ansible

foo.sh/ansible

Fork 0

Commit graph

bd1205af61 add ldap/nss role to git hosts to fix repository owner name Timo Makinen 2019-06-13 20:02:22 +03:00
8920d79078 selinux file context fixes for nginx data directories Timo Makinen 2019-06-11 15:53:55 +03:00
5016b70292 make sure that selinux contexts are correct in ldap data directory Timo Makinen 2019-06-11 15:52:53 +03:00
020a10677b add ldap/nss to cups/server dependency to get group access correct Timo Makinen 2019-06-10 21:06:00 +03:00
9fc02e7bef add role ldap/nss Timo Makinen 2019-06-10 21:05:08 +03:00
998dc0b643 install htop on all hosts Timo Makinen 2019-06-10 19:24:15 +03:00
3129b5e58c first version of cups server role Timo Makinen 2019-06-10 19:23:36 +03:00
6541059276 set sasl-host to get kerberos tickets match hostname Timo Makinen 2019-06-08 17:28:58 +03:00
6c6dcda8ac add ldap02 host Timo Makinen 2019-06-08 17:28:29 +03:00
d599adcd95 enable ldap slave Timo Makinen 2019-06-08 17:24:42 +03:00
8335a9723e copy keytab instead of generating it Timo Makinen 2019-06-08 17:23:51 +03:00
c69316ec6f remove unused ldap02.foo.sh site from proxies Timo Makinen 2019-06-06 23:16:54 +03:00
bc51574113 rename ansible_dir_private to ansible_private Timo Makinen 2019-06-06 23:16:06 +03:00
b13fbe1c2a add support for ldap replication Timo Makinen 2019-06-06 22:11:10 +03:00
b6b3dbbca3 more authz regexp base dn's for gssapi authentication Timo Makinen 2019-06-06 02:30:56 +03:00
da6ed9d4ac force sasl to use external (certificates) when connecting ldap as root Timo Makinen 2019-06-06 02:29:59 +03:00
1a22ce543b lint fixes Timo Makinen 2019-06-06 02:04:51 +03:00
d512c8b8bd add gssapi auth support for ldap server Timo Makinen 2019-06-06 01:58:04 +03:00
9cd3910f42 rename keytab to be more logical Timo Makinen 2019-06-06 01:56:52 +03:00
b533542b57 add support for defining multiple upstream servers for proxy sites Timo Makinen 2019-06-06 01:56:00 +03:00
11e4a82a35 configure authz mappings for gssapi authenticated users Timo Makinen 2019-06-06 01:54:54 +03:00
1979925f7e always install login/plain support for sasl Timo Makinen 2019-06-06 01:52:36 +03:00
00f7b86de6 first version of kerberos/keytab role Timo Makinen 2019-06-06 00:29:10 +03:00
87340a1e2a first version of kerberos/client role Timo Makinen 2019-06-05 20:18:39 +03:00
911332ec6f add daily ldap database dumps to ldap master Timo Makinen 2019-05-31 19:11:32 +03:00
80b017b5d1 write ldap datadirectory handling more cleanly Timo Makinen 2019-05-31 18:56:24 +03:00
a3ea2437a3 only mount /export on ldap master Timo Makinen 2019-05-31 18:35:40 +03:00
0163a5f932 don't use /export for ldap data directory on slaves Timo Makinen 2019-05-31 18:34:39 +03:00
7238a595f2 don't set mac address if we use static address on interface Timo Makinen 2019-05-31 18:32:16 +03:00
05f2b28c4f use random mac address if it's not provided Timo Makinen 2019-05-31 18:30:36 +03:00
7f33b7792a add robots.txt to git server webroot Timo Makinen 2019-05-31 16:57:15 +03:00
5fcf58a3d6 only add datadisk on master ldap Timo Makinen 2019-05-31 02:34:46 +03:00
2374804bfd change kadmin to use different user than kdc when connecting to ldap Timo Makinen 2019-05-31 02:32:57 +03:00
6c917dc696 add acl's for kadmin user Timo Makinen 2019-05-31 02:31:58 +03:00
fbffa25346 install and configure ldapvi on ldap servers Timo Makinen 2019-05-31 02:30:53 +03:00
666ada404e add carp interfaces to gw hosts Timo Makinen 2019-05-30 20:38:19 +03:00
4ba69d7632 add ldap indexes for kerberos kdc Timo Makinen 2019-05-29 19:38:25 +03:00
4cac7b8bc7 finish up kdcproxy Timo Makinen 2019-05-29 19:37:55 +03:00
2ab21a87f5 allow all users to runtime directory Timo Makinen 2019-05-29 19:35:51 +03:00
e1311e7ccc change kdc tcp port to listen only localhost Timo Makinen 2019-05-29 03:19:45 +03:00
f2934aef91 add kdcproxy to kdc role Timo Makinen 2019-05-29 03:15:49 +03:00
f1d32f86b7 added gunicorn role Timo Makinen 2019-05-29 03:14:46 +03:00
40abdfca64 change ldap base dn entries to use variables Timo Makinen 2019-05-29 01:59:00 +03:00
53cacdcb2e log ldap queries to syslog Timo Makinen 2019-05-29 01:57:41 +03:00
bb7b20c65e add support for creating stash files Timo Makinen 2019-05-29 01:56:26 +03:00
45d23c90af fix puppetism typo Timo Makinen 2019-05-29 01:55:53 +03:00
8db1ce69fd add kerberos role to ldap group still work in progress Timo Makinen 2019-05-29 00:41:57 +03:00
c1db2dc402 create syslogd role and enable it on openbsd Timo Makinen 2019-05-29 00:34:44 +03:00
13f0332fa1 create rsyslog role which logs everything to /var/log/all.log Timo Makinen 2019-05-29 00:07:39 +03:00
e0b519cf21 use global variable for default certificate bundle location Timo Makinen 2019-05-28 21:22:14 +03:00
1a4aec1b66 use variables for server settings and move from self signed cert to real ones Timo Makinen 2019-05-28 21:16:47 +03:00
fd9e792aec lint fixes Timo Makinen 2019-05-28 20:37:54 +03:00
58b3ca5d62 add ldap/server role to ldap servers Timo Makinen 2019-05-28 20:34:53 +03:00
89aa8eb0ef first version of ldap server role Timo Makinen 2019-05-28 20:34:07 +03:00
2804d730c9 add ldap and kerberos settings to global vars Timo Makinen 2019-05-28 20:33:01 +03:00
7f284a8e24 add first ldap host Timo Makinen 2019-05-28 20:32:16 +03:00
faaddffce4 more fiddling with ssh security now relying on mozilla recommendations Timo Makinen 2019-05-28 20:30:03 +03:00
180dae44a4 create relayd role and enable it for proxy group Timo Makinen 2019-05-28 02:33:03 +03:00
0a8c59335a add ifstated role and enable it on proxy group Timo Makinen 2019-05-28 02:09:35 +03:00
397a686495 ugly hack to get ldap certificates Timo Makinen 2019-05-28 02:08:23 +03:00
ddb7ddc71b use fullchain certificates for nginx Timo Makinen 2019-05-28 01:10:42 +03:00
d036b43244 add proxy group to global playbook Timo Makinen 2019-05-28 01:00:25 +03:00
4dedb4f2d0 create fullchain of host certificate Timo Makinen 2019-05-28 00:59:15 +03:00
5dc54dd8eb add proxy hosts Timo Makinen 2019-05-28 00:28:29 +03:00
dd19c94511 create network role and include it into base (only openbsd does something) Timo Makinen 2019-05-28 00:25:06 +03:00
ba0c70532f first version of proxy site for nginx Timo Makinen 2019-05-27 23:49:38 +03:00
d448eb6522 no default vars just os family specific Timo Makinen 2019-05-27 23:15:35 +03:00
e95bd87ab5 fix nginx/server role for openbsd Timo Makinen 2019-05-27 22:36:35 +03:00
a69e66bbac initial version of ldap client Timo Makinen 2019-05-27 21:10:50 +03:00
81a3becc55 initial version of saslauthd role Timo Makinen 2019-05-27 21:04:07 +03:00
33a70eacfd add handler for sshd restarts Timo Makinen 2019-05-27 21:03:31 +03:00
d12261fe1c add variables for ansible directories Timo Makinen 2019-05-27 21:01:48 +03:00
b12f219ded add mozilla intermediate compatibility ciphersuites Timo Makinen 2019-05-27 21:00:55 +03:00
f06707ce6b tighten sshd settings (ciphers, kex, macs) Timo Makinen 2019-05-27 20:59:36 +03:00
e393ab4f6a disable reporting changes when getting certificate hash Timo Makinen 2019-05-24 13:03:57 +03:00
f1caad541e store local ca certificate hash in variable Timo Makinen 2019-05-24 12:48:39 +03:00
52c23c914f create hostkey group which has read access to host certificate key Timo Makinen 2019-05-24 11:57:03 +03:00
be9fab2fc3 use command instead of shell as recommended Timo Makinen 2019-05-23 21:24:53 +03:00
0b715e82e6 split long lines (lint fixes) Timo Makinen 2019-05-23 19:29:24 +03:00
30d791d27d lint fixes Timo Makinen 2019-05-23 17:41:19 +03:00
3162d50738 no need to run quota check on boot for openbsd Timo Makinen 2019-05-23 17:38:23 +03:00
011aafca1c add bash and emacs by default on openbsd Timo Makinen 2019-05-23 17:38:03 +03:00
12b270c57b openbsd is missing /srv hierarcy by default so create it Timo Makinen 2019-05-23 17:37:24 +03:00
fd64da10cf hardode datacenter to home for now and use local mirror for openbsd packages Timo Makinen 2019-05-23 17:36:14 +03:00
6e996b7252 always use virtio driver for disks Timo Makinen 2019-05-23 17:34:13 +03:00
2809799242 try fixing line length errors from yamllint Timo Makinen 2019-05-23 17:33:08 +03:00
eecf34b517 fix outside connectivity when default route goes through internal network Timo Makinen 2019-05-23 17:31:53 +03:00
6c5f344318 lint fixes Timo Makinen 2019-05-23 02:36:37 +03:00
46ccf974f9 lint fixes Timo Makinen 2019-05-23 02:35:05 +03:00
650e9c3183 fix default number of cpus for openbsd Timo Makinen 2019-05-23 02:33:46 +03:00
1d0636dfa4 enable psacct on all hosts Timo Makinen 2019-05-23 02:27:39 +03:00
7ffafeb09f create role psacct Timo Makinen 2019-05-23 02:27:05 +03:00
9357facb7d enable ip forwarding on gw hosts Timo Makinen 2019-05-23 02:09:31 +03:00
b0ff639240 add some defaults vars for centos7 Timo Makinen 2019-05-22 23:54:15 +03:00
7d45cde22e starting work on gw group Timo Makinen 2019-05-22 23:53:35 +03:00
81df3e7c10 always add pf role to openbsd hosts Timo Makinen 2019-05-22 23:51:12 +03:00
078e00f054 force correct hostname Timo Makinen 2019-05-22 23:46:25 +03:00
332b433971 initial version of pf module Timo Makinen 2019-05-22 23:39:12 +03:00
107f5d32ac add git to master playbook Timo Makinen 2019-05-22 23:31:45 +03:00
62cc0ab869 add openbsd support to pki role Timo Makinen 2019-05-22 23:30:18 +03:00