noticket - reorganized podman

ansible/roles/podman/tasks/containers/base/awsddns.yml

@@ -0,0 +1,81 @@
+---
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: awsddns
+    container_image: "{{ image }}"
+
+- name: create home.bdebyl.net awsddns server container
+  become: true
+  become_user: "{{ podman_user }}"
+  diff: false
+  containers.podman.podman_container:
+    name: awsddns
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    env:
+      AWS_ZONE_TTL: 60
+      AWS_ZONE_ID: "{{ aws_zone_id }}"
+      AWS_ZONE_HOSTNAME: "{{ aws_zone_hostname }}"
+      AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}"
+      AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}"
+      AWS_DEFAULT_REGION: "{{ aws_default_region }}"
+
+- name: create systemd startup job for awsddns
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: awsddns
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: awsddns-skudak
+    container_image: "{{ image }}"
+
+- name: create wiki.skudakrennsport.com awsddns server container
+  become: true
+  become_user: "{{ podman_user }}"
+  diff: false
+  containers.podman.podman_container:
+    name: awsddns-skudak
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    env:
+      AWS_ZONE_TTL: 60
+      AWS_ZONE_ID: "{{ aws_skudak_zone_id }}"
+      AWS_ZONE_HOSTNAME: "{{ aws_skudak_zone_hostname }}"
+      AWS_ACCESS_KEY_ID: "{{ aws_skudak_access_key_id }}"
+      AWS_SECRET_ACCESS_KEY: "{{ aws_skudak_secret_access_key }}"
+      AWS_DEFAULT_REGION: "{{ aws_default_region }}"
+
+- name: create systemd startup job for awsddns-skudak
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: awsddns-skudak
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: awsddns-fulfillr
+    container_image: "{{ image }}"
+
+- name: create fulfillr.debyltech.com awsddns server container
+  become: true
+  become_user: "{{ podman_user }}"
+  diff: false
+  containers.podman.podman_container:
+    name: awsddns-fulfillr
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    env:
+      AWS_ZONE_TTL: 60
+      AWS_ZONE_ID: "{{ fulfillr_zone_id }}"
+      AWS_ZONE_HOSTNAME: "{{ fulfillr_server_name }}"
+      AWS_ACCESS_KEY_ID: "{{ fulfillr_dns_access_key }}"
+      AWS_SECRET_ACCESS_KEY: "{{ fulfillr_dns_secret_key }}"
+      AWS_DEFAULT_REGION: "{{ fulfillr_region }}"
+
+- name: create systemd startup job for awsddns-fulfillr
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: awsddns-fulfillr

ansible/roles/podman/tasks/containers/base/conf-nginx-http.yml

@@ -0,0 +1,101 @@
+---
+- name: create required nginx volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ nginx_path }}/etc"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  tags: http
+
+- name: setup nginx base configuration
+  become: true
+  ansible.builtin.template:
+    src: templates/nginx/nginx.conf.j2
+    dest: "{{ nginx_path }}/etc/nginx.conf"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: http
+
+- name: create required nginx files
+  become: true
+  ansible.builtin.copy:
+    src: "files/nginx/{{ item }}"
+    dest: "{{ nginx_path }}/etc/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - mime.types
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: http
+
+- name: setup nginx directories
+  become: true
+  ansible.builtin.file:
+    path: "{{ nginx_path }}/etc/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    state: directory
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - sites-enabled
+    - sites-available
+  tags: http
+
+- name: template nginx http sites-available
+  become: true
+  ansible.builtin.template:
+    src: "templates/nginx/sites/{{ item }}.j2"
+    dest: "{{ nginx_path }}/etc/sites-available/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - "{{ assistant_server_name }}.conf"
+    - "{{ bookstack_server_name }}.conf"
+    - "{{ ci_server_name }}.http.conf"
+    - "{{ cloud_server_name }}.conf"
+    - "{{ cloud_skudak_server_name }}.conf"
+    - "{{ fulfillr_server_name }}.conf"
+    - "{{ home_server_name }}.conf"
+    - "{{ logs_server_name }}.conf"
+    - "{{ parts_server_name }}.conf"
+    - "{{ photos_server_name }}.conf"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: http
+
+- name: enable desired nginx http sites
+  become: true
+  ansible.builtin.file:
+    src: "../sites-available/{{ item }}"
+    dest: "{{ nginx_path }}/etc/sites-enabled/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    state: link
+  loop:
+    - "{{ assistant_server_name }}.conf"
+    - "{{ bookstack_server_name }}.conf"
+    - "{{ ci_server_name }}.http.conf"
+    - "{{ cloud_server_name }}.conf"
+    - "{{ cloud_skudak_server_name }}.conf"
+    - "{{ fulfillr_server_name }}.conf"
+    - "{{ home_server_name }}.conf"
+    - "{{ logs_server_name }}.conf"
+    - "{{ parts_server_name }}.conf"
+    - "{{ photos_server_name }}.conf"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: http

ansible/roles/podman/tasks/containers/base/conf-nginx-https.yml

@@ -0,0 +1,68 @@
+---
+- name: create nginx ssl directory
+  become: true
+  ansible.builtin.file:
+    path: "{{ nginx_path }}/etc/ssl"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+    state: directory
+  tags: https
+
+- name: stat dhparam
+  become: true
+  ansible.builtin.stat:
+    path: "{{ nginx_path }}/etc/ssl/dhparam.pem"
+  register: dhparam
+  tags: https
+
+- name: generate openssl dhparam for nginx
+  become: true
+  ansible.builtin.command: |
+    openssl dhparam -out {{ nginx_path }}/ssl/dhparam.pem 2048
+  when: not dhparam.stat.exists
+  args:
+    creates: "{{ nginx_path }}/ssl/dhparam.pem"
+  tags: https
+
+- name: template nginx https sites-available
+  become: true
+  ansible.builtin.template:
+    src: "templates/nginx/sites/{{ item }}.j2"
+    dest: "{{ nginx_path }}/etc/sites-available/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - "{{ bookstack_server_name }}.https.conf"
+    - "{{ ci_server_name }}.https.conf"
+    - "{{ cloud_server_name }}.https.conf"
+    - "{{ cloud_skudak_server_name }}.https.conf"
+    - "{{ fulfillr_server_name }}.https.conf"
+    - "{{ parts_server_name }}.https.conf"
+    - "{{ photos_server_name }}.https.conf"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: https
+
+- name: enable desired nginx https sites
+  become: true
+  ansible.builtin.file:
+    src: "../sites-available/{{ item }}"
+    dest: "{{ nginx_path }}/etc/sites-enabled/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    state: link
+  loop:
+    - "{{ bookstack_server_name }}.https.conf"
+    - "{{ ci_server_name }}.https.conf"
+    - "{{ cloud_server_name }}.https.conf"
+    - "{{ cloud_skudak_server_name }}.https.conf"
+    - "{{ fulfillr_server_name }}.https.conf"
+    - "{{ parts_server_name }}.https.conf"
+    - "{{ photos_server_name }}.https.conf"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: https

ansible/roles/podman/tasks/containers/base/conf-nginx-modsec.yml

@@ -0,0 +1,127 @@
+---
+- name: create nginx/conf directory
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - "{{ nginx_conf_path }}"
+    - "{{ modsec_rules_path }}"
+  notify: restorecon podman
+  tags: modsec
+
+- name: create modsec_includes.conf
+  become: true
+  ansible.builtin.copy:
+    src: files/nginx/modsec_includes.conf
+    dest: "{{ nginx_path }}/etc/modsec_includes.conf"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: modsec
+
+- name: clone coreruleset and modsecurity
+  become: true
+  ansible.builtin.git:
+    repo: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    update: "{{ update_modsec | default(false) }}"
+    force: true
+    version: "{{ item.ver }}"
+  loop: "{{ modsec_git_urls }}"
+  tags: modsec
+
+- name: setup modsec and coreruleset configs
+  become: true
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    force: "{{ update_modsec | default(false) }}"
+    mode: 0644
+    remote_src: true
+  loop: "{{ modsec_conf_links }}"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: modsec
+
+- name: setup coreruleset rules
+  become: true
+  ansible.builtin.copy:
+    src: "{{ crs_rules_path }}/{{ item.name }}.conf"
+    dest: "{{ modsec_rules_path }}/{{ item.name }}.conf"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    force: "{{ update_modsec | default(false) }}"
+    mode: 0644
+    remote_src: true
+  when: item.enabled
+  loop: "{{ crs_rule_links }}"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags:
+    - modsec
+    - modsec_rules
+
+- name: removed disabled coreruleset rules
+  become: true
+  ansible.builtin.file:
+    path: "{{ modsec_rules_path }}/{{ item.name }}.conf"
+    state: absent
+  when: not item.enabled
+  loop: "{{ crs_rule_links }}"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags:
+    - modsec
+    - modsec_rules
+
+- name: setup coreruleset data
+  become: true
+  ansible.builtin.copy:
+    src: "{{ crs_rules_path }}/{{ item }}.data"
+    dest: "{{ modsec_rules_path }}/{{ item }}.data"
+    force: "{{ update_modsec | default(false) }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+    remote_src: true
+  loop: "{{ crs_data_links }}"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags:
+    - modsec
+    - modsec_rules
+
+- name: whitelist local ip addresses
+  become: true
+  ansible.builtin.lineinfile:
+    path: "{{ modsec_crs_before_rule_conf }}"
+    regexp: "{{ modsec_whitelist_local_re }}"
+    line: "{{ modsec_whitelist_local }}"
+  notify: restart nginx
+  tags:
+    - modsec
+    - modsec_rules
+    - modsec_whitelist
+
+- name: activate mod-security
+  become: true
+  ansible.builtin.lineinfile:
+    path: "{{ nginx_path }}/etc/modsecurity.conf"
+    regexp: "{{ item.regex }}"
+    line: "{{ item.line }}"
+  loop: "{{ modsec_conf_replaces }} "
+  notify: restart nginx
+  tags: modsec

ansible/roles/podman/tasks/containers/base/conf-nginx.yml

@@ -0,0 +1,23 @@
+---
+- name: create letsencrypt shared root srv directory
+  become: true
+  ansible.builtin.file:
+    path: /srv/http/letsencrypt
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+    state: directory
+  tags:
+    - ssl
+    - https
+
+- import_tasks: conf-nginx-http.yml
+- import_tasks: conf-nginx-https.yml
+- import_tasks: conf-nginx-modsec.yml
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+  tags:
+    - http
+    - modsec
+    - modsec_rules

ansible/roles/podman/tasks/containers/base/nginx.yml

@@ -0,0 +1,32 @@
+---
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: nginx
+    container_image: "{{ image }}"
+
+- name: create nginx container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: nginx
+    image: "{{ image }}"
+    entrypoint: ""
+    command: ["nginx", "-g", "daemon off;"]
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - host
+    cap_add:
+      - CAP_NET_BIND_SERVICE
+    ports:
+      - 80:80
+      - 443:443
+    volumes:
+      - "{{ nginx_path }}/etc:/etc/nginx:ro"
+      - "/srv/http/letsencrypt:/srv/http/letsencrypt:z"
+      - "/etc/letsencrypt:/etc/letsencrypt:ro"
+
+- name: create systemd startup job for nginx
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: nginx