zammad: new role

group_vars/all/vars.yml

@@ -126,7 +126,6 @@ mail_aliases:
 - "workshops@binary-kitchen.de	timo.schindler@binary-kitchen.de,venti@binary-kitchen.de"
 - "himmel@eh21.easterhegg.eu	christoph@binary-kitchen.de,pheerai@binary-kitchen.de,shortkath@binary-kitchen.de"
 - "tickets@eh21.easterhegg.eu	orga@eh21.easterhegg.eu"
-- "noc@eh21.easterhegg.eu	moepman@binary-kitchen.de"
 
 matrix_domain: matrix.binary-kitchen.de
 matrix_dbname: matrix
@@ -196,3 +195,5 @@ vaultwarden_token: "{{ vault_vaultwarden_token }}"
 vaultwarden_yubico_secret: "{{ vault_vaultwarden_yubico_secret }}"
 
 workadventure_domain: wa.binary-kitchen.de
+
+zammad_domain: requests.binary-kitchen.de

hosts

@@ -29,6 +29,7 @@ fluorine.binary-kitchen.net
 neon.binary-kitchen.net
 sodium.binary-kitchen.net
 magnesium.binary-kitchen.net
+aluminium.binary-kitchen.net
 krypton.binary-kitchen.net
 yttrium.binary-kitchen.net
 zirconium.binary-kitchen.net

roles/zammad/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+
+- name: Restart nginx
+  service: name=nginx state=restarted
+
+- name: Run acertmgr
+  command: /usr/bin/acertmgr

roles/zammad/meta/main.yml

@@ -0,0 +1,5 @@
+---
+
+dependencies:
+- { role: acertmgr }
+- { role: nginx, nginx_ssl: True }

roles/zammad/tasks/main.yml

@@ -0,0 +1,57 @@
+---
+
+- name: Enable elasic apt-key
+  apt_key: url="https://artifacts.elastic.co/GPG-KEY-elasticsearch" keyring="/etc/apt/trusted.gpg.d/elastic.gpg"
+
+- name: Enable elastic repository
+  apt_repository: repo="deb https://artifacts.elastic.co/packages/7.x/apt stable main"
+
+- name: Install elasticsearch
+  apt: name=elasticsearch
+  register: elasticsearch_install
+
+- name: Install attachment plugin
+  command: /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-attachment --batch
+  when: elasticsearch_install.changed
+
+- name: Start the elasticsearch service
+  service: name=elasticsearch state=started enabled=yes
+
+- name: Enable zammad apt-key
+  apt_key: url="https://dl.packager.io/srv/zammad/zammad/key" keyring="/etc/apt/trusted.gpg.d/zammad.gpg"
+
+- name: Enable zammad repository
+  apt_repository: repo="deb https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 12 main"
+
+- name: Install zammad
+  apt: name=zammad
+  register: zammad_install
+
+- name: Configure zammad for ES
+  command: zammad run rails r "Setting.set('es_url', 'http://localhost:9200')"
+  when: zammad_install.changed
+
+- name: Build search index
+  command: zammad run rake zammad:searchindex:rebuild
+  when: zammad_install.changed
+
+- name: Ensure certificates are available
+  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ zammad_domain }}.key -out /etc/nginx/ssl/{{ zammad_domain }}.crt -days 730 -subj "/CN={{ zammad_domain }}" creates=/etc/nginx/ssl/{{ zammad_domain }}.crt
+  notify: Restart nginx
+
+- name: Configure certificate manager for zammad
+  template: src=certs.j2 dest=/etc/acertmgr/{{ zammad_domain }}.conf
+  notify: Run acertmgr
+
+- name: Configure vhost
+  template: src=vhost.j2 dest=/etc/nginx/sites-available/zammad
+  notify: Restart nginx
+
+- name: Enable vhost
+  file: src=/etc/nginx/sites-available/zammad dest=/etc/nginx/sites-enabled/zammad state=link
+  notify: Restart nginx
+
+- name: Enable monitoring
+  include_role: name=icinga-monitor tasks_from=http
+  vars:
+    vhost: "{{ zammad_domain }}"

roles/zammad/templates/certs.j2

@@ -0,0 +1,15 @@
+---
+
+{{ zammad_domain }}:
+- path: /etc/nginx/ssl/{{ zammad_domain }}.key
+  user: root
+  group: root
+  perm: '400'
+  format: key
+  action: '/usr/sbin/service nginx restart'
+- path: /etc/nginx/ssl/{{ zammad_domain }}.crt
+  user: root
+  group: root
+  perm: '400'
+  format: crt,ca
+  action: '/usr/sbin/service nginx restart'

roles/zammad/templates/vhost.j2

@@ -0,0 +1,84 @@
+server {
+  listen 80;
+  listen [::]:80;
+
+  server_name {{ zammad_domain }};
+
+  location /.well-known/acme-challenge {
+    default_type "text/plain";
+    alias /var/www/acme-challenge;
+  }
+
+  return 301 https://$server_name$request_uri;
+
+}
+
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+
+  server_name {{ zammad_domain }};
+
+  ssl_certificate_key /etc/nginx/ssl/{{ zammad_domain }}.key;
+  ssl_certificate /etc/nginx/ssl/{{ zammad_domain }}.crt;
+
+  add_header Strict-Transport-Security "max-age=31536000" always;
+
+  location = /robots.txt  {
+    access_log off; log_not_found off;
+  }
+
+  location = /favicon.ico {
+    access_log off; log_not_found off;
+  }
+
+  root /opt/zammad/public;
+
+  client_max_body_size 50M;
+
+  location ~ ^/(assets/|robots.txt|humans.txt|favicon.ico|apple-touch-icon.png) {
+    expires max;
+  }
+
+  # legacy web socket server
+  location /ws {
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+    proxy_set_header CLIENT_IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 86400;
+    proxy_pass http://127.0.0.1:6042;
+  }
+
+  # action cable
+  location /cable {
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+    proxy_set_header CLIENT_IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 86400;
+    proxy_pass http://127.0.0.1:3000;
+  }
+
+  location / {
+    proxy_set_header Host $http_host;
+    proxy_set_header CLIENT_IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto  $scheme;
+
+    # change this line in an SSO setup
+    proxy_set_header X-Forwarded-User "";
+
+    proxy_read_timeout 180;
+    proxy_pass http://127.0.0.1:3000;
+
+    gzip on;
+    gzip_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml;
+    gzip_proxied any;
+  }
+}

site.yml

@@ -7,7 +7,7 @@
   - root_keys
 
 - name: Setup unattended updates
-  hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, palladium.binary-kitchen.net, argentum.binary-kitchen.net, barium.binary-kitchen.net]
+  hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, aluminium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, palladium.binary-kitchen.net, argentum.binary-kitchen.net, barium.binary-kitchen.net]
   roles:
   - uau
 
@@ -124,6 +124,11 @@
   roles:
   - coturn
 
+- name: Setup zammad server
+  hosts: aluminium.binary-kitchen.net
+  roles:
+  - zammad
+
 - name: Setup jitsi server
   hosts: zirconium.binary-kitchen.net
   roles: