From b2b7045f6184fcbfe2bfd00d2ff2c8247f723fd2 Mon Sep 17 00:00:00 2001 From: Markus Hauschild Date: Mon, 8 Jan 2024 20:08:25 +0100 Subject: [PATCH] zammad: new role --- group_vars/all/vars.yml | 3 +- hosts | 1 + roles/zammad/handlers/main.yml | 7 +++ roles/zammad/meta/main.yml | 5 ++ roles/zammad/tasks/main.yml | 57 ++++++++++++++++++++++ roles/zammad/templates/certs.j2 | 15 ++++++ roles/zammad/templates/vhost.j2 | 84 +++++++++++++++++++++++++++++++++ site.yml | 7 ++- 8 files changed, 177 insertions(+), 2 deletions(-) create mode 100644 roles/zammad/handlers/main.yml create mode 100644 roles/zammad/meta/main.yml create mode 100644 roles/zammad/tasks/main.yml create mode 100644 roles/zammad/templates/certs.j2 create mode 100644 roles/zammad/templates/vhost.j2 diff --git a/group_vars/all/vars.yml b/group_vars/all/vars.yml index e758a0c..acb3f9a 100644 --- a/group_vars/all/vars.yml +++ b/group_vars/all/vars.yml @@ -126,7 +126,6 @@ mail_aliases: - "workshops@binary-kitchen.de timo.schindler@binary-kitchen.de,venti@binary-kitchen.de" - "himmel@eh21.easterhegg.eu christoph@binary-kitchen.de,pheerai@binary-kitchen.de,shortkath@binary-kitchen.de" - "tickets@eh21.easterhegg.eu orga@eh21.easterhegg.eu" -- "noc@eh21.easterhegg.eu moepman@binary-kitchen.de" matrix_domain: matrix.binary-kitchen.de matrix_dbname: matrix @@ -196,3 +195,5 @@ vaultwarden_token: "{{ vault_vaultwarden_token }}" vaultwarden_yubico_secret: "{{ vault_vaultwarden_yubico_secret }}" workadventure_domain: wa.binary-kitchen.de + +zammad_domain: requests.binary-kitchen.de diff --git a/hosts b/hosts index 1cb52c1..2e8898e 100644 --- a/hosts +++ b/hosts @@ -29,6 +29,7 @@ fluorine.binary-kitchen.net neon.binary-kitchen.net sodium.binary-kitchen.net magnesium.binary-kitchen.net +aluminium.binary-kitchen.net krypton.binary-kitchen.net yttrium.binary-kitchen.net zirconium.binary-kitchen.net diff --git a/roles/zammad/handlers/main.yml b/roles/zammad/handlers/main.yml new file mode 100644 index 0000000..ff936dd --- /dev/null +++ b/roles/zammad/handlers/main.yml @@ -0,0 +1,7 @@ +--- + +- name: Restart nginx + service: name=nginx state=restarted + +- name: Run acertmgr + command: /usr/bin/acertmgr diff --git a/roles/zammad/meta/main.yml b/roles/zammad/meta/main.yml new file mode 100644 index 0000000..8fcf724 --- /dev/null +++ b/roles/zammad/meta/main.yml @@ -0,0 +1,5 @@ +--- + +dependencies: +- { role: acertmgr } +- { role: nginx, nginx_ssl: True } diff --git a/roles/zammad/tasks/main.yml b/roles/zammad/tasks/main.yml new file mode 100644 index 0000000..f15c35c --- /dev/null +++ b/roles/zammad/tasks/main.yml @@ -0,0 +1,57 @@ +--- + +- name: Enable elasic apt-key + apt_key: url="https://artifacts.elastic.co/GPG-KEY-elasticsearch" keyring="/etc/apt/trusted.gpg.d/elastic.gpg" + +- name: Enable elastic repository + apt_repository: repo="deb https://artifacts.elastic.co/packages/7.x/apt stable main" + +- name: Install elasticsearch + apt: name=elasticsearch + register: elasticsearch_install + +- name: Install attachment plugin + command: /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-attachment --batch + when: elasticsearch_install.changed + +- name: Start the elasticsearch service + service: name=elasticsearch state=started enabled=yes + +- name: Enable zammad apt-key + apt_key: url="https://dl.packager.io/srv/zammad/zammad/key" keyring="/etc/apt/trusted.gpg.d/zammad.gpg" + +- name: Enable zammad repository + apt_repository: repo="deb https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 12 main" + +- name: Install zammad + apt: name=zammad + register: zammad_install + +- name: Configure zammad for ES + command: zammad run rails r "Setting.set('es_url', 'http://localhost:9200')" + when: zammad_install.changed + +- name: Build search index + command: zammad run rake zammad:searchindex:rebuild + when: zammad_install.changed + +- name: Ensure certificates are available + command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ zammad_domain }}.key -out /etc/nginx/ssl/{{ zammad_domain }}.crt -days 730 -subj "/CN={{ zammad_domain }}" creates=/etc/nginx/ssl/{{ zammad_domain }}.crt + notify: Restart nginx + +- name: Configure certificate manager for zammad + template: src=certs.j2 dest=/etc/acertmgr/{{ zammad_domain }}.conf + notify: Run acertmgr + +- name: Configure vhost + template: src=vhost.j2 dest=/etc/nginx/sites-available/zammad + notify: Restart nginx + +- name: Enable vhost + file: src=/etc/nginx/sites-available/zammad dest=/etc/nginx/sites-enabled/zammad state=link + notify: Restart nginx + +- name: Enable monitoring + include_role: name=icinga-monitor tasks_from=http + vars: + vhost: "{{ zammad_domain }}" diff --git a/roles/zammad/templates/certs.j2 b/roles/zammad/templates/certs.j2 new file mode 100644 index 0000000..13d114b --- /dev/null +++ b/roles/zammad/templates/certs.j2 @@ -0,0 +1,15 @@ +--- + +{{ zammad_domain }}: +- path: /etc/nginx/ssl/{{ zammad_domain }}.key + user: root + group: root + perm: '400' + format: key + action: '/usr/sbin/service nginx restart' +- path: /etc/nginx/ssl/{{ zammad_domain }}.crt + user: root + group: root + perm: '400' + format: crt,ca + action: '/usr/sbin/service nginx restart' diff --git a/roles/zammad/templates/vhost.j2 b/roles/zammad/templates/vhost.j2 new file mode 100644 index 0000000..1179534 --- /dev/null +++ b/roles/zammad/templates/vhost.j2 @@ -0,0 +1,84 @@ +server { + listen 80; + listen [::]:80; + + server_name {{ zammad_domain }}; + + location /.well-known/acme-challenge { + default_type "text/plain"; + alias /var/www/acme-challenge; + } + + return 301 https://$server_name$request_uri; + +} + + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name {{ zammad_domain }}; + + ssl_certificate_key /etc/nginx/ssl/{{ zammad_domain }}.key; + ssl_certificate /etc/nginx/ssl/{{ zammad_domain }}.crt; + + add_header Strict-Transport-Security "max-age=31536000" always; + + location = /robots.txt { + access_log off; log_not_found off; + } + + location = /favicon.ico { + access_log off; log_not_found off; + } + + root /opt/zammad/public; + + client_max_body_size 50M; + + location ~ ^/(assets/|robots.txt|humans.txt|favicon.ico|apple-touch-icon.png) { + expires max; + } + + # legacy web socket server + location /ws { + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_set_header CLIENT_IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 86400; + proxy_pass http://127.0.0.1:6042; + } + + # action cable + location /cable { + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_set_header CLIENT_IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 86400; + proxy_pass http://127.0.0.1:3000; + } + + location / { + proxy_set_header Host $http_host; + proxy_set_header CLIENT_IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + # change this line in an SSO setup + proxy_set_header X-Forwarded-User ""; + + proxy_read_timeout 180; + proxy_pass http://127.0.0.1:3000; + + gzip on; + gzip_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml; + gzip_proxied any; + } +} diff --git a/site.yml b/site.yml index 703c4ca..2867fed 100644 --- a/site.yml +++ b/site.yml @@ -7,7 +7,7 @@ - root_keys - name: Setup unattended updates - hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, palladium.binary-kitchen.net, argentum.binary-kitchen.net, barium.binary-kitchen.net] + hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, aluminium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, palladium.binary-kitchen.net, argentum.binary-kitchen.net, barium.binary-kitchen.net] roles: - uau @@ -124,6 +124,11 @@ roles: - coturn +- name: Setup zammad server + hosts: aluminium.binary-kitchen.net + roles: + - zammad + - name: Setup jitsi server hosts: zirconium.binary-kitchen.net roles: