graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add FreeBSD bootstrap, irc servers, hostname overrides, and cleanups

Browse source 
- bootstrap.yml: support pkg for FreeBSD sudo/python3 install
- base role: FreeBSD package sets, sudoers paths, host key regen, admin group, usermod process-in-use tolerance
- freebsd role: pkg update/upgrade tasks
- general role: standalone hostname tasks (ungated from network.skip), hostname_override support
- inspircd role: deploy configs for ca/us manero.org irc servers with vault-backed secrets
- uisp role: download and run installer on fresh hosts, skip if already running
- netbox role: stop services before usermod to avoid process-in-use failures
- hosts: add irc_servers group, ca/us.manero.org (Tailscale), drop staging.towerops.net
- all.yml: graham user gets static ed25519 key alongside github keys
This commit is contained in:
Graham McIntire 2026-06-19 17:19:29 -05:00
parent b43aa56b5c
commit fb5803c866
No known key found for this signature in database
GPG key ID: F4ABF488E6029E59
48 changed files with 6896 additions and 129 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ansible/bootstrap.yml
View file

@ -35,6 +35,8 @@
yum install -y sudo
elif command -v apk >/dev/null 2>&1; then
apk add --no-cache sudo
elif command -v pkg >/dev/null 2>&1; then
pkg bootstrap -y && pkg install -y sudo
else
echo "Unsupported package manager for sudo installation" >&2
exit 1
@ -57,6 +59,8 @@
yum install -y python3
elif command -v apk >/dev/null 2>&1; then
apk add --no-cache python3 py3-pip
elif command -v pkg >/dev/null 2>&1; then
pkg install -y python3
else
echo "Unsupported package manager for python3 installation" >&2
exit 1

2
ansible/group_vars/all/all.yml
View file

@ -32,6 +32,8 @@ managed_users:
authorized_keys:
- type: github
value: gmcintire
- type: string
value: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEEKtgXwoW8HZGqC+KJok9iNpI/lK4glvoryL4Ng/AL+"
- name: andy
shell: /bin/bash
home: /home/andy

265
ansible/group_vars/all/vault.yml
View file

@ -1,94 +1,173 @@
$ANSIBLE_VAULT;1.1;AES256
63333633326264363332366339613466666634616166363235326436326461366164333634393335
6138666135333630313231613038653464613963323634650a303636356364316532653431386630
61616239666337393065363537613536663061666437656333623162623265666332333539666264
6366373632373833620a323837313065386632323137643233363132373762373765646264656239
39646562623566343737623539636134393166326563303030643765336165626437626436343266
30363264303661646230613865633439373730333861656333383531656439303733326234373364
35663063396664396662653236363838373139353732343536376431396465633537333265396565
38373630383237623665323461633062343734653334373362366139656434633662613038643934
34656232353330663063356563323738396337313737373232363735633238653865366137656365
39663738643239343762353633663434653837663963376537386563393264643630656433316265
33323365333261623564656561383137313934623563333931636564346633383239333936626232
66366636333435616331323633643835353338383235306665373336386138616137396564333666
63393966323030353363663165346463366335643336366139303664616332363938333461373532
66653461343635313834306239326639376238386137343336356366616131656632363237623233
37656262393639393237613362363136643465633665636161356163373136666163373936383938
63346263383836613662623265393732336335316261326335633935343437343731363435626130
66633130626266663934383133313462366264636637646666343762303139663665333732353866
62623936633862623330316165376130386337343730623263623861383462376466333961303234
34356336323638386634656233616236666335376335373163663263303337346630373464643764
66383764333839353266323666343532666238666663386432633932333836643163323835353461
35663137326532616135313138653132303564346265336566613664316533306161393431346131
33333163613432326330386539323636663838313361643366396530643536336534666638303335
37343134616530336436333737396533363533306235353465633938373535366565323962383238
63326361653732373262366234623038653936623236346361666532346335353939636162386663
34373430363162323431636430666662383262343531653064333864653063666430306465336264
34663435383538303166303231313261313137366162623961303337653461306339653530373865
30353637633839656165393931613530323763613130363965386533386363383761613461393238
65376333646230613764636565626333663031646231613631323734383562316437313133376637
61373663326162313166646663396232333462623163323763303837303862393930373564643565
31623965316630326666663037613133356539386462353563303437343335313835636231663630
63373830303638323431323138333733383131643938663064613261353031663133646230613535
36376536396366643034343837613463346465383234383637383763336363366433386461356665
36363131353462356165376261613130653035616232626137666265363535346539666136663037
64373966306136613133326138383766343164613031386132373832313865393962663437383936
31626664646432396666646231386261383838393738346639393865363338326264633662653131
39323161366431353831383235653465383364373532613865616361336162343830613734663139
33363764333465666364303763656238646565393163383661643532383262616362653737343735
61383430306139336461313035633534363131613033373864656264396232303933346639636236
61313731343065626161363531303161356134653234666634363836333762393935613931613334
66363431613564346464613165383434626532656166333435363034633463386239663933333037
31613135633163383438623536616362666133653465666532653237633962633632663132393164
66343536633262363861633534363737373432353962383061396232306363623765363761346463
39633735336633663131346234376338616662336539343031333839373439653966633165383434
61316465633663646165376237353638613162643661396466623638346163336632663065653538
66313835343062336663653531323534316236313534336232386565373465333361323137313830
31376662373830373237646131646665653266643064376336336663306563323066653238386564
34306433623538333561663930333237313836656538656133663364313035393930326635303833
34363832356663323537343562383265626432386365383236646531303432363138366537303533
63393132623530393931643961646364336364346432336431646237633430313233613262333763
30626631336465666662616136326366643965303261346665616631323330373333613739343161
63636538306563386132613731613933326637363338643666396336313961366363653365356537
36386666656634366235313032326363616166326236366462663233323234366564343232396366
62313339626336343031626138373233373636623532343662343561633635636435383566373363
64353566323438363132616238633133396337313564613261303666616163613766333261636436
38393633313931613232303963313035626533373731646563653062386335303663636235623830
31663339346131303963316562626233313832613138633466306335386363333731373661326232
63303338356564356639303336626564323265653533616665623339623935303463353838623364
38386236373165386439356566323932646339656261653638313665326438393561396261656465
36366432396462666435626161383434333561383830336337613432363431336161656439346130
38393465633030383763323936656564303063333561663930363930353534303863373538333636
36363234386337626137316335646536336533383338316536386434316561616436356562366235
34326134393237313266666536363364323931353633663930616330663933313136336234613338
64366139313132636337323837663430373932663839663531353338363261393062363733393039
33623831396531666263653136313037376462346633376434396232396163346138663736363833
63663165353230393562623233623739313861626437323032616333393161353765636436666130
38323266393138326666333066343161646336353564363965613565663362346663393838323731
39303763643062653262653537636332366266363365336534663261373237363932336664663730
61343038363062313561633639316139326537633866623538383666393863356439303433326634
65623861343963323232613963613662353765623437623761333239646361356265663634653136
63306637306639316138383838653738303136613465633765666665346134383235626234366535
37376436313532303432306436356534663031373539323532663939346236646463363631613561
63356436343064393435643666636130353231633566343438346233323137663434643263616439
36323833346364636433616562646335376339336435316639643837363866663861643937383930
32383037623262646334306337333735653137326362386439376439383538373130353862336638
35643336613361663838626634626239333337666361653339623636313838666636323837666333
31356132396239396632616233666638393231333964336533336130393565383739653232663935
64373766353738646263316630326534653131613636666362376434363265616232636134383264
62613037646463366164393830623630376132333232373137383337303134363662386230323331
36326532623337393563646438396332396635303632636661396237636535383834343235356361
37663431636339343630303462636331373134613664356162366236323930393562343436646236
64363131616238373131653137303132633831303634323062663939373835613437636566303563
66616634623766323937323031346233633563613333643261306264393761313232653065373465
34653136376335663163623764356465383265366366333334353032663436383037333662323439
66386630323939666163633636346665663564616263393431363762333930346461336538616538
31666432326331663535626335643233616663323166313635363362316430356531646361653837
35343230626666343033316562396233333830663563393632626230656166663461323136353831
62383134363834313730326434636364303764633239666434313238316438656438626530333630
62373264653863383939303439323362393266636663623931646339366165323038643864363834
66383636363937306365653063653436303966616232383065663834383335393935666231613266
30343562663632346663666332343735613933303462633334386632336230356461336638323737
62653034616464356461633331376638396161626531373662613762333562373436316166323838
65386335636334353735333438336635643630636166373934386430316438393965623235333731
36363634643765373232626239356665316663313263306334643033656166346333
33303162376164613464623864323932616634653932343066383263356564396232336531613039
6662663537373133373963353638363261613066343064340a366662633237333633376266616561
39383563343339373833323131336633333564613161633334633662326331396461623261313966
3535373432666430340a343138656237633133636634333562343539663765303361613032306663
61653165656562306162613536623936326465326132323034306361326138376336343438623430
34383230396333366338643535666530353734343864376233313730343365613962386438646439
33393062346136303631656635316337353937663330633463623537613531336463316665636132
35626531393332336532323332393933316434653366633830666130333636303066623561663637
64366566656366643563666337383835303733653261373032633066383730336136346665303833
65346662373062373836333430306163663535373665386334353235313464623330336363326165
39386361363039356166303133353739626162613637633930343131643030386463663537366361
66626538663836646532636134346230623637626233633866346165396566383731313137303265
31386632656466313864626235393434626638646564646162356365333530633536356436373436
32313932323632663438343330636264373365336139616536343332623830616537663030316535
36393238323465636533353832303264616438626630343963303032623763393533376161633138
33653864363663633730333864303636333733653562323264323937363738656664343830386566
30326163646338323334303937653739613238663661643132616665653031373832366135363864
61623338343963636165373535306266646338656266643539383037656566663961336333643739
33373332353334373035386438353232333661653961653465646231616264633738663064643738
34616632663265343630626262646237363864373262396239353538623534643762333934383561
39383931383161373965623337386430633762643366323965366439666263313833353561356232
32353238336139343161356130343034393366353138346130666339376633333734393365383666
65396430373664336562323438626136623633326561303630383038336539396262653032636335
30656138373064663934663035323163313332333433306430313963393539306362623539393034
64376238386230336138633137653662636262323561386564346538313564366636613866623836
33623134333166313164623739383832666666396461656438616635376331623563376363623965
32616537363861623262366437663637636563353034353932363264656263393035373461666162
65633235643438393362323164393736363665643335326234323633613335323166616539633639
39333338343338613766353735643266366130306462663433363163386635393639633539616633
34393036366432333966366261313938613835373932303166336433623835316237353161616438
36383066393732666638313461363133356561353537643663373834333733376432353337386163
61633662643930313565326635663363656633316166383563643435616335633162376339336339
33373265623837626436393335396133653764376232353564396161386365366538663331613538
32363762376463623665373339663635356131616239333265343934353666323731623230343137
62313437346531323966663163393562366336393937636137353666363631346333303631356132
63613338383463386232313862613731663730376130366332323131343133363666353331653434
61343839393333663766363530313362386534393166643062303633333834643838633837336263
34663764373766376539373031663032303732356461303663366562646665366237313732613239
30333235316630653134343437343939336631666538623264353765636332323763396535386535
36363030346632346461643934306634616232336631343435313564396466336539376238393233
63663939343838383739393433366239656663373464333337626530643262663432333465623437
64656534623563653930333462393038303230643335646630326334653837346433303639326265
34323337633338336464613163666534616335643462333234316630656230346161653338333961
64643166633939393630643439313461313463383065663932323132343033376562666231326432
39616530666435326366353532376536333564383166323232646133373134616335666566306133
38336336336138363332343731396535633031626561643232623265336333653136623936323235
36303730626530633261653031633563336237363339616536353738623564666666313762653564
32663265323562336563613230653334303662663265346338303032646337653937363866663566
64336663663164363036303466643739333238396164396631333163383365613830623430373062
38343930363331636133376232333766323338666334333939323136333139623061646437343539
34323538643030663432343937656438313962623730343330646664393933326463343565313434
66353366326463363235613233623364646638346539653938336163643766373537383762643563
65373537393666653039363965363362663264356536653263663133613265646431663738633662
61303730363132643832393731373062613266363432633338343133633565653437663366323839
65633335346564383638656362373436663031316539663339616366326432383436613765616561
31633363623762343932663165366563656264343039313761616266653535646662356131336665
30346637663165396465346662316537336238343838373566633563313039346633373937663166
36393233353165376232613739376463306663343136643633643733336163316663393632396565
65336261353766393166613561623332376366346366623135353964343564373763393739646463
63383365366265656537303466663437633931343331613163303261363239666531663936623230
61636432613861396562376138313161316239653862646533653133653162326664653265393239
32333162656339343939616165303966626633333130643739336235633064626661633130316263
65393263396131623964373065383839663136623332346637383734356433656539663334376238
30636236353738626264336561663564333333613538343938353231633262663733653933666233
62663135363061343233333061313530386634376638303238333239303636376331373730613961
30333639653765313161666636376631373666393564353532313834336433373734353137646462
37613263653338383566366461373362363431356336626630663031336532396333306137353233
37636233303631623031663765333466636364653531363430663931306637633966336430353132
32626461613736653430663337633136663435663732346330643663653730363939383430363534
32366433613464613662303539333238613438346564336462623739393036393733623762643930
65623937393437373538656239363166373339303036653638633932373061353165356361666438
64333066343564323535646632326130626636393538356437623635313664653030393637613934
61663966383134636264373664333666363936346337323661316138353231643035666238623866
34303961353631323838346264383338656131346130363135333237353766353634303133373333
37623665633731303537326661633332303764343366613339353365623536643961626365343765
30386363376161616235623136336237326364356133383036663832333566656234313239353462
31336638666563303031333931643766343036373831326433633135376630656233363661343264
31346166666332666430656335653338353330383136373932356166633930643932616261626233
35663835336138363864356464373265373464653438353637373163343030336364336163663364
38653432636366393737633565663464623136326638663437373765373737633038393566333865
31393132376238303862656539623737643937643135316563343866353738373232356434356330
34623162666563383035343262303232656433363265313238373132363334653034363961623138
30316264343831393466393234313035663265643233663532333961653932383565373731313566
35323732386161366536366337396665303437346230323438396463623734346537346436376430
62336337383530313331386565386334303639333761663032613666306235616134396339633864
39633335623038393138666566396565303339326639346362366336306437376366626231356335
30633932303963633931303332333630333438653765656237643966383138333963346138396135
30363161366364613534666162376334313439303864626233623539653430353464633633353263
66633161376564393962363935313932306165653437646661383238626338306430393566633362
31663264633734316133323366633439383532303333333033336433333738653037373130643862
32343030666631666531393335613932373536343263616565373632626138616537343266326537
64333131663162623161353138633132623336653731313032313437656165303461613035653562
34613234643364346539363931393837613766313938626132353139626534393865393363633430
66333835363834303038613066626638333766333865333032636661353030633363363563393761
35333034346337653862376136323064656237343563383832303335303535663238303665666233
65613238643333653537643132373033393138313539346465376565663465383561346138356464
65626431396532633638613463343264303037336162316634373937626665303363396137643837
62643061326132663265383862353330636630653464356336613935396431663531386261376137
64323937386334376332343064623639373461366166666136656436623333353738346662613638
35626137323162373637663966663863353437323261366232633237636265663531376632373062
35343839393134313836313464333631373364366338386637396364653462316430643235353134
36386663383236386533316237663364653362653662643237633964663130343633336137326334
35363934343239653836303333373862363436393736306231613263353064303338343136373363
62353931336536663766646632663365323435373733343462343136616664396363623736613564
36363364343761366337393563663532393531353062343266653734363364613839356237626338
37616234636137363461323136313034316134306162663136633663653132363465643533313437
37373536376262626565653033333662626637393565393235306165333362303530663463386364
38353032636237623535386466623939633738303233383963653735333734336132336663383235
38346231636565656163613234626464333634323166346534633233326562383166636366306663
63633433623539323364316365613235363830336339653962653764633236653862316663353066
30386139316266666336653633353633613139633036623037366563323861333632336334336131
65386261313834343735636265306363613838373935313963376163396634653134323334643962
36613030623834313331366633303766333136633866623235323065393665666535373861376634
65393033613333626335376161373435303335633163356364353433313333643639313235396637
62663137343835656532336366663839353831396563393162306134623731653763316231376432
39386361623838376231356532633232383733663265363434396130646130323734363365663865
63386266633539366336653565663063323365396362373631663363326362376361623133633336
61396661336236316461333537333038656638313562356461353931323835316531653762613765
63343934626161646365353263356434323338653863383333343431393634633933346539323531
37306235313731663464393237396262633738363166333330623430663462633963356362646234
34623361633731626335643335323336613636356630653532356331633132663739613630663964
64626462383062306433303135323538336237623432613030326638633530313539363164313134
35663066363337386163356438613939643830623830383761616330323136616339386333626132
61363030353966616461646435333137336538343533643831303935373638393834383265343831
61326331653835623935373330333138643634366432336464336563616238396138623131333434
65663636656331643432333865336330343631623738656561323139633138333434373063656166
31393735666232646536636131366137323432366530386135333530303734313539623465343739
36343865663535336230343830343864623462376631626466613966346137633966333863623262
33653739616261616136376533336135353635333839373438316364383131326434366534353532
63316165623230623738633664633764613133633730383337336233616364356637313062343064
65613232363331356139316161633639383963353666633430633635373033306532386236313665
37323533383265373162313662656430623233613936353832653634303835656662373937633361
63613866356663383939393434326530643234366462316230666134363530646631326465393865
36633035323030663765626332363633626265633738353139663434356663303136643232633238
65366335383961653865653636383036346135643064343765333863376666326135303233373163
39653463386133326664363031396264363866303337323438616339393461393366643362393238
62303735353738383135303939363437333062343437343030663265313632306132303461323431
35356261333265313562373939616536383162363666666666326131306165343037313530393565
61346430613064656231373161396163626461333830636338303232386537616363336361363763
62613530343339336662326630633337336635643865663536323936316638313031343734326364
34636130356335626662656462343238626564316131333566346661383438393830386162633765
63393838616466353335646639366164666135646563383861383833623637303461643265666266
63353233373936636565653539666264656438633330646665613266643064386437313362356236
64613362653638306635393166356439656239303861666633616262396437353364383237333764
65316465326536346636643836386363383365663765366431393031616134656438326436393636
31663466633537393337386363353938303131373531376364656535356166646439653665366138
36356339313739636431613730373931646264633461363735336534396264313363633864613464
39383835636234386662303339303937383339323834383534633136316666383966343238303137
39633536653035376335666265663731646164633835386666313361366231383933656332386639
39353432326137663430643066666639636530353038326632333861653063326561396230323336
36633766326364636131316333623461333436383561386231323565333431336266626230393536
65353736366533663132376636323133386563636637386431323332373838663339346566663536
38373964316537343263353338346438303733333062626232366139316162326434656462616437
62323532383036343839396431366566323338383534343862343932333361343066653261633935
30666634333161376432323266316339303062636562326638376166613862346465343663663365
35336366313861626264383635613261663332356534343036666232386635363363623062323138
34363038666564333565616261333532346663376263313630303934616331383761323037353066
32656230393361373837346632656432306134333536326330663832633535373830653265633533
37613137633634616639396666396430363831303463653238333163343433646639653436376233
39623937653539653532393134333930303866626464303236653337393865313338356234363235
34373962636239626533383062306638386333313166633439396630393233326461396464363135
36633934333765653135633032656138333939323931666131623261626331633339353838346566
39633238336337623936623639353465626437356630613436383536373137396465363765343634
30326362613334323538323432643738303961626331623665306533386235646532313661396362
62343136313836636335343565633537643563376463633565633834323861356637356261646436
61353461623531653066363835353531373731356263306136646463653336313238623430333565
30386338333335363530343535383965633161373465653231646565393930646436313438333535
65643131636264303566613263346332636531626461353733353863313663316236366662303966
61643736666631323465656562633637323061346539363938666663376363366561306166646565
65633234356430643233313434663537623937323137623561363836313738353766653064383564
39666563613638346136306433396631643762633630316164393131393264383965343439326436
35313436363039663734

18
ansible/host_vars/ca.manero.org.yml Normal file
View file

@ -0,0 +1,18 @@
---
# Debian IRC server — reachable via Tailscale MagicDNS
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
ansible_python_interpreter: /usr/bin/python3
# Override the hostname derived from inventory_hostname (ca.manero.org → "ca"),
# since this box's actual hostname is manero-ca.
hostname_override: manero-ca
inspircd_config_files:
- inspircd.conf
- modules.conf
- opers.conf
- links.conf
- irccloud.conf
- thelounge.conf
- motd.txt
- help.txt

25
ansible/host_vars/us.manero.org.yml Normal file
View file

@ -0,0 +1,25 @@
---
# FreeBSD IRC server — reachable via Tailscale MagicDNS
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
ansible_python_interpreter: /usr/local/bin/python3
# This box's hostname is manero-us; the general role's Debian-only hostname
# tasks won't run here, so it stays as-is.
hostname_override: manero-us
network:
skip: true
inspircd_config_files:
- inspircd.conf
- modules.conf
- opers.conf
- links.conf
- irccloud.conf
- help.conf
- filter.conf
- iso-8859-1.conf
- iso-8859-2.conf
- motd.txt
- opermotd.txt
- help.txt
- quotes.txt

6
ansible/hosts
View file

@ -24,7 +24,6 @@ skippy.w5isp.com
mail.mcintire.me ansible_host=107.174.178.20
dokku.w5isp.com
aprs.w5isp.com
staging.towerops.net
prom.w5isp.com ansible_host=10.0.15.31
[prometheus_servers]
@ -34,7 +33,6 @@ prom.w5isp.com
prometheus_servers
[dokku_servers]
staging.towerops.net
[aprsc_servers]
aprs.w5isp.com
@ -61,3 +59,7 @@ node3 ansible_host=node3
[postgresql_servers]
db.w5isp.com
[irc_servers]
us.manero.org ansible_host=manero-us
ca.manero.org ansible_host=manero-ca

10
ansible/playbook.yml
View file

@ -267,3 +267,13 @@
tags: loki
- role: grafana
tags: grafana
- name: Configure IRC servers
hosts: irc_servers
become: true
gather_facts: true
tags:
- irc
- inspircd
roles:
- inspircd

28
ansible/roles/base/defaults/main.yml
View file

@ -5,9 +5,34 @@ managed_users: []
admin_group_map:
Debian: sudo
RedHat: wheel
FreeBSD: wheel
admin_group: "{{ admin_group_map.get(ansible_facts['os_family'], 'sudo') }}"
sudoers_dir_map:
Debian: /etc/sudoers.d
RedHat: /etc/sudoers.d
FreeBSD: /usr/local/etc/sudoers.d
Alpine: /etc/sudoers.d
sudoers_dir: "{{ sudoers_dir_map.get(ansible_facts['os_family'], '/etc/sudoers.d') }}"
sudoers_path_map:
Debian: /etc/sudoers
RedHat: /etc/sudoers
FreeBSD: /usr/local/etc/sudoers
Alpine: /etc/sudoers
sudoers_path: "{{ sudoers_path_map.get(ansible_facts['os_family'], '/etc/sudoers') }}"
visudo_path_map:
Debian: /usr/sbin/visudo
RedHat: /usr/sbin/visudo
FreeBSD: /usr/local/sbin/visudo
Alpine: /usr/sbin/visudo
visudo_path: "{{ visudo_path_map.get(ansible_facts['os_family'], '/usr/sbin/visudo') }}"
base_common_packages:
- git
- vim
@ -35,6 +60,9 @@ base_packages_by_os_family:
- smartmontools
- lm_sensors
- python3
FreeBSD:
- sudo
- python3
base_packages_by_distribution:
Ubuntu:

5
ansible/roles/base/tasks/main.yml
View file

@ -44,4 +44,9 @@
name: debian
when: ansible_facts['os_family'] == "Debian"
- name: Apply FreeBSD-specific configuration
ansible.builtin.include_role:
name: freebsd
when: ansible_facts['os_family'] == "FreeBSD"

10
ansible/roles/base/tasks/system.yml
View file

@ -52,6 +52,16 @@
when: ansible_facts['os_family'] == "Alpine"
notify: restart ssh
- name: Regenerate SSH host keys (FreeBSD)
ansible.builtin.shell:
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
args:
creates: /etc/ssh/ssh_host_ed25519_key
when: ansible_facts['os_family'] == "FreeBSD"
notify: restart ssh
- name: Create marker file to prevent re-running
ansible.builtin.file:
path: /etc/ssh/.host_keys_regenerated

36
ansible/roles/base/tasks/users.yml
View file

@ -44,6 +44,10 @@
loop_control:
label: "{{ item.name }}"
when: item.state | default('present') != 'absent'
register: user_result
failed_when:
- user_result is failed
- '"currently used by process" not in user_result.msg'
- name: Remove managed users marked absent
ansible.builtin.user:
@ -83,24 +87,38 @@
- item.1.type | default('github') == 'file'
- item.0.state | default('present') != 'absent'
- name: Install authorized keys from inline strings
ansible.posix.authorized_key:
user: "{{ item.0.name }}"
state: "{{ item.1.state | default('present') }}"
key: "{{ item.1.value }}"
manage_dir: "{{ item.1.manage_dir | default(true) }}"
exclusive: "{{ item.1.exclusive | default(false) }}"
loop: "{{ managed_users | default([]) | subelements('authorized_keys', skip_missing=True) }}"
loop_control:
label: "{{ item.0.name }} (string key)"
when:
- item.1.type | default('github') == 'string'
- item.0.state | default('present') != 'absent'
- name: Configure sudo for ansible user
ansible.builtin.template:
src: sudoers_ansible.j2
dest: /etc/sudoers.d/ansible
dest: "{{ sudoers_dir }}/ansible"
mode: '0440'
validate: 'visudo -cf %s'
validate: "{{ visudo_path }} -cf %s"
- name: Configure sudo for graham user
ansible.builtin.template:
src: sudoers_graham.j2
dest: /etc/sudoers.d/graham
dest: "{{ sudoers_dir }}/graham"
mode: '0440'
validate: 'visudo -cf %s'
validate: "{{ visudo_path }} -cf %s"
- name: Enable passwordless sudo for %sudo
- name: Enable passwordless sudo for admin group
ansible.builtin.lineinfile:
path: /etc/sudoers
path: "{{ sudoers_path }}"
state: present
regexp: '^%sudo'
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
validate: 'visudo -cf %s'
regexp: '^%{{ admin_group }}'
line: '{{ admin_group }} ALL=(ALL) NOPASSWD: ALL'
validate: "{{ visudo_path }} -cf %s"

10
ansible/roles/freebsd/tasks/main.yml Normal file
View file

@ -0,0 +1,10 @@
---
- name: Update pkg repository catalog
ansible.builtin.command: pkg update
register: pkg_update
changed_when: "'up-to-date' not in pkg_update.stdout"
- name: Upgrade installed packages
ansible.builtin.command: pkg upgrade -y
register: pkg_upgrade
changed_when: "'Your packages are up to date' not in pkg_upgrade.stdout"

3
ansible/roles/general/handlers/main.yml
View file

@ -1,3 +1,6 @@
---
- name: Re-export NFS shares
ansible.builtin.command: exportfs -ra
- name: apply hostname
ansible.builtin.command: hostnamectl set-hostname {{ short_hostname }}

29
ansible/roles/general/tasks/debian/hostname.yml Normal file
View file

@ -0,0 +1,29 @@
- name: Compute short hostname
ansible.builtin.set_fact:
short_hostname: "{{ hostname_override | default(inventory_hostname | split('.') | first) }}"
tags:
- network_hostname
- hostname
- name: "Set hostname (/etc/hosts)"
ansible.builtin.template:
src: templates/etc/hosts.j2
dest: "/etc/hosts"
owner: root
group: root
mode: '0644'
tags:
- network_hostname
- hostname
- name: "Set hostname (/etc/hostname)"
ansible.builtin.template:
src: templates/etc/hostname.j2
dest: "/etc/hostname"
owner: root
group: root
mode: '0644'
notify: apply hostname
tags:
- network_hostname
- hostname

22
ansible/roles/general/tasks/debian/network.yml
View file

@ -86,28 +86,6 @@
tags:
- network_interfaces
- name: "Set hostname (/etc/hosts)"
ansible.builtin.template:
src: templates/etc/hosts.j2
dest: "/etc/hosts"
owner: root
group: root
mode: '0644'
when: network.skip | default(False) != True
tags:
- network_hostname
- name: "Set hostname (/etc/hostname)"
ansible.builtin.template:
src: templates/etc/hostname.j2
dest: "/etc/hostname"
owner: root
group: root
mode: '0644'
when: network.skip | default(False) != True
tags:
- network_hostname
- name: "Restart networking"
ansible.builtin.systemd:
name: networking

6
ansible/roles/general/tasks/main.yml
View file

@ -11,6 +11,12 @@
tags:
- motd
- name: Configure hostname
ansible.builtin.import_tasks: debian/hostname.yml
when: ansible_facts['os_family'] == "Debian"
tags:
- hostname
- name: Configure networking
ansible.builtin.import_tasks: debian/network.yml
when: ansible_facts['os_family'] == "Debian"

2
ansible/roles/general/templates/etc/hostname.j2
View file

@ -1 +1 @@
{{ inventory_hostname | split(".") | first }}
{{ short_hostname }}

4
ansible/roles/general/templates/etc/hosts.j2
View file

@ -1,8 +1,8 @@
127.0.0.1 localhost
{% if network.loopback_in_hosts | default(True) %}
127.0.1.1 {{ inventory_hostname }} {{ inventory_hostname | split(".") | first }}
127.0.1.1 {{ inventory_hostname }} {{ short_hostname }}
{% else %}
{{ "%-15s" | format(ansible_facts['default_ipv4'].address) }} {{ inventory_hostname }} {{ inventory_hostname | split(".") | first }}
{{ "%-15s" | format(ansible_facts['default_ipv4'].address) }} {{ inventory_hostname }} {{ short_hostname }}
{% endif %}
# The following lines are desirable for IPv6 capable hosts

6
ansible/roles/inspircd/defaults/main.yml Normal file
View file

@ -0,0 +1,6 @@
---
inspircd_config_dir_map:
Debian: /etc/inspircd
FreeBSD: /usr/local/etc/inspircd
inspircd_config_dir: "{{ inspircd_config_dir_map.get(ansible_facts['os_family'], '/etc/inspircd') }}"

5
ansible/roles/inspircd/handlers/main.yml Normal file
View file

@ -0,0 +1,5 @@
---
- name: restart inspircd
ansible.builtin.service:
name: inspircd
state: restarted

55
ansible/roles/inspircd/tasks/main.yml Normal file
View file

@ -0,0 +1,55 @@
---
- name: Assert required vault variables are set
ansible.builtin.assert:
that:
- vault_inspircd_ca_oper_graham_password is defined
- vault_inspircd_ca_oper_andys_password is defined
- vault_inspircd_ca_link_us_sendpass is defined
- vault_inspircd_ca_link_us_recvpass is defined
- vault_inspircd_us_oper_graham_password is defined
- vault_inspircd_us_oper_andys_password is defined
- vault_inspircd_us_link_ca_sendpass is defined
- vault_inspircd_us_link_ca_recvpass is defined
- vault_inspircd_us_link_services_sendpass is defined
- vault_inspircd_us_link_services_recvpass is defined
fail_msg: >-
Missing one or more inspircd vault variables. See roles/inspircd/README.md
for the full list.
- name: Install inspircd (Debian)
ansible.builtin.apt:
name: inspircd
state: present
when: ansible_facts['os_family'] == "Debian"
notify: restart inspircd
- name: Install inspircd (FreeBSD)
community.general.pkgng:
name: inspircd
state: present
when: ansible_facts['os_family'] == "FreeBSD"
notify: restart inspircd
- name: Ensure inspircd config directory exists
ansible.builtin.file:
path: "{{ inspircd_config_dir }}"
state: directory
owner: root
group: root
mode: '0755'
- name: Deploy inspircd config files
ansible.builtin.template:
src: "{{ inventory_hostname }}/{{ item }}"
dest: "{{ inspircd_config_dir }}/{{ item }}"
owner: root
group: root
mode: '0644'
loop: "{{ inspircd_config_files }}"
notify: restart inspircd
- name: Ensure inspircd is started and enabled
ansible.builtin.service:
name: inspircd
state: started
enabled: true

20
ansible/roles/inspircd/templates/ca.manero.org/help.txt Normal file
View file

@ -0,0 +1,20 @@
Thanks for installing InspIRCd!
In order to get your server running you need to create config files. Examples
can be found at `/usr/share/doc/inspircd/examples`.
If you need any help with this then you can visit our support channel at
ircs://irc.teranova.net/inspircd, open a support discussion at
https://git.io/JIuYv, or refer to the the docs site:
https://docs.inspircd.org/4/configuration
https://docs.inspircd.org/4/modules
When you are done you can run the following command to start InspIRCd:
/usr/bin/inspircd
If you have installed from an official package you may need to prefix this
command with `sudo -g irc -u irc` to run as the correct group/user.
You can also use one of the helper scripts in `/usr/share/inspircd`.

183
ansible/roles/inspircd/templates/ca.manero.org/inspircd.conf Normal file
View file

@ -0,0 +1,183 @@
<define name="networkDomain" value="manero.org">
<define name="networkName" value="ManeroNet">
<define name="dir" value="/etc/inspircd">
<server
name="ca.&networkDomain;"
description="&networkName; IRC server"
network="&networkName;">
<admin
name="Andy Smith"
description="Supreme Overlord"
nick="andys"
email="andy@nsnw.ca">
<bind
address="*"
port="6697"
type="clients"
sslprofile="sslprofile"
defer="0"
ssl="gnutls"
free="no">
<include file="/etc/inspircd/irccloud.conf">
<include file="/etc/inspircd/thelounge.conf">
<connect
name="main"
allow="*"
maxchans="100"
timeout="20"
pingfreq="2m"
hardsendq="1M"
softsendq="10240"
recvq="10K"
threshold="10"
commandrate="1000"
fakelag="yes"
localmax="0"
globalmax="0"
resolvehostnames="yes"
useident="no"
limit="5000"
modes="+cx">
<cidr
ipv4clone="32"
ipv6clone="128">
<include file="/etc/inspircd/opers.conf">
<files motd="/etc/inspircd/motd.txt">
<dns
timeout="5">
<maxlist chan="*" limit="100">
<options
prefixquit="Quit: "
suffixquit=""
prefixpart="&quot;"
suffixpart="&quot;"
syntaxhints="no"
cyclehostsfromuser="no"
announcets="yes"
allowmismatch="no"
defaultbind="auto"
maskinlist="yes"
maskintopic="yes"
pingwarning="15"
serverpingfreq="1m"
splitwhois="no"
defaultmodes="not"
xlinemessage="You're banned! Email irc@&networkDomain; with the ERROR line below for help."
xlinequit="%fulltype%: %reason%"
modesinlist="opers"
extbanformat="name"
exemptchanops="filter:o nickflood:o nonick:v regmoderated:o"
invitebypassmodes="yes"
nosnoticestack="no">
<performance
netbuffersize="10240"
somaxconn="128"
softlimit="12800"
clonesonconnect="yes"
timeskipwarn="2s"
quietbursts="yes">
<security
announceinvites="dynamic"
hideservices="no"
flatlinks="no"
hidekills=""
hideservicekills="yes"
hidesplits="no"
maxtargets="20"
customversion=""
restrictbannedusers="yes"
genericoper="no"
userstats="Pu">
<limits
maxaway="200"
maxchan="60"
maxhost="64"
maxuser="10"
maxkey="30"
maxkick="300"
maxmodes="20"
maxnick="30"
maxquit="300"
maxreal="130"
maxtopic="330">
<log method="file"
# level="normal"
level="debug"
type="* -USERINPUT -USEROUTPUT"
target="inspircd.log">
<whowas
groupsize="10"
maxgroups="10000"
maxkeep="7d"
nickupdate="yes">
<badhost host="root@*" reason="Don't IRC as root!">
<badhost host="*@198.51.100.0/24" reason="This subnet is bad.">
<badnick nick="ChanServ" reason="Reserved For Services">
<badnick nick="NickServ" reason="Reserved For Services">
<badnick nick="OperServ" reason="Reserved For Services">
<badnick nick="MemoServ" reason="Reserved For Services">
<exception
host="*@serverop.com"
reason="Oper's hostname">
<insane
hostmasks="no"
ipmasks="no"
nickmasks="no"
trigger="95.5">
<sslprofile name="sslprofile"
provider="gnutls"
certfile="/etc/inspircd/fullchain.cer"
keyfile="/etc/inspircd/ca.manero.org.key"
tlsv12="yes">
<customprefix name="founder"
letter="q"
prefix="~"
rank="50000"
ranktoset="50000"
ranktounset="50000"
depriv="yes">
<customprefix name="admin"
letter="a"
prefix="&amp;"
rank="40000"
ranktoset="50000"
ranktounset="50000"
depriv="yes">
<customprefix name="halfop"
letter="h"
prefix="%"
rank="20000"
ranktoset="30000"
ranktounset="30000"
depriv="yes">
<cloak method="nickname"
case="preserve"
class=""
invalidchar="strip"
prefix=""
suffix=".manero.org">
<include file="/etc/inspircd/modules.conf">
<include file="/etc/inspircd/services/atheme.conf">
<include file="/etc/inspircd/links.conf">

1079
ansible/roles/inspircd/templates/ca.manero.org/inspircd.example.conf Normal file
View file

File diff suppressed because it is too large Load diff

31
ansible/roles/inspircd/templates/ca.manero.org/irccloud.conf Normal file
View file

@ -0,0 +1,31 @@
# This file contains connect classes which are used by IRCCloud users.
# See https://www.irccloud.com for more information on IRCCloud and
# https://www.irccloud.com/networks for more information on supporting
# IRCCloud on your network.
<connect name="IRCCloud"
parent="main"
globalmax="100"
localmax="100"
useconnectban="no"
useconnflood="no"
usednsbl="no">
<connect name="IRCCloud (IPv4)"
parent="IRCCloud"
allow="5.254.36.56/29 5.254.36.104/29"
uniqueusername="yes">
# This is not typically needed as each user has their own IPv6 but if you have
# <cidr:ipv6clone> set to a value lower than 128 you will need to enable it.
#<connect name="IRCCloud (IPv6)"
# parent="IRCCloud"
# allow="2a03:5180:f::/62 2a03:5180:f:4::/63 2a03:5180:f:6::/64">
# IRCCloud IPv4 users use a shared IPv4 address which means that some clients
# may have trouble banning them. To work around this you can use the cloak_user
# module to copy the user identifier from the username to the hostname.
#<cloak method="username"
# class="IRCCloud (IPv4),IRCCloud (IPv6)"
# suffix=".irccloud.com">

19
ansible/roles/inspircd/templates/ca.manero.org/links.conf Normal file
View file

@ -0,0 +1,19 @@
<bind address="" port="7001" type="servers" sslprofile="sslprofile">
<link
name="us.manero.org"
ipaddr="100.93.123.98"
port="7001"
allowmask="100.93.123.98/32"
timeout="1m"
sslprofile="sslprofile"
bind=""
statshidden="no"
hidden="no"
sendpass="{{ vault_inspircd_ca_link_us_sendpass }}"
recvpass="{{ vault_inspircd_ca_link_us_recvpass }}">
<uline server="services.manero.org" silent="yes">
<autoconnect period="1m" server="us.manero.org">

159
ansible/roles/inspircd/templates/ca.manero.org/modules.conf Normal file
View file

@ -0,0 +1,159 @@
<module name="alias">
<module name="allowinvite">
<module name="chancreate">
<module name="check">
<module name="chghost">
<module name="chgident">
<module name="chgname">
#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
# Cloak module: Adds user mode x (cloak) which allows user hostnames to
# be hidden. This module does not provide any cloak methods by itself.
# You should also load another module like cloak_account or cloak_sha256.
#
# In order to have users automatically cloaked on connect you should
# load the conn_umodes module and add "x" to <connect:modes>.
<module name="cloak">
<module name="cloak_user">
#<include file="&dir;/codepages/ascii.conf">
#<include file="&dir;/codepages/iso-8859-1.conf">
#<include file="&dir;/codepages/iso-8859-2.conf">
#<include file="&dir;/codepages/rfc1459.conf">
#<include file="&dir;/codepages/strict-rfc1459.conf">
<module name="customprefix">
<module name="hidechans">
<module name="cap">
#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
# IRCv3 module: Provides the IRCv3 account-notify, away-notify,
# extended-join, and standard-replies extensions. These are optional
# enhancements to the client-to-server protocol. An extension is only
# active for a client when the client specifically requests it, so this
# module needs the cap module to work.
#
# Further information on these extensions can be found at the IRCv3
# working group website:
# https://ircv3.net/irc/
#
<module name="ircv3">
# The following block can be used to control which extensions are
# enabled. Note that extended-join can be incompatible with delayjoin
# and host cycling.
#<ircv3 accountnotify="yes"
# awaynotify="yes"
# extendedjoin="yes"
<module name="ircv3_accounttag">
<module name="ircv3_batch">
<module name="ircv3_capnotify">
<module name="ircv3_chghost">
<module name="ircv3_ctctags">
<module name="ircv3_echomessage">
<module name="ircv3_invitenotify">
<module name="ircv3_labeledresponse">
<module name="ircv3_msgid">
<module name="ircv3_servertime">
#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
# IRCv3 Strict Transport Security module: Provides the sts IRCv3
# extension which allows clients connecting insecurely to upgrade their
# connections to TLS.
<module name="ircv3_sts">
<sts host="ca.manero.org" port="6697" duration="1d">
#
# If using the ircv3_sts module you MUST define a STS policy to send
# to clients using the <sts> tag. This tag takes the following
# attributes:
#
# host - A glob match for the SNI hostname to apply this policy to.
# duration - The amount of time that the policy lasts for. Defaults to
# five minutes by default. You should raise this to a month
# or two once you know that your config is valid.
# port - The port on which TLS connections to the server are being
# accepted. You MUST have a CA-verified certificate on this
# port. Self signed certificates are not acceptable.
# preload - Whether client developers can include your certificate in
# preload lists.
#
# <sts host="*.com" duration="5m" port="6697" preload="yes">
<module name="messageflood">
#
# The weight to give each message type. TAGMSGs are considered to be
# 1/5 of a NOTICE or PRIVMSG to avoid users being accidentally flooded
# out of a channel by automatic client features such as typing
# notifications.
#<messageflood message="Message flood detected (trigger is %messages% messages in %duration%)"
# extended="yes"
# notice="1.0"
# privmsg="1.0"
# tagmsg="0.2">
<module name="monitor">
<monitor maxentries="30">
<module name="multiprefix">
<module name="nokicks">
<passforward
# nick: The nick of the service to forward passwords to.
nick="NickServ"
# forwardmsg: Message to send to users when forwarding their
# password. You can use the following variables in this message:
#
# %nick% The nickname of the authenticating user.
# %nickrequired% The nickname of the service to forward to (see above).
# %pass% The password to forward to services.
# %user% The username of the authenticating user.
forwardmsg="NOTICE %nick% :*** Forwarding password to %nickrequired%"
# cmd: The message to send to forward passwords to services.
cmd="SQUERY %nickrequired% :IDENTIFY %nick% %pass%">
<module name="sajoin">
<module name="samode">
<module name="sanick">
<module name="satopic">
<module name="services">
<servicesintegration accountoverrideshold="yes"
disablemodes="no">
<module name="sethost">
<module name="setident">
<module name="setidle">
<module name="setname">
<setname notifyopers="yes">
<module name="sha1">
<module name="sha2">
<module name="showfile">
<module name="showwhois">
<showwhois opersonly="yes">
<module name="shun">
<module name="spanningtree">
<include file="&dir;/links.conf">
#<module name="ssl_openssl">
<module name="stripcolor">
<module name="vhost">
<module name="services_account">
<module name="ssl_gnutls">
<module name="bcrypt">
<bcrypt rounds="10">
<module name="password_hash">
<mkpasswd operonly="no">
<module name="knock">
<knock notify="notice">
<module name="swhois">
<module name="sakick">
<module name="autoop">
<module name="sslmodes">
<module name="sslinfo">
<module name="override">
<module name="sasl">
<sasl requiressl="no"
target="services.manero.org">
<module name="customprefix">
<module name="hideoper">
<hideoper mode="yes">

2724
ansible/roles/inspircd/templates/ca.manero.org/modules.example.conf Normal file
View file

File diff suppressed because it is too large Load diff

32
ansible/roles/inspircd/templates/ca.manero.org/motd.txt Normal file
View file

@ -0,0 +1,32 @@
-------------------------------------------------------------------
XWXWXWXWXWXWXWXW WXWXWXWXWXWXWXWX
WXWXWXWXWXWXWXWX A XWXWXWXWXWXWXWXW
XWXWXWXWXWXWXWXW AWA WXWXWXWXWXWXWXWX
WXWXWXWXWXWXWXWX AA AWXWA AA XWXWXWXWXWXWXWXW
XWXWXWXWXWXWXWXW VWXWXWXWXWV WXWXWXWXWXWXWXWX
WXWXWXWXWXWXWXWX AA VWXWXWXWV AA XWXWXWXWXWXWXWXW
XWXWXWXWXWXWXWXW VWXWXWXA VWXWXWV AXWXWXWV WXWXWXWXWXWXWXWX
WXWXWXWXWXWXWXWX XWXWXWXWXWXWXWXWXWXWXWXWX XWXWXWXWXWXWXWXW
XWXWXWXWXWXWXWXW AXWXWXWXWXWXWXWXWXWXWXWXWXWXA WXWXWXWXWXWXWXWX
WXWXWXWXWXWXWXWX VXWXWXWXWXWXWXWXWXWXWXV XWXWXWXWXWXWXWXW
XWXWXWXWXWXWXWXW VXWXWXWXWXWXWXWXV WXWXWXWXWXWXWXWX
WXWXWXWXWXWXWXWX XWXWXWXWXWXWX XWXWXWXWXWXWXWXW
XWXWXWXWXWXWXWXW AXWXWXWXWXWXWXWXA WXWXWXWXWXWXWXWX
WXWXWXWXWXWXWXWX I XWXWXWXWXWXWXWXW
XWXWXWXWXWXWXWXW I WXWXWXWXWXWXWXWX
WXWXWXWXWXWXWXWX I XWXWXWXWXWXWXWXW
XWXWXWXWXWXWXWXW WXWXWXWXWXWXWXWX
-------------------------------------------------------------------
This server is hosted in Canada, by andys
███╗ ███╗ █████╗ ███╗ ██╗███████╗██████╗ ██████╗
████╗ ████║██╔══██╗████╗ ██║██╔════╝██╔══██╗██╔═══██╗
██╔████╔██║███████║██╔██╗ ██║█████╗ ██████╔╝██║ ██║
██║╚██╔╝██║██╔══██║██║╚██╗██║██╔══╝ ██╔══██╗██║ ██║
██║ ╚═╝ ██║██║ ██║██║ ╚████║███████╗██║ ██║╚██████╔╝
╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═══╝╚══════╝╚═╝ ╚═╝ ╚═════╝
Welcome to the manero memorial irc network

43
ansible/roles/inspircd/templates/ca.manero.org/opers.conf Normal file
View file

@ -0,0 +1,43 @@
<class name="SACommands" commands="SAJOIN SAPART SANICK SAQUIT SATOPIC SAKICK SAMODE OJOIN">
<class name="ServerLink" commands="CONNECT SQUIT RCONNECT RSQUIT MKPASSWD ALLTIME SWHOIS LOCKSERV UNLOCKSERV" usermodes="*" chanmodes="*" privs="servers/auspex" snomasks="Cc">
<class name="BanControl" commands="KILL GLINE KLINE ZLINE QLINE ELINE TLINE RLINE CHECK NICKLOCK NICKUNLOCK SHUN CLONES CBAN" usermodes="*" chanmodes="*" snomasks="Xx">
<class name="OperChat" commands="WALLOPS GLOBOPS" usermodes="*" chanmodes="*" privs="users/mass-message" snomasks="Gg">
<class name="HostCloak" commands="SETHOST SETIDENT SETIDLE CHGNAME CHGHOST CHGIDENT" usermodes="*" chanmodes="*" privs="users/auspex">
<class
name="Shutdown"
commands="DIE RESTART REHASH LOADMODULE UNLOADMODULE RELOADMODULE GLOADMODULE GUNLOADMODULE GRELOADMODULE"
privs="users/auspex channels/auspex servers/auspex users/mass-message users/flood/no-throttle users/flood/increased-buffers"
usermodes="*"
chanmodes="*"
snomasks="*">
<type
# name: Name of the type. Used in actual server operator accounts below.
name="NetAdmin"
# classes: Classes (blocks above) that this type belongs to.
classes="SACommands OperChat BanControl HostCloak Shutdown ServerLink" # vhost: Host that opers of this type get when they log in (oper up). This is optional.
#vhost="netadmin.omega.example.org"
# maxchans: Maximum number of channels opers of this type can be in at once.
maxchans="60"
# modes: User modes besides +o that are set on an oper of this type # when they oper up. Used for snomasks and other things.
# Requires the opermodes module to be loaded.
modes="+s +cCqQ">
<oper
name="gmc"
hash="bcrypt"
password="{{ vault_inspircd_ca_oper_graham_password }}"
host="*@*" sslonly="yes" vhost="gmc.texas.ragnar"
type="NetAdmin">
<oper
name="andys"
hash="bcrypt"
password="{{ vault_inspircd_ca_oper_andys_password }}"
host="*@*"
sslonly="yes"
type="NetAdmin">

52
ansible/roles/inspircd/templates/ca.manero.org/services-atheme.conf Normal file
View file

@ -0,0 +1,52 @@
# This file contains aliases and nickname reservations which are used
# by Atheme. See https://atheme.github.io/atheme.html for more
# information on Atheme.
# This file inherits from the generic config to avoid repetition.
<include file="&dir.example;/services/generic.example.conf">
# Long hand aliases for services pseudoclients.
<alias text="ALIS" replace="PRIVMSG $requirement :$2-" requires="ALIS" service="yes">
<alias text="CHANFIX" replace="PRIVMSG $requirement :$2-" requires="ChanFix" service="yes">
<alias text="GAMESERV" replace="PRIVMSG $requirement :$2-" requires="GameServ" service="yes">
<alias text="GROUPSERV" replace="PRIVMSG $requirement :$2-" requires="GroupServ" service="yes">
<alias text="HELPSERV" replace="PRIVMSG $requirement :$2-" requires="HelpServ" service="yes">
<alias text="INFOSERV" replace="PRIVMSG $requirement :$2-" requires="InfoServ" service="yes">
<alias text="PROXYSCAN" replace="PRIVMSG $requirement :$2-" requires="Proxyscan" service="yes" operonly="yes">
<alias text="RPGSERV" replace="PRIVMSG $requirement :$2-" requires="RPGServ" service="yes">
# Short hand aliases for services pseudoclients.
<alias text="CF" replace="PRIVMSG $requirement :$2-" requires="ChanFix" service="yes">
<alias text="GS" replace="PRIVMSG $requirement :$2-" requires="GroupServ" service="yes">
<alias text="IS" replace="PRIVMSG $requirement :$2-" requires="InfoServ" service="yes">
<alias text="LS" replace="PRIVMSG $requirement :$2-" requires="ALIS" service="yes">
<alias text="PS" replace="PRIVMSG $requirement :$2-" requires="Proxyscan" service="yes" operonly="yes">
<alias text="RS" replace="PRIVMSG $requirement :$2-" requires="RPGServ" service="yes">
# These short hand aliases conflict with other pseudoclients. You can enable
# them but you will need to comment out the uncommented ones above first,
#<alias text="GS" replace="PRIVMSG $requirement :$2-" requires="GameServ" service="yes">
#<alias text="HS" replace="PRIVMSG $requirement :$2-" requires="HelpServ" service="yes">
# Prevent clients from using the nicknames of services pseudoclients.
<badnick nick="ALIS" reason="Reserved for a network service">
<badnick nick="ChanFix" reason="Reserved for a network service">
<badnick nick="GameServ" reason="Reserved for a network service">
<badnick nick="GroupServ" reason="Reserved for a network service">
<badnick nick="HelpServ" reason="Reserved for a network service">
<badnick nick="InfoServ" reason="Reserved for a network service">
<badnick nick="Proxyscan" reason="Reserved for a network service">
<badnick nick="RPGServ" reason="Reserved for a network service">
<badnick nick="SaslServ" reason="Reserved for a network service">
# Exempt services pseudoclients from filters.
<exemptfromfilter target="ALIS">
<exemptfromfilter target="ChanFix">
<exemptfromfilter target="GameServ">
<exemptfromfilter target="GroupServ">
<exemptfromfilter target="HelpServ">
<exemptfromfilter target="InfoServ">
<exemptfromfilter target="Proxyscan">
<exemptfromfilter target="RPGServ">
<exemptfromfilter target="SaslServ">

33
ansible/roles/inspircd/templates/ca.manero.org/thelounge.conf Normal file
View file

@ -0,0 +1,33 @@
# This file contains connect classes which are used by IRCCloud users.
# See https://www.irccloud.com for more information on IRCCloud and
# https://www.irccloud.com/networks for more information on supporting
# IRCCloud on your network.
<connect name="TheLounge"
parent="main"
globalmax="100"
localmax="100"
useconnectban="no"
useconnflood="no"
usednsbl="no">
<connect name="TheLounge (IPv4)"
parent="TheLounge"
allow="167.114.209.151/32 158.69.124.210/32 192.99.44.61/32 172.16.0.0/12"
globalmax="100"
localmax="100"
uniqueusername="yes">
# This is not typically needed as each user has their own IPv6 but if you have
# <cidr:ipv6clone> set to a value lower than 128 you will need to enable it.
#<connect name="IRCCloud (IPv6)"
# parent="IRCCloud"
# allow="2a03:5180:f::/62 2a03:5180:f:4::/63 2a03:5180:f:6::/64">
# IRCCloud IPv4 users use a shared IPv4 address which means that some clients
# may have trouble banning them. To work around this you can use the cloak_user
# module to copy the user identifier from the username to the hostname.
#<cloak method="username"
# class="IRCCloud (IPv4),IRCCloud (IPv6)"
# suffix=".irccloud.com">

80
ansible/roles/inspircd/templates/us.manero.org/filter.conf Normal file
View file

@ -0,0 +1,80 @@
# Configuration file for the filter module
# The tags for this module are formatted as follows:
#
# <keyword pattern="any glob pattern here"
# reason="reason for filtering"
# action="action to take"
# flags="filter flags"
# duration="optional duration of the G-line, Z-line or shun">
#
# Valid actions for 'action' are:
#
# warn This allows the line and sends out a notice to all opers
# with +s.
#
# block This blocks the line, sends out a notice to all opers with
# +s and informs the user that their message was blocked.
#
# silent This blocks the line only, and informs the user that their
# message was blocked, but does not notify opers.
#
# none This action causes nothing to be done except logging. This
# is the default action if none is specified.
#
# kill This disconnects the user, with the 'reason' parameter as
# the kill reason.
#
# gline G-line the user for 'duration' length of time. Durations may
# be specified using the notation 1y2w3d4h5m6s in a similar way to
# other G-lines, omitting the duration or setting it to 0 makes
# any G-lines set by this filter be permanent.
#
# zline Z-line the user for 'duration' length of time. Durations may
# be specified using the notation 1y2w3d4h5m6s in a similar way to
# other Z-lines, omitting the duration or setting it to 0 makes
# any Z-lines set by this filter be permanent.
#
# shun Shun the user for 'duration' length of time. Durations may
# be specified using the notation 1y2w3d4h5m6s in a similar way to
# other X-lines, omitting the duration or setting it to 0 makes
# any shuns set by this filter be permanent.
# Requires the shun module to be loaded.
#
# You can add filters from IRC using the /FILTER command. If you do this, they
# will be set globally to your entire network.
#
# Valid characters for 'flags' are one or more of:
#
# p: Block private and channel messages
# n: Block private and channel notices
# P: Block part messages
# q: Block quit messages
# o: Don't match against opers
# r: Don't match against registered users
# c: Strip color codes from text before trying to match
# *: Represents all of the above flags except r
# -: Does nothing, a no-op for when you do not want to specify any flags
# Example filters:
#
# <keyword pattern="*qwerty*" reason="You qwertied!" action="block" flags="pn">
# <keyword pattern="*killmenow*" reason="As you request." action="kill" flags="*">
# <keyword pattern="*blah*" reason="Don't blah!" action="gline" duration="1d6h" flags="-">
# An example regexp filter:
#
# <keyword pattern="^blah.*?$" reason="Don't blah!" action="gline" duration="1d6h" flags="pnPq">
# You may specify specific channels that are exempt from being filtered:
#<exemptfromfilter target="#opers">
#<exemptfromfilter target="#help">
# You can also exempt messages from being filtered if they are sent to
# specific nicks.
# Example that exempts all messages sent *to* NickServ:
#<exemptfromfilter target="NickServ">
# Note that messages *from* services are never subject to filtering;
# <exemptfromfilter> tags are only for exempting messages sent *to* the
# configured targets.

1137
ansible/roles/inspircd/templates/us.manero.org/help.conf Normal file
View file

File diff suppressed because it is too large Load diff

20
ansible/roles/inspircd/templates/us.manero.org/help.txt Normal file
View file

@ -0,0 +1,20 @@
Thanks for installing InspIRCd!
In order to get your server running you need to create config files. Examples
can be found at `/usr/local/etc/inspircd/examples`.
If you need any help with this then you can visit our support channel at
ircs://irc.teranova.net/inspircd, open a support discussion at
https://git.io/JIuYv, or refer to the the docs site:
https://docs.inspircd.org/4/configuration
https://docs.inspircd.org/4/modules
When you are done you can run the following command to start InspIRCd:
/usr/local/bin/inspircd
If you have installed from an official package you may need to prefix this
command with `sudo -g nobody -u nobody` to run as the correct group/user.
You can also use one of the helper scripts in `/usr/local/libexec/inspircd`.

194
ansible/roles/inspircd/templates/us.manero.org/inspircd.conf Normal file
View file

@ -0,0 +1,194 @@
<define name="networkDomain" value="manero.org">
<define name="networkName" value="ManeroNet">
<define name="dir" value="/usr/local/etc/inspircd">
<server
name="us.&networkDomain;"
description="&networkName; IRC server"
network="&networkName;">
<admin
name="Graham McIntire"
description="Supreme Overlord"
nick="gmc"
email="graham@mcintire.me">
<bind
address="*"
port="6697"
type="Clients"
sslprofile="ssl"
defer="0"
free="no">
<include file="/usr/local/etc/inspircd/irccloud.conf">
<connect
name="main"
allow="*"
maxchans="100"
timeout="20"
pingfreq="2m"
hardsendq="1M"
softsendq="10240"
recvq="10K"
threshold="10"
commandrate="1000"
fakelag="yes"
localmax="3"
globalmax="3"
resolvehostnames="yes"
useident="no"
limit="5000"
modes="+cx">
<cidr
ipv4clone="32"
ipv6clone="128">
<include file="/usr/local/etc/inspircd/opers.conf">
<files motd="/usr/local/etc/inspircd/motd.txt">
<dns
timeout="5">
<maxlist chan="*" limit="100">
<options
prefixquit="Quit: "
suffixquit=""
prefixpart="&quot;"
suffixpart="&quot;"
syntaxhints="no"
cyclehostsfromuser="no"
announcets="yes"
allowmismatch="no"
defaultbind="auto"
maskinlist="yes"
maskintopic="yes"
pingwarning="15"
serverpingfreq="1m"
splitwhois="no"
defaultmodes="not"
xlinemessage="You're banned! Email irc@&networkDomain; with the ERROR line below for help."
xlinequit="%fulltype%: %reason%"
modesinlist="opers"
extbanformat="name"
exemptchanops="filter:o nickflood:o nonick:v regmoderated:o"
invitebypassmodes="yes"
nosnoticestack="no">
<performance
netbuffersize="10240"
somaxconn="128"
softlimit="12800"
clonesonconnect="yes"
timeskipwarn="2s"
quietbursts="yes">
<security
announceinvites="dynamic"
hideservices="no"
flatlinks="no"
hidekills=""
hideservicekills="yes"
hidesplits="no"
maxtargets="20"
customversion=""
restrictbannedusers="yes"
genericoper="no"
userstats="Pu">
<limits
maxaway="200"
maxchan="60"
maxhost="64"
maxuser="10"
maxkey="30"
maxkick="300"
maxmodes="20"
maxnick="30"
maxquit="300"
maxreal="130"
maxtopic="330">
<log method="file"
# level="normal"
level="debug"
type="* -USERINPUT -USEROUTPUT"
target="inspircd.log">
<whowas
groupsize="10"
maxgroups="10000"
maxkeep="7d"
nickupdate="yes">
<badhost host="root@*" reason="Don't IRC as root!">
<badhost host="*@198.51.100.0/24" reason="This subnet is bad.">
<badnick nick="ChanServ" reason="Reserved For Services">
<badnick nick="NickServ" reason="Reserved For Services">
<badnick nick="OperServ" reason="Reserved For Services">
<badnick nick="MemoServ" reason="Reserved For Services">
<exception
host="*@serverop.com"
reason="Oper's hostname">
<insane
hostmasks="no"
ipmasks="no"
nickmasks="no"
trigger="95.5">
<sslprofile name="ssl"
provider="openssl"
ca="/usr/local/etc/inspircd/ca.pem"
certfile="/usr/local/etc/inspircd/fullchain.cer"
keyfile="/usr/local/etc/inspircd/us.manero.org.key"
tlsv12="yes">
<customprefix name="founder"
letter="q"
prefix="~"
rank="50000"
ranktoset="50000"
ranktounset="50000"
depriv="yes">
<customprefix name="admin"
letter="a"
prefix="&amp;"
rank="40000"
ranktoset="50000"
ranktounset="50000"
depriv="yes">
<customprefix name="halfop"
letter="h"
prefix="%"
rank="20000"
ranktoset="30000"
ranktounset="30000"
depriv="yes">
<cloak method="nickname"
case="preserve"
class=""
invalidchar="strip"
prefix=""
suffix=".manero.org">
<class name="bots"
commands="PRIVMSG NOTICE JOIN PART QUIT NICK MODE TOPIC KICK BAN UNBAN WHO WHOIS LIST NAMES"
usermodes="iws"
chanmodes="ntis"
privs="users/flood/no-throttle users/flood/increased-buffers">
<type name="BotOper"
classes="bots"
host="204.110.191.210"
maxchans="9999999">
<include file="/usr/local/etc/inspircd/modules.conf">
<include file="/usr/local/etc/inspircd/services/atheme.conf">
<include file="/usr/local/etc/inspircd/links.conf">

30
ansible/roles/inspircd/templates/us.manero.org/irccloud.conf Normal file
View file

@ -0,0 +1,30 @@
# This file contains connect classes which are used by IRCCloud users.
# See https://www.irccloud.com for more information on IRCCloud and
# https://www.irccloud.com/networks for more information on supporting
# IRCCloud on your network.
<connect name="IRCCloud"
parent="main"
globalmax="100"
localmax="100"
useconnectban="no"
useconnflood="no"
usednsbl="no">
<connect name="IRCCloud (IPv4)"
parent="IRCCloud"
allow="5.254.36.56/29 5.254.36.104/29"
uniqueusername="yes">
# This is not typically needed as each user has their own IPv6 but if you have
# <cidr:ipv6clone> set to a value lower than 128 you will need to enable it.
#<connect name="IRCCloud (IPv6)"
# parent="IRCCloud"
# allow="2a03:5180:f::/62 2a03:5180:f:4::/63 2a03:5180:f:6::/64">
# IRCCloud IPv4 users use a shared IPv4 address which means that some clients
# may have trouble banning them. To work around this you can use the cloak_user
# module to copy the user identifier from the username to the hostname.
#<cloak method="username"
# class="IRCCloud (IPv4),IRCCloud (IPv6)"
# suffix=".irccloud.com">

42
ansible/roles/inspircd/templates/us.manero.org/iso-8859-1.conf Normal file
View file

@ -0,0 +1,42 @@
# This file contains ISO 8859-1 codepage rules for use with the codepage module.
<codepage name="iso-8859-1" charset="iso-8859-1">
<cpchars begin="192" end="214" front="yes"> # ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ
<cpchars begin="216" end="246" front="yes"> # ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö
<cpchars begin="248" end="255" front="yes"> # øùúûüýþÿ
<cpcase lower="83" upper="223"> # ß => S
<cpcase lower="192" upper="224"> # à => À
<cpcase lower="193" upper="225"> # á => Á
<cpcase lower="194" upper="226"> # â => Â
<cpcase lower="195" upper="227"> # ã => Ã
<cpcase lower="196" upper="228"> # ä => Ä
<cpcase lower="197" upper="229"> # å => Å
<cpcase lower="198" upper="230"> # æ => Æ
<cpcase lower="199" upper="231"> # ç => Ç
<cpcase lower="200" upper="232"> # è => È
<cpcase lower="201" upper="233"> # é => É
<cpcase lower="202" upper="234"> # ê => Ê
<cpcase lower="203" upper="235"> # ë => Ë
<cpcase lower="204" upper="236"> # ì => Ì
<cpcase lower="205" upper="237"> # í => Í
<cpcase lower="206" upper="238"> # î => Î
<cpcase lower="207" upper="239"> # ï => Ï
<cpcase lower="208" upper="240"> # ð => Ð
<cpcase lower="209" upper="241"> # ñ => Ñ
<cpcase lower="210" upper="242"> # ò => Ò
<cpcase lower="211" upper="243"> # ó => Ó
<cpcase lower="212" upper="244"> # ô => Ô
<cpcase lower="213" upper="245"> # õ => Õ
<cpcase lower="214" upper="246"> # ö => Ö
<cpcase lower="216" upper="248"> # ø => Ø
<cpcase lower="217" upper="249"> # ù => Ù
<cpcase lower="218" upper="250"> # ú => Ú
<cpcase lower="219" upper="251"> # û => Û
<cpcase lower="220" upper="252"> # ü => Ü
<cpcase lower="221" upper="253"> # ý => Ý
<cpcase lower="222" upper="254"> # þ => Þ
# Include the ASCII rules to avoid duplication.
<include file="&dir.example;/codepages/ascii.example.conf">

60
ansible/roles/inspircd/templates/us.manero.org/iso-8859-2.conf Normal file
View file

@ -0,0 +1,60 @@
# This file contains ISO 8859-2 codepage rules for use with the codepage module.
<codepage name="iso-8859-2" charset="iso-8859-2">
<cpchars index="161" front="yes"> # Ą
<cpchars index="163" front="yes"> # Ł
<cpchars begin="165" end="166" front="yes"> # ĽŚ
<cpchars begin="169" end="172" front="yes"> # ŠŞŤŹ
<cpchars begin="174" end="175" front="yes"> # ŽŻ
<cpchars index="177" front="yes"> # ą
<cpchars index="179" front="yes"> # ł
<cpchars begin="181" end="182" front="yes"> # ľś
<cpchars begin="185" end="188" front="yes"> # šşťź
<cpchars begin="190" end="214" front="yes"> # žżŔÁÂĂÄĹĆÇČÉĘËĚÍÎĎĐŃŇÓÔŐÖ
<cpchars begin="216" end="246" front="yes"> # ŘŮÚŰÜÝŢßŕáâăäĺćçčéęëěíîďđńňóôőö
<cpchars begin="248" end="254" front="yes"> # řůúűüýţ
<cpcase lower="177" upper="161"> # ą => Ą
<cpcase lower="179" upper="163"> # ł => Ł
<cpcase lower="181" upper="165"> # ľ => Ľ
<cpcase lower="182" upper="166"> # ś => Ś
<cpcase lower="185" upper="169"> # š => Š
<cpcase lower="186" upper="170"> # ş => Ş
<cpcase lower="187" upper="171"> # ť => Ť
<cpcase lower="188" upper="172"> # ź => Ź
<cpcase lower="190" upper="174"> # ž => Ž
<cpcase lower="191" upper="175"> # ż => Ż
<cpcase lower="224" upper="192"> # ŕ => Ŕ
<cpcase lower="225" upper="193"> # á => Á
<cpcase lower="226" upper="194"> # â => Â
<cpcase lower="227" upper="195"> # ă => Ă
<cpcase lower="228" upper="196"> # ä => Ä
<cpcase lower="229" upper="197"> # ĺ => Ĺ
<cpcase lower="230" upper="198"> # ć => Ć
<cpcase lower="231" upper="199"> # ç => Ç
<cpcase lower="232" upper="200"> # č => Č
<cpcase lower="233" upper="201"> # é => É
<cpcase lower="234" upper="202"> # ę => Ę
<cpcase lower="235" upper="203"> # ë => Ë
<cpcase lower="236" upper="204"> # ě => Ě
<cpcase lower="237" upper="205"> # í => Í
<cpcase lower="238" upper="206"> # î => Î
<cpcase lower="239" upper="207"> # ď => Ď
<cpcase lower="240" upper="208"> # đ => Đ
<cpcase lower="241" upper="209"> # ń => Ń
<cpcase lower="242" upper="210"> # ň => Ň
<cpcase lower="243" upper="211"> # ó => Ó
<cpcase lower="244" upper="212"> # ô => Ô
<cpcase lower="245" upper="213"> # ő => Ő
<cpcase lower="246" upper="214"> # ö => Ö
<cpcase lower="248" upper="216"> # ř => Ř
<cpcase lower="249" upper="217"> # ů => Ů
<cpcase lower="250" upper="218"> # ú => Ú
<cpcase lower="251" upper="219"> # ű => Ű
<cpcase lower="252" upper="220"> # ü => Ü
<cpcase lower="253" upper="221"> # ý => Ý
<cpcase lower="254" upper="222"> # ţ => Ţ
# Include the ASCII rules to avoid duplication.
<include file="&dir.example;/codepages/ascii.example.conf">

46
ansible/roles/inspircd/templates/us.manero.org/links.conf Normal file
View file

@ -0,0 +1,46 @@
<bind address="" port="7000" type="servers">
#<bind address="" port="7001" type="servers" ssl="ssl">
<bind
address="*"
port="7001"
type="servers"
sslprofile="ssl">
<link
name="ca.manero.org"
ipaddr="100.82.143.128"
port="7001"
allowmask="100.82.143.128/32"
timeout="1m"
sslprofile="ssl"
bind=""
statshidden="no"
hidden="no"
sendpass="{{ vault_inspircd_us_link_ca_sendpass }}"
recvpass="{{ vault_inspircd_us_link_ca_recvpass }}">
#<link
# name="irc.nsnw.ca"
# ipaddr="167.114.169.143"
# port="7001"
# allowmask="167.114.169.143/32"
# timeout="1m"
# ssl="gnutls"
# sslprofile="gnutls"
# bind=""
# statshidden="no"
# hidden="no"
# sendpass="B0PMmTpYr1sw7qAXhbeycKGBkV3vCKDeWCCbo0KPdwIB33p8LI7CJHJaWrt80H1"
# recvpass="sc6JcwWz7CWCMXmAMtQIpPITarLHgSUsiF12TvG9bNwtDc4GMZXruMZitlwGPmx">
<link
name="services.manero.org"
ipaddr="127.0.0.1"
port="7000"
allowmask="127.0.0.0/8"
sendpass="{{ vault_inspircd_us_link_services_sendpass }}"
recvpass="{{ vault_inspircd_us_link_services_recvpass }}">
<uline server="services.manero.org" silent="yes">
#<autoconnect period="1m" server="ca.manero.org">

94
ansible/roles/inspircd/templates/us.manero.org/modules.conf Normal file
View file

@ -0,0 +1,94 @@
<module name="alias">
<module name="allowinvite">
<module name="chancreate">
<module name="check">
<module name="chghost">
<module name="chgident">
<module name="chgname">
<module name="cloak">
<module name="cloak_user">
#<include file="&dir;/codepages/ascii.conf">
#<include file="&dir;/codepages/iso-8859-1.conf">
#<include file="&dir;/codepages/iso-8859-2.conf">
#<include file="&dir;/codepages/rfc1459.conf">
#<include file="&dir;/codepages/strict-rfc1459.conf">
<module name="customprefix">
<module name="hidechans">
<module name="ircv3">
<module name="monitor">
<module name="cap">
<module name="ircv3_accounttag">
<module name="ircv3_batch">
<module name="ircv3_capnotify">
<module name="ircv3_chghost">
<module name="ircv3_ctctags">
<module name="ircv3_echomessage">
<module name="ircv3_invitenotify">
<module name="ircv3_labeledresponse">
<module name="ircv3_msgid">
<module name="ircv3_sts">
<sts host="us.manero.org" port="6697" duration="1d">
<module name="ircv3_servertime">
<module name="messageflood">
<monitor maxentries="30">
<module name="multiprefix">
<module name="nokicks">
<passforward
# nick: The nick of the service to forward passwords to.
nick="NickServ"
# forwardmsg: Message to send to users when forwarding their
# password. You can use the following variables in this message:
#
# %nick% The nickname of the authenticating user.
# %nickrequired% The nickname of the service to forward to (see above).
# %pass% The password to forward to services.
# %user% The username of the authenticating user.
forwardmsg="NOTICE %nick% :*** Forwarding password to %nickrequired%"
# cmd: The message to send to forward passwords to services.
cmd="SQUERY %nickrequired% :IDENTIFY %nick% %pass%">
<module name="sajoin">
<module name="samode">
<module name="sanick">
<module name="satopic">
<module name="services">
<servicesintegration accountoverrideshold="yes"
disablemodes="no">
<module name="sethost">
<module name="setident">
<module name="setidle">
<module name="setname">
<setname notifyopers="yes">
<module name="sha1">
<module name="sha2">
<module name="showfile">
<module name="showwhois">
<showwhois opersonly="yes">
<module name="shun">
<module name="spanningtree">
<include file="&dir;/links.conf">
<module name="ssl_openssl">
<module name="stripcolor">
<module name="vhost">
<module name="services_account">
<module name="bcrypt">
<bcrypt rounds="10">
<module name="password_hash">
<mkpasswd operonly="no">
<module name="knock">
<knock notify="notice">
<module name="swhois">
<module name="sakick">
<module name="autoop">
<module name="sslmodes">
<module name="sslinfo">
<module name="override">
<module name="sasl">
<sasl requiressl="no"
target="services.manero.org">
<module name="customprefix">
<module name="hideoper">
<hideoper mode="yes">

27
ansible/roles/inspircd/templates/us.manero.org/motd.txt Normal file
View file

@ -0,0 +1,27 @@
____
!
! !
! `- _ _ _
| ``` !
_____! * !
\, \
l _ ;
\ _/ \. /
\ .’
. ./’
`. ,
\ ;
``’
This server is hosted in Princeton, Texas by gmc
███╗ ███╗ █████╗ ███╗ ██╗███████╗██████╗ ██████╗
████╗ ████║██╔══██╗████╗ ██║██╔════╝██╔══██╗██╔═══██╗
██╔████╔██║███████║██╔██╗ ██║█████╗ ██████╔╝██║ ██║
██║╚██╔╝██║██╔══██║██║╚██╗██║██╔══╝ ██╔══██╗██║ ██║
██║ ╚═╝ ██║██║ ██║██║ ╚████║███████╗██║ ██║╚██████╔╝
╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═══╝╚══════╝╚═╝ ╚═╝ ╚═════╝
Welcome to the manero memorial irc network

37
ansible/roles/inspircd/templates/us.manero.org/opermotd.txt Normal file
View file

@ -0,0 +1,37 @@
_____ _____ _____ _____ _
|_ _| |_ _| | __ \ / ____| | |
| | _ __ ___ _ __ | | | |__) || | __| |
| | | '_ \ / __| | '_ \ | | | _ / | | / _` |
_| |_ | | | | \__ \ | |_) | _| |_ | | \ \ | |____ | (_| |
|_____| |_| |_| |___/ | .__/ |_____| |_| \_\ \_____| \__,_|
_____________________| |__________________________________
|_____________________|_|__________________________________|
\iThe IRC server for the 31st century\x
/\ /\
{ `---' } \bWELCOME TO AN \c13I\c04N\c07S\c08P\c03I\c10R\c12C\c06D\c99 NETWORK\x
{ O O }
~~> V <~~ If you see this, I'm probably new.
\ \|/ / If I'm not new, my owner is lazy. ;-)
`-----'____
/ \ \_
{ }\ )_\_ _
| \_/ |/ / \_\_/ )
\__/ /(_/ \__/
(__/
+-- To change this see \bopermotd.example.txt\x --+
| |
| * \bWeb:\x https://www.inspircd.org |
| * \bIRC:\x ircs://irc.teranova.net/inspircd |
| * \bDocs:\x https://docs.inspircd.org |
| * \bIssues:\x https://git.io/JIuYi |
| * \bDiscussions:\x https://git.io/JIuYv |
| |
| We hope you like this software. Please do |
| make sure to customise your configuration, |
| though, so you love it. Enjoy. |
| |
| -- The InspIRCd Team |
+---------------------------------------------+

46
ansible/roles/inspircd/templates/us.manero.org/opers.conf Normal file
View file

@ -0,0 +1,46 @@
<class name="SACommands" commands="SAJOIN SAPART SANICK SAQUIT SATOPIC SAKICK SAMODE OJOIN">
<class name="ServerLink" commands="CONNECT SQUIT RCONNECT RSQUIT MKPASSWD ALLTIME SWHOIS LOCKSERV UNLOCKSERV" usermodes="*" chanmodes="*" privs="servers/auspex" snomasks="Cc">
<class name="BanControl" commands="KILL GLINE KLINE ZLINE QLINE ELINE TLINE RLINE CHECK NICKLOCK NICKUNLOCK SHUN CLONES CBAN" usermodes="*" chanmodes="*" snomasks="Xx">
<class name="OperChat" commands="WALLOPS GLOBOPS" usermodes="*" chanmodes="*" privs="users/mass-message" snomasks="Gg">
<class name="HostCloak" commands="SETHOST SETIDENT SETIDLE CHGNAME CHGHOST CHGIDENT" usermodes="*" chanmodes="*" privs="users/auspex">
<class
name="Shutdown"
commands="DIE RESTART REHASH LOADMODULE UNLOADMODULE RELOADMODULE GLOADMODULE GUNLOADMODULE GRELOADMODULE"
privs="users/auspex channels/auspex servers/auspex users/mass-message users/flood/no-throttle users/flood/increased-buffers"
usermodes="*"
chanmodes="*"
snomasks="*">
<type
# name: Name of the type. Used in actual server operator accounts below.
name="NetAdmin"
# classes: Classes (blocks above) that this type belongs to.
classes="SACommands OperChat BanControl HostCloak Shutdown ServerLink" # vhost: Host that opers of this type get when they log in (oper up). This is optional.
vhost="netadmin.manero.org"
# maxchans: Maximum number of channels opers of this type can be in at once.
maxchans="60"
# modes: User modes besides +o that are set on an oper of this type # when they oper up. Used for snomasks and other things.
# Requires the opermodes module to be loaded.
modes="+s +cCqQ">
<oper
name="gmc"
hash="bcrypt"
password="{{ vault_inspircd_us_oper_graham_password }}"
host="*@*"
sslonly="yes"
type="NetAdmin">
<oper
name="andys"
hash="bcrypt"
password="{{ vault_inspircd_us_oper_andys_password }}"
host="*@*"
sslonly="yes"
type="NetAdmin">

203
ansible/roles/inspircd/templates/us.manero.org/quotes.txt Normal file
View file

@ -0,0 +1,203 @@
Men are from Mars. Women are from Venus. Computers are from hell
Computer /nm./: a device designed to speed and automate errors
Hardware /nm./: the part of the computer that you can kick.
Maniac /n./ An early computer built by nuts.
RAM /abr./: Rarely Adequate Memory.
Programmer /n./ A red-eyed, mumbling mammal capable of conversing with inanimate objects
Multitasking /adj./ 3 PCs and a chair with wheels
Plonk /excl./: The sound a newbie makes as he falls to the bottom of a kill file
hURL /n./: a link to a web site that makes you want to puke
SUPERCOMPUTER: what it sounded like before you bought it.
If it's really a supercomputer, how come the bullets don't bounce off when I shoot it? . The Covert Comic.
A computer is like an Old Testament god, with a lot of rules and no mercy. . Joseph Campbell
I dropped my computer on my foot! That Megahurtz!!
A computer's attention span is as long as it's power cord
586: The average IQ needed to understand a PC
Memory is like an orgasm. It's a lot better if you don't have to fake it
If it jams, force it. If it breaks, it needed replacing anyway.
A bus station is where a bus stops. A train station is where a train stops. On my desk I have a workstation..
Want to come see my HARD DRIVE ? I promise it isn't 3.5 inches and it ain't floppy. . Geek pick-up line.
If you torture the data enough, it will confess. . Ronald Coase
If you give someone a program, you will frustrate them for a day; if you teach them how to program, you will frustrate them for a lifetime
ASCII stupid question, get a stupid ANSI!
Use the source, Luke...
Programming is an art form that fights back
MacOS, Windows, BeOS: they're all just Xerox copies
Whenever you think you have a clever programming trick... forget it!
Managing senior programmers is like herding cats. . Dave Platt
Your program is sick ! Shoot it and put it out of its memory
/* You are not expected to understand this */
To define recursion, we must first define recursion
ERROR: Computer possessed; Load EXOR.SYS ? [Y/N]
Linux is only free if your time is worthless
Linux: find out what you've been missing while you've been rebooting Windows NT
unzip; strip; touch; finger; mount; fsck; more; yes; unmount; sleep
Profanity is the one language all programmers know best
It's 5.50 a.m.... Do you know where your stack pointer is?
#define QUESTION ((bb) || !(bb)) . Shakespeare
The more I C, the less I see.
Confucius say: He who play in root, eventually kill tree.
Unix is the answer, but only if you phrase the question very carefully
C++: Hard to learn and built to stay that way
Java is, in many ways, C++-- . Michael Feldman.
They don't make bugs like Bunny anymore . Olav Mjelde
If debugging is the process of removing software bugs, then programming must be the process of putting them in
When the only tool you own is a hammer, every problem you encounter resembles a nail
System Error: press F13 to continue...
To err is human, but for a real disaster you need a computer
Computers make very fast, very accurate mistakes
Life would be so much easier if we only had the source code
Who is this 'General Failure' and why is he reading my disk?
hAS aNYONE sEEN MY cAPSLOCK kEY?
InspIRCd, now with excessive amounts of Cheeze
I'm in the computer business, I make Out-Of-Order signs
Kevorkian Virus: helps your computer shut down whenever it wants to.
[OUT OF QUOTES, PLEASE ORDER MORE]
Insert Something Funkeh.. err.. There! -->
Cannot delete tmp150---3.tmp: There is not enough free disk space. Delete one or more files to free disk space, and then try again
File not found. Should I fake it ? (Y/N)
The definition of an upgrade: Take old bugs out, put new ones in
If it's not on fire, it's a software problem
It's a little-known fact that the Y1K problem caused the Dark Ages
Artificial Intelligence usually beats natural stupidity
Making fun of AOL users is like making fun of the kid in the wheel chair
Daddy, why doesn't this magnet pick up this floppy disk?
Daddy, what does FORMATTING DRIVE C mean?
See daddy ? All the keys are in alphabetical order now.
Enter any 11-digit prime number to continue...
ASCII and ye shall receive.
The web is a dominatrix. Every where I turn, I see little buttons ordering me to Submit.
<FrostyCoolSlug> NO, You cannot dial 999, I'm downloading my mail ;/
640K ought to be enough for anybody. . Bill Gates, 1981
Windows not found, [P]arty, [C]elebrate, [D]rink?
English, the Microsoft of languages...
It's been said that Bill Gates named his company after his dick...
Ever notice how fast Windows runs ? -- Neither did I
If at first you don't succeed, work for Microsoft
We are Microsoft. Resistance Is Futile. You Will Be Assimilated
"Microsoft Works." . Oxymoron
Windows isn't a virus, viruses do something
PANIC! buffer = :NickServ WRITE_DB(3). <-- JUST KIDDING!
It just keeps going and going and going and going and goi <BANG>
All that I know is that nukes are coming from 127.0.0.1
I know all about the irc and the mirc cops.
M re ink n ed d, ple s r fil
Please refrain from feeding the server operators. Thank you.
I know all about mirc stuff, hmm.. I think this channel is experiencing packet loss..
MacDonalds claims Macintosh stole their next idea of the iMac
I can't hold her any longer, captain, she's gonna bl.. sorry, got caught up in the moment
I recommend purchasing a Cyrix CPU for testing nuclear meltdowns
Is it an international rule to have the worst picture possible on your driver license?
Have you hugged your services coder, today?
Ever wonder why they make the colon flash on alarm clocks?
Whats this?.. blue screen with a VXD error?!.. I'VE BEEN NUKED!
do-do-bop-doo-doo-do-do-doo.. For those of you who know that song, you have problems..
be wery wery quiet... hunting wabbit...
I've been IRC Nuked"Great warrior? War does not make one great." - Yoda
"I find your lack of faith.....disturbing." - Darth Vader
"I have a bad feeling about this.."--All of the Star Wars characters.
Can I upgrade my Hard Drive to a WARP drive?
Canadian DOS prompt: EH?\>
Canadian DOS: "Yer sure, eh?" [y/n]
CONGRESS.SYS Corrupted: Re-boot Washington D.C (Y/n)?
I don't have a solution but I admire the problem.
Famous Last Words: Trust me. I know what I'm doing.
Hey Captain, I just created a black ho-÷p!%$û NO CARRIER
Access denied--nah nah na nah nah!
Bad command. Bad, bad command! Sit! Stay! Staaay..
Error: Keyboard not attached. Press F1 to continue.
*grumble* "You're just supposed to sit here?"
"Hey, what's this button d..<BOOM>" -W. Crusher
"He has become One with Himself!" "He's passed out!" "That too."-B5
For a funny quote, call back later.
Famous last words: 'You saw a WHAT around the corner?!'
I like work ... I can sit and watch it for hours.
Copywight 1994 Elmer Fudd. All wights wesewved.
Cannot find REALITY.SYS. Universe halted.
BUFFERS=20 FILES=15 2nd down, 4th quarter, 5 yards to go!
My software never has bugs. It just develops random features.
Why doesn't DOS ever say 'EXCELLENT command or filename!?
Shell to DOS... Come in DOS, do you copy? Shell to DOS...
Computing Definition - Network-Admin: Primary person who just got set up for the blame of the system crash.
An expert is a person who has made all the mistakes which can be made in a very narrow field.
Famous last words: This is the safe way to do it.......
Famous Last Words: Trust me. I know what I'm doing.
Clinton, "I didn't say that - er, well - yes, but I didn't mean..."
CLINTON LEGACY??...even Pharaoh had only ten plagues...
IBM I Bought McIntosh
IBM I Bring Manuals
IBM I've Been Moved
IBM Idolized By Management
IBM Impenetrable Brain Matter
IBM Imperialism By Marketing
IBM Incorrigible Boisterous Mammoth
IBM Inertia Breeds Mediocrity
IBM Ingenuity Becomes Mysterious
IBM Ingrained Batch Mentality
IBM Innovation By Management
IBM Insipid Belligerent Mossbacks
IBM Insipidly Bankrolling Millions
IBM Inspect Before Multiusing
IBM Install Bigger Memory
IBM Institution By Machiavelli
IBM Insultingly Boring Merchandisers
IBM Intellectuals Being Moronized
IBM Intelligence Belittling Meaning
IBM Intimidated, Buffaloed Management
IBM Into Building Money
IBM Intolerant of Beards & Moustaches
IBM Invest Before Multi-tasking
IBM Investigate Baffling Malodor
IBM Irresponsible Behave Multinational
IBM It Beats Mattel
IBM It's a Big Mess
IBM It's Better Manually
IBM Itty Bitty Machine
IBM Institute for Black Magic
100,000 lemmings can't be wrong.
Murphy's Eighth Law: If everything seems to be going well, you have obviously overlooked something.
Rules of the game: Do not believe in miracles - rely on them.
Rules of the game: Any given program, once running, is obsolete.
Computing Definition - Error: What someone else has made when they disagree with your computer output.
Backup not found: (A)bort (R)etry (P)anic
WinErr 653: Multitasking attempted - system confused.
Cannot join #real_life (invite only)
"Unfortunately, no one can be told what the Matrix is. You have to see it for yourself." - Matrix
"Reality is a thing of the past" - Matrix
"The future will not be user friendly" - Matrix
"The general idea in chat is to make yourself understandable... ..." - Peer
"heh i am talkin to someone...she's not dead...yet anyways" - Stinky
"He who must die, must die in the dark, even though he sells candles"
"If at first you don't succeed, skydiving is not for you."
"Friendship is like peeing on yourself: everyone can see it, but only you get the warm feeling that it brings."
"France sucks, but Paris swallows"
"A computer once beat me at chess, but it was no match for me at kick boxing.
"Ever wonder why the SAME PEOPLE make up ALL the conspiracy theories?
"Don't think of it as being outnumbered. Think of it as having a wide target selection."
"Sysadmins can't be sued for malpractice, but surgeons don't have to deal with patients who install new versions of their own innards."
"FACE!"
"Dirka Dirka Mohammed JIHAD!"
We can learn much from wise words, little from wisecracks, and less from wise guys.
"Blessed are the young, for they shall inherit the national debt." - Herbert Hoover
If you have five dollars and Chuck Norris has five dollars, Chuck Norris has more money than you.
Apple pays Chuck Norris 99 cents every time he listens to a song.
If Chuck Norris and InspIRCd met in a dark alley, Chuck Norris would get his first black eye. Ever.
Chuck Norris can sneeze with his eyes open.
Chuck Norris can kill two stones with one bird.
There is no theory of evolution. Just a list of animals Chuck Norris allows to live.
The Great Wall of China was originally created to keep Chuck Norris out. It failed miserably.
Chuck Norris can win a game of Connect Four in only three moves.
Chuck Norris is not hung like a horse... horses are hung like Chuck Norris.
Chuck Norris is currently suing NBC, claiming Law and Order are trademarked names for his left and right legs.
Chuck Norris CAN believe it's not butter.
Chuck Norris is so fast, he can run around the world and punch himself in the back of the head.
When the Boogeyman goes to sleep every night, he checks his closet for Chuck Norris.
Outer space exists because it's afraid to be on the same planet with Chuck Norris.
Chuck Norris counted to infinity - twice.
Chuck Norris only fears one thing in this world, and that is InspIRCd.
InspIRCd's core is ran by donated Chuck Norris DNA.
Chuck Norris exists because InspIRCd allows him to.
Chuck Norris CAN punch you in the face over the internet.
When Chuck Norris uses InspIRCd, he doesn't use the /kill command, he uses the /ROUND-HOUSE-TO-THE-FACE command.
A developer only classifies oneself as such if they consider themselves as such.
"While hunting in Africa, I shot an elephant in my pajamas. How an elephant got into my pajamas I'll never know." -- Groucho Marx

50
ansible/roles/inspircd/templates/us.manero.org/services-atheme.conf Normal file
View file

@ -0,0 +1,50 @@
# This file contains aliases and nickname reservations which are used
# by Atheme. See https://atheme.github.io/atheme.html for more
# information on Atheme.
<include file="/usr/local/etc/inspircd/services/generic.conf">
# Long hand aliases for services pseudoclients.
<alias text="ALIS" replace="PRIVMSG $requirement :$2-" requires="ALIS" service="yes">
<alias text="CHANFIX" replace="PRIVMSG $requirement :$2-" requires="ChanFix" service="yes">
<alias text="GAMESERV" replace="PRIVMSG $requirement :$2-" requires="GameServ" service="yes">
<alias text="GROUPSERV" replace="PRIVMSG $requirement :$2-" requires="GroupServ" service="yes">
<alias text="HELPSERV" replace="PRIVMSG $requirement :$2-" requires="HelpServ" service="yes">
<alias text="INFOSERV" replace="PRIVMSG $requirement :$2-" requires="InfoServ" service="yes">
<alias text="PROXYSCAN" replace="PRIVMSG $requirement :$2-" requires="Proxyscan" service="yes" operonly="yes">
<alias text="RPGSERV" replace="PRIVMSG $requirement :$2-" requires="RPGServ" service="yes">
# Short hand aliases for services pseudoclients.
<alias text="CF" replace="PRIVMSG $requirement :$2-" requires="ChanFix" service="yes">
<alias text="GS" replace="PRIVMSG $requirement :$2-" requires="GroupServ" service="yes">
<alias text="IS" replace="PRIVMSG $requirement :$2-" requires="InfoServ" service="yes">
<alias text="LS" replace="PRIVMSG $requirement :$2-" requires="ALIS" service="yes">
<alias text="PS" replace="PRIVMSG $requirement :$2-" requires="Proxyscan" service="yes" operonly="yes">
<alias text="RS" replace="PRIVMSG $requirement :$2-" requires="RPGServ" service="yes">
# These short hand aliases conflict with other pseudoclients. You can enable
# them but you will need to comment out the uncommented ones above first,
#<alias text="GS" replace="PRIVMSG $requirement :$2-" requires="GameServ" service="yes">
#<alias text="HS" replace="PRIVMSG $requirement :$2-" requires="HelpServ" service="yes">
# Prevent clients from using the nicknames of services pseudoclients.
<badnick nick="ALIS" reason="Reserved for a network service">
<badnick nick="ChanFix" reason="Reserved for a network service">
<badnick nick="GameServ" reason="Reserved for a network service">
<badnick nick="GroupServ" reason="Reserved for a network service">
<badnick nick="HelpServ" reason="Reserved for a network service">
<badnick nick="InfoServ" reason="Reserved for a network service">
<badnick nick="Proxyscan" reason="Reserved for a network service">
<badnick nick="RPGServ" reason="Reserved for a network service">
<badnick nick="SaslServ" reason="Reserved for a network service">
# Exempt services pseudoclients from filters.
<exemptfromfilter target="ALIS">
<exemptfromfilter target="ChanFix">
<exemptfromfilter target="GameServ">
<exemptfromfilter target="GroupServ">
<exemptfromfilter target="HelpServ">
<exemptfromfilter target="InfoServ">
<exemptfromfilter target="Proxyscan">
<exemptfromfilter target="RPGServ">
<exemptfromfilter target="SaslServ">

9
ansible/roles/netbox/tasks/main.yml
View file

@ -38,6 +38,15 @@
state: started
enabled: true
- name: Stop netbox services before user/group changes
ansible.builtin.systemd:
name: "{{ item }}"
state: stopped
loop:
- netbox
- netbox-rq
failed_when: false
- name: Create netbox group
ansible.builtin.group:
name: "{{ netbox_group }}"

24
ansible/roles/uisp/tasks/main.yml
View file

@ -103,6 +103,30 @@
group: root
mode: '0700'
- name: Download UISP installer script
ansible.builtin.get_url:
url: https://getuisp.com/install.sh
dest: "{{ uisp_app_dir }}/update.sh"
owner: "{{ uisp_user }}"
group: root
mode: "0755"
register: uisp_installer
- name: Check if UISP containers are already running
community.docker.docker_container_info:
name: unms-postgres
register: uisp_postgres_container
failed_when: false
- name: Run UISP installer (first install only — skips existing)
ansible.builtin.command: "{{ uisp_app_dir }}/update.sh"
become: true
become_user: "{{ uisp_user }}"
when:
- not uisp_postgres_container.exists | default(false)
register: uisp_install
changed_when: uisp_install.rc == 0
- name: Deploy UISP auto-update cron job
ansible.builtin.copy:
dest: /etc/cron.d/unms-update