diff --git a/ansible/hermes.yml b/ansible/hermes.yml index baccc0f..496ca8e 100644 --- a/ansible/hermes.yml +++ b/ansible/hermes.yml @@ -2,16 +2,24 @@ hosts: all gather_facts: no roles: - - cloudinit-wait + - cloudinit_wait - name: Install services hosts: all pre_tasks: + - name: Delete externally managed environment file + shell: + cmd: "rm /usr/lib/python*/EXTERNALLY-MANAGED" + register: rm + changed_when: "rm.rc == 0" + failed_when: "false" + - name: Copy resolv.conf copy: src: resolv.conf dest: /etc/resolv.conf + roles: - {role: apt, tags: apt} - {role: dnsmasq, tags: dnsmasq} - - {role: nsd, tags: nsd} + - {role: powerdns, tags: powerdns} diff --git a/ansible/inventory/host_vars/hermes.yml b/ansible/inventory/host_vars/hermes.yml index c2a2498..ab05003 100644 --- a/ansible/inventory/host_vars/hermes.yml +++ b/ansible/inventory/host_vars/hermes.yml @@ -1,63 +1,84 @@ apt_install_packages: - qemu-guest-agent - dnsutils + - pdns-server + - pdns-backend-pgsql + - postgresql-client ssh_ca_dir: /root/ssh_ca ssh_ca_user_ca_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGKOClnK6/Hj8INjEgULY/lD2FM/nbiJHqaSXtEw4+Fj User Certificate Authority for DMZ" ssh_ca_host_ca_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX2IhgHNxC6JTvLu9cej+iWuG+uJFMXn4AiRro9533x Host Certficate Authority for DMZ" ssh_ca_user_ca_private_key: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 64343164666336316635323733353839373835316465653038333062386438363131353566626130 - 6531653835313838396638366330386331383533303435300a306333363238633864623864393665 - 31393036346532353134646466666465386633303061346662393430666532366137323866646561 - 3131653064323565370a656361326462336238333464353635303066323565633865663032313661 - 38366238613361626161633862353938326365306634303166346461366531663063343264353533 - 61656630633734643639333738616566326531653264306134363837616365643039626262613433 - 61656361326234313130386533363761366665383064643735316133313133643865616536306466 - 33303733663834646435303935633436383632306330616264343263303861313635383866636163 - 39653064373966643437636530326235653131616366396563386139333837616535616135323337 - 66626161336539356637373138613464376133373234353863383330313362623236633462386234 - 31386635613936306262346264343732623761303331623831353061343035626361623639326530 - 62643139663733666662623039396461623334666565663439613430353364626162653731303535 - 32396638393534363533303039343938346339656266303766613931316337333635373664643461 - 37303332386233663937636631373935613231356262346530323337393733373764613864616563 - 66383137393738316638393530616234653264613363383663366261303433636236326632323734 - 35616133386438613636663631653139386466303534636263393633633663303664326137373139 - 35626336653966396335623330663161333432306538316664376231616161353235353032633438 - 62363663613135616462323363333863376532623764663066616431636632653938666263383731 - 65666564656130383262373964386631643332323066386635643032663833306565643164376239 - 32383732393236336235363936303063663963343061306161643331623330326139663836323561 - 31353532313639613563393938643333326462653833623531613935363265333534663762333831 - 36376264636432656537313834373036623339306430333837323836303134323062306265356430 - 39663238363338666362663364643063613337646237356431383237616465643634313166643435 - 32623864313537336634373631396465643362333237646462336362656430653036656263613162 - 64306662313934643661333462306336333561626335303866306131326538653264343465633139 - 3466663135663239616135353764373532323935613233316132 + $ANSIBLE_VAULT;1.1;AES256 + 64343164666336316635323733353839373835316465653038333062386438363131353566626130 + 6531653835313838396638366330386331383533303435300a306333363238633864623864393665 + 31393036346532353134646466666465386633303061346662393430666532366137323866646561 + 3131653064323565370a656361326462336238333464353635303066323565633865663032313661 + 38366238613361626161633862353938326365306634303166346461366531663063343264353533 + 61656630633734643639333738616566326531653264306134363837616365643039626262613433 + 61656361326234313130386533363761366665383064643735316133313133643865616536306466 + 33303733663834646435303935633436383632306330616264343263303861313635383866636163 + 39653064373966643437636530326235653131616366396563386139333837616535616135323337 + 66626161336539356637373138613464376133373234353863383330313362623236633462386234 + 31386635613936306262346264343732623761303331623831353061343035626361623639326530 + 62643139663733666662623039396461623334666565663439613430353364626162653731303535 + 32396638393534363533303039343938346339656266303766613931316337333635373664643461 + 37303332386233663937636631373935613231356262346530323337393733373764613864616563 + 66383137393738316638393530616234653264613363383663366261303433636236326632323734 + 35616133386438613636663631653139386466303534636263393633633663303664326137373139 + 35626336653966396335623330663161333432306538316664376231616161353235353032633438 + 62363663613135616462323363333863376532623764663066616431636632653938666263383731 + 65666564656130383262373964386631643332323066386635643032663833306565643164376239 + 32383732393236336235363936303063663963343061306161643331623330326139663836323561 + 31353532313639613563393938643333326462653833623531613935363265333534663762333831 + 36376264636432656537313834373036623339306430333837323836303134323062306265356430 + 39663238363338666362663364643063613337646237356431383237616465643634313166643435 + 32623864313537336634373631396465643362333237646462336362656430653036656263613162 + 64306662313934643661333462306336333561626335303866306131326538653264343465633139 + 3466663135663239616135353764373532323935613233316132 ssh_ca_host_ca_private_key: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 34613835376232653534353636303364613437666563653530363564346164656136643732626234 - 6430316165623933666461646639303435386433333335660a393538303835616366333066353665 - 64663236353233383236656365356264653963366464303433313133386430646230363634353465 - 6365313836666534330a633832303963616162623631663732623236383665383333323032383364 - 36313663366461643733373836326335386562663362326438353033376431356537326133646338 - 31623064303662616464343639346663323437333038346664393166333930336539373031313161 - 39343365373238383661343234666430336131323666313032333666306333366566336361383536 - 64626261363138323766306239303133376632386235666633363461303135613865343161356266 - 33333634613761616336653162396662633131333336613264663764333761633032313436376534 - 65376631383239666235313939363265643364376638623630373839303236633635356431356263 - 66366535656335326335616666316534366232353262336164663562613439623135303262356130 - 36316134366366623331393230396132366535356435613563663937376639653339343761306431 - 33353331306334336133316234326133663939636430376139376231383966346363303362386265 - 32356166363231613962383434333536356138623039663561313137653037663231666666646230 - 66323932333031626637616434383737623634353933613861326666313737636133333438656634 - 31363461373639366464343836333031313632346465346535303139623038633330356334633866 - 61303765353439303966623030303966656465353538323932343536393764616566386261306466 - 36343237393333376366303933373139353161376262333739353138666162663339393136303634 - 39383433323563666661313631613761343532373736386537626433323631323465623736653165 - 35356163356361346438366430636563656531363164306534353865393039643136366634323638 - 62656261396635353332376661353661353931663932386465643238343031376235363239303832 - 63393437613362623963306364356363396134623739656265326433356134303835356266326465 - 64623631353163653438376534316162666330663963363064326161656335383639356164393237 - 39346231666362313632363737623139373632376461373362656563616566633265653438393361 - 39393734393061653639313365633931373963666635316138663538356265386562373837393530 - 6537646639613534666533626339356335396634613765616664 + $ANSIBLE_VAULT;1.1;AES256 + 34613835376232653534353636303364613437666563653530363564346164656136643732626234 + 6430316165623933666461646639303435386433333335660a393538303835616366333066353665 + 64663236353233383236656365356264653963366464303433313133386430646230363634353465 + 6365313836666534330a633832303963616162623631663732623236383665383333323032383364 + 36313663366461643733373836326335386562663362326438353033376431356537326133646338 + 31623064303662616464343639346663323437333038346664393166333930336539373031313161 + 39343365373238383661343234666430336131323666313032333666306333366566336361383536 + 64626261363138323766306239303133376632386235666633363461303135613865343161356266 + 33333634613761616336653162396662633131333336613264663764333761633032313436376534 + 65376631383239666235313939363265643364376638623630373839303236633635356431356263 + 66366535656335326335616666316534366232353262336164663562613439623135303262356130 + 36316134366366623331393230396132366535356435613563663937376639653339343761306431 + 33353331306334336133316234326133663939636430376139376231383966346363303362386265 + 32356166363231613962383434333536356138623039663561313137653037663231666666646230 + 66323932333031626637616434383737623634353933613861326666313737636133333438656634 + 31363461373639366464343836333031313632346465346535303139623038633330356334633866 + 61303765353439303966623030303966656465353538323932343536393764616566386261306466 + 36343237393333376366303933373139353161376262333739353138666162663339393136303634 + 39383433323563666661313631613761343532373736386537626433323631323465623736653165 + 35356163356361346438366430636563656531363164306534353865393039643136366634323638 + 62656261396635353332376661353661353931663932386465643238343031376235363239303832 + 63393437613362623963306364356363396134623739656265326433356134303835356266326465 + 64623631353163653438376534316162666330663963363064326161656335383639356164393237 + 39346231666362313632363737623139373632376461373362656563616566633265653438393361 + 39393734393061653639313365633931373963666635316138663538356265386562373837393530 + 6537646639613534666533626339356335396634613765616664 + +api_key: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 65376335393463353232386437613533396261383332653738323764633965393262363239376165 + 3566666139376135643833343535663130353631326466610a623161633238363338633461383434 + 63373365613765663830613565313164323938336338616666313365623261663037626132623531 + 3638653833626532300a656632356563613631633162643464356236396635633237376133323433 + 37363261376535306161393039396333656430323534616462393366643662306631306339346363 + 3065303163643732613435323561663035646365383237643464 + +postgresql_password: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 64646633623535383761356434643064383736626638333738323363393037393133363130623361 + 3965323132656263393365366131343732646239316564390a613263386166383438366162303561 + 63626162656337313034663830626432303437363764653336613338393038393737663238313737 + 3164323834393165380a393138363265393963613835376331623735303538316162343036306230 + 63633335343332313861393135366332313061353064306265653631613735336631653438383066 + 3034323733323333646532613233666333323363643534336233 diff --git a/ansible/requirements.yml b/ansible/requirements.yml index 1e51c6b..2e1c9b2 100644 --- a/ansible/requirements.yml +++ b/ansible/requirements.yml @@ -1,6 +1,9 @@ - name: apt src: https://github.com/sunscrapers/ansible-role-apt.git scm: git -- name: cloudinit-wait +- name: cloudinit_wait src: https://git.pim.kunis.nl/pim/ansible-role-cloudinit-wait scm: git +- name: postgresql_database + src: https://git.pim.kunis.nl/home/ansible-role-postgresql-database + scm: git diff --git a/ansible/roles/nsd/files/nsd.conf b/ansible/roles/nsd/files/nsd.conf deleted file mode 100644 index f46b306..0000000 --- a/ansible/roles/nsd/files/nsd.conf +++ /dev/null @@ -1,29 +0,0 @@ -server: - ip-address: ens4 - port: 53 - server-count: 1 - verbosity: 1 - hide-version: yes - zonesdir: "/etc/nsd/zones" - ip-transparent: yes - ip-freebind: yes - -zone: - name: pim.kunis.nl - zonefile: pim.kunis.nl - -zone: - name: pizzapim.nl - zonefile: pizzapim.nl - provide-xfr: 87.253.155.96/27 NOKEY - provide-xfr: 157.97.168.160/27 NOKEY - -zone: - name: geokunis2.nl - zonefile: geokunis2.nl - provide-xfr: 87.253.155.96/27 NOKEY - provide-xfr: 157.97.168.160/27 NOKEY - -zone: - name: kun.is - zonefile: kun.is diff --git a/ansible/roles/nsd/files/zones/geokunis2.nl b/ansible/roles/nsd/files/zones/geokunis2.nl deleted file mode 100644 index ee25471..0000000 --- a/ansible/roles/nsd/files/zones/geokunis2.nl +++ /dev/null @@ -1,36 +0,0 @@ -$ORIGIN geokunis2.nl. -$TTL 60 - -geokunis2.nl. IN SOA ns.geokunis2.nl. niels.kunis.nl. 2023052600 1800 3600 1209600 3600 - NS ns.geokunis2.nl. - NS ns0.transip.net. - NS ns1.transip.nl. - NS ns2.transip.eu. - A 84.245.14.149 - AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda - CAA 0 issue "letsencrypt.org" -jenl IN A 217.123.41.225 -wg IN A 84.245.14.149 -wg IN AAAA 2a02:58:1:e::1afb -wg4 IN A 84.245.14.149 -wg6 IN AAAA 2a02:58:1:e::1afb -kms IN A 84.245.14.149 -tuindersweijde IN A 84.245.14.149 -files IN A 84.245.14.149 -files IN AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda -ns A 84.245.14.149 - AAAA 2a02:58:19a:f730:c8fe:c0ff:feff:ee07 -cyberchef IN A 84.245.14.149 - AAAA 2a02:58:19a:f730:c8fe:c0ff:feff:ee03 -inbucket IN A 84.245.14.149 - -; proton shizzle -@ IN TXT "protonmail-verification=e712bb186d5278b3775b413b8851ffc7740e845b" -@ IN TXT "sl-verification=sgrkojlcdgroiyjihxfleicgtpzgcb" -@ IN MX 10 mx1.simplelogin.co. -@ IN MX 20 mx2.simplelogin.co. -@ IN TXT "v=spf1 include:simplelogin.co ~all" -dkim02._domainkey IN CNAME dkim02._domainkey.simplelogin.co. -dkim._domainkey IN CNAME dkim._domainkey.simplelogin.co. -dkim03._domainkey IN CNAME dkim03._domainkey.simplelogin.co. -_dmarc IN TXT "v=DMARC1; p=quarantine; pct=100; adkim=s; aspf=s" diff --git a/ansible/roles/nsd/files/zones/kun.is b/ansible/roles/nsd/files/zones/kun.is deleted file mode 100644 index dd60b90..0000000 --- a/ansible/roles/nsd/files/zones/kun.is +++ /dev/null @@ -1,13 +0,0 @@ -$ORIGIN kun.is. -$TTL 60 - -kun.is. IN SOA ns1.kun.is. pim.kunis.nl. 2023051702 1800 3600 1209600 3600 - NS ns1.kun.is. - NS ns2.kun.is. - -ns1 A 84.245.14.149 -ns2 A 84.245.14.149 - -pim A 84.245.14.149 - -* A 84.245.14.149 diff --git a/ansible/roles/nsd/files/zones/pim.kunis.nl b/ansible/roles/nsd/files/zones/pim.kunis.nl deleted file mode 100644 index 87d36e4..0000000 --- a/ansible/roles/nsd/files/zones/pim.kunis.nl +++ /dev/null @@ -1,33 +0,0 @@ -$ORIGIN pim.kunis.nl. -$TTL 60 - -pim.kunis.nl. IN SOA ns.pim.kunis.nl. pim.kunis.nl. 2023052000 1800 3600 1209600 3600 - - NS ns.pim.kunis.nl. - A 84.245.14.149 -# AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda - TXT "v=spf1 ~all" - -_dmarc IN TXT "v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:wpux1bq8@ag.eu.dmarcian.com;" - -www IN A 84.245.14.149 -ns IN A 84.245.14.149 - IN AAAA 2a02:58:19a:f730:c8fe:c0ff:feff:ee07 - -social IN CNAME www.pim.kunis.nl. -dav IN CNAME www.pim.kunis.nl. -git IN CNAME www.pim.kunis.nl. -meet IN CNAME www.pim.kunis.nl. -rss IN CNAME www.pim.kunis.nl. -latex IN CNAME www.pim.kunis.nl. -md IN CNAME www.pim.kunis.nl. -swarm IN CNAME www.pim.kunis.nl. -traefik IN CNAME www.pim.kunis.nl. -syncthing IN CNAME www.pim.kunis.nl. -cloud IN CNAME www.pim.kunis.nl. -pihole IN CNAME www.pim.kunis.nl. -ntfy IN CNAME www.pim.kunis.nl. -apprise IN CNAME www.pim.kunis.nl. -uptime IN CNAME www.pim.kunis.nl. -concourse IN CNAME www.pim.kunis.nl. -discourse IN CNAME www.pim.kunis.nl. diff --git a/ansible/roles/nsd/files/zones/pizzapim.nl b/ansible/roles/nsd/files/zones/pizzapim.nl deleted file mode 100644 index 5e607d0..0000000 --- a/ansible/roles/nsd/files/zones/pizzapim.nl +++ /dev/null @@ -1,18 +0,0 @@ -$ORIGIN pizzapim.nl. -$TTL 60 - -pizzapim.nl. IN SOA ns.pizzapim.nl. pim.kunis.nl. 2023050400 1800 3600 1209600 3600 - - NS ns.pizzapim.nl. - NS ns0.transip.net. - NS ns1.transip.nl. - NS ns2.transip.eu. - A 84.245.14.149 - TXT "v=spf1 ~all" - CAA 0 issue "letsencrypt.org" - -_dmarc IN TXT "v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:wpux1bq8@ag.eu.dmarcian.com;" - -social IN A 84.245.14.149 -ns IN A 84.245.14.149 - AAAA 2a02:58:19a:f730:c8fe:c0ff:feff:ee07 diff --git a/ansible/roles/nsd/tasks/main.yml b/ansible/roles/nsd/tasks/main.yml deleted file mode 100644 index 39d1547..0000000 --- a/ansible/roles/nsd/tasks/main.yml +++ /dev/null @@ -1,18 +0,0 @@ -- name: Install nsd - apt: - name: nsd -- name: Copy nsd.conf - copy: - src: "{{ role_path }}/files/nsd.conf" - dest: /etc/nsd/nsd.conf - register: config -- name: Copy zone directory - copy: - src: "{{ role_path }}/files/zones" - dest: /etc/nsd - register: zones -- name: Enable nsd - systemd: - name: nsd - enabled: true - state: "{{ 'restarted' if config.changed or zones.changed else 'started' }}" diff --git a/ansible/roles/powerdns/api.conf.j2 b/ansible/roles/powerdns/api.conf.j2 new file mode 100644 index 0000000..fdbf48d --- /dev/null +++ b/ansible/roles/powerdns/api.conf.j2 @@ -0,0 +1,5 @@ +api=yes +api-key={{ api_key }} +webserver-address=0.0.0.0 +webserver-port=3000 +webserver-allow-from=0.0.0.0/0 diff --git a/ansible/roles/powerdns/gpgsql.conf.j2 b/ansible/roles/powerdns/gpgsql.conf.j2 new file mode 100644 index 0000000..0aa6213 --- /dev/null +++ b/ansible/roles/powerdns/gpgsql.conf.j2 @@ -0,0 +1,5 @@ +launch=gpgsql +gpgsql-host=thecloud.dmz +gpgsql-dbname=powerdns +gpgsql-user=powerdns +gpgsql-password={{ postgresql_password }} diff --git a/ansible/roles/powerdns/handlers/main.yml b/ansible/roles/powerdns/handlers/main.yml new file mode 100644 index 0000000..d358e6e --- /dev/null +++ b/ansible/roles/powerdns/handlers/main.yml @@ -0,0 +1,4 @@ +- name: restart powerdns + systemd: + name: pdns + state: restarted diff --git a/ansible/roles/powerdns/overwrite.conf b/ansible/roles/powerdns/overwrite.conf new file mode 100644 index 0000000..698393e --- /dev/null +++ b/ansible/roles/powerdns/overwrite.conf @@ -0,0 +1,2 @@ +local-address=192.168.30.7, 127.0.0.1, :: +default-soa-content=ns.@ noreply.@ 0 10800 3600 604800 3600 diff --git a/ansible/roles/powerdns/tasks/main.yml b/ansible/roles/powerdns/tasks/main.yml new file mode 100644 index 0000000..aa50105 --- /dev/null +++ b/ansible/roles/powerdns/tasks/main.yml @@ -0,0 +1,28 @@ +- name: Remove BIND powerdns config + file: + path: /etc/powerdns/pdns.d/bind.conf + state: absent + notify: restart powerdns + +- name: Copy postgresql powerdns config + template: + src: gpgsql.conf.j2 + dest: /etc/powerdns/pdns.d/gpgsql.conf + notify: restart powerdns + +- name: Add API powerdns config + template: + src: api.conf.j2 + dest: /etc/powerdns/pdns.d/api.conf + notify: restart powerdns + +- name: Overwrite powerdns config + copy: + src: overwrite.conf + dest: /etc/powerdns/pdns.d/overwrite.conf + notify: restart powerdns + +- name: Start powerdns + systemd: + name: pdns + state: started