parent
5878ef2e31
commit
eb5feb1fb8
@ -1,2 +1,4 @@ |
||||
hosts |
||||
keys/ |
||||
.vscode/ |
||||
group_vars/infra.yml |
||||
@ -0,0 +1,19 @@ |
||||
#!/sbin/openrc-run |
||||
|
||||
depend() { |
||||
use logger dns |
||||
need net |
||||
after firewall |
||||
} |
||||
|
||||
start() { |
||||
ebegin "Starting dropbear" |
||||
/usr/sbin/dropbear ${DROPBEAR_OPTS} |
||||
eend $? |
||||
} |
||||
|
||||
stop() { |
||||
ebegin "Stopping dropbear" |
||||
start-stop-daemon --stop --pidfile /var/run/dropbear.pid |
||||
eend $? |
||||
} |
||||
@ -0,0 +1,27 @@ |
||||
- name: add default record |
||||
include_tasks: |
||||
file: add_record.yml |
||||
apply: |
||||
delegate_to: "{{ services.internal_ns }}" |
||||
vars: |
||||
record: {} |
||||
when: (records | d([]) | length) == 0 |
||||
|
||||
|
||||
- name: process other items |
||||
include_tasks: |
||||
file: add_record.yml |
||||
apply: |
||||
delegate_to: "{{ services.internal_ns }}" |
||||
loop: "{{ records | d([]) }}" |
||||
loop_control: |
||||
loop_var: record |
||||
|
||||
|
||||
- name: restart coredns |
||||
service: |
||||
name: coredns |
||||
state: restarted |
||||
delegate_to: "{{ services.internal_ns }}" |
||||
when: (ns_instant | d(false) == false) and |
||||
((ns_records_changed | d(false) == true) or (ns_serial_changed | d(false) == true)) |
||||
@ -1,21 +0,0 @@ |
||||
- name: add default record |
||||
include_tasks: add_record.yml |
||||
vars: |
||||
record: {} |
||||
when: (ns_records | d([]) | length) == 0 |
||||
|
||||
|
||||
- name: process other items |
||||
include_tasks: add_record.yml |
||||
loop: "{{ ns_records | d([]) }}" |
||||
loop_control: |
||||
loop_var: record |
||||
|
||||
|
||||
- name: restart coredns |
||||
service: |
||||
name: coredns |
||||
state: restarted |
||||
when: (ns_instant | d(false) == false) and |
||||
((ns_records_changed | d(false) == true) or |
||||
(ns_serial_changed | d(false) == true)) |
||||
@ -0,0 +1,13 @@ |
||||
- name: set role information |
||||
set_fact: |
||||
role_dependency: |
||||
- {stage: 3, role: 'coredns'} |
||||
- {stage: 5, role: 'coredns', tasks_from: 'tls.yml'} |
||||
|
||||
role_dependency_index: 0 |
||||
|
||||
role_hardware: |
||||
cores: 4 |
||||
memory: 128 |
||||
swap: 64 |
||||
disk: 0.3 |
||||
@ -1,93 +0,0 @@ |
||||
- name: install coredns and dependencies |
||||
include_tasks: tasks/install_packages.yml |
||||
vars: |
||||
package: |
||||
- coredns |
||||
- alpine: coredns-openrc |
||||
|
||||
|
||||
- name: create user and group |
||||
include_tasks: tasks/create_user.yml |
||||
vars: |
||||
user: |
||||
name: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
|
||||
|
||||
- name: create config directory |
||||
file: |
||||
path: "{{ coredns_conf_dir }}" |
||||
state: directory |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template corefile |
||||
template: |
||||
src: corefile.j2 |
||||
dest: "{{ coredns_conf_file }}" |
||||
force: yes |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template empty tls file if missing |
||||
copy: |
||||
content: '' |
||||
dest: "{{ coredns_tls_file }}" |
||||
force: no |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template root zone if missing |
||||
template: |
||||
src: zone.j2 |
||||
dest: "{{ coredns_conf_dir ~ '/' ~ (ns_tld | d(int_tld)) ~ '.zone' }}" |
||||
force: no |
||||
mode: 0400 |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: edit service config |
||||
lineinfile: |
||||
path: /etc/conf.d/coredns |
||||
regexp: "^COREDNS_CONFIG=" |
||||
line: "COREDNS_CONFIG={{ coredns_conf_file | quote }}" |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template init script |
||||
template: |
||||
src: init.j2 |
||||
dest: /etc/init.d/coredns |
||||
force: yes |
||||
mode: 0755 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: flush handlers |
||||
meta: flush_handlers |
||||
|
||||
|
||||
- name: add directories to backup plan |
||||
include_role: |
||||
name: backup |
||||
vars: |
||||
function: add |
||||
backup_items: |
||||
- "{{ coredns_conf_dir }}" |
||||
|
||||
|
||||
- name: enable and start coredns |
||||
service: |
||||
name: coredns |
||||
enabled: yes |
||||
state: started |
||||
@ -1,28 +0,0 @@ |
||||
- name: deploy ecc384 cert |
||||
include_role: |
||||
name: ca |
||||
vars: |
||||
function: certs |
||||
ca_options: |
||||
mode: '0400' |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
concat_inter: true |
||||
preset: web |
||||
ocsp_must_staple: false |
||||
notify: restart coredns |
||||
ca_certs: |
||||
- type: ecc384 |
||||
key: "{{ coredns_key_file }}" |
||||
cert: "{{ coredns_cert_file }}" |
||||
|
||||
|
||||
- name: template tls snippet file |
||||
template: |
||||
src: tls.j2 |
||||
dest: "{{ coredns_tls_file }}" |
||||
force: yes |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
@ -1,13 +1,102 @@ |
||||
- name: install coredns |
||||
include_tasks: install.yml |
||||
when: function == 'install' |
||||
- name: build default tld list |
||||
set_fact: |
||||
coredns_tld_list: "{{ [ ns_tld | d(int_tld) ] }}" |
||||
when: coredns_tld_list is not defined |
||||
|
||||
|
||||
- name: install coredns tls enhancements |
||||
include_tasks: install_tls.yml |
||||
when: function == 'install_tls' |
||||
- name: install coredns and dependencies |
||||
include_tasks: tasks/install_packages.yml |
||||
vars: |
||||
package: |
||||
- coredns |
||||
- alpine: coredns-openrc |
||||
|
||||
|
||||
- name: add records |
||||
include_tasks: add_records.yml |
||||
when: function == 'add_records' |
||||
- name: create user and group |
||||
include_tasks: tasks/create_user.yml |
||||
vars: |
||||
user: |
||||
name: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
|
||||
|
||||
- name: create config directory |
||||
file: |
||||
path: "{{ coredns_conf_dir }}" |
||||
state: directory |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template corefile |
||||
template: |
||||
src: corefile.j2 |
||||
dest: "{{ coredns_conf_file }}" |
||||
force: yes |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template empty tls file if missing |
||||
copy: |
||||
content: '' |
||||
dest: "{{ coredns_tls_file }}" |
||||
force: no |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template all zones if missing |
||||
template: |
||||
src: zone.j2 |
||||
dest: "{{ (coredns_conf_dir, zone ~ '.zone') | path_join }}" |
||||
force: no |
||||
mode: 0400 |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
notify: restart coredns |
||||
loop: "{{ coredns_tld_list }}" |
||||
loop_control: |
||||
loop_var: zone |
||||
|
||||
|
||||
- name: edit service config |
||||
lineinfile: |
||||
path: /etc/conf.d/coredns |
||||
regexp: "^COREDNS_CONFIG=" |
||||
line: "COREDNS_CONFIG={{ coredns_conf_file | quote }}" |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template init script |
||||
template: |
||||
src: init.j2 |
||||
dest: /etc/init.d/coredns |
||||
force: yes |
||||
mode: 0755 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: flush handlers |
||||
meta: flush_handlers |
||||
|
||||
|
||||
- name: add directories to backup plan |
||||
include_role: |
||||
name: backup |
||||
tasks_from: add.yml |
||||
vars: |
||||
backup_items: |
||||
- "{{ coredns_conf_dir }}" |
||||
|
||||
|
||||
- name: enable and start coredns |
||||
service: |
||||
name: coredns |
||||
enabled: yes |
||||
state: started |
||||
|
||||
@ -0,0 +1,25 @@ |
||||
- block: |
||||
- name: deploy ecc384 cert |
||||
include_role: |
||||
name: certs |
||||
vars: |
||||
certs: |
||||
cert: "{{ coredns_cert_file }}" |
||||
key: "{{ coredns_key_file }}" |
||||
ecc: yes |
||||
post_hook: service coredns restart |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
|
||||
|
||||
- name: template tls snippet file |
||||
template: |
||||
src: tls.j2 |
||||
dest: "{{ coredns_tls_file }}" |
||||
force: yes |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
|
||||
when: host_tls |
||||
@ -1,9 +1,13 @@ |
||||
tls://{{ ns_tld | d(int_tld) }}:853 { |
||||
import common |
||||
tls {{ coredns_cert_file | quote }} {{ coredns_key_file | quote }} |
||||
} |
||||
{% for zone in coredns_tld_list %} |
||||
tls://{{ zone }}:853 { |
||||
import common |
||||
file {{ (zone ~ '.zone') | quote }} |
||||
tls {{ coredns_cert_file | quote }} {{ coredns_key_file | quote }} |
||||
} |
||||
|
||||
https://{{ ns_tld | d(int_tld) }} { |
||||
import common |
||||
tls {{ coredns_cert_file | quote }} {{ coredns_key_file | quote }} |
||||
} |
||||
https://{{ zone }} { |
||||
import common |
||||
file {{ (zone ~ '.zone') | quote }} |
||||
tls {{ coredns_cert_file | quote }} {{ coredns_key_file | quote }} |
||||
} |
||||
{% endfor %} |
||||
@ -1,32 +1,13 @@ |
||||
{%- set primary_ns = inventory_hostname -%} |
||||
|
||||
{%- if ns_server_group is defined -%} |
||||
{%- set primary_ns = hostvars[groups[ns_server_group][0]]['inventory_hostname'] -%} |
||||
{%- endif -%} |
||||
|
||||
{%- set this_name = (ns_name | d(inventory_hostname)) -%} |
||||
{%- set this_primary_name = (hostvars[primary_ns]['ns_name'] | d(hostvars[primary_ns]['inventory_hostname'])) -%} |
||||
{%- set this_tld = (hostvars[primary_ns]['ns_tld'] | d(ns_tld) | d(int_tld)) -%} |
||||
|
||||
|
||||
|
||||
$ORIGIN {{ this_tld }}. |
||||
$ORIGIN {{ zone }}. |
||||
$TTL {{ ns_ttl | d(300) }} |
||||
|
||||
@ IN SOA {{ this_name ~ '.' ~ this_tld }}. {{ (ns_admin | replace('@', '.')) if ns_admin is defined else ('admin' ~ '.' ~ this_tld) }}. ( |
||||
2021010101 |
||||
@ IN SOA {{ host_name ~ '.' ~ zone }}. {{ (ns_admin | replace('@', '.')) if ns_admin is defined else ('admin' ~ '.' ~ zone) }}. ( |
||||
2023010101 |
||||
{{ ns_refresh | d(1200) }} |
||||
{{ ns_retry | d(300) }} |
||||
{{ ns_expire | d(1209600) }} |
||||
{{ ns_neg_ttl | d(300) }} |
||||
) |
||||
|
||||
{% if ns_server_group is defined -%} |
||||
{% for host in groups[ns_server_group] -%} |
||||
@ IN NS {{ (hostvars[host]['ns_name'] | d(hostvars[host]['inventory_hostname'])) ~ '.' ~ this_tld }}. |
||||
{{ hostvars[host]['ns_name'] | d(hostvars[host]['inventory_hostname']) }} IN A {{ hostvars[host]['ansible_host'] }} |
||||
{% endfor -%} |
||||
{% else -%} |
||||
@ IN NS {{ this_primary_name ~ '.' ~ this_tld }}. |
||||
{{ this_primary_name }} IN A {{ ansible_host }} |
||||
{% endif -%} |
||||
@ IN NS {{ host_name ~ '.' ~ zone }}. |
||||
{{ host_name }} IN A {{ ansible_host }} |
||||
|
||||
@ -0,0 +1,7 @@ |
||||
- name: set role information |
||||
set_fact: |
||||
role_dependency: |
||||
- { stage: 3, role: 'ns' } |
||||
|
||||
role_dependency_index: 1 |
||||
role_dependency_no_common: yes |
||||
@ -0,0 +1,3 @@ |
||||
- name: add internal ns records |
||||
include_role: |
||||
name: ns |
||||
@ -1,16 +1,12 @@ |
||||
- name: ns installation |
||||
include_tasks: install.yml |
||||
when: function == 'install' |
||||
|
||||
|
||||
- block: |
||||
- name: add records |
||||
include_tasks: add_records.yml |
||||
when: services.internal_ns is defined |
||||
|
||||
|
||||
- debug: |
||||
msg: internal nameserver is not defined |
||||
when: services.internal_ns is not defined |
||||
|
||||
when: function == 'add_records' |
||||
- name: add internal ns records with coredns |
||||
block: |
||||
- set_fact: |
||||
records_tmp: "{{ records | d([]) }}" |
||||
|
||||
- include_role: |
||||
name: coredns |
||||
tasks_from: add.yml |
||||
vars: |
||||
records: "{{ records_tmp }}" |
||||
|
||||
when: services.internal_ns is defined |
||||
|
||||
@ -0,0 +1,9 @@ |
||||
- name: set role information |
||||
set_fact: |
||||
role_dependency: |
||||
- {stage: 1, role: 'common'} |
||||
- {stage: 1, role: 'proxmox'} |
||||
- {stage: 5, role: 'proxmox', tasks_from: 'rproxy'} |
||||
- {stage: 6, role: 'proxmox', tasks_from: 'mail'} |
||||
|
||||
role_dependency_index: 0 |
||||
@ -1,72 +1,75 @@ |
||||
- name: install libsasl2-modules |
||||
package: |
||||
name: libsasl2-modules |
||||
- block: |
||||
- name: install libsasl2-modules |
||||
package: |
||||
name: libsasl2-modules |
||||
|
||||
|
||||
- name: edit postfix config |
||||
lineinfile: |
||||
path: /etc/postfix/main.cf |
||||
regexp: '^{{ item.name | regex_escape() }}([^\S\r\n]*)=([^\S\r\n]*)' |
||||
line: '{{ item.name }} = {{ item.value }}' |
||||
notify: restart postfix |
||||
loop: |
||||
- { name: myhostname, value: "{{ host_fqdn }}" } |
||||
- { name: relayhost, value: "{{ mail_server.mta_actual_hostname ~ '.' ~ int_tld }}:465" } |
||||
- { name: sender_canonical_classes, value: "envelope_sender, header_sender" } |
||||
- { name: sender_canonical_maps, value: "regexp:/etc/postfix/sender_canonical_maps" } |
||||
- { name: smtp_header_checks, value: "regexp:/etc/postfix/header_check" } |
||||
- { name: smtp_use_tls, value: "yes" } |
||||
- { name: smtp_sasl_auth_enable, value: "yes" } |
||||
- { name: smtp_sasl_security_options, value: "noanonymous" } |
||||
- { name: smtp_tls_wrappermode, value: "yes" } |
||||
- { name: smtp_tls_security_level, value: "encrypt" } |
||||
- { name: smtp_sasl_password_maps, value: "texthash:/etc/postfix/sasl_passwd" } |
||||
- { name: smtp_tls_CAfile, value: "/etc/ssl/certs/ca-certificates.crt" } |
||||
- { name: notify_classes, value: "" } |
||||
- { name: mydestination, value: "" } |
||||
- name: edit postfix config |
||||
lineinfile: |
||||
path: /etc/postfix/main.cf |
||||
regexp: '^{{ item.name | regex_escape() }}([^\S\r\n]*)=([^\S\r\n]*)' |
||||
line: '{{ item.name }} = {{ item.value }}' |
||||
notify: restart postfix |
||||
loop: |
||||
- { name: myhostname, value: "{{ host_fqdn }}" } |
||||
- { name: relayhost, value: "{{ mail_server.mta_actual_hostname ~ '.' ~ int_tld }}:465" } |
||||
- { name: sender_canonical_classes, value: "envelope_sender, header_sender" } |
||||
- { name: sender_canonical_maps, value: "regexp:/etc/postfix/sender_canonical_maps" } |
||||
- { name: smtp_header_checks, value: "regexp:/etc/postfix/header_check" } |
||||
- { name: smtp_use_tls, value: "yes" } |
||||
- { name: smtp_sasl_auth_enable, value: "yes" } |
||||
- { name: smtp_sasl_security_options, value: "noanonymous" } |
||||
- { name: smtp_tls_wrappermode, value: "yes" } |
||||
- { name: smtp_tls_security_level, value: "encrypt" } |
||||
- { name: smtp_sasl_password_maps, value: "texthash:/etc/postfix/sasl_passwd" } |
||||
- { name: smtp_tls_CAfile, value: "/etc/ssl/certs/ca-certificates.crt" } |
||||
- { name: notify_classes, value: "" } |
||||
- { name: mydestination, value: "" } |
||||
|
||||
|
||||
- name: edit master.cf |
||||
lineinfile: |
||||
path: /etc/postfix/master.cf |
||||
regexp: '^bounce([^\S\r\n]+)unix' |
||||
line: 'bounce unix - - n - 0 discard' |
||||
notify: restart postfix |
||||
- name: edit master.cf |
||||
lineinfile: |
||||
path: /etc/postfix/master.cf |
||||
regexp: '^bounce([^\S\r\n]+)unix' |
||||
line: 'bounce unix - - n - 0 discard' |
||||
notify: restart postfix |
||||
|
||||
|
||||
- name: create postfix files |
||||
copy: |
||||
dest: "/etc/postfix/{{ item.name }}" |
||||
content: "{{ item.content }}" |
||||
mode: "{{ item.mode | d(omit) }}" |
||||
notify: restart postfix |
||||
loop: |
||||
- name: sasl_passwd |
||||
content: "{{ mail_server.mta_actual_hostname ~ '.' ~ int_tld ~ ':465 ' ~ |
||||
mail_account.username ~ '@' ~ mail_server.tld ~ ':' ~ mail_account.password }}" |
||||
mode: '0600' |
||||
- name: sender_canonical_maps |
||||
content: '/.+/ {{ host_name }}@{{ mail_server.tld }}' |
||||
- name: header_check |
||||
content: '/From:.*/ REPLACE From: {{ host_name }} <{{ host_name }}@{{ mail_server.tld }}>' |
||||
- name: create postfix files |
||||
copy: |
||||
dest: "/etc/postfix/{{ item.name }}" |
||||
content: "{{ item.content }}" |
||||
mode: "{{ item.mode | d(omit) }}" |
||||
notify: restart postfix |
||||
loop: |
||||
- name: sasl_passwd |
||||
content: "{{ mail_server.mta_actual_hostname ~ '.' ~ int_tld ~ ':465 ' ~ |
||||
mail_account.username ~ '@' ~ mail_server.tld ~ ':' ~ mail_account.password }}" |
||||
mode: '0600' |
||||
- name: sender_canonical_maps |
||||
content: '/.+/ {{ host_name }}@{{ mail_server.tld }}' |
||||
- name: header_check |
||||
content: '/From:.*/ REPLACE From: {{ host_name }} <{{ host_name }}@{{ mail_server.tld }}>' |
||||
|
||||
|
||||
- name: edit crontab mail config |
||||
lineinfile: |
||||
path: /etc/crontab |
||||
regexp: '^MAILTO=' |
||||
line: 'MAILTO=""' |
||||
insertafter: '^PATH=' |
||||
- name: edit crontab mail config |
||||
lineinfile: |
||||
path: /etc/crontab |
||||
regexp: '^MAILTO=' |
||||
line: 'MAILTO=""' |
||||
insertafter: '^PATH=' |
||||
|
||||
|
||||
- name: edit zed config file |
||||
lineinfile: |
||||
path: /etc/zfs/zed.d/zed.rc |
||||
regexp: '^{{ item.name | upper | regex_escape() }}=' |
||||
line: '{{ item.name | upper }}="{{ item.value }}"' |
||||
notify: restart zed |
||||
loop: |
||||
- { name: zed_email_addr, value: "{{ maintainer_email }}" } |
||||
- { name: zed_email_prog, value: mail } |
||||
- { name: zed_email_opts, value: "-s '@SUBJECT@' @ADDRESS@ -r {{ mail_account.username ~ '@' ~ mail_server.tld }}" } |
||||
- { name: zed_notify_verbose, value: 1 } |
||||
- name: edit zed config file |
||||
lineinfile: |
||||
path: /etc/zfs/zed.d/zed.rc |
||||
regexp: '^{{ item.name | upper | regex_escape() }}=' |
||||
line: '{{ item.name | upper }}="{{ item.value }}"' |
||||
notify: restart zed |
||||
loop: |
||||
- { name: zed_email_addr, value: "{{ maintainer_email }}" } |
||||
- { name: zed_email_prog, value: mail } |
||||
- { name: zed_email_opts, value: "-s '@SUBJECT@' @ADDRESS@ -r {{ mail_account.username ~ '@' ~ mail_server.tld }}" } |
||||
- { name: zed_notify_verbose, value: 1 } |
||||
|
||||
when: (mail_account is mapping) and (mail_server is mapping) |
||||
|
||||
Loading…
Reference in new issue