mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-07-18 06:24:25 +02:00
Shortened network- to net-
This commit is contained in:
parent
66198ca1ec
commit
2108702a2b
@ -49,7 +49,7 @@ For a complete list of role categories and detailed definitions, see:
|
|||||||
|
|
||||||
## Network
|
## Network
|
||||||
|
|
||||||
- **network-***
|
- **net-***
|
||||||
Network infrastructure (DNS records, WireGuard, Let’s Encrypt entrypoints).
|
Network infrastructure (DNS records, WireGuard, Let’s Encrypt entrypoints).
|
||||||
|
|
||||||
- **service-***
|
- **service-***
|
||||||
@ -112,7 +112,7 @@ For a complete list of role categories and detailed definitions, see:
|
|||||||
|
|
||||||
> **Tip:** To find a role quickly, search for its prefix:
|
> **Tip:** To find a role quickly, search for its prefix:
|
||||||
> `core-`, `gen-`, `desk-`, `srv-web-`, `web-service-`, `web-app-`,
|
> `core-`, `gen-`, `desk-`, `srv-web-`, `web-service-`, `web-app-`,
|
||||||
> `network-`, `service-`, `monitor-`, `alert-`, `maint-`, `cln-`,
|
> `net-`, `service-`, `monitor-`, `alert-`, `maint-`, `cln-`,
|
||||||
> `bkp-`, `update-`, `pkgmgr-`, `user-`.
|
> `bkp-`, `update-`, `pkgmgr-`, `user-`.
|
||||||
|
|
||||||
---
|
---
|
||||||
|
@ -12,4 +12,4 @@ ssl_session_tickets on;
|
|||||||
add_header Strict-Transport-Security max-age=15768000;
|
add_header Strict-Transport-Security max-age=15768000;
|
||||||
ssl_stapling on;
|
ssl_stapling on;
|
||||||
ssl_stapling_verify on;
|
ssl_stapling_verify on;
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_credentials.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_credentials.j2' %}
|
@ -19,7 +19,7 @@ The primary purpose of this role is to enable proper routing and connectivity fo
|
|||||||
|
|
||||||
- **iptables Rule Adaptation:** Modifies iptables to allow forwarding and NAT masquerading for the WireGuard client.
|
- **iptables Rule Adaptation:** Modifies iptables to allow forwarding and NAT masquerading for the WireGuard client.
|
||||||
- **NAT Support:** Configures the external interface for proper masquerading.
|
- **NAT Support:** Configures the external interface for proper masquerading.
|
||||||
- **Role Integration:** Depends on the [network-wireguard-plain](../network-wireguard-plain/README.md) role to ensure that WireGuard is properly configured before applying firewall rules.
|
- **Role Integration:** Depends on the [net-wireguard-plain](../net-wireguard-plain/README.md) role to ensure that WireGuard is properly configured before applying firewall rules.
|
||||||
|
|
||||||
## Other Resources
|
## Other Resources
|
||||||
- https://gist.github.com/insdavm/b1034635ab23b8839bf957aa406b5e39
|
- https://gist.github.com/insdavm/b1034635ab23b8839bf957aa406b5e39
|
@ -23,4 +23,4 @@ galaxy_info:
|
|||||||
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
||||||
documentation: "https://s.veen.world/cymais"
|
documentation: "https://s.veen.world/cymais"
|
||||||
dependencies:
|
dependencies:
|
||||||
- network-wireguard-plain
|
- net-wireguard-plain
|
@ -24,4 +24,4 @@ galaxy_info:
|
|||||||
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
||||||
documentation: "https://s.veen.world/cymais"
|
documentation: "https://s.veen.world/cymais"
|
||||||
dependencies:
|
dependencies:
|
||||||
- network-wireguard-core
|
- net-wireguard-core
|
@ -2,5 +2,5 @@ server {
|
|||||||
listen {{ports.public.ldaps.ldap}}ssl;
|
listen {{ports.public.ldaps.ldap}}ssl;
|
||||||
proxy_pass 127.0.0.1:{{ports.localhost.ldap.ldap}};
|
proxy_pass 127.0.0.1:{{ports.localhost.ldap.ldap}};
|
||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_credentials.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_credentials.j2' %}
|
||||||
}
|
}
|
||||||
|
@ -17,7 +17,7 @@ When you apply **srv-web-https**, it will:
|
|||||||
|
|
||||||
1. **Include** the `srv-web-core` role to install and configure Nginx.
|
1. **Include** the `srv-web-core` role to install and configure Nginx.
|
||||||
2. **Clean up** any stale vHost files under `cln-domains`.
|
2. **Clean up** any stale vHost files under `cln-domains`.
|
||||||
3. **Deploy** the Let’s Encrypt challenge-and-redirect snippet from `network-letsencrypt`.
|
3. **Deploy** the Let’s Encrypt challenge-and-redirect snippet from `net-letsencrypt`.
|
||||||
4. **Reload** Nginx automatically when any template changes.
|
4. **Reload** Nginx automatically when any template changes.
|
||||||
|
|
||||||
All tasks are idempotent—once your certificates are in place and your configuration is set, Ansible will skip unchanged steps on subsequent runs.
|
All tasks are idempotent—once your certificates are in place and your configuration is set, Ansible will skip unchanged steps on subsequent runs.
|
||||||
|
@ -26,4 +26,4 @@ galaxy_info:
|
|||||||
dependencies:
|
dependencies:
|
||||||
- srv-web-core
|
- srv-web-core
|
||||||
- cln-domains
|
- cln-domains
|
||||||
- network-letsencrypt
|
- net-letsencrypt
|
@ -13,7 +13,7 @@ server
|
|||||||
{{nginx_docker_reverse_proxy_extra_configuration}}
|
{{nginx_docker_reverse_proxy_extra_configuration}}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_header.j2' %}
|
||||||
|
|
||||||
{% if applications | is_feature_enabled('oauth2', application_id) %}
|
{% if applications | is_feature_enabled('oauth2', application_id) %}
|
||||||
{% set acl = applications[application_id].oauth2_proxy.acl | default({}) %}
|
{% set acl = applications[application_id].oauth2_proxy.acl | default({}) %}
|
||||||
|
@ -6,7 +6,7 @@ map $http_upgrade $connection_upgrade {
|
|||||||
server {
|
server {
|
||||||
server_name {{ domain }};
|
server_name {{ domain }};
|
||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_header.j2' %}
|
||||||
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2' %}
|
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2' %}
|
||||||
|
|
||||||
client_max_body_size {{ client_max_body_size | default('100m') }};
|
client_max_body_size {{ client_max_body_size | default('100m') }};
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
server {
|
server {
|
||||||
server_name {{domain}};
|
server_name {{domain}};
|
||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_header.j2' %}
|
||||||
|
|
||||||
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
||||||
|
|
||||||
|
@ -64,7 +64,7 @@
|
|||||||
|
|
||||||
- name: Include DNS role to register Gitea domain(s)
|
- name: Include DNS role to register Gitea domain(s)
|
||||||
include_role:
|
include_role:
|
||||||
name: network-dns-records
|
name: net-dns-records
|
||||||
vars:
|
vars:
|
||||||
cloudflare_api_token: "{{ certbot_dns_api_token }}"
|
cloudflare_api_token: "{{ certbot_dns_api_token }}"
|
||||||
cloudflare_domains: "{{ [ domains | get_domain(application_id) ] }}"
|
cloudflare_domains: "{{ [ domains | get_domain(application_id) ] }}"
|
||||||
|
@ -5,7 +5,7 @@ server {
|
|||||||
{% set http_port = ports.localhost.http.synapse %}
|
{% set http_port = ports.localhost.http.synapse %}
|
||||||
|
|
||||||
server_name {{domains.matrix.synapse}};
|
server_name {{domains.matrix.synapse}};
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_header.j2' %}
|
||||||
|
|
||||||
# For the federation port
|
# For the federation port
|
||||||
listen 8448 ssl default_server;
|
listen 8448 ssl default_server;
|
||||||
|
@ -4,7 +4,7 @@ server
|
|||||||
{
|
{
|
||||||
server_name {{domain}};
|
server_name {{domain}};
|
||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_header.j2' %}
|
||||||
|
|
||||||
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
||||||
# Remove X-Powered-By, which is an information leak
|
# Remove X-Powered-By, which is an information leak
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
server {
|
server {
|
||||||
server_name {{domain}};
|
server_name {{domain}};
|
||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_header.j2' %}
|
||||||
|
|
||||||
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
||||||
|
|
||||||
|
@ -55,7 +55,7 @@ followus:
|
|||||||
- name: Friendica
|
- name: Friendica
|
||||||
description: Visit {{ 'our' if service_provider.type == 'legal' else 'my' }} friendica profile
|
description: Visit {{ 'our' if service_provider.type == 'legal' else 'my' }} friendica profile
|
||||||
icon:
|
icon:
|
||||||
class: fas fa-network-wired
|
class: fas fa-net-wired
|
||||||
identifier: "{{service_provider.contact.friendica}}"
|
identifier: "{{service_provider.contact.friendica}}"
|
||||||
url: "{{ web_protocol }}://{{ service_provider.contact.friendica.split('@')[2] }}/@{{ service_provider.contact.friendica.split('@')[1] }}"
|
url: "{{ web_protocol }}://{{ service_provider.contact.friendica.split('@')[2] }}/@{{ service_provider.contact.friendica.split('@')[1] }}"
|
||||||
iframe: {{ applications | is_feature_enabled('portfolio_iframe','friendica') }}
|
iframe: {{ applications | is_feature_enabled('portfolio_iframe','friendica') }}
|
||||||
|
@ -13,7 +13,7 @@ server
|
|||||||
{{nginx_docker_reverse_proxy_extra_configuration}}
|
{{nginx_docker_reverse_proxy_extra_configuration}}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_header.j2' %}
|
||||||
|
|
||||||
{% for path in syncope_paths.values() %}
|
{% for path in syncope_paths.values() %}
|
||||||
{% set location = web_protocol ~ '://' ~ domains | get_domain(application_id) ~ '/' ~ path ~ '/' %}
|
{% set location = web_protocol ~ '://' ~ domains | get_domain(application_id) ~ '/' ~ path ~ '/' %}
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
server {
|
server {
|
||||||
server_name {{ domain }};
|
server_name {{ domain }};
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_header.j2' %}
|
||||||
|
|
||||||
return 301 https://{{ target }}$request_uri;
|
return 301 https://{{ target }}$request_uri;
|
||||||
}
|
}
|
||||||
|
@ -17,7 +17,7 @@
|
|||||||
|
|
||||||
- name: Include DNS role to set redirects
|
- name: Include DNS role to set redirects
|
||||||
include_role:
|
include_role:
|
||||||
name: network-dns-records
|
name: net-dns-records
|
||||||
vars:
|
vars:
|
||||||
cloudflare_api_token: "{{ certbot_dns_api_token }}"
|
cloudflare_api_token: "{{ certbot_dns_api_token }}"
|
||||||
cloudflare_domains: "{{ www_domains }}"
|
cloudflare_domains: "{{ www_domains }}"
|
||||||
|
@ -2,7 +2,7 @@ server
|
|||||||
{
|
{
|
||||||
server_name {{domains | get_domain(application_id)}};
|
server_name {{domains | get_domain(application_id)}};
|
||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_header.j2' %}
|
||||||
|
|
||||||
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
||||||
|
|
||||||
|
@ -2,7 +2,7 @@ server
|
|||||||
{
|
{
|
||||||
server_name {{domains | get_domain(application_id)}};
|
server_name {{domains | get_domain(application_id)}};
|
||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/net-letsencrypt/templates/ssl_header.j2' %}
|
||||||
|
|
||||||
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
||||||
|
|
||||||
|
@ -104,18 +104,18 @@
|
|||||||
- name: setup standard wireguard
|
- name: setup standard wireguard
|
||||||
when: ('wireguard_server' | application_allowed(group_names, allowed_applications))
|
when: ('wireguard_server' | application_allowed(group_names, allowed_applications))
|
||||||
include_role:
|
include_role:
|
||||||
name: network-wireguard-core
|
name: net-wireguard-core
|
||||||
|
|
||||||
# vpn setup
|
# vpn setup
|
||||||
- name: setup wireguard client behind firewall\nat
|
- name: setup wireguard client behind firewall\nat
|
||||||
when: ('wireguard_behind_firewall' | application_allowed(group_names, allowed_applications))
|
when: ('wireguard_behind_firewall' | application_allowed(group_names, allowed_applications))
|
||||||
include_role:
|
include_role:
|
||||||
name: network-wireguard-firewalled
|
name: net-wireguard-firewalled
|
||||||
|
|
||||||
- name: setup wireguard client
|
- name: setup wireguard client
|
||||||
when: ('wireguard_client' | application_allowed(group_names, allowed_applications))
|
when: ('wireguard_client' | application_allowed(group_names, allowed_applications))
|
||||||
include_role:
|
include_role:
|
||||||
name: network-wireguard-plain
|
name: net-wireguard-plain
|
||||||
|
|
||||||
## backup setup
|
## backup setup
|
||||||
- name: setup replica backup hosts
|
- name: setup replica backup hosts
|
||||||
|
Loading…
x
Reference in New Issue
Block a user