first commit

ansible/LICENSE

@@ -0,0 +1,5 @@
+Author: Petar Cubela
+Company: Softbox GmbH
+Date: 2024-12-04
+
+Bla bla legal advise bla bla trademark, intellectual property and such bla bla

ansible/README.md

@@ -0,0 +1,3 @@
+# Buero Templates for used software deployments
+
+In this repository I collect all ansible playbooks used during my work.

ansible/TODO.md

@@ -0,0 +1,13 @@
+## todo
+
+### Modifications
+
+- [ ] Build ansible-role-lamp
+- [ ] Build seperate ansible-role-owncloud depending on ansible-role-lamp
+- [ ] Build seperate ansible-role-nextcloud depending on ansible-role-lamp
+
+## LAMP Stack
+
+- [ ] Build with option to choose between apache and nginx
+- [ ] Build with option to choose different databases
+- [ ] Build with option to choose different php versions

ansible/ansible.cfg

@@ -0,0 +1,8 @@
+[defaults]
+nocows = 1
+host_key_checking = false
+inventory = ./hosts.ini 
+ansible_python_interpreter  = /usr/bin/python3
+
+[ssh_connections]
+pipelining = true

ansible/group_vars/all.yml

@@ -0,0 +1,64 @@
+---
+# generic settings
+main_username: sbxadmin
+main_groupname: "{{ main_username }}"
+main_uid: "1000"
+main_gid: "{{ main_uid }}"
+
+# weareinteractive.environment
+environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
+
+global_env_vars:
+  - "PUID={{ main_uid }}"
+  - "PGID={{ main_gid }}"
+  - "TZ={{ ntp_timezone }}"
+
+# geerlingguy.ntp
+ntp_timezone: "Europe/Berlin"
+
+# geerlingguy.nfs
+#nfs_exports: [ "/home/public    *(rw,sync,no_root_squash)" ]
+
+# geerlingguy.security
+security_ssh_port: 22
+security_ssh_password_authentication: "yes"
+security_ssh_permit_root_login: "no"
+security_ssh_usedns: "no"
+security_ssh_permit_empty_password: "no"
+security_ssh_challenge_response_auth: "no"
+security_ssh_gss_api_authentication: "no"
+security_ssh_x11_forwarding: "no"
+security_ssh_allowed_users:
+  - "{{ main_username }}"
+security_ssh_allowed_groups: []
+security_sudoers_passwordless:
+  - "{{ main_username }}"
+security_autoupdate_enabled: false
+security_autoupdate_blacklist: []
+security_autoupdate_reboot: false
+security_autoupdate_reboot_time: "03:00"
+security_autoupdate_mail_to: "service@softbox.de"
+security_autoupdate_mail_on_error: false
+security_fail2ban_enabled: true
+security_fail2ban_custom_configuration_template: "jail.local.j2"
+###
+#packages
+package_list:
+  - bash-completion
+  - htop
+  - apt-transport-https
+  - network-manager
+  - vim
+  - curl
+  - xclip
+  - net-tools
+  - rsync
+  - smartmontools
+  - parted
+  - mlocate
+  - cpp
+  - gcc
+  - make
+  - psmisc
+  #- linux-headers-$(uname -r)
+  - open-vm-tools

ansible/group_vars/nextcloud.yml

@@ -0,0 +1,4 @@
+hostname: cloud
+#.phytron.de
+php_version: 8.2
+domain_base: "phytron.de"

ansible/group_vars/sftp.yml

@@ -0,0 +1,43 @@
+---
+# generic settings
+main_username: sbxadmin
+main_groupname: "{{ main_username }}"
+main_uid: "1000"
+main_gid: "{{ main_uid }}"
+
+# weareinteractive.environment
+environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
+
+global_env_vars:
+  - "PUID={{ main_uid }}"
+  - "PGID={{ main_gid }}"
+  - "TZ={{ ntp_timezone }}"
+
+# geerlingguy.ntp
+ntp_timezone: "Europe/Berlin"
+
+# geerlingguy.nfs
+#nfs_exports: [ "/home/public    *(rw,sync,no_root_squash)" ]
+
+# geerlingguy.security
+security_ssh_port: 22
+security_ssh_password_authentication: "no"
+security_ssh_permit_root_login: "no"
+security_ssh_usedns: "no"
+security_ssh_permit_empty_password: "no"
+security_ssh_challenge_response_auth: "no"
+security_ssh_gss_api_authentication: "no"
+security_ssh_x11_forwarding: "no"
+security_ssh_allowed_users:
+  - "{{ main_username }}"
+security_ssh_allowed_groups: []
+security_sudoers_passwordless:
+  - "{{ main_username }}"
+security_autoupdate_enabled: true
+security_autoupdate_blacklist: []
+security_autoupdate_reboot: reboot
+security_autoupdate_reboot_time: "03:00"
+security_autoupdate_mail_to: "service@softbox.de"
+security_autoupdate_mail_on_error: true
+security_fail2ban_enabled: true
+security_fail2ban_custom_configuration_template: "jail.local.j2"

ansible/hosts.ini

@@ -0,0 +1,9 @@
+#[snipeit]
+#10.0.101.15 ansible_user=root ansible_port=22
+#
+
+[nextcloud]
+192.168.66.66 ansible_user=sbxadmin ansible_port=22
+
+[sftp]
+192.168.66.68 ansible_user=sbxadmin ansible_port=22

ansible/justfile

@@ -0,0 +1,18 @@
+#!/usr/bin/env -S just --justfile
+
+# Ansible playbook against specific host
+run HOST *TAGS:
+  ansible-playbook -b run.yml --limit {{HOST}}  {{TAGS}}
+
+# docker compose against remote host via Ansible
+compose HOST *V:
+  ansible-playbook run.yml --limit {{HOST}} --tags compose {{V}}
+
+
+# optionally use --force to force reinstall all requirements
+reqs *FORCE:
+	ansible-galaxy install -r requirements.yml {{FORCE}}
+
+# just vault (encrypt/decrypt/edit)
+vault ACTION:
+    EDITOR=nvim ansible-vault {{ACTION}} group_vars/secrets.yml

ansible/playbooks/shutdown.yml

@@ -0,0 +1,9 @@
+---
+- name: Shutdown k3s_cluster
+  hosts: k3s_cluster
+  gather_facts: true
+  tasks:
+    - name: Shutdown the nodes (and wait one 1 min)
+      become: true
+      community.general.shutdown:
+        delay: 60

ansible/playbooks/update.yml

@@ -0,0 +1,29 @@
+---
+- hosts:
+    - all
+  become: true
+
+  tasks:
+    - name: Perform a dist-upgrade.
+      ansible.builtin.apt:
+        upgrade: dist
+        update_cache: yes
+
+    - name: Install essential packages
+      package:
+        name: "{{ package_list }}"
+        state: present
+
+    - name: Check if a reboot is required.
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+        get_checksum: no
+      register: reboot_required_file
+
+    - name: Reboot the server (if required).
+      ansible.builtin.reboot:
+      when: reboot_required_file.stat.exists == true
+
+    - name: Remove dependencies that are no longer required.
+      ansible.builtin.apt:
+        autoremove: yes

ansible/requirements.yml

@@ -0,0 +1,8 @@
+---
+roles:
+  #- name: geerlingguy.pip
+  - name: geerlingguy.docker
+  - name: geerlingguy.nfs
+  - name: geerlingguy.security
+  - name: geerlingguy.ntp
+  - name: ironicbadger.docker_compose_generator

ansible/roles/nextcloud/defaults/main.yml

@@ -0,0 +1,5 @@
+site_conf: cloud.conf
+php_version: "8.4"
+mysql_db_name: nextcloud
+mysql_db_user: nextcloud
+web_root: "/var/www/nextcloud"

ansible/roles/nextcloud/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart apache
+  service:
+    name: apache2
+    state: restarted

ansible/roles/nextcloud/tasks/apache.yml

@@ -0,0 +1,35 @@
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ hostname }}"
+
+- name: "Enable recommended Apache Modules."
+  apache2_module: "name={{ item }} state=present"
+  with_items:
+    - dir
+    - env
+    - headers
+    - mime
+    - rewrite
+    - setenvif
+  notify: restart apache
+
+- name: Add Apache virtualhost for Nextcloud
+  template:
+    src: "templates/{{ site_conf }}.j2"
+    dest: "/etc/apache2/sites-available/{{ site_conf }}"
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart apache
+
+- name: Enable the Nextcloud site.
+  command: >
+    a2ensite {{ site_conf }}
+    creates="/etc/apache2/sites-enabled/{{ site_conf }}"
+  notify: restart apache
+
+- name: Disable the default site.
+  command: >
+    a2dissite 000-default 
+    removes=/etc/apache2/sites-enabled/000-default.conf
+  notify: restart apache

ansible/roles/nextcloud/tasks/dependencies.yml

@@ -0,0 +1,72 @@
+---
+- name: Get software for apt repository management.
+  apt:
+    state: present
+    name:
+      - python3-apt
+      - python3-pycurl
+      - python3-pymysql
+      - gnupg2
+
+#- name: Add ondrej repository for later versions of PHP.
+#  apt_repository:
+#    repo: "ppa:ondrej/php"
+#    update_cache: yes
+
+#sudo dpkg -l | grep php | tee packages.txt
+#sudo apt install apt-transport-https lsb-release ca-certificates wget -y
+#sudo wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
+#sudo sh -c 'echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
+#sudo apt update
+
+- name: "Install Apache, MySQL, PHP, and other dependencies."
+  apt:
+    state: present
+    name:
+      - acl
+      - git
+      - curl
+      - wget
+      - unzip
+      - openssl
+      - redis-server
+      - mariadb-server
+      - libpcre3-dev
+      - apache2
+      - "libapache2-mod-php"
+      - "php{{ php_version }}"
+      - "php{{ php_version }}-imagick"
+      - "php{{ php_version }}-common"
+      - "php{{ php_version }}-curl"
+      - "php{{ php_version }}-gd"
+      - "php{{ php_version }}-imap"
+      - "php{{ php_version }}-intl"
+      #- "php{{ php_version }}-json"
+      - "php{{ php_version }}-mbstring"
+      - "php{{ php_version }}-gmp"
+      - "php{{ php_version }}-bcmath"
+      - "php{{ php_version }}-mysql"
+      - "php{{ php_version }}-ssh2"
+      - "php{{ php_version }}-xml"
+      - "php{{ php_version }}-zip"
+      - "php{{ php_version }}-apcu"
+      - "php{{ php_version }}-redis"
+      - "php{{ php_version }}-ldap"
+      #- "php{{ php_version }}-smbclient"
+      - php-phpseclib
+      - bzip2
+      - rsync
+      - jq
+      - inetutils-ping
+      - ldap-utils
+      - smbclient
+      - cron
+
+#- name: Disable the firewall (since this is behind a firewall)
+#  service: name=ufw state=stopped
+
+- name: "Start Apache, MySQL, and PHP."
+  service: "name={{ item }} state=started enabled=yes"
+  with_items:
+    - apache2
+    - mysql

ansible/roles/nextcloud/tasks/main.yml

@@ -0,0 +1,24 @@
+---
+- name: Install LAMP stack dependencies
+  include_tasks:
+    file: dependencies.yml
+
+- name: Configure Apache.
+  include_tasks:
+    file: apache.yml
+
+- name: Configure PHP.
+  include_tasks:
+    file: php.yml
+
+- name: Configure MySQL.
+  include_tasks:
+    file: mysql.yml
+
+- name: Create occ helper script.
+  include_tasks:
+    file: occ.yml
+
+- name: Download Nextcloud.
+  include_tasks:
+    file: nextcloud.yml

ansible/roles/nextcloud/tasks/mysql.yml

@@ -0,0 +1,16 @@
+- name: Create a MySQL database.
+  community.mysql.mysql_db:
+    name: "{{ mysql_db_name }}"
+    state: present
+    login_unix_socket: /run/mysqld/mysqld.sock
+
+- name: Create a MySQL db user.
+  community.mysql.mysql_user:
+    name: "{{ mysql_db_user }}"
+    password: "{{ mysql_passwd }}"
+    login_user: "root"
+    login_password: "{{ mysql_passwd }}"
+    priv: "{{ mysql_db_user }}.*:ALL"
+    host: localhost
+    state: present
+    login_unix_socket: /run/mysqld/mysqld.sock

ansible/roles/nextcloud/tasks/nextcloud.yml

@@ -0,0 +1,13 @@
+---
+- name: Download Nextcloud source.
+  ansible.builtin.get_url:
+    url: https://download.nextcloud.com/server/releases/latest.tar.bz2
+    dest: "/tmp/nextcloud-complete-latest.tar.bz2"
+    owner: www-data
+
+- name: Extract the archive.
+  ansible.builtin.unarchive:
+    src: "/tmp/nextcloud-complete-latest.tar.bz2"
+    dest: "/var/www/"
+    owner: www-data
+    remote_src: yes

ansible/roles/nextcloud/tasks/occ.yml

@@ -0,0 +1,7 @@
+- name: Create a helper script for running occ commands.
+  template:
+    src: "templates/occ.j2"
+    dest: "/usr/local/bin/occ"
+    owner: root
+    group: root
+    mode: 0755

ansible/roles/nextcloud/tasks/php.yml

@@ -0,0 +1,16 @@
+---
+- name: Adjust OpCache memory setting.
+  lineinfile:
+    dest: "/etc/php/{{ php_version }}/apache2/conf.d/10-opcache.ini"
+    regexp: "^opcache.memory_consumption"
+    line: "opcache.memory_consumption = 96"
+    state: present
+  notify: restart apache
+
+#- name: Adjust smbclient setting.
+#  template:
+#    src: "templates/smbclient.ini.j2"
+#    dest: "/etc/php/7.4/mods-available/smbclient.ini"
+#    owner: root
+#    group: root
+#  notify: restart apache

ansible/roles/nextcloud/templates/cloud.conf.j2

@@ -0,0 +1,17 @@
+<VirtualHost *:80>
+ServerName {{ hostname }}.{{ domain_base }}
+DirectoryIndex index.php index.html
+DocumentRoot {{ web_root }}
+<Directory {{ web_root }}>
+  Options FollowSymLinks MultiViews
+  AllowOverride All
+  Require all granted
+
+ <IfModule mod_dav.c>
+  Dav off
+ </IfModule>
+
+ #SetEnv HOME {{ web_root }}
+ #SetEnv HTTP_HOME {{ web_root }}
+</Directory>
+</VirtualHost>

ansible/roles/nextcloud/templates/occ.j2

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+cd /var/www/nextcloud || exit
+sudo -E -u www-data /usr/bin/php /var/www/nextcloud/occ "$@"

ansible/run.yml

@@ -0,0 +1,52 @@
+---
+#- hosts: owncloud
+#  become: yes
+#  vars_files:
+#    - "vars/vault.yml"
+#
+#  pre_tasks:
+#    - name: Update apt cache.
+#      apt:
+#        update_cache: true
+#        cache_valid_time: 3600
+#      when: ansible_os_family == 'Debian'
+#
+#  roles:
+#    - role: geerlingguy.security
+#    #- role: geerlingguy.ntp ## NEEDED?
+#    - role: owncloud
+
+- hosts: nextcloud
+  become: yes
+  vars_files:
+    - "vars/vault.yml"
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt:
+        update_cache: true
+        cache_valid_time: 3600
+      when: ansible_os_family == 'Debian'
+
+  roles:
+    #    - role: geerlingguy.security
+    - role: nextcloud
+    - role: smtp_nextcloud
+      tags: mail
+
+
+- hosts: sftp
+  become: yes
+  vars_files:
+    - "vars/vault.yml"
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt:
+        update_cache: true
+        cache_valid_time: 3600
+      when: ansible_os_family == 'Debian'
+
+  roles:
+    - role: geerlingguy.security
+      tags: base

ansible/vars/vault.yml

@@ -0,0 +1,14 @@
+$ANSIBLE_VAULT;1.1;AES256
+31353435633062366461353231666566366662373733656337356339626234313966366139613161
+3533646266393033316330323737303638303162356161610a393337313837653835396162633030
+30313066326337393831643833663237643966383163363866386133373264373933633133653462
+6636376563336433640a356231363764363834626431616435633436306662313932313164623733
+62383062653166613661303939346135643661646630386532306161393365393133626164303337
+31623962623931353365346365623333386638313266356131326565613730303338643863396237
+39353261616339356563393236633232646361326234333533643338656331623732636432383434
+63653963336333366462366562633631336636643935646632323031666366633136383732643733
+63366433363136666131386434333431333062363238633064646336626463623730616238646136
+31333839623538306161393862306231656466613231326165666562616432363136396332646533
+30663130336438623463336333343830656138316236353963373833386434393337356262313934
+63323030323837373066323337363633636236353931643636643337393161303965613438363638
+3532