commit cf9efd55b50b5fd5c9735011abbadf17a0be252a Author: Yannik Schmidt Date: Mon Feb 12 17:01:18 2024 +0100 initial: no secrets diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..cb71e6a --- /dev/null +++ b/.gitignore @@ -0,0 +1,8 @@ +*.swp +ansible.log +files/icinga_master_hosts.conf +files/nsca_server.conf +files/async-icinga-config-dynamic.json +files/async-icinga-services-dynamic.conf +hosts.ini +files/atlantis-hub-content/ diff --git a/.gitkeep b/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/ansible-install.sh b/ansible-install.sh new file mode 100644 index 0000000..78efe91 --- /dev/null +++ b/ansible-install.sh @@ -0,0 +1 @@ +ansible-galaxy collection install community.general diff --git a/ansible.cfg b/ansible.cfg new file mode 100644 index 0000000..db74175 --- /dev/null +++ b/ansible.cfg @@ -0,0 +1,3 @@ +[defaults] +inventory = hosts.ini +log_path = ansible.log diff --git a/files/COPYING_NSCA_NG b/files/COPYING_NSCA_NG new file mode 100644 index 0000000..7d29829 --- /dev/null +++ b/files/COPYING_NSCA_NG @@ -0,0 +1,63 @@ +https://github.com/weiss/nsca-ng/blob/master/COPYING + +Unless otherwise noted, all files distributed as part of NSCA-ng are covered +by the copyright and license statement below. Some files (outside the `src' +directory) are subject to different copyright and/or license terms, as +specified at the top of those files. However, all NSCA-ng code is believed +to be covered by terms which are at least as permissive as the following +license. + +| Copyright (c) 2013 Holger Weiss +| All rights reserved. +| +| Redistribution and use in source and binary forms, with or without +| modification, are permitted provided that the following conditions are +| met: +| +| 1. Redistributions of source code must retain the above copyright notice, +| this list of conditions and the following disclaimer. +| +| 2. Redistributions in binary form must reproduce the above copyright +| notice, this list of conditions and the following disclaimer in the +| documentation and/or other materials provided with the distribution. +| +| THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS +| IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, +| THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +| PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR +| CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, +| EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +| PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR +| PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF +| LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +| NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +| SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +In addition to these copyright and license terms, binary redistributions may +be required to reproduce the following copyright notices, depending on which +source files are compiled. The above license statement applies to all of +them. + +If any files in the `lib/ev' directory are used during compilation: + +| Copyright (c) 2007-2018 Marc Alexander Lehmann +| Copyright (c) 2011 Emanuele Giaquinta + +If any files in the `lib/pidfile' directory are used during compilation: + +| Copyright (c) 2005 Pawel Jakub Dawidek +| Copyright (c) 2007 Dag-Erling Coidan Smoergrav + +If the file `lib/pidfile/flock.c' is used during compilation: + +| Copyright (c) 2001 The NetBSD Foundation, Inc. + +If any files in the `python' directory (except for `uthash.h') are used: + +| Copyright (c) 2014 Alexander Golovko + +If any files in the `perl' directory are used: + +| Copyright (c) 2015 Matthias Bethke + +Additional requirements may be imposed by external libraries. diff --git a/files/check_dir_size_for_backup.py b/files/check_dir_size_for_backup.py new file mode 100644 index 0000000..522ea00 --- /dev/null +++ b/files/check_dir_size_for_backup.py @@ -0,0 +1,50 @@ +#!/usr/bin/python3 + +import subprocess +import sys +import os +import argparse +import json + +if __name__ == "__main__": + + parser = argparse.ArgumentParser(description="Backup Dir Size helper") + parser.add_argument('PATH') + parser.add_argument('--save-new-size', action='store_const', + default=False, const=True) + args = parser.parse_args() + + # check parameter # + if not args.PATH.replace("/", "").replace("-","").isalnum(): + print("Illegal Path: {} (must be alphanum + /)".format(args.PATH)) + sys.exit(1) + elif not args.PATH.startswith("/"): + print("Path mus be absolute ({})".format(args.PATH)) + sys.exit(1) + elif not os.path.isdir(args.PATH): + print("Path does not exist ({}".format(args.PATH)) + sys.exit(1) + + savedir = "/opt/backup-info" + savepath = os.path.join(savedir, args.PATH.lstrip("/").replace("/", "-")) + currentSize = 0 + if os.path.isfile(savepath): + with open(savepath) as f: + currentSize = int(f.read()) + + # check # + p = subprocess.run(["du", args.PATH], capture_output=True, encoding="utf-8") + size = int(p.stdout.split("\n")[-2].split("\t")[0]) + + if currentSize and currentSize == size: + result = { "changed" : False, "old" : currentSize, "new" : size } + else: + result = { "changed" : True, "old" : currentSize, "new" : size } + + + if args.save_new_size: + with open(savepath, "w") as f: + f.write(str(size)) + + # return result + print(json.dumps(result)) diff --git a/files/influx-repo.gpg b/files/influx-repo.gpg new file mode 100644 index 0000000..ec3e72a Binary files /dev/null and b/files/influx-repo.gpg differ diff --git a/files/influxdb.list b/files/influxdb.list new file mode 100644 index 0000000..6bb489e --- /dev/null +++ b/files/influxdb.list @@ -0,0 +1 @@ +deb [signed-by=/usr/share/keyrings/influx-repo.gpg] https://repos.influxdata.com/debian bullseye stable diff --git a/files/nsca-ng b/files/nsca-ng new file mode 100755 index 0000000..ac71992 Binary files /dev/null and b/files/nsca-ng differ diff --git a/files/pynagsystemd.py b/files/pynagsystemd.py new file mode 100755 index 0000000..e0589de --- /dev/null +++ b/files/pynagsystemd.py @@ -0,0 +1,106 @@ +#!/usr/bin/python3 +""" +You can redistribute it and/or modify it under the terms of the GNU General +Public License as published by the Free Software Foundation, either version 2 +of the License. +Copyright Andrea Briganti a.k.a 'Kbyte' +""" +import io +import subprocess +import argparse + +import nagiosplugin + + +class SystemdStatus(nagiosplugin.Resource): + name = 'SYSTEMD' + + def probe(self): + # Execute systemctl --failed --no-legend and get output + try: + p = subprocess.Popen(['systemctl', '--failed', '--no-legend'], + stderr=subprocess.PIPE, + stdin=subprocess.PIPE, + stdout=subprocess.PIPE) + pres, err = p.communicate() + except OSError as e: + raise nagiosplugin.CheckError(e) + + if err: + raise nagiosplugin.CheckError(err) + + if pres: + result = "" + for line in io.StringIO(pres.decode('utf-8')): + # format is DOT_SPECIA_CHAR name service failed .. + result = "%s %s" % (result, line.split(' ')[1]) + + return [nagiosplugin.Metric('systemd', (False, result), context='systemd')] + + return [nagiosplugin.Metric('systemd', (True, None), context='systemd')] + + +class ServiceStatus(nagiosplugin.Resource): + name = 'SYSTEMD' + + def __init__(self, *args, **kwargs): + self.service = kwargs.pop('service') + super(nagiosplugin.Resource, self).__init__(*args, **kwargs) + + def probe(self): + # Execute systemctl is-active and get output + try: + p = subprocess.Popen(['systemctl', 'is-active', self.service], + stderr=subprocess.PIPE, + stdin=subprocess.PIPE, + stdout=subprocess.PIPE) + pres, err = p.communicate() + except OSError as e: + raise nagiosplugin.CheckError(e) + + if err: + raise nagiosplugin.CheckError(err) + if pres: + result = "" + for line in io.StringIO(pres.decode('utf-8')): + result = "%s %s" % (result, line.split(' ')[0]) + result = result.strip() + if result == "active": + return [nagiosplugin.Metric('systemd', (True, None), context='systemd')] + else: + return [nagiosplugin.Metric('systemd', (False, self.service), context='systemd')] + + return [nagiosplugin.Metric('systemd', (False, "No Service given"), context='systemd')] + + +class SystemdContext(nagiosplugin.Context): + def __init__(self): + super(SystemdContext, self).__init__('systemd') + + def evaluate(self, metric, resource): + value, output = metric.value + if value: + return self.result_cls(nagiosplugin.Ok, metric=metric) + else: + return self.result_cls(nagiosplugin.Critical, metric=metric, hint='failed units: %s' % output) + + +def main(): + parser = argparse.ArgumentParser() + parser.add_argument("-s", "--service", type=str, dest="service", help="Name of the Service that is beeing tested") + + args = parser.parse_args() + + if args.service is None: + check = nagiosplugin.Check( + SystemdStatus(), + SystemdContext()) + else: + check = nagiosplugin.Check( + ServiceStatus(service=args.service), + SystemdContext()) + check.main() + + +if __name__ == '__main__': + main() diff --git a/files/send_nsca b/files/send_nsca new file mode 100755 index 0000000..3cd0004 Binary files /dev/null and b/files/send_nsca differ diff --git a/group_vars/all.yaml b/group_vars/all.yaml new file mode 100644 index 0000000..70ef3b9 --- /dev/null +++ b/group_vars/all.yaml @@ -0,0 +1,280 @@ +--- +checks: +extra_sheppy_pubkeys: +nsca_server: "" +ldap_server: "" +nsca_password: "" +RSYSLOG_SERVER: "" +influxdb_telegraf_password: "" + +icinga_api_user: "" +icinga_api_pass: "" +icinga_api_url: "https://XXXXXXXXXXXXXXX:5665" +icinga_web_url: "https://icinga.atlantishq.de/" + +event_dispatcher_host: dispatcher.atlantishq.de +event_dispatcher_proto: https +event_dispatcher_port: 443 +event_dispatcher_address: "{{ event_dispatcher_proto }}://{{ event_dispatcher_host }}" +event_dispatcher_user: "" +event_dispatcher_pass: "" + +ldap_password: "" +ldap_dc: "atlantishq" +ldap_org: "atlantishq de" +ldap_suffix: "dc=atlantishq,dc=de" +ldap_bind_dn: "cn=Manager,dc=atlantishq,dc=de" +ldap_user_dn: "ou=People,dc=atlantishq,dc=de" +ldap_group_dn: "ou=groups,dc=atlantishq,dc=de" +ldap_connection_url: ldap://192.168.122.112 +ldap_connection_url_ext: "ldaps://ldap.atlantishq.de" + +event_dispatcher_token: "" + +extra_root_keys: + - "# no extra keys" + +smtp_internal_host: mail.atlantishq.de +smtp_internal_host_port: 8025 +smtp_service_user: "" +smtp_service_pass: "" + +pki_domain: pki.atlantishq.de + +SOUNDLIB_AWS_ACCESS_KEY_ID: "" +SOUNDLIB_AWS_SECRET_ACCESS_KEY: "" +SOUNDLIB_S3_ENDPOINT: "" + +# gotify # +gotify_user: admin +gotify_password: "" + +# overwritten in monitoring master group var +monitoring_master: false + +async_icinga_static_services: + - { "name" : "service_names", "timeout" : "5h", "owner" : "sheppy", "token" : "" } + +keycloak_admin_password: "" +keycloak_postgres_password: "" +keycloak_address: keycloak.atlantishq.de + +harbor_http_secret: "" +harbor_core_secret: "" +harbor_jobservice_secret: "" +harbor_postgres_pass: "" +harbor_registry_user: harbor +harbor_registry_password: "" +harbor_admin_password: "" + +keycloak_clients: + python-flask-picture-factory: + party_secret : "" # pwgen -s 16 + client_id: z_images + client_secret: "" # pwgen -s 32 + redirect_uris: + - "https://images.atlantishq.de/*" + - "https://images.athq.de/*" + - "https://images.potaris.de/*" + description: "Images Factory" + keycloak_id: "00000000-0000-0000-0000-000000000001" + groups: "images" + master_address: "https://images.atlantishq.de" + skips: + - "/m/" + - "/media/" + - "/image/" + - "/images/" + - "/picture/" + - "/pictures/" + + simple-log-server: + party_secret : "" + client_id: z_sls + client_secret: "" + redirect_uris: + - "https://sls.atlantishq.de/*" + description: "Simple Log Server" + keycloak_id: "00000000-0000-0000-0000-000000000002" + groups: "monitoring" + master_address: "https://sls.atlantishq.de" + skips: + - "/submit" + + soundlib-interface: + party_secret : "" + client_id: z_soundlib + client_secret: "" + redirect_uris: + - "https://sounds.atlantishq.de/*" + description: "Soundlib interface" + keycloak_id: "00000000-0000-0000-0000-000000000003" + groups: "soundlib" + master_address: "https://sounds.atlantishq.de" + skips: + + pki: + party_secret : "" + client_id: z_hashicorp_vault + client_secret: "" + redirect_uris: + - "https://pki.atlantishq.de/*" + description: "PKI Vault" + keycloak_id: "00000000-0000-0000-0000-000000000004" + groups: "pki" + master_address: "https://pki.atlantishq.de" + skips: + + cert-manager: + party_secret : "" + client_id: z_cert_manager + client_secret: "" + redirect_uris: + - "https://vpn.atlantishq.de/*" + description: "AtlantisHQ Certificate Manager" + keycloak_id: "00000000-0000-0000-0000-000000000005" + groups: "pki" + master_address: "https://vpn.atlantishq.de" + skips: + + tmnf-replay-server: + party_secret : "" + client_id: z_trackmania + client_secret: "" + redirect_uris: + - "https://trackmania.atlantishq.de/*" + description: "AtlantisHQ Trackmania Replays" + keycloak_id: "00000000-0000-0000-0000-000000000006" + groups: "trackmania" + master_address: "https://trackmania.atlantishq.de" + skips: + - "/open-info" + + atlantis-hub: + party_secret : "" + client_id: z_atlantishub + client_secret: "" + redirect_uris: + - "https://hub.atlantishq.de/*" + description: "AtlantisHQ Hub" + keycloak_id: "00000000-0000-0000-0000-000000000007" + groups: + master_address: "https://hub.atlantishq.de" + skips: + + paperless: + party_secret : "" + client_id: z_paperless + client_secret: "" + redirect_uris: + - "https://paperless.atlantishq.de/*" + description: "AtlantisHQ Paperless Archiving" + keycloak_id: "00000000-0000-0000-0000-000000000008" + groups: "paperless" + master_address: "https://paperless.atlantishq.de" + skips: + + icinga: + party_secret : "" + client_id: z_icinga + client_secret: "" + redirect_uris: + - "https://icinga.atlantishq.de/*" + description: "Icinga Web" + keycloak_id: "00000000-0000-0000-0000-000000000009" + groups: "monitoring,icinga" + master_address: "https://icinga.atlantishq.de" + skips: + + grafana: + party_secret : "" + client_id: z_grafana + client_secret: "" + redirect_uris: + - "https://stats.atlantishq.de/*" + description: "Grafana" + keycloak_id: "00000000-0000-0000-0000-000000000010" + groups: "monitoring" + master_address: "https://stats.atlantishq.de" + skips: + + async-icinga: + party_secret : "" + client_id: z_async_icinga + client_secret: "" + redirect_uris: + - "https://async-icinga.atlantishq.de/*" + description: "Icinga Web" + keycloak_id: "00000000-0000-0000-0000-000000000011" + groups: "monitoring,icinga" + master_address: "https://async-icinga.atlantishq.de" + skips: + - "/report" + + hedgedoc: + party_secret : "" + client_id: z_hedgedoc + client_secret: "" + redirect_uris: + - "https://hedgedoc.atlantishq.de/*" + description: "Hedgedoc" + keycloak_id: "00000000-0000-0000-0000-000000000012" + groups: "monitoring" + master_address: "https://hedgedoc.atlantishq.de" + + harbor: + party_secret: "" + client_id: z_harbor + client_secret: "" + redirect_uris: + - "https://harbor-registry.atlantishq.de/*" + description: "Harbor Registry" + keycloak_id: "00000000-0000-0000-0000-000000000013" + groups: "pki" + master_address: "https://harbor-registry.atlantishq.de" + + atlantis-verify: + party_secret: "" + client_id: z_at_verify + client_secret: "" + redirect_uris: + - "https://verify.atlantishq.de/*" + description: "Atlantis Verification" + keycloak_id: "00000000-0000-0000-0000-000000000014" + groups: + master_address: "https://verify.atlantishq.de" + + reactive-resume: + party_secret: "" + client_id: z_reactive_resume + client_secret: "" + redirect_uris: + - "https://resume.atlantishq.de/*" + description: "Reactive Resume" + keycloak_id: "00000000-0000-0000-0000-000000000015" + groups: + master_address: "https://resume.atlantishq.de" + skips: + - "/logo/light.svg" + + money-balancer: + party_secret: "" + client_id: z_money_balancer + client_secret: "" + redirect_uris: + - "https://money-balancer.atlantishq.de/*" + description: "Money Balancer" + keycloak_id: "00000000-0000-0000-0000-000000000016" + groups: + master_address: "https://money-balancer.atlantishq.de" + + atlantis-web-check: + party_secret: "" + client_id: z_web_check + client_secret: "" + redirect_uris: + - "https://smartchecks.atlantishq.de/*" + description: "SMART Web-Checks" + keycloak_id: "00000000-0000-0000-0000-000000000017" + groups: + master_address: "https://smartchecks.atlantishq.de" diff --git a/group_vars/git.yaml b/group_vars/git.yaml new file mode 100644 index 0000000..e69de29 diff --git a/group_vars/harbor-registry.yaml b/group_vars/harbor-registry.yaml new file mode 100644 index 0000000..3ee2be3 --- /dev/null +++ b/group_vars/harbor-registry.yaml @@ -0,0 +1,4 @@ +harbor_version: v2.10.0 +harbor_file: harbor-online-installer-{{ harbor_version }}.tgz +harbor_admin_password: "" +harbor_db_password: "" diff --git a/group_vars/irc.yaml b/group_vars/irc.yaml new file mode 100644 index 0000000..1fd12ce --- /dev/null +++ b/group_vars/irc.yaml @@ -0,0 +1,3 @@ +--- +checks : + - { user : sheppy, name : irc, cmd : "/bin/true"} diff --git a/group_vars/kathi.yaml b/group_vars/kathi.yaml new file mode 100644 index 0000000..c26779e --- /dev/null +++ b/group_vars/kathi.yaml @@ -0,0 +1,7 @@ +extra_sheppy_pubkeys: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC/395VxgeExQUllcOw5n2U/6ZQoBznwNz136SLJd3B8rDUM6vFhJVIDIh3IKGCBttyIiDZtMw/XnMdxfm9/A4micFKcFnYc1/JF+clNXYRC6tX4jq8gOrDdQZkRQXrSpACt9Zm7yk7OYeVoBsOraZCfi8xnkbXiRnIi9u7HFYk01PVwbtEr+aG0PZxHBZZlng+dDi0b9DeJ115QBtW5IWBx9bwBo3utg1TcLIge5q76ioNX7B8r0aNylCOl3yw3ifui2mgiTGKe5utpl4vJV1UphUamTqFPEMm2wxFg3kppfXwdexKpoEoAR3sh/UjeKL59rs/ilzV7KIEGeOctGDI7cxEkQBsZNox2LAoVSOnNJC/TPVVYoLvJ41jYX9mlpK+AlgRdVvNZl9rR4rm06Gh7FP+UxSt/IOgZ8bW1hlbzYq18D9sT8VFxVHzxzbBtgioUnxCtnzJ61sLnQog8AyXCaqVoQ7KtyRXSUZsLpHFsDj2r3GojIMaHRG3ko7zQok= bekama + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCbKTdJjGmXz4dWD21wnLBZXgI1hPBE1gaIW2DAraZFExmoamhYtLTGNv1w2caM22hRI3yk+5DYJHEdhYt3ws7b8ZnLJnjJr8LQj8q3RRfI5ixkO1IsHiO1QG9blaD01aQ7zLd7h9X0gk9wpkC0CR3Z9LsfW73Wkgs+b0ggVeyheX9CXFfCDmveoDKj/Rl1gBZAfFyEvhTiuh9TNVyMdo6haYRJNYXIj3yMWaFQY30Sdf1y+IVwUXsko/RZ8YA8lJ3eHPbs3tdmCgvprHefC051NzIducUuAwq1EVYnFfj6Vbp9QJDbgc1lHDinwr1Sw1C0a+3p+jip8atqPEkBpcqhqEYjq0hGZOUTSSetny7mtS4cK5WGZbwxejD9/eg0Vf60DAqkWN1zXWUQNNftcf1bPvCxqUl7nTjW01Bdyo5LTleAGOPmusOVRaCnu5YkL+g5RIhg97sumWwDfp2Tcr3cz5pRdox9QXDXafcSpSbcUPdqIl094GitkQExCZ91dY0= kathi@atlantisV2 + +extra_root_keys: + - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC/395VxgeExQUllcOw5n2U/6ZQoBznwNz136SLJd3B8rDUM6vFhJVIDIh3IKGCBttyIiDZtMw/XnMdxfm9/A4micFKcFnYc1/JF+clNXYRC6tX4jq8gOrDdQZkRQXrSpACt9Zm7yk7OYeVoBsOraZCfi8xnkbXiRnIi9u7HFYk01PVwbtEr+aG0PZxHBZZlng+dDi0b9DeJ115QBtW5IWBx9bwBo3utg1TcLIge5q76ioNX7B8r0aNylCOl3yw3ifui2mgiTGKe5utpl4vJV1UphUamTqFPEMm2wxFg3kppfXwdexKpoEoAR3sh/UjeKL59rs/ilzV7KIEGeOctGDI7cxEkQBsZNox2LAoVSOnNJC/TPVVYoLvJ41jYX9mlpK+AlgRdVvNZl9rR4rm06Gh7FP+UxSt/IOgZ8bW1hlbzYq18D9sT8VFxVHzxzbBtgioUnxCtnzJ61sLnQog8AyXCaqVoQ7KtyRXSUZsLpHFsDj2r3GojIMaHRG3ko7zQok= bekama + - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCbKTdJjGmXz4dWD21wnLBZXgI1hPBE1gaIW2DAraZFExmoamhYtLTGNv1w2caM22hRI3yk+5DYJHEdhYt3ws7b8ZnLJnjJr8LQj8q3RRfI5ixkO1IsHiO1QG9blaD01aQ7zLd7h9X0gk9wpkC0CR3Z9LsfW73Wkgs+b0ggVeyheX9CXFfCDmveoDKj/Rl1gBZAfFyEvhTiuh9TNVyMdo6haYRJNYXIj3yMWaFQY30Sdf1y+IVwUXsko/RZ8YA8lJ3eHPbs3tdmCgvprHefC051NzIducUuAwq1EVYnFfj6Vbp9QJDbgc1lHDinwr1Sw1C0a+3p+jip8atqPEkBpcqhqEYjq0hGZOUTSSetny7mtS4cK5WGZbwxejD9/eg0Vf60DAqkWN1zXWUQNNftcf1bPvCxqUl7nTjW01Bdyo5LTleAGOPmusOVRaCnu5YkL+g5RIhg97sumWwDfp2Tcr3cz5pRdox9QXDXafcSpSbcUPdqIl094GitkQExCZ91dY0= kathi@atlantisV2 diff --git a/group_vars/mail.yaml b/group_vars/mail.yaml new file mode 100644 index 0000000..70e1bf2 --- /dev/null +++ b/group_vars/mail.yaml @@ -0,0 +1,3 @@ +--- +checks : + - { user : nobody, name : mail_queue, cmd : "/usr/lib/nagios/plugins/check_mailq -w 10 -c 20"} diff --git a/group_vars/monitoring.yaml b/group_vars/monitoring.yaml new file mode 100644 index 0000000..a781164 --- /dev/null +++ b/group_vars/monitoring.yaml @@ -0,0 +1,6 @@ +monitoring_master: true +extra_internal_iptables_ports_allow: + - { "protocol" : "tcp", "port" : 8086, "comment" : "influx" } + - { "protocol" : "tcp", "port" : 514, "comment" : "rsyslog" } + - { "protocol" : "tcp", "port" : 5665, "comment" : "icinga-api" } + - { "protocol" : "tcp", "port" : 5668, "comment" : "nsca" } diff --git a/group_vars/steam.yaml b/group_vars/steam.yaml new file mode 100644 index 0000000..52f73f3 --- /dev/null +++ b/group_vars/steam.yaml @@ -0,0 +1,4 @@ +--- +checks : + - { user : sheppy, name : insurgency-1, cmd : "/etc/monitoring-tools/rcon-check.py -p 27015"} + - { user : sheppy, name : insurgency-2, cmd : "/etc/monitoring-tools/rcon-check.py -p 27016"} diff --git a/group_vars/ths.yaml b/group_vars/ths.yaml new file mode 100644 index 0000000..5d4d887 --- /dev/null +++ b/group_vars/ths.yaml @@ -0,0 +1,3 @@ +--- +checks : + - { user : sheppy, name : irc, cmd : ""} diff --git a/group_vars/usermanagement.yaml b/group_vars/usermanagement.yaml new file mode 100644 index 0000000..e3f85f3 --- /dev/null +++ b/group_vars/usermanagement.yaml @@ -0,0 +1,7 @@ +--- +extra_internal_iptables_ports_allow: + - { "protocol" : "tcp", "port" : 389, "comment" : "ldap" } + - { "protocol" : "tcp", "port" : 22, "comment" : "ssh from backup" } + +extra_sheppy_pubkeys: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDaABPy9h009vUQj+gewvhIO9kDpUBkkW5dGz6HsDxp6FLeZ0KOMTPZyRkwPHkC3Jee8vkTl2fFi7wjXhkWSpPe7H/RFdn6nHf5RSvM4aEwhkjD7E1lvf9lLRUXnISeFXFOdD3hpRXqT5yVP9O1S3Rk3b+i9HPlcw1vDmFHS5mZ+rXmxQSyHD8uuyCEL1Ri5IOz9XxycaJ/MHX2XaHWU+xgrQ2uvWrvhnibB3bhtf94GrHJQXRfjUc4nF3SG3937Fkdit5LozuDE3/mLoNN6PwXz13Z2acClpjiyOZQxpa2+TpwE5i2rWoZwsXv//yzohHbA30+qYSxJYQrYZ1XRyOSPFWSp3wwcuj8yMMqMJT2e75ZyWaHuoYuindOFW4VMR7pFppssnnbdLHvJGe5PZMSDxlyhUtkAK4p1nf2nEng3VjCBcn6UWK1po5DQmcLwkd0cQbWTLxHjH4sAtfyp7A8jsGLXrhWraMOOoU0JVkamZrq2BuSyaC5S7+KdvGCg3U= backupvm diff --git a/group_vars/vpn.yaml b/group_vars/vpn.yaml new file mode 100644 index 0000000..f1934c4 --- /dev/null +++ b/group_vars/vpn.yaml @@ -0,0 +1,9 @@ +--- +checks : + - { user : nobody, name : wireguard-darknet-rudi, cmd : "/usr/lib/nagios/plugins/check_ping -H fe80::2%wg_rudi_darknet -w300,10% -c 1000,20%"} + - { user : nobody, name : wireguard-darknet-hase, cmd : "/usr/lib/nagios/plugins/check_ping -H fe80::2%wg_hase_darknet -w300,10% -c 1000,20%"} +# - { user : nobody, name : darknet-reachable, cmd : "/usr/lib/nagios/plugins/check_ping -H 10.100.100.100 -w300,10% -c 1000,20%"} + +openvpn_management_password: "" +openvpn_management_passfile: mgnt-pass.txt +openvpn_management_port: 23000 diff --git a/group_vars/web1.yaml b/group_vars/web1.yaml new file mode 100644 index 0000000..272ad70 --- /dev/null +++ b/group_vars/web1.yaml @@ -0,0 +1,2 @@ +extra_internal_iptables_ports_allow: + - { "protocol" : "tcp", "port" : 5004, "comment" : "signal-gateway" } diff --git a/group_vars/zabbix.yaml b/group_vars/zabbix.yaml new file mode 100644 index 0000000..564b034 --- /dev/null +++ b/group_vars/zabbix.yaml @@ -0,0 +1,2 @@ +extra_internal_iptables_ports_allow: + - { "protocol" : "tcp", "port" : 10051, "comment" : "zabbix-server" } diff --git a/playbook.yaml b/playbook.yaml new file mode 100644 index 0000000..f04aa6d --- /dev/null +++ b/playbook.yaml @@ -0,0 +1,63 @@ +--- +- hosts: all + roles: + - { role : monitoring-client, tags : [ "monitoring", "monitoring-client", "client"] } + - { role : sshd-config, tags : [ "sshd" ] } + - { role : rsyslog, tags : [ "rsyslog" ] } + - { role : monitoring-influx, tags : [ "influx" ] } + - { role : base, tags : [ "base" ] } + - { role : zabbix-agent, tags : [ "zabbix-agent" ] } + - { role : iptables, tags : [ "iptables" ] } + +- hosts: web1 + roles: + - { role : web1, tags : [ "web1" ] } + - { role : media, tags : [ "media" ] } + +- hosts: mail + roles: + - { role : mail, tags : [ "mail" ] } + +- hosts: backup + roles: + - { role : backup-vm, tags : [ "backup" ] } + +- hosts: kube1 + roles: + - { role : docker-deployments, tags : [ "docker", "kube1" ] } + +- hosts: usermanagement + roles: + - { role : usermanagement, tags : [ "users", "keycloak" ] } + +- hosts: monitoring + roles: + - { role : monitoring-master, tags : [ "monitoring-master", "icinga", "grafana" ] } + +- hosts: typo3-cms + roles: + - { role : typo3-cms, tags : [ "typo3" ] } + +- hosts: paperless + roles: + - { role : paperless, tags : [ "paperless" ] } + +- hosts: vault-pki + roles: + - { role : vault-pki, tags : [ "pki_master", "vault" ] } + +- hosts: vpn + roles: + - { role : openvpn, tags : [ "openvpn", "vpn", "certificate-manager" ] } + +- hosts: timetracking + roles: + - { role : timetracking, tags : [ "timetracking", "kamai" ] } + +- hosts: harbor-registry + roles: + - { role : harbor-registry, tags : [ "harbor" ] } + +- hosts: nextcloud ths + roles: + - { role: nextcloud, tags: ["nextcloud"] } diff --git a/prometheus-adhoc.yaml b/prometheus-adhoc.yaml new file mode 100644 index 0000000..48e7fd7 --- /dev/null +++ b/prometheus-adhoc.yaml @@ -0,0 +1,11 @@ +- name: Install Prometheus Node Exporter + hosts: prometheus + become: yes + tasks: + - name: Install Prometheus Node Exporter + import_role: + name: prometheus.prometheus.node_exporter + vars: + #node_exporter_basic_auth_users: + # prometheus: "toto" + node_exporter_web_telemetry_path: "/node-exporter" diff --git a/roles/backup-vm/files/backup_priv_key b/roles/backup-vm/files/backup_priv_key new file mode 100644 index 0000000..837ca68 --- /dev/null +++ b/roles/backup-vm/files/backup_priv_key @@ -0,0 +1,38 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn +NhAAAAAwEAAQAAAYEA2gAT8vYdNPb1EI/oHsL4SDvZA6VAZJFuXRs+h7A8aehS3mdCjjEz +2ckZMDx5AtyXnvL5E5dnxYu8I14ZFkqT3ux/0RXZ+px3+UUrzOGhMIZIw+xNZb3/ZS0VF5 +yEnhVxTnQ94aUV6k+clT/TtUt0ZN2/ovRz5XMNbw5hR0uZmfq15sUEshw/LrsghC9UYuSD +s/V8cnGifzB19l2h1lPsYK0Nrr1q74Z4mwd24bX/eBqxyUF0X41HOJxd0ht/d+xZHYreS6 +M7gxN/5i6DTej8F89d2dmnApaY4sjmUMaWtvk6cBOYtq1qGcLF7//8s6IR2wN9PqmEsSWE +K2GdV0cjkjxVkqd8MHLo/MjDKjCU9nu+Wclmh7qGLop3ThVuFTEe6RaabLJ523Sx7yRnuT +2TEg8ZcoVLZACuKdZ39pxJ4N1YwgXJ+lFitaaOQ0JnC8JHdHEG1ky8R4x+LALX8qewPI7B +i164Vq2jDjqFNCVZGpma6tgbksmguUu/inbxgoN1AAAFiNBNJKrQTSSqAAAAB3NzaC1yc2 +EAAAGBANoAE/L2HTT29RCP6B7C+Eg72QOlQGSRbl0bPoewPGnoUt5nQo4xM9nJGTA8eQLc +l57y+ROXZ8WLvCNeGRZKk97sf9EV2fqcd/lFK8zhoTCGSMPsTWW9/2UtFRechJ4VcU50Pe +GlFepPnJU/07VLdGTdv6L0c+VzDW8OYUdLmZn6tebFBLIcPy67IIQvVGLkg7P1fHJxon8w +dfZdodZT7GCtDa69au+GeJsHduG1/3gasclBdF+NRzicXdIbf3fsWR2K3kujO4MTf+Yug0 +3o/BfPXdnZpwKWmOLI5lDGlrb5OnATmLatahnCxe///LOiEdsDfT6phLElhCthnVdHI5I8 +VZKnfDBy6PzIwyowlPZ7vlnJZoe6hi6Kd04VbhUxHukWmmyyedt0se8kZ7k9kxIPGXKFS2 +QArinWd/acSeDdWMIFyfpRYrWmjkNCZwvCR3RxBtZMvEeMfiwC1/KnsDyOwYteuFatow46 +hTQlWRqZmurYG5LJoLlLv4p28YKDdQAAAAMBAAEAAAGAbms5r4eflZM83820SdiBf7zol+ +Mc8ZOELh69lmbawt4NE1+EI5eiZr5oRrlqpdtr5PO224iF5FZ5zgQ8esD9kx2BRDtoNHsK +fbTekaD7TyPFOY+4SD9rXCjwlQwPVC8SPCW+rks7BXqbmjFBH4P/iZOUHIrrJR4YgNbsyP +ru60JE3oWOclTCX/4iYzHB8XFDkGRYS3NpVjkKluYoMfJCOVmOI6MHxhj7f7LRMVRI+OG0 +iXbg5gEeQPtavjB1aR3JuajYIRaxbJUzKCgE4+yeljvObSdG9THUiuFOTEkXcdtYnPu3uy +d2LcBQzLJ0BY6YvIoI4OFV6lqRRBXMleUSKzHFgkHUuRAKyPtVrE38HV/X5qQeBlg89/7/ +XuwZDq+A7fSm95uj85bmrUXBKBog/F31UW+1P3lZ7j/ZxmcPwcJTJvPTFOSweynimeSZB/ +lwFJpiDhxJjlfpWF0GxgIHdsjD4CZgSpSKCh/kI954f4HnhWEXbs8quoGwgrjIElTFAAAA +wEbaLe1mPdp8LsvOTbWNiF9eT5pKO2pwkJPINJ20ylxwYaap0Xda79shdskkxKTCwIFvoA +xjdE6B1HKqzsWHu7fiQ29/btdAZav+930tMSxemIwhNe9aHyOgoujNS8UaxaR/sSTnj19V +7DyetxFPGW1H1A/KKnPm+muqgO7KARHoQ+0x3I6pJzM+XHN5DT5FNSdtVm+xWCNsXwL4bk +t5d5vBU/VAspgNZVSge+aN3R2FGqA0dlDww4XX0nywbaO8WgAAAMEA/kwTKHc7W9eqYCzM +yRrPXB1cRhrLYOJNX+ykl/xPPx4YeZmrDmNfzcC8DULC/5HkXEygpsxuzK1SbGM0eeQyMu +LboVYxgslC0QjIfDS3x7CYUMsrK1r1nleGxYFpXRBTqKty6nNR53Unum2QAsGW90xfoD1N +NEeb2d/wgG/QHmTh6BzJ6JYqjc/ATsqfR5aKoNnh1stRHu6TzrIK4Y/6e/HEoXElwOyeYX +DadG5VfnD4jglgQR78sHtaSSIpvCADAAAAwQDbdcgfXQ93mIDnk97aXbrR/tP76+0QmsM2 +IImV3/mhnjwsYXHnYTBoci6t+L+zClpW2FIj532XKSBF+fxIOTpnMW4grKICivbWmcrCj+ +aA+w+mshv4K1A+TDlzfW4c+UHpp26UopkaFMrG9hvNoDcREyYqERf1YnxZCLTGgNQLpDUa +rveYj+PzCjTzUzH2wgtNttIDWeekFxTJP/7a7sdaRe4DzMMn0B0UDVKGgKY7s5q1xL0IJq +8oXFJvSt894ScAAAASc2hlcHB5QGF0bGFudGlzcGFkAQ== +-----END OPENSSH PRIVATE KEY----- diff --git a/roles/backup-vm/files/config b/roles/backup-vm/files/config new file mode 100644 index 0000000..5490bae --- /dev/null +++ b/roles/backup-vm/files/config @@ -0,0 +1,3 @@ +Host * + User sheppy + IdentityFile ~/.ssh/backup_priv_key diff --git a/roles/backup-vm/files/ths_cal_backup.sh b/roles/backup-vm/files/ths_cal_backup.sh new file mode 100644 index 0000000..fabdfc7 --- /dev/null +++ b/roles/backup-vm/files/ths_cal_backup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +set -e + +cd +BACKUP_NAME=backup_$(date +%Y%m%d).zip +mkdir -p ~/ths_caldav_backups/ +mkdir -p ~/ths_carddav_backups/ +mkdir -p ~/ths_carddav_telefon_backups/ + +vdirsyncer -c vsyncdir.conf sync + +zip -q -r ~/ths_caldav_backups/${BACKUP_NAME} ~/ths-caldav +zip -q -r ~/ths_carddav_backups/${BACKUP_NAME} ~/ths-carddav +zip -q -r ~/ths_carddav_telefon_backups/${BACKUP_NAME} ~/ths-carddav-telefon + +~/backups/backup-tools/backup_manager.py ~/ths_caldav_backups/ --debug +~/backups/backup-tools/backup_manager.py ~/ths_carddav_backups/ --debug +~/backups/backup-tools/backup_manager.py ~/ths_carddav_telefon_backups/ --debug + +# send to storrage box +rsync --delete --rsh="/usr/bin/sshpass -p '' ssh -p23" -r ths_caldav_backups/* u244665-sub2@u244665.your-storagebox.de:./ths_caldav_backups/ +rsync --delete --rsh="/usr/bin/sshpass -p '' ssh -p23" -r ths_carddav_backups/* u244665-sub2@u244665.your-storagebox.de:./ths_caldav_backups/carddav/ +rsync --delete --rsh="/usr/bin/sshpass -p '' ssh -p23" -r ths_carddav_telefon_backups/* u244665-sub2@u244665.your-storagebox.de:./ths_caldav_backups/carddav_telefon/ + +curl -H "Content-Type: application/json" \ + -X POST https://async-icinga.atlantishq.de/report \ + -d '{ "service" : "ths_caldav_backup", "token" : "", "status" : "OK", "info" : "" }' diff --git a/roles/backup-vm/files/vsyncdir.conf b/roles/backup-vm/files/vsyncdir.conf new file mode 100644 index 0000000..308ee8b --- /dev/null +++ b/roles/backup-vm/files/vsyncdir.conf @@ -0,0 +1,54 @@ +[general] +status_path = "~/.vdirsyncer/status/" + +[pair ths_caldav] +a = "ths_remote_caldav" +b = "ths_local_caldav" +collections = ["from a"] + +[storage ths_remote_caldav] +type = "caldav" +read_only = true +url = "https://ths.atlantishq.de/remote.php/dav/calendars/backup/ths_shared_by_ths/" +username = "backup" +password = "" + +[storage ths_local_caldav] +type = "filesystem" +path = "~/ths-caldav/" +fileext = ".ics" + +[pair ths_carddav] +a = "ths_remote_carddav" +b = "ths_local_carddav" +collections = ["from a"] + +[storage ths_remote_carddav] +type = "carddav" +read_only = true +url = "https://ths.atlantishq.de/remote.php/dav/addressbooks/users/backup/ths_shared_by_ths/" +username = "backup" +password = "" + +[storage ths_local_carddav] +type = "filesystem" +path = "~/ths-carddav/" +fileext = ".vcf" + + +[pair ths_carddav_telefon] +a = "ths_remote_carddav_telefon" +b = "ths_local_carddav_telefon" +collections = ["from a"] + +[storage ths_remote_carddav_telefon] +type = "carddav" +read_only = true +url = "https://ths.atlantishq.de/remote.php/dav/addressbooks/users/backup/ths-telefon-1_shared_by_ths/" +username = "backup" +password = "" + +[storage ths_local_carddav_telefon] +type = "filesystem" +path = "~/ths-carddav-telefon/" +fileext = ".vcf" diff --git a/roles/backup-vm/tasks/main.yaml b/roles/backup-vm/tasks/main.yaml new file mode 100644 index 0000000..311162d --- /dev/null +++ b/roles/backup-vm/tasks/main.yaml @@ -0,0 +1,76 @@ +- name: Install tools + apt: + pkg: + - zip + - vdirsyncer + +- name: Copy Backup caldav script + copy: + src: ths_cal_backup.sh + dest: /home/sheppy/ths_cal_backup.sh + owner: sheppy + group: sheppy + +- name: Copy vdirsync config + copy: + src: vsyncdir.conf + dest: /home/sheppy/vsyncdir.conf + owner: sheppy + group: sheppy + +- name: Create backups dir + file: + path: /home/sheppy/backups/ + state: directory + owner: sheppy + group: sheppy + +- name: Clone backup tools + git: + repo: https://github.com/FAUSheppy/backup-tools + dest: /home/sheppy/backups/backup-tools/ + version: master + become: yes + become_user: sheppy + +- name: Create SSH Dir + file: + path: /home/sheppy/.ssh/ + state: directory + owner: sheppy + group: sheppy + +- name: Copy SSH config and backup priv key + copy: + src: "{{ item }}" + dest: "/home/sheppy/.ssh/{{ item }}" + owner: sheppy + group: sheppy + mode: 0600 + with_items: + - backup_priv_key + - config + +- name: template SLAPD backup script + template: + src: slapd_backup.sh + dest: /home/sheppy/ + owner: sheppy + group: sheppy + mode: 0700 + +- name: Add slapd script to cron + cron: + minute: "10" + hour: "1" + name: SLAPD via rsync backup + job: /home/sheppy/slapd_backup.sh + user: sheppy + +- name: Add ths nextcloud backup script to cron + cron: + minute: "0" + hour: "1" + name: THS Caldav Backup + job: /home/sheppy/ths_cal_backup.sh + user: sheppy diff --git a/roles/backup-vm/templates/slapd_backup.sh b/roles/backup-vm/templates/slapd_backup.sh new file mode 100644 index 0000000..c33eee5 --- /dev/null +++ b/roles/backup-vm/templates/slapd_backup.sh @@ -0,0 +1,14 @@ +#!/bin/bash +set -e + +DIR=/home/sheppy/slapd_backup + +rsync -r --remove-source-files sheppy@192.168.122.112:$DIR /home/sheppy + +~/backups/backup-tools/backup_manager.py --extensions ldif -- $DIR + +rsync --delete --rsh="/usr/bin/sshpass -p ebHYlyVHgRnBcdkb ssh -p23" -r slapd_backup/* u244665-sub2@u244665.your-storagebox.de:./slapd_backup/ + +curl -H "Content-Type: application/json" \ + -X POST https://async-icinga.atlantishq.de/report \ + -d '{ "service" : "slapd_backup", "token" : "WX0yXFxSsb", "status" : "OK", "info" : "" }' diff --git a/roles/base/tasks/main.yaml b/roles/base/tasks/main.yaml new file mode 100644 index 0000000..4884a9d --- /dev/null +++ b/roles/base/tasks/main.yaml @@ -0,0 +1,49 @@ +- name: Install packages + apt: + pkg: + - rsync + - zsh + - net-tools + - tcpdump + - git + - apt-file + +- name: Ensure Opt dir exists and accessible + file: + name: /opt/ + state: directory + mode: 0711 + +- name: Ensure backup info dir exists and accessible + file: + name: /opt/backup-info/ + state: directory + mode: 0700 + +- name: Copy Backup Helper script + copy: + src: check_dir_size_for_backup.py + dest: /opt/check_dir_size_for_backup.py + mode: 0755 + +- name: Create sheppy .ssh dir + file: + path: /home/sheppy/.ssh/ + state: directory + owner: sheppy + group: sheppy + mode: 0700 + +- name: Template Sheppy authorized keys + template: + src: authorized_keys_sheppy.j2 + dest: /home/sheppy/.ssh/authorized_keys + owner: sheppy + group: sheppy + mode: 0600 + +- name: Add extra root keys + lineinfile: + path: /root/.ssh/authorized_keys + line: "{{ item }}" + loop: "{{ extra_root_keys }}" diff --git a/roles/base/templates/authorized_keys_sheppy.j2 b/roles/base/templates/authorized_keys_sheppy.j2 new file mode 100644 index 0000000..6adbd4f --- /dev/null +++ b/roles/base/templates/authorized_keys_sheppy.j2 @@ -0,0 +1,3 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDoUijFwmZaYHbueDsa3T2BV5UfMxKpztbuJwSBZ5s0WbZlg/9E9SHeGztaN/SCyQZdtOA7bR6tQMWhx4fadvrjg5BrN1bjpNUb2/rAxuWw0yU0Yp2CWwE02m+3bMj4pXeaI2Mk/Ywubfl88W2/OrUpbhHoYeedAIblyzuOwDTS9MpjD/ita89d4CM9AdhGBw3qaggtIxD8A5hULbJWe0D5KdtBFG8RFOmBaEb/tmBvdpwja3i17/AejUdjfjQv8G3BSTbKvOvMRwmnmoE5YCstwHIFqrlmqorSGQIVo5knfcSqgFxs2wDv4OOrPJTWcmr3LmN5lVjHkjtzRQ8zE9sB sheppy-master +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDU2aDU+TOiOXzWpGDhqbpzFkhENPc0QYbsqfImaBIMlbSDs6gxuQRtO9QtqyThrDuPNWVQqooVRj5MgdR9i2uNd8eDr+HWhzuiymy+KAJm9e+E4VTvgTiD+EB0IKJ6Vqm86/M0nwLPu3KNY9k/jjG2DjKDNEqX5b6U9Psfq/HqB5NDNL/BvCTNknehSDCp8gyFYjrRijGz6vnVF8jfNGOaliJvwQI7GciV8/Q986J4RruF/KbIf2DhVjQogHOV1ZVtFpBffxA6+PkDR4kgLYnZM4L4WCHqOqS9Cen4lqJg+ZJMMDx/T0cWkJIdTq6+GUvNjNfrle6Ck72vT1aRAxpjNCo+w5FeV6PtSrE2yF6cLoca1ia7n9fBANI7Pb9WdPytLeBMvzGU3C8b2RilDS89Ri6UZr63YzDI1hmTVUCe73ct2aV5DnDw668Y3+9hT+vi2mC+zHcgfPfJ7erySDmxG1pi2yDlaJP9fLz4MMOtknTdq73nnQPF7MRbiHk1Ots= hypervisor +{{ extra_sheppy_pubkeys }} diff --git a/roles/docker-deployments/handlers/main.yaml b/roles/docker-deployments/handlers/main.yaml new file mode 100644 index 0000000..47a635b --- /dev/null +++ b/roles/docker-deployments/handlers/main.yaml @@ -0,0 +1,8 @@ +- name: reload async icinga settings + uri: + url: "http://localhost:5006/reload-configuration" + status_code: [ 200, 204 ] + +- name: restart hub + shell: + cmd: docker restart atlantis-hub_atlantis-hub_1 diff --git a/roles/docker-deployments/tasks/main.yaml b/roles/docker-deployments/tasks/main.yaml new file mode 100644 index 0000000..d46727a --- /dev/null +++ b/roles/docker-deployments/tasks/main.yaml @@ -0,0 +1,215 @@ +- include_vars: services.yaml + +- name: Create data-dir + file: + name: /data/ + state: directory + +- name: Create opt-dir + file: + name: /opt/ + state: directory + +- name: Async Icinga mount directory + file: + name: /data/async-icinga + state: directory + +- name: Async Icinga database mount directory + file: + name: /data/async-icinga + state: directory + +- name: Async Icinga Service (static) + template: + src: async-config.json.j2 + dest: /data/async-icinga/config.json + notify: + - reload async icinga settings + +- name: Async Icinga Service (static) + template: + src: async-icinga-config.json.j2 + dest: /data/async-icinga/async-icinga-config.json + notify: + - reload async icinga settings + +- name: Async Icinga Service (dynamic from backup file) + copy: + src: async-icinga-config-dynamic.json + dest: /data/async-icinga/ + notify: + - reload async icinga settings + +- name: Create data directories + file: + name: "/data/{{ item }}/" + state: directory + with_items: + - tmnf-replay-server + - atlantis-hub + - grafana + - event-dispatcher + #- reactive-resume + - hedgedoc + - atlantis-verify + - soundlib-interface + - python-flask-picture-factory + - money-balancer + - atlantis-web-check + - gotify + +- name: Copy AtlantisHub config + copy: + src: "atlantis-hub-content/config.yaml" + dest: "/data/atlantis-hub/config.yaml" + notify: restart hub + +- name: Create AtlantisHubDirectories + file: + name: "/data/atlantis-hub/{{ item }}" + state: directory + with_items: + - static-icons + - instance + - static-cache + +- name: Copy AtlantisHub static icons + copy: + src: "atlantis-hub-content/static-icons/" + dest: "/data/atlantis-hub/static-icons/" + +- name: Copy AtlantisHub static icons + template: + src: "grafana.ini" + dest: "/data/grafana/grafana.ini" + +- name: Create compose directories + file: + name: "/opt/{{ item }}" + state: directory + with_items: + - athq-landing + - grafana + - potaris + - sector32 + - async-icinga + - tmnf-replay-server + - atlantis-hub + - grafana + - event-dispatcher + - tor + #- reactive-resume + - hedgedoc + - atlantis-verify + - soundlib-interface + - python-flask-picture-factory + - money-balancer + - atlantis-web-check + - gotify + +- name: Copy compose templates + template: + src: "{{ item }}.yaml" + dest: "/opt/{{ item }}/" + with_items: + - athq-landing + - grafana + - potaris + - sector32 + - async-icinga + - tmnf-replay-server + - atlantis-hub + - grafana + - event-dispatcher + - tor + - hedgedoc + - atlantis-verify + - soundlib-interface + - python-flask-picture-factory + - money-balancer + - atlantis-web-check + - gotify + +- name: Log into private registry + docker_login: + registry: registry.atlantishq.de + username: docker + password: "" + +- name: Deploy compose templates + community.docker.docker_compose: + project_src: "/opt/{{ item }}/" + pull: true + files: + - "{{ item }}.yaml" + with_items: + - athq-landing + - grafana + - potaris + - sector32 + - async-icinga + - tmnf-replay-server + - atlantis-hub + - grafana + - event-dispatcher + - tor + - hedgedoc + - atlantis-verify + - soundlib-interface + - python-flask-picture-factory + - money-balancer + - atlantis-web-check + - gotify + +- name: OAuth2Proxy directories + file: + path: "/opt/oauth2proxy/{{ item }}/" + state: directory + recurse: yes + with_items: + - tmnf-replay-server + - atlantis-hub + - grafana + - async-icinga + - atlantis-verify + - soundlib-interface + - python-flask-picture-factory + #- reactive-resume + - money-balancer + - atlantis-web-check + +- name: include services ports + include_vars: services.yaml + +- name: Deploy OAuth2Proxy compose files + template: + src: oauth-standalone-docker-compose.yaml + dest: "/opt/oauth2proxy/{{ item }}/docker-compose.yaml" + with_items: + - tmnf-replay-server + - atlantis-hub + - grafana + - async-icinga + - atlantis-verify + - soundlib-interface + - python-flask-picture-factory + #- reactive-resume + - money-balancer + - atlantis-web-check + +- name: Deploy OAuth2Proxy + community.docker.docker_compose: + project_src: /opt/oauth2proxy/{{ item }}/ + pull: true + with_items: + - tmnf-replay-server + - atlantis-hub + - grafana + - async-icinga + - atlantis-verify + - soundlib-interface + - python-flask-picture-factory + #- reactive-resume + - money-balancer + - atlantis-web-check diff --git a/roles/docker-deployments/templates/async-config.json.j2 b/roles/docker-deployments/templates/async-config.json.j2 new file mode 100644 index 0000000..935c9d4 --- /dev/null +++ b/roles/docker-deployments/templates/async-config.json.j2 @@ -0,0 +1,7 @@ +{ + "ICINGA_API_USER" : "{{ icinga_api_user }}", + "ICINGA_API_PASS" : "{{ icinga_api_pass }}", + "ICINGA_API_URL" : "{{ icinga_api_url }}", + "ICINGA_WEB_URL" : "{{ icinga_web_url }}", + "ASYNC_ICINGA_DUMMY_HOST" : "ASYNC_ICINGA" +} diff --git a/roles/docker-deployments/templates/async-icinga-config.json.j2 b/roles/docker-deployments/templates/async-icinga-config.json.j2 new file mode 100644 index 0000000..ae62b4a --- /dev/null +++ b/roles/docker-deployments/templates/async-icinga-config.json.j2 @@ -0,0 +1,9 @@ +{ +{% for service in async_icinga_static_services %} + "{{ service['name'] }}" : { + "timeout" : "{{ service['timeout'] }}", + "token" : "{{ service['token'] }}", + "owner" : "{{ service['owner'] }}" + }{% if not loop.last %},{% endif %} +{% endfor %} +} diff --git a/roles/docker-deployments/templates/async-icinga.yaml b/roles/docker-deployments/templates/async-icinga.yaml new file mode 100644 index 0000000..99f0527 --- /dev/null +++ b/roles/docker-deployments/templates/async-icinga.yaml @@ -0,0 +1,8 @@ +async-icinga: + volumes: + - "/data/async-icinga/:/app/config" + - "/data/async-icinga/instance/:/app/instance/" + restart: always + ports: + - 6006:5000 + image: harbor-registry.atlantishq.de/atlantishq/async-icinga diff --git a/roles/docker-deployments/templates/athq-landing.yaml b/roles/docker-deployments/templates/athq-landing.yaml new file mode 100644 index 0000000..fa5da5e --- /dev/null +++ b/roles/docker-deployments/templates/athq-landing.yaml @@ -0,0 +1,5 @@ +athqlanding: + ports: + - 5002:5000 + image: registry.atlantishq.de/athq/landing-page + restart: always diff --git a/roles/docker-deployments/templates/atlantis-hub.yaml b/roles/docker-deployments/templates/atlantis-hub.yaml new file mode 100644 index 0000000..809187e --- /dev/null +++ b/roles/docker-deployments/templates/atlantis-hub.yaml @@ -0,0 +1,10 @@ +atlantis-hub: + image: registry.atlantishq.de/atlantis-hub:latest + restart: always + ports: + - 6011:5000 + volumes: + - /data/atlantis-hub/config.yaml:/app/config.yaml + - /data/atlantis-hub/static-icons/:/app/static/icons/ + - /data/atlantis-hub/sqlite-instance/:/app/instance/ + - /data/atlantis-hub/static-cache/:/app/static/cache/ diff --git a/roles/docker-deployments/templates/atlantis-verify.yaml b/roles/docker-deployments/templates/atlantis-verify.yaml new file mode 100644 index 0000000..ec475fd --- /dev/null +++ b/roles/docker-deployments/templates/atlantis-verify.yaml @@ -0,0 +1,28 @@ +atlantis-verify: + image: harbor-registry.atlantishq.de/atlantishq/atlantis-verify:latest + restart: always + environment: + + LDAP_SERVER: ldap://{{ ldap_server }} + LDAP_BIND_DN: {{ ldap_bind_dn }} + LDAP_BIND_PW: {{ ldap_password }} + LDAP_BASE_DN: {{ ldap_user_dn }} + + DISPATCH_SERVER: {{ event_dispatcher_address }} + + SQLALCHEMY_DATABASE_URI: "instance/database.sqlite" + + KEYCLOAK_URL: https://{{ keycloak_address }} + KEYCLOAK_REALM: master + KEYCLOAK_ADMIN_USER: admin + KEYCLOAK_ADMIN_PASS: {{ keycloak_admin_password }} + + MAIN_HOME: https://hub.atlantishq.de + + DISPATCH_AUTH_USER: {{ event_dispatcher_user }} + DISPATCH_AUTH_PASSWORD: {{ event_dispatcher_pass }} + + ports: + - {{ services[item].port + 1000 }}:5000 + volumes: + - /data/atlantis-verify/instance/:/app/instance/ diff --git a/roles/docker-deployments/templates/atlantis-web-check.yaml b/roles/docker-deployments/templates/atlantis-web-check.yaml new file mode 100644 index 0000000..21e76a2 --- /dev/null +++ b/roles/docker-deployments/templates/atlantis-web-check.yaml @@ -0,0 +1,39 @@ +version: "3.3" +services: + master: + image: harbor-registry.atlantishq.de/atlantishq/atlantis-webcheck-master:latest + restart: always + ports: + - {{ services[item].port + 1000 }}:5000 + depends_on: + - queue + volumes: + - /data/atlantis-web-check/instance/:/app/instance/ + environment: + - QUEUE_HOST=queue + - QUEUE_NAME=scheduled + - DISPATCH_SERVER={{ event_dispatcher_address }} + - DISPATCH_AUTH_USER={{ event_dispatcher_user }} + - DISPATCH_AUTH_PASSWORD={{ event_dispatcher_pass }} + scheduler: + image: harbor-registry.atlantishq.de/atlantishq/atlantis-webcheck-scheduler:latest + restart: always + depends_on: + - master + environment: + - MASTER_HOST=master:5000 + - SLEEP_TIME=1 + queue: + image: rabbitmq + restart: always + ports: + - 5672:5672 + worker: + image: harbor-registry.atlantishq.de/atlantishq/atlantis-webcheck-worker:latest + restart: always + depends_on: + - master + environment: + - MASTER_HOST=master:5000 + - QUEUE_HOST=queue + - QUEUE_NAME=scheduled diff --git a/roles/docker-deployments/templates/collabora.yaml b/roles/docker-deployments/templates/collabora.yaml new file mode 100644 index 0000000..e7e1512 --- /dev/null +++ b/roles/docker-deployments/templates/collabora.yaml @@ -0,0 +1,9 @@ +version: 3 +service: + collabora: + ports: + - 9980:9980 + image: collabora/code + restart: unless-stopped + environment: + - "extra_params=--o:ssl.enable=false --o:ssl.termination=true" diff --git a/roles/docker-deployments/templates/event-dispatcher.yaml b/roles/docker-deployments/templates/event-dispatcher.yaml new file mode 100644 index 0000000..bd4d846 --- /dev/null +++ b/roles/docker-deployments/templates/event-dispatcher.yaml @@ -0,0 +1,14 @@ +event-dispatcher: + ports: + - 5007:5000 + image: registry.atlantishq.de/athq/event-dispatcher + restart: always + volumes: + - "/data/event-dispatcher/instance/:/app/instance/" + environment: + SIGNAL_API_PASS: "{{ event_dispatcher_pass }}" + LDAP_SERVER : "{{ ldap_connection_url }}" + LDAP_BIND_DN : "{{ ldap_bind_dn }}" + LDAP_BIND_PW : "{{ ldap_password }}" + LDAP_BASE_DN : "{{ ldap_user_dn }}" + SIGNAL_GATEWAY_PASS: "{{ event_dispatcher_token }}" diff --git a/roles/docker-deployments/templates/gotify.yaml b/roles/docker-deployments/templates/gotify.yaml new file mode 100644 index 0000000..fcc2ad3 --- /dev/null +++ b/roles/docker-deployments/templates/gotify.yaml @@ -0,0 +1,11 @@ +gotify: + image: gotify/server + restart: always + environment: + - TZ="Europe/Berlin" + - GOTIFY_DEFAULTUSER_NAME={{ gotify_user }} + - GOTIFY_DEFAULTUSER_PASS={{ gotify_password }} + ports: + - 4001:80 + volumes: + - /data/gotify/data:/app/data diff --git a/roles/docker-deployments/templates/grafana.ini b/roles/docker-deployments/templates/grafana.ini new file mode 100644 index 0000000..3098f60 --- /dev/null +++ b/roles/docker-deployments/templates/grafana.ini @@ -0,0 +1,1492 @@ +##################### Grafana Configuration Example ##################### +# +# Everything has defaults so you only need to uncomment things you want to +# change + +# possible values : production, development +;app_mode = production + +# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty +;instance_name = ${HOSTNAME} + +# force migration will run migrations that might cause dataloss +;force_migration = false + +#################################### Paths #################################### +[paths] +# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used) +;data = /var/lib/grafana + +# Temporary files in `data` directory older than given duration will be removed +;temp_data_lifetime = 24h + +# Directory where grafana can store logs +;logs = /var/log/grafana + +# Directory where grafana will automatically scan and look for plugins +;plugins = /var/lib/grafana/plugins + +# folder that contains provisioning config files that grafana will apply on startup and while running. +;provisioning = conf/provisioning + +#################################### Server #################################### +[server] +# Protocol (http, https, h2, socket) +;protocol = http + +# The ip address to bind to, empty will bind to all interfaces +;http_addr = + +# The http port to use +;http_port = 3000 + +# The public facing domain name used to access grafana from a browser +;domain = localhost + +# Redirect to correct domain if host header does not match domain +# Prevents DNS rebinding attacks +;enforce_domain = false + +# The full public facing url you use in browser, used for redirects and emails +# If you use reverse proxy and sub path specify full url (with sub path) +;root_url = %(protocol)s://%(domain)s:%(http_port)s/ + +# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons. +;serve_from_sub_path = false + +# Log web requests +;router_logging = false + +# the path relative working path +;static_root_path = public + +# enable gzip +;enable_gzip = false + +# https certs & key file +;cert_file = +;cert_key = + +# Unix socket gid +# Changing the gid of a file without privileges requires that the target group is in the group of the process and that the process is the file owner +# It is recommended to set the gid as http server user gid +# Not set when the value is -1 +;socket_gid = + +# Unix socket mode +;socket_mode = + +# Unix socket path +;socket = + +# CDN Url +;cdn_url = + +# Sets the maximum time using a duration format (5s/5m/5ms) before timing out read of an incoming request and closing idle connections. +# `0` means there is no timeout for reading the request. +;read_timeout = 0 + +# This setting enables you to specify additional headers that the server adds to HTTP(S) responses. +[server.custom_response_headers] +#exampleHeader1 = exampleValue1 +#exampleHeader2 = exampleValue2 + +#################################### GRPC Server ######################### +;[grpc_server] +;network = "tcp" +;address = "127.0.0.1:10000" +;use_tls = false +;cert_file = +;key_file = + +#################################### Database #################################### +[database] +# You can configure the database connection by specifying type, host, name, user and password +# as separate properties or as on string using the url properties. + +# Either "mysql", "postgres" or "sqlite3", it's your choice +;type = sqlite3 +;host = 127.0.0.1:3306 +;name = grafana +;user = root +# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" +;password = + +# Use either URL or the previous fields to configure the database +# Example: mysql://user:secret@host:port/database +;url = + +# For "postgres", use either "disable", "require" or "verify-full" +# For "mysql", use either "true", "false", or "skip-verify". +;ssl_mode = disable + +# Database drivers may support different transaction isolation levels. +# Currently, only "mysql" driver supports isolation levels. +# If the value is empty - driver's default isolation level is applied. +# For "mysql" use "READ-UNCOMMITTED", "READ-COMMITTED", "REPEATABLE-READ" or "SERIALIZABLE". +;isolation_level = + +;ca_cert_path = +;client_key_path = +;client_cert_path = +;server_cert_name = + +# For "sqlite3" only, path relative to data_path setting +;path = grafana.db + +# Max idle conn setting default is 2 +;max_idle_conn = 2 + +# Max conn setting default is 0 (mean not set) +;max_open_conn = + +# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours) +;conn_max_lifetime = 14400 + +# Set to true to log the sql calls and execution times. +;log_queries = + +# For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared) +;cache_mode = private + +# For "sqlite3" only. Enable/disable Write-Ahead Logging, https://sqlite.org/wal.html. Default is false. +;wal = false + +# For "mysql" only if migrationLocking feature toggle is set. How many seconds to wait before failing to lock the database for the migrations, default is 0. +;locking_attempt_timeout_sec = 0 + +# For "sqlite" only. How many times to retry query in case of database is locked failures. Default is 0 (disabled). +;query_retries = 0 + +# For "sqlite" only. How many times to retry transaction in case of database is locked failures. Default is 5. +;transaction_retries = 5 + +# Set to true to add metrics and tracing for database queries. +;instrument_queries = false + +################################### Data sources ######################### +[datasources] +# Upper limit of data sources that Grafana will return. This limit is a temporary configuration and it will be deprecated when pagination will be introduced on the list data sources API. +;datasource_limit = 5000 + +#################################### Cache server ############################# +[remote_cache] +# Either "redis", "memcached" or "database" default is "database" +;type = database + +# cache connectionstring options +# database: will use Grafana primary database. +# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'. +# memcache: 127.0.0.1:11211 +;connstr = + +# prefix prepended to all the keys in the remote cache +; prefix = + +# This enables encryption of values stored in the remote cache +;encryption = + +#################################### Data proxy ########################### +[dataproxy] + +# This enables data proxy logging, default is false +;logging = false + +# How long the data proxy waits to read the headers of the response before timing out, default is 30 seconds. +# This setting also applies to core backend HTTP data sources where query requests use an HTTP client with timeout set. +;timeout = 30 + +# How long the data proxy waits to establish a TCP connection before timing out, default is 10 seconds. +;dialTimeout = 10 + +# How many seconds the data proxy waits before sending a keepalive probe request. +;keep_alive_seconds = 30 + +# How many seconds the data proxy waits for a successful TLS Handshake before timing out. +;tls_handshake_timeout_seconds = 10 + +# How many seconds the data proxy will wait for a server's first response headers after +# fully writing the request headers if the request has an "Expect: 100-continue" +# header. A value of 0 will result in the body being sent immediately, without +# waiting for the server to approve. +;expect_continue_timeout_seconds = 1 + +# Optionally limits the total number of connections per host, including connections in the dialing, +# active, and idle states. On limit violation, dials will block. +# A value of zero (0) means no limit. +;max_conns_per_host = 0 + +# The maximum number of idle connections that Grafana will keep alive. +;max_idle_connections = 100 + +# How many seconds the data proxy keeps an idle connection open before timing out. +;idle_conn_timeout_seconds = 90 + +# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false. +;send_user_header = false + +# Limit the amount of bytes that will be read/accepted from responses of outgoing HTTP requests. +;response_limit = 0 + +# Limits the number of rows that Grafana will process from SQL data sources. +;row_limit = 1000000 + +# Sets a custom value for the `User-Agent` header for outgoing data proxy requests. If empty, the default value is `Grafana/` (for example `Grafana/9.0.0`). +;user_agent = + +#################################### Analytics #################################### +[analytics] +# Server reporting, sends usage counters to stats.grafana.org every 24 hours. +# No ip addresses are being tracked, only simple counters to track +# running instances, dashboard and error counts. It is very helpful to us. +# Change this option to false to disable reporting. +;reporting_enabled = true + +# The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs +;reporting_distributor = grafana-labs + +# Set to false to disable all checks to https://grafana.com +# for new versions of grafana. The check is used +# in some UI views to notify that a grafana update exists. +# This option does not cause any auto updates, nor send any information +# only a GET request to https://raw.githubusercontent.com/grafana/grafana/main/latest.json to get the latest version. +;check_for_updates = true + +# Set to false to disable all checks to https://grafana.com +# for new versions of plugins. The check is used +# in some UI views to notify that a plugin update exists. +# This option does not cause any auto updates, nor send any information +# only a GET request to https://grafana.com to get the latest versions. +;check_for_plugin_updates = true + +# Google Analytics universal tracking code, only enabled if you specify an id here +;google_analytics_ua_id = + +# Google Analytics 4 tracking code, only enabled if you specify an id here +;google_analytics_4_id = + +# When Google Analytics 4 Enhanced event measurement is enabled, we will try to avoid sending duplicate events and let Google Analytics 4 detect navigation changes, etc. +;google_analytics_4_send_manual_page_views = false + +# Google Tag Manager ID, only enabled if you specify an id here +;google_tag_manager_id = + +# Rudderstack write key, enabled only if rudderstack_data_plane_url is also set +;rudderstack_write_key = + +# Rudderstack data plane url, enabled only if rudderstack_write_key is also set +;rudderstack_data_plane_url = + +# Rudderstack SDK url, optional, only valid if rudderstack_write_key and rudderstack_data_plane_url is also set +;rudderstack_sdk_url = + +# Rudderstack Config url, optional, used by Rudderstack SDK to fetch source config +;rudderstack_config_url = + +# Intercom secret, optional, used to hash user_id before passing to Intercom via Rudderstack +;intercom_secret = + +# Controls if the UI contains any links to user feedback forms +;feedback_links_enabled = true + +#################################### Security #################################### +[security] +# disable creation of admin user on first start of grafana +;disable_initial_admin_creation = false + +# default admin user, created on startup +;admin_user = admin + +# default admin password, can be changed before first start of grafana, or in profile settings +;admin_password = admin + +# default admin email, created on startup +;admin_email = admin@localhost + +# used for signing +;secret_key = SW2YcwTIb9zpOOhoPsMm + +# current key provider used for envelope encryption, default to static value specified by secret_key +;encryption_provider = secretKey.v1 + +# list of configured key providers, space separated (Enterprise only): e.g., awskms.v1 azurekv.v1 +;available_encryption_providers = + +# disable gravatar profile images +;disable_gravatar = false + +# data source proxy whitelist (ip_or_domain:port separated by spaces) +;data_source_proxy_whitelist = + +# disable protection against brute force login attempts +;disable_brute_force_login_protection = false + +# set to true if you host Grafana behind HTTPS. default is false. +;cookie_secure = false + +# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled" +;cookie_samesite = lax + +# set to true if you want to allow browsers to render Grafana in a ,