mrwho/Ansible-Roles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix

Browse source
This commit is contained in:
mrwho 2026-05-09 02:09:57 +03:00
parent ea08949480
commit 16bb2758da
8 changed files with 134 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

76
playbooks/mrwho/dns-local.yml Normal file
View file

@ -0,0 +1,76 @@
---
- name: Configure named local-master
hosts: router
roles:
- named
vars:
# Primary Configuration
named_listen_ipv4:
- "any"
named_listen_ipv4_port:
- 53
named_listen_ipv6:
- "::"
named_listen_ipv6_port:
- 53
named_recursion: true
named_allow_recursion:
- "Local"
named_allow_query:
- "any"
named_allow_transfer:
- "Transfer"
named_dns_keys:
- name: CerbotKey
algorithm: hmac-sha512
secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA==
named_extra_include_files:
- "{{ named_auth_file }}"
named_statistics_channels:
- named_statistics_host: '127.0.0.1'
- named_statistics_port: '8053'
- named_statistics_allow:
- '127.0.0.1'
named_acls:
- name: Transfer
match_list:
- 80.211.195.127
- name: Local
match_list:
- 127.0.0.0/8
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
named_zones:
# Primary server for domain gigacoms.info (specify zone type explicitly)
- name: 'local.mrwho.ru'
type: primary
primaries:
- 212.60.5.162
certbot_key: "CerbotKey"
also_notify:
- 212.60.5.162
- 80.211.195.127
name_servers:
- ns1.mrwho.ru.
- ns2.mrwho.ru.
hosts:
- name: local.mrwho.ru.
ip: 172.20.21.100
- name: router
ip: 172.20.21.100
- name: ca
ip: 172.20.21.99
- name: opensearch
ip: 172.20.21.101
- name: uyuni
ip: 172.20.21.102
- name: vault
ip: 172.20.21.103
- name: gitlab
ip: 172.20.21.104
- name: git
ip: 172.20.21.105

14
playbooks/mrwho/ns1.yml → playbooks/mrwho/dns-primary.yml
View file

@ -22,7 +22,7 @@
named_allow_transfer:
- "Transfer"
named_dns_keys:
- name: CerbotKey
- name: CertbotKey
algorithm: hmac-sha512
secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA==
named_extra_include_files:
@ -50,7 +50,7 @@
type: primary
primaries:
- 212.60.5.162
certbot_key: "CerbotKey"
certbot_key: "CertbotKey"
also_notify:
- 80.211.195.127
name_servers:
@ -98,8 +98,6 @@
- name: git
ip: 212.60.5.162
ipv6: 2a00:b700:3::286
- name: git.local
aliases: git
mail_servers:
- name: ASPMX.L.GOOGLE.COM.
preference: 10
@ -130,7 +128,8 @@
type: primary
primaries:
- 212.60.5.162
certbot_key: "CerbotKey"
allow_update:
- key "CertbotKey"
also_notify:
- 80.211.195.127
name_servers:
@ -149,7 +148,7 @@
type: primary
primaries:
- 212.60.5.162
certbot_key: "CerbotKey"
certbot_key: "CertbotKey"
also_notify:
- 80.211.195.127
name_servers:
@ -167,7 +166,8 @@
type: primary
primaries:
- 212.60.5.162
certbot_key: "CerbotKey"
allow_update:
- key "CertbotKey"
also_notify:
- 80.211.195.127
name_servers:

0
playbooks/mrwho/ns2.yml → playbooks/mrwho/dns-secondary.yml
View file

7
playbooks/mrwho/router-certbot.yml
View file

@ -18,17 +18,16 @@
certbot_delete_certs: false
certbot_certs:
- domains:
- local.mrwho.ru
- "*.mrwho.ru"
- "*.local.mrwho.ru"
certbot_testmode: false
# Generate key with: tsig-keygen -a HMAC-SHA512 CertbotKey
certbot_dns_plugin: rfc2136
certbot_dns_target_server:
certbot_dns_target_server: 212.60.5.162
certbot_dns_target_server_port: 53
certbot_dns_tsig_keyname: CertbotKey
certbot_dns_key_secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA==
certbot_dns_key_algorithm: HMAC-SHA256
certbot_dns_key_secret: "as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA=="
certbot_dns_key_algorithm: HMAC-SHA512
roles:
- certbot-dns

12
playbooks/mrwho/router-nginx.yml
View file

@ -15,9 +15,11 @@
pki_dir: /etc/nginx/certs
nginx_webroot: /var/www
local_http_port: 8080
nginx_letsencrypt_managed: true
letsencrypt_acme_install: true
nginx_letsencrypt_managed: false
letsencrypt_acme_install: false
letsencrypt_acme_certs_dir: /etc/letsencrypt/live
nginx_ssl_cert_file: '/etc/letsencrypt/live/mrwho.ru/fullchain.pem'
nginx_ssl_cert_key: '/etc/letsencrypt/live/mrwho.ru/privkey.pem'
nginx_conf_snippets:
- nginx-compression.conf
- nginx-proxy-params.conf
@ -39,13 +41,13 @@
nginx_virthosts:
- virthost_name: git.local.mrwho.ru
listen: "80"
server_name: git.local.mrwho.ru
server_aliases: git.mrwho.ru
server_name: git.mrwho.ru
serveraliases: git.local.mrwho.ru
# index: index.php
# error_page: /path_to_error_page.html
ssl_enabled: true
ssl_only: true
ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}"
# ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}"
# root: "{{ nginx_webroot }}"
server_tokens: "off"
proxy_standard_setup: true

33
playbooks/mrwho/vm02-certbot.yml Normal file
View file

@ -0,0 +1,33 @@
---
- name: Install and configure Certbot
hosts: vm02
become: true
gather_facts: true
vars:
certbot_install_method: package
certbot_admin_email: mrwho@mrwho.ru
certbot_auto_renew: true
certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
certbot_auto_renew_hour: "5"
certbot_auto_renew_minute: "{{ 59 |random(seed=inventory_hostname) }}" # random number between 0-59
certbot_auto_renew_options: --quiet --no-self-upgrade
certbot_create_reload_services:
- nginx
certbot_create_if_missing: true
certbot_delete_certs: false
certbot_certs:
- domains:
- "*.mrwho.ru"
- "*.local.mrwho.ru"
certbot_testmode: false
# Generate key with: tsig-keygen -a HMAC-SHA512 CertbotKey
certbot_dns_plugin: rfc2136
certbot_dns_target_server: 212.60.5.162
certbot_dns_target_server_port: 53
certbot_dns_tsig_keyname: CertbotKey
certbot_dns_key_secret: "as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA=="
certbot_dns_key_algorithm: HMAC-SHA512
roles:
- certbot-dns

14
roles/named/tasks/main.yml
View file

@ -103,7 +103,7 @@
group: "{{ named_group }}"
mode: "0640"
setype: named_conf_t
validate: named-checkconf %s
# validate: named-checkconf %s
become: true
notify: Reload bind
tags: bind
@ -116,9 +116,9 @@
become: true
tags: bind
- name: Permit DNS traffic in firewalld
ansible.posix.firewalld:
service: dns
permanent: true
state: enabled
immediate: true
# - name: Permit DNS traffic in firewalld
# ansible.posix.firewalld:
# service: dns
# permanent: true
# state: enabled
# immediate: true

2
roles/named/templates/etc_named.conf.j2
View file

@ -156,7 +156,7 @@ zone "{{ named_zone.name }}" IN {
also-notify { {{ named_zone.also_notify|join('; ') }}; };
{% endif %}
{% if named_zone.certbot_key is defined %}
update-policy { grant {{ named_zone.certbot_key }} name _acme-challenge.{{ named_zone.name }}. txt; };
update-policy { grant {{ named_zone.certbot_key }} zonesub TXT; };
{% endif %}
{% if named_zone.allow_update is defined %}
allow-update { {{ named_zone.allow_update|join('; ') }}; };