diff --git a/.gitignore b/.gitignore index b3510dc..3ad6708 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,6 @@ playbooks/test.yml roles/geerlingguy.mysql roles/powerdns.pdns roles/lean_delivery.java +roles/geerlingguy.php +roles/systemli.etherpad +roles/geerlingguy.nodejs diff --git a/ansible.cfg b/ansible.cfg index f6cc60b..0ddb636 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -9,6 +9,7 @@ stdout_callback = yaml bin_ansible_callbacks = True jinja2_extensions = jinja2.ext.do forks = 10 +allow_world_readable_tmpfiles = True [privilege_escalation] become = True diff --git a/inventory/group_vars/all b/inventory/group_vars/all index 65487aa..4683cdc 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -219,6 +219,51 @@ wireguard_networks: - unifi - suesskartoffel port: 50035 + - ipv4: 10.87.253.72/31 + peers: + - kumpir + - ingwer + port: 50036 + - ipv4: 10.87.253.74/31 + peers: + - kumpir + - spinat + port: 50037 + - ipv4: 10.87.253.76/31 + peers: + - kumpir + - uffschnitt + port: 50038 + - ipv4: 10.87.253.78/31 + peers: + - kumpir + - lotuswurzel + port: 50039 + - ipv4: 10.87.253.80/31 + peers: + - kumpir + - wasserfloh + port: 50040 + - ipv4: 10.87.253.82/31 + peers: + - kumpir + - linse + port: 50041 + - ipv4: 10.87.253.84/31 + peers: + - kumpir + - kichererbse + port: 50042 + - ipv4: 10.87.253.86/31 + peers: + - kumpir + - suesskartoffel + port: 50043 + - ipv4: 10.87.253.88/31 + peers: + - kumpir + - unifi + port: 50044 fastd_groups: - gateways diff --git a/inventory/host_vars/kumpir.freifunk-mwu.de b/inventory/host_vars/kumpir.freifunk-mwu.de new file mode 100644 index 0000000..a6a9d8e --- /dev/null +++ b/inventory/host_vars/kumpir.freifunk-mwu.de @@ -0,0 +1,63 @@ +--- +server_type: "services" + +magic: 162 + +acme_server: linse + + +php_packages: + - php + - php-fpm + - php-cli + - php-gd + - php-mysql + - php-mbstring + - php-xml +php_webserver_daemon: "nginx" +php_default_version_debian: "7.3" +php_enable_php_fpm: true +php_use_managed_ini: true +php_upload_max_filesize: "512M" +php_post_max_size: "512M" + +wp_install_dir: "/var/www/wordpress" +wp_mysql_db: "wordpress" +wp_mysql_user: "wordpress" +wp_mysql_password: "{{ lookup('passwordstore', inventory_hostname_short + '/mysql_wordpress') }}" +wp_service_name: "blog.freifunk-mainz.de" + + +mysql_root_password: "{{ lookup('passwordstore', inventory_hostname_short + '/mysql_root') }}" +mysql_databases: + - name: "wordpress" + encoding: "utf8mb4" + collation: "utf8mb4_unicode_ci" + - name: "etherpad" + encoding: "utf8mb4" + collation: "utf8mb4_unicode_ci" +mysql_users: + - name: "wordpress" + host: "localhost" + password: "{{ lookup('passwordstore', inventory_hostname_short + '/mysql_wordpress') }}" + priv: "wordpress.*:ALL" + - name: "etherpad" + host: "localhost" + password: "{{ lookup('passwordstore', inventory_hostname_short + '/mysql_etherpad') }}" + priv: "etherpad.*:ALL" +mysql_max_binlog_size: "100M" +mysql_expire_logs_days: "10" +mysql_bind_address: "127.0.0.1" + +nginx_ssl_directory: /etc/nginx/ssl/freifunk-mwu.de/ + +nginx_etherpad_url: "pad.freifunk-mwu.de" + +etherpad_db_type: mysql +etherpad_ip: 127.0.0.1 +etherpad_port: 9002 +etherpad_mysql_database_host: localhost +etherpad_mysql_database_name: etherpad +etherpad_mysql_database_user: etherpad +etherpad_mysql_database_password: "{{ lookup('passwordstore', inventory_hostname_short + '/mysql_etherpad') }}" +etherpad_mysql_database_port: 3306 diff --git a/inventory/services b/inventory/services index 786c3e0..1a720a8 100644 --- a/inventory/services +++ b/inventory/services @@ -2,3 +2,4 @@ kichererbse.freifunk-mwu.de linse.freifunk-mwu.de unifi.freifunk-mwu.de +kumpir.freifunk-mwu.de diff --git a/inventory/www b/inventory/www new file mode 100644 index 0000000..476e38e --- /dev/null +++ b/inventory/www @@ -0,0 +1,2 @@ +[www] +kumpir.freifunk-mwu.de diff --git a/playbooks/site.yml b/playbooks/site.yml index 299b3af..760c26f 100755 --- a/playbooks/site.yml +++ b/playbooks/site.yml @@ -6,3 +6,4 @@ - import_playbook: dns.yml - import_playbook: buildservers.yml - import_playbook: unifi.yml +- import_playbook: www.yml diff --git a/playbooks/www.yml b/playbooks/www.yml new file mode 100644 index 0000000..c661e4e --- /dev/null +++ b/playbooks/www.yml @@ -0,0 +1,8 @@ +#!/usr/bin/ansible-playbook +--- +- name: Webservers + hosts: www + + roles: + - service-nginx-wordpress + - service-nginx-etherpad diff --git a/requirements.yml b/requirements.yml index 2356191..d442b53 100644 --- a/requirements.yml +++ b/requirements.yml @@ -1,3 +1,5 @@ - src: geerlingguy.mysql - src: powerdns.pdns - src: lean_delivery.java +- src: geerlingguy.php +- src: systemli.etherpad diff --git a/roles/service-nginx-etherpad/README.md b/roles/service-nginx-etherpad/README.md new file mode 100644 index 0000000..05e2e99 --- /dev/null +++ b/roles/service-nginx-etherpad/README.md @@ -0,0 +1,16 @@ +# Ansible Role: Etherpad Nginx Config + +Ansible role that installs and configures Nginx for Etherpad. + + +## Requirements & Dependencies +- service-nginx +- systemli.etherpad + + +## Variables + +```yaml +etherpad_service_name: www.example.com (required) +nginx_ssl_directory: /etc/nginx/ssl/freifunk-mwu.de/ (required) +``` diff --git a/roles/service-nginx-etherpad/handlers/main.yml b/roles/service-nginx-etherpad/handlers/main.yml new file mode 100644 index 0000000..5463835 --- /dev/null +++ b/roles/service-nginx-etherpad/handlers/main.yml @@ -0,0 +1,4 @@ +- name: restart nginx + service: + name: nginx + state: restarted diff --git a/roles/service-nginx-etherpad/meta/main.yml b/roles/service-nginx-etherpad/meta/main.yml new file mode 100644 index 0000000..e22caa2 --- /dev/null +++ b/roles/service-nginx-etherpad/meta/main.yml @@ -0,0 +1,4 @@ +--- +dependencies: + - service-nginx + - systemli.etherpad diff --git a/roles/service-nginx-etherpad/tasks/main.yml b/roles/service-nginx-etherpad/tasks/main.yml new file mode 100644 index 0000000..8fda881 --- /dev/null +++ b/roles/service-nginx-etherpad/tasks/main.yml @@ -0,0 +1,10 @@ +--- +- name: Etherpad | Nginx | Copy virtual host configuration file + template: + src: "nginx-vhost.j2" + dest: /etc/nginx/conf.d/{{ nginx_etherpad_url.split(".")[0] }}.conf + owner: root + group: root + mode: 0644 + notify: + - restart nginx diff --git a/roles/service-nginx-etherpad/templates/nginx-vhost.j2 b/roles/service-nginx-etherpad/templates/nginx-vhost.j2 new file mode 100644 index 0000000..3255369 --- /dev/null +++ b/roles/service-nginx-etherpad/templates/nginx-vhost.j2 @@ -0,0 +1,38 @@ +server { + listen 80; + listen [::]:80; + server_name {{ nginx_etherpad_url }}; + return 301 https://$http_host$request_uri; +} + +map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name {{ nginx_etherpad_url }}; + + ssl_certificate {{ nginx_ssl_directory }}fullchain.pem; + ssl_certificate_key {{ nginx_ssl_directory }}privkey.pem; + ssl_prefer_server_ciphers on; + + location / { + proxy_pass http://localhost:9002/; + proxy_set_header Host $host; + proxy_pass_header Server; + # be careful, this line doesn't override any proxy_buffering on set in a conf.d/file.conf + proxy_buffering off; + proxy_set_header X-Real-IP $remote_addr; # http://wiki.nginx.org/HttpProxyModule + proxy_set_header X-Forwarded-For $remote_addr; # EP logs to show the actual remote IP + proxy_set_header X-Forwarded-Proto $scheme; # for EP to set secure cookie flag when https is used + proxy_set_header Host $host; # pass the host header + proxy_http_version 1.1; # recommended with keepalive connections + # WebSocket proxying - from http://nginx.org/en/docs/http/websocket.html + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + } + +} diff --git a/roles/service-nginx-wordpress/README.md b/roles/service-nginx-wordpress/README.md new file mode 100644 index 0000000..eb3b03c --- /dev/null +++ b/roles/service-nginx-wordpress/README.md @@ -0,0 +1,34 @@ +

+ +

+ +# Ansible Role: WordPress + +Ansible role that installs and configures WordPress with Nginx. + +Features include: +- Installation of any WordPress version to specified directory +- Configuration of `wp-config.php` +- Fetch random salts for wp-config.php (https://api.wordpress.org/secret-key/1.1/salt/) + +## Requirements & Dependencies +- Ansible 1.4 or higher +- Curl + +## Variables +Here is a list of all the default variables for this role, which are also available in `defaults/main.yml`. + +```yaml +wp_version: latest +wp_install_dir: '/var/www/html' +wp_db_name: "{{ wp_mysql_db }}" (required) +wp_db_user: "{{ wp_mysql_user }}" (required) +wp_db_password: "{{ wp_mysql_password }}" (required) +wp_db_host: 'localhost' +wp_db_charset: 'utf8mb4' +wp_db_collate: 'utf8mb4_unicode_ci' +wp_table_prefix: 'wp_' +wp_debug: false +wp_admin_email: 'admin@example.com' +site_name: "{{ wp_sitename }}" (requires) +``` diff --git a/roles/service-nginx-wordpress/defaults/main.yml b/roles/service-nginx-wordpress/defaults/main.yml new file mode 100644 index 0000000..17f87b7 --- /dev/null +++ b/roles/service-nginx-wordpress/defaults/main.yml @@ -0,0 +1,13 @@ +--- +wp_version: latest +wp_install_dir: '/var/www/html' +wp_db_name: "{{ wp_mysql_db }}" +wp_db_user: "{{ wp_mysql_user }}" +wp_db_password: "{{ wp_mysql_password }}" +wp_db_host: 'localhost' +wp_db_charset: 'utf8mb4' +wp_db_collate: 'utf8mb4_unicode_ci' +wp_table_prefix: 'wp_' +wp_debug: false +wp_admin_email: 'admin@example.com' +site_name: "{{ wp_sitename }}" diff --git a/roles/service-nginx-wordpress/handlers/main.yml b/roles/service-nginx-wordpress/handlers/main.yml new file mode 100644 index 0000000..5463835 --- /dev/null +++ b/roles/service-nginx-wordpress/handlers/main.yml @@ -0,0 +1,4 @@ +- name: restart nginx + service: + name: nginx + state: restarted diff --git a/roles/service-nginx-wordpress/meta/main.yml b/roles/service-nginx-wordpress/meta/main.yml new file mode 100644 index 0000000..d4a3786 --- /dev/null +++ b/roles/service-nginx-wordpress/meta/main.yml @@ -0,0 +1,5 @@ +--- +dependencies: + - service-nginx + - geerlingguy.php + - geerlingguy.mysql diff --git a/roles/service-nginx-wordpress/tasks/main.yml b/roles/service-nginx-wordpress/tasks/main.yml new file mode 100644 index 0000000..0d23997 --- /dev/null +++ b/roles/service-nginx-wordpress/tasks/main.yml @@ -0,0 +1,45 @@ +--- +- name: Wordpress | Create directory + file: + path: "{{ wp_install_dir }}" + state: directory + mode: 0755 + +- name: Wordpress | Extract archive in {{ wp_install_dir }} + unarchive: + src: "http://wordpress.org/wordpress-{{ wp_version }}.tar.gz" + dest: "{{ wp_install_dir }}" + extra_opts: + - --strip-components=1 + remote_src: yes + +- name: Wordpress | Fetch random salts for wp-config.php + delegate_to: localhost + command: curl https://api.wordpress.org/secret-key/1.1/salt/ + become: False + args: + warn: false + register: 'wp_salt' + +- name: Wordpress | Copy wp-config.php file + template: + src: wp-config.php.j2 + dest: "{{ wp_install_dir }}/wp-config.php" + +- name: Wordpress | Change ownership of installation directory + file: + path: "{{ wp_install_dir }}" + owner: www-data + group: www-data + state: directory + recurse: yes + +- name: Wordpress | Nginx | Copy virtual host configuration file + template: + src: "nginx-vhost.j2" + dest: /etc/nginx/conf.d/{{ wp_service_name.split(".")[0] }}.conf + owner: root + group: root + mode: 0644 + notify: + - restart nginx diff --git a/roles/service-nginx-wordpress/templates/nginx-vhost.j2 b/roles/service-nginx-wordpress/templates/nginx-vhost.j2 new file mode 100644 index 0000000..59d6b03 --- /dev/null +++ b/roles/service-nginx-wordpress/templates/nginx-vhost.j2 @@ -0,0 +1,52 @@ +server { + listen 80; + listen [::]:80; + server_name {{ wp_service_name }}; + return 301 https://$http_host$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name {{ wp_service_name }}; + + ssl_certificate {{ nginx_ssl_directory }}fullchain.pem; + ssl_certificate_key {{ nginx_ssl_directory }}privkey.pem; + ssl_prefer_server_ciphers on; + + + root {{ wp_install_dir }}; + + # Add index.php to the list if you are using PHP + index index.php; + + server_name {{ wp_service_name }}; + + client_max_body_size 1024M; + + location / { + # First attempt to serve request as file, then + # as directory, then fall back to displaying a 404. + #try_files $uri $uri/ =404; + try_files $uri $uri/ /index.php$is_args$args; + } + + location = /favicon.ico { log_not_found off; access_log off; } + location = /robots.txt { log_not_found off; access_log off; allow all; } + location ~* \.(css|gif|ico|jpeg|jpg|js|png)$ { + expires max; + log_not_found off; + } + + # pass the PHP scripts to FastCGI server listening on socket + location ~ \.php$ { + try_files $uri =404; + include /etc/nginx/fastcgi_params; + fastcgi_read_timeout 3600s; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_pass 127.0.0.1:9000; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_index index.php; + } + +} diff --git a/roles/service-nginx-wordpress/templates/wp-config.php.j2 b/roles/service-nginx-wordpress/templates/wp-config.php.j2 new file mode 100644 index 0000000..7438d13 --- /dev/null +++ b/roles/service-nginx-wordpress/templates/wp-config.php.j2 @@ -0,0 +1,60 @@ +