move w5isp.com to cloudflare
This commit is contained in:
parent
baa50efccf
commit
5ba93d2866
8 changed files with 277 additions and 26 deletions
|
|
@ -32,6 +32,8 @@ w5isp_com_zone:
|
|||
ip: 204.110.191.8
|
||||
- name: aprs
|
||||
ip: 204.110.191.232
|
||||
- name: prop
|
||||
ip: 204.110.191.244
|
||||
other_name_servers:
|
||||
- autodiscover.w5isp.com. IN CNAME mail.w5isp.com.
|
||||
- autoconfig.w5isp.com. IN CNAME mail.w5isp.com.
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@ ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
|
|||
|
||||
firewall_enabled: false
|
||||
|
||||
# Proxmox requires hostname to resolve to actual IP, not loopback
|
||||
# Proxmox manages its own network config - skip all network/firewall management
|
||||
network:
|
||||
skip: true
|
||||
loopback_in_hosts: false
|
||||
|
|
|
|||
|
|
@ -5,28 +5,7 @@ ansible_python_interpreter: /usr/bin/python3
|
|||
ansible_ssh_private_key_file: /Users/graham/.ssh/id_ed25519
|
||||
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
|
||||
|
||||
firewall_allow_rules:
|
||||
- port: 10152
|
||||
proto: tcp
|
||||
comment: APRS-IS full feed
|
||||
- port: 10152
|
||||
proto: udp
|
||||
comment: APRS-IS full feed UDP
|
||||
- port: 14580
|
||||
proto: tcp
|
||||
comment: APRS-IS client
|
||||
- port: 14580
|
||||
proto: udp
|
||||
comment: APRS-IS client UDP
|
||||
- port: 8080
|
||||
proto: udp
|
||||
comment: APRS-IS UDP submit
|
||||
- port: 8080
|
||||
proto: tcp
|
||||
comment: APRS-IS HTTP upload
|
||||
- port: 14501
|
||||
proto: tcp
|
||||
comment: APRS-IS HTTP status
|
||||
firewall_default_incoming: allow
|
||||
|
||||
aprsc_server_id: T2DALLAS
|
||||
aprsc_passcode: "28302"
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
name: "{{ timezone }}"
|
||||
|
||||
- name: Apply firewall configuration
|
||||
hosts: all
|
||||
hosts: all:!proxmox_servers
|
||||
become: true
|
||||
gather_facts: true
|
||||
tags:
|
||||
|
|
|
|||
|
|
@ -93,6 +93,7 @@
|
|||
owner: root
|
||||
group: root
|
||||
mode: 00644
|
||||
when: network.skip | default(False) != True
|
||||
tags:
|
||||
- network_hostname
|
||||
|
||||
|
|
@ -103,6 +104,7 @@
|
|||
owner: root
|
||||
group: root
|
||||
mode: 00644
|
||||
when: network.skip | default(False) != True
|
||||
tags:
|
||||
- network_hostname
|
||||
|
||||
|
|
|
|||
|
|
@ -524,6 +524,273 @@ import {
|
|||
id = "${local.cloudflare_account_id}/db59aa44-79de-4522-9593-43e828f3215a"
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com Zone
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_zone" "w5isp_com" {
|
||||
account_id = local.cloudflare_account_id
|
||||
zone = "w5isp.com"
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - A records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_root" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "w5isp.com"
|
||||
content = "204.110.191.8"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_home" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "home"
|
||||
content = "204.110.191.1"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_photos" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "photos"
|
||||
content = "204.110.191.8"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_skippy" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "skippy"
|
||||
content = "204.110.191.8"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_mail" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "mail"
|
||||
content = "107.174.178.20"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_dokku" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "dokku"
|
||||
content = "204.110.191.218"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_vm1" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "vm1"
|
||||
content = "172.245.56.83"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_log" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "log"
|
||||
content = "204.110.191.8"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_vaprs" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "vaprs"
|
||||
content = "204.110.191.8"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_aprs" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "aprs"
|
||||
content = "204.110.191.232"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_prop" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "prop"
|
||||
content = "32976f0f-bd63-4df4-a292-60c5c63c5313.cfargotunnel.com"
|
||||
proxied = true
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - MX records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_mx_root" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "MX"
|
||||
name = "w5isp.com"
|
||||
content = "mail.w5isp.com"
|
||||
priority = 10
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - CNAME records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_autodiscover" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "autodiscover"
|
||||
content = "mail.w5isp.com"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_autoconfig" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "autoconfig"
|
||||
content = "mail.w5isp.com"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_em40" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "em40"
|
||||
content = "u177982.wl233.sendgrid.net"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_dkim_s1" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "s1._domainkey"
|
||||
content = "s1.domainkey.u177982.wl233.sendgrid.net"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_dkim_s2" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "s2._domainkey"
|
||||
content = "s2.domainkey.u177982.wl233.sendgrid.net"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_uptime" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "uptime"
|
||||
content = "stats.uptimerobot.com"
|
||||
proxied = false
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - TXT records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_txt_spf" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "TXT"
|
||||
name = "w5isp.com"
|
||||
content = "v=spf1 mx a ip4:107.174.178.20 ~all"
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_txt_dkim" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "TXT"
|
||||
name = "dkim._domainkey"
|
||||
content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxti2t8TvzIqKF9BpKn3rQExKg3sS1SyQuwtQgL0r/ELEJ0D9cKU/iM+eB1ROJctKHoMqKDJoRCMP6eibFcgq2kLKqf+aceEOIBx2OK2WCXML+CNqQZA6yO+A8/Jq7iFZPq8D5FmOoxbwRZkso7CkSennSz/+F7nBPI/OfyEiiI4xJzWH3t8SaAkkcy46O+1K0iCkTpsthon7E2PHa3SPkrjbep/5NImTJLK5LuffiLJtLsiK+73mvsAYCDmrNxPTaDjXkj0TWdKl/d/TnlVJl+YloqWIDt/7LtZQM0C7GZ9flIr7z9hHpSWERXAA5Gj5NQ0/hcY3nF4dPoqWs3VeeQIDAQAB"
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_txt_dmarc" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "TXT"
|
||||
name = "_dmarc"
|
||||
content = "v=DMARC1; p=quarantine; rua=mailto:postmaster@w5isp.com; ruf=mailto:postmaster@w5isp.com; fo=1"
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - SRV records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_srv_autodiscover" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "SRV"
|
||||
name = "_autodiscover._tcp"
|
||||
|
||||
data {
|
||||
priority = 0
|
||||
weight = 0
|
||||
port = 443
|
||||
target = "mail.w5isp.com"
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - Zone settings
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_zone_settings_override" "w5isp_com" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
|
||||
settings {
|
||||
min_tls_version = "1.2"
|
||||
always_use_https = "on"
|
||||
tls_1_3 = "zrt"
|
||||
zero_rtt = "on"
|
||||
ssl = "full"
|
||||
|
||||
security_header {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
include_subdomains = true
|
||||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - Firewall
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_ruleset" "w5isp_firewall" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
name = "default"
|
||||
kind = "zone"
|
||||
phase = "http_request_firewall_custom"
|
||||
|
||||
rules {
|
||||
action = "block"
|
||||
expression = local.firewall_expression
|
||||
description = "block abusers"
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - CAA records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_caa" {
|
||||
for_each = toset(local.cloudflare_cas)
|
||||
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CAA"
|
||||
name = "w5isp.com"
|
||||
|
||||
data {
|
||||
flags = "0"
|
||||
tag = "issue"
|
||||
value = each.value
|
||||
}
|
||||
}
|
||||
|
||||
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" {
|
||||
account_id = local.cloudflare_account_id
|
||||
tunnel_id = "db59aa44-79de-4522-9593-43e828f3215a"
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ locals {
|
|||
"qth.social" = local.porkbun_ns
|
||||
# towerops.net is not opted in to Porkbun API access
|
||||
"vntx.org" = local.as393837_ns
|
||||
"w5isp.com" = local.as393837_ns
|
||||
"w5isp.com" = local.cloudflare_ns
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
Loading…
Add table
Reference in a new issue