From 054b2815758e93c699e9a6bb32853e2a4cdef2ff Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Mon, 23 Jun 2025 11:16:59 +0300 Subject: Add email, network, zfs tasks --- templates/aliases.j2 | 1 - templates/auth.conf.j2 | 1 - templates/dma.conf.j2 | 8 -- templates/etc_aliases.j2 | 1 + templates/etc_dma_auth.conf.j2 | 1 + templates/etc_dma_dma.conf.j2 | 8 ++ templates/etc_ssh_sshd_config.j2 | 121 +++++++++++++++++++++++ templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 | 33 +++++++ 8 files changed, 164 insertions(+), 10 deletions(-) delete mode 100644 templates/aliases.j2 delete mode 100644 templates/auth.conf.j2 delete mode 100644 templates/dma.conf.j2 create mode 100644 templates/etc_aliases.j2 create mode 100644 templates/etc_dma_auth.conf.j2 create mode 100644 templates/etc_dma_dma.conf.j2 create mode 100644 templates/etc_ssh_sshd_config.j2 create mode 100644 templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 (limited to 'templates') diff --git a/templates/aliases.j2 b/templates/aliases.j2 deleted file mode 100644 index a9ac845..0000000 --- a/templates/aliases.j2 +++ /dev/null @@ -1 +0,0 @@ -root: {{ dma_to_address }} diff --git a/templates/auth.conf.j2 b/templates/auth.conf.j2 deleted file mode 100644 index a1000ea..0000000 --- a/templates/auth.conf.j2 +++ /dev/null @@ -1 +0,0 @@ -{{ smtp_user }}|{{ smtp_host }}:{{ smtp_password }} diff --git a/templates/dma.conf.j2 b/templates/dma.conf.j2 deleted file mode 100644 index dfaa04f..0000000 --- a/templates/dma.conf.j2 +++ /dev/null @@ -1,8 +0,0 @@ -SMARTHOST {{ smtp_host }} -PORT {{ smtp_port }} -AUTHPATH /etc/dma/auth.conf -SECURETRANSFER -STARTTLS -MAILNAME {{ dma_mail_hostname }} -MASQUERADE {{ ansible_hostname }}@{{ dma_mail_hostname }} -#NULLCLIENT diff --git a/templates/etc_aliases.j2 b/templates/etc_aliases.j2 new file mode 100644 index 0000000..a9ac845 --- /dev/null +++ b/templates/etc_aliases.j2 @@ -0,0 +1 @@ +root: {{ dma_to_address }} diff --git a/templates/etc_dma_auth.conf.j2 b/templates/etc_dma_auth.conf.j2 new file mode 100644 index 0000000..a1000ea --- /dev/null +++ b/templates/etc_dma_auth.conf.j2 @@ -0,0 +1 @@ +{{ smtp_user }}|{{ smtp_host }}:{{ smtp_password }} diff --git a/templates/etc_dma_dma.conf.j2 b/templates/etc_dma_dma.conf.j2 new file mode 100644 index 0000000..dfaa04f --- /dev/null +++ b/templates/etc_dma_dma.conf.j2 @@ -0,0 +1,8 @@ +SMARTHOST {{ smtp_host }} +PORT {{ smtp_port }} +AUTHPATH /etc/dma/auth.conf +SECURETRANSFER +STARTTLS +MAILNAME {{ dma_mail_hostname }} +MASQUERADE {{ ansible_hostname }}@{{ dma_mail_hostname }} +#NULLCLIENT diff --git a/templates/etc_ssh_sshd_config.j2 b/templates/etc_ssh_sshd_config.j2 new file mode 100644 index 0000000..b7ad162 --- /dev/null +++ b/templates/etc_ssh_sshd_config.j2 @@ -0,0 +1,121 @@ +# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +# Note that some of FreeBSD's defaults differ from OpenBSD's, and +# FreeBSD has a few additional options. + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# Change to yes to enable built-in password authentication. +# Note that passwords may also be accepted via KbdInteractiveAuthentication. +PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable PAM authentication +#KbdInteractiveAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +# Set this to 'no' to disable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin prohibit-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +#UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS yes +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#UseBlacklist no +#VersionAddendum FreeBSD-20250219 + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/libexec/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 b/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 new file mode 100644 index 0000000..36bc715 --- /dev/null +++ b/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 @@ -0,0 +1,33 @@ +#!/bin/sh + +# PROVIDE: zpool_gpt_labels +# REQUIRE: zfs +# BEFORE: LOGIN +# KEYWORD: nojail + +. /etc/rc.subr + +name="zpool_gpt_labels" +rcvar="zpool_gpt_labels_enable" +start_cmd="zpool_gpt_labels_start" + +zpool_gpt_labels_start() { + logger "Setting zpool vdev paths to GPT labels" + local zpool_status="$(zpool status)" + for i in 0 1 2 3; do + local raw="nda${i}p4.eli" + local path="/dev/gpt/zfs${i}.eli" + case "$zpool_status" in + *"$raw"*) + zpool set "path=${path}" zroot "${raw}" + logger "Setting ${raw} -> ${path}" + ;; + *) + logger "Skipping ${raw}..." + ;; + esac + done +} + +load_rc_config $name +run_rc_command "$1" -- cgit v1.3