cleanup

.gitignore

@@ -1,3 +1 @@
-.vagrant
+.vscode/
-hosts.ini
-ubuntu-bionic-18.04-cloudimg-console.log

README.md

@@ -4,12 +4,9 @@ Playbooks pour installation via Ansible de services pour le Fuz.
 
 ## Deployment
 1. Récupérer l'inventaire `hosts.ini` auprès d'un humain ou autre
-2. Install ansible: 
+2. Installer ansible: 
     ```bash
-    sudo apt update
+    sudo pip3 install ansible
-    sudo apt install software-properties-common
-    sudo apt-add-repository --yes --update ppa:ansible/ansible
-    sudo apt install ansible
     ```
 <!-- 3. Install the roles: `ansible-galaxy install -r requirements.yml` -->
-1. Launch the playbook: `ansible-playbook main.yml -K --check`
+1. Launch the playbook sans faire de changements: `ansible-playbook main.yml -K --check --diff -vv`

adminsys-classique.yml

@@ -7,11 +7,16 @@
   # roles:
   # - geerlingguy.pip
   tasks:
-    - apt:
+    - name: Faire une full upgrade
+      apt:
         upgrade: yes
-    - apt:
+    - name: Programmes utiles installés
+      apt:
         name:
         - python3-pip
+        - certbot
         - tmux
         - bash-completion
+        - rsync
+        - unattended-upgrades
         # - zsh

ansible-pull-cron.yml

@@ -1 +0,0 @@
-# Configure crontab of ansible pull to this repo to create a puppet-like kind of config

files/nginx/nginx.conf

@@ -1,81 +0,0 @@
-# https://www.digitalocean.com/community/tools/nginx
-
-user                 www-data;
-pid                  /run/nginx.pid;
-worker_processes     auto;
-worker_rlimit_nofile 65535;
-
-# Load modules
-include              /etc/nginx/modules-enabled/*.conf;
-
-events {
-    multi_accept       on;
-    worker_connections 65535;
-}
-
-http {
-    charset                utf-8;
-    sendfile               on;
-    tcp_nopush             on;
-    tcp_nodelay            on;
-    server_tokens          off;
-    log_not_found          off;
-    types_hash_max_size    2048;
-    types_hash_bucket_size 64;
-    client_max_body_size   16M;
-
-    # MIME
-    include                mime.types;
-    default_type           application/octet-stream;
-
-    # Logging
-    access_log             /var/log/nginx/access.log;
-    error_log              /var/log/nginx/error.log warn;
-
-    # SSL
-    ssl_session_timeout    1d;
-    ssl_session_cache      shared:SSL:10m;
-    ssl_session_tickets    off;
-
-    # Diffie-Hellman parameter for DHE ciphersuites
-    ssl_dhparam            /etc/nginx/dhparam.pem;
-
-    # Mozilla Intermediate configuration
-    ssl_protocols          TLSv1.2 TLSv1.3;
-    ssl_ciphers            ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-
-    # OCSP Stapling
-    ssl_stapling           on;
-    ssl_stapling_verify    on;
-
-    # Connection header for WebSocket reverse proxy
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
-        ""      close;
-    }
-
-    map $remote_addr $proxy_forwarded_elem {
-
-        # IPv4 addresses can be sent as-is
-        ~^[0-9.]+$        "for=$remote_addr";
-
-        # IPv6 addresses need to be bracketed and quoted
-        ~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\"";
-
-        # Unix domain socket names cannot be represented in RFC 7239 syntax
-        default           "for=unknown";
-    }
-
-    map $http_forwarded $proxy_add_forwarded {
-
-        # If the incoming Forwarded header is syntactically valid, append to it
-        "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
-
-        # Otherwise, replace it
-        default "$proxy_forwarded_elem";
-    }
-
-    # Load configs
-    include /etc/nginx/conf.d/*.conf;
-    include /etc/nginx/sites-enabled/*;
-}

files/nginx/sites-enabled/fuz.re.conf

@@ -1,52 +0,0 @@
-server {
-    listen                  443 ssl http2;
-    listen                  [::]:443 ssl http2;
-    server_name             fuz.re;
-    root                    /var/www/fuz.re/public;
-
-    # SSL
-    ssl_certificate         /etc/letsencrypt/live/fuz.re/fullchain.pem;
-    ssl_certificate_key     /etc/letsencrypt/live/fuz.re/privkey.pem;
-    ssl_trusted_certificate /etc/letsencrypt/live/fuz.re/chain.pem;
-
-    # security
-    include                 snippets/security.conf;
-
-    # index.html fallback
-    location / {
-        try_files $uri $uri/ /index.html;
-    }
-
-    # index.php fallback
-    location ~ ^/api/ {
-        try_files $uri $uri/ /index.php?$query_string;
-    }
-
-    # additional config
-    include snippets/general.conf;
-}
-
-# subdomains redirect
-server {
-    listen                  443 ssl http2;
-    listen                  [::]:443 ssl http2;
-    server_name             *.fuz.re;
-
-    # SSL
-    ssl_certificate         /etc/letsencrypt/live/fuz.re/fullchain.pem;
-    ssl_certificate_key     /etc/letsencrypt/live/fuz.re/privkey.pem;
-    ssl_trusted_certificate /etc/letsencrypt/live/fuz.re/chain.pem;
-    return                  301 https://fuz.re$request_uri;
-}
-
-# HTTP redirect
-server {
-    listen      80;
-    listen      [::]:80;
-    server_name .fuz.re;
-    include     snippets/letsencrypt.conf;
-
-    location / {
-        return 301 https://fuz.re$request_uri;
-    }
-}

files/nginx/sites-enabled/matrix.fuz.re.conf

@@ -1,38 +0,0 @@
-server {
-    listen                  443 ssl http2;
-    listen                  [::]:443 ssl http2;
-    server_name             matrix.fuz.re;
-
-    # SSL
-    ssl_certificate         /etc/letsencrypt/live/matrix.fuz.re/fullchain.pem;
-    ssl_certificate_key     /etc/letsencrypt/live/matrix.fuz.re/privkey.pem;
-    ssl_trusted_certificate /etc/letsencrypt/live/matrix.fuz.re/chain.pem;
-
-    # security
-    include                 snippets/security.conf;
-
-    # logging
-    access_log              /var/log/nginx/matrix.fuz.re.access.log;
-    error_log               /var/log/nginx/matrix.fuz.re.error.log warn;
-
-    # reverse proxy
-    location / {
-        proxy_pass http://127.0.0.1:8080;
-        include    snippets/proxy.conf;
-    }
-
-    # additional config
-    include snippets/general.conf;
-}
-
-# HTTP redirect
-server {
-    listen      80;
-    listen      [::]:80;
-    server_name matrix.fuz.re;
-    include     snippets/letsencrypt.conf;
-
-    location / {
-        return 301 https://matrix.fuz.re$request_uri;
-    }
-}

files/nginx/snippets/general.conf

@@ -1,18 +0,0 @@
-# favicon.ico
-location = /favicon.ico {
-    log_not_found off;
-    access_log    off;
-}
-
-# robots.txt
-location = /robots.txt {
-    log_not_found off;
-    access_log    off;
-}
-
-# gzip
-gzip            on;
-gzip_vary       on;
-gzip_proxied    any;
-gzip_comp_level 6;
-gzip_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

files/nginx/snippets/letsencrypt.conf

@@ -1,4 +0,0 @@
-# ACME-challenge
-location ^~ /.well-known/acme-challenge/ {
-    root /var/www/_letsencrypt;
-}

files/nginx/snippets/proxy.conf

@@ -1,18 +0,0 @@
-proxy_http_version                 1.1;
-proxy_cache_bypass                 $http_upgrade;
-
-# Proxy headers
-proxy_set_header Upgrade           $http_upgrade;
-proxy_set_header Connection        $connection_upgrade;
-proxy_set_header Host              $host;
-proxy_set_header X-Real-IP         $remote_addr;
-proxy_set_header Forwarded         $proxy_add_forwarded;
-proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto $scheme;
-proxy_set_header X-Forwarded-Host  $host;
-proxy_set_header X-Forwarded-Port  $server_port;
-
-# Proxy timeouts
-proxy_connect_timeout              60s;
-proxy_send_timeout                 60s;
-proxy_read_timeout                 60s;

files/nginx/snippets/security.conf

@@ -1,12 +0,0 @@
-# security headers
-add_header X-XSS-Protection          "1; mode=block" always;
-add_header X-Content-Type-Options    "nosniff" always;
-add_header Referrer-Policy           "no-referrer-when-downgrade" always;
-add_header Content-Security-Policy   "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
-add_header Permissions-Policy        "interest-cohort=()" always;
-add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-
-# . files
-location ~ /\.(?!well-known) {
-    deny all;
-}

hosts.ini

@@ -0,0 +1,2 @@
+# sonic ansible_host=sonic.fuz.re
+octo.fuz.re

lighttpd.yml

@@ -0,0 +1,24 @@
+- hosts: octo.fuz.re
+  become: yes
+  tasks:
+    - name: Lighttpd installé
+      apt:
+        name: lighttpd
+
+    - name: Copie la conf
+      copy:
+        src: files/lighttpd.conf
+        dest: /etc/lighttpd/lighttpd.conf
+      notify: Restart de lighttpd
+
+    - name: On charge lighttpd
+      service:
+        name: lighttpd
+        state: started
+        enabled: yes
+
+  handlers:
+    - name: Restart de lighttpd
+      service:
+        name: lighttpd
+        state: restarted

main.yml

@@ -2,7 +2,7 @@
 - import_playbook: adminsys-classique.yml
 # Octo
 - import_playbook: matrix.yml
-# - import_playbook: nginx.yml
+- import_playbook: lighttpd.yml
 # - import_playbook: certbot.yml
 
 # Sonic

matrix.yml

@@ -1,13 +1,30 @@
 - hosts: octo.fuz.re
+  become: yes
+
   tasks:
   - name: synapse installé et upgradé
-    become: yes
     apt:
       name: matrix-synapse
       update_cache: yes
-  - template:
+      upgrade: yes
-      src: templates/homeserver.yaml.j2
+
-      dest: /etc/matrix-synapse/homeserver.yaml
+  # - name: Config Synapse conforme à ce qu'il y a dans ce dépôt Ansible
+  #   template:
+  #     src: templates/homeserver.yaml.j2
+  #     dest: /etc/matrix-synapse/homeserver.yaml
+      
+  - name: Postgres lancé
+    service:
+      name: postgresql@13-main
+      state: started
+      enabled: yes
+
+  - name: Synapse lancé
+    service:
+      name: matrix-synapse
+      state: started
+      enabled: yes
+      
   vars:
     - matrix_server_name: matrix.fuz.re
     - synapse_postgres_password: !vault |
@@ -17,12 +34,10 @@
                                   36373238633939303261666263303562653233313339326638393032343531613435326436393739
                                   6535346265653732380a363738333836366334633264303130336435323637303037373563306266
                                   3235
-  - synapse_turn_password:
+    - synapse_turn_secret: !vault |
-          !vault |
                               $ANSIBLE_VAULT;1.1;AES256
                               32616461613066343434373265376663653230393837313264636130623963383636333739333561
                               6434613031303161656531303639633437613132336131660a333466356165616434646366333765
                               31653164633930326434643339616231616235613062663733326339653830306566313735306339
                               3831646665393963390a636332353233396462663831623966373437306531663331333233363361
                               31383766356137636661306134326236656666623432656163616132663530343566
-          

requirements.yml

@@ -1,20 +0,0 @@
-# from galaxy
-# - src: geerlingguy.pip
-# - src: geerlingguy.postgresql
-# - src: https://github.com/geerlingguy/ansible-role-certbot
-#   scm: git
-
-# from GitHub, overriding the name and specifying a specific tag
-# - src: https://github.com/bennojoy/nginx
-#   version: master
-#   name: nginx_role
-
-# from a webserver, where the role is packaged in a tar.gz
-# - src: https://some.webserver.example.com/files/master.tar.gz
-#   name: http-role
-
-
-# from GitLab or other git-based scm, using git+ssh
-# - src: https://gitlab.com/famedly/ansible/synapse
-#   scm: git
-  # version: "0.1"  # quoted, so YAML doesn't parse this as a floating-point value

site-statique.yml

@@ -1 +0,0 @@
-# lighttpd ou nginx ?

sonic/.gitignore

@@ -1 +0,0 @@
-homeserver.yaml

templates/nginx.conf

@@ -1,214 +0,0 @@
-
-### FUZ.RE ###
-## TODO: Wiki pas encore hébergé ici ###
-# $HTTP["host"] == "wiki.fuz.re" {
-#     server.document-root = "/var/www/fuz.re/dokuwiki/"
-#     $HTTP["scheme"] == "http" {
-#         url.redirect = (".*" => "https://wiki.fuz.re$0")
-    # }
-
-# FIXME: Redirect www -> https without www
-# $HTTP["host"] == "www.fuz.re" {
-#     $HTTP["scheme"] == "http" {
-#         url.redirect = (".*" => "https://fuz.re$0")
-#     }
-# }
-# Redirect http -> https without www
-# FIXME: Redirect www -> https without www
-# $HTTP["host"] == "fuz.re" {
-#     $HTTP["scheme"] == "http" {
-#         url.redirect = (".*" => "https://fuz.re$0")
-#     }
-# FIXME: HTTPS :
-    # $HTTP["scheme"] == "https" {
-    #     $SERVER["socket"] == ":443" {
-	# 		ssl.engine  = "enable"
-	# server.document-root = "/var/www/fuz.re/newsite/public"
-	# 		ssl.pemfile = "/etc/letsencrypt/live/fuz.re/fullchain.pem"
-	# 		ssl.privkey = "/etc/letsencrypt/live/fuz.re/privkey.pem"
-	# 	}
-    
-# Old Jack.tf
-$HTTP["host"] == "jack.fuz.re" {
-    server.document-root = "/var/www/fuz.re/jack/site"
-    $HTTP["scheme"] == "http" {
-         $HTTP["url"] !~ "^/.well-known/acme-challenge/" {
-         url.redirect = (".*" => "https://jack.fuz.re$0")
-         }
-    }
-    $HTTP["scheme"] == "https" {
-	$SERVER["socket"] == ":443" {
-             ssl.engine  = "enable"
-		ssl.pemfile = "/etc/letsencrypt/live/jack.fuz.re/fullchain.pem"
-		ssl.privkey = "/etc/letsencrypt/live/jack.fuz.re/privkey.pem"
-        }
-    }
-}
-
-
-$HTTP["host"] == "riot.fuz.re" {
-    server.document-root = "/var/www/fuz.re/riot/site"
-    $HTTP["scheme"] == "http" {
-		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
-	            url.redirect = (".*" => "https://riot.fuz.re$0")
-		}
-    }
-    $HTTP["scheme"] == "https" {
-        alias.url = (
-                "/rc" => "/var/www/fuz.re/riot/rc"
-        )
-
-	$SERVER["socket"] == ":443" {
-                ssl.engine  = "enable"
-		ssl.pemfile = "/etc/letsencrypt/live/riot.fuz.re/fullchain.pem"
-		ssl.privkey = "/etc/letsencrypt/live/riot.fuz.re/privkey.pem"
-        }
-    }
-}
-
-$HTTP["host"] == "matrix.fuz.re" {
-    server.document-root = "/var/www/fuz.re/matrix/site"
-    $HTTP["scheme"] == "http" {
-		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
-			url.redirect = (".*" => "https://matrix.fuz.re$0")
-		}
-    }
-    $SERVER["socket"] == ":443" {
-    	ssl.engine  = "enable"
-	ssl.pemfile = "/etc/letsencrypt/live/matrix.fuz.re/fullchain.pem"
-	ssl.privkey = "/etc/letsencrypt/live/matrix.fuz.re/privkey.pem"
-    	proxy.server = ( "" => (( "host" => "127.0.0.1", "port" => 8008 )))
-    	proxy.header = ( "map-host-request" => ( "-" => "matrix.fuz.re"),
-    			     "map-host-response" => ("-" => "-"))
-    }
-    $SERVER["socket"] == ":8448" {
-    	ssl.engine  = "enable"
-	ssl.pemfile = "/etc/letsencrypt/live/matrix.fuz.re/fullchain.pem"
-	ssl.privkey = "/etc/letsencrypt/live/matrix.fuz.re/privkey.pem"
-    	proxy.server = ( "" => (( "host" => "127.0.0.1", "port" => 8008 )))
-    	proxy.header = ( "map-host-request" => ( "-" => "matrix.fuz.re"),
-    			     "map-host-response" => ("-" => "-"))
-    }
-}
-
-$HTTP["host"] == "mumble.fuz.re" {
-    $HTTP["scheme"] == "http" {
-    	server.document-root = "/var/www/fuz.re/mumble/site"
-	$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
-		url.redirect = (".*" => "https://mumble.fuz.re$0")
-	}
-    }
-
-    $SERVER["socket"] == ":443" {
-    	ssl.engine  = "enable"
-	ssl.pemfile = "/etc/letsencrypt/live/mumble.fuz.re/fullchain.pem"
-	ssl.privkey = "/etc/letsencrypt/live/mumble.fuz.re/privkey.pem"
-    	url.redirect-code = 302 # it's a workaround for retarded lighttpd unable to handle websockets, hence a temp 302 redirection -- Lomanic 20200606
-    	url.redirect = (".*" => "https://mumble.fuz.re:64737$0")
-    }
-}
-
-
-
-$HTTP["host"] == "presence.fuz.re" { # added by Lomanic 20200606
-    $HTTP["scheme"] == "http" {
-    	server.document-root = "/var/www/fuz.re/presence/site"
-		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
-			url.redirect = (".*" => "https://${url.authority}${url.path}${qsa}")
-		}
-    }
-
-	$SERVER["socket"] == ":443" {
-		ssl.engine  = "enable"
-		proxy.server = ( "" => (("host" => "127.0.0.1", "port" => 3000)) )
-		#ssl.ca-file = "/etc/letsencrypt/live/presence.fuz.re/chain.pem"
-		#ssl.pemfile = "/etc/lighttpd/certs/presence.fuz.re.pem"
-
-		ssl.pemfile = "/etc/letsencrypt/live/presence.fuz.re/fullchain.pem"
-		ssl.privkey = "/etc/letsencrypt/live/presence.fuz.re/privkey.pem"
-	}
-}
-$HTTP["host"] == "spaceapi.fuz.re" { # added by Lomanic 20201017
-	$HTTP["scheme"] == "http" {
-		server.document-root = "/var/www/fuz.re/spaceapi/site"
-		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
-			url.redirect = (".*" => "https://${url.authority}${url.path}${qsa}")
-		}
-	}
-
-	$SERVER["socket"] == ":443" {
-		ssl.engine  = "enable"
-		proxy.server = ( "" => (("host" => "127.0.0.1", "port" => 3001)) )
-		ssl.pemfile = "/etc/letsencrypt/live/spaceapi.fuz.re/fullchain.pem"
-		ssl.privkey = "/etc/letsencrypt/live/spaceapi.fuz.re/privkey.pem"
-	}
-}
-
-$HTTP["host"] == "sonic.fuz.re" {
-	server.document-root = "/var/www/sonic.fuz.re/"
-}
-
-### Mailman ###
-$HTTP["host"] == "liste.fuz.re" {
-	server.document-root = "/var/www/fuz.re/liste/site"
-	$HTTP["scheme"] == "http" {
-		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
-			url.redirect = (".*" => "https://liste.fuz.re$0")
-		}
-	}
-	$SERVER["socket"] == ":443" {
-		ssl.engine  = "enable"
-		#ssl.ca-file = "/etc/letsencrypt/live/liste.fuz.re/chain.pem"
-		#ssl.pemfile = "/etc/letsencrypt/live/liste.fuz.re/combined.pem"
-		ssl.pemfile = "/etc/letsencrypt/live/liste.fuz.re/fullchain.pem"
-		ssl.privkey = "/etc/letsencrypt/live/liste.fuz.re/privkey.pem"
-	}
-	alias.url = (
-        "/mailman/" => "/usr/lib/cgi-bin/mailman/",
-        "/cgi-bin/mailman/" => "/usr/lib/cgi-bin/mailman/",
-        "/images/mailman/" => "/usr/share/images/mailman/",
-        #"/pipermail/" => "/var/lib/mailman/archives/public/"
-    )
-    cgi.assign = (
-        "/admin" => "",
-        "/admindb" => "",
-        "/confirm" => "",
-        "/create" => "",
-        "/edithtml" => "",
-        "/listinfo" => "",
-        "/options" => "",
-        "/private" => "",
-        "/rmlist" => "",
-        "/roster" => "",
-        "/subscribe" => "")
-}
-
-## Datapaulette - Pas hébérgé ici non plus
-# $HTTP["host"] =~ "www.datapaulette.org" {
-# 	url.redirect = (".*" => "http://datapaulette.org")
-# }
-# $HTTP["host"] =~ "datapaulette.org" {
-#         server.error-handler-404 = "/index.php"
-#         server.document-root = "/var/www/datapaulette.org/dp-wp"
-#        $SERVER["socket"] == ":443" {
-#                ssl.engine  = "enable"
-#                ssl.ca-file = "/etc/letsencrypt/live/datapaulette.org/fullchain.pem"
-#                ssl.pemfile = "/etc/lighttpd/certs/datapaulette.org.pem"
-#        }
-        #url.rewrite = (
-        #       "^/(.*)\.(.+)$" => "$0",
-        #       ###"^/(wp-admin|wp-includes|wp-content|gallery2)/(.*)" => "$0",
-        #       "^/(.+)/?$" => "/index.php/$1"
-        #)
-}
-
-### WOOTDEVICES.IO  - https à activer après copie des certs
-$HTTP["host"] == "wootdevices.io" {
-        server.document-root = "/var/www/wootdevices.io/site/"
-#        $SERVER["socket"] == ":443" {
-#                ssl.engine  = "enable"
-#                ssl.ca-file = "/etc/letsencrypt/live/wootdevices.io/fullchain.pem"
-#                ssl.pemfile = "/etc/lighttpd/certs/wootdevices.io.pem"
-#        }
-}
-