blob: 1848177877389405ed2ee511561bd087d9dae57c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
|
- name: Install packages inside jail
loop:
- { jail: ingress, package: nginx }
- { jail: ingress, package: py311-certbot }
- { jail: ingress, package: py311-certbot-nginx }
- { jail: ingress, package: goaccess }
include_tasks: pkg_jail_install.yml
- name: Configure pf.conf
template:
src: ingress/etc_pf.conf.j2
dest: /usr/local/jails/containers/ingress/etc/pf.conf
owner: root
group: wheel
mode: "0644"
register: ingress_pf_conf
- name: Reload pf.conf
shell: jexec ingress pfctl -f /etc/pf.conf
when: ingress_pf_conf.changed
- name: Check if gateway mode is enabled
shell: jexec ingress sysrc gateway_enable | grep -q "YES"
register: ingress_gateway_enabled
failed_when: false
changed_when: false
- name: Enable gateway mode
shell: jexec ingress sysrc gateway_enable=YES
when: ingress_gateway_enabled.rc != 0
- name: Check if IP forwarding is enabled
shell: jexec ingress sysctl net.inet.ip.forwarding | grep -q "1"
register: ingress_ip_forwarding_enabled
failed_when: false
changed_when: false
- name: Enable IP forwarding
shell: jexec ingress sysctl net.inet.ip.forwarding=1
when: ingress_ip_forwarding_enabled.rc != 0
- name: Install pf-ban-socket.py
copy:
src: templates/ingress/pf-ban-socket.py
dest: /usr/local/jails/containers/ingress/usr/local/bin/pf-ban-socket.py
owner: root
group: wheel
mode: "0755"
register: ingress_pf_ban_socket_py
- name: Install pf-ban-socket service
copy:
src: templates/ingress/usr_local_etc_rc.d_pf_ban_socket
dest: /usr/local/jails/containers/ingress/usr/local/etc/rc.d/pf_ban_socket
owner: root
group: wheel
mode: "0755"
register: ingress_pf_ban_socket_service
- name: Check if pf enabled
shell: jexec ingress sysrc pf_enable | grep -q "YES"
register: ingress_pf_enabled
failed_when: false
changed_when: false
- name: Enable pf
shell: jexec ingress sysrc pf_enable=YES
when: ingress_pf_enabled.rc != 0
- name: Check if pf is running
shell: service -j ingress pf status
register: ingress_pf_status
changed_when: ingress_pf_status.rc != 0
- name: Start pf
shell: service -j ingress pf start
when: ingress_pf_status.rc != 0
- name: Enable pf-ban-socket service
shell: |
service -j ingress pf_ban_socket enable
service -j ingress pf_ban_socket restart
when: ingress_pf_ban_socket_service.changed or ingress_pf_ban_socket_py.changed
- name: Copy acme-dns-auth.py
copy:
src: templates/ingress/acme-dns-auth.py
dest: /usr/local/jails/containers/ingress/usr/local/bin/acme-dns-auth.py
owner: root
group: wheel
mode: "0755"
- name: Check if LetsEncrypt certs are generated
shell: ls /usr/local/jails/containers/ingress/usr/local/etc/letsencrypt/live/{{ cert_name }}
register: cert_exists
failed_when: false
changed_when: false
- name: Manually get certs with certbot and DNS challenge
pause:
prompt: |
/usr/local/etc/letsencrypt/live/{{ cert_name }} does not exist. This means that this is the first run of this playbook.
The {{ cert_name }} cert contains all of the @ and * certs for all domains.
Check the ingress crontab template and run the certbot command manually in the ingress jail. Remove the "-n" flag.
Add the requested DNS records manually into Hetzner DNS. Continue after this is done.
when: cert_exists.rc != 0
- name: Configure nginx.conf
template:
src: ingress/usr_local_etc_nginx_nginx.conf.j2
dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf
owner: root
group: wheel
mode: "0644"
register: nginx_conf
- name: Create nginx snippets directory
file:
path: "/usr/local/jails/containers/ingress/usr/local/etc/nginx/snippets"
state: directory
owner: root
group: wheel
mode: "0755"
- name: Include ban.inc
template:
src: ingress/nginx_snippet_ban.inc
dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/snippets/ban.inc
owner: root
group: wheel
mode: "0644"
- name: Create static directories
loop: "{{ ingress_routes | selectattr('static', 'defined') | map(attribute='static') | unique | list }}"
file:
path: "/usr/local/jails/containers/ingress{{ item }}"
state: directory
recurse: yes
owner: 80
group: 80
mode: "0755"
- name: Check if nginx is enabled
shell: service -j ingress nginx status
changed_when: false
failed_when: false
register: ingress_nginx_enabled
- name: Enable and start nginx
shell: |
service -j ingress nginx enable
service -j ingress nginx restart
when: ingress_nginx_enabled.rc != 0 or nginx_conf.changed
- name: Install hetzner_ddns.sh
template:
src: ingress/usr_local_bin_hetzner_ddns.sh.j2
dest: /usr/local/jails/containers/ingress/usr/local/bin/hetzner_ddns.sh
owner: root
group: wheel
mode: "0755"
- name: Set up hetzner_auth
template:
src: ingress/usr_local_etc_hetzner_auth.j2
dest: /usr/local/jails/containers/ingress/usr/local/etc/hetzner_auth
owner: root
group: wheel
mode: "0600"
- name: Set up gen_goaccess.sh
template:
src: ingress/usr_local_bin_gen_goaccess.sh.j2
dest: /usr/local/jails/containers/ingress/usr/local/bin/gen_goaccess.sh
owner: root
group: wheel
mode: "0755"
- name: Set up crontab
template:
src: ingress/etc_crontab.j2
dest: /usr/local/jails/containers/ingress/etc/crontab
owner: root
group: wheel
mode: "0644"
vars:
tls_hosts: "{{ ingress_routes | map(attribute='host') | unique }}"
register: jail_ingress_etc_crontab
- name: Restart cron
service:
name: cron
state: restarted
when: jail_ingress_etc_crontab.changed
|
