Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
113 lines
2.7 KiB
YAML
113 lines
2.7 KiB
YAML
---
|
|
- name: Install Docker prerequisites
|
|
ansible.builtin.apt:
|
|
name:
|
|
- apt-transport-https
|
|
- ca-certificates
|
|
- curl
|
|
- gnupg
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Add Docker GPG key
|
|
ansible.builtin.get_url:
|
|
url: https://download.docker.com/linux/debian/gpg
|
|
dest: /etc/apt/keyrings/docker.asc
|
|
mode: '0644'
|
|
|
|
- name: Add Docker APT repository
|
|
ansible.builtin.deb822_repository:
|
|
name: docker
|
|
types: [deb]
|
|
uris: https://download.docker.com/linux/debian
|
|
suites: "{{ ansible_facts['distribution_release'] }}"
|
|
components: [stable]
|
|
architectures: [amd64]
|
|
signed_by: /etc/apt/keyrings/docker.asc
|
|
state: present
|
|
|
|
- name: Remove legacy Docker .list repo (superseded by deb822 .sources)
|
|
ansible.builtin.file:
|
|
path: /etc/apt/sources.list.d/docker.list
|
|
state: absent
|
|
|
|
- name: Install Docker CE
|
|
ansible.builtin.apt:
|
|
name:
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
- docker-compose-plugin
|
|
- docker-ce-rootless-extras
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Create UISP group
|
|
ansible.builtin.group:
|
|
name: "{{ uisp_group }}"
|
|
gid: "{{ uisp_group_gid }}"
|
|
state: present
|
|
|
|
- name: Create UISP user
|
|
ansible.builtin.user:
|
|
name: "{{ uisp_user }}"
|
|
uid: "{{ uisp_user_uid }}"
|
|
group: "{{ uisp_group }}"
|
|
groups: docker
|
|
append: yes
|
|
home: "{{ uisp_home }}"
|
|
shell: /bin/sh
|
|
state: present
|
|
|
|
- name: Ensure Docker is running
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
state: started
|
|
enabled: yes
|
|
|
|
- name: Create containerd killmode override directory
|
|
ansible.builtin.file:
|
|
path: /usr/lib/systemd/system/containerd.service.d
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Configure containerd KillMode for UISP
|
|
ansible.builtin.copy:
|
|
dest: /usr/lib/systemd/system/containerd.service.d/unms-killmode.conf
|
|
content: |
|
|
[Service]
|
|
KillMode=mixed
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify:
|
|
- Reload systemd
|
|
- Restart containerd
|
|
|
|
- name: Ensure UISP app directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ uisp_app_dir }}"
|
|
state: directory
|
|
owner: "{{ uisp_user }}"
|
|
group: root
|
|
mode: '0700'
|
|
|
|
- name: Ensure UISP data directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ uisp_data_dir }}"
|
|
state: directory
|
|
owner: "{{ uisp_user }}"
|
|
group: root
|
|
mode: '0700'
|
|
|
|
- name: Deploy UISP auto-update cron job
|
|
ansible.builtin.copy:
|
|
dest: /etc/cron.d/unms-update
|
|
content: |
|
|
* * * * * {{ uisp_user }} {{ uisp_app_dir }}/update.sh --cron > /dev/null 2>&1 || true
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|