From f238182302c167ba3139d7378908b8b7ee5969f9 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Sun, 3 Dec 2023 13:14:34 +0100 Subject: [PATCH] =?UTF-8?q?Pretix=20f=C3=BCr=20Hackertours?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../chaosknoten/host_vars/hackertours.yaml | 12 ++++ inventories/chaosknoten/hosts.yaml | 24 +++++--- .../hackertours.hamburg.ccc.de.conf | 42 ++++++++++++++ .../configs/hackertours/compose.yaml.j2 | 55 +++++++++++++++++++ 4 files changed, 125 insertions(+), 8 deletions(-) create mode 100644 inventories/chaosknoten/host_vars/hackertours.yaml create mode 100644 playbooks/files/chaosknoten/configs/hackertours/hackertours.hamburg.ccc.de.conf create mode 100644 playbooks/templates/chaosknoten/configs/hackertours/compose.yaml.j2 diff --git a/inventories/chaosknoten/host_vars/hackertours.yaml b/inventories/chaosknoten/host_vars/hackertours.yaml new file mode 100644 index 0000000..8346e5d --- /dev/null +++ b/inventories/chaosknoten/host_vars/hackertours.yaml @@ -0,0 +1,12 @@ +docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/hackertours/compose.yaml.j2') }}" +docker_compose__configuration_files: [] + +certbot__version_spec: "" +certbot__acme_account_email_address: le-admin@hamburg.ccc.de +certbot__certificate_domains: + - "hackertours.hamburg.ccc.de" + +nginx__version_spec: "" +nginx__configurations: + - name: hackertours.hamburg.ccc.de + content: "{{ lookup('ansible.builtin.file', 'chaosknoten/configs/hackertours/nginx/hackertours.hamburg.ccc.de.conf') }}" diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml index 384f3fb..bd016b1 100644 --- a/inventories/chaosknoten/hosts.yaml +++ b/inventories/chaosknoten/hosts.yaml @@ -6,6 +6,10 @@ all: ansible_host: cloud-intern.hamburg.ccc.de ansible_user: chaos ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de:42666 + hackertours: + ansible_host: hackertours-intern.hamburg.ccc.de + ansible_user: chaos + ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de:42666 keycloak: ansible_host: keycloak-intern.hamburg.ccc.de ansible_user: chaos @@ -33,21 +37,23 @@ all: ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de:42666 docker_compose_hosts: hosts: - pad: + hackertours: keycloak: lists: onlyoffice: + pad: nextcloud_hosts: hosts: cloud: nginx_hosts: hosts: - pad: - public-reverse-proxy: + hackertours: keycloak: lists: - wiki: onlyoffice: + pad: + public-reverse-proxy: + wiki: public_reverse_proxy_hosts: hosts: public-reverse-proxy: @@ -57,16 +63,18 @@ all: wiki: certbot_hosts: hosts: - pad: + hackertours: keycloak: lists: - wiki: onlyoffice: + pad: + wiki: infrastructure_authorized_keys_hosts: hosts: + hackertours: cloud: + keycloak: + onlyoffice: pad: public-reverse-proxy: - keycloak: wiki: - onlyoffice: diff --git a/playbooks/files/chaosknoten/configs/hackertours/hackertours.hamburg.ccc.de.conf b/playbooks/files/chaosknoten/configs/hackertours/hackertours.hamburg.ccc.de.conf new file mode 100644 index 0000000..83fc399 --- /dev/null +++ b/playbooks/files/chaosknoten/configs/hackertours/hackertours.hamburg.ccc.de.conf @@ -0,0 +1,42 @@ +# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration +# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6 +server { + # Listen on a custom port for the proxy protocol. + listen 8443 ssl http2 proxy_protocol; + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + server_name hackertours.hamburg.ccc.de; + + ssl_certificate /etc/letsencrypt/live/hackertours.hamburg.ccc.de/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/hackertours.hamburg.ccc.de/privkey.pem; + # verify chain of trust of OCSP response using Root CA and Intermediate certs + ssl_trusted_certificate /etc/letsencrypt/live/hackertours.hamburg.ccc.de/chain.pem; + + # HSTS (ngx_http_headers_module is required) (63072000 seconds) + add_header Strict-Transport-Security "max-age=63072000" always; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Port 443; + # This is https in any case. + proxy_set_header X-Forwarded-Proto https; + # Hide the X-Forwarded header. + proxy_hide_header X-Forwarded; + # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that + # is transparent). + # Also provide "_hidden" for by, since it's not relevant. + proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden"; + + location / { + proxy_pass http://127.0.0.1:80/; + } +} diff --git a/playbooks/templates/chaosknoten/configs/hackertours/compose.yaml.j2 b/playbooks/templates/chaosknoten/configs/hackertours/compose.yaml.j2 new file mode 100644 index 0000000..256d956 --- /dev/null +++ b/playbooks/templates/chaosknoten/configs/hackertours/compose.yaml.j2 @@ -0,0 +1,55 @@ +--- +version: "3.6" + +services: + database: + image: docker.io/library/postgres:15-alpine + environment: + - "POSTGRES_USER=pretix" + - "POSTGRES_PASSWORD={{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/hackertours/DB_PASSWORD", create=false, missing="error") }}" + - "POSTGRES_DB=pretix" + volumes: + - database:/var/lib/postgresql/data + networks: + backend: + restart: always + + redis: + image: docker.io/redis:7 + ports: + - "6379:6379" + volumes: + - redis:/rdata + # run redis-server, save a snapshot every 60 seconds if there has been at least 1 write + command: ["redis-server", "--save", "60", "1"] + restart: always + + pretix: + image: gitlab-cr.hamburg.ccc.de/ccchh/ccchh-pretix/ccchh-pretix:23.10.0 + environment: + - "PRETIX_INSTANCE_NAME=CCCHH Hackertours" + - "PRETIX_URL=http://hackertours.hamburg.ccc.de" + - "DATABASE_BACKEND=postgresql" + - "DATABASE_NAME=pretix" + - "DATABASE_USER=pretix" + - "DATABASE_PASSWORD={{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/hackertours/DB_PASSWORD", create=false, missing="error") }}" + - "DATABASE_HOST=database" + - "MAIL_FROM=foo@example.com" + - "MAIL_HOST=cow-intern.hamburg.ccc.de" + - "REDIS_LOCATION=redis://redis/0" + - "CELERY_BACKEND=redis://redis/0" + - "CELERY_BROKER=redis://redis/1" + volumes: + - pretix:/rdata + restart: always + + +volumes: + database: {} + pretix: {} + redis: {} + +networks: + backend: + internal: true + frontend: