diff --git a/all/playbook.yaml b/all/playbook.yaml index 06c2b55..a3258b2 100644 --- a/all/playbook.yaml +++ b/all/playbook.yaml @@ -1,30 +1,59 @@ -- name: Install shit +- name: Playbook to Provision / Re-configure Node hosts: all + vars: + users: + - name: arya + password: {{arya_encrypted_pass}} + - name: devrand + password: {{devrand_encrypted_pass}} + - name: midou + password: {{midou_encrypted_pass}} + - name: ansiblerunner + password: {{ansiblerunner_encrypted_pass}} tasks: - - name: Std Repo stuff + - name: Enable backports + ansible.builtin.apt_repository: + repo: deb http://deb.debian.org/debian bookworm-backports main contrib + state: present + - name: Install Required Programs / APT ansible.builtin.apt: - update_cache: true name: - - htop - - vim - - neovim # Something went wrong! - - curl - - wget + # Misc - sudo - - net-tools - - nmap - - python3-pip - - python3-passlib - - vnstat - chrony + - tmux + - nala + - apt-file + # Monitoring + - htop - gdu - btop - - iperf3 + - iotop + - vnstat - neofetch - - tmux - prometheus-node-exporter - goaccess - - nala + # Text Editing + - vim + - neovim + - curl + - wget + # Backups + - borgbackup + - rsync + # Basic Networking + - net-tools + - nmap + # Python3 + - python3-pip + - python3-passlib # Ansible User Creation + - python3-pyroute2 # for smart-ipv6-rotator + - python3-requests # for smart-ipv6-rotator + # Speed Tests + - iperf3 + - speedtest-cli + # Security + - ufw - name: Enable VNStat service ansible.builtin.service: name: vnstat @@ -40,26 +69,43 @@ name: prometheus-node-exporter enabled: true state: started -- name: Sysctl - hosts: all - tasks: + - name: Enable UFW service + ansible.builtin.service: + name: ufw + enabled: true + state: started + - name: Disable dmesg logging to console ansible.posix.sysctl: name: kernel.printk value: "3 4 1 3" state: present sysctl_set: true -- name: Add users - hosts: all - vars: - users: - - arya - - mrlerien - - devrand - - midou - - ansiblerunner - password: d404559f602eab6fd602ac7680dacbfaadd13630335e951f097af3900e9de176b6db28512f2e000b9d04fba5133e8b1c6e8df59db3a8ab9d60be4b97cc9e81db - tasks: + - name: Allow binding to non-local IPs / IPv6 + ansible.posix.sysctl: + name: net.ipv6.ip_nonlocal_bind + value: "1" + state: present + sysctl_set: true + - name: Allow IP forwarding / IPv4 + ansible.posix.sysctl: + name: net.ipv4.ip_forward + value: "1" + state: present + sysctl_set: true + - name: Allow IP forwarding / IPv6 + ansible.posix.sysctl: + name: net.ipv6.conf.all.forwarding + value: "1" + state: present + sysctl_set: true + - name: Swappiness + ansible.posix.sysctl: + name: vm.swappiness + value: "60" + state: present + sysctl_set: true + - name: Bashrc skel ansible.builtin.template: src: templates/bashrc.j2 @@ -100,31 +146,31 @@ src: templates/prompt.j2 dest: /root/.prompt mode: preserve + - name: Add user ansible.builtin.user: - name: "{{ item }}" + name: "{{ item.name }}" group: users groups: users,sudo - password: "{{ password }}" + password: "{{ item.password }}" shell: /bin/bash update_password: on_create # Add the same initial password for all users (can be overwritten by user) with_items: - "{{ users }}" - name: "Add authorized keys" ansible.posix.authorized_key: - user: "{{ item }}" + user: "{{ item.name }}" key: "{{ lookup('file', 'files/' + item + '.pub') }}" with_items: - "{{ users }}" + - name: "Allow admin users to sudo without a password" ansible.builtin.lineinfile: dest: "/etc/sudoers" # path: in version 2.3 state: "present" regexp: "^%sudo" line: "%sudo ALL=(ALL) NOPASSWD: ALL" -- name: Configure SSHD - hosts: all - tasks: + - name: Sshd configuration file update ansible.builtin.template: src: templates/sshd_config.j2 @@ -142,3 +188,53 @@ name: ssh enabled: true state: restarted + roles: + - role: geerlingguy.docker + docker_install_compose_plugin: true + docker_compose_package: docker-compose-plugin + docker_compose_package_state: present + - role: artis3n.tailscale + # Future Sysadmin seeing this: if this fails; it is because the key is only valid for 365 days (from Jan 6 2024) + tailscale_authkey: "{{tailscale_authkey}}" + tailscale_args: "--login-server https://hs.projectsegfau.lt --accept-dns=false" + - role: borgbase.ansible_role_borgbackup + borg_repository: + - ssh://zh3117@zh3117.rsync.net/data1/home/zh3117/backups/{{rsyncnet_slug}} + borg_source_directories: {{bkp_source_directories}} + borg_exclude_patterns: {{bkp_exclude_patterns}} + borg_remote_path: /usr/local/bin/borg_1.2.4/borg1 + borgmatic_hooks: + postgresql_databases: {{bkp_postgresql_databases}} + healthchecks: + ping_url: https://healthchecks.projectsegfau.lt/ping/{{bkp_hc_uuid}} + states: + - finish + borg_retention_policy: + keep_daily: 7 + keep_weekly: 4 + keep_monthly: 3 + borg_encryption_passcommand: cat /etc/borgmatic/passphrase # very secure I know; it has to be plain text anyway for automated backups, unless there is a better way (in which case please email me@aryak.me) +- name: UFW Firewall Configuration + hosts: eu,us # IN is behind router so no f/w is needed + tasks: + - name: Enable UFW + community.general.ufw: + state: enabled + policy: deny + - name: Allow all in from tailscale + community.general.ufw: + rule: allow + interface: tailscale0 + direction: in + - name: Allow all in from wg (if its there) + community.general.ufw: + rule: allow + interface: wg0 + direction: in + - name: Deny rules + community.general.ufw: + rule: allow + port: {{item.port}} + proto: {{item.proto}} + with_items: + - "{{ ufw_deny_rules }}" diff --git a/host_vars/eu/healthchecks.yaml b/host_vars/eu/healthchecks.yaml index d3b0eb4..cd64505 100644 --- a/host_vars/eu/healthchecks.yaml +++ b/host_vars/eu/healthchecks.yaml @@ -1,11 +1,14 @@ $ANSIBLE_VAULT;1.1;AES256 -61353335333766313361356562623335303363653831383165636530333234383030303962613931 -6131353234313634623166333539326635643939343030370a326435323338343535303030393233 -34333764386332663139353665613935623230343335336235643634666362356339313165663132 -3335633432303033390a326564346637363534383239333031313361333234653136653231373363 -38663465656539653864313330313238383861373065356562373231613930653931306239356230 -63363130323235346162316361383639386531303661313531373535313563623531376161356435 -64363730663430343737353331323061303434363263313435363033613435313735333835393863 -36363861353835356238643739633139313136343830613564623764646230323566353236636666 -31626338313336616330333866326534306331373666663430313438383163643837376166316633 -3263366236656464623063636333323465363338326366663838 +64373361323136313936333662343963373332633633363033346335646639616561386261376263 +6662326539303839633939663066626465383939626139380a663763336132396536373761373938 +33363034343334313566356639313631323931643863363363373265303164306538323638356132 +6234633666303737650a643135613166313963656234336266643731376431626432626662313535 +38646363656566366637336639613766636333383436313566666462303837393338343565306139 +37626530633733386231633031623362653433353163666431626661386261343632646632636231 +39663161323139623065326361663737623431343765643565653636623839306662393832643237 +66663934653161363939373966306233346561623138353462383437623230363265626536346139 +39366365343331653232663465343630393434326437393033633864343636623437366139383730 +32373939643531376231356364353438376539626339306134353738363135303436666536393835 +33663432643764333830373337376365613332383061386461653662356237326266643466633836 +31393662323363653232326134303365323339323366396161656538663565336565343466363365 +3634 diff --git a/host_vars/eu/misc.yaml b/host_vars/eu/misc.yaml new file mode 100644 index 0000000..a0d2675 --- /dev/null +++ b/host_vars/eu/misc.yaml @@ -0,0 +1,51 @@ +--- +ufw_allow_rules: + - port: 22 + proto: tcp + - port: 80 + proto: tcp + - port: 443 + proto: tcp + - port: 443 + proto: udp + - port: 53 + proto: udp + - port: 53 + proto: tcp + - port: 25 + proto: tcp + - port: 5201 + proto: tcp + - port: 6697 + proto: tcp + - port: 1965 + proto: tcp + - port: 51820 + proto: udp + - port: 5202 + proto: tcp + - port: 3389 + proto: tcp +bkp_source_directories: + - /configs + - /var + - /home + - /boot + - /usr + - /root + - /opt + - /zfspool + - /etc +bkp_exclude_patterns: + - /var/log + - /var/lib/docker/buildkit + - /var/lib/docker/containers + - /var/lib/docker/image + - /var/lib/docker/overlay2 + - /var/lib/docker/plugins + - /var/lib/docker/runtimes + - /var/lib/docker/swarm + - /var/lib/docker/tmp + - /var/lib/docker/trust +bkp_postgresql_databases: + - name: invidious diff --git a/host_vars/in/healthchecks.yaml b/host_vars/in/healthchecks.yaml index f367cee..fcbe731 100644 --- a/host_vars/in/healthchecks.yaml +++ b/host_vars/in/healthchecks.yaml @@ -1,11 +1,14 @@ $ANSIBLE_VAULT;1.1;AES256 -38626431346431393962623738643565313736393130653265373038393538633431333634376134 -3733626230643163366565333763626536633666373466300a616337623935326538363866643465 -32663835333930393631623836633865393938353331396164623465326233363034303965393133 -6165633030366266330a643339626531303766383366663065353239346139663730663539653034 -38363266393734376139396638356264326166343964323065373732626134643133386330653233 -63336663366165643561356131336566393532393537303235663866353261343033616530353839 -38656536306561613237386339663636633036386438326162653863363139393862356434353463 -34313135643736663564626666643030646561363037383536656661316564356133396535613137 -34633763306139613363616366343062613730353938373465373135636230316236643365393764 -6461333665333538303466336363376435363966393538663265 +39306635373466386133306563356330636363653032313836366462633664386133313637656562 +3838393830616131333135633935613762643364323536390a383564333933323066353635393939 +34626435363936303839373166336533383936643731333934626632626634653634333931646261 +6235613466356239640a323039623039623335613763663730303161373362393264393138363565 +31353033303434343937646433386531356363613263653736356531303564326134656334653037 +61613436366163333933386633366165356235313763653334633830323636303334616432323163 +62323262373264383939313464626431626366343339373137626365313962383735383764633632 +39343561306663366438353233636162373961323264386563353231626364356536396164363730 +64663338623365326161333336336534373933346136336538646636653734383164366266633233 +35363462663938366262626461363535343266653739366430646535313865663263363137333138 +32383236326565656538653339666432346237313363653761396430333236363331393763393931 +65353539646464386435633830663933363265663734623464323964386238386535303834653532 +6666 diff --git a/host_vars/in/misc.yaml b/host_vars/in/misc.yaml new file mode 100644 index 0000000..09a7c8e --- /dev/null +++ b/host_vars/in/misc.yaml @@ -0,0 +1,31 @@ +--- +bkp_source_directories: + - /var + - /home + - /boot + - /usr + - /root + - /opt + - /zfspool + - /etc +bkp_exclude_patterns: + - /var/log + - /var/lib/docker/buildkit + - /var/lib/docker/containers + - /var/lib/docker/image + - /var/lib/docker/overlay2 + - /var/lib/docker/plugins + - /var/lib/docker/runtimes + - /var/lib/docker/swarm + - /var/lib/docker/tmp + - /var/lib/docker/trust + - /var/lib/postgresql +bkp_postgresql_databases: + - name: gitea + - name: healthchecks + - name: hedgedoc + - name: semaphore + - name: vaultwarden + - name: ejabberd + - name: mailu + - name: roundcube diff --git a/host_vars/us/healthchecks.yaml b/host_vars/us/healthchecks.yaml index fa30bca..1807942 100644 --- a/host_vars/us/healthchecks.yaml +++ b/host_vars/us/healthchecks.yaml @@ -1,11 +1,14 @@ $ANSIBLE_VAULT;1.1;AES256 -32353133376437383030636135373334663838383965303761373666656236653335656430633735 -3861393933636337646535393837663336303538346635340a316664366632363461663734326437 -30623838643565633464393837343133313337393431613562303631366262646135633965346465 -3138613663343966310a353062613134393933373364373432356565363465316431613535393363 -37393935303434636365616235613831666231386632636161656135633734343266653636313261 -39623632376536643065313137396135623165356362616538386664393333333232383930663263 -38336439633239636339363961623837396334343064313736666235333434383762663231323263 -61633961623464643138633131666266323339363862326461323133383938356337393933613436 -38396563373133356330316333613263363935663163363337373836396238636637373735383833 -3037653434623331633666633533363561346364373965336432 +36393333323061396634373536623135376336653134303130336163316163343438613966313162 +6263613432353933633535656633383865643537386132320a623837636238386135376333623630 +35393233306435363332346562363239663636633863616362643931626563343037343463333365 +3632373132653830610a373763316130343737613233636237626534323030303430323461353562 +62333061376563343562386562313031363132326137333634316135343339626264623238343935 +31656639376339353439656632393363656664346362663031343931313534393862616532353732 +31663463363039386565653363653332396336306634356339616630623261643162373839356132 +64323038343430346433633865356462623133353339653336386261323637373731333630666333 +35643961316137356532653864613631633938303031663231343365646232636264633961373930 +36326239653963353562633134666262613332393963646239306336646338363734306161646562 +31366633336566393636616230326663363430333137656366336435656335343732393165363834 +34393766336138373164386332643661646162346166316265346664363530336336313334636366 +3132 diff --git a/host_vars/us/misc.yaml b/host_vars/us/misc.yaml new file mode 100644 index 0000000..8d0eab0 --- /dev/null +++ b/host_vars/us/misc.yaml @@ -0,0 +1,35 @@ +--- +ufw_allow_rules: + - port: 443 + proto: tcp + - port: 443 + proto: udp + - port: 80 + proto: tcp + - port: 53 + proto: udp + - port: 53 + proto: tcp + - port: 5201 + proto: tcp +bkp_source_directories: + - /home + - /etc + - /boot + - /root + - /opt + - /usr + - /var +bkp_exclude_patterns: + - /var/log + - /var/lib/docker/buildkit + - /var/lib/docker/containers + - /var/lib/docker/image + - /var/lib/docker/overlay2 + - /var/lib/docker/plugins + - /var/lib/docker/runtimes + - /var/lib/docker/swarm + - /var/lib/docker/tmp + - /var/lib/docker/trust +bkp_postgresql_databases: + - name: invidious diff --git a/inventory.yml b/inventory.yml index 890cc6c..be852c7 100644 --- a/inventory.yml +++ b/inventory.yml @@ -14,6 +14,7 @@ all: isp: Nonic Cloud wiki_page: Pizza-1 watchtower_mtrx_username: psf-watchtower-pizza + rsyncnet_slug: pizza1 us: ansible_host: us.vpn.projectsegfau.lt ansible_user: ansiblerunner @@ -26,6 +27,7 @@ all: wiki_page: US_Node server_prefix: us watchtower_mtrx_username: psf-watchtower-us + rsyncnet_slug: us in: ansible_host: in.vpn.projectsegfau.lt ansible_user: ansiblerunner @@ -38,3 +40,4 @@ all: isp: Bharti Airtel wiki_page: India_Node watchtower_mtrx_username: psf-watchtower-in + rsyncnet_slug: in diff --git a/roles/requirements.yml b/roles/requirements.yml index a07a85a..2cac5dd 100644 --- a/roles/requirements.yml +++ b/roles/requirements.yml @@ -1,3 +1,6 @@ --- - src: git+https://github.com/caddy-ansible/caddy-ansible.git version: v3.2.0 +- src: geerlingguy.docker +- src: artis3n.tailscale +- src: borgbase.ansible_role_borgbackup diff --git a/secrets.enc b/secrets.enc index c084165..31fa44b 100644 --- a/secrets.enc +++ b/secrets.enc @@ -1,39 +1,70 @@ $ANSIBLE_VAULT;1.1;AES256 -66363332323239613534666139626138646536326232313666336635616562616162656561643739 -3731613361633338636264323832616333363561373836340a363065313866343036363538316264 -35373334393964343561353066623931353230313338303465383033623031643431646338663863 -3961663534333666340a326231383037346631346339663037303730653331663531663663303834 -36353534633437313036396532356332626235653635303435653538396635383236663734333136 -62663563663064333537376333646130613537323138333831643961323862336435363861633031 -31363065346235666563613463356231616262303130323962393264393166306238383265653631 -63386539623935336237373037643035623930313232303130383732303262316662363065346633 -63393136376131613630396263343830653334656535386139303135656437333533646266346330 -64313934616234333239353237343736323738633031336435396336653239626462383461666365 -34376665326231353531666639623239633735633934383761613465613835323136316339643665 -34343539356339306134386665633937353138356461343233363835303032636438383731616261 -64333631333563303838393133316566633038353032623765333430313531396361396530633266 -65343964636664346630663332326539373235316165386139333264666431366436373963646633 -61646538643130616666383530303666633665666261376235373939393833633638383137343533 -63643338616139326166353231323865636162653234636366666230373730663266653738656365 -64383037643562633538353331383665326666306663333539353261633030633465623866643532 -36393361356536643036316633383364366233613032653231333636643536313564303235353231 -65613433306164663961653865616662353639346465386466356531353635656163373039303964 -66306230376161373861356562643663323634373636366366626465343032313439366366343362 -63636630333437653835663038663738316462653431333865373463353235363261636561626236 -33653435303634626166633234386561313662666535396562353633656135383932303363663830 -37323732626339396433316364343833363261646632316634613331613362653535613337633364 -33353535303537666637336337663530636461346632633932643362316230316139633566616465 -63643530636530323839623531376166633035343865393530376134616465363633633739393134 -33623762643430326233343463346132663134383738336165333561313530633664663966303962 -63396431643762623533353261373638313230373363633339643737623136646661653532393134 -64393439336163363430663535656439353933356436663630363234393165303938366535313534 -66623231376461333565613436333930323038336438353931363663386332366434636134356339 -38383563363166663634643666356265363231303431663763363764323665666565646238386539 -37636566333036383533623034306332666661393233613538626261616137616430653164373462 -62633935646231653037353062363830383530376234366334663938366539353935633962393963 -38643435643632343266333439313535386634353663316263333734373839663432346437323361 -35326265613134393931656130303432353664643364656233363334383762333632613662653461 -33313131363434343563633638336365623162363534363933373533346130386130343639643534 -61343261626239353838633638306430303536323931636566643236333338303966623934376466 -64633266383631663030653637653161613934636135383339323462663237356137343839653635 -6462613966346234363839316134373962316564313462363935 +31373334316338616530336663386162326136303066636462656235636139613037323732616433 +3464633562643434666536373662363132656238336435640a343261393539363663623731323533 +35383934346563633538353535613936316237613832353261376534323665653834353831353831 +6237323465623230340a666366333130306462333233336431306135386339373763653037653238 +32393563383237356235633935383161623332613934383164386532316564653861356163393236 +33356133313633333534613966666662636336633565356331616165383433663935663162373730 +30343961316638393433613935323635363332663735623730353230643163393336393462613764 +39323532343533396532636264373166323739343931353139343633636137323633303038643561 +63633964616334386463353566636638393963343931316635343664653363393231363531393438 +31626666616634343833623661386663393731616162636337346235626433356230376564333533 +30626232643461613934346534613233363737373161363832326463343363636336666538633132 +63656633613466623265646235383238663738383632626664356133373964643536646635653238 +66376264376538643465306664653035346637636336366339383561636364616530353232303265 +66626431663965323136363065646339323934623436663862366338613466663564333462326431 +63326131353462316563346366356665393438346430663839376562386638643630613232303833 +66346265633261653463363761333335343331366265663735656331616537323631396331386262 +31623439393039613461303434333636613037326436656363303532373132666339653662376332 +35343964636638393563613066323763653365333965366139396665353065333131653037363563 +65383132356239383332636235336434663961306130656461663739663663346136613239623965 +61363334303637343732393030663066353631323365643532633865363134363761323138343365 +64323233383632376338396632376561636134386133303835396231666436613362343435383234 +36316237636435353736623033356362643238616536626133306639376539353132303331336164 +61396261323865353464353637653061366463376638363736333233383163613662386631343933 +32343937626138343937336162303534336533663535636234363936326139623233356538346630 +63306439643366616137656135623637333033626438343933653063636165373038613239383164 +34636664336165643565643436393961316266653339383961666337383039656362623031656138 +30306433623131366461383635303361666162333261616431363966613432663034343966656139 +63316131646165316339303564316533396362613232643237393233643235666531646162623064 +34393435613635326539613035336462393832653534623433396661366236336237613966623234 +34633838376532326163343437633134353132616438343538633564623033346364336663343564 +64383939646637323932383336303834663236313932656436633533303437626562303031346162 +36623936663266336236346432356135636662613137336439333735356438613433663963653732 +36623331633338346437336130373035306566653766623334303037343663663063663661373736 +31313564646333616638643133636265393837663261396336343866313035643730613639343234 +30653935303831366136633361333637336433393236376339613435303535313038303539336539 +33356634626164663963363562333838353237616130313839653135363733323362613132386461 +64623839356236613839356534323562303031613061633435323232306231313965343766623831 +35636530613036393465323364636661383739623266616530343536353061353363643163666537 +33353961313963366637373163616530373962643630353435383634333865303634363735633461 +62626363303163303265646565373865363733626432353232386436313533353334376165376266 +38623037626137643833363361353635363734393666643336353631363664643863383633336137 +36383834623163323463383736663035653234373337353264316639643462376434633232316331 +33313236333530663362313736303033346134383138333338393761343138363561376334356138 +36363163393835333666393531333635633162363861373033393464623938356332653761333930 +35386435636566336633313263646339303061353638663833643761303463333031386664303531 +61343930306338643634333731353635323164643939356331326564636665303966346137393536 +33313066633266313464333463306637386262363130633832393633366532363538313834306565 +61356533393661353565313166653134643336356138653966623434633335363630636139363139 +36663037303362663035653864306364316361326236623938656334373733313665646530303066 +61386634343232373730363031376637653063333834313862636461353463653161376562376138 +39646164306233643665663737653631353035656135373263343863356437623661633333643331 +35353334313964363731636166356163363831653930356133643938303664336533303331333536 +65353364376232623463623138663737303333636432663262633033663737303836666135386138 +38666562383337353137663735306230373637353837616237643334663933316463666335613739 +65663565643365363431396635663661643964643462643364663231613333323433343931623637 +36336266373333623237383635303436396362393032303731633162383265666430386437643963 +62643961383435626633353733373336313638333038653238383034373635626637303665303562 +36663531326434343763663731623865323531303037306166316264646461376134353831656565 +39613962643938333332333038346234393538343030343261396532363237613339373831303564 +66393162613230376237373631323931663830366336663138643631633438386131333763646562 +38646431343263653237313336653231363962373939393164636562613939663161353565343438 +36626134656533366131653466646138326237303262623731373533313132303339333661616335 +37616334646131303332326261633938336633373039636131363235313330653530346636353236 +64663463333435383535393831613564613266616166666332653366656165633939333537393033 +35393965623265633035656162343961396230346431646533363666396461363139376134326134 +34346136326537616533636433633562336563396539653965633037383265383930303866666535 +30343536623163343237393866323637313739366339316532636633643533373937653764356564 +34373836396264613766666565343139613033373136363165646138636633383361653036653232 +3730