diff options
249 files changed, 5470 insertions, 3817 deletions
diff --git a/chaos-at-home/ch-equinox-t450s.yml b/chaos-at-home/ch-equinox-t450s.yml index 8b57b6bc..ea1aca7f 100644 --- a/chaos-at-home/ch-equinox-t450s.yml +++ b/chaos-at-home/ch-equinox-t450s.yml @@ -23,7 +23,7 @@ - role: apt-repo/backports - role: apt-repo/spreadspace - role: apt-repo/ansible - - role: apt-repo/tor-project + #- role: apt-repo/tor-project ## https://gitlab.torproject.org/tpo/core/tor/-/issues/40946 - role: apt-repo/kubernetes - role: apt-repo/element - role: storage/zfs/base @@ -32,8 +32,8 @@ - role: core/users - role: network/wireguard/base - role: ws/minet - - role: ws/pipewire - role: ws/flatpak + - role: ws/thunderbird-gpg-hack post_tasks: - name: make sure tlp is started and enabled systemd: @@ -86,8 +86,9 @@ echo "Touchpad not found..." fi - - name: install deps for c3voc/cm repo - pip: - name: - - "bundlewrap>=4.13.6" - - "bundlewrap-keepass" + ## PEP 668 + #- name: install deps for c3voc/cm repo + # pip: + # name: + # - "bundlewrap>=4.13.6" + # - "bundlewrap-keepass" diff --git a/chaos-at-home/ch-equinox-ws.yml b/chaos-at-home/ch-equinox-ws.yml index 24e071b5..c3010e44 100644 --- a/chaos-at-home/ch-equinox-ws.yml +++ b/chaos-at-home/ch-equinox-ws.yml @@ -24,15 +24,16 @@ - role: apt-repo/backports - role: apt-repo/spreadspace - role: apt-repo/ansible - - role: apt-repo/tor-project + #- role: apt-repo/tor-project ## https://gitlab.torproject.org/tpo/core/tor/-/issues/40946 - role: apt-repo/kubernetes - role: apt-repo/element + #- role: apt-repo/qmk ## qmk-repo does not support noble yet.. - role: storage/zfs/base - role: storage/zfs/sanoid - role: ws/base - role: core/users - - role: ws/pipewire - role: ws/flatpak + - role: ws/thunderbird-gpg-hack post_tasks: - name: disable caps-lock lineinfile: @@ -48,11 +49,12 @@ opts: nodev,x-systemd.automount,nofail state: mounted - - name: install deps for c3voc/cm repo - pip: - name: - - "bundlewrap>=4.13.6" - - "bundlewrap-keepass" + ## PEP 668 + #- name: install deps for c3voc/cm repo + # pip: + # name: + # - "bundlewrap>=4.13.6" + # - "bundlewrap-keepass" # - name: install gotify-desktop # become: yes diff --git a/chaos-at-home/mz-ap.yml b/chaos-at-home/ch-mz-ap.yml index 46b0aa88..545d8c4a 100644 --- a/chaos-at-home/mz-ap.yml +++ b/chaos-at-home/ch-mz-ap.yml @@ -1,6 +1,6 @@ --- - name: Basic Setup - hosts: mz-ap + hosts: ch-mz-ap connection: local gather_facts: no roles: diff --git a/chaos-at-home/ch-mz-router.yml b/chaos-at-home/ch-mz-router.yml new file mode 100644 index 00000000..65c0c2b0 --- /dev/null +++ b/chaos-at-home/ch-mz-router.yml @@ -0,0 +1,15 @@ +--- +- name: Basic Setup + hosts: ch-mz-router + connection: local + gather_facts: no + roles: + - role: installer/openwrt/image + post_tasks: + - pause: + prompt: | + * scp -O {{ output_images[0] }} ch-mz-router:/tmp/openwrt.bin + * ssh ch-mz-router sysupgrade -n /tmp/openwrt.bin + * ssh ch-mz-router dropbearkey -t ed25519 -f /etc/dyndns/id_ed25519 + replace the key at the dyndns server (ch-pan: /var/lib/dyndns/.ssh/authorized_keys) + after that run the dyndns update script manually to accept the ssh host-key diff --git a/chaos-at-home/host_vars/mz-router.yml b/chaos-at-home/host_vars/mz-router.yml deleted file mode 100644 index 9d5b814b..00000000 --- a/chaos-at-home/host_vars/mz-router.yml +++ /dev/null @@ -1,61 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;chaos-at-home -65643339366566643435323363386430633134636135383962623132373433393832663837376539 -3235323334643539356336333737646438393664336265660a393134323731336665386165613435 -33393233666434643462323235656163373365333565373566616666666339616632663464326436 -3061343337356139330a653463376366343835616237646239643338333866653530613364323638 -35336561633037366437333866306231613738336339646538373261656365386231393265363130 -37303830386562646335353462353662383636393233623962376565363435643366633733626334 -35643363306163666662353962393231643939313230343961666661333334313438653234373733 -37376530633163323462366434623532626536323830333562316239306634303731643965386233 -32383466356366613262653731663665343036373136343731393332616435636165393639643165 -30363663376236613533393333663163376332326536396465656162653961316563373861323662 -64393265636566306631323937333164613165616232393633386438316362656635383062303337 -39333932616535613230346666373635653363333761373765346237313731343166666136323734 -31383930646434306137333262376264323539383365303931353666333738666639386537353831 -63616366346336326331663938383161373837356331633265303266353738633233303039383066 -62633738376139626662366632373435373337323737336639306339653231336433333863303130 -64663964393562616635633738333139646334636433316638393835306366363238623562626134 -39643465303936633564373933343163643637616239663534666631633536613165326663663431 -37623931303461376336653562646366383836343534386366306334666330306635396561303661 -62353830666234616438383565636638663436303830356535323935653034646366396530313336 -61646137336435313138326535376339333735393931373333323561373936396664333537336361 -61646332623639663264646362393133356562616338303835336330393265663432323139356233 -66356161366564316339623835613266343233373434666462326531303361313230633638353963 -34303262653534326562623138313566646631343136393766316434663735326661623930626539 -66363066363236363965613765666362616137333035383331666163623266316434353731306366 -32623733613165653265386430663361373466396430306262353631326238396130613165656332 -34373139313063336636626461646563373531383935376436653933306333346431393833656366 -61356437333031346634616539326438613931346666346234333365303463626465353039616437 -37613433396138636534326638393966356661386662396330623234616638633333333161653735 -38386261306561383632613065653538376136306239336663356662386638623338613462353663 -62373666633333333461333963386632613137326165396433633439363938623838656665326339 -30323765613437373539333339646136633263323061653764306264316437353832313263323139 -32323633323562626661313534616263326561613030656363616461393334363833396133323266 -66386139383163386537383433396261373766653164373736323235643631656161393262383738 -61316533336662646232303936356236366436663265646131363237366463363732343964363366 -37653037303630613330333663623535663739643430333263636539613632303738653031663936 -38623665643939353733386335356161336531663333623538343332336264376663623261656633 -30333638646363356236303532363532353039323862366135653166316336623062333537366335 -31633839396461336361643465636664646164663762346236363763396263383163326465653964 -34663134623430353432646130633661636237613435323836386262333363373139376462363765 -63623638366136646265396432333339653234643532336233383461386361616630313936303162 -35626366366262623934333961653363616135313836643365613836343438353365383264623037 -31663231316462616137373435663039633434623466356266633235313865323362393636393862 -64343062336433343137316565373535666337653833353136376635666539656662373763623238 -30666532633965386264323565353431306633666364656662333631646139386138393066356238 -62653837656664333462363334373664373937333932313465353237636134626466343735633466 -31643039333866303233613762323866333264313135373130623166393339613131323537373537 -35626633373838363766623233626130646332336435316333323439613636373536343233633137 -30363863656465636635633936356165386633653637333932396164653835313163376363616133 -35376637376630636336386538353235353364313464313231633663616536323532336432376232 -64396234303332313134366133643664643165393932323361616666383162303337626663396131 -35613865373635303834373062666539386462663238383332616565303866316239613361373661 -37346162623764336332663431303664343430366562633361623566356266616534656562363833 -63366238656261646564306133623433306663376531373563363032303938303538356630636466 -30616630306334616237346661346235376133303538306638663631376163383138636365326230 -32376139373030303239376631316166393363613465323436633932376463303531386161313264 -65323261326232366332396335386639313735353135356139343937386232653737393565376639 -31363530313038306131383236396364666165393837343538316539336263333663643031623136 -30316436633662353162363836633238613833613530613762383662653435393263626161373938 -61613133643937346433643862326165326233363335656431663064336165383462623636383334 -63313438346136633461 diff --git a/chaos-at-home/mz-router.yml b/chaos-at-home/mz-router.yml deleted file mode 100644 index 8f4f056f..00000000 --- a/chaos-at-home/mz-router.yml +++ /dev/null @@ -1,14 +0,0 @@ ---- -- name: Basic Setup - hosts: mz-router - connection: local - gather_facts: no - roles: - - role: installer/openwrt/image - post_tasks: - - pause: - prompt: "\n****** copy and install image onto router and wait for it to come back ******\n" - - - shell: "base64 -d | ssh chmz-router \"/bin/sh -c 'umask 077; cat > /etc/dyndns/id_rsa'\"" - args: - stdin: "{{ vault_dyndns_ssh_key_b64 }}" diff --git a/dan/group_vars/all.yml b/dan/group_vars/all.yml deleted file mode 100644 index 191025b4..00000000 --- a/dan/group_vars/all.yml +++ /dev/null @@ -1,26 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -39333835343437643137363564396365316439626562616635373336383136393961366164373439 -6134633733313738636562666461653861346439323231300a343935313134326635643464626565 -61643764393538666235356530633236366431313236646664323561633032353966633262376435 -3532393163636264390a336634653935663361333433626231633764356666616632356166653434 -34623165613963373261343161653739323836626234333135366239623861396136656464343934 -62383134626161666633613937616132356330373364366235363362396532353638663437363563 -65646634643238653130396363323464656162666162343365666330633037363531316531396365 -32383765623666643561613465373038396266656465356263623135633631303130396466363031 -63383633636136366439313731363839336635386664383364376466323464363032303133623038 -62613639313531643666326539663864636364623161356563616231326237646130303961383666 -32366332303464363734306535633239636539653863383135383066653730386330626430303730 -61653634653935623837323639626261313166326235636232626162386430616135626536373437 -65656339383161333166353466643436656463653237303566303665343937386534393039663836 -62656237303863323564383331343665376663363131386238356633356662633537663866336531 -62376163316662613439666161343461396434306632633333376362346362386163373639333163 -66636661316530653336383562366237633230383635386362303435613466313963376634616138 -32376534313430643564366362353062336339343737306466386662623463393063363935333435 -61666137323339633932666364346266393561303631663932386166626136356439323863636637 -63326136633938616539623938313738656635656161396562326162336530623230336438313863 -63346162613235316435393137313935643637393765666561303261333265313031343231306133 -33663164393338613433303261323265616639396130613330313662303532323361656535666635 -37613836323239633139616435313361383138356463353033353639363365663934356561626331 -33663830343463306534343439633565343433633765323538353861636433303634303330643234 -64393032323434616533663038626466356532383735366331333933653635343966333463353435 -3663 diff --git a/dan/group_vars/ele-router.yml b/dan/group_vars/ele-router.yml deleted file mode 100644 index 84b07f1c..00000000 --- a/dan/group_vars/ele-router.yml +++ /dev/null @@ -1,167 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -62666535326238396536643861623335353861653832366661643937333335666332646138643564 -6161623938663063656537373736323137306461616230370a326237633131656563323633323537 -33346336666363646231353330616364303434346336643162303066653037613432396132653162 -3764626365653764390a303638363930393031663739383665633630643039653937353332366230 -65633734633339656435393465336133383061306265373033623232636430356537643638643166 -34333038663430323631343038383736636636393266383466393537386232386466613165393361 -64366562663561346134663662646532396431646135353865346437383463613039613333666431 -61613134623735383235393239396338326632343530316261646665626239333035336236616637 -38633032316566336563343039633330393063353437623938363931363835376136393365643635 -66333231626432646435326138396438366165633264643032636666323166656266653936323339 -38306238313461663136353133323230316538393834323339316233353066653838363331326337 -64373735326561353836306530313133393939393261396565623331373361393130363835636638 -36356565636230646263643165373264336662313234363138363934313764386634363366613966 -66316439383439626132636662333463383737366432643365386136316139633630656661343261 -34323264623432613761643534333836356133326634376338376465343236306661643437616137 -31626565346436623166373565306231623233303966333234333438303666653966363465376366 -36306337343963323564316230356263613261666333373834663063313230376163383839356536 -39353030336231366331633866636538383961626261396532643264616464616437393566353163 -37326237623039623264643066653239626635353732316634666635666631323164346565363066 -61353931626337393861643664623338666561613261363564323534396231343336316133646436 -64346236323963663335306432626137353336373330363063396331663430303530376166393532 -30613062343630646163336431616662303666626434323966663933663664363462636530653336 -31666338376135353637646161303633636436643366306532623438613332663537616564353539 -66393437663937366665323762366230623331646361343036653464396239633631663766323735 -62623766343339623361643438636663656339643835316164356564613537643231313032373331 -65613131343561313663336435363837313863333630633539383337356131646630373732613739 -39623761326537663935343964633064363638646531333265626262363139663161336436343033 -34656363356433663063643263316533393763333537666437303630643430393466653934316466 -66616334373965633664363635373064353861643634353935363164303138346364633163313635 -65666563313065316233383539363765616233623437346632626663393839653138643162303335 -39396162623136343937316431373931636531323161336461323237646366646466633837653136 -61393637393532636265373632636566643039323362656438333533636239343265373332636261 -36393737653962303136303163303466393630363966356639316632636261643331366231313264 -33653834356238386135326632306535663436363835623162396539393531643463623563633130 -33366130383634633162656165376535666638643239313833393965323033333732393465386435 -32353031323430636261383061666430343063336133396366313861306235356234333535613864 -63633338383531346262343639656263313135343331316337316561353130643163306134613165 -63333538616434396262313431383331623330346632616136383962613965366632653131313339 -61616366343139393936643432326530326530633162393431323263303339393033386165363132 -36313237326331616636643131386165633030363030616165353830393939636534646163656638 -30623164386637346231623931623166376136663438333661396238343066313863333738373430 -31613833653033616663343964306331613938646462343362333130653964616563653536373039 -63376135346163653337356266396334666162613565313762363031316237656662353064653462 -32363132373838613265366262363734393961383365313766383466316431613462663065393133 -61306465663938346233656331363432623030666663366262663032643335336564633861373632 -65633739343531316237373365613861363762343135323134663731613835346664306333626664 -61353862646632373634356331383366306136343539633138313230313066396534653062616564 -34356336643130666333343233316364663634363437656432356631666264336531313331303937 -63666230353465366635666635343038666533643961336563313332623530386462303063323638 -34356263366633313035623734616635393737653331316162633538306235303463623739366162 -32366233653330303661393030653337303037376133396235353830316630316363316536393337 -65343830663031333764373061313832643133363662303230626438353733643737633263363130 -32663632386565346538393064666339626262323536373333643236626562336164326132306563 -62393338356530323162666431396333303931306462376432623366616235383338613935353732 -61653933353838666665663365393438306230366662303237626664363732366161626430323738 -36393463363535646462303534373435363865326466663838376131323131393361373430393231 -37393463373965346466376363326139616137373564356464343666653964303833326566373235 -62646432366231323764336530393439306665363163306662363031636632343762313232653931 -62326565633163393239323963396563643066383239373866343435643065653839323361633966 -30363138613934616366653230646264613031383830346161633537373566323263316532343061 -36616638356662353364306139656364366231653234653536383938636532393630633639313930 -36663434633832396637626137643633653861366135383430393963336232633165613064636435 -65336138616666303866323236623938633761373234626563623832356632356462643439396263 -35313234396466316436633937633764653538623761356336363536666634626361666436363330 -63376232313235333939393238383035383463376264343839613032663966653766633630363365 -66613632336631626535626539366566373339653334656630343531636262633534353033343939 -66666163336663663830313932333361346566633366363232373138373835373835356235316138 -65643932646535383039383730623236323063366463303337663232383637326433613131636663 -65386165306666396563633736333133313039383330363031326132363637616661613234633935 -62323066396363373138346364643331353534386265303661383065373366373665303832386236 -35623930353738396362323539383362653233316632353062663537396237383930663230636665 -37363634356437643437336130353763393133646637353830343739386639373038626263333961 -61393234356563303039656231303039646636613561323033383662623064313166666232383236 -37303034306538326363653133643034336561626331313938636230666236616134316537646134 -64623761343061636435383837383166373330643236316164646666363537343031353539313930 -31666163353739326432343736343662373430333939376237343465353665336533373735306663 -64646665623535393339353636316466303561646534633532653866663230323433303232303965 -62366238353265376639666134653162303562316262303765343132353930363835666539343162 -39396233326639663638346136623761386166313537343334306261663433346331663232633962 -65346364663465383561346238376434336362626135303137316266353638356235353136333431 -35353265313234323030653461636535386337343732633634643134353134353462666634346239 -65376264326337313664333330326639326534383733373433343037623065376537663062373638 -39336561656639396638666636613238636261373331353863383336316139376539313237663263 -34613433383839306231623530666363333139363431393339333730366335343962356337313636 -65666335643166316265653238366139303336663934363963353162323539366636316337643661 -30303035353532363437653061356363396531613838353031623061633538303438643932396431 -39393938353435353630343235346165373731346530363932343161626635343036366366393639 -30346363353363663836326339343435306636643834396231653433303239623833363962373661 -34373661353938303033303139613262333864633130663631626133633130333038313063393631 -61643338393832633632396163323935666237353730643162623238616464336338303337616339 -31613932636361353933303339653537613832316333666362626563373463646633613238333364 -35653033623239326634653939663933373466373935303561333838326665343932363133396461 -33383839313435646661303965366234353232656438363263393738633566353435643033376236 -37663433646136376564306266363664343765666362653866343032376665323462393430303331 -65623631633233633730366638393438633530323663666239316463623963386666623830383633 -30623831613664663231636262306663353661383764636666666233386461343832613565636432 -38666165646631306630623937396438373435636165653337306538366439316335366464663238 -37663362633331613534666365626338653032393031656635626539623639346335636533333630 -38326163313763653434396231333035343932376137666336393165646562363966633365666661 -61393639643934653935633765313139393761663038396334373030363566643231353137666162 -65303036343030323164373538623933326339633737643337383837363762393330313136333835 -36663764376131383761343162346562326233613933346234386462376337343538636261313431 -34353235363665333132313563613166326364643936613330653030376663366330336331336239 -33313561363032386532346463373236653339396234626534643834636535633235346265656336 -34613463653166663233393231383231343364613134366233663235306337306434333038626433 -34343161646334636430383861656532613238646136303165333739393437633166623833393761 -33613666656462316534613138323362333266663561376532636662373630303463393535366631 -63376337373135393061626335633831333239633232386130393233666264663662613331353162 -37346535653439613737333265623139623036333165363166343564616162373836396234636336 -65643238353233353532326665633832386439343232393265366563343931353862643166646337 -30326436646466373036373666323464633464343762306264356637336335666230306632343336 -61323164323566643037363762323332356465623963663633366662353435356165373531373965 -36346437383131623364623561303535383930616366616131326238626163346361633434326338 -64623139653232323762613737653864363231383635633161663163346238346564353833653464 -37393634316335613239306430376464353361333364323263306232666233343031333835333262 -39633862623862643738366563393662363330363663666363393830373635346238393136313434 -63613665313438636665396664363934303964643230386562643339396662623035646632633962 -35333430623930383036643134303533666164326261616464323637663831633132306337316362 -61303539316332323230353863306534656535666263646631643432626235336630333064633462 -37383561663863653735383631613961383637353832336364666636386431383765356239383734 -34623030346565636533366332333133363662306465633939343132353233303138373639616430 -32633531643537663334346665633038626538393138646639303064376430623165386239336532 -33343965313530643331363539383738366265346165396138313366373234323132663635346631 -64663866396531333833343863393138643635613564366339333731386437303536383264613230 -30633033643966663636373732313864316638363363613933353732653061633366306364646436 -37356565303137333039376630336161653364353738313236303532383530633037333231633835 -33336535616331636565393864333737383966613238316136393665376637353436656139323436 -63643461663331656461303838303238623035643435343636343937653964616362623038396337 -65383465343566396366643539336433633664663136373138373562633238653833396266376530 -62303733633061303231396330343365323866303566616464626331303565333435363537303762 -62313732313365373038363736666462623537643332333035353362653330356266393839323432 -35323934663332333534363135643162306666386437323666313464363234656339393065376536 -35373831326439353232613865633165666435623533303265303632336637653536616536366165 -61653939656639306636636662383034366166333262383836326637356437656134633330326138 -39653961313461636163333138363966326363366261626565323434346539336434313435316336 -30663733663061363064653539656435656338323734333465633264653736373561326436343539 -33323832313866363663343665633031643762323265303133663061336331626337383061356432 -63376561323634643930333063616636393433636534343239356338396333643363303232396538 -33373761656638636134646234396563333431626630393564383339303636653537353265383432 -62666231383363633937383865333065623763323966373831313836633138333165373033323537 -39313231653335373661396462633234343933346235396633323666336666353238613932356431 -65656532353063363963306136373632386434656530303134363862663235323432663839343237 -65666533656235303734363765333232616263316565633264386565373937393861646338613834 -33356366616434386535643332633534663939383935333939393834663365323266386133633639 -39623562346333366262643463653231313539626363383165343964333733613064326464653137 -38313164316562616532363263393639323334393263346565666536643664343234356534386333 -63656664653537616163343931323766643839316363323736306237323263376536616232303934 -61343434303338383230616232663836633333373436396432623562643439336639623364323737 -64363536613336343837653939663933333737633836383635346631356537656535313632386162 -36306335323865363736386635643161643736333933343435613566376137393366346533363862 -32353735303261363634316561626661353931643239376634366635303264393466343366396237 -61613436653333353866396365656233643663636439623538303139663865383835386634396532 -62363238613465373235626138366464663531373039656431383261336337363936373931613339 -30623935393831656361646435383533666431393966313337313735656636656232373464326432 -30343935373864633064363935363465326438313863643237313865666636323932323932393363 -63663739373433643661323965303662396363663134636637613134303861386363656164366633 -65393766316265376664303435656437343730363536663764346365373961643737373934633166 -39373263393139646465386564313132313265346135653439373661386264353261663634326434 -34316466613464303938376165313566626633313365393966326437356134616337666533303661 -35666632623965333663386432363433643861313636623861623731623763303136376465356233 -32393932373363336664633132396634646664326131636462636264386663343834313139343462 -36306163633036663966353831346535313036393334393964363238323466623932633739633262 -62303233373966636531613439343065626531366464613566373130313534313831363034383462 -38646165366233326464656330383932616362633564633739306630393466646433663435393463 -39653539313961333265383534396533366565633464343130363431656563343664363163663662 -3639333531643235396232316262623239363864623032613232 diff --git a/dan/group_vars/elevate-festival.yml b/dan/group_vars/elevate-festival.yml deleted file mode 100644 index dd1ea3ec..00000000 --- a/dan/group_vars/elevate-festival.yml +++ /dev/null @@ -1,15 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -39626666613066636362366536663934343261366635366638666365393065316437383064643139 -3465316361303730323666336161363866656233333936340a383139373764393430306164356336 -36653761636139613638376638623964313561303365346464353066616631336265633262313765 -6438396634393332640a343731663030643563303335316236333333633564626436313137623365 -31373739353961393138393237306237646636666531393433363965373734643030613063343532 -39343831306337373462663331333132393335336361363432663462366362396631356238643330 -38353933626165616436613033663730326434313435613534353162336537363436306265646131 -65393961313736326330656366393637343435373862326365313934613532396431336136653933 -39616166346438633366373132313439643135393631376138336361366165386165386336363638 -35646436613633353464653337353761323362326437343036373365663263343364313737656663 -64646461343833303835323930333438323164656661666139386536626166396234323538393961 -62373361663533633535326665653434353939366530386334386463346463373062366439666462 -30333262356436623133313438336435343534623435633533643461353563613063616332666230 -6134393036366565396165323930353030386665643266663466 diff --git a/dan/group_vars/elevate-mediachannel.yml b/dan/group_vars/elevate-mediachannel.yml deleted file mode 100644 index e160cf54..00000000 --- a/dan/group_vars/elevate-mediachannel.yml +++ /dev/null @@ -1,10 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -65333264376332373164623736623330633833626435636637343930633261313030396335306664 -3431373866316237663335313438323836613266393939350a303239373562323664623838333339 -66336338326639363137353136336364636264396332396165663763613666353532363938353332 -6638343232643763630a623232376264306530626563303866393966643335636165616661356138 -35373639323133663837616639383862633631633931636430663331393462376234643831376134 -31396439363134356339313734363633643537376566383966323466393934646665313435313265 -63363863316264343563346535393432626661333365346364613032313165343161353465393535 -35653537303664343863346239373636613734373862343132663936623065626536663737373862 -6164 diff --git a/dan/group_vars/elevate.yml b/dan/group_vars/elevate.yml deleted file mode 100644 index b9d7d29a..00000000 --- a/dan/group_vars/elevate.yml +++ /dev/null @@ -1,9 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -61656330653064313535396131363439636234333566356439366133383737336366313264643861 -3365633735666464393532303463646634386231656634640a326530316234383832343062336363 -61393565616463306236353736653466353839306232646663623063663539393339633337383164 -3764386139333964310a303865373666393261366632386533656164633766626136303530316534 -65386335623433626234363430653933333534613565326364616163303666373866366338303633 -39373530326661613734346230636235653334666561383036353130303539326638336137306166 -32613935313435333864626161643139643631623230383534356461633630396638653931643131 -35656262303632313965 diff --git a/dan/group_vars/k8s-emc.yml b/dan/group_vars/k8s-emc.yml deleted file mode 100644 index 060be2eb..00000000 --- a/dan/group_vars/k8s-emc.yml +++ /dev/null @@ -1,10 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -61333930636361366561623133393666393566646538316464613834386236373463623762336335 -6237333534653261376537366463633536636438616230610a663461346436326330303862313039 -36343136376230306438633239303263326263383436333533373731656236396466363433636565 -3962316137343233620a363461633638316561303631343331303764336465356435313662393538 -30653536653934343534373835356637626430306437643730303562656437306434623263346261 -33313836336561373063383661666334383961653164323066653262613131393266393264383235 -30353462326630656363653461326433363739353837316164363733333463396165313330663065 -30303831376161376233323335616431633738653735366139646439653563653331653130313537 -62303166383264636162636266653738333762396564633630653032623531653539 diff --git a/dan/host_vars/ele-calypso.yml b/dan/host_vars/ele-calypso.yml deleted file mode 100644 index 9f5414af..00000000 --- a/dan/host_vars/ele-calypso.yml +++ /dev/null @@ -1,22 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -37393363613766653939336635386264386434393136373236366330333131363764343633633639 -6436353937376339383233313335396163663134373635650a653365666539313130613464383666 -62623964383261303365366161373938366131366465366433636364356639333766313162303766 -6164373537316331300a666137633636353332363838303236306465313462346366633934386564 -35643031646134613239623931343062643431366139643462323032316334376234633834653964 -32383235636264653764323364313164313435366564393038393963383963373839353463616431 -38393835333661386461623836333135353066356464636638303433386236616538393465326330 -39336330313039353664663961363965383231303863613530383465636133633637643135373838 -39326132623961376133613034663330366237396361373239336238363461353232363333303330 -32616238303262326665353162383263353764653732663366313437353161343333653962663863 -37313630613232333637376234656533313831666331326263363130343236626633663838643535 -33343864323436353236373464633866656532313936613736303733616639393831353137636238 -32363630396361323139613630666238623434373636646265353832313639306333326231666633 -64616634656665366663666435313464333432346135346563383131333061353635316362326434 -65623132316538616137323234656536666663303839383066666136633464313131373737316131 -36333564636630633130353465346461373761303764323738663638653761373263313438333335 -66333066393934633939313834303564623235353436396231393739613639633366343538383364 -66353835633561356266366233313439363433666565636537313139636536356333316463356363 -30346565646638346337613461376631663965343439303139643035303562393131613166313663 -63376233376638376539333533643639393062653639343262313838643430373339303635393437 -6537 diff --git a/dan/host_vars/ele-coturn.yml b/dan/host_vars/ele-coturn.yml deleted file mode 100644 index 7574b0b4..00000000 --- a/dan/host_vars/ele-coturn.yml +++ /dev/null @@ -1,18 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -33643766613664653232346436333636376564396235303135336164383263616335656464363862 -6165653236323338323133316434636332396537666662320a333461656262333233313133626163 -64366339353039373061393532333036636439383637653535343036303033666261386636653638 -6162613361396234390a353966623732663633326663333531666131616336383463356234626363 -34633830323862343266656165306264303465343930653161383336626230653335326261646637 -64636637386666396232326435626630613865343864663361623637396264363433323065653864 -34343130376436396536623162623633623837396332363566323136336435306230306132333862 -33303936653530633738613662626163336132393834393438393662653363626137623466616430 -39656262633933346239663562336635653633353162316430313137366562323366613332323966 -37646635653931323335306537396538333431616538653435663335343064353966323666386636 -65303730623863623262626238363361333864333839393331663465643837643937653234626234 -65356430663832613338343737653335363531393133646236313730393165393132383739333962 -62333538363139663764316238636466343538666462386266616133346563373763313663616364 -35663536343064323234396662353035386239653532623739643237366139303737633436656438 -38323233646565323839326539343232313234383862313835363730616335303766656437343761 -64366338343661313530623664333935303762323363613731666330623238393966656431323538 -6635 diff --git a/dan/host_vars/ele-gwhetzner.yml b/dan/host_vars/ele-gwhetzner.yml deleted file mode 100644 index 8b579bb0..00000000 --- a/dan/host_vars/ele-gwhetzner.yml +++ /dev/null @@ -1,17 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -36343835316464333566383362316662323461393339643462653138303565333663373938663836 -3764643539303864386532636539343461613063383865380a356237663837663931326266376131 -62306631366466393736323764396539653661666363326335626439326430613537656363333163 -6332336333346664310a613066373039336531346131656563353265646562366261393532333664 -31323731663838633731653961333934326636313866336235613838643732313632616339643837 -34386533363835333632633634336262633665353663393662303165336639373136616161616266 -61656566656136613238383963376239666264373230313337303131353861633461323732373130 -38623537333163393662616537356435383462363265613736313161393466336566646431373531 -32643430323730326536306464396261393564323366643065663865633666303862326236393338 -37663864646434353634373762313236613130653733643763646265366232376639653164303935 -37646139316166633136626265316130326363323436623035633731656665373965366362613965 -61353038636462393666666438306239656563316537373262633362303937346336333830313137 -64613639323631326662386638343734356362366466623930633837353666663933353666333538 -62653038316330616637633365316536643666666537303764306134326561343036303631383830 -36666539386239633361323337303061626261313039323334636237336331633463383037626462 -30396361316663636531 diff --git a/dan/host_vars/ele-jitsi.yml b/dan/host_vars/ele-jitsi.yml deleted file mode 100644 index fb36ca68..00000000 --- a/dan/host_vars/ele-jitsi.yml +++ /dev/null @@ -1,26 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -38373939316137333037336333356362653866633962323666643232323230333631666463633038 -3434653263316531363431363164623637663862616439630a343632306266646339363864306333 -33643433346637346366323036306537346633386461313861636662303138363265636630643337 -3831663830316234350a346432613830346533393262383139393038626466326231383833373261 -64303738336630623234303363373162393933636634646634646566353466306438376639343834 -31346337646435623838326231393664306232326637323634363031303139383433333263323433 -61626134636561653435663831326261323165353062366564616131383230323832333832366331 -34623237356433306661396566366235396536323436626364613666313037306662376463393836 -64326236616232356234326638373161366138316664303035623732313138643438653335326533 -33656432616234373234663637333463636635323464326364343337623930393661623262333564 -61333439363361666633373033623062333836373366353764366264646662343738363431343030 -61336661353066633033636263656231396461323637356531303331363963633166643137616531 -38613231613335613739386361666337366161343562613539653938643961356537613938356462 -32623162393530623261323163613930653862636332383138303664613434663039663633353163 -30356136666536623764373430343235373334343732396338313261303838663934616533313437 -35306538373435373637343764353539323538373538343766386236613630363736303763653633 -61653834656135666536646438323834653930623363306466313539633137613138333537663163 -30396332313962386136633961386665366232376336343833666562643139613538316166373961 -64396434353730323764643463616137376161323565626332356665333332303439333935333238 -36643639373739343237643633666232373639313336643264663239633462306462613736356136 -35303464613431396636666631383731383966633138373166643266643730363131616332313737 -63326166613030356538373064393039626230323961643536656166373634346331376237353237 -62623866306234356662336263666531656562363134343333376561306365386138653765653432 -65613832623836656531623835383738656662616138653730323764343437393634383666623966 -3563 diff --git a/dan/host_vars/ele-lt.yml b/dan/host_vars/ele-lt.yml deleted file mode 100644 index a6d92a74..00000000 --- a/dan/host_vars/ele-lt.yml +++ /dev/null @@ -1,20 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -33623330323462663137623863303262373039363563663434373736646462616237616161353330 -6438336330633039633134643230633036383631313535330a663439643563616631343337663336 -33663165323636386435306438393534633339626232306464663238353634343238363965363765 -3338363339326130370a393964393934623036623239323636643562366136323963363737646331 -39313866633339376539376333363365383364616635353332356137643330643533346134363930 -30653331623135386335316339343366323735666137386231383034313465616465343831643765 -35316235653737333132336564346634323739643966626461323939393638313361646365396231 -34363265366133306637363233356463333637353363626537653561366262353362386236306436 -37373366386535346165343131333532613639383563343135356432393264346162326463343165 -64353135653262356635633739666131323837656235313331373631376431393737316263306237 -31386161346531376432643830303865393565316432333534663732353132303034653162346632 -30383435366136323161333237376461333161386631646165626135313632386331353936393439 -38663939326462633338323732623237656161303063363365383461366161616565653663666465 -63646230343661343764653566326165393535376137326231633865303934646364303633633363 -33333937663433636539636531316432393430303530306130333331663232346533663262323733 -36363963636630613035303937376533636137646362333835613838666536336436306630626263 -62303331643962303738333461373531343937393236326130383766656131343365316131363462 -32613161353861623033666431303039386530613064643763353037333466383135616639653235 -303037343830366264653835313163313331 diff --git a/dan/host_vars/ele-media.yml b/dan/host_vars/ele-media.yml deleted file mode 100644 index be3605aa..00000000 --- a/dan/host_vars/ele-media.yml +++ /dev/null @@ -1,18 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -32383030626365353437666338353362653263373234613333386537333465366536396533343739 -6165663837376238636161386162373666313135376264370a346166363462323831346237393266 -64666238656632323331356230363331316534626437326538636433336239626164616665383864 -3064333035656334300a306535623632666566636631666339396435346435663064613463306366 -66326436333364303434623132643063666137366461613634353335666164376231303462633233 -65653532613761636537646439623338663338373364323531383936373765356436306265366465 -32636465323237623562356262356238363263383837386565393565366433376236366363623838 -30356336393139333561633863386431343731306331313137363731366335373435643866316332 -36323666376135313538663334663338313364313638666165333439666365373264656465363461 -38303262323237363733313633636131353661643433393530656232396363373664323639646635 -32303836386532353335363835376439363532333830343237346437346639636530333831356637 -35663335376435653839346166336465396462323231396235623762373032363064383662613764 -38653230623061333533373033373137393132366362343438346163393062663137653532633338 -65643430386466616366333164396637633764613938313232613631616535653366346135663865 -35643931666363616566356435303665386663656562373862646538326265373430656630343363 -37636432343561323737383538386563316234323438303563613537616565336239663439363936 -3231 diff --git a/dan/host_vars/sk-2019.yml b/dan/host_vars/sk-2019.yml deleted file mode 100644 index 2882acd5..00000000 --- a/dan/host_vars/sk-2019.yml +++ /dev/null @@ -1,21 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -65356433653063643165336636353364333339626236303637353639346166623666333136663466 -3637633166353765393636323931336338616435383736620a393565653533643732323661336433 -36636164633535303531343362383439633038323539346331666333333964616164636362363666 -6230313331636566630a636539306135343532643234323566656635353836383865373865643337 -32313739663638336232313462663261383632313866663131626330353766613338346231363131 -65616564353865633930623732323262393232343161633764633430316437303138323635333335 -31383361313861646537636133346137393362663566653936626137663839353430373265353262 -33653432366234366531376163613762383961323333303864656335313265363163613666396534 -65366136353765323165636438663336653137363136636565313934643262303939353563663635 -32643336623564386464353065346134303063346533353833363334626535663137333164383961 -39343161316433386233373866366138666664316332613039633531653564343137313961636436 -30613131323635633833613762346538373533316566616639326461626366343663366238333661 -31636462626539663965613063633832656235343562616533383531353133383137333032643564 -39613234353061323131643530613430303233336331653136363836636639383761633635393636 -39393539393066323238636334316537333239353837343934633364323937306634336233363863 -61383661316438386338653735626162613732613634333464393739633061666566623531626166 -30636262343633313730346462373738396535383164666266396265366635653866306464663234 -32646232666135313264656538633834363931643232626431383539613462626364363763616437 -31633761326535613363653861316534363236336332313961343532623434363737326434356439 -66626335616634613364 diff --git a/dan/host_vars/sk-2019vm.yml b/dan/host_vars/sk-2019vm.yml deleted file mode 100644 index 3f728447..00000000 --- a/dan/host_vars/sk-2019vm.yml +++ /dev/null @@ -1,21 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -31323764346661386139383032303266363633313764666462623534643433396631333062366631 -3435663166366366663734383739323731356161623835300a666335373262383065636665646136 -30653035393231643134623464383531623430633663666461306437383831326635363163623765 -3465323635376166620a343933626435323765373837313063363036326236653330353434303566 -66333664616362303533663764383939633366656166303936646263613934663139626365633137 -36633536333336643433643962616635646330383237326165343239633338313465636236373832 -65366331636464613434646266623166653932363239346339613934333732383765616566396232 -61333066353632346138663464393033316563336239326237613630303738396166373835643931 -36366436346461343735623338343938623234643039643239383463333966376363653035333966 -63363561376134656636333538313034356565616465333566633732643138316234326666343762 -61303230396163356538316661313763656563663063636238633239393661346264353563313165 -64376435323161316436333335343336363333303361613535646238353236353333366338386633 -65613036303162653136613935373266393631656431643830303637316438653233376130326461 -36616434343765386261326233376663396364346233343734363062653039396162396533626533 -30323438313865366136393233393438316430653931383630316333623430393733333535643735 -65643838633532353433343262356237333432343531336366323832356665306133656139373564 -37383531333030643432333137396332373036626134396332623530666636396162323237396636 -66656461373038316334313165633636663137323661353733343536656262323033623466346466 -62383835323066653063636566623765306362616166666130356361623964656330656236396165 -31663930633232653838 diff --git a/dan/host_vars/sk-cloudio.yml b/dan/host_vars/sk-cloudio.yml deleted file mode 100644 index 509ed672..00000000 --- a/dan/host_vars/sk-cloudio.yml +++ /dev/null @@ -1,82 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -38373935316661656666663139653966636234643337653432343830376332386533323164323337 -3066393834633363656537383433343365346330636136360a333462373465393939383634303439 -36376238303837373763643235663330353662323165636233623534623065303961356630623536 -3335613565396430640a333930656531666530393836633432363762366439343535366266333933 -61313839373139303835633234376330623634313666643964633432613432316437363930666331 -37363065663437396234613735363337343563303064343033356562633061353433386435663630 -34633761646566373435643563666436303766346430313131643334666235363062353864313037 -35623130386465613335623132623236373431636632343563653836383237326131306134636464 -65663363613661303262363334393639323132343664363863653564626537643432393465313238 -64623836626537366339616339393938353336626134333734303738316162633065623464323832 -61303965326133323063623663333664313933653233373864383231393730616163656164643935 -61353636633734613638616637393938326530393330306463303339666135626534663465373032 -66353662333631363036353234626366306636323135643334613461393763306161633934303538 -65386135353436336462336165316138383562316664306430373763336161303933393234393466 -64646262366533363038663931623161333130643164346565373064666631303434323331386632 -61373163356566353962303161396261613834643265636433393032383739386331313134663266 -34396265666435626564383063376632373038343030366336343638656437626663653232353932 -35386361633933316263666263323534633737393337303939626564346231363162353136323561 -61313134343163303434323965616333613465393632393266666237613164386663373731333231 -39646636353163653933353765646563656466306437386135663530346134316163323239376338 -39393138383930643231323766643364643738633766353331656532316336366363376462653335 -31343935303238613034336436343137373331323766303139393437623137616563613430633433 -32626431653634333861623335643963353337323435653538343036306463623765666234353930 -32663665323661396161333162386538336633303036336665336139386638643463376361356234 -35653431343630643662306634346239643063306562363266336262363662383264383930396265 -63646632383932323335666164376661613132616665356135356535303961333437363039343132 -65363233336634383234303237323534636261333132326639393261643162393330386366383965 -36306538343363623064356132623236353338303866353666336666396264333864363836633233 -32646434303839616639333538346561373961363438326336663365306366623836663930616138 -31366133626135636665613663653131343766343766373530366637323333393237663430626535 -63633935626265383866643437383236363264396334313164666433353863373834316134386235 -33666335303739316131323431623836633030653134303736353730636637323362316562383933 -36353161346662396138303265616231633161663165656662343930643537363366373765613233 -37346430653465303063636363636565306337623939373539313837376139373062623561616232 -63643461393530366366313630313364306230663537333061356364383364663663316561393932 -33333638376530336633643836373231353839643366626661636330366534363661333765343833 -63336138656461373939396233306139306563653337386232383435313135396461653731386434 -64353835663863396633616262663866653264376530396261656666373138316636323038346330 -61633761353065663062323938353538643338363130613932353461366535326462613162643833 -62663062623438353862616436643363303063343337336537386635373537333330356537306631 -63663439343435313732363636376162613030663930646334623237323065623632346461653730 -34663937656130373066366666643539376661633062356331666436366239346165653164643132 -32396131326533363264616135386639313132663030373363343364323965313539323063333761 -34373162643736383633623736323731653537653338316164623064663865663032376238643834 -64613032656365326162633237633130353963633131353130656330663863663733653766323561 -36323139303738326264393833313761363937643262383933633366366634336261343536663565 -33316166313130626537393939363037616165303933393230333632306430623438643363663433 -39346333623061663166353138373963316263393332303862333764393435613233613965333965 -62333230323266333430633365623739633436633635383339373332333934353734313530353533 -35333964623532306363373461396462363733633837363132356638353266666634363035656665 -31333966666166373239346139623632346165393163643334626534623765643533653761303662 -32373765393332303131666230616232623432303036633362393230626666323566393762333538 -36366539313732373430343464656439623432303664383632613362366339636462616635613834 -62643962666634636365373132613634613462313938316566623265353730366436366631383431 -32623039656537613630613636323639623334613830653931326464326234623938653532303764 -65633535333062313738393330303832306530633130353737653961633566613963643065323033 -64646563346332343537623939646435663836656266633061373332313636366338633464373639 -33663732313262356133393363336361623636326231616631333633313230346362643163376130 -61393338313761623765353164656530643533643661663235353366373039323934313466346238 -61346661616237343164633137663134636631383563383038303330663664343066386135316433 -65626135643564653038653531313065393731666162383365386333626130636435613339333130 -64643538666565383965396263316365353234636634303563333435363865306662656631306166 -61633035306562336565656138313233396266656161666438366537663132613333666636366631 -63376636336237626233333937343236393166633733373534353131633036633239633234643536 -63353535306561343962303331306330633934323264326138613161633639616263333734663634 -38393964636137633862343066343538333938363733653866323161643834393363663539613630 -33643737663536373265356437346463656361303461626265393730663837633632363963373130 -31353164306563346239333736303636333336323065656231633038636137396463363638626630 -35656137616536363732376139663561646638663262376433643366373965323837623433323233 -31626131653766626537316430303564336263396239653964663936393433343831383132303530 -35643539366339393839653664666464643739393134666234333733613532363161663630373033 -32636665313461363932333533393133343762383561353863656536303565623564343262343337 -36653536366534653037633830323537653637326163303131616162303961393735623839353831 -30353134646639343531396437643831366239393066653433323135613033333162376364636639 -63313432643663613061333335333664626233626331663338626334613564386365653461383030 -32346130373965396164653663643933363235616534663031336430323838326265636563643839 -37646239653835366433646331633861633330663438323737653764663338643632353832383238 -33663831323062623036643039656534326234313161373836383966376564306231616162643831 -36623832346636306135333439656466303039396435613731393535376165613534623832633034 -61383133356332383730346630356131663263313532616661333139323133356666333966333762 -3731 diff --git a/dan/host_vars/sk-testvm.yml b/dan/host_vars/sk-testvm.yml deleted file mode 100644 index 033f490c..00000000 --- a/dan/host_vars/sk-testvm.yml +++ /dev/null @@ -1,20 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -35666266336366353336306161626463373466323434316163653235623464626134316237333961 -3139623939363464366539646365323136393939316333630a373365623838663038306438636537 -63663830653332316132353033326638663332363636623131666266313065323430346634333339 -6339336365343265660a353637373133323634646463396137353130663731623265663064653337 -66363135376339363862316134373631643765383935333030323938653337396435356361353638 -35346665376262306565393339646238353230363439333762306633316331643963653466313961 -32613063306437633333386265663562616563616664613962633564373563326539363866313763 -30613232353663643066613732316564666361646163366437323765633935656238336632323733 -65386135656435313466653666623233303661343530613932373961643634346562393532663462 -31353262323133363537303035383639353334323935613831376637613964663635306637643037 -62303134633064616531353039383336363563376365326234323835643233306139363032663536 -63373534323731366365393632623432326561303863616261306233616436383266646361356636 -64383831363863363738633065386435343935633137613964316237666566313430623061636439 -31646661333161623465316564323835653062343730343331353339363664663331303735346162 -63646531646430303630356132376232656639313163376631373135313237633334646135653239 -37386437633432376564383964636266623230363834633239356565376530633838333533346335 -66383966313862353130663334383535376464613638366330303962656336613765656362393335 -37643066353734303733346234633736653663376639656633306635363061623163376139616564 -646461383234653235356164626537326664 diff --git a/dan/host_vars/sk-tomnext-nc.yml b/dan/host_vars/sk-tomnext-nc.yml deleted file mode 100644 index a1008b15..00000000 --- a/dan/host_vars/sk-tomnext-nc.yml +++ /dev/null @@ -1,24 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -38303565323764636435626633373138303637383839656366303532313266356665306666376534 -6566623963643964613133306334396336333566646631310a366430303430306563626530323636 -64316438663337653135353935373038393931393261653133336164383436653665666132383233 -3566353365376265630a316166653133336338336330303161393932666335393361346435623733 -39383137396232613937633863306437666263623638633663343966333339376665666439653663 -62633536633937373230346636356134623066373436613839306635353262363062313036666262 -36333330363161623939613431363135653337643030323233666566633132636234346638346337 -35366165663866313230633831643839356335623734306262663663336530356437623536373265 -64646136303831363364636261363333383564643339636662366336646662663837653865363333 -62633331376636663638656362643262373163623764663034363839633433666661623164633532 -37346532323961613133623661663363383963626561383033303961633162376631643730383434 -37356261373736313036613864626362633631663534376665626238353033613831636364326137 -61663033653663633533376361646330383339343733653836303163306638376139323331323164 -32636133343333396564666563393239306239633739336361346466366565303433323230303562 -64663535303665303739633833316639346262626237376130326162376363316236396536316466 -63616436636262363062653162316335393465653263373132646237386565636232376266366435 -65643964346332393832353163363038313237313038363030306161373836666562613831333033 -61303332616261616437386266336664356636303633646134386236396238363061636330616266 -66303131326431343132316232363863343233666163366362643763303162393238346432616632 -39343138383538626561356635633562336531623039313336323138363965656536613935336436 -39306638316339323033653861616533396339313764613264613365396664613230306237646562 -35396233356638313339656331323763636330373334613631626130306331336432633334323032 -386630346436653564616130323562323530 diff --git a/dan/host_vars/sk-tomnext.yml b/dan/host_vars/sk-tomnext.yml deleted file mode 100644 index fc3ea2c6..00000000 --- a/dan/host_vars/sk-tomnext.yml +++ /dev/null @@ -1,21 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -32633430643636636263663937653962346365323663323335326366363134386163373532643666 -3462383534633339623538646230653639393534343536360a343665316266613464333066626631 -36393863383832303761386566343430343138343230643761623761396239633839666266356265 -6164333761343338620a623432663562626332656136626537396230303766616631373733383566 -34356561613066356666646631373466316162383063386262646435343935356135623261393439 -38656639643366346338326136306239323637336237363532353334623639363539333131653935 -33306239313131326531613466613330346430376639666564383263643031666636326263346462 -63626135393338386166666539386337633361393334666238393833373437313739636465393161 -34633266633862303937346366363634613165313635646164663131393634376330386464316666 -31396433383761316431343036383134303732653765613330303863333934333839643764346331 -61623038303638313632343038306464653030663933313462656438303564363433356438303637 -65666363633166306630333866323034396131313866653338346465653637653564323363376531 -35636263623039356437333563636131373237623034393362653736356265363261306132373738 -39656437353561323633323565646464333361303530333530646234663036653937663231616237 -65313061613638393131666430306464366564383963346334646365366234663737633363303963 -35336663343936663661326638333136616432383831306333643363663761363937626466393331 -31343538353735626464643162306164623963613937656136393934663761633435376636303861 -33646432643963313131353639396432653337626232653262346133313564373766396537356362 -33373466393462376137323264616662343962376463303030616335303431386131613565356365 -38653564303532373566 diff --git a/dan/host_vars/sk-torrent.yml b/dan/host_vars/sk-torrent.yml deleted file mode 100644 index c95d5807..00000000 --- a/dan/host_vars/sk-torrent.yml +++ /dev/null @@ -1,10 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;dan -37333061623432316463656165303235356636626364393138613735333631646137313866383866 -6236313162353066383439613737393934616638316637370a626434626230373836313963336234 -33636230396235313934646634373034616564656339653066656166353936643236346235333038 -6334353930333062390a333531373932633331393636386630636162363962373538376133633036 -36363236633862303933663565653361646533396565646136613539363166376232386239343863 -62666331333634373962336466376339653531356637383930363866363031326533323730646435 -61303239613733326531636331626363343232663135343333343139623864653761373961343962 -31346233326638646133333133336538333361646261623436316238326530336464663761343361 -6137 diff --git a/dan/sk-tomnext-nc.yml b/dan/sk-tomnext-nc.yml deleted file mode 100644 index 9b756a18..00000000 --- a/dan/sk-tomnext-nc.yml +++ /dev/null @@ -1,24 +0,0 @@ ---- -- name: Basic Setup - hosts: sk-tomnext-nc - roles: - - role: apt-repo/base - - role: core/base - - role: core/sshd/base - - role: core/zsh - -- name: Payload Setup - hosts: sk-tomnext-nc - roles: - - role: core/users - - role: storage/zfs/base - - role: apt-repo/spreadspace - - role: storage/zfs/sanoid - - role: kubernetes/base - - role: kubernetes/standalone/base - - role: x509/acmetool/base - - role: nginx/base - - role: mail/postfix/base - - role: apps/nextcloud - - role: apps/collabora/code - - role: apps/onlyoffice diff --git a/dan/cloud-install.yml b/elevate/cloud-install.yml index 72db81d9..72db81d9 100644 --- a/dan/cloud-install.yml +++ b/elevate/cloud-install.yml diff --git a/dan/common.yml b/elevate/common.yml index af4b4fda..af4b4fda 100644 --- a/dan/common.yml +++ b/elevate/common.yml diff --git a/dan/ele-calypso.yml b/elevate/ele-calypso.yml index 5d8e51ce..5d8e51ce 100644 --- a/dan/ele-calypso.yml +++ b/elevate/ele-calypso.yml diff --git a/dan/ele-chromebook.yml b/elevate/ele-chromebook.yml index 411c49b7..411c49b7 100644 --- a/dan/ele-chromebook.yml +++ b/elevate/ele-chromebook.yml diff --git a/dan/ele-companion-raspi.yml b/elevate/ele-companion-raspi.yml index e16c4d70..e16c4d70 100644 --- a/dan/ele-companion-raspi.yml +++ b/elevate/ele-companion-raspi.yml diff --git a/dan/ele-coturn.yml b/elevate/ele-coturn.yml index 4111f156..4111f156 100644 --- a/dan/ele-coturn.yml +++ b/elevate/ele-coturn.yml diff --git a/dan/ele-dione.yml b/elevate/ele-dione.yml index 95800036..95800036 100644 --- a/dan/ele-dione.yml +++ b/elevate/ele-dione.yml diff --git a/dan/ele-dolmetsch-raspi.yml b/elevate/ele-dolmetsch-raspi.yml index cbb2ca58..cbb2ca58 100644 --- a/dan/ele-dolmetsch-raspi.yml +++ b/elevate/ele-dolmetsch-raspi.yml diff --git a/dan/ele-emc-ctrl.yml b/elevate/ele-emc-ctrl.yml index b24d8df4..b24d8df4 100644 --- a/dan/ele-emc-ctrl.yml +++ b/elevate/ele-emc-ctrl.yml diff --git a/dan/ele-emcplayer.yml b/elevate/ele-emcplayer.yml index 0b9d7568..0b9d7568 100644 --- a/dan/ele-emcplayer.yml +++ b/elevate/ele-emcplayer.yml diff --git a/dan/ele-gwhetzner.yml b/elevate/ele-gwhetzner.yml index 754fae65..754fae65 100644 --- a/dan/ele-gwhetzner.yml +++ b/elevate/ele-gwhetzner.yml diff --git a/dan/ele-helene.yml b/elevate/ele-helene.yml index dda7134f..dda7134f 100644 --- a/dan/ele-helene.yml +++ b/elevate/ele-helene.yml diff --git a/dan/ele-hpws-maxi.yml b/elevate/ele-hpws-maxi.yml index 1661de96..1661de96 100644 --- a/dan/ele-hpws-maxi.yml +++ b/elevate/ele-hpws-maxi.yml diff --git a/dan/ele-hpws-mini1.yml b/elevate/ele-hpws-mini1.yml index 2d2690b6..2d2690b6 100644 --- a/dan/ele-hpws-mini1.yml +++ b/elevate/ele-hpws-mini1.yml diff --git a/dan/ele-hpws-mini2.yml b/elevate/ele-hpws-mini2.yml index 83341a64..83341a64 100644 --- a/dan/ele-hpws-mini2.yml +++ b/elevate/ele-hpws-mini2.yml diff --git a/dan/ele-hyperion.yml b/elevate/ele-hyperion.yml index 3402de41..3402de41 100644 --- a/dan/ele-hyperion.yml +++ b/elevate/ele-hyperion.yml diff --git a/dan/ele-jitsi.yml b/elevate/ele-jitsi.yml index 7fd463d8..7fd463d8 100644 --- a/dan/ele-jitsi.yml +++ b/elevate/ele-jitsi.yml diff --git a/dan/ele-lt.yml b/elevate/ele-lt.yml index 67eaafcd..67eaafcd 100644 --- a/dan/ele-lt.yml +++ b/elevate/ele-lt.yml diff --git a/dan/ele-media.yml b/elevate/ele-media.yml index d22f91dd..d22f91dd 100644 --- a/dan/ele-media.yml +++ b/elevate/ele-media.yml diff --git a/dan/ele-router.yml b/elevate/ele-router.yml index e160b57a..e160b57a 100644 --- a/dan/ele-router.yml +++ b/elevate/ele-router.yml diff --git a/dan/ele-stage-raspi.yml b/elevate/ele-stage-raspi.yml index b19389c4..b19389c4 100644 --- a/dan/ele-stage-raspi.yml +++ b/elevate/ele-stage-raspi.yml diff --git a/dan/ele-tarvos.yml b/elevate/ele-tarvos.yml index d034d970..d034d970 100644 --- a/dan/ele-tarvos.yml +++ b/elevate/ele-tarvos.yml diff --git a/dan/ele-telesto.yml b/elevate/ele-telesto.yml index f8f7f55a..f8f7f55a 100644 --- a/dan/ele-telesto.yml +++ b/elevate/ele-telesto.yml diff --git a/dan/ele-thetys.yml b/elevate/ele-thetys.yml index a1a259d2..a1a259d2 100644 --- a/dan/ele-thetys.yml +++ b/elevate/ele-thetys.yml diff --git a/dan/ele-tsdatacop.yml b/elevate/ele-tsdatacop.yml index 949bbba2..949bbba2 100644 --- a/dan/ele-tsdatacop.yml +++ b/elevate/ele-tsdatacop.yml diff --git a/dan/ele-uhrturm.yml b/elevate/ele-uhrturm.yml index 2b102803..2b102803 100644 --- a/dan/ele-uhrturm.yml +++ b/elevate/ele-uhrturm.yml diff --git a/dan/ele-winvm.yml b/elevate/ele-winvm.yml index 1af6ad58..1af6ad58 100644 --- a/dan/ele-winvm.yml +++ b/elevate/ele-winvm.yml diff --git a/dan/ele-ymir.yml b/elevate/ele-ymir.yml index ac94cbee..ac94cbee 100644 --- a/dan/ele-ymir.yml +++ b/elevate/ele-ymir.yml diff --git a/dan/emc-cdn.yml b/elevate/emc-cdn.yml index 94697fdf..94697fdf 100644 --- a/dan/emc-cdn.yml +++ b/elevate/emc-cdn.yml diff --git a/dan/generic.yml b/elevate/generic.yml index bc8866c5..bc8866c5 100644 --- a/dan/generic.yml +++ b/elevate/generic.yml diff --git a/elevate/group_vars/all.yml b/elevate/group_vars/all.yml new file mode 100644 index 00000000..ce5422e5 --- /dev/null +++ b/elevate/group_vars/all.yml @@ -0,0 +1,12 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +30393539363138333165306261633761333339366433643761376566383738343861313234356565 +3936386363353665666363633635656562373731383666360a366631356230653935343266393535 +36346435333232356139396436373166623066633265336533336661303032666535666437643037 +3864333634376565370a353831366234353037323731396665633262636637346366336639366664 +36333034396530316237646635626635666466363030656665666535396131366436326365363530 +37643531353633633831643938623730313630636666363639626564306131353339623463366365 +34376666336532643237613862613138303462303765333531323166363233366264373336613530 +39303832336438616265626530666439313734616237353033616266623365616338363237386433 +61666532393233306563313033306165303133613338393231663465336632633861646462303838 +65363763313236656461663338333534626436376661346239653462393537303863643531383266 +643130373130326262333533626263343261 diff --git a/elevate/group_vars/ele-router.yml b/elevate/group_vars/ele-router.yml new file mode 100644 index 00000000..250d7572 --- /dev/null +++ b/elevate/group_vars/ele-router.yml @@ -0,0 +1,167 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +30313236663032633534666365353639363464313732343039386338613036616561663331336561 +6234306334643432646235643132626639366538636165630a623939663664356532626231346664 +65386433653163303635623262323232343961643239356339643037316137383132633834643938 +3238646130313465370a623332306664646238336635353131363461313161656364613938363833 +64333837633262336462333765623731313165353539356535333431313432633264376463376462 +61343732323762643463396364386339646566643337636635613335383061363662346339373164 +35643934643937356665386135666336386532366564386538656663353262393235656665306665 +33333635616639316463396265386638656362636432393165663131653166343063383466663430 +38383463363834333362383736343833326666336334393861666232383734393165313932316538 +66626531393765313632636534363566666339633434626130633663333365323364333531383538 +39616361376264343963393837663633343065366234633533383563323737363434643961633733 +66616231343137306234623538643739393466396165396466393162353035353039643865353562 +31333162383664383565656239653262396532356466333238356364646132336235656637366663 +66383533363130316336323736356563336230633539613961623562306364323466383232353466 +33336635636331306363663238653931376438376231386330346266303037663139363861653938 +31633761353039366661653831386437343263643465396363623761356663366662383763393265 +31306535343135626164643532323539383838636563663336386364653532303566666164353836 +66316435346139393239366164323032396665323562373830636563316336346362393132363764 +30346133393766343366613561633531313434343235333335613835306238643539333066313762 +65643831343464643232303465653362646130353230323532636366326233346561643866623364 +66363366613363333339386466666431346364343765646465356338333836653232356434353437 +37366631336164636331633932643731616665346665326161376563316233326231663034353765 +62613234333735376566313934393734383764633139663731666236323461386538383161633432 +61386165326163646337313831663838363431386138616131343034313936323737373264373064 +65336162643530303838363434663733346461633362396137376162656238643165656363373536 +62626135373338356438326132346365643263323937643536643139383566373538613234383962 +32383038633565376630663966633133366236643336346135376533393732366130623930333464 +38663033366332313761383164346635393438633136366464636364303137663430616238336366 +31396135393330656238656562366333323236363336306531613537613738623564613734373637 +61616637626435393834646266393530633530626665386166393039653236393039303862353663 +66616137353265653737376334333366303162343331356130383637333131613962633862633263 +61313535663134303566646137396237323231323763346365316133363065356561316161373166 +31376432643334666438623362626337636130373435646637313935303832636133613530333932 +31663138333937346466333664366532366339306266303238303634623330323336633561643034 +65366539353332653530643865633030363464333165393163333335336366356562373337383966 +34343631626665396164353034643438383362366165343433356362353933383361346530666137 +39383932636662653062386535636234366464613130626333646430336561616462633864363034 +34303166316361626339346431663665393833353764653462356133393539616339656330343166 +36613962316633333432623237396633323362323266353938373137636364333131323231353863 +33646265663735383533336639386237643433626539346535336339616130393464363362376436 +39383636373963326366346332383863363832303433366438303331653436613165613235623034 +33343962626433633264633331323932313839613833643530303138656666633363313662386530 +35303738653631383264643230326264333462356166396635663037623736303966353233613136 +39313137656132376230383431393239626135356430343439613061303865336161386234313730 +35663932323134313064643266363464343537663536373935336531666466373366616364643638 +35346561366536643966313966303338653832656662343162636234646461653431353931333831 +32666635666664303332366132353132396233313938343162353265653633323532633432613539 +65366464383430393232646435373739373562656237616637643832623338636532653535636436 +63303964653934336232633562623634343730646331663464613035646266666338623265313539 +39303033616631383139386561386330383834343337313961636234376239646236313166383235 +37643564386566623266343531396437623836366463383937646266613639343165623530326266 +30333361303532336262623038616230336164653863346236633635633862613030373830343037 +36663034636234626163333933343563346263623665303863323763336331333963616333623731 +34666431353530373762353032636437363132333966393235373866633265353861313037313066 +34363464666365316238663530333264626135313239623161653337393330363138663030326630 +39313465663337373163376563333130353133326638343763613037616365653331663566333138 +32393439353532323734373864323531373133373462376561303333656633613439643263363264 +37653962306261386262346463623361346563343866366339376433356635336665353962393131 +30386130643537343635313565356663386638353933336161386632373533326634393265383830 +30653939666531363832333230376133306135306536336134366133313664643338363438643062 +66326631623366356639653331343066633966666431393339393339366566366637663130333639 +62376239373636653166623532643333326131623836613462396663656134393965326330363065 +63313437633133623537383665633732653937386362306439613332343938303039623463303633 +65366536313436646430313666616434626366656330636262313662636462613663333563383665 +61653336626439373166623231663466393966323466356361356639356364613963326433613638 +62303863306537366238373163613736303765623939656564363531386235623133396665663832 +62383735313038636439633038633666353235636335653732313063363566616335396236613337 +62633439643339306462356165393462376466303837666632393133313865326134303663343764 +35613733336363623333396432316565616165306666353038393762663839336337656166613030 +36653239313437653735336666623232303437366531623032663739653638613438633630643337 +34623132376237373365316431373664656336653030393965323761653333356362666233313738 +35623962303139326530383831396136623638316633346133303532313239343034343461373930 +35646163303234343837633736313436366133386236386139313236363534303365636164646531 +64656639633331326236346439383637393933363430643461376166376434343338343130663762 +32316235616338643264303162623939346232376631316135666637383030666337336339643264 +30656536636666633130626537616363373065313537643664386162363265633838343038383730 +34363765396534373530623238616437346634366638353161383238636661393366303334316232 +61323832373265643430383234643363313339313037366236653531663136643032383039326231 +32383031613831366539353637356335363565343931666638353264633430663762633734633462 +37653636643932386137306161313364353061373061393261653933326230643961313933326164 +34306465353564396432613133663739303133306431643732646165653566313135643333326363 +31353935353863303936613661613438373565386666356236303537643466366135363237663666 +65646565643330393062636665356435613138356465353064626132363331626338373939353836 +37386533616130353837306635626164383663336136363261373163356336636436636232366331 +37356435393763663336386235613136653566363065326137376461323534316365333064363135 +32366364373162343331646363623834666331336161383266376262316433613830393463386632 +39643738363262313932303535623866306263623839323962393666313466316533386235636139 +36356166363963613761353233343661383230633434303263303931613835393431343830376661 +38343066393034313339346334306232303435666137326136386135316462396565343031333835 +63376533326337333965376537326334323834653532313839616364376535326531303233313734 +35376130326239376661356631666531633434633036623437306535626335643236623664346664 +37316630366239333036386661636436643839663630366534333839396134313839623534653461 +31303831336239636137663039343336643363633864303137376437356664653938363831356331 +33353532313861626661323036383063646233616261623036616163643339633439303035616433 +39643664373530343962626165303036323238346130663033303933306338653137653461653337 +63376434333965656434386236633832363137656432343032376430343066396163316434366365 +30636365666431303463646463333636363664316639336266623062633330363131313262623839 +30613564366364623131333262653830303137373934393766633066343136633937353638643765 +64626566363839636539326235383639346237393566333865653064383165396131343035373937 +32616233636162373565383531346130383339346333373536623165393062633131356438383931 +38366231613234363737313265613266303363313564386361316439353166626563333030356666 +32356432353666323361353239383033653365666137393333343034373734333933636234653063 +63323530636131366138643537313963396166373533366232396131373966366635663931646331 +63316531343963333239363164383364373530396439353830383532653730323935333862383332 +37613639323332636632333862643262333737663039633938393230663063373366356237393663 +34376332616632636630653133376435373637633037653562333331373861316136623730643132 +62343064316134343135303736643630656564643137313737343834623661623161613334393765 +65333032343438663631326432333232633039386465386466326230303066343364313965303435 +35373065316432336663363035326464363333393534616364333039316137613261376165393961 +37393664623332646639376238393936663930663361333638656234643235333337383866643966 +33366663666234376330643534666666346365653162396264633036343837306165663230663537 +66643638613233366636396565663135636666393639386237323237383131316561313631666361 +32623433306132323835643062336338653666363462666533306430643035363939343336333634 +34363235303465313233633038646131333735633639303233666239336265623031356639383236 +66353232373935373464363839306532356562326134303863356331323838333236366162313333 +64373031613536353539383562613738633062623665643063326238343637356666393462363033 +61636664633231353736623661393264326538366661373766653134376134623431373164336533 +64383132316538376336306366366338663639616665663662633730623439646339653139303534 +65353739616363633935383039346439613934303838666339376639636162343138366233666339 +31613531393535633565396539313564373465306138326463643736316566643935623236623433 +36376265643931306263373965316637393232313261373034646666306431616531353735376266 +61373763393734626162646635336663353764623163343631653863343566346336616664626533 +34306337333462336238333062623465346532363233353931303934656431666662396338323030 +33623236643762373761643235386366366462363665323831366636666365373331613630356233 +35333566636565656663376332663234623237643639613631336561393838616662626232356262 +38346435643361623466643137633763653335376437313462373333373966656165383534303665 +33396330633963353438313930623535336163656166306262633333393538363965653961633763 +34313535646562333363653862336565616134373663386131343131363261633666623533666534 +65333537653933616230316564336461653939393433393837393439316461643031646231643134 +31633338643764366637343737623164633762343037636562323565623730373735656463393135 +39373338343333363338343933363461306463356462303933636630626139613961643035396266 +64626535363038306565313534616536636536653261616233306461643361373965333136623664 +36313566623638666130613434633235653230633835376361646338613338653735343562373063 +63326466666339323931333763336237326264623636393465633864366632613865386439306235 +39663663376130366334373338643333356537383132623262616539656132396164373932316434 +35336166656437313965363361346235663031323062386336643534306664353863646436356336 +66663037323537616665366235363634636664616662373365343863626434376462626265376532 +61643635393135653965353964346538643165323661393839316131336230656161626362396439 +38323164653136656163366534303236353337663937666364333932653363643832656637383830 +37393662373936333663356431303936633835346631383835383862626530333834346237396332 +61646666316439653365613865346466333330666538316532326533386635373061386465393832 +32623336643736396238316230616165343565643239373739646463653361616637396430393036 +62633739376662643733626530656436323837653537373465373331326664323337393639363233 +35643966373634313632666264643031326134623333366336343031373965353735626633663161 +64653533386464326237616632393939336164616163356133383630386431316334366462366139 +34653239366637316365653166636462363139356135656333633066626530336666393364356231 +30353337353965323564393664333462383564656264396361616262396261353630353339663432 +34356164313866626462376666333034303133666632653234343365363966393731353036636331 +33353962326636343636616262633331313165323938396437656438666234623161323531356331 +31313930353937343931303532313032636464306232323532663835333538383038326665623461 +61633433383737663238663962363337323634386636643664393762666139386464323432303264 +66653663356335393931306366386130613963633964656364386235363162393238366237643463 +38636237393962653834356531653430633534653232356230373732323833346262313631343639 +39313730366434333564343730343733643030323133303133363165383930343732643431623139 +30363634316631323131306535353234623434353362663933623939656165346438393535656539 +37373533663763623464386165346532353763386461616232323161656130356532363131336664 +31623963616134643361366166613335656436363363653138346434376638346261363163306336 +64643465343931386233363432323435373633656232353565646538653931613135306631303333 +36643434343765633832373738336132336165363938313966396661303438393365613464343562 +33306433633666633834646130303031663464666537376264636433653539353263643436336533 +35663531633938303366306165623331326465323733316561396538303137336266636231353438 +37316338386138333030626339323237633632303565316638653331303638646532393134326335 +61653664633238633539346439323337323161626234306431343762393834333265303137383162 +38656661626636623262383064316562313132313137313162613766346238336132353530623663 +63336437303336633066636137663662613931656662656430333732316631663031653561633838 +3236633033633165653762356165656664646432613139373965 diff --git a/elevate/group_vars/elevate-festival.yml b/elevate/group_vars/elevate-festival.yml new file mode 100644 index 00000000..de98a87f --- /dev/null +++ b/elevate/group_vars/elevate-festival.yml @@ -0,0 +1,15 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +32653933396132613661663565393466373638643434393364356564333433303630356263653336 +6366313935323539343662386135646262343161393435330a353861356462613337316130393636 +34646231373138356134303865343236626536356535366138346433343464313064356266363761 +3336353332653563350a636134353762363965613761633333356239306631633163323630353931 +36396230353439643937383764353834383065646332363232346165373836313336363432636630 +61663232363738666663346630323530326235316639336266356561646339336661623063633437 +33663632623262336138633834323566376463333464646234323330383733333666363165656566 +36313531393939383762303439636366343636343836343738326435633135333861643833363833 +61306562363466633566313533656336306530656534396661386330653039636636303562646430 +38323762396434656131646537346461633036326335633438363063393966636538663666633934 +39306537333238353237333361363964316562373936646337383133643463316563373461393638 +63643831646638353036306237626130613032333364386462643139343938343366376439343862 +39623936326531363332623836323338653638326336626666303536393335306566356535636566 +3463616238393332366364653864643864653938356564393932 diff --git a/elevate/group_vars/elevate-mediachannel.yml b/elevate/group_vars/elevate-mediachannel.yml new file mode 100644 index 00000000..978bfa05 --- /dev/null +++ b/elevate/group_vars/elevate-mediachannel.yml @@ -0,0 +1,10 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +33636266386666653435383034336336636362326466613062623036343931613836356632323435 +6138623537666638366534316131643338353134343535620a386362353235373136373030653031 +33363237653266666463633164663732396666643536646566366631646539303739643064353864 +3733353664333937620a623066663364306466636530376433663937663064323534613365643236 +38356565323335373031393936353537356465313234646336323166323862353565666635663333 +31653738383931383166336637376365613139356130623234366162336232393333366663333139 +35323663613739633431306564613666653066323061343265653038663131363030333632666461 +36663636343138636136666133636566356532316631316264623134333838643738373238383466 +6331 diff --git a/elevate/group_vars/elevate.yml b/elevate/group_vars/elevate.yml new file mode 100644 index 00000000..a5cfd2b1 --- /dev/null +++ b/elevate/group_vars/elevate.yml @@ -0,0 +1,9 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +62383831363463313638313037383265326236633466373436373632373236316261623735666338 +3232623363623037653838643438323233653730363663390a333663633932313630333532353936 +63646661613639656532363339646232643764373339393634636266383261343536666532313261 +3765643666633436390a376531656164323737356436373366373462646561343466313534633461 +37386366646436333664613639613561356536333035346464656661663330663535336562383837 +66636639356563353935376236633630336364643264383735633961323032353535623465303061 +34356539383933306538336435656539643466393036386564616133613435633266326438326165 +65383730363331343239 diff --git a/elevate/group_vars/k8s-emc.yml b/elevate/group_vars/k8s-emc.yml new file mode 100644 index 00000000..37e1e27e --- /dev/null +++ b/elevate/group_vars/k8s-emc.yml @@ -0,0 +1,10 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +63633762663537383737616533666365306562643765306164303831383161393664656430653736 +6133636536353261313032643036326539303062373466370a303936663931303432383835346264 +63653865373466343164643665613938353634613765313761323763353537346464656636303036 +6464643234636163650a633431363938363263323537643533363337353363383634333136383761 +66363138313263383832613732326639633332336266666665616332626337636632383232366461 +35366639316561363563343466616135623632323834303739663465616333373935343935643230 +66323866313836393036343236336236663934613364393331383830393065646162303636616465 +37323634393837356262633361356665316664643033636530313039393066626439623763633932 +31396165316664336538653730663934333264373536303432386639626335303439 diff --git a/elevate/host_vars/ele-calypso.yml b/elevate/host_vars/ele-calypso.yml new file mode 100644 index 00000000..0caab9ab --- /dev/null +++ b/elevate/host_vars/ele-calypso.yml @@ -0,0 +1,22 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +38396664336363636636333132323162626365623633653761653064616137666637346234343331 +3865633038646465393464303430633731646230626261320a373637333231366566643434653838 +32616330663864616433343461646362613166313134613031383936396135393934373137626563 +3163313531613136370a643861303630393535336332326237366430383763616664303664316637 +31363136653265363834613836613039626362313435393336306661633762353532626333636233 +61663138356632363037333532393638386462356162316136326463306162613235336265366239 +30646366353835643838363534373933666663633930386334656135653061393239613739383534 +32646231313666313038363539373665303030643235303938616232623433336337323834343830 +38393330393662663635346236656331366364653234326631316261326338316633323736623338 +31393436633833323734656135343866316634396539646462396566663161373836396664353764 +36643733386139663162346337643363633863653735306339356331366230343861326161306636 +33366562353738343630356462356338373739393038396236353263343339363562303234363932 +31643163643335383237613838633631643138633231666635383261626264343338363631633136 +33383633333161323365313636343861383230363362646435373139343565643066633663333564 +63393130323837656661373663343565653530666536623331373764613831643735316335313930 +39336533363439663962373262393136326162343562653036633936633563323934326235653837 +61616539363764643130646663373966386566623366306364326531323730623534353333353439 +39393032376264396139336465366462643835383466666161626265303632613133636165323032 +32323266373664366566333130613636626231623661633064323437626633636566343434366130 +39316334613230303163663638306464386134343733633431616566313265336338313363653234 +3063 diff --git a/elevate/host_vars/ele-coturn.yml b/elevate/host_vars/ele-coturn.yml new file mode 100644 index 00000000..783d5b89 --- /dev/null +++ b/elevate/host_vars/ele-coturn.yml @@ -0,0 +1,18 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +35363465636633653332646237663638653761356538396666643762373835313466333330383539 +3032363763386532376564346134623164653239376664300a393063333866323266333230303238 +30363765616337376565363233313166663335393763336562366535643466323435623032393631 +6434386232653331380a306262303962313462343537396164376133313531663830303232303436 +64336235373364353835306430613833396132616436646435353133336538386666386330393566 +61326462363362383362343935663563373730613233313834643937653438356237633761396266 +33333033323563663261646263633738613161343662356465636630646461333766626365343031 +30353866323866393161303230363431326432376266373062333432353133323061363138656435 +38303130366539356139373032333633303532666434643261623539623163383365616232666265 +34306265613764303235313235353037343439323135623537383437313463353663306436373764 +37313162656636636165366361353133353932643037633630306265623034333462363632663164 +33623835376435373762383761343934636664396462626533356539666639343536383436656239 +32643365663636323162376337646534623863653934373939663236393965326634333238356265 +30356531363938626530653136346362626665393264646561303537366531396532663163323162 +61646337626638663835366234316533353334396162636533373035646137366439623961303734 +64316632363531303666646335393336366235366435386364393466303133336335643932373837 +3431 diff --git a/elevate/host_vars/ele-gwhetzner.yml b/elevate/host_vars/ele-gwhetzner.yml new file mode 100644 index 00000000..abc2743a --- /dev/null +++ b/elevate/host_vars/ele-gwhetzner.yml @@ -0,0 +1,17 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +33666238613731336263663662633166303038316639396534353761623838393538393930316234 +3932373938353637386365663934356264326230383363390a333064636665313562333732663863 +30316364366662616365333834366132323763353932663133323831653334396530663634313538 +3262306234373865310a373531646439626661313531373863303239653362316438666138326561 +64653239333937333234616133366565306436386335343333656138376431653664356139326364 +65613363366434666435386434656132326562386562366230363066393362616663643862613431 +32363339646534636531623661363732306562616665366437336638316533656538616462616465 +35613061343038323865393164343339396361376531373164653335303833306463343832633564 +31343936643462376263323732326462666433633130623363386133386436346461663234383162 +65343531616439623262616539313032616461396539373962623163306133366365356563323565 +64663432313931313861326361616432623635303336613562663735353736653765323063323034 +64343665343466346536666662316135326330633364663235616561303861356337656362313539 +63333533323439346561323066656166393663386536343839326539376564376666373935396430 +65366636343333653735333830343266653831643661353436386364343665653165666234636331 +62373463303734383837323033386534333238336330303838376436646562633033363730346134 +64363464386465306639 diff --git a/elevate/host_vars/ele-jitsi.yml b/elevate/host_vars/ele-jitsi.yml new file mode 100644 index 00000000..f0c1d80d --- /dev/null +++ b/elevate/host_vars/ele-jitsi.yml @@ -0,0 +1,26 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +64363833346333666661396162336461613535303530373664663962303838373161616566363163 +6464393533623034393530626163653433623931333461360a613637306661396636313234316666 +34346665363732623163663335386466356463313763333364326634303439306462643736623665 +6639623435306563320a383936623837363961316630643631303765336533303536323064343233 +63663037653364633631623761633331663765623931613465396162626538626335623338613938 +35643262653531613164373931313732343266313038316663666338313437613236636530626362 +32363431336233356532383030303166623363626234396137333430336365393865333237313439 +30623666663666623939666532336338326230306332633162363866326330616333323339613537 +36306663393931396636393730333862653930323832383863316562313531326333303637313932 +32376264316663666139353832666530306532663564313237366239663765643230306335646131 +64376632363131626636356633653734633965383039363830333733363762343262303738623239 +62643064333665643832653434386336373539323466363936653732636131653562346465333835 +34306436303661343932323566376431323266323532393237303532323239643663616538346531 +63346233636261373535666136323762636139356433326233396430383534346533623535353264 +36376266616361646630366339383065326666366166383932663237653935323362623161373532 +64616632663964613131663134316566303265356137356364373534376538303934643539653233 +35313536633036626639623731663465623131343635303762616166313237663434643966343931 +31393336613432376563663432663362353937393363383361376433323839363331653439623264 +36663836663065376535373438363164343565626639363361636566346538653836323765343433 +65656362333837303865643164356130666435333635663939323135336535333937653836653261 +62626632666132626462343032363264373863373235333266393232646133653130353139626339 +37386236653362633530393561613266626664643035373832643832386136323162333364663539 +30656533326239333364316536303033303733616233653237646463393538326161323334366439 +65363831326433316337316663356331633636636163323565383134656333613065653433383931 +3766 diff --git a/elevate/host_vars/ele-lt.yml b/elevate/host_vars/ele-lt.yml new file mode 100644 index 00000000..27a5fc5b --- /dev/null +++ b/elevate/host_vars/ele-lt.yml @@ -0,0 +1,20 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +31643430396134323836663063656635366534373236646335346630663263633836643965383362 +3463633864656231323731376462613165326461376137310a336361306137376431613265323931 +30626466643962376632636263653735623663616335643963333763323966393163323337383365 +3435323338666530310a346265336535306630376439396239386364656366313562333033616634 +38633461373061393163653534323533306138633361633237396136626265633731313363363330 +30343636376536633836353135343235333133383161643862326535396262353661616237633537 +31373163623234613333396336306366396637376536643161353361313731386530646335613134 +64633539393736383835333166396334313534333539346330313237343464373238326334336130 +35396262626435363838316161376635616564396337633035336539323164356263303738343533 +61633834333462393464306361663761393430363762373836303332343535643965373537646265 +66323464396537613366326138316631663465643233666237623236633335366166633437636639 +64323761333964653137343138376430396564656139363232303132656565633938383734396134 +30393964636232646230653562383131663030643165393636353363393564396264653138663962 +35303932376261303337323337356539316636653763616166303266373638356462363362306232 +33396333656535626430656661396264663566303733353164623035393239343361613130643038 +31373331613762613936323565646565333662393634333934316539376332323565613036373633 +65336463386466316634613930353063343966633136623366316338613464636565373533396361 +39363833633863373963626330643838633365356461343264376264613863353233663931353437 +373432626563346432613832616333373261 diff --git a/elevate/host_vars/ele-media.yml b/elevate/host_vars/ele-media.yml new file mode 100644 index 00000000..821a9ad6 --- /dev/null +++ b/elevate/host_vars/ele-media.yml @@ -0,0 +1,18 @@ +$ANSIBLE_VAULT;1.2;AES256;elevate +61643762383461616132626431383463636633303539333866626462346434386331646136326532 +3938646637323162306333643232333537626135663665360a633866646633333161376165356431 +62613533363633623936343338643335323662366235356236386438326638393032623665313466 +3839356630356130650a363838613662323839643734306631646262356538323163643934383161 +31643665376362376461373732376435333566373938626334393937353736383038363837333831 +61313961346163613366633636616632666434633135323934333933613663353939333537383537 +63656165363138333336666461616331363566333965636634373132616261636564623131373862 +66363738663638383335346636313335343635656564316330336666333562656434653664323536 +66643438623163636132343035333531346639633632343061666566356234353036663764386532 +34343666636666643462363333323331663866376335336431613735643930393736336562336362 +39373538346266373862383065653235306563663264646439363730393730643038363135643634 +34646638613035636562303539633666336236373735353238363163363533376134373035366462 +38356538653639393331623064656533316161303661373261376338386537333266363833393132 +32653437366438626330333765613232386235656139353431303733376336373565306634313033 +37393239363961663230666665633538343465666131303231326230623538306534333137376539 +31653764653132363430626333616337316539303137353662323163326465663331303930626461 +6566 diff --git a/dan/image-generate.yml b/elevate/image-generate.yml index 1b11f1eb..1b11f1eb 100644 --- a/dan/image-generate.yml +++ b/elevate/image-generate.yml diff --git a/dan/info-beamer.yml b/elevate/info-beamer.yml index 6160e9f2..6160e9f2 100644 --- a/dan/info-beamer.yml +++ b/elevate/info-beamer.yml diff --git a/dan/iso-generate.yml b/elevate/iso-generate.yml index 584b8914..584b8914 100644 --- a/dan/iso-generate.yml +++ b/elevate/iso-generate.yml diff --git a/dan/iso-install.yml b/elevate/iso-install.yml index 5defe6d3..5defe6d3 100644 --- a/dan/iso-install.yml +++ b/elevate/iso-install.yml diff --git a/dan/k8s-emc.yml b/elevate/k8s-emc.yml index 206c0211..206c0211 100644 --- a/dan/k8s-emc.yml +++ b/elevate/k8s-emc.yml diff --git a/dan/openwrt-deploy.yml b/elevate/openwrt-deploy.yml index e7cc49fa..e7cc49fa 100644 --- a/dan/openwrt-deploy.yml +++ b/elevate/openwrt-deploy.yml diff --git a/dan/usb-generate.yml b/elevate/usb-generate.yml index 7f633f1e..7f633f1e 100644 --- a/dan/usb-generate.yml +++ b/elevate/usb-generate.yml diff --git a/dan/usb-install.yml b/elevate/usb-install.yml index 0f62bc85..0f62bc85 100644 --- a/dan/usb-install.yml +++ b/elevate/usb-install.yml diff --git a/dan/vm-deploy.yml b/elevate/vm-deploy.yml index 8530b14a..8530b14a 100644 --- a/dan/vm-deploy.yml +++ b/elevate/vm-deploy.yml diff --git a/dan/vm-install.yml b/elevate/vm-install.yml index da6a29a5..da6a29a5 100644 --- a/dan/vm-install.yml +++ b/elevate/vm-install.yml diff --git a/files/chaos-at-home/bind-zones/db.elev8.at b/files/chaos-at-home/bind-zones/db.elev8.at index e5a5c2a4..fb8ac94a 100644 --- a/files/chaos-at-home/bind-zones/db.elev8.at +++ b/files/chaos-at-home/bind-zones/db.elev8.at @@ -1,7 +1,7 @@ $TTL 1h @ SOA ns0.chaos-at-home.org. hostmaster ( - 2024061802 + 2024082500 1h 5m 28d @@ -13,10 +13,11 @@ $TTL 1h MX 10 mx0.chaos-at-home.org. MX 10 mx1.chaos-at-home.org. -wolke CNAME cloudio.skillz.biz. -office CNAME cloudio.skillz.biz. +;wolke CNAME cloudio.skillz.biz. +;office CNAME cloudio.skillz.biz. +wolke A 94.130.242.24 +office A 94.130.242.24 -bs CNAME cloudio.skillz.biz. wikijs CNAME cloudio.skillz.biz. ;stun A 162.55.59.151 diff --git a/files/dan/elevate/elevatge_logo_white_sm.png b/files/elevate/elevatge_logo_white_sm.png Binary files differindex e6457c08..e6457c08 100644 --- a/files/dan/elevate/elevatge_logo_white_sm.png +++ b/files/elevate/elevatge_logo_white_sm.png diff --git a/files/dan/elevate/elevatge_turm_white_sm.png b/files/elevate/elevatge_turm_white_sm.png Binary files differindex c3238ee0..c3238ee0 100644 --- a/files/dan/elevate/elevatge_turm_white_sm.png +++ b/files/elevate/elevatge_turm_white_sm.png diff --git a/files/dan/elevate/info-beamer/branding.ppm b/files/elevate/info-beamer/branding.ppm Binary files differindex 66b4996d..66b4996d 100644 --- a/files/dan/elevate/info-beamer/branding.ppm +++ b/files/elevate/info-beamer/branding.ppm diff --git a/files/dan/elevate/info-beamer/e19-branding.jpg b/files/elevate/info-beamer/e19-branding.jpg Binary files differindex 925b5d08..925b5d08 100644 --- a/files/dan/elevate/info-beamer/e19-branding.jpg +++ b/files/elevate/info-beamer/e19-branding.jpg diff --git a/files/dan/elevate/info-beamer/e20-branding.jpg b/files/elevate/info-beamer/e20-branding.jpg Binary files differindex 54c52f0d..54c52f0d 100644 --- a/files/dan/elevate/info-beamer/e20-branding.jpg +++ b/files/elevate/info-beamer/e20-branding.jpg diff --git a/files/dan/elevate/info-beamer/e21-branding.jpg b/files/elevate/info-beamer/e21-branding.jpg Binary files differindex 1a5111f0..1a5111f0 100644 --- a/files/dan/elevate/info-beamer/e21-branding.jpg +++ b/files/elevate/info-beamer/e21-branding.jpg diff --git a/files/dan/elevate/info-beamer/e22-branding.jpg b/files/elevate/info-beamer/e22-branding.jpg Binary files differindex 8db39ddd..8db39ddd 100644 --- a/files/dan/elevate/info-beamer/e22-branding.jpg +++ b/files/elevate/info-beamer/e22-branding.jpg diff --git a/files/dan/elevate/info-beamer/e23-branding.jpg b/files/elevate/info-beamer/e23-branding.jpg Binary files differindex cb1668f7..cb1668f7 100644 --- a/files/dan/elevate/info-beamer/e23-branding.jpg +++ b/files/elevate/info-beamer/e23-branding.jpg diff --git a/files/dan/elevate/info-beamer/e24-branding.jpg b/files/elevate/info-beamer/e24-branding.jpg Binary files differindex 08e828f7..08e828f7 100644 --- a/files/dan/elevate/info-beamer/e24-branding.jpg +++ b/files/elevate/info-beamer/e24-branding.jpg diff --git a/filter_plugins/ini.py b/filter_plugins/ini.py index f4f596bc..89f553cf 100644 --- a/filter_plugins/ini.py +++ b/filter_plugins/ini.py @@ -24,7 +24,7 @@ def from_ini(o): raise AnsibleFilterError('from_ini requires a string, got %s' % type(o)) parser = configparser.RawConfigParser() parser.optionxform = partial(to_text, errors='surrogate_or_strict') - parser.readfp(StringIO(o)) + parser.read_file(StringIO(o)) d = dict(parser._sections) for k in d: d[k] = dict(d[k]) diff --git a/gpg/get-vault-pass-dan b/gpg/get-vault-pass-elevate index 37f60413..37f60413 100755 --- a/gpg/get-vault-pass-dan +++ b/gpg/get-vault-pass-elevate diff --git a/gpg/get-vault-pass-skillz b/gpg/get-vault-pass-skillz new file mode 100755 index 00000000..37f60413 --- /dev/null +++ b/gpg/get-vault-pass-skillz @@ -0,0 +1,2 @@ +#!/bin/bash +exec "${BASH_SOURCE%/*}/get-vault-pass.sh" "${BASH_SOURCE##*/get-vault-pass-}" diff --git a/gpg/vault-keyring-elevate.gpg b/gpg/vault-keyring-elevate.gpg Binary files differnew file mode 100644 index 00000000..a989bfdc --- /dev/null +++ b/gpg/vault-keyring-elevate.gpg diff --git a/gpg/vault-keyring-dan.gpg b/gpg/vault-keyring-skillz.gpg Binary files differindex 5514efc9..5514efc9 100644 --- a/gpg/vault-keyring-dan.gpg +++ b/gpg/vault-keyring-skillz.gpg diff --git a/gpg/vault-pass-dan.gpg b/gpg/vault-pass-dan.gpg deleted file mode 100644 index 862ef834..00000000 --- a/gpg/vault-pass-dan.gpg +++ /dev/null @@ -1,30 +0,0 @@ ------BEGIN PGP MESSAGE----- - -hQIMAwn6BEwlAdD6AQ//YV/o/+FbGxfjgK4IU8MGEzO9qRrvi5rS179ThBihQAoz -dDueIBrpwJ0AgcxO4ktPZk86hrpet6QlpRYQcQfXV/3hN9Z5+DORIxmpyWWqTZPC -0zD4MO7a0sgTYqSiBMyx/lsnNEzr47MRIt4oloaKrgvmct1dD/csjDCjE+CQt48+ -D7zu/QsYd6yyqr4zPLQ5y2N0SjsQLI/O+pns4ugiwOEAtzpAOgYoHah15B+VAjP4 -MVhjkeOYHSzfOSfaDxhlnFJwb/uZ9bI7BKFnvCnz9wnbq6iOCElwhaP3zgc80JtU -sa5C76ivAZnhczDEElfirlYVVAL1pCH5LR6Vpo5UtwubVX2LGhU1UfpWF+ChS6/d -H9yn8sKL5DV/2tS6Sry8deIHqEtL6vvLiyjDPXOpG1/473moadpC/YjWSnhmLh0G -uc/vGWbMgaaYf8aKiv6QNYmHwwhKT0GoiDRFX2h1VjnuHzxKfA1xnn1f00uZBYcK -/WG6nJuAZg4KaGIyiy0l6hP8z4ZSIGKZC6UdKPCRFqoSa1BH+wOqRji2uRy1KTJ1 -cglidBwhvdGOCFxbcjzJlhOAZlYf4b3hF9mmok5SyCrCn9MkvrSOIpOCCvOPkh/t -enSmwA5EAnnqwtJl3scsanG4JciF3V1hU+f+T+ftf4Hoo1YUf44SdmWPiM+ssEiF -AgwDPWJqFfpI23UBD/9pArJnxGl4l7pg6d+FfdIRnaw61rxuS1OZBIZdNY7rHXIe -SQpzVUHMa1JvVlXlDeuTLhuFRKCjnib7ZB/M/wUOwqa+yvKLh5EjUiXXmj5E228o -wb195WULqsbwURW85n5I2HBDRuMge91nQNSq1rt51bpBz5QoFKqBwIdoWQwA9Hzz -SywWa2jL1a6J7X/jMx979+eRNk/7wxwuNTu/orz6i2V+uxuJJy6K5vo+xxb0xIoH -YE3oKhcqhS2GM8dOJ55XO/lFau1dgkz/2W/o03aJViAokj8A6bUo5EzEzGCIhwTR -YdBenvgW9yDcHEcwRj4cBhQ9yEgHcuhD1WUERm5EKbVy3A24n9PzdF32VZWOntVQ -JIDAor5+7pbCLJmKsImPSdv5FbOcjRrP9+lyJeaJ21Jd3nVK2idV4CS/j7qU9b69 -r0ZZPspyffj6GzONKRvt0Dd1LQleBrPqMlnOwUo4o1aMobceVWlL3n1puvDENgZi -LRd7vr7zSHfcBHcnygE7bhfkEewD4V3OJA2gcz+drALpZW2fySTtPbf4PFoD0FL9 -IGQ2qQWTb9FG2C+RK22yB++mp/AjO8AQ8ZmMZ8WFr0i3kUFfOcQJJLaTXEg4YkDp -QqRcC2/9LOFY6VHcr/ZgYJfVRCdHrSKp2IZ9vf2j145fAtgNyWKbqyROdTNO5tK5 -AZYhXZUn+GqkAn0BWr8b8N5N2XChqXqVl+kBh4XIh0n8gRrLnqtdlmeUeiPnev2R -7Pf1RN2U707M+fDNCRM96NaX+NjmIe0U0ZdILFRZBjmkUahU8+58AlmLHNwKMLox -Z9PDfDafqPBpBnTpkfoWMd6NAWWx6/EomTXISsMMSknSKBYYI512fc3eedtBc405 -rQDrtS7CyzDbsARqP8VPkDqi4YG9nHiPnL2Zls5A89YuPtS/P8x1eaE= -=Sf0S ------END PGP MESSAGE----- diff --git a/gpg/vault-pass-elevate.gpg b/gpg/vault-pass-elevate.gpg new file mode 100644 index 00000000..084bc01b --- /dev/null +++ b/gpg/vault-pass-elevate.gpg @@ -0,0 +1,19 @@ +-----BEGIN PGP MESSAGE----- + +hQIMAwn6BEwlAdD6ARAApUZioRNq3mR3GRd9SMxcfW1juCh1gE/k3PNiL550H1Mk +nODPKvdtcBn1atwVtwxnj/W1abB6vqq0fdEHmArto9PdrBnIDSSemUIIQqOtPx1T +h4HeASbwAkv6vDm0OMsCioj8hD3IL7AgihB7eRUlnbnTSEpXIXzyJQi5dSev9YUR +A+LF4696AfRoe6emh4XS25KKgfbfPKkYzm+e9o0ExIihT0SCemFA2hjlarpCQz7B +YZBKrlgyqqVu/zDWJ0owdkF+o0++Ec4qwLKQKeEjGtLIEAO6Ir51tEuQZy/Xf+cd +N0sO00ChILYNrr2AKU6MmRdIUv0zAsR89lZ2bpj3bEDqMdLKxk6GwPD1JCO9fWWk +qT76k7VzyV47p+EuOvbXmmow3oI208/uWiR3cKB30B3BAM1C++td6ydyksj2WUOA +UL7FffZo6UQNe88xqojWb+b+PG3jyqquE2aUYe7zby0T1cECmSjiK/7cpJ/XzqsS +0JyvOxFqF5XGvO6ws8a4xqYykw2mSvKhVWM6dCnUPDhedP4KHCX8aQXHsmBshdhc +QEg6mS/BEKL9fC273GR6JjRF/19A+Hp3D/yunYgbUReCDMvzK6Ex1YV6sw4/sltc +dZLRqs65A7OYrgaJ4qvSD1H2jTrQoINi/LgeLbf30x3LSbIY2uyEoH+SY3XPQM3S +vAGrnpvzwajuk5xrcnxSwHBqG2+mg/jNwp0uiHiACjsE2BNiD1R3v3LgXvwZGaLN +JV19miWUAyiS6BO7t4zrq+3S8l09JovlFuOKmo8Nx5kSmRNFt9vkw0oXyrq8yCQu +JNnx0Adueawlc5otzR/BhbINV7jfA0KaMfSU3um8s7XlomamS6tVCiQ2e4alP1/s +9KAc0vvoXlczgGxoWM7W0aLYiNCfgCEY3Tq5dahhzs2M8dKwYSOLP7gQU5mO +=8wCG +-----END PGP MESSAGE----- diff --git a/gpg/vault-pass-skillz.gpg b/gpg/vault-pass-skillz.gpg new file mode 100644 index 00000000..1a549cec --- /dev/null +++ b/gpg/vault-pass-skillz.gpg @@ -0,0 +1,30 @@ +-----BEGIN PGP MESSAGE----- + +hQIMAwn6BEwlAdD6AQ//ZUMP+IUfYNbmt+NOoxgAoTVAyIiy9I1IvQUd2H3XZzU7 +VzoiapgITsimwQPg0CNAx6AiVaJfJ4GK052/jzbnHo158ZF7qSPBeCztCCAv1v66 +XgXnQwORc4ShFgANraVLRElXpw+ukyobf8IS22Kf+/aQi132drqcI0khj8rU97ey +YIasTbGsURlGRSZxpkjhMUaolCg/SEklRY6IqytwcZovof6diP9s8/B8EMc8IRkB +yPRNz1pm0pRFc0mXwRLxbJyplBCRk17zV68sgi+cz4U8bpFU4zvxUvBiosYfnwt1 +etH+ioZxzGb8/GEJ6e2mUZUtCuHMw+EYrosjj2dLsD3pMi6JK0KeCA8h05SvYDmD +HZohCoQm4+o6s1npHAin2utvuFUb9GLM7lZCQ841jEn4iRm9+F7j40rxifV9ufTA +PlujnvBA6FH4XOs4E9behpnG9NXIA6qQeDhXOaf8riShh6qSz5OTxz1MNkrsU+tC +7mFUrLgNRSQ4bzn3xYN8SSxGxGqLr1V/wbCf7PQlAZrJlrap30Rn1WO2lJDnZLBz +sDUuLDM6TH5kysddMUtgCN1OBxtEaEL23U50/c/8gQ1BdJCgeKlKM3kyiMpMOItM +Gs/hk3N1KraliZBjHBgvr1W4e/AphuxSQr0eu9nbxLyNYCuDIMhLRZxXq/thgZ6F +AgwDPWJqFfpI23UBD/99dOOp3SqOQG+sWxty/PdNo5zQQP7O8//MK8PvovMNB5J/ +aGZOY6ymPA3+tWc8jUAOaqUFDUBt3L2rf1Q+KJ0yQl/TexFDvVOO0M9Lg6LIBtL6 +bSS/OpUIPiYnS2QcUAkzoTEuzq+H03qbhfG3Qgj8he4dxZZQNqGq1zW2u0cocFqY +FB5LyA9qJnVe2Vw2+AqiFwMa7vv6A12KxLbTZLSxYm6++xJ5aRkbTlShfosi47bK +Zo14nxHsHxfD1MDe4CwMgP1chHUBRBeGV+jIbWnhMQecvdJSlbKNtLApLVVd6kwb +JomkahomdHqyHSitj5ZMKDsEvNE9x4SFhAMjTdXiiKkd/7nFaRbQiRaMA8tJAtpR +x/PO3ohFd3lauxa52KoJl3cGJMT4bxaePk4WBkd2S1McwP00bukbd5+rsCGaKm2z +xmJSmSaSgXzKU5BnO6n03igLYqW89ZRX6zcV+aFRtJWippig4DIGk6ea61yr/i/6 +Ws9kA7UDBr+PDtiBY35fbTqjyeUqoxc+6Mfi/djFfdXHiFhngX/an/sOlmNZazV0 +OyYK92sbzaRYf/RK4zHoQ8pqf/J7PgUzLfzUAO6d/S2DBwfk+Eb0+9rct1UQJCAV +qQY3heH77OCMtV+4HPche8UanisLGFAzL+fwGma5CVdSg/krXD50vOhCcTPP0NK8 +AZbm6Nmq55tXGtPYoHpik9HkppoAaM1jQlMh0EVHyAxDaIBzgGVzEjKC3AMwCzGL +w1ZImYOGZDVdwWSxaZQi+U+zL4qL6EBXWG37JG9utNI6hFe5ULB9Vtus6P5ASDvm +kutQclhglcFEeUvSTU2b1f+oSyV/BRVHKtK++X2UHQfAAPNYcOrkjGg25RbsW3IE +/fdC1OZgItA0xOlkoGIfsoPQizlwRkt99T80Sk7udGrBH0PnikoxGC1hoWo= +=ck4/ +-----END PGP MESSAGE----- diff --git a/inventory/group_vars/accesspoints/vars.yml b/inventory/group_vars/accesspoints/vars.yml index 5545dae7..653c2262 100644 --- a/inventory/group_vars/accesspoints/vars.yml +++ b/inventory/group_vars/accesspoints/vars.yml @@ -148,7 +148,6 @@ openwrt_packages_add: - less - nano - tcpdump-mini - - horst - prometheus-node-exporter-lua - prometheus-node-exporter-lua-netstat - prometheus-node-exporter-lua-openwrt diff --git a/inventory/group_vars/all/users.yml b/inventory/group_vars/all/users.yml index 3fb26b34..0dce7e82 100644 --- a/inventory/group_vars/all/users.yml +++ b/inventory/group_vars/all/users.yml @@ -49,9 +49,6 @@ ssh_key_map: chaos-at-home: - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDL8afqxWieebpxezBuLj2CIx/iAuTY9ziJt8JCJE0qYh+B2wXe9e+sPaKwz5yyS0X0MoEPHbYuVytxGQfGhdVR57gWWTYq5MBBFEqmu5MexAFKlNxad4TNQQwhs7rnI+lptKJO+rqeG/vaQBgao+61ZVwRR5Zr1zsXEoo5m4VB8VPo3TW0nSb97LdMyUmb1TaqDKJ5hrtrV6YcokXzE8FwHMK15oJsuJC7YUReijol3hGsRVw1H5S1zu4uDz7G32dPVxoLOPgupnf0SxnXdNVfNU50MHHSK68HzBXz4/rE1YLacRPloOhO7xegkWd5KGa09opEbUGzGu/lSXgHuAJpPgloy14cehDhLJ7F7SbXK4QBBtVgV+1CYXG2eJsRHIdkWiTWLuG+QZ4oEFLjQBjWpUYsEiDt9FEtSVCtKH2vBk26ps5yIoSCtYq6POvg9miGgcpQA6HHwh5ekVUaKRGWuMdAIvjvQSlCsFjYkxD1NpCgU1RhyWWTI3xTSKzTxcXiCWWZoBDJVoW46EpSvySsOpxL/hLxJwMR8ouc6cPRZZl3m51824Rv3LdEXNBmn3vnojzIvrOed3sxpD0+7+tbA4J1uTbAxtkOMhK94WXKiUAOD7e5bJYdzajvDD2T9tkj/Mqdo8z3iR2/yjkGMEAeWWVOQEh7QhQS7OFEAKK4fw== equinox@chaos-at-home.org - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBO6D6zd2fJiBiacdHFPQ99XadnS8GPjicYxL5+8Zjjb equinox@chaos-at-home.org - dan: - - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwjCMiwyz7f0b1b6S5RjGbYXjd+hkTVsNzZ9xIkqqvdF8zCU6qZTqkhem13m6E1aPjALl0iyrmpb8N2pmASD7axUaTMTDd2tktkB3LULBbQCCApMnw5viZc9fm9dLBdbdiYyRtNrpk/b39V+9uViAbRtATBrYS5vV/14gT42WxPhpFiCz6A5JsKpmbBafS9vfexnqLTvKBtYLt+zhuS9eFovMHM5k7Qq4mRdKe+wdMBDeRls2z2G/ZjPrfHAkw2WctFUdSY+YAVzLB0SddVWnbOSZ19tsnzskyHpDD49LWb7wYl0OJ9fhxO02lnxW5Vdpwwwx8I7FVH83fDTQpzfSdr8tMY3F9rvCmi4noiTGDE2AAWqh73unKuydvBomNYX8HbuiJO9eTgwUIRAqsl8vHNU5rA10YF5r2SUqofrBNfINUH8x0NhpLGzNPIlazndaPY1no+XeQRQtgSU1bdDQzmySyyn5g9mlMSTU+jHfzyoK7yqlKE0W/R2ZTOEwr6+uRdFqn+mWmB0Mr20YavjVretseVs1AkmqaVClEO1juwb/CWI//Nd4uboD9zdZwkHmCjLlOmC+GkGrnLValaqQDh8iR8aKiVbaQVffl3ph1pD3BCn79KJy56YySLTbaI4lFDUHherkTdvgyMVmZJZMROzwuX7i4bi04TZ/GKTfDrw== equinox@elevate.at - - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICU107TyOHAQjWTq6A05IiazdoOvzmrSOOgvjRiih/z+ equinox@elevate.at spreadspace: - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCtmysXjBidEwJek6hBgaENiyVOwroFi19xRZZw+cYYqi6asDfF6B/h6gYNkJGWo0rD5ZaLdau1O210O5Xu+TfK1e2bZbxuFIj2fguUkat9wN6IQIO2m2Wcf4k/eiTmtAE3dp0l5ThMqfxxE8dj76mOOrUHCfJUIVoATGs4X5TLcGcXroAcZ+DFFoDzjxjFYNmIuUNtXDwXTpPc63SAYmRvW0ZYZlvH1qZ6irLh+GtE1dZ1Q5lQZvp6xUYcjInbpcd5Ko3KbG/In7sNmUCI7iaTwC4DPDTcHFj99Ll1jruAbdaQqe+ClZv55dbQ+92RDF6fsuQBD8FeRz7nYChvCqNPT1KOvcVsDtbW0iJ1PZ05QdE27w23wJj9OE0JWM09P3AH3ttswHaJ+P4s7mSxxK2m6YZcqop3czLlWWoGna0ynd5eV6l/rtvAQUvBOXjKQ5fPQY5d9cF0Z87NBE54HM9a/IKZ2toU2MuYNUpI/DUoAA9ILS4bJm3AUz8wbaC5EiuIhbM6I/u0NANamaQKRrolGNP4ETaQvhABs+S3/NSSBy4DMjtwax2BxyenF6i89vyHPNY+LZzBOn842yUlEGn6Z11MxiE5fhIfMPUclSYi5bQJDf1fvAyAo59/AX8sPqRK+/OCLIgLwdtW6D4OZGXjqrBJe2j/5uZSJEsl6ROyKw== equinox@spreadspace.org - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIPFw9I25dUMCMM66lIvt6VeBMhAX7tl4qvb7HxXQd8z equinox@spreadspace.org @@ -64,3 +61,8 @@ ssh_key_map: realraum: - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDj7AcnQZCRihToOI7/L5YslP4bkZlZwR2dg6hV8EfQ+37z1p0imhoqc2Oz/zIEgOVARBHkn5XmfR9Bu6e3YfKpXpJXC9O3jpRSw34Xac/8qXzWZsqVAXbtzvBlYA/G4j0NQM9XIVBa1ZzBZu87xeE4KUWzO80fnQ+G3GSBp28BM4TUiSOmX9y58chPZfUp2DE80fInoXv11ikLLCBDXfMkzFCZ4Gcexhr0TYcBUgLV7ufL0xqLg4yE+Z21PLtttvVYgZIers2nWetLPoREi5yDGKeCjJVyT00X2rp6h3eFkc/VaHfb5c2MY9/4BOt+cbFCx73sG0C1SnSzWd624K/8CEoJTsX4MazLLrxwi3hIwiYX1mCCfq4+S4PpSFvMUGdMWB52PkBRXulQislCVBA/lzma93xJr1jWVFSikjkvAUt8Zt33vHMRd7RMYDfsDVIEKpUT49cBj0v7zs6IVE858J33sUZoVXaiA2sjsap8RguNtjJMSYx8+nwkQAjxwlTiV2J6pHGQHJDyeVsqGlnMpEk32ZeSs/BQ7XWPG62FT3SN6E4C/fa8dawvs7RgY0cbZkhucECBu9Zto/KakIhzLtFzgDighPmK5SlAPoNEJLJYPo5ry2SBTysc4uV7xYZSQ6OVofeQeFXKL8oPe/ZAvKafn3Zk0mQcCtH0Z8q8iQ== equinox@realraum.at - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF70nrRNdkB/PnoKp+2nmjRavHIexOsS4IrC7Ah0bnwJ equinox@r3.at + elevate: + - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCwjCMiwyz7f0b1b6S5RjGbYXjd+hkTVsNzZ9xIkqqvdF8zCU6qZTqkhem13m6E1aPjALl0iyrmpb8N2pmASD7axUaTMTDd2tktkB3LULBbQCCApMnw5viZc9fm9dLBdbdiYyRtNrpk/b39V+9uViAbRtATBrYS5vV/14gT42WxPhpFiCz6A5JsKpmbBafS9vfexnqLTvKBtYLt+zhuS9eFovMHM5k7Qq4mRdKe+wdMBDeRls2z2G/ZjPrfHAkw2WctFUdSY+YAVzLB0SddVWnbOSZ19tsnzskyHpDD49LWb7wYl0OJ9fhxO02lnxW5Vdpwwwx8I7FVH83fDTQpzfSdr8tMY3F9rvCmi4noiTGDE2AAWqh73unKuydvBomNYX8HbuiJO9eTgwUIRAqsl8vHNU5rA10YF5r2SUqofrBNfINUH8x0NhpLGzNPIlazndaPY1no+XeQRQtgSU1bdDQzmySyyn5g9mlMSTU+jHfzyoK7yqlKE0W/R2ZTOEwr6+uRdFqn+mWmB0Mr20YavjVretseVs1AkmqaVClEO1juwb/CWI//Nd4uboD9zdZwkHmCjLlOmC+GkGrnLValaqQDh8iR8aKiVbaQVffl3ph1pD3BCn79KJy56YySLTbaI4lFDUHherkTdvgyMVmZJZMROzwuX7i4bi04TZ/GKTfDrw== equinox@elevate.at + - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICU107TyOHAQjWTq6A05IiazdoOvzmrSOOgvjRiih/z+ equinox@elevate.at + skillz: + - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEjFaRBmI3JY12earMMxw7t8t4J4fGya8tb1AXUc/wm equinox@skillz.biz diff --git a/inventory/group_vars/ele-infobeamer/vars.yml b/inventory/group_vars/ele-infobeamer/vars.yml index 9aabdfd8..d2407fce 100644 --- a/inventory/group_vars/ele-infobeamer/vars.yml +++ b/inventory/group_vars/ele-infobeamer/vars.yml @@ -10,7 +10,7 @@ info_beamer_wireless: info_beamer_prefer_wired: true -info_beamer_branding_logo: "{{ global_files_dir }}/dan/elevate/info-beamer/branding.ppm" -info_beamer_branding_background: "{{ global_files_dir }}/dan/elevate/info-beamer/e24-branding.jpg" +info_beamer_branding_logo: "{{ global_files_dir }}/elevate/info-beamer/branding.ppm" +info_beamer_branding_background: "{{ global_files_dir }}/elevate/info-beamer/e24-branding.jpg" info_beamer_device_connect_key: "{{ vault_info_beamer_device_connect_key }}" diff --git a/inventory/group_vars/promzone-chaos-at-home/vars.yml b/inventory/group_vars/promzone-chaos-at-home/vars.yml index e59b972a..752bada7 100644 --- a/inventory/group_vars/promzone-chaos-at-home/vars.yml +++ b/inventory/group_vars/promzone-chaos-at-home/vars.yml @@ -5,7 +5,7 @@ prometheus_exporters_extra: [] prometheus_exporters_default: - node -prometheus_exporter_node_version: 1.8.1 +prometheus_exporter_node_version: 1.8.2 prometheus_exporter_ipmi_version: 1.8.0 prometheus_exporter_ssl_version: 2.4.3 prometheus_exporter_blackbox_version: 0.25.0 @@ -14,9 +14,9 @@ prometheus_exporter_smokeping_version: 0.8.1 prometheus_exporter_bind_version: 0.7.0 prometheus_exporter_chrony_version: 0.10.1 prometheus_exporter_chrony_disable_dns_lookups: yes -prometheus_exporter_mosquitto_version: 0.7.2 +prometheus_exporter_mosquitto_version: 0.7.3 -prometheus_server_version: 2.53.0 +prometheus_server_version: 2.54.1 prometheus_alertmanager_version: 0.27.0 prometheus_server: ch-mon @@ -36,6 +36,7 @@ prometheus_server_jobs: - standalone-kubelet - whawty-nginx-sso - mosquitto + - coredns prometheus_zone_name: chaos@home diff --git a/inventory/group_vars/promzone-elevate-festival/vars.yml b/inventory/group_vars/promzone-elevate-festival/vars.yml index 8e1bf156..398f1511 100644 --- a/inventory/group_vars/promzone-elevate-festival/vars.yml +++ b/inventory/group_vars/promzone-elevate-festival/vars.yml @@ -5,7 +5,7 @@ prometheus_exporters_extra: [] prometheus_exporters_default: - node -prometheus_exporter_node_version: 1.8.1 +prometheus_exporter_node_version: 1.8.2 prometheus_exporter_ipmi_version: 1.8.0 prometheus_exporter_ssl_version: 2.4.3 prometheus_exporter_blackbox_version: 0.25.0 @@ -13,7 +13,7 @@ prometheus_exporter_nut_version: 3.1.1 prometheus_exporter_chrony_version: 0.10.1 prometheus_exporter_chrony_disable_dns_lookups: yes -prometheus_server_version: 2.53.0 +prometheus_server_version: 2.54.1 prometheus_alertmanager_version: 0.27.0 prometheus_server: ele-calypso diff --git a/inventory/group_vars/vmhost-sk-2024/vars.yml b/inventory/group_vars/vmhost-sk-2024/vars.yml new file mode 100644 index 00000000..295e1535 --- /dev/null +++ b/inventory/group_vars/vmhost-sk-2024/vars.yml @@ -0,0 +1,27 @@ +--- +vm_host: + name: sk-2024 + network: + dns: + - 185.12.64.1 + - 185.12.64.2 + bridges: + public: + prefix: 192.168.242.0/24 + offsets: + sk-cloudio: 24 + # sk-??: 31 + sk-2024: 254 + nat: yes + overlays: + default: + prefix: 94.130.242.0/24 + offsets: + sk-cloudio: 24 + # sk-??: 31 + zfs: + default: + pool: storage + name: vm + properties: + compression: lz4 diff --git a/inventory/host_vars/ch-apps/vars.yml b/inventory/host_vars/ch-apps/vars.yml index a3f34992..57a7e485 100644 --- a/inventory/host_vars/ch-apps/vars.yml +++ b/inventory/host_vars/ch-apps/vars.yml @@ -141,7 +141,7 @@ kubelet_storage: quota: 10G 'syncoid:sync': 'false' -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 42 kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/ch-chromebook.yml b/inventory/host_vars/ch-chromebook.yml index bf93cba1..55bde4b6 100644 --- a/inventory/host_vars/ch-chromebook.yml +++ b/inventory/host_vars/ch-chromebook.yml @@ -1,4 +1,7 @@ --- +## enable this for installation if @ N28 +#apt_repo_provider: chaos-at-home-cache + ubuntu_autoinstall_locale: de_AT ubuntu_autoinstall_keyboard_layout: de ubuntu_autoinstall_keyboard_variant: nodeadkeys diff --git a/inventory/host_vars/ch-companion-raspi.yml b/inventory/host_vars/ch-companion-raspi.yml index d8134f27..d82f5b8e 100644 --- a/inventory/host_vars/ch-companion-raspi.yml +++ b/inventory/host_vars/ch-companion-raspi.yml @@ -29,7 +29,7 @@ docker_pkg_provider: docker-com docker_plugins: - buildx -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 42 kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/ch-dione.yml b/inventory/host_vars/ch-dione.yml index 8534d2fb..1782ceea 100644 --- a/inventory/host_vars/ch-dione.yml +++ b/inventory/host_vars/ch-dione.yml @@ -49,7 +49,7 @@ kubelet_storage: size: 5G fs: ext4 -# kubernetes_version: 1.30.3 +# kubernetes_version: 1.30.4 # kubernetes_container_runtime: docker # kubernetes_standalone_max_pods: 42 # kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/ch-equinox-t450s.yml b/inventory/host_vars/ch-equinox-t450s.yml index 1d0864bd..869bcac8 100644 --- a/inventory/host_vars/ch-equinox-t450s.yml +++ b/inventory/host_vars/ch-equinox-t450s.yml @@ -1,4 +1,10 @@ --- +## enable this for installation if @ N28 +#apt_repo_provider: chaos-at-home-cache +#kubernetes_apt_repo_baseurl: http://apt.chaos-at-home.org/kubernetes +#spreadspace_apt_repo_baseurl: http://apt.chaos-at-home.org/spreadspace + + ubuntu_autoinstall_locale: de_AT ubuntu_autoinstall_keyboard_layout: de ubuntu_autoinstall_keyboard_variant: nodeadkeys @@ -25,7 +31,7 @@ install_dhcp: yes network: domain: "{{ host_domain }}" primary: - name: enx00e04d6a076e + name: enx00e04c025fa4 base_modules_blacklist: "{{ base_modules_blacklist_none }}" @@ -96,7 +102,6 @@ ws_base_extra_packages: - clinfo - cmake - cpu-x - - cura - ddrescueview - debhelper - debmake @@ -112,9 +117,12 @@ ws_base_extra_packages: - doxygen - easytag - elpa-debian-el + - elpa-dockerfile-mode - elpa-go-mode + - elpa-jinja2-mode - elpa-lua-mode - elpa-php-mode + - elpa-py-autopep8 - elpa-rust-mode - elpa-web-mode - elpa-yaml-mode @@ -161,7 +169,6 @@ ws_base_extra_packages: - kpartx - libdbd-mysql-perl - libgpgme11 - - libncurses5 - libusb-dev - libusb-1.0-0-dev - libvirt-clients @@ -218,8 +225,7 @@ ws_base_extra_packages: - python3-sphinx-rtd-theme - python3-toml - python3-xopen - - qemu - - qemu-kvm + - qemu-system - qemu-system-gui - qemu-user-static - qemu-utils @@ -256,6 +262,8 @@ ws_base_extra_packages: - texlive-lang-german - texlive-latex-extra - tlp + - tor + - tor-geoipdb - torbrowser-launcher - totem - unrar @@ -280,26 +288,24 @@ ws_base_extra_packages: - xdg-desktop-portal-gtk - xfce4-goodies - xorriso - - xul-ext-lightning - yamllint - yasm # needs apt-repo/spreadspace - go - info-beamer - #- helm ## TODO: not yet in repo for jammy - k9s - kubeletctl - grype # needs apt-repo/ansible - ansible - # needs apt-repo/tor-project - - tor - - tor-geoipdb # needs apt-repo/kubernetes - kubectl # needs apt-repo/element - element-desktop +ws_base_extra_snaps: + - thunderbird + kubernetes_version: "1.30" @@ -422,3 +428,6 @@ ws_flatpak_apps: - name: org.kicad.KiCad shortcuts: - name: kicad + - name: com.ultimaker.cura + shortcuts: + - name: cura diff --git a/inventory/host_vars/ch-equinox-ws.yml b/inventory/host_vars/ch-equinox-ws.yml index 4ead9282..188a309b 100644 --- a/inventory/host_vars/ch-equinox-ws.yml +++ b/inventory/host_vars/ch-equinox-ws.yml @@ -106,7 +106,6 @@ ws_base_extra_packages: - clinfo - cmake - cpu-x - - cura - ddrescueview - debhelper - debmake @@ -122,9 +121,12 @@ ws_base_extra_packages: - doxygen - easytag - elpa-debian-el + - elpa-dockerfile-mode - elpa-go-mode + - elpa-jinja2-mode - elpa-lua-mode - elpa-php-mode + - elpa-py-autopep8 - elpa-rust-mode - elpa-web-mode - elpa-yaml-mode @@ -168,7 +170,6 @@ ws_base_extra_packages: - kpartx - libdbd-mysql-perl - libgpgme11 - - libncurses5 - libusb-dev - libusb-1.0-0-dev - libvirt-clients @@ -183,7 +184,6 @@ ws_base_extra_packages: - meld - meson - mingw-w64 - - mono-devel - mosh - msmtp-mta - mumble @@ -226,8 +226,7 @@ ws_base_extra_packages: - python3-sphinx-rtd-theme - python3-toml - python3-xopen - - qemu - - qemu-kvm + - qemu-system - qemu-system-gui - qemu-user-static - qemu-utils @@ -252,7 +251,7 @@ ws_base_extra_packages: - spice-client-gtk - sqlite3 - sshfs - - steam + - steam-installer - stlink-tools - stm32flash - stress @@ -265,6 +264,8 @@ ws_base_extra_packages: - texlive - texlive-lang-german - texlive-latex-extra + - tor + - tor-geoipdb - torbrowser-launcher - totem - unrar @@ -288,25 +289,25 @@ ws_base_extra_packages: - xdg-desktop-portal-gtk - xfce4-goodies - xorriso - - xul-ext-lightning - yamllint - yasm # needs apt-repo/spreadspace - go - info-beamer - #- helm ## TODO: not yet in repo for jammy - k9s - kubeletctl - grype # needs apt-repo/ansible - ansible - # needs apt-repo/tor-project - - tor - - tor-geoipdb # needs apt-repo/kubernetes - kubectl # needs apt-repo/element - element-desktop + ## needs apt-repo/qmk + #- qmk + +ws_base_extra_snaps: + - thunderbird kubernetes_version: "1.30" @@ -344,3 +345,6 @@ ws_flatpak_apps: - name: org.kicad.KiCad shortcuts: - name: kicad + - name: com.ultimaker.cura + shortcuts: + - name: cura diff --git a/inventory/host_vars/ch-helene.yml b/inventory/host_vars/ch-helene.yml index 61d4f7ef..52b3a3f9 100644 --- a/inventory/host_vars/ch-helene.yml +++ b/inventory/host_vars/ch-helene.yml @@ -49,7 +49,7 @@ kubelet_storage: size: 5G fs: ext4 -# kubernetes_version: 1.30.3 +# kubernetes_version: 1.30.4 # kubernetes_container_runtime: docker # kubernetes_standalone_max_pods: 42 # kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/ch-iot.yml b/inventory/host_vars/ch-iot.yml index 30bee5d8..8eb72d9c 100644 --- a/inventory/host_vars/ch-iot.yml +++ b/inventory/host_vars/ch-iot.yml @@ -78,6 +78,7 @@ coredns_config: | {{ network_zones.iot.prefix | ansible.utils.ipaddr(network_zones.iot.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }} apt.chaos-at-home.org no_reverse } + prometheus 127.0.0.1:9153 } @@ -89,6 +90,7 @@ spreadspace_apt_repo_components: prometheus_exporters_extra: - chrony - mosquitto + - coredns prometheus_job_multitarget_blackbox__probe: ch-mon: diff --git a/inventory/host_vars/ch-mon.yml b/inventory/host_vars/ch-mon.yml index 85b2dd8c..b93dbd05 100644 --- a/inventory/host_vars/ch-mon.yml +++ b/inventory/host_vars/ch-mon.yml @@ -141,6 +141,7 @@ prometheus_server_alertmanager: basic_auth: username: server password: "{{ vault_prometheus_alertmanager_auth_user_passwords['server'] }}" + scrape_instance: "{{ inventory_hostname }}" prometheus_server_web_external_url: "http://mon.chaos-at-home.org/prometheus/" @@ -260,13 +261,13 @@ grafana_datasources: manageAlerts: no grafana_dashboards: - - file: node-full + - file: sys/node-full datasource: "Prometheus" - - file: openwrt + - file: sys/openwrt datasource: "Prometheus" - - file: chrony + - file: sys/ipmi datasource: "Prometheus" - - file: environment-sensors + - file: environment/sensors datasource: "Prometheus" - file: blackbox/ssh datasource: "Prometheus" @@ -274,17 +275,19 @@ grafana_dashboards: datasource: "Prometheus" - file: blackbox/mqtt datasource: "Prometheus" - - file: smokeping + - file: net/chrony datasource: "Prometheus" - - file: bind + - file: net/smokeping datasource: "Prometheus" - - file: ipmi + - file: net/bind datasource: "Prometheus" - - file: standalone-kubelet-overview + - file: net/mosquitto datasource: "Prometheus" - - file: apps/whawty-nginx-sso + - file: net/coredns + datasource: "Prometheus" + - file: apps/standalone-kubelet-overview datasource: "Prometheus" - - file: mosquitto + - file: apps/whawty-nginx-sso datasource: "Prometheus" grafana_admin_password: "{{ vault_grafana_admin_password }}" diff --git a/inventory/host_vars/mz-ap.yml b/inventory/host_vars/ch-mz-ap.yml index 044f41f9..044f41f9 100644 --- a/inventory/host_vars/mz-ap.yml +++ b/inventory/host_vars/ch-mz-ap.yml diff --git a/inventory/host_vars/mz-router.yml b/inventory/host_vars/ch-mz-router.yml index 254aaf02..c798623b 100644 --- a/inventory/host_vars/mz-router.yml +++ b/inventory/host_vars/ch-mz-router.yml @@ -1,10 +1,4 @@ --- -## TOOD: -# After router upgrades run this command to generate a new dyndns ssh key -# $ dropbearkey -t ed25519 -f /etc/dyndns/id_ed25519 -# Then replace the key at the dyndns server (/var/lib/dyndns/.ssh/authorized_keys) -# after that run the dyndns update script manually to accept the ssh host-key - openwrt_arch: ath79 openwrt_target: generic openwrt_profile: tplink_tl-wdr4300-v1 diff --git a/inventory/host_vars/ch-pan.yml b/inventory/host_vars/ch-pan.yml index 29ec85ae..74e630a7 100644 --- a/inventory/host_vars/ch-pan.yml +++ b/inventory/host_vars/ch-pan.yml @@ -88,7 +88,7 @@ dyndns: - "dyn.schaaas.at. 7200 IN AAAA 2a02:3e0:407::19" - "captive.schaaas.at. 7200 IN CNAME dyn.schaaas.at." clients: - mz-router: mzl + ch-mz-router: mzl ch-equinox-t450s: equinox ele-media: elemedia diff --git a/inventory/host_vars/ch-router.yml b/inventory/host_vars/ch-router.yml index 3f31bcbe..fa15ac69 100644 --- a/inventory/host_vars/ch-router.yml +++ b/inventory/host_vars/ch-router.yml @@ -404,8 +404,8 @@ openwrt_uci: options: enabled: '1' interface: 'eth1' - download: '147000' - upload: '20000' + download: '510000' + upload: '72000' qdisc: 'cake' script: 'piece_of_cake.qos' qdisc_advanced: '0' diff --git a/inventory/host_vars/ele-calypso.yml b/inventory/host_vars/ele-calypso.yml index a2607fc6..8da4c4af 100644 --- a/inventory/host_vars/ele-calypso.yml +++ b/inventory/host_vars/ele-calypso.yml @@ -74,7 +74,7 @@ kubelet_storage: size: 5G fs: ext4 -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 42 kubernetes_standalone_cni_variant: with-portmap @@ -101,6 +101,7 @@ prometheus_server_storage: prometheus_server_alertmanager: url: "127.0.0.1:9093" path_prefix: "/alertmanager/" + scrape_instance: "{{ inventory_hostname }}" prometheus_server_web_external_url: "http://{{ network.primary.address | ansible.utils.ipaddr('address') }}/prometheus/" @@ -173,19 +174,19 @@ grafana_datasources: manageAlerts: no grafana_dashboards: - - file: node-full + - file: sys/node-full datasource: "Prometheus" - - file: openwrt + - file: sys/openwrt datasource: "Prometheus" - - file: chrony + - file: sys/ipmi datasource: "Prometheus" - - file: blackbox/ssh + - file: net/chrony datasource: "Prometheus" - - file: network-ups-tools + - file: blackbox/ssh datasource: "Prometheus" - - file: ipmi + - file: environment/network-ups-tools datasource: "Prometheus" - - file: standalone-kubelet-overview + - file: apps/standalone-kubelet-overview datasource: "Prometheus" grafana_admin_password: "{{ vault_grafana_admin_password }}" diff --git a/inventory/host_vars/ele-companion-raspi.yml b/inventory/host_vars/ele-companion-raspi.yml index 7d130639..b25acb27 100644 --- a/inventory/host_vars/ele-companion-raspi.yml +++ b/inventory/host_vars/ele-companion-raspi.yml @@ -29,7 +29,7 @@ docker_pkg_provider: docker-com docker_plugins: - buildx -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 42 kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/ele-coturn.yml b/inventory/host_vars/ele-coturn.yml index f966ac9e..1cbc2767 100644 --- a/inventory/host_vars/ele-coturn.yml +++ b/inventory/host_vars/ele-coturn.yml @@ -27,7 +27,7 @@ acme_directory_server: "{{ acme_directory_server_le_live_v2 }}" acme_client: acmetool -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 100 kubernetes_standalone_pod_cidr: 192.168.255.0/24 diff --git a/inventory/host_vars/ele-helene.yml b/inventory/host_vars/ele-helene.yml index 6eef576d..76f7978c 100644 --- a/inventory/host_vars/ele-helene.yml +++ b/inventory/host_vars/ele-helene.yml @@ -92,7 +92,7 @@ kubelet_storage: size: 5G fs: ext4 -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 42 kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/ele-jitsi.yml b/inventory/host_vars/ele-jitsi.yml index ea446019..4fe526c0 100644 --- a/inventory/host_vars/ele-jitsi.yml +++ b/inventory/host_vars/ele-jitsi.yml @@ -32,7 +32,7 @@ acme_directory_server: "{{ acme_directory_server_le_live_v2 }}" acme_client: acmetool -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 100 kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/ele-media.yml b/inventory/host_vars/ele-media.yml index dc5beccd..d0fe5e2f 100644 --- a/inventory/host_vars/ele-media.yml +++ b/inventory/host_vars/ele-media.yml @@ -73,7 +73,7 @@ kubelet_storage: size: 5G fs: ext4 -kubernetes_version: 1.30.2 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/ele-thetys.yml b/inventory/host_vars/ele-thetys.yml index 2911be57..8d00359e 100644 --- a/inventory/host_vars/ele-thetys.yml +++ b/inventory/host_vars/ele-thetys.yml @@ -77,7 +77,7 @@ kubelet_storage: size: 5G fs: ext4 -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 42 kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/glt-jitsi.yml b/inventory/host_vars/glt-jitsi.yml index 2e36c347..69e51909 100644 --- a/inventory/host_vars/glt-jitsi.yml +++ b/inventory/host_vars/glt-jitsi.yml @@ -27,7 +27,7 @@ acme_directory_server: "{{ acme_directory_server_le_live_v2 }}" acme_client: acmetool -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 100 kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/s2-thetys.yml b/inventory/host_vars/s2-thetys.yml index 5f2897c9..8f03e497 100644 --- a/inventory/host_vars/s2-thetys.yml +++ b/inventory/host_vars/s2-thetys.yml @@ -53,7 +53,7 @@ kubelet_storage: size: 5G fs: ext4 -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 42 kubernetes_standalone_cni_variant: with-portmap diff --git a/inventory/host_vars/sk-2024.yml b/inventory/host_vars/sk-2024.yml new file mode 100644 index 00000000..338ffeca --- /dev/null +++ b/inventory/host_vars/sk-2024.yml @@ -0,0 +1,63 @@ +--- +system_lvm_volume_size_root: 4G +install: + cloud: + credentials: "{{ vault_hroot_robot_account }}" + disks: + primary: software-raid + raid: + level: 1 + members: + - /dev/nvme0n1 + - /dev/nvme1n1 + system_lvm: + size: 15G + +network: + nameservers: "{{ vm_host.network.dns }}" + domain: "{{ host_domain }}" + interfaces: + - name: br-public + address: "{{ vm_host.network.bridges.public.prefix | ansible.utils.ipaddr(vm_host.network.bridges.public.offsets[inventory_hostname]) }}" + +external_ip: "94.130.242.46" + +ssh_users_root: + - equinox + - dan + +apt_repo_components: + - main + - contrib ## for zfs + - non-free-firmware + + +luks_devices: + crypto-nvme0: + passphrase: "{{ vault_luks_devices['crypto-nvme0'].passphrase }}" + device: /dev/disk/by-id/nvme-eui.002538b531b04024-part3 + crypto-nvme1: + passphrase: "{{ vault_luks_devices['crypto-nvme1'].passphrase }}" + device: /dev/disk/by-id/nvme-eui.002538b531b0402c-part3 + + +zfs_arc_size: + min: 2GB + max: 8GB + +zfs_pools: + storage: + mountpoint: /srv/storage + create_vdevs: mirror /dev/mapper/crypto-nvme0 /dev/mapper/crypto-nvme1 + properties: + ashift: 12 + autotrim: "on" + +zfs_sanoid_modules: + storage/vm: + use_template: production + recursive: yes + process_children_only: yes + storage/vm/sk-cloudio/data: + use_template: ignore + recursive: yes diff --git a/inventory/host_vars/sk-cloudio/bluespice.yml b/inventory/host_vars/sk-cloudio/bluespice.yml deleted file mode 100644 index 30b3f330..00000000 --- a/inventory/host_vars/sk-cloudio/bluespice.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -## bluespice role does not work yet... - -# bluespice_zfs: -# pool: storage -# name: bluespice -# properties: -# compression: lz4 -# quota: 20G - -# bluespice_instances: -# example: -# version: 4.2.4 -# port: 8000 -# hostname: bs.elev8.at -# language: en -# admin: -# username: admin -# password: test -# db_password: secretgeheim diff --git a/inventory/host_vars/sk-cloudio/collabora.yml b/inventory/host_vars/sk-cloudio/collabora.yml index 93cab2eb..5910da27 100644 --- a/inventory/host_vars/sk-cloudio/collabora.yml +++ b/inventory/host_vars/sk-cloudio/collabora.yml @@ -1,11 +1,17 @@ --- -collabora_code_base_path: /srv/storage/collabora/code - collabora_code_instances: o.skillz.biz: - version: 23.05.6.4.1 + version: 24.04.6.2.1 port: 8200 - hostname: o.skillz.biz + storage: + type: directory + dest: /srv/storage/collabora/code/o.skillz.biz + publish: + zone: "{{ apps_publish_zone__sk_cloudio }}" + hostnames: + - o.skillz.biz + tls: + certificate_provider: acmetool admin: username: admin password: "{{ vault_collabora_code_admin_passwords['o.skillz.biz'] }}" diff --git a/inventory/host_vars/sk-cloudio/etherpad.yml b/inventory/host_vars/sk-cloudio/etherpad.yml deleted file mode 100644 index a368be44..00000000 --- a/inventory/host_vars/sk-cloudio/etherpad.yml +++ /dev/null @@ -1,58 +0,0 @@ ---- -etherpad_lite_zfs: - pool: storage - name: etherpad-lite - properties: - compression: lz4 - -etherpad_lite_instances: - pad.elevate.at: - version: c65c5f17aa26c9179ce591f44721861ba6f6bec4-elevate - port: 8300 - hostnames: - - pad.elevate.at - zfs_properties: - quota: 5G - settings: - title: Elevate Etherpad - users: - admin: - is_admin: true - password: "{{ vault_etherpad_lite_user_passwords['pad.elevate.at']['admin'] }}" - user: - is_admin: false - password: "{{ vault_etherpad_lite_user_passwords['pad.elevate.at']['user'] }}" - - defaultPadText: "Welcome to the ELEVATE - Etherpad!\n\nThis pad text is synchronized\ - \ as you type, so that everyone viewing this page sees the same text. This allows\ - \ you to collaborate seamlessly on documents!\n\nGet involved with Etherpad at http://etherpad.org\n\ - \n IMPORTANT: THIS PAD IS PRIVIDED FOR FREE TO THE PUBLIC! There is no guarantee\ - \ for your data - please take care of backups yourself! This is usually intended\ - \ only for the Elevate Team and it might get access control in the future! If you\ - \ are interested in having a PAD for your project, please get back to dan@elevate.at\ - \ for information. It can be made available!" - favicon: favicon.ico - - maxAge: 21600 - editOnly: false - minify: true - requireSession: false - requireAuthentication: false - requireAuthorization: false - socketTransportProtocols: [xhr-polling, jsonp-polling, htmlfile] - abiword: null - loglevel: INFO - logconfig: - appenders: - - type: console - dbType: "mysql" - dbSettings: - host: "127.0.0.1" - user: "etherpad-lite" - password: "{{ vault_etherpad_lite_database_passwords['pad.elevate.at'] }}" - database: "etherpad-lite" - charset: "utf8mb4" - database: - type: mariadb - version: 10.4.22 - password: "{{ vault_etherpad_lite_database_passwords['pad.elevate.at'] }}" diff --git a/inventory/host_vars/sk-cloudio/nextcloud.yml b/inventory/host_vars/sk-cloudio/nextcloud.yml index a0b52cb5..3c5e5ae0 100644 --- a/inventory/host_vars/sk-cloudio/nextcloud.yml +++ b/inventory/host_vars/sk-cloudio/nextcloud.yml @@ -1,94 +1,116 @@ --- -nextcloud_zfs: +_nextcloud_zfs_base_: pool: storage name: nextcloud - properties: - compression: lz4 nextcloud_instances: - luzesombra.skillz.biz: - # new: true - version: 29.0.3 - port: 8100 - hostnames: - - luzesombra.skillz.biz - zfs_properties: - quota: 200G - redis: - version: 7.2.1 - database: - type: mariadb - version: 11.1.2 - password: "{{ vault_nextcloud_database_passwords['luzesombra.skillz.biz'] }}" - insomnia.skillz.biz: - # new: true - version: 29.0.3 - port: 8101 - hostnames: - - insomnia.skillz.biz - zfs_properties: - quota: 400G - redis: - version: 7.2.1 - database: - type: mariadb - version: 10.11.5 - password: "{{ vault_nextcloud_database_passwords['insomnia.skillz.biz'] }}" - nc.skillz.biz: - # new: true - version: 29.0.3 - port: 8102 - hostnames: - - nc.skillz.biz - zfs_properties: - quota: 200G - redis: - version: 7.2.1 - database: - type: mariadb - version: 10.11.5 - password: "{{ vault_nextcloud_database_passwords['nc.skillz.biz'] }}" - extra_args: - - "--log_bin_trust_function_creators=true" - custom_image: - dockerfile: | - RUN set -x \ - && apt-get update -q \ - && apt-get install -y -q ffmpeg \ - && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* - visuals.pixeldada.com: - # new: true - version: 29.0.3 - port: 8103 - hostnames: - - visuals.pixeldada.com - zfs_properties: - quota: 100G - redis: - version: 7.2.4 - database: - type: mariadb - version: 11.3.2 - password: "{{ vault_nextcloud_database_passwords['visuals.pixeldada.com'] }}" - extra_args: - - "--log_bin_trust_function_creators=true" - custom_image: - dockerfile: | - RUN set -x \ - && apt-get update -q \ - && apt-get install -y -q ffmpeg \ - && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* +# luzesombra.skillz.biz: +# # new: true +# version: 29.0.4 +# port: 8100 +# hostnames: +# - luzesombra.skillz.biz +# storage: +# type: zfs +# parent: "{{ _nextcloud_zfs_base_ }}" +# name: luzesombra.skillz.biz +# properties: +# quota: 200G +# redis: +# version: 7.2.1 +# database: +# type: mariadb +# version: 11.1.2 +# password: "{{ vault_nextcloud_database_passwords['luzesombra.skillz.biz'] }}" +# insomnia.skillz.biz: +# # new: true +# version: 29.0.4 +# port: 8101 +# hostnames: +# - insomnia.skillz.biz +# storage: +# type: zfs +# parent: "{{ _nextcloud_zfs_base_ }}" +# name: insomnia.skillz.biz +# properties: +# quota: 400G +# redis: +# version: 7.2.1 +# database: +# type: mariadb +# version: 10.11.5 +# password: "{{ vault_nextcloud_database_passwords['insomnia.skillz.biz'] }}" +# nc.skillz.biz: +# # new: true +# version: 29.0.4 +# port: 8102 +# hostnames: +# - nc.skillz.biz +# storage: +# type: zfs +# parent: "{{ _nextcloud_zfs_base_ }}" +# name: nc.skillz.biz +# properties: +# quota: 200G +# redis: +# version: 7.2.1 +# database: +# type: mariadb +# version: 10.11.5 +# password: "{{ vault_nextcloud_database_passwords['nc.skillz.biz'] }}" +# extra_args: +# - "--log_bin_trust_function_creators=true" +# custom_image: +# dockerfile: | +# RUN set -x \ +# && apt-get update -q \ +# && apt-get install -y -q ffmpeg \ +# && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* +# visuals.pixeldada.com: +# # new: true +# version: 29.0.4 +# port: 8103 +# hostnames: +# - visuals.pixeldada.com +# storage: +# type: zfs +# parent: "{{ _nextcloud_zfs_base_ }}" +# name: visuals.pixeldada.com +# properties: +# quota: 100G +# redis: +# version: 7.2.4 +# database: +# type: mariadb +# version: 11.3.2 +# password: "{{ vault_nextcloud_database_passwords['visuals.pixeldada.com'] }}" +# extra_args: +# - "--log_bin_trust_function_creators=true" +# custom_image: +# dockerfile: | +# RUN set -x \ +# && apt-get update -q \ +# && apt-get install -y -q ffmpeg \ +# && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* wolke.elev8.at: # new: true version: 29.0.3 port: 8105 - hostnames: - - wolke.elev8.at - zfs_properties: - quota: 10G + storage: + type: zfs + parent: "{{ _nextcloud_zfs_base_ }}" + name: wolke.elev8.at + properties: + quota: 10G redis: version: 7.2.1 database: type: mariadb version: 10.11.5 password: "{{ vault_nextcloud_database_passwords['wolke.elev8.at'] }}" + publish: + zone: "{{ apps_publish_zone__sk_cloudio }}" + hostnames: + - wolke.elev8.at + tls: + certificate_provider: acmetool diff --git a/inventory/host_vars/sk-cloudio/onlyoffice.yml b/inventory/host_vars/sk-cloudio/onlyoffice.yml index 11f82abe..d8d3da82 100644 --- a/inventory/host_vars/sk-cloudio/onlyoffice.yml +++ b/inventory/host_vars/sk-cloudio/onlyoffice.yml @@ -1,20 +1,30 @@ --- -onlyoffice_zfs: +_onlyoffice_zfs_base_: pool: storage name: onlyoffice properties: compression: lz4 - quota: 5G onlyoffice_instances: office.elev8.at: - version: 8.1.0.1 + version: 8.1.1.2 port: 8600 - hostname: office.elev8.at jwt_secret: "{{ vault_onlyoffice_jwt_secrets['office.elev8.at'] }}" + storage: + type: zfs + parent: "{{ _onlyoffice_zfs_base_ }}" + name: office.elev8.at + properties: + quota: 5G database: - version: 12.19 + version: 12.20 password: "{{ vault_onlyoffice_database_passwords['office.elev8.at'] }}" amqp: - version: 3.13.4 + version: 3.13.7 password: "{{ vault_onlyoffice_amqp_passwords['office.elev8.at'] }}" + publish: + zone: "{{ apps_publish_zone__sk_cloudio }}" + hostnames: + - office.elev8.at + tls: + certificate_provider: acmetool diff --git a/inventory/host_vars/sk-cloudio/pigallery2.yml b/inventory/host_vars/sk-cloudio/pigallery2.yml deleted file mode 100644 index 2a7d5c84..00000000 --- a/inventory/host_vars/sk-cloudio/pigallery2.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -pigallery2_zfs: - pool: storage - name: pigallery2 - properties: - compression: lz4 - -pigallery2_instances: - pix.elevate.at: - version: 1.9.3 - port: 8700 - hostname: pix.elevate.at - zfs_properties: - quota: 5G - images_paths: - 2019: /srv/storage/nextcloud/wolke.elevate.at/nextcloud/data/__groupfolders/1/Editions_from_2014/Fotos_Editions/2019/ - 2020: /srv/storage/nextcloud/wolke.elevate.at/nextcloud/data/__groupfolders/1/Editions_from_2014/Fotos_Editions/2020/ - 2021: /srv/storage/nextcloud/wolke.elevate.at/nextcloud/data/__groupfolders/1/Editions_from_2014/Fotos_Editions/2021/ - 2022: /srv/storage/nextcloud/wolke.elevate.at/nextcloud/data/__groupfolders/1/Editions_from_2014/Fotos_Editions/2022/ - 2023: /srv/storage/nextcloud/wolke.elevate.at/nextcloud/data/__groupfolders/1/Editions_from_2014/Fotos_Editions/2023/ diff --git a/inventory/host_vars/sk-cloudio/vars.yml b/inventory/host_vars/sk-cloudio/vars.yml index a6306161..8c57def9 100644 --- a/inventory/host_vars/sk-cloudio/vars.yml +++ b/inventory/host_vars/sk-cloudio/vars.yml @@ -1,19 +1,43 @@ --- -system_lvm_volume_size_root: 3584M +system_lvm_volume_size_root: 4G system_lvm_volume_size_varlog: 5G install: - cloud: - credentials: "{{ vault_hroot_robot_account }}" - server_name: "{{ host_name }}" + vm: + memory: 48G + numcpus: 12 + autostart: True disks: - primary: software-raid - raid: - level: 1 - members: - - /dev/nvme0n1 - - /dev/nvme1n1 - system_lvm: - size: 15G + primary: /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0 + scsi: + sda: + type: zfs + name: root + size: 15g + sdb: + type: zfs + name: data + size: 900g + properties: + 'syncoid:sync': 'false' + interfaces: + - bridge: br-public + name: primary0 + +network: + nameservers: "{{ vm_host.network.dns }}" + domain: "{{ host_domain }}" + systemd_link: + interfaces: "{{ install.interfaces }}" + primary: &_network_primary_ + name: primary0 + address: "{{ vm_host.network.bridges.public.prefix | ansible.utils.ipaddr(vm_host.network.bridges.public.offsets[inventory_hostname]) }}" + gateway: "{{ vm_host.network.bridges.public.prefix | ansible.utils.ipaddr(vm_host.network.bridges.public.offsets[vm_host.name]) | ansible.utils.ipaddr('address') }}" + template: overlay + overlay: "{{ (vm_host.network.bridges.public.overlays.default.prefix | ansible.utils.ipaddr(vm_host.network.bridges.public.overlays.default.offsets[inventory_hostname])).split('/')[0] }}" + interfaces: + - *_network_primary_ + +external_ip: "{{ network.primary.overlay }}" apt_repo_components: @@ -22,7 +46,6 @@ apt_repo_components: - non-free-firmware spreadspace_apt_repo_components: - - main - container @@ -33,20 +56,23 @@ zfs_arc_size: zfs_pools: storage: mountpoint: /srv/storage - create_vdevs: mirror /dev/nvme0n1p3 /dev/nvme1n1p3 + create_vdevs: /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-1 properties: ashift: 12 autotrim: "on" +zfs_volumes: + storage: + nextcloud: + properties: + compression: lz4 + xattr: sa + zfs_sanoid_modules: storage/nextcloud: use_template: production recursive: yes process_children_only: yes - storage/etherpad-lite: - use_template: production - recursive: yes - process_children_only: yes storage/keycloak: use_template: production recursive: yes @@ -73,7 +99,7 @@ kubelet_storage: properties: quota: 20G -kubernetes_version: 1.30.2 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 100 kubernetes_standalone_pod_cidr: 192.168.255.0/24 @@ -94,8 +120,43 @@ postfix_base_inet_protocols: acme_directory_server: "{{ acme_directory_server_le_live_v2 }}" acme_client: acmetool -## TODO: remove once migration of elevate services has been done -ssh_users_root: - - equinox - - dan - - brt + +sk_cloudio_apps_publish_ca_key: "{{ vault_sk_cloudio_apps_publish_ca_key }}" +sk_cloudio_apps_publish_ca_cert: | + -----BEGIN CERTIFICATE----- + MIIE+DCCAuCgAwIBAgIUWYAlW7BhaDHZaWjkVlttP26KVhgwDQYJKoZIhvcNAQEL + BQAwKTEnMCUGA1UEAwweQXBwcyBQdWJsaXNoIENBIGZvciBzay1jbG91ZGlvMCAX + DTI0MDgyNDIwNDEzNloYDzIwNjQwNzA2MjA0MTM2WjApMScwJQYDVQQDDB5BcHBz + IFB1Ymxpc2ggQ0EgZm9yIHNrLWNsb3VkaW8wggIiMA0GCSqGSIb3DQEBAQUAA4IC + DwAwggIKAoICAQDUOVJTgNrqTlD6FXupVLIoMbQ7O9Xj3XmtYGVtF6LUPodbrlTs + 9TRkhWwVSUGokfgRtKOx1Zk13HFadKw92t9zzTVnT62drH9xOPPGitBXyxeCiyzr + Ib98qnDeO9o+9x0cRsg4tvjksfyMV0JtFxOsSJ6diHrGrakk9SIRVk63GYbRSKBQ + wKCeAihFX35oyd3qCmIt6ZuueX5Z2dNdiaXmcrwe0MhBghd4Upqe3BPopGeVzJtY + Bm6Fsq/V2H28g6l3kNU5sPpgPWMpDRuUTjnfe1MFVu51QwmbkxqWhODaH8dClshJ + imACGnRmTxJ5bAqBbT2z3IEdhaEnKKUyN8OYqX3mtmU1/We9d52cLvghtbiRuhrE + 4eK7GRCvc0QqU/hk6eFvfXVd5KI48tB8at9tKP6tWeavlYyfq5G3canmzOTTbxuA + TfpbFrHIwHCk9M3VTIcABMeb38EGoOpaSTTcX3eOT/k97tQJPKFlfl+EF+fhbijN + 1CEdR+6m2BIvcNmGkKl0VH6eVXiAUFKm03Kg1sH0gh4upQKdx+54szF51jsrHcPI + 16oBChS0t+JG1tcvbluVWwLMw1G5nvm302/RxYahNyCniMAUl/eaubTHarTBtK7w + lAYryanwtlbAR/XQZAHBNzhG/2er1nCr6E5Wh+98ID+ElWbmaQ5ale/8OQIDAQAB + oxYwFDASBgNVHRMBAf8ECDAGAQH/AgEBMA0GCSqGSIb3DQEBCwUAA4ICAQCpTUjN + veOg2dZ/44tg5P5RnZKZFiyYapaaxv3W6cfqpfUhrI8qSuBn9G/UAJAfMszU87rf + OZ1PRZCFuzu+dB7CrmMgvqt0cTRpaxlN9CzZpfpFADlt9NQKYxK4T8IxIZ7ebISl + UNyX08mRXNB3N+Qq1CcTVtwHNLbnwkLttryGJ1tmAwEu4QIHauG7cDXFQuRGP0CE + x+DSdLTcs6hvOYq4OfpX0Zci5zy4SI50DLoT5h94IaIPAL6XBi7n9bj8ZSHqa1ZC + lveyaGguEy53meARTXSCm/jxtpo8xD7pWz4vnYPZuyMGe9rbE77Y8CwWK/RvUdYx + th09ALKw76W59e78RkxKTqBvGmZYw1igY4p8IqcXci65xtO2HiRDHX2jU7AYkgAD + z5Rv+2ZMcOQHOPzxDRXk06+pQUZ3qQ3cU9ASziTSaLITnMVH0VokRNXvSZYxeuwR + yDqb1H4MsV91Sy4UyXmtfXZYouM3/3OwCzxpkgvxdVdQBzssUssLrRcS5UEcJGr8 + 69M2CNHXX1fy0mLKdgqHNPzX9ALnqTHJMV5C5J3Q4RU6Vl2Un3Vg3A3dRKLPkg5P + C69nyBua3CIlx6Z8o2Ik9tJdwCULV6lYLGEfpsJHt627gF893Jexxuo3zI7XWQhb + ucrEkA2qzf0fHzCwFeiACMjssiN1YyevdI4Flw== + -----END CERTIFICATE----- + +apps_publish_zone__sk_cloudio: + name: sk-cloudio + publisher: sk-cloudio + certificate_provider: static-ca + certificate_ca_config: + cert_content: "{{ sk_cloudio_apps_publish_ca_cert }}" + key_content: "{{ sk_cloudio_apps_publish_ca_key }}" diff --git a/inventory/host_vars/sk-testvm.yml b/inventory/host_vars/sk-testvm.yml index 0c45dfcb..d728464d 100644 --- a/inventory/host_vars/sk-testvm.yml +++ b/inventory/host_vars/sk-testvm.yml @@ -56,7 +56,7 @@ kubelet_storage: size: 1G fs: ext4 -kubernetes_version: 1.30.3 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 100 kubernetes_standalone_pod_cidr: 192.168.255.0/24 diff --git a/inventory/host_vars/sk-tomnext-nc.yml b/inventory/host_vars/sk-tomnext-nc.yml index e46aee23..01cf6e8c 100644 --- a/inventory/host_vars/sk-tomnext-nc.yml +++ b/inventory/host_vars/sk-tomnext-nc.yml @@ -88,7 +88,7 @@ kubelet_storage: properties: quota: 15G -kubernetes_version: 1.30.2 +kubernetes_version: 1.30.4 kubernetes_container_runtime: docker kubernetes_standalone_max_pods: 15 kubernetes_standalone_cni_variant: with-portmap @@ -117,7 +117,7 @@ nextcloud_zfs: nextcloud_instances: team.tomwaitz.eu: # new: true - version: 29.0.3 + version: 29.0.4 port: 8100 hostnames: - team.tomwaitz.eu @@ -148,13 +148,15 @@ nextcloud_instances: && docker-php-ext-enable smbclient \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* -collabora_code_base_path: /srv/storage/collabora/code collabora_code_instances: o.tomwaitz.eu: version: 23.05.6.4.1 port: 8200 hostname: o.tomwaitz.eu + storage: + type: directory + dest: /srv/storage/collabora/code/o.tomwaitz.eu admin: username: admin password: "{{ vault_collabora_code_admin_passwords['o.tomwaitz.eu'] }}" diff --git a/inventory/hosts.ini b/inventory/hosts.ini index 01d3eae3..f4c61e2a 100644 --- a/inventory/hosts.ini +++ b/inventory/hosts.ini @@ -1,3 +1,4 @@ + [all:vars] ansible_user=root ansible_port=222 @@ -70,8 +71,8 @@ chaos-at-home-sensors chaos-at-home-ups [chaos-at-home_mz] -mz-router ansible_host=chmz-router -mz-ap ansible_host=chmz-ap +ch-mz-router host_name=mz-router +ch-mz-ap host_name=mz-ap [chaos-at-home_mur-at] ch-atlas host_name=atlas @@ -190,15 +191,14 @@ glt-telesto host_name=minion-glt ############################### -# environment: dan +# environment: skillz [skillz:vars] host_domain=skillz.biz -env_group=dan +env_group=skillz [skillz] sk-2019 host_name=2019 -sk-cloudio host_name=cloudio sk-2019vm host_name=2019vm sk-tomnext host_name=tomnext sk-tomnext-nc host_name=tomnext-nc @@ -206,10 +206,16 @@ sk-tomnext-hp host_name=scriptbee host_domain=tomwaitz.eu sk-testvm host_name=testvm sk-torrent host_name=torrent +sk-2024 host_name=2024 +sk-cloudio host_name=cloudio + + +############################### +# environment: elevate [elevate:vars] host_domain=elev8.at -env_group=dan +env_group=elevate [elevate] ele-media host_name=media @@ -283,7 +289,7 @@ ele-infobeamer-default [elevate-mediachannel:vars] host_domain=elev8.at -env_group=dan +env_group=elevate [elevate-mediachannel] ele-emc-ctrl host_name=emc-ctrl @@ -322,8 +328,8 @@ ch-testvm-openwrt ch-installsmb ch-gw-c3voc ch-raspi-openwrt -mz-ap -mz-router +ch-mz-ap +ch-mz-router ele-router-hmtsaal ele-router-orpheum ele-router-emc @@ -444,6 +450,13 @@ sk-tomnext [vmhost-sk-tomnext:children] vmhost-sk-tomnext-guests +[vmhost-sk-2024-guests] +sk-cloudio +[vmhost-sk-2024] +sk-2024 +[vmhost-sk-2024:children] +vmhost-sk-2024-guests + [vmhost-ele-helene-guests] ele-winvm ele-testvm @@ -459,6 +472,7 @@ ch-prometheus ch-atlas sk-2019vm sk-tomnext +sk-2024 ele-helene [kvmguests:children] @@ -467,6 +481,7 @@ vmhost-ch-prometheus-guests vmhost-ch-atlas-guests vmhost-sk-2019vm-guests vmhost-sk-tomnext-guests +vmhost-sk-2024-guests vmhost-ele-helene-guests @@ -536,9 +551,9 @@ ch-apps ## hoster [hroot] sk-2019 -sk-cloudio sk-2019vm sk-tomnext +sk-2024 [hcloud] ch-testvm-hcloud diff --git a/roles/approx/tasks/main.yml b/roles/approx/tasks/main.yml index 26c8f8d4..cc9d670b 100644 --- a/roles/approx/tasks/main.yml +++ b/roles/approx/tasks/main.yml @@ -61,6 +61,8 @@ [Socket] ListenStream= ListenStream=127.0.0.1:19999 + + TriggerLimitBurst=0 dest: /etc/systemd/system/approx.socket.d/ansible.conf notify: restart approx socket diff --git a/roles/apps/bluespice/defaults/main.yml b/roles/apps/bluespice/defaults/main.yml deleted file mode 100644 index 23d18724..00000000 --- a/roles/apps/bluespice/defaults/main.yml +++ /dev/null @@ -1,19 +0,0 @@ ---- -# bluespice_base_path: /srv/bluespice - -# bluespice_zfs: -# pool: storage -# name: bluespice -# properties: -# compression: lz4 - -# bluespice_instances: -# example: -# version: 4.2.4 -# port: 8000 -# hostname: bs.example.com -# language: en -# admin: -# username: admin -# password: very-secure-password -# db_password: super-secret diff --git a/roles/apps/bluespice/tasks/main.yml b/roles/apps/bluespice/tasks/main.yml deleted file mode 100644 index 49ef2418..00000000 --- a/roles/apps/bluespice/tasks/main.yml +++ /dev/null @@ -1,62 +0,0 @@ ---- -- name: create zfs datasets - when: bluespice_zfs is defined - block: - - name: create zfs base dataset - zfs: - name: "{{ bluespice_zfs.pool }}/{{ bluespice_zfs.name }}" - state: present - extra_zfs_properties: "{{ bluespice_zfs.properties | dehumanize_zfs_properties | default(omit) }}" - - - name: create zfs volumes for instances - loop: "{{ bluespice_instances | dict2items }}" - loop_control: - label: "{{ item.key }} ({{ (item.value.zfs_properties | default({})).items() | map('join', '=') | join(', ') }})" - zfs: - name: "{{ bluespice_zfs.pool }}/{{ bluespice_zfs.name }}/{{ item.key }}" - state: present - extra_zfs_properties: "{{ item.value.zfs_properties | dehumanize_zfs_properties | default(omit) }}" - - - name: configure bluespice base bath - set_fact: - bluespice_base_path: "{{ (zfs_pools[bluespice_zfs.pool].mountpoint, bluespice_zfs.name) | path_join }}" - - -- name: create instance subdirectories - loop: "{{ bluespice_instances | list }}" - file: - path: "{{ bluespice_base_path }}/{{ item }}/data" - state: directory - - -- name: install pod manifest - loop: "{{ bluespice_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - vars: - kubernetes_standalone_pod: - name: "bluespice-{{ item.key }}" - spec: "{{ lookup('template', 'pod-spec.yml.j2') }}" - mode: "0600" - include_role: - name: kubernetes/standalone/pod - -- name: configure nginx vhost - loop: "{{ bluespice_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - vars: - nginx_vhost: - name: "bluespice-{{ item.key }}" - template: generic - tls: - certificate_provider: "{{ acme_client }}" - hostnames: - - "{{ item.value.hostname }}" - locations: - '/': - proxy_pass: "http://127.0.0.1:{{ item.value.port }}" - extra_directives: |- - client_max_body_size 0; - include_role: - name: nginx/vhost diff --git a/roles/apps/bluespice/templates/pod-spec.yml.j2 b/roles/apps/bluespice/templates/pod-spec.yml.j2 deleted file mode 100644 index 67493dc0..00000000 --- a/roles/apps/bluespice/templates/pod-spec.yml.j2 +++ /dev/null @@ -1,35 +0,0 @@ -terminationGracePeriodSeconds: 120 -containers: -- name: bluespice - image: "bluespice/bluespice-free:{{ item.value.version }}" - resources: - limits: - memory: "4Gi" - env: - - name: "BS_NAME" - value: "{{ item.key }}" - - name: "BS_URL" - value: "https://{{ item.value.hostname }}" - - name: "BS_LANG" - value: "{{ item.value.language }}" - - name: "BS_USER" - value: "{{ item.value.admin.username }}" - - name: "BS_PASSWORD" - value: "{{ item.value.admin.password }}" - - name: "BS_DB_PASSWORD" - value: "{{ item.value.db_password }}" - - name: "DISABLE_PINGBACK" - value: "yes" - volumeMounts: - - name: data - mountPath: /data - ports: - - containerPort: 80 - hostPort: {{ item.value.port }} - hostIP: 127.0.0.1 - -volumes: -- name: data - hostPath: - path: "{{ bluespice_base_path }}/{{ item.key }}/data" - type: Directory diff --git a/roles/apps/collabora/code/contrib/extract-coolwsdxml.sh b/roles/apps/collabora/code/contrib/extract-coolwsdxml.sh index 3f1a2f9e..26496ea7 100755 --- a/roles/apps/collabora/code/contrib/extract-coolwsdxml.sh +++ b/roles/apps/collabora/code/contrib/extract-coolwsdxml.sh @@ -8,7 +8,7 @@ VERSION="$1" IMAGE_TAG="$VERSION" IMAGE_NAME="collabora/code" -CONF_D=$(realpath "${BASH_SOURCE%/*}/../templates/config") +CONF_D=$(realpath "${BASH_SOURCE%/*}/../instance/templates/config") CONTAINER_NAME="collabora-code-coolwsd.xml-extractor" sudo docker rm "$CONTAINER_NAME" > /dev/null 2>&1 diff --git a/roles/apps/collabora/code/contrib/extract-loolwsdxml.sh b/roles/apps/collabora/code/contrib/extract-loolwsdxml.sh deleted file mode 100755 index ab4e5fb4..00000000 --- a/roles/apps/collabora/code/contrib/extract-loolwsdxml.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash - -if [ -z "$1" ]; then - echo "Usage: $0 <version>" - exit 1 -fi -VERSION="$1" - -IMAGE_TAG="$VERSION" -IMAGE_NAME="collabora/code" -CONF_D=$(realpath "${BASH_SOURCE%/*}/../templates/config") -CONTAINER_NAME="collabora-code-loolwsd.xml-extractor" - -sudo docker rm "$CONTAINER_NAME" > /dev/null 2>&1 - -set -e -sudo docker create --name "$CONTAINER_NAME" "$IMAGE_NAME:$IMAGE_TAG" /bin/true -sudo docker cp --archive=false "$CONTAINER_NAME:/etc/loolwsd/loolwsd.xml" - | tar -xO loolwsd.xml > "$CONF_D/loolwsd.$VERSION.xml.j2" -sudo docker rm "$CONTAINER_NAME" - -echo "" -echo "File extraction was sucessful! Now snyc the config file with existing ones." -echo "" -echo "you might also want to delete the image:" -echo "" -echo " sudo docker rmi '$IMAGE_NAME:$IMAGE_TAG'" -echo "" diff --git a/roles/apps/collabora/code/defaults/main.yml b/roles/apps/collabora/code/defaults/main.yml index ef0699c1..932c2168 100644 --- a/roles/apps/collabora/code/defaults/main.yml +++ b/roles/apps/collabora/code/defaults/main.yml @@ -1,22 +1,27 @@ --- -collabora_code_base_path: /srv/collabora/code - # collabora_code_instances: # example: # version: 4.0.6.1 # port: 8200 -# hostname: office.example.com +# storage: +# type: ... +# publish: +# zone: "{{ apps_publish_zone__foo }}" +# hostnames: +# - office.example.com +# tls: +# certificate_provider: ... # admin: # username: admin # password: S3cret -# backend_storages: -# - cloud.example.com -# macros: # optional (by default allowed=false) -# allowed: true -# security_level: 1 -# custom_image: # optional -# from: foo/bar:1.0 # optional -# dockerfile: | -# USER root -# RUN apt-get install ... -# USER 101 +# backend_storages: +# - cloud.example.com +# macros: # optional (by default allowed=false) +# allowed: true +# security_level: 1 +# custom_image: # optional +# from: foo/bar:1.0 # optional +# dockerfile: | +# USER root +# RUN apt-get install ... +# USER 101 diff --git a/roles/apps/collabora/code/filter_plugins/collabora_code.py b/roles/apps/collabora/code/filter_plugins/collabora_code.py deleted file mode 100644 index 2bd6959e..00000000 --- a/roles/apps/collabora/code/filter_plugins/collabora_code.py +++ /dev/null @@ -1,25 +0,0 @@ -from __future__ import (absolute_import, division, print_function) -__metaclass__ = type - -from ansible import errors - - -def collabora_code_loolvcool(version): - try: - ver_maj = version.split('.')[0] - if int(ver_maj) > 6: - return False - return True - except Exception as e: - raise errors.AnsibleFilterError("collabora_code_loolvcool(): %s" % str(e)) - - -class FilterModule(object): - - ''' collabora code filters ''' - filter_map = { - 'collabora_code_loolvcool': collabora_code_loolvcool, - } - - def filters(self): - return self.filter_map diff --git a/roles/apps/collabora/code/instance/tasks/custom-image.yml b/roles/apps/collabora/code/instance/tasks/custom-image.yml new file mode 100644 index 00000000..212fff36 --- /dev/null +++ b/roles/apps/collabora/code/instance/tasks/custom-image.yml @@ -0,0 +1,24 @@ +--- +- name: create build directory for custom image + file: + path: "{{ collabora_code_instance_basepath }}/build" + state: directory + +- name: generate Dockerfile for custom image + copy: + content: | + FROM {{ collabora_code_instances[collabora_code_instance].custom_image.from | default('collabora/code:' + collabora_code_instances[collabora_code_instance].version) }} + {{ collabora_code_instances[collabora_code_instance].custom_image.dockerfile }} + dest: "{{ collabora_code_instance_basepath }}/build/Dockerfile" + register: collabora_code_custom_image_docker + +- name: build custom image + docker_image: + name: "collabora/code/{{ collabora_code_instance }}:{{ collabora_code_instances[collabora_code_instance].version }}" + state: present + force_source: "{{ collabora_code_custom_image_docker is changed }}" + source: build + build: + path: "{{ collabora_code_instance_basepath }}/build" + network: host + pull: yes diff --git a/roles/apps/collabora/code/instance/tasks/main.yml b/roles/apps/collabora/code/instance/tasks/main.yml new file mode 100644 index 00000000..b0470a5b --- /dev/null +++ b/roles/apps/collabora/code/instance/tasks/main.yml @@ -0,0 +1,95 @@ +--- +- name: prepare storage volume + vars: + storage_volume: "{{ collabora_code_instances[collabora_code_instance].storage }}" + include_role: + name: "storage/{{ collabora_code_instances[collabora_code_instance].storage.type }}/volume" + +- set_fact: + collabora_code_instance_basepath: "{{ storage_volume_mountpoint }}" + +- name: create instance config directory + file: + path: "{{ collabora_code_instance_basepath }}/config" + state: directory + mode: 0750 + +- name: generate configuration file + template: + src: "config/coolwsd.{{ collabora_code_instances[collabora_code_instance].version }}.xml.j2" + dest: "{{ collabora_code_instance_basepath }}/config/coolwsd.xml" + +- name: generate/install TLS certificates for publishment + vars: + x509_certificate_name: "collabora-code-{{ collabora_code_instance }}_publish" + x509_certificate_hostnames: [] + x509_certificate_config: + ca: "{{ collabora_code_instances[collabora_code_instance].publish.zone.certificate_ca_config }}" + cert: + common_name: "collabora-code-{{ collabora_code_instance }}.{{ inventory_hostname }}" + extended_key_usage: + - serverAuth + extended_key_usage_critical: yes + create_subject_key_identifier: yes + not_after: +100w + x509_certificate_renewal: + install: + - dest: "{{ collabora_code_instance_basepath }}/config/ca-chain.cert.pem" + src: + - ca_cert + mode: "0400" + owner: 100 + - dest: "{{ collabora_code_instance_basepath }}/config/cert.pem" + src: + - cert + mode: "0400" + owner: 100 + - dest: "{{ collabora_code_instance_basepath }}/config/key.pem" + src: + - key + owner: 100 + mode: "0400" + include_role: + name: "x509/{{ collabora_code_instances[collabora_code_instance].publish.zone.certificate_provider }}/cert" + +- name: build custom image + when: "'custom_image' in collabora_code_instances[collabora_code_instance]" + include_tasks: custom-image.yml + +- name: install pod manifest + vars: + kubernetes_standalone_pod: + name: "collabora-code-{{ collabora_code_instance }}" + spec: "{{ lookup('template', 'pod-spec.yml.j2') }}" + mode: "0600" + config_hash_items: + - path: "{{ collabora_code_instance_basepath }}/config/coolwsd.xml" + properties: + - checksum + include_role: + name: kubernetes/standalone/pod + +- name: render nginx-vhost custom config + set_fact: + collabora_code_nginx_vhost_custom: "{{ lookup('template', 'nginx-vhost.conf.j2') }}" + +- name: configure nginx vhost for publishment + vars: + nginx_vhost__yaml: | + name: "collabora-code-{{ collabora_code_instance }}.{{ inventory_hostname }}" + template: generic + {% if 'tls' in collabora_code_instances[collabora_code_instance].publish %} + tls: + {{ collabora_code_instances[collabora_code_instance].publish.tls | to_nice_yaml(indent=2) | indent(2) }} + {% endif %} + hostnames: + {% for hostname in collabora_code_instances[collabora_code_instance].publish.hostnames %} + - {{ hostname }} + {% endfor %} + custom: | + {{ collabora_code_nginx_vhost_custom | indent(2) }} + nginx_vhost: "{{ nginx_vhost__yaml | from_yaml }}" + include_role: + name: nginx/vhost + apply: + delegate_to: "{{ collabora_code_instances[collabora_code_instance].publish.zone.publisher }}" diff --git a/roles/apps/collabora/code/templates/config/coolwsd.21.11.1.3.1.xml.j2 b/roles/apps/collabora/code/instance/templates/config/coolwsd.21.11.1.3.1.xml.j2 index 05e9e3fa..b902dea9 100644 --- a/roles/apps/collabora/code/templates/config/coolwsd.21.11.1.3.1.xml.j2 +++ b/roles/apps/collabora/code/instance/templates/config/coolwsd.21.11.1.3.1.xml.j2 @@ -13,7 +13,7 @@ <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - <server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> + <server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ collabora_code_instances[collabora_code_instance].publish.hostnames[0] }}</server_name> <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing cool." type="path" relative="true" default="browser/../"></file_server_root_path> <hexify_embedded_urls desc="Enable to protect encoded URLs from getting decoded by intermediate hops. Particularly useful on Azure deployments" type="bool" default="false"></hexify_embedded_urls> @@ -163,8 +163,8 @@ <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs> - <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic, Beanshell, Javascript and Python scripts. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ item.value.macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> - <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ item.value.macros.security_level | default('1') }}</macro_security_level> + <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic, Beanshell, Javascript and Python scripts. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ collabora_code_instances[collabora_code_instance].macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> + <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ collabora_code_instances[collabora_code_instance].macros.security_level | default('1') }}</macro_security_level> <enable_metrics_unauthenticated desc="When enabled, the /cool/getMetrics endpoint will not require authentication." type="bool" default="false">false</enable_metrics_unauthenticated> </security> @@ -191,7 +191,7 @@ <filesystem allow="false" /> <wopi desc="Allow/deny wopi storage." allow="true"> <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> -{% for backend in item.value.backend_storages %} +{% for backend in collabora_code_instances[collabora_code_instance].backend_storages %} <host allow="true">{{ backend }}</host> {% endfor %} <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> @@ -214,8 +214,8 @@ <admin_console desc="Web admin console settings."> <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or coolconfig to set up a secure password.">{{ item.value.admin.password }}</password> + <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ collabora_code_instances[collabora_code_instance].admin.username }}</username> + <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or coolconfig to set up a secure password.">{{ collabora_code_instances[collabora_code_instance].admin.password }}</password> </admin_console> <monitors desc="Addresses of servers we connect to on start for monitoring"> diff --git a/roles/apps/collabora/code/templates/config/coolwsd.23.05.5.2.1.xml.j2 b/roles/apps/collabora/code/instance/templates/config/coolwsd.23.05.5.2.1.xml.j2 index 4b002328..7c4a263a 100644 --- a/roles/apps/collabora/code/templates/config/coolwsd.23.05.5.2.1.xml.j2 +++ b/roles/apps/collabora/code/instance/templates/config/coolwsd.23.05.5.2.1.xml.j2 @@ -38,7 +38,7 @@ <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - <server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> + <server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ collabora_code_instances[collabora_code_instance].publish.hostnames[0] }}</server_name> <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing cool." type="path" relative="true" default="browser/../"></file_server_root_path> <hexify_embedded_urls desc="Enable to protect encoded URLs from getting decoded by intermediate hops. Particularly useful on Azure deployments" type="bool" default="false"></hexify_embedded_urls> <experimental_features desc="Enable/Disable experimental features" type="bool" default="true">true</experimental_features> @@ -194,8 +194,8 @@ <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs> - <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic and Python scripts to execute both installed and from documents. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ item.value.macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> - <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ item.value.macros.security_level | default('1') }}</macro_security_level> + <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic and Python scripts to execute both installed and from documents. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ collabora_code_instances[collabora_code_instance].macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> + <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ collabora_code_instances[collabora_code_instance].macros.security_level | default('1') }}</macro_security_level> <enable_websocket_urp desc="Should we enable URP (UNO remote protocol) communication over the websocket. This allows full control of the Kit child server to anyone with access to the websocket including executing macros without confirmation or running arbitrary shell commands in the jail." type="bool" default="false">false</enable_websocket_urp> <enable_metrics_unauthenticated desc="When enabled, the /cool/getMetrics endpoint will not require authentication." type="bool" default="false">false</enable_metrics_unauthenticated> </security> @@ -224,7 +224,7 @@ </locking> <alias_groups desc="default mode is 'first' it allows only the first host when groups are not defined. set mode to 'groups' and define group to allow multiple host and its aliases" mode="groups"> -{% for backend in item.value.backend_storages %} +{% for backend in collabora_code_instances[collabora_code_instance].backend_storages %} <group> <host allow="true">https://{{ backend }}:443</host> </group> @@ -245,8 +245,8 @@ <admin_console desc="Web admin console settings."> <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or coolconfig to set up a secure password.">{{ item.value.admin.password }}</password> + <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ collabora_code_instances[collabora_code_instance].admin.username }}</username> + <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or coolconfig to set up a secure password.">{{ collabora_code_instances[collabora_code_instance].admin.password }}</password> <logging desc="Log admin activities irrespective of logging.level"> <admin_login desc="log when an admin logged into the console" type="bool" default="true">true</admin_login> <metrics_fetch desc="log when metrics endpoint is accessed and metrics endpoint authentication is enabled" type="bool" default="true">true</metrics_fetch> diff --git a/roles/apps/collabora/code/templates/config/coolwsd.23.05.6.4.1.xml.j2 b/roles/apps/collabora/code/instance/templates/config/coolwsd.23.05.6.4.1.xml.j2 index 4d4ac71c..aaccd7d0 100644 --- a/roles/apps/collabora/code/templates/config/coolwsd.23.05.6.4.1.xml.j2 +++ b/roles/apps/collabora/code/instance/templates/config/coolwsd.23.05.6.4.1.xml.j2 @@ -38,7 +38,7 @@ <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - <server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> + <server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ collabora_code_instances[collabora_code_instance].publish.hostnames[0] }}</server_name> <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing cool." type="path" relative="true" default="browser/../"></file_server_root_path> <hexify_embedded_urls desc="Enable to protect encoded URLs from getting decoded by intermediate hops. Particularly useful on Azure deployments" type="bool" default="false"></hexify_embedded_urls> <experimental_features desc="Enable/Disable experimental features" type="bool" default="true">true</experimental_features> @@ -209,8 +209,8 @@ <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs> - <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic and Python scripts to execute both installed and from documents. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ item.value.macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> - <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ item.value.macros.security_level | default('1') }}</macro_security_level> + <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic and Python scripts to execute both installed and from documents. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ collabora_code_instances[collabora_code_instance].macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> + <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ collabora_code_instances[collabora_code_instance].macros.security_level | default('1') }}</macro_security_level> <enable_websocket_urp desc="Should we enable URP (UNO remote protocol) communication over the websocket. This allows full control of the Kit child server to anyone with access to the websocket including executing macros without confirmation or running arbitrary shell commands in the jail." type="bool" default="false">false</enable_websocket_urp> <enable_metrics_unauthenticated desc="When enabled, the /cool/getMetrics endpoint will not require authentication." type="bool" default="false">false</enable_metrics_unauthenticated> </security> @@ -239,7 +239,7 @@ </locking> <alias_groups desc="default mode is 'first' it allows only the first host when groups are not defined. set mode to 'groups' and define group to allow multiple host and its aliases" mode="groups"> -{% for backend in item.value.backend_storages %} +{% for backend in collabora_code_instances[collabora_code_instance].backend_storages %} <group> <host allow="true">https://{{ backend }}:443</host> </group> @@ -260,8 +260,8 @@ <admin_console desc="Web admin console settings."> <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or coolconfig to set up a secure password.">{{ item.value.admin.password }}</password> + <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ collabora_code_instances[collabora_code_instance].admin.username }}</username> + <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or coolconfig to set up a secure password.">{{ collabora_code_instances[collabora_code_instance].admin.password }}</password> <logging desc="Log admin activities irrespective of logging.level"> <admin_login desc="log when an admin logged into the console" type="bool" default="true">true</admin_login> <metrics_fetch desc="log when metrics endpoint is accessed and metrics endpoint authentication is enabled" type="bool" default="true">true</metrics_fetch> diff --git a/roles/apps/collabora/code/instance/templates/config/coolwsd.24.04.6.2.1.xml.j2 b/roles/apps/collabora/code/instance/templates/config/coolwsd.24.04.6.2.1.xml.j2 new file mode 100644 index 00000000..aab67a87 --- /dev/null +++ b/roles/apps/collabora/code/instance/templates/config/coolwsd.24.04.6.2.1.xml.j2 @@ -0,0 +1,340 @@ +<!-- -*- nxml-child-indent: 4; tab-width: 4; indent-tabs-mode: nil -*- --> +<config> + + <!-- For more detailed documentation on typical configuration options please see: + https://sdk.collaboraonline.com/docs/installation/Configuration.html --> + + <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> + <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> + + <accessibility desc="Accessibility settings"> + <enable type="bool" desc="Controls whether accessibility support should be enabled or not." default="false">false</enable> + </accessibility> + + <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> + + <!-- + These are the settings of external (remote) spellchecker and grammar checker services. Currently LanguageTool and Duden Korrekturserver APIs are supported, you can + set either of them. By default they are disabled. To turn the support on, please set "enabled" property to true. It works with self hosted or cloud services, free + and premium as well. The "base_url" may be https://api.languagetoolplus.com/v2 if the cloud version of LanguageTool is used. Please note that your data in the + document e.g. the text part of it will be sent to the cloud API. Please read the respective privacy policies, e.g. https://languagetool.org/legal/privacy. + --> + <languagetool desc="Remote API settings for spell and grammar checking"> + <enabled desc="Enable Remote Spell and Grammar Checker" type="bool" default="false"></enabled> + <base_url desc="HTTP endpoint for the API server, without /check or /languages postfix at the end." type="string" default=""></base_url> + <user_name desc="LanguageTool or Duden account username for premium usage." type="string" default=""></user_name> + <api_key desc="API key provided by LanguageTool or Duden account for premium usage." type="string" default=""></api_key> + <ssl_verification desc="Enable or disable SSL verification. You may have to disable it in test environments with self-signed certificates." type="string" default="true"></ssl_verification> + <rest_protocol desc="REST API protocol. For LanguageTool leave it blank, for Duden Korrekturserver use the string 'duden'." type="string" default=""></rest_protocol> + </languagetool> + + <deepl desc="DeepL API settings for translation service"> + <enabled desc="If true, shows translate option as a menu entry in the compact view and as an icon in the tabbed view." type="bool" default="false">false</enabled> + <api_url desc="URL for the API" type="string" default=""></api_url> + <auth_key desc="Auth Key generated by your account" type="string" default=""></auth_key> + </deepl> + + <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> + <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> + <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> + <mount_namespaces desc="Use mount namespaces instead of coolmount." type="bool" default="true"></mount_namespaces> + + <server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ collabora_code_instances[collabora_code_instance].publish.hostnames[0] }}</server_name> + <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing cool." type="path" relative="true" default="browser/../"></file_server_root_path> + <hexify_embedded_urls desc="Enable to protect encoded URLs from getting decoded by intermediate hops. Particularly useful on Azure deployments" type="bool" default="false"></hexify_embedded_urls> + <experimental_features desc="Enable/Disable experimental features" type="bool" default="true">true</experimental_features> + + <memproportion desc="The maximum percentage of available memory consumed by all of the Collabora Online Development Edition processes, after which we start cleaning up idle documents. If cgroup memory limits are set, this is the maximum percentage of that limit to consume." type="double" default="80.0"></memproportion> + <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="4">4</num_prespawn_children> + <!-- <fetch_update_check desc="Every number of hours will fetch latest version data. Defaults to 10 hours." type="uint" default="10">10</fetch_update_check> --> + <!-- <allow_update_popup desc="Allows notification about an update in the editor" type="bool" default="true">true</allow_update_popup> --> + <per_document desc="Document-specific settings, including LO Core settings."> + <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> + <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> + <bgsave_priority desc="A (lower) priority for use by background save processes to free time for interactive ones" type="uint" default="5">5</bgsave_priority> + <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> + <pdf_resolution_dpi desc="The resolution, in DPI, used to render PDF documents as image. Memory consumption grows proportionally. Must be a positive value less than 385. Defaults to 96." type="uint" default="96">96</pdf_resolution_dpi> + <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> + <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Disabled when 0. Defaults to 30 seconds." type="uint" default="30">30</idlesave_duration_secs> + <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Disabled when 0. Defaults to 5 minutes." type="uint" default="300">300</autosave_duration_secs> + <background_autosave desc="Allow auto-saves to occur in a forked background process where possible." type="bool" default="true">true</background_autosave> + <background_manualsave desc="Allow manual save to occur in a forked background process where possible" type="bool" default="true">true</background_manualsave> + <always_save_on_exit desc="On exiting the last editor, always perform a save and upload if the document had been modified. This is to allow the storage to store the document, if it had skipped doing so, previously, as an optimization." type="bool" default="false">false</always_save_on_exit> + <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> + <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> + <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> + <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> + <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> + <limit_store_failures desc="Maximum number of consecutive save-and-upload to storage failures when unloading the document. 0 for unlimited (not recommended)." type="uint" default="5">5</limit_store_failures> + <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> + <min_time_between_saves_ms desc="Minimum number of milliseconds between saving the document on disk." type="uint" default="500">500</min_time_between_saves_ms> + <min_time_between_uploads_ms desc="Minimum number of milliseconds between uploading the document to storage." type="uint" default="5000">5000</min_time_between_uploads_ms> + <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="true"> + <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> + <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> + <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> + <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> + <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> + <lost_kit_grace_period_secs desc="The minimum grace period for a lost kit process (not referenced by coolwsd) to resolve its lost status before it is terminated. To disable the cleanup of lost kits use value 0" default="120">120</lost_kit_grace_period_secs> + </cleanup> + </per_document> + + <per_view desc="View-specific settings."> + <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 300 seconds." type="uint" default="300">300</out_of_focus_timeout_secs> + <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> + <custom_os_info desc="Custom string shown as OS version in About dialog, get from system if empty." type="string" default=""></custom_os_info> + </per_view> + + <ver_suffix desc="Appended to etags to allow easy refresh of changed files during development" type="string" default=""></ver_suffix> + + <logging> + <color type="bool">true</color> + <!-- + Note to developers: When you do "make run", the logging.level will be set on the + coolwsd command line, so if you want to change it for your testing, do it in + Makefile.am, not here. + --> + <level type="string" desc="Can be 0-8 (with the lowest numbers being the least verbose), or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> + <level_startup type="string" desc="As for level - but for the initial startup phase which is most problematic, logging reverts to level configured above when startup is complete" default="trace">trace</level_startup> + <disabled_areas type="string" desc="High verbosity logging ie. info to trace are disable-able, comma separated: Generic, Pixel, Socket, WebSocket, Http, WebServer, Storage, WOPI, Admin, Javascript" default="Socket,WebSocket,Admin">Socket,WebSocket,Admin,Pixel</disabled_areas> + <most_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from the client can not set a more verbose log level than this" default="notice">notice</most_verbose_level_settable_from_client> + <least_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from a client can not set a less verbose log level than this" default="fatal">fatal</least_verbose_level_settable_from_client> + <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> + <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" + See also: https://docs.libreoffice.org/sal/html/sal_log.html --> + <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> + <file enable="false"> + <!-- If you use other path than /var/log and you run coolwsd from systemd, make sure that you enable that path in coolwsd.service (ReadWritePaths). --> + <property name="path" desc="Log file path.">/var/log/coolwsd.log</property> + <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> + <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> + <property name="compress" desc="Enable/disable log file compression.">true</property> + <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> + <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> + <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> + <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> + </file> + <anonymize> + <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> + <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> + </anonymize> + <docstats type="bool" desc="Enable to see document handling information in logs." default="false">false</docstats> + <userstats desc="Enable user stats. i.e: logs the details of a file and user" type="bool" default="false">false</userstats> + <disable_server_audit type="bool" desc="Disabled server audit dialog and notification. Admin will no longer see warnings in the application user interface. This doesn't affect log file." default="false">false</disable_server_audit> + </logging> + + <!-- + Note to developers: When you do "make run", the trace_event[@enable] will be set on the + coolwsd command line, so if you want to change it for your testing, do it in Makefile.am, + not here. + --> + <trace_event desc="The possibility to turn on generation of a Chrome Trace Event file" enable="false"> + <path desc="Output path for the Trace Event file, to which they will be written if turned on at run-time" type="string" default="/var/log/coolwsd.trace.json">/var/log/coolwsd.trace.json</path> + </trace_event> + + <browser_logging desc="Logging in the browser console" default="false">false</browser_logging> + + <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> + <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/cooltrace-%.gz" compress="true" snapshot="false"></path> + <filter> + <message desc="Regex pattern of messages to exclude"></message> + </filter> + <outgoing> + <record desc="Whether or not to record outgoing messages" default="false">false</record> + </outgoing> + </trace> + + <net desc="Network settings"> + <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, coolwsd unexpectedly listens on [::1] only. + You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> + <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> + <listen type="string" default="any" desc="Listen address that coolwsd binds to. Can be 'any' or 'loopback'.">any</listen> + <!-- this allows you to shift all of our URLs into a sub-path from + https://my.com/browser/a123... to https://my.com/my/sub/path/browser/a123... --> + <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> + <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> + <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> + <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> + <host desc="The IPv6 loopback (localhost) address.">::1</host> + <host desc="The IPv4 private 172.16.0.0/12 subnet part 1.">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="The IPv4 private 172.16.0.0/12 subnet part 2.">172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="The IPv4 private 172.16.0.0/12 subnet part 3.">172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="The IPv4 private 10.0.0.0/8 subnet (Podman).">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host> + </post_allow> + <lok_allow desc="Allowed hosts as an external data source inside edited files. All allowed post_allow.host and storage.wopi entries are also considered to be allowed as a data source. Used for example in: PostMessage Action_InsertGraphics, =WEBSERVICE() function, external reference in the cell."> + <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> + <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> + <host desc="The IPv6 loopback (localhost) address.">::1</host> + <host desc="The IPv4 private 172.16.0.0/12 subnet part 1.">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="The IPv4 private 172.16.0.0/12 subnet part 2.">172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="The IPv4 private 172.16.0.0/12 subnet part 3.">172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="The IPv4 private 10.0.0.0/8 subnet (Podman).">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host> + <host desc="Localhost access by name">localhost</host> + </lok_allow> + <content_security_policy desc="Customize the CSP header by specifying one or more policy-directive, separated by semicolons. See w3.org/TR/CSP2"></content_security_policy> + <frame_ancestors desc="OBSOLETE: Use content_security_policy. Specify who is allowed to embed the Collabora Online iframe (coolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> + <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by coolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> + + <!-- this setting radically changes how online works, it should not be used in a production environment --> + <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> + </net> + + <ssl desc="SSL settings"> + <!-- switches from https:// + wss:// to http:// + ws:// --> + <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> + <!-- SSL off-load can be done in a proxy, if so disable SSL, and enable termination below in production --> + <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> + <cert_file_path desc="Path to the cert file" relative="false">/etc/coolwsd/cert.pem</cert_file_path> + <key_file_path desc="Path to the key file" relative="false">/etc/coolwsd/key.pem</key_file_path> + <ca_file_path desc="Path to the ca file" relative="false">/etc/coolwsd/ca-chain.cert.pem</ca_file_path> + <ssl_verification desc="Enable or disable SSL verification of hosts remote to coolwsd. If true SSL verification will be strict, otherwise certs of hosts will not be verified. You may have to disable it in test environments with self-signed certificates." type="string" default="false">false</ssl_verification> + <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> + <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> + <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> + <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> + <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> + <pin></pin> + </pins> + </hpkp> + <sts desc="Strict-Transport-Security settings, per rfc6797. Subdomains are always included."> + <enabled desc="Whether or not Strict-Transport-Security is enabled. Enable only when ready for production. Cannot be disabled without resetting the browsers." type="bool" default="false">false</enabled> + <max_age desc="Strict-Transport-Security max-age directive, in seconds. 0 is allowed; please see rfc6797 for details. Defaults to 1 year." type="int" default="31536000">31536000</max_age> + </sts> + </ssl> + + <security desc="Altering these defaults potentially opens you to significant risk"> + <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> + + <!-- deprecated: If capabilities is 'false', coolwsd will assume mount_namespaces of 'true' to achieve + this goal, only avoiding chroot for process isolation if linux namespaces are unavailable --> + <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> + + <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs> + <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic and Python scripts to execute both installed and from documents. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ collabora_code_instances[collabora_code_instance].macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> + <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ collabora_code_instances[collabora_code_instance].macros.security_level | default('1') }}</macro_security_level> + <enable_websocket_urp desc="Should we enable URP (UNO remote protocol) communication over the websocket. This allows full control of the Kit child server to anyone with access to the websocket including executing macros without confirmation or running arbitrary shell commands in the jail." type="bool" default="false">false</enable_websocket_urp> + <enable_metrics_unauthenticated desc="When enabled, the /cool/getMetrics endpoint will not require authentication." type="bool" default="false">false</enable_metrics_unauthenticated> + </security> + + <certificates> + <database_path type="string" desc="Path to the NSS certificates that are used for signing documents" default=""></database_path> + </certificates> + + <watermark> + <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> + <text desc="Watermark text to be displayed on the document if entered" type="string"></text> + </watermark> + + + <user_interface> + <mode type="string" desc="Controls the user interface style. The 'default' means: Take the value from ui_defaults, or decide for one of compact or tabbed (default|compact|tabbed)" default="default">default</mode> + <use_integration_theme desc="Use theme from the integrator" type="bool" default="true">true</use_integration_theme> + </user_interface> + + <storage desc="Backend storage"> + <filesystem allow="false" /> + <wopi desc="Allow/deny wopi storage." allow="true"> + <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> + <locking desc="Locking settings"> + <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> + </locking> + + <alias_groups desc="default mode is 'first' it allows only the first host when groups are not defined. set mode to 'groups' and define group to allow multiple host and its aliases" mode="groups"> +{% for backend in collabora_code_instances[collabora_code_instance].backend_storages %} + <group> + <host allow="true">https://{{ backend }}:443</host> + </group> +{% endfor %} + </alias_groups> + + <is_legacy_server desc="Set to true for legacy server that need deprecated headers." type="bool" default="false"></is_legacy_server> + </wopi> + <ssl desc="SSL settings"> + <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> + <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and coolwsd. When empty this defaults to following the ssl.enable setting"></enable> + <cert_file_path desc="Path to the cert file. When empty this defaults to following the ssl.cert_file_path setting" relative="false"></cert_file_path> + <key_file_path desc="Path to the key file. When empty this defaults to following the ssl.key_file_path settinge" relative="false"></key_file_path> + <ca_file_path desc="Path to the ca file. When empty this defaults to following the ssl.ca_file_path setting" relative="false"></ca_file_path> + <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overridden only if absolutely needed."></cipher_list> + </ssl> + </storage> + + <admin_console desc="Web admin console settings."> + <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> + <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> + <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ collabora_code_instances[collabora_code_instance].admin.username }}</username> + <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or coolconfig to set up a secure password.">{{ collabora_code_instances[collabora_code_instance].admin.password }}</password> + <logging desc="Log admin activities irrespective of logging.level"> + <admin_login desc="log when an admin logged into the console" type="bool" default="true">true</admin_login> + <metrics_fetch desc="log when metrics endpoint is accessed and metrics endpoint authentication is enabled" type="bool" default="true">true</metrics_fetch> + <monitor_connect desc="log when external monitor gets connected" type="bool" default="true">true</monitor_connect> + <admin_action desc="log when admin does some action for example killing a process" type="bool" default="true">true</admin_action> + </logging> + </admin_console> + + <monitors desc="Addresses of servers we connect to on start for monitoring"> + <!-- <monitor desc="Address of the monitor and interval after which it should try reconnting after disconnect" retryInterval="20">wss://foobar:234/ws</monitor> --> + </monitors> + + <quarantine_files desc="Files are stored here to be examined later in cases of crashes or similar situation." default="false" enable="false"> + <limit_dir_size_mb desc="Maximum directory size, in MBs. On exceeding the specified limit, older files will be deleted." default="250" type="uint"></limit_dir_size_mb> + <max_versions_to_maintain desc="How many versions of the same file to keep." default="5" type="uint"></max_versions_to_maintain> + <path desc="Absolute path of the directory under which quarantined files will be stored. Do not use a relative path." type="path" relative="false"></path> + <expiry_min desc="Time in mins after quarantined files will be deleted." type="int" default="3000"></expiry_min> + </quarantine_files> + + <remote_config> + <remote_url desc="remote server to which you will send request to get remote config in response" type="string" default=""></remote_url> + </remote_config> + + <stop_on_config_change desc="Stop coolwsd whenever config files change." type="bool" default="false">false</stop_on_config_change> + + <remote_font_config> + <url desc="URL of optional JSON file that lists fonts to be included in Online" type="string" default=""></url> + </remote_font_config> + + <home_mode> + <enable desc="Enable more configuration options for home users" type="bool" default="false">false</enable> + </home_mode> + + <fonts_missing> + <handling desc="How to handle fonts mising in a document: 'report', 'log', 'both', or 'ignore'" type="string" default="log">log</handling> + </fonts_missing> + + <indirection_endpoint> + <url desc="URL endpoint to server which servers routeToken in json format" default=""></url> + <migration_timeout_secs desc="The maximum number of seconds waiting for shutdown migration message from indirection server before unloading an document. Defaults to 180 second." type="uint" default="180"></migration_timeout_secs> + </indirection_endpoint> + + + + + + <zotero desc="Zotero plugin configuration. For more details about Zotero visit https://www.zotero.org/"> + <enable desc="Enable Zotero plugin." type="bool" default="true">true</enable> + </zotero> + + <help_url desc="The Help root URL, or empty for no help (hides the Help buttons)" type="string" default="https://help.collaboraoffice.com/help.html?">https://help.collaboraoffice.com/help.html?</help_url> + + <overwrite_mode> + <enable desc="Enable overwrite mode (user can use insert key)" type="bool" default="true">true</enable> + </overwrite_mode> + + <wasm desc="WASM-specific settings"> + <enable desc="Enable WASM support" type="bool" default="false"></enable> + <force desc="When enabled, all requests are redirected to WASM." type="bool" default="false"></force> + </wasm> + +</config> diff --git a/roles/apps/collabora/code/instance/templates/nginx-vhost.conf.j2 b/roles/apps/collabora/code/instance/templates/nginx-vhost.conf.j2 new file mode 100644 index 00000000..a7248194 --- /dev/null +++ b/roles/apps/collabora/code/instance/templates/nginx-vhost.conf.j2 @@ -0,0 +1,113 @@ +client_max_body_size 128M; + +# static files +location ^~ /browser { + include snippets/proxy-nobuff.conf; + include snippets/proxy-forward-headers.conf; + + proxy_set_header Host $http_host; +{% if collabora_code_instances[collabora_code_instance].publish.zone.publisher == inventory_hostname %} + proxy_pass https://127.0.0.1:{{ collabora_code_instances[collabora_code_instance].port }}; +{% else %} + proxy_pass https://{{ ansible_default_ipv4.address }}:{{ collabora_code_instances[collabora_code_instance].port }}; +{% endif %} + proxy_ssl_trusted_certificate /etc/ssl/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}-ca-crt.pem; + proxy_ssl_verify on; + proxy_ssl_name collabora-code-{{ collabora_code_instance }}.{{ inventory_hostname }}; + proxy_ssl_protocols TLSv1.3; +} + +# WOPI discovery URL +location ^~ /hosting/discovery { + include snippets/proxy-nobuff.conf; + include snippets/proxy-forward-headers.conf; + + proxy_set_header Host $http_host; +{% if collabora_code_instances[collabora_code_instance].publish.zone.publisher == inventory_hostname %} + proxy_pass https://127.0.0.1:{{ collabora_code_instances[collabora_code_instance].port }}; +{% else %} + proxy_pass https://{{ ansible_default_ipv4.address }}:{{ collabora_code_instances[collabora_code_instance].port }}; +{% endif %} + proxy_ssl_trusted_certificate /etc/ssl/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}-ca-crt.pem; + proxy_ssl_verify on; + proxy_ssl_name collabora-code-{{ collabora_code_instance }}.{{ inventory_hostname }}; + proxy_ssl_protocols TLSv1.3; +} + +# Capabilities +location ^~ /hosting/capabilities { + include snippets/proxy-nobuff.conf; + include snippets/proxy-forward-headers.conf; + + proxy_set_header Host $http_host; +{% if collabora_code_instances[collabora_code_instance].publish.zone.publisher == inventory_hostname %} + proxy_pass https://127.0.0.1:{{ collabora_code_instances[collabora_code_instance].port }}; +{% else %} + proxy_pass https://{{ ansible_default_ipv4.address }}:{{ collabora_code_instances[collabora_code_instance].port }}; +{% endif %} + proxy_ssl_trusted_certificate /etc/ssl/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}-ca-crt.pem; + proxy_ssl_verify on; + proxy_ssl_name collabora-code-{{ collabora_code_instance }}.{{ inventory_hostname }}; + proxy_ssl_protocols TLSv1.3; +} + +# main websocket +location ~ ^/cool/(.*)/ws$ { + include snippets/proxy-nobuff.conf; + include snippets/proxy-forward-headers.conf; + + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + + proxy_read_timeout 36000s; + + proxy_set_header Host $http_host; +{% if collabora_code_instances[collabora_code_instance].publish.zone.publisher == inventory_hostname %} + proxy_pass https://127.0.0.1:{{ collabora_code_instances[collabora_code_instance].port }}; +{% else %} + proxy_pass https://{{ ansible_default_ipv4.address }}:{{ collabora_code_instances[collabora_code_instance].port }}; +{% endif %} + proxy_ssl_trusted_certificate /etc/ssl/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}-ca-crt.pem; + proxy_ssl_verify on; + proxy_ssl_name collabora-code-{{ collabora_code_instance }}.{{ inventory_hostname }}; + proxy_ssl_protocols TLSv1.3; +} + +# download, presentation and image upload +location ~ ^/(c|l)ool { + include snippets/proxy-nobuff.conf; + include snippets/proxy-forward-headers.conf; + + proxy_set_header Host $http_host; +{% if collabora_code_instances[collabora_code_instance].publish.zone.publisher == inventory_hostname %} + proxy_pass https://127.0.0.1:{{ collabora_code_instances[collabora_code_instance].port }}; +{% else %} + proxy_pass https://{{ ansible_default_ipv4.address }}:{{ collabora_code_instances[collabora_code_instance].port }}; +{% endif %} + proxy_ssl_trusted_certificate /etc/ssl/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}-ca-crt.pem; + proxy_ssl_verify on; + proxy_ssl_name collabora-code-{{ collabora_code_instance }}.{{ inventory_hostname }}; + proxy_ssl_protocols TLSv1.3; +} + +# Admin Console websocket +location ^~ /cool/adminws { + include snippets/proxy-nobuff.conf; + include snippets/proxy-forward-headers.conf; + + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + + proxy_read_timeout 36000s; + + proxy_set_header Host $http_host; +{% if collabora_code_instances[collabora_code_instance].publish.zone.publisher == inventory_hostname %} + proxy_pass https://127.0.0.1:{{ collabora_code_instances[collabora_code_instance].port }}; +{% else %} + proxy_pass https://{{ ansible_default_ipv4.address }}:{{ collabora_code_instances[collabora_code_instance].port }}; +{% endif %} + proxy_ssl_trusted_certificate /etc/ssl/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}/apps-publish-{{ collabora_code_instances[collabora_code_instance].publish.zone.name }}-ca-crt.pem; + proxy_ssl_verify on; + proxy_ssl_name collabora-code-{{ collabora_code_instance }}.{{ inventory_hostname }}; + proxy_ssl_protocols TLSv1.3; +} diff --git a/roles/apps/collabora/code/instance/templates/pod-spec.yml.j2 b/roles/apps/collabora/code/instance/templates/pod-spec.yml.j2 new file mode 100644 index 00000000..a01bafee --- /dev/null +++ b/roles/apps/collabora/code/instance/templates/pod-spec.yml.j2 @@ -0,0 +1,40 @@ +containers: +- name: collabora-code + image: "collabora/code{% if 'custom_image' in collabora_code_instances[collabora_code_instance] %}/{{ collabora_code_instance }}{% endif %}:{{ collabora_code_instances[collabora_code_instance].version }}" + resources: + limits: + memory: "4Gi" + env: + - name: "DONT_GEN_SSL_CERT" + value: "1" + volumeMounts: + - name: temp + mountPath: /opt/cool/child-roots + - name: config + mountPath: /etc/coolwsd/coolwsd.xml + subPath: coolwsd.xml + readOnly: true + - name: config + mountPath: /etc/coolwsd/ca-chain.cert.pem + subPath: cert.pem + readOnly: true + - name: config + mountPath: /etc/coolwsd/cert.pem + subPath: cert.pem + readOnly: true + - name: config + mountPath: /etc/coolwsd/key.pem + subPath: key.pem + readOnly: true + ports: + - containerPort: 9980 + hostPort: {{ collabora_code_instances[collabora_code_instance].port }} + hostIP: 127.0.0.1 +volumes: +- name: config + hostPath: + path: "{{ collabora_code_instance_basepath }}/config/" + type: Directory +- name: temp + emptyDir: + medium: Memory diff --git a/roles/apps/collabora/code/tasks/custom-image.yml b/roles/apps/collabora/code/tasks/custom-image.yml deleted file mode 100644 index 84f6b1ae..00000000 --- a/roles/apps/collabora/code/tasks/custom-image.yml +++ /dev/null @@ -1,24 +0,0 @@ ---- -- name: create build directory for custom image - file: - path: "{{ collabora_code_base_path }}/{{ item.key }}/build" - state: directory - -- name: generate Dockerfile for custom image - copy: - content: | - FROM {{ item.value.custom_image.from | default('collabora/code:' + item.value.version) }} - {{ item.value.custom_image.dockerfile }} - dest: "{{ collabora_code_base_path }}/{{ item.key }}/build/Dockerfile" - register: collabora_code_custom_image_docker - -- name: build custom image - docker_image: - name: "collabora/code/{{ item.key }}:{{ item.value.version }}" - state: present - force_source: "{{ collabora_code_custom_image_docker is changed }}" - source: build - build: - path: "{{ collabora_code_base_path }}/{{ item.key }}/build" - network: host - pull: yes diff --git a/roles/apps/collabora/code/tasks/main.yml b/roles/apps/collabora/code/tasks/main.yml index 84efec5c..11b3fee4 100644 --- a/roles/apps/collabora/code/tasks/main.yml +++ b/roles/apps/collabora/code/tasks/main.yml @@ -1,52 +1,7 @@ --- -- name: create collabora-code config subdirectory +- name: instance specific tasks loop: "{{ collabora_code_instances | list }}" - file: - path: "{{ collabora_code_base_path }}/{{ item }}/config" - state: directory - mode: 0750 - -- name: generate configuration file - loop: "{{ collabora_code_instances | dict2items }}" loop_control: - label: "{{ item.key }}" - template: - src: "config/{{ item.value.version | collabora_code_loolvcool | ternary('lool', 'cool') }}wsd.{{ item.value.version }}.xml.j2" - dest: "{{ collabora_code_base_path }}/{{ item.key }}/config/{{ item.value.version | collabora_code_loolvcool | ternary('lool', 'cool') }}wsd.xml" - -- name: remove legacy configuration file - loop: "{{ collabora_code_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - file: - path: "{{ collabora_code_base_path }}/{{ item.key }}/config/{{ item.value.version | collabora_code_loolvcool | ternary('cool', 'lool') }}wsd.xml" - state: absent - -- name: build custom image - loop: "{{ collabora_code_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - when: "'custom_image' in item.value" - include_tasks: custom-image.yml - -- name: install pod manifest - loop: "{{ collabora_code_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - vars: - kubernetes_standalone_pod: - name: "collabora-code-{{ item.key }}" - spec: "{{ lookup('template', 'pod-spec.yml.j2') }}" - mode: "0600" - config_hash_items: - - path: "{{ collabora_code_base_path }}/{{ item.key }}/config/{{ item.value.version | collabora_code_loolvcool | ternary('lool', 'cool') }}wsd.xml" - properties: - - checksum + loop_var: collabora_code_instance include_role: - name: kubernetes/standalone/pod - -- name: install nginx vhost config - loop: "{{ collabora_code_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - include_tasks: nginx-vhost.yml + name: apps/collabora/code/instance diff --git a/roles/apps/collabora/code/tasks/nginx-vhost.yml b/roles/apps/collabora/code/tasks/nginx-vhost.yml deleted file mode 100644 index afd8f1e0..00000000 --- a/roles/apps/collabora/code/tasks/nginx-vhost.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- -- name: render nginx-vhost custom config - set_fact: - collabora_code_nginx_vhost_custom: "{{ lookup('template', 'nginx-vhost.conf.j2') }}" - -- name: configure nginx vhost - vars: - nginx_vhost: - name: "collabora-code-{{ item.key }}" - template: generic - tls: - certificate_provider: "{{ acme_client }}" - hostnames: - - "{{ item.value.hostname }}" - custom: "{{ collabora_code_nginx_vhost_custom }}" - include_role: - name: nginx/vhost diff --git a/roles/apps/collabora/code/templates/config/loolwsd.6.4.0.14.xml.j2 b/roles/apps/collabora/code/templates/config/loolwsd.6.4.0.14.xml.j2 deleted file mode 100644 index cbdae29a..00000000 --- a/roles/apps/collabora/code/templates/config/loolwsd.6.4.0.14.xml.j2 +++ /dev/null @@ -1,179 +0,0 @@ -<config> - - <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> - <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> - - <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> - - <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> - <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> - <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - - <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> - <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path> - - <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion> - <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children> - <per_document desc="Document-specific settings, including LO Core settings."> - <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> - <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> - <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url> - <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> - <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> - <!-- Idle save and auto save are checked every 30 seconds --> - <!-- They are disabled when the value is zero or negative. --> - <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs> - <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs> - <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit> - <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> - <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> - <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> - <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> - <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> - <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> - <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false"> - <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> - <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> - <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> - <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> - <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> - </cleanup> - </per_document> - - <per_view desc="View-specific settings."> - <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs> - <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> - </per_view> - - <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html> - - <logging> - <color type="bool">true</color> - <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> - <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> - <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" - See also: https://docs.libreoffice.org/sal/html/sal_log.html --> - <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> - <file enable="false"> - <property name="path" desc="Log file path.">/var/log/loolwsd.log</property> - <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> - <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> - <property name="compress" desc="Enable/disable log file compression.">true</property> - <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> - <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> - <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> - <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> - </file> - <anonymize> - <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> - <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> - </anonymize> - </logging> - - <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging> - - <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> - <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path> - <filter> - <message desc="Regex pattern of messages to exclude"></message> - </filter> - <outgoing> - <record desc="Whether or not to record outgoing messages" default="false">false</record> - </outgoing> - </trace> - - <net desc="Network settings"> - <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only. - You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> - <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> - <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen> - <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> - <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> - <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> - <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> - <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> - <host desc="The IPv6 loopback (localhost) address.">::1</host> - <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - </post_allow> - <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> - <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> - </net> - - <ssl desc="SSL settings"> - <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> - <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> - <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path> - <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path> - <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> - <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> - <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> - <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> - <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> - <pin></pin> - </pins> - </hpkp> - </ssl> - - <security desc="Altering these defaults potentially opens you to significant risk"> - <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> - <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> - </security> - - <watermark> - <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> - <text desc="Watermark text to be displayed on the document if entered" type="string"></text> - </watermark> - - <welcome> - <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">false</enable> - <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button> - <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path> - </welcome> - - <user_interface> - <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode> - </user_interface> - - <storage desc="Backend storage"> - <filesystem allow="false" /> - <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true"> - <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> -{% for backend in item.value.backend_storages %} - <host allow="true">{{ backend }}</host> -{% endfor %} - <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> - <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies> - <locking desc="Locking settings"> - <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> - </locking> - </wopi> - <webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false"> - <host desc="Hostname to allow" allow="false">localhost</host> - </webdav> - <ssl desc="SSL settings"> - <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> - <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable> - <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path> - <key_file_path desc="Path to the key file" relative="false"></key_file_path> - <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list> - </ssl> - </storage> - - <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent> - - <admin_console desc="Web admin console settings."> - <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> - <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">{{ item.value.admin.password }}</password> - </admin_console> - - <monitors desc="Addresses of servers we connect to on start for monitoring"> - </monitors> - -</config> diff --git a/roles/apps/collabora/code/templates/config/loolwsd.6.4.10.2.xml.j2 b/roles/apps/collabora/code/templates/config/loolwsd.6.4.10.2.xml.j2 deleted file mode 100644 index 7f6c7c0f..00000000 --- a/roles/apps/collabora/code/templates/config/loolwsd.6.4.10.2.xml.j2 +++ /dev/null @@ -1,192 +0,0 @@ -<!-- -*- nxml-child-indent: 4; tab-width: 4; indent-tabs-mode: nil -*- --> - -<config> - - <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> - <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> - - <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> - - <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> - <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> - <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - - <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> - <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path> - - <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion> - <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children> - <per_document desc="Document-specific settings, including LO Core settings."> - <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> - <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> - <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url> - <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> - <pdf_resolution_dpi desc="The resolution, in DPI, used to render PDF documents as image. Memory consumption grows proportionally. Must be a positive value less than 385. Defaults to 96." type="uint" default="96">96</pdf_resolution_dpi> - <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> - <!-- Idle save and auto save are checked every 30 seconds --> - <!-- They are disabled when the value is zero or negative. --> - <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs> - <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs> - <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit> - <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> - <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> - <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> - <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> - <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> - <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> - <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false"> - <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> - <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> - <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> - <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> - <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> - <lost_kit_grace_period_secs desc="The minimum grace period for a lost kit process (not referenced by loolwsd) to resolve its lost status before it is terminated. To disable the cleanup of lost kits use value 0" default="120">120</lost_kit_grace_period_secs> - </cleanup> - </per_document> - - <per_view desc="View-specific settings."> - <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs> - <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> - </per_view> - - <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html> - - <logging> - <color type="bool">true</color> - <level type="string" desc="Can be 0-8 (with the lowest numbers being the least verbose), or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> - <most_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from the client can not set a more verbose log level than this" default="notice">notice</most_verbose_level_settable_from_client> - <least_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from a client can not set a less verbose log level than this" default="fatal">fatal</least_verbose_level_settable_from_client> - <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> - <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" - See also: https://docs.libreoffice.org/sal/html/sal_log.html --> - <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> - <file enable="false"> - <!-- If you use other path than /var/log and you run loolwsd from systemd, make sure that you enable that path in loolwsd.service (ReadWritePaths). --> - <property name="path" desc="Log file path.">/var/log/loolwsd.log</property> - <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> - <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> - <property name="compress" desc="Enable/disable log file compression.">true</property> - <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> - <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> - <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> - <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> - </file> - <anonymize> - <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> - <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> - </anonymize> - </logging> - - <trace_event desc="The possibility to turn on generation of a Chrome Trace Event file" enable="false"> - <path desc="Output path for the Trace Event file, to which they will be written if turned on at run-time" type="string" default="/var/log/loolwsd.trace.json">/var/log/loolwsd.trace.json</path> - </trace_event> - - <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging> - - <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> - <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path> - <filter> - <message desc="Regex pattern of messages to exclude"></message> - </filter> - <outgoing> - <record desc="Whether or not to record outgoing messages" default="false">false</record> - </outgoing> - </trace> - - <net desc="Network settings"> - <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only. - You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> - <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> - <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen> - <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> - <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> - <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> - <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> - <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> - <host desc="The IPv6 loopback (localhost) address.">::1</host> - <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - </post_allow> - <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> - <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> - </net> - - <ssl desc="SSL settings"> - <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> - <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> - <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path> - <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path> - <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> - <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> - <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> - <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> - <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> - <pin></pin> - </pins> - </hpkp> - </ssl> - - <security desc="Altering these defaults potentially opens you to significant risk"> - <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> - <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> - <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs> - <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic, Beanshell, Javascript and Python scripts. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ item.value.macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> - <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ item.value.macros.security_level | default('1') }}</macro_security_level> - </security> - - <watermark> - <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> - <text desc="Watermark text to be displayed on the document if entered" type="string"></text> - </watermark> - - <welcome> - <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">false</enable> - <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button> - <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path> - </welcome> - - <user_interface> - <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode> - </user_interface> - - <storage desc="Backend storage"> - <filesystem allow="false" /> - <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true"> - <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> -{% for backend in item.value.backend_storages %} - <host allow="true">{{ backend }}</host> -{% endfor %} - <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> - <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies> - <locking desc="Locking settings"> - <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> - </locking> - </wopi> - <ssl desc="SSL settings"> - <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> - <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable> - <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path> - <key_file_path desc="Path to the key file" relative="false"></key_file_path> - <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list> - </ssl> - </storage> - - <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent> - - <admin_console desc="Web admin console settings."> - <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> - <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">{{ item.value.admin.password }}</password> - </admin_console> - - <monitors desc="Addresses of servers we connect to on start for monitoring"> - </monitors> - - - -</config> diff --git a/roles/apps/collabora/code/templates/config/loolwsd.6.4.14.3.xml.j2 b/roles/apps/collabora/code/templates/config/loolwsd.6.4.14.3.xml.j2 deleted file mode 100644 index e9ababf2..00000000 --- a/roles/apps/collabora/code/templates/config/loolwsd.6.4.14.3.xml.j2 +++ /dev/null @@ -1,203 +0,0 @@ -<!-- -*- nxml-child-indent: 4; tab-width: 4; indent-tabs-mode: nil -*- --> -<config> - - <!-- For more detailed documentation on typical configuration options please see: - https://sdk.collaboraonline.com/docs/installation/Configuration.html --> - - <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> - <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> - - <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> - - <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> - <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> - <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - - <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> - <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path> - <hexify_embedded_urls desc="Enable to protect encoded URLs from getting decoded by intermediate hops. Particularly useful on Azure deployments" type="bool" default="false"></hexify_embedded_urls> - - <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion> - <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children> - <per_document desc="Document-specific settings, including LO Core settings."> - <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> - <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> - <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url> - <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> - <pdf_resolution_dpi desc="The resolution, in DPI, used to render PDF documents as image. Memory consumption grows proportionally. Must be a positive value less than 385. Defaults to 96." type="uint" default="96">96</pdf_resolution_dpi> - <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> - <!-- Idle save and auto save are checked every 30 seconds --> - <!-- They are disabled when the value is zero or negative. --> - <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs> - <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs> - <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit> - <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> - <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> - <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> - <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> - <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> - <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> - <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false"> - <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> - <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> - <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> - <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> - <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> - <lost_kit_grace_period_secs desc="The minimum grace period for a lost kit process (not referenced by loolwsd) to resolve its lost status before it is terminated. To disable the cleanup of lost kits use value 0" default="120">120</lost_kit_grace_period_secs> - </cleanup> - </per_document> - - <per_view desc="View-specific settings."> - <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs> - <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> - </per_view> - - <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html> - <ver_suffix desc="Appended to etags to allow easy refresh of changed files during development" type="string" default=""></ver_suffix> - - <logging> - <color type="bool">true</color> - <level type="string" desc="Can be 0-8 (with the lowest numbers being the least verbose), or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> - <most_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from the client can not set a more verbose log level than this" default="notice">notice</most_verbose_level_settable_from_client> - <least_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from a client can not set a less verbose log level than this" default="fatal">fatal</least_verbose_level_settable_from_client> - <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> - <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" - See also: https://docs.libreoffice.org/sal/html/sal_log.html --> - <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> - <file enable="false"> - <!-- If you use other path than /var/log and you run loolwsd from systemd, make sure that you enable that path in loolwsd.service (ReadWritePaths). --> - <property name="path" desc="Log file path.">/var/log/loolwsd.log</property> - <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> - <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> - <property name="compress" desc="Enable/disable log file compression.">true</property> - <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> - <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> - <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> - <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> - </file> - <anonymize> - <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> - <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> - </anonymize> - </logging> - - <trace_event desc="The possibility to turn on generation of a Chrome Trace Event file" enable="false"> - <path desc="Output path for the Trace Event file, to which they will be written if turned on at run-time" type="string" default="/var/log/loolwsd.trace.json">/var/log/loolwsd.trace.json</path> - </trace_event> - - <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging> - - <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> - <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path> - <filter> - <message desc="Regex pattern of messages to exclude"></message> - </filter> - <outgoing> - <record desc="Whether or not to record outgoing messages" default="false">false</record> - </outgoing> - </trace> - - <net desc="Network settings"> - <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only. - You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> - <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> - <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen> - <!-- this allows you to shift all of our URLs into a sub-path from - https://my.com/loleaflet/a123... to https://my.com/my/sub/path/loleaflet/a123... --> - <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> - <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> - <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> - <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> - <host desc="The IPv6 loopback (localhost) address.">::1</host> - <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - </post_allow> - <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> - <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> - - <!-- this setting radically changes how online works, it should not be used in a production environment --> - <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> - </net> - - <ssl desc="SSL settings"> - <!-- switches from https:// + wss:// to http:// + ws:// --> - <enable type="bool" desc="Controls whether SSL encryption between loolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> - <!-- SSL off-load can be done in a proxy, if so disable SSL, and enable termination below in production --> - <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> - <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path> - <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path> - <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> - <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> - <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> - <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> - <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> - <pin></pin> - </pins> - </hpkp> - </ssl> - - <security desc="Altering these defaults potentially opens you to significant risk"> - <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> - <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> - <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs> - <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic, Beanshell, Javascript and Python scripts. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ item.value.macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> - <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ item.value.macros.security_level | default('1') }}</macro_security_level> - <enable_metrics_unauthenticated desc="When enabled, the /lool/getMetrics endpoint will not require authentication." type="bool" default="false">false</enable_metrics_unauthenticated> - </security> - - <watermark> - <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> - <text desc="Watermark text to be displayed on the document if entered" type="string"></text> - </watermark> - - <welcome> - <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">false</enable> - <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button> - <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path> - </welcome> - - <user_interface> - <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode> - </user_interface> - - <storage desc="Backend storage"> - <filesystem allow="false" /> - <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true"> - <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> -{% for backend in item.value.backend_storages %} - <host allow="true">{{ backend }}</host> -{% endfor %} - <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> - <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies> - <locking desc="Locking settings"> - <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> - </locking> - </wopi> - <ssl desc="SSL settings"> - <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> - <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable> - <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path> - <key_file_path desc="Path to the key file" relative="false"></key_file_path> - <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list> - </ssl> - </storage> - - <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent> - - <admin_console desc="Web admin console settings."> - <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> - <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">{{ item.value.admin.password }}</password> - </admin_console> - - <monitors desc="Addresses of servers we connect to on start for monitoring"> - </monitors> - - - -</config> diff --git a/roles/apps/collabora/code/templates/config/loolwsd.6.4.3.3.xml.j2 b/roles/apps/collabora/code/templates/config/loolwsd.6.4.3.3.xml.j2 deleted file mode 100644 index 2542d252..00000000 --- a/roles/apps/collabora/code/templates/config/loolwsd.6.4.3.3.xml.j2 +++ /dev/null @@ -1,180 +0,0 @@ -<config> - - <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> - <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> - - <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> - - <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> - <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> - <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - - <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> - <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path> - - <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion> - <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children> - <per_document desc="Document-specific settings, including LO Core settings."> - <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> - <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> - <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url> - <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> - <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> - <!-- Idle save and auto save are checked every 30 seconds --> - <!-- They are disabled when the value is zero or negative. --> - <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs> - <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs> - <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit> - <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> - <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> - <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> - <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> - <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> - <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> - <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false"> - <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> - <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> - <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> - <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> - <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> - </cleanup> - </per_document> - - <per_view desc="View-specific settings."> - <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs> - <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> - </per_view> - - <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html> - - <logging> - <color type="bool">true</color> - <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> - <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> - <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" - See also: https://docs.libreoffice.org/sal/html/sal_log.html --> - <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> - <file enable="false"> - <!-- If you use other path than /var/log and you run loolwsd from systemd, make sure that you enable that path in loolwsd.service (ReadWritePaths). --> - <property name="path" desc="Log file path.">/var/log/loolwsd.log</property> - <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> - <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> - <property name="compress" desc="Enable/disable log file compression.">true</property> - <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> - <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> - <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> - <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> - </file> - <anonymize> - <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> - <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> - </anonymize> - </logging> - - <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging> - - <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> - <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path> - <filter> - <message desc="Regex pattern of messages to exclude"></message> - </filter> - <outgoing> - <record desc="Whether or not to record outgoing messages" default="false">false</record> - </outgoing> - </trace> - - <net desc="Network settings"> - <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only. - You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> - <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> - <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen> - <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> - <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> - <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> - <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> - <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> - <host desc="The IPv6 loopback (localhost) address.">::1</host> - <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - </post_allow> - <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> - <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> - </net> - - <ssl desc="SSL settings"> - <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> - <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> - <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path> - <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path> - <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> - <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> - <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> - <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> - <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> - <pin></pin> - </pins> - </hpkp> - </ssl> - - <security desc="Altering these defaults potentially opens you to significant risk"> - <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> - <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> - </security> - - <watermark> - <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> - <text desc="Watermark text to be displayed on the document if entered" type="string"></text> - </watermark> - - <welcome> - <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">false</enable> - <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button> - <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path> - </welcome> - - <user_interface> - <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode> - </user_interface> - - <storage desc="Backend storage"> - <filesystem allow="false" /> - <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true"> - <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> -{% for backend in item.value.backend_storages %} - <host allow="true">{{ backend }}</host> -{% endfor %} - <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> - <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies> - <locking desc="Locking settings"> - <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> - </locking> - </wopi> - <webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false"> - <host desc="Hostname to allow" allow="false">localhost</host> - </webdav> - <ssl desc="SSL settings"> - <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> - <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable> - <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path> - <key_file_path desc="Path to the key file" relative="false"></key_file_path> - <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list> - </ssl> - </storage> - - <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent> - - <admin_console desc="Web admin console settings."> - <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> - <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">{{ item.value.admin.password }}</password> - </admin_console> - - <monitors desc="Addresses of servers we connect to on start for monitoring"> - </monitors> - -</config> diff --git a/roles/apps/collabora/code/templates/config/loolwsd.6.4.4.3.xml.j2 b/roles/apps/collabora/code/templates/config/loolwsd.6.4.4.3.xml.j2 deleted file mode 100644 index 2542d252..00000000 --- a/roles/apps/collabora/code/templates/config/loolwsd.6.4.4.3.xml.j2 +++ /dev/null @@ -1,180 +0,0 @@ -<config> - - <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> - <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> - - <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> - - <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> - <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> - <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - - <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> - <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path> - - <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion> - <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children> - <per_document desc="Document-specific settings, including LO Core settings."> - <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> - <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> - <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url> - <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> - <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> - <!-- Idle save and auto save are checked every 30 seconds --> - <!-- They are disabled when the value is zero or negative. --> - <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs> - <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs> - <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit> - <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> - <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> - <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> - <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> - <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> - <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> - <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false"> - <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> - <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> - <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> - <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> - <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> - </cleanup> - </per_document> - - <per_view desc="View-specific settings."> - <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs> - <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> - </per_view> - - <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html> - - <logging> - <color type="bool">true</color> - <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> - <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> - <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" - See also: https://docs.libreoffice.org/sal/html/sal_log.html --> - <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> - <file enable="false"> - <!-- If you use other path than /var/log and you run loolwsd from systemd, make sure that you enable that path in loolwsd.service (ReadWritePaths). --> - <property name="path" desc="Log file path.">/var/log/loolwsd.log</property> - <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> - <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> - <property name="compress" desc="Enable/disable log file compression.">true</property> - <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> - <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> - <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> - <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> - </file> - <anonymize> - <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> - <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> - </anonymize> - </logging> - - <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging> - - <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> - <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path> - <filter> - <message desc="Regex pattern of messages to exclude"></message> - </filter> - <outgoing> - <record desc="Whether or not to record outgoing messages" default="false">false</record> - </outgoing> - </trace> - - <net desc="Network settings"> - <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only. - You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> - <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> - <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen> - <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> - <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> - <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> - <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> - <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> - <host desc="The IPv6 loopback (localhost) address.">::1</host> - <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - </post_allow> - <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> - <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> - </net> - - <ssl desc="SSL settings"> - <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> - <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> - <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path> - <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path> - <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> - <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> - <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> - <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> - <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> - <pin></pin> - </pins> - </hpkp> - </ssl> - - <security desc="Altering these defaults potentially opens you to significant risk"> - <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> - <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> - </security> - - <watermark> - <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> - <text desc="Watermark text to be displayed on the document if entered" type="string"></text> - </watermark> - - <welcome> - <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">false</enable> - <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button> - <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path> - </welcome> - - <user_interface> - <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode> - </user_interface> - - <storage desc="Backend storage"> - <filesystem allow="false" /> - <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true"> - <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> -{% for backend in item.value.backend_storages %} - <host allow="true">{{ backend }}</host> -{% endfor %} - <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> - <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies> - <locking desc="Locking settings"> - <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> - </locking> - </wopi> - <webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false"> - <host desc="Hostname to allow" allow="false">localhost</host> - </webdav> - <ssl desc="SSL settings"> - <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> - <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable> - <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path> - <key_file_path desc="Path to the key file" relative="false"></key_file_path> - <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list> - </ssl> - </storage> - - <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent> - - <admin_console desc="Web admin console settings."> - <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> - <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">{{ item.value.admin.password }}</password> - </admin_console> - - <monitors desc="Addresses of servers we connect to on start for monitoring"> - </monitors> - -</config> diff --git a/roles/apps/collabora/code/templates/config/loolwsd.6.4.6.2.xml.j2 b/roles/apps/collabora/code/templates/config/loolwsd.6.4.6.2.xml.j2 deleted file mode 100644 index 2542d252..00000000 --- a/roles/apps/collabora/code/templates/config/loolwsd.6.4.6.2.xml.j2 +++ /dev/null @@ -1,180 +0,0 @@ -<config> - - <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> - <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> - - <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> - - <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> - <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> - <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - - <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> - <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path> - - <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion> - <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children> - <per_document desc="Document-specific settings, including LO Core settings."> - <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> - <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> - <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url> - <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> - <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> - <!-- Idle save and auto save are checked every 30 seconds --> - <!-- They are disabled when the value is zero or negative. --> - <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs> - <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs> - <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit> - <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> - <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> - <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> - <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> - <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> - <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> - <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false"> - <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> - <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> - <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> - <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> - <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> - </cleanup> - </per_document> - - <per_view desc="View-specific settings."> - <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs> - <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> - </per_view> - - <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html> - - <logging> - <color type="bool">true</color> - <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> - <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> - <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" - See also: https://docs.libreoffice.org/sal/html/sal_log.html --> - <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> - <file enable="false"> - <!-- If you use other path than /var/log and you run loolwsd from systemd, make sure that you enable that path in loolwsd.service (ReadWritePaths). --> - <property name="path" desc="Log file path.">/var/log/loolwsd.log</property> - <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> - <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> - <property name="compress" desc="Enable/disable log file compression.">true</property> - <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> - <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> - <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> - <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> - </file> - <anonymize> - <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> - <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> - </anonymize> - </logging> - - <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging> - - <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> - <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path> - <filter> - <message desc="Regex pattern of messages to exclude"></message> - </filter> - <outgoing> - <record desc="Whether or not to record outgoing messages" default="false">false</record> - </outgoing> - </trace> - - <net desc="Network settings"> - <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only. - You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> - <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> - <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen> - <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> - <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> - <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> - <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> - <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> - <host desc="The IPv6 loopback (localhost) address.">::1</host> - <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - </post_allow> - <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> - <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> - </net> - - <ssl desc="SSL settings"> - <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> - <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> - <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path> - <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path> - <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> - <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> - <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> - <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> - <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> - <pin></pin> - </pins> - </hpkp> - </ssl> - - <security desc="Altering these defaults potentially opens you to significant risk"> - <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> - <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> - </security> - - <watermark> - <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> - <text desc="Watermark text to be displayed on the document if entered" type="string"></text> - </watermark> - - <welcome> - <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">false</enable> - <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button> - <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path> - </welcome> - - <user_interface> - <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode> - </user_interface> - - <storage desc="Backend storage"> - <filesystem allow="false" /> - <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true"> - <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> -{% for backend in item.value.backend_storages %} - <host allow="true">{{ backend }}</host> -{% endfor %} - <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> - <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies> - <locking desc="Locking settings"> - <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> - </locking> - </wopi> - <webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false"> - <host desc="Hostname to allow" allow="false">localhost</host> - </webdav> - <ssl desc="SSL settings"> - <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> - <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable> - <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path> - <key_file_path desc="Path to the key file" relative="false"></key_file_path> - <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list> - </ssl> - </storage> - - <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent> - - <admin_console desc="Web admin console settings."> - <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> - <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">{{ item.value.admin.password }}</password> - </admin_console> - - <monitors desc="Addresses of servers we connect to on start for monitoring"> - </monitors> - -</config> diff --git a/roles/apps/collabora/code/templates/config/loolwsd.6.4.7.3.xml.j2 b/roles/apps/collabora/code/templates/config/loolwsd.6.4.7.3.xml.j2 deleted file mode 100644 index bd6eab16..00000000 --- a/roles/apps/collabora/code/templates/config/loolwsd.6.4.7.3.xml.j2 +++ /dev/null @@ -1,184 +0,0 @@ -<config> - - <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> - <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> - - <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> - - <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> - <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> - <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - - <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> - <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path> - - <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion> - <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children> - <per_document desc="Document-specific settings, including LO Core settings."> - - <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> - <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> - <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url> - <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> - <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> - <!-- Idle save and auto save are checked every 30 seconds --> - <!-- They are disabled when the value is zero or negative. --> - <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs> - <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs> - <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit> - <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> - <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> - <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> - <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> - <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> - <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> - <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false"> - <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> - <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> - <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> - <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> - <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> - </cleanup> - </per_document> - - <per_view desc="View-specific settings."> - <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs> - <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> - </per_view> - - <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html> - - <logging> - <color type="bool">true</color> - <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> - <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> - <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" - See also: https://docs.libreoffice.org/sal/html/sal_log.html --> - <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> - <file enable="false"> - <!-- If you use other path than /var/log and you run loolwsd from systemd, make sure that you enable that path in loolwsd.service (ReadWritePaths). --> - <property name="path" desc="Log file path.">/var/log/loolwsd.log</property> - <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> - <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> - <property name="compress" desc="Enable/disable log file compression.">true</property> - <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> - <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> - <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> - <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> - </file> - <anonymize> - <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> - <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> - </anonymize> - </logging> - - <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging> - - <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> - <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path> - <filter> - <message desc="Regex pattern of messages to exclude"></message> - </filter> - <outgoing> - <record desc="Whether or not to record outgoing messages" default="false">false</record> - </outgoing> - </trace> - - <net desc="Network settings"> - <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only. - You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> - <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> - <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen> - <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> - <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> - <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> - <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> - <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> - <host desc="The IPv6 loopback (localhost) address.">::1</host> - <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - </post_allow> - <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> - <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> - </net> - - <ssl desc="SSL settings"> - <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> - <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> - <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path> - <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path> - <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> - <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> - <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> - <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> - <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> - <pin></pin> - </pins> - </hpkp> - </ssl> - - <security desc="Altering these defaults potentially opens you to significant risk"> - <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> - <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> - <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs> - <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic, Beanshell, Javascript and Python scripts. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ item.value.macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> - <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ item.value.macros.security_level | default('1') }}</macro_security_level> - </security> - - <watermark> - <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> - <text desc="Watermark text to be displayed on the document if entered" type="string"></text> - </watermark> - - <welcome> - <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">false</enable> - <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button> - <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path> - </welcome> - - <user_interface> - <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode> - </user_interface> - - <storage desc="Backend storage"> - <filesystem allow="false" /> - <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true"> - <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> -{% for backend in item.value.backend_storages %} - <host allow="true">{{ backend }}</host> -{% endfor %} - <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> - <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies> - <locking desc="Locking settings"> - <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> - </locking> - </wopi> - <webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false"> - <host desc="Hostname to allow" allow="false">localhost</host> - </webdav> - <ssl desc="SSL settings"> - <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> - <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable> - <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path> - <key_file_path desc="Path to the key file" relative="false"></key_file_path> - <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list> - </ssl> - </storage> - - <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent> - - <admin_console desc="Web admin console settings."> - <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> - <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">{{ item.value.admin.password }}</password> - </admin_console> - - <monitors desc="Addresses of servers we connect to on start for monitoring"> - </monitors> - -</config> diff --git a/roles/apps/collabora/code/templates/config/loolwsd.6.4.7.5.xml.j2 b/roles/apps/collabora/code/templates/config/loolwsd.6.4.7.5.xml.j2 deleted file mode 100644 index d3d5686f..00000000 --- a/roles/apps/collabora/code/templates/config/loolwsd.6.4.7.5.xml.j2 +++ /dev/null @@ -1,184 +0,0 @@ -<config> - - <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> - <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> - - <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> - - <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> - <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> - <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - - <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> - <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path> - - <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion> - <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children> - <per_document desc="Document-specific settings, including LO Core settings."> - <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> - <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> - <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url> - <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> - <pdf_resolution_dpi desc="The resolution, in DPI, used to render PDF documents as image. Memory consumption grows proportionally. Must be a positive value less than 385. Defaults to 96." type="uint" default="96">96</pdf_resolution_dpi> - <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> - <!-- Idle save and auto save are checked every 30 seconds --> - <!-- They are disabled when the value is zero or negative. --> - <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs> - <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs> - <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit> - <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> - <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> - <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> - <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> - <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> - <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> - <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false"> - <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> - <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> - <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> - <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> - <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> - </cleanup> - </per_document> - - <per_view desc="View-specific settings."> - <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs> - <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> - </per_view> - - <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html> - - <logging> - <color type="bool">true</color> - <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> - <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> - <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" - See also: https://docs.libreoffice.org/sal/html/sal_log.html --> - <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> - <file enable="false"> - <!-- If you use other path than /var/log and you run loolwsd from systemd, make sure that you enable that path in loolwsd.service (ReadWritePaths). --> - <property name="path" desc="Log file path.">/var/log/loolwsd.log</property> - <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> - <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> - <property name="compress" desc="Enable/disable log file compression.">true</property> - <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> - <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> - <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> - <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> - </file> - <anonymize> - <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> - <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> - </anonymize> - </logging> - - <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging> - - <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> - <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path> - <filter> - <message desc="Regex pattern of messages to exclude"></message> - </filter> - <outgoing> - <record desc="Whether or not to record outgoing messages" default="false">false</record> - </outgoing> - </trace> - - <net desc="Network settings"> - <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only. - You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> - <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> - <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen> - <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> - <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> - <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> - <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> - <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> - <host desc="The IPv6 loopback (localhost) address.">::1</host> - <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - </post_allow> - <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> - <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> - </net> - - <ssl desc="SSL settings"> - <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> - <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> - <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path> - <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path> - <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> - <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> - <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> - <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> - <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> - <pin></pin> - </pins> - </hpkp> - </ssl> - - <security desc="Altering these defaults potentially opens you to significant risk"> - <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> - <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> - <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs> - <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic, Beanshell, Javascript and Python scripts. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ item.value.macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> - <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ item.value.macros.security_level | default('1') }}</macro_security_level> - </security> - - <watermark> - <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> - <text desc="Watermark text to be displayed on the document if entered" type="string"></text> - </watermark> - - <welcome> - <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">false</enable> - <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button> - <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path> - </welcome> - - <user_interface> - <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode> - </user_interface> - - <storage desc="Backend storage"> - <filesystem allow="false" /> - <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true"> - <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> -{% for backend in item.value.backend_storages %} - <host allow="true">{{ backend }}</host> -{% endfor %} - <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> - <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies> - <locking desc="Locking settings"> - <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> - </locking> - </wopi> - <webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false"> - <host desc="Hostname to allow" allow="false">localhost</host> - </webdav> - <ssl desc="SSL settings"> - <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> - <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable> - <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path> - <key_file_path desc="Path to the key file" relative="false"></key_file_path> - <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list> - </ssl> - </storage> - - <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent> - - <admin_console desc="Web admin console settings."> - <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> - <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">{{ item.value.admin.password }}</password> - </admin_console> - - <monitors desc="Addresses of servers we connect to on start for monitoring"> - </monitors> - -</config> diff --git a/roles/apps/collabora/code/templates/config/loolwsd.6.4.8.1.xml.j2 b/roles/apps/collabora/code/templates/config/loolwsd.6.4.8.1.xml.j2 deleted file mode 100644 index 4daa414c..00000000 --- a/roles/apps/collabora/code/templates/config/loolwsd.6.4.8.1.xml.j2 +++ /dev/null @@ -1,188 +0,0 @@ -<config> - - <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. --> - <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. --> - - <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages> - - <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path> - <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path> - <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree> - - <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">{{ item.value.hostname }}</server_name> - <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path> - - <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion> - <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children> - <per_document desc="Document-specific settings, including LO Core settings."> - <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency> - <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority> - <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url> - <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments> - <pdf_resolution_dpi desc="The resolution, in DPI, used to render PDF documents as image. Memory consumption grows proportionally. Must be a positive value less than 385. Defaults to 96." type="uint" default="96">96</pdf_resolution_dpi> - <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs> - <!-- Idle save and auto save are checked every 30 seconds --> - <!-- They are disabled when the value is zero or negative. --> - <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs> - <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs> - <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit> - <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb> - <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb> - <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb> - <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files> - <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs> - <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs> - <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false"> - <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms> - <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs> - <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs> - <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb> - <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per> - </cleanup> - </per_document> - - <per_view desc="View-specific settings."> - <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs> - <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs> - </per_view> - - <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html> - - <logging> - <color type="bool">true</color> - <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level> - <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol> - <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav" - See also: https://docs.libreoffice.org/sal/html/sal_log.html --> - <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log> - <file enable="false"> - <!-- If you use other path than /var/log and you run loolwsd from systemd, make sure that you enable that path in loolwsd.service (ReadWritePaths). --> - <property name="path" desc="Log file path.">/var/log/loolwsd.log</property> - <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property> - <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property> - <property name="compress" desc="Enable/disable log file compression.">true</property> - <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property> - <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property> - <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property> - <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property> - </file> - <anonymize> - <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data> - <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt> - </anonymize> - </logging> - - <event_trace> - <path type="string" desc="Event Trace file path." default="/var/log/loolwsd.trace">/var/log/loolwsd.trace</path> - </event_trace> - - <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging> - - <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false"> - <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path> - <filter> - <message desc="Regex pattern of messages to exclude"></message> - </filter> - <outgoing> - <record desc="Whether or not to record outgoing messages" default="false">false</record> - </outgoing> - </trace> - - <net desc="Network settings"> - <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only. - You need to change net.proto to IPv4, if you want to use 127.0.0.1. --> - <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto> - <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen> - <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root> - <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix> - <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true"> - <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host> - <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host> - <host desc="The IPv6 loopback (localhost) address.">::1</host> - <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host> - </post_allow> - <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors> - <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs> - </net> - - <ssl desc="SSL settings"> - <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable> - <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination> - <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path> - <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path> - <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list> - <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false"> - <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age> - <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri> - <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned"> - <pin></pin> - </pins> - </hpkp> - </ssl> - - <security desc="Altering these defaults potentially opens you to significant risk"> - <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp> - <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities> - <jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs> - <enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic, Beanshell, Javascript and Python scripts. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">{{ item.value.macros.allowed | default(false) | ternary('true', 'false') }}</enable_macros_execution> - <macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">{{ item.value.macros.security_level | default('1') }}</macro_security_level> - </security> - - <watermark> - <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity> - <text desc="Watermark text to be displayed on the document if entered" type="string"></text> - </watermark> - - <welcome> - <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">false</enable> - <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button> - <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path> - </welcome> - - <user_interface> - <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode> - </user_interface> - - <storage desc="Backend storage"> - <filesystem allow="false" /> - <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true"> - <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host> -{% for backend in item.value.backend_storages %} - <host allow="true">{{ backend }}</host> -{% endfor %} - <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size> - <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies> - <locking desc="Locking settings"> - <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh> - </locking> - </wopi> - <webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false"> - <host desc="Hostname to allow" allow="false">localhost</host> - </webdav> - <ssl desc="SSL settings"> - <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme> - <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable> - <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path> - <key_file_path desc="Path to the key file" relative="false"></key_file_path> - <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path> - <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list> - </ssl> - </storage> - - <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent> - - <admin_console desc="Web admin console settings."> - <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable> - <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam> - <username desc="The username of the admin console. Ignored if PAM is enabled.">{{ item.value.admin.username }}</username> - <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">{{ item.value.admin.password }}</password> - </admin_console> - - <monitors desc="Addresses of servers we connect to on start for monitoring"> - </monitors> - -</config> diff --git a/roles/apps/collabora/code/templates/nginx-vhost.conf.j2 b/roles/apps/collabora/code/templates/nginx-vhost.conf.j2 deleted file mode 100644 index 67502e20..00000000 --- a/roles/apps/collabora/code/templates/nginx-vhost.conf.j2 +++ /dev/null @@ -1,99 +0,0 @@ -client_max_body_size 128M; - -# static files -{% if item.value.version | collabora_code_loolvcool %} -location ^~ /loleaflet { -{% else %} -location ^~ /browser { -{% endif %} - include snippets/proxy-nobuff.conf; - include snippets/proxy-forward-headers.conf; - - proxy_set_header Host $http_host; - proxy_pass http://127.0.0.1:{{ item.value.port }}; - - proxy_redirect http://$host/ https://$host/; - proxy_redirect http://$host:9980/ https://$host/; -} - -# WOPI discovery URL -location ^~ /hosting/discovery { - include snippets/proxy-nobuff.conf; - include snippets/proxy-forward-headers.conf; - - proxy_set_header Host $http_host; - proxy_pass http://127.0.0.1:{{ item.value.port }}; - - proxy_redirect http://$host/ https://$host/; - proxy_redirect http://$host:9980/ https://$host/; -} - -# Capabilities -location ^~ /hosting/capabilities { - include snippets/proxy-nobuff.conf; - include snippets/proxy-forward-headers.conf; - - proxy_set_header Host $http_host; - proxy_pass http://127.0.0.1:{{ item.value.port }}; - - proxy_redirect http://$host/ https://$host/; - proxy_redirect http://$host:9980/ https://$host/; -} - -# main websocket -{% if item.value.version | collabora_code_loolvcool %} -location ~ ^/lool/(.*)/ws$ { -{% else %} -location ~ ^/cool/(.*)/ws$ { -{% endif %} - include snippets/proxy-nobuff.conf; - include snippets/proxy-forward-headers.conf; - - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - - proxy_read_timeout 36000s; - - proxy_set_header Host $http_host; - proxy_pass http://127.0.0.1:{{ item.value.port }}; - - proxy_redirect http://$host/ https://$host/; - proxy_redirect http://$host:9980/ https://$host/; -} - -# download, presentation and image upload -{% if item.value.version | collabora_code_loolvcool %} -location ~ ^/lool { -{% else %} -location ~ ^/(c|l)ool { -{% endif %} - include snippets/proxy-nobuff.conf; - include snippets/proxy-forward-headers.conf; - - proxy_set_header Host $http_host; - proxy_pass http://127.0.0.1:{{ item.value.port }}; - - proxy_redirect http://$host/ https://$host/; - proxy_redirect http://$host:9980/ https://$host/; -} - -# Admin Console websocket -{% if item.value.version | collabora_code_loolvcool %} -location ^~ /lool/adminws { -{% else %} -location ^~ /cool/adminws { -{% endif %} - include snippets/proxy-nobuff.conf; - include snippets/proxy-forward-headers.conf; - - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - - proxy_read_timeout 36000s; - - proxy_set_header Host $http_host; - proxy_pass http://127.0.0.1:{{ item.value.port }}; - - proxy_redirect http://$host/ https://$host/; - proxy_redirect http://$host:9980/ https://$host/; -} diff --git a/roles/apps/collabora/code/templates/pod-spec.yml.j2 b/roles/apps/collabora/code/templates/pod-spec.yml.j2 deleted file mode 100644 index 22dfaf49..00000000 --- a/roles/apps/collabora/code/templates/pod-spec.yml.j2 +++ /dev/null @@ -1,30 +0,0 @@ -containers: -- name: collabora-code - image: "collabora/code{% if 'custom_image' in item.value %}/{{ item.key }}{% endif %}:{{ item.value.version }}" - resources: - limits: - memory: "4Gi" - env: - - name: "DONT_GEN_SSL_CERT" - value: "1" - - name: "extra_params" - value: "--o:ssl.enable=false --o:ssl.termination=true" - volumeMounts: - - name: config -{% if item.value.version | collabora_code_loolvcool %} - mountPath: /etc/loolwsd/loolwsd.xml - subPath: loolwsd.xml -{% else %} - mountPath: /etc/coolwsd/coolwsd.xml - subPath: coolwsd.xml -{% endif %} - readOnly: true - ports: - - containerPort: 9980 - hostPort: {{ item.value.port }} - hostIP: 127.0.0.1 -volumes: -- name: config - hostPath: - path: "{{ collabora_code_base_path }}/{{ item.key }}/config/" - type: Directory diff --git a/roles/apps/nextcloud/base/defaults/main.yml b/roles/apps/nextcloud/base/defaults/main.yml new file mode 100644 index 00000000..1a8a6d52 --- /dev/null +++ b/roles/apps/nextcloud/base/defaults/main.yml @@ -0,0 +1,9 @@ +--- +nextcloud_app_uid: "950" +nextcloud_app_gid: "950" + +nextcloud_db_uid: "951" +nextcloud_db_gid: "951" + +nextcloud_redis_uid: "952" +nextcloud_redis_gid: "952" diff --git a/roles/apps/nextcloud/base/tasks/main.yml b/roles/apps/nextcloud/base/tasks/main.yml new file mode 100644 index 00000000..4c85a35c --- /dev/null +++ b/roles/apps/nextcloud/base/tasks/main.yml @@ -0,0 +1,51 @@ +--- +- name: add group for nextcloud app + group: + name: nc-app + gid: "{{ nextcloud_app_gid }}" + +- name: add user for nextcloud app + user: + name: nc-app + uid: "{{ nextcloud_app_uid }}" + group: nc-app + password: "!" + +- name: add group for nextcloud db + group: + name: nc-db + gid: "{{ nextcloud_db_gid }}" + +- name: add user for nextcloud db + user: + name: nc-db + uid: "{{ nextcloud_db_uid }}" + group: nc-db + password: "!" + +- name: add group for nextcloud redis + group: + name: nc-redis + gid: "{{ nextcloud_redis_gid }}" + +- name: add user for nextcloud redis + user: + name: nc-redis + uid: "{{ nextcloud_redis_uid }}" + group: nc-redis + password: "!" + +- name: install template systemd unit for cron trigger + template: + src: cron@.service.j2 + dest: /etc/systemd/system/nextcloud-cron@.service + +- name: install management scripts + loop: + - nextcloud-upgrade + - nextcloud-occ + - nextcloud-cron + template: + src: "{{ item }}.j2" + dest: "/usr/local/bin/{{ item }}" + mode: 0755 diff --git a/roles/apps/nextcloud/templates/cron@.service.j2 b/roles/apps/nextcloud/base/templates/cron@.service.j2 index 822f64b4..d8cde0a3 100644 --- a/roles/apps/nextcloud/templates/cron@.service.j2 +++ b/roles/apps/nextcloud/base/templates/cron@.service.j2 @@ -3,7 +3,7 @@ Description=Nextcloud cron.php job for %i [Service] Type=oneshot -ExecStart={{ nextcloud_base_path }}/%i/config/run-cron.sh +ExecStart=/usr/local/bin/nextcloud-cron %i NoNewPrivileges=yes PrivateTmp=yes PrivateDevices=yes diff --git a/roles/apps/nextcloud/base/templates/nextcloud-cron.j2 b/roles/apps/nextcloud/base/templates/nextcloud-cron.j2 new file mode 100755 index 00000000..355ae2c3 --- /dev/null +++ b/roles/apps/nextcloud/base/templates/nextcloud-cron.j2 @@ -0,0 +1,19 @@ +#!/bin/bash + +INST_NAME="$1" +shift + +if [ -z "$INST_NAME" ]; then + echo "Usage: $0 <instance>" + exit 1 +fi + +set -eu + +pod_id=$(crictl pods -q --state ready --name "^nextcloud-$INST_NAME-{{ ansible_nodename }}$") +if [ -z "$pod_id" ]; then echo "Pod not found"; exit 1; fi + +container_id=$(crictl ps -q --name '^nextcloud$' -p "$pod_id") +if [ -z "$container_id" ]; then echo "Container not found"; exit 1; fi + +exec crictl exec "$container_id" php -f /var/www/html/cron.php diff --git a/roles/apps/nextcloud/templates/nextcloud-occ.j2 b/roles/apps/nextcloud/base/templates/nextcloud-occ.j2 index f12f1259..f12f1259 100755 --- a/roles/apps/nextcloud/templates/nextcloud-occ.j2 +++ b/roles/apps/nextcloud/base/templates/nextcloud-occ.j2 diff --git a/roles/apps/nextcloud/templates/nextcloud-upgrade.j2 b/roles/apps/nextcloud/base/templates/nextcloud-upgrade.j2 index f59f3be6..ffa912e8 100755 --- a/roles/apps/nextcloud/templates/nextcloud-upgrade.j2 +++ b/roles/apps/nextcloud/base/templates/nextcloud-upgrade.j2 @@ -24,7 +24,7 @@ function cleanup { } trap cleanup EXIT -IMAGE_BUILD_D="{{ nextcloud_base_path }}/$INST_NAME/build" +IMAGE_BUILD_D=$(cat "$K8S_CONFIG_HASH_FILE" | grep "build/Dockerfile:" | tr -d ":" | xargs dirname) IMAGE_NAME="nextcloud" if [ -e "$IMAGE_BUILD_D/Dockerfile" ]; then ## this only works if docker is installed... @@ -40,15 +40,17 @@ else crictl pull "docker.io/library/nextcloud:$VERSION" echo "" fi -{% if nextcloud_zfs is defined %} -echo "*** creating ZFS snapshot" -echo "" +STORAGE_TYPE=$(findmnt -no fstype -T "$IMAGE_BUILD_D") +if [ $STORAGE_TYPE == "zfs" ]; then + echo "*** creating ZFS snapshot" + echo "" -IMAGE_NAME_ESCAPED=${IMAGE_NAME/\//\\/} -CURRENT_VERSION=$(cat "$K8S_MANIFEST_FILE" | awk '/image: "'"$IMAGE_NAME_ESCAPED"':.*"/ { print($2) }' | tr -d '"' | cut -d ':' -f 2) -zfs snapshot "{{ nextcloud_zfs.pool }}/{{ nextcloud_zfs.name }}/$INST_NAME@upgrade_$CURRENT_VERSION-to-$VERSION""_$(date '+%Y-%m-%m_%H:%M:%S')" -{% endif %} + IMAGE_NAME_ESCAPED=${IMAGE_NAME/\//\\/} + CURRENT_VERSION=$(cat "$K8S_MANIFEST_FILE" | awk '/image: "'"$IMAGE_NAME_ESCAPED"':.*"/ { print($2) }' | tr -d '"' | cut -d ':' -f 2) + ZFS_VOLUME=$(findmnt -no source -T "$IMAGE_BUILD_D") + zfs snapshot "$ZFS_VOLUME@upgrade_$CURRENT_VERSION-to-$VERSION""_$(date '+%Y-%m-%m_%H:%M:%S')" +fi echo "*** Rebuilding config-hash file" echo "" diff --git a/roles/apps/nextcloud/defaults/main.yml b/roles/apps/nextcloud/defaults/main.yml index f194a6f9..631b0a0a 100644 --- a/roles/apps/nextcloud/defaults/main.yml +++ b/roles/apps/nextcloud/defaults/main.yml @@ -1,31 +1,11 @@ --- -nextcloud_app_uid: "950" -nextcloud_app_gid: "950" - -nextcloud_db_uid: "951" -nextcloud_db_gid: "951" - -nextcloud_redis_uid: "952" -nextcloud_redis_gid: "952" - -# nextcloud_base_path: /srv/nextcloud - -# nextcloud_zfs: -# pool: storage -# name: nextcloud -# properties: -# compression: lz4 - # nextcloud_instances: # example: # new: yes # version: 17.0.0 # port: 8100 -# hostnames: -# - wolke.example.com -# - cloud.example.com -# zfs_properties: -# quota: 100G +# storage: +# type: ... # database: # type: mariadb # version: 10.4.8 @@ -34,3 +14,10 @@ nextcloud_redis_gid: "952" # from: foo/bar:1.0 # optional # dockerfile: | # RUN apt-get install ... +# publish: +# zone: "{{ apps_publish_zone__foo }}" +# hostnames: +# - wolke.example.com +# - cloud.example.com +# tls: +# certificate_provider: ... diff --git a/roles/apps/nextcloud/instance/defaults/main.yml b/roles/apps/nextcloud/instance/defaults/main.yml new file mode 100644 index 00000000..1a8a6d52 --- /dev/null +++ b/roles/apps/nextcloud/instance/defaults/main.yml @@ -0,0 +1,9 @@ +--- +nextcloud_app_uid: "950" +nextcloud_app_gid: "950" + +nextcloud_db_uid: "951" +nextcloud_db_gid: "951" + +nextcloud_redis_uid: "952" +nextcloud_redis_gid: "952" diff --git a/roles/apps/nextcloud/tasks/custom-image.yml b/roles/apps/nextcloud/instance/tasks/custom-image.yml index 3d9e31d1..f9e130a2 100644 --- a/roles/apps/nextcloud/tasks/custom-image.yml +++ b/roles/apps/nextcloud/instance/tasks/custom-image.yml @@ -1,31 +1,31 @@ --- - name: create build directory for custom image file: - path: "{{ nextcloud_base_path }}/{{ item.key }}/build" + path: "{{ nextcloud_instance_basepath }}/build" state: directory - name: generate Dockerfile for custom image copy: content: | - FROM {{ item.value.custom_image.from | default('nextcloud:' + item.value.version) }} + FROM {{ nextcloud_instances[nextcloud_instance].custom_image.from | default('nextcloud:' + nextcloud_instances[nextcloud_instance].version) }} RUN set -x \ && addgroup --gid {{ nextcloud_app_gid }} nc-app \ && adduser --uid {{ nextcloud_app_uid }} --gid {{ nextcloud_app_gid }} --system --no-create-home --home /var/www/html --disabled-login --disabled-password nc-app - {% if 'custom_image' in item.value %} + {% if 'custom_image' in nextcloud_instances[nextcloud_instance] %} - {{ item.value.custom_image.dockerfile }} + {{ nextcloud_instances[nextcloud_instance].custom_image.dockerfile }} {% endif %} - dest: "{{ nextcloud_base_path }}/{{ item.key }}/build/Dockerfile" + dest: "{{ nextcloud_instance_basepath }}/build/Dockerfile" register: nextcloud_custom_image_docker - name: build custom image docker_image: - name: "nextcloud/{{ item.key }}:{{ item.value.version }}" + name: "nextcloud/{{ nextcloud_instance }}:{{ nextcloud_instances[nextcloud_instance].version }}" state: present force_source: "{{ nextcloud_custom_image_docker is changed }}" source: build build: - path: "{{ nextcloud_base_path }}/{{ item.key }}/build" + path: "{{ nextcloud_instance_basepath }}/build" network: host pull: yes diff --git a/roles/apps/nextcloud/instance/tasks/main.yml b/roles/apps/nextcloud/instance/tasks/main.yml new file mode 100644 index 00000000..3c8928b2 --- /dev/null +++ b/roles/apps/nextcloud/instance/tasks/main.yml @@ -0,0 +1,189 @@ +--- +- name: prepare storage volume + vars: + storage_volume: "{{ nextcloud_instances[nextcloud_instance].storage }}" + include_role: + name: "storage/{{ nextcloud_instances[nextcloud_instance].storage.type }}/volume" + +- set_fact: + nextcloud_instance_basepath: "{{ storage_volume_mountpoint }}" + +- name: create nextcloud app subdirectory + file: + path: "{{ nextcloud_instance_basepath }}/nextcloud" + owner: "{{ nextcloud_app_uid }}" + group: "{{ nextcloud_app_gid }}" + state: directory + +- name: create nextcloud database subdirectory + file: + path: "{{ nextcloud_instance_basepath }}/{{ nextcloud_instances[nextcloud_instance].database.type }}" + owner: "{{ nextcloud_db_uid }}" + group: "{{ nextcloud_db_gid }}" + state: directory + +- name: create nextcloud redis subdirectory + file: + path: "{{ nextcloud_instance_basepath }}/redis" + owner: "{{ nextcloud_redis_uid }}" + group: "{{ nextcloud_redis_gid }}" + state: directory + + +- name: create auxiliary config directory + file: + path: "{{ nextcloud_instance_basepath }}/config" + state: directory + +- name: create apache vhost config + template: + src: apache-site.conf.j2 + dest: "{{ nextcloud_instance_basepath }}/config/apache-site.conf" + +- name: configure apache to run on port 8080 only + copy: + content: | + Listen 8080 + dest: "{{ nextcloud_instance_basepath }}/config/ports.conf" + + +- name: create tls directory + file: + path: "{{ nextcloud_instance_basepath }}/tls" + owner: "{{ nextcloud_app_uid }}" + group: "{{ nextcloud_app_gid }}" + mode: 0500 + state: directory + +- name: generate/install TLS certificates for publishment + vars: + x509_certificate_name: "nextcloud-{{ nextcloud_instance }}_publish" + x509_certificate_hostnames: [] + x509_certificate_config: + ca: "{{ nextcloud_instances[nextcloud_instance].publish.zone.certificate_ca_config }}" + cert: + common_name: "nextcloud-{{ nextcloud_instance }}.{{ inventory_hostname }}" + extended_key_usage: + - serverAuth + extended_key_usage_critical: yes + create_subject_key_identifier: yes + not_after: +100w + x509_certificate_renewal: + install: + - dest: "{{ nextcloud_instance_basepath }}/tls/cert.pem" + src: + - cert + owner: "{{ nextcloud_app_uid }}" + mode: "0400" + - dest: "{{ nextcloud_instance_basepath }}/tls/key.pem" + src: + - key + owner: "{{ nextcloud_app_uid }}" + mode: "0400" + include_role: + name: "x509/{{ nextcloud_instances[nextcloud_instance].publish.zone.certificate_provider }}/cert" + + +- name: build custom image + # when: "'custom_image' in nextcloud_instances[nextcloud_instance]" + include_tasks: custom-image.yml + +- name: install pod manifest + vars: + kubernetes_standalone_pod: + name: "nextcloud-{{ nextcloud_instance }}" + spec: "{{ lookup('template', 'pod-spec-with-{{ nextcloud_instances[nextcloud_instance].database.type }}.yml.j2') }}" + mode: "0600" + config_hash_items: + - path: "{{ nextcloud_instance_basepath }}/config/apache-site.conf" + properties: + - checksum + - path: "{{ nextcloud_instance_basepath }}/config/ports.conf" + properties: + - checksum + - path: "{{ nextcloud_instance_basepath }}/build/Dockerfile" + properties: + - checksum + include_role: + name: kubernetes/standalone/pod + + +- name: install systemd timer unit + template: + src: cron-.timer.j2 + dest: "/etc/systemd/system/nextcloud-cron-{{ nextcloud_instance }}.timer" + +- name: start/enable cron trigger systemd timer + systemd: + daemon_reload: yes + name: "nextcloud-cron-{{ nextcloud_instance }}.timer" + state: started + enabled: yes + + +- name: configure nginx vhost for publishment + vars: + nginx_vhost__yaml: | + name: "nextcloud-{{ nextcloud_instance }}.{{ inventory_hostname }}" + template: generic + {% if 'tls' in nextcloud_instances[nextcloud_instance].publish %} + tls: + {{ nextcloud_instances[nextcloud_instance].publish.tls | to_nice_yaml(indent=2) | indent(2) }} + {% endif %} + hostnames: + {% for hostname in nextcloud_instances[nextcloud_instance].publish.hostnames %} + - {{ hostname }} + {% endfor %} + locations: + '/': + {% if nextcloud_instances[nextcloud_instance].publish.zone.publisher == inventory_hostname %} + proxy_pass: "https://127.0.0.1:{{ nextcloud_instances[nextcloud_instance].port }}" + {% else %} + proxy_pass: "https://{{ ansible_default_ipv4.address }}:{{ nextcloud_instances[nextcloud_instance].port }}" + {% endif %} + proxy_redirect: + - redirect: "https://$host:8080/" + replacement: "https://$host/" + proxy_ssl: + trusted_certificate: "/etc/ssl/apps-publish-{{ nextcloud_instances[nextcloud_instance].publish.zone.name }}/apps-publish-{{ nextcloud_instances[nextcloud_instance].publish.zone.name }}-ca-crt.pem" + verify: "on" + name: "nextcloud-{{ nextcloud_instance }}.{{ inventory_hostname }}" + protocols: "TLSv1.3" + extra_directives: |- + client_max_body_size 0; + types { + text/javascript js mjs; + } + nginx_vhost: "{{ nginx_vhost__yaml | from_yaml }}" + include_role: + name: nginx/vhost + apply: + delegate_to: "{{ nextcloud_instances[nextcloud_instance].publish.zone.publisher }}" + + +# TODO: +# do this automatically! +- name: print info for new instance + when: "'new' in nextcloud_instances[nextcloud_instance] and nextcloud_instances[nextcloud_instance].new" + pause: + seconds: 5 + prompt: | + ************* {{ nextcloud_instance }} is a new instance + ** + ** Go to https://{{ nextcloud_instances[nextcloud_instance].publish.hostnames[0] }} and finalize the + ** installation. After that run the following commands: + ** + ** $ nextcloud-occ {{ nextcloud_instance }} config:system:set default_phone_region --value='at' + ** $ nextcloud-occ {{ nextcloud_instance }} config:system:set memcache.locking --value '\OC\Memcache\Redis' + ** $ nextcloud-occ {{ nextcloud_instance }} config:system:set redis host --value '127.0.0.1' + ** $ nextcloud-occ {{ nextcloud_instance }} config:system:set redis port --type integer --value 6379 + ** $ nextcloud-occ {{ nextcloud_instance }} config:system:set redis timeout --type float --value 0.0 + ** $ nextcloud-occ {{ nextcloud_instance }} config:system:set redis password + ** $ nextcloud-occ {{ nextcloud_instance }} config:system:set maintenance_window_start --type integer --value 23 + ** + ** in case you want to use an exteranl collabora/code server: + ** + ** $ nextcloud-occ {{ nextcloud_instance }} app:disable richdocumentscode + ** $ nextcloud-occ {{ nextcloud_instance }} app:remove richdocumentscode + ** + **************************************** diff --git a/roles/apps/nextcloud/instance/templates/apache-site.conf.j2 b/roles/apps/nextcloud/instance/templates/apache-site.conf.j2 new file mode 100644 index 00000000..8df06113 --- /dev/null +++ b/roles/apps/nextcloud/instance/templates/apache-site.conf.j2 @@ -0,0 +1,20 @@ +IncludeOptional mods-available/socache_shmcb.load +IncludeOptional mods-available/ssl.load +IncludeOptional mods-available/ssl.conf + +<VirtualHost *:8080> + ServerAdmin webmaster@localhost + DocumentRoot /var/www/html + + UseCanonicalName Off + UseCanonicalPhysicalPort Off + + ServerName nextcloud-{{ nextcloud_instance }}.{{ inventory_hostname }} + SSLEngine on + SSLCertificateFile "/etc/ssl/publish/cert.pem" + SSLCertificateKeyFile "/etc/ssl/publish/key.pem" + SSLProtocol TLSv1.3 + + ErrorLog ${APACHE_LOG_DIR}/error.log + CustomLog ${APACHE_LOG_DIR}/access.log combined +</VirtualHost> diff --git a/roles/apps/nextcloud/instance/templates/cron-.timer.j2 b/roles/apps/nextcloud/instance/templates/cron-.timer.j2 new file mode 100644 index 00000000..eead0fd0 --- /dev/null +++ b/roles/apps/nextcloud/instance/templates/cron-.timer.j2 @@ -0,0 +1,9 @@ +[Unit] +Description=Nextcloud cron.php job timer for {{ nextcloud_instance }} + +[Timer] +OnCalendar=*:{{ 5 | random(seed=nextcloud_instance) }}/5 +Unit=nextcloud-cron@{{ nextcloud_instance }}.service + +[Install] +WantedBy=timers.target diff --git a/roles/apps/nextcloud/instance/templates/pod-spec-with-mariadb.yml.j2 b/roles/apps/nextcloud/instance/templates/pod-spec-with-mariadb.yml.j2 new file mode 100644 index 00000000..c1a4f2ea --- /dev/null +++ b/roles/apps/nextcloud/instance/templates/pod-spec-with-mariadb.yml.j2 @@ -0,0 +1,110 @@ +securityContext: + allowPrivilegeEscalation: false +containers: +- name: nextcloud +{# image: "nextcloud{% if 'custom_image' in nextcloud_instances[nextcloud_instance] %}/{{ nextcloud_instance }}{% endif %}:{{ nextcloud_instances[nextcloud_instance].version }}" #} + image: "nextcloud/{{ nextcloud_instance }}:{{ nextcloud_instances[nextcloud_instance].version }}" + securityContext: + runAsUser: {{ nextcloud_app_uid }} + runAsGroup: {{ nextcloud_app_gid }} + resources: + limits: + memory: "4Gi" +{% if 'new' in nextcloud_instances[nextcloud_instance] and nextcloud_instances[nextcloud_instance].new %} + env: + - name: NEXTCLOUD_TRUSTED_DOMAINS + value: "{{ nextcloud_instances[nextcloud_instance].publish.hostnames | join(' ') }}" + - name: MYSQL_HOST + value: 127.0.0.1 + - name: MYSQL_DATABASE + value: nextcloud + - name: MYSQL_USER + value: nextcloud + - name: MYSQL_PASSWORD + value: "{{ nextcloud_instances[nextcloud_instance].database.password }}" +{% endif %} + volumeMounts: + - name: nextcloud + mountPath: /var/www/html + - name: config + mountPath: /etc/apache2/sites-available/000-default.conf + subPath: apache-site.conf + readOnly: true + - name: config + mountPath: /etc/apache2/ports.conf + subPath: ports.conf + readOnly: true + - name: tls + mountPath: /etc/ssl/publish + readOnly: true + ports: + - containerPort: 8080 + hostPort: {{ nextcloud_instances[nextcloud_instance].port }} + hostIP: 127.0.0.1 +- name: redis + image: "redis:{{ nextcloud_instances[nextcloud_instance].redis.version }}" + args: + - --bind 127.0.0.1 + securityContext: + runAsUser: {{ nextcloud_redis_uid }} + runAsGroup: {{ nextcloud_redis_gid }} + resources: + limits: + memory: "512Mi" + volumeMounts: + - name: redis + mountPath: /data +- name: database + image: "mariadb:{{ nextcloud_instances[nextcloud_instance].database.version }}" + args: + - --transaction-isolation=READ-COMMITTED + - --log-bin=binlog + - --binlog-format=ROW +{% for arg in (nextcloud_instances[nextcloud_instance].database.extra_args | default([])) %} + - {{ arg }} +{% endfor %} + securityContext: + runAsUser: {{ nextcloud_db_uid }} + runAsGroup: {{ nextcloud_db_gid }} + resources: + limits: + memory: "2Gi" + env: + - name: MARIADB_AUTO_UPGRADE + value: "true" + - name: MARIADB_DISABLE_UPGRADE_BACKUP + value: "true" +{% if 'new' in nextcloud_instances[nextcloud_instance] and nextcloud_instances[nextcloud_instance].new %} + - name: MARIADB_RANDOM_ROOT_PASSWORD + value: "true" + - name: MARIADB_DATABASE + value: nextcloud + - name: MARIADB_USER + value: nextcloud + - name: MARIADB_PASSWORD + value: "{{ nextcloud_instances[nextcloud_instance].database.password }}" +{% endif %} + volumeMounts: + - name: database + mountPath: /var/lib/mysql +volumes: +- name: config + hostPath: + path: "{{ nextcloud_instance_basepath }}/config/" + type: Directory +- name: tls + hostPath: + path: "{{ nextcloud_instance_basepath }}/tls/" + type: Directory +- name: nextcloud + hostPath: + path: "{{ nextcloud_instance_basepath }}/nextcloud" + type: Directory +- name: redis + hostPath: + path: "{{ nextcloud_instance_basepath }}/redis" + type: Directory +- name: database + hostPath: + path: "{{ nextcloud_instance_basepath }}/{{ nextcloud_instances[nextcloud_instance].database.type }}" + type: Directory diff --git a/roles/apps/nextcloud/meta/main.yml b/roles/apps/nextcloud/meta/main.yml new file mode 100644 index 00000000..c00c47ce --- /dev/null +++ b/roles/apps/nextcloud/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - role: apps/nextcloud/base diff --git a/roles/apps/nextcloud/tasks/main.yml b/roles/apps/nextcloud/tasks/main.yml index d1a11b19..6e81f351 100644 --- a/roles/apps/nextcloud/tasks/main.yml +++ b/roles/apps/nextcloud/tasks/main.yml @@ -1,240 +1,7 @@ --- -- name: create zfs datasets - when: nextcloud_zfs is defined - block: - - name: create zfs base dataset - zfs: - name: "{{ nextcloud_zfs.pool }}/{{ nextcloud_zfs.name }}" - state: present - extra_zfs_properties: "{{ nextcloud_zfs.properties | dehumanize_zfs_properties | default(omit) }}" - - - name: create zfs volumes for instances - loop: "{{ nextcloud_instances | dict2items }}" - loop_control: - label: "{{ item.key }} ({{ (item.value.zfs_properties | default({})).items() | map('join', '=') | join(', ') }})" - zfs: - name: "{{ nextcloud_zfs.pool }}/{{ nextcloud_zfs.name }}/{{ item.key }}" - state: present - extra_zfs_properties: "{{ item.value.zfs_properties | dehumanize_zfs_properties | default(omit) }}" - - - name: configure nextcloud base bath - set_fact: - nextcloud_base_path: "{{ (zfs_pools[nextcloud_zfs.pool].mountpoint, nextcloud_zfs.name) | path_join }}" - - -- name: create instance subdirectories - when: nextcloud_zfs is not defined +- name: instance specific tasks loop: "{{ nextcloud_instances | list }}" - file: - path: "{{ nextcloud_base_path }}/{{ item }}" - state: directory - - - -- name: add group for nextcloud app - group: - name: nc-app - gid: "{{ nextcloud_app_gid }}" - -- name: add user for nextcloud app - user: - name: nc-app - uid: "{{ nextcloud_app_uid }}" - group: nc-app - password: "!" - -- name: create nextcloud app subdirectory - loop: "{{ nextcloud_instances | list }}" - file: - path: "{{ nextcloud_base_path }}/{{ item }}/nextcloud" - owner: "{{ nextcloud_app_uid }}" - group: "{{ nextcloud_app_gid }}" - state: directory - - -- name: add group for nextcloud db - group: - name: nc-db - gid: "{{ nextcloud_db_gid }}" - -- name: add user for nextcloud db - user: - name: nc-db - uid: "{{ nextcloud_db_uid }}" - group: nc-db - password: "!" - -- name: create nextcloud database subdirectory - loop: "{{ nextcloud_instances | dict2items }}" - loop_control: - label: "{{ item.key }} ({{ item.value.database.type }})" - file: - path: "{{ nextcloud_base_path }}/{{ item.key }}/{{ item.value.database.type }}" - owner: "{{ nextcloud_db_uid }}" - group: "{{ nextcloud_db_gid }}" - state: directory - - -- name: add group for nextcloud redis - group: - name: nc-redis - gid: "{{ nextcloud_redis_gid }}" - -- name: add user for nextcloud redis - user: - name: nc-redis - uid: "{{ nextcloud_redis_uid }}" - group: nc-redis - password: "!" - -- name: create nextcloud database subdirectory - loop: "{{ nextcloud_instances | list }}" - file: - path: "{{ nextcloud_base_path }}/{{ item }}/redis" - owner: "{{ nextcloud_redis_uid }}" - group: "{{ nextcloud_redis_gid }}" - state: directory - - -- name: create auxiliary config directory - loop: "{{ nextcloud_instances | list }}" - file: - path: "{{ nextcloud_base_path }}/{{ item }}/config" - state: directory - -- name: create apache vhost config - loop: "{{ nextcloud_instances | list }}" - template: - src: apache-site.conf.j2 - dest: "{{ nextcloud_base_path }}/{{ item }}/config/apache-site.conf" - -- name: configure apache to run on port 8080 only - loop: "{{ nextcloud_instances | list }}" - copy: - content: | - Listen 8080 - dest: "{{ nextcloud_base_path }}/{{ item }}/config/ports.conf" - - -- name: build custom image - loop: "{{ nextcloud_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - # when: "'custom_image' in item.value" - include_tasks: custom-image.yml - -- name: install pod manifest - loop: "{{ nextcloud_instances | dict2items }}" loop_control: - label: "{{ item.key }}" - vars: - kubernetes_standalone_pod: - name: "nextcloud-{{ item.key }}" - spec: "{{ lookup('template', 'pod-spec-with-{{ item.value.database.type }}.yml.j2') }}" - mode: "0600" - config_hash_items: - - path: "{{ nextcloud_base_path }}/{{ item.key }}/config/apache-site.conf" - properties: - - checksum - - path: "{{ nextcloud_base_path }}/{{ item.key }}/config/ports.conf" - properties: - - checksum - - path: "{{ nextcloud_base_path }}/{{ item.key }}/build/Dockerfile" - properties: - - checksum + loop_var: nextcloud_instance include_role: - name: kubernetes/standalone/pod - - -- name: install cron trigger script - loop: "{{ nextcloud_instances | list }}" - template: - src: run-cron.sh.j2 - dest: "{{ nextcloud_base_path }}/{{ item }}/config/run-cron.sh" - mode: 0755 - -- name: install template systemd unit for cron trigger - template: - src: cron@.service.j2 - dest: /etc/systemd/system/nextcloud-cron@.service - -- name: install systemd timer unit - loop: "{{ nextcloud_instances | list }}" - template: - src: cron-.timer.j2 - dest: "/etc/systemd/system/nextcloud-cron-{{ item }}.timer" - -- name: start/enable cron trigger systemd timer - loop: "{{ nextcloud_instances | list }}" - systemd: - daemon_reload: yes - name: "nextcloud-cron-{{ item }}.timer" - state: started - enabled: yes - - -- name: configure nginx vhost - loop: "{{ nextcloud_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - vars: - nginx_vhost: - name: "nextcloud-{{ item.key }}" - template: generic - tls: - certificate_provider: "{{ acme_client }}" - hostnames: "{{ item.value.hostnames }}" - locations: - '/': - proxy_pass: "http://127.0.0.1:{{ item.value.port }}" - proxy_redirect: - - redirect: "http://$host/" - replacement: "https://$host/" - - redirect: "http://$host:8080/" - replacement: "https://$host/" - extra_directives: |- - client_max_body_size 0; - types { - text/javascript js mjs; - } - include_role: - name: nginx/vhost - - -- name: install management scripts - loop: - - nextcloud-upgrade - - nextcloud-occ - template: - src: "{{ item }}.j2" - dest: "/usr/local/bin/{{ item }}" - mode: 0755 - -## TODO: -# do this automatically! -- name: print info for new instance - loop: "{{ nextcloud_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - when: "'new' in item.value and item.value.new" - pause: - seconds: 5 - prompt: | - ************* {{ item.key }} is a new instance - ** - ** Go to https://{{ item.value.hostnames[0] }} and finalize the - ** installation. After that run the following commands: - ** - ** $ nextcloud-occ {{ item.key }} config:system:set default_phone_region --value='at' - ** $ nextcloud-occ {{ item.key }} config:system:set memcache.locking --value '\OC\Memcache\Redis' - ** $ nextcloud-occ {{ item.key }} config:system:set redis host --value '127.0.0.1' - ** $ nextcloud-occ {{ item.key }} config:system:set redis port --type integer --value 6379 - ** $ nextcloud-occ {{ item.key }} config:system:set redis timeout --type float --value 0.0 - ** $ nextcloud-occ {{ item.key }} config:system:set redis password - ** - ** in case you want to use an exteranl collabora/code server: - ** - ** $ nextcloud-occ {{ item.key }} app:disable richdocumentscode - ** $ nextcloud-occ {{ item.key }} app:remove richdocumentscode - ** - **************************************** + name: apps/nextcloud/instance diff --git a/roles/apps/nextcloud/templates/apache-site.conf.j2 b/roles/apps/nextcloud/templates/apache-site.conf.j2 deleted file mode 100644 index a52a7fc5..00000000 --- a/roles/apps/nextcloud/templates/apache-site.conf.j2 +++ /dev/null @@ -1,10 +0,0 @@ -<VirtualHost *:8080> - ServerAdmin webmaster@localhost - DocumentRoot /var/www/html - - UseCanonicalName Off - UseCanonicalPhysicalPort Off - - ErrorLog ${APACHE_LOG_DIR}/error.log - CustomLog ${APACHE_LOG_DIR}/access.log combined -</VirtualHost> diff --git a/roles/apps/nextcloud/templates/cron-.timer.j2 b/roles/apps/nextcloud/templates/cron-.timer.j2 deleted file mode 100644 index 0c3f7cd7..00000000 --- a/roles/apps/nextcloud/templates/cron-.timer.j2 +++ /dev/null @@ -1,9 +0,0 @@ -[Unit] -Description=Nextcloud cron.php job timer for %i - -[Timer] -OnCalendar=*:{{ 5 | random(seed=item) }}/5 -Unit=nextcloud-cron@{{ item }}.service - -[Install] -WantedBy=timers.target diff --git a/roles/apps/nextcloud/templates/pod-spec-with-mariadb.yml.j2 b/roles/apps/nextcloud/templates/pod-spec-with-mariadb.yml.j2 deleted file mode 100644 index a49bc3ea..00000000 --- a/roles/apps/nextcloud/templates/pod-spec-with-mariadb.yml.j2 +++ /dev/null @@ -1,101 +0,0 @@ -securityContext: - allowPrivilegeEscalation: false -containers: -- name: nextcloud -{# image: "nextcloud{% if 'custom_image' in item.value %}/{{ item.key }}{% endif %}:{{ item.value.version }}" #} - image: "nextcloud/{{ item.key }}:{{ item.value.version }}" - securityContext: - runAsUser: {{ nextcloud_app_uid }} - runAsGroup: {{ nextcloud_app_gid }} - resources: - limits: - memory: "4Gi" -{% if 'new' in item.value and item.value.new %} - env: - - name: NEXTCLOUD_TRUSTED_DOMAINS - value: "{{ item.value.hostnames | join(' ') }}" - - name: OVERWRITEPROTOCOL - value: "https" - - name: MYSQL_HOST - value: 127.0.0.1 - - name: MYSQL_DATABASE - value: nextcloud - - name: MYSQL_USER - value: nextcloud - - name: MYSQL_PASSWORD - value: "{{ item.value.database.password }}" -{% endif %} - volumeMounts: - - name: nextcloud - mountPath: /var/www/html - - name: config - mountPath: /etc/apache2/sites-available/000-default.conf - subPath: apache-site.conf - readOnly: true - - name: config - mountPath: /etc/apache2/ports.conf - subPath: ports.conf - readOnly: true - ports: - - containerPort: 8080 - hostPort: {{ item.value.port }} - hostIP: 127.0.0.1 -- name: redis - image: "redis:{{ item.value.redis.version }}" - args: - - --bind 127.0.0.1 - securityContext: - runAsUser: {{ nextcloud_redis_uid }} - runAsGroup: {{ nextcloud_redis_gid }} - resources: - limits: - memory: "512Mi" - volumeMounts: - - name: redis - mountPath: /data -- name: database - image: "mariadb:{{ item.value.database.version }}" - args: - - --transaction-isolation=READ-COMMITTED - - --log-bin=binlog - - --binlog-format=ROW -{% for arg in (item.value.database.extra_args | default([])) %} - - {{ arg }} -{% endfor %} - securityContext: - runAsUser: {{ nextcloud_db_uid }} - runAsGroup: {{ nextcloud_db_gid }} - resources: - limits: - memory: "2Gi" -{% if 'new' in item.value and item.value.new %} - env: - - name: MYSQL_RANDOM_ROOT_PASSWORD - value: "true" - - name: MYSQL_DATABASE - value: nextcloud - - name: MYSQL_USER - value: nextcloud - - name: MYSQL_PASSWORD - value: "{{ item.value.database.password }}" -{% endif %} - volumeMounts: - - name: database - mountPath: /var/lib/mysql -volumes: -- name: config - hostPath: - path: "{{ nextcloud_base_path }}/{{ item.key }}/config/" - type: Directory -- name: nextcloud - hostPath: - path: "{{ nextcloud_base_path }}/{{ item.key }}/nextcloud" - type: Directory -- name: redis - hostPath: - path: "{{ nextcloud_base_path }}/{{ item.key }}/redis" - type: Directory -- name: database - hostPath: - path: "{{ nextcloud_base_path }}/{{ item.key }}/{{ item.value.database.type }}" - type: Directory diff --git a/roles/apps/nextcloud/templates/run-cron.sh.j2 b/roles/apps/nextcloud/templates/run-cron.sh.j2 deleted file mode 100644 index 455bc3ec..00000000 --- a/roles/apps/nextcloud/templates/run-cron.sh.j2 +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash - -POD_NAME="{{ item }}-$(hostname)" -POD_ID=$(crictl pods --name "$POD_NAME" --state ready -q) -CONTAINER_ID=$(crictl ps --pod "$POD_ID" --name nextcloud -q) - -exec crictl exec "$CONTAINER_ID" php -f /var/www/html/cron.php diff --git a/roles/apps/onlyoffice/defaults/main.yml b/roles/apps/onlyoffice/defaults/main.yml index 1ea4773a..7e33368d 100644 --- a/roles/apps/onlyoffice/defaults/main.yml +++ b/roles/apps/onlyoffice/defaults/main.yml @@ -1,30 +1,21 @@ --- -# onlyoffice_app_uid: "960" -# onlyoffice_app_gid: "960" - -onlyoffice_db_uid: "961" -onlyoffice_db_gid: "961" - -# onlyoffice_amqp_uid: "962" -# onlyoffice_amqp_gid: "962" - -# onlyoffice_base_path: /srv/onlyoffice - -# onlyoffice_zfs: -# pool: storage -# name: onlyoffice -# properties: -# compression: lz4 - # onlyoffice_instances: # example: # version: 6.2.1.24 # port: 8600 # hostname: office.example.com # jwt_secret: very-secure-password +# storage: +# type: ... # database: # version: 9.5.25 # password: secret # amqp: # version: 3.8.14 # password: secret +# publish: +# zone: "{{ apps_publish_zone__foo }}" +# hostnames: +# - office.example.com +# tls: +# certificate_provider: ... diff --git a/roles/apps/onlyoffice/instance/tasks/main.yml b/roles/apps/onlyoffice/instance/tasks/main.yml new file mode 100644 index 00000000..2ca6026d --- /dev/null +++ b/roles/apps/onlyoffice/instance/tasks/main.yml @@ -0,0 +1,88 @@ +--- +- name: prepare storage volume + vars: + storage_volume: "{{ onlyoffice_instances[onlyoffice_instance].storage }}" + include_role: + name: "storage/{{ onlyoffice_instances[onlyoffice_instance].storage.type }}/volume" + +- set_fact: + onlyoffice_instance_basepath: "{{ storage_volume_mountpoint }}" + +- name: create onlyoffice database subdirectory + file: + path: "{{ onlyoffice_instance_basepath }}/postgres" + state: directory + +- name: create onlyoffice tls subdirectory + file: + path: "{{ onlyoffice_instance_basepath }}/tls" + state: directory + mode: 0700 + +- name: generate/install TLS certificates for publishment + vars: + x509_certificate_name: "onlyoffice-{{ onlyoffice_instance }}_publish" + x509_certificate_hostnames: [] + x509_certificate_config: + ca: "{{ onlyoffice_instances[onlyoffice_instance].publish.zone.certificate_ca_config }}" + cert: + common_name: "onlyoffice-{{ onlyoffice_instance }}.{{ inventory_hostname }}" + extended_key_usage: + - serverAuth + extended_key_usage_critical: yes + create_subject_key_identifier: yes + not_after: +100w + x509_certificate_renewal: + install: + - dest: "{{ onlyoffice_instance_basepath }}/tls/onlyoffice.crt" + src: + - cert + mode: "0400" + - dest: "{{ onlyoffice_instance_basepath }}/tls/onlyoffice.key" + src: + - key + mode: "0400" + include_role: + name: "x509/{{ onlyoffice_instances[onlyoffice_instance].publish.zone.certificate_provider }}/cert" + +- name: install pod manifest + vars: + kubernetes_standalone_pod: + name: "onlyoffice-{{ onlyoffice_instance }}" + spec: "{{ lookup('template', 'pod-spec.yml.j2') }}" + mode: "0600" + include_role: + name: kubernetes/standalone/pod + +- name: configure nginx vhost for publishment + vars: + nginx_vhost__yaml: | + name: "onlyoffice-{{ onlyoffice_instance }}.{{ inventory_hostname }}" + template: generic + {% if 'tls' in onlyoffice_instances[onlyoffice_instance].publish %} + tls: + {{ onlyoffice_instances[onlyoffice_instance].publish.tls | to_nice_yaml(indent=2) | indent(2) }} + {% endif %} + hostnames: + {% for hostname in onlyoffice_instances[onlyoffice_instance].publish.hostnames %} + - {{ hostname }} + {% endfor %} + locations: + '/': + {% if onlyoffice_instances[onlyoffice_instance].publish.zone.publisher == inventory_hostname %} + proxy_pass: "https://127.0.0.1:{{ onlyoffice_instances[onlyoffice_instance].port }}" + {% else %} + proxy_pass: "https://{{ ansible_default_ipv4.address }}:{{ onlyoffice_instances[onlyoffice_instance].port }}" + {% endif %} + proxy_ssl: + trusted_certificate: "/etc/ssl/apps-publish-{{ onlyoffice_instances[onlyoffice_instance].publish.zone.name }}/apps-publish-{{ onlyoffice_instances[onlyoffice_instance].publish.zone.name }}-ca-crt.pem" + verify: "on" + name: "onlyoffice-{{ onlyoffice_instance }}.{{ inventory_hostname }}" + protocols: "TLSv1.2 TLSv1.3" + extra_directives: |- + client_max_body_size 0; + nginx_vhost: "{{ nginx_vhost__yaml | from_yaml }}" + include_role: + name: nginx/vhost + apply: + delegate_to: "{{ onlyoffice_instances[onlyoffice_instance].publish.zone.publisher }}" diff --git a/roles/apps/onlyoffice/instance/templates/pod-spec.yml.j2 b/roles/apps/onlyoffice/instance/templates/pod-spec.yml.j2 new file mode 100644 index 00000000..ec70f8c1 --- /dev/null +++ b/roles/apps/onlyoffice/instance/templates/pod-spec.yml.j2 @@ -0,0 +1,75 @@ +terminationGracePeriodSeconds: 120 +containers: +- name: documentserver + image: "onlyoffice/documentserver:{{ onlyoffice_instances[onlyoffice_instance].version }}" + resources: + limits: + memory: "4Gi" + env: + - name: "DB_TYPE" + value: "postgres" + - name: "DB_HOST" + value: "127.0.0.1" + - name: "DB_PORT" + value: "5432" + - name: "DB_NAME" + value: "onlyoffice" + - name: "DB_USER" + value: "onlyoffice" + - name: "DB_PWD" + value: "{{ onlyoffice_instances[onlyoffice_instance].database.password }}" + - name: "AMQP_TYPE" + value: "rabbitmq" + - name: "AMQP_URI" + value: "amqp://onlyoffice:{{ onlyoffice_instances[onlyoffice_instance].amqp.password }}@127.0.0.1:5672" + - name: "JWT_ENABLED" + value: "true" + - name: "JWT_SECRET" + value: "{{ onlyoffice_instances[onlyoffice_instance].jwt_secret }}" + volumeMounts: + - name: tls + mountPath: /var/www/onlyoffice/Data/certs/ + readOnly: true + ports: + - containerPort: 443 + hostPort: {{ onlyoffice_instances[onlyoffice_instance].port }} + hostIP: 127.0.0.1 + +- name: postgresql + image: "postgres:{{ onlyoffice_instances[onlyoffice_instance].database.version }}" + args: + - postgres + - -c + - listen_addresses=127.0.0.1 + env: + - name: "POSTGRES_DB" + value: "onlyoffice" + - name: "POSTGRES_USER" + value: "onlyoffice" + - name: "POSTGRES_PASSWORD" + value: "{{ onlyoffice_instances[onlyoffice_instance].database.password }}" + volumeMounts: + - name: postgres + mountPath: /var/lib/postgresql/data + +- name: rabbitmq + image: "rabbitmq:{{ onlyoffice_instances[onlyoffice_instance].amqp.version }}" + env: + - name: "RABBITMQ_NODENAME" + value: "rabbit@localhost" + - name: "RABBITMQ_NODE_IP_ADDRESS" + value: "127.0.0.1" + - name: "RABBITMQ_DEFAULT_USER" + value: "onlyoffice" + - name: "RABBITMQ_DEFAULT_PASS" + value: "{{ onlyoffice_instances[onlyoffice_instance].amqp.password }}" + +volumes: +- name: tls + hostPath: + path: "{{ onlyoffice_instance_basepath }}/tls" + type: Directory +- name: postgres + hostPath: + path: "{{ onlyoffice_instance_basepath }}/postgres" + type: Directory diff --git a/roles/apps/onlyoffice/tasks/main.yml b/roles/apps/onlyoffice/tasks/main.yml index 960e811b..a42ee589 100644 --- a/roles/apps/onlyoffice/tasks/main.yml +++ b/roles/apps/onlyoffice/tasks/main.yml @@ -1,153 +1,7 @@ --- -- name: create zfs datasets - when: onlyoffice_zfs is defined - block: - - name: create zfs base dataset - zfs: - name: "{{ onlyoffice_zfs.pool }}/{{ onlyoffice_zfs.name }}" - state: present - extra_zfs_properties: "{{ onlyoffice_zfs.properties | dehumanize_zfs_properties | default(omit) }}" - - - name: create zfs volumes for instances - loop: "{{ onlyoffice_instances | dict2items }}" - loop_control: - label: "{{ item.key }} ({{ (item.value.zfs_properties | default({})).items() | map('join', '=') | join(', ') }})" - zfs: - name: "{{ onlyoffice_zfs.pool }}/{{ onlyoffice_zfs.name }}/{{ item.key }}" - state: present - extra_zfs_properties: "{{ item.value.zfs_properties | dehumanize_zfs_properties | default(omit) }}" - - - name: configure onlyoffice base bath - set_fact: - onlyoffice_base_path: "{{ (zfs_pools[onlyoffice_zfs.pool].mountpoint, onlyoffice_zfs.name) | path_join }}" - - -- name: create instance subdirectories - when: onlyoffice_zfs is not defined +- name: instance specific tasks loop: "{{ onlyoffice_instances | list }}" - file: - path: "{{ onlyoffice_base_path }}/{{ item }}" - state: directory - - -# TODO: run documentserver components as non-root -# - name: add group for onlyoffice app -# group: -# name: oo-app -# gid: "{{ onlyoffice_app_gid }}" - -# - name: add user for onlyoffice app -# user: -# name: oo-app -# uid: "{{ onlyoffice_app_uid }}" -# group: oo-app -# password: "!" - -# - name: create onlyoffice app subdirectory -# loop: "{{ onlyoffice_instances | list }}" -# file: -# path: "{{ onlyoffice_base_path }}/{{ item }}/onlyoffice" -# owner: "{{ onlyoffice_app_uid }}" -# group: "{{ onlyoffice_app_gid }}" -# state: directory - - -- name: add group for onlyoffice db - group: - name: oo-db - gid: "{{ onlyoffice_db_gid }}" - -- name: add user for onlyoffice db - user: - name: oo-db - uid: "{{ onlyoffice_db_uid }}" - group: oo-db - password: "!" - -- name: create onlyoffice database subdirectory - loop: "{{ onlyoffice_instances | dict2items}}" loop_control: - label: "{{ item.key }}" - file: - path: "{{ onlyoffice_base_path }}/{{ item.key }}/postgres" - owner: "{{ onlyoffice_db_uid }}" - group: "{{ onlyoffice_db_gid }}" - state: directory - - -# TODO: run documentserver components as non-root -# - name: add group for onlyoffice aqmp -# group: -# name: oo-aqmp -# gid: "{{ onlyoffice_aqmp_gid }}" - -# - name: add user for onlyoffice aqmp -# user: -# name: oo-aqmp -# uid: "{{ onlyoffice_aqmp_uid }}" -# group: oo-aqmp -# password: "!" - -# - name: create onlyoffice aqmp subdirectory -# loop: "{{ onlyoffice_instances | list }}" -# file: -# path: "{{ onlyoffice_base_path }}/{{ item }}/onlyoffice" -# owner: "{{ onlyoffice_aqmp_uid }}" -# group: "{{ onlyoffice_aqmp_gid }}" -# state: directory - -# TODO: AQMP config? -# - name: create onlyoffice rabbitmq subdirectory -# loop: "{{ onlyoffice_instances | dict2items}}" -# loop_control: -# label: "{{ item.key }}" -# file: -# path: "{{ onlyoffice_base_path }}/{{ item.key }}/rabbitmq" -# state: directory - -# - name: install rabbitmq config snipped -# loop: "{{ onlyoffice_instances | dict2items}}" -# loop_control: -# label: "{{ item.key }}" -# copy: -# dest: "{{ onlyoffice_base_path }}/{{ item.key }}/rabbitmq/config" -# content: | -# management.tcp.ip = 127.0.0.1 - - -- name: install pod manifest - loop: "{{ onlyoffice_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - vars: - kubernetes_standalone_pod: - name: "onlyoffice-{{ item.key }}" - spec: "{{ lookup('template', 'pod-spec.yml.j2') }}" - mode: "0600" -# TODO: AQMP config? -# config_hash_items: -# - path: "{{ onlyoffice_base_path }}/{{ item.key }}/rabbitmq/config" -# properties: -# - checksum - include_role: - name: kubernetes/standalone/pod - -- name: configure nginx vhost - loop: "{{ onlyoffice_instances | dict2items }}" - loop_control: - label: "{{ item.key }}" - vars: - nginx_vhost: - name: "onlyoffice-{{ item.key }}" - template: generic - tls: - certificate_provider: "{{ acme_client }}" - hostnames: - - "{{ item.value.hostname }}" - locations: - '/': - proxy_pass: "http://127.0.0.1:{{ item.value.port }}" - extra_directives: |- - client_max_body_size 0; + loop_var: onlyoffice_instance include_role: - name: nginx/vhost + name: apps/onlyoffice/instance diff --git a/roles/apps/onlyoffice/templates/pod-spec.yml.j2 b/roles/apps/onlyoffice/templates/pod-spec.yml.j2 deleted file mode 100644 index 620e0d18..00000000 --- a/roles/apps/onlyoffice/templates/pod-spec.yml.j2 +++ /dev/null @@ -1,102 +0,0 @@ -{# TODO: -securityContext: - allowPrivilegeEscalation: false -#} -terminationGracePeriodSeconds: 120 -containers: -{# TODO: only listen to localhost #} -- name: documentserver - image: "onlyoffice/documentserver:{{ item.value.version }}" - resources: - limits: - memory: "4Gi" -{# TODO: - securityContext: - allowPrivilegeEscalation: false - runAsUser: {{ onlyoffice_amqp_uid }} - runAsGroup: {{ onlyoffice_amqp_gid }} -#} - env: - - name: "DB_TYPE" - value: "postgres" - - name: "DB_HOST" - value: "127.0.0.1" - - name: "DB_PORT" - value: "5432" - - name: "DB_NAME" - value: "onlyoffice" - - name: "DB_USER" - value: "onlyoffice" - - name: "DB_PWD" - value: "{{ item.value.database.password }}" - - name: "AMQP_TYPE" - value: "rabbitmq" - - name: "AMQP_URI" - value: "amqp://onlyoffice:{{ item.value.amqp.password }}@127.0.0.1:5672" - - name: "JWT_ENABLED" - value: "true" - - name: "JWT_SECRET" - value: "{{ item.value.jwt_secret }}" - ports: - - containerPort: 80 - hostPort: {{ item.value.port }} - hostIP: 127.0.0.1 - -- name: postgresql - image: "postgres:{{ item.value.database.version }}" - args: - - postgres - - -c - - listen_addresses=127.0.0.1 - securityContext: - allowPrivilegeEscalation: false - runAsUser: {{ onlyoffice_db_uid }} - runAsGroup: {{ onlyoffice_db_gid }} - env: - - name: "POSTGRES_DB" - value: "onlyoffice" - - name: "POSTGRES_USER" - value: "onlyoffice" - - name: "POSTGRES_PASSWORD" - value: "{{ item.value.database.password }}" - volumeMounts: - - name: postgres - mountPath: /var/lib/postgresql/data - -{# TODO: only listen to localhost #} -- name: rabbitmq - image: "rabbitmq:{{ item.value.amqp.version }}" -{# TODO: - securityContext: - allowPrivilegeEscalation: false - runAsUser: {{ onlyoffice_amqp_uid }} - runAsGroup: {{ onlyoffice_amqp_gid }} -#} - env: - - name: "RABBITMQ_NODENAME" - value: "rabbit@localhost" - - name: "RABBITMQ_NODE_IP_ADDRESS" - value: "127.0.0.1" - - name: "RABBITMQ_DEFAULT_USER" - value: "onlyoffice" - - name: "RABBITMQ_DEFAULT_PASS" - value: "{{ item.value.amqp.password }}" -{# TODO: AQMP config? - volumeMounts: - - name: rabbitmq - mountPath: /etc/rabbitmq/conf.d/k8s.conf - subPath: config - readOnly: true -#} - -volumes: -- name: postgres - hostPath: - path: "{{ onlyoffice_base_path }}/{{ item.key }}/postgres" - type: Directory -{# TODO: AQMP config? -- name: rabbitmq - hostPath: - path: "{{ onlyoffice_base_path }}/{{ item.key }}/rabbitmq" - type: Directory -#} diff --git a/roles/apt-repo/qmk/files/repo.gpg b/roles/apt-repo/qmk/files/repo.gpg Binary files differnew file mode 100644 index 00000000..b9c59a08 --- /dev/null +++ b/roles/apt-repo/qmk/files/repo.gpg diff --git a/roles/apt-repo/qmk/tasks/main.yml b/roles/apt-repo/qmk/tasks/main.yml new file mode 100644 index 00000000..90bb9c9f --- /dev/null +++ b/roles/apt-repo/qmk/tasks/main.yml @@ -0,0 +1,18 @@ +--- +- name: add repository key + copy: + src: repo.gpg + dest: /etc/apt/keyrings/qmk.gpg + register: apt_repo_qmk_key + +- name: add repository entry + copy: + content: | + deb [signed-by=/etc/apt/keyrings/qmk.gpg] https://linux.qmk.fm/ {{ ansible_distribution_release }} main + dest: /etc/apt/sources.list.d/qmk.list + register: apt_repo_qmk_sources + +- name: update apt cache + when: apt_repo_qmk_key is changed or + apt_repo_qmk_sources is changed + command: apt-get update diff --git a/roles/cloud/install/filter_plugins/hetzner.py b/roles/cloud/install/filter_plugins/hetzner.py index d01be0ba..052d0b29 100644 --- a/roles/cloud/install/filter_plugins/hetzner.py +++ b/roles/cloud/install/filter_plugins/hetzner.py @@ -28,7 +28,6 @@ class FilterModule(object): def filters(self): return { - 'hetzner_install_image_name_glob': hetzner_install_image_name_glob, 'hroot_extract_ssh_key_fingerprints': hroot_extract_ssh_key_fingerprints, 'hroot_extract_serverip': hroot_extract_serverip, } diff --git a/roles/core/sshd/jump/defaults/main.yml b/roles/core/sshd/jump/defaults/main.yml index ada0554a..63546eaa 100644 --- a/roles/core/sshd/jump/defaults/main.yml +++ b/roles/core/sshd/jump/defaults/main.yml @@ -6,3 +6,10 @@ # - ssh-rsa ... # permit_open: # - host:port +# foo: +# authorized_keys: +# - ssh-ed25519 .... +# - ssh-rsa ... +# tcp_forwarding: remote +# permit_listen: +# - 22001 diff --git a/roles/core/sshd/jump/tasks/main.yml b/roles/core/sshd/jump/tasks/main.yml index 2120cbd6..59cb4f66 100644 --- a/roles/core/sshd/jump/tasks/main.yml +++ b/roles/core/sshd/jump/tasks/main.yml @@ -49,9 +49,9 @@ AllowAgentForwarding no AllowStreamLocalForwarding no ForceCommand /sbin/nologin - AllowTcpForwarding local + AllowTcpForwarding {{ config.tcp_forwarding | default('local') }} PermitOpen {{ config.permit_open | default(['any']) | list | join(' ') }} - PermitListen none + PermitListen {{ config.permit_listen | default(['none']) | list | join(' ') }} {% if not loop.last %} {% endif %} diff --git a/roles/greenbone/server/templates/docker-compose-22.4.yml.j2 b/roles/greenbone/server/templates/docker-compose-22.4.yml.j2 index 85742836..8c007ee9 100644 --- a/roles/greenbone/server/templates/docker-compose-22.4.yml.j2 +++ b/roles/greenbone/server/templates/docker-compose-22.4.yml.j2 @@ -1,65 +1,65 @@ services: vulnerability-tests: - image: greenbone/vulnerability-tests + image: registry.community.greenbone.net/community/vulnerability-tests environment: STORAGE_PATH: /var/lib/openvas/22.04/vt-data/nasl volumes: - vt_data_vol:/mnt notus-data: - image: greenbone/notus-data + image: registry.community.greenbone.net/community/notus-data volumes: - notus_data_vol:/mnt scap-data: - image: greenbone/scap-data + image: registry.community.greenbone.net/community/scap-data volumes: - scap_data_vol:/mnt cert-bund-data: - image: greenbone/cert-bund-data + image: registry.community.greenbone.net/community/cert-bund-data volumes: - cert_data_vol:/mnt dfn-cert-data: - image: greenbone/dfn-cert-data + image: registry.community.greenbone.net/community/dfn-cert-data volumes: - cert_data_vol:/mnt depends_on: - cert-bund-data data-objects: - image: greenbone/data-objects + image: registry.community.greenbone.net/community/data-objects volumes: - data_objects_vol:/mnt report-formats: - image: greenbone/report-formats + image: registry.community.greenbone.net/community/report-formats volumes: - data_objects_vol:/mnt depends_on: - data-objects gpg-data: - image: greenbone/gpg-data + image: registry.community.greenbone.net/community/gpg-data volumes: - gpg_data_vol:/mnt redis-server: - image: greenbone/redis-server + image: registry.community.greenbone.net/community/redis-server restart: on-failure volumes: - redis_socket_vol:/run/redis/ pg-gvm: - image: greenbone/pg-gvm:stable + image: registry.community.greenbone.net/community/pg-gvm:stable restart: on-failure volumes: - psql_data_vol:/var/lib/postgresql - psql_socket_vol:/var/run/postgresql gvmd: - image: greenbone/gvmd:stable + image: registry.community.greenbone.net/community/gvmd:stable restart: on-failure volumes: - gvmd_data_vol:/var/lib/gvm @@ -86,7 +86,7 @@ services: condition: service_completed_successfully gsa: - image: greenbone/gsa:stable + image: registry.community.greenbone.net/community/gsa:stable restart: on-failure ports: - 127.0.0.1:9392:80 @@ -94,9 +94,73 @@ services: - gvmd_socket_vol:/run/gvmd depends_on: - gvmd + # Sets log level of openvas to the set LOG_LEVEL within the env + # and changes log output to /var/log/openvas instead /var/log/gvm + # to reduce likelyhood of unwanted log interferences + configure-openvas: + image: registry.community.greenbone.net/community/openvas-scanner:stable + volumes: + - openvas_data_vol:/mnt + - openvas_log_data_vol:/var/log/openvas + command: + - /bin/sh + - -c + - | + printf "table_driven_lsc = yes\nopenvasd_server = http://openvasd:80\n" > /mnt/openvas.conf + sed "s/level=.*/level=INFO/" /etc/openvas/openvas_log.conf | sed 's/gvm/openvas/' > /mnt/openvas_log.conf + chmod 644 /mnt/openvas.conf + chmod 644 /mnt/openvas_log.conf + touch /var/log/openvas/openvas.log + chmod 666 /var/log/openvas/openvas.log + + # shows logs of openvas + openvas: + image: registry.community.greenbone.net/community/openvas-scanner:stable + restart: on-failure + volumes: + - openvas_data_vol:/etc/openvas + - openvas_log_data_vol:/var/log/openvas + command: + - /bin/sh + - -c + - | + cat /etc/openvas/openvas.conf + tail -f /var/log/openvas/openvas.log + depends_on: + configure-openvas: + condition: service_completed_successfully + + openvasd: + image: registry.community.greenbone.net/community/openvas-scanner:stable + restart: on-failure + environment: + # `service_notus` is set to disable everything but notus, + # if you want to utilize openvasd directly removed `OPENVASD_MODE` + OPENVASD_MODE: service_notus + GNUPGHOME: /etc/openvas/gnupg + LISTENING: 0.0.0.0:80 + volumes: + - openvas_data_vol:/etc/openvas + - openvas_log_data_vol:/var/log/openvas + - gpg_data_vol:/etc/openvas/gnupg + - notus_data_vol:/var/lib/notus + # enable port forwarding when you want to use the http api from your host machine + # ports: + # - 127.0.0.1:3000:80 + depends_on: + vulnerability-tests: + condition: service_completed_successfully + configure-openvas: + condition: service_completed_successfully + gpg-data: + condition: service_completed_successfully + networks: + default: + aliases: + - openvasd ospd-openvas: - image: greenbone/ospd-openvas:stable + image: registry.community.greenbone.net/community/ospd-openvas:stable restart: on-failure hostname: ospd-openvas.local cap_add: @@ -111,8 +175,6 @@ services: "-f", "--config", "/etc/gvm/ospd-openvas.conf", - "--mqtt-broker-address", - "mqtt-broker", "--notus-feed-dir", "/var/lib/notus/advisories", "-m", @@ -124,6 +186,8 @@ services: - notus_data_vol:/var/lib/notus - ospd_openvas_socket_vol:/run/ospd - redis_socket_vol:/run/redis/ + - openvas_data_vol:/etc/openvas/ + - openvas_log_data_vol:/var/log/openvas depends_on: redis-server: condition: service_started @@ -131,32 +195,11 @@ services: condition: service_completed_successfully vulnerability-tests: condition: service_completed_successfully - - mqtt-broker: - restart: on-failure - image: greenbone/mqtt-broker - networks: - default: - aliases: - - mqtt-broker - - broker - - notus-scanner: - restart: on-failure - image: greenbone/notus-scanner:stable - volumes: - - notus_data_vol:/var/lib/notus - - gpg_data_vol:/etc/openvas/gnupg - environment: - NOTUS_SCANNER_MQTT_BROKER_ADDRESS: mqtt-broker - NOTUS_SCANNER_PRODUCTS_DIRECTORY: /var/lib/notus/products - depends_on: - - mqtt-broker - - gpg-data - - vulnerability-tests + configure-openvas: + condition: service_completed_successfully gvm-tools: - image: greenbone/gvm-tools + image: registry.community.greenbone.net/community/gvm-tools volumes: - gvmd_socket_vol:/run/gvmd - ospd_openvas_socket_vol:/run/ospd @@ -177,3 +220,5 @@ volumes: gvmd_socket_vol: ospd_openvas_socket_vol: redis_socket_vol: + openvas_data_vol: + openvas_log_data_vol: diff --git a/roles/installer/ubuntu/autoinstall/templates/autoinstall.yml.j2 b/roles/installer/ubuntu/autoinstall/templates/autoinstall.yml.j2 index 1de70b70..efee3941 100644 --- a/roles/installer/ubuntu/autoinstall/templates/autoinstall.yml.j2 +++ b/roles/installer/ubuntu/autoinstall/templates/autoinstall.yml.j2 @@ -272,7 +272,7 @@ autoinstall: - curtin in-target --target=/target -- apt-get -y -q purge systemd-oomd {% endif %} {% if (install_codename | ubuntu_release_compare('>=', 'noble')) %} - - curtin in-target --target=/target -- apt-get -y -q purge ubuntu-kernel-accessories ubuntu-pro-client lxd-installer + - curtin in-target --target=/target -- apt-get -y -q purge ubuntu-kernel-accessories ubuntu-pro-client lxd-installer unminimize {% endif %} {% if ubuntu_autoinstall_desktop is undefined %} - curtin in-target --target=/target -- apt-mark manual iputils-ping isc-dhcp-client netcat-openbsd netplan.io sudo diff --git a/roles/monitoring/grafana/files/dashboard-standalone-kubelet-overview.json b/roles/monitoring/grafana/files/dashboard-apps/standalone-kubelet-overview.json index 5ff9a338..5ff9a338 100644 --- a/roles/monitoring/grafana/files/dashboard-standalone-kubelet-overview.json +++ b/roles/monitoring/grafana/files/dashboard-apps/standalone-kubelet-overview.json diff --git a/roles/monitoring/grafana/files/dashboard-network-ups-tools.json b/roles/monitoring/grafana/files/dashboard-environment/network-ups-tools.json index 367e9b56..367e9b56 100644 --- a/roles/monitoring/grafana/files/dashboard-network-ups-tools.json +++ b/roles/monitoring/grafana/files/dashboard-environment/network-ups-tools.json diff --git a/roles/monitoring/grafana/files/dashboard-environment-sensors.json b/roles/monitoring/grafana/files/dashboard-environment/sensors.json index 78734478..78734478 100644 --- a/roles/monitoring/grafana/files/dashboard-environment-sensors.json +++ b/roles/monitoring/grafana/files/dashboard-environment/sensors.json diff --git a/roles/monitoring/grafana/files/dashboard-bind.json b/roles/monitoring/grafana/files/dashboard-net/bind.json index 1a18bf04..1a18bf04 100644 --- a/roles/monitoring/grafana/files/dashboard-bind.json +++ b/roles/monitoring/grafana/files/dashboard-net/bind.json diff --git a/roles/monitoring/grafana/files/dashboard-chrony.json b/roles/monitoring/grafana/files/dashboard-net/chrony.json index 2c093cf6..2c093cf6 100644 --- a/roles/monitoring/grafana/files/dashboard-chrony.json +++ b/roles/monitoring/grafana/files/dashboard-net/chrony.json diff --git a/roles/monitoring/grafana/files/dashboard-net/coredns.json b/roles/monitoring/grafana/files/dashboard-net/coredns.json new file mode 100644 index 00000000..61776b09 --- /dev/null +++ b/roles/monitoring/grafana/files/dashboard-net/coredns.json @@ -0,0 +1,2463 @@ +{ + "__inputs": [ + { + "name": "DS_PROMETHEUS", + "label": "Prometheus", + "description": "", + "type": "datasource", + "pluginId": "prometheus", + "pluginName": "Prometheus" + } + ], + "__elements": {}, + "__requires": [ + { + "type": "panel", + "id": "gauge", + "name": "Gauge", + "version": "" + }, + { + "type": "grafana", + "id": "grafana", + "name": "Grafana", + "version": "11.1.0" + }, + { + "type": "panel", + "id": "piechart", + "name": "Pie chart", + "version": "" + }, + { + "type": "datasource", + "id": "prometheus", + "name": "Prometheus", + "version": "1.0.0" + }, + { + "type": "panel", + "id": "stat", + "name": "Stat", + "version": "" + }, + { + "type": "panel", + "id": "timeseries", + "name": "Time series", + "version": "" + } + ], + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": { + "type": "datasource", + "uid": "grafana" + }, + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "type": "dashboard" + } + ] + }, + "description": "A dashboard for the CoreDNS DNS server with updated metrics for version 1.7.0+. Based on the CoreDNS 1.7.0+ dashboard by ejkinger", + "editable": true, + "fiscalYearStartMonth": 0, + "gnetId": 14981, + "graphTooltip": 0, + "id": null, + "links": [ + { + "$$hashKey": "object:94", + "icon": "external link", + "tags": [], + "targetBlank": true, + "title": "CoreDNS.io", + "type": "link", + "url": "https://coredns.io" + } + ], + "panels": [ + { + "datasource": { + "type": "prometheus", + "uid": "PBFA97CFB590B2093" + }, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 0 + }, + "id": 44, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "PBFA97CFB590B2093" + }, + "refId": "A" + } + ], + "title": "Global stats", + "type": "row" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + } + }, + "mappings": [] + }, + "overrides": [] + }, + "gridPos": { + "h": 10, + "w": 24, + "x": 0, + "y": 1 + }, + "id": 39, + "options": { + "displayLabels": [ + "percent" + ], + "legend": { + "displayMode": "table", + "placement": "right", + "showLegend": true, + "values": [ + "value" + ] + }, + "pieType": "pie", + "reduceOptions": { + "calcs": [ + "sum" + ], + "fields": "", + "values": false + }, + "text": {}, + "tooltip": { + "mode": "single", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_dns_requests_total[5m])) by (instance)", + "format": "time_series", + "interval": "", + "intervalFactor": 1, + "legendFormat": "{{instance}}", + "refId": "A", + "step": 60 + } + ], + "title": "Requests (by instance)", + "type": "piechart" + }, + { + "collapsed": false, + "datasource": { + "type": "prometheus", + "uid": "PBFA97CFB590B2093" + }, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 11 + }, + "id": 41, + "panels": [], + "repeat": "instance", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "PBFA97CFB590B2093" + }, + "refId": "A" + } + ], + "title": "Health: $instance", + "type": "row" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "super-light-blue", + "value": null + } + ] + } + }, + "overrides": [] + }, + "gridPos": { + "h": 6, + "w": 3, + "x": 0, + "y": 12 + }, + "id": 42, + "maxPerRow": 2, + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "auto", + "orientation": "auto", + "percentChangeColorMode": "standard", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "showPercentChange": false, + "text": {}, + "textMode": "name", + "wideLayout": true + }, + "pluginVersion": "11.1.0", + "repeatDirection": "v", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "coredns_build_info{instance=~\"$instance\"}", + "format": "time_series", + "interval": "", + "intervalFactor": 1, + "legendFormat": "{{version}}", + "refId": "A", + "step": 60 + } + ], + "title": "Version", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [] + }, + "gridPos": { + "h": 6, + "w": 3, + "x": 3, + "y": 12 + }, + "id": 35, + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "center", + "orientation": "auto", + "percentChangeColorMode": "standard", + "reduceOptions": { + "calcs": [ + "sum" + ], + "fields": "", + "values": false + }, + "showPercentChange": false, + "text": {}, + "textMode": "auto", + "wideLayout": true + }, + "pluginVersion": "11.1.0", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_forward_healthcheck_broken_total{instance=~\"$instance\"}[5m]))", + "interval": "", + "legendFormat": "{{instance}}", + "refId": "A" + } + ], + "title": "Upstream Health Check Fails", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 1 + } + ] + } + }, + "overrides": [] + }, + "gridPos": { + "h": 6, + "w": 3, + "x": 6, + "y": 12 + }, + "id": 36, + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "center", + "orientation": "auto", + "percentChangeColorMode": "standard", + "reduceOptions": { + "calcs": [ + "sum" + ], + "fields": "", + "values": false + }, + "showPercentChange": false, + "text": {}, + "textMode": "auto", + "wideLayout": true + }, + "pluginVersion": "11.1.0", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_forward_max_concurrent_rejects_total{instance=~\"$instance\"}[5m]))", + "interval": "", + "legendFormat": "{{instance}}", + "refId": "A" + } + ], + "title": "Upstream Rejected Queries", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [] + }, + "gridPos": { + "h": 6, + "w": 3, + "x": 9, + "y": 12 + }, + "id": 81, + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "center", + "orientation": "auto", + "percentChangeColorMode": "standard", + "reduceOptions": { + "calcs": [ + "sum" + ], + "fields": "", + "values": false + }, + "showPercentChange": false, + "text": {}, + "textMode": "auto", + "wideLayout": true + }, + "pluginVersion": "11.1.0", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_panics_total{instance=~\"$instance\"}[5m]))", + "interval": "", + "legendFormat": "{{instance}}", + "refId": "A" + } + ], + "title": "Panics", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [] + }, + "gridPos": { + "h": 6, + "w": 3, + "x": 12, + "y": 12 + }, + "id": 92, + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "center", + "orientation": "auto", + "percentChangeColorMode": "standard", + "reduceOptions": { + "calcs": [ + "sum" + ], + "fields": "", + "values": false + }, + "showPercentChange": false, + "text": {}, + "textMode": "auto", + "wideLayout": true + }, + "pluginVersion": "11.1.0", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_reload_failed_total{instance=~\"$instance\"}[5m]))", + "interval": "", + "legendFormat": "{{instance}}", + "refId": "A" + } + ], + "title": "Failed Reloads", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "mappings": [], + "max": 0.03, + "min": 0, + "thresholds": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "orange", + "value": 60 + }, + { + "color": "red", + "value": 85 + } + ] + }, + "unit": "s" + }, + "overrides": [] + }, + "gridPos": { + "h": 6, + "w": 4, + "x": 15, + "y": 12 + }, + "id": 119, + "options": { + "minVizHeight": 75, + "minVizWidth": 75, + "orientation": "auto", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "showThresholdLabels": false, + "showThresholdMarkers": true, + "sizing": "auto", + "text": {} + }, + "pluginVersion": "11.1.0", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "editorMode": "code", + "exemplar": true, + "expr": "sum(rate(process_cpu_seconds_total{job=\"coredns\", instance=~\"$instance\"}[5m]))", + "interval": "", + "legendFormat": "{{instance}}", + "range": true, + "refId": "A" + } + ], + "title": "CPU Time", + "type": "gauge" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "mappings": [], + "thresholds": { + "mode": "percentage", + "steps": [ + { + "color": "super-light-blue", + "value": null + } + ] + }, + "unit": "decbytes" + }, + "overrides": [] + }, + "gridPos": { + "h": 6, + "w": 5, + "x": 19, + "y": 12 + }, + "id": 134, + "options": { + "colorMode": "value", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "auto", + "percentChangeColorMode": "standard", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "showPercentChange": false, + "text": {}, + "textMode": "value", + "wideLayout": true + }, + "pluginVersion": "11.1.0", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "editorMode": "code", + "exemplar": true, + "expr": "go_memstats_alloc_bytes{job=\"coredns\", instance=~\"$instance\"}", + "interval": "", + "intervalFactor": 2, + "legendFormat": "{{instance}}", + "range": true, + "refId": "A" + } + ], + "title": "Memory Usage", + "type": "stat" + }, + { + "collapsed": false, + "datasource": { + "type": "prometheus", + "uid": "PBFA97CFB590B2093" + }, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 18 + }, + "id": 26, + "panels": [], + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "PBFA97CFB590B2093" + }, + "refId": "A" + } + ], + "title": "Local", + "type": "row" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "reqps" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 12, + "x": 0, + "y": 19 + }, + "id": 2, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_dns_requests_total{instance=~\"$instance\"}[5m])) by (server)", + "format": "time_series", + "interval": "", + "intervalFactor": 2, + "legendFormat": "{{server}}", + "refId": "A", + "step": 60 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_cache_requests_total{instance=~\"$instance\"}[5m]))", + "hide": false, + "interval": "", + "legendFormat": "cache", + "refId": "B" + } + ], + "title": "Requests (total)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "reqps" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 12, + "x": 12, + "y": 19 + }, + "id": 6, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_dns_requests_total{instance=~\"$instance\"}[5m])) by (zone)", + "interval": "", + "intervalFactor": 2, + "legendFormat": "{{zone}}", + "refId": "A", + "step": 60 + } + ], + "title": "Requests (by zone)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "s" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 12, + "x": 0, + "y": 26 + }, + "id": 32, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.99, sum(rate(coredns_dns_request_duration_seconds_bucket{instance=~\"$instance\", zone=\".\"}[5m])) by (le))", + "format": "time_series", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "99%", + "refId": "A", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.90, sum(rate(coredns_dns_request_duration_seconds_bucket{instance=~\"$instance\", zone=\".\"}[5m])) by (le))", + "format": "time_series", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "90%", + "refId": "B", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.50, sum(rate(coredns_dns_request_duration_seconds_bucket{instance=~\"$instance\", zone=\".\"}[5m])) by (le))", + "format": "time_series", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "50%", + "refId": "C", + "step": 40 + } + ], + "title": "Responses (latency, internet zone)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "reqps" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 12, + "x": 12, + "y": 26 + }, + "id": 4, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_dns_requests_total{instance=~\"$instance\"}[5m])) by (type)", + "interval": "", + "intervalFactor": 2, + "legendFormat": "{{type}}", + "refId": "A", + "step": 60 + } + ], + "title": "Requests (by type)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "percentunit" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 12, + "x": 0, + "y": 33 + }, + "id": 24, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_cache_hits_total{instance=~\"$instance\", type=\"success\"}[5m])) / sum(rate(coredns_cache_requests_total{instance=~\"$instance\"}[5m]))", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "hits: success", + "refId": "A", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_cache_hits_total{instance=~\"$instance\", type=\"denial\"}[5m])) / sum(rate(coredns_cache_requests_total{instance=~\"$instance\"}[5m]))", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "hits: denial", + "refId": "B", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "(sum(rate(coredns_cache_requests_total{instance=~\"$instance\"}[5m])) - sum(rate(coredns_cache_hits_total{instance=~\"$instance\", type=\"success\"}[5m]))) / sum(rate(coredns_cache_requests_total{instance=~\"$instance\"}[5m]))", + "hide": false, + "interval": "", + "legendFormat": "misses", + "refId": "C" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_dnssec_cache_hits_total{instance=~\"$instance\"}[5m])) / sum(rate(coredns_cache_requests_total{instance=~\"$instance\"}[5m]))", + "hide": false, + "interval": "", + "legendFormat": "hits: DNSSEC", + "refId": "D" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "(sum(rate(coredns_cache_requests_total{instance=~\"$instance\"}[5m])) - sum(rate(coredns_dnssec_cache_hits_total{instance=~\"$instance\"}[5m]))) / sum(rate(coredns_cache_requests_total{instance=~\"$instance\"}[5m]))", + "hide": false, + "interval": "", + "legendFormat": "misses: DNSSEC", + "refId": "E" + } + ], + "title": "Cache (hitrate)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "reqps" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 12, + "x": 12, + "y": 33 + }, + "id": 8, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_dns_do_requests_total{instance=~\"$instance\"}[5m])) by (zone)", + "interval": "", + "intervalFactor": 2, + "legendFormat": "{{zone}}", + "refId": "A", + "step": 40 + } + ], + "title": "Requests (DNSSEC by zone)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + } + }, + "decimals": 0, + "mappings": [], + "unit": "short" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 8, + "x": 0, + "y": 40 + }, + "id": 14, + "options": { + "displayLabels": [], + "legend": { + "calcs": [], + "displayMode": "table", + "placement": "right", + "showLegend": true, + "values": [ + "value", + "percent" + ] + }, + "pieType": "pie", + "reduceOptions": { + "calcs": [ + "sum" + ], + "fields": "", + "values": false + }, + "text": {}, + "tooltip": { + "mode": "single", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_dns_responses_total{instance=~\"$instance\"}[5m])) by (rcode)", + "interval": "", + "intervalFactor": 2, + "legendFormat": "{{rcode}}", + "refId": "A", + "step": 40 + } + ], + "title": "Responses (by code)", + "type": "piechart" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "decbytes" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 8, + "x": 8, + "y": 40 + }, + "id": 18, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.99, sum(rate(coredns_dns_request_size_bytes_bucket{instance=~\"$instance\", zone=\".\"}[5m])) by (le))", + "interval": "", + "intervalFactor": 2, + "legendFormat": "99%", + "refId": "A", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.90, sum(rate(coredns_dns_request_size_bytes_bucket{instance=~\"$instance\", zone=\".\"}[5m])) by (le))", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "90%", + "refId": "B", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.50, sum(rate(coredns_dns_request_size_bytes_bucket{instance=~\"$instance\", zone=\".\"}[5m])) by (le))", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "50%", + "metric": "", + "refId": "C", + "step": 40 + } + ], + "title": "Requests (size, internet zone)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "decbytes" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 8, + "x": 16, + "y": 40 + }, + "id": 33, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.99, sum(rate(coredns_dns_response_size_bytes_bucket{instance=~\"$instance\", zone=\".\"}[5m])) by (le))", + "interval": "", + "intervalFactor": 2, + "legendFormat": "99%", + "refId": "A", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.90, sum(rate(coredns_dns_response_size_bytes_bucket{instance=~\"$instance\", zone=\".\"}[5m])) by (le))", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "90%", + "refId": "B", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.50, sum(rate(coredns_dns_response_size_bytes_bucket{instance=~\"$instance\", zone=\".\"}[5m])) by (le))", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "50%", + "metric": "", + "refId": "C", + "step": 40 + } + ], + "title": "Responses (size, internet zone)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + } + ] + }, + "unit": "short" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 24, + "x": 0, + "y": 47 + }, + "id": 22, + "options": { + "colorMode": "value", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "auto", + "percentChangeColorMode": "standard", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "showPercentChange": false, + "text": {}, + "textMode": "auto", + "wideLayout": true + }, + "pluginVersion": "11.1.0", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(coredns_cache_entries{instance=~\"$instance\"}) by (type)", + "interval": "", + "intervalFactor": 2, + "legendFormat": "{{type}}", + "refId": "A", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(coredns_dnssec_cache_entries{instance=~\"$instance\"})", + "hide": false, + "interval": "", + "legendFormat": "DNSSEC", + "refId": "B" + } + ], + "title": "Cache (size)", + "type": "stat" + }, + { + "collapsed": false, + "datasource": { + "type": "prometheus", + "uid": "PBFA97CFB590B2093" + }, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 54 + }, + "id": 63, + "panels": [], + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "PBFA97CFB590B2093" + }, + "refId": "A" + } + ], + "title": "Upstream", + "type": "row" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "reqps" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 12, + "x": 0, + "y": 55 + }, + "id": 72, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_forward_requests_total{instance=~\"$instance\"}[5m]))", + "format": "time_series", + "interval": "", + "intervalFactor": 2, + "legendFormat": "upstream", + "refId": "A", + "step": 60 + } + ], + "title": "Requests (total)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineStyle": { + "fill": "solid" + }, + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + } + ] + }, + "unit": "percentunit" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 12, + "x": 12, + "y": 55 + }, + "id": 38, + "maxPerRow": 6, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "repeatDirection": "h", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_forward_conn_cache_hits_total{instance=~\"$instance\"}[5m])) / sum(rate(coredns_forward_requests_total{instance=~\"$instance\"}[5m]))", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "hits", + "refId": "A", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "(sum(rate(coredns_forward_requests_total{instance=~\"$instance\"}[5m])) - sum(rate(coredns_forward_conn_cache_hits_total{instance=~\"$instance\"}[5m]))) / sum(rate(coredns_forward_requests_total{instance=~\"$instance\"}[5m]))", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "misses", + "refId": "B", + "step": 40 + } + ], + "title": "Cache (hitrate)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "opacity", + "hideFrom": { + "graph": false, + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 2, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": true, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "noValue": "0", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "s" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 12, + "x": 0, + "y": 62 + }, + "id": 37, + "options": { + "graph": {}, + "legend": { + "calcs": [], + "displayMode": "list", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.99, sum(rate(coredns_forward_request_duration_seconds_bucket{instance=~\"$instance\"}[5m])) by (le))", + "format": "time_series", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "99%", + "refId": "A", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.90, sum(rate(coredns_forward_request_duration_seconds_bucket{instance=~\"$instance\"}[5m])) by (le))", + "format": "time_series", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "90%", + "refId": "B", + "step": 40 + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "histogram_quantile(0.50, sum(rate(coredns_forward_request_duration_seconds_bucket{instance=~\"$instance\"}[5m])) by (le))", + "format": "time_series", + "hide": false, + "interval": "", + "intervalFactor": 2, + "legendFormat": "50%", + "refId": "C", + "step": 40 + } + ], + "title": "Responses (latency)", + "type": "timeseries" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + } + }, + "decimals": 0, + "mappings": [], + "unit": "short" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 6, + "x": 12, + "y": 62 + }, + "id": 105, + "options": { + "displayLabels": [ + "percent" + ], + "legend": { + "calcs": [], + "displayMode": "table", + "placement": "right", + "showLegend": true, + "values": [ + "value" + ] + }, + "pieType": "pie", + "reduceOptions": { + "calcs": [ + "sum" + ], + "fields": "", + "values": false + }, + "text": {}, + "tooltip": { + "mode": "single", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_forward_requests_total{instance=~\"$instance\"}[5m])) by (to)", + "interval": "", + "intervalFactor": 2, + "legendFormat": "{{to}}", + "refId": "A", + "step": 40 + } + ], + "title": "Requests (by upstream)", + "transformations": [ + { + "id": "filterFieldsByName", + "options": { + "include": { + "names": [ + "Time", + "1.0.0.1:853", + "1.1.1.1:853", + "8.8.4.4:853", + "8.8.8.8:853" + ] + } + } + } + ], + "type": "piechart" + }, + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + } + }, + "decimals": 0, + "mappings": [], + "unit": "short" + }, + "overrides": [] + }, + "gridPos": { + "h": 7, + "w": 6, + "x": 18, + "y": 62 + }, + "id": 53, + "options": { + "displayLabels": [], + "legend": { + "calcs": [], + "displayMode": "table", + "placement": "right", + "showLegend": true, + "values": [ + "value", + "percent" + ] + }, + "pieType": "pie", + "reduceOptions": { + "calcs": [ + "sum" + ], + "fields": "", + "values": false + }, + "text": {}, + "tooltip": { + "mode": "single", + "sort": "none" + } + }, + "pluginVersion": "7.5.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "exemplar": true, + "expr": "sum(rate(coredns_forward_responses_total{instance=~\"$instance\"}[5m])) by (rcode)", + "interval": "", + "intervalFactor": 2, + "legendFormat": "{{rcode}}", + "refId": "A", + "step": 40 + } + ], + "title": "Responses (by code)", + "type": "piechart" + } + ], + "refresh": "5s", + "schemaVersion": 39, + "tags": [ + "dns", + "coredns" + ], + "templating": { + "list": [ + { + "allValue": ".*", + "current": {}, + "datasource": { + "type": "prometheus", + "uid": "${DS_PROMETHEUS}" + }, + "definition": "label_values(up{job=\"coredns\"}, instance)", + "hide": 0, + "includeAll": true, + "label": "Instance", + "multi": true, + "name": "instance", + "options": [], + "query": { + "query": "label_values(up{job=\"coredns\"}, instance)", + "refId": "StandardVariableQuery" + }, + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "sort": 3, + "tagValuesQuery": "", + "tagsQuery": "", + "type": "query", + "useTags": false + } + ] + }, + "time": { + "from": "now-15m", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "1m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ] + }, + "timezone": "", + "title": "CoreDNS", + "uid": "wY4blRMGz", + "version": 1, + "weekStart": "" +}
\ No newline at end of file diff --git a/roles/monitoring/grafana/files/dashboard-mosquitto.json b/roles/monitoring/grafana/files/dashboard-net/mosquitto.json index 3c0ce190..3c0ce190 100644 --- a/roles/monitoring/grafana/files/dashboard-mosquitto.json +++ b/roles/monitoring/grafana/files/dashboard-net/mosquitto.json diff --git a/roles/monitoring/grafana/files/dashboard-smokeping.json b/roles/monitoring/grafana/files/dashboard-net/smokeping.json index ef26a1f9..ef26a1f9 100644 --- a/roles/monitoring/grafana/files/dashboard-smokeping.json +++ b/roles/monitoring/grafana/files/dashboard-net/smokeping.json diff --git a/roles/monitoring/grafana/files/dashboard-ipmi.json b/roles/monitoring/grafana/files/dashboard-sys/ipmi.json index 62920b61..62920b61 100644 --- a/roles/monitoring/grafana/files/dashboard-ipmi.json +++ b/roles/monitoring/grafana/files/dashboard-sys/ipmi.json diff --git a/roles/monitoring/grafana/files/dashboard-node-full.json b/roles/monitoring/grafana/files/dashboard-sys/node-full.json index e887f9b5..e887f9b5 100644 --- a/roles/monitoring/grafana/files/dashboard-node-full.json +++ b/roles/monitoring/grafana/files/dashboard-sys/node-full.json diff --git a/roles/monitoring/grafana/files/dashboard-openwrt.json b/roles/monitoring/grafana/files/dashboard-sys/openwrt.json index b3bf4cea..b3bf4cea 100644 --- a/roles/monitoring/grafana/files/dashboard-openwrt.json +++ b/roles/monitoring/grafana/files/dashboard-sys/openwrt.json diff --git a/roles/monitoring/grafana/tasks/main.yml b/roles/monitoring/grafana/tasks/main.yml index 5d6c9c17..240d8125 100644 --- a/roles/monitoring/grafana/tasks/main.yml +++ b/roles/monitoring/grafana/tasks/main.yml @@ -126,7 +126,7 @@ mode: 0750 - name: create sub-directories for dashboards - loop: "{{ grafana_dashboards | grafana_dashboard_subdirs }}" + loop: "{{ grafana_dashboards | grafana_dashboard_subdirs | unique }}" file: path: "/var/lib/grafana/dashboards/ansible/{{ item }}" state: directory diff --git a/roles/monitoring/prometheus/exporter/coredns/handlers/main.yml b/roles/monitoring/prometheus/exporter/coredns/handlers/main.yml new file mode 100644 index 00000000..d4e42ca0 --- /dev/null +++ b/roles/monitoring/prometheus/exporter/coredns/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: reload nginx + service: + name: nginx + state: reloaded diff --git a/roles/monitoring/prometheus/exporter/coredns/tasks/main.yml b/roles/monitoring/prometheus/exporter/coredns/tasks/main.yml new file mode 100644 index 00000000..884eb4bf --- /dev/null +++ b/roles/monitoring/prometheus/exporter/coredns/tasks/main.yml @@ -0,0 +1,9 @@ +--- +- name: register exporter + copy: + content: | + location = /coredns { + proxy_pass http://127.0.0.1:9153/metrics; + } + dest: /etc/prometheus/exporter/coredns.locations + notify: reload nginx diff --git a/roles/monitoring/prometheus/exporter/meta/main.yml b/roles/monitoring/prometheus/exporter/meta/main.yml index b60d0dbc..0580861a 100644 --- a/roles/monitoring/prometheus/exporter/meta/main.yml +++ b/roles/monitoring/prometheus/exporter/meta/main.yml @@ -29,4 +29,6 @@ dependencies: when: "'nftables' in (prometheus_exporters_default | union(prometheus_exporters_extra))" - role: monitoring/prometheus/exporter/mosquitto when: "'mosquitto' in (prometheus_exporters_default | union(prometheus_exporters_extra))" + - role: monitoring/prometheus/exporter/coredns + when: "'coredns' in (prometheus_exporters_default | union(prometheus_exporters_extra))" - role: monitoring/prometheus/exporter/register diff --git a/roles/monitoring/prometheus/server/defaults/main/main.yml b/roles/monitoring/prometheus/server/defaults/main/main.yml index 9f867568..dd290e9e 100644 --- a/roles/monitoring/prometheus/server/defaults/main/main.yml +++ b/roles/monitoring/prometheus/server/defaults/main/main.yml @@ -15,7 +15,7 @@ prometheus_server_evaluation_interval: "15s" prometheus_server_jobs: - node -#prometheus_server_jobs_extra: | +#prometheus_server_jobs_extra: |- # - job_name: ... prometheus_server_rules: @@ -41,6 +41,7 @@ prometheus_server_rules: nftables: "{{ prometheus_server_rules_nftables + prometheus_server_rules_nftables_extra }}" whawty-nginx-sso: "{{ prometheus_server_rules_whawty_nginx_sso + prometheus_server_rules_whawty_nginx_sso_extra }}" mosquitto: "{{ prometheus_server_rules_mosquitto + prometheus_server_rules_mosquitto_extra }}" + coredns: "{{ prometheus_server_rules_coredns + prometheus_server_rules_coredns_extra }}" # prometheus_server_alertmanager: # url: "127.0.0.1:9093" @@ -48,6 +49,7 @@ prometheus_server_rules: # basic_auth: # username: server # password: geheim +# scrape_instance: <inventory-hostname> prometheus_server_web_listen_address: 127.0.0.1:9090 # prometheus_server_web_route_prefix: /prometheus/ @@ -73,5 +75,27 @@ prometheus_server_web_listen_address: 127.0.0.1:9090 # - node # - blackbox +prometheus_server_remote_write_receiver: no + +# prometheus_server_remote_write_destinations: +# example: +# url: "https://mon.example.com/prometheus/api/v1/write" +# basic_auth: +# username: remote +# password_file: /etc/prometheus/prometheus-remote.secret +# tls_config: +# ca: | +# -----BEGIN CERTIFICATE----- +# ... +# -----END CERTIFICATE----- +# write_relabel_configs: +# - source_labels: ['__name__'] +# regex: 'go_gc_.*' +# action: 'drop' +# - source_labels: ['job'] +# regex: 'alertmanager' +# action: 'drop' + # prometheus_server_secret_files: # user: secret +# remote: othersecret diff --git a/roles/monitoring/prometheus/server/defaults/main/rules_coredns.yml b/roles/monitoring/prometheus/server/defaults/main/rules_coredns.yml new file mode 100644 index 00000000..126a7ba4 --- /dev/null +++ b/roles/monitoring/prometheus/server/defaults/main/rules_coredns.yml @@ -0,0 +1,29 @@ +--- +prometheus_server_rules_coredns_extra: [] +prometheus_server_rules_coredns: + - alert: CorednsPanicCount + expr: increase(coredns_panics_total[15m]) > 0 + for: 0m + labels: + severity: critical + annotations: + summary: CoreDNS Panic (instance {{ '{{' }} $labels.instance {{ '}}' }}) + description: "Number of CoreDNS panics encountered has been increasing in the last 15 minutes\n VALUE = {{ '{{' }} $value {{ '}}' }}\n LABELS = {{ '{{' }} $labels {{ '}}' }}" + + - alert: CorednsFailedReloadCount + expr: increase(coredns_reload_failed_total[15m]) > 0 + for: 0m + labels: + severity: critical + annotations: + summary: CoreDNS reload failed (instance {{ '{{' }} $labels.instance {{ '}}' }}) + description: "Number of CoreDNS failed reloads has been increasing in the last 15 minutes\n VALUE = {{ '{{' }} $value {{ '}}' }}\n LABELS = {{ '{{' }} $labels {{ '}}' }}" + + - alert: CorednsBrokenForwardHealthchecks + expr: increase(coredns_forward_healthcheck_broken_total[15m]) > 0 + for: 0m + labels: + severity: warning + annotations: + summary: CoreDNS broken forward healthchecks (instance {{ '{{' }} $labels.instance {{ '}}' }}) + description: "Number of CoreDNS broken forward healthchecks has been increasing in the last 15 minutes\n VALUE = {{ '{{' }} $value {{ '}}' }}\n LABELS = {{ '{{' }} $labels {{ '}}' }}" diff --git a/roles/monitoring/prometheus/server/templates/prometheus.service.j2 b/roles/monitoring/prometheus/server/templates/prometheus.service.j2 index e65e9425..86c30cbd 100644 --- a/roles/monitoring/prometheus/server/templates/prometheus.service.j2 +++ b/roles/monitoring/prometheus/server/templates/prometheus.service.j2 @@ -6,7 +6,7 @@ After=time-sync.target [Service] Restart=on-failure User=prometheus -ExecStart=/usr/bin/prometheus --config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/var/lib/prometheus/metrics2/ --storage.tsdb.retention.time={{ prometheus_server_retention }}{% if prometheus_server_web_external_url is defined %} --web.external-url={{ prometheus_server_web_external_url }}{% endif %}{% if prometheus_server_web_route_prefix is defined %} --web.route-prefix={{ prometheus_server_web_route_prefix }}{% endif %}{% if prometheus_server_auth_users is defined %} --web.config.file=/etc/prometheus/prometheus-web.yml{% endif %} --web.listen-address={{ prometheus_server_web_listen_address }} +ExecStart=/usr/bin/prometheus --config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/var/lib/prometheus/metrics2/ --storage.tsdb.retention.time={{ prometheus_server_retention }}{% if prometheus_server_web_external_url is defined %} --web.external-url={{ prometheus_server_web_external_url }}{% endif %}{% if prometheus_server_web_route_prefix is defined %} --web.route-prefix={{ prometheus_server_web_route_prefix }}{% endif %}{% if prometheus_server_auth_users is defined %} --web.config.file=/etc/prometheus/prometheus-web.yml{% endif %}{% if prometheus_server_remote_write_receiver %} --web.enable-remote-write-receiver{% endif %} --web.listen-address={{ prometheus_server_web_listen_address }} ExecReload=/bin/kill -HUP $MAINPID TimeoutStopSec=20s SendSIGKILL=no diff --git a/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 b/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 index 09d5452d..d72a4815 100644 --- a/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 +++ b/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 @@ -45,7 +45,7 @@ scrape_configs: - targets: ['localhost:9090'] labels: instance: '{{ inventory_hostname }}' -{% if prometheus_server_alertmanager is defined %} +{% if prometheus_server_alertmanager is defined and 'scrape_instance' in prometheus_server_alertmanager %} - job_name: 'alertmanager' {% if 'path_prefix' in prometheus_server_alertmanager %} @@ -58,6 +58,8 @@ scrape_configs: {% endif %} static_configs: - targets: ['{{ prometheus_server_alertmanager.url }}'] + labels: + instance: '{{ prometheus_server_alertmanager.scrape_instance }}' {% endif %} {% for job in (prometheus_server_jobs) %} @@ -94,3 +96,10 @@ scrape_configs: - targets: ['{{ config.url }}'] {% endfor %} {% endfor %} +{% if prometheus_server_remote_write_destinations is defined %} + +remote_write: +{% for name, config in prometheus_server_remote_write_destinations.items() %} + - {{ config | combine({'name': name }) | to_nice_yaml(indent=2) | indent(4) }} +{% endfor %} +{% endif %} diff --git a/roles/ws/pipewire/tasks/main.yml b/roles/ws/pipewire/tasks/main.yml index 3f99b60c..9d310dca 100644 --- a/roles/ws/pipewire/tasks/main.yml +++ b/roles/ws/pipewire/tasks/main.yml @@ -1,4 +1,10 @@ --- +- name: check if ubuntu version is old enough + assert: + msg: "Starting with Ubuntu Kinetic pipewire is already the default - please don't use this role for newer version of Ubuntu!" + that: + - (ansible_distribution_release | ubuntu_release_compare('<', 'kinetic')) + - name: install pipewire and deps apt: name: diff --git a/roles/ws/thunderbird-gpg-hack/handlers/main.yml b/roles/ws/thunderbird-gpg-hack/handlers/main.yml new file mode 100644 index 00000000..d4967d21 --- /dev/null +++ b/roles/ws/thunderbird-gpg-hack/handlers/main.yml @@ -0,0 +1,3 @@ +--- +- name: replace apparmor profile snap.thunderbird.thunderbird + command: apparmor_parser -v -C -r /var/lib/snapd/apparmor/profiles/snap.thunderbird.thunderbird diff --git a/roles/ws/thunderbird-gpg-hack/tasks/main.yml b/roles/ws/thunderbird-gpg-hack/tasks/main.yml new file mode 100644 index 00000000..8a6037e8 --- /dev/null +++ b/roles/ws/thunderbird-gpg-hack/tasks/main.yml @@ -0,0 +1,49 @@ +--- +## workaround for: https://bugs.launchpad.net/ubuntu/+source/thunderbird/+bug/2009825 +## also see: https://forum.snapcraft.io/t/thunderbird-snap-and-external-gnupg-for-smart-cards/39553/1 + +# manual config changes: +## go to: Edit -> Settings -> (scroll to the end) -> Config Editor... +## mail.openpgp.allow_external_gnupg = true +## mail.openpgp.alternative_gpg_path = /home/equinox/gpg-wrapper-snap.sh + +- name: connect gpg-keys slot of thunderbird snap + command: snap connect thunderbird:gpg-keys :gpg-keys + changed_when: false + +## TODOM make home-dir configurable or find location for wrapper that is usable for all users... +- name: generate gpg-wrapper to workaround HOME variable issue + copy: + content: | + #!/bin/sh + export HOME="$SNAP_REAL_HOME" + exec $SNAP/usr/bin/gpg "$@" + dest: /home/equinox/gpg-wrapper-snap.sh + mode: 0755 + +- name: create apparmor abstraction for gnupg2 + copy: + content: | + # vim:syntax=apparmor + # gnupg2 sub-process running permissions + + abi <abi/4.0>, + + # user configurations + owner @{HOME}/.gnupg/* r, + owner @{HOME}/.gnupg/random_seed rk, + owner @{HOME}/.gnupg/tofu.db rwk, + owner /{,var/}run/user/[0-9]*/gnupg/* rw, + + # Include additions to the abstraction + include if exists <abstractions/gnupg2.d> + dest: /etc/apparmor.d/abstractions/gnupg2 + notify: replace apparmor profile snap.thunderbird.thunderbird + +- name: patch thunderbird apparmor profile + lineinfile: + line: " #include <abstractions/gnupg2>" + state: present + insertafter: " #include <abstractions/openssl>" + path: /var/lib/snapd/apparmor/profiles/snap.thunderbird.thunderbird + notify: replace apparmor profile snap.thunderbird.thunderbird diff --git a/roles/x509/acmetool/base/templates/responses.j2 b/roles/x509/acmetool/base/templates/responses.j2 index 981eba90..81f4f8a4 100644 --- a/roles/x509/acmetool/base/templates/responses.j2 +++ b/roles/x509/acmetool/base/templates/responses.j2 @@ -3,6 +3,7 @@ "acme-agreement:https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017-w-v1.3-notice.pdf": true "acme-agreement:https://letsencrypt.org/documents/LE-SA-v1.3-August-10-2022.pdf": true "acme-agreement:https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf": true +"acme-agreement:https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf": true "acmetool-quickstart-choose-server": {{ acmetool_directory_server }} "acmetool-quickstart-choose-method": webroot "acmetool-quickstart-webroot-path": "{{ acmetool_challenge_webroot_path | default('/var/run/acme/acme-challenge') }}" diff --git a/skillz/cloud-install.yml b/skillz/cloud-install.yml new file mode 100644 index 00000000..72db81d9 --- /dev/null +++ b/skillz/cloud-install.yml @@ -0,0 +1,10 @@ +--- +- name: cook variables for host + hosts: "{{ install_hostname }}" + gather_facts: no + tasks: + - set_fact: + install: "{{ install | default({}) }}" + network: "{{ network | default({}) }}" + +- import_playbook: ../common/cloud-install.yml diff --git a/skillz/common.yml b/skillz/common.yml new file mode 100644 index 00000000..af4b4fda --- /dev/null +++ b/skillz/common.yml @@ -0,0 +1,10 @@ +--- +- name: Basic Setup + hosts: "{{ install_hostname }}" + roles: + - role: apt-repo/base + when: ansible_pkg_mgr == "apt" + - role: core/base + - role: core/sshd/base + - role: core/zsh + - role: core/ntp diff --git a/skillz/generic.yml b/skillz/generic.yml new file mode 100644 index 00000000..bc8866c5 --- /dev/null +++ b/skillz/generic.yml @@ -0,0 +1,5 @@ +--- +- name: "Apply role {{ myrole }} to hosts: {{ myhosts }}" + hosts: "{{ myhosts }}" + roles: + - role: "{{ myrole }}" diff --git a/skillz/group_vars/all.yml b/skillz/group_vars/all.yml new file mode 100644 index 00000000..c1689af2 --- /dev/null +++ b/skillz/group_vars/all.yml @@ -0,0 +1,26 @@ +$ANSIBLE_VAULT;1.2;AES256;skillz +34303062356563613439616633656336306230363866343163613162653231623035393632373163 +6661303664363964666162363563393366356637643866330a313262633532393432336664363630 +61363631313631386331326331396663326564353137343433323631313737666164343836366165 +6136656337306365380a376163393163336437653365366266653464383036626565633039323631 +36356433306432653637316630323338353339373430356361613861663465386236383831396235 +62343637336665653665376337623435303033303961656430313164363364343233346630626565 +35303032323239373863306465393436383864636233316664663061346232383563366166343536 +65613730363563663831633063663933633935303937373263376264303339643333363037383232 +31363039393734323064366237326565333761386330316166666434643732626466313733326434 +61613939643165336233333664343130636337373838653734363639356532326633353064643731 +62366330656333653164303661373666363638323832623364336230326263653030613464396634 +64356339656462386432626464356665323736383464386362393832356530303236643733373562 +39316561393338386436353536653062386335383066343461663837363362646365393966656266 +30363238636431366330313032346437626664326336663230663338303061333233316334343535 +37613037376134656435343166356162616434343335663234326439336131356264666639643335 +38343030346635656638363439383030373362356236613466373938613762633462303362313238 +34323831336666633437316237333766386464383037303235303939346533626433333664663434 +62663762396366633663326633363433656565653633396561383338343061643234663230393563 +66353233613066353732326361383337386466643064343561333836363861373130623963336139 +62356131396237323232333936393232373939656465663032333564333564396331623535623966 +38306136313234326237633964346666313165373630356362333038636365326161303164646232 +37393863353262343631613631323234343664366531376439643137326131323738303963663534 +63366638653632363965383834633432343136653031313864396532343036346635346663306539 +31303064663963323934323931623164303564616632663631346437316462323138376139333164 +6635 diff --git a/skillz/host_vars/sk-2019.yml b/skillz/host_vars/sk-2019.yml new file mode 100644 index 00000000..908c08a7 --- /dev/null +++ b/skillz/host_vars/sk-2019.yml @@ -0,0 +1,21 @@ +$ANSIBLE_VAULT;1.2;AES256;skillz +35326231663932373064373761356464353663663232666435613835336631366237343964313433 +3765646361386137366363656635396336363334326235330a376165353932363763366562313638 +32646366363530613565396232373664346138373465393964616336333433313966393938336438 +6434626536363937630a663165643238616164353138666131643739323361616262663461326439 +64646365356134323637376338353934303031653863353765313062653737306664643330313832 +32663461623263373164383632363233336364393138383764353531363331616435393764313034 +30623438313239373462656131323935663832303937396461303035373538383333353730336633 +34633234323736306263613030643339636435356432333437376266626461396634313534646462 +34666630653636373333306262323663333366363436353662346563666264663639353530326466 +64303436646636333233663635623065323462333962346335323534663033636464343035363034 +62393665353730356338393734613630646334316164376139336237373839643564393562306333 +65383434373666303930326566323937363661396262616437646530636130653032656630353432 +39343662336661363163646531383430376338363362386566343464363062383730643932616566 +35346439346138666233653933653866376231666466613439383230396635396561393330313062 +64656365313366396138356436616461396331393137613936333438376231373361623637393432 +32333333663263623965383534643632663561626566636236643436616630623535636237633932 +37663834366165306262393131356262353131666230623033633231316436643566616337633835 +61613261313164356365666430353763323761663533656134653030633032336166663734373539 +39393933643261313463383739633530336539323661376239383235623830623339633963323635 +36353930666438613330 diff --git a/skillz/host_vars/sk-2019vm.yml b/skillz/host_vars/sk-2019vm.yml new file mode 100644 index 00000000..d81283be --- /dev/null +++ b/skillz/host_vars/sk-2019vm.yml @@ -0,0 +1,21 @@ +$ANSIBLE_VAULT;1.2;AES256;skillz +36643464643335623666313430333664646430326235383430346639616631316463653435653066 +3666353361383635613138643966356663343266303532660a366139616338363834363134663834 +39343432313233666164366363613936346464333330316332656337626361636133626335306438 +6163646330613732370a393338623232336631323538393136653930666665313461333435393838 +32313866313836646662656532326366333430636333396365663461653537333633663163653661 +62303035653165663531653961623237386135393139363464363437663064653131323737623234 +38626232653138633863646366623536353561306166303361653835326535636439643165333865 +61386363353833326433656236653437336463396532306536336261333934313538623735663338 +34383264353962373361643936626433646663386465646462653661316461653837613564346563 +35646438343864626466323239363630336534666635666331613630396438336561356236323330 +61623139363132633163366666333036336264303737303165616565343261353164323138336262 +30653030393436376234343031616138346266623638306633326665626137336661333638646337 +33306565386430343230303166303238653562636634653364323461666339343763393065386432 +36333638303563333336353561613434353033613138626236303138343637663164646632373262 +35306462363933366439326264373034633963313334633232393336336332393030323433353162 +38386632303165343631636165353264306262363365613231643338303938653835383230376262 +61366233643831393064353430316636356362346537346137383839356337353730353964323038 +39636631616433653331643232623665346466323365633631396363643234653963616233613332 +30396132336338396661393736363630313965626161356530393338396562363665363636656430 +30656437656532396233 diff --git a/skillz/host_vars/sk-2024.yml b/skillz/host_vars/sk-2024.yml new file mode 100644 index 00000000..70a66843 --- /dev/null +++ b/skillz/host_vars/sk-2024.yml @@ -0,0 +1,22 @@ +$ANSIBLE_VAULT;1.2;AES256;skillz +33613131383766346466323766306266393038393964613864653561333032663262366237313231 +6433303530396233373633656433616136373537336263390a346234376363376136323633633538 +36626337313837303565346535303031316664663733343063613039386566633362353034313665 +3036636133623438340a373935393438353537383664343865393462656162613339376132356632 +34303736343539386532663761313666356136353230633138323934363431363833336237633236 +65316263636530633662356561623866633662323434393961336331633339303839303838626239 +36323262666163346536333537623362653462313335313436393039336235313263386432326133 +31643961353362613230663832356237383338363464346230666230666333663961633065333963 +66303265313332333365313164333330656163643937383138393338346663633361623364336433 +63356231376435366561653236643866393161653830643166313666376463373565656336653466 +39363063316663356632343037356438383061363964373836626334643362323932333736376666 +62383765393732643734633031363365316335366235333433663762663762396334636333303630 +62386133393266626561336463323963616661333563303331383237366337363631393566613866 +62363962363239626461393636393733623833303734343137643036636635333937383665353662 +30633965323236326232393837366566633865633338313638373138386332303464383631623235 +32343236646364313234316135646431396437653265643562663536383961646132636635393939 +35303066626233646664306139643964343863353635323032343664633639633831653931616262 +62613961316132623638393632336566653133666230613962303264663835303165343537393236 +30333362616431636666636337326366396635346161613965313839306230643165633765323339 +34393831396665623634653237353932373062376135316133366464393837366630633139633533 +36316237323738653837646565323563363939343738383933306565616437336261 diff --git a/skillz/host_vars/sk-cloudio.yml b/skillz/host_vars/sk-cloudio.yml new file mode 100644 index 00000000..9eb8ad1e --- /dev/null +++ b/skillz/host_vars/sk-cloudio.yml @@ -0,0 +1,246 @@ +$ANSIBLE_VAULT;1.2;AES256;skillz +66353130383062316462386138393335326535393536316339393131633237376230323634346639 +3266363564396662313666663961653938663061616262380a363961346366333566366438336636 +32326631663164383838383330363839313631346139303039663835353963366330356366616435 +3735643034343738640a386433623163613964666561373436316363616238356233313730323038 +65393034326539636232343734383331666332346561393633616535666334313736373536663031 +30393733623535303639396462623236303062373937646235636138346339313964373634646632 +33356464316534366638666634636234313238343037376430643237336337323565666535363666 +33306537613534313733616333633461366632616562366639353231376637313365303961636339 +38336238386266376361363339623036386136326363343766623962623330643732386432623166 +36643536623230663338623064633837393866386361643439313965643432333034306533626664 +38633632323432303966343266313666643563323733313364306633346135643234623830613465 +37373234376261666364616564653339356234336437383337366435626130636265653634653734 +65663738646137393734343066303139323033383864353134363666333131613230636462613638 +66636564333063643930353961623033353561386662613862356661383065636435343736303262 +38373434383338353562623032326462373735376632303464663835393763316465343238626231 +30623734366161303838626539383933376364356232626239613732613933376264356665613537 +65623331313537306230356632343133356131373331663030656332636430396664633661363039 +64383736333862613565346135666164333732313733663934376435303535386538353465633163 +66353833376462623230623535666339663431393232353964373038376430643139333134306336 +65643635313263613632386331626433363638303432623032633963313165313031626463326638 +36666532623533363635353161326331333462343633623965646433313965373537653463343061 +34336237616461663436306165353837643633346362323762313734313739643363326239353437 +38343038373531333666663430386662663365646464306530333035613038383630386332383030 +63323133353435336338346564343435636264643961393261376130383932326330663030346538 +33376632306338626231666338376139356639323734636664343666616138353131616262343436 +61373866366139333437336336343362636331356161363165366561316462613434346461643939 +35326366313864346235316362663961313330336263643733333539633630363666303835643332 +30313833616439373165333862346134613163326138323164353937336639376136393338366530 +36383637653462373064653566643733396136616135373163656431306436343235366232666564 +66646231376431386636323530663930313531353633353232653833323963646333346530643266 +32626564623761323065666236316664396663303738353935613333646431333233303062633330 +66373735316337663239346338633765363466333236323836663163616631343730623265323261 +30666634376265383736636164363236636638376234653761313133666365346466306261353334 +34306631643333666262336233306365386365623264663664613136393963376466323438393931 +61346535333164303030623261303134653939333338663634636661373063393165616530303638 +34303832386464643435386338313339316665313662336233356664653439353031363663333532 +36383036633336343332326530303831366631396236396666663032396166656538666566623138 +34383661373733326664353730306338666362363164623736323661343163653866343636633462 +61643032613563663537656135353037666430393631623232363866346162396361633736383031 +66353034623664643366623262663764313364356333313165306664613732666562366566623663 +66356464323364643733363965306132663366376462346261366365333966333334383630633532 +32373235393439623737623336313035633137646435643863363566373035663033353937623433 +66343636656537666530663138373837306533366464643264343937313963633434316564303731 +30363535313365656136326563306136656635616131396565313962646162353638346231616332 +63373263353435316236633934316232656631646136343764373562373730613735663262633162 +36633139316465323733383362623734383639393462366262313335313862656161313234643838 +35663030353837323863303935663166643732383634383666323631306335353164323464626635 +36626661383462303536626438346139376338313863643836336130303037623065376638613631 +32623034383762386535386331376464346139663462333033656235336537656566373861346366 +39303464393639616637316665663261663236663461363830366163396333653664353731666331 +63336464343866393962303338623962316330663333653334356130333166666161373339366237 +61316465626430343264323037633439313135356334373732343632303164313036336362326432 +39613639656266303762363632666461366531653437393537303530613861343536663230323238 +39613736356566613733303636613966393437363265316263376637306663313337343366393366 +65623861643763343866343063313731396466316339356565336566316432326535363239663039 +38653961393935343962346235376536323463663639643235663130616235376366356366313535 +61346438313361333165386631623933386439323035303765616535343735383030333832373432 +30373466323538356232663637346338653435306261373332393935613366626565653766656533 +66616638653263343766363962633337313930323262646230396563633061363230336133646633 +65663138626239643631663338313435313431663365303238626433633039633762353761316265 +35353463616566653534363535646439343161393639363532366265303565343761653062373038 +31313636363331396237663132366632626663313038356163323065383939346361313066363764 +34363063626263626433353439646237316631363933386637623130666336343164633437326337 +35373633363538333834316566376634393434333336663333653265363234366430643165633830 +66396162313130316539316134333538653935306635353137383065646465623337346366373539 +61376237393335346538643463366134383333396137653262623839343961663036663962666262 +33616532646638346261666238623166623133303438643462383430393032346334663161366333 +39323964353037666165653935616431306263616634353239633730346164376333386430353334 +37373233663565353337316238343766313766633737356562663038363234636431353665306535 +30373035653330303437306230646337343966306161623666313532653862646331646633656563 +37663539613730646235613031326534616531346661663765393730393935316365366164323164 +32383363313862323931376234323330353637373930353432653536636564663738613130613934 +38303235663939663630316566333338336539393933323766613161623162653532346236353936 +32383864306363353936663265653565396438366534396633663139306264666562323237653837 +38373062316232653866623435353463313265323139343334346337313130636165356665363030 +66346630303431633066333139626661616631386232633765613166303231626231653438363331 +38306134663063613766363037626338393464396237656337343362366261396166343538393162 +35373730356532656166396163663830623137623531633066373832303130653131333639383062 +34623738326562643264636166343865363333343633356136353633333063636239663136366333 +66366635333966636632386330643265393865386534333865313464663531633231663839616534 +33326565363134633662363166363666643538643637383765613730346331626537303235366561 +33666132633836323133373131653363326438346664623039303762393139666331626161343437 +39303136383734343664646638326432613965616165323734356632323634303337663430373439 +36346231333863636338383964633230353832373434623234333130383137386666626339313064 +35653862313663633061396530303665303963396438346337386262616164663334613632316565 +38333763643936336336656361633165353733333936643835633337626434303631326162643739 +35363732666639323836383662313431376537346162333361656232636165626636316366623065 +63333638656130666632633837626266363237313935346164383331333532653134386330383435 +30613137306466643130633134353464613131323831613765656533396438643061383165373131 +61663262663661316161653236353831316337386336313432646366336635323936623738636139 +63323364366330306631343836363431363630623963653237386232366464633733663561323764 +64343463313432303434383432316639663262383538316633393733623839663639373636336566 +37656138323431373537303738646336323261316532343465616661653735636532396639633936 +64616537333833623634656436656361636465653039653931653239623765626563316363316535 +64323830666561316639333330643237313136626363333661386565653164353537396565323431 +35363665383061363434623464383737303361633039623738393966666434353862353234326336 +66666532646163303337626236653263386230333864323963376238353461313966643762653063 +30373662613434346163313933386664633933616134613134356230353561633966353233396162 +62623232663165623562363661613137353038646162653135326663386132646231303038303338 +35613534333837323465623361363061336163323361616538643566376438653933653965636536 +37303961353165623361346535383832393632663166393766396230643939313530623765356334 +36663237393634323037623431643361623830373536663532313736633035623062346363623766 +34613861323864663662383231366335386362323865623137613032636235373163626537393661 +64663638343662623364303035343432623335323533663864616436356233383732383662333066 +39663765623334623662353133373835326133333062323963376431663134353761613464643061 +35623737643336653962343431306431303132343935303932613764313838303230653664643562 +35666436616663633939323932373539396161306664636637623663313334656165393963363137 +38643461316430383732666536633335663233336639653239653630333762353065633432666661 +63363931623335613466393461333431613764636438613733383062353763343530343631663037 +37313861333962313831646337376134356133323233396365613030643430303364326232636462 +61386564663161313964323234313034343666303130316662353638666661373439383335616564 +35323863643965656566313465613166326362616539643030306165336439393930373465663530 +30316265346165333030616433326332643362633135393065623239613736353465633562663864 +36663932356430303163336136353964393366316236336432313738653236353261623732633334 +31643938656264303330393961376236626563643630393730373334643064343237386532643138 +34333864326335393336363963393532623036326532366138643432636462643238376635363062 +63336263303536376636303937363937373633356466346438306138326232613935373433346231 +33313864353830663264343838396365326437613330363365663031353566643661366631353134 +34646132613137613266303365366236626131363033346330616438323861316438316430303962 +38653165343638316363623361353435383166333162613139636331373138333232623830376334 +39636166373138663265393037663062363433326337376134376265373630396566333038343265 +36333464383566303466303938623932313033336131316430383937313164343663646335353731 +33653262353736373338306439326333303365343937393766306234393034643730613263393132 +62666163663031323433623630666161656536626232373433633733343936643265636536656638 +30353734386463313534623531383537353338306431353135393130306564643036386334333335 +65323238356239633731353865626236646334623038333365373664653431306335623133313731 +64646237333566613638333039376533663763393064633237323566326166363764633935656262 +61363566363736616437306230333732613335313463643236613139326538313762396137626135 +36653161353033666265646665353531653035386336666235626162646561383138653165303132 +38323162313266643165373837326662346266653030393331333237323230366564643138303939 +64353730303938356430353066343630636234326636623135383131393663323033613130633034 +62623734653662393831376664633564643736663839356365326134636533326364356563393030 +66633164663930336530323461646165393038363731373437613535313930316561333064323337 +64353033373265323334393530316234363330373766333730646439363739613365653337333033 +65346466323965376462646364366133666664353766396165363466646235313035613333313565 +65633032306435613030363461303037616639353463313565646432353565353239313634313535 +63353739393361663735623839326562656336363464373934633562396534633132623730313562 +37343361373366336665323232353234613431336437393266643663666137306662653061376435 +35623062333938653733313134383735356463646332333437653766366164663164326465303265 +61383730623663306566376631353531613763626135643866346139306162313964383839653333 +38646635663034643136646635393131373737646133306665346338343162653430353332323930 +30613966343162303334383437303464353232303961316363633839633130653432346132633337 +33373263303930383565323136306131316564396338343630346535326533626661366565356166 +30643937666466613633346439393336633665303831623337663439326230653637613939616438 +33373634303833636665643866333031316435336465326632376431306636366330363935636236 +65346566363438633664393937373330666262323739336539383337613662663661363163633133 +61663063376361316637653530326364313733383662376461326664373330363630336439313632 +64616266343038656262663730393636316535666363303730343631323764303930633339616563 +33303332313431356339393363366330323430306137353062353235653534303836393636306466 +30623231626234623435613366363437326165356431636464663631306237323533383565383733 +36336138323032303364346134613565626137633662353536363937323931393363633636316133 +64356339316534653965303530656266633761653764393633643562623132663230393931313539 +63343865636631336163623933393737373339303737313466663764656130316263303063616664 +36613933376361633134366136346239333738393063373033663831303562396237306531356136 +65393734663638326138663331303163383764363639633033393330386638646430623030653331 +33393036393462653232386334656635616437316237653663646438366464386239373864663462 +64646466336665316135336665643137366333316534316661336530623665376132353533633532 +35623636396264323034316339363336306538306465663561326566396434636434616338623930 +35393861393365653136323764353433386662323139393231343262346432303261313661383162 +30663966613661316432373361653034613839613761386266396134373261613161623565666537 +38326564663338393261653435323238666565363061306137636266393431613162373561653930 +30636137323362613662353930323333376635323134316430636135623061663762313639306433 +38313466656439643965376163346562303737333663353562373165303339393530303935323639 +36386333376361383365346333366463623032653231346130323032356632353331663964313035 +38666235633061616536376266613132386432376561316132666234333930616462386237356238 +33386561383331313738653538646533333964383333396364663166363161616436633734653835 +37316135353065633932656439656165663437373934336237386666663134623362383439653238 +64643664656365303131306266306139353164623935626561643366633330383837373032313838 +33616432643662326430663932353734386634373131633039646237376563393262333838393234 +63376334333862656434313934313965353263363032383261326433643939646464346164313131 +34356361636163616164663432343132343131363533376638656635366436646434373235353831 +65326436616536376533613232636233356164626137343831313065373064336235643535323536 +30323030353639633534313164353835353161653939643638303436396136333033353838633064 +30303233616632303765346137653739343531366134653235323032666630626338646663613762 +62303966323064353765666564333065663331343239653436626430326332316436346632346334 +65646130656331393430656364616161333831363130636438353166613936616165336361373465 +64643839333763346562656661353036333838326235343439316337353937343966303536626133 +63313966306636616334656633616338616334313039653530373566613838393262616663393366 +30396162623163663162633861666663356132653836636664333030646162333737623335363737 +65646233386363636265346438626634376661396236333830356135316234396237643431643761 +33366139663730323934643331633434303365613532656238643934303634636433646261353434 +34306434626439323465393365303737663866306534666534643631636337623666303037353034 +34313839383930313062613634366430353133363739636665353138383034353963633333653765 +36393332383739326136646231363436303765346430373865643866383332343231653235393164 +34663935663365303031376463376665666236666438376536303335653636616331643637633762 +65643139613364623733663362346633316535633261666238363663633166643239356134616439 +31396130356435656132323634393364666238656632633264643132323761366266326136386232 +32373438353538396262373163396431323030633365353765373463643934666638373366663939 +32643061386265316334623764373632346436396336616539333661616335613937613833326165 +61616163366635643630633138323937633332313733363130396365363333383865363731363861 +34396262386333646661613032303239636436313364326631303339613733333039663539306336 +32636661656464353861643937356234313838303737373631633438366161636436363837306131 +33653534623437633061383262346137613437343834633431613664633061313731396263643034 +32643235356532623932656462393234346438383738333933396632656165636661646330653136 +30323366613831623639613062613030363065633161316330663539306436666363386665353132 +34306565623762663461393837653937333039636530613164343066613262373835373837613631 +33636333643664343133343632633333366233356133343436393732393736366637353338633132 +31626432643366373938323530353465383561343734616132353066616565633263396262663965 +32353031323861633239306538666364323063353064396538326136663839346333623630336664 +35366563653831663732363034366632626133326437366339333663376263343030383833643761 +66333438616636653434326139363965343061313262636632316533356261343362313339613036 +31393538383932346432626665383731363434333062633733383638376635633762333735393832 +65303036393139386534663965663562383062356533303462333864613163646235313033613430 +38633338383366383538396535353436643832626637336337313464633464616465663866393437 +63393339336364626138393966616330663531376265356635323335633863653132636561396339 +66383537663966343465306263303739663433613366333730643137303565323963326639336538 +63623864623038666234363837623930616235363338653636623331613463653438633330353662 +61616337396234396633623938383163306230333135383561316333353032363833643934653632 +61373833633237303365666661663265386238363735666234323438623737383231303966613231 +62623237636162666466333437613534356166633061363834663337363934626564333631343435 +31363735353066636233643361323665316538323762643963376166616462313664393664373361 +64663533376532336633633835646266396531343663653036336166326264313965646662636130 +66376637316539666163643537393966376239633761643734316432663165383566303164653135 +33333032343133653066623761316566333831643339323838623465633365333332346534363231 +65353538326265303435353261346362353662623636343438373535633732633331353463326465 +35653539633437373334643233643862383836353163346661616330666166316162616134643462 +36663833353639613561323865306166376236313332313430656238346331346638326239336165 +38353162393539343036386564626639303637626661343838383465396536303536306238333664 +63343539666334393238336134336364333265623438643337363936336531643863366637656436 +31383066316434323136363563616138653761376436323765663031303533373065633032623131 +37646164336332663039656663333735623236393464616436373062333763653361643238643439 +37303738393935346334623466656536666436333636333961316637376363643261393636366436 +31326433663832643264373165343835306535643737316661393661333130666332366161643262 +39623130636163373834333131623136656531623437343161343264373339376262343537343433 +31373839653464636231613436643032316433616661383664383431393065663662386631323161 +31326135373639383034646330303664643864663166653034313237336638303863323266326630 +33376539303730666530633935383531616261373964333633306236626431383734313639313433 +39353737383164346538663931626565666633626232306535663735643864396264323234396130 +38346537326663626330633733646433616462353264623139393835303037313065373935396435 +62633234666135353838303663383464313863626266636165666332373431343438343835386666 +66356534336130303235666439303561343364626263373432303065376263633365663131663436 +36373538343730366236613737353561313133613636656634343961636665366266366633376433 +36626165343632346631633830306134333862346161623630393564653864363435383235343765 +31633435613666653734383038646237376637633665303830636333313863323062623634303761 +34393163646263383739313538656662613136343033363834393535656435633530306266336631 +66303430353636323339383464616131643137373034346266346431323635323862643263366230 +65663864373262666165313339656432643762363064353139663035333037616164663166306163 +64613231383836343263376638366438373839376236663231336663626239396630396364336335 +37313766653233393062313833373631386139346666333239613566393337366461633961636437 +31653034653064373937333962653933653830646435366639396538613665333565363366346335 +61323961383533356462646133626231376666383131633636313639396435396431666663363666 +63373130303966653966663338396561646435613934376566393965376137353730633335663637 +38646336643830303661303337316366333738393634303262306530366361336137343832353037 +33663039643462663462643338326431393833626664343332326362613663663232633538383733 +3263 diff --git a/skillz/host_vars/sk-testvm.yml b/skillz/host_vars/sk-testvm.yml new file mode 100644 index 00000000..9d90f0e6 --- /dev/null +++ b/skillz/host_vars/sk-testvm.yml @@ -0,0 +1,20 @@ +$ANSIBLE_VAULT;1.2;AES256;skillz +36343634626466393365306234316131613539323961623538663531396562386132383566393466 +6130363435373732366339353834366363613132663939620a383639346430303738363336623932 +33386534653435666564643632373263653061346139373230633862616234346663396162336362 +3838303063353831380a633633646333326438313338353138616237363131633930613835333936 +66366539613262316463386534353465306664663737343963303137353530643839323737653632 +65666364373864636161363838366531373662343138356665333431616633653663643133666231 +37393132386332356331373938666465636563356662393230393062343363613037336532323662 +63663663326436353665613630623338626166346530393766333432343463343838623538343431 +64353432366231643930336234623831306462303864646430326436313961373430353366313363 +61396564373133626132643533353230633137306461373338643236333261616264313066623965 +31643738353735656234646264346435373533666630613165663331326565353664626231636438 +35343538383964313561303935653664353862653561656334633734626535616661323562396531 +33633832356164623636646430363835356434343266393732623036323235386462363837373366 +39373062323636376661303035653861656563353931383931353137633663316438376434353230 +36653730353337373962393738306462313332393166623162353861373738636362303431663466 +66613733323439383462643661323161383838653634353432636464323564323332386163313961 +35356464646165353130623638373762326135613661643561653036336362373036396336326136 +61623537653532623366616562333635366235663439656137636336323233623133633139396562 +333931343862326637623030306666663235 diff --git a/skillz/host_vars/sk-tomnext-nc.yml b/skillz/host_vars/sk-tomnext-nc.yml new file mode 100644 index 00000000..edc3d87c --- /dev/null +++ b/skillz/host_vars/sk-tomnext-nc.yml @@ -0,0 +1,24 @@ +$ANSIBLE_VAULT;1.2;AES256;skillz +36356134653135646230316263303837396362626634666630353766313231383539623464313232 +3664336463343730333532633363393636383132666637320a626332313833313934663262373661 +39353666623762366536656665653039303738633062386439323765336365643366646633326166 +6430393563343136330a636636663066366539313362663665333339313739653064353034363233 +31313465643039616538663462353934313636633531313064656663303866623939623530376537 +61373363663231313566396534623532303562353730383839353830623230313231303362353436 +38313162363237326234376533393132393832333632313532323266346162643364376339393038 +31656566366361336561316165646433653562626432313638323433303130663635626533353562 +34326132626231383136636230353731643031636332323638646364383939376561636532303762 +63386636333032623934366438326362383032646637373133613966393738646232353935643337 +32343661376537323336653433376631383934656265626430383261356135393436663631373062 +30333230666135356361326435353936643531393133653662333262356366323163656439636234 +66383134373631333163386331643062393964336365373535333564396338663430383230343633 +63656338616533636462623261383865393665303738633766396638656131613336343031343431 +65316439333231616662626338323134353535626134656633313662393164326634633432313464 +64396636383333343764653862623665636430346166336234386661393832623962633664616531 +61336564303131643038303333316364616139386435613337303931336235396236373639623437 +34316538326232376463333239643762623562393937663830633530656631376438643432333630 +34326232386263646461613934653938636535303234383130336437373536333832306361663765 +66353763323632313537373235386638636637643462356131386434623165633637343138313133 +62663130363036643437396161623130643431376665383437393230333032336331373938383535 +62666266306265623362376438343931363939613834333066646663633963393763643337306237 +303134316237656561613735633037316534 diff --git a/skillz/host_vars/sk-tomnext.yml b/skillz/host_vars/sk-tomnext.yml new file mode 100644 index 00000000..633b2343 --- /dev/null +++ b/skillz/host_vars/sk-tomnext.yml @@ -0,0 +1,21 @@ +$ANSIBLE_VAULT;1.2;AES256;skillz +65643036623938393866636366326163616632373835343732653435663062663830373737353465 +6431653934353539663635343136666334613235326330640a393932333233373533383065333561 +38313961636234636630383835383536313232306130653733643864366535643633363839353030 +3531333730303361330a613761396630316363303537633164656163613765663935306136373565 +31393361316339383463303166396437353961663436393135303138643633373139376361616237 +61323836613639346638393364613539373939646366386565383336373035373535613233383037 +66653532636661643930663335636565666464633364653065363836653666373364356265373763 +31666231306136366139663637343030613432373561343437386231386431366432343633323032 +34356238323038333661323066363035373930303433626131306138353561393239643034633265 +30663536326666643839333662666662343139626265663630626334656161303735646665336565 +30346361343663666635626366636639643536663439363630633439623965373435323634356238 +64666165663061303031323830613565326163393566633231333961303638343662333335363363 +36393066636463303061353636383339333233373936633438306537363765623439343434626465 +31653036653166613035343639333239386333316238383232353463343631656234373138386564 +34316165326239626566623230336537343766373831323566356338313837653330356233353338 +64626232303537356564623165376539323662303431643562636661306163383033313037346337 +36306366613134343032366162303335323731346139303932623130623830646562336234326161 +36633137333439373534383963613239623931326538613362643139353261666262623033303633 +34313230663237326665313232306436653530633439316638623436656363343931373632343230 +63663465336234393866 diff --git a/skillz/host_vars/sk-torrent.yml b/skillz/host_vars/sk-torrent.yml new file mode 100644 index 00000000..ff0933da --- /dev/null +++ b/skillz/host_vars/sk-torrent.yml @@ -0,0 +1,10 @@ +$ANSIBLE_VAULT;1.2;AES256;skillz +34666562643336356334333631623765396463633339383637323365613134643837363366663030 +3066333336333863306539633265356438353437363236640a303134316263383036653364626533 +30636530643563636561336638333235393038303763646166396233363765313539376334383334 +3034313933613162320a346662306463393264306363653239616435336135363834626436386161 +32386238313237623234373330313938333564393435323539363833663136333435663832333538 +30373266623862643131633863376139386634303038333533666562363765663635666362313938 +33626231623535306361343739636464303438396138383738333135306333616535303031306436 +62353061363963633339303162666162383332366434366232353864656630616231366165356439 +3637 diff --git a/skillz/image-generate.yml b/skillz/image-generate.yml new file mode 100644 index 00000000..1b11f1eb --- /dev/null +++ b/skillz/image-generate.yml @@ -0,0 +1,20 @@ +--- +- name: generate os image + hosts: "{{ install_hostnames }}" + connection: local + gather_facts: no + roles: + - role: "installer/{{ install_distro }}/image" + post_tasks: + - pause: + seconds: 0 + prompt: | + The resulting images can be found here: + + {% for host in play_hosts %} + {{ host }}: + {% for image in hostvars[host].output_images %} + - {{ image }} + {% endfor %} + + {% endfor %} diff --git a/skillz/iso-generate.yml b/skillz/iso-generate.yml new file mode 100644 index 00000000..584b8914 --- /dev/null +++ b/skillz/iso-generate.yml @@ -0,0 +1,10 @@ +--- +- name: cook variables for host + hosts: "{{ install_hostnames }}" + gather_facts: no + tasks: + - set_fact: + install: "{{ install | default({}) }}" + network: "{{ network | default({}) }}" + +- import_playbook: ../common/iso-generate.yml diff --git a/skillz/iso-install.yml b/skillz/iso-install.yml new file mode 100644 index 00000000..5defe6d3 --- /dev/null +++ b/skillz/iso-install.yml @@ -0,0 +1,10 @@ +--- +- name: cook variables for host + hosts: "{{ install_hostname }}" + gather_facts: no + tasks: + - set_fact: + install: "{{ install | default({}) }}" + network: "{{ network | default({}) }}" + +- import_playbook: ../common/iso-install.yml diff --git a/skillz/openwrt-deploy.yml b/skillz/openwrt-deploy.yml new file mode 100644 index 00000000..e7cc49fa --- /dev/null +++ b/skillz/openwrt-deploy.yml @@ -0,0 +1,9 @@ +--- +- name: generate os image + hosts: "{{ install_hostname }}" + connection: local + gather_facts: no + roles: + - role: installer/openwrt/image + +- import_playbook: ../common/openwrt-deploy.yml diff --git a/dan/sk-2019.yml b/skillz/sk-2019.yml index 3d555ba5..3d555ba5 100644 --- a/dan/sk-2019.yml +++ b/skillz/sk-2019.yml diff --git a/dan/sk-2019vm.yml b/skillz/sk-2019vm.yml index d7c42245..d7c42245 100644 --- a/dan/sk-2019vm.yml +++ b/skillz/sk-2019vm.yml diff --git a/skillz/sk-2024.yml b/skillz/sk-2024.yml new file mode 100644 index 00000000..a16cff2a --- /dev/null +++ b/skillz/sk-2024.yml @@ -0,0 +1,43 @@ +--- +- name: Basic Setup + hosts: sk-2024 + roles: + - role: apt-repo/base + - role: core/base + - role: core/sshd/base + - role: core/zsh + - role: core/ntp + - role: core/cpu-microcode + +- name: Payload Setup + hosts: sk-2024 + roles: + - role: storage/luks/base + - role: storage/zfs/base + - role: storage/zfs/sanoid + - role: vm/host/base + - role: vm/host/network + - role: installer/debian/base + tasks: + - name: install post-boot script + copy: + dest: /usr/local/bin/post-boot + mode: 0755 + content: | + #!/bin/bash + set -e + + {% for name, volume in luks_devices.items() %} + echo -e "opening crypto volume: \033[1;37m{{ name }}\033[0m" + cryptsetup luksOpen '{{ volume.device }}' '{{ name }}' + {% endfor %} + + systemctl restart zfs-import-cache.service + systemctl restart zfs-mount.service + systemctl restart zfs-share.service + systemctl restart zfs-zed.service + mount -a + + sleep 2 + rm -f /run/libvirt/qemu/autostarted + systemctl restart libvirtd.service diff --git a/dan/sk-cloudio.yml b/skillz/sk-cloudio.yml index 15e8bfec..a0ff8f51 100644 --- a/dan/sk-cloudio.yml +++ b/skillz/sk-cloudio.yml @@ -6,9 +6,9 @@ - role: core/base - role: core/sshd/base - role: core/zsh - - role: core/cpu-microcode + - role: core/ntp -- name: Payload Setup +- name: Infra hosts: sk-cloudio roles: - role: core/users @@ -17,15 +17,20 @@ - role: storage/zfs/sanoid - role: kubernetes/base - role: kubernetes/standalone/base + - role: x509/static-ca/base - role: x509/acmetool/base - role: nginx/base + - role: apps/publish/base - role: mail/postfix/base + +- name: Apps + hosts: sk-cloudio + roles: - role: apps/nextcloud - - role: apps/collabora/code +# - role: apps/collabora/code - role: apps/onlyoffice - #- role: apps/etherpad-lite - - role: apps/coturn - - role: apps/jitsi/meet - - role: apps/keycloak - #- role: apps/pigallery2 - - role: apps/wikijs + +# - role: apps/coturn +# - role: apps/jitsi/meet +# - role: apps/wikijs +# - role: apps/keycloak diff --git a/dan/sk-testvm.yml b/skillz/sk-testvm.yml index 74ba2053..74ba2053 100644 --- a/dan/sk-testvm.yml +++ b/skillz/sk-testvm.yml diff --git a/dan/sk-tomnext-hp.yml b/skillz/sk-tomnext-hp.yml index b0c38093..b0c38093 100644 --- a/dan/sk-tomnext-hp.yml +++ b/skillz/sk-tomnext-hp.yml diff --git a/skillz/sk-tomnext-nc.yml b/skillz/sk-tomnext-nc.yml new file mode 100644 index 00000000..fbc7aeb0 --- /dev/null +++ b/skillz/sk-tomnext-nc.yml @@ -0,0 +1,28 @@ +--- +- name: Basic Setup + hosts: sk-tomnext-nc + tasks: + - debug: + msg: "this is a legacy host please use branch legacy/skillz" +# roles: +# - role: apt-repo/base +# - role: core/base +# - role: core/sshd/base +# - role: core/zsh +# +#- name: Payload Setup +# hosts: sk-tomnext-nc +# roles: +# - role: core/users +# - role: storage/zfs/base +# - role: apt-repo/spreadspace +# - role: storage/zfs/sanoid +# - role: kubernetes/base +# - role: kubernetes/standalone/base +# - role: x509/acmetool/base +# - role: nginx/base +# - role: mail/postfix/base +# - role: apps/nextcloud +# - role: apps/collabora/code +# - role: apps/onlyoffice +# diff --git a/dan/sk-tomnext.yml b/skillz/sk-tomnext.yml index 8ad69918..8ad69918 100644 --- a/dan/sk-tomnext.yml +++ b/skillz/sk-tomnext.yml diff --git a/dan/sk-torrent.yml b/skillz/sk-torrent.yml index e6a176c1..e6a176c1 100644 --- a/dan/sk-torrent.yml +++ b/skillz/sk-torrent.yml diff --git a/skillz/usb-generate.yml b/skillz/usb-generate.yml new file mode 100644 index 00000000..7f633f1e --- /dev/null +++ b/skillz/usb-generate.yml @@ -0,0 +1,10 @@ +--- +- name: cook variables for host + hosts: "{{ install_hostnames }}" + gather_facts: no + tasks: + - set_fact: + install: "{{ install | default({}) }}" + network: "{{ network | default({}) }}" + +- import_playbook: ../common/usb-generate.yml diff --git a/skillz/usb-install.yml b/skillz/usb-install.yml new file mode 100644 index 00000000..0f62bc85 --- /dev/null +++ b/skillz/usb-install.yml @@ -0,0 +1,10 @@ +--- +- name: cook variables for host + hosts: "{{ install_hostname }}" + gather_facts: no + tasks: + - set_fact: + install: "{{ install | default({}) }}" + network: "{{ network | default({}) }}" + +- import_playbook: ../common/usb-install.yml diff --git a/skillz/vm-deploy.yml b/skillz/vm-deploy.yml new file mode 100644 index 00000000..8530b14a --- /dev/null +++ b/skillz/vm-deploy.yml @@ -0,0 +1,18 @@ +--- +- name: generate os image + hosts: "{{ install_hostname }}" + connection: local + gather_facts: no + roles: + - role: "installer/{{ install_distro }}/image" + +- name: cook variables for host + hosts: "{{ install_hostname }}" + gather_facts: no + tasks: + - set_fact: + install: "{{ install | default({}) }}" + network: "{{ network | default({}) }}" + vm_host: "{{ vm_host | default({}) }}" + +- import_playbook: ../common/vm-deploy.yml diff --git a/skillz/vm-install.yml b/skillz/vm-install.yml new file mode 100644 index 00000000..da6a29a5 --- /dev/null +++ b/skillz/vm-install.yml @@ -0,0 +1,11 @@ +--- +- name: cook variables for host + hosts: "{{ install_hostname }}" + gather_facts: no + tasks: + - set_fact: + install: "{{ install | default({}) }}" + network: "{{ network | default({}) }}" + vm_host: "{{ vm_host | default({}) }}" + +- import_playbook: ../common/vm-install.yml @@ -19,4 +19,4 @@ cd "${BASH_SOURCE%/*}" source common/utils.sh vault_environment__set "$env_group" || exit 1 -exec ansible-vault "$command" "$file" +exec ansible-vault "$command" "$file" "$@" |
