Compare commits
170 Commits
import-den
...
production
Author | SHA1 | Date | |
---|---|---|---|
8231c71927 | |||
00e7832e9d | |||
47c7b56e86 | |||
f46758fe53 | |||
b7ffc08af9 | |||
6d931c54cb | |||
46f5fd365c | |||
931403de64 | |||
f26bace747 | |||
3c1cb027ba | |||
95edd4bcb4 | |||
b454b5f5b9 | |||
b2aa0317e5 | |||
10e380c3c1 | |||
0e3300bb49 | |||
fd68a06188 | |||
f0a2afc714 | |||
14109af928 | |||
e91ce0f58f | |||
e8a5ec5594 | |||
90abdc179b | |||
4df811c834 | |||
32a0f8d653 | |||
0df71b4331 | |||
13d5e44baa | |||
beec7cde28 | |||
fb981646e5 | |||
5d4350aed3 | |||
b6e9f75352 | |||
40b7913d32 | |||
24d6de3a5d | |||
8b735d45e2 | |||
e03e939bf9 | |||
4778c43503 | |||
dc3cbea053 | |||
c7e590843f | |||
29ceb78cde | |||
fffbaf4698 | |||
8519dfec68 | |||
b73c0805cd | |||
080002e642 | |||
1bd2f39312 | |||
58c100acc1 | |||
47a364290c | |||
b36dc960c8 | |||
ddf1c03dbb | |||
f4f7f93583 | |||
7145ae4481 | |||
937b3c99b7 | |||
667646a295 | |||
36c70f4016 | |||
97045b5f12 | |||
ffbd2dc4c3 | |||
c1fcf5f3b1 | |||
ac0a2b6587 | |||
b6b129c41f | |||
774706211e | |||
2ce85f172e | |||
ffe1e60baf | |||
c4532b4686 | |||
3143bfd96d | |||
d89138e2a7 | |||
05d86ce689 | |||
55acb1dea4 | |||
9f176609a5 | |||
409016ea75 | |||
8776b16be1 | |||
6763d1b64e | |||
d4d7d41ca7 | |||
16827d7318 | |||
51e33815df | |||
bfeeb8673e | |||
de9ac40e3f | |||
c951f48b71 | |||
f96e9a4901 | |||
75c91e72cb | |||
2a9a5cf394 | |||
1089146801 | |||
27d178d852 | |||
841317e0f4 | |||
5f1793547b | |||
942b71815e | |||
edd16ff3a7 | |||
1290fd5ec7 | |||
f56ed6f64e | |||
d8263f9b80 | |||
269b30ce9f | |||
21f8818a52 | |||
985b401aaa | |||
65af33d4fb | |||
4053be45d2 | |||
8d9af70941 | |||
ef0a931157 | |||
d8359f002d | |||
938be46faf | |||
0a3d34d962 | |||
600a73a984 | |||
b0613cf377 | |||
b7f34f8b9d | |||
b685f16c91 | |||
f90197f791 | |||
e8107a3054 | |||
524c82cafa | |||
d4f39e8e5f | |||
a7cd6609e6 | |||
d65cb9a43b | |||
b1249e69eb | |||
87bb69fa37 | |||
76d1da11d9 | |||
f32d814658 | |||
a6319da822 | |||
9d9e61d51d | |||
8420bbdf6f | |||
508c0dc1b2 | |||
6ebd02042f | |||
4ff7a39f0e | |||
bf3aaa5ff1 | |||
96daffc979 | |||
84c1cecf61 | |||
c932881cd7 | |||
a1ce36fd6c | |||
c28a4f5a52 | |||
361e118b31 | |||
f55e5363a0 | |||
edbf9f3f20 | |||
f820978b78 | |||
4653655010 | |||
d8d848055f | |||
e36d40dbc3 | |||
5e0c0e4bff | |||
906dd92d7e | |||
e58c63decc | |||
cc007e6470 | |||
c8c91269fd | |||
ddb72f1cb3 | |||
0730cbb4c2 | |||
cade9c0aca | |||
8016f86164 | |||
2bafbeedd7 | |||
979021f5c4 | |||
cdd09ed524 | |||
a705925aa6 | |||
0c8e3159d3 | |||
6e43bbbe44 | |||
68e41ceab8 | |||
d082729a66 | |||
51da14de69 | |||
18d28c3b7f | |||
cd93d792ff | |||
36b1fbffb2 | |||
6096be0f81 | |||
2674d21efc | |||
2c2a37ef8b | |||
c75e31c145 | |||
f69cd00888 | |||
37a1ec433a | |||
29435f6fc3 | |||
75f105a6aa | |||
0a00f3ea93 | |||
2d5da24ce5 | |||
7e73f6b1a4 | |||
0eca62f4ce | |||
91089d5d98 | |||
eac227d120 | |||
f9341ad9fe | |||
d017233a52 | |||
5fdbdc7462 | |||
533aedd864 | |||
7481741f95 | |||
8c21d250c3 |
23
.gommit.toml
Normal file
23
.gommit.toml
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
[config]
|
||||||
|
exclude-merge-commits=true
|
||||||
|
check-summary-length=true
|
||||||
|
summary-length=50
|
||||||
|
|
||||||
|
[matchers]
|
||||||
|
all='^(?:(?:Add|Remove|Update|Enable|Disable) |(?:role|profile|id|pipeline)\.[\w\-_]+: )[\w \.\+\-]+\n(?:(?:\n\- .*)+\n)?(?:\nSigned-off-by: \w+ \w+ <.*@.*>)'
|
||||||
|
|
||||||
|
[examples]
|
||||||
|
summary_variant_one="""
|
||||||
|
[Add|Remove|Update|Enable|Disable] this and that
|
||||||
|
"""
|
||||||
|
|
||||||
|
summary_variant_two="""
|
||||||
|
[role.$role|profile.$profile]: this and that
|
||||||
|
"""
|
||||||
|
|
||||||
|
body_message="""
|
||||||
|
- an optional body line
|
||||||
|
- another optional body line
|
||||||
|
|
||||||
|
Signed-off-by: Max Mandatory <required@example.com>
|
||||||
|
"""
|
@ -1,9 +1,32 @@
|
|||||||
|
---
|
||||||
|
# yamllint disable rule:line-length
|
||||||
skip_clone: true
|
skip_clone: true
|
||||||
|
|
||||||
pipeline:
|
pipeline:
|
||||||
|
# commit_lint:
|
||||||
|
# image: registry.opensuse.org/home/crameleon/libertacasa/containers/containerfile/libertacasa/pipeline-gommit:latest
|
||||||
|
# secrets: [ci_netrc_username, ci_netrc_password, ci_netrc_machine]
|
||||||
|
# when:
|
||||||
|
# event: [push]
|
||||||
|
# commands:
|
||||||
|
# - git clone --single-branch -b $CI_COMMIT_BRANCH $CI_REPO_LINK ../salt-libertacasa-commit-linting
|
||||||
|
# - cd ../salt-libertacasa-commit-linting
|
||||||
|
# - bin/lint-commits.pl production
|
||||||
|
|
||||||
|
code_lint:
|
||||||
|
image: registry.opensuse.org/home/crameleon/libertacasa/containers/containerfile/libertacasa/pipeline-lint:latest
|
||||||
|
secrets: [ci_netrc_username, ci_netrc_password, ci_netrc_machine]
|
||||||
|
when:
|
||||||
|
event: [push]
|
||||||
|
commands:
|
||||||
|
- git clone --single-branch -b $CI_COMMIT_BRANCH $CI_REPO_LINK ../salt-libertacasa-linting
|
||||||
|
- cd ../salt-libertacasa-linting
|
||||||
|
- find . -type f \( -name '*.yaml' -o -name '*.yml' \) -exec yamllint -f colored -s {} +
|
||||||
|
- find . -name '*.sls' -exec salt-lint --severity -x 204 {} +
|
||||||
|
|
||||||
check:
|
check:
|
||||||
image: registry.opensuse.org/home/crameleon/libertacasa/containers/containerfile/libertacasa/pipeline:latest
|
image: registry.opensuse.org/home/crameleon/libertacasa/containers/containerfile/libertacasa/pipeline:latest
|
||||||
secrets: [ ci_netrc_username, ci_netrc_password, ci_netrc_machine ]
|
secrets: [ci_netrc_username, ci_netrc_password, ci_netrc_machine]
|
||||||
when:
|
when:
|
||||||
event: [push]
|
event: [push]
|
||||||
commands:
|
commands:
|
||||||
@ -29,5 +52,5 @@ pipeline:
|
|||||||
event: [push]
|
event: [push]
|
||||||
instance: woodpecker-orpheus.intranet.squirrelcube.com
|
instance: woodpecker-orpheus.intranet.squirrelcube.com
|
||||||
commands:
|
commands:
|
||||||
#- rolesyncer
|
# - rolesyncer
|
||||||
- bin/rolesyncer.py
|
- bin/rolesyncer.py
|
||||||
|
39
bin/lint-commits.pl
Executable file
39
bin/lint-commits.pl
Executable file
@ -0,0 +1,39 @@
|
|||||||
|
#!/usr/bin/perl
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
#
|
||||||
|
use v5.26;
|
||||||
|
|
||||||
|
my ($branch_main) = @ARGV;
|
||||||
|
|
||||||
|
if(!$branch_main){
|
||||||
|
$branch_main = "master"
|
||||||
|
}
|
||||||
|
|
||||||
|
`git ls-remote origin $branch_main` =~ /([a-f0-9]{40})/;
|
||||||
|
|
||||||
|
my $refHead = `git rev-parse HEAD`;
|
||||||
|
my $refTail = $1;
|
||||||
|
|
||||||
|
chomp($refHead);
|
||||||
|
chomp($refTail);
|
||||||
|
|
||||||
|
if ($refHead eq $refTail) {
|
||||||
|
exit 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
system "gommit check range $refTail $refHead";
|
||||||
|
|
||||||
|
if ($? > 0) {
|
||||||
|
exit 1;
|
||||||
|
}
|
@ -1,4 +1,14 @@
|
|||||||
#!/usr/bin/env sh
|
#!/usr/bin/env sh
|
||||||
# This rewrites top-files to fetch roles from grains instead of our custom roles API. Useful for testing outside of the LibertaCasa infrastructure, but not recommended for production.
|
# This rewrites top-files to fetch roles from grains instead of our custom roles API. Useful for testing outside of the LibertaCasa infrastructure, but not recommended for production.
|
||||||
|
|
||||||
sed -i "s/salt\['http.query'\].*/grains\['roles'\] -%}/" */top.sls
|
potential_files=(*/top.sls salt/common/suse.sls)
|
||||||
|
|
||||||
|
for file in ${potential_files[@]}
|
||||||
|
do
|
||||||
|
if [ -f "$file" ]
|
||||||
|
then
|
||||||
|
files+="$file "
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
sed -i "s/salt\['http.query'\].*/grains\['roles'\] -%}/" ${files[@]}
|
||||||
|
@ -15,6 +15,7 @@ keepalived:
|
|||||||
smtp_server: {{ mailer }}
|
smtp_server: {{ mailer }}
|
||||||
smtp_connect_timeout: 30
|
smtp_connect_timeout: 30
|
||||||
router_id: SSO_FO
|
router_id: SSO_FO
|
||||||
|
enable_script_security: true
|
||||||
vrrp_script:
|
vrrp_script:
|
||||||
check_nginx_port:
|
check_nginx_port:
|
||||||
script: '"/usr/bin/curl -kfsSm2 https://[::1]:443"'
|
script: '"/usr/bin/curl -kfsSm2 https://[::1]:443"'
|
||||||
@ -89,18 +90,15 @@ nginx:
|
|||||||
{{ nginx_crtkeypair('lysergic', 'lysergic.dev') | indent }}
|
{{ nginx_crtkeypair('lysergic', 'lysergic.dev') | indent }}
|
||||||
- include: snippets/tls
|
- include: snippets/tls
|
||||||
tls_syscidsso:
|
tls_syscidsso:
|
||||||
- ssl_trusted_certificate: {{ trustcrt }}
|
|
||||||
- ssl_client_certificate: {{ trustcrt }}
|
- ssl_client_certificate: {{ trustcrt }}
|
||||||
- ssl_certificate: /etc/ssl/syscid/sso.syscid.com.crt
|
- ssl_certificate: /etc/ssl/syscid/sso.syscid.com.crt
|
||||||
- ssl_certificate_key: /etc/ssl/syscid/sso.syscid.com.key
|
- ssl_certificate_key: /etc/ssl/syscid/sso.syscid.com.key
|
||||||
- ssl_ocsp: 'on'
|
- ssl_ocsp: 'on'
|
||||||
- ssl_ocsp_responder: {{ stapler }}
|
- ssl_ocsp_responder: {{ stapler }}
|
||||||
- ssl_stapling: 'on'
|
|
||||||
- ssl_stapling_responder: {{ stapler }}
|
- ssl_stapling_responder: {{ stapler }}
|
||||||
- ssl_stapling_verify: 'on'
|
|
||||||
- ssl_verify_client: 'on'
|
- ssl_verify_client: 'on'
|
||||||
- resolver: {{ resolver }} ipv6=off
|
- resolver: {{ resolver }} ipv6=off
|
||||||
- include: snippets.d/tls
|
- include: snippets/tls
|
||||||
|
|
||||||
servers:
|
servers:
|
||||||
managed:
|
managed:
|
||||||
@ -110,7 +108,7 @@ nginx:
|
|||||||
- proxy_cache_path: /var/cache/nginx/sso_public keys_zone=cache_sso_public:10m
|
- proxy_cache_path: /var/cache/nginx/sso_public keys_zone=cache_sso_public:10m
|
||||||
- proxy_cache_path: /var/cache/nginx/sso_private keys_zone=cache_sso_private:10m
|
- proxy_cache_path: /var/cache/nginx/sso_private keys_zone=cache_sso_private:10m
|
||||||
- upstream jboss:
|
- upstream jboss:
|
||||||
- ip: hash
|
- ip_hash: ''
|
||||||
- server:
|
- server:
|
||||||
- theia.backend.syscid.com:8443
|
- theia.backend.syscid.com:8443
|
||||||
- orpheus.backend.syscid.com:8443
|
- orpheus.backend.syscid.com:8443
|
||||||
@ -120,13 +118,18 @@ nginx:
|
|||||||
config:
|
config:
|
||||||
- server:
|
- server:
|
||||||
- include:
|
- include:
|
||||||
- snippets/listen
|
- snippets/listen_ha
|
||||||
- snippets/tls_libertacasa
|
- snippets/tls_libertacasa
|
||||||
- server_name: libertacasa.info libcasa.info
|
- server_name: libertacasa.info libcasa.info
|
||||||
- location /:
|
- location /:
|
||||||
- proxy_pass: https://bookstack.themis.backend.syscid.com
|
- proxy_pass: https://bookstack.themis.backend.syscid.com
|
||||||
- proxy_http_version: 1.1
|
- proxy_http_version: 1.1
|
||||||
- client_max_body_size: 20M
|
- client_max_body_size: 20M
|
||||||
|
- modsecurity_rules: |-
|
||||||
|
'
|
||||||
|
SecRuleRemoveById 941160 949110
|
||||||
|
SecAction "id:900200, phase:1, nolog, pass, t:none, setvar:\'tx.allowed_methods=GET HEAD POST OPTIONS PUT PATCH\'"
|
||||||
|
'
|
||||||
|
|
||||||
http.conf:
|
http.conf:
|
||||||
config:
|
config:
|
||||||
@ -142,19 +145,23 @@ nginx:
|
|||||||
config:
|
config:
|
||||||
- server:
|
- server:
|
||||||
- include:
|
- include:
|
||||||
- snippets/listen
|
- snippets/listen_ha
|
||||||
- snippets/tls_lysergic
|
- snippets/tls_lysergic
|
||||||
- server_name: pasta.lysergic.dev
|
- server_name: pasta.lysergic.dev
|
||||||
- location /:
|
- location /:
|
||||||
- proxy_pass: https://privatebin.themis.backend.syscid.com
|
- proxy_pass: https://privatebin.themis.backend.syscid.com
|
||||||
- proxy_http_version: 1.1
|
- proxy_http_version: 1.1
|
||||||
- client_max_body_size: 50M
|
- client_max_body_size: 50M
|
||||||
|
- modsecurity_rules: |-
|
||||||
|
'
|
||||||
|
SecRequestBodyNoFilesLimit 50000000
|
||||||
|
'
|
||||||
|
|
||||||
sso_private.conf:
|
sso_private.conf:
|
||||||
config:
|
config:
|
||||||
- server:
|
- server:
|
||||||
- include:
|
- include:
|
||||||
- snippets/listen
|
- snippets/listen_ha
|
||||||
- snippets/tls_syscidsso
|
- snippets/tls_syscidsso
|
||||||
- server_name: sso.syscid.com
|
- server_name: sso.syscid.com
|
||||||
- root: /srv/www/sso.syscid.com
|
- root: /srv/www/sso.syscid.com
|
||||||
@ -174,14 +181,14 @@ nginx:
|
|||||||
config:
|
config:
|
||||||
- server:
|
- server:
|
||||||
- include:
|
- include:
|
||||||
- snippets/listen
|
- snippets/listen_ha
|
||||||
- snippets/tls_libsso
|
- snippets/tls_libsso
|
||||||
- server_name: sso.casa www.sso.casa
|
- server_name: sso.casa www.sso.casa
|
||||||
- location /:
|
- location /:
|
||||||
- root: /srv/www/sso.casa
|
- root: /srv/www/sso.casa
|
||||||
- server:
|
- server:
|
||||||
- include:
|
- include:
|
||||||
- snippets/listen
|
- snippets/listen_ha
|
||||||
- snippets/tls_libsso
|
- snippets/tls_libsso
|
||||||
- server_name: libsso.net www.libsso.net
|
- server_name: libsso.net www.libsso.net
|
||||||
- location /:
|
- location /:
|
||||||
@ -204,3 +211,30 @@ nginx:
|
|||||||
- proxy_busy_buffers_size: 512k
|
- proxy_busy_buffers_size: 512k
|
||||||
- error_log: /var/log/nginx/libsso_public.error.log
|
- error_log: /var/log/nginx/libsso_public.error.log
|
||||||
- access_log: /var/log/nginx/libsso_public.access.log combined
|
- access_log: /var/log/nginx/libsso_public.access.log combined
|
||||||
|
|
||||||
|
agola.conf:
|
||||||
|
config:
|
||||||
|
- server:
|
||||||
|
- include:
|
||||||
|
- snippets/listen_ha
|
||||||
|
- snippets/tls_lysergic
|
||||||
|
- server_name: ci.lysergic.dev ci.git.com.de
|
||||||
|
- location /:
|
||||||
|
- proxy_pass: https://ci.lysergic.dev
|
||||||
|
- proxy_ssl_verify: 'on'
|
||||||
|
- include: snippets/proxy
|
||||||
|
|
||||||
|
manage_firewall: True
|
||||||
|
firewalld:
|
||||||
|
zones:
|
||||||
|
public:
|
||||||
|
services:
|
||||||
|
- http
|
||||||
|
- https
|
||||||
|
|
||||||
|
profile:
|
||||||
|
apparmor:
|
||||||
|
local:
|
||||||
|
usr.sbin.nginx:
|
||||||
|
- '{{ trustcrt }} r,'
|
||||||
|
- '/srv/www/{libsso.net,sso.casa,sso.syscid.com}/{index.html,stuff/tacit-css-1.5.2.min.css} r,'
|
||||||
|
@ -1,8 +1,13 @@
|
|||||||
|
---
|
||||||
|
- apache
|
||||||
- firewalld
|
- firewalld
|
||||||
- keepalived
|
- keepalived
|
||||||
|
- memcached
|
||||||
- nginx
|
- nginx
|
||||||
- openssh
|
- openssh
|
||||||
|
- php
|
||||||
- postfix
|
- postfix
|
||||||
|
- prometheus
|
||||||
- salt
|
- salt
|
||||||
- tor
|
- tor
|
||||||
- users
|
- users
|
||||||
|
@ -15,6 +15,7 @@ zypper:
|
|||||||
refreshdb_force: False
|
refreshdb_force: False
|
||||||
|
|
||||||
firewalld:
|
firewalld:
|
||||||
|
FlushAllOnReload: 'yes'
|
||||||
zones:
|
zones:
|
||||||
internal:
|
internal:
|
||||||
short: Internal
|
short: Internal
|
||||||
|
1
pillar/id/dencpod01_lysergic_dev.sls
Normal file
1
pillar/id/dencpod01_lysergic_dev.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
manage_firewall: True
|
@ -1,4 +1,4 @@
|
|||||||
{%- set mediapath = '/srv/matterbridge/' -%}
|
{%- set mediapath = '/var/lib/matterbridge/' -%}
|
||||||
|
|
||||||
{%- macro discord_common() -%}
|
{%- macro discord_common() -%}
|
||||||
AutoWebhooks: 'true'
|
AutoWebhooks: 'true'
|
||||||
@ -34,12 +34,12 @@ profile:
|
|||||||
Password: ${'secret_matterbridge:general:accounts:xmpp.libertacasa:Password'}
|
Password: ${'secret_matterbridge:general:accounts:xmpp.libertacasa:Password'}
|
||||||
Muc: muc.liberta.casa
|
Muc: muc.liberta.casa
|
||||||
Nick: viaduct
|
Nick: viaduct
|
||||||
RemoteNickFormat: '[{PROTOCOL}] <{NICK}>'
|
RemoteNickFormat: '[{PROTOCOL}] <{NICK}> '
|
||||||
Label: x
|
Label: x
|
||||||
Debug: 'false'
|
Debug: 'false'
|
||||||
telegram.libertacasa:
|
telegram.libertacasa:
|
||||||
Token: ${'secret_matterbridge:general:accounts:telegram.libertacasa:Token'}
|
Token: ${'secret_matterbridge:general:accounts:telegram.libertacasa:Token'}
|
||||||
RemoteNickFormat: '<{NICK}> '
|
RemoteNickFormat: '[{PROTOCOL}] <{NICK}> '
|
||||||
MessageFormat: HTMLNick
|
MessageFormat: HTMLNick
|
||||||
Label: tg
|
Label: tg
|
||||||
DisableWebPagePreview: 'true'
|
DisableWebPagePreview: 'true'
|
||||||
@ -47,7 +47,7 @@ profile:
|
|||||||
Server: 192.168.0.110:2220
|
Server: 192.168.0.110:2220
|
||||||
Nick: LC
|
Nick: LC
|
||||||
RemoteNickFormat: '{PROTOCOL}:<{NICK}> '
|
RemoteNickFormat: '{PROTOCOL}:<{NICK}> '
|
||||||
Label: p
|
Label: ssh
|
||||||
discord.23:
|
discord.23:
|
||||||
Token: ${'secret_matterbridge:general:accounts:discord.23:Token'}
|
Token: ${'secret_matterbridge:general:accounts:discord.23:Token'}
|
||||||
Server: ${'secret_matterbridge:general:accounts:discord.23:Server'}
|
Server: ${'secret_matterbridge:general:accounts:discord.23:Server'}
|
||||||
@ -61,7 +61,6 @@ profile:
|
|||||||
gateways:
|
gateways:
|
||||||
libcasa:
|
libcasa:
|
||||||
irc.libertacasa: '#libcasa'
|
irc.libertacasa: '#libcasa'
|
||||||
sshchat.Psyched: sshchat
|
|
||||||
xmpp.libertacasa: libcasa
|
xmpp.libertacasa: libcasa
|
||||||
dev:
|
dev:
|
||||||
irc.libertacasa: '#dev'
|
irc.libertacasa: '#dev'
|
||||||
@ -69,22 +68,19 @@ profile:
|
|||||||
lucy:
|
lucy:
|
||||||
irc.libertacasa: '#lucy'
|
irc.libertacasa: '#lucy'
|
||||||
xmpp.libertacasa: lucy
|
xmpp.libertacasa: lucy
|
||||||
|
telegram.libertacasa: '-1001795702961'
|
||||||
|
sshchat.Psyched: sshchat
|
||||||
info:
|
info:
|
||||||
irc.libertacasa: '#libcasa.info'
|
irc.libertacasa: '#libcasa.info'
|
||||||
xmpp.libertacasa: libcasa.info
|
xmpp.libertacasa: libcasa.info
|
||||||
#telegram.libertacasa: '-1001518274267'
|
|
||||||
chat:
|
chat:
|
||||||
irc.libertacasa: '#chai'
|
irc.libertacasa: '#chat'
|
||||||
discord.23: chat
|
discord.23: chat
|
||||||
xmpp.libertacasa: chat
|
xmpp.libertacasa: chat
|
||||||
dota:
|
petals:
|
||||||
irc.libertacasa: '#dotes'
|
irc.libertacasa: '#Petals'
|
||||||
discord.23: dotes
|
telegram.libertacasa: '-1001971550949'
|
||||||
xmpp.libertacasa: dota
|
|
||||||
aithunder:
|
|
||||||
irc.libertacasa: '#aithunder'
|
|
||||||
# discord.aithunder: main-chat
|
|
||||||
xmpp.libertacasa: aithunder
|
|
||||||
|
|
||||||
libertacasa-irc:
|
libertacasa-irc:
|
||||||
general:
|
general:
|
||||||
@ -215,24 +211,61 @@ profile:
|
|||||||
nerds:
|
nerds:
|
||||||
irc.libertacasa: '#nerds'
|
irc.libertacasa: '#nerds'
|
||||||
irc.nerds: '#nerds'
|
irc.nerds: '#nerds'
|
||||||
chillops:
|
|
||||||
irc.libertacasa: '#chillops'
|
|
||||||
irc.chillnet: '#chillops'
|
|
||||||
irc.stardust: '#chillnet-test'
|
|
||||||
music:
|
music:
|
||||||
irc.libertacasa: '#music'
|
irc.libertacasa: '#music'
|
||||||
irc.chillnet: '#music'
|
irc.chillnet: '#music'
|
||||||
irc.stardust: '#music'
|
irc.stardust: '#music'
|
||||||
|
chillnet:
|
||||||
|
general:
|
||||||
|
MediaDownloadSize: 1000000000
|
||||||
|
MediaDownloadPath: {{ mediapath }}chillnet
|
||||||
|
MediaServerDownload: https://up.chillnet.org
|
||||||
|
accounts:
|
||||||
|
irc.chillnet:
|
||||||
|
Server: irc.chillnet.org:6697
|
||||||
|
UseTLS: 'true'
|
||||||
|
UseSASL: 'true'
|
||||||
|
Nick: viaduct
|
||||||
|
NickServNick: viaduct
|
||||||
|
NickServPassword: ${'secret_matterbridge:chillnet:accounts:irc.chillnet:NickServPassword'}
|
||||||
|
ColorNicks: 'true'
|
||||||
|
Charset: utf8
|
||||||
|
MessageSplit: 'true'
|
||||||
|
MessageQueue: 60
|
||||||
|
UseRelayMsg: 'true'
|
||||||
|
RemoteNickFormat: '{NICK}/{LABEL}'
|
||||||
|
telegram.chillnet:
|
||||||
|
Token: ${'secret_matterbridge:chillnet:accounts:telegram.chillnet:Token'}
|
||||||
|
RemoteNickFormat: '<{NICK}> '
|
||||||
|
MessageFormat: HTMLNick
|
||||||
|
Label: tg
|
||||||
|
DisableWebPagePreview: 'true'
|
||||||
|
discord.23:
|
||||||
|
Token: ${'secret_matterbridge:general:accounts:discord.23:Token'}
|
||||||
|
Server: ${'secret_matterbridge:general:accounts:discord.23:Server'}
|
||||||
|
{{ discord_common() }}
|
||||||
|
gateways:
|
||||||
|
staff:
|
||||||
|
irc.chillnet: '#chillstaff'
|
||||||
|
telegram.chillnet: '-1001932699309'
|
||||||
|
devs:
|
||||||
|
irc.chillnet: '#chilldevs'
|
||||||
|
telegram.chillnet: '-1001778806358'
|
||||||
|
discord.23: chilldevs
|
||||||
|
|
||||||
lighttpd:
|
lighttpd:
|
||||||
vhosts:
|
vhosts:
|
||||||
matterbridge-general:
|
matterbridge-general:
|
||||||
host: 'libertacasa-general\.matterbridge\.dericom02\.rigel\.lysergic\.dev'
|
host: 'libertacasa-general.matterbridge.dericom02.rigel.lysergic.dev'
|
||||||
root: {{ mediapath }}libertacasa-general
|
root: {{ mediapath }}libertacasa-general
|
||||||
matterbridge-irc:
|
matterbridge-irc:
|
||||||
host: 'libertacasa-irc\.matterbridge\.dericom02\.rigel\.lysergic\.dev'
|
host: 'libertacasa-irc.matterbridge.dericom02.rigel.lysergic.dev'
|
||||||
root: {{ mediapath }}libertacasa-irc
|
root: {{ mediapath }}libertacasa-irc
|
||||||
|
matterbridge-chillnet:
|
||||||
|
host: 'chillnet.matterbridge.dericom02.rigel.lysergic.dev'
|
||||||
|
root: {{ mediapath }}chillnet
|
||||||
|
|
||||||
|
manage_firewall: True
|
||||||
firewalld:
|
firewalld:
|
||||||
zones:
|
zones:
|
||||||
web:
|
web:
|
||||||
|
1
pillar/id/derigsm01_rigel_lysergic_dev.sls
Normal file
1
pillar/id/derigsm01_rigel_lysergic_dev.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
manage_firewall: True
|
@ -12,3 +12,5 @@ tor:
|
|||||||
hostname: cr36xbvmgjwnfw4sly4kuc6c3ozhesjre3y5pggq5xdkkmbrq6dz4fad.onion
|
hostname: cr36xbvmgjwnfw4sly4kuc6c3ozhesjre3y5pggq5xdkkmbrq6dz4fad.onion
|
||||||
hs_ed25519_public_key: PT0gZWQyNTUxOXYxLXB1YmxpYzogdHlwZTAgPT0AAAAUd+uGrDJs0tuSXjiqC8LbsnJJMSbx15jQ7calMDGHhw==
|
hs_ed25519_public_key: PT0gZWQyNTUxOXYxLXB1YmxpYzogdHlwZTAgPT0AAAAUd+uGrDJs0tuSXjiqC8LbsnJJMSbx15jQ7calMDGHhw==
|
||||||
hs_ed25519_secret_key: ${'secret_tor:hidden_services:irc:key'}
|
hs_ed25519_secret_key: ${'secret_tor:hidden_services:irc:key'}
|
||||||
|
|
||||||
|
manage_firewall: True
|
||||||
|
@ -44,15 +44,15 @@
|
|||||||
- proxy_set_header: Host $http_host
|
- proxy_set_header: Host $http_host
|
||||||
- resolver: '{{ resolver }} ipv4=off valid=24h'
|
- resolver: '{{ resolver }} ipv4=off valid=24h'
|
||||||
{%- endmacro -%}
|
{%- endmacro -%}
|
||||||
{%- macro matterbridge_media(name) -%}
|
{%- macro matterbridge_media(domain, name, tls='load') -%}
|
||||||
- server:
|
- server:
|
||||||
- include:
|
- include:
|
||||||
- snippets/listen
|
- snippets/listen
|
||||||
- snippets/tls_load
|
- snippets/tls_{{ tls }}
|
||||||
- snippets/tls
|
- snippets/tls
|
||||||
- server_name: {% if name == 'general' %}load.casa{%- else %}{{ name ~ '.load.casa' }}{%- endif %}
|
- server_name: {{ domain }}
|
||||||
- location /:
|
- location /:
|
||||||
- proxy_pass: http://libertacasa-{{ name }}.matterbridge.dericom02.rigel.lysergic.dev
|
- proxy_pass: http://{{ name }}.matterbridge.dericom02.rigel.lysergic.dev
|
||||||
{%- endmacro -%}
|
{%- endmacro -%}
|
||||||
|
|
||||||
nginx:
|
nginx:
|
||||||
@ -71,6 +71,7 @@ nginx:
|
|||||||
{{ nginx_crtkeypair('meet', 'meet.com.de') | indent }}
|
{{ nginx_crtkeypair('meet', 'meet.com.de') | indent }}
|
||||||
{{ nginx_crtkeypair('takahe', 'social.liberta.casa') | indent }}
|
{{ nginx_crtkeypair('takahe', 'social.liberta.casa') | indent }}
|
||||||
{{ nginx_crtkeypair('pub_sectigo', 'pub') | indent }}
|
{{ nginx_crtkeypair('pub_sectigo', 'pub') | indent }}
|
||||||
|
{{ nginx_crtkeypair('up.chillnet.org', 'up.chillnet.org') | indent }}
|
||||||
|
|
||||||
{#- locations shared between clearnet and Tor LibertaCasa servers #}
|
{#- locations shared between clearnet and Tor LibertaCasa servers #}
|
||||||
libertacasa:
|
libertacasa:
|
||||||
@ -316,8 +317,9 @@ nginx:
|
|||||||
|
|
||||||
matterbridge.conf:
|
matterbridge.conf:
|
||||||
config:
|
config:
|
||||||
{{ matterbridge_media('general') }}
|
{{ matterbridge_media('load.casa', 'libertacasa-general') }}
|
||||||
{{ matterbridge_media('irc') }}
|
{{ matterbridge_media('irc.load.casa', 'libertacasa-irc') }}
|
||||||
|
{{ matterbridge_media('up.chillnet.org', 'chillnet', 'up.chillnet.org') }}
|
||||||
|
|
||||||
meet.conf:
|
meet.conf:
|
||||||
config:
|
config:
|
||||||
@ -441,3 +443,4 @@ nginx:
|
|||||||
- sub_filter_types: application/xml
|
- sub_filter_types: application/xml
|
||||||
- sub_filter: takahe.rigel.lysergic.dev:8000 exhausted.life
|
- sub_filter: takahe.rigel.lysergic.dev:8000 exhausted.life
|
||||||
|
|
||||||
|
manage_firewall: True
|
||||||
|
1
pillar/id/derutil01_rigel_lysergic_dev.sls
Normal file
1
pillar/id/derutil01_rigel_lysergic_dev.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
manage_firewall: True
|
123
pillar/id/moni_lysergic_dev.sls
Normal file
123
pillar/id/moni_lysergic_dev.sls
Normal file
@ -0,0 +1,123 @@
|
|||||||
|
prometheus:
|
||||||
|
pkg:
|
||||||
|
component:
|
||||||
|
prometheus:
|
||||||
|
config:
|
||||||
|
alerting:
|
||||||
|
alertmanagers:
|
||||||
|
- static_configs:
|
||||||
|
- targets:
|
||||||
|
- localhost:9093
|
||||||
|
|
||||||
|
rule_files:
|
||||||
|
- /etc/prometheus/alerts/lysergic/*.yml
|
||||||
|
|
||||||
|
scrape_configs:
|
||||||
|
- job_name: 'prometheus'
|
||||||
|
static_configs:
|
||||||
|
- targets: ['localhost:9090']
|
||||||
|
|
||||||
|
- job_name: 'node_exporters_lysergic'
|
||||||
|
scrape_timeout: 1m
|
||||||
|
scrape_interval: 5m
|
||||||
|
file_sd_configs:
|
||||||
|
- files:
|
||||||
|
- '/etc/prometheus/targets/node-lysergic.json'
|
||||||
|
|
||||||
|
- job_name: 'blackbox-2xx'
|
||||||
|
metrics_path: /probe
|
||||||
|
params:
|
||||||
|
module: [http_2xx]
|
||||||
|
file_sd_configs:
|
||||||
|
- files: ['/etc/prometheus/targets/blackbox-2xx*.json']
|
||||||
|
relabel_configs:
|
||||||
|
- source_labels: [__address__]
|
||||||
|
target_label: __param_target
|
||||||
|
- source_labels: [__param_target]
|
||||||
|
target_label: instance
|
||||||
|
- target_label: __address__
|
||||||
|
replacement: 127.0.0.1:9115
|
||||||
|
|
||||||
|
- job_name: 'blackbox-3xx'
|
||||||
|
metrics_path: /probe
|
||||||
|
params:
|
||||||
|
module: [http_3xx]
|
||||||
|
file_sd_configs:
|
||||||
|
- files: ['/etc/prometheus/targets/blackbox-3xx*.json']
|
||||||
|
relabel_configs:
|
||||||
|
- source_labels: [__address__]
|
||||||
|
target_label: __param_target
|
||||||
|
- source_labels: [__param_target]
|
||||||
|
target_label: instance
|
||||||
|
- target_label: __address__
|
||||||
|
replacement: 127.0.0.1:9115
|
||||||
|
|
||||||
|
- job_name: 'certificate_exporter'
|
||||||
|
static_configs:
|
||||||
|
- targets: ['therapon.rigel.lysergic.dev:9793']
|
||||||
|
|
||||||
|
alertmanager:
|
||||||
|
config:
|
||||||
|
route:
|
||||||
|
group_by: ['alertname']
|
||||||
|
group_wait: 10s
|
||||||
|
group_interval: 10s
|
||||||
|
repeat_interval: 1h
|
||||||
|
receiver: 'smtp-local'
|
||||||
|
routes:
|
||||||
|
- receiver: 'lysergic'
|
||||||
|
# continue: false
|
||||||
|
match:
|
||||||
|
project: LYSERGIC
|
||||||
|
- receiver: 'chillnet'
|
||||||
|
match:
|
||||||
|
project: CHILLNET
|
||||||
|
|
||||||
|
receivers:
|
||||||
|
- name: 'smtp-local'
|
||||||
|
email_configs:
|
||||||
|
- to: 'system@lysergic.dev'
|
||||||
|
from: 'alertmanager@moni.lysergic.dev'
|
||||||
|
require_tls: false
|
||||||
|
# !!! TO-DO
|
||||||
|
smarthost: 'zz0.email:465'
|
||||||
|
send_resolved: yes
|
||||||
|
|
||||||
|
- name: 'irc-libertacasa'
|
||||||
|
webhook_configs:
|
||||||
|
- url: 'http://127.0.0.1:2410/universe'
|
||||||
|
send_resolved: yes
|
||||||
|
|
||||||
|
- name: 'lysergic'
|
||||||
|
webhook_configs:
|
||||||
|
- url: 'http://127.0.0.1:2410/universe'
|
||||||
|
send_resolved: yes
|
||||||
|
- url: http://127.0.0.2:8081/prometheus/webhook
|
||||||
|
send_resolved: yes
|
||||||
|
email_configs:
|
||||||
|
- to: 'system@lysergic.dev'
|
||||||
|
from: 'alertmanager@moni.lysergic.dev'
|
||||||
|
require_tls: false
|
||||||
|
smarthost: 'zz0.email:465'
|
||||||
|
send_resolved: yes
|
||||||
|
|
||||||
|
- name: 'chillnet'
|
||||||
|
email_configs:
|
||||||
|
- to: 'team@chillnet.org'
|
||||||
|
from: 'alertmanager@moni.lysergic.dev'
|
||||||
|
require_tls: false
|
||||||
|
smarthost: 'zz0.email:465'
|
||||||
|
send_resolved: yes
|
||||||
|
|
||||||
|
manage_firewall: True
|
||||||
|
firewalld:
|
||||||
|
zones:
|
||||||
|
internal:
|
||||||
|
services:
|
||||||
|
- https
|
||||||
|
ports:
|
||||||
|
- comment: DNS Slave
|
||||||
|
port: 5353
|
||||||
|
protocol: tcp
|
||||||
|
- port: 5353
|
||||||
|
protocol: udp
|
1
pillar/id/orpheus_psyched_dev.sls
Normal file
1
pillar/id/orpheus_psyched_dev.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
manage_sshd: False
|
1
pillar/id/philia_rigel_lysergic_dev.sls
Normal file
1
pillar/id/philia_rigel_lysergic_dev.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
manage_sshd: False
|
1
pillar/id/phoebe_lysergic_dev.sls
Normal file
1
pillar/id/phoebe_lysergic_dev.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
manage_firewall: True
|
1
pillar/id/selene_psyched_dev.sls
Normal file
1
pillar/id/selene_psyched_dev.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
manage_sshd: False
|
1
pillar/id/theia_psyched_dev.sls
Normal file
1
pillar/id/theia_psyched_dev.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
manage_sshd: False
|
150
pillar/id/themis_lysergic_dev.sls
Normal file
150
pillar/id/themis_lysergic_dev.sls
Normal file
@ -0,0 +1,150 @@
|
|||||||
|
{%- set common = {'address': '[fd29:8e45:f292:ff80::1]', 'port': 443, 'domain': '.themis.backend.syscid.com', 'snippetsdir': '/etc/apache2/snippets.d/'} -%}
|
||||||
|
|
||||||
|
{%- macro httpdformulaexcess() -%}
|
||||||
|
LogLevel: False
|
||||||
|
ErrorLog: False
|
||||||
|
LogFormat: False
|
||||||
|
CustomLog: False
|
||||||
|
ServerAdmin: False
|
||||||
|
ServerAlias: False
|
||||||
|
{%- endmacro -%}
|
||||||
|
{%- macro httpdcommon(app) -%}
|
||||||
|
Include {{ common['snippetsdir'] }}ssl_themis.conf
|
||||||
|
<FilesMatch '\.php$'>
|
||||||
|
SetHandler 'proxy:unix:/run/php-fpm/{{ app }}.sock|fcgi://{{ app }}'
|
||||||
|
</FilesMatch>
|
||||||
|
{%- endmacro -%}
|
||||||
|
|
||||||
|
apache:
|
||||||
|
sites:
|
||||||
|
BookStack:
|
||||||
|
interface: '{{ common['address'] }}'
|
||||||
|
port: {{ common['port'] }}
|
||||||
|
ServerName: bookstack{{ common['domain'] }}
|
||||||
|
DocumentRoot: /srv/www/BookStack/
|
||||||
|
DirectoryIndex: index.php
|
||||||
|
Directory:
|
||||||
|
/srv/www/BookStack/:
|
||||||
|
Options: FollowSymLinks
|
||||||
|
AllowOverride: None
|
||||||
|
Require: all granted
|
||||||
|
Formula_Append: |
|
||||||
|
RewriteEngine On
|
||||||
|
RewriteCond %{HTTP:Authorization} .
|
||||||
|
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
|
||||||
|
RewriteCond %{REQUEST_FILENAME} !-d
|
||||||
|
RewriteCond %{REQUEST_URI} (.+)/$
|
||||||
|
RewriteRule ^ %1 [L,R=301]
|
||||||
|
RewriteCond %{REQUEST_FILENAME} !-d
|
||||||
|
RewriteCond %{REQUEST_FILENAME} !-f
|
||||||
|
RewriteRule ^ index.php [L]
|
||||||
|
{{ httpdformulaexcess() }}
|
||||||
|
Formula_Append: |
|
||||||
|
{{ httpdcommon('BookStack') }}
|
||||||
|
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
|
||||||
|
SetOutputFilter DEFLATE
|
||||||
|
|
||||||
|
PrivateBin:
|
||||||
|
interface: '{{ common['address'] }}'
|
||||||
|
port: {{ common['port'] }}
|
||||||
|
ServerName: privatebin{{ common['domain'] }}
|
||||||
|
DocumentRoot: /srv/www/PrivateBin/public
|
||||||
|
DirectoryIndex: index.php
|
||||||
|
Directory:
|
||||||
|
/srv/www/PrivateBin/:
|
||||||
|
Options: false
|
||||||
|
AllowOverride: None
|
||||||
|
Require: all granted
|
||||||
|
{{ httpdformulaexcess() }}
|
||||||
|
Formula_Append: |
|
||||||
|
{{ httpdcommon('PrivateBin') }}
|
||||||
|
|
||||||
|
profile:
|
||||||
|
bookstack:
|
||||||
|
app_url: https://libertacasa.info
|
||||||
|
db_host: ${'secret_bookstack:db_host'}
|
||||||
|
db_database: ${'secret_bookstack:db_database'}
|
||||||
|
db_username: ${'secret_bookstack:db_username'}
|
||||||
|
db_password: ${'secret_bookstack:db_password'}
|
||||||
|
mail_driver: smtp
|
||||||
|
mail_from_name: LibertaCasa Documentation
|
||||||
|
mail_from: mail@libertacasa.info
|
||||||
|
mail_host: zz0.email
|
||||||
|
mail_port: 465
|
||||||
|
mail_username: mail@libertacasa.info
|
||||||
|
mail_password: ${'secret_bookstack:mail_password'}
|
||||||
|
mail_encryption: ssl
|
||||||
|
app_theme: lysergic
|
||||||
|
cache_driver: memcached
|
||||||
|
session_driver: memcached
|
||||||
|
memcached_servers: /run/memcached/memcached.sock
|
||||||
|
session_secure_cookie: true
|
||||||
|
session_cookie_name: libertacasa_megayummycookie
|
||||||
|
app_debug: false
|
||||||
|
session_lifetime: 240
|
||||||
|
auth_method: saml2
|
||||||
|
auth_auto_initiate: true
|
||||||
|
saml2_name: LibertaCasa SSO
|
||||||
|
saml2_email_attribute: email
|
||||||
|
saml2_external_id_attribute: uid
|
||||||
|
saml2_display_name_attributes: fullname
|
||||||
|
saml2_idp_entityid: https://libsso.net/realms/LibertaCasa
|
||||||
|
saml2_idp_sso: https://libsso.net/realms/LibertaCasa/protocol/saml
|
||||||
|
saml2_idp_slo: https://libsso.net/realms/LibertaCasa/protocol/saml
|
||||||
|
saml2_idp_x509: ${'secret_bookstack:saml2_idp_x509'}
|
||||||
|
saml2_autoload_metadata: false
|
||||||
|
saml2_sp_x509: ${'secret_bookstack:saml2_sp_x509'}
|
||||||
|
saml2_sp_x509_key: ${'secret_bookstack:saml2_sp_x509_key'}
|
||||||
|
saml2_user_to_groups: true
|
||||||
|
saml2_group_attribute: groups
|
||||||
|
saml2_remove_from_groups: true
|
||||||
|
queue_connection: database
|
||||||
|
|
||||||
|
privatebin:
|
||||||
|
main:
|
||||||
|
name: Bin
|
||||||
|
fileupload: true
|
||||||
|
syntaxhighlightingtheme: sons-of-obsidian
|
||||||
|
sizelimit: 310485760
|
||||||
|
notice: 'Note: Kittens will die if you abuse this service.'
|
||||||
|
languageselection: true
|
||||||
|
urlshortener: ${'secret_privatebin:main:urlshortener'}
|
||||||
|
qrcode: true
|
||||||
|
expire:
|
||||||
|
default: 1week
|
||||||
|
expire_options:
|
||||||
|
5min: 300
|
||||||
|
10min: 600
|
||||||
|
1hour: 3600
|
||||||
|
1day: 86400
|
||||||
|
1week: 604800
|
||||||
|
1month: 2592000
|
||||||
|
1year: 31536000
|
||||||
|
never: 0
|
||||||
|
formatter_options:
|
||||||
|
plaintext: Plain Text
|
||||||
|
syntaxhighlighting: Source Code
|
||||||
|
markdown: Markdown
|
||||||
|
traffic:
|
||||||
|
limit: 10
|
||||||
|
header: X_FORWARDED_FOR
|
||||||
|
dir: /var/lib/PrivateBin/limits
|
||||||
|
purge:
|
||||||
|
limit: 300
|
||||||
|
batchsize: 10
|
||||||
|
dir: /var/lib/PrivateBin/limits
|
||||||
|
model:
|
||||||
|
class: Database
|
||||||
|
model_options:
|
||||||
|
dsn: ${'secret_privatebin:model_options:dsn'}
|
||||||
|
tbl: privatebin_
|
||||||
|
usr: ${'secret_privatebin:model_options:usr'}
|
||||||
|
pwd: ${'secret_privatebin:model_options:pwd'}
|
||||||
|
opt[12]: true
|
||||||
|
|
||||||
|
manage_firewall: True
|
||||||
|
firewalld:
|
||||||
|
zones:
|
||||||
|
backend:
|
||||||
|
services:
|
||||||
|
- https
|
7
pillar/id/thetrip_lysergic_dev.sls
Normal file
7
pillar/id/thetrip_lysergic_dev.sls
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
manage_firewall: True
|
||||||
|
firewalld:
|
||||||
|
zones:
|
||||||
|
public:
|
||||||
|
services:
|
||||||
|
- http
|
||||||
|
- https
|
1
pillar/role/bookstack.sls
Normal file
1
pillar/role/bookstack.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
# empty
|
@ -1,7 +1,7 @@
|
|||||||
firewalld:
|
firewalld:
|
||||||
zones:
|
zones:
|
||||||
internal:
|
internal:
|
||||||
services:
|
protocols:
|
||||||
- vrrp
|
- vrrp
|
||||||
backend:
|
backend:
|
||||||
protocols:
|
protocols:
|
||||||
|
2
pillar/role/memcached.sls
Normal file
2
pillar/role/memcached.sls
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
memcached:
|
||||||
|
listen_address: /run/memcached/memcached.sock
|
11
pillar/role/monitoring/prometheus-alertmanager.sls
Normal file
11
pillar/role/monitoring/prometheus-alertmanager.sls
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
prometheus:
|
||||||
|
wanted:
|
||||||
|
component:
|
||||||
|
- alertmanager
|
||||||
|
pkg:
|
||||||
|
component:
|
||||||
|
alertmanager:
|
||||||
|
config:
|
||||||
|
global:
|
||||||
|
resolve_timeout: 5m
|
||||||
|
|
50
pillar/role/monitoring/prometheus-exporter-blackbox.sls
Normal file
50
pillar/role/monitoring/prometheus-exporter-blackbox.sls
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
prometheus:
|
||||||
|
wanted:
|
||||||
|
component:
|
||||||
|
- blackbox_exporter
|
||||||
|
pkg:
|
||||||
|
component:
|
||||||
|
blackbox_exporter:
|
||||||
|
config:
|
||||||
|
modules:
|
||||||
|
http_2xx:
|
||||||
|
prober: http
|
||||||
|
timeout: 15s
|
||||||
|
http_post_2xx:
|
||||||
|
prober: http
|
||||||
|
http:
|
||||||
|
method: POST
|
||||||
|
http_3xx:
|
||||||
|
prober: http
|
||||||
|
timeout: 5s
|
||||||
|
http:
|
||||||
|
method: HEAD
|
||||||
|
no_follow_redirects: true
|
||||||
|
valid_status_codes: [301, 302]
|
||||||
|
tcp_connect:
|
||||||
|
prober: tcp
|
||||||
|
ssh_banner:
|
||||||
|
prober: tcp
|
||||||
|
tcp:
|
||||||
|
query_response:
|
||||||
|
- expect: "^SSH-2.0-"
|
||||||
|
irc_banner:
|
||||||
|
prober: tcp
|
||||||
|
tcp:
|
||||||
|
query_response:
|
||||||
|
- send: "NICK prober"
|
||||||
|
- send: "USER prober prober prober :prober"
|
||||||
|
- expect: "PING :([^ ]+)"
|
||||||
|
send: "PONG ${1}"
|
||||||
|
- expect: "^:[^ ]+ 001"
|
||||||
|
icmp:
|
||||||
|
prober: icmp
|
||||||
|
|
||||||
|
firewalld:
|
||||||
|
zones:
|
||||||
|
internal:
|
||||||
|
ports:
|
||||||
|
- comment: 'Prometheus Blackbox Exporter'
|
||||||
|
port: 9115
|
||||||
|
protocol: tcp
|
||||||
|
|
17
pillar/role/monitoring/prometheus.sls
Normal file
17
pillar/role/monitoring/prometheus.sls
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
prometheus:
|
||||||
|
wanted:
|
||||||
|
component:
|
||||||
|
- prometheus
|
||||||
|
pkg:
|
||||||
|
component:
|
||||||
|
prometheus:
|
||||||
|
config:
|
||||||
|
global:
|
||||||
|
scrape_interval: 15s
|
||||||
|
evaluation_interval: 1m
|
||||||
|
|
||||||
|
firewalld:
|
||||||
|
zones:
|
||||||
|
internal:
|
||||||
|
services:
|
||||||
|
- prometheus
|
1
pillar/role/php-fpm.sls
Normal file
1
pillar/role/php-fpm.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
# empty
|
1
pillar/role/privatebin.sls
Normal file
1
pillar/role/privatebin.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
# empty
|
@ -21,7 +21,7 @@ salt:
|
|||||||
- roots
|
- roots
|
||||||
- git
|
- git
|
||||||
file_roots:
|
file_roots:
|
||||||
production:
|
__env__:
|
||||||
{%- for formula in formulas %}
|
{%- for formula in formulas %}
|
||||||
- /srv/formulas/{{ formula }}-formula
|
- /srv/formulas/{{ formula }}-formula
|
||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
@ -30,6 +30,7 @@ salt:
|
|||||||
- https://git.com.de/LibertaCasa/salt.git:
|
- https://git.com.de/LibertaCasa/salt.git:
|
||||||
- user: ${'secret_salt:master:gitfs_remotes:LibertaCasa:user'}
|
- user: ${'secret_salt:master:gitfs_remotes:LibertaCasa:user'}
|
||||||
- password: ${'secret_salt:master:gitfs_remotes:LibertaCasa:password'}
|
- password: ${'secret_salt:master:gitfs_remotes:LibertaCasa:password'}
|
||||||
|
- fallback: production
|
||||||
ext_pillar:
|
ext_pillar:
|
||||||
- netbox:
|
- netbox:
|
||||||
api_url: ${'secret_salt:master:ext_pillar:netbox:api_url'}
|
api_url: ${'secret_salt:master:ext_pillar:netbox:api_url'}
|
||||||
@ -59,6 +60,7 @@ salt:
|
|||||||
timeout: 20
|
timeout: 20
|
||||||
gather_job_timeout: 20
|
gather_job_timeout: 20
|
||||||
keep_jobs: 30
|
keep_jobs: 30
|
||||||
|
ping_on_rotate: True
|
||||||
user: ${'secret_salt:master:user'}
|
user: ${'secret_salt:master:user'}
|
||||||
syndic_user: ${'secret_salt:master:syndic_user'}
|
syndic_user: ${'secret_salt:master:syndic_user'}
|
||||||
cache.redis.unix_socket_path: ${'secret_salt:master:cache.redis.unix_socket_path'}
|
cache.redis.unix_socket_path: ${'secret_salt:master:cache.redis.unix_socket_path'}
|
||||||
|
@ -3,4 +3,7 @@ salt:
|
|||||||
minion_remove_config: True
|
minion_remove_config: True
|
||||||
minion:
|
minion:
|
||||||
master_type: str
|
master_type: str
|
||||||
|
backup_mode: minion
|
||||||
|
cache_jobs: True
|
||||||
|
enable_gpu_grains: False
|
||||||
saltenv: production
|
saltenv: production
|
||||||
|
13
pillar/role/web/apache-httpd.sls
Normal file
13
pillar/role/web/apache-httpd.sls
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
{%- set host = grains['host'] -%}
|
||||||
|
{%- set fqdn = grains['fqdn'] -%}
|
||||||
|
|
||||||
|
apache:
|
||||||
|
global:
|
||||||
|
ServerAdmin: system@lysergic.dev
|
||||||
|
|
||||||
|
profile:
|
||||||
|
apache-httpd:
|
||||||
|
snippets:
|
||||||
|
ssl_{{ host }}:
|
||||||
|
- 'SSLCertificateFile "/etc/ssl/{{ host }}/{{ fqdn }}.crt"'
|
||||||
|
- 'SSLCertificateKeyFile "/etc/ssl/{{ host }}/{{ fqdn }}.key"'
|
1
salt/common/openbsd.sls
Normal file
1
salt/common/openbsd.sls
Normal file
@ -0,0 +1 @@
|
|||||||
|
# Nothing yet
|
@ -1,5 +1,6 @@
|
|||||||
include:
|
include:
|
||||||
- openssh.banner
|
- openssh.banner
|
||||||
|
{%- if salt['pillar.get']('manage_sshd', True) %}
|
||||||
- openssh.config
|
- openssh.config
|
||||||
|
|
||||||
/etc/ssh/user_ca:
|
/etc/ssh/user_ca:
|
||||||
@ -10,3 +11,4 @@ include:
|
|||||||
{%- endfor -%}
|
{%- endfor -%}
|
||||||
- require:
|
- require:
|
||||||
- pkg: openssh
|
- pkg: openssh
|
||||||
|
{%- endif %}
|
||||||
|
@ -1,9 +1,16 @@
|
|||||||
include:
|
include:
|
||||||
|
{#- drop pillar check after all firewall configurations have been imported #}
|
||||||
|
{%- if salt['pillar.get']('manage_firewall', False) %}
|
||||||
- firewalld
|
- firewalld
|
||||||
|
{%- endif %}
|
||||||
- profile.seccheck
|
- profile.seccheck
|
||||||
- profile.zypp
|
- profile.zypp
|
||||||
- profile.node_exporter
|
- profile.prometheus.node_exporter
|
||||||
|
{%- if salt['cmd.run']("awk '/^passwd/{ print $2; exit }' /etc/nsswitch.conf") == 'sss' %}
|
||||||
|
{%- do salt.log.warning('Not configuring local users due to sss') %}
|
||||||
|
{%- else %}
|
||||||
- users
|
- users
|
||||||
|
{%- endif %}
|
||||||
- .ssh
|
- .ssh
|
||||||
- postfix.config
|
- postfix.config
|
||||||
|
|
||||||
@ -62,7 +69,6 @@ common_packages_remove:
|
|||||||
{#- we only use AutoYaST for the OS deployment #}
|
{#- we only use AutoYaST for the OS deployment #}
|
||||||
- autoyast2
|
- autoyast2
|
||||||
- autoyast2-installation
|
- autoyast2-installation
|
||||||
- libX11-data
|
|
||||||
- yast2-add-on
|
- yast2-add-on
|
||||||
- yast2-services-manager
|
- yast2-services-manager
|
||||||
- yast2-slp
|
- yast2-slp
|
||||||
|
28
salt/profile/apache-httpd/init.sls
Normal file
28
salt/profile/apache-httpd/init.sls
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
{%- set snippetsdir = '/etc/apache2/snippets.d' -%}
|
||||||
|
{%- set mypillar = salt['pillar.get']('profile:apache-httpd', {}) -%}
|
||||||
|
|
||||||
|
{{ snippetsdir }}:
|
||||||
|
file.directory:
|
||||||
|
- makedirs: True
|
||||||
|
|
||||||
|
{%- if 'snippets' in mypillar %}
|
||||||
|
{%- for snippet, config in mypillar['snippets'].items() %}
|
||||||
|
{{ snippetsdir }}/{{ snippet }}.conf:
|
||||||
|
file.managed:
|
||||||
|
- contents:
|
||||||
|
{%- for line in config %}
|
||||||
|
- {{ line }}
|
||||||
|
{%- endfor %}
|
||||||
|
- require:
|
||||||
|
- file: {{ snippetsdir }}
|
||||||
|
{#- formula dependencies #}
|
||||||
|
- watch_in:
|
||||||
|
- service: apache-service-running
|
||||||
|
{%- endfor %}
|
||||||
|
{%- endif %}
|
||||||
|
|
||||||
|
include:
|
||||||
|
- apache.config
|
||||||
|
|
||||||
|
|
||||||
|
|
22
salt/profile/apparmor/local.sls
Normal file
22
salt/profile/apparmor/local.sls
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
{%- set aapillar = salt['pillar.get']('profile:apparmor') %}
|
||||||
|
|
||||||
|
{%- if 'local' in aapillar %}
|
||||||
|
{%- for profile, lines in aapillar['local'].items() %}
|
||||||
|
/etc/apparmor.d/local/{{ profile }}:
|
||||||
|
file.managed:
|
||||||
|
- contents: {{ lines }}
|
||||||
|
- watch_in:
|
||||||
|
- module: apparmor_reload
|
||||||
|
{%- endfor %}
|
||||||
|
|
||||||
|
{%- if aapillar['local'] | length %}
|
||||||
|
apparmor_reload:
|
||||||
|
module.run:
|
||||||
|
- name: service.reload
|
||||||
|
- m_name: apparmor
|
||||||
|
- onchanges:
|
||||||
|
{%- for profile in aapillar['local'] %}
|
||||||
|
- file: /etc/apparmor.d/local/{{ profile }}
|
||||||
|
{%- endfor %}
|
||||||
|
{%- endif %}
|
||||||
|
{%- endif %}
|
74
salt/profile/bookstack/init.sls
Normal file
74
salt/profile/bookstack/init.sls
Normal file
@ -0,0 +1,74 @@
|
|||||||
|
{%- set mypillar = salt['pillar.get']('profile:bookstack', {}) -%}
|
||||||
|
{%- set configfile = '/etc/sysconfig/BookStack' -%}
|
||||||
|
|
||||||
|
bookstack_packages:
|
||||||
|
pkg.installed:
|
||||||
|
- names:
|
||||||
|
- BookStack-config-php-fpm-apache
|
||||||
|
|
||||||
|
bookstack_permissions:
|
||||||
|
file.managed:
|
||||||
|
- mode: '0640'
|
||||||
|
- user: root
|
||||||
|
- group: www
|
||||||
|
- names:
|
||||||
|
- {{ configfile }}
|
||||||
|
|
||||||
|
{%- if mypillar | length %}
|
||||||
|
{{ configfile }}:
|
||||||
|
file.keyvalue:
|
||||||
|
- separator: '='
|
||||||
|
- show_changes: False
|
||||||
|
- require:
|
||||||
|
- pkg: bookstack_packages
|
||||||
|
- key_values:
|
||||||
|
{%- macro condconf(option) %}
|
||||||
|
{%- if option in mypillar -%}
|
||||||
|
{%- if ( mypillar[option] is string and mypillar[option].startswith('$') ) or mypillar[option] is number %}
|
||||||
|
{%- set value = mypillar[option] %}
|
||||||
|
{%- else %}
|
||||||
|
{%- set value = "\"'" ~ mypillar[option] ~ "'\"" %}
|
||||||
|
{%- endif %}
|
||||||
|
{{ option | upper }}: {{ value }}
|
||||||
|
{%- endif -%}
|
||||||
|
{%- endmacro %}
|
||||||
|
{{ condconf('app_url') }}
|
||||||
|
{{ condconf('db_host') }}
|
||||||
|
{{ condconf('db_database') }}
|
||||||
|
{{ condconf('db_username') }}
|
||||||
|
{{ condconf('db_password') }}
|
||||||
|
{{ condconf('mail_driver') }}
|
||||||
|
{{ condconf('mail_from_name') }}
|
||||||
|
{{ condconf('mail_from') }}
|
||||||
|
{{ condconf('mail_host') }}
|
||||||
|
{{ condconf('mail_port') }}
|
||||||
|
{{ condconf('mail_username') }}
|
||||||
|
{{ condconf('mail_password') }}
|
||||||
|
{{ condconf('mail_encryption') }}
|
||||||
|
{{ condconf('app_theme') }}
|
||||||
|
{{ condconf('cache_driver') }}
|
||||||
|
{{ condconf('session_driver') }}
|
||||||
|
{{ condconf('memcached_servers') }}
|
||||||
|
{{ condconf('session_secure_cookie') }}
|
||||||
|
{{ condconf('session_cookie_name') }}
|
||||||
|
{{ condconf('app_debug') }}
|
||||||
|
{{ condconf('session_lifetime') }}
|
||||||
|
{{ condconf('auth_method') }}
|
||||||
|
{{ condconf('auth_auto_initiate') }}
|
||||||
|
{{ condconf('saml2_name') }}
|
||||||
|
{{ condconf('saml2_email_attribute') }}
|
||||||
|
{{ condconf('saml2_external_id_attribute') }}
|
||||||
|
{{ condconf('saml2_display_name_attributes') }}
|
||||||
|
{{ condconf('saml2_idp_entityid') }}
|
||||||
|
{{ condconf('saml2_idp_sso') }}
|
||||||
|
{{ condconf('saml2_idp_slo') }}
|
||||||
|
{{ condconf('saml2_idp_x509') }}
|
||||||
|
{{ condconf('saml2_autoload_metadata') }}
|
||||||
|
{{ condconf('saml2_sp_x509') }}
|
||||||
|
{{ condconf('saml2_user_to_groups') }}
|
||||||
|
{{ condconf('saml2_group_attribute') }}
|
||||||
|
{{ condconf('saml2_remove_from_groups') }}
|
||||||
|
{{ condconf('saml2_dump_user_details') }}
|
||||||
|
{{ condconf('queue_connection') }}
|
||||||
|
{{ condconf('app_views_books') }}
|
||||||
|
{%- endif %}
|
@ -46,7 +46,7 @@ matterbridge_{{ instance }}_mediadir:
|
|||||||
- user: matterbridge
|
- user: matterbridge
|
||||||
{#- to-do: implement some shared group #}
|
{#- to-do: implement some shared group #}
|
||||||
- group: lighttpd
|
- group: lighttpd
|
||||||
- mode: 750
|
- mode: '0750'
|
||||||
- makedirs: True
|
- makedirs: True
|
||||||
{%- endif %}
|
{%- endif %}
|
||||||
|
|
||||||
|
@ -5,6 +5,6 @@ include:
|
|||||||
file.managed:
|
file.managed:
|
||||||
- user: keepalived_script
|
- user: keepalived_script
|
||||||
- group: wheel
|
- group: wheel
|
||||||
- mode: 750
|
- mode: '0750'
|
||||||
- template: jinja
|
- template: jinja
|
||||||
- source: salt://{{ slspath }}/files/failover.sh.j2
|
- source: salt://{{ slspath }}/files/failover.sh.j2
|
||||||
|
55
salt/profile/privatebin/init.sls
Normal file
55
salt/profile/privatebin/init.sls
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{%- set mypillar = salt['pillar.get']('profile:privatebin', {}) -%}
|
||||||
|
{%- set confdir = '/etc/PrivateBin' -%}
|
||||||
|
{%- set configfile = confdir ~ '/conf.php' -%}
|
||||||
|
|
||||||
|
privatebin_packages:
|
||||||
|
pkg.installed:
|
||||||
|
- names:
|
||||||
|
- PrivateBin-config-httpd
|
||||||
|
|
||||||
|
privatebin_clean:
|
||||||
|
file.directory:
|
||||||
|
- name: {{ confdir }}
|
||||||
|
- clean: True
|
||||||
|
- onchanges:
|
||||||
|
- pkg: privatebin_packages
|
||||||
|
- require:
|
||||||
|
- pkg: privatebin_packages
|
||||||
|
|
||||||
|
{%- if mypillar | length %}
|
||||||
|
{{ configfile }}:
|
||||||
|
ini.options_present:
|
||||||
|
- separator: '='
|
||||||
|
- strict: True
|
||||||
|
- sections:
|
||||||
|
{%- macro conf(section, options) %}
|
||||||
|
{%- for option in options.keys() -%}
|
||||||
|
{%- if ( mypillar[section][option] is string and mypillar[section][option].startswith('$') ) or mypillar[section][option] is number %}
|
||||||
|
{%- set value = mypillar[section][option] -%}
|
||||||
|
{%- else %}
|
||||||
|
{%- set value = "\"'" ~ mypillar[section][option] ~ "'\"" -%}
|
||||||
|
{%- endif %}
|
||||||
|
{{ option }}: {{ value }}
|
||||||
|
{%- endfor -%}
|
||||||
|
{%- endmacro %}
|
||||||
|
{%- for section, options in mypillar.items() %}
|
||||||
|
{{ section }}:
|
||||||
|
{{ conf(section, options) }}
|
||||||
|
{%- endfor %}
|
||||||
|
- require:
|
||||||
|
- pkg: privatebin_packages
|
||||||
|
- watch:
|
||||||
|
- file: privatebin_clean
|
||||||
|
- watch_in:
|
||||||
|
- file: privatebin_permissions
|
||||||
|
{%- endif %}
|
||||||
|
|
||||||
|
privatebin_permissions:
|
||||||
|
file.managed:
|
||||||
|
- mode: '0640'
|
||||||
|
- user: wwwrun
|
||||||
|
- group: privatebin
|
||||||
|
- names:
|
||||||
|
- {{ configfile }}
|
||||||
|
- require:
|
||||||
|
- pkg: privatebin_packages
|
18
salt/profile/prometheus/targets.sls
Normal file
18
salt/profile/prometheus/targets.sls
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
{%- set mypillar = salt['pillar.get']('profile:prometheus:targets') %}
|
||||||
|
{%- set targetsdir = '/etc/prometheus/targets' %}
|
||||||
|
|
||||||
|
{%- if mypillar | length %}
|
||||||
|
{{ targetsdir }}:
|
||||||
|
file.directory:
|
||||||
|
- group: prometheus
|
||||||
|
|
||||||
|
{%- for group, nodes in mypillar.items() %}
|
||||||
|
{{ targetsdir }}/{{ group }}.json:
|
||||||
|
file.serialize:
|
||||||
|
- dataset: {{ nodes }}
|
||||||
|
- serializer: json
|
||||||
|
{%- endfor %}
|
||||||
|
|
||||||
|
{%- else %}
|
||||||
|
{%- do salt.log.debug('profile.prometheus: no targets defined') %}
|
||||||
|
{%- endif %}
|
6
salt/profile/salt/formulas.sls
Normal file
6
salt/profile/salt/formulas.sls
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
salt_master_formulas:
|
||||||
|
git.latest:
|
||||||
|
- name: https://git.com.de/LibertaCasa/salt-formulas.git
|
||||||
|
- target: /srv/formulas
|
||||||
|
- branch: production
|
||||||
|
- submodules: True
|
@ -7,6 +7,7 @@
|
|||||||
|
|
||||||
include:
|
include:
|
||||||
- salt.master
|
- salt.master
|
||||||
|
- .formulas
|
||||||
|
|
||||||
salt_master_extension_modules_dirs:
|
salt_master_extension_modules_dirs:
|
||||||
file.directory:
|
file.directory:
|
||||||
@ -17,7 +18,7 @@ salt_master_extension_modules_dirs:
|
|||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
- user: root
|
- user: root
|
||||||
- group: salt
|
- group: salt
|
||||||
- mode: 0755
|
- mode: '0755'
|
||||||
|
|
||||||
salt_master_extension_modules_bins:
|
salt_master_extension_modules_bins:
|
||||||
file.managed:
|
file.managed:
|
||||||
@ -30,24 +31,17 @@ salt_master_extension_modules_bins:
|
|||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
- user: root
|
- user: root
|
||||||
- group: salt
|
- group: salt
|
||||||
- mode: 0640
|
- mode: '0640'
|
||||||
- require:
|
- require:
|
||||||
- file: salt_master_extension_modules_dirs
|
- file: salt_master_extension_modules_dirs
|
||||||
|
|
||||||
salt_master_formulas:
|
|
||||||
git.latest:
|
|
||||||
- name: https://git.com.de/LibertaCasa/salt-formulas.git
|
|
||||||
- target: /srv/formulas
|
|
||||||
- branch: production
|
|
||||||
- submodules: True
|
|
||||||
|
|
||||||
salt_master_extra_packages:
|
salt_master_extra_packages:
|
||||||
pkg.installed:
|
pkg.installed:
|
||||||
- names:
|
- names:
|
||||||
- python3-ldap
|
- python3-ldap
|
||||||
- python3-pynetbox
|
- python3-pynetbox
|
||||||
- python3-redis
|
- python3-redis
|
||||||
- redis
|
- redis7
|
||||||
- salt-bash-completion
|
- salt-bash-completion
|
||||||
- salt-fish-completion
|
- salt-fish-completion
|
||||||
- salt-keydiff
|
- salt-keydiff
|
||||||
@ -72,29 +66,29 @@ salt_master_extra_packages:
|
|||||||
- requirepass {{ master_pillar['cache.redis.password'] }}
|
- requirepass {{ master_pillar['cache.redis.password'] }}
|
||||||
- user: root
|
- user: root
|
||||||
- group: redis
|
- group: redis
|
||||||
- mode: 0640
|
- mode: '0640'
|
||||||
- require:
|
- require:
|
||||||
- pkg: redis
|
- pkg: redis7
|
||||||
|
|
||||||
/var/lib/redis/salt:
|
/var/lib/redis/salt:
|
||||||
file.directory:
|
file.directory:
|
||||||
- user: redis
|
- user: redis
|
||||||
- group: redis
|
- group: redis
|
||||||
- mode: 0750
|
- mode: '0750'
|
||||||
- require:
|
- require:
|
||||||
- pkg: redis
|
- pkg: redis7
|
||||||
|
|
||||||
salt_redis_service_enable:
|
salt_redis_service_enable:
|
||||||
service.enabled:
|
service.enabled:
|
||||||
- name: {{ redis_service }}
|
- name: {{ redis_service }}
|
||||||
- require:
|
- require:
|
||||||
- pkg: redis
|
- pkg: redis7
|
||||||
|
|
||||||
salt_redis_service_start:
|
salt_redis_service_start:
|
||||||
service.running:
|
service.running:
|
||||||
- name: {{ redis_service }}
|
- name: {{ redis_service }}
|
||||||
- require:
|
- require:
|
||||||
- pkg: redis
|
- pkg: redis7
|
||||||
- watch:
|
- watch:
|
||||||
- file: {{ redis_config }}
|
- file: {{ redis_config }}
|
||||||
|
|
||||||
@ -102,7 +96,7 @@ salt_redis_membership:
|
|||||||
group.present:
|
group.present:
|
||||||
- name: redis
|
- name: redis
|
||||||
- require:
|
- require:
|
||||||
- pkg: redis
|
- pkg: redis7
|
||||||
- addusers:
|
- addusers:
|
||||||
- {{ master_pillar['user'] }}
|
- {{ master_pillar['user'] }}
|
||||||
{%- if pillar['secret_salt'] is defined %}
|
{%- if pillar['secret_salt'] is defined %}
|
||||||
|
@ -1,5 +1,7 @@
|
|||||||
{%- set netbox_pillar = salt['pillar.get']('netbox') -%}
|
{%- set netbox_pillar = salt['pillar.get']('netbox') -%}
|
||||||
{%- if 'custom_fields' in netbox_pillar and netbox_pillar['custom_fields']['salt_roles'] is not none and 'salt.syndic' in netbox_pillar['custom_fields']['salt_roles'] -%}
|
{%- if 'custom_fields' in netbox_pillar
|
||||||
|
and netbox_pillar['custom_fields']['salt_roles'] is not none
|
||||||
|
and 'salt.syndic' in netbox_pillar['custom_fields']['salt_roles'] -%}
|
||||||
{%- set master = salt['pillar.get']('salt:master:syndic_master') -%}
|
{%- set master = salt['pillar.get']('salt:master:syndic_master') -%}
|
||||||
{%- elif 'config_context' in netbox_pillar -%}
|
{%- elif 'config_context' in netbox_pillar -%}
|
||||||
{%- set master = netbox_pillar['config_context']['salt_master'] -%}
|
{%- set master = netbox_pillar['config_context']['salt_master'] -%}
|
||||||
|
5
salt/role/bookstack.sls
Normal file
5
salt/role/bookstack.sls
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
include:
|
||||||
|
- role.web.apache-httpd
|
||||||
|
- role.memcached
|
||||||
|
- profile.bookstack
|
||||||
|
- php.fpm
|
2
salt/role/memcached.sls
Normal file
2
salt/role/memcached.sls
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
include:
|
||||||
|
- memcached.config
|
2
salt/role/monitoring/prometheus-alertmanager.sls
Normal file
2
salt/role/monitoring/prometheus-alertmanager.sls
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
include:
|
||||||
|
- prometheus.config
|
2
salt/role/monitoring/prometheus-exporter-blackbox.sls
Normal file
2
salt/role/monitoring/prometheus-exporter-blackbox.sls
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
include:
|
||||||
|
- prometheus.config
|
3
salt/role/monitoring/prometheus.sls
Normal file
3
salt/role/monitoring/prometheus.sls
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
include:
|
||||||
|
- prometheus.config
|
||||||
|
- profile.prometheus.targets
|
2
salt/role/php-fpm.sls
Normal file
2
salt/role/php-fpm.sls
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
include:
|
||||||
|
- php.fpm
|
4
salt/role/privatebin.sls
Normal file
4
salt/role/privatebin.sls
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
include:
|
||||||
|
- role.web.apache-httpd
|
||||||
|
- profile.privatebin
|
||||||
|
- php.fpm
|
@ -1,5 +1,6 @@
|
|||||||
include:
|
include:
|
||||||
- nginx.pkg
|
- nginx.pkg
|
||||||
|
- profile.apparmor.local
|
||||||
- nginx.config
|
- nginx.config
|
||||||
- nginx.snippets
|
- nginx.snippets
|
||||||
- nginx.servers
|
- nginx.servers
|
||||||
|
2
salt/role/web/apache-httpd.sls
Normal file
2
salt/role/web/apache-httpd.sls
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
include:
|
||||||
|
- profile.apache-httpd
|
Loading…
Reference in New Issue
Block a user