diff --git a/inventories/chaosknoten/host_vars/pretalx.yaml b/inventories/chaosknoten/host_vars/pretalx.yaml new file mode 100644 index 0000000..fbc7c57 --- /dev/null +++ b/inventories/chaosknoten/host_vars/pretalx.yaml @@ -0,0 +1,14 @@ +docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/pretalx/compose.yaml.j2') }}" +docker_compose__configuration_files: [] + +certbot__version_spec: "" +certbot__acme_account_email_address: le-admin@hamburg.ccc.de +certbot__certificate_domains: + - "pretalx.hamburg.ccc.de" +certbot__new_cert_commands: + - "systemctl reload nginx.service" + +nginx__version_spec: "" +nginx__configurations: + - name: pretalx.hamburg.ccc.de + content: "{{ lookup('ansible.builtin.file', 'chaosknoten/configs/pretalx/nginx/pretalx.hamburg.ccc.de.conf') }}" diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml index a07db31..d6f2dcc 100644 --- a/inventories/chaosknoten/hosts.yaml +++ b/inventories/chaosknoten/hosts.yaml @@ -42,6 +42,11 @@ all: ansible_port: 42666 ansible_user: chaos ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de:42666 + pretalx: + ansible_host: pretalx-intern.hamburg.ccc.de + ansible_port: 42666 + ansible_user: chaos + ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de:42666 public-reverse-proxy: ansible_host: public-reverse-proxy.hamburg.ccc.de ansible_port: 42666 @@ -64,6 +69,7 @@ all: lists: onlyoffice: pad: + pretalx: zammad: nextcloud_hosts: hosts: @@ -78,6 +84,7 @@ all: mumble: onlyoffice: pad: + pretalx: public-reverse-proxy: wiki: zammad: @@ -98,6 +105,7 @@ all: mumble: onlyoffice: pad: + pretalx: wiki: zammad: infrastructure_authorized_keys_hosts: @@ -109,6 +117,7 @@ all: keycloak: onlyoffice: pad: + pretalx: public-reverse-proxy: wiki: zammad: diff --git a/playbooks/files/chaosknoten/configs/pretalx/nginx/pretalx.hamburg.ccc.de.conf b/playbooks/files/chaosknoten/configs/pretalx/nginx/pretalx.hamburg.ccc.de.conf new file mode 100644 index 0000000..10c4bf7 --- /dev/null +++ b/playbooks/files/chaosknoten/configs/pretalx/nginx/pretalx.hamburg.ccc.de.conf @@ -0,0 +1,50 @@ +# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration +# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6 +server { + # Listen on a custom port for the proxy protocol. + listen 8443 ssl http2 proxy_protocol; + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + server_name pretalx.hamburg.ccc.de; + + ssl_certificate /etc/letsencrypt/live/pretalx.hamburg.ccc.de/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/pretalx.hamburg.ccc.de/privkey.pem; + # verify chain of trust of OCSP response using Root CA and Intermediate certs + ssl_trusted_certificate /etc/letsencrypt/live/pretalx.hamburg.ccc.de/chain.pem; + + # HSTS (ngx_http_headers_module is required) (63072000 seconds) + add_header Strict-Transport-Security "max-age=63072000" always; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Port 443; + # This is https in any case. + proxy_set_header X-Forwarded-Proto https; + # Hide the X-Forwarded header. + proxy_hide_header X-Forwarded; + # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that + # is transparent). + # Also provide "_hidden" for by, since it's not relevant. + proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden"; + + location /media { + proxy_pass http://127.0.0.1:8081/media/; + } + + location /static { + proxy_pass http://127.0.0.1:8081/static/; + } + + location / { + proxy_pass http://127.0.0.1:8080/; + } +} diff --git a/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/acme_challenge.conf b/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/acme_challenge.conf index 9052d90..01dbe31 100644 --- a/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/acme_challenge.conf +++ b/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/acme_challenge.conf @@ -17,6 +17,7 @@ map $host $upstream_acme_challenge_host { netbox.hamburg.ccc.de 172.31.17.149:31820; onlyoffice.hamburg.ccc.de 172.31.17.147:31820; pad.hamburg.ccc.de 172.31.17.141:31820; + pretalx.hamburg.ccc.de 172.31.17.157:31820; spaceapi.hamburg.ccc.de 172.31.17.151:31820; staging.hamburg.ccc.de 172.31.17.151:31820; wiki.ccchh.net 172.31.17.146:31820; diff --git a/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/nginx.conf b/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/nginx.conf index fef10d0..ee4c432 100644 --- a/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/nginx.conf +++ b/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/nginx.conf @@ -22,6 +22,7 @@ stream { www.ccchoir.de ccchoir-intern.hamburg.ccc.de:8443; cloud.hamburg.ccc.de cloud-intern.hamburg.ccc.de:8443; pad.hamburg.ccc.de pad-intern.hamburg.ccc.de:8443; + pretalx.hamburg.ccc.de pretalx-intern.hamburg.ccc.de:8443; id.hamburg.ccc.de 172.31.17.144:8443; invite.hamburg.ccc.de 172.31.17.144:8443; keycloak-admin.hamburg.ccc.de 172.31.17.144:8444; diff --git a/playbooks/templates/chaosknoten/configs/pretalx/compose.yaml.j2 b/playbooks/templates/chaosknoten/configs/pretalx/compose.yaml.j2 new file mode 100644 index 0000000..add5c0f --- /dev/null +++ b/playbooks/templates/chaosknoten/configs/pretalx/compose.yaml.j2 @@ -0,0 +1,106 @@ +--- +# see https://github.com/pretalx/pretalx-docker/blob/main/docker-compose.yml + +services: + database: + image: docker.io/library/postgres:15-alpine + environment: + - "POSTGRES_USER=pretalx" + - "POSTGRES_PASSWORD={{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/pretalx/DB_PASSWORD", create=false, missing="error") }}" + - "POSTGRES_DB=pretalx" + volumes: + - database:/var/lib/postgresql/data + restart: always + + redis: + image: redis:latest + restart: unless-stopped + volumes: + - redis:/data + + static: + image: docker.io/library/nginx + restart: always + volumes: + - public:/usr/share/nginx/html + ports: + - 8081:80 + + pretalx: + image: pretalx/standalone:latest + entrypoint: gunicorn + command: + - "pretalx.wsgi" + - "--name" + - "pretalx" + - "--workers" + - "4" + - "--max-requests" + - "1200" + - "--max-requests-jitter" + - "50" + - "--log-level=info" + - "--bind=0.0.0.0:8080" + ports: + - 8080:8080 + restart: unless-stopped + environment: + PRETALX_DATA_DIR: /data + PRETALX_FILESYSTEM_MEDIA: /public/media + PRETALX_FILESYSTEM_STATIC: /public/static + PRETALX_SITE_URL: https://pretalx.hamburg.ccc.de + PRETALX_DB_TYPE: postgresql + PRETALX_DB_NAME: pretalx + PRETALX_DB_USER: pretalx + PRETALX_DB_PASS: "{{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/pretalx/DB_PASSWORD", create=false, missing="error") }}" + PRETALX_DB_HOST: database + PRETALX_MAIL_FROM: "pretalx@hamburg.ccc.de" + PRETALX_MAIL_HOST: "cow-intern.hamburg.ccc.de" + PRETALX_CELERY_BACKEND: redis://redis/1 + PRETALX_CELERY_BROKER: redis://redis/2 + PRETALX_REDIS: redis://redis/3 + PRETALX_REDIS_SESSIONS: "True" + # PRETALX_LOGGING_EMAIL: noc@hamburg.ccc.de + PRETALX_LANGUAGE_CODE: de + PRETALX_TIME_ZONE: Europe/Berlin + volumes: + - pretalx:/data + - public:/public + + celery: + image: pretalx/standalone:latest + command: + - taskworker + restart: unless-stopped + environment: + PRETALX_DATA_DIR: /data + PRETALX_FILESYSTEM_MEDIA: /public/media + PRETALX_FILESYSTEM_STATIC: /public/static + PRETALX_SITE_URL: https://pretalx.hamburg.ccc.de + PRETALX_DB_TYPE: postgresql + PRETALX_DB_NAME: pretalx + PRETALX_DB_USER: pretalx + PRETALX_DB_PASS: "{{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/pretalx/DB_PASSWORD", create=false, missing="error") }}" + PRETALX_DB_HOST: database + PRETALX_MAIL_FROM: "pretalx@hamburg.ccc.de" + PRETALX_MAIL_HOST: "cow.hamburg.ccc.de" + PRETALX_MAIL_PORT: 587 + PRETALX_MAIL_USER: pretalx@hamburg.ccc.de + PRETALX_MAIL_PASSWORD: "{{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/pretalx/PRETALX_MAIL_PASSWORD", create=false, missing="error") }}" + PRETALX_MAIL_TLS: "true" + PRETALX_CELERY_BACKEND: redis://redis/1 + PRETALX_CELERY_BROKER: redis://redis/2 + PRETALX_REDIS: redis://redis/3 + PRETALX_REDIS_SESSIONS: "True" + # PRETALX_LOGGING_EMAIL: noc@hamburg.ccc.de + PRETALX_LANGUAGE_CODE: de + PRETALX_TIME_ZONE: Europe/Berlin + volumes: + - pretalx:/data + - public:/public + +volumes: + database: {} + redis: {} + pretalx: {} + public: {}