Restructure and update role for firmware build server

* rename role ffmwu-build -> firmware-build-server
* rename playbook build-server to firmware-build-server

inventory/host_vars/milchreis.freifunk-mwu.de

@@ -0,0 +1,2 @@
+---
+ffmwu_server_type: "firmware-build"

playbooks/build-server.yml

@@ -1,7 +0,0 @@
-#!/usr/bin/ansible-playbook
-
-- hosts: ffmwu-build-servers
-  remote_user: admin
-  roles:
-  - prerequisites
-  - ffmwu-build

playbooks/firmware-build-server.yml

@@ -0,0 +1,14 @@
+#!/usr/bin/ansible-playbook
+
+- hosts: ffmwu-build-servers
+  remote_user: admin
+  roles:
+  - prerequisites
+  - server-apt-repos
+  - server-basic
+  - users
+  - service-haveged
+  - service-ntpd
+  - service-vnstat
+  - service-nginx
+  - firmware-build-server

roles/ffmwu-build/meta/main.yml

@@ -1,3 +0,0 @@
----
-dependencies:
-- ffmwu-server

roles/ffmwu-build/tasks/main.yml

@@ -1,17 +0,0 @@
----
-
-# we don't want to disrupt servers where this role is manually maintained!
-# thus: warning and block statement
-
-- name: full-stop if build role is manually maintained on this server
-  debug: msg="build role skipped to not disrupt manual maintenance - set ansible_managed_build to True to enable ansible control"
-  when: (not ansible_managed_build is defined) or (not ansible_managed_build)
-
-- block:
-  - include: packages.yml
-  - include: git-repos.yml
-  - include: rsyncd.yml
-  - include: web.yml
-
-  when: (ansible_managed_build is defined) and (ansible_managed_build)
-# end block

roles/ffmwu-build/tasks/packages.yml

@@ -1,48 +0,0 @@
----
-- name: add apt repository of neoraider
-  apt_repository:
-    repo: 'deb https://repo.universe-factory.net/debian/ sid main'
-    state: present
-    filename: 'neoraider'
-  notify: update apt cache
-
-- name: add apt repository of freifunk-mwu
-  apt_repository:
-    repo: 'deb http://repo.freifunk-mwu.de/debian/ jessie main'
-    state: present
-    filename: 'ffmwu'
-  notify: update apt cache
-
-- name: add apt-key of neoraider
-  apt_key:
-    keyserver: keyserver.ubuntu.com
-    id: 16EF3F64CB201D9C
-    state: present
-  notify: update apt cache
-
-- name: add apt-key of freifunk-mwu package sigs
-  apt_key:
-    url: http://repo.freifunk-mwu.de/83A70084.gpg.key
-    state: present
-  notify: update apt cache
-
-- name: install needed packages for build-server
-  apt:
-    state: present
-    name: "{{ item }}"
-    update_cache: yes
-    cache_valid_time: 21600
-  with_items:
-    - apache2
-    - apache2-utils
-    - build-essential
-    - ecdsautils
-    - gawk
-    - git
-    - haveged
-    - libncurses5-dev
-    - libssl-dev
-    - pkg-config
-    - subversion
-    - unzip
-    - zlib1g-dev

roles/ffmwu-build/tasks/web.yml

@@ -1,111 +0,0 @@
----
-- name: ensure webroot owned by user/group admin
-  file:
-    dest: /var/www/html
-    owner: admin
-    group: admin
-    recurse: yes
-
-- name: enable apache module ssl
-  apache2_module:
-    state: present
-    name: ssl
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: disable default apache http site
-  command: /usr/sbin/a2dissite 000-default
-  args:
-    removes: /etc/apache2/sites-enabled/000-default.conf
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: disable default apache https site
-  command: /usr/sbin/a2dissite default-ssl
-  args:
-    removes: /etc/apache2/sites-enabled/default-ssl.conf
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: disable unwanted default configs
-  command: /usr/sbin/a2disconf other-vhosts-access-log
-  args:
-    removes: /etc/apache2/conf-enabled/other-vhosts-access-log.conf
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: configure apache ssl cipher suites
-  lineinfile:
-    dest: /etc/apache2/mods-enabled/ssl.conf
-    regexp: '^([\s\t]+)?SSLCipherSuite'
-    line: "SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
-    state: present
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: configure apache ssl protocols
-  lineinfile:
-    dest: /etc/apache2/mods-available/ssl.conf
-    regexp: '^([\s\t]+)?SSLProtocol'
-    line: "SSLProtocol all -SSLv2 -SSLv3"
-    state: present
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: configure apache security settings
-  lineinfile:
-    dest: /etc/apache2/conf-available/security.conf
-    regexp: "^ServerTokens"
-    line: "ServerTokens Prod"
-    state: present
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: configure apache server signature
-  lineinfile:
-    dest: /etc/apache2/conf-available/security.conf
-    regexp: "^ServerSignature"
-    line: "ServerSignature EMail"
-    state: present
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: write ffmwu http site
-  template:
-    src: ffmwu-default-http.conf.j2
-    dest: /etc/apache2/sites-available/ffmwu-default-http.conf
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: write ffmwu https site
-  template:
-    src: ffmwu-default-https.conf.j2
-    dest: /etc/apache2/sites-available/ffmwu-default-https.conf
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: enable ffmwu apache http site
-  command: /usr/sbin/a2ensite ffmwu-default-http
-  args:
-    creates: /etc/apache2/sites-enabled/ffmwu-default-http.conf
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2
-
-- name: enable ffmwu apache https site
-  command: /usr/sbin/a2ensite ffmwu-default-https
-  args:
-    creates: /etc/apache2/sites-enabled/ffmwu-default-https.conf
-  notify:
-    - check apache syntax
-    - restart systemd unit apache2

roles/firmware-build-server/files/maesto.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDJhcbPmN6qjd+KI5t8tOVJYqS/8Jef2bAUZFlLYU6kBxZDa0Qu7Hg30z50hFcavoM6Dnh24kiZHsvCdKZ3u8mr6WhaJzDPxDm8YKk2U5WOKrQ48eq4LKU3dIOiO/5M0u90P51hF90J8/bgmp9HpNL31/8g6RT2kjBkwk62ATXF4eb0kyENHPdDn2axInKQ3z8sxhpCWhWE6J/LKIPI5J66E7F+CR7rhvk2h0ikGyBy8xZhJWY/U/IDyDV0JmvW6TNmXi4bUvUhm2lY7PRen6Xvq5UAEjC3K4YtcBCLrNtfyIR7N7vHTuuaDUjdOGCF88KdzxZ5AxIPmhN9WVj+HydCJjB1TiAzINg2egZ3Ot4juXVAi5QbU5Addw0yJdoTwGHe0mrjQ1e+VsMziDR2wZvpsU+x+D8xWmsBAh+V4vDm9gowVo5vPfFMRxAlPktNtrERSNB84OwCLtrhDc+a6BGxVuR1EHbt9H2hAUfsxRVSmwGGm5bG4QOI/DbUsARhthiYQ2Q7cNXGl0UrMkxfFpO86fiH35j3F8Cqr9oQTJOnaK64e8+zwbw+L0XxVPtAPgIGsNeNbam+ALIlbj9RQP1Cin0dlq3QCdEZ1UWdcN38RL+z27LzMgubFnapnWnlmnjqtfKAXldwwQxe1qsdWvzMA4PE/AEUF+NL5w89TYUWdw==

roles/firmware-build-server/handlers/main.yml

@@ -10,3 +10,7 @@
 - name: update apt cache
   apt:
     update_cache: yes
+
+- name: reload systemd
+  systemd:
+    daemon_reload: yes

roles/firmware-build-server/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+- include: packages.yml
+- include: git-repos.yml
+- include: rsyncd.yml
+
+- name: create user maesto
+  user:
+    name: maesto
+    shell: /bin/bash
+    state: present
+
+- name: install ssh public key of maesto
+  authorized_key:
+    user: maesto
+    state: present
+    exclusive: yes
+    key: "{{ lookup('file', 'maesto.pub') }}"
+
+- name: configure passwordless sudo access
+  template:
+    src: "sudoers-maesto.j2"
+    dest: "/etc/sudoers.d/maesto"
+    owner: root
+    group: root
+    mode: '0440'
+    validate: "/usr/sbin/visudo -cf %s"

roles/firmware-build-server/tasks/packages.yml

@@ -0,0 +1,19 @@
+---
+- name: install packages
+  apt:
+    state: present
+    name: "{{ item }}"
+    update_cache: yes
+    cache_valid_time: 21600
+  with_items:
+    - build-essential
+    - ecdsautils
+    - gawk
+    - git
+    - haveged
+    - libncurses5-dev
+    - libssl-dev
+    - pkg-config
+    - subversion
+    - unzip
+    - zlib1g-dev

roles/firmware-build-server/tasks/rsyncd.yml

@@ -1,17 +1,22 @@
 ---
 - name: install rsnycd configuration file
-  copy:
-    src: rsyncd.conf
+  template:
+    src: rsyncd.conf.j2
     dest: /etc/rsyncd.conf
     mode: 0640
+    owner: root
+    group: root
 
 - name: install rsnyc systemd unit
-  copy:
-    src: rsync.service
+  template:
+    src: rsync.service.j2
     dest: /etc/systemd/system/
     mode: 0644
+    owner: root
+    group: root
+  notify: reload systemd
 
-- name: ensure rsync is started on boot as a daemon
+- name: ensure rsync is started and activated
   systemd:
     name: rsync
     state: started

roles/firmware-build-server/templates/sudoers-maesto.j2

@@ -0,0 +1,2 @@
+# {{ ansible_managed }}
+maesto ALL=NOPASSWD: ALL

roles/service-nginx/templates/index.html.j2

@@ -20,6 +20,9 @@
         <h1>Freifunk MWU Gateway <a href="./index.html">{{ inventory_hostname_short }}</a></h1>
     </header>
     <div class="block"><a href="firmware">Firmware</a></div>
+{% if ffmwu_server_type == "firmware-build" %}
+    <div class="block"><a href="_archive">Firmware Archiv</a></div>
+{% endif %}
     <div class="block"><a href="traffic">Traffic</a></div>
 </body>
 </html>