CCCHH/ansible-infra
CCCHH/ansible-infra
3
1
Fork 0
Code Issues 3 Pull requests Wiki Activity Actions

Add lint configuration and CI and fix the identified errors #14

Merged
june merged 10 commits from lint_and_ci into main 2024-12-01 22:26:24 +01:00
Conversation 0 Commits 10 Files changed 21 +837 -763
21 changed files with 837 additions and 763 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
.ansible-lint Normal file
View file

@ -0,0 +1,6 @@
skip_list:
- "yaml[line-length]"
- "name[casing]"
exclude_paths:
- .forgejo/

15
.editorconfig Normal file
View file

@ -0,0 +1,15 @@
root = true
[*]
end_of_line = lf
insert_final_newline = true
trim_trailing_whitespace = true
indent_style = space
charset = utf-8
[*.md]
indent_size = 2
trim_trailing_whitespace = false
[*.yaml]
indent_size = 2

32
.forgejo/workflows/lint.yaml Normal file
View file

@ -0,0 +1,32 @@
# Links & Resources:
# https://github.com/ansible/ansible-lint?tab=readme-ov-file#using-ansible-lint-as-a-github-action
# https://github.com/ansible/ansible-lint/blob/main/action.yml
on:
pull_request:
push:
jobs:
ansible-lint:
name: Ansible Lint
runs-on: docker
steps:
- uses: actions/checkout@v4
- name: Install pip
run: |
apt update
apt install -y pip
- name: Install python jmespath
run: |
pip install jmespath
env:
PIP_BREAK_SYSTEM_PACKAGES: 1
# Don't let it setup python as the then called setup-python action doesn't
# work in our environmnet.
# Rather manually setup python (pip) before instead.
- name: Run ansible-lint
uses: https://github.com/ansible/ansible-lint@main
with:
setup_python: "false"
requirements_file: "requirements.yml"
env:
PIP_BREAK_SYSTEM_PACKAGES: 1

6
.yamllint.yaml Normal file
View file

@ -0,0 +1,6 @@
rules:
brackets:
min-spaces-inside: 1
max-spaces-inside: 1
min-spaces-inside-empty: 1
max-spaces-inside-empty: 1

2
inventories/chaosknoten/host_vars/ccchoir.yaml
View file

@ -1,5 +1,5 @@
docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/ccchoir/compose.yaml.j2') }}" docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/ccchoir/compose.yaml.j2') }}"
docker_compose__configuration_files: [] docker_compose__configuration_files: [ ]
certbot__version_spec: "" certbot__version_spec: ""
certbot__acme_account_email_address: le-admin@hamburg.ccc.de certbot__acme_account_email_address: le-admin@hamburg.ccc.de

2
inventories/chaosknoten/host_vars/pad.yaml
View file

@ -1,5 +1,5 @@
docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/pad/compose.yaml.j2') }}" docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/pad/compose.yaml.j2') }}"
docker_compose__configuration_files: [] docker_compose__configuration_files: [ ]
certbot__version_spec: "" certbot__version_spec: ""
certbot__acme_account_email_address: le-admin@hamburg.ccc.de certbot__acme_account_email_address: le-admin@hamburg.ccc.de

2
inventories/chaosknoten/host_vars/pretalx.yaml
View file

@ -1,5 +1,5 @@
docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/pretalx/compose.yaml.j2') }}" docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/pretalx/compose.yaml.j2') }}"
docker_compose__configuration_files: [] docker_compose__configuration_files: [ ]
certbot__version_spec: "" certbot__version_spec: ""
certbot__acme_account_email_address: le-admin@hamburg.ccc.de certbot__acme_account_email_address: le-admin@hamburg.ccc.de

2
inventories/chaosknoten/host_vars/zammad.yaml
View file

@ -1,5 +1,5 @@
docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/zammad/compose.yaml.j2') }}" docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/zammad/compose.yaml.j2') }}"
docker_compose__configuration_files: [] docker_compose__configuration_files: [ ]
certbot__version_spec: "" certbot__version_spec: ""
certbot__acme_account_email_address: le-admin@hamburg.ccc.de certbot__acme_account_email_address: le-admin@hamburg.ccc.de

13
playbooks/files/chaosknoten/configs/grafana/docker_compose/grafana-datasource.yml
View file

@ -1,10 +1,9 @@
apiVersion: 1 apiVersion: 1
datasources: datasources:
- name: Prometheus - name: Prometheus
type: prometheus type: prometheus
url: http://prometheus:9090 url: http://prometheus:9090
isDefault: true isDefault: true
access: proxy access: proxy
editable: true editable: true

204
playbooks/files/chaosknoten/configs/grafana/docker_compose/prometheus.yml
View file

@ -5,110 +5,110 @@ global:
alerting: alerting:
alertmanagers: alertmanagers:
- scheme: http - scheme: http
timeout: 10s timeout: 10s
static_configs: static_configs:
- targets: - targets:
- "alertmanager:9093" - "alertmanager:9093"
rule_files: rule_files:
- "/etc/prometheus/rules/*.rules.yaml" - "/etc/prometheus/rules/*.rules.yaml"
scrape_configs: scrape_configs:
- job_name: prometheus - job_name: prometheus
honor_timestamps: true honor_timestamps: true
metrics_path: /metrics metrics_path: /metrics
scheme: http scheme: http
static_configs: static_configs:
- targets: - targets:
- localhost:9090 - localhost:9090
- job_name: alertmanager - job_name: alertmanager
honor_timestamps: true honor_timestamps: true
metrics_path: /metrics metrics_path: /metrics
scheme: http scheme: http
static_configs: static_configs:
- targets: - targets:
- alertmanager:9093 - alertmanager:9093
- job_name: c3lingo - job_name: c3lingo
honor_timestamps: true honor_timestamps: true
scrape_interval: 5s scrape_interval: 5s
scrape_timeout: 1s scrape_timeout: 1s
metrics_path: /mumblestats/metrics metrics_path: /mumblestats/metrics
scheme: https scheme: https
static_configs: static_configs:
- targets: - targets:
- mumble.c3lingo.org:443 - mumble.c3lingo.org:443
- job_name: mumble - job_name: mumble
honor_timestamps: true honor_timestamps: true
scrape_interval: 5s scrape_interval: 5s
scrape_timeout: 1s scrape_timeout: 1s
metrics_path: /metrics metrics_path: /metrics
scheme: https scheme: https
static_configs: static_configs:
- targets: - targets:
- mumble.hamburg.ccc.de:443 - mumble.hamburg.ccc.de:443
- job_name: opnsense-ccchh - job_name: opnsense-ccchh
honor_timestamps: true honor_timestamps: true
metrics_path: /metrics metrics_path: /metrics
scheme: http scheme: http
static_configs: static_configs:
- targets: - targets:
- 185.161.129.132:9100 - 185.161.129.132:9100
- job_name: jitsi - job_name: jitsi
honor_timestamps: true honor_timestamps: true
scrape_interval: 5s scrape_interval: 5s
scrape_timeout: 1s scrape_timeout: 1s
metrics_path: /metrics metrics_path: /metrics
scheme: http scheme: http
static_configs: static_configs:
- targets: - targets:
- jitsi.hamburg.ccc.de:9888 # Jitsi Video Bridge - jitsi.hamburg.ccc.de:9888 # Jitsi Video Bridge
- job_name: 'pve' - job_name: 'pve'
static_configs: static_configs:
- targets: - targets:
- 212.12.48.126 # chaosknoten - 212.12.48.126 # chaosknoten
metrics_path: /pve metrics_path: /pve
params: params:
module: [default] module: [ default ]
cluster: ['1'] cluster: [ '1' ]
node: ['1'] node: [ '1' ]
relabel_configs: relabel_configs:
- source_labels: [__address__] - source_labels: [ __address__ ]
target_label: __param_target target_label: __param_target
- source_labels: [__param_target] - source_labels: [ __param_target ]
target_label: instance target_label: instance
- target_label: __address__ - target_label: __address__
replacement: pve-exporter:9221 replacement: pve-exporter:9221
- job_name: hosts - job_name: hosts
static_configs: static_configs:
# Wieske Chaosknoten VMs # Wieske Chaosknoten VMs
- labels: - labels:
site: wieske site: wieske
type: virtual_machine type: virtual_machine
hypervisor: chaosknoten hypervisor: chaosknoten
targets: targets:
- netbox-intern.hamburg.ccc.de:9100 - netbox-intern.hamburg.ccc.de:9100
- matrix-intern.hamburg.ccc.de:9100 - matrix-intern.hamburg.ccc.de:9100
- public-web-static-intern.hamburg.ccc.de:9100 - public-web-static-intern.hamburg.ccc.de:9100
- git-intern.hamburg.ccc.de:9100 - git-intern.hamburg.ccc.de:9100
- forgejo-actions-runner-intern.hamburg.ccc.de:9100 - forgejo-actions-runner-intern.hamburg.ccc.de:9100
- eh22-wiki-intern.hamburg.ccc.de:9100 - eh22-wiki-intern.hamburg.ccc.de:9100
- nix-box-june-intern.hamburg.ccc.de:9100 - nix-box-june-intern.hamburg.ccc.de:9100
- mjolnir-intern.hamburg.ccc.de:9100 - mjolnir-intern.hamburg.ccc.de:9100
- woodpecker-intern.hamburg.ccc.de:9100 - woodpecker-intern.hamburg.ccc.de:9100
- penpot-intern.hamburg.ccc.de:9100 - penpot-intern.hamburg.ccc.de:9100
- jitsi.hamburg.ccc.de:9100 - jitsi.hamburg.ccc.de:9100
- onlyoffice-intern.hamburg.ccc.de:9100 - onlyoffice-intern.hamburg.ccc.de:9100
- ccchoir-intern.hamburg.ccc.de:9100 - ccchoir-intern.hamburg.ccc.de:9100
- tickets-intern.hamburg.ccc.de:9100 - tickets-intern.hamburg.ccc.de:9100
- keycloak-intern.hamburg.ccc.de:9100 - keycloak-intern.hamburg.ccc.de:9100
- onlyoffice-intern.hamburg.ccc.de:9100 - onlyoffice-intern.hamburg.ccc.de:9100
- pad-intern.hamburg.ccc.de:9100 - pad-intern.hamburg.ccc.de:9100
- wiki-intern.hamburg.ccc.de:9100 - wiki-intern.hamburg.ccc.de:9100
- zammad-intern.hamburg.ccc.de:9100 - zammad-intern.hamburg.ccc.de:9100
- pretalx-intern.hamburg.ccc.de:9100 - pretalx-intern.hamburg.ccc.de:9100
- labels: - labels:
site: wieske site: wieske
type: physical_machine type: physical_machine
targets: targets:
- chaosknoten.hamburg.ccc.de:9100 - chaosknoten.hamburg.ccc.de:9100

1160
playbooks/files/chaosknoten/configs/grafana/docker_compose/prometheus_alerts.rules.yaml
View file

File diff suppressed because it is too large Load diff

60
playbooks/files/chaosknoten/configs/lists/compose/compose.yaml
View file

@ -5,21 +5,21 @@ services:
container_name: mailman-core container_name: mailman-core
hostname: mailman-core hostname: mailman-core
volumes: volumes:
- /opt/mailman/core:/opt/mailman/ - /opt/mailman/core:/opt/mailman/
stop_grace_period: 30s stop_grace_period: 30s
links: links:
- database:database - database:database
depends_on: depends_on:
- database - database
environment: environment:
- DATABASE_URL=postgresql://mailman:wvQjbMRnwFuxGEPz@database/mailmandb - DATABASE_URL=postgresql://mailman:wvQjbMRnwFuxGEPz@database/mailmandb
- DATABASE_TYPE=postgres - DATABASE_TYPE=postgres
- DATABASE_CLASS=mailman.database.postgresql.PostgreSQLDatabase - DATABASE_CLASS=mailman.database.postgresql.PostgreSQLDatabase
- HYPERKITTY_API_KEY=ITfRjushI6FP0TLMnRpZxlfB2e17DN86 - HYPERKITTY_API_KEY=ITfRjushI6FP0TLMnRpZxlfB2e17DN86
- MTA=postfix - MTA=postfix
ports: ports:
- "127.0.0.1:8001:8001" # API - "127.0.0.1:8001:8001" # API
- "127.0.0.1:8024:8024" # LMTP - incoming emails - "127.0.0.1:8024:8024" # LMTP - incoming emails
networks: networks:
mailman: mailman:
@ -29,36 +29,36 @@ services:
container_name: mailman-web container_name: mailman-web
hostname: mailman-web hostname: mailman-web
depends_on: depends_on:
- database - database
links: links:
- mailman-core:mailman-core - mailman-core:mailman-core
- database:database - database:database
volumes: volumes:
- /opt/mailman/web:/opt/mailman-web-data - /opt/mailman/web:/opt/mailman-web-data
environment: environment:
- DATABASE_TYPE=postgres - DATABASE_TYPE=postgres
- DATABASE_URL=postgresql://mailman:wvQjbMRnwFuxGEPz@database/mailmandb - DATABASE_URL=postgresql://mailman:wvQjbMRnwFuxGEPz@database/mailmandb
- "DJANGO_ALLOWED_HOSTS=lists.hamburg.ccc.de,lists.c3lingo.org" - "DJANGO_ALLOWED_HOSTS=lists.hamburg.ccc.de,lists.c3lingo.org"
- HYPERKITTY_API_KEY=ITfRjushI6FP0TLMnRpZxlfB2e17DN86 - HYPERKITTY_API_KEY=ITfRjushI6FP0TLMnRpZxlfB2e17DN86
- SERVE_FROM_DOMAIN=lists.hamburg.ccc.de - SERVE_FROM_DOMAIN=lists.hamburg.ccc.de
- SECRET_KEY=ugfknEYBaFVc62R1jlIjnkizQaqr7tSt - SECRET_KEY=ugfknEYBaFVc62R1jlIjnkizQaqr7tSt
- MAILMAN_ADMIN_USER=ccchh-admin - MAILMAN_ADMIN_USER=ccchh-admin
- MAILMAN_ADMIN_EMAIL=tony@cowtest.hamburg.ccc.de - MAILMAN_ADMIN_EMAIL=tony@cowtest.hamburg.ccc.de
ports: ports:
- "127.0.0.1:8000:8000" # HTTP - "127.0.0.1:8000:8000" # HTTP
- "127.0.0.1:8080:8080" # uwsgi - "127.0.0.1:8080:8080" # uwsgi
networks: networks:
mailman: mailman:
database: database:
restart: unless-stopped restart: unless-stopped
environment: environment:
- POSTGRES_DB=mailmandb - POSTGRES_DB=mailmandb
- POSTGRES_USER=mailman - POSTGRES_USER=mailman
- POSTGRES_PASSWORD=wvQjbMRnwFuxGEPz - POSTGRES_PASSWORD=wvQjbMRnwFuxGEPz
image: postgres:12-alpine image: postgres:12-alpine
volumes: volumes:
- /opt/mailman/database:/var/lib/postgresql/data - /opt/mailman/database:/var/lib/postgresql/data
networks: networks:
mailman: mailman:
@ -68,5 +68,5 @@ networks:
ipam: ipam:
driver: default driver: default
config: config:
- -
subnet: 172.19.199.0/24 subnet: 172.19.199.0/24

3
playbooks/roles/apt_update_and_upgrade/handlers/main.yaml Normal file
View file

@ -0,0 +1,3 @@
- name: reboot the system
become: true
ansible.builtin.reboot:

20
playbooks/roles/apt_update_and_upgrade/tasks/main.yaml
View file

@ -1,15 +1,13 @@
- name: update, upgrade and potentially reboot - name: update, upgrade and potentially reboot
become: true become: true
block: block:
- name: apt-get update - name: apt-get update
ansible.builtin.apt: ansible.builtin.apt:
update-cache: true update-cache: true
- name: apt-get dist-upgrade - name: apt-get dist-upgrade
ansible.builtin.apt: ansible.builtin.apt:
upgrade: dist upgrade: dist
register: apt_update_and_upgrade__upgrade_result register: apt_update_and_upgrade__upgrade_result
notify:
- name: reboot, after package upgrade - reboot the system
ansible.builtin.reboot:
when: apt_update_and_upgrade__upgrade_result.changed

3
playbooks/roles/deploy_ssh_server_config/handlers/main.yaml Normal file
View file

@ -0,0 +1,3 @@
- name: reboot the system
become: true
ansible.builtin.reboot:

45
playbooks/roles/deploy_ssh_server_config/tasks/main.yaml
View file

@ -3,21 +3,34 @@
become: true become: true
block: block:
- name: deploy `sshd_config` - name: deploy `sshd_config`
ansible.builtin.template: ansible.builtin.template:
force: true force: true
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
src: sshd_config.j2 src: sshd_config.j2
register: deploy_ssh_server_config__ssh_config_copy_result notify:
# Reboot instead of just restarting the ssh service, since I don't know how Ansible reacts, when it restarts the service it probably needs for the connection.
- reboot the system
- name: deactivate short moduli - name: deactivate short moduli
ansible.builtin.shell: ansible.builtin.shell:
cmd: awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.tmp && mv /etc/ssh/moduli.tmp /etc/ssh/moduli executable: /bin/bash
cmd: |
set -eo pipefail
# Rebooting here instead of restarting the ssh service, since I don't know how Ansible reacts, when it restarts the service it probably needs for the connection. awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.tmp
- name: reboot, if ssh server config got changed if diff /etc/ssh/moduli /etc/ssh/moduli.tmp; then
ansible.builtin.reboot: rm /etc/ssh/moduli.tmp
when: deploy_ssh_server_config__ssh_config_copy_result.changed else
mv /etc/ssh/moduli.tmp /etc/ssh/moduli
echo "ansible-changed: changed /etc/ssh/moduli"
fi
register: result
changed_when:
- '"ansible-changed" in result.stdout'
notify:
# Reboot instead of just restarting the ssh service, since I don't know how Ansible reacts, when it restarts the service it probably needs for the connection.
- reboot the system

1
playbooks/roles/infrastructure_authorized_keys/tasks/main.yaml
View file

@ -4,4 +4,3 @@
user: chaos user: chaos
exclusive: true exclusive: true
key: https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/raw/branch/trunk/authorized_keys key: https://git.hamburg.ccc.de/CCCHH/infrastructure-authorized-keys/raw/branch/trunk/authorized_keys

4
playbooks/roles/nextcloud/meta/main.yaml
View file

@ -11,10 +11,10 @@ dependencies:
- role: nginx - role: nginx
vars: vars:
nginx__version_spec: "{{ nextcloud__nginx_version_spec }}" nginx__version_spec: "{{ nextcloud__nginx_version_spec }}"
nginx__configurations: nginx__configurations:
- name: "{{ nextcloud__fqdn }}" - name: "{{ nextcloud__fqdn }}"
content: "{{ lookup('ansible.builtin.template', 'nginx_nextcloud.conf.j2') }}" content: "{{ lookup('ansible.builtin.template', 'nginx_nextcloud.conf.j2') }}"
- role: docker_compose - role: docker_compose
vars: vars:
docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'compose.yaml.j2') }}" docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'compose.yaml.j2') }}"
docker_compose__configuration_files: [] docker_compose__configuration_files: [ ]

2
playbooks/roles/nginx/defaults/main.yaml
View file

@ -1,5 +1,5 @@
nginx__deploy_redirect_conf: true nginx__deploy_redirect_conf: true
nginx__deploy_tls_conf: true nginx__deploy_tls_conf: true
nginx__configurations: [] nginx__configurations: [ ]
nginx__use_custom_nginx_conf: false nginx__use_custom_nginx_conf: false
nginx__custom_nginx_conf: "" nginx__custom_nginx_conf: ""

16
playbooks/roles/nginx/tasks/main/config_deploy.yaml
View file

@ -7,11 +7,11 @@
when: nginx__use_custom_nginx_conf when: nginx__use_custom_nginx_conf
block: block:
- name: when no `nginx.conf.ansiblesave` is present, save the current `nginx.conf` - name: when no `nginx.conf.ansiblesave` is present, save the current `nginx.conf`
when: nginx__nginx_conf_ansiblesave_stat_result.stat.exists == false when: not nginx__nginx_conf_ansiblesave_stat_result.stat.exists
ansible.builtin.copy: ansible.builtin.copy:
force: true force: true
dest: /etc/nginx/nginx.conf.ansiblesave dest: /etc/nginx/nginx.conf.ansiblesave
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
remote_src: true remote_src: true
@ -22,7 +22,7 @@
ansible.builtin.copy: ansible.builtin.copy:
content: "{{ nginx__custom_nginx_conf }}" content: "{{ nginx__custom_nginx_conf }}"
dest: "/etc/nginx/nginx.conf" dest: "/etc/nginx/nginx.conf"
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
become: true become: true
@ -36,7 +36,7 @@
ansible.builtin.copy: ansible.builtin.copy:
force: true force: true
dest: /etc/nginx/nginx.conf dest: /etc/nginx/nginx.conf
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
remote_src: true remote_src: true
@ -55,7 +55,7 @@
ansible.builtin.get_url: ansible.builtin.get_url:
force: true force: true
dest: /etc/nginx-mozilla-dhparam dest: /etc/nginx-mozilla-dhparam
mode: 0644 mode: "0644"
url: https://ssl-config.mozilla.org/ffdhe2048.txt url: https://ssl-config.mozilla.org/ffdhe2048.txt
become: true become: true
notify: Restart `nginx.service` notify: Restart `nginx.service`
@ -71,7 +71,7 @@
ansible.builtin.copy: ansible.builtin.copy:
force: true force: true
dest: /etc/nginx/conf.d/tls.conf dest: /etc/nginx/conf.d/tls.conf
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
src: tls.conf src: tls.conf
@ -89,7 +89,7 @@
ansible.builtin.copy: ansible.builtin.copy:
force: true force: true
dest: /etc/nginx/conf.d/redirect.conf dest: /etc/nginx/conf.d/redirect.conf
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
src: redirect.conf src: redirect.conf
@ -104,7 +104,7 @@
ansible.builtin.copy: ansible.builtin.copy:
content: "{{ item.content }}" content: "{{ item.content }}"
dest: "/etc/nginx/conf.d/{{ item.name }}.conf" dest: "/etc/nginx/conf.d/{{ item.name }}.conf"
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
become: true become: true

2
requirements.yml
View file

@ -2,4 +2,4 @@ collections:
# Install a collection from Ansible Galaxy. # Install a collection from Ansible Galaxy.
- name: debops.debops - name: debops.debops
version: ">=3.1.0" version: ">=3.1.0"
source: https://galaxy.ansible.com source: https://galaxy.ansible.com