Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
63 lines
1.5 KiB
YAML
63 lines
1.5 KiB
YAML
---
|
|
# Global variables for all hosts
|
|
|
|
# SSH key for Ansible connections - override per-host if needed
|
|
ansible_ssh_private_key_file: "{{ lookup('env', 'ANSIBLE_SSH_PRIVATE_KEY_FILE') | default('~/.ssh/ansible', true) }}"
|
|
|
|
# Tailscale auth key - set via TAILSCALE_AUTHKEY env var
|
|
tailscale_authkey: "{{ lookup('env', 'TAILSCALE_AUTHKEY') | default(lookup('env', 'TAILSCALE_KEY'), true) }}"
|
|
|
|
# Timezone configuration
|
|
timezone: America/Chicago
|
|
|
|
# Managed groups and users
|
|
managed_groups:
|
|
- name: ansible
|
|
gid: 10001
|
|
|
|
managed_users:
|
|
- name: ansible
|
|
uid: 10001
|
|
shell: /bin/bash
|
|
home: /home/ansible
|
|
primary_group: ansible
|
|
authorized_keys:
|
|
- type: file
|
|
value: ansible.pub
|
|
exclusive: true
|
|
- name: graham
|
|
shell: /bin/bash
|
|
home: /home/graham
|
|
admin: true
|
|
authorized_keys:
|
|
- type: github
|
|
value: gmcintire
|
|
- name: andy
|
|
shell: /bin/bash
|
|
home: /home/andy
|
|
admin: true
|
|
authorized_keys:
|
|
- type: github
|
|
value: nsnw
|
|
|
|
# Base settings
|
|
base:
|
|
ntp:
|
|
server: 0.us.pool.ntp.org
|
|
monitoring:
|
|
cert_dir: /var/lib/icinga2/certs
|
|
server: monitor.vntx.net
|
|
|
|
# SSH service name (varies by distribution)
|
|
ssh_service: "{{ 'ssh' if ansible_facts['os_family'] == 'Debian' else 'sshd' }}"
|
|
|
|
# NTP service name (varies by distribution)
|
|
ntp_service: "{{ 'ntp' if ansible_facts['os_family'] == 'Debian' else 'ntpd' }}"
|
|
|
|
# Network configuration - skip for all hosts
|
|
network:
|
|
skip: true
|
|
nameservers:
|
|
- 9.9.9.9
|
|
- 149.112.112.112
|
|
domain: local
|