Commits · 4a74fc48729a298cd4aa4d329bfd456f261af17f · Gruppo Sistemisti / servers-config · GitLab

15 Mar, 2018 40 commits
- lxd: allow containers to communicate with the host · 4a74fc48
  Pietro Albini authored Mar 16, 2018
  
  4a74fc48
- nginx: add more forwarded headers · 9a33494e
  Pietro Albini authored Mar 16, 2018
  
  9a33494e
- postfix: add firewall rule · 3e311109
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mapreri@ubuntu.com>
```
  3e311109
- postfix: fix handlers · 7c868b0d
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mapreri@ubuntu.com>
```
  7c868b0d
- firewall: s/command/cmd/g · 9da8513f
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mapreri@ubuntu.com>
```
  9da8513f
- common/iptables: add some ||true as needed · cac9bc27
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mapreri@ubuntu.com>
```
  cac9bc27
- common/firewall: make the script fail in case of error · a1f5d98e
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mapreri@ubuntu.com>
```
  a1f5d98e
- common/munin: workaround some bug where 'host *' would bind only on ipv6 · 4a217b52
  Mattia Rizzolo authored Mar 15, 2018
```
Some nonesense like:
|2018/03/15-23:08:59 Munin::Node::Server (type Net::Server::Fork) starting! pid(10504)
|Resolved [*]:4949 to [::]:4949, IPv6
|Not including resolved host [0.0.0.0] IPv4 because it will be handled by [::] IPv6
|Binding to TCP port 4949 on host :: with IPv6
Signed-off-by: Mattia Rizzolo <mapreri@ubuntu.com>
```
  4a217b52
- common/munin: that ip whitelist can only work on ipv4 of course... · fb164bce
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mapreri@ubuntu.com>
```
  fb164bce
- common/munin: fix iptables syntax · a0330ecb
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mapreri@ubuntu.com>
```
  a0330ecb
- common/firewall: no need for secrecy here · b14c5f6a
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mapreri@ubuntu.com>
```
  b14c5f6a
- hosts: drop explicit IP from roadhouse, we moved to the real one now · 6c8fa1ff
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  6c8fa1ff
- common/munin: fix path · 53e6dabd
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  53e6dabd
- deploy munin · b9410c7c
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  b9410c7c
- remote accidentally added file · 31b485a8
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  31b485a8
- postfix: add ssl-keys reload hook · 777de469
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  777de469
- postfix: add the aliases table · 40e67900
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  40e67900
- postfix: fixup ssl cert location · 82ff16a3
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  82ff16a3
- add admins to the 'adm' group, so they can read system logs · f1aba03c
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  f1aba03c
- use a bit of yaml magic to de-duplicate the users' extra_groups · d461b8c9
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  d461b8c9
- deploy postfix with spamassassin · 7d50e1d1
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  7d50e1d1
- set local_weberver and change letsencrypt_email · 7d524e0b
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  7d524e0b
- play/roadhouse: proxy code.ubuntu-it.org · 273eea19
  Pietro Albini authored Mar 15, 2018
  
  273eea19
- nginx: fix path · 815ae2b4
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  815ae2b4
- nginx: drop duplicate directives · e8093422
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  e8093422
- nginx: generate dh params · 3705c7e8
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  3705c7e8
- nginx: add a bunch of confs for better proxying and security · ec7457ea
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  ec7457ea
- nginx: fix wrong host header proxies · 6730740d
  Pietro Albini authored Mar 15, 2018
  
  6730740d
- nginx: deploy ssl · c6a17764
  Pietro Albini authored Mar 15, 2018
  
  c6a17764
- configure munin-node in the common role · 63bf7923
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  63bf7923
- deploy ssl-keys after a bunch of random fixups · c3d4c492
  Mattia Rizzolo authored Mar 15, 2018
```
* use run-parts to run the hooks, instead of embedding everything in
  dehydrated's hook scripts
* add the local hostname to the "domains" file
* no support for ssl cert request through ansible yet
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  c3d4c492
- don't run the ssl-keys play just yet · d1c73c2b
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  d1c73c2b
- Merge branch 'ssl-keys' · d66b22c0
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  d66b22c0
- roadhouse: also deploy wwwtest and votantonio nginx proxies conf · b4e49f7f
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  b4e49f7f
- nginx: return 204 with a useful message for the default site · e78d0c34
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  e78d0c34
- play/roadhouse: deploy nginx · 3bfd8257
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  3bfd8257
- nginx: fix the ssl reload thing · 6fe70609
  Mattia Rizzolo authored Mar 15, 2018
```
FIXME: {{ ssl_home }} is not defined in this role yet
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  6fe70609
- nginx: no need to add www-data to any special group to read private ssl keys · 1e9daf83
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  1e9daf83
- nginx: don't install the sudoers bit, ssl-keys role already takes care of it · 06b1979f
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  06b1979f
- nginx: make the file world readable. no need for useless secrets · 4cfad4c3
  Mattia Rizzolo authored Mar 15, 2018
```
Signed-off-by: Mattia Rizzolo <mattia@debian.org>
```
  4cfad4c3