From e8631202bb490dde9e245bc668ee4ec8fcc35362 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Sun, 9 Jun 2019 22:15:10 +0200 Subject: liquid-truth vs liquidtruth --- dan/ele-lt.yml | 2 +- inventory/host_vars/ele-lt.yml | 2 +- inventory/hosts.ini | 2 +- roles/elevate/liquid-truth/defaults/main.yml | 2 - roles/elevate/liquid-truth/handlers/main.yml | 5 -- roles/elevate/liquid-truth/tasks/main.yml | 24 ------- roles/elevate/liquid-truth/tasks/mongodb.yml | 21 ------ roles/elevate/liquid-truth/tasks/nginx.yml | 78 ---------------------- roles/elevate/liquid-truth/templates/nginx.conf.j2 | 48 ------------- roles/elevate/liquidtruth/defaults/main.yml | 2 + roles/elevate/liquidtruth/handlers/main.yml | 5 ++ roles/elevate/liquidtruth/tasks/main.yml | 24 +++++++ roles/elevate/liquidtruth/tasks/mongodb.yml | 21 ++++++ roles/elevate/liquidtruth/tasks/nginx.yml | 78 ++++++++++++++++++++++ roles/elevate/liquidtruth/templates/nginx.conf.j2 | 48 +++++++++++++ 15 files changed, 181 insertions(+), 181 deletions(-) delete mode 100644 roles/elevate/liquid-truth/defaults/main.yml delete mode 100644 roles/elevate/liquid-truth/handlers/main.yml delete mode 100644 roles/elevate/liquid-truth/tasks/main.yml delete mode 100644 roles/elevate/liquid-truth/tasks/mongodb.yml delete mode 100644 roles/elevate/liquid-truth/tasks/nginx.yml delete mode 100644 roles/elevate/liquid-truth/templates/nginx.conf.j2 create mode 100644 roles/elevate/liquidtruth/defaults/main.yml create mode 100644 roles/elevate/liquidtruth/handlers/main.yml create mode 100644 roles/elevate/liquidtruth/tasks/main.yml create mode 100644 roles/elevate/liquidtruth/tasks/mongodb.yml create mode 100644 roles/elevate/liquidtruth/tasks/nginx.yml create mode 100644 roles/elevate/liquidtruth/templates/nginx.conf.j2 diff --git a/dan/ele-lt.yml b/dan/ele-lt.yml index d19c6af4..876d0d16 100644 --- a/dan/ele-lt.yml +++ b/dan/ele-lt.yml @@ -6,4 +6,4 @@ - role: sshd - role: zsh - role: acmetool/base - - role: elevate/liquid-truth + - role: elevate/liquidtruth diff --git a/inventory/host_vars/ele-lt.yml b/inventory/host_vars/ele-lt.yml index 1acbf2a6..6f019a76 100644 --- a/inventory/host_vars/ele-lt.yml +++ b/inventory/host_vars/ele-lt.yml @@ -1,7 +1,7 @@ --- #acmetool_directory_server: "{{ acmetool_directory_server_le_live }}" -liquid_truth_hostnames: +liquidtruth_hostnames: # - liquidtruth.at # - www.liquidtruth.at # - www2.liquidtruth.at diff --git a/inventory/hosts.ini b/inventory/hosts.ini index 4a89a282..8ff02b4c 100644 --- a/inventory/hosts.ini +++ b/inventory/hosts.ini @@ -129,7 +129,7 @@ ele-router ele-telesto host_name=telesto ele-thetys host_name=thetys ele-uhrturm host_name=uhrturm -ele-lt host_name=liquid-truth ansible_port=222 +ele-lt host_name=liquidtruth ansible_port=222 [elevate:children] ele_ap diff --git a/roles/elevate/liquid-truth/defaults/main.yml b/roles/elevate/liquid-truth/defaults/main.yml deleted file mode 100644 index 4770c5fb..00000000 --- a/roles/elevate/liquid-truth/defaults/main.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -liquid_truth_srv_disk_size: 12G diff --git a/roles/elevate/liquid-truth/handlers/main.yml b/roles/elevate/liquid-truth/handlers/main.yml deleted file mode 100644 index 6deed0cd..00000000 --- a/roles/elevate/liquid-truth/handlers/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: restart nginx - service: - name: nginx - state: restarted diff --git a/roles/elevate/liquid-truth/tasks/main.yml b/roles/elevate/liquid-truth/tasks/main.yml deleted file mode 100644 index 7f4749ae..00000000 --- a/roles/elevate/liquid-truth/tasks/main.yml +++ /dev/null @@ -1,24 +0,0 @@ ---- -- name: create logical volume for /srv - lvol: - vg: "{{ host_name }}" - lv: "srv" - size: "{{ liquid_truth_srv_disk_size }}" - -- name: create filesystem - filesystem: - fstype: xfs - dev: "/dev/mapper/{{ host_name | replace('-', '--') }}-srv" - -- name: mount filesytem - mount: - src: "/dev/mapper/{{ host_name | replace('-', '--') }}-srv" - path: /srv - fstype: xfs - state: mounted - -- name: install and configure mongodb - import_tasks: mongodb.yml - -- name: install and configure nginx - import_tasks: nginx.yml diff --git a/roles/elevate/liquid-truth/tasks/mongodb.yml b/roles/elevate/liquid-truth/tasks/mongodb.yml deleted file mode 100644 index 244d9849..00000000 --- a/roles/elevate/liquid-truth/tasks/mongodb.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- -- name: create mongodb data directory - file: - name: /srv/mongodb - state: directory - -- name: create bind mount for mongodb - mount: - src: /srv/mongodb - path: /var/lib/mongodb - fstype: none - opts: bind,defaults - state: mounted - -- name: install mongodb server - apt: - name: - - mongodb - - mongo-tools - - python-pymongo - state: present diff --git a/roles/elevate/liquid-truth/tasks/nginx.yml b/roles/elevate/liquid-truth/tasks/nginx.yml deleted file mode 100644 index a5bd31d7..00000000 --- a/roles/elevate/liquid-truth/tasks/nginx.yml +++ /dev/null @@ -1,78 +0,0 @@ ---- -- name: install nginx - apt: - name: nginx-light - state: present - -- name: remove nginx default config - file: - name: /etc/nginx/sites-enabled/default - state: absent - notify: restart nginx - -- name: install nginx config snippets - loop: - - ssl - - hsts - copy: - src: "{{ global_files_dir }}/common/nginx-snippets/{{ item }}.conf" - dest: /etc/nginx/snippets/ - notify: restart nginx - -- name: generate Diffie-Hellman parameters - openssl_dhparam: - path: /etc/ssl/dhparams.pem - size: 2048 - notify: restart nginx - -- name: install nginx config - template: - src: nginx.conf.j2 - dest: /etc/nginx/sites-available/liquid-truth - notify: restart nginx - -- name: check if acme certs already exist - loop: "{{ liquid_truth_hostnames }}" - stat: - path: "/var/lib/acme/live/{{ item }}" - register: acme_cert_stat - -- name: set acmecert_missing_hostnames variable - set_fact: - acmecert_missing_hostnames: "{{ acme_cert_stat.results | acme_cert_nonexistent(liquid_truth_hostnames) }}" - -- name: link nonexistent hostnames to self-signed interim cert - when: acmecert_missing_hostnames | length > 0 - block: - - name: get id of existing selfsigned interim certificate - command: cat /var/lib/acme/.selfsigned-interim-cert - changed_when: false - check_mode: false - register: selfsigned_interim_cert_id - - - name: set selfsigned_interim_cert_id variable - set_fact: - selfsigned_interim_cert_id: "{{ selfsigned_interim_cert_id.stdout }}" - - - name: link to snakeoil cert for nonexistent hostnames - loop: "{{ acmecert_missing_hostnames }}" - file: - src: "../certs/{{ selfsigned_interim_cert_id }}" - dest: "/var/lib/acme/live/{{ item }}" - state: link - -- name: enable vhost config using acme cert - file: - src: ../sites-available/liquid-truth - dest: /etc/nginx/sites-enabled/liquid-truth - state: link - -- name: make sure nginx config has been (re)loaded - meta: flush_handlers - -- name: get certificate using acmetool - import_role: - name: acmetool/cert - vars: - acmetool_cert_name: "{{ liquid_truth_hostnames[0] }}" - acmetool_cert_hostnames: "{{ liquid_truth_hostnames }}" diff --git a/roles/elevate/liquid-truth/templates/nginx.conf.j2 b/roles/elevate/liquid-truth/templates/nginx.conf.j2 deleted file mode 100644 index e3cdf575..00000000 --- a/roles/elevate/liquid-truth/templates/nginx.conf.j2 +++ /dev/null @@ -1,48 +0,0 @@ -# used for websockets -# set http_connection to either upgrade or close (as normal) -map $http_upgrade $connection_upgrade { - default upgrade; - '' close; -} - -server { - listen 80; - listen [::]:80; - server_name {{ liquid_truth_hostnames | join(' ') }}; - - include snippets/acmetool.conf; - - location / { - return 301 https://$host$request_uri; - } -} - -server { - listen 443 ssl http2; - listen [::]:443 ssl http2; - server_name {{ liquid_truth_hostnames | join(' ') }}; - - include snippets/acmetool.conf; - include snippets/ssl.conf; - ssl_certificate /var/lib/acme/live/{{ liquid_truth_hostnames[0] }}/fullchain; - ssl_certificate_key /var/lib/acme/live/{{ liquid_truth_hostnames[0] }}/privkey; - include snippets/hsts.conf; - - location / { - proxy_buffering off; - proxy_ignore_headers "X-Accel-Buffering"; - proxy_request_buffering off; - proxy_http_version 1.1; - - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - - # for websockets - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - - proxy_pass http://127.0.0.1:8080; - } -} diff --git a/roles/elevate/liquidtruth/defaults/main.yml b/roles/elevate/liquidtruth/defaults/main.yml new file mode 100644 index 00000000..76aa667a --- /dev/null +++ b/roles/elevate/liquidtruth/defaults/main.yml @@ -0,0 +1,2 @@ +--- +liquidtruth_srv_disk_size: 12G diff --git a/roles/elevate/liquidtruth/handlers/main.yml b/roles/elevate/liquidtruth/handlers/main.yml new file mode 100644 index 00000000..6deed0cd --- /dev/null +++ b/roles/elevate/liquidtruth/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: restart nginx + service: + name: nginx + state: restarted diff --git a/roles/elevate/liquidtruth/tasks/main.yml b/roles/elevate/liquidtruth/tasks/main.yml new file mode 100644 index 00000000..97eee759 --- /dev/null +++ b/roles/elevate/liquidtruth/tasks/main.yml @@ -0,0 +1,24 @@ +--- +- name: create logical volume for /srv + lvol: + vg: "{{ host_name }}" + lv: "srv" + size: "{{ liquidtruth_srv_disk_size }}" + +- name: create filesystem + filesystem: + fstype: xfs + dev: "/dev/mapper/{{ host_name | replace('-', '--') }}-srv" + +- name: mount filesytem + mount: + src: "/dev/mapper/{{ host_name | replace('-', '--') }}-srv" + path: /srv + fstype: xfs + state: mounted + +- name: install and configure mongodb + import_tasks: mongodb.yml + +- name: install and configure nginx + import_tasks: nginx.yml diff --git a/roles/elevate/liquidtruth/tasks/mongodb.yml b/roles/elevate/liquidtruth/tasks/mongodb.yml new file mode 100644 index 00000000..244d9849 --- /dev/null +++ b/roles/elevate/liquidtruth/tasks/mongodb.yml @@ -0,0 +1,21 @@ +--- +- name: create mongodb data directory + file: + name: /srv/mongodb + state: directory + +- name: create bind mount for mongodb + mount: + src: /srv/mongodb + path: /var/lib/mongodb + fstype: none + opts: bind,defaults + state: mounted + +- name: install mongodb server + apt: + name: + - mongodb + - mongo-tools + - python-pymongo + state: present diff --git a/roles/elevate/liquidtruth/tasks/nginx.yml b/roles/elevate/liquidtruth/tasks/nginx.yml new file mode 100644 index 00000000..2066ce27 --- /dev/null +++ b/roles/elevate/liquidtruth/tasks/nginx.yml @@ -0,0 +1,78 @@ +--- +- name: install nginx + apt: + name: nginx-light + state: present + +- name: remove nginx default config + file: + name: /etc/nginx/sites-enabled/default + state: absent + notify: restart nginx + +- name: install nginx config snippets + loop: + - ssl + - hsts + copy: + src: "{{ global_files_dir }}/common/nginx-snippets/{{ item }}.conf" + dest: /etc/nginx/snippets/ + notify: restart nginx + +- name: generate Diffie-Hellman parameters + openssl_dhparam: + path: /etc/ssl/dhparams.pem + size: 2048 + notify: restart nginx + +- name: install nginx config + template: + src: nginx.conf.j2 + dest: /etc/nginx/sites-available/liquidtruth + notify: restart nginx + +- name: check if acme certs already exist + loop: "{{ liquidtruth_hostnames }}" + stat: + path: "/var/lib/acme/live/{{ item }}" + register: acme_cert_stat + +- name: set acmecert_missing_hostnames variable + set_fact: + acmecert_missing_hostnames: "{{ acme_cert_stat.results | acme_cert_nonexistent(liquidtruth_hostnames) }}" + +- name: link nonexistent hostnames to self-signed interim cert + when: acmecert_missing_hostnames | length > 0 + block: + - name: get id of existing selfsigned interim certificate + command: cat /var/lib/acme/.selfsigned-interim-cert + changed_when: false + check_mode: false + register: selfsigned_interim_cert_id + + - name: set selfsigned_interim_cert_id variable + set_fact: + selfsigned_interim_cert_id: "{{ selfsigned_interim_cert_id.stdout }}" + + - name: link to snakeoil cert for nonexistent hostnames + loop: "{{ acmecert_missing_hostnames }}" + file: + src: "../certs/{{ selfsigned_interim_cert_id }}" + dest: "/var/lib/acme/live/{{ item }}" + state: link + +- name: enable vhost config using acme cert + file: + src: ../sites-available/liquidtruth + dest: /etc/nginx/sites-enabled/liquidtruth + state: link + +- name: make sure nginx config has been (re)loaded + meta: flush_handlers + +- name: get certificate using acmetool + import_role: + name: acmetool/cert + vars: + acmetool_cert_name: "{{ liquidtruth_hostnames[0] }}" + acmetool_cert_hostnames: "{{ liquidtruth_hostnames }}" diff --git a/roles/elevate/liquidtruth/templates/nginx.conf.j2 b/roles/elevate/liquidtruth/templates/nginx.conf.j2 new file mode 100644 index 00000000..ef690b1c --- /dev/null +++ b/roles/elevate/liquidtruth/templates/nginx.conf.j2 @@ -0,0 +1,48 @@ +# used for websockets +# set http_connection to either upgrade or close (as normal) +map $http_upgrade $connection_upgrade { + default upgrade; + '' close; +} + +server { + listen 80; + listen [::]:80; + server_name {{ liquidtruth_hostnames | join(' ') }}; + + include snippets/acmetool.conf; + + location / { + return 301 https://$host$request_uri; + } +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name {{ liquidtruth_hostnames | join(' ') }}; + + include snippets/acmetool.conf; + include snippets/ssl.conf; + ssl_certificate /var/lib/acme/live/{{ liquidtruth_hostnames[0] }}/fullchain; + ssl_certificate_key /var/lib/acme/live/{{ liquidtruth_hostnames[0] }}/privkey; + include snippets/hsts.conf; + + location / { + proxy_buffering off; + proxy_ignore_headers "X-Accel-Buffering"; + proxy_request_buffering off; + proxy_http_version 1.1; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + # for websockets + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + + proxy_pass http://127.0.0.1:8080; + } +} -- cgit v1.2.3