306 lines
9.6 KiB
YAML
306 lines
9.6 KiB
YAML
# - name: Init bouncer env vars
|
|
# ansible.builtin.set_fact:
|
|
# crowdsec_env:
|
|
# COLLECTIONS: crowdsecurity/nginx
|
|
# GID: ${GID-1000}
|
|
|
|
# - name: Collect bouncer keys
|
|
# set_fact:
|
|
# bouncer_key_env: "{{
|
|
# groups['all'] | map('extract', hostvars) |
|
|
# json_query('[?crowdsec_firewall_bouncer_enabled && crowdsec_firewall_bouncer_enabled==`true`].{key: inventory_hostname, value: vault_crowdsec_firewall_bouncer_key}') |
|
|
# list
|
|
# }}"
|
|
|
|
# - name: Append bouncer keys env vars
|
|
# ansible.builtin.set_fact:
|
|
# crowdsec_env: "{{ crowdsec_env | combine({ 'BOUNCER_KEY_firewall_' + item.key: item.value }) }}"
|
|
# loop: "{{ bouncer_key_env }}"
|
|
# - name: Collect bouncer keys
|
|
# debug:
|
|
# msg: "{{ crowdsec_env }}"
|
|
|
|
# - name: Set default repo name
|
|
# debug:
|
|
# msg: "{{ odoo_repos | json_query('[].{name: name || url.split(`/`)[1].split(`.`)[0], pull:pull, url:url, version:version, }') }}"
|
|
|
|
# - name: set_fact
|
|
# set_fact:
|
|
# revoke_tables: "{{ postgres_users | subelements('revoke_tables') | subelements('databases', 'skip_missing=True') }}"
|
|
|
|
# - name: "Revoke privilieges to users."
|
|
# debug:
|
|
# msg: "{{ revoke_tables }}"
|
|
|
|
# - name: "Revoke privilieges to users."
|
|
# debug:
|
|
# msg: "{{ item.0.name }}, {{ item.1.name }}"
|
|
# loop: "{{ revoke_tables }}"
|
|
|
|
# - name: "Grant privilieges to users."
|
|
# debug:
|
|
# var: "{{ item.0.name }}, {{ item.1 }}"
|
|
# loop: "{{ postgres_users | subelements('databases') }}"
|
|
|
|
# - name: "Get ip address of postgres container"
|
|
# shell: "docker inspect --format '{''{range.NetworkSettings.Networks}''}''{''{.IPAddress}''}''{''{end}''}' {{ postgres_hostname }}"
|
|
# register: ip_address
|
|
|
|
# - name: debug
|
|
# debug:
|
|
# var: ip_address.stdout
|
|
|
|
# - name: Distribution
|
|
# debug: msg="{{ ansible_distribution }}"
|
|
# - name: Distribution version
|
|
# debug: msg="{{ ansible_distribution_version }}"
|
|
# - name: Distribution major version
|
|
# debug: msg="{{ ansible_distribution_major_version }}"
|
|
|
|
# - name: Debug
|
|
# debug:
|
|
# var: groups.all
|
|
|
|
# - name: Dig src DNS record
|
|
# debug:
|
|
# msg: "{{ lookup('dig', item.src_hostname) }}"
|
|
# loop: "{{ nginx_proxies }}"
|
|
# register: dig_src
|
|
|
|
# - name: Dig host DNS record
|
|
# debug:
|
|
# msg: "{{ lookup('dig', ansible_host) }}"
|
|
# register: dig_host
|
|
|
|
# - name: src DNS record
|
|
# debug:
|
|
# msg: "{{ dig_src.results }}"
|
|
|
|
# - name: host DNS record
|
|
# debug:
|
|
# msg: "{{ dig_host.msg }}"
|
|
|
|
# - name: Fail if src IP is not resolved correctly
|
|
# fail:
|
|
# msg: "DNS record for {{ item.item.src_hostname }} does not point to proxy host."
|
|
# when: item.msg != dig_host.msg
|
|
# loop: "{{ dig_src.results }}"
|
|
|
|
# - name: odoo master password
|
|
# debug:
|
|
# msg: "{{ vault_odoo_master_password }}"
|
|
|
|
# - name: odoo master password hash
|
|
# debug:
|
|
# msg: "{{ vault_odoo_master_password_hash }}"
|
|
|
|
# - name: odoo master password hash caculated
|
|
# debug:
|
|
# msg: "{{ vault_odoo_master_password | password_hash('pbkdf2_sha512') }}"
|
|
|
|
# - name: odoo https
|
|
# debug:
|
|
# msg: "{{ groups['all'] | map('extract', hostvars) |
|
|
# json_query('[*].nginx_proxies[?monitor_odoo==`true`].src_hostname') |
|
|
# flatten }}"
|
|
|
|
# - name: cadvisor https
|
|
# debug:
|
|
# msg: "{{ groups['all'] | map('extract', hostvars) |
|
|
# json_query('[? cadvisor_hostname && prometheus_target_scheme==`https`].[ansible_host,prometheus_target_port]') |
|
|
# map('join', ':') | list }}"
|
|
|
|
# - name: cadvisor http
|
|
# debug:
|
|
# msg: "{{ groups['all'] | map('extract', hostvars) |
|
|
# json_query('[? cadvisor_hostname && prometheus_target_scheme==`http`].[ansible_host,prometheus_target_port]') |
|
|
# map('join', ':') | list }}"
|
|
|
|
# - name: node_exporter https
|
|
# debug:
|
|
# msg: "{{ groups['all'] | map('extract', hostvars) |
|
|
# json_query('[? node_exporter_hostname && prometheus_target_scheme==`https`].[ansible_host,prometheus_target_port]') |
|
|
# map('join', ':') | list }}"
|
|
|
|
# - name: node_exporter http
|
|
# debug:
|
|
# msg: "{{ groups['all'] | map('extract', hostvars) |
|
|
# json_query('[? node_exporter_hostname && prometheus_target_scheme==`http`].[ansible_host,prometheus_target_port]') |
|
|
# map('join', ':') | list }}"
|
|
|
|
# - name: nextcloud-exporter https
|
|
# debug:
|
|
# msg: "{{ groups['all'] | map('extract', hostvars) |
|
|
# json_query('[? nextcloud_exporter_hostname && prometheus_target_scheme==`https`].[ansible_host,prometheus_target_port]') |
|
|
# map('join', ':') | list }}"
|
|
|
|
# - name: bigbluebutton_exporter http
|
|
# debug:
|
|
# msg: "{{ groups['all'] | map('extract', hostvars) |
|
|
# json_query('[? bigbluebutton_exporter_hostname && prometheus_target_scheme==`http`].[ansible_host,prometheus_target_port]') |
|
|
# map('join', ':') | list }}"
|
|
|
|
# - name: postgres_exporter https
|
|
# debug:
|
|
# msg: "{{ groups['all'] | map('extract', hostvars) |
|
|
# json_query('[? postgres_exporter_hostname && prometheus_target_scheme==`https`].[ansible_host,prometheus_target_port]') |
|
|
# map('join', ':') | list }}"
|
|
|
|
# - name: restic_server https
|
|
# debug:
|
|
# msg: "{{ groups['all'] | map('extract', hostvars) |
|
|
# json_query('[? restic_server_hostname && prometheus_target_scheme==`https`].[ansible_host,prometheus_target_port]') |
|
|
# map('join', ':') | list }}"
|
|
|
|
# - name: Extract and filter targets
|
|
# set_fact:
|
|
# src_hostnames: "{{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false` && monitor!=null].src_hostname') | flatten }}"
|
|
|
|
# - name: Extract and filter targets
|
|
# set_fact:
|
|
# paths: "{{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false` && monitor!=null].monitor') | flatten }}"
|
|
|
|
# - name: Generate URLs and store in a list
|
|
# debug:
|
|
# msg: "{{ src_hostnames | zip(paths) | map('join', '') | map('regex_replace', '^(.*)$', 'https://\\1') }}"
|
|
|
|
# - name: debug
|
|
# debug:
|
|
# msg: "{{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false`].src_hostname') | flatten | map('regex_replace', '^(.*)$', 'https://\\1') }}"
|
|
|
|
# register: ansible_jobs
|
|
# async: 120
|
|
# poll: 0
|
|
|
|
# - name: Wait for extraction to finish
|
|
# async_status:
|
|
# jid: "{{ item.ansible_job_id }}"
|
|
# register: ansible_job
|
|
# until: ansible_job.finished
|
|
# delay: 5
|
|
# retries: 10
|
|
# loop: "{{ ansible_jobs.results }}"
|
|
|
|
# - name: debug
|
|
# debug:
|
|
# msg:
|
|
# - "{{ ansible_memtotal_mb }}"
|
|
# - "{{ ansible_processor_vcpus }}"
|
|
# - "{{ (ansible_memtotal_mb * 0.25 * 1024) | round }}kB"
|
|
# - "{{ (ansible_memtotal_mb * 0.75 * 1024) | round }}kB"
|
|
# - "{{ (ansible_memtotal_mb * 0.062 * 1024) | round }}kB"
|
|
# - "{{ (((ansible_memtotal_mb * 1024) - (ansible_memtotal_mb * 0.25 * 1024)) / (3 * postgres_max_connections)) | round }}kB"
|
|
|
|
# - name: debug
|
|
# debug:
|
|
# var: groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor==`true`].src_hostname') | flatten
|
|
|
|
# - name: debug
|
|
# debug:
|
|
# var: hostvars[inventory_hostname]
|
|
|
|
# - name: set Digests
|
|
# set_fact:
|
|
# odoo_image: odoo@sha256:d4960fde390072f14b197f45775770b7cafc43d3afea60882766ce7d2004aa00
|
|
|
|
# - name: Pull odoo image
|
|
# docker_image:
|
|
# name: "{{ odoo_image }}"
|
|
# source: pull
|
|
# force_source: true
|
|
# register: pull_odoo_image
|
|
|
|
# - name: Tag odoo image
|
|
# command: "docker tag {{ odoo_image[7:19] }} odoo:{{ odoo_image[7:19] }}"
|
|
# when: pull_odoo_image.image.RepoTags | length == 0
|
|
|
|
# - name: Dig DNS CNAME record
|
|
# debug:
|
|
# msg: "{{ lookup('dig', item.src_hostname, 'qtype=CNAME') }}"
|
|
# register: dig
|
|
# loop: "{{ nginx_proxies }}"
|
|
|
|
# - name: Fail if DNS record points to alias.zeit.co.
|
|
# fail:
|
|
# msg: DNS record points to default alias.
|
|
# when: item.msg == 'alias.zeit.co.'
|
|
# loop: "{{ dig.results }}"
|
|
|
|
# - name: Debug
|
|
# debug:
|
|
# var: groups
|
|
|
|
# |fetchlistfromdict(groups.servers)
|
|
|
|
# - name: Debug
|
|
# debug:
|
|
# var: (groups.exporter | map('extract', hostvars) | map(attribute='ansible_host') | list)
|
|
# (hostvars | dict2items | json_query('[*].value') | json_query('[?group_names[0]==`exporter`]') | select('ansible_host'))
|
|
|
|
# groups
|
|
# [?ansible_host==`zeus.mint-system.com`]
|
|
# | json_query('[?ansible_host==`zeus.mint-system.com`]')
|
|
#
|
|
|
|
# - name: Register nginx conf files
|
|
# command: "ls -1 {{ nginx_data_dir }}"
|
|
# register: nginx_proxy_conf_files
|
|
|
|
# - name: Debug
|
|
# debug:
|
|
# var: nginx_proxy_conf_files
|
|
|
|
# - set_fact:
|
|
# managed_files: "{{ nginx_proxies | map(attribute='src_hostname') | map('regex_replace', '^(.*)$', '\\1.conf') | list }}"
|
|
|
|
# - name: Debug
|
|
# debug:
|
|
# var: managed_files
|
|
|
|
# - name: Remove unmanaged nginx conf files
|
|
# file:
|
|
# path: "{{ nginx_data_dir }}/{{ item }}"
|
|
# state: absent
|
|
# loop: "{{ nginx_proxy_conf_files.stdout_lines }}"
|
|
# when: item not in (json_query(certbot_stat_filter) | list)
|
|
|
|
# - name: Debug modsecurity_exclude_rules_before_crs
|
|
# debug:
|
|
# msg: "{{ item }}"
|
|
# loop: "{{ modsecurity_exclude_rules_before_crs }}"
|
|
|
|
# - name: Check if cert files exist
|
|
# stat:
|
|
# path: "{{ certbot_data_dir }}/live/{{ item.src_hostname }}"
|
|
# loop: "{{ nginx_proxies }}"
|
|
# register: certbot_certs
|
|
|
|
# - name: Debug certbot_certs
|
|
# debug:
|
|
# msg: "{{ certbot_certs }}"
|
|
|
|
# - name: Debug certbot_certs
|
|
# debug:
|
|
# msg: "{{ certbot_certs | json_query('results[*] | [?stat.exists==`false`].item.src_hostname') | list }}"
|
|
|
|
# - name: Debug hi
|
|
# debug:
|
|
# msg: "hi"
|
|
# when: certbot_certs | json_query(certbot_stat_filter) | list
|
|
|
|
# - name: Debug postgres_hostname
|
|
# debug:
|
|
# var: postgres_hostname
|
|
|
|
# - name: Debug nginx_hostname
|
|
# debug:
|
|
# var: nginx_hostname
|
|
|
|
# - name: Debug bookstack_hostname
|
|
# debug:
|
|
# var: bookstack_hostname
|
|
|
|
# - name: debug
|
|
# debug:
|
|
# msg: "{{ vercel_domains.json | json_query('domains[*].{name: name, id: id}') }}"
|