504 lines
12 KiB
YAML
504 lines
12 KiB
YAML
- name: Setup ufw port forwarding for VPNs subnets
|
|
hosts: vps_servers
|
|
become: true
|
|
gather_facts: true
|
|
tasks:
|
|
- name: Install ufw
|
|
ansible.builtin.apt:
|
|
name: ufw
|
|
state: present
|
|
update_cache: true
|
|
|
|
# - name: Configure ufw port forwarding
|
|
# ansible.builtin.lineinfile:
|
|
# path: '/etc/sysctl.conf'
|
|
# regexp: '^#?net.ipv4.ip_forward='
|
|
# line: 'net.ipv4.ip_forward=1'
|
|
# state: present
|
|
# notify: Reload sysctl
|
|
|
|
- name: Configure ufw port forwarding
|
|
ansible.builtin.copy:
|
|
src: 'sysctl/99-ipv4-forward.conf'
|
|
dest: '/etc/sysctl.d/99-ipv4-forward.conf'
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: Reload sysctl
|
|
|
|
- name: Set ufw default forwarding policy
|
|
ansible.builtin.lineinfile:
|
|
path: '/etc/default/ufw'
|
|
regexp: '^DEFAULT_FORWARD_POLICY='
|
|
line: 'DEFAULT_FORWARD_POLICY="ACCEPT"'
|
|
state: present
|
|
notify: Reload ufw
|
|
|
|
- name: Add postrouting nat
|
|
ansible.builtin.blockinfile:
|
|
path: '/etc/ufw/before.rules'
|
|
insertbefore: '^\*filter'
|
|
block: |
|
|
# VPN NAT
|
|
*nat
|
|
:POSTROUTING ACCEPT [0:0]
|
|
-A POSTROUTING -s 10.9.0.0/24 -o {{ public_ip_iface }} -j MASQUERADE
|
|
-A POSTROUTING -s 10.8.0.0/24 -o {{ public_ip_iface }} -j MASQUERADE
|
|
-A POSTROUTING -s 10.10.0.0/24 -o {{ public_ip_iface }} -j MASQUERADE
|
|
COMMIT
|
|
# END VPN NAT
|
|
notify: Reload ufw
|
|
|
|
handlers:
|
|
- name: Reload sysctl
|
|
ansible.builtin.command: sysctl -p /etc/sysctl.d/99-ipv4-forward.conf
|
|
register: result
|
|
changed_when: result.rc == 0
|
|
|
|
- name: Reload ufw
|
|
ansible.builtin.command: ufw reload
|
|
register: result
|
|
changed_when: result.rc == 0
|
|
|
|
- name: Setup strongswan
|
|
hosts: vps_servers
|
|
become: true
|
|
gather_facts: true
|
|
tasks:
|
|
- name: Uninstall strongswan legacy packages if present
|
|
ansible.builtin.apt:
|
|
name:
|
|
- strongswan-starter
|
|
- strongswan-charon
|
|
state: absent
|
|
purge: true
|
|
autoremove: true
|
|
|
|
- name: Install strongswan with swanctl and vici
|
|
ansible.builtin.apt:
|
|
name:
|
|
- charon-systemd
|
|
- strongswan-swanctl
|
|
- libcharon-extra-plugins
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Copy strongswan config
|
|
ansible.builtin.template:
|
|
src: 'strongswan/ra-tech.conf.j2'
|
|
dest: '/etc/swanctl/conf.d/ra-tech.conf'
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Copy strongswan dhcp module config
|
|
ansible.builtin.template:
|
|
src: 'strongswan/charon/dhcp.conf.j2'
|
|
dest: '/etc/strongswan.d/charon/dhcp.conf'
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Copy Root CA
|
|
ansible.builtin.copy:
|
|
src: 'strongswan/ca.pem'
|
|
dest: '/etc/swanctl/x509ca/ca-crt.pem'
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Copy keys
|
|
ansible.builtin.copy:
|
|
src: 'strongswan/keys/'
|
|
dest: '/etc/swanctl/rsa/'
|
|
owner: root
|
|
group: root
|
|
mode: '0640'
|
|
|
|
- name: Copy certificates
|
|
ansible.builtin.copy:
|
|
src: 'strongswan/certs/'
|
|
dest: '/etc/swanctl/x509/'
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify:
|
|
- Restart strongswan service
|
|
|
|
- name: Configure ra0 iface
|
|
ansible.builtin.script: 'strongswan/iface-ra0-up.sh'
|
|
|
|
- name: Copy ra0 iface setup script
|
|
ansible.builtin.copy:
|
|
src: 'strongswan/iface-ra0-up.sh'
|
|
dest: '/usr/local/bin'
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Copy ra0 startup service
|
|
ansible.builtin.copy:
|
|
src: 'strongswan/iface-ra0.service'
|
|
dest: '/etc/systemd/system/iface-ra0.service'
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify:
|
|
- Reload ra0 startup service
|
|
|
|
- name: Ufw allow strongswan ports
|
|
community.general.ufw:
|
|
rule: allow
|
|
proto: udp
|
|
port: '{{ item }}'
|
|
loop:
|
|
- '500'
|
|
- '4500'
|
|
|
|
- name: Ufw allow from vpn subnet
|
|
community.general.ufw:
|
|
rule: allow
|
|
proto: any
|
|
src: '10.9.0.0/24'
|
|
|
|
handlers:
|
|
- name: Restart strongswan service
|
|
ansible.builtin.systemd:
|
|
name: strongswan
|
|
state: restarted
|
|
enabled: true
|
|
|
|
- name: Reload ra0 startup service
|
|
ansible.builtin.systemd:
|
|
name: iface-ra0.service
|
|
enabled: true
|
|
daemon_reload: true
|
|
|
|
- name: Setup cloak
|
|
hosts: vps_servers
|
|
become: true
|
|
tasks:
|
|
- name: Create go download directory
|
|
ansible.builtin.file:
|
|
path: /opt/go
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Download go
|
|
ansible.builtin.get_url:
|
|
url: 'https://go.dev/dl/go1.26.0.linux-amd64.tar.gz'
|
|
dest: '/opt/go/go1.26.0.linux-amd64.tar.gz'
|
|
mode: '0644'
|
|
timeout: 60
|
|
|
|
- name: Unpack go
|
|
ansible.builtin.unarchive:
|
|
src: '/opt/go/go1.26.0.linux-amd64.tar.gz'
|
|
dest: '/usr/local'
|
|
remote_src: true
|
|
|
|
- name: Install git and make
|
|
ansible.builtin.apt:
|
|
name:
|
|
- git
|
|
- make
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Clone cloak git repository
|
|
ansible.builtin.git:
|
|
repo: 'https://github.com/cbeuw/Cloak.git'
|
|
dest: '/opt/git/Cloak'
|
|
single_branch: true
|
|
version: master
|
|
|
|
- name: Build cloak
|
|
community.general.make:
|
|
chdir: '/opt/git/Cloak'
|
|
environment:
|
|
PATH: '{{ ansible_env.PATH }}:/usr/local/go/bin'
|
|
|
|
- name: Setup cloak server
|
|
ansible.builtin.copy:
|
|
src: '/opt/git/Cloak/build/ck-server'
|
|
remote_src: true
|
|
dest: '/usr/local/bin'
|
|
owner: 'root'
|
|
group: 'root'
|
|
mode: '0755'
|
|
|
|
- name: Add cloak group
|
|
ansible.builtin.group:
|
|
name: cloak
|
|
state: present
|
|
|
|
- name: Add user for cloak
|
|
ansible.builtin.user:
|
|
name: cloak
|
|
group: cloak
|
|
state: present
|
|
createhome: false
|
|
|
|
- name: Create cloak directory
|
|
ansible.builtin.file:
|
|
path: '/etc/cloak'
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Setup cloak server configuration
|
|
ansible.builtin.template:
|
|
src: 'cloak/server.json.j2'
|
|
dest: '/etc/cloak/server.json'
|
|
owner: root
|
|
group: cloak
|
|
mode: '0644'
|
|
|
|
- name: Create cloak server data dir
|
|
ansible.builtin.file:
|
|
path: '/opt/cloak'
|
|
state: directory
|
|
owner: cloak
|
|
group: cloak
|
|
mode: '0755'
|
|
|
|
- name: Setup cloak systemd service
|
|
ansible.builtin.copy:
|
|
src: 'cloak/cloak.service'
|
|
dest: '/etc/systemd/system/cloak.service'
|
|
mode: '0644'
|
|
notify: Reload cloak service
|
|
|
|
- name: Ufw allow cloak port
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: '5691'
|
|
proto: tcp
|
|
|
|
handlers:
|
|
- name: Reload cloak service
|
|
ansible.builtin.systemd:
|
|
name: cloak.service
|
|
state: started
|
|
enabled: false
|
|
daemon_reload: true
|
|
|
|
- name: Setup openvpn server
|
|
hosts: vps_servers
|
|
become: true
|
|
tasks:
|
|
- name: Install openvpn server
|
|
ansible.builtin.apt:
|
|
name: openvpn
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Copy certificates
|
|
ansible.builtin.copy:
|
|
src: 'openvpn/certs/'
|
|
dest: '/etc/openvpn/server/'
|
|
owner: root
|
|
group: root
|
|
mode: '0640'
|
|
|
|
- name: Copy openvpn config
|
|
ansible.builtin.copy:
|
|
src: 'openvpn/server.conf'
|
|
dest: '/etc/openvpn/server/server.conf'
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify:
|
|
- Restart openvpn server
|
|
|
|
- name: Ufw allow openvpn port
|
|
community.general.ufw:
|
|
rule: allow
|
|
proto: tcp
|
|
port: '5690'
|
|
|
|
- name: Ufw allow from vpn subnet
|
|
community.general.ufw:
|
|
rule: allow
|
|
proto: any
|
|
src: '10.8.0.0/24'
|
|
|
|
handlers:
|
|
- name: Restart openvpn server
|
|
ansible.builtin.systemd:
|
|
name: openvpn-server@server
|
|
state: restarted
|
|
enabled: true
|
|
|
|
- name: Setup bind9
|
|
hosts: vps_servers
|
|
become: true
|
|
tasks:
|
|
- name: Install bind9
|
|
ansible.builtin.apt:
|
|
name: bind9
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Copy bind9 config
|
|
ansible.builtin.copy:
|
|
src: '{{ item }}'
|
|
dest: '/etc/bind/'
|
|
owner: root
|
|
group: bind
|
|
mode: '0644'
|
|
loop:
|
|
- 'bind9/named.conf.local'
|
|
- 'bind9/named.conf.options'
|
|
- 'bind9/named.conf.default-zones'
|
|
- 'bind9/named.conf.root-hints'
|
|
|
|
- name: Copy bind9 zones
|
|
ansible.builtin.copy:
|
|
src: 'bind9/zones/'
|
|
dest: '/etc/bind/zones/'
|
|
owner: root
|
|
group: bind
|
|
mode: '0644'
|
|
notify:
|
|
- Restart bind9
|
|
|
|
- name: Ufw allow bind9 ports
|
|
community.general.ufw:
|
|
rule: allow
|
|
name: Bind9
|
|
|
|
handlers:
|
|
- name: Restart bind9
|
|
ansible.builtin.systemd:
|
|
name: named
|
|
state: restarted
|
|
enabled: true
|
|
daemon_reload: true
|
|
|
|
- name: Setup prometheus node exporter
|
|
hosts: vps_servers
|
|
become: true
|
|
tasks:
|
|
- name: Create node-exporter download directory
|
|
ansible.builtin.file:
|
|
path: /opt/node-exporter
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Download node exporter executable
|
|
ansible.builtin.get_url:
|
|
url: 'https://github.com/prometheus/node_exporter/releases/download/v1.10.2/node_exporter-1.10.2.linux-amd64.tar.gz'
|
|
dest: '/opt/node-exporter/node_exporter-1.10.2.linux-amd64.tar.gz'
|
|
mode: '0644'
|
|
|
|
- name: Extract node_exporter
|
|
ansible.builtin.unarchive:
|
|
src: '/opt/node-exporter/node_exporter-1.10.2.linux-amd64.tar.gz'
|
|
dest: '/usr/local/bin'
|
|
remote_src: true
|
|
include:
|
|
- 'node_exporter-1.10.2.linux-amd64/node_exporter'
|
|
extra_opts:
|
|
- '--strip-components=1'
|
|
|
|
- name: Add node-exporter group
|
|
ansible.builtin.group:
|
|
name: node_exporter
|
|
state: present
|
|
|
|
- name: Add user for node exporter
|
|
ansible.builtin.user:
|
|
name: node_exporter
|
|
group: node_exporter
|
|
state: present
|
|
createhome: false
|
|
|
|
- name: Setup node-exporter service
|
|
ansible.builtin.copy:
|
|
src: 'node-exporter/node-exporter.service'
|
|
dest: '/etc/systemd/system/node-exporter.service'
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: Reload node-exporter
|
|
|
|
handlers:
|
|
- name: Reload node-exporter
|
|
ansible.builtin.systemd:
|
|
name: node-exporter
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|
|
|
|
- name: Setup haproxy
|
|
hosts: vps_servers
|
|
become: true
|
|
tasks:
|
|
- name: Install haproxy
|
|
ansible.builtin.apt:
|
|
name: haproxy
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Create haproxy certs directory
|
|
ansible.builtin.file:
|
|
path: /etc/haproxy/certs/
|
|
state: directory
|
|
owner: root
|
|
group: haproxy
|
|
mode: '0755'
|
|
|
|
- name: Copy server certificate and key
|
|
ansible.builtin.copy:
|
|
src: 'haproxy/64.188.58.223.pem'
|
|
dest: '/etc/haproxy/certs/64.188.58.223.pem'
|
|
owner: root
|
|
group: haproxy
|
|
mode: '0640'
|
|
|
|
- name: Copy configuration
|
|
ansible.builtin.copy:
|
|
src: 'haproxy/haproxy.cfg'
|
|
dest: '/etc/haproxy/haproxy.cfg'
|
|
owner: root
|
|
group: haproxy
|
|
mode: '0644'
|
|
notify: Restart haproxy
|
|
|
|
- name: Allow ufw jenkins webhook port
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: '7777'
|
|
proto: tcp
|
|
|
|
handlers:
|
|
- name: Restart haproxy
|
|
ansible.builtin.systemd:
|
|
name: haproxy
|
|
state: restarted
|
|
enabled: true
|
|
|
|
- name: Setup tiny proxy
|
|
hosts: vps_servers
|
|
become: true
|
|
tasks:
|
|
- name: Install tiny proxy
|
|
ansible.builtin.apt:
|
|
name: tinyproxy
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Configure tiny proxy
|
|
ansible.builtin.copy:
|
|
src: 'tinyproxy/tinyproxy.conf'
|
|
dest: '/etc/tinyproxy/tinyproxy.conf'
|
|
mode: '0644'
|
|
notify: Restart tinyproxy
|
|
|
|
handlers:
|
|
- name: Restart tinyproxy
|
|
ansible.builtin.systemd:
|
|
name: tinyproxy
|
|
state: restarted
|
|
enabled: true
|