blob: 544c781ce72e09e2dbd447fc90b53d95cbbd7da2 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
---
- name: Basic Setup
hosts: ch-http-proxy
roles:
- role: apt-repo/base
- role: core/base
- role: core/sshd
- role: core/zsh
- role: apt-repo/spreadspace
- role: acmetool/base
- role: nginx/base
- role: nginx/vhost
nginx_vhost:
default: yes
name: web
template: static-files-with-acme
acme: yes
hostnames:
- web.chaos-at-home.org
root: /var/www/default
index: index.html
acmetool_cert_config:
request:
challenge:
http-self-test: false
- role: nginx/vhost
nginx_vhost:
name: webmail
template: generic-proxy-no-buffering-with-acme
acme: yes
hostnames:
- webmail.chaos-at-home.org
client_max_body_size: "200M"
proxy_pass: "https://{{ network_zones.lan.prefix | ipaddr(network_zones.lan.offsets['ch-prometheus-old']) | ipaddr('address') }}/"
acmetool_cert_config:
request:
challenge:
http-self-test: false
- role: nginx/vhost
nginx_vhost:
name: webdav
template: generic-proxy-no-buffering-with-acme
acme: yes
hostnames:
- webdav.chaos-at-home.org
proxy_pass: "https://{{ network_zones.lan.prefix | ipaddr(network_zones.lan.offsets['ch-prometheus-old']) | ipaddr('address') }}/"
acmetool_cert_config:
request:
challenge:
http-self-test: false
- role: nginx/vhost
nginx_vhost:
name: imap
acme: no
content: |
server {
listen 80;
listen [::]:80;
server_name imap.chaos-at-home.org;
location /.well-known/acme-challenge/ {
proxy_pass http://{{ network_services.imap.addr }};
}
location / {
return 303 https://webmail.chaos-at-home.org;
}
}
post_tasks:
- name: lower minimum tls protocol version to 1.0
lineinfile:
path: /etc/ssl/openssl.cnf
regexp: '^MinProtocol\s*='
line: 'MinProtocol = TLSv1.0'
- name: create directory for default server
file:
path: /var/www/default
state: directory
- name: copy chaos-at-home logo file
copy:
src: "{{ global_files_dir }}/chaos-at-home/logo.jpg"
dest: /var/www/default/logo.jpg
- name: install index.html for default server
copy:
dest: /var/www/default/index.html
content: |
<html>
<head>
<title>No Such Site</title>
</head>
<body style="font-family: Helvetica, Arial, Sans-Serif; color: white; background: black;">
<div style="text-align: center; margin-top: 4em; margin-left:auto; margin-right:auto;">
<img src="logo.jpg" alt="chaos@home Logo" />
<h2 style="">You have reached the chaos@home internal webserver, however the URL that you used is unknown to this host.</h2>
</div>
</body>
</html>
# - name: install systemd service unit for service-ip
# copy:
# dest: /etc/systemd/system/http-service-ip.service
# content: |
# [Unit]
# Description=Assign HTTP Sevice IP
# After=network.target
# [Service]
# Type=oneshot
# ExecStart=/usr/sbin/ip addr add dev {{ network.primary.name }} {{ network_services.http.addr }}/32
# ExecStop=/usr/sbin/ip addr del dev {{ network.primary.name }} {{ network_services.http.addr }}/32
# RemainAfterExit=yes
# [Install]
# WantedBy=multi-user.target
# register: service_ip_systemd_unit
# - name: make sure service-ip systemd unit is enabeld and started
# systemd:
# daemon_reload: yes
# name: http-service-ip.service
# state: "{{ (service_ip_systemd_unit is changed) | ternary('restarted', 'started') }}"
# enabled: yes
|
