feat: first commit
This commit is contained in:
kodacci committed
commit
5fdf790556
25 files changed
+1957
No files matched your search
+503
@@ -0,0 +1,503 @@
|
||||
- name: Setup ufw port forwarding for VPNs subnets
|
||||
hosts: vps_servers
|
||||
become: true
|
||||
gather_facts: true
|
||||
tasks:
|
||||
- name: Install ufw
|
||||
ansible.builtin.apt:
|
||||
name: ufw
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
# - name: Configure ufw port forwarding
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: '/etc/sysctl.conf'
|
||||
# regexp: '^#?net.ipv4.ip_forward='
|
||||
# line: 'net.ipv4.ip_forward=1'
|
||||
# state: present
|
||||
# notify: Reload sysctl
|
||||
|
||||
- name: Configure ufw port forwarding
|
||||
ansible.builtin.copy:
|
||||
src: 'sysctl/99-ipv4-forward.conf'
|
||||
dest: '/etc/sysctl.d/99-ipv4-forward.conf'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
notify: Reload sysctl
|
||||
|
||||
- name: Set ufw default forwarding policy
|
||||
ansible.builtin.lineinfile:
|
||||
path: '/etc/default/ufw'
|
||||
regexp: '^DEFAULT_FORWARD_POLICY='
|
||||
line: 'DEFAULT_FORWARD_POLICY="ACCEPT"'
|
||||
state: present
|
||||
notify: Reload ufw
|
||||
|
||||
- name: Add postrouting nat
|
||||
ansible.builtin.blockinfile:
|
||||
path: '/etc/ufw/before.rules'
|
||||
insertbefore: '^\*filter'
|
||||
block: |
|
||||
# VPN NAT
|
||||
*nat
|
||||
:POSTROUTING ACCEPT [0:0]
|
||||
-A POSTROUTING -s 10.9.0.0/24 -o {{ public_ip_iface }} -j MASQUERADE
|
||||
-A POSTROUTING -s 10.8.0.0/24 -o {{ public_ip_iface }} -j MASQUERADE
|
||||
-A POSTROUTING -s 10.10.0.0/24 -o {{ public_ip_iface }} -j MASQUERADE
|
||||
COMMIT
|
||||
# END VPN NAT
|
||||
notify: Reload ufw
|
||||
|
||||
handlers:
|
||||
- name: Reload sysctl
|
||||
ansible.builtin.command: sysctl -p /etc/sysctl.d/99-ipv4-forward.conf
|
||||
register: result
|
||||
changed_when: result.rc == 0
|
||||
|
||||
- name: Reload ufw
|
||||
ansible.builtin.command: ufw reload
|
||||
register: result
|
||||
changed_when: result.rc == 0
|
||||
|
||||
- name: Setup strongswan
|
||||
hosts: vps_servers
|
||||
become: true
|
||||
gather_facts: true
|
||||
tasks:
|
||||
- name: Uninstall strongswan legacy packages if present
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- strongswan-starter
|
||||
- strongswan-charon
|
||||
state: absent
|
||||
purge: true
|
||||
autoremove: true
|
||||
|
||||
- name: Install strongswan with swanctl and vici
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- charon-systemd
|
||||
- strongswan-swanctl
|
||||
- libcharon-extra-plugins
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Copy strongswan config
|
||||
ansible.builtin.template:
|
||||
src: 'strongswan/ra-tech.conf.j2'
|
||||
dest: '/etc/swanctl/conf.d/ra-tech.conf'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Copy strongswan dhcp module config
|
||||
ansible.builtin.template:
|
||||
src: 'strongswan/charon/dhcp.conf.j2'
|
||||
dest: '/etc/strongswan.d/charon/dhcp.conf'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Copy Root CA
|
||||
ansible.builtin.copy:
|
||||
src: 'strongswan/ca.pem'
|
||||
dest: '/etc/swanctl/x509ca/ca-crt.pem'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Copy keys
|
||||
ansible.builtin.copy:
|
||||
src: 'strongswan/keys/'
|
||||
dest: '/etc/swanctl/rsa/'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: Copy certificates
|
||||
ansible.builtin.copy:
|
||||
src: 'strongswan/certs/'
|
||||
dest: '/etc/swanctl/x509/'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
notify:
|
||||
- Restart strongswan service
|
||||
|
||||
- name: Configure ra0 iface
|
||||
ansible.builtin.script: 'strongswan/iface-ra0-up.sh'
|
||||
|
||||
- name: Copy ra0 iface setup script
|
||||
ansible.builtin.copy:
|
||||
src: 'strongswan/iface-ra0-up.sh'
|
||||
dest: '/usr/local/bin'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Copy ra0 startup service
|
||||
ansible.builtin.copy:
|
||||
src: 'strongswan/iface-ra0.service'
|
||||
dest: '/etc/systemd/system/iface-ra0.service'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
notify:
|
||||
- Reload ra0 startup service
|
||||
|
||||
- name: Ufw allow strongswan ports
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
proto: udp
|
||||
port: '{{ item }}'
|
||||
loop:
|
||||
- '500'
|
||||
- '4500'
|
||||
|
||||
- name: Ufw allow from vpn subnet
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
proto: any
|
||||
src: '10.9.0.0/24'
|
||||
|
||||
handlers:
|
||||
- name: Restart strongswan service
|
||||
ansible.builtin.systemd:
|
||||
name: strongswan
|
||||
state: restarted
|
||||
enabled: true
|
||||
|
||||
- name: Reload ra0 startup service
|
||||
ansible.builtin.systemd:
|
||||
name: iface-ra0.service
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
|
||||
- name: Setup cloak
|
||||
hosts: vps_servers
|
||||
become: true
|
||||
tasks:
|
||||
- name: Create go download directory
|
||||
ansible.builtin.file:
|
||||
path: /opt/go
|
||||
state: directory
|
||||
mode: '0755'
|
||||
|
||||
- name: Download go
|
||||
ansible.builtin.get_url:
|
||||
url: 'https://go.dev/dl/go1.26.0.linux-amd64.tar.gz'
|
||||
dest: '/opt/go/go1.26.0.linux-amd64.tar.gz'
|
||||
mode: '0644'
|
||||
timeout: 60
|
||||
|
||||
- name: Unpack go
|
||||
ansible.builtin.unarchive:
|
||||
src: '/opt/go/go1.26.0.linux-amd64.tar.gz'
|
||||
dest: '/usr/local'
|
||||
remote_src: true
|
||||
|
||||
- name: Install git and make
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- git
|
||||
- make
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Clone cloak git repository
|
||||
ansible.builtin.git:
|
||||
repo: 'https://github.com/cbeuw/Cloak.git'
|
||||
dest: '/opt/git/Cloak'
|
||||
single_branch: true
|
||||
version: master
|
||||
|
||||
- name: Build cloak
|
||||
community.general.make:
|
||||
chdir: '/opt/git/Cloak'
|
||||
environment:
|
||||
PATH: '{{ ansible_env.PATH }}:/usr/local/go/bin'
|
||||
|
||||
- name: Setup cloak server
|
||||
ansible.builtin.copy:
|
||||
src: '/opt/git/Cloak/build/ck-server'
|
||||
remote_src: true
|
||||
dest: '/usr/local/bin'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: '0755'
|
||||
|
||||
- name: Add cloak group
|
||||
ansible.builtin.group:
|
||||
name: cloak
|
||||
state: present
|
||||
|
||||
- name: Add user for cloak
|
||||
ansible.builtin.user:
|
||||
name: cloak
|
||||
group: cloak
|
||||
state: present
|
||||
createhome: false
|
||||
|
||||
- name: Create cloak directory
|
||||
ansible.builtin.file:
|
||||
path: '/etc/cloak'
|
||||
state: directory
|
||||
mode: '0755'
|
||||
|
||||
- name: Setup cloak server configuration
|
||||
ansible.builtin.template:
|
||||
src: 'cloak/server.json.j2'
|
||||
dest: '/etc/cloak/server.json'
|
||||
owner: root
|
||||
group: cloak
|
||||
mode: '0644'
|
||||
|
||||
- name: Create cloak server data dir
|
||||
ansible.builtin.file:
|
||||
path: '/opt/cloak'
|
||||
state: directory
|
||||
owner: cloak
|
||||
group: cloak
|
||||
mode: '0755'
|
||||
|
||||
- name: Setup cloak systemd service
|
||||
ansible.builtin.copy:
|
||||
src: 'cloak/cloak.service'
|
||||
dest: '/etc/systemd/system/cloak.service'
|
||||
mode: '0644'
|
||||
notify: Reload cloak service
|
||||
|
||||
- name: Ufw allow cloak port
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: '5691'
|
||||
proto: tcp
|
||||
|
||||
handlers:
|
||||
- name: Reload cloak service
|
||||
ansible.builtin.systemd:
|
||||
name: cloak.service
|
||||
state: started
|
||||
enabled: false
|
||||
daemon_reload: true
|
||||
|
||||
- name: Setup openvpn server
|
||||
hosts: vps_servers
|
||||
become: true
|
||||
tasks:
|
||||
- name: Install openvpn server
|
||||
ansible.builtin.apt:
|
||||
name: openvpn
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Copy certificates
|
||||
ansible.builtin.copy:
|
||||
src: 'openvpn/certs/'
|
||||
dest: '/etc/openvpn/server/'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: Copy openvpn config
|
||||
ansible.builtin.copy:
|
||||
src: 'openvpn/server.conf'
|
||||
dest: '/etc/openvpn/server/server.conf'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
notify:
|
||||
- Restart openvpn server
|
||||
|
||||
- name: Ufw allow openvpn port
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
proto: tcp
|
||||
port: '5690'
|
||||
|
||||
- name: Ufw allow from vpn subnet
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
proto: any
|
||||
src: '10.8.0.0/24'
|
||||
|
||||
handlers:
|
||||
- name: Restart openvpn server
|
||||
ansible.builtin.systemd:
|
||||
name: openvpn-server@server
|
||||
state: restarted
|
||||
enabled: true
|
||||
|
||||
- name: Setup bind9
|
||||
hosts: vps_servers
|
||||
become: true
|
||||
tasks:
|
||||
- name: Install bind9
|
||||
ansible.builtin.apt:
|
||||
name: bind9
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Copy bind9 config
|
||||
ansible.builtin.copy:
|
||||
src: '{{ item }}'
|
||||
dest: '/etc/bind/'
|
||||
owner: root
|
||||
group: bind
|
||||
mode: '0644'
|
||||
loop:
|
||||
- 'bind9/named.conf.local'
|
||||
- 'bind9/named.conf.options'
|
||||
- 'bind9/named.conf.default-zones'
|
||||
- 'bind9/named.conf.root-hints'
|
||||
|
||||
- name: Copy bind9 zones
|
||||
ansible.builtin.copy:
|
||||
src: 'bind9/zones/'
|
||||
dest: '/etc/bind/zones/'
|
||||
owner: root
|
||||
group: bind
|
||||
mode: '0644'
|
||||
notify:
|
||||
- Restart bind9
|
||||
|
||||
- name: Ufw allow bind9 ports
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
name: Bind9
|
||||
|
||||
handlers:
|
||||
- name: Restart bind9
|
||||
ansible.builtin.systemd:
|
||||
name: named
|
||||
state: restarted
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
|
||||
- name: Setup prometheus node exporter
|
||||
hosts: vps_servers
|
||||
become: true
|
||||
tasks:
|
||||
- name: Create node-exporter download directory
|
||||
ansible.builtin.file:
|
||||
path: /opt/node-exporter
|
||||
state: directory
|
||||
mode: '0755'
|
||||
|
||||
- name: Download node exporter executable
|
||||
ansible.builtin.get_url:
|
||||
url: 'https://github.com/prometheus/node_exporter/releases/download/v1.10.2/node_exporter-1.10.2.linux-amd64.tar.gz'
|
||||
dest: '/opt/node-exporter/node_exporter-1.10.2.linux-amd64.tar.gz'
|
||||
mode: '0644'
|
||||
|
||||
- name: Extract node_exporter
|
||||
ansible.builtin.unarchive:
|
||||
src: '/opt/node-exporter/node_exporter-1.10.2.linux-amd64.tar.gz'
|
||||
dest: '/usr/local/bin'
|
||||
remote_src: true
|
||||
include:
|
||||
- 'node_exporter-1.10.2.linux-amd64/node_exporter'
|
||||
extra_opts:
|
||||
- '--strip-components=1'
|
||||
|
||||
- name: Add node-exporter group
|
||||
ansible.builtin.group:
|
||||
name: node_exporter
|
||||
state: present
|
||||
|
||||
- name: Add user for node exporter
|
||||
ansible.builtin.user:
|
||||
name: node_exporter
|
||||
group: node_exporter
|
||||
state: present
|
||||
createhome: false
|
||||
|
||||
- name: Setup node-exporter service
|
||||
ansible.builtin.copy:
|
||||
src: 'node-exporter/node-exporter.service'
|
||||
dest: '/etc/systemd/system/node-exporter.service'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
notify: Reload node-exporter
|
||||
|
||||
handlers:
|
||||
- name: Reload node-exporter
|
||||
ansible.builtin.systemd:
|
||||
name: node-exporter
|
||||
state: started
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
|
||||
- name: Setup haproxy
|
||||
hosts: vps_servers
|
||||
become: true
|
||||
tasks:
|
||||
- name: Install haproxy
|
||||
ansible.builtin.apt:
|
||||
name: haproxy
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Create haproxy certs directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/haproxy/certs/
|
||||
state: directory
|
||||
owner: root
|
||||
group: haproxy
|
||||
mode: '0755'
|
||||
|
||||
- name: Copy server certificate and key
|
||||
ansible.builtin.copy:
|
||||
src: 'haproxy/64.188.58.223.pem'
|
||||
dest: '/etc/haproxy/certs/64.188.58.223.pem'
|
||||
owner: root
|
||||
group: haproxy
|
||||
mode: '0640'
|
||||
|
||||
- name: Copy configuration
|
||||
ansible.builtin.copy:
|
||||
src: 'haproxy/haproxy.cfg'
|
||||
dest: '/etc/haproxy/haproxy.cfg'
|
||||
owner: root
|
||||
group: haproxy
|
||||
mode: '0644'
|
||||
notify: Restart haproxy
|
||||
|
||||
- name: Allow ufw jenkins webhook port
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: '7777'
|
||||
proto: tcp
|
||||
|
||||
handlers:
|
||||
- name: Restart haproxy
|
||||
ansible.builtin.systemd:
|
||||
name: haproxy
|
||||
state: restarted
|
||||
enabled: true
|
||||
|
||||
- name: Setup tiny proxy
|
||||
hosts: vps_servers
|
||||
become: true
|
||||
tasks:
|
||||
- name: Install tiny proxy
|
||||
ansible.builtin.apt:
|
||||
name: tinyproxy
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Configure tiny proxy
|
||||
ansible.builtin.copy:
|
||||
src: 'tinyproxy/tinyproxy.conf'
|
||||
dest: '/etc/tinyproxy/tinyproxy.conf'
|
||||
mode: '0644'
|
||||
notify: Restart tinyproxy
|
||||
|
||||
handlers:
|
||||
- name: Restart tinyproxy
|
||||
ansible.builtin.systemd:
|
||||
name: tinyproxy
|
||||
state: restarted
|
||||
enabled: true
|
||||
Reference in new issue
Block a user