drpuur/mini-beieli-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
jlehmann
2021-04-09 19:57:32 +02:00
commit fecc1d77d4
25 changed files with 637 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/aide/files/aide-update
+4
View File
@@ -0,0 +1,4 @@
#!/bin/bash
/usr/sbin/aide -c /etc/aide.conf --init
/bin/cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
ansible/roles/aide/files/aide.conf.local
+1
View File
@@ -0,0 +1 @@
!/root/.ansible/tmp
ansible/roles/aide/handlers/main.yml
+3
View File
@@ -0,0 +1,3 @@
---
- name: update aide database
action: command /usr/local/bin/aide-update
ansible/roles/aide/tasks/main.yml
+42
View File
@@ -0,0 +1,42 @@
---
- name: Install aide
yum:
name: aide
- name: Remove all the current ignore list in aide.conf
lineinfile:
dest: /etc/aide.conf
backup: yes
regexp: "^#!|!/"
state: absent
- name: change up aide.conf to standards set in aide_ignore_list var
lineinfile:
dest: /etc/aide.conf
line: "@@include /etc/aide.conf.local"
insertafter: EOF
state: present
- name: copy aide.conf.local
copy:
src: aide.conf.local
dest: /etc/aide.conf.local
mode: '0600'
- name: copy aide-update script
copy:
src: aide-update
dest: /usr/local/bin/aide-update
mode: '0755'
- name: Add crontab to check aide nightly
cron:
cron_file: aide_check
user: root
name: "Check Aide DB nightly"
hour: "23"
minute: "45"
job: "/usr/sbin/aide --check"
notify:
- update aide database
ansible/roles/common/files/jail.local
+2
View File
@@ -0,0 +1,2 @@
[sshd]
enabled = true
ansible/roles/common/handlers/main.yml
+30
View File
@@ -0,0 +1,30 @@
---
- name: Restart ssh
service:
name=sshd
state=restarted
- name: Restart zabbix-agent
service:
name=zabbix-agent
state=restarted
- name: Restart postfix
service:
name=postfix
state=restarted
- name: Restart fail2ban
service:
name=fail2ban
state=restarted
- name: reload firewalld
systemd:
name=firewalld
state=reloaded
- name: Restore selinux context
command: restorecon -irv /home/beieli/mini-beieli-web
ansible/roles/common/tasks/main.yml
+172
View File
@@ -0,0 +1,172 @@
---
- name: install basic packages
yum:
name: "{{ packages }}"
vars:
packages:
- langpacks-en
- langpacks-de
- glibc-all-langpacks
- podman
- sysstat
- mailx
- bind-utils
- epel-release
- setroubleshoot-server
- socat
- unzip
- wget
- git
- bzip2
- name: Enable SELinux
selinux:
policy: targeted
state: enforcing
- name: disable kdump
systemd:
name: kdump
enabled: no
- name: Add Group beieli
group:
name: beieli
gid: 1000
state: present
- name: Add User beieli
user:
name: beieli
shell: /bin/bash
uid: 1000
group: beieli
- name: Change permission of /home/beieli
file:
path: /home/beieli
state: directory
owner: beieli
group: beieli
mode: '0755'
- name: Create /home/beieli/mini-beieli-web
file:
path: /home/beieli/mini-beieli-web
state: directory
owner: beieli
group: beieli
mode: '0755'
- name: Allow apache to read files in /home/beieli/mini-beieli-web
sefcontext:
target: '/home/beieli/mini-beieli-web(/.*)?'
setype: httpd_sys_content_t
state: present
notify:
- Restore selinux context
- name: allow root SSH with key only
lineinfile: dest=/etc/ssh/sshd_config
regexp="^PermitRootLogin"
line="PermitRootLogin without-password"
state=present
notify: Restart ssh
- name: create /etc/hosts from template
template:
src: hosts.j2
dest: /etc/hosts
owner: root
group: root
backup: yes
mode: '0644'
- name: install zabbix agent
yum:
name: zabbix40-agent
- name: enable zabbix agent
systemd:
name: zabbix-agent
enabled: yes
- name: zabbix config
lineinfile: dest=/etc/zabbix/zabbix_agentd.conf
regexp="^Server="
line="Server={{ zabbix_server_ip }}"
state=present
notify: Restart zabbix-agent
- name: install postfix
yum:
name: postfix
- name: enable postfix
systemd:
name: postfix
enabled: yes
- name: postfix config
lineinfile: dest=/etc/postfix/main.cf
regexp="^relayhost"
line="relayhost = [{{ mailserver }}]:25"
state=present
notify: Restart postfix
- name: postfix config
lineinfile: dest=/etc/postfix/main.cf
regexp="^myhostname"
line="myhostname = {{ ansible_hostname }}.{{ my_domain }}"
state=present
notify: Restart postfix
- name: create .forward file
copy:
dest: "/root/.forward"
content: "{{ mail_forward_address }}\n"
- name: install fail2ban
yum:
name: fail2ban
- name: enable fail2ban
systemd:
name: fail2ban
enabled: yes
- name: copy fail2ban config
copy:
src: jail.local
dest: /etc/fail2ban/jail.local
mode: '0644'
notify: Restart fail2ban
- name: setup firewalld rules - services
firewalld:
service: "{{ item }}"
permanent: yes
state: enabled
loop:
- ssh
- http
- https
notify: reload firewalld
- name: setup firewalld rules - remove services
firewalld:
service: "{{ item }}"
permanent: yes
state: disabled
loop:
- cockpit
notify: reload firewalld
- name: setup firewalld rules - ports
firewalld:
port: "{{ item }}"
permanent: yes
state: enabled
loop:
- 10050/tcp
notify: reload firewalld
ansible/roles/common/templates/hosts.j2
+16
View File
@@ -0,0 +1,16 @@
# Your system has configured 'manage_etc_hosts' as True.
# As a result, if you wish for changes to this file to persist
# then you will need to either
# a.) make changes to the master file in /etc/cloud/templates/hosts.redhat.tmpl
# b.) change or remove the value of 'manage_etc_hosts' in
# /etc/cloud/cloud.cfg or cloud-config from user-data
#
# The following lines are desirable for IPv4 capable hosts
{{ ansible_default_ipv4.address }} {{ ansible_hostname }}.{{ my_domain }} {{ ansible_hostname }}
127.0.0.1 localhost.localdomain localhost
127.0.0.1 localhost4.localdomain4 localhost4
# The following lines are desirable for IPv6 capable hosts
{{ ansible_default_ipv6.address }} {{ ansible_hostname }}.{{ my_domain }} {{ ansible_hostname }}
::1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
ansible/roles/influxsw/handlers/main.yml
+5
View File
@@ -0,0 +1,5 @@
---
- name: Restart telegraf
service:
name=telegraf
state=restarted
ansible/roles/influxsw/tasks/main.yml
+33
View File
@@ -0,0 +1,33 @@
---
- name: Add repository
yum_repository:
name: influxrepo
description: InfluxDB Repository - RHEL
baseurl: https://repos.influxdata.com/rhel/8/x86_64/stable/
gpgkey: https://repos.influxdata.com/influxdb.key
gpgcheck: yes
- name: Install influx packages
yum:
name: "{{ item }}"
loop:
- telegraf
- influxdb2
- name: enable telegraf
systemd:
name: telegraf
enabled: yes
- name: enable influxdb
systemd:
name: influxdb
enabled: yes
state: started
- name: create telegraf config from template
template:
src: telegraf.conf.j2
dest: /etc/telegraf/telegraf.conf
mode: '0644'
notify: Restart telegraf
ansible/roles/influxsw/templates/telegraf.conf.j2
+31
View File
@@ -0,0 +1,31 @@
[global_tags]
# Configuration for telegraf agent
[agent]
interval = "10s"
round_interval = true
metric_batch_size = 1000
metric_buffer_limit = 100000
collection_jitter = "0s"
flush_interval = "10s"
flush_jitter = "0s"
precision = ""
debug = false
quiet = false
logfile = ""
hostname = ""
omit_hostname = false
[[inputs.tail]]
files = ["/home/beieli/mini-beieli-lorahandler/mini-beieli-lorahandler.log"]
from_beginning = false
pipe = false
tagexclude = ["path","host"]
data_format = "influx"
# Configuration for sending metrics to InfluxDB 2.0
[[outputs.influxdb_v2]]
urls = ["http://127.0.0.1:8086"]
token = "{{ influx_token }}"
organization = "minibeieliorg"
bucket = "minibeielibucket"
ansible/roles/mini-beieli-lorahandler/handlers/main.yml
+3
View File
@@ -0,0 +1,3 @@
---
- name: Restore selinux context
command: restorecon -irv /home/beieli
ansible/roles/mini-beieli-lorahandler/tasks/main.yml
+15
View File
@@ -0,0 +1,15 @@
---
- name: Allow apache to read files in /home/beieli/mini-beieli-web
sefcontext:
target: '/home/beieli/mini-beieli-web(/.*)?'
setype: httpd_sys_content_t
state: present
notify:
- Restore selinux context
- name: set SELinux permissions on binary
sefcontext:
target: "/home/beieli/mini-beieli-lorahandler/mini-beieli-lorahandler"
setype: bin_t
notify:
- Restore selinux context
ansible/roles/mini-beieli-web/handlers/main.yml
+3
View File
@@ -0,0 +1,3 @@
---
- name: Restore selinux context
command: restorecon -irv /home/beieli
ansible/roles/mini-beieli-web/tasks/main.yml
+7
View File
@@ -0,0 +1,7 @@
---
- name: set SELinux permissions on binary
sefcontext:
target: "/home/beieli/mini-beieli-web/mini-beieli-web"
setype: bin_t
notify:
- Restore selinux context
ansible/roles/nginx/handlers/main.yml
+5
View File
@@ -0,0 +1,5 @@
---
- name: Restart nginx
service:
name=nginx
state=restarted
ansible/roles/nginx/tasks/main.yml
+27
View File
@@ -0,0 +1,27 @@
---
- name: Install nginx
yum:
name: nginx
- name: enable nginx
systemd:
name: nginx
enabled: yes
state: started
- name: create /etc/nginx/nginx.conf from template
template:
src: nginx.conf.j2
dest: /etc/nginx/nginx.conf
owner: root
group: root
mode: '0644'
notify: Restart nginx
- name: Allow apache to read files in /etc/letsencrypt/{{ letsEncryptDomain }}
sefcontext:
target: '/etc/letsencrypt/{{ letsEncryptDomain }}(/.*)?'
setype: httpd_sys_content_t
state: present
notify:
- Restore selinux context
ansible/roles/nginx/templates/nginx.conf.j2
+74
View File
@@ -0,0 +1,74 @@
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# GZip Settings
gzip on;
gzip_vary on;
gzip_min_length 10240;
gzip_proxied expired no-cache no-store private auth;
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml application/javascript;
gzip_disable "MSIE [1-6]\.";
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 301 https://{{ letsEncryptDomain }}$request_uri;
}
server {
server_name mini-beieli.ch;
root {{ document_root }}/static;
error_page 502 /502.html;
location /lorahandler {
proxy_pass http://127.0.0.1:8080;
}
location /static {
autoindex off;
root {{ document_root }}/;
expires 30d;
}
location / { try_files $uri @mini-beieli; }
location @mini-beieli {
proxy_pass http://127.0.0.1:4000;
}
listen [::]:443 ssl ipv6only=on;
listen 443 ssl;
ssl_certificate /etc/letsencrypt/{{ letsEncryptDomain }}/fullchain.cer;
ssl_certificate_key /etc/letsencrypt/{{ letsEncryptDomain }}/{{ letsEncryptDomain }}.key;
}
}
ansible/roles/nginx/templates/vhost.j2
+18
View File
@@ -0,0 +1,18 @@
server {
server_name www.{{ my_domain }};
root /opt/nginx/www.linuxtechwhiz.info;
location / {
index index.html index.htm index.php;
}
access_log /var/log/nginx/www.linuxtechwhiz.info.access.log;
error_log /var/log/nginx/www.linuxtechwhiz.info.error.log;
location ~ \.php$ {
include /etc/nginx/fastcgi_params;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
}
ansible/roles/nginx/templates/vserver.conf.j2
+9
View File
@@ -0,0 +1,9 @@
server {
listen 80;
listen [::]:80;
root {{ document_root }};
server_name {{ ansible_hostname }}.{{ my_domain }};
location / {
try_files $uri $uri/ =404;
}
}
ansible/roles/redis/tasks/main.yml
+10
View File
@@ -0,0 +1,10 @@
---
- name: Install redis
yum:
name: redis
- name: enable redis
systemd:
name: redis
enabled: yes
state: started