639636133386336313631636330333466643433
|
||||
34323837653365623237366433393038343035666130363962356137386161346336363866326135
|
||||
62643332376438333832383036643339616362393639623636636536396266323630383938313263
|
||||
64393638656232313737633863363762653661653337353538356163393434333066303037653033
|
||||
32616363303364383739326235616336343665313737626339316365323332626331636661393436
|
||||
65386333326237653261616231633962626663663235386636376538363066643731366237613838
|
||||
30633364643565333931666462383764383033396562646433643434323035313136366131366337
|
||||
35326531633038396664383662633839666436653638323861366131396232653331376239333833
|
||||
63373665323537313637663237616563333139663536313536303338343231613832616263613837
|
||||
34383864333133623963353761376262633862656635363738643832326237353431656139646631
|
||||
33656636303338373434353338623830353534313864666134643133306637363838623530626636
|
||||
63396165336561343133653265386136653636623665356436346630616531373866613264383034
|
||||
33393331316232623066353639363239353333386532313438376637633834633038303333346330
|
||||
66323865633032653233383632386230666236353363326430363132366262653364313638656435
|
||||
37343563356466363338376239383634656230333439373830393630353232373530383735373336
|
||||
35363031383734623061343935353361633365303735373765383962313339373739663131313336
|
||||
37616432376232323565633561666230616533353066353439373465343366633230376536323032
|
||||
35663836633634313932363865643162616135613262353834616139313534366461373734646464
|
||||
36363261623837376561376365376365326338663862626437313035346431353335373734336636
|
||||
61646261306231373464353866653661313937633832313665303932336564303330323736663838
|
||||
32333033646132626231303331373261623238653330656636646137336433373661626430343332
|
||||
36643837363263373530663835623830343238616431386634303964386438663439386562346464
|
||||
66323534333535383130386630313365326364626231633933316430373031363663326466363430
|
||||
39326332613464343261306130623531656434366662383064393032663037666563663965626662
|
||||
30643365376534343066653864363534366564653230376465366235643738346264633263366536
|
||||
64653434336437373836663034646562316639646333666534663337663836663837666539333834
|
||||
37663964636130316635343466323432633536363963373765333061323763333464616462366132
|
||||
61643166353662306262623361363037623233356465343763323430373965376438643037346463
|
||||
37656332643132613330653161396532383838306339363730373537616665313733636139633565
|
||||
32376237333766663861633839363134323032383337336565396333636638383565623235373038
|
||||
30396161353133393038386337326133303636653266633635373561616564303865643034613639
|
||||
38323938373334366265323464636635363362373565633235383236363961343964316266323364
|
||||
38343030346536353365663235346464393638666131353861646364333465663461346434323465
|
||||
36643662326536386539633533303230356630633335646635613331306266656530643736656663
|
||||
31396630323234356137626439393132323531613236616234383463346136646430343366313339
|
||||
65623333633735383161663639653061316637623835333235323331656436313034316262313039
|
||||
61366435396239376338393864613536306134376230613830653033306334623364633835386562
|
||||
64343961386137666565616134373130323064313134663530666664393661356335346536356433
|
||||
36316235653330396630646438323365393233653364666531663731656130326632
|
||||
@ -1,13 +1,11 @@
|
||||
---
|
||||
#file - roles/common/defaults/main.yml
|
||||
|
||||
# add a dummy API key for AbuseIPDB.com (override with real one in host_vars)
|
||||
abuseipdb_api_key: dummy
|
||||
fail2ban_maxretry: 6
|
||||
# 1 hour in seconds
|
||||
fail2ban_findtime: 3600
|
||||
# 2 weeks in seconds
|
||||
fail2ban_bantime: 1209600
|
||||
fail2ban_ignoreip: 127.0.0.1/8 172.26.0.0/16 192.168.5.0/24
|
||||
fail2ban_ignoreip: 127.0.0.1/8,172.26.0.0/16,192.168.5.0/24
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
2
roles/common/files/00-persistent-journal.conf
Normal file
2
roles/common/files/00-persistent-journal.conf
Normal file
@ -0,0 +1,2 @@
|
||||
[Journal]
|
||||
Storage=persistent
|
||||
@ -1,5 +0,0 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define ABUSECH_IPV4 = {
|
||||
192.168.254.254
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,7 +0,0 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define ABUSEIPDB_IPV6 = {
|
||||
2400:6180:0:d1::4ce:d001,
|
||||
2607:5300:60:232d::,
|
||||
2607:f298:6:a066::1bf:e80e,
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@ -3,7 +3,12 @@
|
||||
<option name="family" value="inet6" />
|
||||
<short>abusers-ipv6</short>
|
||||
<description>A list of abusive IPv6 addresses.</description>
|
||||
<entry>2400:6180:0:d1::4ce:d001</entry>
|
||||
<entry>2607:5300:60:232d::</entry>
|
||||
<entry>2607:f298:6:a066::1bf:e80e</entry>
|
||||
<entry>2001:41d0:1:f934::1</entry>
|
||||
<entry>2001:41d0:602:238d::</entry>
|
||||
<entry>2001:41d0:a:2a31::</entry>
|
||||
<entry>2400:6180:0:d1::476:7001</entry>
|
||||
<entry>2402:1f00:8001:8bd::</entry>
|
||||
<entry>2604:a880:800:10::5bf:2001</entry>
|
||||
<entry>2a00:d680:20:50::bcb2</entry>
|
||||
<entry>2a02:2168:a01:33ee::1</entry>
|
||||
</ipset>
|
||||
|
||||
@ -1,89 +0,0 @@
|
||||
#!/usr/bin/perl
|
||||
#
|
||||
# aggregate-cidr-addresses - combine a list of CIDR address blocks
|
||||
# Copyright (C) 2001,2007 Mark Suter <suter@zwitterion.org>
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see L<http://www.gnu.org/licenses/>.
|
||||
#
|
||||
# [MJS 22 Oct 2001] Aggregate CIDR addresses
|
||||
# [MJS 9 Oct 2007] Overlap idea from Anthony Ledesma at theplanet dot com.
|
||||
# [MJS 16 Feb 2012] Prompted to clarify license by Alexander Talos-Zens - at at univie dot ac dot at
|
||||
# [MJS 21 Feb 2012] IPv6 fixes by Alexander Talos-Zens
|
||||
# [MJS 21 Feb 2012] Split ranges into prefixes (fixes a 10+ year old bug)
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
use English qw( -no_match_vars );
|
||||
use Net::IP;
|
||||
|
||||
## Read in all the IP addresses
|
||||
my @addrs = map { Net::IP->new($_) or die "$PROGRAM_NAME: Not an IP: \"$_\"."; }
|
||||
map { / \A \s* (.+?) \s* \Z /msix and $1; } <>;
|
||||
|
||||
## Split any ranges into prefixes
|
||||
@addrs = map {
|
||||
defined $_->prefixlen ? $_ : map { Net::IP->new($_) }
|
||||
$_->find_prefixes
|
||||
} @addrs;
|
||||
|
||||
## Sort the IP addresses
|
||||
@addrs = sort { $a->version <=> $b->version or $a->bincomp( 'lt', $b ) ? -1 : $a->bincomp( 'gt', $b ) ? 1 : 0 } @addrs;
|
||||
|
||||
## Handle overlaps
|
||||
my $count = 0;
|
||||
my $current = $addrs[0];
|
||||
foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
|
||||
my $r = $current->overlaps($next);
|
||||
if ( $current->version != $next->version or $r == $IP_NO_OVERLAP ) {
|
||||
$current = $next;
|
||||
$count++;
|
||||
}
|
||||
elsif ( $r == $IP_A_IN_B_OVERLAP ) {
|
||||
$current = $next;
|
||||
splice @addrs, $count, 1;
|
||||
}
|
||||
elsif ( $r == $IP_B_IN_A_OVERLAP or $r == $IP_IDENTICAL ) {
|
||||
splice @addrs, $count + 1, 1;
|
||||
}
|
||||
else {
|
||||
die "$PROGRAM_NAME: internal error - overlaps() returned an unexpected value!\n";
|
||||
}
|
||||
}
|
||||
|
||||
## Keep aggregating until we don't change anything
|
||||
my $change = 1;
|
||||
while ($change) {
|
||||
$change = 0;
|
||||
my @new_addrs = ();
|
||||
$current = $addrs[0];
|
||||
foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
|
||||
if ( my $total = $current->aggregate($next) ) {
|
||||
$current = $total;
|
||||
$change = 1;
|
||||
}
|
||||
else {
|
||||
push @new_addrs, $current;
|
||||
$current = $next;
|
||||
}
|
||||
}
|
||||
push @new_addrs, $current;
|
||||
@addrs = @new_addrs;
|
||||
}
|
||||
|
||||
## Print out the IP addresses
|
||||
foreach (@addrs) {
|
||||
print $_->prefix(), "\n";
|
||||
}
|
||||
|
||||
# $Id: aggregate-cidr-addresses,v 1.9 2012/02/21 10:14:22 suter Exp suter $
|
||||
@ -1,5 +0,0 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV4 = {
|
||||
192.168.254.254/32
|
||||
}
|
||||
@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet" />
|
||||
<short>spamhaus-ipv4</short>
|
||||
<description>Spamhaus DROP and EDROP lists placeholder (IPv4).</description>
|
||||
</ipset>
|
||||
@ -1,5 +0,0 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV6 = {
|
||||
fd21:3523:74e0:7301::/64
|
||||
}
|
||||
@ -1,6 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet6" />
|
||||
<short>spamhaus-ipv6</short>
|
||||
<description>Spamhaus DROP list placeholder (IPv6).</description>
|
||||
</ipset>
|
||||
@ -1,27 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Abuse.ch SSL Blacklist IPs
|
||||
# This service will fail if nftables is not running so we use Requires to make
|
||||
# sure that nftables is started.
|
||||
Requires=nftables.service
|
||||
# Make sure the network is up and nftables is started
|
||||
After=network-online.target nftables.service
|
||||
Wants=network-online.target update-abusech-nftables.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/nftables
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-abusech-nftables
|
||||
ExecStart=/usr/bin/flock -x update-abusech-nftables.lck \
|
||||
/usr/local/bin/update-abusech-nftables.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@ -1,63 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-abuseipdb-nftables.sh v0.0.1
|
||||
#
|
||||
# Download IP addresses seen using a blacklisted SSL certificate and load them
|
||||
# into nftables sets. As of 2021-07-28 these appear to only be IPv4.
|
||||
#
|
||||
# See: https://sslbl.abuse.ch/blacklist
|
||||
#
|
||||
# Copyright (C) 2021 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
abusech_ipv4_set_path=/etc/nftables/abusech-ipv4.nft
|
||||
abusech_list_temp=$(mktemp)
|
||||
|
||||
echo "Downloading Abuse.sh SSL Blacklist IPs"
|
||||
|
||||
abusech_response=$(curl -s -G -w "%{http_code}\n" https://sslbl.abuse.ch/blacklist/sslipblacklist.txt --output "$abusech_list_temp")
|
||||
|
||||
if [[ $abusech_response -ne 200 ]]; then
|
||||
echo "Abuse.ch responded: HTTP $abusech_response"
|
||||
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -f "$abusech_list_temp" ]]; then
|
||||
echo "Processing IPv4 list"
|
||||
|
||||
abusech_ipv4_list_temp=$(mktemp)
|
||||
abusech_ipv4_set_temp=$(mktemp)
|
||||
|
||||
# Remove comments, DOS carriage returns, and IPv6 addresses (even though
|
||||
# Abuse.ch seems to only have IPv4 addresses, let's not break our shit on
|
||||
# that assumption some time down the line).
|
||||
sed -e '/#/d' -e 's/
|
||||
//' -e '/:/d' "$abusech_list_temp" > "$abusech_ipv4_list_temp"
|
||||
|
||||
echo "Building abusech-ipv4 set"
|
||||
cat << NFT_HEAD > "$abusech_ipv4_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define ABUSECH_IPV4 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
# nftables doesn't mind if the last element in the set has a trailing
|
||||
# comma so we don't need to do anything special here.
|
||||
echo "$network," >> "$abusech_ipv4_set_temp"
|
||||
done < $abusech_ipv4_list_temp
|
||||
|
||||
echo "}" >> "$abusech_ipv4_set_temp"
|
||||
|
||||
install -m 0600 "$abusech_ipv4_set_temp" "$abusech_ipv4_set_path"
|
||||
|
||||
rm -f "$abusech_list_temp" "$abusech_ipv4_list_temp" "$abusech_ipv4_set_temp"
|
||||
fi
|
||||
|
||||
echo "Reloading nftables"
|
||||
# The abusech nftables sets are included by nftables.conf
|
||||
@ -1,12 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Abuse.ch SSL Blacklist IPs
|
||||
|
||||
[Timer]
|
||||
# Once a day at midnight
|
||||
OnCalendar=*-*-* 00:00:00
|
||||
# Add a random delay of 0–3600 seconds
|
||||
RandomizedDelaySec=3600
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@ -1,27 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
# This service will fail if firewalld is not running so we use Requires to make
|
||||
# sure that firewalld is started.
|
||||
Requires=firewalld.service
|
||||
# Make sure the network is up and firewalld is started
|
||||
After=network-online.target firewalld.service
|
||||
Wants=network-online.target update-spamhaus-lists.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/firewalld/ipsets
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-spamhaus-lists
|
||||
ExecStart=/usr/bin/flock -x update-spamhaus-lists.lck \
|
||||
/usr/local/bin/update-spamhaus-lists.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@ -1,107 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-spamhaus-lists.sh v0.0.5
|
||||
#
|
||||
# Download Spamhaus DROP lists and load them into firewalld ipsets. Should work
|
||||
# with both the iptables and nftables backends.
|
||||
#
|
||||
# See: https://www.spamhaus.org/drop/
|
||||
#
|
||||
# Copyright (C) 2021 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
firewalld_ipsets=$(firewall-cmd --get-ipsets)
|
||||
xml_temp=$(mktemp)
|
||||
spamhaus_ipv4_ipset_path=/etc/firewalld/ipsets/spamhaus-ipv4.xml
|
||||
spamhaus_ipv6_ipset_path=/etc/firewalld/ipsets/spamhaus-ipv6.xml
|
||||
|
||||
function download() {
|
||||
echo "Downloading $1"
|
||||
wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
|
||||
}
|
||||
|
||||
download drop.txt
|
||||
download edrop.txt
|
||||
download dropv6.txt
|
||||
|
||||
if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
|
||||
echo "Processing IPv4 DROP lists"
|
||||
|
||||
# Extract all networks from drop.txt and edrop.txt, skipping blank lines and
|
||||
# comments.
|
||||
networks=$(cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//')
|
||||
|
||||
# If firewalld already has this ipset we should delete it first to emulate
|
||||
# `ipset flush` (but I don't want to use that because newer hosts might be
|
||||
# using nftables and firewalld will handle that for us).
|
||||
if [[ "$firewalld_ipsets" =~ spamhaus-ipv4 ]]; then
|
||||
echo "Deleting existing spamhaus-ipv4 ipset"
|
||||
# This deletes the firewalld ipset XML file as well as the ipset itself
|
||||
firewall-cmd --permanent --delete-ipset=spamhaus-ipv4
|
||||
else
|
||||
echo "Creating placeholder spamhaus-ipv4 ipset"
|
||||
# Create a placeholder ipset so firewalld doesn't complain when we try
|
||||
# to reload the ipset later after having added a new XML definition. I
|
||||
# don't know why, but depending on the system state there may not be a
|
||||
# ipset defined and firewalld errors on INVALID_IPSET.
|
||||
firewall-cmd --permanent --new-ipset=spamhaus-ipv4 --type=hash:net --option=family=inet
|
||||
fi
|
||||
|
||||
# I'm not proud of this, but writing the XML directly is WAY faster than
|
||||
# using firewall-cmd to add each entry one by one (and we can't add from
|
||||
# a file because many of our hosts are using old firewalld).
|
||||
cat << XML_HEAD > "$xml_temp"
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet" />
|
||||
<short>spamhaus-ipv4</short>
|
||||
<description>Spamhaus DROP and EDROP lists (IPv4).</description>
|
||||
XML_HEAD
|
||||
|
||||
for network in $networks; do
|
||||
echo " <entry>$network</entry>" >> "$xml_temp"
|
||||
done
|
||||
|
||||
echo "</ipset>" >> "$xml_temp"
|
||||
|
||||
install -m 0600 "$xml_temp" "$spamhaus_ipv4_ipset_path"
|
||||
fi
|
||||
|
||||
if [[ -f "dropv6.txt" ]]; then
|
||||
echo "Processing IPv6 DROP list"
|
||||
|
||||
networks=$(sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt)
|
||||
|
||||
if [[ "$firewalld_ipsets" =~ spamhaus-ipv6 ]]; then
|
||||
echo "Deleting existing spamhaus-ipv6 ipset"
|
||||
firewall-cmd --permanent --delete-ipset=spamhaus-ipv6
|
||||
else
|
||||
echo "Creating placeholder spamhaus-ipv6 ipset"
|
||||
firewall-cmd --permanent --new-ipset=spamhaus-ipv6 --type=hash:net --option=family=inet6
|
||||
fi
|
||||
|
||||
cat << XML_HEAD > "$xml_temp"
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ipset type="hash:net">
|
||||
<option name="family" value="inet6" />
|
||||
<short>spamhaus-ipv6</short>
|
||||
<description>Spamhaus DROP lists (IPv6).</description>
|
||||
XML_HEAD
|
||||
|
||||
for network in $networks; do
|
||||
echo " <entry>$network</entry>" >> "$xml_temp"
|
||||
done
|
||||
|
||||
echo "</ipset>" >> "$xml_temp"
|
||||
|
||||
install -m 0600 "$xml_temp" "$spamhaus_ipv6_ipset_path"
|
||||
fi
|
||||
|
||||
echo "Reloading firewalld"
|
||||
firewall-cmd --reload
|
||||
|
||||
rm -v drop.txt edrop.txt dropv6.txt "$xml_temp"
|
||||
@ -1,12 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
|
||||
[Timer]
|
||||
# Once a day at midnight
|
||||
OnCalendar=*-*-* 00:00:00
|
||||
# Add a random delay of 0–3600 seconds
|
||||
RandomizedDelaySec=3600
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@ -1,27 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
# This service will fail if nftables is not running so we use Requires to make
|
||||
# sure that nftables is started.
|
||||
Requires=nftables.service
|
||||
# Make sure the network is up and nftables is started
|
||||
After=network-online.target nftables.service
|
||||
Wants=network-online.target update-spamhaus-nftables.timer
|
||||
|
||||
[Service]
|
||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||
# Doesn't need access to /home or /root
|
||||
ProtectHome=true
|
||||
# Possibly only works on Ubuntu 18.04+
|
||||
ProtectKernelTunables=true
|
||||
ProtectSystem=full
|
||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||
ReadWriteDirectories=/etc/nftables
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/var/tmp
|
||||
|
||||
SyslogIdentifier=update-spamhaus-nftables
|
||||
ExecStart=/usr/bin/flock -x update-spamhaus-nftables.lck \
|
||||
/usr/local/bin/update-spamhaus-nftables.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@ -1,91 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# update-spamhaus-nftables.sh v0.0.1
|
||||
#
|
||||
# Download Spamhaus DROP lists and load them into nftables sets.
|
||||
#
|
||||
# See: https://www.spamhaus.org/drop/
|
||||
#
|
||||
# Copyright (C) 2021 Alan Orth
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
|
||||
# Exit on first error
|
||||
set -o errexit
|
||||
|
||||
spamhaus_ipv4_set_path=/etc/nftables/spamhaus-ipv4.nft
|
||||
spamhaus_ipv6_set_path=/etc/nftables/spamhaus-ipv6.nft
|
||||
|
||||
function download() {
|
||||
echo "Downloading $1"
|
||||
wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
|
||||
}
|
||||
|
||||
download drop.txt
|
||||
download edrop.txt
|
||||
download dropv6.txt
|
||||
|
||||
if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
|
||||
echo "Processing IPv4 DROP lists"
|
||||
|
||||
spamhaus_ipv4_list_temp=$(mktemp)
|
||||
spamhaus_ipv4_set_temp=$(mktemp)
|
||||
|
||||
# Extract all networks from drop.txt and edrop.txt, skipping blank lines and
|
||||
# comments. Use aggregate-cidr-addresses.pl to merge overlapping IPv4 CIDR
|
||||
# ranges to work around a firewalld bug.
|
||||
#
|
||||
# See: https://bugzilla.redhat.com/show_bug.cgi?id=1836571
|
||||
cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' | aggregate-cidr-addresses.pl > "$spamhaus_ipv4_list_temp"
|
||||
|
||||
echo "Building spamhaus-ipv4 set"
|
||||
cat << NFT_HEAD > "$spamhaus_ipv4_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV4 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
# nftables doesn't mind if the last element in the set has a trailing
|
||||
# comma so we don't need to do anything special here.
|
||||
echo "$network," >> "$spamhaus_ipv4_set_temp"
|
||||
done < $spamhaus_ipv4_list_temp
|
||||
|
||||
echo "}" >> "$spamhaus_ipv4_set_temp"
|
||||
|
||||
install -m 0600 "$spamhaus_ipv4_set_temp" "$spamhaus_ipv4_set_path"
|
||||
|
||||
rm -f "$spamhaus_ipv4_list_temp" "$spamhaus_ipv4_set_temp"
|
||||
fi
|
||||
|
||||
if [[ -f "dropv6.txt" ]]; then
|
||||
echo "Processing IPv6 DROP lists"
|
||||
|
||||
spamhaus_ipv6_list_temp=$(mktemp)
|
||||
spamhaus_ipv6_set_temp=$(mktemp)
|
||||
|
||||
sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt > "$spamhaus_ipv6_list_temp"
|
||||
|
||||
echo "Building spamhaus-ipv6 set"
|
||||
cat << NFT_HEAD > "$spamhaus_ipv6_set_temp"
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
define SPAMHAUS_IPV6 = {
|
||||
NFT_HEAD
|
||||
|
||||
while read -r network; do
|
||||
echo "$network," >> "$spamhaus_ipv6_set_temp"
|
||||
done < $spamhaus_ipv6_list_temp
|
||||
|
||||
echo "}" >> "$spamhaus_ipv6_set_temp"
|
||||
|
||||
install -m 0600 "$spamhaus_ipv6_set_temp" "$spamhaus_ipv6_set_path"
|
||||
|
||||
rm -f "$spamhaus_ipv6_list_temp" "$spamhaus_ipv6_set_temp"
|
||||
fi
|
||||
|
||||
echo "Reloading nftables"
|
||||
# The spamhaus nftables sets are included by nftables.conf
|
||||
/usr/sbin/nft -f /etc/nftables.conf
|
||||
|
||||
rm -v drop.txt edrop.txt dropv6.txt
|
||||
@ -1,12 +0,0 @@
|
||||
[Unit]
|
||||
Description=Update Spamhaus lists
|
||||
|
||||
[Timer]
|
||||
# Once a day at midnight
|
||||
OnCalendar=*-*-* 00:00:00
|
||||
# Add a random delay of 0–3600 seconds
|
||||
RandomizedDelaySec=3600
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@ -15,6 +15,3 @@
|
||||
|
||||
- name: reload systemd
|
||||
systemd: daemon_reload=yes
|
||||
|
||||
- name: restart nftables
|
||||
systemd: name=nftables state=restarted
|
||||
|
||||
@ -4,11 +4,6 @@
|
||||
template: src=etc/fail2ban/jail.d/sshd.local.j2 dest=/etc/fail2ban/jail.d/sshd.local owner=root mode=0644
|
||||
notify: restart fail2ban
|
||||
|
||||
- name: Configure fail2ban nginx filter
|
||||
when: "extra_fail2ban_filters is defined and 'nginx' in extra_fail2ban_filters"
|
||||
template: src=etc/fail2ban/jail.d/nginx.local.j2 dest=/etc/fail2ban/jail.d/nginx.local owner=root mode=0644
|
||||
notify: restart fail2ban
|
||||
|
||||
- name: Create fail2ban service override directory
|
||||
file: path=/etc/systemd/system/fail2ban.service.d state=directory owner=root mode=0755
|
||||
|
||||
|
||||
15
roles/common/tasks/firewall_Alpine.yml
Normal file
15
roles/common/tasks/firewall_Alpine.yml
Normal file
@ -0,0 +1,15 @@
|
||||
---
|
||||
# TODO: configure awall (ipsets?)
|
||||
# TODO: configure fail2ban
|
||||
|
||||
- block:
|
||||
- name: Set Alpine firewall packages
|
||||
set_fact:
|
||||
alpine_firewall_packages:
|
||||
- awall
|
||||
- fail2ban
|
||||
|
||||
- name: Install Alpine firewall packages
|
||||
apk: name={{ alpine_firewall_packages }} state=present
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@ -1,9 +1,7 @@
|
||||
---
|
||||
# Debian 11 will use nftables directly, with no firewalld.
|
||||
|
||||
- block:
|
||||
- name: Set Debian firewall packages
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
set_fact:
|
||||
debian_firewall_packages:
|
||||
- firewalld
|
||||
@ -11,43 +9,12 @@
|
||||
- fail2ban
|
||||
- python3-systemd # for fail2ban systemd backend
|
||||
|
||||
- name: Set Debian firewall packages
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
set_fact:
|
||||
debian_firewall_packages:
|
||||
- fail2ban
|
||||
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
||||
- nftables
|
||||
- python3-systemd
|
||||
- curl # for nftables update scripts
|
||||
|
||||
- name: Install firewall packages
|
||||
apt: pkg={{ debian_firewall_packages }} state=present cache_valid_time=3600
|
||||
|
||||
- name: Copy nftables.conf
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
|
||||
notify:
|
||||
- restart nftables
|
||||
|
||||
- name: Create /etc/nftables extra config directory
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
file: path=/etc/nftables state=directory owner=root mode=0755
|
||||
|
||||
- name: Copy extra nftables configuration files
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
|
||||
loop:
|
||||
- { src: "spamhaus-ipv4.nft", force: "no" }
|
||||
- { src: "spamhaus-ipv6.nft", force: "no" }
|
||||
- { src: "abusech-ipv4.nft", force: "no" }
|
||||
- { src: "abuseipdb-ipv4.nft", force: "yes" }
|
||||
- { src: "abuseipdb-ipv6.nft", force: "yes" }
|
||||
notify:
|
||||
- restart nftables
|
||||
- name: Install firewalld and deps
|
||||
when: ansible_distribution_major_version is version('9', '>=')
|
||||
apt: pkg={{ debian_firewall_packages }} state=present
|
||||
|
||||
- name: Use iptables backend in firewalld
|
||||
when: ansible_distribution_major_version is version('10', '==')
|
||||
when: ansible_distribution_major_version is version('10', '>=')
|
||||
lineinfile:
|
||||
dest: /etc/firewalld/firewalld.conf
|
||||
regexp: '^FirewallBackend=nftables$'
|
||||
@ -59,7 +26,7 @@
|
||||
# backend. Using individual calls seems to work around it.
|
||||
# See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931722
|
||||
- name: Use individual iptables calls
|
||||
when: ansible_distribution_major_version is version('10', '==')
|
||||
when: ansible_distribution_major_version is version('10', '>=')
|
||||
lineinfile:
|
||||
dest: /etc/firewalld/firewalld.conf
|
||||
regexp: '^IndividualCalls=no$'
|
||||
@ -68,79 +35,24 @@
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy firewalld public zone file
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
when: ansible_distribution_major_version is version('9', '>=')
|
||||
template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
|
||||
|
||||
- name: Format public.xml firewalld zone file
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
when: ansible_distribution_major_version is version('9', '>=')
|
||||
command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy firewalld ipsets of abusive IPs
|
||||
when: ansible_distribution_major_version is version('10', '<=')
|
||||
- name: Copy ipsets of abusive IPs
|
||||
when: ansible_distribution_major_version is version('9', '>=')
|
||||
copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
|
||||
loop:
|
||||
- abusers-ipv4.xml
|
||||
- abusers-ipv6.xml
|
||||
- spamhaus-ipv4.xml
|
||||
- spamhaus-ipv6.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy Spamhaus firewalld update script
|
||||
when: ansible_distribution_version is version('10', '<=')
|
||||
copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
|
||||
|
||||
- name: Copy Spamhaus firewalld systemd units
|
||||
when: ansible_distribution_version is version('10', '<=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-lists.service
|
||||
- update-spamhaus-lists.timer
|
||||
register: spamhaus_firewalld_systemd_units
|
||||
|
||||
- name: Copy Spamhaus nftables update scripts
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.sh
|
||||
- aggregate-cidr-addresses.pl
|
||||
- update-abusech-nftables.sh
|
||||
|
||||
- name: Copy nftables systemd units
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.service
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.service
|
||||
- update-abusech-nftables.timer
|
||||
register: nftables_systemd_units
|
||||
|
||||
# need to reload to pick up service/timer/environment changes
|
||||
- name: Reload systemd daemon
|
||||
systemd: daemon_reload=yes
|
||||
when: spamhaus_firewalld_systemd_units is changed or
|
||||
nftables_systemd_units is changed
|
||||
|
||||
- name: Start and enable Spamhaus firewalld update timer
|
||||
when: ansible_distribution_version is version('10', '<=')
|
||||
systemd: name=update-spamhaus-lists.timer state=started enabled=yes
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Start and enable nftables update timers
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
systemd: name={{ item }} state=started enabled=yes
|
||||
loop:
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.timer
|
||||
|
||||
- name: Start and enable nftables
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
systemd: name=nftables state=started enabled=yes
|
||||
|
||||
- include_tasks: fail2ban.yml
|
||||
when: ansible_distribution_major_version is version('9', '>=')
|
||||
tags: firewall
|
||||
|
||||
@ -1,11 +1,7 @@
|
||||
---
|
||||
# Ubuntu 20.04 will use nftables directly, with no firewalld.
|
||||
# Ubuntu 18.04 will use firewalld with the nftables backend.
|
||||
# Ubuntu 16.04 will use firewalld with the iptables backend.
|
||||
|
||||
- block:
|
||||
- name: Set Ubuntu firewall packages
|
||||
when: ansible_distribution_version is version('20.04', '<')
|
||||
set_fact:
|
||||
ubuntu_firewall_packages:
|
||||
- firewalld
|
||||
@ -13,119 +9,54 @@
|
||||
- fail2ban
|
||||
- python3-systemd # for fail2ban systemd backend
|
||||
|
||||
- name: Set Ubuntu firewall packages
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
set_fact:
|
||||
ubuntu_firewall_packages:
|
||||
- fail2ban
|
||||
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
||||
- nftables
|
||||
- python3-systemd
|
||||
- curl # for nftables update scripts
|
||||
|
||||
- name: Install firewall packages
|
||||
apt: pkg={{ ubuntu_firewall_packages }} state=present cache_valid_time=3600
|
||||
- name: Install firewalld and deps
|
||||
when: ansible_distribution_version is version('16.04', '>=')
|
||||
apt: pkg={{ ubuntu_firewall_packages }} state=present
|
||||
|
||||
- name: Remove ufw
|
||||
when: ansible_distribution_version is version('16.04', '>=')
|
||||
apt: pkg=ufw state=absent
|
||||
|
||||
- name: Copy nftables.conf
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
|
||||
notify:
|
||||
- restart nftables
|
||||
# I'm not sure why, but you can use firewalld with the nftables backend even
|
||||
# if nftables itself is not installed. In that case the only way to see the
|
||||
# currently active rules is with firewall-cmd. I prefer installing nftables
|
||||
# so that we can have somewhat of a parallel with iptables:
|
||||
#
|
||||
# nft list ruleset
|
||||
#
|
||||
# See: https://firewalld.org/2018/07/nftables-backend
|
||||
- name: Install nftables
|
||||
when: ansible_distribution_version is version('20.04', '==')
|
||||
apt: pkg=nftables state=present
|
||||
|
||||
- name: Create /etc/nftables extra config directory
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
file: path=/etc/nftables state=directory owner=root mode=0755
|
||||
|
||||
- name: Copy extra nftables configuration files
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
|
||||
loop:
|
||||
- { src: "spamhaus-ipv4.nft", force: "no" }
|
||||
- { src: "spamhaus-ipv6.nft", force: "no" }
|
||||
- { src: "abusech-ipv4.nft", force: "no" }
|
||||
- { src: "abuseipdb-ipv4.nft", force: "yes" }
|
||||
- { src: "abuseipdb-ipv6.nft", force: "yes" }
|
||||
- name: Use nftables backend in firewalld
|
||||
when: ansible_distribution_version is version('20.04', '==')
|
||||
lineinfile:
|
||||
dest: /etc/firewalld/firewalld.conf
|
||||
regexp: '^FirewallBackend=iptables$'
|
||||
line: 'FirewallBackend=nftables'
|
||||
notify:
|
||||
- restart nftables
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy firewalld public zone file
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
when: ansible_distribution_version is version('16.04', '>=')
|
||||
template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
|
||||
|
||||
- name: Format public.xml firewalld zone file
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
when: ansible_distribution_version is version('16.04', '>=')
|
||||
command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy firewalld ipsets of abusive IPs
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
- name: Copy ipsets of abusive IPs
|
||||
when: ansible_distribution_version is version('16.04', '>=')
|
||||
copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
|
||||
loop:
|
||||
- abusers-ipv4.xml
|
||||
- abusers-ipv6.xml
|
||||
- spamhaus-ipv4.xml
|
||||
- spamhaus-ipv6.xml
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Copy Spamhaus firewalld update script
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
|
||||
|
||||
- name: Copy Spamhaus firewalld systemd units
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-lists.service
|
||||
- update-spamhaus-lists.timer
|
||||
register: spamhaus_firewalld_systemd_units
|
||||
|
||||
- name: Copy nftables update scripts
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.sh
|
||||
- aggregate-cidr-addresses.pl
|
||||
- update-abusech-nftables.sh
|
||||
|
||||
- name: Copy nftables systemd units
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
||||
loop:
|
||||
- update-spamhaus-nftables.service
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.service
|
||||
- update-abusech-nftables.timer
|
||||
register: nftables_systemd_units
|
||||
|
||||
# need to reload to pick up service/timer/environment changes
|
||||
- name: Reload systemd daemon
|
||||
systemd: daemon_reload=yes
|
||||
when: spamhaus_firewalld_systemd_units is changed or
|
||||
nftables_systemd_units is changed
|
||||
|
||||
- name: Start and enable Spamhaus firewalld update timer
|
||||
when: ansible_distribution_version is version('18.04', '<=')
|
||||
systemd: name=update-spamhaus-lists.timer state=started enabled=yes
|
||||
notify:
|
||||
- restart firewalld
|
||||
|
||||
- name: Start and enable nftables update timers
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
systemd: name={{ item }} state=started enabled=yes
|
||||
loop:
|
||||
- update-spamhaus-nftables.timer
|
||||
- update-abusech-nftables.timer
|
||||
|
||||
- name: Start and enable nftables
|
||||
when: ansible_distribution_version is version('20.04', '>=')
|
||||
systemd: name=nftables state=started enabled=yes
|
||||
|
||||
- include_tasks: fail2ban.yml
|
||||
when: ansible_distribution_version is version('16.04', '>=')
|
||||
tags: firewall
|
||||
|
||||
@ -17,6 +17,11 @@
|
||||
when: ansible_distribution == 'Ubuntu'
|
||||
tags: packages
|
||||
|
||||
- name: Install common packages
|
||||
include_tasks: packages_Alpine.yml
|
||||
when: ansible_distribution == 'Alpine'
|
||||
tags: packages
|
||||
|
||||
- name: Configure firewall
|
||||
include_tasks: firewall_Debian.yml
|
||||
when: ansible_distribution == 'Debian'
|
||||
|
||||
@ -1,27 +1,23 @@
|
||||
---
|
||||
# Hosts running Ubuntu 16.04+ and Debian 9+ use systemd init system and should
|
||||
# use systemd-timesyncd as a network time client instead of the standalone ntp
|
||||
# client.
|
||||
# use timedatectl as a network time client instead of the standalone ntp client.
|
||||
# Alpine can use chrony.
|
||||
|
||||
- name: Set timezone
|
||||
when: timezone is defined and ansible_service_mgr == 'systemd'
|
||||
command: /usr/bin/timedatectl set-timezone {{ timezone }}
|
||||
tags: timezone
|
||||
|
||||
# Apparently some cloud images don't have this installed by default. From what
|
||||
# I can see on existing servers, systemd-timesyncd is a standalone package on
|
||||
# Ubuntu 20.04 and Debian 11.
|
||||
- name: Install systemd-timesyncd
|
||||
when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or
|
||||
(ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
|
||||
apt: name=systemd-timesyncd state=present cache_valid_time=3600
|
||||
|
||||
- name: Start and enable systemd's NTP client
|
||||
when: ansible_service_mgr == 'systemd'
|
||||
systemd: name=systemd-timesyncd state=started enabled=yes
|
||||
|
||||
- name: Uninstall ntp on modern Ubuntu/Debian
|
||||
apt: name=ntp state=absent
|
||||
apt: name=ntp state=absent update_cache=yes
|
||||
when: ansible_service_mgr == 'systemd'
|
||||
|
||||
- name: Install chronyd on Alpine
|
||||
apt: name=chrony state=present
|
||||
when: ansible_distribution == 'Alpine'
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
28
roles/common/tasks/packages_Alpine.yml
Normal file
28
roles/common/tasks/packages_Alpine.yml
Normal file
@ -0,0 +1,28 @@
|
||||
---
|
||||
# requires: ansible-galaxy collection install community.general
|
||||
# TODO: configure tarsnap
|
||||
|
||||
- block:
|
||||
- name: Upgrade base OS
|
||||
apk: upgrade=yes update_cache=yes
|
||||
|
||||
- name: Set Alpine base packages
|
||||
set_fact:
|
||||
alpine_base_packages:
|
||||
- git
|
||||
- tmux
|
||||
- htop
|
||||
- strace
|
||||
- mosh
|
||||
- vim
|
||||
- unzip
|
||||
- zstd
|
||||
|
||||
- name: Install Alpine base packages
|
||||
apk: name={{ alpine_base_packages }} state=present update_cache=yes
|
||||
|
||||
#- name: Install tarsnap
|
||||
# import_tasks: tarsnap.yml
|
||||
tags: packages
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
@ -3,13 +3,11 @@
|
||||
- block:
|
||||
- name: Configure apt mirror
|
||||
template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
|
||||
when: ansible_architecture != 'armv7l'
|
||||
|
||||
- name: Set fact for base packages
|
||||
set_fact:
|
||||
base_packages:
|
||||
- git
|
||||
- git-lfs
|
||||
- tmux
|
||||
- iotop
|
||||
- htop
|
||||
|
||||
@ -12,7 +12,6 @@
|
||||
set_fact:
|
||||
ubuntu_base_packages:
|
||||
- git
|
||||
- git-lfs
|
||||
- tmux
|
||||
- iotop
|
||||
- htop
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
when: ansible_architecture != 'armv7l'
|
||||
|
||||
- name: Add GPG key for Tarsnap
|
||||
apt_key: id=0xBF75EEAB040E447C url=https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc state=present
|
||||
apt_key: id=0xFC72A10BF6B692AA url=https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc state=present
|
||||
register: add_tarsnap_apt_key
|
||||
|
||||
- name: Update apt cache
|
||||
|
||||
@ -1,17 +0,0 @@
|
||||
[nginx]
|
||||
enabled = true
|
||||
# See: /etc/fail2ban/filter.d/nginx-botsearch.conf
|
||||
filter = nginx-botsearch
|
||||
{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
|
||||
# Integrate with nftables
|
||||
banaction=nftables[type=allports]
|
||||
{% else %}
|
||||
# Integrate with firewalld and ipsets
|
||||
banaction = firewallcmd-ipset
|
||||
{% endif %}
|
||||
logpath = /var/log/nginx/*-access.log
|
||||
# Try to find a non-existent wp-login.php once and get banned. Tough luck.
|
||||
maxretry = 1
|
||||
findtime = {{ fail2ban_findtime }}
|
||||
bantime = {{ fail2ban_bantime }}
|
||||
ignoreip = {{ fail2ban_ignoreip }}
|
||||
@ -2,13 +2,8 @@
|
||||
enabled = true
|
||||
# See: /etc/fail2ban/filter.d/sshd.conf
|
||||
filter = sshd
|
||||
{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
|
||||
# Integrate with nftables
|
||||
banaction=nftables[type=allports]
|
||||
{% else %}
|
||||
# Integrate with firewalld and ipsets
|
||||
banaction = firewallcmd-ipset
|
||||
{% endif %}
|
||||
backend = systemd
|
||||
maxretry = {{ fail2ban_maxretry }}
|
||||
findtime = {{ fail2ban_findtime }}
|
||||
|
||||
@ -2,14 +2,14 @@
|
||||
PrivateDevices=yes
|
||||
PrivateTmp=yes
|
||||
ProtectHome=read-only
|
||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
|
||||
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=') %}
|
||||
ProtectSystem=strict
|
||||
{% else %}
|
||||
{# Older systemd versions don't have ProtectSystem=strict #}
|
||||
ProtectSystem=full
|
||||
{% endif %}
|
||||
NoNewPrivileges=yes
|
||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
|
||||
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=') %}
|
||||
ReadWritePaths=-/var/run/fail2ban
|
||||
ReadWritePaths=-/var/lib/fail2ban
|
||||
ReadWritePaths=-/var/log/fail2ban.log
|
||||
|
||||
@ -1,120 +0,0 @@
|
||||
#!/usr/sbin/nft -f
|
||||
#
|
||||
# Initially based on: https://wiki.nftables.org/wiki-nftables/index.php/Simple_ruleset_for_a_server
|
||||
#
|
||||
|
||||
flush ruleset
|
||||
|
||||
# Lists updated daily by update-spamhaus-nftables.sh
|
||||
include "/etc/nftables/spamhaus-ipv4.nft"
|
||||
include "/etc/nftables/spamhaus-ipv6.nft"
|
||||
|
||||
# Lists updated monthly (manually)
|
||||
include "/etc/nftables/abuseipdb-ipv4.nft"
|
||||
include "/etc/nftables/abuseipdb-ipv6.nft"
|
||||
|
||||
# Lists updated daily by update-abusech-nftables.sh
|
||||
include "/etc/nftables/abusech-ipv4.nft"
|
||||
|
||||
# Notes:
|
||||
# - tables hold chains, chains hold rules
|
||||
# - inet is for both ipv4 and ipv6
|
||||
table inet filter {
|
||||
set spamhaus-ipv4 {
|
||||
type ipv4_addr
|
||||
# if the set contains prefixes we need to use the interval flag
|
||||
flags interval
|
||||
elements = $SPAMHAUS_IPV4
|
||||
}
|
||||
|
||||
set spamhaus-ipv6 {
|
||||
type ipv6_addr
|
||||
flags interval
|
||||
elements = $SPAMHAUS_IPV6
|
||||
}
|
||||
|
||||
set abusech-ipv4 {
|
||||
type ipv4_addr
|
||||
elements = $ABUSECH_IPV4
|
||||
}
|
||||
|
||||
set abuseipdb-ipv4 {
|
||||
type ipv4_addr
|
||||
elements = $ABUSEIPDB_IPV4
|
||||
}
|
||||
|
||||
set abuseipdb-ipv6 {
|
||||
type ipv6_addr
|
||||
elements = $ABUSEIPDB_IPV6
|
||||
}
|
||||
|
||||
chain input {
|
||||
type filter hook input priority 0;
|
||||
|
||||
ct state {established, related} accept comment "Allow traffic from established and related packets"
|
||||
|
||||
ct state invalid counter drop comment "Early drop of invalid connections"
|
||||
|
||||
ip saddr @spamhaus-ipv4 counter drop comment "Early drop of incoming packets matching spamhaus-ipv4 list"
|
||||
ip6 saddr @spamhaus-ipv6 counter drop comment "Early drop of incoming packets matching spamhaus-ipv6 list"
|
||||
|
||||
ip saddr @abusech-ipv4 counter drop comment "Early drop of packets matching abusech-ipv4 list"
|
||||
|
||||
ip saddr @abuseipdb-ipv4 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv4 list"
|
||||
ip6 saddr @abuseipdb-ipv6 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv6 list"
|
||||
|
||||
iifname lo accept comment "Allow from loopback"
|
||||
|
||||
ip protocol icmp limit rate 4/second accept comment "Allow ICMP"
|
||||
ip6 nexthdr ipv6-icmp limit rate 4/second accept comment "Allow IPv6 ICMP"
|
||||
ip protocol igmp limit rate 4/second accept comment "Allow IGMP"
|
||||
|
||||
{# SSH rules #}
|
||||
ip saddr 0.0.0.0/0 ct state new tcp dport 22 counter accept comment "Allow SSH"
|
||||
ip6 saddr ::/0 ct state new tcp dport 22 counter accept comment "Allow SSH"
|
||||
|
||||
{# Web rules #}
|
||||
{% if 'web' in group_names %}
|
||||
ip saddr 0.0.0.0/0 ct state new tcp dport 80 counter accept comment "Allow HTTP"
|
||||
ip saddr 0.0.0.0/0 ct state new tcp dport 443 counter accept comment "Allow HTTPS"
|
||||
ip6 saddr ::/0 ct state new tcp dport 80 counter accept comment "Allow HTTP"
|
||||
ip6 saddr ::/0 ct state new tcp dport 443 counter accept comment "Allow HTTPS"
|
||||
{% endif %}
|
||||
|
||||
ip saddr 0.0.0.0/0 ct state new udp dport 60001 counter accept comment "Allow mosh"
|
||||
ip saddr 0.0.0.0/0 ct state new udp dport 60002 counter accept comment "Allow mosh"
|
||||
ip saddr 0.0.0.0/0 ct state new udp dport 60003 counter accept comment "Allow mosh"
|
||||
ip6 saddr ::/0 ct state new udp dport 60001 counter accept comment "Allow mosh"
|
||||
ip6 saddr ::/0 ct state new udp dport 60002 counter accept comment "Allow mosh"
|
||||
ip6 saddr ::/0 ct state new udp dport 60003 counter accept comment "Allow mosh"
|
||||
|
||||
{# Extra rules #}
|
||||
{% if extra_iptables_rules is defined %}
|
||||
{% for rule in extra_iptables_rules %}
|
||||
ip saddr {{ ghetto_ipsets[rule.acl].src }} ct state new {{ rule.protocol }} dport {{ rule.port }} counter accept
|
||||
|
||||
{% if ghetto_ipsets[rule.acl].ipv6src is defined %}
|
||||
ip6 saddr {{ ghetto_ipsets[rule.acl].ipv6src }} ct state new {{ rule.protocol }} dport {{ rule.port }} counter accept
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
# everything else
|
||||
reject with icmpx type port-unreachable
|
||||
}
|
||||
chain forward {
|
||||
type filter hook forward priority 0;
|
||||
}
|
||||
chain output {
|
||||
type filter hook output priority 0;
|
||||
|
||||
ip daddr @spamhaus-ipv4 counter drop comment "Drop outgoing packets matching spamhaus-ipv4 list"
|
||||
ip6 daddr @spamhaus-ipv6 counter drop comment "Drop outgoing packets matching spamhaus-ipv6 list"
|
||||
|
||||
ip daddr @abusech-ipv4 counter drop comment "Drop outgoing packets matching abusech-ipv4 list"
|
||||
|
||||
ip daddr @abuseipdb-ipv4 counter drop comment "Drop outgoing packets matching abuseipdb-ipv4 list"
|
||||
ip6 daddr @abuseipdb-ipv6 counter drop comment "Drop outgoing packets matching abuseipdb-ipv6 list"
|
||||
}
|
||||
}
|
||||
@ -69,13 +69,4 @@
|
||||
<source ipset="abusers-ipv6"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
<rule>
|
||||
<source ipset="spamhaus-ipv4"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
<rule>
|
||||
<source ipset="spamhaus-ipv6"/>
|
||||
<drop/>
|
||||
</rule>
|
||||
|
||||
</zone>
|
||||
|
||||
@ -9,7 +9,7 @@ deb http://security.ubuntu.com/ubuntu/ {{ ansible_distribution_release }}-securi
|
||||
{% set apt_mirror = apt_mirror | default('deb.debian.org') %}
|
||||
deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }} main contrib non-free
|
||||
|
||||
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main contrib non-free
|
||||
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}/updates main contrib non-free
|
||||
|
||||
deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }}-updates main contrib non-free
|
||||
|
||||
|
||||
@ -1,138 +0,0 @@
|
||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
# possible, but leave them commented. Uncommented options override the
|
||||
# default value.
|
||||
|
||||
Include /etc/ssh/sshd_config.d/*.conf
|
||||
|
||||
#Port 22
|
||||
#AddressFamily any
|
||||
#ListenAddress 0.0.0.0
|
||||
#ListenAddress ::
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
#RekeyLimit default none
|
||||
|
||||
# Logging
|
||||
#SyslogFacility AUTH
|
||||
# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear audit track of which key was using to log in.
|
||||
LogLevel VERBOSE
|
||||
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
PermitRootLogin prohibit-password
|
||||
#StrictModes yes
|
||||
MaxAuthTries 4
|
||||
#MaxSessions 10
|
||||
|
||||
#PubkeyAuthentication yes
|
||||
|
||||
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
|
||||
# but this is overridden so installations will only check .ssh/authorized_keys
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
|
||||
#AuthorizedPrincipalsFile none
|
||||
|
||||
#AuthorizedKeysCommand none
|
||||
#AuthorizedKeysCommandUser nobody
|
||||
|
||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||
#HostbasedAuthentication no
|
||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||
# HostbasedAuthentication
|
||||
#IgnoreUserKnownHosts no
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
#KerberosGetAFSToken no
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
#GSSAPIStrictAcceptorCheck yes
|
||||
#GSSAPIKeyExchange no
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
UsePAM yes
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
#AllowTcpForwarding yes
|
||||
#GatewayPorts no
|
||||
X11Forwarding no
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
PrintMotd no
|
||||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
|
||||
# Allow client to pass locale environment variables
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
|
||||
# Based on the ssh-audit profile for OpenSSH 8.4, but with but with all algos
|
||||
# with less than 256 bits removed, as NSA's Suite B removed them years ago and
|
||||
# the new (2018) CNSA suite is 256 bits and up.
|
||||
#
|
||||
# See: https://github.com/jtesta/ssh-audit/blob/master/src/ssh_audit/policy.py
|
||||
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
|
||||
# only allow shell access by provisioning user
|
||||
AllowUsers {{ provisioning_user.name }}
|
||||
@ -128,8 +128,8 @@ PasswordAuthentication yes
|
||||
# ... but with ciphers and MACs with < 256 bits removed, as NSA's Suite B now
|
||||
# does away with these! See: https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
|
||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
|
||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
|
||||
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
|
||||
|
||||
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
||||
# Is there a list of allowed users?
|
||||
|
||||
@ -17,7 +17,7 @@ innodb_buffer_pool_size: 256M
|
||||
# Ansible 2.7.x with PyMySQL seems to default to TCP connection so we should
|
||||
# force it to use a Unix socket.
|
||||
# See: https://github.com/ansible/ansible/issues/47736
|
||||
mariadb_login_unix_socket: /run/mysqld/mysqld.sock
|
||||
mariadb_login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||
|
||||
# default is 100 but the max I've seen used is 5, so let's reduce it
|
||||
max_connections: 33
|
||||
|
||||
@ -29,27 +29,29 @@
|
||||
- restart mariadb
|
||||
tags: mariadb
|
||||
|
||||
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_user_module.html
|
||||
# 'localhost' needs to be the last item for idempotency, see
|
||||
# https://docs.ansible.com/ansible/latest/mysql_user_module.html
|
||||
- name: Update MariaDB root password for all root accounts
|
||||
mysql_user: name=root host={{ item }} password={{ mariadb_root_password }} login_unix_socket={{ mariadb_login_unix_socket }}
|
||||
loop:
|
||||
- "{{ inventory_hostname }}"
|
||||
- 127.0.0.1
|
||||
- ::1
|
||||
- localhost
|
||||
tags: mariadb
|
||||
|
||||
- name: Create .my.conf file with root credentials
|
||||
template: src=.my.cnf.j2 dest=/root/.my.cnf owner=root mode=0600
|
||||
tags: mariadb
|
||||
|
||||
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_db_module.html
|
||||
- name: Create MariaDB database(s)
|
||||
mysql_db: db={{ item.name }} state=present encoding=utf8mb4 login_unix_socket={{ mariadb_login_unix_socket }}
|
||||
mysql_db: db={{ item.name }} state=present encoding=utf8mb4
|
||||
loop: "{{ mariadb_databases }}"
|
||||
when: mariadb_databases is defined
|
||||
tags: mariadb
|
||||
|
||||
- name: Create MariaDB user(s)
|
||||
mysql_user: name={{ item.user }} password={{ item.pass }} priv={{ item.name }}.*:ALL host=127.0.0.1 state=present login_unix_socket={{ mariadb_login_unix_socket }}
|
||||
mysql_user: name={{ item.user }} password={{ item.pass }} priv={{ item.name }}.*:ALL host=127.0.0.1 state=present
|
||||
loop: "{{ mariadb_databases }}"
|
||||
when: mariadb_databases is defined
|
||||
tags: mariadb
|
||||
|
||||
@ -19,14 +19,14 @@
|
||||
# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
|
||||
[client]
|
||||
port = 3306
|
||||
socket = /run/mysqld/mysqld.sock
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
|
||||
# Here is entries for some specific programs
|
||||
# The following values assume you have at least 32M ram
|
||||
|
||||
# This was formally known as [safe_mysqld]. Both versions are currently parsed.
|
||||
[mysqld_safe]
|
||||
socket = /run/mysqld/mysqld.sock
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
nice = 0
|
||||
|
||||
[mysqld]
|
||||
@ -34,8 +34,8 @@ nice = 0
|
||||
# * Basic Settings
|
||||
#
|
||||
user = mysql
|
||||
pid-file = /run/mysqld/mysqld.pid
|
||||
socket = /run/mysqld/mysqld.sock
|
||||
pid-file = /var/run/mysqld/mysqld.pid
|
||||
socket = /var/run/mysqld/mysqld.sock
|
||||
port = 3306
|
||||
basedir = /usr
|
||||
datadir = /var/lib/mysql
|
||||
|
||||
@ -20,25 +20,18 @@ nginx_ssl_protocols: 'TLSv1.2 TLSv1.3'
|
||||
# See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
|
||||
nginx_ssl_stapling_resolver: '1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]'
|
||||
|
||||
# HTTP Strict-Transport-Security header, recommended by Google to be ~1 year
|
||||
# in seconds, see: https://hstspreload.org/
|
||||
nginx_hsts_max_age: 31536000
|
||||
|
||||
# install acme.sh?
|
||||
# install certbot + dependencies?
|
||||
# True unless you're in development and using "localhost" + snakeoil certs
|
||||
use_letsencrypt: True
|
||||
|
||||
# Directory root for Let's Encrypt certs
|
||||
letsencrypt_root: /etc/ssl
|
||||
letsencrypt_root: /etc/letsencrypt/live
|
||||
|
||||
# Location where to save initial acme.sh script. After installation the script
|
||||
# will automatically create its home in the /root/.acme.sh directory (including
|
||||
# a copy of the script itself).
|
||||
letsencrypt_acme_script: /root/acme.sh
|
||||
letsencrypt_acme_home: /root/.acme.sh
|
||||
# Location of Let's Encrypt's certbot script
|
||||
letsencrypt_certbot_dest: /opt/certbot-auto
|
||||
|
||||
# stable is 1.20.x
|
||||
# mainline is 1.21.x
|
||||
# stable is 1.18.x
|
||||
# mainline is 1.19.x
|
||||
nginx_version: mainline
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@ -15,6 +15,3 @@ add_header X-XSS-Protection "1; mode=block" always;
|
||||
# CSP can be quite difficult to configure, and cause real issues if you get it wrong
|
||||
# There is website that helps you generate a policy here http://cspisawesome.com/
|
||||
# add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' https://www.google-analytics.com;" always;
|
||||
|
||||
# Opt this site out of Google Chrome's Federated Learning of Cohorts (FLoC)
|
||||
add_header Permissions-Policy interest-cohort=() always;
|
||||
|
||||
3
roles/nginx/files/start-nginx.sh
Executable file
3
roles/nginx/files/start-nginx.sh
Executable file
@ -0,0 +1,3 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
/bin/systemctl start nginx
|
||||
3
roles/nginx/files/stop-nginx.sh
Executable file
3
roles/nginx/files/stop-nginx.sh
Executable file
@ -0,0 +1,3 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
/bin/systemctl stop nginx
|
||||
@ -1,61 +1,137 @@
|
||||
---
|
||||
|
||||
# Use acme.sh instead of certbot because they only support installation via
|
||||
# snap now.
|
||||
- block:
|
||||
- name: Remove certbot
|
||||
apt:
|
||||
name: certbot
|
||||
state: absent
|
||||
|
||||
- name: Remove old certbot post and pre hooks for nginx
|
||||
file:
|
||||
dest: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
|
||||
- /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
|
||||
|
||||
- name: Download acme.sh
|
||||
get_url:
|
||||
url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
|
||||
dest: "{{ letsencrypt_acme_script }}"
|
||||
mode: 0700
|
||||
|
||||
- name: Prepare Let's Encrypt well-known directory
|
||||
file:
|
||||
state: directory
|
||||
path: /var/lib/letsencrypt/.well-known
|
||||
owner: root
|
||||
group: nginx
|
||||
mode: g+s
|
||||
|
||||
- name: Copy systemd service to renew Let's Encrypt certs
|
||||
template:
|
||||
src: renew-letsencrypt.service.j2
|
||||
dest: /etc/systemd/system/renew-letsencrypt.service
|
||||
mode: 0644
|
||||
owner: root
|
||||
group: root
|
||||
template: src=renew-letsencrypt.service.j2 dest=/etc/systemd/system/renew-letsencrypt.service mode=0644 owner=root group=root
|
||||
|
||||
- name: Copy systemd timer to renew Let's Encrypt certs
|
||||
copy:
|
||||
src: renew-letsencrypt.timer
|
||||
dest: /etc/systemd/system/renew-letsencrypt.timer
|
||||
mode: 0644
|
||||
owner: root
|
||||
group: root
|
||||
copy: src=renew-letsencrypt.timer dest=/etc/systemd/system/renew-letsencrypt.timer mode=0644 owner=root group=root
|
||||
|
||||
# always issues daemon-reload just in case the service/timer changed
|
||||
# always issues daemon-reload just in case the server/timer changed
|
||||
- name: Start and enable systemd timer to renew Let's Encrypt certs
|
||||
systemd:
|
||||
name: renew-letsencrypt.timer
|
||||
state: started
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
systemd: name=renew-letsencrypt.timer state=started enabled=yes daemon_reload=yes
|
||||
|
||||
when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '=='))
|
||||
or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
|
||||
- name: Download certbot
|
||||
get_url: dest={{ letsencrypt_certbot_dest }} url=https://dl.eff.org/certbot-auto mode=700
|
||||
|
||||
# Dependencies certbot checks for on its first run. I set them in a fact so that
|
||||
# I can pass the list directly to the apt module to install in one transaction.
|
||||
- name: Set certbot dependencies (Debian 10)
|
||||
when: ansible_distribution == 'Debian' and ansible_distribution_major_version is version('10', '==')
|
||||
set_fact:
|
||||
certbot_dependencies:
|
||||
- augeas-lenses
|
||||
- binutils
|
||||
- binutils-common
|
||||
- binutils-x86-64-linux-gnu
|
||||
- cpp
|
||||
- cpp-8
|
||||
- gcc
|
||||
- gcc-8
|
||||
- libasan5
|
||||
- libatomic1
|
||||
- libaugeas0
|
||||
- libbinutils
|
||||
- libc-dev-bin
|
||||
- libc6-dev
|
||||
- libcc1-0
|
||||
- libexpat1-dev
|
||||
- libffi-dev
|
||||
- libgcc-8-dev
|
||||
- libgomp1
|
||||
- libisl19
|
||||
- libitm1
|
||||
- liblsan0
|
||||
- libmpc3
|
||||
- libmpfr6
|
||||
- libmpx2
|
||||
- libpython-dev
|
||||
- libpython2-dev
|
||||
- libpython2.7
|
||||
- libpython2.7-dev
|
||||
- libquadmath0
|
||||
- libssl-dev
|
||||
- libtsan0
|
||||
- libubsan1
|
||||
- linux-libc-dev
|
||||
- python-dev
|
||||
- python-pip-whl
|
||||
- python-pkg-resources
|
||||
- python-virtualenv
|
||||
- python2-dev
|
||||
- python2.7-dev
|
||||
- python3-distutils
|
||||
- python3-lib2to3
|
||||
- python3-virtualenv
|
||||
- virtualenv
|
||||
|
||||
# Dependencies certbot checks for on its first run. I set them in a fact so that
|
||||
# I can pass the list directly to the apt module to install in one transaction.
|
||||
- name: Set certbot dependencies (Ubuntu 18.04)
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==')
|
||||
set_fact:
|
||||
certbot_dependencies:
|
||||
- augeas-lenses
|
||||
- binutils
|
||||
- binutils-common
|
||||
- binutils-x86-64-linux-gnu
|
||||
- cpp
|
||||
- cpp-7
|
||||
- gcc
|
||||
- gcc-7
|
||||
- gcc-7-base
|
||||
- libasan4
|
||||
- libatomic1
|
||||
- libaugeas0
|
||||
- libbinutils
|
||||
- libc-dev-bin
|
||||
- libc6-dev
|
||||
- libcc1-0
|
||||
- libcilkrts5
|
||||
- libexpat1-dev
|
||||
- libffi-dev
|
||||
- libgcc-7-dev
|
||||
- libgomp1
|
||||
- libisl19
|
||||
- libitm1
|
||||
- liblsan0
|
||||
- libmpc3
|
||||
- libmpx2
|
||||
- libpython-dev
|
||||
- libpython2.7
|
||||
- libpython2.7-dev
|
||||
- libquadmath0
|
||||
- libssl-dev
|
||||
- libtsan0
|
||||
- libubsan0
|
||||
- linux-libc-dev
|
||||
- python-dev
|
||||
- python-pip-whl
|
||||
- python-pkg-resources
|
||||
- python-virtualenv
|
||||
- python2.7-dev
|
||||
- python3-virtualenv
|
||||
- virtualenv
|
||||
|
||||
- name: Install certbot dependencies
|
||||
apt: name={{ certbot_dependencies }} state=present update_cache=yes
|
||||
|
||||
when: ansible_distribution != 'Ubuntu' and ansible_distribution_major_version is version('20.04', '!=')
|
||||
tags: letsencrypt
|
||||
|
||||
# On Ubuntu 20.04 it is no longer recommended/supported to use the standalone
|
||||
# certbot-auto so I guess we need to use the one from the repositories.
|
||||
- block:
|
||||
- name: Install certbot (Ubuntu 20.04)
|
||||
apt: name=certbot state=present update_cache=yes
|
||||
|
||||
- name: Copy certbot post and pre hooks for nginx
|
||||
copy: src={{ item.src }} dest={{ item.dest }} owner=root group=root mode=0755
|
||||
with_items:
|
||||
- { src: 'stop-nginx.sh', dest: '/etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh' }
|
||||
- { src: 'start-nginx.sh', dest: '/etc/letsencrypt/renewal-hooks/post/start-nginx.sh' }
|
||||
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')
|
||||
tags: letsencrypt
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@ -16,15 +16,8 @@
|
||||
add_nginx_apt_key is changed or
|
||||
add_nginx_apt_repository is changed
|
||||
|
||||
- name: Set nginx packages
|
||||
set_fact:
|
||||
nginx_packages:
|
||||
- nginx
|
||||
- ssl-cert # for ssl-cert-snakeoil.pem in nginx
|
||||
tags: nginx, packages
|
||||
|
||||
- name: Install nginx packages
|
||||
apt: pkg={{ nginx_packages }} cache_valid_time=3600 state=present
|
||||
- name: Install nginx
|
||||
apt: pkg=nginx cache_valid_time=3600 state=present
|
||||
tags: nginx, packages
|
||||
|
||||
- name: Copy nginx.conf
|
||||
@ -78,6 +71,7 @@
|
||||
|
||||
- name: Configure Let's Encrypt
|
||||
include_tasks: letsencrypt.yml
|
||||
when: use_letsencrypt is defined and use_letsencrypt
|
||||
tags: letsencrypt
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@ -7,11 +7,13 @@
|
||||
notify:
|
||||
- reload nginx
|
||||
|
||||
- name: Download 4096-bit RFC 7919 dhparams
|
||||
get_url:
|
||||
url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
|
||||
checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
|
||||
dest: "{{ nginx_ssl_dhparam }}"
|
||||
- name: Generate self-signed TLS cert
|
||||
command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
|
||||
notify:
|
||||
- reload nginx
|
||||
|
||||
- name: Generate 2048-bit dhparam
|
||||
command: openssl dhparam -out dhparam.pem 2048 chdir=/etc/ssl/certs creates=dhparam.pem
|
||||
notify:
|
||||
- reload nginx
|
||||
|
||||
|
||||
@ -16,9 +16,9 @@ server {
|
||||
listen [::]:443 ssl http2 default_server;
|
||||
server_name _;
|
||||
|
||||
# self-signed "snakeoil" certificate from ssl-cert package
|
||||
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
|
||||
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
|
||||
# "snakeoil" certificate (self signed!)
|
||||
ssl_certificate /etc/ssl/certs/nginx-snakeoil.crt;
|
||||
ssl_certificate_key /etc/ssl/private/nginx-snakeoil.key;
|
||||
|
||||
ssl_session_timeout {{ nginx_ssl_session_timeout }};
|
||||
ssl_session_cache {{ nginx_ssl_session_cache }};
|
||||
|
||||
@ -16,8 +16,8 @@
|
||||
|
||||
# concatenated key + cert
|
||||
# See: http://nginx.org/en/docs/http/configuring_https_servers.html
|
||||
ssl_certificate {{ letsencrypt_root }}/certs/{{ domain_name }}.fullchain.pem;
|
||||
ssl_certificate_key {{ letsencrypt_root }}/private/{{ domain_name }}.key.pem;
|
||||
ssl_certificate {{ letsencrypt_root }}/{{ domain_name }}/fullchain.pem;
|
||||
ssl_certificate_key {{ letsencrypt_root }}/{{ domain_name }}/privkey.pem;
|
||||
|
||||
{% endif %}
|
||||
|
||||
@ -51,5 +51,5 @@
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
add_header Strict-Transport-Security "max-age={{ nginx_hsts_max_age }}; includeSubDomains; preload" always;
|
||||
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
|
||||
{% endif %}
|
||||
|
||||
@ -1,9 +1,7 @@
|
||||
[Unit]
|
||||
Description=Renew Let's Encrypt certificates
|
||||
ConditionFileIsExecutable={{ letsencrypt_acme_home }}/acme.sh
|
||||
ConditionFileIsExecutable={{ letsencrypt_certbot_dest }}
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart={{ letsencrypt_acme_home }}/acme.sh --cron --home {{ letsencrypt_acme_home }} --reloadcmd "/bin/systemctl reload nginx" -w /var/lib/letsencrypt
|
||||
|
||||
SuccessExitStatus=0 2
|
||||
ExecStart={{ letsencrypt_certbot_dest }} renew --standalone --pre-hook "/bin/systemctl stop nginx" --post-hook "/bin/systemctl start nginx"
|
||||
|
||||
@ -14,8 +14,6 @@ server {
|
||||
listen [::]:80;
|
||||
server_name {{ domain_name }} {{ domain_aliases }};
|
||||
|
||||
{% include 'well-known.j2' %}
|
||||
|
||||
# redirect http -> https
|
||||
location / {
|
||||
# ? in rewrite makes sure nginx doesn't append query string again
|
||||
@ -77,7 +75,7 @@ server {
|
||||
fastcgi_pass unix:/run/php/php7.2-fpm-{{ domain_name }}.sock;
|
||||
{% elif ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==') %}
|
||||
fastcgi_pass unix:/run/php/php7.3-fpm-{{ domain_name }}.sock;
|
||||
{% elif (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==')) %}
|
||||
{% elif ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==') %}
|
||||
fastcgi_pass unix:/run/php/php7.4-fpm-{{ domain_name }}.sock;
|
||||
{% else %}
|
||||
fastcgi_pass unix:/var/run/php5-fpm-{{ domain_name }}.sock;
|
||||
@ -98,7 +96,7 @@ server {
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
add_header Strict-Transport-Security "max-age={{ nginx_hsts_max_age }}; includeSubDomains; preload" always;
|
||||
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
|
||||
{% endif %}
|
||||
|
||||
include extra-security.conf;
|
||||
|
||||
@ -1,6 +0,0 @@
|
||||
location ^~ /.well-known/acme-challenge/ {
|
||||
allow all;
|
||||
root /var/lib/letsencrypt/;
|
||||
default_type "text/plain";
|
||||
try_files $uri =404;
|
||||
}
|
||||
@ -9,7 +9,7 @@
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
add_header Strict-Transport-Security "max-age={{ nginx_hsts_max_age }}; includeSubDomains; preload" always;
|
||||
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
@ -20,7 +20,7 @@
|
||||
# Enable this if you want HSTS (recommended, but be careful)
|
||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||
# See: https://hstspreload.appspot.com/
|
||||
add_header Strict-Transport-Security "max-age={{ nginx_hsts_max_age }}; includeSubDomains; preload" always;
|
||||
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
|
||||
@ -28,8 +28,7 @@
|
||||
- name: Update php.ini
|
||||
template: src=php7.3-php.ini.j2 dest=/etc/php/7.3/fpm/php.ini owner=root group=root mode=0644
|
||||
notify: reload php7.3-fpm
|
||||
|
||||
tags: php-fpm
|
||||
when: install_php
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@ -28,8 +28,7 @@
|
||||
- name: Update php.ini
|
||||
template: src=php7.2-php.ini.j2 dest=/etc/php/7.2/fpm/php.ini owner=root group=root mode=0644
|
||||
notify: reload php7.2-fpm
|
||||
|
||||
tags: php-fpm
|
||||
when: install_php
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@ -28,8 +28,7 @@
|
||||
- name: Update php.ini
|
||||
template: src=php7.4-php.ini.j2 dest=/etc/php/7.4/fpm/php.ini owner=root group=root mode=0644
|
||||
notify: reload php7.4-fpm
|
||||
|
||||
tags: php-fpm
|
||||
when: install_php
|
||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
@ -2,49 +2,20 @@
|
||||
# Ubuntu 18.04 uses php-fpm 7.2
|
||||
# Debian 10 uses php-fpm 7.3
|
||||
# Ubuntu 20.04 uses PHP 7.4
|
||||
# Debian 11 uses PHP 7.4
|
||||
|
||||
# If any of the vhosts on this host need WordPress then we need to install PHP.
|
||||
# This uses selectattr to filter the list of dicts in nginx_vhosts, selecting
|
||||
# any that have has_wordpress defined, and has_wordpress set to True.
|
||||
#
|
||||
# See: https://stackoverflow.com/a/31896249
|
||||
- name: Check if any vhost needs WordPress
|
||||
set_fact:
|
||||
install_php: True
|
||||
when: "nginx_vhosts | selectattr('has_wordpress', 'defined') | selectattr('has_wordpress', 'equalto', True) | list | length > 0"
|
||||
|
||||
# Legacy, was only for Piwik, but leaving for now.
|
||||
- name: Check if any vhost needs PHP
|
||||
set_fact:
|
||||
install_php: True
|
||||
when: "nginx_vhosts | selectattr('needs_php', 'defined') | selectattr('needs_php', 'equalto', True) | list | length > 0"
|
||||
|
||||
# If install_php has not been set, then we assume no vhosts need PHP. This is
|
||||
# a bit hacky, but it's the closest we come to an if/then/else.
|
||||
- name: Set install_php to False
|
||||
set_fact:
|
||||
install_php: False
|
||||
when: install_php is not defined
|
||||
|
||||
- name: Configure php-fpm on Ubuntu 18.04
|
||||
include_tasks: Ubuntu_18.04.yml
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==') and install_php
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==')
|
||||
tags: php-fpm
|
||||
|
||||
- name: Configure php-fpm on Debian 10
|
||||
include_tasks: Debian_10.yml
|
||||
when: ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==') and install_php
|
||||
when: ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==')
|
||||
tags: php-fpm
|
||||
|
||||
- name: Configure php-fpm on Ubuntu 20.04
|
||||
include_tasks: Ubuntu_20.04.yml
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==') and install_php
|
||||
tags: php-fpm
|
||||
|
||||
- name: Configure php-fpm on Debian 11
|
||||
include_tasks: Ubuntu_20.04.yml
|
||||
when: ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==') and install_php
|
||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')
|
||||
tags: php-fpm
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
|
||||
10
vars/Alpine.yml
Normal file
10
vars/Alpine.yml
Normal file
@ -0,0 +1,10 @@
|
||||
---
|
||||
|
||||
# sshd service name is `ssh` on Debian/Ubuntu, but it's
|
||||
# `sshd` on CentOS and Alpine
|
||||
sshd_service_name: sshd
|
||||
|
||||
# provisioning user vars
|
||||
provisioning_user: { name: 'provisioning', home: '/home/provisioning' }
|
||||
|
||||
# vim: set ts=2 sw=2:
|
||||
Reference in New Issue
Block a user