zammad: new role
This commit is contained in:
parent
83d6c87415
commit
b2b7045f61
@ -126,7 +126,6 @@ mail_aliases:
|
|||||||
- "workshops@binary-kitchen.de timo.schindler@binary-kitchen.de,venti@binary-kitchen.de"
|
- "workshops@binary-kitchen.de timo.schindler@binary-kitchen.de,venti@binary-kitchen.de"
|
||||||
- "himmel@eh21.easterhegg.eu christoph@binary-kitchen.de,pheerai@binary-kitchen.de,shortkath@binary-kitchen.de"
|
- "himmel@eh21.easterhegg.eu christoph@binary-kitchen.de,pheerai@binary-kitchen.de,shortkath@binary-kitchen.de"
|
||||||
- "tickets@eh21.easterhegg.eu orga@eh21.easterhegg.eu"
|
- "tickets@eh21.easterhegg.eu orga@eh21.easterhegg.eu"
|
||||||
- "noc@eh21.easterhegg.eu moepman@binary-kitchen.de"
|
|
||||||
|
|
||||||
matrix_domain: matrix.binary-kitchen.de
|
matrix_domain: matrix.binary-kitchen.de
|
||||||
matrix_dbname: matrix
|
matrix_dbname: matrix
|
||||||
@ -196,3 +195,5 @@ vaultwarden_token: "{{ vault_vaultwarden_token }}"
|
|||||||
vaultwarden_yubico_secret: "{{ vault_vaultwarden_yubico_secret }}"
|
vaultwarden_yubico_secret: "{{ vault_vaultwarden_yubico_secret }}"
|
||||||
|
|
||||||
workadventure_domain: wa.binary-kitchen.de
|
workadventure_domain: wa.binary-kitchen.de
|
||||||
|
|
||||||
|
zammad_domain: requests.binary-kitchen.de
|
||||||
|
1
hosts
1
hosts
@ -29,6 +29,7 @@ fluorine.binary-kitchen.net
|
|||||||
neon.binary-kitchen.net
|
neon.binary-kitchen.net
|
||||||
sodium.binary-kitchen.net
|
sodium.binary-kitchen.net
|
||||||
magnesium.binary-kitchen.net
|
magnesium.binary-kitchen.net
|
||||||
|
aluminium.binary-kitchen.net
|
||||||
krypton.binary-kitchen.net
|
krypton.binary-kitchen.net
|
||||||
yttrium.binary-kitchen.net
|
yttrium.binary-kitchen.net
|
||||||
zirconium.binary-kitchen.net
|
zirconium.binary-kitchen.net
|
||||||
|
7
roles/zammad/handlers/main.yml
Normal file
7
roles/zammad/handlers/main.yml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- name: Restart nginx
|
||||||
|
service: name=nginx state=restarted
|
||||||
|
|
||||||
|
- name: Run acertmgr
|
||||||
|
command: /usr/bin/acertmgr
|
5
roles/zammad/meta/main.yml
Normal file
5
roles/zammad/meta/main.yml
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
dependencies:
|
||||||
|
- { role: acertmgr }
|
||||||
|
- { role: nginx, nginx_ssl: True }
|
57
roles/zammad/tasks/main.yml
Normal file
57
roles/zammad/tasks/main.yml
Normal file
@ -0,0 +1,57 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- name: Enable elasic apt-key
|
||||||
|
apt_key: url="https://artifacts.elastic.co/GPG-KEY-elasticsearch" keyring="/etc/apt/trusted.gpg.d/elastic.gpg"
|
||||||
|
|
||||||
|
- name: Enable elastic repository
|
||||||
|
apt_repository: repo="deb https://artifacts.elastic.co/packages/7.x/apt stable main"
|
||||||
|
|
||||||
|
- name: Install elasticsearch
|
||||||
|
apt: name=elasticsearch
|
||||||
|
register: elasticsearch_install
|
||||||
|
|
||||||
|
- name: Install attachment plugin
|
||||||
|
command: /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-attachment --batch
|
||||||
|
when: elasticsearch_install.changed
|
||||||
|
|
||||||
|
- name: Start the elasticsearch service
|
||||||
|
service: name=elasticsearch state=started enabled=yes
|
||||||
|
|
||||||
|
- name: Enable zammad apt-key
|
||||||
|
apt_key: url="https://dl.packager.io/srv/zammad/zammad/key" keyring="/etc/apt/trusted.gpg.d/zammad.gpg"
|
||||||
|
|
||||||
|
- name: Enable zammad repository
|
||||||
|
apt_repository: repo="deb https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 12 main"
|
||||||
|
|
||||||
|
- name: Install zammad
|
||||||
|
apt: name=zammad
|
||||||
|
register: zammad_install
|
||||||
|
|
||||||
|
- name: Configure zammad for ES
|
||||||
|
command: zammad run rails r "Setting.set('es_url', 'http://localhost:9200')"
|
||||||
|
when: zammad_install.changed
|
||||||
|
|
||||||
|
- name: Build search index
|
||||||
|
command: zammad run rake zammad:searchindex:rebuild
|
||||||
|
when: zammad_install.changed
|
||||||
|
|
||||||
|
- name: Ensure certificates are available
|
||||||
|
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ zammad_domain }}.key -out /etc/nginx/ssl/{{ zammad_domain }}.crt -days 730 -subj "/CN={{ zammad_domain }}" creates=/etc/nginx/ssl/{{ zammad_domain }}.crt
|
||||||
|
notify: Restart nginx
|
||||||
|
|
||||||
|
- name: Configure certificate manager for zammad
|
||||||
|
template: src=certs.j2 dest=/etc/acertmgr/{{ zammad_domain }}.conf
|
||||||
|
notify: Run acertmgr
|
||||||
|
|
||||||
|
- name: Configure vhost
|
||||||
|
template: src=vhost.j2 dest=/etc/nginx/sites-available/zammad
|
||||||
|
notify: Restart nginx
|
||||||
|
|
||||||
|
- name: Enable vhost
|
||||||
|
file: src=/etc/nginx/sites-available/zammad dest=/etc/nginx/sites-enabled/zammad state=link
|
||||||
|
notify: Restart nginx
|
||||||
|
|
||||||
|
- name: Enable monitoring
|
||||||
|
include_role: name=icinga-monitor tasks_from=http
|
||||||
|
vars:
|
||||||
|
vhost: "{{ zammad_domain }}"
|
15
roles/zammad/templates/certs.j2
Normal file
15
roles/zammad/templates/certs.j2
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
{{ zammad_domain }}:
|
||||||
|
- path: /etc/nginx/ssl/{{ zammad_domain }}.key
|
||||||
|
user: root
|
||||||
|
group: root
|
||||||
|
perm: '400'
|
||||||
|
format: key
|
||||||
|
action: '/usr/sbin/service nginx restart'
|
||||||
|
- path: /etc/nginx/ssl/{{ zammad_domain }}.crt
|
||||||
|
user: root
|
||||||
|
group: root
|
||||||
|
perm: '400'
|
||||||
|
format: crt,ca
|
||||||
|
action: '/usr/sbin/service nginx restart'
|
84
roles/zammad/templates/vhost.j2
Normal file
84
roles/zammad/templates/vhost.j2
Normal file
@ -0,0 +1,84 @@
|
|||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
listen [::]:80;
|
||||||
|
|
||||||
|
server_name {{ zammad_domain }};
|
||||||
|
|
||||||
|
location /.well-known/acme-challenge {
|
||||||
|
default_type "text/plain";
|
||||||
|
alias /var/www/acme-challenge;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 301 https://$server_name$request_uri;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
listen [::]:443 ssl http2;
|
||||||
|
|
||||||
|
server_name {{ zammad_domain }};
|
||||||
|
|
||||||
|
ssl_certificate_key /etc/nginx/ssl/{{ zammad_domain }}.key;
|
||||||
|
ssl_certificate /etc/nginx/ssl/{{ zammad_domain }}.crt;
|
||||||
|
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000" always;
|
||||||
|
|
||||||
|
location = /robots.txt {
|
||||||
|
access_log off; log_not_found off;
|
||||||
|
}
|
||||||
|
|
||||||
|
location = /favicon.ico {
|
||||||
|
access_log off; log_not_found off;
|
||||||
|
}
|
||||||
|
|
||||||
|
root /opt/zammad/public;
|
||||||
|
|
||||||
|
client_max_body_size 50M;
|
||||||
|
|
||||||
|
location ~ ^/(assets/|robots.txt|humans.txt|favicon.ico|apple-touch-icon.png) {
|
||||||
|
expires max;
|
||||||
|
}
|
||||||
|
|
||||||
|
# legacy web socket server
|
||||||
|
location /ws {
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "Upgrade";
|
||||||
|
proxy_set_header CLIENT_IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_read_timeout 86400;
|
||||||
|
proxy_pass http://127.0.0.1:6042;
|
||||||
|
}
|
||||||
|
|
||||||
|
# action cable
|
||||||
|
location /cable {
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "Upgrade";
|
||||||
|
proxy_set_header CLIENT_IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_read_timeout 86400;
|
||||||
|
proxy_pass http://127.0.0.1:3000;
|
||||||
|
}
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_set_header Host $http_host;
|
||||||
|
proxy_set_header CLIENT_IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
|
||||||
|
# change this line in an SSO setup
|
||||||
|
proxy_set_header X-Forwarded-User "";
|
||||||
|
|
||||||
|
proxy_read_timeout 180;
|
||||||
|
proxy_pass http://127.0.0.1:3000;
|
||||||
|
|
||||||
|
gzip on;
|
||||||
|
gzip_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml;
|
||||||
|
gzip_proxied any;
|
||||||
|
}
|
||||||
|
}
|
7
site.yml
7
site.yml
@ -7,7 +7,7 @@
|
|||||||
- root_keys
|
- root_keys
|
||||||
|
|
||||||
- name: Setup unattended updates
|
- name: Setup unattended updates
|
||||||
hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, palladium.binary-kitchen.net, argentum.binary-kitchen.net, barium.binary-kitchen.net]
|
hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, aluminium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, palladium.binary-kitchen.net, argentum.binary-kitchen.net, barium.binary-kitchen.net]
|
||||||
roles:
|
roles:
|
||||||
- uau
|
- uau
|
||||||
|
|
||||||
@ -124,6 +124,11 @@
|
|||||||
roles:
|
roles:
|
||||||
- coturn
|
- coturn
|
||||||
|
|
||||||
|
- name: Setup zammad server
|
||||||
|
hosts: aluminium.binary-kitchen.net
|
||||||
|
roles:
|
||||||
|
- zammad
|
||||||
|
|
||||||
- name: Setup jitsi server
|
- name: Setup jitsi server
|
||||||
hosts: zirconium.binary-kitchen.net
|
hosts: zirconium.binary-kitchen.net
|
||||||
roles:
|
roles:
|
||||||
|
Loading…
Reference in New Issue
Block a user