better playbook organization; add zabov role; add dns-filter role

This commit is contained in:
Claudio Maradonna 2022-11-23 11:59:37 +01:00
parent 129f63c323
commit 53055f3e5b
Signed by untrusted user who does not match committer: claudiomaradonna
GPG key ID: 0CBA58694C5680D9
27 changed files with 408 additions and 17 deletions

View file

@ -1,6 +0,0 @@
---
- name: "Setup the target for pi-hole"
hosts: "{{ target if target is defined else 'planets' }}"
roles:
- role: pi-hole

View file

@ -4,26 +4,28 @@
hosts: "{{ target if target is defined else 'planets' }}"
roles:
# Hardening
# - role: iptables-persistent
# tags: [firewall, ips, ids]
- role: hardening-basic
tags: [hardening, ips, ids]
- role: iptables-persistent
tags: [firewall, ips, ids]
- role: iptables-basic
tags: [firewall, ips, ids]
- role: fail2ban-basic
tags: [fail2ban, ips, ids]
- role: auditd
tags: [auditd]
- role: iptables-webserver
tags: [firewall, webserver]
- role: fail2ban-basic
tags: [fail2ban, ips, ids]
# Services
- role: ipfs
tags: [ipfs]
- role: yggdrasil
tags: [yggdrasil]
- role: snort-community
tags: [snort, ips, ids]
- role: auditd
tags: [auditd]
- role: dns-filter
tags: [dns_filter]

View file

@ -0,0 +1,29 @@
---
language: python
python: "2.7"
# Use the new container infrastructure
sudo: false
# Install ansible
addons:
apt:
packages:
- python-pip
install:
# Install ansible
- pip install ansible
# Check ansible version
- ansible --version
# Create ansible.cfg with correct roles_path
- printf '[defaults]\nroles_path=../' >ansible.cfg
script:
# Basic role syntax check
- ansible-playbook tests/test.yml -i tests/inventory --syntax-check
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

View file

@ -0,0 +1,35 @@
dns-filter
=========
This role setup selected dns-filter
Requirements
------------
.
Role Variables
--------------
- **dns_filter_enabled** (boolean): if true enable dns filter
- **dns_filter_selected** (string): selectable dns filter, check filter list
Dependencies
------------
.
Example Playbook
----------------
`ansible-playbook -i inventory/example.yml handbook.yml --extra-vars="target=your_target go_path=/opt/go/bin" --tags dns_filter`
License
-------
GPLv3
Author Information
------------------
- [Claudio Maradonna](https://social.unitoo.it/claudio)

View file

@ -0,0 +1,6 @@
---
# defaults file for dns-filter
dns_filter_enabled: false
dns_filter_list: ['pi-hole', 'zabov']
dns_filter_selected: zabov

View file

@ -0,0 +1,2 @@
---
# handlers file for dns-filter

View file

@ -0,0 +1,52 @@
galaxy_info:
author: your name
description: your role description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
#
# Provide a list of supported platforms, and for each platform a list of versions.
# If you don't wish to enumerate all versions for a particular platform, use 'all'.
# To view available platforms and versions (or releases), visit:
# https://galaxy.ansible.com/api/v1/platforms/
#
# platforms:
# - name: Fedora
# versions:
# - all
# - 25
# - name: SomePlatform
# versions:
# - all
# - 1.0
# - 7
# - 99.99
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

View file

@ -0,0 +1,11 @@
---
# tasks file for dns-filter
- name: Install selected DNS filter if enabled
when:
- "dns_filter_enabled is true"
- "dns_filter_selected in dns_filter_list"
block:
- name: Call DNS filter role
ansible.builtin.include_role:
name: "{{ dns_filter_selected }}"

View file

@ -0,0 +1,2 @@
localhost

View file

@ -0,0 +1,5 @@
---
- hosts: localhost
remote_user: root
roles:
- dns-filter

View file

@ -0,0 +1,2 @@
---
# vars file for dns-filter

View file

@ -1,6 +1,7 @@
- name: Handle iptables-persistent
when:
- "is_docker is not true"
- "iptables_persistent_save_to_file is true"
block:
- name: Install iptables-persistent package
ansible.builtin.package:

View file

@ -1,5 +1,4 @@
- name: Save iptables rules
when: "iptables_persistent_save_to_file is true"
block:
- name: Save rules with iptables-persistent v4
ansible.builtin.shell: iptables-save > /etc/iptables/rules.v4

29
roles/zabov/.travis.yml Normal file
View file

@ -0,0 +1,29 @@
---
language: python
python: "2.7"
# Use the new container infrastructure
sudo: false
# Install ansible
addons:
apt:
packages:
- python-pip
install:
# Install ansible
- pip install ansible
# Check ansible version
- ansible --version
# Create ansible.cfg with correct roles_path
- printf '[defaults]\nroles_path=../' >ansible.cfg
script:
# Basic role syntax check
- ansible-playbook tests/test.yml -i tests/inventory --syntax-check
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

38
roles/zabov/README.md Normal file
View file

@ -0,0 +1,38 @@
zabov
=========
This role setup Zabov DNS filter
Requirements
------------
.
Role Variables
--------------
- **zabov_git_url** (string): Git valid url of Zabov
- **zabov_git_branch** (string): Zabov Git branch
- **zabov_installation_path** (string): Zabov installation path
- **zabov_user** (string): Zabov dedicated user
- **zabov_group** (string): Zabov dedicated group
Dependencies
------------
.
Example Playbook
----------------
`ansible-playbook -i inventory/example.yml handbook.yml --extra-vars="target=your_target go_path=/opt/go/bin" --tags dns_filter`
License
-------
GPLv3
Author Information
------------------
- [Claudio Maradonna](https://social.unitoo.it/claudio)

View file

@ -0,0 +1,8 @@
---
# defaults file for zabov
zabov_git_url: "https://git.keinpfusch.net/loweel/zabov"
zabov_installation_path: "/home/zabov/zabov"
zabov_git_branch: "master"
zabov_user: zabov
zabov_group: zabov

View file

@ -0,0 +1,2 @@
---
# handlers file for zabov

52
roles/zabov/meta/main.yml Normal file
View file

@ -0,0 +1,52 @@
galaxy_info:
author: your name
description: your role description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
#
# Provide a list of supported platforms, and for each platform a list of versions.
# If you don't wish to enumerate all versions for a particular platform, use 'all'.
# To view available platforms and versions (or releases), visit:
# https://galaxy.ansible.com/api/v1/platforms/
#
# platforms:
# - name: Fedora
# versions:
# - all
# - 25
# - name: SomePlatform
# versions:
# - all
# - 1.0
# - 7
# - 99.99
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

View file

@ -0,0 +1,15 @@
- name: Setup systemd
when: 'is_docker is not true'
block:
- name: Install systemd files
ansible.builtin.template:
src: '{{ item.src }}'
dest: '/{{ item.path }}'
with_community.general.filetree: '../templates/systemd/'
when: item.state == 'file'
- name: Enable service
ansible.builtin.systemd:
name: zabov
state: started
daemon_reload: yes

View file

@ -0,0 +1,74 @@
---
# tasks file for zabov
- name: Install zabov from sources
when: 'go_path is defined'
block:
- name: Install git if needed
ansible.builtin.package:
name: git
- name: Create zabov group
group:
name: "{{ zabov_group }}"
state: present
- name: Create zabov user
user:
name: "{{ zabov_user }}"
state: present
shell: /sbin/nologin
group: "{{ zabov_group }}"
- name: Official repo print url
debug:
msg: "{{ zabov_git_url }}"
- name: Compile zabov
become: true
become_user: "{{ zabov_user }}"
block:
- name: Check if repo is cloned
stat:
path: "{{ zabov_installation_path }}"
register: installation_path
- name: Clone repo
when: 'not installation_path.stat.exists'
ansible.builtin.git:
repo: "{{ zabov_git_url }}"
dest: "{{ zabov_installation_path }}"
single_branch: yes
version: "{{ zabov_git_branch }}"
- name: Update repo
ansible.builtin.git:
repo: "{{ zabov_git_url }}"
dest: "{{ zabov_installation_path }}"
update: yes
- name: Get $PATH
ansible.builtin.shell:
cmd: "echo $PATH"
register: path_env
- name: Get go dependencies
ansible.builtin.shell:
cmd: "go get"
chdir: "{{ zabov_installation_path }}"
environment:
PATH: '{{ go_path }}:{{ path_env }}'
args:
executable: /bin/bash
- name: Build executable
ansible.builtin.shell:
cmd: "go build -mod=vendor"
chdir: "{{ zabov_installation_path }}"
environment:
PATH: '{{ go_path }}:{{ path_env }}'
args:
executable: /bin/bash
- include_tasks: "install_{{ ansible_service_mgr }}_service.yml"
ignore_errors: true

View file

@ -0,0 +1,24 @@
[Unit]
Description=Zabov Daemon
Documentation=https://git.keinpfusch.net/loweel/zabov
Wants=network.target
After=network.target
[Service]
Type=simple
WorkingDirectory={{ zabov_installation_path }}
ExecStart={{ zabov_installation_path }}/zabov
User={{ zabov_user }}
Group={{ zabov_group }}
StateDirectory=zabov
Restart=always
RestartSec=60
KillMode=process
KillSignal=SIGINT
ProtectSystem=true
SecureBits=keep-caps
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
[Install]
WantedBy=multi-user.target

View file

@ -0,0 +1,2 @@
localhost

View file

@ -0,0 +1,5 @@
---
- hosts: localhost
remote_user: root
roles:
- zabov

View file

@ -0,0 +1,2 @@
---
# vars file for zabov