Clean up inventory, group_vars, and prefill READMEs
- hosts.ini: underscore group names, hostname aliases with ansible_host - move ansible_user/ansible_port to group_vars/all.yml - rename group_vars files to match underscore group names - trim sftp group_vars to its only override (password auth off) - run.yml: load moved secrets file (group_vars/secrets.yml) - untrack .DS_Store, extend .gitignore - prefill root/ansible/server READMEs, add jira + cloud server folders - update CLAUDE.md to match Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Claude Fable 5
Vendored
BIN
Binary file not shown.
+19
-2
@@ -1,3 +1,20 @@
|
||||
# Buero Templates for used software deployments
|
||||
# Ansible
|
||||
|
||||
In this repository I collect all ansible playbooks used during my work.
|
||||
Global configuration for all Phytron servers. Run everything from this directory, preferably via `just`.
|
||||
|
||||
## Layout
|
||||
|
||||
- `hosts.ini` — inventory; one group per host (`phy_z_*`), host aliases match the real hostnames
|
||||
- `group_vars/all.yml` — defaults for all hosts; `group_vars/<group>.yml` holds per-host overrides only
|
||||
- `group_vars/secrets.yml` — ansible-vault encrypted secrets
|
||||
- `run.yml` — main playbook; `playbooks/` — utilities (update, shutdown)
|
||||
- `roles/` — custom roles; external roles come from `requirements.yml`
|
||||
|
||||
## Usage
|
||||
|
||||
```sh
|
||||
just reqs # install Galaxy role requirements
|
||||
just run <HOST> [ARGS] # run run.yml against one host, e.g. just run phy_z_srv_cloud
|
||||
just compose <HOST> # docker compose tasks only (--tags compose)
|
||||
just vault edit # edit encrypted secrets (encrypt/decrypt/edit)
|
||||
```
|
||||
|
||||
@@ -1,4 +1,8 @@
|
||||
---
|
||||
# connection settings (identical for all hosts)
|
||||
ansible_user: sbxadmin
|
||||
ansible_port: 22
|
||||
|
||||
# generic settings
|
||||
main_username: sbxadmin
|
||||
main_groupname: "{{ main_username }}"
|
||||
|
||||
@@ -1,43 +0,0 @@
|
||||
---
|
||||
# generic settings
|
||||
main_username: sbxadmin
|
||||
main_groupname: "{{ main_username }}"
|
||||
main_uid: "1000"
|
||||
main_gid: "{{ main_uid }}"
|
||||
|
||||
# weareinteractive.environment
|
||||
environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
|
||||
|
||||
global_env_vars:
|
||||
- "PUID={{ main_uid }}"
|
||||
- "PGID={{ main_gid }}"
|
||||
- "TZ={{ ntp_timezone }}"
|
||||
|
||||
# geerlingguy.ntp
|
||||
ntp_timezone: "Europe/Berlin"
|
||||
|
||||
# geerlingguy.nfs
|
||||
#nfs_exports: [ "/home/public *(rw,sync,no_root_squash)" ]
|
||||
|
||||
# geerlingguy.security
|
||||
security_ssh_port: 22
|
||||
security_ssh_password_authentication: "yes"
|
||||
security_ssh_permit_root_login: "no"
|
||||
security_ssh_usedns: "no"
|
||||
security_ssh_permit_empty_password: "no"
|
||||
security_ssh_challenge_response_auth: "no"
|
||||
security_ssh_gss_api_authentication: "no"
|
||||
security_ssh_x11_forwarding: "no"
|
||||
security_ssh_allowed_users:
|
||||
- "{{ main_username }}"
|
||||
security_ssh_allowed_groups: []
|
||||
security_sudoers_passwordless:
|
||||
- "{{ main_username }}"
|
||||
security_autoupdate_enabled: true
|
||||
security_autoupdate_blacklist: []
|
||||
security_autoupdate_reboot: reboot
|
||||
security_autoupdate_reboot_time: "03:00"
|
||||
security_autoupdate_mail_to: "service@softbox.de"
|
||||
security_autoupdate_mail_on_error: true
|
||||
security_fail2ban_enabled: true
|
||||
security_fail2ban_custom_configuration_template: "jail.local.j2"
|
||||
@@ -1,47 +0,0 @@
|
||||
# generic settings
|
||||
main_username: sbxadmin
|
||||
main_groupname: "{{ main_username }}"
|
||||
main_uid: "1000"
|
||||
main_gid: "{{ main_uid }}"
|
||||
|
||||
# weareinteractive.environment
|
||||
environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
|
||||
|
||||
global_env_vars:
|
||||
- "PUID={{ main_uid }}"
|
||||
- "PGID={{ main_gid }}"
|
||||
- "TZ={{ ntp_timezone }}"
|
||||
|
||||
# geerlingguy.ntp
|
||||
ntp_timezone: "Europe/Berlin"
|
||||
|
||||
# geerlingguy.nfs
|
||||
#nfs_exports: [ "/home/public *(rw,sync,no_root_squash)" ]
|
||||
|
||||
# geerlingguy.security
|
||||
security_ssh_port: 22
|
||||
security_ssh_password_authentication: "yes"
|
||||
security_ssh_permit_root_login: "no"
|
||||
security_ssh_usedns: "no"
|
||||
security_ssh_permit_empty_password: "no"
|
||||
security_ssh_challenge_response_auth: "no"
|
||||
security_ssh_gss_api_authentication: "no"
|
||||
security_ssh_x11_forwarding: "no"
|
||||
security_ssh_allowed_users:
|
||||
- "{{ main_username }}"
|
||||
security_ssh_allowed_groups: []
|
||||
security_sudoers_passwordless:
|
||||
- "{{ main_username }}"
|
||||
security_autoupdate_enabled: true
|
||||
security_autoupdate_blacklist: []
|
||||
security_autoupdate_reboot: reboot
|
||||
security_autoupdate_reboot_time: "03:00"
|
||||
security_autoupdate_mail_to: "service@softbox.de"
|
||||
security_autoupdate_mail_on_error: true
|
||||
security_fail2ban_enabled: true
|
||||
security_fail2ban_custom_configuration_template: "jail.local.j2"
|
||||
|
||||
#cloud.phytron.de
|
||||
hostname: cloud
|
||||
php_version: 8.2
|
||||
domain_base: "phytron.de"
|
||||
@@ -1,43 +0,0 @@
|
||||
---
|
||||
# generic settings
|
||||
main_username: sbxadmin
|
||||
main_groupname: "{{ main_username }}"
|
||||
main_uid: "1000"
|
||||
main_gid: "{{ main_uid }}"
|
||||
|
||||
# weareinteractive.environment
|
||||
environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
|
||||
|
||||
global_env_vars:
|
||||
- "PUID={{ main_uid }}"
|
||||
- "PGID={{ main_gid }}"
|
||||
- "TZ={{ ntp_timezone }}"
|
||||
|
||||
# geerlingguy.ntp
|
||||
ntp_timezone: "Europe/Berlin"
|
||||
|
||||
# geerlingguy.nfs
|
||||
#nfs_exports: [ "/home/public *(rw,sync,no_root_squash)" ]
|
||||
|
||||
# geerlingguy.security
|
||||
security_ssh_port: 22
|
||||
security_ssh_password_authentication: "yes"
|
||||
security_ssh_permit_root_login: "no"
|
||||
security_ssh_usedns: "no"
|
||||
security_ssh_permit_empty_password: "no"
|
||||
security_ssh_challenge_response_auth: "no"
|
||||
security_ssh_gss_api_authentication: "no"
|
||||
security_ssh_x11_forwarding: "no"
|
||||
security_ssh_allowed_users:
|
||||
- "{{ main_username }}"
|
||||
security_ssh_allowed_groups: []
|
||||
security_sudoers_passwordless:
|
||||
- "{{ main_username }}"
|
||||
security_autoupdate_enabled: true
|
||||
security_autoupdate_blacklist: []
|
||||
security_autoupdate_reboot: reboot
|
||||
security_autoupdate_reboot_time: "03:00"
|
||||
security_autoupdate_mail_to: "service@softbox.de"
|
||||
security_autoupdate_mail_on_error: true
|
||||
security_fail2ban_enabled: true
|
||||
security_fail2ban_custom_configuration_template: "jail.local.j2"
|
||||
@@ -1,43 +0,0 @@
|
||||
---
|
||||
# generic settings
|
||||
main_username: sbxadmin
|
||||
main_groupname: "{{ main_username }}"
|
||||
main_uid: "1000"
|
||||
main_gid: "{{ main_uid }}"
|
||||
|
||||
# weareinteractive.environment
|
||||
environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
|
||||
|
||||
global_env_vars:
|
||||
- "PUID={{ main_uid }}"
|
||||
- "PGID={{ main_gid }}"
|
||||
- "TZ={{ ntp_timezone }}"
|
||||
|
||||
# geerlingguy.ntp
|
||||
ntp_timezone: "Europe/Berlin"
|
||||
|
||||
# geerlingguy.nfs
|
||||
#nfs_exports: [ "/home/public *(rw,sync,no_root_squash)" ]
|
||||
|
||||
# geerlingguy.security
|
||||
security_ssh_port: 22
|
||||
security_ssh_password_authentication: "yes"
|
||||
security_ssh_permit_root_login: "no"
|
||||
security_ssh_usedns: "no"
|
||||
security_ssh_permit_empty_password: "no"
|
||||
security_ssh_challenge_response_auth: "no"
|
||||
security_ssh_gss_api_authentication: "no"
|
||||
security_ssh_x11_forwarding: "no"
|
||||
security_ssh_allowed_users:
|
||||
- "{{ main_username }}"
|
||||
security_ssh_allowed_groups: []
|
||||
security_sudoers_passwordless:
|
||||
- "{{ main_username }}"
|
||||
security_autoupdate_enabled: true
|
||||
security_autoupdate_blacklist: []
|
||||
security_autoupdate_reboot: reboot
|
||||
security_autoupdate_reboot_time: "03:00"
|
||||
security_autoupdate_mail_to: "service@softbox.de"
|
||||
security_autoupdate_mail_on_error: true
|
||||
security_fail2ban_enabled: true
|
||||
security_fail2ban_custom_configuration_template: "jail.local.j2"
|
||||
@@ -1,43 +0,0 @@
|
||||
---
|
||||
# generic settings
|
||||
main_username: sbxadmin
|
||||
main_groupname: "{{ main_username }}"
|
||||
main_uid: "1000"
|
||||
main_gid: "{{ main_uid }}"
|
||||
|
||||
# weareinteractive.environment
|
||||
environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
|
||||
|
||||
global_env_vars:
|
||||
- "PUID={{ main_uid }}"
|
||||
- "PGID={{ main_gid }}"
|
||||
- "TZ={{ ntp_timezone }}"
|
||||
|
||||
# geerlingguy.ntp
|
||||
ntp_timezone: "Europe/Berlin"
|
||||
|
||||
# geerlingguy.nfs
|
||||
#nfs_exports: [ "/home/public *(rw,sync,no_root_squash)" ]
|
||||
|
||||
# geerlingguy.security
|
||||
security_ssh_port: 22
|
||||
security_ssh_password_authentication: "yes"
|
||||
security_ssh_permit_root_login: "no"
|
||||
security_ssh_usedns: "no"
|
||||
security_ssh_permit_empty_password: "no"
|
||||
security_ssh_challenge_response_auth: "no"
|
||||
security_ssh_gss_api_authentication: "no"
|
||||
security_ssh_x11_forwarding: "no"
|
||||
security_ssh_allowed_users:
|
||||
- "{{ main_username }}"
|
||||
security_ssh_allowed_groups: []
|
||||
security_sudoers_passwordless:
|
||||
- "{{ main_username }}"
|
||||
security_autoupdate_enabled: true
|
||||
security_autoupdate_blacklist: []
|
||||
security_autoupdate_reboot: reboot
|
||||
security_autoupdate_reboot_time: "03:00"
|
||||
security_autoupdate_mail_to: "service@softbox.de"
|
||||
security_autoupdate_mail_on_error: true
|
||||
security_fail2ban_enabled: true
|
||||
security_fail2ban_custom_configuration_template: "jail.local.j2"
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
# overrides of group_vars/all.yml
|
||||
|
||||
# geerlingguy.security — DMZ host: no SSH password login, keys only
|
||||
security_ssh_password_authentication: "no"
|
||||
@@ -0,0 +1,4 @@
|
||||
#cloud.phytron.de
|
||||
hostname: cloud
|
||||
php_version: 8.2
|
||||
domain_base: "phytron.de"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
|
||||
+10
-11
@@ -1,15 +1,14 @@
|
||||
[phy-z-srv-jira]
|
||||
192.168.66.41 ansible_user=sbxadmin ansible_port=22
|
||||
[phy_z_srv_jira]
|
||||
phy-z-srv-jira ansible_host=192.168.66.41
|
||||
|
||||
[phy-z-srv-cloud]
|
||||
192.168.66.66 ansible_user=sbxadmin ansible_port=22
|
||||
[phy_z_srv_cloud]
|
||||
phy-z-srv-cloud ansible_host=192.168.66.66
|
||||
|
||||
[phy-z-srv-git]
|
||||
192.168.66.67 ansible_user=sbxadmin ansible_port=22
|
||||
[phy_z_srv_git]
|
||||
phy-z-srv-git ansible_host=192.168.66.67
|
||||
|
||||
[phy-z-dmz-sftp01]
|
||||
192.168.66.68 ansible_user=sbxadmin ansible_port=22
|
||||
|
||||
[phy-z-srv-gpu01]
|
||||
192.168.66.69 ansible_user=sbxadmin ansible_port=22
|
||||
[phy_z_dmz_sftp01]
|
||||
phy-z-dmz-sftp01 ansible_host=192.168.66.68
|
||||
|
||||
[phy_z_srv_gpu01]
|
||||
phy-z-srv-gpu01 ansible_host=192.168.66.69
|
||||
|
||||
+4
-21
@@ -1,25 +1,8 @@
|
||||
---
|
||||
#- hosts: owncloud
|
||||
# become: yes
|
||||
# vars_files:
|
||||
# - "vars/vault.yml"
|
||||
#
|
||||
# pre_tasks:
|
||||
# - name: Update apt cache.
|
||||
# apt:
|
||||
# update_cache: true
|
||||
# cache_valid_time: 3600
|
||||
# when: ansible_os_family == 'Debian'
|
||||
#
|
||||
# roles:
|
||||
# - role: geerlingguy.security
|
||||
# #- role: geerlingguy.ntp ## NEEDED?
|
||||
# - role: owncloud
|
||||
|
||||
- hosts: nextcloud
|
||||
- hosts: phy_z_srv_cloud
|
||||
become: yes
|
||||
vars_files:
|
||||
- "vars/vault.yml"
|
||||
- "group_vars/secrets.yml"
|
||||
|
||||
pre_tasks:
|
||||
- name: Update apt cache.
|
||||
@@ -35,10 +18,10 @@
|
||||
tags: mail
|
||||
|
||||
|
||||
- hosts: sftp
|
||||
- hosts: phy_z_dmz_sftp01
|
||||
become: yes
|
||||
vars_files:
|
||||
- "vars/vault.yml"
|
||||
- "group_vars/secrets.yml"
|
||||
|
||||
pre_tasks:
|
||||
- name: Update apt cache.
|
||||
|
||||
Reference in New Issue
Block a user