graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

resolvers: NXDOMAIN blocklist via RPZ; fix Ansible deprecations

Browse source 
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a
set of domains (and subdomains) and logs only those matches under rpz-log
tag "blocklist". Domains are templated from resolver_blocked_domains
(single source of truth) into /etc/unbound/blocklist.rpz; respip module
enabled for RPZ support.

Fix deprecation warnings across the Ansible tree:
- apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana),
  removing stale .list files and adding update_cache where deb822 drops it
- community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml
- top-level facts -> ansible_facts[...] (ansible_os_family,
  distribution_release, fqdn, architecture, default_ipv4) repo-wide
This commit is contained in:
Graham McIntire 2026-06-07 10:32:42 -05:00
parent d632095eb2
commit c64f59929e
No known key found for this signature in database
GPG key ID: F4ABF488E6029E59
24 changed files with 183 additions and 97 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ansible/group_vars/all/all.yml
View file

@ -49,10 +49,10 @@ base:
server: monitor.vntx.net server: monitor.vntx.net
# SSH service name (varies by distribution) # SSH service name (varies by distribution)
ssh_service: "{{ 'ssh' if ansible_os_family == 'Debian' else 'sshd' }}" ssh_service: "{{ 'ssh' if ansible_facts['os_family'] == 'Debian' else 'sshd' }}"
# NTP service name (varies by distribution) # NTP service name (varies by distribution)
ntp_service: "{{ 'ntp' if ansible_os_family == 'Debian' else 'ntpd' }}" ntp_service: "{{ 'ntp' if ansible_facts['os_family'] == 'Debian' else 'ntpd' }}"
# Network configuration - skip for all hosts # Network configuration - skip for all hosts
network: network:

9
ansible/group_vars/resolvers/main.yml
View file

@ -11,6 +11,15 @@ resolver_allowed_netblocks:
- ::1 - ::1
- 2606:1c80::/32 - 2606:1c80::/32
# Domains returned as NXDOMAIN (blocklist). Covers the name and all subdomains.
# Consumed by unbound.conf.j2 via local-zone ... always_nxdomain.
resolver_blocked_domains:
- proxyjs.brdtnet.com
- proxyjs.luminatinet.com
- proxyjs.bright-sdk.com
- clientsdk.bright-sdk.com
- clientsdk.brdtnet.com
firewall_allow_rules: firewall_allow_rules:
- port: 53 - port: 53
proto: udp proto: udp

8
ansible/regenerate-ssh-keys.yml
View file

@ -28,21 +28,21 @@
- name: Regenerate SSH host keys (Debian/Ubuntu) - name: Regenerate SSH host keys (Debian/Ubuntu)
command: dpkg-reconfigure openssh-server command: dpkg-reconfigure openssh-server
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
- name: Regenerate SSH host keys (RHEL/CentOS) - name: Regenerate SSH host keys (RHEL/CentOS)
shell: | shell: |
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N '' ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N '' ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N '' ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
when: ansible_os_family == "RedHat" when: ansible_facts['os_family'] == "RedHat"
- name: Regenerate SSH host keys (Alpine) - name: Regenerate SSH host keys (Alpine)
shell: | shell: |
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N '' ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N '' ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N '' ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
when: ansible_os_family == "Alpine" when: ansible_facts['os_family'] == "Alpine"
- name: Set correct permissions on private keys - name: Set correct permissions on private keys
file: file:
@ -66,7 +66,7 @@
- name: Restart SSH service - name: Restart SSH service
service: service:
name: "{{ 'ssh' if ansible_os_family == 'Debian' else 'sshd' }}" name: "{{ 'ssh' if ansible_facts['os_family'] == 'Debian' else 'sshd' }}"
state: restarted state: restarted
- name: Create marker file to indicate keys were regenerated - name: Create marker file to indicate keys were regenerated

4
ansible/requirements.yml
View file

@ -11,8 +11,8 @@ collections:
version: ">=3.0.0" # Required for PostgreSQL management version: ">=3.0.0" # Required for PostgreSQL management
- name: community.proxmox - name: community.proxmox
version: ">=1.0.0" # Required for Proxmox VM management version: ">=1.0.0" # Required for Proxmox VM management
- name: community.mysql - name: ansible.mysql
version: ">=3.0.0" # Required for Icinga2 MySQL management version: ">=5.0.0" # Required for Icinga2 MySQL management (renamed from community.mysql)
- name: netbox.netbox - name: netbox.netbox
version: ">=3.0.0" # Required for NetBox automation version: ">=3.0.0" # Required for NetBox automation

3
ansible/roles/aprsc/defaults/main.yml
View file

@ -30,6 +30,3 @@ aprsc_log_rotate_count: 5
# Resource limits # Resource limits
aprsc_file_limit: 10000 aprsc_file_limit: 10000
# APT repository
aprsc_apt_repo: "deb http://aprsc-dist.he.fi/aprsc/apt {{ ansible_distribution_release }} main"

14
ansible/roles/aprsc/tasks/main.yml
View file

@ -1,9 +1,17 @@
--- ---
- name: Add aprsc APT repository - name: Add aprsc APT repository
ansible.builtin.apt_repository: ansible.builtin.deb822_repository:
repo: "{{ aprsc_apt_repo }}" name: aprsc
types: [deb]
uris: http://aprsc-dist.he.fi/aprsc/apt
suites: "{{ ansible_facts['distribution_release'] }}"
components: [main]
state: present state: present
filename: aprsc
- name: Remove legacy aprsc .list repo (superseded by deb822 .sources)
ansible.builtin.file:
path: /etc/apt/sources.list.d/aprsc.list
state: absent
- name: Install aprsc - name: Install aprsc
ansible.builtin.apt: ansible.builtin.apt:

6
ansible/roles/base/tasks/system.yml
View file

@ -29,7 +29,7 @@
ansible.builtin.command: ansible.builtin.command:
args: args:
creates: /etc/ssh/ssh_host_ed25519_key creates: /etc/ssh/ssh_host_ed25519_key
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
notify: restart ssh notify: restart ssh
- name: Regenerate SSH host keys (RHEL) - name: Regenerate SSH host keys (RHEL)
@ -39,7 +39,7 @@
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N '' ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
args: args:
creates: /etc/ssh/ssh_host_ed25519_key creates: /etc/ssh/ssh_host_ed25519_key
when: ansible_os_family == "RedHat" when: ansible_facts['os_family'] == "RedHat"
notify: restart ssh notify: restart ssh
- name: Regenerate SSH host keys (Alpine) - name: Regenerate SSH host keys (Alpine)
@ -49,7 +49,7 @@
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N '' ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
args: args:
creates: /etc/ssh/ssh_host_ed25519_key creates: /etc/ssh/ssh_host_ed25519_key
when: ansible_os_family == "Alpine" when: ansible_facts['os_family'] == "Alpine"
notify: restart ssh notify: restart ssh
- name: Create marker file to prevent re-running - name: Create marker file to prevent re-running

2
ansible/roles/base/templates/ntp.conf.j2
View file

@ -1,4 +1,4 @@
{% if ansible_fqdn in groups['ntp'] %} {% if ansible_facts['fqdn'] in groups['ntp'] %}
driftfile /var/lib/ntp/ntp.drift driftfile /var/lib/ntp/ntp.drift
statistics loopstats peerstats clockstats statistics loopstats peerstats clockstats

22
ansible/roles/caddy/tasks/main.yml
View file

@ -5,7 +5,7 @@
register: caddy_installed register: caddy_installed
changed_when: false changed_when: false
failed_when: false failed_when: false
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
- name: Install required packages (Debian/Ubuntu) - name: Install required packages (Debian/Ubuntu)
ansible.builtin.apt: ansible.builtin.apt:
@ -17,13 +17,13 @@
- gnupg2 - gnupg2
state: present state: present
update_cache: true update_cache: true
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
- name: Check for conflicting Caddy repositories - name: Check for conflicting Caddy repositories
ansible.builtin.stat: ansible.builtin.stat:
path: /usr/share/keyrings/caddy-stable-archive-keyring.gpg path: /usr/share/keyrings/caddy-stable-archive-keyring.gpg
register: old_keyring register: old_keyring
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
- name: Remove old Caddy repository files if they exist - name: Remove old Caddy repository files if they exist
ansible.builtin.file: ansible.builtin.file:
@ -34,7 +34,7 @@
- /etc/apt/sources.list.d/caddy.list - /etc/apt/sources.list.d/caddy.list
- /usr/share/keyrings/caddy-stable-archive-keyring.gpg - /usr/share/keyrings/caddy-stable-archive-keyring.gpg
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- old_keyring.stat.exists | default(false) - old_keyring.stat.exists | default(false)
notify: update apt cache notify: update apt cache
@ -42,14 +42,14 @@
ansible.builtin.stat: ansible.builtin.stat:
path: /etc/apt/trusted.gpg.d/caddy-stable.asc path: /etc/apt/trusted.gpg.d/caddy-stable.asc
register: caddy_gpg_key register: caddy_gpg_key
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
- name: Add Caddy GPG key (Debian/Ubuntu) - name: Add Caddy GPG key (Debian/Ubuntu)
ansible.builtin.get_url: ansible.builtin.get_url:
url: "https://dl.cloudsmith.io/public/caddy/stable/gpg.key" url: "https://dl.cloudsmith.io/public/caddy/stable/gpg.key"
dest: /usr/share/keyrings/caddy-stable-archive-keyring.asc dest: /usr/share/keyrings/caddy-stable-archive-keyring.asc
mode: '0644' mode: '0644'
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
- name: Add Caddy repository (Debian/Ubuntu) - name: Add Caddy repository (Debian/Ubuntu)
ansible.builtin.deb822_repository: ansible.builtin.deb822_repository:
@ -60,7 +60,7 @@
components: main components: main
signed_by: /usr/share/keyrings/caddy-stable-archive-keyring.asc signed_by: /usr/share/keyrings/caddy-stable-archive-keyring.asc
state: present state: present
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
- name: Install Caddy (Debian/Ubuntu) - name: Install Caddy (Debian/Ubuntu)
ansible.builtin.apt: ansible.builtin.apt:
@ -68,7 +68,7 @@
state: present state: present
update_cache: true update_cache: true
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- caddy_installed.rc != 0 - caddy_installed.rc != 0
# --- Install: RedHat/AlmaLinux --- # --- Install: RedHat/AlmaLinux ---
@ -76,19 +76,19 @@
ansible.builtin.dnf: ansible.builtin.dnf:
name: dnf-plugins-core name: dnf-plugins-core
state: present state: present
when: ansible_os_family == "RedHat" when: ansible_facts['os_family'] == "RedHat"
- name: Enable Caddy COPR repository (RedHat) - name: Enable Caddy COPR repository (RedHat)
ansible.builtin.command: ansible.builtin.command:
cmd: dnf -y copr enable @caddy/caddy cmd: dnf -y copr enable @caddy/caddy
creates: /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:group_caddy:caddy.repo creates: /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:group_caddy:caddy.repo
when: ansible_os_family == "RedHat" when: ansible_facts['os_family'] == "RedHat"
- name: Install Caddy (RedHat) - name: Install Caddy (RedHat)
ansible.builtin.dnf: ansible.builtin.dnf:
name: caddy name: caddy
state: present state: present
when: ansible_os_family == "RedHat" when: ansible_facts['os_family'] == "RedHat"
# --- Common configuration --- # --- Common configuration ---
- name: Ensure Caddy log directory exists - name: Ensure Caddy log directory exists

4
ansible/roles/dokku/tasks/main.yml
View file

@ -21,9 +21,9 @@
name: docker name: docker
types: deb types: deb
uris: https://download.docker.com/linux/debian uris: https://download.docker.com/linux/debian
suites: "{{ ansible_distribution_release }}" suites: "{{ ansible_facts['distribution_release'] }}"
components: stable components: stable
architectures: "{{ ansible_architecture | replace('x86_64', 'amd64') }}" architectures: "{{ ansible_facts['architecture'] | replace('x86_64', 'amd64') }}"
signed_by: /usr/share/keyrings/docker-archive-keyring.asc signed_by: /usr/share/keyrings/docker-archive-keyring.asc
state: present state: present

36
ansible/roles/firewall/tasks/main.yml
View file

@ -9,20 +9,20 @@
name: ufw name: ufw
state: present state: present
update_cache: true update_cache: true
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
- name: Install firewalld - name: Install firewalld
ansible.builtin.dnf: ansible.builtin.dnf:
name: firewalld name: firewalld
state: present state: present
when: ansible_os_family == "RedHat" when: ansible_facts['os_family'] == "RedHat"
- name: Ensure firewalld is started and enabled - name: Ensure firewalld is started and enabled
ansible.builtin.systemd: ansible.builtin.systemd:
name: firewalld name: firewalld
state: started state: started
enabled: true enabled: true
when: ansible_os_family == "RedHat" when: ansible_facts['os_family'] == "RedHat"
# --- Firewalld (RedHat/AlmaLinux) --- # --- Firewalld (RedHat/AlmaLinux) ---
@ -34,7 +34,7 @@
immediate: true immediate: true
state: enabled state: enabled
loop: "{{ firewall_trusted_subnets }}" loop: "{{ firewall_trusted_subnets }}"
when: ansible_os_family == "RedHat" when: ansible_facts['os_family'] == "RedHat"
- name: Allow SSH from specific IPs in firewalld - name: Allow SSH from specific IPs in firewalld
ansible.posix.firewalld: ansible.posix.firewalld:
@ -45,7 +45,7 @@
state: enabled state: enabled
loop: "{{ firewall_ssh_allow_from }}" loop: "{{ firewall_ssh_allow_from }}"
when: when:
- ansible_os_family == "RedHat" - ansible_facts['os_family'] == "RedHat"
- firewall_ssh_allow_from | length > 0 - firewall_ssh_allow_from | length > 0
- name: Allow per-host public services in firewalld - name: Allow per-host public services in firewalld
@ -57,7 +57,7 @@
state: enabled state: enabled
loop: "{{ firewall_allow_rules }}" loop: "{{ firewall_allow_rules }}"
when: when:
- ansible_os_family == "RedHat" - ansible_facts['os_family'] == "RedHat"
- firewall_allow_rules | length > 0 - firewall_allow_rules | length > 0
# --- UFW (Debian/Ubuntu) - Check current state --- # --- UFW (Debian/Ubuntu) - Check current state ---
@ -68,7 +68,7 @@
changed_when: false changed_when: false
failed_when: false failed_when: false
check_mode: false check_mode: false
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
# --- UFW (Debian/Ubuntu) - Disable when firewall not managed --- # --- UFW (Debian/Ubuntu) - Disable when firewall not managed ---
@ -76,7 +76,7 @@
community.general.ufw: community.general.ufw:
state: disabled state: disabled
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- not (firewall_enabled | default(true)) - not (firewall_enabled | default(true))
- _fw_ufw_active.stdout is defined - _fw_ufw_active.stdout is defined
- "'Status: active' in _fw_ufw_active.stdout" - "'Status: active' in _fw_ufw_active.stdout"
@ -88,7 +88,7 @@
direction: incoming direction: incoming
policy: "{{ firewall_default_incoming }}" policy: "{{ firewall_default_incoming }}"
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- firewall_enabled | default(true) - firewall_enabled | default(true)
- name: Set default outgoing policy to allow - name: Set default outgoing policy to allow
@ -96,7 +96,7 @@
direction: outgoing direction: outgoing
policy: "{{ firewall_default_outgoing }}" policy: "{{ firewall_default_outgoing }}"
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- firewall_enabled | default(true) - firewall_enabled | default(true)
- name: Set default routed policy - name: Set default routed policy
@ -104,7 +104,7 @@
direction: routed direction: routed
policy: "{{ firewall_default_routed }}" policy: "{{ firewall_default_routed }}"
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- firewall_enabled | default(true) - firewall_enabled | default(true)
- name: "Capture existing ufw rules" - name: "Capture existing ufw rules"
@ -114,7 +114,7 @@
failed_when: false failed_when: false
check_mode: false check_mode: false
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- firewall_enabled | default(true) - firewall_enabled | default(true)
- _fw_ufw_active.stdout is defined - _fw_ufw_active.stdout is defined
- "'Status: active' in _fw_ufw_active.stdout" - "'Status: active' in _fw_ufw_active.stdout"
@ -126,7 +126,7 @@
comment: "{{ item.comment }}" comment: "{{ item.comment }}"
loop: "{{ firewall_trusted_subnets }}" loop: "{{ firewall_trusted_subnets }}"
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- firewall_enabled | default(true) - firewall_enabled | default(true)
- _fw_ufw_rules.skipped | default(true) or item.subnet not in _fw_ufw_rules.stdout - _fw_ufw_rules.skipped | default(true) or item.subnet not in _fw_ufw_rules.stdout
@ -139,7 +139,7 @@
comment: "SSH from {{ item.comment }}" comment: "SSH from {{ item.comment }}"
loop: "{{ firewall_ssh_allow_from }}" loop: "{{ firewall_ssh_allow_from }}"
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- firewall_enabled | default(true) - firewall_enabled | default(true)
- firewall_ssh_allow_from | length > 0 - firewall_ssh_allow_from | length > 0
- _fw_ufw_rules.skipped | default(true) or item.ip not in _fw_ufw_rules.stdout - _fw_ufw_rules.skipped | default(true) or item.ip not in _fw_ufw_rules.stdout
@ -153,7 +153,7 @@
comment: "{{ item.comment }}" comment: "{{ item.comment }}"
loop: "{{ firewall_allow_rules }}" loop: "{{ firewall_allow_rules }}"
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- firewall_enabled | default(true) - firewall_enabled | default(true)
- firewall_allow_rules | length > 0 - firewall_allow_rules | length > 0
- _fw_ufw_rules.skipped | default(true) or (item.port | string + '/' + item.proto) not in _fw_ufw_rules.stdout - _fw_ufw_rules.skipped | default(true) or (item.port | string + '/' + item.proto) not in _fw_ufw_rules.stdout
@ -166,7 +166,7 @@
state: present state: present
reload: true reload: true
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- firewall_enabled | default(true) - firewall_enabled | default(true)
- firewall_ip_forward - firewall_ip_forward
@ -182,7 +182,7 @@
COMMIT COMMIT
loop: "{{ firewall_masquerade_rules }}" loop: "{{ firewall_masquerade_rules }}"
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- firewall_enabled | default(true) - firewall_enabled | default(true)
- firewall_masquerade_rules | length > 0 - firewall_masquerade_rules | length > 0
notify: Reload ufw notify: Reload ufw
@ -191,7 +191,7 @@
community.general.ufw: community.general.ufw:
state: enabled state: enabled
when: when:
- ansible_os_family == "Debian" - ansible_facts['os_family'] == "Debian"
- firewall_enabled | default(true) - firewall_enabled | default(true)
- _fw_ufw_active.stdout is defined - _fw_ufw_active.stdout is defined
- "'Status: active' not in _fw_ufw_active.stdout" - "'Status: active' not in _fw_ufw_active.stdout"

14
ansible/roles/general/tasks/main.yml
View file

@ -1,44 +1,44 @@
--- ---
- name: Install misc Debian packages - name: Install misc Debian packages
ansible.builtin.import_tasks: debian/misc.yml ansible.builtin.import_tasks: debian/misc.yml
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
tags: tags:
- misc - misc
- name: Configure MOTD - name: Configure MOTD
ansible.builtin.import_tasks: debian/motd.yml ansible.builtin.import_tasks: debian/motd.yml
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
tags: tags:
- motd - motd
- name: Configure networking - name: Configure networking
ansible.builtin.import_tasks: debian/network.yml ansible.builtin.import_tasks: debian/network.yml
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
tags: tags:
- network - network
- name: Apply UDP GRO fix for Tailscale - name: Apply UDP GRO fix for Tailscale
ansible.builtin.import_tasks: udp-gro-fix.yml ansible.builtin.import_tasks: udp-gro-fix.yml
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
tags: tags:
- network - network
- tailscale - tailscale
- name: Install K3s packages - name: Install K3s packages
ansible.builtin.import_tasks: debian/k3s.yml ansible.builtin.import_tasks: debian/k3s.yml
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
tags: tags:
- k3s - k3s
- name: Uninstall Icinga2 on non-monitor hosts - name: Uninstall Icinga2 on non-monitor hosts
ansible.builtin.import_tasks: debian/icinga2.yml ansible.builtin.import_tasks: debian/icinga2.yml
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
tags: tags:
- icinga2 - icinga2
- monitoring - monitoring
- name: Configure NFS mounts - name: Configure NFS mounts
ansible.builtin.import_tasks: debian/nfs.yml ansible.builtin.import_tasks: debian/nfs.yml
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
tags: tags:
- nfs - nfs

12
ansible/roles/general/templates/etc/apt/sources.list.j2
View file

@ -1,11 +1,11 @@
# Main # Main
deb http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }} main deb http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_facts['distribution_release'] }} main
deb-src http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }} main deb-src http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_facts['distribution_release'] }} main
# Security # Security
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main deb http://security.debian.org/debian-security {{ ansible_facts['distribution_release'] }}-security main
deb-src http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main deb-src http://security.debian.org/debian-security {{ ansible_facts['distribution_release'] }}-security main
# Updates # Updates
deb http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }}-updates main deb http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_facts['distribution_release'] }}-updates main
deb-src http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }}-updates main deb-src http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_facts['distribution_release'] }}-updates main

2
ansible/roles/general/templates/etc/hosts.j2
View file

@ -2,7 +2,7 @@
{% if network.loopback_in_hosts | default(True) %} {% if network.loopback_in_hosts | default(True) %}
127.0.1.1 {{ inventory_hostname }} {{ inventory_hostname | split(".") | first }} 127.0.1.1 {{ inventory_hostname }} {{ inventory_hostname | split(".") | first }}
{% else %} {% else %}
{{ "%-15s" | format(ansible_default_ipv4.address) }} {{ inventory_hostname }} {{ inventory_hostname | split(".") | first }} {{ "%-15s" | format(ansible_facts['default_ipv4'].address) }} {{ inventory_hostname }} {{ inventory_hostname | split(".") | first }}
{% endif %} {% endif %}
# The following lines are desirable for IPv6 capable hosts # The following lines are desirable for IPv6 capable hosts

17
ansible/roles/grafana/tasks/main.yml
View file

@ -23,16 +23,25 @@
force: false force: false
- name: Add Grafana apt repository - name: Add Grafana apt repository
ansible.builtin.apt_repository: ansible.builtin.deb822_repository:
repo: "deb [signed-by={{ grafana_apt_keyring }}] https://apt.grafana.com stable main" name: grafana
filename: grafana types: [deb]
uris: https://apt.grafana.com
suites: [stable]
components: [main]
signed_by: "{{ grafana_apt_keyring }}"
state: present state: present
update_cache: true
- name: Remove legacy Grafana .list repo (superseded by deb822 .sources)
ansible.builtin.file:
path: /etc/apt/sources.list.d/grafana.list
state: absent
- name: Install Grafana OSS - name: Install Grafana OSS
ansible.builtin.apt: ansible.builtin.apt:
name: grafana name: grafana
state: present state: present
update_cache: true
- name: Configure grafana.ini - name: Configure grafana.ini
ansible.builtin.template: ansible.builtin.template:

2
ansible/roles/loki/tasks/main.yml
View file

@ -7,7 +7,7 @@
name: unzip name: unzip
state: present state: present
update_cache: true update_cache: true
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
- name: Create loki group - name: Create loki group
ansible.builtin.group: ansible.builtin.group:

2
ansible/roles/monitor/defaults/main.yml
View file

@ -7,12 +7,10 @@
# Icinga repo + packages # Icinga repo + packages
icinga2_apt_key_url: "https://packages.icinga.com/icinga.key" icinga2_apt_key_url: "https://packages.icinga.com/icinga.key"
icinga2_apt_keyring: "/etc/apt/keyrings/icinga-archive-keyring.gpg" icinga2_apt_keyring: "/etc/apt/keyrings/icinga-archive-keyring.gpg"
icinga2_apt_repo: "deb [signed-by={{ icinga2_apt_keyring }}] https://packages.icinga.com/ubuntu icinga-{{ ansible_distribution_release }} main"
# PagerDuty agent repo + packages # PagerDuty agent repo + packages
pdagent_apt_key_url: "https://packages.pagerduty.com/GPG-KEY-pagerduty" pdagent_apt_key_url: "https://packages.pagerduty.com/GPG-KEY-pagerduty"
pdagent_apt_keyring: "/etc/apt/keyrings/pagerduty-archive-keyring.gpg" pdagent_apt_keyring: "/etc/apt/keyrings/pagerduty-archive-keyring.gpg"
pdagent_apt_repo: "deb [signed-by={{ pdagent_apt_keyring }}] https://packages.pagerduty.com/pdagent deb/"
pdagent_packages: pdagent_packages:
- pdagent - pdagent
- pdagent-integrations - pdagent-integrations

56
ansible/roles/monitor/tasks/main.yml
View file

@ -50,11 +50,19 @@
- /etc/apt/sources.list.d/jammy-icinga.list.distUpgrade - /etc/apt/sources.list.d/jammy-icinga.list.distUpgrade
- name: Add Icinga apt repository - name: Add Icinga apt repository
ansible.builtin.apt_repository: ansible.builtin.deb822_repository:
repo: "{{ icinga2_apt_repo }}" name: icinga
filename: icinga types: [deb]
uris: https://packages.icinga.com/ubuntu
suites: "icinga-{{ ansible_facts['distribution_release'] }}"
components: [main]
signed_by: "{{ icinga2_apt_keyring }}"
state: present state: present
update_cache: true
- name: Remove legacy Icinga .list repo (superseded by deb822 .sources)
ansible.builtin.file:
path: /etc/apt/sources.list.d/icinga.list
state: absent
- name: Install database stack - name: Install database stack
ansible.builtin.apt: ansible.builtin.apt:
@ -93,16 +101,24 @@
mode: "0644" mode: "0644"
- name: Add PagerDuty apt repository - name: Add PagerDuty apt repository
ansible.builtin.apt_repository: ansible.builtin.deb822_repository:
repo: "{{ pdagent_apt_repo }}" name: pdagent
filename: pdagent types: [deb]
uris: https://packages.pagerduty.com/pdagent
suites: "deb/"
signed_by: "{{ pdagent_apt_keyring }}"
state: present state: present
update_cache: true
- name: Remove legacy PagerDuty .list repo (superseded by deb822 .sources)
ansible.builtin.file:
path: /etc/apt/sources.list.d/pdagent.list
state: absent
- name: Install PagerDuty agent - name: Install PagerDuty agent
ansible.builtin.apt: ansible.builtin.apt:
name: "{{ pdagent_packages }}" name: "{{ pdagent_packages }}"
state: present state: present
update_cache: true
- name: Ensure PagerDuty agent is started + enabled - name: Ensure PagerDuty agent is started + enabled
ansible.builtin.systemd: ansible.builtin.systemd:
@ -125,9 +141,9 @@
name: "{{ apache_php_version.stdout }}-mysql" name: "{{ apache_php_version.stdout }}-mysql"
state: present state: present
when: apache_php_version.stdout | length > 0 when: apache_php_version.stdout | length > 0
when: ansible_os_family == "Debian" when: ansible_facts['os_family'] == "Debian"
- name: Ensure PyMySQL is installed (required by community.mysql) - name: Ensure PyMySQL is installed (required by ansible.mysql)
ansible.builtin.shell: ansible.builtin.shell:
cmd: | cmd: |
set -e set -e
@ -149,13 +165,13 @@
enabled: true enabled: true
- name: Create IDO database - name: Create IDO database
community.mysql.mysql_db: ansible.mysql.mysql_db:
name: "{{ icinga2_ido_db_name }}" name: "{{ icinga2_ido_db_name }}"
state: present state: present
login_unix_socket: /run/mysqld/mysqld.sock login_unix_socket: /run/mysqld/mysqld.sock
- name: Create IDO daemon DB user (icinga2) - name: Create IDO daemon DB user (icinga2)
community.mysql.mysql_user: ansible.mysql.mysql_user:
name: "{{ icinga2_ido_db_user }}" name: "{{ icinga2_ido_db_user }}"
host: localhost host: localhost
password: "{{ icinga2_ido_db_password }}" password: "{{ icinga2_ido_db_password }}"
@ -164,7 +180,7 @@
login_unix_socket: /run/mysqld/mysqld.sock login_unix_socket: /run/mysqld/mysqld.sock
- name: Create read-only IDO user for icingaweb2 (icinga) - name: Create read-only IDO user for icingaweb2 (icinga)
community.mysql.mysql_user: ansible.mysql.mysql_user:
name: "{{ icingaweb2_ido_db_user }}" name: "{{ icingaweb2_ido_db_user }}"
host: localhost host: localhost
password: "{{ icingaweb2_ido_db_password }}" password: "{{ icingaweb2_ido_db_password }}"
@ -173,13 +189,13 @@
login_unix_socket: /run/mysqld/mysqld.sock login_unix_socket: /run/mysqld/mysqld.sock
- name: Create icingaweb2 database - name: Create icingaweb2 database
community.mysql.mysql_db: ansible.mysql.mysql_db:
name: "{{ icingaweb2_db_name }}" name: "{{ icingaweb2_db_name }}"
state: present state: present
login_unix_socket: /run/mysqld/mysqld.sock login_unix_socket: /run/mysqld/mysqld.sock
- name: Create icingaweb2 DB user - name: Create icingaweb2 DB user
community.mysql.mysql_user: ansible.mysql.mysql_user:
name: "{{ icingaweb2_db_user }}" name: "{{ icingaweb2_db_user }}"
host: localhost host: localhost
password: "{{ icingaweb2_db_password }}" password: "{{ icingaweb2_db_password }}"
@ -188,7 +204,7 @@
login_unix_socket: /run/mysqld/mysqld.sock login_unix_socket: /run/mysqld/mysqld.sock
- name: Check whether IDO schema has been imported - name: Check whether IDO schema has been imported
community.mysql.mysql_query: ansible.mysql.mysql_query:
login_db: "{{ icinga2_ido_db_name }}" login_db: "{{ icinga2_ido_db_name }}"
query: "SHOW TABLES LIKE 'icinga_dbversion'" query: "SHOW TABLES LIKE 'icinga_dbversion'"
login_unix_socket: /run/mysqld/mysqld.sock login_unix_socket: /run/mysqld/mysqld.sock
@ -196,7 +212,7 @@
changed_when: false changed_when: false
- name: Import IDO schema (first install only) - name: Import IDO schema (first install only)
community.mysql.mysql_db: ansible.mysql.mysql_db:
name: "{{ icinga2_ido_db_name }}" name: "{{ icinga2_ido_db_name }}"
state: import state: import
target: "{{ icinga2_ido_schema_path }}" target: "{{ icinga2_ido_schema_path }}"
@ -205,7 +221,7 @@
notify: Restart icinga2 notify: Restart icinga2
- name: Check whether icingaweb2 schema has been imported - name: Check whether icingaweb2 schema has been imported
community.mysql.mysql_query: ansible.mysql.mysql_query:
login_db: "{{ icingaweb2_db_name }}" login_db: "{{ icingaweb2_db_name }}"
query: "SHOW TABLES LIKE 'icingaweb_user'" query: "SHOW TABLES LIKE 'icingaweb_user'"
login_unix_socket: /run/mysqld/mysqld.sock login_unix_socket: /run/mysqld/mysqld.sock
@ -213,7 +229,7 @@
changed_when: false changed_when: false
- name: Import icingaweb2 schema (first install only) - name: Import icingaweb2 schema (first install only)
community.mysql.mysql_db: ansible.mysql.mysql_db:
name: "{{ icingaweb2_db_name }}" name: "{{ icingaweb2_db_name }}"
state: import state: import
target: /usr/share/icingaweb2/schema/mysql.schema.sql target: /usr/share/icingaweb2/schema/mysql.schema.sql
@ -221,7 +237,7 @@
when: iweb2_schema_check.rowcount[0] == 0 when: iweb2_schema_check.rowcount[0] == 0
- name: Bootstrap icingaweb2 admin account (first install only) - name: Bootstrap icingaweb2 admin account (first install only)
community.mysql.mysql_query: ansible.mysql.mysql_query:
login_db: "{{ icingaweb2_db_name }}" login_db: "{{ icingaweb2_db_name }}"
query: >- query: >-
INSERT INTO icingaweb_user (name, active, password_hash) VALUES INSERT INTO icingaweb_user (name, active, password_hash) VALUES

2
ansible/roles/ns/handlers/main.yml
View file

@ -4,7 +4,7 @@
- name: Restart bind - name: Restart bind
ansible.builtin.service: ansible.builtin.service:
name: "{{ 'bind9' if ansible_os_family == 'Debian' else 'named' }}" name: "{{ 'bind9' if ansible_facts['os_family'] == 'Debian' else 'named' }}"
state: restarted state: restarted
become: true become: true

4
ansible/roles/ns/tasks/bind9.yml
View file

@ -60,7 +60,7 @@
- name: Enable and start BIND9 service - name: Enable and start BIND9 service
ansible.builtin.service: ansible.builtin.service:
name: "{{ 'bind9' if ansible_os_family == 'Debian' else 'named' }}" name: "{{ 'bind9' if ansible_facts['os_family'] == 'Debian' else 'named' }}"
state: started state: started
enabled: true enabled: true
@ -71,4 +71,4 @@
permanent: true permanent: true
state: enabled state: enabled
notify: Restart firewalld notify: Restart firewalld
when: ansible_os_family == 'RedHat' when: ansible_facts['os_family'] == 'RedHat'

10
ansible/roles/resolvers/tasks/main.yml
View file

@ -29,6 +29,14 @@
daemon_reload: true daemon_reload: true
when: unbound_override.changed when: unbound_override.changed
- name: Deploy blocklist RPZ zonefile
ansible.builtin.template:
src: blocklist.rpz.j2
dest: /etc/unbound/blocklist.rpz
mode: "644"
notify:
- Restart unbound
- name: Create Unbound config - name: Create Unbound config
ansible.builtin.template: ansible.builtin.template:
src: unbound.conf.j2 src: unbound.conf.j2
@ -50,7 +58,7 @@
permanent: true permanent: true
immediate: true immediate: true
state: enabled state: enabled
when: ansible_os_family == "RedHat" when: ansible_facts['os_family'] == "RedHat"
notify: notify:
- Restart firewalld - Restart firewalld

15
ansible/roles/resolvers/templates/blocklist.rpz.j2 Normal file
View file

@ -0,0 +1,15 @@
; Managed by Ansible (roles/resolvers) — do not edit by hand.
; Source of truth: resolver_blocked_domains in group_vars/resolvers/main.yml
;
; Response Policy Zone. Each listed name and its subdomains resolve to
; NXDOMAIN (forced by rpz-action-override in unbound.conf), and matches are
; logged to syslog under rpz-log-name "blocklist". Names are relative to the
; $ORIGIN below, per RPZ convention (the zone suffix is the policy trigger).
$TTL 3600
$ORIGIN blocklist.rpz.
@ IN SOA localhost. root.localhost. 1 3600 600 86400 3600
@ IN NS localhost.
{% for domain in resolver_blocked_domains | default([]) %}
{{ domain }} CNAME .
*.{{ domain }} CNAME .
{% endfor %}

16
ansible/roles/resolvers/templates/unbound.conf.j2
View file

@ -338,6 +338,10 @@ server:
access-control: {{ netblock }} allow access-control: {{ netblock }} allow
{% endfor %} {% endfor %}
# Blocklist (NXDOMAIN + logging) is implemented as an RPZ at the end of
# this file so that only blocklist hits are logged. See the rpz: clause
# and /etc/unbound/blocklist.rpz (templated from resolver_blocked_domains).
# tag access-control with list of tags (in "" with spaces between) # tag access-control with list of tags (in "" with spaces between)
# Clients using this access control element use localzones that # Clients using this access control element use localzones that
# are tagged with one of these tags. # are tagged with one of these tags.
@ -636,6 +640,8 @@ server:
# except cachedb(just before iterator), and python (at the beginning, # except cachedb(just before iterator), and python (at the beginning,
# or, just before the iterator). # or, just before the iterator).
# module-config: "validator iterator" # module-config: "validator iterator"
# respip is required for the RPZ blocklist (rpz: clause at end of file).
module-config: "respip validator iterator"
# File with trusted keys, kept uptodate using RFC5011 probes, # File with trusted keys, kept uptodate using RFC5011 probes,
# initial file like trust-anchor-file, then it stores metadata. # initial file like trust-anchor-file, then it stores metadata.
@ -1336,3 +1342,13 @@ remote-control:
# rpz-signal-nxdomain-ra: no # rpz-signal-nxdomain-ra: no
# for-downstream: no # for-downstream: no
# tags: "example" # tags: "example"
# Blocklist RPZ: returns NXDOMAIN for resolver_blocked_domains (and subdomains)
# and logs only these matches to syslog (tag "blocklist"). Zonefile is templated
# from group_vars/resolvers/main.yml. Requires respip in module-config (above).
rpz:
name: "blocklist.rpz"
zonefile: "/etc/unbound/blocklist.rpz"
rpz-action-override: nxdomain
rpz-log: yes
rpz-log-name: "blocklist"

16
ansible/roles/uisp/tasks/main.yml
View file

@ -16,11 +16,21 @@
mode: '0644' mode: '0644'
- name: Add Docker APT repository - name: Add Docker APT repository
ansible.builtin.apt_repository: ansible.builtin.deb822_repository:
repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable" name: docker
filename: docker types: [deb]
uris: https://download.docker.com/linux/debian
suites: "{{ ansible_facts['distribution_release'] }}"
components: [stable]
architectures: [amd64]
signed_by: /etc/apt/keyrings/docker.asc
state: present state: present
- name: Remove legacy Docker .list repo (superseded by deb822 .sources)
ansible.builtin.file:
path: /etc/apt/sources.list.d/docker.list
state: absent
- name: Install Docker CE - name: Install Docker CE
ansible.builtin.apt: ansible.builtin.apt:
name: name: