Compare commits
171 Commits
ebd8b0632b
...
debian13
| Author | SHA1 | Date | |
|---|---|---|---|
d51f8fefaa
|
|||
|
9ff6e19135
|
|||
|
4680999680
|
|||
|
602734acce
|
|||
|
0db7911b70
|
|||
|
ee4c62e5f9
|
|||
|
a315db8a7c
|
|||
|
5f00892df3
|
|||
|
9357265d27
|
|||
|
dd62266340
|
|||
|
a1bec20824
|
|||
|
8e91c44529
|
|||
|
02d4135c79
|
|||
|
37e148d009
|
|||
|
73dbbd23b6
|
|||
|
b84283aa38
|
|||
|
1695fdf8d1
|
|||
|
9f1f7b1c69
|
|||
|
7d725f2084
|
|||
|
4c39b0d48c
|
|||
|
f4023d0b20
|
|||
|
6aaface4a2
|
|||
|
333e1cbeb9
|
|||
|
0c62f4bdf0
|
|||
|
26f22c0447
|
|||
|
05881e2585
|
|||
|
d4d326c2f7
|
|||
|
1d4a6f208b
|
|||
|
8b22076d4a
|
|||
|
38176cb34c
|
|||
|
da737b71f7
|
|||
|
c28189a1a5
|
|||
|
b600141e89
|
|||
|
4be98d1a33
|
|||
|
2bb018a40c
|
|||
|
89a1e11b7a
|
|||
|
0c0cad9084
|
|||
|
9dce701a19
|
|||
|
3e9ee44d5b
|
|||
|
599b5e5e83
|
|||
|
bc700ea532
|
|||
|
8016701b57
|
|||
|
00558c7dea
|
|||
|
c927186837
|
|||
|
690774c862
|
|||
|
cc021bd14a
|
|||
|
73fd06fe3a
|
|||
|
88cb3a370e
|
|||
|
027a43ddbe
|
|||
|
bb30c3be20
|
|||
|
d8d9790d21
|
|||
|
9a500ebc0d
|
|||
|
4bae942585
|
|||
|
99866c0c90
|
|||
|
0afb8a4493
|
|||
|
506695da31
|
|||
|
f67ed7762c
|
|||
|
014f4d9502
|
|||
|
22c16e1ed3
|
|||
|
5aa6a33e51
|
|||
|
7f9b06af9c
|
|||
|
84db337fea
|
|||
|
7b23f5f94f
|
|||
|
9830338be3
|
|||
|
e3eed26765
|
|||
|
8b31c7e148
|
|||
|
3ff8043aaf
|
|||
|
cb79f7ef70
|
|||
|
bb14f05d2a
|
|||
|
5b1530fa91
|
|||
|
5312dc6bd5
|
|||
|
d6e060d3af
|
|||
|
b873af004a
|
|||
|
7ea3ab46f8
|
|||
|
0561bd5b52
|
|||
|
d62572f02c
|
|||
|
2ffe5e87d9
|
|||
|
38d4f1a303
|
|||
|
ed8cb88038
|
|||
|
c31e447861
|
|||
|
545684467c
|
|||
|
24ae5eaab1
|
|||
|
dac23f1427
|
|||
|
41fbc73dd1
|
|||
|
fee794bcf0
|
|||
|
8bce1d8b1b
|
|||
|
6dc2ea36b6
|
|||
|
af71a9b5f8
|
|||
|
4dd57803e2
|
|||
|
18d4245fc0
|
|||
|
1bddf3cccd
|
|||
|
20dbe61fe1
|
|||
|
899e87321b
|
|||
|
06416a3b64
|
|||
|
7a9a24ef5d
|
|||
|
067adcd9f5
|
|||
|
84d210cfab
|
|||
|
17736a4f14
|
|||
|
b9e91c4a3d
|
|||
|
51c95e5d4c
|
|||
|
8dbec29d2a
|
|||
|
d3bf3dab04
|
|||
|
8f50b7756b
|
|||
|
e86ccc9979
|
|||
|
cea8529f49
|
|||
|
d77718edae
|
|||
|
14d57fc477
|
|||
|
5c39f1abd8
|
|||
|
6794eb0432
|
|||
|
11614e3725
|
|||
|
b106f9d9e5
|
|||
|
3c8250e6ac
|
|||
|
d280859b0d
|
|||
|
bca1629d2f
|
|||
|
4fa82faf18
|
|||
|
b8f0b4b1fb
|
|||
|
68e5d05bbb
|
|||
|
446d402778
|
|||
|
67379fc2e4
|
|||
|
73546967b6
|
|||
|
16b661efe1
|
|||
|
fdb9a75489
|
|||
|
232d7a0348
|
|||
|
6e4bb5bc34
|
|||
|
c840ffe018
|
|||
|
45c9d7ea0a
|
|||
|
a62bc446e8
|
|||
|
62a6a491db
|
|||
|
4867d6da6a
|
|||
|
d9f7c7a93b
|
|||
|
bc8c030700
|
|||
|
f7598d8f1c
|
|||
|
c353e84a84
|
|||
|
99ca23f258
|
|||
|
b663d27fd8
|
|||
|
67c99dacf6
|
|||
|
4abf2b10e4
|
|||
|
f5199264f9
|
|||
|
b259f09cbd
|
|||
|
f4b32e516b
|
|||
|
fcb12ecee0
|
|||
|
5bc03ceacc
|
|||
|
c317429f6d
|
|||
|
b512a7f765
|
|||
|
e3a87d4f79
|
|||
|
dec2d50fbc
|
|||
|
34be0013b7
|
|||
|
399585f4e7
|
|||
|
0240897b1b
|
|||
|
1da0da53ec
|
|||
|
677cc9f160
|
|||
|
ffe7a872dd
|
|||
|
95d0005978
|
|||
|
498766fdc4
|
|||
| fc0fcc5742 | |||
| 587bd6dcdd | |||
|
92a4c72809
|
|||
|
a2d61abba2
|
|||
|
d2a5a28809
|
|||
|
84c0589aee
|
|||
|
2961578a54
|
|||
|
4d74f76b3c
|
|||
|
9e737466c5
|
|||
|
0ffb1b1a36
|
|||
|
68f0b85eb3
|
|||
|
ebbde530d2
|
|||
|
ab47df6031
|
|||
|
de75b2ffb6
|
|||
|
e10d83dadd
|
|||
|
f070fd9a64
|
|||
|
6e1527b1a8
|
3
Pipfile
3
Pipfile
@@ -7,6 +7,7 @@ verify_ssl = true
|
|||||||
|
|
||||||
[packages]
|
[packages]
|
||||||
ansible = "*"
|
ansible = "*"
|
||||||
|
ansible-lint = "*"
|
||||||
|
|
||||||
[requires]
|
[requires]
|
||||||
python_version = "3.9"
|
python_version = "3.13"
|
||||||
|
|||||||
864
Pipfile.lock
generated
864
Pipfile.lock
generated
@@ -1,11 +1,11 @@
|
|||||||
{
|
{
|
||||||
"_meta": {
|
"_meta": {
|
||||||
"hash": {
|
"hash": {
|
||||||
"sha256": "65b615b857250757470e21fc3a4b1cdfe75b4b012c0d1d633a5ebf1988d9cb91"
|
"sha256": "47970866f4ffc7775e3a95dd04ee8b75f9784c457baadd8a31fe1783584fa73f"
|
||||||
},
|
},
|
||||||
"pipfile-spec": 6,
|
"pipfile-spec": 6,
|
||||||
"requires": {
|
"requires": {
|
||||||
"python_version": "3.9"
|
"python_version": "3.13"
|
||||||
},
|
},
|
||||||
"sources": [
|
"sources": [
|
||||||
{
|
{
|
||||||
@@ -18,226 +18,730 @@
|
|||||||
"default": {
|
"default": {
|
||||||
"ansible": {
|
"ansible": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:2955fcbf51367f8bd88c38a86f8be83d4fcd05f778afb4feed31abfe8dcff639"
|
"sha256:1a17f8c593a973e6d81f10ebfe7eac53e799616f745d57b99bd36b34f79f16a2",
|
||||||
|
"sha256:1b3ad8158dd2597ce45a864a55ca09e5be1807cc97f44a00c39d7bb9e1520aa6"
|
||||||
],
|
],
|
||||||
"index": "pypi",
|
"index": "pypi",
|
||||||
"version": "==4.6.0"
|
"markers": "python_version >= '3.11'",
|
||||||
|
"version": "==12.0.0"
|
||||||
|
},
|
||||||
|
"ansible-compat": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:5bb843838414b75efff24dae5ff5b332cd503a596143d471980243cec4b46c9c",
|
||||||
|
"sha256:f29ab81264b3f04fb94ac2d7f68fe73efc2eb3cbe4ecf00f9b4742e77c41756f"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.10'",
|
||||||
|
"version": "==25.8.1"
|
||||||
},
|
},
|
||||||
"ansible-core": {
|
"ansible-core": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:7d3ce47014122907454704363485e48513f8ad0f00138b88870eb6d88953d121"
|
"sha256:1fe6ca533951b5ba4a619e763ea4f6725f68c36677c7d5aaa467b59aa449bdc8",
|
||||||
|
"sha256:87fcbbc492ed16eb6adb0379bae0adbf69f3ce88a8440e7e88e0dcefa9f8a54c"
|
||||||
],
|
],
|
||||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
|
"markers": "python_version >= '3.11'",
|
||||||
"version": "==2.11.5"
|
"version": "==2.19.2"
|
||||||
|
},
|
||||||
|
"ansible-lint": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:2d5a8a2b01c46966591a17769a129142181515aac19c27742ecb8c94e84bf692",
|
||||||
|
"sha256:b8fe138a1257c6e58a755febd726b3186820f6dcb23a5bb062538c939a7277bb"
|
||||||
|
],
|
||||||
|
"index": "pypi",
|
||||||
|
"markers": "python_version >= '3.10'",
|
||||||
|
"version": "==25.9.0"
|
||||||
|
},
|
||||||
|
"attrs": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:427318ce031701fea540783410126f03899a97ffc6f61596ad581ac2e40e3bc3",
|
||||||
|
"sha256:75d7cefc7fb576747b2c81b4442d4d4a1ce0900973527c011d1030fd3bf4af1b"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.8'",
|
||||||
|
"version": "==25.3.0"
|
||||||
|
},
|
||||||
|
"black": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:0172a012f725b792c358d57fe7b6b6e8e67375dd157f64fa7a3097b3ed3e2175",
|
||||||
|
"sha256:0474bca9a0dd1b51791fcc507a4e02078a1c63f6d4e4ae5544b9848c7adfb619",
|
||||||
|
"sha256:154b06d618233fe468236ba1f0e40823d4eb08b26f5e9261526fde34916b9140",
|
||||||
|
"sha256:1b9dc70c21ef8b43248f1d86aedd2aaf75ae110b958a7909ad8463c4aa0880b0",
|
||||||
|
"sha256:2ab0ce111ef026790e9b13bd216fa7bc48edd934ffc4cbf78808b235793cbc92",
|
||||||
|
"sha256:3bec74ee60f8dfef564b573a96b8930f7b6a538e846123d5ad77ba14a8d7a64f",
|
||||||
|
"sha256:456386fe87bad41b806d53c062e2974615825c7a52159cde7ccaeb0695fa28fa",
|
||||||
|
"sha256:474b34c1342cdc157d307b56c4c65bce916480c4a8f6551fdc6bf9b486a7c4ae",
|
||||||
|
"sha256:77e7060a00c5ec4b3367c55f39cf9b06e68965a4f2e61cecacd6d0d9b7ec945a",
|
||||||
|
"sha256:846d58e3ce7879ec1ffe816bb9df6d006cd9590515ed5d17db14e17666b2b357",
|
||||||
|
"sha256:8e46eecf65a095fa62e53245ae2795c90bdecabd53b50c448d0a8bcd0d2e74c4",
|
||||||
|
"sha256:9101ee58ddc2442199a25cb648d46ba22cd580b00ca4b44234a324e3ec7a0f7e",
|
||||||
|
"sha256:a16b14a44c1af60a210d8da28e108e13e75a284bf21a9afa6b4571f96ab8bb9d",
|
||||||
|
"sha256:aaf319612536d502fdd0e88ce52d8f1352b2c0a955cc2798f79eeca9d3af0608",
|
||||||
|
"sha256:b756fc75871cb1bcac5499552d771822fd9db5a2bb8db2a7247936ca48f39831",
|
||||||
|
"sha256:c0372a93e16b3954208417bfe448e09b0de5cc721d521866cd9e0acac3c04a1f",
|
||||||
|
"sha256:ce41ed2614b706fd55fd0b4a6909d06b5bab344ffbfadc6ef34ae50adba3d4f7",
|
||||||
|
"sha256:d119957b37cc641596063cd7db2656c5be3752ac17877017b2ffcdb9dfc4d2b1",
|
||||||
|
"sha256:e3c1f4cd5e93842774d9ee4ef6cd8d17790e65f44f7cdbaab5f2cf8ccf22a823",
|
||||||
|
"sha256:e593466de7b998374ea2585a471ba90553283fb9beefcfa430d84a2651ed5933",
|
||||||
|
"sha256:ef69351df3c84485a8beb6f7b8f9721e2009e20ef80a8d619e2d1788b7816d47",
|
||||||
|
"sha256:f96b6726d690c96c60ba682955199f8c39abc1ae0c3a494a9c62c0184049a713"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==25.9.0"
|
||||||
|
},
|
||||||
|
"bracex": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:0b0049264e7340b3ec782b5cb99beb325f36c3782a32e36e876452fd49a09952",
|
||||||
|
"sha256:98f1347cd77e22ee8d967a30ad4e310b233f7754dbf31ff3fceb76145ba47dc7"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==2.6"
|
||||||
},
|
},
|
||||||
"cffi": {
|
"cffi": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:06c54a68935738d206570b20da5ef2b6b6d92b38ef3ec45c5422c0ebaf338d4d",
|
"sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb",
|
||||||
"sha256:0c0591bee64e438883b0c92a7bed78f6290d40bf02e54c5bf0978eaf36061771",
|
"sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b",
|
||||||
"sha256:19ca0dbdeda3b2615421d54bef8985f72af6e0c47082a8d26122adac81a95872",
|
"sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f",
|
||||||
"sha256:22b9c3c320171c108e903d61a3723b51e37aaa8c81255b5e7ce102775bd01e2c",
|
"sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9",
|
||||||
"sha256:26bb2549b72708c833f5abe62b756176022a7b9a7f689b571e74c8478ead51dc",
|
"sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44",
|
||||||
"sha256:33791e8a2dc2953f28b8d8d300dde42dd929ac28f974c4b4c6272cb2955cb762",
|
"sha256:0f6084a0ea23d05d20c3edcda20c3d006f9b6f3fefeac38f59262e10cef47ee2",
|
||||||
"sha256:3c8d896becff2fa653dc4438b54a5a25a971d1f4110b32bd3068db3722c80202",
|
"sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c",
|
||||||
"sha256:4373612d59c404baeb7cbd788a18b2b2a8331abcc84c3ba40051fcd18b17a4d5",
|
"sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75",
|
||||||
"sha256:487d63e1454627c8e47dd230025780e91869cfba4c753a74fda196a1f6ad6548",
|
"sha256:1cd13c99ce269b3ed80b417dcd591415d3372bcac067009b6e0f59c7d4015e65",
|
||||||
"sha256:48916e459c54c4a70e52745639f1db524542140433599e13911b2f329834276a",
|
"sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e",
|
||||||
"sha256:4922cd707b25e623b902c86188aca466d3620892db76c0bdd7b99a3d5e61d35f",
|
"sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a",
|
||||||
"sha256:55af55e32ae468e9946f741a5d51f9896da6b9bf0bbdd326843fec05c730eb20",
|
"sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e",
|
||||||
"sha256:57e555a9feb4a8460415f1aac331a2dc833b1115284f7ded7278b54afc5bd218",
|
"sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25",
|
||||||
"sha256:5d4b68e216fc65e9fe4f524c177b54964af043dde734807586cf5435af84045c",
|
"sha256:2081580ebb843f759b9f617314a24ed5738c51d2aee65d31e02f6f7a2b97707a",
|
||||||
"sha256:64fda793737bc4037521d4899be780534b9aea552eb673b9833b01f945904c2e",
|
"sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe",
|
||||||
"sha256:6d6169cb3c6c2ad50db5b868db6491a790300ade1ed5d1da29289d73bbe40b56",
|
"sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b",
|
||||||
"sha256:7bcac9a2b4fdbed2c16fa5681356d7121ecabf041f18d97ed5b8e0dd38a80224",
|
"sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91",
|
||||||
"sha256:80b06212075346b5546b0417b9f2bf467fea3bfe7352f781ffc05a8ab24ba14a",
|
"sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592",
|
||||||
"sha256:818014c754cd3dba7229c0f5884396264d51ffb87ec86e927ef0be140bfdb0d2",
|
"sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187",
|
||||||
"sha256:8eb687582ed7cd8c4bdbff3df6c0da443eb89c3c72e6e5dcdd9c81729712791a",
|
"sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c",
|
||||||
"sha256:99f27fefe34c37ba9875f224a8f36e31d744d8083e00f520f133cab79ad5e819",
|
"sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1",
|
||||||
"sha256:9f3e33c28cd39d1b655ed1ba7247133b6f7fc16fa16887b120c0c670e35ce346",
|
"sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94",
|
||||||
"sha256:a8661b2ce9694ca01c529bfa204dbb144b275a31685a075ce123f12331be790b",
|
"sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba",
|
||||||
"sha256:a9da7010cec5a12193d1af9872a00888f396aba3dc79186604a09ea3ee7c029e",
|
"sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb",
|
||||||
"sha256:aedb15f0a5a5949ecb129a82b72b19df97bbbca024081ed2ef88bd5c0a610534",
|
"sha256:3f4d46d8b35698056ec29bca21546e1551a205058ae1a181d871e278b0b28165",
|
||||||
"sha256:b315d709717a99f4b27b59b021e6207c64620790ca3e0bde636a6c7f14618abb",
|
"sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529",
|
||||||
"sha256:ba6f2b3f452e150945d58f4badd92310449876c4c954836cfb1803bdd7b422f0",
|
"sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca",
|
||||||
"sha256:c33d18eb6e6bc36f09d793c0dc58b0211fccc6ae5149b808da4a62660678b156",
|
"sha256:4647afc2f90d1ddd33441e5b0e85b16b12ddec4fca55f0d9671fef036ecca27c",
|
||||||
"sha256:c9a875ce9d7fe32887784274dd533c57909b7b1dcadcc128a2ac21331a9765dd",
|
"sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6",
|
||||||
"sha256:c9e005e9bd57bc987764c32a1bee4364c44fdc11a3cc20a40b93b444984f2b87",
|
"sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c",
|
||||||
"sha256:d2ad4d668a5c0645d281dcd17aff2be3212bc109b33814bbb15c4939f44181cc",
|
"sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0",
|
||||||
"sha256:d950695ae4381ecd856bcaf2b1e866720e4ab9a1498cba61c602e56630ca7195",
|
"sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743",
|
||||||
"sha256:e22dcb48709fc51a7b58a927391b23ab37eb3737a98ac4338e2448bef8559b33",
|
"sha256:61d028e90346df14fedc3d1e5441df818d095f3b87d286825dfcbd6459b7ef63",
|
||||||
"sha256:e8c6a99be100371dbb046880e7a282152aa5d6127ae01783e37662ef73850d8f",
|
"sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5",
|
||||||
"sha256:e9dc245e3ac69c92ee4c167fbdd7428ec1956d4e754223124991ef29eb57a09d",
|
"sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5",
|
||||||
"sha256:eb687a11f0a7a1839719edd80f41e459cc5366857ecbed383ff376c4e3cc6afd",
|
"sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4",
|
||||||
"sha256:eb9e2a346c5238a30a746893f23a9535e700f8192a68c07c0258e7ece6ff3728",
|
"sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d",
|
||||||
"sha256:ed38b924ce794e505647f7c331b22a693bee1538fdf46b0222c4717b42f744e7",
|
"sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b",
|
||||||
"sha256:f0010c6f9d1a4011e429109fda55a225921e3206e7f62a0c22a35344bfd13cca",
|
"sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93",
|
||||||
"sha256:f0c5d1acbfca6ebdd6b1e3eded8d261affb6ddcf2186205518f1428b8569bb99",
|
"sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205",
|
||||||
"sha256:f10afb1004f102c7868ebfe91c28f4a712227fe4cb24974350ace1f90e1febbf",
|
"sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27",
|
||||||
"sha256:f174135f5609428cc6e1b9090f9268f5c8935fddb1b25ccb8255a2d50de6789e",
|
"sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512",
|
||||||
"sha256:f3ebe6e73c319340830a9b2825d32eb6d8475c1dac020b4f0aa774ee3b898d1c",
|
"sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d",
|
||||||
"sha256:f627688813d0a4140153ff532537fbe4afea5a3dffce1f9deb7f91f848a832b5",
|
"sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c",
|
||||||
"sha256:fd4305f86f53dfd8cd3522269ed7fc34856a8ee3709a5e28b2836b2db9d4cd69"
|
"sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037",
|
||||||
|
"sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26",
|
||||||
|
"sha256:89472c9762729b5ae1ad974b777416bfda4ac5642423fa93bd57a09204712322",
|
||||||
|
"sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb",
|
||||||
|
"sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c",
|
||||||
|
"sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8",
|
||||||
|
"sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4",
|
||||||
|
"sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414",
|
||||||
|
"sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9",
|
||||||
|
"sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664",
|
||||||
|
"sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9",
|
||||||
|
"sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775",
|
||||||
|
"sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739",
|
||||||
|
"sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc",
|
||||||
|
"sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062",
|
||||||
|
"sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe",
|
||||||
|
"sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9",
|
||||||
|
"sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92",
|
||||||
|
"sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5",
|
||||||
|
"sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13",
|
||||||
|
"sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d",
|
||||||
|
"sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26",
|
||||||
|
"sha256:cb527a79772e5ef98fb1d700678fe031e353e765d1ca2d409c92263c6d43e09f",
|
||||||
|
"sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495",
|
||||||
|
"sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b",
|
||||||
|
"sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6",
|
||||||
|
"sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c",
|
||||||
|
"sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef",
|
||||||
|
"sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5",
|
||||||
|
"sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18",
|
||||||
|
"sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad",
|
||||||
|
"sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3",
|
||||||
|
"sha256:de8dad4425a6ca6e4e5e297b27b5c824ecc7581910bf9aee86cb6835e6812aa7",
|
||||||
|
"sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5",
|
||||||
|
"sha256:e6e73b9e02893c764e7e8d5bb5ce277f1a009cd5243f8228f75f842bf937c534",
|
||||||
|
"sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49",
|
||||||
|
"sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2",
|
||||||
|
"sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5",
|
||||||
|
"sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453",
|
||||||
|
"sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf"
|
||||||
],
|
],
|
||||||
"version": "==1.14.6"
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==2.0.0"
|
||||||
|
},
|
||||||
|
"click": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:9b9f285302c6e3064f4330c05f05b81945b2a39544279343e6e7c5f27a9baddc",
|
||||||
|
"sha256:e7b8232224eba16f4ebe410c25ced9f7875cb5f3263ffc93cc3e8da705e229c4"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.10'",
|
||||||
|
"version": "==8.3.0"
|
||||||
},
|
},
|
||||||
"cryptography": {
|
"cryptography": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:0a7dcbcd3f1913f664aca35d47c1331fce738d44ec34b7be8b9d332151b0b01e",
|
"sha256:0a17377fa52563d730248ba1f68185461fff36e8bc75d8787a7dd2e20a802b7a",
|
||||||
"sha256:1eb7bb0df6f6f583dd8e054689def236255161ebbcf62b226454ab9ec663746b",
|
"sha256:0ca4be2af48c24df689a150d9cd37404f689e2968e247b6b8ff09bff5bcd786f",
|
||||||
"sha256:21ca464b3a4b8d8e86ba0ee5045e103a1fcfac3b39319727bc0fc58c09c6aff7",
|
"sha256:0d1922d9280e08cde90b518a10cd66831f632960a8d08cb3418922d83fce6f12",
|
||||||
"sha256:34dae04a0dce5730d8eb7894eab617d8a70d0c97da76b905de9efb7128ad7085",
|
"sha256:0dfb7c88d4462a0cfdd0d87a3c245a7bc3feb59de101f6ff88194f740f72eda6",
|
||||||
"sha256:3520667fda779eb788ea00080124875be18f2d8f0848ec00733c0ec3bb8219fc",
|
"sha256:0ff483716be32690c14636e54a1f6e2e1b7bf8e22ca50b989f88fa1b2d287080",
|
||||||
"sha256:3c4129fc3fdc0fa8e40861b5ac0c673315b3c902bbdc05fc176764815b43dd1d",
|
"sha256:13e67c4d3fb8b6bc4ef778a7ccdd8df4cd15b4bcc18f4239c8440891a11245cc",
|
||||||
"sha256:3fa3a7ccf96e826affdf1a0a9432be74dc73423125c8f96a909e3835a5ef194a",
|
"sha256:15b5fd9358803b0d1cc42505a18d8bca81dabb35b5cfbfea1505092e13a9d96d",
|
||||||
"sha256:5b0fbfae7ff7febdb74b574055c7466da334a5371f253732d7e2e7525d570498",
|
"sha256:1cd6d50c1a8b79af1a6f703709d8973845f677c8e97b1268f5ff323d38ce8475",
|
||||||
"sha256:695104a9223a7239d155d7627ad912953b540929ef97ae0c34c7b8bf30857e89",
|
"sha256:2dd339ba3345b908fa3141ddba4025568fa6fd398eabce3ef72a29ac2d73ad75",
|
||||||
"sha256:8695456444f277af73a4877db9fc979849cd3ee74c198d04fc0776ebc3db52b9",
|
"sha256:341fb7a26bc9d6093c1b124b9f13acc283d2d51da440b98b55ab3f79f2522ead",
|
||||||
"sha256:94cc5ed4ceaefcbe5bf38c8fba6a21fc1d365bb8fb826ea1688e3370b2e24a1c",
|
"sha256:34f04b7311174469ab3ac2647469743720f8b6c8b046f238e5cb27905695eb2a",
|
||||||
"sha256:94fff993ee9bc1b2440d3b7243d488c6a3d9724cc2b09cdb297f6a886d040ef7",
|
"sha256:41c281a74df173876da1dc9a9b6953d387f06e3d3ed9284e3baae3ab3f40883a",
|
||||||
"sha256:9965c46c674ba8cc572bc09a03f4c649292ee73e1b683adb1ce81e82e9a6a0fb",
|
"sha256:449ef2b321bec7d97ef2c944173275ebdab78f3abdd005400cc409e27cd159ab",
|
||||||
"sha256:a00cf305f07b26c351d8d4e1af84ad7501eca8a342dedf24a7acb0e7b7406e14",
|
"sha256:45f790934ac1018adeba46a0f7289b2b8fe76ba774a88c7f1922213a56c98bc1",
|
||||||
"sha256:a305600e7a6b7b855cd798e00278161b681ad6e9b7eca94c721d5f588ab212af",
|
"sha256:48948940d0ae00483e85e9154bb42997d0b77c21e43a77b7773c8c80de532ac5",
|
||||||
"sha256:cd65b60cfe004790c795cc35f272e41a3df4631e2fb6b35aa7ac6ef2859d554e",
|
"sha256:4c49eda9a23019e11d32a0eb51a27b3e7ddedde91e099c0ac6373e3aacc0d2ee",
|
||||||
"sha256:d2a6e5ef66503da51d2110edf6c403dc6b494cc0082f85db12f54e9c5d4c3ec5",
|
"sha256:504e464944f2c003a0785b81668fe23c06f3b037e9cb9f68a7c672246319f277",
|
||||||
"sha256:d9ec0e67a14f9d1d48dd87a2531009a9b251c02ea42851c060b25c782516ff06",
|
"sha256:534b96c0831855e29fc3b069b085fd185aa5353033631a585d5cd4dd5d40d657",
|
||||||
"sha256:f44d141b8c4ea5eb4dbc9b3ad992d45580c1d22bf5e24363f2fbf50c2d7ae8a7"
|
"sha256:6ef1488967e729948d424d09c94753d0167ce59afba8d0f6c07a22b629c557b2",
|
||||||
|
"sha256:7176a5ab56fac98d706921f6416a05e5aff7df0e4b91516f450f8627cda22af3",
|
||||||
|
"sha256:7411c910fb2a412053cf33cfad0153ee20d27e256c6c3f14d7d7d1d9fec59fd5",
|
||||||
|
"sha256:757af4f6341ce7a1e47c326ca2a81f41d236070217e5fbbad61bbfe299d55d28",
|
||||||
|
"sha256:7823bc7cdf0b747ecfb096d004cc41573c2f5c7e3a29861603a2871b43d3ef32",
|
||||||
|
"sha256:7fab1187b6c6b2f11a326f33b036f7168f5b996aedd0c059f9738915e4e8f53a",
|
||||||
|
"sha256:84ef1f145de5aee82ea2447224dc23f065ff4cc5791bb3b506615957a6ba8128",
|
||||||
|
"sha256:92e8cfe8bd7dd86eac0a677499894862cd5cc2fd74de917daa881d00871ac8e7",
|
||||||
|
"sha256:9394c7d5a7565ac5f7d9ba38b2617448eba384d7b107b262d63890079fad77ca",
|
||||||
|
"sha256:9495d78f52c804b5ec8878b5b8c7873aa8e63db9cd9ee387ff2db3fffe4df784",
|
||||||
|
"sha256:9873bf7c1f2a6330bdfe8621e7ce64b725784f9f0c3a6a55c3047af5849f920e",
|
||||||
|
"sha256:9babb7818fdd71394e576cf26c5452df77a355eac1a27ddfa24096665a27f8fd",
|
||||||
|
"sha256:9e8776dac9e660c22241b6587fae51a67b4b0147daa4d176b172c3ff768ad736",
|
||||||
|
"sha256:9ed64e5083fa806709e74fc5ea067dfef9090e5b7a2320a49be3c9df3583a2d8",
|
||||||
|
"sha256:9f2c4cc63be3ef43c0221861177cee5d14b505cd4d4599a89e2cd273c4d3542a",
|
||||||
|
"sha256:9f40642a140c0c8649987027867242b801486865277cbabc8c6059ddef16dc8b",
|
||||||
|
"sha256:af84e8e99f1a82cea149e253014ea9dc89f75b82c87bb6c7242203186f465129",
|
||||||
|
"sha256:b9c79af2c3058430d911ff1a5b2b96bbfe8da47d5ed961639ce4681886614e70",
|
||||||
|
"sha256:c52fded6383f7e20eaf70a60aeddd796b3677c3ad2922c801be330db62778e05",
|
||||||
|
"sha256:cbb8e769d4cac884bb28e3ff620ef1001b75588a5c83c9c9f1fdc9afbe7f29b0",
|
||||||
|
"sha256:d84c40bdb8674c29fa192373498b6cb1e84f882889d21a471b45d1f868d8d44b",
|
||||||
|
"sha256:db5597a4c7353b2e5fb05a8e6cb74b56a4658a2b7bf3cb6b1821ae7e7fd6eaa0",
|
||||||
|
"sha256:e22801b61613ebdebf7deb18b507919e107547a1d39a3b57f5f855032dd7cfb8",
|
||||||
|
"sha256:e34da95e29daf8a71cb2841fd55df0511539a6cdf33e6f77c1e95e44006b9b46",
|
||||||
|
"sha256:e46710a240a41d594953012213ea8ca398cd2448fbc5d0f1be8160b5511104a0",
|
||||||
|
"sha256:e94eb5fa32a8a9f9bf991f424f002913e3dd7c699ef552db9b14ba6a76a6313b",
|
||||||
|
"sha256:ec13b7105117dbc9afd023300fb9954d72ca855c274fe563e72428ece10191c0",
|
||||||
|
"sha256:ed570874e88f213437f5cf758f9ef26cbfc3f336d889b1e592ee11283bb8d1c7",
|
||||||
|
"sha256:ed957044e368ed295257ae3d212b95456bd9756df490e1ac4538857f67531fcc",
|
||||||
|
"sha256:ef648d2c690703501714588b2ba640facd50fd16548133b11b2859e8655a69da",
|
||||||
|
"sha256:efc9e51c3e595267ff84adf56e9b357db89ab2279d7e375ffcaf8f678606f3d9",
|
||||||
|
"sha256:f736ab8036796f5a119ff8211deda416f8c15ce03776db704a7a4e17381cb2ef",
|
||||||
|
"sha256:f7a24ea78de345cfa7f6a8d3bde8b242c7fac27f2bd78fa23474ca38dfaeeab9",
|
||||||
|
"sha256:f7de12fa0eee6234de9a9ce0ffcfa6ce97361db7a50b09b65c63ac58e5f22fc7",
|
||||||
|
"sha256:f9b55038b5c6c47559aa33626d8ecd092f354e23de3c6975e4bb205df128a2a0",
|
||||||
|
"sha256:fd4b5e2ee4e60425711ec65c33add4e7a626adef79d66f62ba0acfd493af282d"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.8' and python_full_version not in '3.9.0, 3.9.1'",
|
||||||
|
"version": "==46.0.1"
|
||||||
|
},
|
||||||
|
"distro": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:2fa77c6fd8940f116ee1d6b94a2f90b13b5ea8d019b98bc8bafdcabcdd9bdbed",
|
||||||
|
"sha256:7bffd925d65168f85027d8da9af6bddab658135b840670a223589bc0c8ef02b2"
|
||||||
],
|
],
|
||||||
"markers": "python_version >= '3.6'",
|
"markers": "python_version >= '3.6'",
|
||||||
"version": "==3.4.8"
|
"version": "==1.9.0"
|
||||||
|
},
|
||||||
|
"filelock": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:66eda1888b0171c998b35be2bcc0f6d75c388a7ce20c3f3f37aa8e96c2dddf58",
|
||||||
|
"sha256:d38e30481def20772f5baf097c122c3babc4fcdb7e14e57049eb9d88c6dc017d"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==3.19.1"
|
||||||
|
},
|
||||||
|
"importlib-metadata": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:d13b81ad223b890aa16c5471f2ac3056cf76c5f10f82d6f9292f0b415f389000",
|
||||||
|
"sha256:e5dd1551894c77868a30651cef00984d50e1002d06942a7101d34870c5f02afd"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==8.7.0"
|
||||||
},
|
},
|
||||||
"jinja2": {
|
"jinja2": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:1f06f2da51e7b56b8f238affdd6b4e2c61e39598a378cc49345bc1bd42a978a4",
|
"sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d",
|
||||||
"sha256:703f484b47a6af502e743c9122595cc812b0271f661722403114f71a79d0f5a4"
|
"sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67"
|
||||||
],
|
],
|
||||||
"markers": "python_version >= '3.6'",
|
"markers": "python_version >= '3.7'",
|
||||||
"version": "==3.0.1"
|
"version": "==3.1.6"
|
||||||
|
},
|
||||||
|
"jsonschema": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63",
|
||||||
|
"sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==4.25.1"
|
||||||
|
},
|
||||||
|
"jsonschema-specifications": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe",
|
||||||
|
"sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==2025.9.1"
|
||||||
},
|
},
|
||||||
"markupsafe": {
|
"markupsafe": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:01a9b8ea66f1658938f65b93a85ebe8bc016e6769611be228d797c9d998dd298",
|
"sha256:0bff5e0ae4ef2e1ae4fdf2dfd5b76c75e5c2fa4132d05fc1b0dabcd20c7e28c4",
|
||||||
"sha256:023cb26ec21ece8dc3907c0e8320058b2e0cb3c55cf9564da612bc325bed5e64",
|
"sha256:0f4ca02bea9a23221c0182836703cbf8930c5e9454bacce27e767509fa286a30",
|
||||||
"sha256:0446679737af14f45767963a1a9ef7620189912317d095f2d9ffa183a4d25d2b",
|
"sha256:1225beacc926f536dc82e45f8a4d68502949dc67eea90eab715dea3a21c1b5f0",
|
||||||
"sha256:0717a7390a68be14b8c793ba258e075c6f4ca819f15edfc2a3a027c823718567",
|
"sha256:131a3c7689c85f5ad20f9f6fb1b866f402c445b220c19fe4308c0b147ccd2ad9",
|
||||||
"sha256:0955295dd5eec6cb6cc2fe1698f4c6d84af2e92de33fbcac4111913cd100a6ff",
|
"sha256:15ab75ef81add55874e7ab7055e9c397312385bd9ced94920f2802310c930396",
|
||||||
"sha256:0d4b31cc67ab36e3392bbf3862cfbadac3db12bdd8b02a2731f509ed5b829724",
|
"sha256:1a9d3f5f0901fdec14d8d2f66ef7d035f2157240a433441719ac9a3fba440b13",
|
||||||
"sha256:10f82115e21dc0dfec9ab5c0223652f7197feb168c940f3ef61563fc2d6beb74",
|
"sha256:1c99d261bd2d5f6b59325c92c73df481e05e57f19837bdca8413b9eac4bd8028",
|
||||||
"sha256:168cd0a3642de83558a5153c8bd34f175a9a6e7f6dc6384b9655d2697312a646",
|
"sha256:1e084f686b92e5b83186b07e8a17fc09e38fff551f3602b249881fec658d3eca",
|
||||||
"sha256:1d609f577dc6e1aa17d746f8bd3c31aa4d258f4070d61b2aa5c4166c1539de35",
|
"sha256:2181e67807fc2fa785d0592dc2d6206c019b9502410671cc905d132a92866557",
|
||||||
"sha256:1f2ade76b9903f39aa442b4aadd2177decb66525062db244b35d71d0ee8599b6",
|
"sha256:2cb8438c3cbb25e220c2ab33bb226559e7afb3baec11c4f218ffa7308603c832",
|
||||||
"sha256:2a7d351cbd8cfeb19ca00de495e224dea7e7d919659c2841bbb7f420ad03e2d6",
|
"sha256:3169b1eefae027567d1ce6ee7cae382c57fe26e82775f460f0b2778beaad66c0",
|
||||||
"sha256:2d7d807855b419fc2ed3e631034685db6079889a1f01d5d9dac950f764da3dad",
|
"sha256:3809ede931876f5b2ec92eef964286840ed3540dadf803dd570c3b7e13141a3b",
|
||||||
"sha256:2ef54abee730b502252bcdf31b10dacb0a416229b72c18b19e24a4509f273d26",
|
"sha256:38a9ef736c01fccdd6600705b09dc574584b89bea478200c5fbf112a6b0d5579",
|
||||||
"sha256:36bc903cbb393720fad60fc28c10de6acf10dc6cc883f3e24ee4012371399a38",
|
"sha256:3d79d162e7be8f996986c064d1c7c817f6df3a77fe3d6859f6f9e7be4b8c213a",
|
||||||
"sha256:37205cac2a79194e3750b0af2a5720d95f786a55ce7df90c3af697bfa100eaac",
|
"sha256:444dcda765c8a838eaae23112db52f1efaf750daddb2d9ca300bcae1039adc5c",
|
||||||
"sha256:3c112550557578c26af18a1ccc9e090bfe03832ae994343cfdacd287db6a6ae7",
|
"sha256:48032821bbdf20f5799ff537c7ac3d1fba0ba032cfc06194faffa8cda8b560ff",
|
||||||
"sha256:3dd007d54ee88b46be476e293f48c85048603f5f516008bee124ddd891398ed6",
|
"sha256:4aa4e5faecf353ed117801a068ebab7b7e09ffb6e1d5e412dc852e0da018126c",
|
||||||
"sha256:47ab1e7b91c098ab893b828deafa1203de86d0bc6ab587b160f78fe6c4011f75",
|
"sha256:52305740fe773d09cffb16f8ed0427942901f00adedac82ec8b67752f58a1b22",
|
||||||
"sha256:49e3ceeabbfb9d66c3aef5af3a60cc43b85c33df25ce03d0031a608b0a8b2e3f",
|
"sha256:569511d3b58c8791ab4c2e1285575265991e6d8f8700c7be0e88f86cb0672094",
|
||||||
"sha256:4efca8f86c54b22348a5467704e3fec767b2db12fc39c6d963168ab1d3fc9135",
|
"sha256:57cb5a3cf367aeb1d316576250f65edec5bb3be939e9247ae594b4bcbc317dfb",
|
||||||
"sha256:53edb4da6925ad13c07b6d26c2a852bd81e364f95301c66e930ab2aef5b5ddd8",
|
"sha256:5b02fb34468b6aaa40dfc198d813a641e3a63b98c2b05a16b9f80b7ec314185e",
|
||||||
"sha256:5855f8438a7d1d458206a2466bf82b0f104a3724bf96a1c781ab731e4201731a",
|
"sha256:6381026f158fdb7c72a168278597a5e3a5222e83ea18f543112b2662a9b699c5",
|
||||||
"sha256:594c67807fb16238b30c44bdf74f36c02cdf22d1c8cda91ef8a0ed8dabf5620a",
|
"sha256:6af100e168aa82a50e186c82875a5893c5597a0c1ccdb0d8b40240b1f28b969a",
|
||||||
"sha256:5bb28c636d87e840583ee3adeb78172efc47c8b26127267f54a9c0ec251d41a9",
|
"sha256:6c89876f41da747c8d3677a2b540fb32ef5715f97b66eeb0c6b66f5e3ef6f59d",
|
||||||
"sha256:60bf42e36abfaf9aff1f50f52644b336d4f0a3fd6d8a60ca0d054ac9f713a864",
|
"sha256:6e296a513ca3d94054c2c881cc913116e90fd030ad1c656b3869762b754f5f8a",
|
||||||
"sha256:611d1ad9a4288cf3e3c16014564df047fe08410e628f89805e475368bd304914",
|
"sha256:70a87b411535ccad5ef2f1df5136506a10775d267e197e4cf531ced10537bd6b",
|
||||||
"sha256:6557b31b5e2c9ddf0de32a691f2312a32f77cd7681d8af66c2692efdbef84c18",
|
"sha256:7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8",
|
||||||
"sha256:693ce3f9e70a6cf7d2fb9e6c9d8b204b6b39897a2c4a1aa65728d5ac97dcc1d8",
|
"sha256:846ade7b71e3536c4e56b386c2a47adf5741d2d8b94ec9dc3e92e5e1ee1e2225",
|
||||||
"sha256:6a7fae0dd14cf60ad5ff42baa2e95727c3d81ded453457771d02b7d2b3f9c0c2",
|
"sha256:88416bd1e65dcea10bc7569faacb2c20ce071dd1f87539ca2ab364bf6231393c",
|
||||||
"sha256:6c4ca60fa24e85fe25b912b01e62cb969d69a23a5d5867682dd3e80b5b02581d",
|
"sha256:88b49a3b9ff31e19998750c38e030fc7bb937398b1f78cfa599aaef92d693144",
|
||||||
"sha256:6fcf051089389abe060c9cd7caa212c707e58153afa2c649f00346ce6d260f1b",
|
"sha256:8c4e8c3ce11e1f92f6536ff07154f9d49677ebaaafc32db9db4620bc11ed480f",
|
||||||
"sha256:7d91275b0245b1da4d4cfa07e0faedd5b0812efc15b702576d103293e252af1b",
|
"sha256:8e06879fc22a25ca47312fbe7c8264eb0b662f6db27cb2d3bbbc74b1df4b9b87",
|
||||||
"sha256:905fec760bd2fa1388bb5b489ee8ee5f7291d692638ea5f67982d968366bef9f",
|
"sha256:9025b4018f3a1314059769c7bf15441064b2207cb3f065e6ea1e7359cb46db9d",
|
||||||
"sha256:97383d78eb34da7e1fa37dd273c20ad4320929af65d156e35a5e2d89566d9dfb",
|
"sha256:93335ca3812df2f366e80509ae119189886b0f3c2b81325d39efdb84a1e2ae93",
|
||||||
"sha256:984d76483eb32f1bcb536dc27e4ad56bba4baa70be32fa87152832cdd9db0833",
|
"sha256:9778bd8ab0a994ebf6f84c2b949e65736d5575320a17ae8984a77fab08db94cf",
|
||||||
"sha256:99df47edb6bda1249d3e80fdabb1dab8c08ef3975f69aed437cb69d0a5de1e28",
|
"sha256:9e2d922824181480953426608b81967de705c3cef4d1af983af849d7bd619158",
|
||||||
"sha256:a30e67a65b53ea0a5e62fe23682cfe22712e01f453b95233b25502f7c61cb415",
|
"sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84",
|
||||||
"sha256:ab3ef638ace319fa26553db0624c4699e31a28bb2a835c5faca8f8acf6a5a902",
|
"sha256:a904af0a6162c73e3edcb969eeeb53a63ceeb5d8cf642fade7d39e7963a22ddb",
|
||||||
"sha256:add36cb2dbb8b736611303cd3bfcee00afd96471b09cda130da3581cbdc56a6d",
|
"sha256:ad10d3ded218f1039f11a75f8091880239651b52e9bb592ca27de44eed242a48",
|
||||||
"sha256:b2f4bf27480f5e5e8ce285a8c8fd176c0b03e93dcc6646477d4630e83440c6a9",
|
"sha256:b424c77b206d63d500bcb69fa55ed8d0e6a3774056bdc4839fc9298a7edca171",
|
||||||
"sha256:b7f2d075102dc8c794cbde1947378051c4e5180d52d276987b8d28a3bd58c17d",
|
"sha256:b5a6b3ada725cea8a5e634536b1b01c30bcdcd7f9c6fff4151548d5bf6b3a36c",
|
||||||
"sha256:baa1a4e8f868845af802979fcdbf0bb11f94f1cb7ced4c4b8a351bb60d108145",
|
"sha256:ba8062ed2cf21c07a9e295d5b8a2a5ce678b913b45fdf68c32d95d6c1291e0b6",
|
||||||
"sha256:be98f628055368795d818ebf93da628541e10b75b41c559fdf36d104c5787066",
|
"sha256:ba9527cdd4c926ed0760bc301f6728ef34d841f405abf9d4f959c478421e4efd",
|
||||||
"sha256:bf5d821ffabf0ef3533c39c518f3357b171a1651c1ff6827325e4489b0e46c3c",
|
"sha256:bbcb445fa71794da8f178f0f6d66789a28d7319071af7a496d4d507ed566270d",
|
||||||
"sha256:c47adbc92fc1bb2b3274c4b3a43ae0e4573d9fbff4f54cd484555edbf030baf1",
|
"sha256:bcf3e58998965654fdaff38e58584d8937aa3096ab5354d493c77d1fdd66d7a1",
|
||||||
"sha256:d7f9850398e85aba693bb640262d3611788b1f29a79f0c93c565694658f4071f",
|
"sha256:c0ef13eaeee5b615fb07c9a7dadb38eac06a0608b41570d8ade51c56539e509d",
|
||||||
"sha256:d8446c54dc28c01e5a2dbac5a25f071f6653e6e40f3a8818e8b45d790fe6ef53",
|
"sha256:cabc348d87e913db6ab4aa100f01b08f481097838bdddf7c7a84b7575b7309ca",
|
||||||
"sha256:e0f138900af21926a02425cf736db95be9f4af72ba1bb21453432a07f6082134",
|
"sha256:cdb82a876c47801bb54a690c5ae105a46b392ac6099881cdfb9f6e95e4014c6a",
|
||||||
"sha256:e9936f0b261d4df76ad22f8fee3ae83b60d7c3e871292cd42f40b81b70afae85",
|
"sha256:cfad01eed2c2e0c01fd0ecd2ef42c492f7f93902e39a42fc9ee1692961443a29",
|
||||||
"sha256:f5653a225f31e113b152e56f154ccbe59eeb1c7487b39b9d9f9cdb58e6c79dc5",
|
"sha256:d16a81a06776313e817c951135cf7340a3e91e8c1ff2fac444cfd75fffa04afe",
|
||||||
"sha256:f826e31d18b516f653fe296d967d700fddad5901ae07c622bb3705955e1faa94",
|
"sha256:d8213e09c917a951de9d09ecee036d5c7d36cb6cb7dbaece4c71a60d79fb9798",
|
||||||
"sha256:f8ba0e8349a38d3001fae7eadded3f6606f0da5d748ee53cc1dab1d6527b9509",
|
"sha256:e07c3764494e3776c602c1e78e298937c3315ccc9043ead7e685b7f2b8d47b3c",
|
||||||
"sha256:f9081981fe268bd86831e5c75f7de206ef275defcb82bc70740ae6dc507aee51",
|
"sha256:e17c96c14e19278594aa4841ec148115f9c7615a47382ecb6b82bd8fea3ab0c8",
|
||||||
"sha256:fa130dd50c57d53368c9d59395cb5526eda596d3ffe36666cd81a44d56e48872"
|
"sha256:e444a31f8db13eb18ada366ab3cf45fd4b31e4db1236a4448f68778c1d1a5a2f",
|
||||||
|
"sha256:e6a2a455bd412959b57a172ce6328d2dd1f01cb2135efda2e4576e8a23fa3b0f",
|
||||||
|
"sha256:eaa0a10b7f72326f1372a713e73c3f739b524b3af41feb43e4921cb529f5929a",
|
||||||
|
"sha256:eb7972a85c54febfb25b5c4b4f3af4dcc731994c7da0d8a0b4a6eb0640e1d178",
|
||||||
|
"sha256:ee55d3edf80167e48ea11a923c7386f4669df67d7994554387f84e7d8b0a2bf0",
|
||||||
|
"sha256:f3818cb119498c0678015754eba762e0d61e5b52d34c8b13d770f0719f7b1d79",
|
||||||
|
"sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430",
|
||||||
|
"sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50"
|
||||||
],
|
],
|
||||||
"markers": "python_version >= '3.6'",
|
"markers": "python_version >= '3.9'",
|
||||||
"version": "==2.0.1"
|
"version": "==3.0.2"
|
||||||
|
},
|
||||||
|
"mypy-extensions": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:1be4cccdb0f2482337c4743e60421de3a356cd97508abadd57d47403e94f5505",
|
||||||
|
"sha256:52e68efc3284861e772bbcd66823fde5ae21fd2fdb51c62a211403730b916558"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.8'",
|
||||||
|
"version": "==1.1.0"
|
||||||
},
|
},
|
||||||
"packaging": {
|
"packaging": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:7dc96269f53a4ccec5c0670940a4281106dd0bb343f47b7471f779df49c2fbe7",
|
"sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484",
|
||||||
"sha256:c86254f9220d55e31cc94d69bade760f0847da8000def4dfe1c6b872fd14ff14"
|
"sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f"
|
||||||
],
|
],
|
||||||
"markers": "python_version >= '3.6'",
|
"markers": "python_version >= '3.8'",
|
||||||
"version": "==21.0"
|
"version": "==25.0"
|
||||||
|
},
|
||||||
|
"pathspec": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:a0d503e138a4c123b27490a4f7beda6a01c6f288df0e4a8b79c7eb0dc7b4cc08",
|
||||||
|
"sha256:a482d51503a1ab33b1c67a6c3813a26953dbdc71c31dacaef9a838c4e29f5712"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.8'",
|
||||||
|
"version": "==0.12.1"
|
||||||
|
},
|
||||||
|
"platformdirs": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:abd01743f24e5287cd7a5db3752faf1a2d65353f38ec26d98e25a6db65958c85",
|
||||||
|
"sha256:ca753cf4d81dc309bc67b0ea38fd15dc97bc30ce419a7f58d13eb3bf14c4febf"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==4.4.0"
|
||||||
},
|
},
|
||||||
"pycparser": {
|
"pycparser": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:2d475327684562c3a96cc71adf7dc8c4f0565175cf86b6d7a404ff4c771f15f0",
|
"sha256:78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2",
|
||||||
"sha256:7582ad22678f0fcd81102833f60ef8d0e57288b6b5fb00323d101be910e35705"
|
"sha256:e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934"
|
||||||
],
|
],
|
||||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
|
"markers": "python_version >= '3.8'",
|
||||||
"version": "==2.20"
|
"version": "==2.23"
|
||||||
},
|
},
|
||||||
"pyparsing": {
|
"pytokens": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1",
|
"sha256:c9a4bfa0be1d26aebce03e6884ba454e842f186a59ea43a6d3b25af58223c044",
|
||||||
"sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b"
|
"sha256:db7b72284e480e69fb085d9f251f66b3d2df8b7166059261258ff35f50fb711b"
|
||||||
],
|
],
|
||||||
"markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
|
"markers": "python_version >= '3.8'",
|
||||||
"version": "==2.4.7"
|
"version": "==0.1.10"
|
||||||
},
|
},
|
||||||
"pyyaml": {
|
"pyyaml": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:08682f6b72c722394747bddaf0aa62277e02557c0fd1c42cb853016a38f8dedf",
|
"sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff",
|
||||||
"sha256:0f5f5786c0e09baddcd8b4b45f20a7b5d61a7e7e99846e3c799b05c7c53fa696",
|
"sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48",
|
||||||
"sha256:129def1b7c1bf22faffd67b8f3724645203b79d8f4cc81f674654d9902cb4393",
|
"sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086",
|
||||||
"sha256:294db365efa064d00b8d1ef65d8ea2c3426ac366c0c4368d930bf1c5fb497f77",
|
"sha256:0b69e4ce7a131fe56b7e4d770c67429700908fc0752af059838b1cfb41960e4e",
|
||||||
"sha256:3b2b1824fe7112845700f815ff6a489360226a5609b96ec2190a45e62a9fc922",
|
"sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133",
|
||||||
"sha256:3bd0e463264cf257d1ffd2e40223b197271046d09dadf73a0fe82b9c1fc385a5",
|
"sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5",
|
||||||
"sha256:4465124ef1b18d9ace298060f4eccc64b0850899ac4ac53294547536533800c8",
|
"sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484",
|
||||||
"sha256:49d4cdd9065b9b6e206d0595fee27a96b5dd22618e7520c33204a4a3239d5b10",
|
"sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee",
|
||||||
"sha256:4e0583d24c881e14342eaf4ec5fbc97f934b999a6828693a99157fde912540cc",
|
"sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5",
|
||||||
"sha256:5accb17103e43963b80e6f837831f38d314a0495500067cb25afab2e8d7a4018",
|
"sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68",
|
||||||
"sha256:607774cbba28732bfa802b54baa7484215f530991055bb562efbed5b2f20a45e",
|
"sha256:24471b829b3bf607e04e88d79542a9d48bb037c2267d7927a874e6c205ca7e9a",
|
||||||
"sha256:6c78645d400265a062508ae399b60b8c167bf003db364ecb26dcab2bda048253",
|
"sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf",
|
||||||
"sha256:72a01f726a9c7851ca9bfad6fd09ca4e090a023c00945ea05ba1638c09dc3347",
|
"sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99",
|
||||||
"sha256:74c1485f7707cf707a7aef42ef6322b8f97921bd89be2ab6317fd782c2d53183",
|
"sha256:39693e1f8320ae4f43943590b49779ffb98acb81f788220ea932a6b6c51004d8",
|
||||||
"sha256:895f61ef02e8fed38159bb70f7e100e00f471eae2bc838cd0f4ebb21e28f8541",
|
"sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85",
|
||||||
"sha256:8c1be557ee92a20f184922c7b6424e8ab6691788e6d86137c5d93c1a6ec1b8fb",
|
"sha256:3b1fdb9dc17f5a7677423d508ab4f243a726dea51fa5e70992e59a7411c89d19",
|
||||||
"sha256:bb4191dfc9306777bc594117aee052446b3fa88737cd13b7188d0e7aa8162185",
|
"sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc",
|
||||||
"sha256:bfb51918d4ff3d77c1c856a9699f8492c612cde32fd3bcd344af9be34999bfdc",
|
"sha256:43fa96a3ca0d6b1812e01ced1044a003533c47f6ee8aca31724f78e93ccc089a",
|
||||||
"sha256:c20cfa2d49991c8b4147af39859b167664f2ad4561704ee74c1de03318e898db",
|
"sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1",
|
||||||
"sha256:cb333c16912324fd5f769fff6bc5de372e9e7a202247b48870bc251ed40239aa",
|
"sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317",
|
||||||
"sha256:d2d9808ea7b4af864f35ea216be506ecec180628aced0704e34aca0b040ffe46",
|
"sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c",
|
||||||
"sha256:d483ad4e639292c90170eb6f7783ad19490e7a8defb3e46f97dfe4bacae89122",
|
"sha256:6395c297d42274772abc367baaa79683958044e5d3835486c16da75d2a694631",
|
||||||
"sha256:dd5de0646207f053eb0d6c74ae45ba98c3395a571a2891858e87df7c9b9bd51b",
|
"sha256:688ba32a1cffef67fd2e9398a2efebaea461578b0923624778664cc1c914db5d",
|
||||||
"sha256:e1d4970ea66be07ae37a3c2e48b5ec63f7ba6804bdddfdbd3cfd954d25a82e63",
|
"sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652",
|
||||||
"sha256:e4fac90784481d221a8e4b1162afa7c47ed953be40d31ab4629ae917510051df",
|
"sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5",
|
||||||
"sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc",
|
"sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e",
|
||||||
"sha256:fd7f6999a8070df521b6384004ef42833b9bd62cfee11a09bda1079b4b704247",
|
"sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b",
|
||||||
"sha256:fdc842473cd33f45ff6bce46aea678a54e3d21f1b61a7750ce3c498eedfe25d6",
|
"sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8",
|
||||||
"sha256:fe69978f3f768926cfa37b867e3843918e012cf83f680806599ddce33c2c68b0"
|
"sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476",
|
||||||
|
"sha256:82d09873e40955485746739bcb8b4586983670466c23382c19cffecbf1fd8706",
|
||||||
|
"sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563",
|
||||||
|
"sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237",
|
||||||
|
"sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b",
|
||||||
|
"sha256:9056c1ecd25795207ad294bcf39f2db3d845767be0ea6e6a34d856f006006083",
|
||||||
|
"sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180",
|
||||||
|
"sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425",
|
||||||
|
"sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e",
|
||||||
|
"sha256:a8786accb172bd8afb8be14490a16625cbc387036876ab6ba70912730faf8e1f",
|
||||||
|
"sha256:a9f8c2e67970f13b16084e04f134610fd1d374bf477b17ec1599185cf611d725",
|
||||||
|
"sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183",
|
||||||
|
"sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab",
|
||||||
|
"sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774",
|
||||||
|
"sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725",
|
||||||
|
"sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e",
|
||||||
|
"sha256:d7fded462629cfa4b685c5416b949ebad6cec74af5e2d42905d41e257e0869f5",
|
||||||
|
"sha256:d84a1718ee396f54f3a086ea0a66d8e552b2ab2017ef8b420e92edbc841c352d",
|
||||||
|
"sha256:d8e03406cac8513435335dbab54c0d385e4a49e4945d2909a581c83647ca0290",
|
||||||
|
"sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44",
|
||||||
|
"sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed",
|
||||||
|
"sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4",
|
||||||
|
"sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba",
|
||||||
|
"sha256:f753120cb8181e736c57ef7636e83f31b9c0d1722c516f7e86cf15b7aa57ff12",
|
||||||
|
"sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4"
|
||||||
],
|
],
|
||||||
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
|
"markers": "python_version >= '3.8'",
|
||||||
"version": "==5.4.1"
|
"version": "==6.0.2"
|
||||||
|
},
|
||||||
|
"referencing": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:df2e89862cd09deabbdba16944cc3f10feb6b3e6f18e902f7cc25609a34775aa",
|
||||||
|
"sha256:e8699adbbf8b5c7de96d8ffa0eb5c158b3beafce084968e2ea8bb08c6794dcd0"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==0.36.2"
|
||||||
},
|
},
|
||||||
"resolvelib": {
|
"resolvelib": {
|
||||||
"hashes": [
|
"hashes": [
|
||||||
"sha256:8113ae3ed6d33c6be0bcbf03ffeb06c0995c099b7b8aaa5ddf2e9b3b3df4e915",
|
"sha256:8e3e2000beaf53fdfd8772fda1a7b1df97e803ab7c8925621bbb87c4d187a94d",
|
||||||
"sha256:9b9b80d5c60e4c2a8b7fbf0712c3449dc01d74e215632e5199850c9eca687628"
|
"sha256:c27fbb5098acd7dfc01fb2be3724bd0881168edc2bd3b4dc876ca3f46b8e4a3d"
|
||||||
],
|
],
|
||||||
"version": "==0.5.4"
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==1.2.0"
|
||||||
|
},
|
||||||
|
"rpds-py": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:008b839781d6c9bf3b6a8984d1d8e56f0ec46dc56df61fd669c49b58ae800400",
|
||||||
|
"sha256:037a2361db72ee98d829bc2c5b7cc55598ae0a5e0ec1823a56ea99374cfd73c1",
|
||||||
|
"sha256:079bc583a26db831a985c5257797b2b5d3affb0386e7ff886256762f82113b5e",
|
||||||
|
"sha256:08f1e20bccf73b08d12d804d6e1c22ca5530e71659e6673bce31a6bb71c1e73f",
|
||||||
|
"sha256:0b08d152555acf1f455154d498ca855618c1378ec810646fcd7c76416ac6dc60",
|
||||||
|
"sha256:0d807710df3b5faa66c731afa162ea29717ab3be17bdc15f90f2d9f183da4059",
|
||||||
|
"sha256:0dc5dceeaefcc96dc192e3a80bbe1d6c410c469e97bdd47494a7d930987f18b2",
|
||||||
|
"sha256:12ed005216a51b1d6e2b02a7bd31885fe317e45897de81d86dcce7d74618ffff",
|
||||||
|
"sha256:134fae0e36022edad8290a6661edf40c023562964efea0cc0ec7f5d392d2aaef",
|
||||||
|
"sha256:13e608ac9f50a0ed4faec0e90ece76ae33b34c0e8656e3dceb9a7db994c692cd",
|
||||||
|
"sha256:1441811a96eadca93c517d08df75de45e5ffe68aa3089924f963c782c4b898cf",
|
||||||
|
"sha256:15d3b4d83582d10c601f481eca29c3f138d44c92187d197aff663a269197c02d",
|
||||||
|
"sha256:16323f674c089b0360674a4abd28d5042947d54ba620f72514d69be4ff64845e",
|
||||||
|
"sha256:168b025f8fd8d8d10957405f3fdcef3dc20f5982d398f90851f4abc58c566c52",
|
||||||
|
"sha256:1b207d881a9aef7ba753d69c123a35d96ca7cb808056998f6b9e8747321f03b8",
|
||||||
|
"sha256:1fea2b1a922c47c51fd07d656324531adc787e415c8b116530a1d29c0516c62d",
|
||||||
|
"sha256:23f6b69d1c26c4704fec01311963a41d7de3ee0570a84ebde4d544e5a1859ffc",
|
||||||
|
"sha256:2643400120f55c8a96f7c9d858f7be0c88d383cd4653ae2cf0d0c88f668073e5",
|
||||||
|
"sha256:26a1c73171d10b7acccbded82bf6a586ab8203601e565badc74bbbf8bc5a10f8",
|
||||||
|
"sha256:2bde09cbcf2248b73c7c323be49b280180ff39fadcfe04e7b6f54a678d02a7cf",
|
||||||
|
"sha256:2c426b99a068601b5f4623573df7a7c3d72e87533a2dd2253353a03e7502566c",
|
||||||
|
"sha256:2efe4eb1d01b7f5f1939f4ef30ecea6c6b3521eec451fb93191bf84b2a522418",
|
||||||
|
"sha256:2f57af9b4d0793e53266ee4325535a31ba48e2f875da81a9177c9926dfa60746",
|
||||||
|
"sha256:2fd50659a069c15eef8aa3d64bbef0d69fd27bb4a50c9ab4f17f83a16cbf8905",
|
||||||
|
"sha256:3020724ade63fe320a972e2ffd93b5623227e684315adce194941167fee02688",
|
||||||
|
"sha256:3182af66048c00a075010bc7f4860f33913528a4b6fc09094a6e7598e462fe39",
|
||||||
|
"sha256:31d3ebadefcd73b73928ed0b2fd696f7fefda8629229f81929ac9c1854d0cffb",
|
||||||
|
"sha256:33aa65b97826a0e885ef6e278fbd934e98cdcfed80b63946025f01e2f5b29502",
|
||||||
|
"sha256:387ce8c44ae94e0ec50532d9cb0edce17311024c9794eb196b90e1058aadeb66",
|
||||||
|
"sha256:3adc388fc3afb6540aec081fa59e6e0d3908722771aa1e37ffe22b220a436f0b",
|
||||||
|
"sha256:3c64d07e95606ec402a0a1c511fe003873fa6af630bda59bac77fac8b4318ebc",
|
||||||
|
"sha256:3ce0cac322b0d69b63c9cdb895ee1b65805ec9ffad37639f291dd79467bee675",
|
||||||
|
"sha256:3d905d16f77eb6ab2e324e09bfa277b4c8e5e6b8a78a3e7ff8f3cdf773b4c013",
|
||||||
|
"sha256:3deab27804d65cd8289eb814c2c0e807c4b9d9916c9225e363cb0cf875eb67c1",
|
||||||
|
"sha256:3e039aabf6d5f83c745d5f9a0a381d031e9ed871967c0a5c38d201aca41f3ba1",
|
||||||
|
"sha256:41e532bbdcb57c92ba3be62c42e9f096431b4cf478da9bc3bc6ce5c38ab7ba7a",
|
||||||
|
"sha256:42a89282d711711d0a62d6f57d81aa43a1368686c45bc1c46b7f079d55692734",
|
||||||
|
"sha256:466bfe65bd932da36ff279ddd92de56b042f2266d752719beb97b08526268ec5",
|
||||||
|
"sha256:4708c5c0ceb2d034f9991623631d3d23cb16e65c83736ea020cdbe28d57c0a0e",
|
||||||
|
"sha256:47162fdab9407ec3f160805ac3e154df042e577dd53341745fc7fb3f625e6d92",
|
||||||
|
"sha256:4848ca84d6ded9b58e474dfdbad4b8bfb450344c0551ddc8d958bf4b36aa837c",
|
||||||
|
"sha256:4b507d19f817ebaca79574b16eb2ae412e5c0835542c93fe9983f1e432aca195",
|
||||||
|
"sha256:4e44099bd522cba71a2c6b97f68e19f40e7d85399de899d66cdb67b32d7cb786",
|
||||||
|
"sha256:4ed2e16abbc982a169d30d1a420274a709949e2cbdef119fe2ec9d870b42f274",
|
||||||
|
"sha256:4f75e4bd8ab8db624e02c8e2fc4063021b58becdbe6df793a8111d9343aec1e3",
|
||||||
|
"sha256:4fc9b7fe29478824361ead6e14e4f5aed570d477e06088826537e202d25fe859",
|
||||||
|
"sha256:50c946f048209e6362e22576baea09193809f87687a95a8db24e5fbdb307b93a",
|
||||||
|
"sha256:5281ed1cc1d49882f9997981c88df1a22e140ab41df19071222f7e5fc4e72125",
|
||||||
|
"sha256:530064db9146b247351f2a0250b8f00b289accea4596a033e94be2389977de71",
|
||||||
|
"sha256:55266dafa22e672f5a4f65019015f90336ed31c6383bd53f5e7826d21a0e0b83",
|
||||||
|
"sha256:5b640501be9288c77738b5492b3fd3abc4ba95c50c2e41273c8a1459f08298d3",
|
||||||
|
"sha256:62ac3d4e3e07b58ee0ddecd71d6ce3b1637de2d373501412df395a0ec5f9beb5",
|
||||||
|
"sha256:62f85b665cedab1a503747617393573995dac4600ff51869d69ad2f39eb5e817",
|
||||||
|
"sha256:639fd5efec029f99b79ae47e5d7e00ad8a773da899b6309f6786ecaf22948c48",
|
||||||
|
"sha256:6567d2bb951e21232c2f660c24cf3470bb96de56cdcb3f071a83feeaff8a2772",
|
||||||
|
"sha256:67ce7620704745881a3d4b0ada80ab4d99df390838839921f99e63c474f82cf2",
|
||||||
|
"sha256:689fb5200a749db0415b092972e8eba85847c23885c8543a8b0f5c009b1a5948",
|
||||||
|
"sha256:68afeec26d42ab3b47e541b272166a0b4400313946871cba3ed3a4fc0cab1cef",
|
||||||
|
"sha256:6e5e54da1e74b91dbc7996b56640f79b195d5925c2b78efaa8c5d53e1d88edde",
|
||||||
|
"sha256:6f4461bf931108c9fa226ffb0e257c1b18dc2d44cd72b125bec50ee0ab1248a9",
|
||||||
|
"sha256:6f5b7bd8e219ed50299e58551a410b64daafb5017d54bbe822e003856f06a802",
|
||||||
|
"sha256:70d0738ef8fee13c003b100c2fbd667ec4f133468109b3472d249231108283a3",
|
||||||
|
"sha256:71108900c9c3c8590697244b9519017a400d9ba26a36c48381b3f64743a44aab",
|
||||||
|
"sha256:74e5b2f7bb6fa38b1b10546d27acbacf2a022a8b5543efb06cfebc72a59c85be",
|
||||||
|
"sha256:78af06ddc7fe5cc0e967085a9115accee665fb912c22a3f54bad70cc65b05fe6",
|
||||||
|
"sha256:7b002cab05d6339716b03a4a3a2ce26737f6231d7b523f339fa061d53368c9d8",
|
||||||
|
"sha256:7b90b0496570bd6b0321724a330d8b545827c4df2034b6ddfc5f5275f55da2ad",
|
||||||
|
"sha256:7ba22cb9693df986033b91ae1d7a979bc399237d45fccf875b76f62bb9e52ddf",
|
||||||
|
"sha256:7ba32c16b064267b22f1850a34051121d423b6f7338a12b9459550eb2096e7ec",
|
||||||
|
"sha256:7e32721e5d4922deaaf963469d795d5bde6093207c52fec719bd22e5d1bedbc4",
|
||||||
|
"sha256:7ee6521b9baf06085f62ba9c7a3e5becffbc32480d2f1b351559c001c38ce4c1",
|
||||||
|
"sha256:80c60cfb5310677bd67cb1e85a1e8eb52e12529545441b43e6f14d90b878775a",
|
||||||
|
"sha256:8177002868d1426305bb5de1e138161c2ec9eb2d939be38291d7c431c4712df8",
|
||||||
|
"sha256:819064fa048ba01b6dadc5116f3ac48610435ac9a0058bbde98e569f9e785c39",
|
||||||
|
"sha256:84f7d509870098de0e864cad0102711c1e24e9b1a50ee713b65928adb22269e4",
|
||||||
|
"sha256:879b0e14a2da6a1102a3fc8af580fc1ead37e6d6692a781bd8c83da37429b5ab",
|
||||||
|
"sha256:8a3f29aba6e2d7d90528d3c792555a93497fe6538aa65eb675b44505be747808",
|
||||||
|
"sha256:8a63b640a7845f2bdd232eb0d0a4a2dd939bcdd6c57e6bb134526487f3160ec5",
|
||||||
|
"sha256:8b61097f7488de4be8244c89915da8ed212832ccf1e7c7753a25a394bf9b1f10",
|
||||||
|
"sha256:8ee50c3e41739886606388ba3ab3ee2aae9f35fb23f833091833255a31740797",
|
||||||
|
"sha256:8fabb8fd848a5f75a2324e4a84501ee3a5e3c78d8603f83475441866e60b94a3",
|
||||||
|
"sha256:9024de74731df54546fab0bfbcdb49fae19159ecaecfc8f37c18d2c7e2c0bd61",
|
||||||
|
"sha256:92022bbbad0d4426e616815b16bc4127f83c9a74940e1ccf3cfe0b387aba0228",
|
||||||
|
"sha256:93a2ed40de81bcff59aabebb626562d48332f3d028ca2036f1d23cbb52750be4",
|
||||||
|
"sha256:94c44ee01fd21c9058f124d2d4f0c9dc7634bec93cd4b38eefc385dabe71acbf",
|
||||||
|
"sha256:9a1f4814b65eacac94a00fc9a526e3fdafd78e439469644032032d0d63de4881",
|
||||||
|
"sha256:9d992ac10eb86d9b6f369647b6a3f412fc0075cfd5d799530e84d335e440a002",
|
||||||
|
"sha256:9e71f5a087ead99563c11fdaceee83ee982fd39cf67601f4fd66cb386336ee52",
|
||||||
|
"sha256:a205fdfe55c90c2cd8e540ca9ceba65cbe6629b443bc05db1f590a3db8189ff9",
|
||||||
|
"sha256:a46fdec0083a26415f11d5f236b79fa1291c32aaa4a17684d82f7017a1f818b1",
|
||||||
|
"sha256:a50431bf02583e21bf273c71b89d710e7a710ad5e39c725b14e685610555926f",
|
||||||
|
"sha256:a512c8263249a9d68cac08b05dd59d2b3f2061d99b322813cbcc14c3c7421998",
|
||||||
|
"sha256:a55b9132bb1ade6c734ddd2759c8dc132aa63687d259e725221f106b83a0e485",
|
||||||
|
"sha256:a6e57b0abfe7cc513450fcf529eb486b6e4d3f8aee83e92eb5f1ef848218d456",
|
||||||
|
"sha256:a75f305c9b013289121ec0f1181931975df78738cdf650093e6b86d74aa7d8dd",
|
||||||
|
"sha256:a9e960fc78fecd1100539f14132425e1d5fe44ecb9239f8f27f079962021523e",
|
||||||
|
"sha256:aa8933159edc50be265ed22b401125c9eebff3171f570258854dbce3ecd55475",
|
||||||
|
"sha256:aaf94f812c95b5e60ebaf8bfb1898a7d7cb9c1af5744d4a67fa47796e0465d4e",
|
||||||
|
"sha256:abfa1171a9952d2e0002aba2ad3780820b00cc3d9c98c6630f2e93271501f66c",
|
||||||
|
"sha256:acb9aafccaae278f449d9c713b64a9e68662e7799dbd5859e2c6b3c67b56d334",
|
||||||
|
"sha256:ae2775c1973e3c30316892737b91f9283f9908e3cc7625b9331271eaaed7dc90",
|
||||||
|
"sha256:ae92443798a40a92dc5f0b01d8a7c93adde0c4dc965310a29ae7c64d72b9fad2",
|
||||||
|
"sha256:b2e7f8f169d775dd9092a1743768d771f1d1300453ddfe6325ae3ab5332b4657",
|
||||||
|
"sha256:b4938466c6b257b2f5c4ff98acd8128ec36b5059e5c8f8372d79316b1c36bb15",
|
||||||
|
"sha256:b6dfb0e058adb12d8b1d1b25f686e94ffa65d9995a5157afe99743bf7369d62b",
|
||||||
|
"sha256:b7fb801aa7f845ddf601c49630deeeccde7ce10065561d92729bfe81bd21fb33",
|
||||||
|
"sha256:ba81d2b56b6d4911ce735aad0a1d4495e808b8ee4dc58715998741a26874e7c2",
|
||||||
|
"sha256:bbf94c58e8e0cd6b6f38d8de67acae41b3a515c26169366ab58bdca4a6883bb8",
|
||||||
|
"sha256:be898f271f851f68b318872ce6ebebbc62f303b654e43bf72683dbdc25b7c881",
|
||||||
|
"sha256:bf876e79763eecf3e7356f157540d6a093cef395b65514f17a356f62af6cc136",
|
||||||
|
"sha256:c1476d6f29eb81aa4151c9a31219b03f1f798dc43d8af1250a870735516a1212",
|
||||||
|
"sha256:c2a8fed130ce946d5c585eddc7c8eeef0051f58ac80a8ee43bd17835c144c2cc",
|
||||||
|
"sha256:c46c9dd2403b66a2a3b9720ec4b74d4ab49d4fabf9f03dfdce2d42af913fe8d0",
|
||||||
|
"sha256:c4b676c4ae3921649a15d28ed10025548e9b561ded473aa413af749503c6737e",
|
||||||
|
"sha256:c796c0c1cc68cb08b0284db4229f5af76168172670c74908fdbd4b7d7f515819",
|
||||||
|
"sha256:c918c65ec2e42c2a78d19f18c553d77319119bf43aa9e2edf7fb78d624355527",
|
||||||
|
"sha256:cb56c6210ef77caa58e16e8c17d35c63fe3f5b60fd9ba9d424470c3400bcf9ed",
|
||||||
|
"sha256:cdfe4bb2f9fe7458b7453ad3c33e726d6d1c7c0a72960bcc23800d77384e42df",
|
||||||
|
"sha256:cf9931f14223de59551ab9d38ed18d92f14f055a5f78c1d8ad6493f735021bbb",
|
||||||
|
"sha256:d252f2d8ca0195faa707f8eb9368955760880b2b42a8ee16d382bf5dd807f89a",
|
||||||
|
"sha256:d5fa0ee122dc09e23607a28e6d7b150da16c662e66409bbe85230e4c85bb528a",
|
||||||
|
"sha256:d76f9cc8665acdc0c9177043746775aa7babbf479b5520b78ae4002d889f5c21",
|
||||||
|
"sha256:d78827d7ac08627ea2c8e02c9e5b41180ea5ea1f747e9db0915e3adf36b62dcf",
|
||||||
|
"sha256:d7ff07d696a7a38152ebdb8212ca9e5baab56656749f3d6004b34ab726b550b8",
|
||||||
|
"sha256:d9199717881f13c32c4046a15f024971a3b78ad4ea029e8da6b86e5aa9cf4594",
|
||||||
|
"sha256:dc23e6820e3b40847e2f4a7726462ba0cf53089512abe9ee16318c366494c17a",
|
||||||
|
"sha256:dce51c828941973a5684d458214d3a36fcd28da3e1875d659388f4f9f12cc33e",
|
||||||
|
"sha256:dd2135527aa40f061350c3f8f89da2644de26cd73e4de458e79606384f4f68e7",
|
||||||
|
"sha256:dd6cd0485b7d347304067153a6dc1d73f7d4fd995a396ef32a24d24b8ac63ac8",
|
||||||
|
"sha256:df8b74962e35c9249425d90144e721eed198e6555a0e22a563d29fe4486b51f6",
|
||||||
|
"sha256:dfbfac137d2a3d0725758cd141f878bf4329ba25e34979797c89474a89a8a3a3",
|
||||||
|
"sha256:e202e6d4188e53c6661af813b46c37ca2c45e497fc558bacc1a7630ec2695aec",
|
||||||
|
"sha256:e2f6fd8a1cea5bbe599b6e78a6e5ee08db434fc8ffea51ff201c8765679698b3",
|
||||||
|
"sha256:e48af21883ded2b3e9eb48cb7880ad8598b31ab752ff3be6457001d78f416723",
|
||||||
|
"sha256:e4b9fcfbc021633863a37e92571d6f91851fa656f0180246e84cbd8b3f6b329b",
|
||||||
|
"sha256:e5c20f33fd10485b80f65e800bbe5f6785af510b9f4056c5a3c612ebc83ba6cb",
|
||||||
|
"sha256:eb11a4f1b2b63337cfd3b4d110af778a59aae51c81d195768e353d8b52f88081",
|
||||||
|
"sha256:ed090ccd235f6fa8bb5861684567f0a83e04f52dfc2e5c05f2e4b1309fcf85e7",
|
||||||
|
"sha256:ed10dc32829e7d222b7d3b93136d25a406ba9788f6a7ebf6809092da1f4d279d",
|
||||||
|
"sha256:eda8719d598f2f7f3e0f885cba8646644b55a187762bec091fa14a2b819746a9",
|
||||||
|
"sha256:ee4308f409a40e50593c7e3bb8cbe0b4d4c66d1674a316324f0c2f5383b486f9",
|
||||||
|
"sha256:ee5422d7fb21f6a00c1901bf6559c49fee13a5159d0288320737bbf6585bd3e4",
|
||||||
|
"sha256:f149826d742b406579466283769a8ea448eed82a789af0ed17b0cd5770433444",
|
||||||
|
"sha256:f2729615f9d430af0ae6b36cf042cb55c0936408d543fb691e1a9e36648fd35a",
|
||||||
|
"sha256:f39f58a27cc6e59f432b568ed8429c7e1641324fbe38131de852cd77b2d534b0",
|
||||||
|
"sha256:f41f814b8eaa48768d1bb551591f6ba45f87ac76899453e8ccd41dba1289b04b",
|
||||||
|
"sha256:f9025faafc62ed0b75a53e541895ca272815bec18abe2249ff6501c8f2e12b83",
|
||||||
|
"sha256:faf8d146f3d476abfee026c4ae3bdd9ca14236ae4e4c310cbd1cf75ba33d24a3",
|
||||||
|
"sha256:fb08b65b93e0c6dd70aac7f7890a9c0938d5ec71d5cb32d45cf844fb8ae47636",
|
||||||
|
"sha256:fb7c72262deae25366e3b6c0c0ba46007967aea15d1eea746e44ddba8ec58dcc",
|
||||||
|
"sha256:fb89bec23fddc489e5d78b550a7b773557c9ab58b7946154a10a6f7a214a48b2",
|
||||||
|
"sha256:fe0dd05afb46597b9a2e11c351e5e4283c741237e7f617ffb3252780cca9336a",
|
||||||
|
"sha256:fecc80cb2a90e28af8a9b366edacf33d7a91cbfe4c2c4544ea1246e949cfebeb",
|
||||||
|
"sha256:fed467af29776f6556250c9ed85ea5a4dd121ab56a5f8b206e3e7a4c551e48ec",
|
||||||
|
"sha256:ffce0481cc6e95e5b3f0a47ee17ffbd234399e6d532f394c8dce320c3b089c21"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==0.27.1"
|
||||||
|
},
|
||||||
|
"ruamel-yaml": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:148f6488d698b7a5eded5ea793a025308b25eca97208181b6a026037f391f701",
|
||||||
|
"sha256:dbfca74b018c4c3fba0b9cc9ee33e53c371194a9000e694995e620490fd40700"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.8'",
|
||||||
|
"version": "==0.18.15"
|
||||||
|
},
|
||||||
|
"ruamel-yaml-clib": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:040ae85536960525ea62868b642bdb0c2cc6021c9f9d507810c0c604e66f5a7b",
|
||||||
|
"sha256:0467c5965282c62203273b838ae77c0d29d7638c8a4e3a1c8bdd3602c10904e4",
|
||||||
|
"sha256:0b7e75b4965e1d4690e93021adfcecccbca7d61c7bddd8e22406ef2ff20d74ef",
|
||||||
|
"sha256:11f891336688faf5156a36293a9c362bdc7c88f03a8a027c2c1d8e0bcde998e5",
|
||||||
|
"sha256:1492a6051dab8d912fc2adeef0e8c72216b24d57bd896ea607cb90bb0c4981d3",
|
||||||
|
"sha256:20b0f8dc160ba83b6dcc0e256846e1a02d044e13f7ea74a3d1d56ede4e48c632",
|
||||||
|
"sha256:22353049ba4181685023b25b5b51a574bce33e7f51c759371a7422dcae5402a6",
|
||||||
|
"sha256:2c59aa6170b990d8d2719323e628aaf36f3bfbc1c26279c0eeeb24d05d2d11c7",
|
||||||
|
"sha256:32621c177bbf782ca5a18ba4d7af0f1082a3f6e517ac2a18b3974d4edf349680",
|
||||||
|
"sha256:3bc2a80e6420ca8b7d3590791e2dfc709c88ab9152c00eeb511c9875ce5778bf",
|
||||||
|
"sha256:3eac5a91891ceb88138c113f9db04f3cebdae277f5d44eaa3651a4f573e6a5da",
|
||||||
|
"sha256:4a6679521a58256a90b0d89e03992c15144c5f3858f40d7c18886023d7943db6",
|
||||||
|
"sha256:4c8c5d82f50bb53986a5e02d1b3092b03622c02c2eb78e29bec33fd9593bae1a",
|
||||||
|
"sha256:4f6f3eac23941b32afccc23081e1f50612bdbe4e982012ef4f5797986828cd01",
|
||||||
|
"sha256:5a0e060aace4c24dcaf71023bbd7d42674e3b230f7e7b97317baf1e953e5b519",
|
||||||
|
"sha256:6442cb36270b3afb1b4951f060eccca1ce49f3d087ca1ca4563a6eb479cb3de6",
|
||||||
|
"sha256:6c8fbb13ec503f99a91901ab46e0b07ae7941cd527393187039aec586fdfd36f",
|
||||||
|
"sha256:749c16fcc4a2b09f28843cda5a193e0283e47454b63ec4b81eaa2242f50e4ccd",
|
||||||
|
"sha256:7dd5adc8b930b12c8fc5b99e2d535a09889941aa0d0bd06f4749e9a9397c71d2",
|
||||||
|
"sha256:811ea1594b8a0fb466172c384267a4e5e367298af6b228931f273b111f17ef52",
|
||||||
|
"sha256:932205970b9f9991b34f55136be327501903f7c66830e9760a8ffb15b07f05cd",
|
||||||
|
"sha256:943f32bc9dedb3abff9879edc134901df92cfce2c3d5c9348f172f62eb2d771d",
|
||||||
|
"sha256:95c3829bb364fdb8e0332c9931ecf57d9be3519241323c5274bd82f709cebc0c",
|
||||||
|
"sha256:96777d473c05ee3e5e3c3e999f5d23c6f4ec5b0c38c098b3a5229085f74236c6",
|
||||||
|
"sha256:a274fb2cb086c7a3dea4322ec27f4cb5cc4b6298adb583ab0e211a4682f241eb",
|
||||||
|
"sha256:a52d48f4e7bf9005e8f0a89209bf9a73f7190ddf0489eee5eb51377385f59f2a",
|
||||||
|
"sha256:a606ef75a60ecf3d924613892cc603b154178ee25abb3055db5062da811fd969",
|
||||||
|
"sha256:ab007f2f5a87bd08ab1499bdf96f3d5c6ad4dcfa364884cb4549aa0154b13a28",
|
||||||
|
"sha256:b82a7c94a498853aa0b272fd5bc67f29008da798d4f93a2f9f289feb8426a58d",
|
||||||
|
"sha256:bb43a269eb827806502c7c8efb7ae7e9e9d0573257a46e8e952f4d4caba4f31e",
|
||||||
|
"sha256:bc5f1e1c28e966d61d2519f2a3d451ba989f9ea0f2307de7bc45baa526de9e45",
|
||||||
|
"sha256:bd0a08f0bab19093c54e18a14a10b4322e1eacc5217056f3c063bd2f59853ce4",
|
||||||
|
"sha256:beffaed67936fbbeffd10966a4eb53c402fafd3d6833770516bf7314bc6ffa12",
|
||||||
|
"sha256:bf165fef1f223beae7333275156ab2022cffe255dcc51c27f066b4370da81e31",
|
||||||
|
"sha256:cf12567a7b565cbf65d438dec6cfbe2917d3c1bdddfce84a9930b7d35ea59642",
|
||||||
|
"sha256:d84318609196d6bd6da0edfa25cedfbabd8dbde5140a0a23af29ad4b8f91fb1e",
|
||||||
|
"sha256:d85252669dc32f98ebcd5d36768f5d4faeaeaa2d655ac0473be490ecdae3c285",
|
||||||
|
"sha256:e143ada795c341b56de9418c58d028989093ee611aa27ffb9b7f609c00d813ed",
|
||||||
|
"sha256:e188d2699864c11c36cdfdada94d781fd5d6b0071cd9c427bceb08ad3d7c70e1",
|
||||||
|
"sha256:e2f1c3765db32be59d18ab3953f43ab62a761327aafc1594a2a1fbe038b8b8a7",
|
||||||
|
"sha256:e5b8daf27af0b90da7bb903a876477a9e6d7270be6146906b276605997c7e9a3",
|
||||||
|
"sha256:e7e3736715fbf53e9be2a79eb4db68e4ed857017344d697e8b9749444ae57475",
|
||||||
|
"sha256:e8c4ebfcfd57177b572e2040777b8abc537cdef58a2120e830124946aa9b42c5",
|
||||||
|
"sha256:f66efbc1caa63c088dead1c4170d148eabc9b80d95fb75b6c92ac0aad2437d76",
|
||||||
|
"sha256:fc4b630cd3fa2cf7fce38afa91d7cfe844a9f75d7f0f36393fa98815e911d987",
|
||||||
|
"sha256:fd5415dded15c3822597455bc02bcd66e81ef8b7a48cb71a33628fc9fdde39df"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==0.2.12"
|
||||||
|
},
|
||||||
|
"subprocess-tee": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:21942e976715af4a19a526918adb03a8a27a8edab959f2d075b777e3d78f532d",
|
||||||
|
"sha256:91b2b4da3aae9a7088d84acaf2ea0abee3f4fd9c0d2eae69a9b9122a71476590"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.8'",
|
||||||
|
"version": "==0.4.2"
|
||||||
|
},
|
||||||
|
"wcmatch": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:5848ace7dbb0476e5e55ab63c6bbd529745089343427caa5537f230cc01beb8a",
|
||||||
|
"sha256:f11f94208c8c8484a16f4f48638a85d771d9513f4ab3f37595978801cb9465af"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==10.1"
|
||||||
|
},
|
||||||
|
"yamllint": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:364f0d79e81409f591e323725e6a9f4504c8699ddf2d7263d8d2b539cd66a583",
|
||||||
|
"sha256:81f7c0c5559becc8049470d86046b36e96113637bcbe4753ecef06977c00245d"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==1.37.1"
|
||||||
|
},
|
||||||
|
"zipp": {
|
||||||
|
"hashes": [
|
||||||
|
"sha256:071652d6115ed432f5ce1d34c336c0adfd6a884660d1e9712a256d3d3bd4b14e",
|
||||||
|
"sha256:a07157588a12518c9d4034df3fbbee09c814741a33ff63c05fa29d26a2404166"
|
||||||
|
],
|
||||||
|
"markers": "python_version >= '3.9'",
|
||||||
|
"version": "==3.23.0"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"develop": {}
|
"develop": {}
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ Ansible playbook for base and initial configuration of the web server hosting my
|
|||||||
## Assumptions
|
## Assumptions
|
||||||
Before you can run this, a few things are assumed:
|
Before you can run this, a few things are assumed:
|
||||||
|
|
||||||
- You have a clean, minimal Ubuntu 18.04/20.04 or Debian 10/11 host up and running
|
- You have a clean, minimal Debian 12 host up and running
|
||||||
- Python 3 is installed on the remote server (requirement of Ansible)
|
- Python 3 is installed on the remote server (requirement of Ansible)
|
||||||
- You have a user account with password-less SSH access to the machine
|
- You have a user account with password-less SSH access to the machine
|
||||||
- You have sudo privileges on the remote host
|
- You have sudo privileges on the remote host
|
||||||
|
|||||||
12
ansible.cfg
12
ansible.cfg
@@ -2,16 +2,16 @@
|
|||||||
retry_files_enabled=False
|
retry_files_enabled=False
|
||||||
force_handlers=True
|
force_handlers=True
|
||||||
inventory=hosts
|
inventory=hosts
|
||||||
|
gathering = smart
|
||||||
# instead of using --ask-vault-pass
|
# instead of using --ask-vault-pass
|
||||||
ask_vault_pass=True
|
ask_vault_pass=True
|
||||||
remote_user = provisioning
|
remote_user = provisioning
|
||||||
interpreter_python=auto
|
interpreter_python=auto
|
||||||
|
# Don't warn on unknown SSH host keys because it's super annoying for new hosts
|
||||||
ansible_managed = This file is managed by Ansible.%n
|
# or if you get a new laptop and run Ansible there!
|
||||||
template: {file}
|
#
|
||||||
date: %Y-%m-%d %H:%M:%S
|
# See: https://docs.ansible.com/ansible/latest/user_guide/connection_details.html#managing-host-key-checking
|
||||||
user: {uid}
|
host_key_checking = False
|
||||||
host: {host}
|
|
||||||
|
|
||||||
[privilege_escalation]
|
[privilege_escalation]
|
||||||
# instead of using -K
|
# instead of using -K
|
||||||
|
|||||||
@@ -3,4 +3,12 @@
|
|||||||
|
|
||||||
tls_cipher_suite: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
|
tls_cipher_suite: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
|
||||||
|
|
||||||
|
ansible_managed: |-
|
||||||
|
This file is managed by Ansible.
|
||||||
|
|
||||||
|
{{ 'template: ' + template_path }}
|
||||||
|
{{ 'date: ' + (template_mtime | string) }}
|
||||||
|
{{ 'user: ' + template_uid }}
|
||||||
|
{{ 'host: ' + template_host }}
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,8 +1,14 @@
|
|||||||
---
|
---
|
||||||
# file: group_vars/web
|
# file: group_vars/web
|
||||||
|
|
||||||
|
# run nginx by default
|
||||||
|
webserver: nginx
|
||||||
|
|
||||||
# all hosts run fail2ban with the sshd filter, but some can use other filters
|
# all hosts run fail2ban with the sshd filter, but some can use other filters
|
||||||
extra_fail2ban_filters:
|
extra_fail2ban_filters:
|
||||||
- nginx
|
- nginx
|
||||||
|
|
||||||
|
# root prefix for all web servers
|
||||||
|
web_root_prefix: /var/www
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,163 +0,0 @@
|
|||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
36643866316634653430343333316233346137663238373035376232643132663036343736376464
|
|
||||||
3033313234383933656361343938653362623265653030360a396638643333633137376231663538
|
|
||||||
65313537316564303330663730333131633165633238643532646435386436623163346366383533
|
|
||||||
3965636630393834620a343531623964626135636337313861653361393733333463633234363435
|
|
||||||
64643934346466663934613962613230623562323666353231326363343430336637323666383634
|
|
||||||
36626136643432343332343665343734653435383336313862383863626466663633363738313563
|
|
||||||
30303666306439333836306161633432346636396333653434666531353966353430666436623531
|
|
||||||
31636562656161333830313362653764306137396231346334613336346538306432636639386561
|
|
||||||
65323737383865313264623934613365373465323065616130333837386665666333623832626239
|
|
||||||
33333230643332373238363432306466613737373132643134363563613535376365616130333433
|
|
||||||
35653262356233626331643432396237306237363135623830643536653938363461303738613130
|
|
||||||
66613036393338393037386162383831663866323233383736303532363837663039376166363639
|
|
||||||
34666237333562643665653165393730646632316237663337383937353365333532336462656362
|
|
||||||
31353934393363363765616335626565343238336262653361306164383030303835303666326532
|
|
||||||
31386332346362633433356161643536333862373030306364393935663061396538616637623230
|
|
||||||
66383163396139306430343639346264336464646233316636666239643132376164613666363538
|
|
||||||
33356365643430383732396235623038643566623131616461376261343563353236306663656634
|
|
||||||
64643035373039383031303464346264383066623762323161643561366164313461613038633531
|
|
||||||
36383161363065366164383932623231626633646166313835343264373366393236626336353039
|
|
||||||
66646338303731346337363962353135346239306562663737363038306433386230326636336162
|
|
||||||
65313132626564663738633531333662666661326463643032656136376564643938623061346464
|
|
||||||
66653239663464306430613563666336643839323537626338666435336138613763313364323637
|
|
||||||
30666566326463623438316263623233333434623366306330656564636163336636623433646631
|
|
||||||
65316562616136626330333166646332366537666664303766346239316535333031396235303466
|
|
||||||
34393664373361356231333530323865646333653237613636386632393730623330653437393164
|
|
||||||
65343266373237386364373862656138633263666633333465623836366233663537393539393638
|
|
||||||
34643963363865383434633163623832646632393234636136346137366361393638393461306337
|
|
||||||
64653436313065326637363632336565306137613131306364336537613835306332633366313130
|
|
||||||
34393732643361663731383661646631353035353064613931333330653031626435353163323633
|
|
||||||
65326135376462666435643837333131313863313630336566333835613132383365343234366133
|
|
||||||
39336131363366616136663636663334386361646465336331343836626439316532376566353565
|
|
||||||
37643361646435643133336333643837633331316432303062623062396564373137613235363762
|
|
||||||
32363838333337363035343631353261653063316138626133303937623233326531333837383033
|
|
||||||
39366536333434303864616164313137613337643730306261626138343764663662393161613730
|
|
||||||
36303736306631636266336131396336646635653131336265623364633038363339353933636632
|
|
||||||
39626134353866313439333962376663393831303261633431303035663130613265333739616135
|
|
||||||
62623138386235653935383364623230343662333138653562633266336534383963326237663132
|
|
||||||
38646335623532383565303466386261613931666438313261653434633934353739613431636132
|
|
||||||
39633133656230666231383936396264313630353434313035643565333661393736386637313264
|
|
||||||
63636337373334313937643261313564333564383566633730396364653533666236643433643436
|
|
||||||
33363061356362386535323038383637613364393639646363366630373735353234333134636565
|
|
||||||
37653064636536376638626135393332626539346365353661636439323338653137383866663734
|
|
||||||
62303139363436646464383266396464313565376132393937356665396536623332376134393366
|
|
||||||
30346435313566313237326461346362353633353261373038656130323365383765613739323239
|
|
||||||
38633934643531633037623036623839386637663762366631633033646138323936353433326430
|
|
||||||
34396466653230643766636636393735373363616637386662333535643536626261653264346332
|
|
||||||
34336337646133646261353939353166393530323730333063393365626365383366633464633236
|
|
||||||
64656535613838313461623864666362373030636366373038373863616462373939356238353362
|
|
||||||
36363535653734343533666532343166313964303236313135386134623963386535306435656330
|
|
||||||
38386430303330303837326138356364373439313836636234656331643131646363386138653065
|
|
||||||
64353837396533303463643130613339663166333933643362303565623432643064353865393635
|
|
||||||
65663362666130623933623733323933343065633432613965373764383035316338316338373934
|
|
||||||
65383061386635316331366532626437303664636436306535663365373064346136393063623335
|
|
||||||
35643062363536633332313531356637313032666262366466626462666663303161653635666331
|
|
||||||
32343130383231323239363235313031346438323330383938303733323436646336353163356132
|
|
||||||
30336136646261323866663530336335636464623035626635333961623363396239353935636531
|
|
||||||
64373231386163663962313834333538333133376433623363306239393462383930306432396562
|
|
||||||
65393761633834663431353032393032396330393338343863333939323632393438646331613463
|
|
||||||
35363530653161653266616331356531666434353663643364316564623438316132383463356437
|
|
||||||
38626365343733383735383939646331376531376563623231323535323735356630336130383835
|
|
||||||
39633335373163656431336130333664306164336536356431323438333933636365303330393233
|
|
||||||
32353437393133646632373234376431626332626333343866643463653662373861346539663131
|
|
||||||
32393333633766633738393937356134313236343633636533376665316134653632623061353866
|
|
||||||
36373761366264653737386331383235306137323965363265653937353833343362633433313462
|
|
||||||
32316466356335366630373635376561636233336165666661653632323835336563313134343064
|
|
||||||
30333033333331303164323133613536613636373333663131633162616235316636346337333462
|
|
||||||
64306336636562353733613538343462626233303661363131333665366135306332346135323136
|
|
||||||
31306535643539303936346632623930333339353439376462633462626165633437393830373739
|
|
||||||
61653230646366623830353630336661623466316136373264353762313065346632366164653261
|
|
||||||
64313830303466306135313964613537633236383535343132613332613733316161623365333163
|
|
||||||
38633930323439303030316433343764356538313632366635653437346161646439663563323832
|
|
||||||
38363731353734303932653662326138646239306261383232643537313365393061383663643632
|
|
||||||
31343736373739643164623437663239616663373335643262336664326365656137643066383463
|
|
||||||
37356666306666353339626662326135636530386462613061326631366535383034303830323237
|
|
||||||
65316135343135383230656638363564303635363333623833373163326365393430663235623231
|
|
||||||
35646632643735363730613462656562356139323863616266343566343861356238623564326430
|
|
||||||
31306366366330363036616137363163663136316565313334616164346639663465666338316439
|
|
||||||
33643732343062313536313233333039366435386235333736333937633266653761616262346566
|
|
||||||
32636337623266656464636634643632316134376334653932363134613336346539656438633137
|
|
||||||
31306439663834663431346133653532636664636463376337616539393239316465636537633630
|
|
||||||
30363461343733653465666332646236386633396530333863616236383437333931643731626364
|
|
||||||
38393337656130666237373538393430306333333033306466343866303038643234646339306233
|
|
||||||
32336364363838636563643939626665643231636633666166653539313461393238333461383262
|
|
||||||
62346634633236343433336531396361323238386262313565396265663162353765343037303862
|
|
||||||
63633034363664313733633433356332333633366530643863316364653065623161663932323831
|
|
||||||
31646530613933613735333834373532616136393662346431656363346364353031303262326134
|
|
||||||
31343332386166646530373635343039323163323366616263346431353765303430353636373539
|
|
||||||
36346461303730313630373637346266323331373733383465323037343633313739306233336339
|
|
||||||
63646137643332623834343462333263356432366631663065383962373634366639656133323964
|
|
||||||
64343035323863373139313163323562643066306139363235626532396436663137653635353035
|
|
||||||
31396334346137626461633436343539366635356537306231353961333963616334323037346637
|
|
||||||
33626161333264643261656661643933653835356236333831343563653938303266323730363865
|
|
||||||
31363562383666633636343935386535306361386234346535613363613363393065363832306363
|
|
||||||
63643238383363646137306361306265666435363739306463663637343761643831633261633531
|
|
||||||
36626562636333336434613365316232343832646163396338613839643064653834633832376230
|
|
||||||
33343265386162303266373033353332393931633663623734396133326232303465666432356363
|
|
||||||
66306338616634616631363662313963386638343266383063313166353437373433623736333361
|
|
||||||
36333163386630376262616362613530346563383637656130363365366634633135323863646363
|
|
||||||
35323430343033323734363533326334303438663065656535666432376661613435623365316139
|
|
||||||
30623835373535623662633131393831376231623663316331313661646531393338613532623063
|
|
||||||
66343665356338636438646339663761336636653332646233326264373435346263386130383861
|
|
||||||
34623265373463653165383665306334643233373066356231343666663866373739336436653933
|
|
||||||
65623134306536333538333061303066636339376636333438623666366362666137653261376539
|
|
||||||
31346435613134303866333065306237343162333138643339313461663934643234303132613961
|
|
||||||
65393037396463663034636534323566366161623365666466393634373764333437383263656535
|
|
||||||
33643461636362646135626164373335386130303766633434633062356630336463623661396639
|
|
||||||
32646565623164363631383731666161343762393639343839373234326337643766336263353166
|
|
||||||
62633964303733643035326535656561366139626565643938356264646239336166316534373261
|
|
||||||
30623765623338616537353062666338376262393966373033346233383132653839323731626663
|
|
||||||
66393938313132653538313031323538333263333361303661646633366633353534373837313935
|
|
||||||
37323635633431623365643738623834653631323564393436326562326439666462306263653331
|
|
||||||
66316134616432323939373366343564623264336632376132663462396362663134643236643832
|
|
||||||
31393366653961323763333335303135383934633538636335303435636334343737306232373561
|
|
||||||
31343139363863326536613163663862343263313630336438666132306162646130613233393935
|
|
||||||
37336330643361323032366433313939616134366134393032613862616136393339643232356139
|
|
||||||
35326534623263353766326132623330323639303230616263636536366263643339663838376238
|
|
||||||
35323731303163616236306439343632353561646339663933313937363739303864336438626638
|
|
||||||
64633139633338623431343236333534373835356365343536636261386437613538303334663739
|
|
||||||
62396532353832323262343763353365333561643633353638313534393164366539353431396336
|
|
||||||
36653563633237333730376331326432663561343463616135613738663130323936373136393538
|
|
||||||
65636634363631313364326665336164653939356133333031633632373030623666373562623564
|
|
||||||
64616365616435393231646236623333333037346363666664666233306661353337343066626136
|
|
||||||
35666164356537323735636131383266393064373538303966353531636561623032643233346566
|
|
||||||
61633465376631656636366662373865623764336135323865316336663731383335303330616231
|
|
||||||
64313836373063313061626365316538653831316562333165616531643434633964333438333665
|
|
||||||
66376634323531356538343837326636636636393639396535346264656531613733386337353966
|
|
||||||
31363730646365313834316234626532663563613234643563366566373662616335623035393536
|
|
||||||
61653334346336613539313732383438313132653738393339373661336531633565303635353665
|
|
||||||
31383939643261666538356633326666363934643738636430383537636165623264616236633863
|
|
||||||
35336134386437383539303061343261313530313366316338663539383238663966653837663331
|
|
||||||
33386464653161376335316536633532383035363066653234626363343232393165313463343930
|
|
||||||
63323435613932626435363235396236313365636166663238323534623038663034303365326566
|
|
||||||
66306635373433313730343536633931643935323062643136383434643138306138363366663834
|
|
||||||
66613964303634616139323832363633363063653237366135613964663733376161373937323462
|
|
||||||
30313833623733336366356635323261613132393734613735393062333232313236326264323366
|
|
||||||
32376535616334376137663636633333323665333939363366313432633436653864306532393966
|
|
||||||
61636337356534373164653637633162613235623364396539623961353466303036383031363162
|
|
||||||
37313364613939613939343538633665666136363135656330623332656466383139656234336133
|
|
||||||
62366262663064623137626363613066366666313733623463623562636131323435346264653564
|
|
||||||
31323431663339653966336230356339303534353139663739363263633564373364323937386434
|
|
||||||
37306462653630326366316530656462316539373263366262313930356663376334343562303361
|
|
||||||
61623161613939616666386336626537333135346136643537326635383939663863623332373033
|
|
||||||
32643730313861636163623133323061333631333332373838636163326562633936363631653062
|
|
||||||
37336661626336623462616562333264373330323363363630313739363962323735393332303562
|
|
||||||
62393161323962393039346432353066646162336332663636343739343566363833333738316437
|
|
||||||
64333337363137643931366536396333633538633830353865323765616264356335383031353534
|
|
||||||
33376363386630303332643263383738386532373434613963613764326636333133303262393832
|
|
||||||
35373930383662383064333465633736363063363434333662396331633032353733353334363162
|
|
||||||
32393361643562623362333963663262363235326536396131643435306665343438333933616466
|
|
||||||
34326634373965313638666337326633653938343561663739333464343135346437636436633034
|
|
||||||
62333039373136656664363531373430356363363736306533386135323061316339326636643739
|
|
||||||
38363763653331646638613963646138666165666439643065363335343132613731623264376536
|
|
||||||
37366533636564346661343966373964353731623861633463363638356163346165643164373535
|
|
||||||
30373564326263393436326337653631383731313139636339356433333830666265343165323330
|
|
||||||
36616538616534626237623862636536303336343331383237333333656637303266616137336439
|
|
||||||
61653631636632366563373034346365313337356266636338336663643538303063613036383831
|
|
||||||
65613635336366316263336131666238386237366264396438383966313762626639643236313532
|
|
||||||
30663235666662396231376631366139653937646132343639396430643339393165656266636235
|
|
||||||
38356135666433323434613238356537306630643861353436323037353461326534313632386232
|
|
||||||
63643261373263646437373535333036336634396331616330353233613564363361396437326435
|
|
||||||
38396462643833313362633436303637323163663166653231653866643733616432323663316362
|
|
||||||
3037356363643462356137346638313963376637643162623062
|
|
||||||
@@ -1,46 +1,27 @@
|
|||||||
$ANSIBLE_VAULT;1.1;AES256
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
65653532333862366436303432656664373261323934306234623534633335356466623330373063
|
38663333313561616264323430323162323837623430363739623561633331656664613936666665
|
||||||
3164363863313131303330363564326130383433646332640a373233653965653164353663633038
|
6364373033623163393239663035306337383066343438310a383666313434323036643037363065
|
||||||
63363966646361366637643261613062393736366361356235633139323537636638396264316534
|
30396333626130303633663930663965666662646233393439376661346265616565616236623366
|
||||||
6366313732323066620a333738656661656537646632326262663862393434663435313037653564
|
3930373433646231610a336233663132306263656465633034333030316362643939316465666534
|
||||||
66303732396261373436373538396466643330633336623066313933323266386438363566343834
|
38353961393038613961353732613434663565633466303265383231343336386330333464376363
|
||||||
38616661303931376136616532386637386130326264336430613336613836323666326261643838
|
33616330643364376332623634363766656366666239633964316439376463313063333162343963
|
||||||
36613565323062626662313864633539323538316562346533363437373766343764346132333631
|
61356634393438313063666434626338616264613639656462626639616263366531663135393466
|
||||||
66336135383732393939383133626662343335376531336364303662356566393034326635333066
|
66346635616439306364356133303664376134626636616131373138656562363363306633333164
|
||||||
64333635303633306639656161623631333139653034633939303565386330383236616364353136
|
62623135343633393834393165383231316562643062343165663235313930663039623135373263
|
||||||
62663536613565383064633235613539313933373530306164356462353861383761363931613430
|
61343336643235303962333938613230356465346436376334373438386461366231383737643137
|
||||||
37373939616564663562376635333862646234353133663331396661626234356665633835323137
|
36343832353730366131653430633465383163396336353065306638373166386438356264616139
|
||||||
39343462303438376131626335346637316238626462333430346539313838386662363031336636
|
65346635663338366463343932336231386235393836616238373864626235623935663661396663
|
||||||
34366132363439653137393662653661663262346632306533376565353037616362316161333566
|
31633565356465333737303339333435383162316530396563333335613062623138333232336162
|
||||||
30393530656566643136613039363537613035666465656530366637393664343665666534383837
|
62376363666431363931663231643561616562383230643737393261623934363633313231333137
|
||||||
63393133336664313466636538386338653937643563633737633962626562326637356661633463
|
39383238656237343661626662366465356463396336386261326334613436396364633062646532
|
||||||
61613231346532306265623361636330376563396266393330393166643833353165363934313533
|
61313136366636363861316166396134316562666435653437326331363563653035343138636163
|
||||||
66333832373035376334326336616534326566666361616665633363383032393236336634303232
|
66336139636533656334643966383962383734623565323435333665666164353732663736326364
|
||||||
36656336316635376431396233626539633839386533333436633264613761353361333565656233
|
35616264383237316330386539363065376334643432393636643464646238633034333166663665
|
||||||
65373331306434363938393339333133336461646130666535343965646536656263623530666333
|
33313166393738626133636136346637646437306335326263393634363133663736666338313838
|
||||||
36353664643132623465353661656466383363376261363534303462306661623564663561656664
|
64623139613037653461643563666539613237323934376534376461313833336338623032616661
|
||||||
37633936636263623065366666666530616264396334623766613036313735353264356162613836
|
64643062663633366436383232366137373936383430306332616634636331326361383931363961
|
||||||
35643737346530393933643537333561356465363239353630343333373038373836623231336437
|
62313236313563326438303935373837666434313435653236643135303739373763656562393537
|
||||||
30343932363864663435656634343138353638343461623665336461326565636164643231323133
|
31653265653739346433663937343439656231663963333633373066356231623762313438393763
|
||||||
65383664633665343365363764353566653635663137633033303731303030613565653565303433
|
36306336656566633034373834316363333233326130626639313130643935333437653934313636
|
||||||
35373930396166646134326165653436613137383630653338613634633361623432373839376430
|
32383034346234333561333466653561323834346166633831303566376266373933356536383031
|
||||||
38376630633363613632316530663839326538366366626230356337323536306665616661373261
|
6236303934323963336662386666653138313165366133303434
|
||||||
36653965623936663963353836653636306362663062636466613034333532633534646635313737
|
|
||||||
33313962323636643132396166626566366466336238323163656332383530363833613633383165
|
|
||||||
66366239613530613264313739396661386165343162633237303034373765643037656564653061
|
|
||||||
63373036356134353633633532663365323932633531616261373735313737333033353532656434
|
|
||||||
36316339303930336464393261323035626330366133626137373034396166336263333964333963
|
|
||||||
62636432386531306133623163643461336137653331653861383139373938353162636566623566
|
|
||||||
35616637663638313566653832343634613632663861333162333932336264613730313864663663
|
|
||||||
38396563373339626365353766646565336335656539393738376331383038353436313963633438
|
|
||||||
33373433613034373763643434613365303938373764306662363635626636633266643035663836
|
|
||||||
65353632313137366231323764313036613134643830326330653763656362343561643964623361
|
|
||||||
64336565666630626339346563663931393035363938663734616666356435326638353131383434
|
|
||||||
65623539613662393936653161663264343132333936303661643534343536363165313564333037
|
|
||||||
39343561656461313265393466346662343530313230386266646662633262643464366661363630
|
|
||||||
63376463396631666366313266633964396137373661643764666537366539373337333731343933
|
|
||||||
31613232363436643236623935326265353666313861303531633462623363373536636534623532
|
|
||||||
66636533356363353735653839646263663631316239326164646463396532343038373861393033
|
|
||||||
36623962396231633164356335623865326632303237643864656335326435373234366536313565
|
|
||||||
34313638373063303434613663323136646263393036356336323532373130386536306235343165
|
|
||||||
6462
|
|
||||||
|
|||||||
269
host_vars/web22
269
host_vars/web22
@@ -1,130 +1,141 @@
|
|||||||
$ANSIBLE_VAULT;1.1;AES256
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
30653064396464333266346335623639626664323437633033643334333131666533373636346562
|
38353762626535363837346634333565643931386536313339336365663162656533363636383931
|
||||||
3064356161636364306236663237383737373437613335390a386266376130303236333635356530
|
3737373161623364396366323338613062386466313539640a653334643937326338386262623261
|
||||||
62393236356533383061323034646466323464636635643336346533363362366130343637353234
|
65643635373532636439396235373964303537646334343633633531633435323037313433346636
|
||||||
3438313633323564380a383963353238303663313061316135383530366161386334363836316530
|
3866306363303338360a356166353265386130616163616662623764313536616666656237636563
|
||||||
36383038323835343432393735366233363561633034623961646364386539643864303533613439
|
30323036353635303438363234646234656530373365396530666539393132643831653039666562
|
||||||
32613561343837613565386235323932363664323665386232656532616638386565653835386333
|
65383962306465363862333131383263353736623264616465336139313638343462653361333239
|
||||||
64616164303332323565306161303936373530323761343235363334363330313564316635343737
|
64363562653366396664623662376433663335313231653935626237663430303734326433333739
|
||||||
63333566646262613339333130333165353037636330666232633963666335333161313562636339
|
62616265373732316530366331323664373637386661353664626464646264356465346466663539
|
||||||
64653034363136323431333137653736646463323762323866303965626565363934373834633034
|
31613435366362343564313732616639376664613630316236373333653634386130663463626231
|
||||||
39616562353138653834636233333665316461623335616136313534343933613065343962316163
|
31396631623466666364316237313363366439326231653035316437616134643035393138383364
|
||||||
33363464623233313336386134303764623338616464623735653836623565316330333561393439
|
35313738373562353632366637663232393638396330626165323535343538633264353366663738
|
||||||
62666332653863656537326235376532613135623435353762316261393162383732393463303231
|
30663135646162396331623837343661613333313437313434313365623664316135626239636230
|
||||||
64316138623466643331326464633932386636636639646434633261303564653665353530646661
|
65376137303439323166346536353831653537326662356330393362666430633831323537623830
|
||||||
63363337373939626535393963386364393862343039623633316364323863616236616464376630
|
65326164663136383339353138663936306166633662346363353063663435323266653137666630
|
||||||
31356531363535336639303863633430626130613238663237366131663738343330396665626333
|
61353263653735626236373233313436343466653238376634623366356431333439323932343938
|
||||||
35633032663333366131626331363964613530616333383031633937316663663930666433643662
|
33303432613063383135633261653837633961643737623462626439373335613430356532353031
|
||||||
63376431396538333566383234666163323734653965326466656137336362643862366530316164
|
31626666663963643736323731613735376239663530373166626365666339346435323761333637
|
||||||
65663436383239613931383138646363623037666338633132353034663231653466363735313834
|
35383464626437646665653931653932653033376464386132383038633734373138313830303466
|
||||||
39363131653232356137343532613664353438616566646339623334306234346132656436343663
|
39313532333866303565353161636435646231313461646639316566386639323561363633636139
|
||||||
32366466623637613366333866316432643763616465633639383165366462656131343331306635
|
37613661626162306431313266383964323434343039386533333535646565373933396565613565
|
||||||
66336264326661313136663665336366616633323834646336633266653961613635353337303031
|
34666136633265663035306261623531333665636336303665613635333232316331643935353461
|
||||||
30393531383631303734373162323233633032353730616536373033643861393039613164656336
|
32643735623532313363663530656630653531666335323565353063316537396334383230386462
|
||||||
30396132313432363230373663386534646361636430336138333735393366643962326130396637
|
33333565616634356537376466373332356663376363353166656139623336396130653564333739
|
||||||
66313966393863313134386335653435613037353061656366373862323865633630386162613437
|
39303733303939313838363331356437646632386631343466383332313037616430313566396335
|
||||||
33623631303363666538373864353365616666393139386330373130376531323132393034333930
|
31363038373437643266656463373662653966653832613935303462303031653761336165646162
|
||||||
30333231316462393035663330333036383234613962346633616538363962303733643935333930
|
31646631373335336435383638666562373236656231613662646161613533376237366463383630
|
||||||
32356330663639663135623738356265393431323937633162663166303335663464323332373931
|
36393532316336303531353032303937353963306164663162386137393664353962323865616532
|
||||||
31376533303861383662623638346566313231393465346139646230306563353334343262316664
|
63326462626130386234643639363762323863326134623063343731366433306431303763363233
|
||||||
62303439323630623965666162396636373162356261663063646636633662363530356666653862
|
36366334386266616261616266386439623665326339653562373836306165353137353137376337
|
||||||
64323637313435316362616432363038306634353464306162333562643063373938363239653666
|
37316363653935623736613138356333653936363866356665303737363032363564643532303234
|
||||||
62616435316230306637383365383665313561383139633961623636336433316365313131613465
|
37656432656363336564393263353430373437303337303461613763346461646565646535366638
|
||||||
33333561656435653630353139363233616363616234353538336564626566633135396131383434
|
34366337343033666134383966646563356533626665373337646231313431346239303635353261
|
||||||
37633165643637333539323935663561316161343431306233386439306638373130316365333234
|
62313939383762303235373537643531623465353062303939383666323139396630346461626136
|
||||||
66653762636163393030396330663365646538363533643366643164383332306135323935313938
|
38656632373637616532666433626564376338363239326234656561636239653536366331633234
|
||||||
65373331386361373337663466313331333234376533366661666435383931306466373162623837
|
65366139623238336234363564616430646435666562616636303064663437663731303839313365
|
||||||
34376136336631366464623630373264653931303038623262353130376635626365353166326535
|
38636438386162623862363865646233346336636439663833343136316165343564393339653565
|
||||||
63643865656333376265656464666332343830393234633265386234623731333635653762313639
|
38346166346434386338303032303430303535373635336562663030336566666435623537363137
|
||||||
64616634346137656634613831383733326334343466646233663832303331653866323937383334
|
61373161343138656365376531633830313561336632633330323035346431643837383062343537
|
||||||
37373635616538323931666434626632623635336432623266346662663966663862623636373338
|
66663961306666333535656432393134363565656635333633363732626665656365356138623164
|
||||||
39666565633232643333626234306466313662316563353939653435663039333362326263633230
|
65303936633666643034313636663262616661313739663135653335366261613133643630343362
|
||||||
31646637383337333538376266333239356637383735303161646237346537376638653931333863
|
66343033363835613031626635336538303362393561313032336136306465316231366137373736
|
||||||
32346464336664313134616530623564356230316132633433346262653438303966643932343633
|
62303335393333306132326135393562666431303631306538326433613362306131316139386361
|
||||||
61653830303334356534626632633839346666313330343636363530316261346534653436326339
|
31383665386466653066613038633335636233396335383764336462636138333034383836386365
|
||||||
33343338656636313139383536313366653234326165306130653431396433656434303432656537
|
38323739346630643532346161383336646165333336393961663930623531303434366265313861
|
||||||
36393632373330323439663930396432323539306235623532326238323937386433383664656263
|
39613231373335373338656434636134663036636234393534353033613133383034343437626434
|
||||||
66353237313435383933623730646663343064336532356232643234636234356130666166396530
|
31646339613430343265333833303231333739666266646436336161363330396264313636616461
|
||||||
66663434383763323135363161306161373336303364626438383066376130666535623438336536
|
61396332363537636162316261363030393466356263353938343236323932306366316535366533
|
||||||
38343862386636343337613130363531656163346538376262653866613962343663373931343131
|
38633165393339356339383939666161336461653438353632653530326639313238323761386461
|
||||||
32366163306436353566613135346433666630633837666563343636303465663162623164636463
|
63653765313532646166306237386435663432633934343039666637323362626338313135623034
|
||||||
63653534353561393533656432326237323937636339613063333964343534303165353335653239
|
30356438633635363738383932393861376235353962303663313963313964383530306530316363
|
||||||
64643466366461373166633831373838323533613631653830336538626136616161623462346366
|
64656638363436326562323234303961396333323931666365656433663865616439336138656232
|
||||||
35333966666231626336323239643966323538366666646335333537663461323763343361633339
|
66653964383034343837663936306632336562373637346132333063663263306237303461333732
|
||||||
66366266313134333461623130396434343261623236616231633533656334373138316434646139
|
65363661623064643663623661393563353739373535373764356163666639376236313839336438
|
||||||
32396639623139383565303261643165366662633065343461613437353765636333303061326534
|
35386265646331313663653761353864663934663261313037396135373938343265353934353361
|
||||||
32616539316631666165336364333264386239326466373534313638336630306439653132663962
|
30343564623631316366343838656135393364353836613330393536623662383637333039383133
|
||||||
30353863346331366564376536633834656134386265303265366233373933616235623432343834
|
37653733626662646631616563306638366263323634303636616331323964393962643061646361
|
||||||
62313530663038633665653235386534306130326639386231616233326433366463663361366231
|
39363562396634656637626630653533396236613334343332326439656165306537326464613436
|
||||||
30356638363639393130383564303538623831653230653338633633366666383439353132363032
|
37333632663731316165613432353339356561316431623038303365303663326666303666646363
|
||||||
61353134376335633461303138333863666135323138616464333438623536363734656438316231
|
66656630396661353765666131393737636630366666373136313837373165303437316233656261
|
||||||
64663030326361396365346339393235373636313763623865393163333238646536663066356361
|
38346463303964343132393162663762346163363739383733326635643264616166393264633934
|
||||||
61656261323566306433626432393339306437323233663762323232333735323033626236633666
|
64333137373532343032303431316633613836323631613231346133366635616435366436316239
|
||||||
34326434633437336238646663633863626536653230386436626130373434346231396263313166
|
64353633366431386664623239353735623037623364346431633733336563303430653233313637
|
||||||
65313961393732333431353865313530356365333462653666663865313034366462376330366439
|
35353138616164643834343339653739373038633531303039333632663566323565383637646561
|
||||||
63616261386664633963393864633538366662653239356261663561653139326665666335306138
|
31383965396365653364343761363161656432656665383963656463613637633938376234353532
|
||||||
35326232363166653638383830356565303337323833323233396634353931626331313039306433
|
33653837613266666661613165376665626432643439363637623333336234313836373232333736
|
||||||
65346666373334376661353463323434636235636234313764323330353665373339653866646239
|
65313232373233613763376463663161643636663162643864363962376232326462643936383131
|
||||||
63346636613065623233643537343237356538363230326431326130303464336637643338666562
|
39366164323038376633376238363663313238336166386663616261306532633331643537376631
|
||||||
63653266623138653165316635643235303131323861306235353135623564366337646166363830
|
31376663393036363566653061353636326565376636346466656263663266326332656461336437
|
||||||
39643431356464376238366134303231323031326437363330343130326136383065626438623930
|
32646162313932646632663738646532663439313630393038383530653562313439336631663535
|
||||||
64623630346230343662626133313332623661353663383863626565373033323065396633636430
|
36396265353231373435353137303164356633653938373166363663616632303764633738333439
|
||||||
65613861303964616633373038646162326634376363623432363161613632376361613065613234
|
62626533346561333565626163643235393164353861636662636531333834623965323034363735
|
||||||
35363963366662386334306233363233643465366164316434373538643732663236616539323133
|
33336138356663303462393864343434636364346432383665313931653062363138623261326438
|
||||||
64383761336233656534653266333832383632343939366662643830643065316464356563376666
|
31616533643163363261386635653732343939633965363362643536626264323537656238633539
|
||||||
31653762616163396134363238346563623961653738383132646264306339623961306561393732
|
62393935386433313366656133633532353131343237623466376632623434626362363062326531
|
||||||
32633635336436663435303731306666336365613030646236363634663731353366366337396435
|
33346165643164363365626432333631393664316266613731663162313764386336333231396632
|
||||||
37316339316534346235666664646335373335306634336262663566386336366235646635336238
|
36666536336333623063346166306164376138343566353063343866316432333266366337623866
|
||||||
30323861663239366438353339633863363536616363396365643361363331633463366162636438
|
61313039663661643863663434343732313139653037373065333463383635393061323938643162
|
||||||
33633364353333663538393430323434373531373536613837353833646336356332313837326431
|
61383064303461366162636439343438376266313931323934313563623435346634663739666565
|
||||||
36666335313163303933333734336532303832373465393939313636343635313737653433323531
|
62333035346634303139626432313262383262633437663436323763313361633235393037343665
|
||||||
33646636373431346432343630633034383936613336353839616632343339643262656330313436
|
62316564376464333133343134333230383765303834613233613232626131343631326433373062
|
||||||
36363538323038623765616636366537633332343465326564323830656333383330393461333638
|
36343466396430313534336332636233623337613134333861646334326633396434353765636163
|
||||||
31633561626265613839303265663164306166313331353739613661313234626563396133353430
|
37343638363234313030363661306337393361333332306331396164346633336130336366396430
|
||||||
63343664633238316263303662633032323965363939393238313062316166663563366534646233
|
62306539656332313162626239303066656664383639353730633738643132386662643733393761
|
||||||
36393233643635353333376462353563333536366533643664303232626564623461643266303530
|
62666339346130626163656237623730363066343838303036613038613763356263363365366238
|
||||||
33616333306262656136646238366631643963356266306533623962653462366335656333383862
|
62623435303838623630333231663137393362323234383533393763623235376164626461373736
|
||||||
63623535316439663664653862386565383737333035653732336266393266323437383666313165
|
36343761353362623433663936623433353439646463613233363732613435373564616239626564
|
||||||
38623336653731303464643363643034623333306362636536323137626462326632346332343762
|
61313066333939326435656535333963313831316231356232346534633531613963353130333432
|
||||||
31393235303962653533306431363062386331666461366235396337646532316231373136396562
|
37656163663230626632393939363532356366643764323330366630656334623261656334633865
|
||||||
30333734666134623430623030646166653831303963303837353664646561653031333935353931
|
61303066333566363061626437643132353664383061383364333338666230313034373535613063
|
||||||
32383936633432313964616166646664633330656637333133363735613631616264613034623237
|
63386237383638333263323337313336373830303865303466363965303839316162663431656538
|
||||||
32623563313164663563633263383839646231363931363136333361613537633439333564373934
|
33376332643335366537306133613761613132643232316438623939356331656263633933613935
|
||||||
39646639613131626430326534346639306136626236303635626438343963666262643330626563
|
65653465383434386561323462626362623566663330656439386361616562353430303938636436
|
||||||
33666262393363373237336531653236323161613237613636663736373331393734613661633332
|
66636531343063633561363330663436383930613438323764356562383536393933646264323135
|
||||||
64353939383463383261626537653637363134393839623434383066663432393361643666336364
|
64633764356166343965346362323466306636363633656466653934313230326435336536306230
|
||||||
35333266343261663963313064623932353133613163663231663565663765343630363139636636
|
38353432323537393131313239373861386237313530366139313338313330326632313536353837
|
||||||
32613463363932333166666364646235656661343161633764323831306337636666363565323831
|
63386161336335363834356437326630353031373435316462613634633039336132646134653236
|
||||||
63303935353933363265386361653863313734353366613430326536393761343262323632313332
|
31346664353932323339366464356161333637313761666138386164313163333531626235663338
|
||||||
64633635303261313931386165316161326164613635613537663466646430376139306333373366
|
62386333303264306363646136646463393134373939346438383465393439343337643336633039
|
||||||
38326136356333633432623237643266633361376363393034383330613034353830313039646237
|
62316464663038326439656334373331303165346534346466663538313632633561393335333931
|
||||||
64346666616363316361356466383234646436663863373961666636373863373436373334383031
|
65363964363335616639643462393463343437626539363838626439386164303464316666633663
|
||||||
38653836653563383666663139633164643361303732356239323435356630613239623962366462
|
63656639626133653266306266306531646331386366343936316136363935323662336335326338
|
||||||
34316166326334613131626230613363303334373537393134633930663636626135663162336636
|
30666130316265666631306635646565363039306138313462376662626161313134383633653834
|
||||||
61363633653666323832656362363532663833623835613732363339336638323662353130653136
|
32376163383763306165323466306264616366343332636564636162666434333732643635336163
|
||||||
62393338646662303934633438633935316563386135663862323438613234313138393364343461
|
61626162626331613438373464336465303739316130343965633532336531313661613961313164
|
||||||
31373963613431313966303339666531626161633361383836303534333931363135353062613633
|
39636165316638616338653965373833333732396363393463383433383930353361636166346232
|
||||||
37336637623731623838303639653832633866613564393232326261336137363862303731626332
|
61323935663536306533336137356566383130393564623938666231393431626136396137633066
|
||||||
36643438663564333865326263643834373730316136376538393731353165316331346331366532
|
36633133313861353338616561373838363833353531633465363731336237663561383561326635
|
||||||
63633233663966373934663532656530623765616336376634613366376136613831313239656563
|
62306338643965613635353536613335363934666362366466663461646135346436336164346536
|
||||||
35343464376364333035356639343966326335663432636363323339363335656437336439663161
|
62666631303638386137356233303235613636346661303834613335616161396238663530643165
|
||||||
66343434383334616535313330396165316262393962383232343564623833313964346635326264
|
65366364336139303766303938643038303461656335303438396565346330313665636165626432
|
||||||
31303139386463663539623862643431396130666537663137643439646535346631396530383134
|
64326666313562646239356231663834326566313331303363343064346539626636346438313266
|
||||||
36333663316434613933623965346264343164316132346466643262616235653266663765653864
|
65643364656164336166353435343730376266333633666230316464356439336463316464653137
|
||||||
32643139396430656136313235633538313334383538626532356664386539313161376662303837
|
66303865613961373732323439326535373933393537656462303831333432636261613564636330
|
||||||
64393230623732643335363164393733386131323235613065633530383864343161643562323735
|
63323361366332386331376437666234346661373233653432343733346363306130383665626437
|
||||||
30333766383030666463363535613138373735373833366661366563616532316132363233333737
|
33313330336365633464643563643465393935653132376135663163393161616462353838336664
|
||||||
30353137303439383038663063666631666264633062333837353837363731316662313636326431
|
35393833656135643733623765626639386561333336623930303465323963613164666531396632
|
||||||
37613939333766353530646330653532353965323864353434383035613639643263663762666663
|
35326365386566353966383635643132316230383363393539653335633934646239316131653536
|
||||||
37636463396161656335376539356638643539336330396432356338393665616637623039346433
|
66656161653030343462346337653434313062343663633665363838393865336536626532623132
|
||||||
30656161666135376130303566623132303738323038363939363733376666646431643465303065
|
66643636656134353363636433636538623930396262663864343332303066333566653063336464
|
||||||
63636263653262376533646636373536373661353063323431373537323930626638613735643338
|
32303030396137346636636164323133396364623532643332363638643761323938616530353836
|
||||||
33346565363462326236373137306332616562666631313131356634353961383165383939313665
|
65366331633561623331393231323534343239323565333330636136383836616230343034633036
|
||||||
32613438333061613139666530313962366536323531663866313638626433623736613536633965
|
38373530616532653166653932643665396434373465376530313663646236336238656266616261
|
||||||
32353635626161363930333562613536393238366333366365616435353164663265643831303566
|
33396463303963646633373038336662623161643135656136326533646337316562323932613833
|
||||||
61643333313635626231373564363730313731646464373566363961396439333433313432383138
|
65616434316239353531666131383335383733333830613934393465663138353662613063323537
|
||||||
32666438333637613633373537326139343266393335616634353961646535616237613764336663
|
31393337343737646537666430323666366338303731623339323063393636353132636233343436
|
||||||
63653437396538353238383138656535646539303864633235363535376635643362663064666366
|
61653862333837623666343061633531396235633565313631663937393337303764316466613130
|
||||||
62623165333234393435343233373430363161663936343165346662336366623532383730353136
|
33653732373034613639326338353438643664653461616133646235393864386564353765313932
|
||||||
66643739626538353036663739326132336161623363393130346365666265323765346232633264
|
36613165323465333937626165316632313334313364353463366239356630653530313761373261
|
||||||
6337
|
35326331313438656238646535643131656634396238363734626431633734336238616538383636
|
||||||
|
32303331666531653331306263303534613332653535643833303062653566393632333030383263
|
||||||
|
63393636643264656439373165383861323534333462353763343931363065393738323433323839
|
||||||
|
33333530323434363662633939303261636465356663326565633238663333656131376130396561
|
||||||
|
63363636613161383465323233626630613265346162386439353665393832383961616564636538
|
||||||
|
65333635336638646436623033343831356339656638333231666439643337306636313931643466
|
||||||
|
32393765303361323735646130613035346564356562656631373435653832663165313131336236
|
||||||
|
31636634663466366234386262623234626161663461386661656435656133616339383633386230
|
||||||
|
34313065396335636630333066633339646432313632373131306235333164336534363630313939
|
||||||
|
32623062393230633732323130613338363833356533306662616637326337343330303635343532
|
||||||
|
38396665633938313932656130303263396631343761616631616637633831666139343130313236
|
||||||
|
62356630346264376432
|
||||||
|
|||||||
150
host_vars/web23
150
host_vars/web23
@@ -1,85 +1,67 @@
|
|||||||
$ANSIBLE_VAULT;1.1;AES256
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
34643866316432643663656661633339313239653763623430356538363761393162626338336433
|
64326662336532386161646564656439396461666266656463393335663130323930326139386562
|
||||||
6535353761396539323630396230316637363536396631350a343338396638613636396364323762
|
3639653630336132663666646161363938386334323064320a663564613066313533353433333434
|
||||||
62306431363961393937633033373963623064333363633034623430613031383032363562663536
|
30346561616465646163646534356339666639333862623637613435376361323032636439633930
|
||||||
3566646634303639340a366236343164666563366130636433383832656563376463333431303861
|
3731313063363337380a373961353530383764623830363935626231333734303364313565626633
|
||||||
34323164323161303762616164366632663761626665323832366166386166636130383830633065
|
37343037633862633632613165323136373662396438613663636433346566653064653632313338
|
||||||
64646563396264303035636661663162393332613661663564316466313363656263646533633861
|
36396333393334336434326630646164333531306432386133353664336535343363343939393464
|
||||||
30366136316131643734356431633064373062613539643937626539373536666663646331643862
|
34626335626436353239366138323863656336636536383733363931633933636331643263653566
|
||||||
39366666386438373335396136616662346230363631326465373065333633313638303564336165
|
30613931616462373336393337363430353962613665353936383533326364353365623333316664
|
||||||
62323164373933396166363236396461623432363931636637613235636663613432636136616664
|
62383439396131303831326562323264336638623461643361663763356236373464346464316237
|
||||||
64643130373337353936663863356363653630633033343538623133616662386430343632303031
|
65393232343733643338653734326562626166366562303037613862396564636662363066356664
|
||||||
61386331346561346138643735393162616135633333343135653238366533663733626361656666
|
32656363616637303039373732396533643432343961666365313963383131643464333765643737
|
||||||
61616130313031646365613638633463353861353935623562646666393733656266643834396361
|
32386165666131626365313938633530346361383734323334613464353862393931323836626563
|
||||||
38333363633162636561323331646262643139643135666261343364333634613138343431623637
|
62656531346532646530306463653364326362613162323536643836643839663933343132613435
|
||||||
39383635393565656139666535386336616165623333386266383431663936313034393439626234
|
63303234646335306632316166626266313635303566396363333464363631353834373761353837
|
||||||
30386263323630303563613334393538306430396537613436613264646664616261323336366432
|
65643461623135363139646564336430353461336433633765303138313730613630346465326666
|
||||||
62333061333730393064666131346339623061306637633261333635336233363831353662653437
|
61393133636262653836333664623333656164663361353130623863653863323131326136373238
|
||||||
33626333333130386161323038333465613737393835656632346436396361383761303865333339
|
33376333316433653337373834666136363130373261333330643439313734343036636364306532
|
||||||
36613062353630316633336464336463633230633762366663396463303234343266323233326165
|
63343662383539633235356162656366323965383331343139616361653466633865626337326562
|
||||||
30303637353163613464633930336463326535623662636638643066333733623032353564393164
|
63643761613536613334333065643533323066393764633931633066353064393966646161376361
|
||||||
66363732393438393462353034626363636664316464356432363235366134326261326335306462
|
37623939386636346161346164303832303534323038626335336665653634386132343031303861
|
||||||
61623330656538633364373561336436353362303638356539393031336531396139343539353936
|
61323765306366333936303765636436633465356539316631343562363535663932333666363035
|
||||||
66323332336235393162376436346330386537336239636434346565386565373365343462323164
|
30386233623265636464393662386464333430396337626230306438396563303437363938303061
|
||||||
63373462313861653561313762363338623664333233316632303562393736346665626530643061
|
32653939383136376365343934613339383563303935623664633639326137353437363261393637
|
||||||
65353337623230643136616262623430323235346439626364376362653337303735646663326535
|
66613331643530623862636665396536613730306537373666623135663837393466343261646461
|
||||||
63393937366232623663623165323965303563323137383462623339396163353433343836383666
|
62376162613861643633656334303132353034333834626664666237393534386439313638393933
|
||||||
39633065373839646235326130633635316237366631333765343333613564333461326465356134
|
35643663613432323432646466386434363335353234643264643463613334356462313766643030
|
||||||
37663735393537333532363062633161313437623831356332663765613936383338343634386239
|
30336364396235663230356235303264323339643761333036333537633862343862386130626533
|
||||||
37303137623138396261663230303530343132346665386363346230663836656634316364373064
|
36626536396663393031303533313238616133323239356634303830353439363133353839663266
|
||||||
61666262363638376162393339636138353634633630333435383437313433316564663963323532
|
36306539636563633734623162356230383232306138393831393336626336383966643335376564
|
||||||
30383835336565346337613464343561343832653263663465393133343566333864633766613531
|
36303730313936633361643736613736303163363536313038316432323039643362636538333037
|
||||||
39653238633237373736663635306563323631346331353362343031303636366439356362306138
|
65613663333032623035656665393565366363396134363832363163656532363537373435623233
|
||||||
64656166653232633239633037373330343139636261646238613662613364656632643334343233
|
36373961333237373264326634353363356537356538343663613034396132396366626330303365
|
||||||
31633438386433633736663564613230393662316534336132333636326137353831373335396666
|
62353461616434343938386237373365633861333733613631633234623034366364363761613636
|
||||||
63636530633037643339326466386638323733363732323939323862326432303231393435616630
|
34393532316466323264363363653335366639613731326131393335313039646538626665356333
|
||||||
63303461616338386230303933636161306238613861326633636331376464643531333939303735
|
62663435633539643237326631636563363833633130363535653336333538366137306235663730
|
||||||
38653165303832313739363136616266363837613337306230336433643237326232356333343963
|
36633934636536633865376262356239303966646638626638386536366662386432343466366161
|
||||||
62316139393661323965313066636530393433613438633430373864343438623631666564386639
|
36646436636538643366623864326630396565373462393132343834626638313437316137353564
|
||||||
34656461643530636537383264313266653465333764623166383838373366323662653939613439
|
34646138616438323065336266366434316135613938643131353034646230396632386433366365
|
||||||
38386339393164363863373838303839353532346238643163616635363064343435393933303234
|
38616436346232363563336439613939313464323861616530633962316634363462373530613665
|
||||||
64306431623738656434333766343263653865393935626466353433386463623739393130386332
|
63653636646565303664326631363535373037663734663965346430363831613431613365393832
|
||||||
32623762353665393863383762643035313266643863363062626332316439616639616333623730
|
62373030336262643430313635626261613232656236333130396537633238623265363932333966
|
||||||
35373662316131393836333936656438316334363364323339343236376634323365386461373061
|
34326135363762396564613064323135313663613565646461376162306532643433333336666532
|
||||||
38363335353965646563646231653434623531336465333231396530623365306137643931633238
|
65383661303137613335653336663666653463623565386137326662653839633536326135633764
|
||||||
32663937616366393237623861323337623963353964313233353433643733313730666239373031
|
33623437333931393737363061356235336232376437643131373531356566323336306138353561
|
||||||
62316338623734303839616639303539643439613062656438633563653337626364316535373661
|
66333863313461613930383231663162616261616639323238646439656166666261626533636161
|
||||||
32313337366465656533653766356436623638316534623666346666646364633436656330663666
|
38333362393033316266633364313739366262636530363937386137616234326638303137613433
|
||||||
38636439333834313639316663326630356531613432353837616465353763623335623464363734
|
65313962653566333364383732386165396136303666383439303064326463346563663434646364
|
||||||
34366335656366323634636465353563633532616334636665396439326438656462386336326265
|
62396130646632653039383661613638303162363538376236666338623865366639663138363636
|
||||||
32393131636362633230366330633564376165313830616134393931613566383433646632363536
|
36373766386234383465316635323931356233366262386135363238366538623135623361386436
|
||||||
39636563313662656439613565353663613962653730313666636263373065613230313965336130
|
64653533646233653463656334633566373433303365353965663732636566663332343337626337
|
||||||
30346637323565333139643332336239646636643037316436373134663232373738363564613633
|
34623861373562386264346430333133343631653631376366373735626664363965666561306262
|
||||||
64396330316332616631346339323466376162336539656433353666643438323365663665623661
|
35666235653235346233636361383566616533646662333662323139313865383264633734643263
|
||||||
33656162643163323161373931353963303934643532343561643838336236386139316334636161
|
63656431393834633935613430643839613433326431666665323136376562333737383862313261
|
||||||
38316239356165373036306464313066623432383037613134633364373762313639366330306333
|
65656431336439303563373833343965323965346439636131633366633431393032613963666539
|
||||||
66643139336436643535353466393830363136386431373962656165633465326135616430316634
|
38326539343132326334316233323362633835356265333031663066643535363639623031336362
|
||||||
39333966373361613433333631353334343765643435353466626536636437333739353036346635
|
64346230383638363763323462386261666266623134393139303264343234623132323437396630
|
||||||
64346235336132393030666531343761366562396233386236356332343963363438373535633065
|
66363738376133393731616535653230303262313937373333353932303038626166346366303163
|
||||||
64643730333465316439363735396566636338303236623438393566316533613333396561353930
|
66613831353731373165636532363165356561383137626437333563616561386666623234313438
|
||||||
66633631303336346333306332663639643138656636373266353061623234386339313266376564
|
37333435306530323235393164383138346131653235633536383636316161316238313064636261
|
||||||
37376130336230366630396335343330663162396237366131306237663232316361633939333365
|
33353963333430383236303038333939316637326130396430623964633338353863613534653663
|
||||||
36366234663735393664353934303930616566336133313664313538326136343363323530343865
|
30333839393230626261663966616230303330636335323565663938343562666663303536636332
|
||||||
63663633383338323363353061393366353064346232623464333863666334616636333662323265
|
34336665323764663163653161373166313631393534326532613538313637313136356336313433
|
||||||
35653761323965376364343362643734646439373237333632373736353436326133376663346132
|
34353036653738343433613763383137336562373332333062326134626638633938336364376131
|
||||||
38373530333137323038653534623761353265313336303538376565626363626535663635313235
|
61303435333163663636653135363162303663663266393438656430306532343438386436343735
|
||||||
35663765376334366661383764663066383232323431623262626662623138323431383863363736
|
31343231653263373532386263653263386435363633396638396164323539306233303562303862
|
||||||
66366462303838656234373263653835373666623934633865353533316537363431646661636433
|
3339306136613431636138333266633739323666633431363039
|
||||||
30383862626636613636323639313063323632323731613134303863356166613137363538333466
|
|
||||||
65666635666563616464616538343639363331336233663038616332663032616364393761343036
|
|
||||||
61373636623331636136313038333661613339623763663132306131663665663237363730646339
|
|
||||||
36363766376437643930663363333635666366343431376439613961353039663938303834316433
|
|
||||||
34326235386164373130643533373566653061366636623565303361666234616530346561386239
|
|
||||||
37346337336137663366353632323434343263636435313034646639376430633133626466343737
|
|
||||||
61656334656639393239633361316635646665633532323461663432633135353264383666666438
|
|
||||||
33306336343732643234623430653538613064653635363765303166303061316636393736663561
|
|
||||||
66393935663835633437326265656239353730626262333038616633326138623261343864613161
|
|
||||||
35333233613163666461323339663063646361646563653531356337373663343166613965366232
|
|
||||||
65313839633730386436633962373434643636396264646431653639343361363335633633383062
|
|
||||||
34356232366132346537313838663730323336613661376331636363353464316266633336383639
|
|
||||||
30373564333265653839666161643366313163356161356237383133636130333330316430613632
|
|
||||||
34376338383561613635323030613731636637653961646632363838316665313934646130663361
|
|
||||||
65633232396539646337333061326234316534333866383830343632306331663631343864313236
|
|
||||||
65613932643938313161353331613634656230303863653037343434373862353462336134646637
|
|
||||||
32616266353730336663613865316164626364303262663461363436323133653663636665323134
|
|
||||||
30306431336637663130
|
|
||||||
|
|||||||
@@ -13,13 +13,13 @@
|
|||||||
|
|
||||||
- hosts: all
|
- hosts: all
|
||||||
user: provisioning
|
user: provisioning
|
||||||
become: yes
|
become: true
|
||||||
vars_files:
|
vars_files:
|
||||||
- "../vars/{{ ansible_distribution }}.yml"
|
- "../vars/{{ ansible_distribution }}.yml"
|
||||||
|
|
||||||
tasks:
|
tasks:
|
||||||
- name: Set password, shell, homedir for provisioning user
|
- name: Set password, shell, homedir for provisioning user
|
||||||
when: provisioning_user is defined
|
when: provisioning_user is defined
|
||||||
user: name={{ provisioning_user.name }} password={{ provisioning_user.password }} shell={{ provisioning_user.shell }} state={{ provisioning_user.state }} createhome=no
|
user: name={{ provisioning_user.name }} password={{ provisioning_user.password }} shell={{ provisioning_user.shell }} state={{ provisioning_user.state }} createhome=false
|
||||||
|
|
||||||
# vim: set sw=2 ts=2:
|
# vim: set sw=2 ts=2:
|
||||||
|
|||||||
@@ -2,7 +2,7 @@
|
|||||||
# file: nomads.yml
|
# file: nomads.yml
|
||||||
|
|
||||||
- hosts: nomads
|
- hosts: nomads
|
||||||
become: yes
|
become: true
|
||||||
roles:
|
roles:
|
||||||
- common
|
- common
|
||||||
- munin
|
- munin
|
||||||
|
|||||||
11
roles/caddy/defaults/main.yml
Normal file
11
roles/caddy/defaults/main.yml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
---
|
||||||
|
# file: roles/caddy/defaults/main.yml
|
||||||
|
|
||||||
|
# parent directory of vhost document roots
|
||||||
|
caddy_root_prefix: "{{ web_root_prefix }}"
|
||||||
|
|
||||||
|
# Email address to use for the ACME account managing the site's certificates.
|
||||||
|
# Not sure what Caddy does if this doesn't exist.
|
||||||
|
caddy_email: foo@example.com
|
||||||
|
|
||||||
|
# vim: set ts=2 sw=2:
|
||||||
10
roles/caddy/handlers/main.yml
Normal file
10
roles/caddy/handlers/main.yml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
---
|
||||||
|
# file: roles/caddy/handlers/main.yml
|
||||||
|
|
||||||
|
# I'm currently not sure when we need to restart versus reload
|
||||||
|
- name: reload caddy
|
||||||
|
ansible.builtin.systemd_service:
|
||||||
|
name: caddy
|
||||||
|
state: reloaded
|
||||||
|
|
||||||
|
# vim: set sw=2 ts=2:
|
||||||
82
roles/caddy/tasks/main.yml
Normal file
82
roles/caddy/tasks/main.yml
Normal file
@@ -0,0 +1,82 @@
|
|||||||
|
---
|
||||||
|
# file: roles/caddy/tasks/main.yml
|
||||||
|
#
|
||||||
|
# Configure Caddy.
|
||||||
|
|
||||||
|
- name: Check Caddy package signing key
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: /etc/apt/keyrings/caddy-stable-archive-keyring.key
|
||||||
|
register: caddy_signing_key_stat
|
||||||
|
tags:
|
||||||
|
- packages
|
||||||
|
- caddy
|
||||||
|
|
||||||
|
# See: https://caddyserver.com/docs/install#debian-ubuntu-raspbian
|
||||||
|
- name: Download Caddy package signing key
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: https://dl.cloudsmith.io/public/caddy/stable/gpg.key
|
||||||
|
dest: /etc/apt/keyrings/caddy-stable-archive-keyring.key
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
register: download_caddy_signing_key
|
||||||
|
when: not caddy_signing_key_stat.stat.exists
|
||||||
|
tags:
|
||||||
|
- packages
|
||||||
|
- caddy
|
||||||
|
|
||||||
|
- name: Add Caddy stable repo
|
||||||
|
ansible.builtin.apt_repository:
|
||||||
|
repo: deb [signed-by=/etc/apt/keyrings/caddy-stable-archive-keyring.key] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main
|
||||||
|
filename: caddy-stable
|
||||||
|
state: present
|
||||||
|
register: add_caddy_apt_repository
|
||||||
|
tags:
|
||||||
|
- packages
|
||||||
|
- caddy
|
||||||
|
|
||||||
|
- name: Update apt cache
|
||||||
|
ansible.builtin.apt: # noqa no-handler
|
||||||
|
update_cache: true
|
||||||
|
when: (download_caddy_signing_key.status_code is defined and download_caddy_signing_key.status_code == 200) or add_caddy_apt_repository is changed
|
||||||
|
tags:
|
||||||
|
- packages
|
||||||
|
- caddy
|
||||||
|
|
||||||
|
- name: Install Caddy
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: caddy
|
||||||
|
state: present
|
||||||
|
install_recommends: false
|
||||||
|
cache_valid_time: 3600
|
||||||
|
tags:
|
||||||
|
- caddy
|
||||||
|
- packages
|
||||||
|
|
||||||
|
- name: Create Caddyfile
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: etc/caddy/Caddyfile.j2
|
||||||
|
dest: /etc/caddy/Caddyfile
|
||||||
|
mode: "0755"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
notify:
|
||||||
|
- reload caddy
|
||||||
|
tags: caddy
|
||||||
|
|
||||||
|
- name: Create Caddy conf.d directory
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /etc/caddy/conf.d
|
||||||
|
state: directory
|
||||||
|
mode: "0755"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
tags: caddy
|
||||||
|
|
||||||
|
# TODO: the variable is still named nginx_vhosts
|
||||||
|
- name: Configure Caddy virtual hosts
|
||||||
|
ansible.builtin.include_tasks: vhosts.yml
|
||||||
|
when: nginx_vhosts is defined
|
||||||
|
tags: caddy
|
||||||
|
|
||||||
|
# vim: set sw=2 ts=2:
|
||||||
14
roles/caddy/tasks/vhosts.yml
Normal file
14
roles/caddy/tasks/vhosts.yml
Normal file
@@ -0,0 +1,14 @@
|
|||||||
|
---
|
||||||
|
- name: Configure vhosts
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: etc/caddy/conf.d/vhost.j2
|
||||||
|
dest: /etc/caddy/conf.d/{{ item.domain_name }}
|
||||||
|
mode: "0644"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
loop: "{{ nginx_vhosts }}"
|
||||||
|
notify:
|
||||||
|
- reload caddy
|
||||||
|
tags: caddy
|
||||||
|
|
||||||
|
# vim: set ts=2 sw=2:
|
||||||
29
roles/caddy/templates/etc/caddy/Caddyfile.j2
Normal file
29
roles/caddy/templates/etc/caddy/Caddyfile.j2
Normal file
@@ -0,0 +1,29 @@
|
|||||||
|
# Global options
|
||||||
|
{
|
||||||
|
email {{ caddy_email }}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Common security response headers
|
||||||
|
(security-headers) {
|
||||||
|
header {
|
||||||
|
# disable Google FLoC tracking
|
||||||
|
Permissions-Policy interest-cohort=()
|
||||||
|
|
||||||
|
# enable HSTS
|
||||||
|
Strict-Transport-Security max-age=31536000
|
||||||
|
|
||||||
|
# disable clients from sniffing the media type
|
||||||
|
X-Content-Type-Options nosniff
|
||||||
|
|
||||||
|
# clickjacking protection: refuse to allow rendering this page
|
||||||
|
# in a frame, iframe, etc.
|
||||||
|
X-Frame-Options DENY
|
||||||
|
|
||||||
|
# keep referrer data off of HTTP connections
|
||||||
|
Referrer-Policy no-referrer-when-downgrade
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Import additional caddy config files in /etc/caddy/conf.d/
|
||||||
|
# Note: these are imported in lexical sort order!
|
||||||
|
import /etc/caddy/conf.d/*
|
||||||
46
roles/caddy/templates/etc/caddy/conf.d/vhost.j2
Normal file
46
roles/caddy/templates/etc/caddy/conf.d/vhost.j2
Normal file
@@ -0,0 +1,46 @@
|
|||||||
|
{{ ansible_managed | comment }}
|
||||||
|
|
||||||
|
{# helper variables and per-site defaults that we can't set in role defaults #}
|
||||||
|
{% set domain_name = item.domain_name %}
|
||||||
|
{% set domain_aliases = item.domain_aliases | default("") %}
|
||||||
|
{# assume optional features are off unless a vhost explicitly sets them #}
|
||||||
|
{% set has_wordpress = item.has_wordpress | default(false) %}
|
||||||
|
{% set needs_php = item.needs_php | default(false) %}
|
||||||
|
{% set has_gitea = item.has_gitea | default(false) %}
|
||||||
|
{% set static_site = item.static_site | default(false) %}
|
||||||
|
{# Allow sites to override the document root #}
|
||||||
|
{% if item.document_root is defined %}
|
||||||
|
{% set document_root = item.document_root %}
|
||||||
|
{% else %}
|
||||||
|
{% set document_root = (caddy_root_prefix, domain_name) | ansible.builtin.path_join %}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
{% if domain_aliases %}
|
||||||
|
{# domain_aliases is a string, so we split on space #}
|
||||||
|
{% for domain in domain_aliases | split (' ') %}
|
||||||
|
{{ domain }} {
|
||||||
|
redir https://{{domain_name}}{uri}
|
||||||
|
}
|
||||||
|
{% endfor %}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
{{ domain_name }} {
|
||||||
|
{% if has_gitea %}
|
||||||
|
reverse_proxy :3000
|
||||||
|
{% elif static_site -%}
|
||||||
|
root * {{ document_root }}
|
||||||
|
|
||||||
|
encode
|
||||||
|
|
||||||
|
file_server
|
||||||
|
{% elif has_wordpress -%}
|
||||||
|
root * {{ document_root }}
|
||||||
|
encode
|
||||||
|
{% if ansible_distribution_major_version is version('12', '==') -%}
|
||||||
|
php_fastcgi unix//run/php/php8.2-fpm-{{ domain_name }}.sock
|
||||||
|
{% endif -%}
|
||||||
|
file_server
|
||||||
|
{% endif -%}
|
||||||
|
|
||||||
|
import security-headers
|
||||||
|
}
|
||||||
@@ -8,6 +8,10 @@ fail2ban_maxretry: 6
|
|||||||
fail2ban_findtime: 3600
|
fail2ban_findtime: 3600
|
||||||
# 2 weeks in seconds
|
# 2 weeks in seconds
|
||||||
fail2ban_bantime: 1209600
|
fail2ban_bantime: 1209600
|
||||||
fail2ban_ignoreip: 127.0.0.1/8 172.26.0.0/16 192.168.5.0/24
|
fail2ban_ignoreip: 127.0.0.0/8
|
||||||
|
|
||||||
|
# Disable SSH passwords. Must use SSH keys. This is OK because we add the keys
|
||||||
|
# before re-configuring the SSH daemon to disable passwords.
|
||||||
|
ssh_password_authentication: disabled
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
@@ -1,5 +0,0 @@
|
|||||||
#!/usr/sbin/nft -f
|
|
||||||
|
|
||||||
define ABUSEIPDB_IPV6 = {
|
|
||||||
fe80::bca2:37fa:fe58:414e
|
|
||||||
}
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -1,6 +0,0 @@
|
|||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<ipset type="hash:ip">
|
|
||||||
<option name="family" value="inet6" />
|
|
||||||
<short>abusers-ipv6</short>
|
|
||||||
<description>A list of abusive IPv6 addresses.</description>
|
|
||||||
</ipset>
|
|
||||||
@@ -1,89 +0,0 @@
|
|||||||
#!/usr/bin/perl
|
|
||||||
#
|
|
||||||
# aggregate-cidr-addresses - combine a list of CIDR address blocks
|
|
||||||
# Copyright (C) 2001,2007 Mark Suter <suter@zwitterion.org>
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, either version 3 of the License, or
|
|
||||||
# (at your option) any later version.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see L<http://www.gnu.org/licenses/>.
|
|
||||||
#
|
|
||||||
# [MJS 22 Oct 2001] Aggregate CIDR addresses
|
|
||||||
# [MJS 9 Oct 2007] Overlap idea from Anthony Ledesma at theplanet dot com.
|
|
||||||
# [MJS 16 Feb 2012] Prompted to clarify license by Alexander Talos-Zens - at at univie dot ac dot at
|
|
||||||
# [MJS 21 Feb 2012] IPv6 fixes by Alexander Talos-Zens
|
|
||||||
# [MJS 21 Feb 2012] Split ranges into prefixes (fixes a 10+ year old bug)
|
|
||||||
|
|
||||||
use strict;
|
|
||||||
use warnings;
|
|
||||||
use English qw( -no_match_vars );
|
|
||||||
use Net::IP;
|
|
||||||
|
|
||||||
## Read in all the IP addresses
|
|
||||||
my @addrs = map { Net::IP->new($_) or die "$PROGRAM_NAME: Not an IP: \"$_\"."; }
|
|
||||||
map { / \A \s* (.+?) \s* \Z /msix and $1; } <>;
|
|
||||||
|
|
||||||
## Split any ranges into prefixes
|
|
||||||
@addrs = map {
|
|
||||||
defined $_->prefixlen ? $_ : map { Net::IP->new($_) }
|
|
||||||
$_->find_prefixes
|
|
||||||
} @addrs;
|
|
||||||
|
|
||||||
## Sort the IP addresses
|
|
||||||
@addrs = sort { $a->version <=> $b->version or $a->bincomp( 'lt', $b ) ? -1 : $a->bincomp( 'gt', $b ) ? 1 : 0 } @addrs;
|
|
||||||
|
|
||||||
## Handle overlaps
|
|
||||||
my $count = 0;
|
|
||||||
my $current = $addrs[0];
|
|
||||||
foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
|
|
||||||
my $r = $current->overlaps($next);
|
|
||||||
if ( $current->version != $next->version or $r == $IP_NO_OVERLAP ) {
|
|
||||||
$current = $next;
|
|
||||||
$count++;
|
|
||||||
}
|
|
||||||
elsif ( $r == $IP_A_IN_B_OVERLAP ) {
|
|
||||||
$current = $next;
|
|
||||||
splice @addrs, $count, 1;
|
|
||||||
}
|
|
||||||
elsif ( $r == $IP_B_IN_A_OVERLAP or $r == $IP_IDENTICAL ) {
|
|
||||||
splice @addrs, $count + 1, 1;
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
die "$PROGRAM_NAME: internal error - overlaps() returned an unexpected value!\n";
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
## Keep aggregating until we don't change anything
|
|
||||||
my $change = 1;
|
|
||||||
while ($change) {
|
|
||||||
$change = 0;
|
|
||||||
my @new_addrs = ();
|
|
||||||
$current = $addrs[0];
|
|
||||||
foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
|
|
||||||
if ( my $total = $current->aggregate($next) ) {
|
|
||||||
$current = $total;
|
|
||||||
$change = 1;
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
push @new_addrs, $current;
|
|
||||||
$current = $next;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
push @new_addrs, $current;
|
|
||||||
@addrs = @new_addrs;
|
|
||||||
}
|
|
||||||
|
|
||||||
## Print out the IP addresses
|
|
||||||
foreach (@addrs) {
|
|
||||||
print $_->prefix(), "\n";
|
|
||||||
}
|
|
||||||
|
|
||||||
# $Id: aggregate-cidr-addresses,v 1.9 2012/02/21 10:14:22 suter Exp suter $
|
|
||||||
@@ -1,2 +0,0 @@
|
|||||||
autoclean -y
|
|
||||||
upgrade -y -o APT::Get::Show-Upgraded=true
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
# Configuration for cron-apt. For further information about the possible
|
|
||||||
# configuration settings see the README file.
|
|
||||||
|
|
||||||
MAILON="never"
|
|
||||||
OPTIONS="-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list -o Dir::Etc::SourceParts=\"/dev/null\""
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
provisioning ALL=(ALL) ALL
|
|
||||||
@@ -1,5 +1,5 @@
|
|||||||
#!/usr/sbin/nft -f
|
#!/usr/sbin/nft -f
|
||||||
|
|
||||||
define SPAMHAUS_IPV4 = {
|
define FIREHOL_LEVEL1_IPV4 = {
|
||||||
192.168.254.254/32
|
192.168.254.254/32
|
||||||
}
|
}
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<ipset type="hash:net">
|
|
||||||
<option name="family" value="inet" />
|
|
||||||
<short>spamhaus-ipv4</short>
|
|
||||||
<description>Spamhaus DROP and EDROP lists placeholder (IPv4).</description>
|
|
||||||
</ipset>
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
#!/usr/sbin/nft -f
|
|
||||||
|
|
||||||
define SPAMHAUS_IPV6 = {
|
|
||||||
fd21:3523:74e0:7301::/64
|
|
||||||
}
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<ipset type="hash:net">
|
|
||||||
<option name="family" value="inet6" />
|
|
||||||
<short>spamhaus-ipv6</short>
|
|
||||||
<description>Spamhaus DROP list placeholder (IPv6).</description>
|
|
||||||
</ipset>
|
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmRO6E0G4Ls3TifVfJ+mQjlfWiBZNJfsSXGhwQ/HA1M aorth@balozi
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=Update Abuse.ch SSL Blacklist IPs
|
|
||||||
# This service will fail if nftables is not running so we use Requires to make
|
|
||||||
# sure that nftables is started.
|
|
||||||
Requires=nftables.service
|
|
||||||
# Make sure the network is up and nftables is started
|
|
||||||
After=network-online.target nftables.service
|
|
||||||
Wants=network-online.target update-abusech-nftables.timer
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
|
||||||
# Doesn't need access to /home or /root
|
|
||||||
ProtectHome=true
|
|
||||||
# Possibly only works on Ubuntu 18.04+
|
|
||||||
ProtectKernelTunables=true
|
|
||||||
ProtectSystem=full
|
|
||||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
|
||||||
ReadWriteDirectories=/etc/nftables
|
|
||||||
PrivateTmp=true
|
|
||||||
WorkingDirectory=/var/tmp
|
|
||||||
|
|
||||||
SyslogIdentifier=update-abusech-nftables
|
|
||||||
ExecStart=/usr/bin/flock -x update-abusech-nftables.lck \
|
|
||||||
/usr/local/bin/update-abusech-nftables.sh
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
@@ -1,63 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
#
|
|
||||||
# update-abuseipdb-nftables.sh v0.0.1
|
|
||||||
#
|
|
||||||
# Download IP addresses seen using a blacklisted SSL certificate and load them
|
|
||||||
# into nftables sets. As of 2021-07-28 these appear to only be IPv4.
|
|
||||||
#
|
|
||||||
# See: https://sslbl.abuse.ch/blacklist
|
|
||||||
#
|
|
||||||
# Copyright (C) 2021 Alan Orth
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: GPL-3.0-only
|
|
||||||
|
|
||||||
# Exit on first error
|
|
||||||
set -o errexit
|
|
||||||
|
|
||||||
abusech_ipv4_set_path=/etc/nftables/abusech-ipv4.nft
|
|
||||||
abusech_list_temp=$(mktemp)
|
|
||||||
|
|
||||||
echo "Downloading Abuse.sh SSL Blacklist IPs"
|
|
||||||
|
|
||||||
abusech_response=$(curl -s -G -w "%{http_code}\n" https://sslbl.abuse.ch/blacklist/sslipblacklist.txt --output "$abusech_list_temp")
|
|
||||||
|
|
||||||
if [[ $abusech_response -ne 200 ]]; then
|
|
||||||
echo "Abuse.ch responded: HTTP $abusech_response"
|
|
||||||
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -f "$abusech_list_temp" ]]; then
|
|
||||||
echo "Processing IPv4 list"
|
|
||||||
|
|
||||||
abusech_ipv4_list_temp=$(mktemp)
|
|
||||||
abusech_ipv4_set_temp=$(mktemp)
|
|
||||||
|
|
||||||
# Remove comments, DOS carriage returns, and IPv6 addresses (even though
|
|
||||||
# Abuse.ch seems to only have IPv4 addresses, let's not break our shit on
|
|
||||||
# that assumption some time down the line).
|
|
||||||
sed -e '/#/d' -e 's/
|
|
||||||
//' -e '/:/d' "$abusech_list_temp" > "$abusech_ipv4_list_temp"
|
|
||||||
|
|
||||||
echo "Building abusech-ipv4 set"
|
|
||||||
cat << NFT_HEAD > "$abusech_ipv4_set_temp"
|
|
||||||
#!/usr/sbin/nft -f
|
|
||||||
|
|
||||||
define ABUSECH_IPV4 = {
|
|
||||||
NFT_HEAD
|
|
||||||
|
|
||||||
while read -r network; do
|
|
||||||
# nftables doesn't mind if the last element in the set has a trailing
|
|
||||||
# comma so we don't need to do anything special here.
|
|
||||||
echo "$network," >> "$abusech_ipv4_set_temp"
|
|
||||||
done < $abusech_ipv4_list_temp
|
|
||||||
|
|
||||||
echo "}" >> "$abusech_ipv4_set_temp"
|
|
||||||
|
|
||||||
install -m 0600 "$abusech_ipv4_set_temp" "$abusech_ipv4_set_path"
|
|
||||||
|
|
||||||
rm -f "$abusech_list_temp" "$abusech_ipv4_list_temp" "$abusech_ipv4_set_temp"
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Reloading nftables"
|
|
||||||
# The abusech nftables sets are included by nftables.conf
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=Update Abuse.ch SSL Blacklist IPs
|
|
||||||
|
|
||||||
[Timer]
|
|
||||||
# Once a day at midnight
|
|
||||||
OnCalendar=*-*-* 00:00:00
|
|
||||||
# Add a random delay of 0–3600 seconds
|
|
||||||
RandomizedDelaySec=3600
|
|
||||||
Persistent=true
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=timers.target
|
|
||||||
24
roles/common/files/update-firehol-nftables.service
Normal file
24
roles/common/files/update-firehol-nftables.service
Normal file
@@ -0,0 +1,24 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Update FireHOL lists
|
||||||
|
# Make sure the network is up
|
||||||
|
After=network-online.target
|
||||||
|
Wants=network-online.target update-firehol-nftables.timer
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
||||||
|
# Doesn't need access to /home or /root
|
||||||
|
ProtectHome=true
|
||||||
|
# Possibly only works on Ubuntu 18.04+
|
||||||
|
ProtectKernelTunables=true
|
||||||
|
ProtectSystem=full
|
||||||
|
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
||||||
|
ReadWriteDirectories=/etc/nftables
|
||||||
|
PrivateTmp=true
|
||||||
|
WorkingDirectory=/var/tmp
|
||||||
|
|
||||||
|
SyslogIdentifier=update-firehol-nftables
|
||||||
|
ExecStart=/usr/bin/flock -x update-firehol-nftables.lck \
|
||||||
|
/usr/local/bin/update-firehol-nftables.sh
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
@@ -1,5 +1,5 @@
|
|||||||
[Unit]
|
[Unit]
|
||||||
Description=Update Spamhaus lists
|
Description=Update FireHOL lists
|
||||||
|
|
||||||
[Timer]
|
[Timer]
|
||||||
# Once a day at midnight
|
# Once a day at midnight
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=Update Spamhaus lists
|
|
||||||
# This service will fail if firewalld is not running so we use Requires to make
|
|
||||||
# sure that firewalld is started.
|
|
||||||
Requires=firewalld.service
|
|
||||||
# Make sure the network is up and firewalld is started
|
|
||||||
After=network-online.target firewalld.service
|
|
||||||
Wants=network-online.target update-spamhaus-lists.timer
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
|
||||||
# Doesn't need access to /home or /root
|
|
||||||
ProtectHome=true
|
|
||||||
# Possibly only works on Ubuntu 18.04+
|
|
||||||
ProtectKernelTunables=true
|
|
||||||
ProtectSystem=full
|
|
||||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
|
||||||
ReadWriteDirectories=/etc/firewalld/ipsets
|
|
||||||
PrivateTmp=true
|
|
||||||
WorkingDirectory=/var/tmp
|
|
||||||
|
|
||||||
SyslogIdentifier=update-spamhaus-lists
|
|
||||||
ExecStart=/usr/bin/flock -x update-spamhaus-lists.lck \
|
|
||||||
/usr/local/bin/update-spamhaus-lists.sh
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
@@ -1,107 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
#
|
|
||||||
# update-spamhaus-lists.sh v0.0.5
|
|
||||||
#
|
|
||||||
# Download Spamhaus DROP lists and load them into firewalld ipsets. Should work
|
|
||||||
# with both the iptables and nftables backends.
|
|
||||||
#
|
|
||||||
# See: https://www.spamhaus.org/drop/
|
|
||||||
#
|
|
||||||
# Copyright (C) 2021 Alan Orth
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: GPL-3.0-only
|
|
||||||
|
|
||||||
# Exit on first error
|
|
||||||
set -o errexit
|
|
||||||
|
|
||||||
firewalld_ipsets=$(firewall-cmd --get-ipsets)
|
|
||||||
xml_temp=$(mktemp)
|
|
||||||
spamhaus_ipv4_ipset_path=/etc/firewalld/ipsets/spamhaus-ipv4.xml
|
|
||||||
spamhaus_ipv6_ipset_path=/etc/firewalld/ipsets/spamhaus-ipv6.xml
|
|
||||||
|
|
||||||
function download() {
|
|
||||||
echo "Downloading $1"
|
|
||||||
wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
|
|
||||||
}
|
|
||||||
|
|
||||||
download drop.txt
|
|
||||||
download edrop.txt
|
|
||||||
download dropv6.txt
|
|
||||||
|
|
||||||
if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
|
|
||||||
echo "Processing IPv4 DROP lists"
|
|
||||||
|
|
||||||
# Extract all networks from drop.txt and edrop.txt, skipping blank lines and
|
|
||||||
# comments.
|
|
||||||
networks=$(cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//')
|
|
||||||
|
|
||||||
# If firewalld already has this ipset we should delete it first to emulate
|
|
||||||
# `ipset flush` (but I don't want to use that because newer hosts might be
|
|
||||||
# using nftables and firewalld will handle that for us).
|
|
||||||
if [[ "$firewalld_ipsets" =~ spamhaus-ipv4 ]]; then
|
|
||||||
echo "Deleting existing spamhaus-ipv4 ipset"
|
|
||||||
# This deletes the firewalld ipset XML file as well as the ipset itself
|
|
||||||
firewall-cmd --permanent --delete-ipset=spamhaus-ipv4
|
|
||||||
else
|
|
||||||
echo "Creating placeholder spamhaus-ipv4 ipset"
|
|
||||||
# Create a placeholder ipset so firewalld doesn't complain when we try
|
|
||||||
# to reload the ipset later after having added a new XML definition. I
|
|
||||||
# don't know why, but depending on the system state there may not be a
|
|
||||||
# ipset defined and firewalld errors on INVALID_IPSET.
|
|
||||||
firewall-cmd --permanent --new-ipset=spamhaus-ipv4 --type=hash:net --option=family=inet
|
|
||||||
fi
|
|
||||||
|
|
||||||
# I'm not proud of this, but writing the XML directly is WAY faster than
|
|
||||||
# using firewall-cmd to add each entry one by one (and we can't add from
|
|
||||||
# a file because many of our hosts are using old firewalld).
|
|
||||||
cat << XML_HEAD > "$xml_temp"
|
|
||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<ipset type="hash:net">
|
|
||||||
<option name="family" value="inet" />
|
|
||||||
<short>spamhaus-ipv4</short>
|
|
||||||
<description>Spamhaus DROP and EDROP lists (IPv4).</description>
|
|
||||||
XML_HEAD
|
|
||||||
|
|
||||||
for network in $networks; do
|
|
||||||
echo " <entry>$network</entry>" >> "$xml_temp"
|
|
||||||
done
|
|
||||||
|
|
||||||
echo "</ipset>" >> "$xml_temp"
|
|
||||||
|
|
||||||
install -m 0600 "$xml_temp" "$spamhaus_ipv4_ipset_path"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -f "dropv6.txt" ]]; then
|
|
||||||
echo "Processing IPv6 DROP list"
|
|
||||||
|
|
||||||
networks=$(sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt)
|
|
||||||
|
|
||||||
if [[ "$firewalld_ipsets" =~ spamhaus-ipv6 ]]; then
|
|
||||||
echo "Deleting existing spamhaus-ipv6 ipset"
|
|
||||||
firewall-cmd --permanent --delete-ipset=spamhaus-ipv6
|
|
||||||
else
|
|
||||||
echo "Creating placeholder spamhaus-ipv6 ipset"
|
|
||||||
firewall-cmd --permanent --new-ipset=spamhaus-ipv6 --type=hash:net --option=family=inet6
|
|
||||||
fi
|
|
||||||
|
|
||||||
cat << XML_HEAD > "$xml_temp"
|
|
||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<ipset type="hash:net">
|
|
||||||
<option name="family" value="inet6" />
|
|
||||||
<short>spamhaus-ipv6</short>
|
|
||||||
<description>Spamhaus DROP lists (IPv6).</description>
|
|
||||||
XML_HEAD
|
|
||||||
|
|
||||||
for network in $networks; do
|
|
||||||
echo " <entry>$network</entry>" >> "$xml_temp"
|
|
||||||
done
|
|
||||||
|
|
||||||
echo "</ipset>" >> "$xml_temp"
|
|
||||||
|
|
||||||
install -m 0600 "$xml_temp" "$spamhaus_ipv6_ipset_path"
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Reloading firewalld"
|
|
||||||
firewall-cmd --reload
|
|
||||||
|
|
||||||
rm -v drop.txt edrop.txt dropv6.txt "$xml_temp"
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=Update Spamhaus lists
|
|
||||||
# This service will fail if nftables is not running so we use Requires to make
|
|
||||||
# sure that nftables is started.
|
|
||||||
Requires=nftables.service
|
|
||||||
# Make sure the network is up and nftables is started
|
|
||||||
After=network-online.target nftables.service
|
|
||||||
Wants=network-online.target update-spamhaus-nftables.timer
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
# https://www.ctrl.blog/entry/systemd-service-hardening.html
|
|
||||||
# Doesn't need access to /home or /root
|
|
||||||
ProtectHome=true
|
|
||||||
# Possibly only works on Ubuntu 18.04+
|
|
||||||
ProtectKernelTunables=true
|
|
||||||
ProtectSystem=full
|
|
||||||
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
|
|
||||||
ReadWriteDirectories=/etc/nftables
|
|
||||||
PrivateTmp=true
|
|
||||||
WorkingDirectory=/var/tmp
|
|
||||||
|
|
||||||
SyslogIdentifier=update-spamhaus-nftables
|
|
||||||
ExecStart=/usr/bin/flock -x update-spamhaus-nftables.lck \
|
|
||||||
/usr/local/bin/update-spamhaus-nftables.sh
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
@@ -1,91 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
#
|
|
||||||
# update-spamhaus-nftables.sh v0.0.1
|
|
||||||
#
|
|
||||||
# Download Spamhaus DROP lists and load them into nftables sets.
|
|
||||||
#
|
|
||||||
# See: https://www.spamhaus.org/drop/
|
|
||||||
#
|
|
||||||
# Copyright (C) 2021 Alan Orth
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: GPL-3.0-only
|
|
||||||
|
|
||||||
# Exit on first error
|
|
||||||
set -o errexit
|
|
||||||
|
|
||||||
spamhaus_ipv4_set_path=/etc/nftables/spamhaus-ipv4.nft
|
|
||||||
spamhaus_ipv6_set_path=/etc/nftables/spamhaus-ipv6.nft
|
|
||||||
|
|
||||||
function download() {
|
|
||||||
echo "Downloading $1"
|
|
||||||
wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
|
|
||||||
}
|
|
||||||
|
|
||||||
download drop.txt
|
|
||||||
download edrop.txt
|
|
||||||
download dropv6.txt
|
|
||||||
|
|
||||||
if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
|
|
||||||
echo "Processing IPv4 DROP lists"
|
|
||||||
|
|
||||||
spamhaus_ipv4_list_temp=$(mktemp)
|
|
||||||
spamhaus_ipv4_set_temp=$(mktemp)
|
|
||||||
|
|
||||||
# Extract all networks from drop.txt and edrop.txt, skipping blank lines and
|
|
||||||
# comments. Use aggregate-cidr-addresses.pl to merge overlapping IPv4 CIDR
|
|
||||||
# ranges to work around a firewalld bug.
|
|
||||||
#
|
|
||||||
# See: https://bugzilla.redhat.com/show_bug.cgi?id=1836571
|
|
||||||
cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' | aggregate-cidr-addresses.pl > "$spamhaus_ipv4_list_temp"
|
|
||||||
|
|
||||||
echo "Building spamhaus-ipv4 set"
|
|
||||||
cat << NFT_HEAD > "$spamhaus_ipv4_set_temp"
|
|
||||||
#!/usr/sbin/nft -f
|
|
||||||
|
|
||||||
define SPAMHAUS_IPV4 = {
|
|
||||||
NFT_HEAD
|
|
||||||
|
|
||||||
while read -r network; do
|
|
||||||
# nftables doesn't mind if the last element in the set has a trailing
|
|
||||||
# comma so we don't need to do anything special here.
|
|
||||||
echo "$network," >> "$spamhaus_ipv4_set_temp"
|
|
||||||
done < $spamhaus_ipv4_list_temp
|
|
||||||
|
|
||||||
echo "}" >> "$spamhaus_ipv4_set_temp"
|
|
||||||
|
|
||||||
install -m 0600 "$spamhaus_ipv4_set_temp" "$spamhaus_ipv4_set_path"
|
|
||||||
|
|
||||||
rm -f "$spamhaus_ipv4_list_temp" "$spamhaus_ipv4_set_temp"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -f "dropv6.txt" ]]; then
|
|
||||||
echo "Processing IPv6 DROP lists"
|
|
||||||
|
|
||||||
spamhaus_ipv6_list_temp=$(mktemp)
|
|
||||||
spamhaus_ipv6_set_temp=$(mktemp)
|
|
||||||
|
|
||||||
sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt > "$spamhaus_ipv6_list_temp"
|
|
||||||
|
|
||||||
echo "Building spamhaus-ipv6 set"
|
|
||||||
cat << NFT_HEAD > "$spamhaus_ipv6_set_temp"
|
|
||||||
#!/usr/sbin/nft -f
|
|
||||||
|
|
||||||
define SPAMHAUS_IPV6 = {
|
|
||||||
NFT_HEAD
|
|
||||||
|
|
||||||
while read -r network; do
|
|
||||||
echo "$network," >> "$spamhaus_ipv6_set_temp"
|
|
||||||
done < $spamhaus_ipv6_list_temp
|
|
||||||
|
|
||||||
echo "}" >> "$spamhaus_ipv6_set_temp"
|
|
||||||
|
|
||||||
install -m 0600 "$spamhaus_ipv6_set_temp" "$spamhaus_ipv6_set_path"
|
|
||||||
|
|
||||||
rm -f "$spamhaus_ipv6_list_temp" "$spamhaus_ipv6_set_temp"
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Reloading nftables"
|
|
||||||
# The spamhaus nftables sets are included by nftables.conf
|
|
||||||
/usr/sbin/nft -f /etc/nftables.conf
|
|
||||||
|
|
||||||
rm -v drop.txt edrop.txt dropv6.txt
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=Update Spamhaus lists
|
|
||||||
|
|
||||||
[Timer]
|
|
||||||
# Once a day at midnight
|
|
||||||
OnCalendar=*-*-* 00:00:00
|
|
||||||
# Add a random delay of 0–3600 seconds
|
|
||||||
RandomizedDelaySec=3600
|
|
||||||
Persistent=true
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=timers.target
|
|
||||||
@@ -1,23 +1,27 @@
|
|||||||
---
|
---
|
||||||
# file: roles/common/handlers/main.yml
|
# ansible.builtin.file: roles/common/handlers/main.yml
|
||||||
|
|
||||||
- name: reload sshd
|
- name: Reload sshd
|
||||||
systemd: name={{ sshd_service_name }} state=reloaded
|
ansible.builtin.systemd_service:
|
||||||
|
name: "{{ sshd_service_name }}"
|
||||||
|
state: reloaded
|
||||||
|
|
||||||
- name: reload sysctl
|
- name: Reload sysctl
|
||||||
command: sysctl -p /etc/sysctl.conf
|
ansible.builtin.command: sysctl -p /etc/sysctl.conf
|
||||||
|
|
||||||
- name: restart firewalld
|
- name: Reload systemd
|
||||||
systemd: name=firewalld state=restarted
|
ansible.builtin.systemd_service:
|
||||||
|
daemon_reload: true
|
||||||
|
|
||||||
- name: reload systemd
|
- name: Restart nftables
|
||||||
systemd: daemon_reload=yes
|
ansible.builtin.systemd_service:
|
||||||
|
name: nftables
|
||||||
- name: restart nftables
|
state: restarted
|
||||||
systemd: name=nftables state=restarted
|
|
||||||
|
|
||||||
# 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed
|
# 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed
|
||||||
# in the order they are defined, not in the order they are listed in the task's
|
# in the order they are defined, not in the order they are listed in the task's
|
||||||
# notify statement and we must restart fail2ban after updating the firewall.
|
# notify statement and we must restart fail2ban after updating the firewall.
|
||||||
- name: restart fail2ban
|
- name: Restart fail2ban
|
||||||
systemd: name=fail2ban state=restarted
|
ansible.builtin.systemd_service:
|
||||||
|
name: fail2ban
|
||||||
|
state: restarted
|
||||||
|
|||||||
@@ -1,12 +1,17 @@
|
|||||||
---
|
---
|
||||||
|
- name: Remove cron-apt
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: cron-apt
|
||||||
|
state: absent
|
||||||
|
cache_valid_time: 3600
|
||||||
|
|
||||||
- name: Configure cron-apt (config)
|
- name: Remove cron-apt configs
|
||||||
copy: src={{ item.src }} dest={{ item.dest }} mode={{ item.mode }} owner={{ item.owner }} group={{ item.group }}
|
ansible.builtin.file:
|
||||||
|
path: "{{ item }}"
|
||||||
|
state: absent
|
||||||
loop:
|
loop:
|
||||||
- { src: 'etc/cron-apt/config', dest: '/etc/cron-apt/config', mode: '0644', owner: 'root', group: 'root' }
|
- /etc/cron-apt/config
|
||||||
- { src: 'etc/cron-apt/3-download', dest: '/etc/cron-apt/action.d/3-download', mode: '0644', owner: 'root', group: 'root' }
|
- /etc/cron-apt/action.d/3-download
|
||||||
|
- /etc/apt/security.sources.list
|
||||||
- name: Configure cron-apt (security)
|
|
||||||
template: src=security.sources.list.j2 dest=/etc/apt/security.sources.list mode=0644 owner=root group=root
|
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,25 +1,55 @@
|
|||||||
---
|
---
|
||||||
|
- name: Install fail2ban
|
||||||
|
when: ansible_distribution_version is version('11', '>=')
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name:
|
||||||
|
- fail2ban
|
||||||
|
- python3-systemd
|
||||||
|
state: present
|
||||||
|
cache_valid_time: 3600
|
||||||
|
|
||||||
- name: Configure fail2ban sshd filter
|
- name: Configure fail2ban sshd filter
|
||||||
template: src=etc/fail2ban/jail.d/sshd.local.j2 dest=/etc/fail2ban/jail.d/sshd.local owner=root mode=0644
|
ansible.builtin.template:
|
||||||
notify: restart fail2ban
|
src: etc/fail2ban/jail.d/sshd.local.j2
|
||||||
|
dest: /etc/fail2ban/jail.d/sshd.local
|
||||||
|
owner: root
|
||||||
|
mode: "0644"
|
||||||
|
notify: Restart fail2ban
|
||||||
|
|
||||||
- name: Configure fail2ban nginx filter
|
- name: Configure fail2ban nginx filter
|
||||||
when: "extra_fail2ban_filters is defined and 'nginx' in extra_fail2ban_filters"
|
when:
|
||||||
template: src=etc/fail2ban/jail.d/nginx.local.j2 dest=/etc/fail2ban/jail.d/nginx.local owner=root mode=0644
|
- webserver is defined and webserver == 'nginx'
|
||||||
notify: restart fail2ban
|
- extra_fail2ban_filters is defined
|
||||||
|
- "'nginx' in extra_fail2ban_filters"
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: etc/fail2ban/jail.d/nginx.local.j2
|
||||||
|
dest: /etc/fail2ban/jail.d/nginx.local
|
||||||
|
owner: root
|
||||||
|
mode: "0644"
|
||||||
|
notify: Restart fail2ban
|
||||||
|
|
||||||
- name: Create fail2ban service override directory
|
- name: Create fail2ban service override directory
|
||||||
file: path=/etc/systemd/system/fail2ban.service.d state=directory owner=root mode=0755
|
ansible.builtin.file:
|
||||||
|
path: /etc/systemd/system/fail2ban.service.d
|
||||||
|
state: directory
|
||||||
|
owner: root
|
||||||
|
mode: "0755"
|
||||||
|
|
||||||
# See Arch Linux's example: https://wiki.archlinux.org/index.php/Fail2ban
|
# See Arch Linux's example: https://wiki.archlinux.org/index.php/Fail2ban
|
||||||
- name: Configure fail2ban service override
|
- name: Configure fail2ban service override
|
||||||
template: src=etc/systemd/system/fail2ban.service.d/override.conf.j2 dest=/etc/systemd/system/fail2ban.service.d/override.conf owner=root mode=0644
|
ansible.builtin.template:
|
||||||
|
src: etc/systemd/system/fail2ban.service.d/override.conf.j2
|
||||||
|
dest: /etc/systemd/system/fail2ban.service.d/override.conf
|
||||||
|
owner: root
|
||||||
|
mode: "0644"
|
||||||
notify:
|
notify:
|
||||||
- reload systemd
|
- Reload systemd
|
||||||
- restart fail2ban
|
- Restart fail2ban
|
||||||
|
|
||||||
- name: Start and enable fail2ban service
|
- name: Start and enable fail2ban service
|
||||||
systemd: name=fail2ban state=started enabled=yes
|
ansible.builtin.systemd_service:
|
||||||
|
name: fail2ban
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
|
||||||
# vim: set sw=2 ts=2:
|
# vim: set sw=2 ts=2:
|
||||||
|
|||||||
25
roles/common/tasks/firewall.yml
Normal file
25
roles/common/tasks/firewall.yml
Normal file
@@ -0,0 +1,25 @@
|
|||||||
|
---
|
||||||
|
# Debian 11+ will use nftables directly, with no firewalld.
|
||||||
|
|
||||||
|
- name: Install Debian firewall packages
|
||||||
|
when: ansible_distribution_version is version('11', '>=')
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: nftables
|
||||||
|
state: present
|
||||||
|
cache_valid_time: 3600
|
||||||
|
|
||||||
|
- name: Remove iptables on newer Debian
|
||||||
|
when: ansible_distribution_version is version('11', '>=')
|
||||||
|
ansible.builtin.apt:
|
||||||
|
pkg: iptables
|
||||||
|
state: absent
|
||||||
|
|
||||||
|
- name: Configure nftables
|
||||||
|
when: ansible_distribution_version is version('11', '>=')
|
||||||
|
ansible.builtin.include_tasks: nftables.yml
|
||||||
|
|
||||||
|
- name: Configure fail2ban
|
||||||
|
when: ansible_distribution_version is version('9', '>=')
|
||||||
|
ansible.builtin.include_tasks: fail2ban.yml
|
||||||
|
|
||||||
|
# vim: set sw=2 ts=2:
|
||||||
@@ -1,160 +0,0 @@
|
|||||||
---
|
|
||||||
# Debian 10 will use firewalld with the iptables backend.
|
|
||||||
# Debian 11 will use nftables directly, with no firewalld.
|
|
||||||
|
|
||||||
- block:
|
|
||||||
- name: Set Debian firewall packages
|
|
||||||
when: ansible_distribution_major_version is version('10', '<=')
|
|
||||||
set_fact:
|
|
||||||
debian_firewall_packages:
|
|
||||||
- firewalld
|
|
||||||
- tidy
|
|
||||||
- fail2ban
|
|
||||||
- python3-systemd # for fail2ban systemd backend
|
|
||||||
|
|
||||||
- name: Set Debian firewall packages
|
|
||||||
when: ansible_distribution_major_version is version('11', '>=')
|
|
||||||
set_fact:
|
|
||||||
debian_firewall_packages:
|
|
||||||
- fail2ban
|
|
||||||
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
|
||||||
- nftables
|
|
||||||
- python3-systemd
|
|
||||||
- curl # for nftables update scripts
|
|
||||||
|
|
||||||
- name: Install firewall packages
|
|
||||||
apt: pkg={{ debian_firewall_packages }} state=present cache_valid_time=3600
|
|
||||||
|
|
||||||
- name: Remove iptables on newer Debian
|
|
||||||
when: ansible_distribution_major_version is version('11', '>=')
|
|
||||||
apt: pkg=iptables state=absent
|
|
||||||
|
|
||||||
- name: Copy nftables.conf
|
|
||||||
when: ansible_distribution_major_version is version('11', '>=')
|
|
||||||
template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
|
|
||||||
notify:
|
|
||||||
- restart nftables
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Create /etc/nftables extra config directory
|
|
||||||
when: ansible_distribution_major_version is version('11', '>=')
|
|
||||||
file: path=/etc/nftables state=directory owner=root mode=0755
|
|
||||||
|
|
||||||
- name: Copy extra nftables configuration files
|
|
||||||
when: ansible_distribution_major_version is version('11', '>=')
|
|
||||||
copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
|
|
||||||
loop:
|
|
||||||
- { src: "spamhaus-ipv4.nft", force: "no" }
|
|
||||||
- { src: "spamhaus-ipv6.nft", force: "no" }
|
|
||||||
- { src: "abusech-ipv4.nft", force: "no" }
|
|
||||||
- { src: "abuseipdb-ipv4.nft", force: "yes" }
|
|
||||||
- { src: "abuseipdb-ipv6.nft", force: "yes" }
|
|
||||||
notify:
|
|
||||||
- restart nftables
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Use iptables backend in firewalld
|
|
||||||
when: ansible_distribution_major_version is version('10', '==')
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/firewalld/firewalld.conf
|
|
||||||
regexp: '^FirewallBackend=nftables$'
|
|
||||||
line: 'FirewallBackend=iptables'
|
|
||||||
notify:
|
|
||||||
- restart firewalld
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
# firewalld seems to have an issue with iptables 1.8.2 when using the nftables
|
|
||||||
# backend. Using individual calls seems to work around it.
|
|
||||||
# See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931722
|
|
||||||
- name: Use individual iptables calls
|
|
||||||
when: ansible_distribution_major_version is version('10', '==')
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/firewalld/firewalld.conf
|
|
||||||
regexp: '^IndividualCalls=no$'
|
|
||||||
line: 'IndividualCalls=yes'
|
|
||||||
notify:
|
|
||||||
- restart firewalld
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Copy firewalld public zone file
|
|
||||||
when: ansible_distribution_major_version is version('10', '<=')
|
|
||||||
template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
|
|
||||||
|
|
||||||
- name: Format public.xml firewalld zone file
|
|
||||||
when: ansible_distribution_major_version is version('10', '<=')
|
|
||||||
command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
|
|
||||||
notify:
|
|
||||||
- restart firewalld
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Copy firewalld ipsets of abusive IPs
|
|
||||||
when: ansible_distribution_major_version is version('10', '<=')
|
|
||||||
copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
|
|
||||||
loop:
|
|
||||||
- abusers-ipv4.xml
|
|
||||||
- abusers-ipv6.xml
|
|
||||||
- spamhaus-ipv4.xml
|
|
||||||
- spamhaus-ipv6.xml
|
|
||||||
notify:
|
|
||||||
- restart firewalld
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Copy Spamhaus firewalld update script
|
|
||||||
when: ansible_distribution_version is version('10', '<=')
|
|
||||||
copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
|
|
||||||
|
|
||||||
- name: Copy Spamhaus firewalld systemd units
|
|
||||||
when: ansible_distribution_version is version('10', '<=')
|
|
||||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
|
||||||
loop:
|
|
||||||
- update-spamhaus-lists.service
|
|
||||||
- update-spamhaus-lists.timer
|
|
||||||
register: spamhaus_firewalld_systemd_units
|
|
||||||
|
|
||||||
- name: Copy Spamhaus nftables update scripts
|
|
||||||
when: ansible_distribution_version is version('11', '>=')
|
|
||||||
copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
|
|
||||||
loop:
|
|
||||||
- update-spamhaus-nftables.sh
|
|
||||||
- aggregate-cidr-addresses.pl
|
|
||||||
- update-abusech-nftables.sh
|
|
||||||
|
|
||||||
- name: Copy nftables systemd units
|
|
||||||
when: ansible_distribution_version is version('11', '>=')
|
|
||||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
|
||||||
loop:
|
|
||||||
- update-spamhaus-nftables.service
|
|
||||||
- update-spamhaus-nftables.timer
|
|
||||||
- update-abusech-nftables.service
|
|
||||||
- update-abusech-nftables.timer
|
|
||||||
register: nftables_systemd_units
|
|
||||||
|
|
||||||
# need to reload to pick up service/timer/environment changes
|
|
||||||
- name: Reload systemd daemon
|
|
||||||
systemd: daemon_reload=yes
|
|
||||||
when: spamhaus_firewalld_systemd_units is changed or
|
|
||||||
nftables_systemd_units is changed
|
|
||||||
|
|
||||||
- name: Start and enable Spamhaus firewalld update timer
|
|
||||||
when: ansible_distribution_version is version('10', '<=')
|
|
||||||
systemd: name=update-spamhaus-lists.timer state=started enabled=yes
|
|
||||||
notify:
|
|
||||||
- restart firewalld
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Start and enable nftables update timers
|
|
||||||
when: ansible_distribution_version is version('11', '>=')
|
|
||||||
systemd: name={{ item }} state=started enabled=yes
|
|
||||||
loop:
|
|
||||||
- update-spamhaus-nftables.timer
|
|
||||||
- update-abusech-nftables.timer
|
|
||||||
|
|
||||||
- name: Start and enable nftables
|
|
||||||
when: ansible_distribution_major_version is version('11', '>=')
|
|
||||||
systemd: name=nftables state=started enabled=yes
|
|
||||||
|
|
||||||
- include_tasks: fail2ban.yml
|
|
||||||
when: ansible_distribution_major_version is version('9', '>=')
|
|
||||||
tags: firewall
|
|
||||||
|
|
||||||
# vim: set sw=2 ts=2:
|
|
||||||
@@ -1,138 +0,0 @@
|
|||||||
---
|
|
||||||
# Ubuntu 20.04 will use nftables directly, with no firewalld.
|
|
||||||
# Ubuntu 18.04 will use firewalld with the nftables backend.
|
|
||||||
# Ubuntu 16.04 will use firewalld with the iptables backend.
|
|
||||||
|
|
||||||
- block:
|
|
||||||
- name: Set Ubuntu firewall packages
|
|
||||||
when: ansible_distribution_version is version('20.04', '<')
|
|
||||||
set_fact:
|
|
||||||
ubuntu_firewall_packages:
|
|
||||||
- firewalld
|
|
||||||
- tidy
|
|
||||||
- fail2ban
|
|
||||||
- python3-systemd # for fail2ban systemd backend
|
|
||||||
|
|
||||||
- name: Set Ubuntu firewall packages
|
|
||||||
when: ansible_distribution_version is version('20.04', '>=')
|
|
||||||
set_fact:
|
|
||||||
ubuntu_firewall_packages:
|
|
||||||
- fail2ban
|
|
||||||
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
|
||||||
- nftables
|
|
||||||
- python3-systemd
|
|
||||||
- curl # for nftables update scripts
|
|
||||||
|
|
||||||
- name: Install firewall packages
|
|
||||||
apt: pkg={{ ubuntu_firewall_packages }} state=present cache_valid_time=3600
|
|
||||||
|
|
||||||
- name: Remove ufw
|
|
||||||
when: ansible_distribution_version is version('16.04', '>=')
|
|
||||||
apt: pkg=ufw state=absent
|
|
||||||
|
|
||||||
- name: Copy nftables.conf
|
|
||||||
when: ansible_distribution_version is version('20.04', '>=')
|
|
||||||
template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
|
|
||||||
notify:
|
|
||||||
- restart nftables
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Create /etc/nftables extra config directory
|
|
||||||
when: ansible_distribution_version is version('20.04', '>=')
|
|
||||||
file: path=/etc/nftables state=directory owner=root mode=0755
|
|
||||||
|
|
||||||
- name: Copy extra nftables configuration files
|
|
||||||
when: ansible_distribution_version is version('20.04', '>=')
|
|
||||||
copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
|
|
||||||
loop:
|
|
||||||
- { src: "spamhaus-ipv4.nft", force: "no" }
|
|
||||||
- { src: "spamhaus-ipv6.nft", force: "no" }
|
|
||||||
- { src: "abusech-ipv4.nft", force: "no" }
|
|
||||||
- { src: "abuseipdb-ipv4.nft", force: "yes" }
|
|
||||||
- { src: "abuseipdb-ipv6.nft", force: "yes" }
|
|
||||||
notify:
|
|
||||||
- restart nftables
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Copy firewalld public zone file
|
|
||||||
when: ansible_distribution_version is version('18.04', '<=')
|
|
||||||
template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
|
|
||||||
|
|
||||||
- name: Format public.xml firewalld zone file
|
|
||||||
when: ansible_distribution_version is version('18.04', '<=')
|
|
||||||
command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
|
|
||||||
notify:
|
|
||||||
- restart firewalld
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Copy firewalld ipsets of abusive IPs
|
|
||||||
when: ansible_distribution_version is version('18.04', '<=')
|
|
||||||
copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
|
|
||||||
loop:
|
|
||||||
- abusers-ipv4.xml
|
|
||||||
- abusers-ipv6.xml
|
|
||||||
- spamhaus-ipv4.xml
|
|
||||||
- spamhaus-ipv6.xml
|
|
||||||
notify:
|
|
||||||
- restart firewalld
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Copy Spamhaus firewalld update script
|
|
||||||
when: ansible_distribution_version is version('18.04', '<=')
|
|
||||||
copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
|
|
||||||
|
|
||||||
- name: Copy Spamhaus firewalld systemd units
|
|
||||||
when: ansible_distribution_version is version('18.04', '<=')
|
|
||||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
|
||||||
loop:
|
|
||||||
- update-spamhaus-lists.service
|
|
||||||
- update-spamhaus-lists.timer
|
|
||||||
register: spamhaus_firewalld_systemd_units
|
|
||||||
|
|
||||||
- name: Copy nftables update scripts
|
|
||||||
when: ansible_distribution_version is version('20.04', '>=')
|
|
||||||
copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
|
|
||||||
loop:
|
|
||||||
- update-spamhaus-nftables.sh
|
|
||||||
- aggregate-cidr-addresses.pl
|
|
||||||
- update-abusech-nftables.sh
|
|
||||||
|
|
||||||
- name: Copy nftables systemd units
|
|
||||||
when: ansible_distribution_version is version('20.04', '>=')
|
|
||||||
copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
|
|
||||||
loop:
|
|
||||||
- update-spamhaus-nftables.service
|
|
||||||
- update-spamhaus-nftables.timer
|
|
||||||
- update-abusech-nftables.service
|
|
||||||
- update-abusech-nftables.timer
|
|
||||||
register: nftables_systemd_units
|
|
||||||
|
|
||||||
# need to reload to pick up service/timer/environment changes
|
|
||||||
- name: Reload systemd daemon
|
|
||||||
systemd: daemon_reload=yes
|
|
||||||
when: spamhaus_firewalld_systemd_units is changed or
|
|
||||||
nftables_systemd_units is changed
|
|
||||||
|
|
||||||
- name: Start and enable Spamhaus firewalld update timer
|
|
||||||
when: ansible_distribution_version is version('18.04', '<=')
|
|
||||||
systemd: name=update-spamhaus-lists.timer state=started enabled=yes
|
|
||||||
notify:
|
|
||||||
- restart firewalld
|
|
||||||
- restart fail2ban
|
|
||||||
|
|
||||||
- name: Start and enable nftables update timers
|
|
||||||
when: ansible_distribution_version is version('20.04', '>=')
|
|
||||||
systemd: name={{ item }} state=started enabled=yes
|
|
||||||
loop:
|
|
||||||
- update-spamhaus-nftables.timer
|
|
||||||
- update-abusech-nftables.timer
|
|
||||||
|
|
||||||
- name: Start and enable nftables
|
|
||||||
when: ansible_distribution_version is version('20.04', '>=')
|
|
||||||
systemd: name=nftables state=started enabled=yes
|
|
||||||
|
|
||||||
- include_tasks: fail2ban.yml
|
|
||||||
when: ansible_distribution_version is version('16.04', '>=')
|
|
||||||
tags: firewall
|
|
||||||
|
|
||||||
# vim: set sw=2 ts=2:
|
|
||||||
@@ -1,54 +1,48 @@
|
|||||||
---
|
---
|
||||||
- name: Import OS-specific variables
|
- name: Import OS-specific variables
|
||||||
include_vars: "vars/{{ ansible_distribution }}.yml"
|
ansible.builtin.include_vars: vars/{{ ansible_distribution }}.yml
|
||||||
tags: always
|
tags: always
|
||||||
|
|
||||||
- name: Configure network time
|
- name: Configure network time
|
||||||
import_tasks: ntp.yml
|
ansible.builtin.import_tasks: ntp.yml
|
||||||
tags: ntp
|
tags: ntp
|
||||||
|
|
||||||
- name: Install common packages
|
- name: Install common packages
|
||||||
include_tasks: packages_Debian.yml
|
ansible.builtin.include_tasks: packages.yml
|
||||||
when: ansible_distribution == 'Debian'
|
|
||||||
tags: packages
|
|
||||||
|
|
||||||
- name: Install common packages
|
|
||||||
include_tasks: packages_Ubuntu.yml
|
|
||||||
when: ansible_distribution == 'Ubuntu'
|
|
||||||
tags: packages
|
tags: packages
|
||||||
|
|
||||||
- name: Configure firewall
|
- name: Configure firewall
|
||||||
include_tasks: firewall_Debian.yml
|
ansible.builtin.import_tasks: firewall.yml
|
||||||
when: ansible_distribution == 'Debian'
|
|
||||||
tags: firewall
|
|
||||||
|
|
||||||
- name: Configure firewall
|
|
||||||
include_tasks: firewall_Ubuntu.yml
|
|
||||||
when: ansible_distribution == 'Ubuntu'
|
|
||||||
tags: firewall
|
tags: firewall
|
||||||
|
|
||||||
- name: Configure secure shell daemon
|
- name: Configure secure shell daemon
|
||||||
import_tasks: sshd.yml
|
ansible.builtin.import_tasks: sshd.yml
|
||||||
tags: sshd
|
tags: sshd
|
||||||
|
|
||||||
# containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!
|
# containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!
|
||||||
- name: Reconfigure /etc/sysctl.conf
|
- name: Reconfigure /etc/sysctl.conf
|
||||||
when: ansible_virtualization_role != 'host'
|
when: ansible_virtualization_role != 'host'
|
||||||
template: src=sysctl_{{ ansible_distribution }}.j2 dest=/etc/sysctl.conf owner=root group=root mode=0644
|
ansible.builtin.template:
|
||||||
|
src: "sysctl_{{ ansible_distribution }}.j2"
|
||||||
|
dest: /etc/sysctl.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
notify:
|
notify:
|
||||||
- reload sysctl
|
- Reload sysctl
|
||||||
tags: sysctl
|
tags: sysctl
|
||||||
|
|
||||||
- name: Reconfigure /etc/rc.local
|
|
||||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('19.04', '<=')
|
|
||||||
template: src=rc.local_Ubuntu.j2 dest=/etc/rc.local owner=root group=root mode=0755
|
|
||||||
|
|
||||||
- name: Set I/O scheduler
|
- name: Set I/O scheduler
|
||||||
template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644
|
ansible.builtin.template:
|
||||||
|
src: etc/udev/rules.d/60-scheduler.rules.j2
|
||||||
|
dest: /etc/udev/rules.d/60-scheduler.rules
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
tags: udev
|
tags: udev
|
||||||
|
|
||||||
- name: Copy admin SSH keys
|
- name: Copy admin SSH keys
|
||||||
import_tasks: ssh-keys.yml
|
ansible.builtin.import_tasks: ssh-keys.yml
|
||||||
tags: ssh-keys
|
tags: ssh-keys
|
||||||
|
|
||||||
# vim: set sw=2 ts=2:
|
# vim: set sw=2 ts=2:
|
||||||
|
|||||||
96
roles/common/tasks/nftables.yml
Normal file
96
roles/common/tasks/nftables.yml
Normal file
@@ -0,0 +1,96 @@
|
|||||||
|
---
|
||||||
|
# Common nftables tasks for Debian 11 and Debian 12.
|
||||||
|
|
||||||
|
- name: Copy nftables.conf
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: nftables.conf.j2
|
||||||
|
dest: /etc/nftables.conf
|
||||||
|
owner: root
|
||||||
|
mode: "0644"
|
||||||
|
notify:
|
||||||
|
- Restart nftables
|
||||||
|
- Restart fail2ban
|
||||||
|
|
||||||
|
- name: Create /etc/nftables extra config directory
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /etc/nftables
|
||||||
|
state: directory
|
||||||
|
owner: root
|
||||||
|
mode: "0755"
|
||||||
|
|
||||||
|
- name: Copy extra nftables configuration files
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ item.src }}"
|
||||||
|
dest: /etc/nftables/{{ item.src }}
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
force: "{{ item.force }}"
|
||||||
|
loop:
|
||||||
|
- { src: firehol_level1-ipv4.nft, force: false }
|
||||||
|
notify:
|
||||||
|
- Restart nftables
|
||||||
|
- Restart fail2ban
|
||||||
|
|
||||||
|
- name: Copy nftables update scripts
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: update-firehol-nftables.sh.j2
|
||||||
|
dest: /usr/local/bin/update-firehol-nftables.sh
|
||||||
|
mode: "0755"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
|
||||||
|
- name: Remove deprecated data and scripts
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ item }}"
|
||||||
|
state: absent
|
||||||
|
loop:
|
||||||
|
- /etc/nftables/spamhaus-ipv4.nft
|
||||||
|
- /etc/nftables/spamhaus-ipv6.nft
|
||||||
|
- /etc/nftables/abuseipdb-ipv4.nft
|
||||||
|
- /etc/nftables/abuseipdb-ipv6.nft
|
||||||
|
- /etc/nftables/abusech-ipv4.nft
|
||||||
|
- /usr/local/bin/update-abusech-nftables.sh
|
||||||
|
- /usr/local/bin/update-spamhaus-nftables.sh
|
||||||
|
- /etc/systemd/system/update-abusech-nftables.service
|
||||||
|
- /etc/systemd/system/update-abusech-nftables.timer
|
||||||
|
- /etc/systemd/system/update-spamhaus-nftables.service
|
||||||
|
- /etc/systemd/system/update-spamhaus-nftables.timer
|
||||||
|
- /usr/local/bin/aggregate-cidr-addresses.pl
|
||||||
|
notify:
|
||||||
|
- Restart nftables
|
||||||
|
- Restart fail2ban
|
||||||
|
|
||||||
|
- name: Copy nftables systemd units
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ item }}"
|
||||||
|
dest: /etc/systemd/system/{{ item }}
|
||||||
|
mode: "0644"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
loop:
|
||||||
|
- update-firehol-nftables.service
|
||||||
|
- update-firehol-nftables.timer
|
||||||
|
register: nftables_systemd_units
|
||||||
|
|
||||||
|
# need to reload to pick up service/timer/environment changes
|
||||||
|
- name: Reload systemd daemon
|
||||||
|
when: nftables_systemd_units is changed
|
||||||
|
ansible.builtin.systemd_service: # noqa no-handler
|
||||||
|
daemon_reload: true
|
||||||
|
|
||||||
|
- name: Start and enable nftables update timers
|
||||||
|
ansible.builtin.systemd_service:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
loop:
|
||||||
|
- update-firehol-nftables.timer
|
||||||
|
|
||||||
|
- name: Start and enable nftables
|
||||||
|
ansible.builtin.systemd_service:
|
||||||
|
name: nftables
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# vim: set sw=2 ts=2:
|
||||||
@@ -1,27 +1,40 @@
|
|||||||
---
|
---
|
||||||
# Hosts running Ubuntu 16.04+ and Debian 9+ use systemd init system and should
|
# Hosts running Debian 9+ use systemd init system and can use systemd-timesyncd
|
||||||
# use systemd-timesyncd as a network time client instead of the standalone ntp
|
# as a network time client instead of the standalone ntp client.
|
||||||
# client.
|
|
||||||
|
|
||||||
- name: Set timezone
|
- name: Set timezone
|
||||||
when: timezone is defined and ansible_service_mgr == 'systemd'
|
when:
|
||||||
command: /usr/bin/timedatectl set-timezone {{ timezone }}
|
- timezone is defined
|
||||||
|
- ansible_service_mgr == 'systemd'
|
||||||
|
community.general.timezone:
|
||||||
|
name: "{{ timezone }}"
|
||||||
tags: timezone
|
tags: timezone
|
||||||
|
|
||||||
# Apparently some cloud images don't have this installed by default. From what
|
# Apparently some cloud images don't have this installed by default. From what
|
||||||
# I can see on existing servers, systemd-timesyncd is a standalone package on
|
# I can see on existing servers, systemd-timesyncd is a standalone package on
|
||||||
# Ubuntu 20.04 and Debian 11.
|
# Debian 11 and Debian 12.
|
||||||
- name: Install systemd-timesyncd
|
- name: Install systemd-timesyncd
|
||||||
when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or
|
when: ansible_distribution_version is version('11', '>=')
|
||||||
(ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
|
ansible.builtin.apt:
|
||||||
apt: name=systemd-timesyncd state=present cache_valid_time=3600
|
name: systemd-timesyncd
|
||||||
|
state: present
|
||||||
|
cache_valid_time: 3600
|
||||||
|
|
||||||
- name: Start and enable systemd's NTP client
|
- name: Start and enable systemd's NTP client
|
||||||
when: ansible_service_mgr == 'systemd'
|
when: ansible_service_mgr == 'systemd'
|
||||||
systemd: name=systemd-timesyncd state=started enabled=yes
|
ansible.builtin.systemd_service:
|
||||||
|
name: systemd-timesyncd
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
|
||||||
- name: Uninstall ntp on modern Ubuntu/Debian
|
# On Debian 12 ntp doesn't conflict with systemd-timesyncd so we should try to
|
||||||
apt: name=ntp state=absent
|
# remove it to be sure.
|
||||||
when: ansible_service_mgr == 'systemd'
|
- name: Uninstall ntp on Debian 12
|
||||||
|
when:
|
||||||
|
- ansible_service_mgr == 'systemd'
|
||||||
|
- ansible_distribution_major_version is version('12', '==')
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: ntp
|
||||||
|
state: absent
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
57
roles/common/tasks/packages.yml
Normal file
57
roles/common/tasks/packages.yml
Normal file
@@ -0,0 +1,57 @@
|
|||||||
|
---
|
||||||
|
- name: Configure Debian packages
|
||||||
|
tags: packages
|
||||||
|
block:
|
||||||
|
# Scaleway seems to use a weird sources.list format as of Debian 12?
|
||||||
|
- name: Check for weird Debian sources
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: /etc/apt/sources.list.d/debian.sources
|
||||||
|
register: weird_debian_sources_stat
|
||||||
|
|
||||||
|
- name: Configure apt mirror
|
||||||
|
when:
|
||||||
|
- ansible_architecture != 'armv7l'
|
||||||
|
- not weird_debian_sources_stat
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: sources.list.j2
|
||||||
|
dest: /etc/apt/sources.list
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
|
||||||
|
- name: Set fact for base packages
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
base_packages:
|
||||||
|
- git
|
||||||
|
- git-lfs
|
||||||
|
- tmux
|
||||||
|
- iotop
|
||||||
|
- htop
|
||||||
|
- strace
|
||||||
|
- safe-rm
|
||||||
|
- debian-goodies
|
||||||
|
- mosh
|
||||||
|
- python3-pycurl # for ansible's apt_repository
|
||||||
|
- vim
|
||||||
|
- unzip
|
||||||
|
- apt-transport-https # for https support in apt
|
||||||
|
- gnupg2
|
||||||
|
- zstd
|
||||||
|
- rsync
|
||||||
|
- lsof
|
||||||
|
- unattended-upgrades
|
||||||
|
|
||||||
|
- name: Install base packages
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: "{{ base_packages }}"
|
||||||
|
state: present
|
||||||
|
cache_valid_time: 3600
|
||||||
|
|
||||||
|
- name: Remove cron-apt
|
||||||
|
tags: cron-apt
|
||||||
|
ansible.builtin.import_tasks: cron-apt.yml
|
||||||
|
|
||||||
|
- name: Install tarsnap
|
||||||
|
ansible.builtin.import_tasks: tarsnap.yml
|
||||||
|
|
||||||
|
# vim: set sw=2 ts=2:
|
||||||
@@ -1,41 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- block:
|
|
||||||
- name: Configure apt mirror
|
|
||||||
template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
|
|
||||||
when: ansible_architecture != 'armv7l'
|
|
||||||
|
|
||||||
- name: Set fact for base packages
|
|
||||||
set_fact:
|
|
||||||
base_packages:
|
|
||||||
- git
|
|
||||||
- git-lfs
|
|
||||||
- tmux
|
|
||||||
- iotop
|
|
||||||
- htop
|
|
||||||
- strace
|
|
||||||
- cron-apt
|
|
||||||
- safe-rm
|
|
||||||
- debian-goodies
|
|
||||||
- mosh
|
|
||||||
- python3-pycurl # for ansible's apt_repository
|
|
||||||
- vim
|
|
||||||
- unzip
|
|
||||||
- apt-transport-https # for https support in apt
|
|
||||||
- gnupg2
|
|
||||||
- zstd
|
|
||||||
- rsync
|
|
||||||
- lsof
|
|
||||||
|
|
||||||
- name: Install base packages
|
|
||||||
apt: name={{ base_packages }} state=present cache_valid_time=3600
|
|
||||||
|
|
||||||
- name: Configure cron-apt
|
|
||||||
import_tasks: cron-apt.yml
|
|
||||||
tags: cron-apt
|
|
||||||
|
|
||||||
- name: Install tarsnap
|
|
||||||
import_tasks: tarsnap.yml
|
|
||||||
tags: packages
|
|
||||||
|
|
||||||
# vim: set sw=2 ts=2:
|
|
||||||
@@ -1,108 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- block:
|
|
||||||
- name: Configure apt mirror
|
|
||||||
template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
|
|
||||||
when: ansible_architecture != 'armv7l'
|
|
||||||
|
|
||||||
- name: Upgrade base OS
|
|
||||||
apt: upgrade=dist cache_valid_time=3600
|
|
||||||
|
|
||||||
- name: Set Ubuntu base packages
|
|
||||||
set_fact:
|
|
||||||
ubuntu_base_packages:
|
|
||||||
- git
|
|
||||||
- git-lfs
|
|
||||||
- tmux
|
|
||||||
- iotop
|
|
||||||
- htop
|
|
||||||
- strace
|
|
||||||
- cron-apt
|
|
||||||
- safe-rm
|
|
||||||
- debian-goodies
|
|
||||||
- mosh
|
|
||||||
- python-pycurl # for ansible's apt_repository
|
|
||||||
- vim
|
|
||||||
- unzip
|
|
||||||
- apt-transport-https # for https support in apt
|
|
||||||
- zstd
|
|
||||||
- rsync
|
|
||||||
- lsof
|
|
||||||
|
|
||||||
- name: Install base packages
|
|
||||||
apt: pkg={{ ubuntu_base_packages }} state=present cache_valid_time=3600
|
|
||||||
|
|
||||||
# We have to remove snaps one by one in a specific order because some depend
|
|
||||||
# on others. Only after that can we remove the corresponding system packages.
|
|
||||||
- name: Remove lxd snap
|
|
||||||
snap: name=lxd state=absent
|
|
||||||
when: ansible_distribution_version is version('20.04', '==')
|
|
||||||
ignore_errors: yes
|
|
||||||
|
|
||||||
- name: Remove core18 snap
|
|
||||||
snap: name=core18 state=absent
|
|
||||||
when: ansible_distribution_version is version('20.04', '==')
|
|
||||||
ignore_errors: yes
|
|
||||||
|
|
||||||
- name: Remove snapd snap
|
|
||||||
snap: name=snapd state=absent
|
|
||||||
when: ansible_distribution_version is version('20.04', '==')
|
|
||||||
ignore_errors: yes
|
|
||||||
|
|
||||||
- name: Set fact for packages to remove (Ubuntu <= 18.04)
|
|
||||||
set_fact:
|
|
||||||
ubuntu_annoying_packages:
|
|
||||||
- whoopsie # security (CIS 4.1)
|
|
||||||
- apport # security (CIS 4.1)
|
|
||||||
- command-not-found # annoying
|
|
||||||
- command-not-found-data # annoying
|
|
||||||
- python3-commandnotfound # annoying
|
|
||||||
- snapd # annoying (Ubuntu >= 16.04)
|
|
||||||
- lxd # annoying (Ubuntu >= 16.04)
|
|
||||||
- lxd-client # annoying (Ubuntu >= 16.04)
|
|
||||||
- liblxc1 # annoying (Ubuntu >= 16.04)
|
|
||||||
- lxc-common # annoying (Ubuntu >= 16.04)
|
|
||||||
- lxcfs #annoying (Ubuntu >= 16.04)
|
|
||||||
when: ansible_distribution_version is version('18.04', '<=')
|
|
||||||
|
|
||||||
- name: Set fact for packages to remove (Ubuntu 20.04)
|
|
||||||
set_fact:
|
|
||||||
ubuntu_annoying_packages:
|
|
||||||
- whoopsie # security (CIS 4.1)
|
|
||||||
- apport # security (CIS 4.1)
|
|
||||||
- command-not-found # annoying
|
|
||||||
- command-not-found-data # annoying
|
|
||||||
- python3-commandnotfound # annoying
|
|
||||||
- snapd # annoying (Ubuntu >= 16.04)
|
|
||||||
- lxd-agent-loader # annoying (Ubuntu 20.04)
|
|
||||||
when: ansible_distribution_version is version('20.04', '==')
|
|
||||||
|
|
||||||
- name: Remove packages
|
|
||||||
apt: name={{ ubuntu_annoying_packages }} state=absent purge=yes
|
|
||||||
|
|
||||||
- name: Disable annoying Canonical spam in MOTD
|
|
||||||
file: path={{ item }} mode=0644 state=absent
|
|
||||||
loop:
|
|
||||||
- /etc/update-motd.d/99-esm # Ubuntu 14.04
|
|
||||||
- /etc/update-motd.d/10-help-text # Ubuntu 14.04+
|
|
||||||
- /etc/update-motd.d/50-motd-news # Ubuntu 18.04+
|
|
||||||
- /etc/update-motd.d/80-esm # Ubuntu 18.04+
|
|
||||||
- /etc/update-motd.d/80-livepatch # Ubuntu 18.04+
|
|
||||||
ignore_errors: yes
|
|
||||||
|
|
||||||
- name: Disable annoying Canonical spam in MOTD
|
|
||||||
systemd: name={{ item }} state=stopped enabled=no
|
|
||||||
when: ansible_service_mgr == 'systemd'
|
|
||||||
loop:
|
|
||||||
- motd-news.service
|
|
||||||
- motd-news.timer
|
|
||||||
|
|
||||||
- name: Configure cron-apt
|
|
||||||
import_tasks: cron-apt.yml
|
|
||||||
tags: cron-apt
|
|
||||||
|
|
||||||
- name: Install tarsnap
|
|
||||||
import_tasks: tarsnap.yml
|
|
||||||
tags: packages
|
|
||||||
|
|
||||||
# vim: set sw=2 ts=2:
|
|
||||||
@@ -1,9 +1,11 @@
|
|||||||
---
|
---
|
||||||
- name: Zero .ssh/authorized_keys for provisioning user
|
- name: Zero .ssh/authorized_keys for provisioning user
|
||||||
file: dest={{ provisioning_user.home }}/.ssh/authorized_keys state=absent
|
ansible.builtin.file:
|
||||||
|
dest: "{{ provisioning_user.home }}/.ssh/authorized_keys"
|
||||||
|
state: absent
|
||||||
|
|
||||||
- name: Add public keys to authorized_keys
|
- name: Add public keys to authorized_keys
|
||||||
authorized_key: { user: '{{ provisioning_user.name }}', key: "{{ lookup('file',item) }}" }
|
ansible.posix.authorized_key: { user: "{{ provisioning_user.name }}", key: "{{ lookup('file', item) }}" }
|
||||||
with_fileglob:
|
with_fileglob:
|
||||||
# use descriptive names for keys, like: aorth-mzito-rsa.pub
|
# use descriptive names for keys, like: aorth-mzito-rsa.pub
|
||||||
- ssh-pub-keys/*.pub
|
- ssh-pub-keys/*.pub
|
||||||
|
|||||||
@@ -1,17 +1,26 @@
|
|||||||
---
|
---
|
||||||
|
# Only override the system sshd configuration on older Debian.
|
||||||
# SSH configs don't change in Debian minor versions
|
|
||||||
- name: Reconfigure /etc/ssh/sshd_config
|
- name: Reconfigure /etc/ssh/sshd_config
|
||||||
template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
|
when: ansible_distribution_version is version('12', '<=')
|
||||||
when: ansible_distribution == 'Debian'
|
ansible.builtin.template:
|
||||||
notify: reload sshd
|
src: "sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2"
|
||||||
|
dest: /etc/ssh/sshd_config
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0600"
|
||||||
|
notify: Reload sshd
|
||||||
|
|
||||||
# Ubuntu is the only distro we have where SSH version is very different from 14.04 -> 14.10,
|
# Newer OpenSSH versions support including extra configuration. The includes
|
||||||
# ie with new ciphers supported etc.
|
# happen at the beginning of the file and the first value to be read is used.
|
||||||
- name: Reconfigure /etc/ssh/sshd_config
|
- name: Configure sshd_config.d overrides
|
||||||
template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
|
when: ansible_distribution_version is version('13', '>=')
|
||||||
when: ansible_distribution == 'Ubuntu'
|
ansible.builtin.template:
|
||||||
notify: reload sshd
|
src: etc/ssh/sshd_config.d/01-{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.conf.j2
|
||||||
|
dest: /etc/ssh/sshd_config.d/01-custom.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0600"
|
||||||
|
notify: Reload sshd
|
||||||
|
|
||||||
# See: WeakDH (2015): https://weakdh.org/sysadmin.html
|
# See: WeakDH (2015): https://weakdh.org/sysadmin.html
|
||||||
- name: Remove small Diffie-Hellman SSH moduli
|
- name: Remove small Diffie-Hellman SSH moduli
|
||||||
@@ -24,28 +33,30 @@
|
|||||||
register: check_unsafe_moduli
|
register: check_unsafe_moduli
|
||||||
|
|
||||||
- name: Extract safe Diffie-Hellman SSH moduli
|
- name: Extract safe Diffie-Hellman SSH moduli
|
||||||
|
when: check_unsafe_moduli.stdout | length > 0
|
||||||
ansible.builtin.shell:
|
ansible.builtin.shell:
|
||||||
cmd: awk '$5 >= 3071' moduli > moduli.safe
|
cmd: awk '$5 >= 3071' moduli > moduli.safe
|
||||||
chdir: /etc/ssh
|
chdir: /etc/ssh
|
||||||
creates: moduli.safe
|
creates: moduli.safe
|
||||||
when: check_unsafe_moduli.stdout | length > 0
|
|
||||||
register: extract_safe_moduli
|
register: extract_safe_moduli
|
||||||
|
|
||||||
- name: Replace unsafe Diffie-Hellman SSH moduli
|
- name: Replace unsafe Diffie-Hellman SSH moduli
|
||||||
|
when: extract_safe_moduli is changed
|
||||||
ansible.builtin.command:
|
ansible.builtin.command:
|
||||||
cmd: mv moduli.safe moduli
|
cmd: mv moduli.safe moduli
|
||||||
chdir: /etc/ssh
|
chdir: /etc/ssh
|
||||||
register: replace_small_moduli
|
register: replace_small_moduli
|
||||||
when: extract_safe_moduli is changed
|
notify: Reload sshd
|
||||||
notify: reload sshd
|
|
||||||
|
|
||||||
- name: Remove DSA and ECDSA host keys
|
- name: Remove DSA and ECDSA host keys
|
||||||
file: name=/etc/ssh/{{ item }} state=absent
|
ansible.builtin.file:
|
||||||
|
name: "/etc/ssh/{{ item }}"
|
||||||
|
state: absent
|
||||||
loop:
|
loop:
|
||||||
- ssh_host_dsa_key
|
- ssh_host_dsa_key
|
||||||
- ssh_host_dsa_key.pub
|
- ssh_host_dsa_key.pub
|
||||||
- ssh_host_ecdsa_key
|
- ssh_host_ecdsa_key
|
||||||
- ssh_host_ecdsa_key.pub
|
- ssh_host_ecdsa_key.pub
|
||||||
notify: reload sshd
|
notify: Reload sshd
|
||||||
|
|
||||||
# vim: set sw=2 ts=2:
|
# vim: set sw=2 ts=2:
|
||||||
|
|||||||
@@ -1,24 +1,45 @@
|
|||||||
---
|
---
|
||||||
- name: Add Tarsnap apt mirror
|
- name: Check tarsnap apt signing key
|
||||||
template: src=tarsnap_sources.list.j2 dest=/etc/apt/sources.list.d/tarsnap.list owner=root group=root mode=0644
|
ansible.builtin.stat:
|
||||||
register: add_tarsnap_apt_repository
|
path: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
|
||||||
when: ansible_architecture != 'armv7l'
|
register: tarsnap_signing_key_stat
|
||||||
|
|
||||||
- name: Add GPG key for Tarsnap
|
- name: Download tarsnap apt signing key
|
||||||
apt_key: id=0xBF75EEAB040E447C url=https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc state=present
|
when: not tarsnap_signing_key_stat.stat.exists
|
||||||
register: add_tarsnap_apt_key
|
ansible.builtin.get_url:
|
||||||
|
url: https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc
|
||||||
|
dest: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
register: download_tarsnap_signing_key
|
||||||
|
|
||||||
|
- name: Add tarsnap.org repo
|
||||||
|
when: ansible_architecture != 'armv7l'
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: tarsnap_sources.list.j2
|
||||||
|
dest: /etc/apt/sources.list.d/tarsnap.list
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
register: add_tarsnap_apt_repository
|
||||||
|
|
||||||
- name: Update apt cache
|
- name: Update apt cache
|
||||||
apt:
|
when: (download_tarsnap_signing_key.status_code is defined and download_tarsnap_signing_key.status_code == 200) or add_tarsnap_apt_repository is changed
|
||||||
update_cache: yes
|
ansible.builtin.apt: # noqa no-handler
|
||||||
when:
|
update_cache: true
|
||||||
add_tarsnap_apt_key is changed or
|
|
||||||
add_tarsnap_apt_repository is changed
|
|
||||||
|
|
||||||
- name: Install tarsnap
|
- name: Install tarsnap
|
||||||
apt: pkg=tarsnap cache_valid_time=3600
|
ansible.builtin.apt:
|
||||||
|
pkg: tarsnap
|
||||||
|
cache_valid_time: 3600
|
||||||
|
|
||||||
- name: Copy tarsnaprc
|
- name: Copy tarsnaprc
|
||||||
copy: src=tarsnaprc dest=/root/.tarsnaprc owner=root group=root mode=0600
|
ansible.builtin.copy:
|
||||||
|
src: tarsnaprc
|
||||||
|
dest: /root/.tarsnaprc
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0600"
|
||||||
|
|
||||||
# vim: set sw=2 ts=2:
|
# vim: set sw=2 ts=2:
|
||||||
|
|||||||
@@ -2,13 +2,9 @@
|
|||||||
enabled = true
|
enabled = true
|
||||||
# See: /etc/fail2ban/filter.d/nginx-botsearch.conf
|
# See: /etc/fail2ban/filter.d/nginx-botsearch.conf
|
||||||
filter = nginx-botsearch
|
filter = nginx-botsearch
|
||||||
{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
|
|
||||||
# Integrate with nftables
|
# Integrate with nftables
|
||||||
banaction=nftables[type=allports]
|
banaction=nftables[type=allports]
|
||||||
{% else %}
|
backend = pyinotify
|
||||||
# Integrate with firewalld and ipsets
|
|
||||||
banaction = firewallcmd-ipset
|
|
||||||
{% endif %}
|
|
||||||
logpath = /var/log/nginx/*-access.log
|
logpath = /var/log/nginx/*-access.log
|
||||||
# Try to find a non-existent wp-login.php once and get banned. Tough luck.
|
# Try to find a non-existent wp-login.php once and get banned. Tough luck.
|
||||||
maxretry = 1
|
maxretry = 1
|
||||||
|
|||||||
@@ -2,13 +2,8 @@
|
|||||||
enabled = true
|
enabled = true
|
||||||
# See: /etc/fail2ban/filter.d/sshd.conf
|
# See: /etc/fail2ban/filter.d/sshd.conf
|
||||||
filter = sshd
|
filter = sshd
|
||||||
{% if (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '>=')) or (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=')) %}
|
|
||||||
# Integrate with nftables
|
# Integrate with nftables
|
||||||
banaction=nftables[type=allports]
|
banaction=nftables[type=allports]
|
||||||
{% else %}
|
|
||||||
# Integrate with firewalld and ipsets
|
|
||||||
banaction = firewallcmd-ipset
|
|
||||||
{% endif %}
|
|
||||||
backend = systemd
|
backend = systemd
|
||||||
maxretry = {{ fail2ban_maxretry }}
|
maxretry = {{ fail2ban_maxretry }}
|
||||||
findtime = {{ fail2ban_findtime }}
|
findtime = {{ fail2ban_findtime }}
|
||||||
|
|||||||
@@ -0,0 +1,40 @@
|
|||||||
|
{{ ansible_managed | comment }}
|
||||||
|
|
||||||
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||||
|
|
||||||
|
# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear
|
||||||
|
# audit track of which key was using to log in.
|
||||||
|
LogLevel VERBOSE
|
||||||
|
|
||||||
|
MaxAuthTries 4
|
||||||
|
|
||||||
|
AuthorizedKeysFile .ssh/authorized_keys
|
||||||
|
|
||||||
|
# To disable tunneled clear text passwords, change to no here!
|
||||||
|
{% if ssh_password_authentication == 'disabled' %}
|
||||||
|
PasswordAuthentication no
|
||||||
|
{% else %}
|
||||||
|
PasswordAuthentication yes
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
X11Forwarding no
|
||||||
|
|
||||||
|
# Based on the ssh-audit profile for Debian 13, but with but with all algos with
|
||||||
|
# less than 256 bits removed, as NSA's Suite B removed them years ago and the
|
||||||
|
# new (2018) CNSA suite is 256 bits and up.
|
||||||
|
#
|
||||||
|
# See: ssh-audit.py -P "Hardened Debian 13 (version 1)"
|
||||||
|
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
||||||
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||||
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||||
|
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com
|
||||||
|
|
||||||
|
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
||||||
|
AllowUsers {{ ssh_allowed_users|join(" ") }} {{ provisioning_user.name }}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
PerSourcePenaltyExemptList {{ fail2ban_ignoreip | replace(" ", ",") }}
|
||||||
|
|
||||||
|
# Mask to use for IPv4 and IPv6 respectively when applying network penalties.
|
||||||
|
# The default is 32:128.
|
||||||
|
PerSourceNetBlockSize 24:56
|
||||||
@@ -1,15 +1,19 @@
|
|||||||
|
[Unit]
|
||||||
|
# If nftables is stopped or restarted, propagate to fail2ban as well
|
||||||
|
PartOf=nftables.service
|
||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
PrivateDevices=yes
|
PrivateDevices=yes
|
||||||
PrivateTmp=yes
|
PrivateTmp=yes
|
||||||
ProtectHome=read-only
|
ProtectHome=read-only
|
||||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
|
{% if ansible_distribution_version is version('11','>=') %}
|
||||||
ProtectSystem=strict
|
ProtectSystem=strict
|
||||||
{% else %}
|
{% else %}
|
||||||
{# Older systemd versions don't have ProtectSystem=strict #}
|
{# Older systemd versions don't have ProtectSystem=strict #}
|
||||||
ProtectSystem=full
|
ProtectSystem=full
|
||||||
{% endif %}
|
{% endif %}
|
||||||
NoNewPrivileges=yes
|
NoNewPrivileges=yes
|
||||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
|
{% if ansible_distribution_version is version('11','>=') %}
|
||||||
ReadWritePaths=-/var/run/fail2ban
|
ReadWritePaths=-/var/run/fail2ban
|
||||||
ReadWritePaths=-/var/lib/fail2ban
|
ReadWritePaths=-/var/lib/fail2ban
|
||||||
ReadWritePaths=-/var/log/fail2ban.log
|
ReadWritePaths=-/var/log/fail2ban.log
|
||||||
|
|||||||
@@ -5,47 +5,18 @@
|
|||||||
|
|
||||||
flush ruleset
|
flush ruleset
|
||||||
|
|
||||||
# Lists updated daily by update-spamhaus-nftables.sh
|
# List updated daily by update-firehol-nftables.sh
|
||||||
include "/etc/nftables/spamhaus-ipv4.nft"
|
include "/etc/nftables/firehol_level1-ipv4.nft"
|
||||||
include "/etc/nftables/spamhaus-ipv6.nft"
|
|
||||||
|
|
||||||
# Lists updated monthly (manually)
|
|
||||||
include "/etc/nftables/abuseipdb-ipv4.nft"
|
|
||||||
include "/etc/nftables/abuseipdb-ipv6.nft"
|
|
||||||
|
|
||||||
# Lists updated daily by update-abusech-nftables.sh
|
|
||||||
include "/etc/nftables/abusech-ipv4.nft"
|
|
||||||
|
|
||||||
# Notes:
|
# Notes:
|
||||||
# - tables hold chains, chains hold rules
|
# - tables hold chains, chains hold rules
|
||||||
# - inet is for both ipv4 and ipv6
|
# - inet is for both ipv4 and ipv6
|
||||||
table inet filter {
|
table inet filter {
|
||||||
set spamhaus-ipv4 {
|
set firehol_level1-ipv4 {
|
||||||
type ipv4_addr
|
type ipv4_addr
|
||||||
# if the set contains prefixes we need to use the interval flag
|
# if the set contains prefixes we need to use the interval flag
|
||||||
flags interval
|
flags interval
|
||||||
elements = $SPAMHAUS_IPV4
|
elements = $FIREHOL_LEVEL1_IPV4
|
||||||
}
|
|
||||||
|
|
||||||
set spamhaus-ipv6 {
|
|
||||||
type ipv6_addr
|
|
||||||
flags interval
|
|
||||||
elements = $SPAMHAUS_IPV6
|
|
||||||
}
|
|
||||||
|
|
||||||
set abusech-ipv4 {
|
|
||||||
type ipv4_addr
|
|
||||||
elements = $ABUSECH_IPV4
|
|
||||||
}
|
|
||||||
|
|
||||||
set abuseipdb-ipv4 {
|
|
||||||
type ipv4_addr
|
|
||||||
elements = $ABUSEIPDB_IPV4
|
|
||||||
}
|
|
||||||
|
|
||||||
set abuseipdb-ipv6 {
|
|
||||||
type ipv6_addr
|
|
||||||
elements = $ABUSEIPDB_IPV6
|
|
||||||
}
|
}
|
||||||
|
|
||||||
chain input {
|
chain input {
|
||||||
@@ -55,13 +26,7 @@ table inet filter {
|
|||||||
|
|
||||||
ct state invalid counter drop comment "Early drop of invalid connections"
|
ct state invalid counter drop comment "Early drop of invalid connections"
|
||||||
|
|
||||||
ip saddr @spamhaus-ipv4 counter drop comment "Early drop of incoming packets matching spamhaus-ipv4 list"
|
ip saddr @firehol_level1-ipv4 counter drop comment "Early drop of incoming packets matching firehol_level1-ipv4 list"
|
||||||
ip6 saddr @spamhaus-ipv6 counter drop comment "Early drop of incoming packets matching spamhaus-ipv6 list"
|
|
||||||
|
|
||||||
ip saddr @abusech-ipv4 counter drop comment "Early drop of packets matching abusech-ipv4 list"
|
|
||||||
|
|
||||||
ip saddr @abuseipdb-ipv4 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv4 list"
|
|
||||||
ip6 saddr @abuseipdb-ipv6 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv6 list"
|
|
||||||
|
|
||||||
iifname lo accept comment "Allow from loopback"
|
iifname lo accept comment "Allow from loopback"
|
||||||
|
|
||||||
@@ -105,12 +70,6 @@ table inet filter {
|
|||||||
chain output {
|
chain output {
|
||||||
type filter hook output priority 0;
|
type filter hook output priority 0;
|
||||||
|
|
||||||
ip daddr @spamhaus-ipv4 counter drop comment "Drop outgoing packets matching spamhaus-ipv4 list"
|
ip daddr @firehol_level1-ipv4 counter drop comment "Drop outgoing packets matching firehol_level1-ipv4 list"
|
||||||
ip6 daddr @spamhaus-ipv6 counter drop comment "Drop outgoing packets matching spamhaus-ipv6 list"
|
|
||||||
|
|
||||||
ip daddr @abusech-ipv4 counter drop comment "Drop outgoing packets matching abusech-ipv4 list"
|
|
||||||
|
|
||||||
ip daddr @abuseipdb-ipv4 counter drop comment "Drop outgoing packets matching abuseipdb-ipv4 list"
|
|
||||||
ip6 daddr @abuseipdb-ipv6 counter drop comment "Drop outgoing packets matching abuseipdb-ipv6 list"
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,81 +0,0 @@
|
|||||||
<zone>
|
|
||||||
<short>Public</short>
|
|
||||||
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
|
|
||||||
<interface name="{{ ansible_default_ipv4.interface }}"/>
|
|
||||||
|
|
||||||
{# ssh rules #}
|
|
||||||
<rule family="ipv4">
|
|
||||||
<source address="0.0.0.0/0"/>
|
|
||||||
<port protocol="tcp" port="22"/>
|
|
||||||
<accept/>
|
|
||||||
</rule>
|
|
||||||
|
|
||||||
{# ipv6 ssh rules #}
|
|
||||||
<rule family="ipv6">
|
|
||||||
<source address="::/0"/>
|
|
||||||
<port protocol="tcp" port="22"/>
|
|
||||||
<accept/>
|
|
||||||
</rule>
|
|
||||||
|
|
||||||
{# web rules #}
|
|
||||||
<rule family="ipv4">
|
|
||||||
<source address="0.0.0.0/0"/>
|
|
||||||
<port protocol="tcp" port="80"/>
|
|
||||||
<accept/>
|
|
||||||
</rule>
|
|
||||||
|
|
||||||
{# ipv6 web rules #}
|
|
||||||
<rule family="ipv6">
|
|
||||||
<source address="::/0"/>
|
|
||||||
<port protocol="tcp" port="80"/>
|
|
||||||
<accept/>
|
|
||||||
</rule>
|
|
||||||
|
|
||||||
{# munin rules #}
|
|
||||||
{% if munin_master_host is defined %}
|
|
||||||
<rule family="ipv4">
|
|
||||||
<source address="{{ ghetto_ipsets[munin_master_host].src }}"/>
|
|
||||||
<port protocol="tcp" port="{{ munin_node_port }}"/>
|
|
||||||
<accept/>
|
|
||||||
</rule>
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{# extra rules #}
|
|
||||||
{% if extra_iptables_rules is defined %}
|
|
||||||
{% for rule in extra_iptables_rules %}
|
|
||||||
<rule family="ipv4">
|
|
||||||
<source address="{{ ghetto_ipsets[rule.acl].src }}"/>
|
|
||||||
<port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
|
|
||||||
<accept/>
|
|
||||||
</rule>
|
|
||||||
|
|
||||||
{# ipv6 extra rules #}
|
|
||||||
{% if ghetto_ipsets[rule.acl].ipv6src is defined %}
|
|
||||||
<rule family="ipv6">
|
|
||||||
<source address="{{ ghetto_ipsets[rule.acl].ipv6src }}"/>
|
|
||||||
<port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
|
|
||||||
<accept/>
|
|
||||||
</rule>
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% endfor %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
<rule>
|
|
||||||
<source ipset="abusers-ipv4"/>
|
|
||||||
<drop/>
|
|
||||||
</rule>
|
|
||||||
<rule>
|
|
||||||
<source ipset="abusers-ipv6"/>
|
|
||||||
<drop/>
|
|
||||||
</rule>
|
|
||||||
<rule>
|
|
||||||
<source ipset="spamhaus-ipv4"/>
|
|
||||||
<drop/>
|
|
||||||
</rule>
|
|
||||||
<rule>
|
|
||||||
<source ipset="spamhaus-ipv6"/>
|
|
||||||
<drop/>
|
|
||||||
</rule>
|
|
||||||
|
|
||||||
</zone>
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
#!/bin/sh -e
|
|
||||||
#
|
|
||||||
# rc.local
|
|
||||||
#
|
|
||||||
# This script is executed at the end of each multiuser runlevel.
|
|
||||||
# Make sure that the script will "exit 0" on success or any other
|
|
||||||
# value on error.
|
|
||||||
#
|
|
||||||
# In order to enable or disable this script just change the execution
|
|
||||||
# bits.
|
|
||||||
#
|
|
||||||
# By default this script does nothing.
|
|
||||||
|
|
||||||
exit 0
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
{% if ansible_distribution == 'Ubuntu' %}
|
|
||||||
deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security main restricted universe multiverse
|
|
||||||
{% elif ansible_distribution == 'Debian' %}
|
|
||||||
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}/updates main contrib non-free
|
|
||||||
{% endif %}
|
|
||||||
@@ -1,16 +1,6 @@
|
|||||||
{% if ansible_distribution == 'Ubuntu' %}
|
|
||||||
{% set apt_mirror = apt_mirror | default("ubuntu.mirror.ac.ke") %}
|
|
||||||
|
|
||||||
deb http://{{ apt_mirror }}/ubuntu/ {{ ansible_distribution_release }} main restricted universe multiverse
|
|
||||||
deb http://{{ apt_mirror }}/ubuntu/ {{ ansible_distribution_release }}-updates main restricted universe multiverse
|
|
||||||
deb http://security.ubuntu.com/ubuntu/ {{ ansible_distribution_release }}-security main restricted universe multiverse
|
|
||||||
|
|
||||||
{% else %}
|
|
||||||
{% set apt_mirror = apt_mirror | default('deb.debian.org') %}
|
{% set apt_mirror = apt_mirror | default('deb.debian.org') %}
|
||||||
deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }} main contrib non-free
|
deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }} main contrib non-free
|
||||||
|
|
||||||
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main contrib non-free
|
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main contrib non-free
|
||||||
|
|
||||||
deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }}-updates main contrib non-free
|
deb http://{{ apt_mirror }}/debian/ {{ ansible_distribution_release }}-updates main contrib non-free
|
||||||
|
|
||||||
{% endif %} {# ansible_distribution #}
|
|
||||||
|
|||||||
@@ -56,7 +56,11 @@ AuthorizedKeysFile .ssh/authorized_keys
|
|||||||
#IgnoreRhosts yes
|
#IgnoreRhosts yes
|
||||||
|
|
||||||
# To disable tunneled clear text passwords, change to no here!
|
# To disable tunneled clear text passwords, change to no here!
|
||||||
#PasswordAuthentication yes
|
{% if ssh_password_authentication == 'disabled' %}
|
||||||
|
PasswordAuthentication no
|
||||||
|
{% else %}
|
||||||
|
PasswordAuthentication yes
|
||||||
|
{% endif %}
|
||||||
#PermitEmptyPasswords no
|
#PermitEmptyPasswords no
|
||||||
|
|
||||||
# Change to yes to enable challenge-response passwords (beware issues with
|
# Change to yes to enable challenge-response passwords (beware issues with
|
||||||
@@ -131,8 +135,7 @@ Subsystem sftp /usr/lib/openssh/sftp-server
|
|||||||
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
||||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||||
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
|
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
|
||||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
|
||||||
|
|
||||||
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
||||||
# Is there a list of allowed users?
|
# Is there a list of allowed users?
|
||||||
|
|||||||
@@ -1,9 +1,8 @@
|
|||||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
|
||||||
|
|
||||||
# This is the sshd server system-wide configuration file. See
|
# This is the sshd server system-wide configuration file. See
|
||||||
# sshd_config(5) for more information.
|
# sshd_config(5) for more information.
|
||||||
|
|
||||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games
|
||||||
|
|
||||||
# The strategy used for options in the default sshd_config shipped with
|
# The strategy used for options in the default sshd_config shipped with
|
||||||
# OpenSSH is to specify options with their default value where
|
# OpenSSH is to specify options with their default value where
|
||||||
@@ -18,6 +17,7 @@ Include /etc/ssh/sshd_config.d/*.conf
|
|||||||
#ListenAddress ::
|
#ListenAddress ::
|
||||||
|
|
||||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||||
|
#HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||||
|
|
||||||
# Ciphers and keying
|
# Ciphers and keying
|
||||||
@@ -56,12 +56,16 @@ AuthorizedKeysFile .ssh/authorized_keys
|
|||||||
#IgnoreRhosts yes
|
#IgnoreRhosts yes
|
||||||
|
|
||||||
# To disable tunneled clear text passwords, change to no here!
|
# To disable tunneled clear text passwords, change to no here!
|
||||||
#PasswordAuthentication yes
|
{% if ssh_password_authentication == 'disabled' %}
|
||||||
|
PasswordAuthentication no
|
||||||
|
{% else %}
|
||||||
|
PasswordAuthentication yes
|
||||||
|
{% endif %}
|
||||||
#PermitEmptyPasswords no
|
#PermitEmptyPasswords no
|
||||||
|
|
||||||
# Change to yes to enable challenge-response passwords (beware issues with
|
# Change to yes to enable challenge-response passwords (beware issues with
|
||||||
# some PAM modules and threads)
|
# some PAM modules and threads)
|
||||||
ChallengeResponseAuthentication no
|
KbdInteractiveAuthentication no
|
||||||
|
|
||||||
# Kerberos options
|
# Kerberos options
|
||||||
#KerberosAuthentication no
|
#KerberosAuthentication no
|
||||||
@@ -77,13 +81,13 @@ ChallengeResponseAuthentication no
|
|||||||
|
|
||||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||||
# and session processing. If this is enabled, PAM authentication will
|
# and session processing. If this is enabled, PAM authentication will
|
||||||
# be allowed through the ChallengeResponseAuthentication and
|
# be allowed through the KbdInteractiveAuthentication and
|
||||||
# PasswordAuthentication. Depending on your PAM configuration,
|
# PasswordAuthentication. Depending on your PAM configuration,
|
||||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
# PAM authentication via KbdInteractiveAuthentication may bypass
|
||||||
# the setting of "PermitRootLogin without-password".
|
# the setting of "PermitRootLogin prohibit-password".
|
||||||
# If you just want the PAM account and session checks to run without
|
# If you just want the PAM account and session checks to run without
|
||||||
# PAM authentication, then enable this but set PasswordAuthentication
|
# PAM authentication, then enable this but set PasswordAuthentication
|
||||||
# and ChallengeResponseAuthentication to 'no'.
|
# and KbdInteractiveAuthentication to 'no'.
|
||||||
UsePAM yes
|
UsePAM yes
|
||||||
|
|
||||||
#AllowAgentForwarding yes
|
#AllowAgentForwarding yes
|
||||||
@@ -101,7 +105,7 @@ PrintMotd no
|
|||||||
#ClientAliveInterval 0
|
#ClientAliveInterval 0
|
||||||
#ClientAliveCountMax 3
|
#ClientAliveCountMax 3
|
||||||
#UseDNS no
|
#UseDNS no
|
||||||
#PidFile /var/run/sshd.pid
|
#PidFile /run/sshd.pid
|
||||||
#MaxStartups 10:30:100
|
#MaxStartups 10:30:100
|
||||||
#PermitTunnel no
|
#PermitTunnel no
|
||||||
#ChrootDirectory none
|
#ChrootDirectory none
|
||||||
@@ -114,7 +118,7 @@ PrintMotd no
|
|||||||
AcceptEnv LANG LC_*
|
AcceptEnv LANG LC_*
|
||||||
|
|
||||||
# override default of no subsystems
|
# override default of no subsystems
|
||||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||||
|
|
||||||
# Example of overriding settings on a per-user basis
|
# Example of overriding settings on a per-user basis
|
||||||
#Match User anoncvs
|
#Match User anoncvs
|
||||||
@@ -122,14 +126,16 @@ Subsystem sftp /usr/lib/openssh/sftp-server
|
|||||||
# AllowTcpForwarding no
|
# AllowTcpForwarding no
|
||||||
# PermitTTY no
|
# PermitTTY no
|
||||||
# ForceCommand cvs server
|
# ForceCommand cvs server
|
||||||
PasswordAuthentication yes
|
|
||||||
|
|
||||||
# Originally from: https://stribika.github.io/2015/01/04/secure-secure-shell.html
|
# Based on the ssh-audit profile for OpenSSH 9.2, but with but with all algos
|
||||||
# ... but with ciphers and MACs with < 256 bits removed, as NSA's Suite B now
|
# with less than 256 bits removed, as NSA's Suite B removed them years ago and
|
||||||
# does away with these! See: https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
|
# the new (2018) CNSA suite is 256 bits and up.
|
||||||
|
#
|
||||||
|
# See: https://github.com/jtesta/ssh-audit/blob/master/src/ssh_audit/policy.py
|
||||||
|
# See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
|
||||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
||||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||||
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
|
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
|
||||||
|
|
||||||
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
{% if ssh_allowed_users is defined and ssh_allowed_users %}
|
||||||
# Is there a list of allowed users?
|
# Is there a list of allowed users?
|
||||||
@@ -1,133 +0,0 @@
|
|||||||
# $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
|
|
||||||
|
|
||||||
# This is the sshd server system-wide configuration file. See
|
|
||||||
# sshd_config(5) for more information.
|
|
||||||
|
|
||||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
|
||||||
|
|
||||||
# The strategy used for options in the default sshd_config shipped with
|
|
||||||
# OpenSSH is to specify options with their default value where
|
|
||||||
# possible, but leave them commented. Uncommented options override the
|
|
||||||
# default value.
|
|
||||||
|
|
||||||
#Port 22
|
|
||||||
#AddressFamily any
|
|
||||||
#ListenAddress 0.0.0.0
|
|
||||||
#ListenAddress ::
|
|
||||||
|
|
||||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
|
||||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
|
||||||
|
|
||||||
# Ciphers and keying
|
|
||||||
#RekeyLimit default none
|
|
||||||
|
|
||||||
# Logging
|
|
||||||
#SyslogFacility AUTH
|
|
||||||
# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear audit track of which key was using to log in.
|
|
||||||
LogLevel VERBOSE
|
|
||||||
|
|
||||||
# Authentication:
|
|
||||||
|
|
||||||
#LoginGraceTime 2m
|
|
||||||
PermitRootLogin prohibit-password
|
|
||||||
#StrictModes yes
|
|
||||||
MaxAuthTries 4
|
|
||||||
#MaxSessions 10
|
|
||||||
|
|
||||||
#PubkeyAuthentication yes
|
|
||||||
|
|
||||||
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
|
|
||||||
# but this is overridden so installations will only check .ssh/authorized_keys
|
|
||||||
AuthorizedKeysFile .ssh/authorized_keys
|
|
||||||
|
|
||||||
#AuthorizedPrincipalsFile none
|
|
||||||
|
|
||||||
#AuthorizedKeysCommand none
|
|
||||||
#AuthorizedKeysCommandUser nobody
|
|
||||||
|
|
||||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
|
||||||
#HostbasedAuthentication no
|
|
||||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
|
||||||
# HostbasedAuthentication
|
|
||||||
#IgnoreUserKnownHosts no
|
|
||||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
|
||||||
#IgnoreRhosts yes
|
|
||||||
|
|
||||||
# To disable tunneled clear text passwords, change to no here!
|
|
||||||
#PasswordAuthentication yes
|
|
||||||
#PermitEmptyPasswords no
|
|
||||||
|
|
||||||
# Change to yes to enable challenge-response passwords (beware issues with
|
|
||||||
# some PAM modules and threads)
|
|
||||||
ChallengeResponseAuthentication no
|
|
||||||
|
|
||||||
# Kerberos options
|
|
||||||
#KerberosAuthentication no
|
|
||||||
#KerberosOrLocalPasswd yes
|
|
||||||
#KerberosTicketCleanup yes
|
|
||||||
#KerberosGetAFSToken no
|
|
||||||
|
|
||||||
# GSSAPI options
|
|
||||||
#GSSAPIAuthentication no
|
|
||||||
#GSSAPICleanupCredentials yes
|
|
||||||
#GSSAPIStrictAcceptorCheck yes
|
|
||||||
#GSSAPIKeyExchange no
|
|
||||||
|
|
||||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
|
||||||
# and session processing. If this is enabled, PAM authentication will
|
|
||||||
# be allowed through the ChallengeResponseAuthentication and
|
|
||||||
# PasswordAuthentication. Depending on your PAM configuration,
|
|
||||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
|
||||||
# the setting of "PermitRootLogin without-password".
|
|
||||||
# If you just want the PAM account and session checks to run without
|
|
||||||
# PAM authentication, then enable this but set PasswordAuthentication
|
|
||||||
# and ChallengeResponseAuthentication to 'no'.
|
|
||||||
UsePAM yes
|
|
||||||
|
|
||||||
#AllowAgentForwarding yes
|
|
||||||
#AllowTcpForwarding yes
|
|
||||||
#GatewayPorts no
|
|
||||||
X11Forwarding no
|
|
||||||
#X11DisplayOffset 10
|
|
||||||
#X11UseLocalhost yes
|
|
||||||
#PermitTTY yes
|
|
||||||
PrintMotd no
|
|
||||||
#PrintLastLog yes
|
|
||||||
#TCPKeepAlive yes
|
|
||||||
#UseLogin no
|
|
||||||
#PermitUserEnvironment no
|
|
||||||
#Compression delayed
|
|
||||||
#ClientAliveInterval 0
|
|
||||||
#ClientAliveCountMax 3
|
|
||||||
#UseDNS no
|
|
||||||
#PidFile /var/run/sshd.pid
|
|
||||||
#MaxStartups 10:30:100
|
|
||||||
#PermitTunnel no
|
|
||||||
#ChrootDirectory none
|
|
||||||
#VersionAddendum none
|
|
||||||
|
|
||||||
# no default banner path
|
|
||||||
#Banner none
|
|
||||||
|
|
||||||
# Allow client to pass locale environment variables
|
|
||||||
AcceptEnv LANG LC_*
|
|
||||||
|
|
||||||
# override default of no subsystems
|
|
||||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
|
||||||
|
|
||||||
# Example of overriding settings on a per-user basis
|
|
||||||
#Match User anoncvs
|
|
||||||
# X11Forwarding no
|
|
||||||
# AllowTcpForwarding no
|
|
||||||
# PermitTTY no
|
|
||||||
# ForceCommand cvs server
|
|
||||||
|
|
||||||
# Originally from: https://stribika.github.io/2015/01/04/secure-secure-shell.html
|
|
||||||
# ... but with ciphers and MACs with < 256 bits removed, as NSA's Suite B now
|
|
||||||
# does away with these! See: https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml
|
|
||||||
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
|
|
||||||
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
|
|
||||||
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
|
|
||||||
|
|
||||||
# only allow shell access by provisioning user
|
|
||||||
AllowUsers {{ provisioning_user.name }}
|
|
||||||
@@ -1,100 +0,0 @@
|
|||||||
#
|
|
||||||
# /etc/sysctl.conf - Configuration file for setting system variables
|
|
||||||
# See /etc/sysctl.d/ for additional system variables
|
|
||||||
# See sysctl.conf (5) for information.
|
|
||||||
#
|
|
||||||
|
|
||||||
#kernel.domainname = example.com
|
|
||||||
|
|
||||||
# Uncomment the following to stop low-level messages on console
|
|
||||||
#kernel.printk = 3 4 1 3
|
|
||||||
|
|
||||||
##############################################################3
|
|
||||||
# Functions previously found in netbase
|
|
||||||
#
|
|
||||||
|
|
||||||
# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
|
|
||||||
# Turn on Source Address Verification in all interfaces to
|
|
||||||
# prevent some spoofing attacks
|
|
||||||
#net.ipv4.conf.default.rp_filter=1
|
|
||||||
#net.ipv4.conf.all.rp_filter=1
|
|
||||||
|
|
||||||
# Uncomment the next line to enable TCP/IP SYN cookies
|
|
||||||
# See http://lwn.net/Articles/277146/
|
|
||||||
# Note: This may impact IPv6 TCP sessions too
|
|
||||||
#net.ipv4.tcp_syncookies=1
|
|
||||||
|
|
||||||
# Uncomment the next line to enable packet forwarding for IPv4
|
|
||||||
#net.ipv4.ip_forward=1
|
|
||||||
|
|
||||||
# Uncomment the next line to enable packet forwarding for IPv6
|
|
||||||
# Enabling this option disables Stateless Address Autoconfiguration
|
|
||||||
# based on Router Advertisements for this host
|
|
||||||
#net.ipv6.conf.all.forwarding=1
|
|
||||||
|
|
||||||
|
|
||||||
###################################################################
|
|
||||||
# Additional settings - these settings can improve the network
|
|
||||||
# security of the host and prevent against some network attacks
|
|
||||||
# including spoofing attacks and man in the middle attacks through
|
|
||||||
# redirection. Some network environments, however, require that these
|
|
||||||
# settings are disabled so review and enable them as needed.
|
|
||||||
#
|
|
||||||
# Do not accept ICMP redirects (prevent MITM attacks)
|
|
||||||
#net.ipv4.conf.all.accept_redirects = 0
|
|
||||||
#net.ipv6.conf.all.accept_redirects = 0
|
|
||||||
# _or_
|
|
||||||
# Accept ICMP redirects only for gateways listed in our default
|
|
||||||
# gateway list (enabled by default)
|
|
||||||
# net.ipv4.conf.all.secure_redirects = 1
|
|
||||||
#
|
|
||||||
# Do not send ICMP redirects (we are not a router)
|
|
||||||
#net.ipv4.conf.all.send_redirects = 0
|
|
||||||
#
|
|
||||||
# Do not accept IP source route packets (we are not a router)
|
|
||||||
#net.ipv4.conf.all.accept_source_route = 0
|
|
||||||
#net.ipv6.conf.all.accept_source_route = 0
|
|
||||||
#
|
|
||||||
# Log Martian Packets
|
|
||||||
#net.ipv4.conf.all.log_martians = 1
|
|
||||||
#
|
|
||||||
|
|
||||||
# CIS Benchmark Adjustments
|
|
||||||
# See: https://github.com/alanorth/securekickstarts
|
|
||||||
kernel.randomize_va_space = 2
|
|
||||||
net.ipv4.ip_forward = 0
|
|
||||||
net.ipv4.conf.all.send_redirects = 0
|
|
||||||
net.ipv4.conf.default.send_redirects = 0
|
|
||||||
net.ipv4.conf.all.accept_source_route = 0
|
|
||||||
net.ipv4.conf.default.accept_source_route = 0
|
|
||||||
net.ipv4.conf.all.accept_redirects = 0
|
|
||||||
net.ipv4.conf.default.accept_redirects = 0
|
|
||||||
net.ipv4.conf.all.secure_redirects = 0
|
|
||||||
net.ipv4.conf.default.secure_redirects = 0
|
|
||||||
net.ipv4.conf.all.log_martians = 1
|
|
||||||
net.ipv4.conf.default.log_martians = 1
|
|
||||||
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
|
||||||
net.ipv4.icmp_ignore_bogus_error_responses = 1
|
|
||||||
net.ipv4.conf.all.rp_filter = 1
|
|
||||||
net.ipv4.conf.default.rp_filter = 1
|
|
||||||
net.ipv4.tcp_syncookies = 1
|
|
||||||
|
|
||||||
# TCP stuff
|
|
||||||
# See: http://fasterdata.es.net/host-tuning/linux/
|
|
||||||
# increase TCP max buffer size settable using setsockopt()
|
|
||||||
net.core.rmem_max = 16777216
|
|
||||||
net.core.wmem_max = 16777216
|
|
||||||
# increase Linux autotuning TCP buffer limit
|
|
||||||
net.ipv4.tcp_rmem = 4096 87380 16777216
|
|
||||||
net.ipv4.tcp_wmem = 4096 65536 16777216
|
|
||||||
# increase the length of the processor input queue
|
|
||||||
net.core.netdev_max_backlog = 30000
|
|
||||||
# recommended for hosts with jumbo frames enabled
|
|
||||||
#net.ipv4.tcp_mtu_probing=1
|
|
||||||
|
|
||||||
# increase quadruplets (src ip, src port, dest ip, dest port)
|
|
||||||
# see: http://vincent.bernat.im/en/blog/2014-tcp-time-wait-state-linux.html
|
|
||||||
net.ipv4.ip_local_port_range = 10240 65535
|
|
||||||
# recommended for web servers, especially if running SPDY
|
|
||||||
# see: http://www.chromium.org/spdy/spdy-best-practices
|
|
||||||
net.ipv4.tcp_slow_start_after_idle = 0
|
|
||||||
@@ -1 +1 @@
|
|||||||
deb [arch=amd64] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./
|
deb [arch=amd64 signed-by=/etc/apt/keyrings/tarsnap-deb-packaging-key.asc] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./
|
||||||
|
|||||||
65
roles/common/templates/update-firehol-nftables.sh.j2
Executable file
65
roles/common/templates/update-firehol-nftables.sh.j2
Executable file
@@ -0,0 +1,65 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# update-firehol-nftables.sh v0.0.1
|
||||||
|
#
|
||||||
|
# Download FireHOL lists and load them into nftables sets.
|
||||||
|
#
|
||||||
|
# See: https://iplists.firehol.org/
|
||||||
|
#
|
||||||
|
# Copyright (C) 2025 Alan Orth
|
||||||
|
#
|
||||||
|
# SPDX-License-Identifier: GPL-3.0-only
|
||||||
|
|
||||||
|
# Exit on first error
|
||||||
|
set -o errexit
|
||||||
|
|
||||||
|
firehol_level1_ipv4_set_path=/etc/nftables/firehol_level1-ipv4.nft
|
||||||
|
|
||||||
|
function download() {
|
||||||
|
echo "Downloading $1"
|
||||||
|
wget -q -O - "https://iplists.firehol.org/files/$1" > "$1"
|
||||||
|
}
|
||||||
|
|
||||||
|
download firehol_level1.netset
|
||||||
|
|
||||||
|
if [[ -f "firehol_level1.netset" ]]; then
|
||||||
|
echo "Processing FireHOL Level 1 list"
|
||||||
|
|
||||||
|
firehol_level1_ipv4_list_temp=$(mktemp)
|
||||||
|
firehol_level1_ipv4_set_temp=$(mktemp)
|
||||||
|
|
||||||
|
# Filter blank lines, comments, and bogons we use inside the LAN, DMZ, and
|
||||||
|
# for local services like systemd-resolved and others on localhost. Ideally
|
||||||
|
# these are blocked already at the WAN side by network administrators.
|
||||||
|
cat firehol_level1.netset \
|
||||||
|
| sed \
|
||||||
|
-e '/^$/d' \
|
||||||
|
-e '/^#.*/d' \
|
||||||
|
-e '/^127\.0\.0\.0\/8/d' \
|
||||||
|
> "$firehol_level1_ipv4_list_temp"
|
||||||
|
|
||||||
|
echo "Building firehol_level1-ipv4 set"
|
||||||
|
cat << NFT_HEAD > "$firehol_level1_ipv4_set_temp"
|
||||||
|
#!/usr/sbin/nft -f
|
||||||
|
|
||||||
|
define FIREHOL_LEVEL1_IPV4 = {
|
||||||
|
NFT_HEAD
|
||||||
|
|
||||||
|
while read -r network; do
|
||||||
|
# nftables doesn't mind if the last element in the set has a trailing
|
||||||
|
# comma so we don't need to do anything special here.
|
||||||
|
echo "$network," >> "$firehol_level1_ipv4_set_temp"
|
||||||
|
done < $firehol_level1_ipv4_list_temp
|
||||||
|
|
||||||
|
echo "}" >> "$firehol_level1_ipv4_set_temp"
|
||||||
|
|
||||||
|
install -m 0600 "$firehol_level1_ipv4_set_temp" "$firehol_level1_ipv4_set_path"
|
||||||
|
|
||||||
|
rm -f "$firehol_level1_ipv4_list_temp" "$firehol_level1_ipv4_set_temp"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Restarting nftables"
|
||||||
|
|
||||||
|
/usr/bin/systemctl restart nftables.service
|
||||||
|
|
||||||
|
rm -v firehol_level1.netset
|
||||||
@@ -1,5 +1,5 @@
|
|||||||
---
|
---
|
||||||
# file: roles/mariadb/defaults/main.yml
|
# ansible.builtin.file: roles/mariadb/defaults/main.yml
|
||||||
#
|
#
|
||||||
# Based on my running of mysqltuner.pl on a host with three WordPress databases
|
# Based on my running of mysqltuner.pl on a host with three WordPress databases
|
||||||
#
|
#
|
||||||
|
|||||||
@@ -1,5 +1,7 @@
|
|||||||
---
|
---
|
||||||
- name: restart mariadb
|
- name: restart mariadb
|
||||||
systemd: name=mariadb state=restarted
|
ansible.builtin.systemd_service:
|
||||||
|
name: mariadb
|
||||||
|
state: restarted
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,57 +1,111 @@
|
|||||||
---
|
---
|
||||||
- name: Add GPG key for MariaDB repo
|
- name: Remove MariaDB key from apt-key
|
||||||
apt_key: id=0x177F4010FE56CA3336300305F1656F24C74CD1D8 url=https://mariadb.org/mariadb_release_signing_key.asc
|
ansible.builtin.apt_key:
|
||||||
register: add_mariadb_apt_key
|
id: "013577200103762554506315430003013705453362230723150730"
|
||||||
tags: mariadb, packages
|
state: absent
|
||||||
|
tags:
|
||||||
|
- packages
|
||||||
|
- mariadb
|
||||||
|
|
||||||
- name: Add MariaDB 10.5 repo
|
- name: Check MariaDB package signing key
|
||||||
template: src=mariadb.list.j2 dest=/etc/apt/sources.list.d/mariadb.list owner=root group=root mode=0644
|
ansible.builtin.stat:
|
||||||
|
path: /etc/apt/keyrings/mariadb_release_signing_key.asc
|
||||||
|
register: mariadb_signing_key_stat
|
||||||
|
tags:
|
||||||
|
- packages
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: Download MariaDB package signing key
|
||||||
|
when: not mariadb_signing_key_stat.stat.exists
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: https://mariadb.org/mariadb_release_signing_key.asc
|
||||||
|
dest: /etc/apt/keyrings/mariadb_release_signing_key.asc
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
register: download_mariadb_signing_key
|
||||||
|
tags:
|
||||||
|
- packages
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: Add MariaDB 10.11 repo
|
||||||
|
ansible.builtin.apt_repository:
|
||||||
|
repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/mariadb_release_signing_key.asc] https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/debian {{ ansible_distribution_release
|
||||||
|
}} main
|
||||||
|
filename: mariadb
|
||||||
|
state: present
|
||||||
register: add_mariadb_apt_repository
|
register: add_mariadb_apt_repository
|
||||||
tags: mariadb, packages
|
tags:
|
||||||
|
- packages
|
||||||
|
- mariadb
|
||||||
|
|
||||||
- name: Update apt cache
|
- name: Update apt cache
|
||||||
apt:
|
when: (download_mariadb_signing_key.status_code is defined and download_mariadb_signing_key.status_code == 200) or add_mariadb_apt_repository is changed
|
||||||
update_cache: yes
|
ansible.builtin.apt: # noqa no-handler
|
||||||
when:
|
update_cache: true
|
||||||
add_mariadb_apt_key is changed or
|
tags:
|
||||||
add_mariadb_apt_repository is changed
|
- packages
|
||||||
|
- mariadb
|
||||||
|
|
||||||
- name: Install mariadb-server
|
- name: Install mariadb-server
|
||||||
apt: name={{ item }} state=present cache_valid_time=3600
|
ansible.builtin.apt:
|
||||||
loop:
|
name: [mariadb-server, python3-pymysql]
|
||||||
- mariadb-server
|
state: present
|
||||||
- python3-pymysql # for ansible
|
cache_valid_time: 3600
|
||||||
tags: mariadb, packages
|
tags: mariadb, packages
|
||||||
|
|
||||||
- name: Create system my.cnf
|
- name: Create system my.cnf
|
||||||
template: src=my.cnf.j2 dest=/etc/mysql/my.cnf owner=root group=root mode=0644
|
ansible.builtin.template:
|
||||||
|
src: my.cnf.j2
|
||||||
|
dest: /etc/mysql/my.cnf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
notify:
|
notify:
|
||||||
- restart mariadb
|
- restart mariadb
|
||||||
tags: mariadb
|
tags: mariadb
|
||||||
|
|
||||||
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_user_module.html
|
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_user_module.html
|
||||||
- name: Update MariaDB root password for all root accounts
|
- name: Update MariaDB root password for all root accounts
|
||||||
mysql_user: name=root host={{ item }} password={{ mariadb_root_password }} login_unix_socket={{ mariadb_login_unix_socket }}
|
community.mysql.mysql_user:
|
||||||
|
name: root
|
||||||
|
host: "{{ item }}"
|
||||||
|
password: "{{ mariadb_root_password }}"
|
||||||
|
login_unix_socket: "{{ mariadb_login_unix_socket }}"
|
||||||
loop:
|
loop:
|
||||||
- 127.0.0.1
|
- 127.0.0.1
|
||||||
- ::1
|
- ::1
|
||||||
tags: mariadb
|
tags: mariadb
|
||||||
|
|
||||||
- name: Create .my.conf file with root credentials
|
- name: Create .my.conf file with root credentials
|
||||||
template: src=.my.cnf.j2 dest=/root/.my.cnf owner=root mode=0600
|
ansible.builtin.template:
|
||||||
|
src: .my.cnf.j2
|
||||||
|
dest: /root/.my.cnf
|
||||||
|
owner: root
|
||||||
|
mode: "0600"
|
||||||
tags: mariadb
|
tags: mariadb
|
||||||
|
|
||||||
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_db_module.html
|
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_db_module.html
|
||||||
- name: Create MariaDB database(s)
|
- name: Create MariaDB database(s)
|
||||||
mysql_db: db={{ item.name }} state=present encoding=utf8mb4 login_unix_socket={{ mariadb_login_unix_socket }}
|
|
||||||
loop: "{{ mariadb_databases }}"
|
|
||||||
when: mariadb_databases is defined
|
when: mariadb_databases is defined
|
||||||
|
community.mysql.mysql_db:
|
||||||
|
db: "{{ item.name }}"
|
||||||
|
state: present
|
||||||
|
encoding: utf8mb4
|
||||||
|
login_unix_socket: "{{ mariadb_login_unix_socket }}"
|
||||||
|
loop: "{{ mariadb_databases }}"
|
||||||
tags: mariadb
|
tags: mariadb
|
||||||
|
|
||||||
- name: Create MariaDB user(s)
|
- name: Create MariaDB user(s)
|
||||||
mysql_user: name={{ item.user }} password={{ item.pass }} priv={{ item.name }}.*:ALL host=127.0.0.1 state=present login_unix_socket={{ mariadb_login_unix_socket }}
|
|
||||||
loop: "{{ mariadb_databases }}"
|
|
||||||
when: mariadb_databases is defined
|
when: mariadb_databases is defined
|
||||||
|
community.mysql.mysql_user:
|
||||||
|
name: "{{ item.user }}"
|
||||||
|
password: "{{ item.pass }}"
|
||||||
|
priv: "{{ item.name }}.*:ALL"
|
||||||
|
host: 127.0.0.1
|
||||||
|
state: present
|
||||||
|
login_unix_socket: "{{ mariadb_login_unix_socket }}"
|
||||||
|
loop: "{{ mariadb_databases }}"
|
||||||
tags: mariadb
|
tags: mariadb
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,3 +0,0 @@
|
|||||||
{{ ansible_managed | comment }}
|
|
||||||
|
|
||||||
deb [arch=amd64] http://mirror.23media.de/mariadb/repo/10.5/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} main
|
|
||||||
@@ -1,4 +1,4 @@
|
|||||||
---
|
---
|
||||||
# file: roles/munin/handlers/main.yml
|
# ansible.builtin.file: roles/munin/handlers/main.yml
|
||||||
- name: restart munin-node
|
- name: restart munin-node
|
||||||
systemd: name=munin-node state=restarted
|
ansible.builtin.systemd_service: name=munin-node state=restarted
|
||||||
|
|||||||
@@ -1,8 +1,8 @@
|
|||||||
---
|
---
|
||||||
- name: Configure munin scraper
|
- name: Configure munin scraper
|
||||||
import_tasks: munin.yml
|
ansible.builtin.import_tasks: munin.yml
|
||||||
tags: munin
|
tags: munin
|
||||||
|
|
||||||
- name: Configure munin listener
|
- name: Configure munin listener
|
||||||
import_tasks: munin-node.yml
|
ansible.builtin.import_tasks: munin-node.yml
|
||||||
tags: munin-node
|
tags: munin-node
|
||||||
|
|||||||
@@ -1,25 +1,34 @@
|
|||||||
---
|
---
|
||||||
- name: Install munin-node
|
- name: Install munin-node
|
||||||
apt: name=munin-node state=present
|
ansible.builtin.apt:
|
||||||
|
name: munin-node
|
||||||
|
state: present
|
||||||
tags: packages
|
tags: packages
|
||||||
|
|
||||||
# some nice things to have for munin-node on Ubuntu
|
# some nice things to have for munin-node on Ubuntu
|
||||||
# libwww-perl: for munin's nginx_status check
|
# libwww-perl: for munin's nginx_status check
|
||||||
- name: Install munin-node deps
|
- name: Install munin-node deps
|
||||||
apt: name=libwww-perl state=present
|
ansible.builtin.apt:
|
||||||
|
name: libwww-perl
|
||||||
|
state: present
|
||||||
tags: packages
|
tags: packages
|
||||||
|
|
||||||
- name: Create munin-node.conf
|
- name: Create munin-node.conf
|
||||||
template: src=munin-node.conf.j2 dest=/etc/munin/munin-node.conf
|
ansible.builtin.template:
|
||||||
|
src: munin-node.conf.j2
|
||||||
|
dest: /etc/munin/munin-node.conf
|
||||||
notify:
|
notify:
|
||||||
- restart munin-node
|
- restart munin-node
|
||||||
|
|
||||||
- name: Configure munin-node
|
- name: Configure munin-node
|
||||||
shell: munin-node-configure --shell --families=contrib,auto | sh -x
|
ansible.builtin.shell: munin-node-configure --shell --families=contrib,auto | sh -x
|
||||||
notify:
|
notify:
|
||||||
- restart munin-node
|
- restart munin-node
|
||||||
|
|
||||||
- name: Start munin-node
|
- name: Start munin-node
|
||||||
systemd: name=munin-node state=started enabled=true
|
ansible.builtin.systemd_service:
|
||||||
|
name: munin-node
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,9 +1,16 @@
|
|||||||
---
|
---
|
||||||
- name: Install munin package
|
- name: Install munin package
|
||||||
apt: name=munin state=present
|
ansible.builtin.apt:
|
||||||
|
name: munin
|
||||||
|
state: present
|
||||||
tags: packages
|
tags: packages
|
||||||
|
|
||||||
- name: Create munin configuration file
|
- name: Create munin configuration file
|
||||||
template: src=munin.conf.j2 dest=/etc/munin/munin.conf owner=root group=root mode=0644
|
ansible.builtin.template:
|
||||||
|
src: munin.conf.j2
|
||||||
|
dest: /etc/munin/munin.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,32 +1,32 @@
|
|||||||
---
|
---
|
||||||
# file: roles/nginx/defaults/main.yml
|
# ansible.builtin.file: roles/nginx/defaults/main.yml
|
||||||
|
|
||||||
# path config
|
# path config
|
||||||
nginx_confd_path: /etc/nginx/conf.d
|
nginx_confd_path: /etc/nginx/conf.d
|
||||||
|
|
||||||
# parent directory of vhost roots
|
# parent directory of vhost roots
|
||||||
nginx_root_prefix: /var/www
|
nginx_root_prefix: "{{ web_root_prefix }}"
|
||||||
|
|
||||||
# 1 hour timeout
|
# 1 day timeout
|
||||||
nginx_ssl_session_timeout: 1h
|
nginx_ssl_session_timeout: 1d
|
||||||
# 10MB -> 40,000 sessions
|
# 10MB -> 40,000 sessions
|
||||||
nginx_ssl_session_cache: shared:SSL:10m
|
nginx_ssl_session_cache: shared:SSL:10m
|
||||||
# 1400 bytes to fit in one MTU (default is 16k!)
|
nginx_ssl_buffer_size: 4k
|
||||||
nginx_ssl_buffer_size: 1400
|
|
||||||
nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
|
nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
|
||||||
nginx_ssl_protocols: 'TLSv1.2 TLSv1.3'
|
nginx_ssl_protocols: TLSv1.2 TLSv1.3
|
||||||
|
nginx_ssl_ecdh_curve: X25519:prime256v1:secp384r1
|
||||||
|
|
||||||
# DNS resolvers for OCSP stapling (default to Cloudflare public DNS)
|
# DNS resolvers for OCSP stapling (default to Cloudflare public DNS)
|
||||||
# See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
|
# See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
|
||||||
nginx_ssl_stapling_resolver: '1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]'
|
nginx_ssl_stapling_resolver: 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]
|
||||||
|
|
||||||
# HTTP Strict-Transport-Security header, recommended by Google to be ~1 year
|
# HTTP Strict-Transport-Security header, recommended by Google to be ~1 year
|
||||||
# in seconds, see: https://hstspreload.org/
|
# in seconds, see: https://hstspreload.org/
|
||||||
nginx_hsts_max_age: 31536000
|
nginx_hsts_max_age: 31536000
|
||||||
|
|
||||||
# install acme.sh?
|
# install acme.sh?
|
||||||
# True unless you're in development and using "localhost" + snakeoil certs
|
# true unless you're in development and using "localhost" + snakeoil certs
|
||||||
use_letsencrypt: True
|
use_letsencrypt: true
|
||||||
|
|
||||||
# Directory root for Let's Encrypt certs
|
# Directory root for Let's Encrypt certs
|
||||||
letsencrypt_root: /etc/ssl
|
letsencrypt_root: /etc/ssl
|
||||||
@@ -37,8 +37,8 @@ letsencrypt_root: /etc/ssl
|
|||||||
letsencrypt_acme_script_temp: /root/acme.sh
|
letsencrypt_acme_script_temp: /root/acme.sh
|
||||||
letsencrypt_acme_home: /root/.acme.sh
|
letsencrypt_acme_home: /root/.acme.sh
|
||||||
|
|
||||||
# stable is 1.20.x
|
# stable is 1.26.x
|
||||||
# mainline is 1.21.x
|
# mainline is 1.27.x
|
||||||
nginx_version: mainline
|
nginx_version: mainline
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,5 +1,7 @@
|
|||||||
---
|
---
|
||||||
- name: reload nginx
|
- name: Reload nginx
|
||||||
systemd: name=nginx state=reloaded
|
ansible.builtin.systemd_service:
|
||||||
|
name: nginx
|
||||||
|
state: reloaded
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,89 +1,91 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
# Use acme.sh instead of certbot because they only support installation via
|
# Use acme.sh instead of certbot because they only support installation via
|
||||||
# snap now.
|
# snap now.
|
||||||
- block:
|
- name: Install and configure Let's Encrypt
|
||||||
- name: Remove certbot
|
|
||||||
apt:
|
|
||||||
name: certbot
|
|
||||||
state: absent
|
|
||||||
|
|
||||||
- name: Remove old certbot post and pre hooks for nginx
|
|
||||||
file:
|
|
||||||
dest: "{{ item }}"
|
|
||||||
state: absent
|
|
||||||
with_items:
|
|
||||||
- /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
|
|
||||||
- /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
|
|
||||||
|
|
||||||
- name: Check if acme.sh is installed
|
|
||||||
stat:
|
|
||||||
path: "{{ letsencrypt_acme_home }}"
|
|
||||||
register: acme_home
|
|
||||||
|
|
||||||
- name: Download acme.sh
|
|
||||||
get_url:
|
|
||||||
url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
|
|
||||||
dest: "{{ letsencrypt_acme_script_temp }}"
|
|
||||||
mode: 0700
|
|
||||||
register: acme_download
|
|
||||||
when: not acme_home.stat.exists
|
|
||||||
|
|
||||||
# Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
|
|
||||||
# have to chdir to the /root directory where the script exists or else it
|
|
||||||
# fails. Ansible runs it, but the script can't find itself...).
|
|
||||||
- name: Install acme.sh
|
|
||||||
ansible.builtin.command:
|
|
||||||
cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
|
|
||||||
creates: "{{ letsencrypt_acme_home }}/acme.sh"
|
|
||||||
chdir: /root
|
|
||||||
register: acme_install
|
|
||||||
when: acme_download is changed
|
|
||||||
|
|
||||||
- name: Remove temporary acme.sh script
|
|
||||||
file:
|
|
||||||
dest: "{{ letsencrypt_acme_script_temp }}"
|
|
||||||
state: absent
|
|
||||||
when: acme_install.rc is defined and acme_install.rc == 0
|
|
||||||
|
|
||||||
- name: Set default certificate authority for acme.sh
|
|
||||||
ansible.builtin.command:
|
|
||||||
cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"
|
|
||||||
|
|
||||||
- name: Prepare Let's Encrypt well-known directory
|
|
||||||
file:
|
|
||||||
state: directory
|
|
||||||
path: /var/lib/letsencrypt/.well-known
|
|
||||||
owner: root
|
|
||||||
group: nginx
|
|
||||||
mode: g+s
|
|
||||||
|
|
||||||
- name: Copy systemd service to renew Let's Encrypt certs
|
|
||||||
template:
|
|
||||||
src: renew-letsencrypt.service.j2
|
|
||||||
dest: /etc/systemd/system/renew-letsencrypt.service
|
|
||||||
mode: 0644
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
|
|
||||||
- name: Copy systemd timer to renew Let's Encrypt certs
|
|
||||||
copy:
|
|
||||||
src: renew-letsencrypt.timer
|
|
||||||
dest: /etc/systemd/system/renew-letsencrypt.timer
|
|
||||||
mode: 0644
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
|
|
||||||
# always issues daemon-reload just in case the service/timer changed
|
|
||||||
- name: Start and enable systemd timer to renew Let's Encrypt certs
|
|
||||||
systemd:
|
|
||||||
name: renew-letsencrypt.timer
|
|
||||||
state: started
|
|
||||||
enabled: yes
|
|
||||||
daemon_reload: yes
|
|
||||||
|
|
||||||
when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '=='))
|
|
||||||
or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '=='))
|
|
||||||
tags: letsencrypt
|
tags: letsencrypt
|
||||||
|
when:
|
||||||
|
- ansible_distribution == 'Debian'
|
||||||
|
- ansible_distribution_version is version('11', '>='))
|
||||||
|
block:
|
||||||
|
- name: Remove certbot
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: certbot
|
||||||
|
state: absent
|
||||||
|
|
||||||
|
- name: Remove old certbot post and pre hooks for nginx
|
||||||
|
ansible.builtin.file:
|
||||||
|
dest: "{{ item }}"
|
||||||
|
state: absent
|
||||||
|
with_items:
|
||||||
|
- /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
|
||||||
|
- /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
|
||||||
|
|
||||||
|
- name: Check if acme.sh is installed
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: "{{ letsencrypt_acme_home }}"
|
||||||
|
register: acme_home
|
||||||
|
|
||||||
|
- name: Download acme.sh
|
||||||
|
when: not acme_home.stat.exists
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
|
||||||
|
dest: "{{ letsencrypt_acme_script_temp }}"
|
||||||
|
mode: "0700"
|
||||||
|
register: acme_download
|
||||||
|
|
||||||
|
# Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
|
||||||
|
# have to chdir to the /root directory where the script exists or else it
|
||||||
|
# fails. Ansible runs it, but the script can't find itself...).
|
||||||
|
- name: Install acme.sh
|
||||||
|
when: acme_download is changed
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
|
||||||
|
creates: "{{ letsencrypt_acme_home }}/acme.sh"
|
||||||
|
chdir: /root
|
||||||
|
register: acme_install
|
||||||
|
|
||||||
|
- name: Remove temporary acme.sh script
|
||||||
|
when:
|
||||||
|
- acme_install.rc is defined
|
||||||
|
- acme_install.rc == 0
|
||||||
|
ansible.builtin.file:
|
||||||
|
dest: "{{ letsencrypt_acme_script_temp }}"
|
||||||
|
state: absent
|
||||||
|
|
||||||
|
- name: Set default certificate authority for acme.sh
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"
|
||||||
|
|
||||||
|
- name: Prepare Let's Encrypt well-known directory
|
||||||
|
ansible.builtin.file:
|
||||||
|
state: directory
|
||||||
|
path: /var/lib/letsencrypt/.well-known
|
||||||
|
owner: root
|
||||||
|
group: nginx
|
||||||
|
mode: g+s
|
||||||
|
|
||||||
|
- name: Copy systemd service to renew Let's Encrypt certs
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: renew-letsencrypt.service.j2
|
||||||
|
dest: /etc/systemd/system/renew-letsencrypt.service
|
||||||
|
mode: "0644"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
|
||||||
|
- name: Copy systemd timer to renew Let's Encrypt certs
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: renew-letsencrypt.timer
|
||||||
|
dest: /etc/systemd/system/renew-letsencrypt.timer
|
||||||
|
mode: "0644"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
|
||||||
|
# always issues daemon-reload just in case the service/timer changed
|
||||||
|
- name: Start and enable systemd timer to renew Let's Encrypt certs
|
||||||
|
ansible.builtin.systemd_service:
|
||||||
|
name: renew-letsencrypt.timer
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
daemon_reload: true
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,76 +1,132 @@
|
|||||||
---
|
---
|
||||||
- name: Add nginx.org apt signing key
|
- name: Remove nginx apt signing key from apt-key
|
||||||
apt_key: id=0x573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 url=https://nginx.org/keys/nginx_signing.key state=present
|
ansible.builtin.apt_key:
|
||||||
register: add_nginx_apt_key
|
id: "053473772654754373614404074646527257655730117366337542"
|
||||||
tags: nginx, packages
|
state: absent
|
||||||
|
tags:
|
||||||
|
- packages
|
||||||
|
- nginx
|
||||||
|
|
||||||
|
- name: Download nginx apt signing key
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: https://nginx.org/keys/nginx_signing.key
|
||||||
|
dest: /usr/share/keyrings/nginx_signing.key
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
checksum: sha256:55385da31d198fa6a5012d40ae98ecb272a6c4e8fffffba94719ffd3e87de37a
|
||||||
|
register: download_nginx_signing_key
|
||||||
|
tags:
|
||||||
|
- packages
|
||||||
|
- nginx
|
||||||
|
|
||||||
- name: Add nginx.org repo
|
- name: Add nginx.org repo
|
||||||
template: src=nginx_org_sources.list.j2 dest=/etc/apt/sources.list.d/nginx_org_sources.list owner=root group=root mode=0644
|
ansible.builtin.template:
|
||||||
|
src: nginx_org_sources.list.j2
|
||||||
|
dest: /etc/apt/sources.list.d/nginx_org_sources.list
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
register: add_nginx_apt_repository
|
register: add_nginx_apt_repository
|
||||||
tags: nginx, packages
|
tags:
|
||||||
|
- nginx
|
||||||
|
- packages
|
||||||
|
|
||||||
- name: Update apt cache
|
- name: Update apt cache
|
||||||
apt:
|
when: (download_nginx_signing_key.status_code is defined and download_nginx_signing_key.status_code == 200) or add_nginx_apt_repository is changed
|
||||||
update_cache: yes
|
ansible.builtin.apt: # noqa no-handler
|
||||||
when:
|
update_cache: true
|
||||||
add_nginx_apt_key is changed or
|
|
||||||
add_nginx_apt_repository is changed
|
|
||||||
|
|
||||||
- name: Install nginx
|
- name: Install nginx
|
||||||
apt: pkg=nginx cache_valid_time=3600 state=present
|
ansible.builtin.apt:
|
||||||
tags: nginx, packages
|
pkg: nginx
|
||||||
|
cache_valid_time: 3600
|
||||||
|
state: present
|
||||||
|
tags:
|
||||||
|
- nginx
|
||||||
|
- packages
|
||||||
|
|
||||||
- name: Copy nginx.conf
|
- name: Copy nginx.conf
|
||||||
template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf mode=0644 owner=root group=root
|
ansible.builtin.template:
|
||||||
|
src: nginx.conf.j2
|
||||||
|
dest: /etc/nginx/nginx.conf
|
||||||
|
mode: "0644"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
notify:
|
notify:
|
||||||
- reload nginx
|
- Reload nginx
|
||||||
tags: nginx
|
tags: nginx
|
||||||
|
|
||||||
- name: Copy extra nginx configs
|
- name: Copy extra nginx configs
|
||||||
copy: src={{ item }} dest=/etc/nginx/{{ item }} mode=0644 owner=root group=root
|
ansible.builtin.copy:
|
||||||
|
src: "{{ item }}"
|
||||||
|
dest: /etc/nginx/{{ item }}
|
||||||
|
mode: "0644"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
loop:
|
loop:
|
||||||
- extra-security.conf
|
- extra-security.conf
|
||||||
- fastcgi_cache
|
- fastcgi_cache
|
||||||
notify:
|
notify:
|
||||||
- reload nginx
|
- Reload nginx
|
||||||
tags: nginx
|
tags: nginx
|
||||||
|
|
||||||
- name: Remove default nginx vhost
|
- name: Remove default nginx vhost
|
||||||
file: path=/etc/nginx/conf.d/default.conf state=absent
|
ansible.builtin.file:
|
||||||
|
path: /etc/nginx/conf.d/default.conf
|
||||||
|
state: absent
|
||||||
tags: nginx
|
tags: nginx
|
||||||
|
|
||||||
- name: Create fastcgi cache dir
|
- name: Create fastcgi cache dir
|
||||||
file: path=/var/cache/nginx/cached/fastcgi state=directory owner=nginx group=nginx mode=0755
|
ansible.builtin.file:
|
||||||
|
path: /var/cache/nginx/cached/fastcgi
|
||||||
|
state: directory
|
||||||
|
owner: nginx
|
||||||
|
group: nginx
|
||||||
|
mode: "0755"
|
||||||
tags: nginx
|
tags: nginx
|
||||||
|
|
||||||
- name: Configure nginx virtual hosts
|
- name: Configure nginx virtual hosts
|
||||||
include_tasks: vhosts.yml
|
|
||||||
when: nginx_vhosts is defined
|
when: nginx_vhosts is defined
|
||||||
|
ansible.builtin.include_tasks: vhosts.yml
|
||||||
tags: nginx
|
tags: nginx
|
||||||
|
|
||||||
- name: Configure WordPress
|
- name: Configure WordPress
|
||||||
include_tasks: wordpress.yml
|
|
||||||
when: nginx_vhosts is defined
|
when: nginx_vhosts is defined
|
||||||
|
ansible.builtin.include_tasks: wordpress.yml
|
||||||
tags: wordpress
|
tags: wordpress
|
||||||
|
|
||||||
- name: Configure blank nginx vhost
|
- name: Configure blank nginx vhost
|
||||||
template: src=blank-vhost.conf.j2 dest={{ nginx_confd_path }}/blank-vhost.conf mode=0644 owner=root group=root
|
ansible.builtin.template:
|
||||||
|
src: blank-vhost.conf.j2
|
||||||
|
dest: "{{ nginx_confd_path }}/blank-vhost.conf"
|
||||||
|
mode: "0644"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
notify:
|
notify:
|
||||||
- reload nginx
|
- Reload nginx
|
||||||
tags: nginx
|
tags: nginx
|
||||||
|
|
||||||
- name: Configure munin vhost
|
- name: Configure munin vhost
|
||||||
copy: src=munin.conf dest=/etc/nginx/conf.d/munin.conf mode=0644 owner=root group=root
|
ansible.builtin.copy:
|
||||||
|
src: munin.conf
|
||||||
|
dest: /etc/nginx/conf.d/munin.conf
|
||||||
|
mode: "0644"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
notify:
|
notify:
|
||||||
- reload nginx
|
- Reload nginx
|
||||||
tags: nginx
|
tags: nginx
|
||||||
|
|
||||||
- name: Start and enable nginx service
|
- name: Start and enable nginx service
|
||||||
systemd: name=nginx state=started enabled=yes
|
ansible.builtin.systemd_service:
|
||||||
|
name: nginx
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
tags: nginx
|
tags: nginx
|
||||||
|
|
||||||
- name: Configure Let's Encrypt
|
- name: Configure Let's Encrypt
|
||||||
include_tasks: letsencrypt.yml
|
ansible.builtin.include_tasks: letsencrypt.yml
|
||||||
tags: letsencrypt
|
tags: letsencrypt
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,29 +1,40 @@
|
|||||||
---
|
---
|
||||||
|
- name: Configure https vhosts
|
||||||
- block:
|
|
||||||
- name: Configure https vhosts
|
|
||||||
template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root
|
|
||||||
loop: "{{ nginx_vhosts }}"
|
|
||||||
notify:
|
|
||||||
- reload nginx
|
|
||||||
|
|
||||||
- name: Generate self-signed TLS cert
|
|
||||||
command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
|
|
||||||
notify:
|
|
||||||
- reload nginx
|
|
||||||
|
|
||||||
- name: Download 4096-bit RFC 7919 dhparams
|
|
||||||
get_url:
|
|
||||||
url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
|
|
||||||
checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
|
|
||||||
dest: "{{ nginx_ssl_dhparam }}"
|
|
||||||
notify:
|
|
||||||
- reload nginx
|
|
||||||
|
|
||||||
# TODO: this could break because we can override the document root in host vars
|
|
||||||
- name: Create vhost document roots
|
|
||||||
file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx
|
|
||||||
loop: "{{ nginx_vhosts }}"
|
|
||||||
tags: nginx
|
tags: nginx
|
||||||
|
block:
|
||||||
|
- name: Configure https vhosts
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: vhost.conf.j2
|
||||||
|
dest: "{{ nginx_confd_path }}/{{ item.domain_name }}.conf"
|
||||||
|
mode: "0644"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
loop: "{{ nginx_vhosts }}"
|
||||||
|
notify:
|
||||||
|
- Reload nginx
|
||||||
|
|
||||||
|
- name: Generate self-signed TLS cert
|
||||||
|
ansible.builtin.command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key
|
||||||
|
-out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
|
||||||
|
notify:
|
||||||
|
- Reload nginx
|
||||||
|
|
||||||
|
- name: Download 4096-bit RFC 7919 dhparams
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
|
||||||
|
checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
|
||||||
|
dest: "{{ nginx_ssl_dhparam }}"
|
||||||
|
notify:
|
||||||
|
- Reload nginx
|
||||||
|
|
||||||
|
# TODO: this could break because we can override the document root in host vars
|
||||||
|
- name: Create vhost document roots
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ nginx_root_prefix }}/{{ item.domain_name }}"
|
||||||
|
state: directory
|
||||||
|
mode: "0755"
|
||||||
|
owner: nginx
|
||||||
|
group: nginx
|
||||||
|
loop: "{{ nginx_vhosts }}"
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -1,15 +1,29 @@
|
|||||||
---
|
---
|
||||||
|
- name: Install and configure WordPress
|
||||||
- block:
|
|
||||||
- name: Install WordPress
|
|
||||||
git: repo=https://github.com/WordPress/WordPress.git dest={{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress version={{ item.wordpress_version }} depth=1 force=yes
|
|
||||||
when: item.has_wordpress is defined and item.has_wordpress
|
|
||||||
loop: "{{ nginx_vhosts }}"
|
|
||||||
|
|
||||||
- name: Fix WordPress directory permissions
|
|
||||||
file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory owner=nginx group=nginx recurse=yes
|
|
||||||
when: item.has_wordpress is defined and item.has_wordpress
|
|
||||||
loop: "{{ nginx_vhosts }}"
|
|
||||||
tags: wordpress
|
tags: wordpress
|
||||||
|
block:
|
||||||
|
- name: Install WordPress
|
||||||
|
when:
|
||||||
|
- item.has_wordpress is defined
|
||||||
|
- item.has_wordpress
|
||||||
|
ansible.builtin.git:
|
||||||
|
repo: https://github.com/WordPress/WordPress.git
|
||||||
|
dest: "{{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress"
|
||||||
|
version: "{{ item.wordpress_version }}"
|
||||||
|
depth: 1
|
||||||
|
force: true
|
||||||
|
loop: "{{ nginx_vhosts }}"
|
||||||
|
|
||||||
|
- name: Fix WordPress directory permissions
|
||||||
|
when:
|
||||||
|
- item.has_wordpress is defined
|
||||||
|
- item.has_wordpress
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ nginx_root_prefix }}/{{ item.domain_name }}"
|
||||||
|
state: directory
|
||||||
|
owner: nginx
|
||||||
|
group: nginx
|
||||||
|
recurse: true
|
||||||
|
loop: "{{ nginx_vhosts }}"
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
# vim: set ts=2 sw=2:
|
||||||
|
|||||||
@@ -11,9 +11,11 @@ server {
|
|||||||
|
|
||||||
return 444;
|
return 444;
|
||||||
}
|
}
|
||||||
|
|
||||||
server {
|
server {
|
||||||
listen 443 ssl http2 default_server;
|
listen 443 ssl default_server;
|
||||||
listen [::]:443 ssl http2 default_server;
|
listen [::]:443 ssl default_server;
|
||||||
|
http2 on;
|
||||||
server_name _;
|
server_name _;
|
||||||
|
|
||||||
# self-signed "snakeoil" certificate
|
# self-signed "snakeoil" certificate
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
{# helper variables and per-site defaults that we can't set in role defaults #}
|
{# helper variables and per-site defaults that we can't set in role defaults #}
|
||||||
{% set domain_name = item.domain_name %}
|
{% set domain_name = item.domain_name %}
|
||||||
{# assume HSTS is off unless a vhost explicitly sets it to True #}
|
{# assume HSTS is off unless a vhost explicitly sets it to true #}
|
||||||
{% set enable_hsts = item.enable_hsts | default(False) %}
|
{% set enable_hsts = item.enable_hsts | default(false) %}
|
||||||
|
|
||||||
{# first, check if the current vhost has a custom cert (perhaps self-signed) #}
|
{# first, check if the current vhost has a custom cert (perhaps self-signed) #}
|
||||||
{% if item.tls_certificate_path is defined and item.tls_key_path is defined %}
|
{% if item.tls_certificate_path is defined and item.tls_key_path is defined %}
|
||||||
@@ -27,27 +27,19 @@
|
|||||||
|
|
||||||
ssl_dhparam {{ nginx_ssl_dhparam }};
|
ssl_dhparam {{ nginx_ssl_dhparam }};
|
||||||
ssl_protocols {{ nginx_ssl_protocols }};
|
ssl_protocols {{ nginx_ssl_protocols }};
|
||||||
|
ssl_ecdh_curve {{ nginx_ssl_ecdh_curve }};
|
||||||
ssl_ciphers "{{ tls_cipher_suite }}";
|
ssl_ciphers "{{ tls_cipher_suite }}";
|
||||||
ssl_prefer_server_ciphers on;
|
ssl_prefer_server_ciphers off;
|
||||||
|
|
||||||
{# OSCP stapling only works with real certs #}
|
{# OSCP stapling only works with real certs #}
|
||||||
{% if use_letsencrypt == True or item.tls_certificate_path %}
|
{% if use_letsencrypt == true or item.tls_certificate_path %}
|
||||||
# OCSP stapling...
|
# OCSP stapling...
|
||||||
ssl_stapling on;
|
ssl_stapling on;
|
||||||
ssl_stapling_verify on;
|
ssl_stapling_verify on;
|
||||||
resolver {{ nginx_ssl_stapling_resolver }};
|
resolver {{ nginx_ssl_stapling_resolver }};
|
||||||
{% endif %} {# end: use_letsencrypt #}
|
{% endif %} {# end: use_letsencrypt #}
|
||||||
|
|
||||||
# nginx does not auto-rotate session ticket keys: only a HUP / restart will do so and
|
{% if enable_hsts == true %}
|
||||||
# when a restart is performed the previous key is lost, which resets all previous
|
|
||||||
# sessions. The fix for this is to setup a manual rotation mechanism:
|
|
||||||
# http://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx
|
|
||||||
#
|
|
||||||
# Note that you'll have to define and rotate the keys securely by yourself. In absence
|
|
||||||
# of such infrastructure, consider turning off session tickets:
|
|
||||||
ssl_session_tickets off;
|
|
||||||
|
|
||||||
{% if enable_hsts == True %}
|
|
||||||
# Enable this if you want HSTS (recommended, but be careful)
|
# Enable this if you want HSTS (recommended, but be careful)
|
||||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||||
# See: https://hstspreload.appspot.com/
|
# See: https://hstspreload.appspot.com/
|
||||||
|
|||||||
@@ -1,19 +1,7 @@
|
|||||||
{{ ansible_managed | comment }}
|
{{ ansible_managed | comment }}
|
||||||
|
|
||||||
{% if ansible_distribution == 'Ubuntu' %}
|
|
||||||
|
|
||||||
{% if nginx_version == "stable" %}
|
{% if nginx_version == "stable" %}
|
||||||
deb [arch=amd64] https://nginx.org/packages/ubuntu/ {{ ansible_distribution_release }} nginx
|
deb [arch=amd64 signed-by=/usr/share/keyrings/nginx_signing.key] https://nginx.org/packages/debian/ {{ ansible_distribution_release }} nginx
|
||||||
{% elif nginx_version == "mainline" %}
|
{% elif nginx_version == "mainline" %}
|
||||||
deb [arch=amd64] https://nginx.org/packages/mainline/ubuntu/ {{ ansible_distribution_release }} nginx
|
deb [arch=amd64 signed-by=/usr/share/keyrings/nginx_signing.key] https://nginx.org/packages/mainline/debian/ {{ ansible_distribution_release }} nginx
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% elif ansible_distribution == 'Debian' %}
|
|
||||||
|
|
||||||
{% if nginx_version == "stable" %}
|
|
||||||
deb [arch=amd64] https://nginx.org/packages/debian/ {{ ansible_distribution_release }} nginx
|
|
||||||
{% elif nginx_version == "mainline" %}
|
|
||||||
deb [arch=amd64] https://nginx.org/packages/mainline/debian/ {{ ansible_distribution_release }} nginx
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|||||||
@@ -4,10 +4,16 @@
|
|||||||
{% set domain_name = item.domain_name %}
|
{% set domain_name = item.domain_name %}
|
||||||
{% set domain_aliases = item.domain_aliases | default("") %}
|
{% set domain_aliases = item.domain_aliases | default("") %}
|
||||||
{# assume optional features are off unless a vhost explicitly sets them #}
|
{# assume optional features are off unless a vhost explicitly sets them #}
|
||||||
{% set enable_hsts = item.enable_hsts | default(False) %}
|
{% set enable_hsts = item.enable_hsts | default(false) %}
|
||||||
{% set has_wordpress = item.has_wordpress | default(False) %}
|
{% set has_wordpress = item.has_wordpress | default(false) %}
|
||||||
{% set needs_php = item.needs_php | default(False) %}
|
{% set needs_php = item.needs_php | default(false) %}
|
||||||
{% set has_gitea = item.has_gitea | default(False) %}
|
{% set has_gitea = item.has_gitea | default(false) %}
|
||||||
|
{# Allow sites to override the document root #}
|
||||||
|
{% if item.document_root is defined %}
|
||||||
|
{% set document_root = item.document_root %}
|
||||||
|
{% else %}
|
||||||
|
{% set document_root = (nginx_root_prefix, domain_name) | ansible.builtin.path_join %}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
# http -> https vhost
|
# http -> https vhost
|
||||||
server {
|
server {
|
||||||
@@ -26,31 +32,27 @@ server {
|
|||||||
}
|
}
|
||||||
|
|
||||||
server {
|
server {
|
||||||
listen 443 ssl http2;
|
listen 443 ssl;
|
||||||
listen [::]:443 ssl http2;
|
listen [::]:443 ssl;
|
||||||
|
http2 on;
|
||||||
|
|
||||||
{# Allow sites to override the nginx document root #}
|
root {{ document_root }};
|
||||||
{% if item.document_root is defined %}
|
|
||||||
root {{ item.document_root }};
|
|
||||||
{% else %}
|
|
||||||
root {{ nginx_root_prefix }}/{{ domain_name }};
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{# will only work if the TLS cert covers the domain + aliases, like example.com and www.example.com #}
|
{# will only work if the TLS cert covers the domain + aliases, like example.com and www.example.com #}
|
||||||
server_name {{ domain_name }} {{ domain_aliases }};
|
server_name {{ domain_name }} {{ domain_aliases }};
|
||||||
|
|
||||||
index {% if has_wordpress == True or needs_php == True %}index.php{% else %}index.html{% endif %};
|
index {% if has_wordpress == true or needs_php == true %}index.php{% else %}index.html{% endif %};
|
||||||
|
|
||||||
access_log /var/log/nginx/{{ domain_name }}-access.log;
|
access_log /var/log/nginx/{{ domain_name }}-access.log;
|
||||||
error_log /var/log/nginx/{{ domain_name }}-error.log;
|
error_log /var/log/nginx/{{ domain_name }}-error.log;
|
||||||
|
|
||||||
{% include 'https.j2' %}
|
{% include 'https.j2' %}
|
||||||
|
|
||||||
{% if has_wordpress == True %}
|
{% if has_wordpress == true %}
|
||||||
{% include 'wordpress.j2' %}
|
{% include 'wordpress.j2' %}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
{% if has_gitea == True %}
|
{% if has_gitea == true %}
|
||||||
{% include 'gitea.j2' %}
|
{% include 'gitea.j2' %}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
@@ -59,7 +61,7 @@ server {
|
|||||||
root /usr/share/nginx/html;
|
root /usr/share/nginx/html;
|
||||||
}
|
}
|
||||||
|
|
||||||
{% if has_wordpress == True or needs_php == True %}
|
{% if has_wordpress == true or needs_php == true %}
|
||||||
location ~ [^/]\.php(/|$) {
|
location ~ [^/]\.php(/|$) {
|
||||||
# Zero-day exploit defense.
|
# Zero-day exploit defense.
|
||||||
# http://forum.nginx.org/read.php?2,88845,page=3
|
# http://forum.nginx.org/read.php?2,88845,page=3
|
||||||
@@ -75,17 +77,8 @@ server {
|
|||||||
# See: https://httpoxy.org/
|
# See: https://httpoxy.org/
|
||||||
fastcgi_param HTTP_PROXY "";
|
fastcgi_param HTTP_PROXY "";
|
||||||
|
|
||||||
{# As of Ubuntu 16.04 and Debian 9, the PHP-FPM configs are the same #}
|
{% if ansible_distribution_major_version is version('12', '==') %}
|
||||||
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('16.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('9', '==')) %}
|
fastcgi_pass unix:/run/php/php8.2-fpm-{{ domain_name }}.sock;
|
||||||
fastcgi_pass unix:/run/php/php7.0-fpm-{{ domain_name }}.sock;
|
|
||||||
{% elif ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==') %}
|
|
||||||
fastcgi_pass unix:/run/php/php7.2-fpm-{{ domain_name }}.sock;
|
|
||||||
{% elif ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==') %}
|
|
||||||
fastcgi_pass unix:/run/php/php7.3-fpm-{{ domain_name }}.sock;
|
|
||||||
{% elif (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==')) %}
|
|
||||||
fastcgi_pass unix:/run/php/php7.4-fpm-{{ domain_name }}.sock;
|
|
||||||
{% else %}
|
|
||||||
fastcgi_pass unix:/var/run/php5-fpm-{{ domain_name }}.sock;
|
|
||||||
{% endif %}
|
{% endif %}
|
||||||
fastcgi_index index.php;
|
fastcgi_index index.php;
|
||||||
# set script path relative to document root in server block
|
# set script path relative to document root in server block
|
||||||
@@ -99,7 +92,7 @@ server {
|
|||||||
fastcgi_cache_bypass $http_pragma $wordpress_logged_in;
|
fastcgi_cache_bypass $http_pragma $wordpress_logged_in;
|
||||||
fastcgi_no_cache $http_pragma $wordpress_logged_in;
|
fastcgi_no_cache $http_pragma $wordpress_logged_in;
|
||||||
|
|
||||||
{% if enable_hsts == True %}
|
{% if enable_hsts == true %}
|
||||||
# Enable this if you want HSTS (recommended, but be careful)
|
# Enable this if you want HSTS (recommended, but be careful)
|
||||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||||
# See: https://hstspreload.appspot.com/
|
# See: https://hstspreload.appspot.com/
|
||||||
@@ -113,7 +106,7 @@ server {
|
|||||||
include extra-security.conf;
|
include extra-security.conf;
|
||||||
}
|
}
|
||||||
|
|
||||||
{% if has_wordpress == True %}
|
{% if has_wordpress == true %}
|
||||||
# Check if a user is logged in
|
# Check if a user is logged in
|
||||||
# if so, set $wordpress_logged_in = 1
|
# if so, set $wordpress_logged_in = 1
|
||||||
# otherwise, set $wordpress_logged_in = 0
|
# otherwise, set $wordpress_logged_in = 0
|
||||||
|
|||||||
@@ -5,7 +5,7 @@
|
|||||||
location / {
|
location / {
|
||||||
try_files $uri $uri/ /index.php?$args;
|
try_files $uri $uri/ /index.php?$args;
|
||||||
|
|
||||||
{% if enable_hsts == True %}
|
{% if enable_hsts == true %}
|
||||||
# Enable this if you want HSTS (recommended, but be careful)
|
# Enable this if you want HSTS (recommended, but be careful)
|
||||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||||
# See: https://hstspreload.appspot.com/
|
# See: https://hstspreload.appspot.com/
|
||||||
@@ -16,7 +16,7 @@
|
|||||||
location ~* \.(?:ico|css|js|gif|jpe?g|png|svg)$ {
|
location ~* \.(?:ico|css|js|gif|jpe?g|png|svg)$ {
|
||||||
add_header Cache-Control "max-age=604800";
|
add_header Cache-Control "max-age=604800";
|
||||||
|
|
||||||
{% if enable_hsts == True %}
|
{% if enable_hsts == true %}
|
||||||
# Enable this if you want HSTS (recommended, but be careful)
|
# Enable this if you want HSTS (recommended, but be careful)
|
||||||
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
|
||||||
# See: https://hstspreload.appspot.com/
|
# See: https://hstspreload.appspot.com/
|
||||||
|
|||||||
@@ -1,14 +0,0 @@
|
|||||||
---
|
|
||||||
# For Ubuntu 18.04
|
|
||||||
- name: reload php7.2-fpm
|
|
||||||
systemd: name=php7.2-fpm state=reloaded
|
|
||||||
|
|
||||||
# For Debian 10
|
|
||||||
- name: reload php7.3-fpm
|
|
||||||
systemd: name=php7.3-fpm state=reloaded
|
|
||||||
|
|
||||||
# For Ubuntu 20.04
|
|
||||||
- name: reload php7.4-fpm
|
|
||||||
systemd: name=php7.4-fpm state=reloaded
|
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- block:
|
|
||||||
- name: Set php-fpm packages
|
|
||||||
set_fact:
|
|
||||||
php_fpm_packages:
|
|
||||||
- php-fpm
|
|
||||||
# for WordPress
|
|
||||||
- php-mysql
|
|
||||||
- php-gd
|
|
||||||
- php-curl
|
|
||||||
|
|
||||||
- name: Install php-fpm and deps
|
|
||||||
apt: name={{ php_fpm_packages }} state=present update_cache=yes
|
|
||||||
|
|
||||||
# only copy php-fpm config for vhosts that need WordPress or PHP
|
|
||||||
- name: Copy php-fpm pool config
|
|
||||||
template: src=php7.3-pool.conf.j2 dest=/etc/php/7.3/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
|
|
||||||
loop: "{{ nginx_vhosts }}"
|
|
||||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
|
||||||
notify: reload php7.3-fpm
|
|
||||||
|
|
||||||
- name: Remove default www pool
|
|
||||||
file: path=/etc/php/7.3/fpm/pool.d/www.conf state=absent
|
|
||||||
notify: reload php7.3-fpm
|
|
||||||
|
|
||||||
# re-configure php.ini
|
|
||||||
- name: Update php.ini
|
|
||||||
template: src=php7.3-php.ini.j2 dest=/etc/php/7.3/fpm/php.ini owner=root group=root mode=0644
|
|
||||||
notify: reload php7.3-fpm
|
|
||||||
|
|
||||||
tags: php-fpm
|
|
||||||
when: install_php
|
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- block:
|
|
||||||
- name: Set php-fpm packages
|
|
||||||
set_fact:
|
|
||||||
php_fpm_packages:
|
|
||||||
- php-fpm
|
|
||||||
# for WordPress
|
|
||||||
- php-mysql
|
|
||||||
- php-gd
|
|
||||||
- php-curl
|
|
||||||
|
|
||||||
- name: Install php-fpm and deps
|
|
||||||
apt: name={{ php_fpm_packages }} state=present update_cache=yes
|
|
||||||
|
|
||||||
# only copy php-fpm config for vhosts that need WordPress or PHP
|
|
||||||
- name: Copy php-fpm pool config
|
|
||||||
template: src=php7.2-pool.conf.j2 dest=/etc/php/7.2/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
|
|
||||||
loop: "{{ nginx_vhosts }}"
|
|
||||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
|
||||||
notify: reload php7.2-fpm
|
|
||||||
|
|
||||||
- name: Remove default www pool
|
|
||||||
file: path=/etc/php/7.2/fpm/pool.d/www.conf state=absent
|
|
||||||
notify: reload php7.2-fpm
|
|
||||||
|
|
||||||
# re-configure php.ini
|
|
||||||
- name: Update php.ini
|
|
||||||
template: src=php7.2-php.ini.j2 dest=/etc/php/7.2/fpm/php.ini owner=root group=root mode=0644
|
|
||||||
notify: reload php7.2-fpm
|
|
||||||
|
|
||||||
tags: php-fpm
|
|
||||||
when: install_php
|
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- block:
|
|
||||||
- name: Set php-fpm packages
|
|
||||||
set_fact:
|
|
||||||
php_fpm_packages:
|
|
||||||
- php7.4-fpm
|
|
||||||
# for WordPress
|
|
||||||
- php7.4-mysql
|
|
||||||
- php7.4-gd
|
|
||||||
- php7.4-curl
|
|
||||||
- php7.4-xml
|
|
||||||
|
|
||||||
- name: Install php-fpm and deps
|
|
||||||
apt: name={{ php_fpm_packages }} state=present update_cache=yes
|
|
||||||
|
|
||||||
# only copy php-fpm config for vhosts that need WordPress or PHP
|
|
||||||
- name: Copy php-fpm pool config
|
|
||||||
template: src=php7.4-pool.conf.j2 dest=/etc/php/7.4/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
|
|
||||||
loop: "{{ nginx_vhosts }}"
|
|
||||||
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
|
|
||||||
notify: reload php7.4-fpm
|
|
||||||
|
|
||||||
- name: Remove default www pool
|
|
||||||
file: path=/etc/php/7.4/fpm/pool.d/www.conf state=absent
|
|
||||||
notify: reload php7.4-fpm
|
|
||||||
|
|
||||||
# re-configure php.ini
|
|
||||||
- name: Update php.ini
|
|
||||||
template: src=php7.4-php.ini.j2 dest=/etc/php/7.4/fpm/php.ini owner=root group=root mode=0644
|
|
||||||
notify: reload php7.4-fpm
|
|
||||||
|
|
||||||
tags: php-fpm
|
|
||||||
when: install_php
|
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
---
|
|
||||||
# Ubuntu 18.04 uses php-fpm 7.2
|
|
||||||
# Debian 10 uses php-fpm 7.3
|
|
||||||
# Ubuntu 20.04 uses PHP 7.4
|
|
||||||
# Debian 11 uses PHP 7.4
|
|
||||||
|
|
||||||
# If any of the vhosts on this host need WordPress then we need to install PHP.
|
|
||||||
# This uses selectattr to filter the list of dicts in nginx_vhosts, selecting
|
|
||||||
# any that have has_wordpress defined, and has_wordpress set to True.
|
|
||||||
#
|
|
||||||
# See: https://stackoverflow.com/a/31896249
|
|
||||||
- name: Check if any vhost needs WordPress
|
|
||||||
set_fact:
|
|
||||||
install_php: True
|
|
||||||
when: "nginx_vhosts | selectattr('has_wordpress', 'defined') | selectattr('has_wordpress', 'equalto', True) | list | length > 0"
|
|
||||||
|
|
||||||
# Legacy, was only for Piwik, but leaving for now.
|
|
||||||
- name: Check if any vhost needs PHP
|
|
||||||
set_fact:
|
|
||||||
install_php: True
|
|
||||||
when: "nginx_vhosts | selectattr('needs_php', 'defined') | selectattr('needs_php', 'equalto', True) | list | length > 0"
|
|
||||||
|
|
||||||
# If install_php has not been set, then we assume no vhosts need PHP. This is
|
|
||||||
# a bit hacky, but it's the closest we come to an if/then/else.
|
|
||||||
- name: Set install_php to False
|
|
||||||
set_fact:
|
|
||||||
install_php: False
|
|
||||||
when: install_php is not defined
|
|
||||||
|
|
||||||
- name: Configure php-fpm on Ubuntu 18.04
|
|
||||||
include_tasks: Ubuntu_18.04.yml
|
|
||||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('18.04', '==') and install_php
|
|
||||||
tags: php-fpm
|
|
||||||
|
|
||||||
- name: Configure php-fpm on Debian 10
|
|
||||||
include_tasks: Debian_10.yml
|
|
||||||
when: ansible_distribution == 'Debian' and ansible_distribution_version is version('10', '==') and install_php
|
|
||||||
tags: php-fpm
|
|
||||||
|
|
||||||
- name: Configure php-fpm on Ubuntu 20.04
|
|
||||||
include_tasks: Ubuntu_20.04.yml
|
|
||||||
when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==') and install_php
|
|
||||||
tags: php-fpm
|
|
||||||
|
|
||||||
- name: Configure php-fpm on Debian 11
|
|
||||||
include_tasks: Ubuntu_20.04.yml
|
|
||||||
when: ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==') and install_php
|
|
||||||
tags: php-fpm
|
|
||||||
|
|
||||||
# vim: set ts=2 sw=2:
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -1,415 +0,0 @@
|
|||||||
{% set domain_name = item.domain_name %}
|
|
||||||
|
|
||||||
; Start a new pool named '{{ domain_name }}'.
|
|
||||||
; the variable $pool can we used in any directive and will be replaced by the
|
|
||||||
; pool name ('{{ domain_name }}' here)
|
|
||||||
[{{ domain_name }}]
|
|
||||||
|
|
||||||
; Per pool prefix
|
|
||||||
; It only applies on the following directives:
|
|
||||||
; - 'access.log'
|
|
||||||
; - 'slowlog'
|
|
||||||
; - 'listen' (unixsocket)
|
|
||||||
; - 'chroot'
|
|
||||||
; - 'chdir'
|
|
||||||
; - 'php_values'
|
|
||||||
; - 'php_admin_values'
|
|
||||||
; When not set, the global prefix (or /usr) applies instead.
|
|
||||||
; Note: This directive can also be relative to the global prefix.
|
|
||||||
; Default Value: none
|
|
||||||
;prefix = /path/to/pools/$pool
|
|
||||||
|
|
||||||
; Unix user/group of processes
|
|
||||||
; Note: The user is mandatory. If the group is not set, the default user's group
|
|
||||||
; will be used.
|
|
||||||
user = nginx
|
|
||||||
group = nginx
|
|
||||||
|
|
||||||
; The address on which to accept FastCGI requests.
|
|
||||||
; Valid syntaxes are:
|
|
||||||
; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on
|
|
||||||
; a specific port;
|
|
||||||
; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
|
|
||||||
; a specific port;
|
|
||||||
; 'port' - to listen on a TCP socket to all addresses
|
|
||||||
; (IPv6 and IPv4-mapped) on a specific port;
|
|
||||||
; '/path/to/unix/socket' - to listen on a unix socket.
|
|
||||||
; Note: This value is mandatory.
|
|
||||||
listen = /run/php/php7.2-fpm-{{ domain_name }}.sock
|
|
||||||
|
|
||||||
; Set listen(2) backlog.
|
|
||||||
; Default Value: 511 (-1 on FreeBSD and OpenBSD)
|
|
||||||
;listen.backlog = 511
|
|
||||||
|
|
||||||
; Set permissions for unix socket, if one is used. In Linux, read/write
|
|
||||||
; permissions must be set in order to allow connections from a web server. Many
|
|
||||||
; BSD-derived systems allow connections regardless of permissions.
|
|
||||||
; Default Values: user and group are set as the running user
|
|
||||||
; mode is set to 0660
|
|
||||||
listen.owner = nginx
|
|
||||||
listen.group = nginx
|
|
||||||
;listen.mode = 0660
|
|
||||||
; When POSIX Access Control Lists are supported you can set them using
|
|
||||||
; these options, value is a comma separated list of user/group names.
|
|
||||||
; When set, listen.owner and listen.group are ignored
|
|
||||||
;listen.acl_users =
|
|
||||||
;listen.acl_groups =
|
|
||||||
|
|
||||||
; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
|
|
||||||
; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
|
|
||||||
; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
|
|
||||||
; must be separated by a comma. If this value is left blank, connections will be
|
|
||||||
; accepted from any ip address.
|
|
||||||
; Default Value: any
|
|
||||||
;listen.allowed_clients = 127.0.0.1
|
|
||||||
|
|
||||||
; Specify the nice(2) priority to apply to the pool processes (only if set)
|
|
||||||
; The value can vary from -19 (highest priority) to 20 (lower priority)
|
|
||||||
; Note: - It will only work if the FPM master process is launched as root
|
|
||||||
; - The pool processes will inherit the master process priority
|
|
||||||
; unless it specified otherwise
|
|
||||||
; Default Value: no set
|
|
||||||
; process.priority = -19
|
|
||||||
|
|
||||||
; Choose how the process manager will control the number of child processes.
|
|
||||||
; Possible Values:
|
|
||||||
; static - a fixed number (pm.max_children) of child processes;
|
|
||||||
; dynamic - the number of child processes are set dynamically based on the
|
|
||||||
; following directives. With this process management, there will be
|
|
||||||
; always at least 1 children.
|
|
||||||
; pm.max_children - the maximum number of children that can
|
|
||||||
; be alive at the same time.
|
|
||||||
; pm.start_servers - the number of children created on startup.
|
|
||||||
; pm.min_spare_servers - the minimum number of children in 'idle'
|
|
||||||
; state (waiting to process). If the number
|
|
||||||
; of 'idle' processes is less than this
|
|
||||||
; number then some children will be created.
|
|
||||||
; pm.max_spare_servers - the maximum number of children in 'idle'
|
|
||||||
; state (waiting to process). If the number
|
|
||||||
; of 'idle' processes is greater than this
|
|
||||||
; number then some children will be killed.
|
|
||||||
; ondemand - no children are created at startup. Children will be forked when
|
|
||||||
; new requests will connect. The following parameter are used:
|
|
||||||
; pm.max_children - the maximum number of children that
|
|
||||||
; can be alive at the same time.
|
|
||||||
; pm.process_idle_timeout - The number of seconds after which
|
|
||||||
; an idle process will be killed.
|
|
||||||
; Note: This value is mandatory.
|
|
||||||
pm = dynamic
|
|
||||||
|
|
||||||
; The number of child processes to be created when pm is set to 'static' and the
|
|
||||||
; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
|
|
||||||
; This value sets the limit on the number of simultaneous requests that will be
|
|
||||||
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
|
|
||||||
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
|
|
||||||
; CGI. The below defaults are based on a server without much resources. Don't
|
|
||||||
; forget to tweak pm.* to fit your needs.
|
|
||||||
; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
|
|
||||||
; Note: This value is mandatory.
|
|
||||||
pm.max_children = 5
|
|
||||||
|
|
||||||
; The number of child processes created on startup.
|
|
||||||
; Note: Used only when pm is set to 'dynamic'
|
|
||||||
; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
|
|
||||||
pm.start_servers = 2
|
|
||||||
|
|
||||||
; The desired minimum number of idle server processes.
|
|
||||||
; Note: Used only when pm is set to 'dynamic'
|
|
||||||
; Note: Mandatory when pm is set to 'dynamic'
|
|
||||||
pm.min_spare_servers = 1
|
|
||||||
|
|
||||||
; The desired maximum number of idle server processes.
|
|
||||||
; Note: Used only when pm is set to 'dynamic'
|
|
||||||
; Note: Mandatory when pm is set to 'dynamic'
|
|
||||||
pm.max_spare_servers = 3
|
|
||||||
|
|
||||||
; The number of seconds after which an idle process will be killed.
|
|
||||||
; Note: Used only when pm is set to 'ondemand'
|
|
||||||
; Default Value: 10s
|
|
||||||
;pm.process_idle_timeout = 10s;
|
|
||||||
|
|
||||||
; The number of requests each child process should execute before respawning.
|
|
||||||
; This can be useful to work around memory leaks in 3rd party libraries. For
|
|
||||||
; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
|
|
||||||
; Default Value: 0
|
|
||||||
;pm.max_requests = 500
|
|
||||||
|
|
||||||
; The URI to view the FPM status page. If this value is not set, no URI will be
|
|
||||||
; recognized as a status page. It shows the following informations:
|
|
||||||
; pool - the name of the pool;
|
|
||||||
; process manager - static, dynamic or ondemand;
|
|
||||||
; start time - the date and time FPM has started;
|
|
||||||
; start since - number of seconds since FPM has started;
|
|
||||||
; accepted conn - the number of request accepted by the pool;
|
|
||||||
; listen queue - the number of request in the queue of pending
|
|
||||||
; connections (see backlog in listen(2));
|
|
||||||
; max listen queue - the maximum number of requests in the queue
|
|
||||||
; of pending connections since FPM has started;
|
|
||||||
; listen queue len - the size of the socket queue of pending connections;
|
|
||||||
; idle processes - the number of idle processes;
|
|
||||||
; active processes - the number of active processes;
|
|
||||||
; total processes - the number of idle + active processes;
|
|
||||||
; max active processes - the maximum number of active processes since FPM
|
|
||||||
; has started;
|
|
||||||
; max children reached - number of times, the process limit has been reached,
|
|
||||||
; when pm tries to start more children (works only for
|
|
||||||
; pm 'dynamic' and 'ondemand');
|
|
||||||
; Value are updated in real time.
|
|
||||||
; Example output:
|
|
||||||
; pool: www
|
|
||||||
; process manager: static
|
|
||||||
; start time: 01/Jul/2011:17:53:49 +0200
|
|
||||||
; start since: 62636
|
|
||||||
; accepted conn: 190460
|
|
||||||
; listen queue: 0
|
|
||||||
; max listen queue: 1
|
|
||||||
; listen queue len: 42
|
|
||||||
; idle processes: 4
|
|
||||||
; active processes: 11
|
|
||||||
; total processes: 15
|
|
||||||
; max active processes: 12
|
|
||||||
; max children reached: 0
|
|
||||||
;
|
|
||||||
; By default the status page output is formatted as text/plain. Passing either
|
|
||||||
; 'html', 'xml' or 'json' in the query string will return the corresponding
|
|
||||||
; output syntax. Example:
|
|
||||||
; http://www.foo.bar/status
|
|
||||||
; http://www.foo.bar/status?json
|
|
||||||
; http://www.foo.bar/status?html
|
|
||||||
; http://www.foo.bar/status?xml
|
|
||||||
;
|
|
||||||
; By default the status page only outputs short status. Passing 'full' in the
|
|
||||||
; query string will also return status for each pool process.
|
|
||||||
; Example:
|
|
||||||
; http://www.foo.bar/status?full
|
|
||||||
; http://www.foo.bar/status?json&full
|
|
||||||
; http://www.foo.bar/status?html&full
|
|
||||||
; http://www.foo.bar/status?xml&full
|
|
||||||
; The Full status returns for each process:
|
|
||||||
; pid - the PID of the process;
|
|
||||||
; state - the state of the process (Idle, Running, ...);
|
|
||||||
; start time - the date and time the process has started;
|
|
||||||
; start since - the number of seconds since the process has started;
|
|
||||||
; requests - the number of requests the process has served;
|
|
||||||
; request duration - the duration in µs of the requests;
|
|
||||||
; request method - the request method (GET, POST, ...);
|
|
||||||
; request URI - the request URI with the query string;
|
|
||||||
; content length - the content length of the request (only with POST);
|
|
||||||
; user - the user (PHP_AUTH_USER) (or '-' if not set);
|
|
||||||
; script - the main script called (or '-' if not set);
|
|
||||||
; last request cpu - the %cpu the last request consumed
|
|
||||||
; it's always 0 if the process is not in Idle state
|
|
||||||
; because CPU calculation is done when the request
|
|
||||||
; processing has terminated;
|
|
||||||
; last request memory - the max amount of memory the last request consumed
|
|
||||||
; it's always 0 if the process is not in Idle state
|
|
||||||
; because memory calculation is done when the request
|
|
||||||
; processing has terminated;
|
|
||||||
; If the process is in Idle state, then informations are related to the
|
|
||||||
; last request the process has served. Otherwise informations are related to
|
|
||||||
; the current request being served.
|
|
||||||
; Example output:
|
|
||||||
; ************************
|
|
||||||
; pid: 31330
|
|
||||||
; state: Running
|
|
||||||
; start time: 01/Jul/2011:17:53:49 +0200
|
|
||||||
; start since: 63087
|
|
||||||
; requests: 12808
|
|
||||||
; request duration: 1250261
|
|
||||||
; request method: GET
|
|
||||||
; request URI: /test_mem.php?N=10000
|
|
||||||
; content length: 0
|
|
||||||
; user: -
|
|
||||||
; script: /home/fat/web/docs/php/test_mem.php
|
|
||||||
; last request cpu: 0.00
|
|
||||||
; last request memory: 0
|
|
||||||
;
|
|
||||||
; Note: There is a real-time FPM status monitoring sample web page available
|
|
||||||
; It's available in: /usr/share/php/7.2/fpm/status.html
|
|
||||||
;
|
|
||||||
; Note: The value must start with a leading slash (/). The value can be
|
|
||||||
; anything, but it may not be a good idea to use the .php extension or it
|
|
||||||
; may conflict with a real PHP file.
|
|
||||||
; Default Value: not set
|
|
||||||
;pm.status_path = /status
|
|
||||||
|
|
||||||
; The ping URI to call the monitoring page of FPM. If this value is not set, no
|
|
||||||
; URI will be recognized as a ping page. This could be used to test from outside
|
|
||||||
; that FPM is alive and responding, or to
|
|
||||||
; - create a graph of FPM availability (rrd or such);
|
|
||||||
; - remove a server from a group if it is not responding (load balancing);
|
|
||||||
; - trigger alerts for the operating team (24/7).
|
|
||||||
; Note: The value must start with a leading slash (/). The value can be
|
|
||||||
; anything, but it may not be a good idea to use the .php extension or it
|
|
||||||
; may conflict with a real PHP file.
|
|
||||||
; Default Value: not set
|
|
||||||
;ping.path = /ping
|
|
||||||
|
|
||||||
; This directive may be used to customize the response of a ping request. The
|
|
||||||
; response is formatted as text/plain with a 200 response code.
|
|
||||||
; Default Value: pong
|
|
||||||
;ping.response = pong
|
|
||||||
|
|
||||||
; The access log file
|
|
||||||
; Default: not set
|
|
||||||
;access.log = log/$pool.access.log
|
|
||||||
|
|
||||||
; The access log format.
|
|
||||||
; The following syntax is allowed
|
|
||||||
; %%: the '%' character
|
|
||||||
; %C: %CPU used by the request
|
|
||||||
; it can accept the following format:
|
|
||||||
; - %{user}C for user CPU only
|
|
||||||
; - %{system}C for system CPU only
|
|
||||||
; - %{total}C for user + system CPU (default)
|
|
||||||
; %d: time taken to serve the request
|
|
||||||
; it can accept the following format:
|
|
||||||
; - %{seconds}d (default)
|
|
||||||
; - %{miliseconds}d
|
|
||||||
; - %{mili}d
|
|
||||||
; - %{microseconds}d
|
|
||||||
; - %{micro}d
|
|
||||||
; %e: an environment variable (same as $_ENV or $_SERVER)
|
|
||||||
; it must be associated with embraces to specify the name of the env
|
|
||||||
; variable. Some exemples:
|
|
||||||
; - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
|
|
||||||
; - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
|
|
||||||
; %f: script filename
|
|
||||||
; %l: content-length of the request (for POST request only)
|
|
||||||
; %m: request method
|
|
||||||
; %M: peak of memory allocated by PHP
|
|
||||||
; it can accept the following format:
|
|
||||||
; - %{bytes}M (default)
|
|
||||||
; - %{kilobytes}M
|
|
||||||
; - %{kilo}M
|
|
||||||
; - %{megabytes}M
|
|
||||||
; - %{mega}M
|
|
||||||
; %n: pool name
|
|
||||||
; %o: output header
|
|
||||||
; it must be associated with embraces to specify the name of the header:
|
|
||||||
; - %{Content-Type}o
|
|
||||||
; - %{X-Powered-By}o
|
|
||||||
; - %{Transfert-Encoding}o
|
|
||||||
; - ....
|
|
||||||
; %p: PID of the child that serviced the request
|
|
||||||
; %P: PID of the parent of the child that serviced the request
|
|
||||||
; %q: the query string
|
|
||||||
; %Q: the '?' character if query string exists
|
|
||||||
; %r: the request URI (without the query string, see %q and %Q)
|
|
||||||
; %R: remote IP address
|
|
||||||
; %s: status (response code)
|
|
||||||
; %t: server time the request was received
|
|
||||||
; it can accept a strftime(3) format:
|
|
||||||
; %d/%b/%Y:%H:%M:%S %z (default)
|
|
||||||
; %T: time the log has been written (the request has finished)
|
|
||||||
; it can accept a strftime(3) format:
|
|
||||||
; %d/%b/%Y:%H:%M:%S %z (default)
|
|
||||||
; %u: remote user
|
|
||||||
;
|
|
||||||
; Default: "%R - %u %t \"%m %r\" %s"
|
|
||||||
;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
|
|
||||||
|
|
||||||
; The log file for slow requests
|
|
||||||
; Default Value: not set
|
|
||||||
; Note: slowlog is mandatory if request_slowlog_timeout is set
|
|
||||||
;slowlog = log/$pool.log.slow
|
|
||||||
|
|
||||||
; The timeout for serving a single request after which a PHP backtrace will be
|
|
||||||
; dumped to the 'slowlog' file. A value of '0s' means 'off'.
|
|
||||||
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
|
|
||||||
; Default Value: 0
|
|
||||||
;request_slowlog_timeout = 0
|
|
||||||
|
|
||||||
; Depth of slow log stack trace.
|
|
||||||
; Default Value: 20
|
|
||||||
;request_slowlog_trace_depth = 20
|
|
||||||
|
|
||||||
; The timeout for serving a single request after which the worker process will
|
|
||||||
; be killed. This option should be used when the 'max_execution_time' ini option
|
|
||||||
; does not stop script execution for some reason. A value of '0' means 'off'.
|
|
||||||
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
|
|
||||||
; Default Value: 0
|
|
||||||
;request_terminate_timeout = 0
|
|
||||||
|
|
||||||
; Set open file descriptor rlimit.
|
|
||||||
; Default Value: system defined value
|
|
||||||
;rlimit_files = 1024
|
|
||||||
|
|
||||||
; Set max core size rlimit.
|
|
||||||
; Possible Values: 'unlimited' or an integer greater or equal to 0
|
|
||||||
; Default Value: system defined value
|
|
||||||
;rlimit_core = 0
|
|
||||||
|
|
||||||
; Chroot to this directory at the start. This value must be defined as an
|
|
||||||
; absolute path. When this value is not set, chroot is not used.
|
|
||||||
; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
|
|
||||||
; of its subdirectories. If the pool prefix is not set, the global prefix
|
|
||||||
; will be used instead.
|
|
||||||
; Note: chrooting is a great security feature and should be used whenever
|
|
||||||
; possible. However, all PHP paths will be relative to the chroot
|
|
||||||
; (error_log, sessions.save_path, ...).
|
|
||||||
; Default Value: not set
|
|
||||||
;chroot =
|
|
||||||
|
|
||||||
; Chdir to this directory at the start.
|
|
||||||
; Note: relative path can be used.
|
|
||||||
; Default Value: current directory or / when chroot
|
|
||||||
;chdir = /var/www
|
|
||||||
|
|
||||||
; Redirect worker stdout and stderr into main error log. If not set, stdout and
|
|
||||||
; stderr will be redirected to /dev/null according to FastCGI specs.
|
|
||||||
; Note: on highloaded environement, this can cause some delay in the page
|
|
||||||
; process time (several ms).
|
|
||||||
; Default Value: no
|
|
||||||
catch_workers_output = yes
|
|
||||||
|
|
||||||
; Clear environment in FPM workers
|
|
||||||
; Prevents arbitrary environment variables from reaching FPM worker processes
|
|
||||||
; by clearing the environment in workers before env vars specified in this
|
|
||||||
; pool configuration are added.
|
|
||||||
; Setting to "no" will make all environment variables available to PHP code
|
|
||||||
; via getenv(), $_ENV and $_SERVER.
|
|
||||||
; Default Value: yes
|
|
||||||
;clear_env = no
|
|
||||||
|
|
||||||
; Limits the extensions of the main script FPM will allow to parse. This can
|
|
||||||
; prevent configuration mistakes on the web server side. You should only limit
|
|
||||||
; FPM to .php extensions to prevent malicious users to use other extensions to
|
|
||||||
; execute php code.
|
|
||||||
; Note: set an empty value to allow all extensions.
|
|
||||||
; Default Value: .php
|
|
||||||
;security.limit_extensions = .php .php3 .php4 .php5 .php7
|
|
||||||
|
|
||||||
; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
|
|
||||||
; the current environment.
|
|
||||||
; Default Value: clean env
|
|
||||||
;env[HOSTNAME] = $HOSTNAME
|
|
||||||
;env[PATH] = /usr/local/bin:/usr/bin:/bin
|
|
||||||
;env[TMP] = /tmp
|
|
||||||
;env[TMPDIR] = /tmp
|
|
||||||
;env[TEMP] = /tmp
|
|
||||||
|
|
||||||
; Additional php.ini defines, specific to this pool of workers. These settings
|
|
||||||
; overwrite the values previously defined in the php.ini. The directives are the
|
|
||||||
; same as the PHP SAPI:
|
|
||||||
; php_value/php_flag - you can set classic ini defines which can
|
|
||||||
; be overwritten from PHP call 'ini_set'.
|
|
||||||
; php_admin_value/php_admin_flag - these directives won't be overwritten by
|
|
||||||
; PHP call 'ini_set'
|
|
||||||
; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
|
|
||||||
|
|
||||||
; Defining 'extension' will load the corresponding shared extension from
|
|
||||||
; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
|
|
||||||
; overwrite previously defined php.ini values, but will append the new value
|
|
||||||
; instead.
|
|
||||||
|
|
||||||
; Note: path INI options can be relative and will be expanded with the prefix
|
|
||||||
; (pool, global or /usr)
|
|
||||||
|
|
||||||
; Default Value: nothing is defined by default except the values in php.ini and
|
|
||||||
; specified at startup with the -d argument
|
|
||||||
;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
|
|
||||||
;php_flag[display_errors] = off
|
|
||||||
;php_admin_value[error_log] = /var/log/fpm-php.www.log
|
|
||||||
;php_admin_flag[log_errors] = on
|
|
||||||
;php_admin_value[memory_limit] = 32M
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -1,428 +0,0 @@
|
|||||||
{% set domain_name = item.domain_name %}
|
|
||||||
|
|
||||||
; Start a new pool named '{{ domain_name }}'.
|
|
||||||
; the variable $pool can be used in any directive and will be replaced by the
|
|
||||||
; pool name ('{{ domain_name }}' here)
|
|
||||||
[{{ domain_name }}]
|
|
||||||
|
|
||||||
; Per pool prefix
|
|
||||||
; It only applies on the following directives:
|
|
||||||
; - 'access.log'
|
|
||||||
; - 'slowlog'
|
|
||||||
; - 'listen' (unixsocket)
|
|
||||||
; - 'chroot'
|
|
||||||
; - 'chdir'
|
|
||||||
; - 'php_values'
|
|
||||||
; - 'php_admin_values'
|
|
||||||
; When not set, the global prefix (or /usr) applies instead.
|
|
||||||
; Note: This directive can also be relative to the global prefix.
|
|
||||||
; Default Value: none
|
|
||||||
;prefix = /path/to/pools/$pool
|
|
||||||
|
|
||||||
; Unix user/group of processes
|
|
||||||
; Note: The user is mandatory. If the group is not set, the default user's group
|
|
||||||
; will be used.
|
|
||||||
user = nginx
|
|
||||||
group = nginx
|
|
||||||
|
|
||||||
; The address on which to accept FastCGI requests.
|
|
||||||
; Valid syntaxes are:
|
|
||||||
; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on
|
|
||||||
; a specific port;
|
|
||||||
; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
|
|
||||||
; a specific port;
|
|
||||||
; 'port' - to listen on a TCP socket to all addresses
|
|
||||||
; (IPv6 and IPv4-mapped) on a specific port;
|
|
||||||
; '/path/to/unix/socket' - to listen on a unix socket.
|
|
||||||
; Note: This value is mandatory.
|
|
||||||
listen = /run/php/php7.3-fpm-{{ domain_name }}.sock
|
|
||||||
|
|
||||||
; Set listen(2) backlog.
|
|
||||||
; Default Value: 511 (-1 on FreeBSD and OpenBSD)
|
|
||||||
;listen.backlog = 511
|
|
||||||
|
|
||||||
; Set permissions for unix socket, if one is used. In Linux, read/write
|
|
||||||
; permissions must be set in order to allow connections from a web server. Many
|
|
||||||
; BSD-derived systems allow connections regardless of permissions.
|
|
||||||
; Default Values: user and group are set as the running user
|
|
||||||
; mode is set to 0660
|
|
||||||
listen.owner = nginx
|
|
||||||
listen.group = nginx
|
|
||||||
;listen.mode = 0660
|
|
||||||
; When POSIX Access Control Lists are supported you can set them using
|
|
||||||
; these options, value is a comma separated list of user/group names.
|
|
||||||
; When set, listen.owner and listen.group are ignored
|
|
||||||
;listen.acl_users =
|
|
||||||
;listen.acl_groups =
|
|
||||||
|
|
||||||
; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
|
|
||||||
; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
|
|
||||||
; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
|
|
||||||
; must be separated by a comma. If this value is left blank, connections will be
|
|
||||||
; accepted from any ip address.
|
|
||||||
; Default Value: any
|
|
||||||
;listen.allowed_clients = 127.0.0.1
|
|
||||||
|
|
||||||
; Specify the nice(2) priority to apply to the pool processes (only if set)
|
|
||||||
; The value can vary from -19 (highest priority) to 20 (lower priority)
|
|
||||||
; Note: - It will only work if the FPM master process is launched as root
|
|
||||||
; - The pool processes will inherit the master process priority
|
|
||||||
; unless it specified otherwise
|
|
||||||
; Default Value: no set
|
|
||||||
; process.priority = -19
|
|
||||||
|
|
||||||
; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user
|
|
||||||
; or group is differrent than the master process user. It allows to create process
|
|
||||||
; core dump and ptrace the process for the pool user.
|
|
||||||
; Default Value: no
|
|
||||||
; process.dumpable = yes
|
|
||||||
|
|
||||||
; Choose how the process manager will control the number of child processes.
|
|
||||||
; Possible Values:
|
|
||||||
; static - a fixed number (pm.max_children) of child processes;
|
|
||||||
; dynamic - the number of child processes are set dynamically based on the
|
|
||||||
; following directives. With this process management, there will be
|
|
||||||
; always at least 1 children.
|
|
||||||
; pm.max_children - the maximum number of children that can
|
|
||||||
; be alive at the same time.
|
|
||||||
; pm.start_servers - the number of children created on startup.
|
|
||||||
; pm.min_spare_servers - the minimum number of children in 'idle'
|
|
||||||
; state (waiting to process). If the number
|
|
||||||
; of 'idle' processes is less than this
|
|
||||||
; number then some children will be created.
|
|
||||||
; pm.max_spare_servers - the maximum number of children in 'idle'
|
|
||||||
; state (waiting to process). If the number
|
|
||||||
; of 'idle' processes is greater than this
|
|
||||||
; number then some children will be killed.
|
|
||||||
; ondemand - no children are created at startup. Children will be forked when
|
|
||||||
; new requests will connect. The following parameter are used:
|
|
||||||
; pm.max_children - the maximum number of children that
|
|
||||||
; can be alive at the same time.
|
|
||||||
; pm.process_idle_timeout - The number of seconds after which
|
|
||||||
; an idle process will be killed.
|
|
||||||
; Note: This value is mandatory.
|
|
||||||
pm = dynamic
|
|
||||||
|
|
||||||
; The number of child processes to be created when pm is set to 'static' and the
|
|
||||||
; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
|
|
||||||
; This value sets the limit on the number of simultaneous requests that will be
|
|
||||||
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
|
|
||||||
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
|
|
||||||
; CGI. The below defaults are based on a server without much resources. Don't
|
|
||||||
; forget to tweak pm.* to fit your needs.
|
|
||||||
; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
|
|
||||||
; Note: This value is mandatory.
|
|
||||||
pm.max_children = 5
|
|
||||||
|
|
||||||
; The number of child processes created on startup.
|
|
||||||
; Note: Used only when pm is set to 'dynamic'
|
|
||||||
; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
|
|
||||||
pm.start_servers = 2
|
|
||||||
|
|
||||||
; The desired minimum number of idle server processes.
|
|
||||||
; Note: Used only when pm is set to 'dynamic'
|
|
||||||
; Note: Mandatory when pm is set to 'dynamic'
|
|
||||||
pm.min_spare_servers = 1
|
|
||||||
|
|
||||||
; The desired maximum number of idle server processes.
|
|
||||||
; Note: Used only when pm is set to 'dynamic'
|
|
||||||
; Note: Mandatory when pm is set to 'dynamic'
|
|
||||||
pm.max_spare_servers = 3
|
|
||||||
|
|
||||||
; The number of seconds after which an idle process will be killed.
|
|
||||||
; Note: Used only when pm is set to 'ondemand'
|
|
||||||
; Default Value: 10s
|
|
||||||
;pm.process_idle_timeout = 10s;
|
|
||||||
|
|
||||||
; The number of requests each child process should execute before respawning.
|
|
||||||
; This can be useful to work around memory leaks in 3rd party libraries. For
|
|
||||||
; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
|
|
||||||
; Default Value: 0
|
|
||||||
;pm.max_requests = 500
|
|
||||||
|
|
||||||
; The URI to view the FPM status page. If this value is not set, no URI will be
|
|
||||||
; recognized as a status page. It shows the following informations:
|
|
||||||
; pool - the name of the pool;
|
|
||||||
; process manager - static, dynamic or ondemand;
|
|
||||||
; start time - the date and time FPM has started;
|
|
||||||
; start since - number of seconds since FPM has started;
|
|
||||||
; accepted conn - the number of request accepted by the pool;
|
|
||||||
; listen queue - the number of request in the queue of pending
|
|
||||||
; connections (see backlog in listen(2));
|
|
||||||
; max listen queue - the maximum number of requests in the queue
|
|
||||||
; of pending connections since FPM has started;
|
|
||||||
; listen queue len - the size of the socket queue of pending connections;
|
|
||||||
; idle processes - the number of idle processes;
|
|
||||||
; active processes - the number of active processes;
|
|
||||||
; total processes - the number of idle + active processes;
|
|
||||||
; max active processes - the maximum number of active processes since FPM
|
|
||||||
; has started;
|
|
||||||
; max children reached - number of times, the process limit has been reached,
|
|
||||||
; when pm tries to start more children (works only for
|
|
||||||
; pm 'dynamic' and 'ondemand');
|
|
||||||
; Value are updated in real time.
|
|
||||||
; Example output:
|
|
||||||
; pool: www
|
|
||||||
; process manager: static
|
|
||||||
; start time: 01/Jul/2011:17:53:49 +0200
|
|
||||||
; start since: 62636
|
|
||||||
; accepted conn: 190460
|
|
||||||
; listen queue: 0
|
|
||||||
; max listen queue: 1
|
|
||||||
; listen queue len: 42
|
|
||||||
; idle processes: 4
|
|
||||||
; active processes: 11
|
|
||||||
; total processes: 15
|
|
||||||
; max active processes: 12
|
|
||||||
; max children reached: 0
|
|
||||||
;
|
|
||||||
; By default the status page output is formatted as text/plain. Passing either
|
|
||||||
; 'html', 'xml' or 'json' in the query string will return the corresponding
|
|
||||||
; output syntax. Example:
|
|
||||||
; http://www.foo.bar/status
|
|
||||||
; http://www.foo.bar/status?json
|
|
||||||
; http://www.foo.bar/status?html
|
|
||||||
; http://www.foo.bar/status?xml
|
|
||||||
;
|
|
||||||
; By default the status page only outputs short status. Passing 'full' in the
|
|
||||||
; query string will also return status for each pool process.
|
|
||||||
; Example:
|
|
||||||
; http://www.foo.bar/status?full
|
|
||||||
; http://www.foo.bar/status?json&full
|
|
||||||
; http://www.foo.bar/status?html&full
|
|
||||||
; http://www.foo.bar/status?xml&full
|
|
||||||
; The Full status returns for each process:
|
|
||||||
; pid - the PID of the process;
|
|
||||||
; state - the state of the process (Idle, Running, ...);
|
|
||||||
; start time - the date and time the process has started;
|
|
||||||
; start since - the number of seconds since the process has started;
|
|
||||||
; requests - the number of requests the process has served;
|
|
||||||
; request duration - the duration in µs of the requests;
|
|
||||||
; request method - the request method (GET, POST, ...);
|
|
||||||
; request URI - the request URI with the query string;
|
|
||||||
; content length - the content length of the request (only with POST);
|
|
||||||
; user - the user (PHP_AUTH_USER) (or '-' if not set);
|
|
||||||
; script - the main script called (or '-' if not set);
|
|
||||||
; last request cpu - the %cpu the last request consumed
|
|
||||||
; it's always 0 if the process is not in Idle state
|
|
||||||
; because CPU calculation is done when the request
|
|
||||||
; processing has terminated;
|
|
||||||
; last request memory - the max amount of memory the last request consumed
|
|
||||||
; it's always 0 if the process is not in Idle state
|
|
||||||
; because memory calculation is done when the request
|
|
||||||
; processing has terminated;
|
|
||||||
; If the process is in Idle state, then informations are related to the
|
|
||||||
; last request the process has served. Otherwise informations are related to
|
|
||||||
; the current request being served.
|
|
||||||
; Example output:
|
|
||||||
; ************************
|
|
||||||
; pid: 31330
|
|
||||||
; state: Running
|
|
||||||
; start time: 01/Jul/2011:17:53:49 +0200
|
|
||||||
; start since: 63087
|
|
||||||
; requests: 12808
|
|
||||||
; request duration: 1250261
|
|
||||||
; request method: GET
|
|
||||||
; request URI: /test_mem.php?N=10000
|
|
||||||
; content length: 0
|
|
||||||
; user: -
|
|
||||||
; script: /home/fat/web/docs/php/test_mem.php
|
|
||||||
; last request cpu: 0.00
|
|
||||||
; last request memory: 0
|
|
||||||
;
|
|
||||||
; Note: There is a real-time FPM status monitoring sample web page available
|
|
||||||
; It's available in: /usr/share/php/7.3/fpm/status.html
|
|
||||||
;
|
|
||||||
; Note: The value must start with a leading slash (/). The value can be
|
|
||||||
; anything, but it may not be a good idea to use the .php extension or it
|
|
||||||
; may conflict with a real PHP file.
|
|
||||||
; Default Value: not set
|
|
||||||
;pm.status_path = /status
|
|
||||||
|
|
||||||
; The ping URI to call the monitoring page of FPM. If this value is not set, no
|
|
||||||
; URI will be recognized as a ping page. This could be used to test from outside
|
|
||||||
; that FPM is alive and responding, or to
|
|
||||||
; - create a graph of FPM availability (rrd or such);
|
|
||||||
; - remove a server from a group if it is not responding (load balancing);
|
|
||||||
; - trigger alerts for the operating team (24/7).
|
|
||||||
; Note: The value must start with a leading slash (/). The value can be
|
|
||||||
; anything, but it may not be a good idea to use the .php extension or it
|
|
||||||
; may conflict with a real PHP file.
|
|
||||||
; Default Value: not set
|
|
||||||
;ping.path = /ping
|
|
||||||
|
|
||||||
; This directive may be used to customize the response of a ping request. The
|
|
||||||
; response is formatted as text/plain with a 200 response code.
|
|
||||||
; Default Value: pong
|
|
||||||
;ping.response = pong
|
|
||||||
|
|
||||||
; The access log file
|
|
||||||
; Default: not set
|
|
||||||
;access.log = log/$pool.access.log
|
|
||||||
|
|
||||||
; The access log format.
|
|
||||||
; The following syntax is allowed
|
|
||||||
; %%: the '%' character
|
|
||||||
; %C: %CPU used by the request
|
|
||||||
; it can accept the following format:
|
|
||||||
; - %{user}C for user CPU only
|
|
||||||
; - %{system}C for system CPU only
|
|
||||||
; - %{total}C for user + system CPU (default)
|
|
||||||
; %d: time taken to serve the request
|
|
||||||
; it can accept the following format:
|
|
||||||
; - %{seconds}d (default)
|
|
||||||
; - %{miliseconds}d
|
|
||||||
; - %{mili}d
|
|
||||||
; - %{microseconds}d
|
|
||||||
; - %{micro}d
|
|
||||||
; %e: an environment variable (same as $_ENV or $_SERVER)
|
|
||||||
; it must be associated with embraces to specify the name of the env
|
|
||||||
; variable. Some exemples:
|
|
||||||
; - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
|
|
||||||
; - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
|
|
||||||
; %f: script filename
|
|
||||||
; %l: content-length of the request (for POST request only)
|
|
||||||
; %m: request method
|
|
||||||
; %M: peak of memory allocated by PHP
|
|
||||||
; it can accept the following format:
|
|
||||||
; - %{bytes}M (default)
|
|
||||||
; - %{kilobytes}M
|
|
||||||
; - %{kilo}M
|
|
||||||
; - %{megabytes}M
|
|
||||||
; - %{mega}M
|
|
||||||
; %n: pool name
|
|
||||||
; %o: output header
|
|
||||||
; it must be associated with embraces to specify the name of the header:
|
|
||||||
; - %{Content-Type}o
|
|
||||||
; - %{X-Powered-By}o
|
|
||||||
; - %{Transfert-Encoding}o
|
|
||||||
; - ....
|
|
||||||
; %p: PID of the child that serviced the request
|
|
||||||
; %P: PID of the parent of the child that serviced the request
|
|
||||||
; %q: the query string
|
|
||||||
; %Q: the '?' character if query string exists
|
|
||||||
; %r: the request URI (without the query string, see %q and %Q)
|
|
||||||
; %R: remote IP address
|
|
||||||
; %s: status (response code)
|
|
||||||
; %t: server time the request was received
|
|
||||||
; it can accept a strftime(3) format:
|
|
||||||
; The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
|
|
||||||
; %T: time the log has been written (the request has finished)
|
|
||||||
; it can accept a strftime(3) format:
|
|
||||||
; The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
|
|
||||||
; %u: remote user
|
|
||||||
;
|
|
||||||
; Default: "%R - %u %t \"%m %r\" %s"
|
|
||||||
;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
|
|
||||||
|
|
||||||
; The log file for slow requests
|
|
||||||
; Default Value: not set
|
|
||||||
; Note: slowlog is mandatory if request_slowlog_timeout is set
|
|
||||||
;slowlog = log/$pool.log.slow
|
|
||||||
|
|
||||||
; The timeout for serving a single request after which a PHP backtrace will be
|
|
||||||
; dumped to the 'slowlog' file. A value of '0s' means 'off'.
|
|
||||||
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
|
|
||||||
; Default Value: 0
|
|
||||||
;request_slowlog_timeout = 0
|
|
||||||
|
|
||||||
; Depth of slow log stack trace.
|
|
||||||
; Default Value: 20
|
|
||||||
;request_slowlog_trace_depth = 20
|
|
||||||
|
|
||||||
; The timeout for serving a single request after which the worker process will
|
|
||||||
; be killed. This option should be used when the 'max_execution_time' ini option
|
|
||||||
; does not stop script execution for some reason. A value of '0' means 'off'.
|
|
||||||
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
|
|
||||||
; Default Value: 0
|
|
||||||
;request_terminate_timeout = 0
|
|
||||||
|
|
||||||
; Set open file descriptor rlimit.
|
|
||||||
; Default Value: system defined value
|
|
||||||
;rlimit_files = 1024
|
|
||||||
|
|
||||||
; Set max core size rlimit.
|
|
||||||
; Possible Values: 'unlimited' or an integer greater or equal to 0
|
|
||||||
; Default Value: system defined value
|
|
||||||
;rlimit_core = 0
|
|
||||||
|
|
||||||
; Chroot to this directory at the start. This value must be defined as an
|
|
||||||
; absolute path. When this value is not set, chroot is not used.
|
|
||||||
; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
|
|
||||||
; of its subdirectories. If the pool prefix is not set, the global prefix
|
|
||||||
; will be used instead.
|
|
||||||
; Note: chrooting is a great security feature and should be used whenever
|
|
||||||
; possible. However, all PHP paths will be relative to the chroot
|
|
||||||
; (error_log, sessions.save_path, ...).
|
|
||||||
; Default Value: not set
|
|
||||||
;chroot =
|
|
||||||
|
|
||||||
; Chdir to this directory at the start.
|
|
||||||
; Note: relative path can be used.
|
|
||||||
; Default Value: current directory or / when chroot
|
|
||||||
;chdir = /var/www
|
|
||||||
|
|
||||||
; Redirect worker stdout and stderr into main error log. If not set, stdout and
|
|
||||||
; stderr will be redirected to /dev/null according to FastCGI specs.
|
|
||||||
; Note: on highloaded environement, this can cause some delay in the page
|
|
||||||
; process time (several ms).
|
|
||||||
; Default Value: no
|
|
||||||
;catch_workers_output = yes
|
|
||||||
|
|
||||||
; Decorate worker output with prefix and suffix containing information about
|
|
||||||
; the child that writes to the log and if stdout or stderr is used as well as
|
|
||||||
; log level and time. This options is used only if catch_workers_output is yes.
|
|
||||||
; Settings to "no" will output data as written to the stdout or stderr.
|
|
||||||
; Default value: yes
|
|
||||||
;decorate_workers_output = no
|
|
||||||
|
|
||||||
; Clear environment in FPM workers
|
|
||||||
; Prevents arbitrary environment variables from reaching FPM worker processes
|
|
||||||
; by clearing the environment in workers before env vars specified in this
|
|
||||||
; pool configuration are added.
|
|
||||||
; Setting to "no" will make all environment variables available to PHP code
|
|
||||||
; via getenv(), $_ENV and $_SERVER.
|
|
||||||
; Default Value: yes
|
|
||||||
;clear_env = no
|
|
||||||
|
|
||||||
; Limits the extensions of the main script FPM will allow to parse. This can
|
|
||||||
; prevent configuration mistakes on the web server side. You should only limit
|
|
||||||
; FPM to .php extensions to prevent malicious users to use other extensions to
|
|
||||||
; execute php code.
|
|
||||||
; Note: set an empty value to allow all extensions.
|
|
||||||
; Default Value: .php
|
|
||||||
;security.limit_extensions = .php .php3 .php4 .php5 .php7
|
|
||||||
|
|
||||||
; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
|
|
||||||
; the current environment.
|
|
||||||
; Default Value: clean env
|
|
||||||
;env[HOSTNAME] = $HOSTNAME
|
|
||||||
;env[PATH] = /usr/local/bin:/usr/bin:/bin
|
|
||||||
;env[TMP] = /tmp
|
|
||||||
;env[TMPDIR] = /tmp
|
|
||||||
;env[TEMP] = /tmp
|
|
||||||
|
|
||||||
; Additional php.ini defines, specific to this pool of workers. These settings
|
|
||||||
; overwrite the values previously defined in the php.ini. The directives are the
|
|
||||||
; same as the PHP SAPI:
|
|
||||||
; php_value/php_flag - you can set classic ini defines which can
|
|
||||||
; be overwritten from PHP call 'ini_set'.
|
|
||||||
; php_admin_value/php_admin_flag - these directives won't be overwritten by
|
|
||||||
; PHP call 'ini_set'
|
|
||||||
; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
|
|
||||||
|
|
||||||
; Defining 'extension' will load the corresponding shared extension from
|
|
||||||
; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
|
|
||||||
; overwrite previously defined php.ini values, but will append the new value
|
|
||||||
; instead.
|
|
||||||
|
|
||||||
; Note: path INI options can be relative and will be expanded with the prefix
|
|
||||||
; (pool, global or /usr)
|
|
||||||
|
|
||||||
; Default Value: nothing is defined by default except the values in php.ini and
|
|
||||||
; specified at startup with the -d argument
|
|
||||||
;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
|
|
||||||
;php_flag[display_errors] = off
|
|
||||||
;php_admin_value[error_log] = /var/log/fpm-php.www.log
|
|
||||||
;php_admin_flag[log_errors] = on
|
|
||||||
;php_admin_value[memory_limit] = 32M
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user