139 lines
5 KiB
YAML
139 lines
5 KiB
YAML
---
|
|
### mrlesmithjr.ansible-manage-lvm
|
|
lvm_groups:
|
|
- vgname: vg_docker
|
|
disks:
|
|
- /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi1
|
|
create: true
|
|
lvnames:
|
|
- lvname: lv_docker
|
|
size: +100%FREE
|
|
create: true
|
|
filesystem: xfs
|
|
mount: true
|
|
mntp: /var/lib/docker
|
|
manage_lvm: true
|
|
pvresize_to_max: true
|
|
|
|
### geerlingguy.pip
|
|
pip_package: python3-pip
|
|
pip_install_packages:
|
|
- name: docker # für munin-plugin docker_
|
|
|
|
### mgrote.apt_manage_packages
|
|
apt_packages_extra:
|
|
- libnet-dns-perl # für munin: dnsresponse_*
|
|
|
|
### mgrote_user
|
|
users:
|
|
- username: mg
|
|
password: "{{ lookup('keepass', 'mg_linux_password_hash', 'password') }}"
|
|
update_password: always
|
|
groups: ssh, sudo, docker
|
|
state: present
|
|
public_ssh_key: "{{ ssh_public_key_mg }}"
|
|
allow_sudo: true
|
|
allow_passwordless_sudo: true
|
|
- username: docker-user
|
|
password: "{{ lookup('keepass', 'docker-user_linux_password_hash', 'password') }}"
|
|
update_password: always
|
|
groups: ssh, sudo, docker
|
|
state: present
|
|
allow_sudo: true
|
|
allow_passwordless_sudo: true
|
|
uid: "5000"
|
|
- username: ansible-user
|
|
password: "{{ lookup('keepass', 'ansible_user_linux_password_hash', 'password') }}"
|
|
update_password: always
|
|
groups: ssh, sudo
|
|
state: present
|
|
public_ssh_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcBwOjanQV6sFWaTetqpl20SVe3aRzGjKbsp7hKkDCE mg@irantu
|
|
allow_sudo: true
|
|
allow_passwordless_sudo: true
|
|
|
|
### geerlingguy.docker
|
|
docker_users:
|
|
- mg
|
|
- docker-user
|
|
docker_install_compose: true
|
|
docker_add_repo: false # erstelle kein Repo-Eintrag unter /etc/apt/sources.list.d/, steht explizit unter "repos_override", wird nur zum installieren benötigt
|
|
|
|
### mgrote_docker-compose-deploy
|
|
docker_compose_base_dir: /home/docker-user
|
|
|
|
### mgrote_apt_manage_sources
|
|
repos_override: # mit docker-repos
|
|
- deb [arch=amd64] https://download.docker.com/linux/ubuntu jammy stable
|
|
- "deb http://de.archive.ubuntu.com/ubuntu/ {{ ansible_distribution_release }} main restricted"
|
|
- "deb http://de.archive.ubuntu.com/ubuntu/ {{ ansible_distribution_release }}-updates main restricted"
|
|
- "deb http://de.archive.ubuntu.com/ubuntu/ {{ ansible_distribution_release }} universe"
|
|
- "deb http://de.archive.ubuntu.com/ubuntu/ {{ ansible_distribution_release }}-updates universe"
|
|
- "deb http://de.archive.ubuntu.com/ubuntu/ {{ ansible_distribution_release }} multiverse"
|
|
- "deb http://de.archive.ubuntu.com/ubuntu/ {{ ansible_distribution_release }}-updates multiverse"
|
|
- "deb http://de.archive.ubuntu.com/ubuntu/ {{ ansible_distribution_release }}-backports main restricted universe multiverse"
|
|
- "deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security main restricted"
|
|
- "deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security universe"
|
|
- "deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security multiverse"
|
|
|
|
### mgrote_systemd_resolved
|
|
systemd_resolved_nameserver: 192.168.2.37
|
|
|
|
### mgrote_munin_node
|
|
munin_node_allowed_cidrs: [0.0.0.0/0] # weil der munin-server aus einem anderen subnet zugreift
|
|
munin_node_plugins:
|
|
- name: systemd_status
|
|
src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/systemd/systemd_status
|
|
- name: systemd_mem
|
|
src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/systemd/systemd_mem
|
|
config: |
|
|
[systemd_mem]
|
|
env.all_services true
|
|
- name: lvm_
|
|
src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/disk/lvm_
|
|
config: |
|
|
[lvm_*]
|
|
user root
|
|
- name: fail2ban
|
|
src: https://git.mgrote.net/mg/munin-plugins/raw/branch/master/extern/fail2ban
|
|
config: |
|
|
[fail2ban]
|
|
env.client /usr/bin/fail2ban-client
|
|
env.config_dir /etc/fail2ban
|
|
user root
|
|
- name: docker_containers
|
|
src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/docker/docker_
|
|
config: |
|
|
[docker_*]
|
|
user root
|
|
env.DOCKER_HOST unix://run/docker.sock
|
|
- name: docker_cpu
|
|
src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/docker/docker_
|
|
- name: docker_memory
|
|
src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/docker/docker_
|
|
- name: docker_network
|
|
src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/docker/docker_
|
|
- name: docker_volumes
|
|
src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/docker/docker_
|
|
- name: docker_volumesize
|
|
src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/docker/docker_volumesize
|
|
- name: chrony
|
|
src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/chrony/chrony
|
|
|
|
### oefenweb.ufw
|
|
ufw_rules:
|
|
- rule: allow
|
|
to_port: 22
|
|
protocol: tcp
|
|
comment: 'ssh'
|
|
from_ip: 0.0.0.0/0
|
|
- rule: allow
|
|
to_port: 4949
|
|
protocol: tcp
|
|
comment: 'munin'
|
|
from_ip: 192.168.2.0/24
|
|
- rule: allow
|
|
from_ip: 192.168.0.0/16
|
|
comment: 'docker networks'
|
|
- rule: allow
|
|
from_ip: 172.0.0.0/8
|
|
comment: 'docker networks'
|