infra
/
ansible
4
5
Fork 5
Code Issues 6 Pull Requests Activity

Compare commits

base: infra:master
Branches Tags
infra:master
infra:kea
infra:pizza
kishi:master
kishi:mailman3-nginx
kishi:mailman3web
kishi:mailman3
kishi:oldmaster
kishi:mail
..
compare: kishi:master
Branches Tags
kishi:master
kishi:mailman3-nginx
kishi:mailman3web
kishi:mailman3
kishi:oldmaster
kishi:mail
infra:master
infra:kea
infra:pizza

No commits in common. "master" and "master" have entirely different histories.
master ... master

12 changed files with 12 additions and 112 deletions
Show Stats Expand all files Collapse all files

2
host_vars/beryllium.binary-kitchen.net
View File

@ -1,5 +1,5 @@
---
root_keys_host:
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqSDdYNxbI3C5PMtjBHmTukbapSzpXDY0x3aICQkZhl toffy"
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB+wC+Lik9TNbRo40+e2BmJzJY8EuwRiJzKKvGCHlMmagOmZVf+zUmjc1uMvrgoA4UPJyKlkW1HqRhKLmsoccD2wg1JLlnjx6KBhiPGjPt833eWv0CyfJVqoHVPUs14BwCRGzuFZPXh8LC1XWiDlo23RC0RgPpk+wcOzf79ZivYSL4UNMcBIMIKmPlRwBLRUUXjYU2jgv1mWvIQVdKRbwmLk7FajREANKiLj+Tk+D4VmkDq6gUqXZHYbyUauwrtpYSv2JM6YQYhWz+eNXIID1NmlopAf66RwFxAaane6qMUMSCQw3HUBL2BjFGgmmdJPvsEfrj+S1CYh61iC1NHmPhP6DDnQO7aiP6dWLnRXLg4qcUaN0XGNZmhScls/jNbN4U+w6gIlR12KyoCJOK4pXiifBiuqmFGucyETex1jdKoaLPeB8Smu4HkFksmRgTZHbiYVvkgI/iW9KjBBzxCc8cwehabUpQ0DVN4chpFiFNHb3SfCh6W/3IKFcu4ou4lbvVowq+v/M7aDhjSqGEBMS/HRMQ8KteNTngFBcpTzMPBz1RQIOqlWUGp8yqu1SwZ/ZG1nMyUehchfkw/n+ML676UYMCZX2m7hqWXVccCnJLzFApv+0Lzqf3TNSbeLS1N/MDdjg+uejtj1889/leIF1/CnaHIs7WJN1qmdeVGw== anti"
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDMJDyq3veSnK+6hSw+Ml6lvTQTPC6vRFqtDXvPBnOtId8F9+/N0ADcPa5UTesnTkQgSAY7WpSoN5D6clYzdcPR55e5WZwZfMSkX14D7v7mrGxUcE4HshTorfEYv5XBd11Tvu0ruMdxlFQ+VFHkZIF305xgyx32INA3zUfnhzHJlKEdIAy8iSbERUV+X5kB59aep6xSpitCHJtsTT5Ky+EsvAhndKB5hDBuwVVr0+Sg5PypeTQ4zzWFyR6DFBEvyEj6bs/pQff9WxSRIXEuLffXOXdRLGHWqX7PfhWcH9WNH55WT7ZKCMGVuG4kYLkZ633c296ISg9q0eNKn99oHuwvzVg/wV3wndHINE+iUKKJjaRUpDUwd9DftFqMbFGATpf8en6KPs/7bgZUGACIfDO6Uy59V75cntiMFZc+BnnpV2qLVBFFD5ClRBCRdqH5D0px+jpuQFo9EUhggL4jzlj9wQf26zv0E4zSGTqbM1jfO3zcXlxSjg3H3Og2GAO5fCQiodpsqkW9Hby/p4s5l+P97tlVlgapnZlSA/1em4lmYshmRk/9scN8PMSXfW9uhncv9qXqp0ypEqEuNfj5u/1Eu8zmayIA9V23xyPn92LMT6MP2BB1kC7jeAXfXHdKBhTYW6bLQJKMs9nypH6RODK1fb9JlIrB61ZDJ9L5K++o2Q== noby"

2
roles/act_runner/defaults/main.yml
View File

@ -3,5 +3,5 @@
actrunner_user: act_runner
actrunner_group: act_runner
actrunner_version: 0.2.10
actrunner_version: 0.2.6
actrunner_url: https://gitea.com/gitea/act_runner/releases/download/v{{ actrunner_version }}/act_runner-{{ actrunner_version }}-linux-amd64

4
roles/authentik/templates/docker-compose.yml.j2
View File

@ -29,7 +29,7 @@ services:
volumes:
- ./redis:/data
server:
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2}
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.10.7}
restart: unless-stopped
command: server
environment:
@ -48,7 +48,7 @@ services:
- postgresql
- redis
worker:
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2}
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.10.7}
restart: unless-stopped
command: worker
environment:

4
roles/dns_intern/templates/bind/23.172.in-addr.arpa.zone.j2
View File

@ -1,7 +1,7 @@
$ORIGIN 23.172.in-addr.arpa. ; base for unqualified names
$TTL 1h ; default time-to-live
@ IN SOA ns1.binary.kitchen. hostmaster.binary.kitchen. (
2024051300; serial
2024030100; serial
1d; refresh
2h; retry
4w; expire
@ -11,7 +11,7 @@ $TTL 1h ; default time-to-live
IN NS ns2.binary.kitchen.
; Loopback
1.0 IN PTR core.binary.kitchen.
2.0 IN PTR rt-w13b.binary.kitchen.
2.0 IN PTR erx-bk.binary.kitchen.
3.0 IN PTR erx-rz.binary.kitchen.
4.0 IN PTR erx-auweg.binary.kitchen.
; Management

4
roles/dns_intern/templates/bind/binary.kitchen.zone.j2
View File

@ -1,7 +1,7 @@
$ORIGIN binary.kitchen ; base for unqualified names
$TTL 1h ; default time-to-live
@ IN SOA ns1.binary.kitchen. hostmaster.binary.kitchen. (
2024051300; serial
2024030100; serial
1d; refresh
2h; retry
4w; expire
@ -34,7 +34,7 @@ radius IN A 172.23.2.3
radius IN A 172.23.2.4
; Loopback
core IN A 172.23.0.1
rt-w13b IN A 172.23.0.2
erx-bk IN A 172.23.0.2
erx-rz IN A 172.23.0.3
erx-auweg IN A 172.23.0.4
; Management

2
roles/gitea/defaults/main.yml
View File

@ -3,5 +3,5 @@
gitea_user: gogs
gitea_group: gogs
gitea_version: 1.21.11
gitea_version: 1.21.10
gitea_url: https://github.com/go-gitea/gitea/releases/download/v{{ gitea_version }}/gitea-{{ gitea_version }}-linux-amd64

2
roles/mail/files/rspamd/local.d/phishing.conf
View File

@ -1,2 +0,0 @@
openphish_enabled = true;
phishtank_enabled = false;

2
roles/netbox/defaults/main.yml
View File

@ -2,4 +2,4 @@
netbox_group: netbox
netbox_user: netbox
netbox_version: 3.7.8
netbox_version: 3.7.4

14
roles/web/files/certs
View File

@ -14,20 +14,6 @@ www.binary-kitchen.de binary-kitchen.de www.binary.kitchen binary.kitchen:
format: key
action: '/usr/sbin/service nginx restart'
autoconfig.binary-kitchen.de:
- path: /etc/nginx/ssl/autoconfig.binary-kitchen.de.crt
user: root
group: root
perm: '400'
format: crt,ca
action: '/usr/sbin/service nginx restart'
- path: /etc/nginx/ssl/autoconfig.binary-kitchen.de.key
user: root
group: root
perm: '400'
format: key
action: '/usr/sbin/service nginx restart'
www.ccc-r.de:
- path: /etc/nginx/ssl/www.ccc-r.de.crt
user: root

30
roles/web/files/vhost
View File

@ -85,36 +85,6 @@ server {
}
}
server {
listen 80;
listen [::]:80;
server_name autoconfig.binary-kitchen.de;
location /.well-known/acme-challenge {
default_type "text/plain";
alias /var/www/acme-challenge;
}
location / {
return 301 https://autoconfig.binary-kitchen.de$request_uri;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name autoconfig.binary-kitchen.de;
ssl_certificate_key /etc/nginx/ssl/autoconfig.binary-kitchen.de.key;
ssl_certificate /etc/nginx/ssl/autoconfig.binary-kitchen.de.crt;
root /var/www/autconfig;
default_type text/html;
}
server {
listen 80;
listen [::]:80;

17
roles/web/tasks/main.yml
View File

@ -8,23 +8,13 @@
- php-sqlite3
- php-xml
- name: Create vhost directories
file: path=/var/www/{{ item }} state=directory owner=www-data group=www-data
with_items:
- autoconfig
- autoconfig/mail
- ccc-r
- makerspace-regensburg
- kitchen
- name: Create vhost directory
file: path=/var/www/kitchen state=directory owner=www-data group=www-data
- name: Ensure (BK) certificates are available
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/www.binary-kitchen.de.key -out /etc/nginx/ssl/www.binary-kitchen.de.crt -days 730 -subj "/CN=www.binary-kitchen.de" creates=/etc/nginx/ssl/www.binary-kitchen.de.crt
notify: Restart nginx
- name: Ensure (BK autodiscover) certificates are available
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/autoconfig.binary-kitchen.de.key -out /etc/nginx/ssl/autoconfig.binary-kitchen.de.crt -days 730 -subj "/CN=autoconfig.binary-kitchen.de" creates=/etc/nginx/ssl/autoconfig.binary-kitchen.de.crt
notify: Restart nginx
- name: Ensure (CCC-R) certificates are available
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/www.ccc-r.de.key -out /etc/nginx/ssl/www.ccc-r.de.crt -days 730 -subj "/CN=www.ccc-r.de" creates=/etc/nginx/ssl/www.ccc-r.de.crt
notify: Restart nginx
@ -33,9 +23,6 @@
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/www.makerspace-regensburg.de.key -out /etc/nginx/ssl/www.makerspace-regensburg.de.crt -days 730 -subj "/CN=www.makerspace-regensburg.de" creates=/etc/nginx/ssl/www.makerspace-regensburg.de.crt
notify: Restart nginx
- name: Place Thunderbird autoconfig file
template: src=auto_mail.xml.j2 dest=/var/www/autoconfig/mail/config-v1.1.xml
- name: Configure certificate manager
copy: src=certs dest=/etc/acertmgr/www.binary-kitchen.de.conf
notify: Run acertmgr

41
roles/web/templates/auto_mail.xml.j2
View File

@ -1,41 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<clientConfig version="1.1">
<emailProvider id="binary-kitchen.de">
<domain>{{ mail_domain }}</domain>
<displayName>Binary Kitchen</displayName>
<displayShortName>Binary Kitchen</displayShortName>
<incomingServer type="imap">
<hostname>{{ mail_server }}</hostname>
<port>993</port>
<socketType>SSL</socketType>
<authentication>password-encrypted</authentication>
<username>%EMAILLOCALPART%</username>
</incomingServer>
<incomingServer type="imap">
<hostname>{{ mail_server }}</hostname>
<port>143</port>
<socketType>STARTTLS</socketType>
<authentication>password-encrypted</authentication>
<username>%EMAILLOCALPART%</username>
</incomingServer>
<outgoingServer type="smtp">
<hostname>{{ mail_server }}</hostname>
<port>465</port>
<socketType>SSL</socketType>
<authentication>password-encrypted</authentication>
<username>%EMAILLOCALPART%</username>
</outgoingServer>
<outgoingServer type="smtp">
<hostname>{{ mail_server }}</hostname>
<port>587</port>
<socketType>STARTTLS</socketType>
<authentication>password-encrypted</authentication>
<username>%EMAILLOCALPART%</username>
</outgoingServer>
<documentation url="https://www.binary-kitchen.de/wiki/infra:start#e-mail">
<descr lang="de">Beschreibung der Einstellungen</descr>
<descr lang="en">Generic settings description</descr>
</documentation>
</emailProvider>
</clientConfig>