zammad: new role

This commit is contained in:
Markus 2024-01-08 20:08:25 +01:00
parent 83d6c87415
commit b2b7045f61
8 changed files with 177 additions and 2 deletions

View File

@ -126,7 +126,6 @@ mail_aliases:
- "workshops@binary-kitchen.de timo.schindler@binary-kitchen.de,venti@binary-kitchen.de" - "workshops@binary-kitchen.de timo.schindler@binary-kitchen.de,venti@binary-kitchen.de"
- "himmel@eh21.easterhegg.eu christoph@binary-kitchen.de,pheerai@binary-kitchen.de,shortkath@binary-kitchen.de" - "himmel@eh21.easterhegg.eu christoph@binary-kitchen.de,pheerai@binary-kitchen.de,shortkath@binary-kitchen.de"
- "tickets@eh21.easterhegg.eu orga@eh21.easterhegg.eu" - "tickets@eh21.easterhegg.eu orga@eh21.easterhegg.eu"
- "noc@eh21.easterhegg.eu moepman@binary-kitchen.de"
matrix_domain: matrix.binary-kitchen.de matrix_domain: matrix.binary-kitchen.de
matrix_dbname: matrix matrix_dbname: matrix
@ -196,3 +195,5 @@ vaultwarden_token: "{{ vault_vaultwarden_token }}"
vaultwarden_yubico_secret: "{{ vault_vaultwarden_yubico_secret }}" vaultwarden_yubico_secret: "{{ vault_vaultwarden_yubico_secret }}"
workadventure_domain: wa.binary-kitchen.de workadventure_domain: wa.binary-kitchen.de
zammad_domain: requests.binary-kitchen.de

1
hosts
View File

@ -29,6 +29,7 @@ fluorine.binary-kitchen.net
neon.binary-kitchen.net neon.binary-kitchen.net
sodium.binary-kitchen.net sodium.binary-kitchen.net
magnesium.binary-kitchen.net magnesium.binary-kitchen.net
aluminium.binary-kitchen.net
krypton.binary-kitchen.net krypton.binary-kitchen.net
yttrium.binary-kitchen.net yttrium.binary-kitchen.net
zirconium.binary-kitchen.net zirconium.binary-kitchen.net

View File

@ -0,0 +1,7 @@
---
- name: Restart nginx
service: name=nginx state=restarted
- name: Run acertmgr
command: /usr/bin/acertmgr

View File

@ -0,0 +1,5 @@
---
dependencies:
- { role: acertmgr }
- { role: nginx, nginx_ssl: True }

View File

@ -0,0 +1,57 @@
---
- name: Enable elasic apt-key
apt_key: url="https://artifacts.elastic.co/GPG-KEY-elasticsearch" keyring="/etc/apt/trusted.gpg.d/elastic.gpg"
- name: Enable elastic repository
apt_repository: repo="deb https://artifacts.elastic.co/packages/7.x/apt stable main"
- name: Install elasticsearch
apt: name=elasticsearch
register: elasticsearch_install
- name: Install attachment plugin
command: /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-attachment --batch
when: elasticsearch_install.changed
- name: Start the elasticsearch service
service: name=elasticsearch state=started enabled=yes
- name: Enable zammad apt-key
apt_key: url="https://dl.packager.io/srv/zammad/zammad/key" keyring="/etc/apt/trusted.gpg.d/zammad.gpg"
- name: Enable zammad repository
apt_repository: repo="deb https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 12 main"
- name: Install zammad
apt: name=zammad
register: zammad_install
- name: Configure zammad for ES
command: zammad run rails r "Setting.set('es_url', 'http://localhost:9200')"
when: zammad_install.changed
- name: Build search index
command: zammad run rake zammad:searchindex:rebuild
when: zammad_install.changed
- name: Ensure certificates are available
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ zammad_domain }}.key -out /etc/nginx/ssl/{{ zammad_domain }}.crt -days 730 -subj "/CN={{ zammad_domain }}" creates=/etc/nginx/ssl/{{ zammad_domain }}.crt
notify: Restart nginx
- name: Configure certificate manager for zammad
template: src=certs.j2 dest=/etc/acertmgr/{{ zammad_domain }}.conf
notify: Run acertmgr
- name: Configure vhost
template: src=vhost.j2 dest=/etc/nginx/sites-available/zammad
notify: Restart nginx
- name: Enable vhost
file: src=/etc/nginx/sites-available/zammad dest=/etc/nginx/sites-enabled/zammad state=link
notify: Restart nginx
- name: Enable monitoring
include_role: name=icinga-monitor tasks_from=http
vars:
vhost: "{{ zammad_domain }}"

View File

@ -0,0 +1,15 @@
---
{{ zammad_domain }}:
- path: /etc/nginx/ssl/{{ zammad_domain }}.key
user: root
group: root
perm: '400'
format: key
action: '/usr/sbin/service nginx restart'
- path: /etc/nginx/ssl/{{ zammad_domain }}.crt
user: root
group: root
perm: '400'
format: crt,ca
action: '/usr/sbin/service nginx restart'

View File

@ -0,0 +1,84 @@
server {
listen 80;
listen [::]:80;
server_name {{ zammad_domain }};
location /.well-known/acme-challenge {
default_type "text/plain";
alias /var/www/acme-challenge;
}
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {{ zammad_domain }};
ssl_certificate_key /etc/nginx/ssl/{{ zammad_domain }}.key;
ssl_certificate /etc/nginx/ssl/{{ zammad_domain }}.crt;
add_header Strict-Transport-Security "max-age=31536000" always;
location = /robots.txt {
access_log off; log_not_found off;
}
location = /favicon.ico {
access_log off; log_not_found off;
}
root /opt/zammad/public;
client_max_body_size 50M;
location ~ ^/(assets/|robots.txt|humans.txt|favicon.ico|apple-touch-icon.png) {
expires max;
}
# legacy web socket server
location /ws {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header CLIENT_IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 86400;
proxy_pass http://127.0.0.1:6042;
}
# action cable
location /cable {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header CLIENT_IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 86400;
proxy_pass http://127.0.0.1:3000;
}
location / {
proxy_set_header Host $http_host;
proxy_set_header CLIENT_IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# change this line in an SSO setup
proxy_set_header X-Forwarded-User "";
proxy_read_timeout 180;
proxy_pass http://127.0.0.1:3000;
gzip on;
gzip_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml;
gzip_proxied any;
}
}

View File

@ -7,7 +7,7 @@
- root_keys - root_keys
- name: Setup unattended updates - name: Setup unattended updates
hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, palladium.binary-kitchen.net, argentum.binary-kitchen.net, barium.binary-kitchen.net] hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, aluminium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, palladium.binary-kitchen.net, argentum.binary-kitchen.net, barium.binary-kitchen.net]
roles: roles:
- uau - uau
@ -124,6 +124,11 @@
roles: roles:
- coturn - coturn
- name: Setup zammad server
hosts: aluminium.binary-kitchen.net
roles:
- zammad
- name: Setup jitsi server - name: Setup jitsi server
hosts: zirconium.binary-kitchen.net hosts: zirconium.binary-kitchen.net
roles: roles: