add polyvalent
Paul Wako
parent
eced0aac2d
commit
649c0b4781
|
|
@ -8,10 +8,6 @@ Assumes:
|
|||
- Passwordless sudo is enabled for the user ansible uses
|
||||
- Root and user pw is something memorable
|
||||
|
||||
- Wireguard hosts:
|
||||
- Secure boot is disabled (wireguard is an unsigned module)
|
||||
- Wireguard is configured on 10.200.0.0/24; See https://wiki.debian.org/Wireguard
|
||||
|
||||
- ZFS server:
|
||||
- ZFS is configured with a volume at /bigdata for sharing
|
||||
|
||||
|
|
|
|||
|
|
@ -1,68 +0,0 @@
|
|||
# $DragonFly: src/etc/dma/dma.conf,v 1.2 2008/02/04 10:11:41 matthias Exp $
|
||||
#
|
||||
# Your smarthost (also called relayhost). Leave blank if you don't want
|
||||
# smarthost support.
|
||||
# NOTE: on Debian systems this is handled via debconf!
|
||||
# Please use dpkg-reconfigure dma to change this value.
|
||||
SMARTHOST smtp.gmail.com
|
||||
|
||||
# Use this SMTP port. Most users will be fine with the default (25)
|
||||
PORT 587
|
||||
|
||||
# Path to your alias file. Just stay with the default.
|
||||
#ALIASES /etc/aliases
|
||||
|
||||
# Path to your spooldir. Just stay with the default.
|
||||
#SPOOLDIR /var/spool/dma
|
||||
|
||||
# SMTP authentication
|
||||
AUTHPATH /etc/dma/auth.conf
|
||||
|
||||
# Uncomment if yout want TLS/SSL support
|
||||
SECURETRANSFER
|
||||
|
||||
# Uncomment if you want STARTTLS support (only used in combination with
|
||||
# SECURETRANSFER)
|
||||
STARTTLS
|
||||
|
||||
# Uncomment if you have specified STARTTLS above and it should be allowed
|
||||
# to fail ("opportunistic TLS", use an encrypted connection when available
|
||||
# but allow an unencrypted one to servers that do not support it)
|
||||
#OPPORTUNISTIC_TLS
|
||||
|
||||
# Path to your local SSL certificate
|
||||
#CERTFILE
|
||||
|
||||
# If you want to use plain text SMTP login without using encryption, change
|
||||
# the SECURE entry below to INSECURE. Otherwise plain login will only work
|
||||
# over a secure connection. Use this option with caution.
|
||||
#SECURE
|
||||
|
||||
# Uncomment if you want to defer your mails. This is useful if you are
|
||||
# behind a dialup line. You have to submit your mails manually with dma -q
|
||||
#DEFER
|
||||
|
||||
# Uncomment if you want the bounce message to include the complete original
|
||||
# message, not just the headers.
|
||||
#FULLBOUNCE
|
||||
|
||||
# The internet hostname dma uses to identify the host.
|
||||
# If not set or empty, the result of gethostname(2) is used.
|
||||
# If MAILNAME is an absolute path to a file, the first line of this file
|
||||
# will be used as the hostname.
|
||||
# NOTE: on Debian systems this is handled via debconf!
|
||||
# Please use dpkg-reconfigure dma to change this value.
|
||||
MAILNAME /etc/mailname
|
||||
|
||||
# Masquerade envelope from addresses with this address/hostname.
|
||||
# Use this if mails are not accepted by destination mail servers because
|
||||
# your sender domain is invalid.
|
||||
# By default, MASQUERADE is not set.
|
||||
# Format: MASQUERADE [user@][host]
|
||||
# Examples:
|
||||
# MASQUERADE john@ on host "hamlet" will send all mails as john@hamlet
|
||||
# MASQUERADE percolator will send mails as $username@percolator, e.g. fish@percolator
|
||||
# MASQUERADE herb@ert will send all mails as herb@ert
|
||||
|
||||
# Directly forward the mail to the SMARTHOST bypassing aliases and local delivery
|
||||
#NULLCLIENT
|
||||
|
|
@ -1,14 +1,14 @@
|
|||
[compute]
|
||||
fogcutter interface=eno1
|
||||
fogcutter hostname=fogcutter.seaturtle.pw interface=eno1
|
||||
|
||||
[daily]
|
||||
cabinet interface=enp9s0
|
||||
cabinet hostname=cabinet.seaturtle.pw interface=enp9s0
|
||||
|
||||
[nfs]
|
||||
bigdummy interface=enp2s0
|
||||
bigdummy hostname=bigdummy.seaturtle.pw interface=enp2s0
|
||||
|
||||
[remote]
|
||||
joe@madone.seaturtle.pw interface=enp1s0
|
||||
|
||||
[router]
|
||||
corsa
|
||||
[proxy]
|
||||
polyvalent hostname=polyvalent.seaturtle.pw interface=eth0
|
||||
|
|
|
|||
|
|
@ -1,12 +1,16 @@
|
|||
# All hosts are debian 10
|
||||
---
|
||||
# Common
|
||||
- hosts: daily,compute,nfs,router
|
||||
- hosts: daily,compute,nfs,proxy
|
||||
become: yes
|
||||
handlers:
|
||||
- import_tasks: handlers.yml
|
||||
tasks:
|
||||
# Core
|
||||
- name: Set hostname
|
||||
hostname:
|
||||
name: "{{ hostname }}"
|
||||
|
||||
- name: Install common packages
|
||||
apt:
|
||||
name:
|
||||
|
|
@ -70,8 +74,8 @@
|
|||
notify: Restart systemd-logind service
|
||||
|
||||
- name: Set chrony ntp servers
|
||||
copy:
|
||||
src: files/chrony.conf
|
||||
template:
|
||||
src: templates/chrony.conf.j2
|
||||
dest: /etc/chrony/chrony.conf
|
||||
owner: root
|
||||
group: root
|
||||
|
|
@ -79,7 +83,7 @@
|
|||
notify: Restart chrony service
|
||||
|
||||
# Core networking
|
||||
- name: Configure sshd_config to listen on 37121/2222/22 and disable password auth
|
||||
- name: Configure sshd_config to listen on 22/2222/37121 and disable password auth
|
||||
copy:
|
||||
src: files/sshd_config
|
||||
dest: /etc/ssh/sshd_config
|
||||
|
|
@ -88,8 +92,7 @@
|
|||
mode: '0644'
|
||||
notify: Restart sshd service
|
||||
|
||||
## Changes will take effect during next reboot
|
||||
## (determined by unattended-upgrades)
|
||||
## Changes will take effect during next reboot, does not effect static IPs
|
||||
- name: Configure sysctl with IPv6 privacy extensions
|
||||
template:
|
||||
src: templates/local.conf.j2
|
||||
|
|
@ -98,17 +101,6 @@
|
|||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Configure dma
|
||||
copy:
|
||||
src: files/dma.conf
|
||||
dest: /etc/dma/dma.conf
|
||||
owner: root
|
||||
group: mail
|
||||
mode: '0640'
|
||||
|
||||
- debug:
|
||||
msg: 'Manually configure /etc/dma/auth.conf'
|
||||
|
||||
- name: Configure smartd
|
||||
copy:
|
||||
src: files/smartd.conf
|
||||
|
|
@ -271,3 +263,16 @@
|
|||
msg:
|
||||
- Start/Configure haproxy manually
|
||||
- Start microk8s manually
|
||||
|
||||
# Proxy config
|
||||
- hosts: proxy
|
||||
become: yes
|
||||
tasks:
|
||||
## Changes will take effect during next reboot
|
||||
- name: Configure sysctl to reject RA acceptance
|
||||
template:
|
||||
src: templates/disablera.conf.j2
|
||||
dest: /etc/sysctl.d/disablera.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
|
|
|||
|
|
@ -1,9 +1,16 @@
|
|||
# Welcome to the chrony configuration file. See chrony.conf(5) for more
|
||||
# information about usuable directives.
|
||||
{% if hostname == 'polyvalent.seaturtle.pw' %}
|
||||
server 0.us.pool.ntp.org iburst
|
||||
server 1.us.pool.ntp.org iburst
|
||||
server 2.us.pool.ntp.org iburst
|
||||
server 3.us.pool.ntp.org iburst
|
||||
{% else %}
|
||||
server ntp-1.vt.edu iburst
|
||||
server ntp-2.vt.edu iburst
|
||||
server ntp-3.vt.edu iburst
|
||||
server ntp-4.vt.edu iburst
|
||||
{% endif %}
|
||||
pool 2.debian.pool.ntp.org iburst
|
||||
|
||||
# This directive specify the location of the file containing ID/key pairs for
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
net.ipv6.conf.{{ interface }}.accept_ra=0
|
||||
net.ipv6.conf.all.accept_ra=0
|
||||
Loading…
Reference in New Issue