cleanup server

group_vars/server/server

@@ -15,13 +15,6 @@ rsynclocations:
 rsynchostalloawed: 192.168.1.10
 
 
-fail2ban_destmail: "{{ user.mail }}"
-fail2ban_sendmail: "{{inventory_hostname}}@{{domain.name}}"
-
-Gandi_API_KEYS: "{{ vault_gandi_API_Keys }}"
-Gandi_Domain: "{{ domain.name }}"
-Gandi_Record: www
-
 docker_users: "{{user.name}}"
 keystodeploy:
     - name: juicessh with password

group_vars/server/web

@@ -1,411 +0,0 @@
-nginx_ssl_cert_name: "{{ domain.name }}"
-ansible_rsync_certs_DomainName: "{{ domain.name }}"
-certbot_auto_renew_user: root
-certbot_create_if_missing: true
-certbot_cert_name: "{{domain.name}}"
-certbot_certs:
-  - email: "{{user.mail}}"
-    domains:
-    - "{{domain.name}}"
-    - www.{{domain.name}}
-    - git.{{domain.name}}
-    - supysonic.{{domain.name}}
-    - syno.{{domain.name}}
-    - file.{{domain.name}}
-    - hass.{{domain.name}}
-    - ww.{{domain.name}}
-    - vault.{{domain.name}}
-    - drone.{{domain.name}}
-
-nginx_server_tokens: "off"
-nginx_server_resolver: "192.168.1.40 192.168.1.10 ipv6=off"
-nginx_realIP_Proxy: 192.168.1.40/24
-nginx_upstreams:
-    - name: Nextcloud-PHP-handler
-      servers:
-        - unix:/run/nextcloud/nextcloud.sock
-    - name: archMirrorUp
-      servers:
-        - localhost:7001
-        - localhost:7002 backup
-        - localhost:7003 backup
-nginx_extra_http_options: |
-  proxy_connect_timeout 600s;
-  proxy_send_timeout 600s;
-  proxy_read_timeout 600s;
-  fastcgi_send_timeout 600s;
-  fastcgi_read_timeout 600s;
-nginx_vhosts:
-    - listen: "80 default_server"
-      server_name: "*.ducamps.win ducamps.win"
-      filename: "redirect80.conf"
-      state: "present"
-      template: "{{ nginx_vhost_template }}"
-      extra_parameters: |
-        return 301 https://$host;
-    - listen: "443 ssl"
-      server_name: "www.{{domain.name}}"
-      root: "/usr/share/nginx/html/"
-      error_page: "404              /404/404.html"
-      filename: "default.conf"
-      state: "present"
-      template: "{{ nginx_vhost_template }}"
-      extra_parameters: |
-        include /etc/nginx/conf.d/{{domain.name}}.ssl;
-        error_page   500 502 503 504  /50x.html;
-        location = /50x.html {
-            root   /usr/share/nginx/html;
-        }
-        location / {
-           rewrite ^/.well-known/carddav /radicale/$remote_user/carddav/ redirect;
-           rewrite ^/.well-known/caldav /radicale/$remote_user/caldav/ redirect;
-
-           index index.php index.html index.htm ;
-           default_type text/html;
-
-        }
-        location =/ {
-             rewrite ^ /welcome;
-        }
-        location /radicale/
-        {
-            # The trailing / is important!
-            proxy_pass        http://localhost:5232/; # The / is important!
-            proxy_set_header  X-Script-Name /radicale;
-            proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_pass_header Authorization;
-        }
-
-
-        location ~ \.php$ {
-           # try_files $uri =404;
-            fastcgi_split_path_info ^(.+\.php)(/.+)$;
-            fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
-            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_read_timeout 800;
-            fastcgi_index index.php;
-            include fastcgi_params;
-        }
-        include /etc/nginx/conf.d/*.default;
-    - listen: "443 ssl"
-      server_name: "git.{{domain.name}}"
-      filename: "gitea.conf"
-      state: "present"
-      access_log: /var/log/nginx/gitea.access.log
-      error_log: /var/log/nginx/gitea.error.log
-      template: "{{ nginx_vhost_template }}"
-      extra_parameters: |
-        include /etc/nginx/conf.d/{{domain.name}}.ssl;
-        location / {
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-Host $host:$server_port;
-          proxy_set_header X-Forwarded-Server $host;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-          proxy_pass http://localhost:3000;
-        }
-
-    - listen: "443 ssl"
-      server_name: "syno.{{domain.name}}"
-      filename: "syno.conf"
-      state: "present"
-      template: "{{ nginx_vhost_template }}"
-      access_log: /var/log/nginx/syno.access.log
-      error_log: /var/log/nginx/syno.error.log
-      extra_parameters: |
-        include /etc/nginx/conf.d/{{domain.name}}.ssl;
-        location / {
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-Host $host:$server_port;
-          proxy_set_header X-Forwarded-Server $host;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-          proxy_pass http://192.168.1.10:5000;
-        }
-    - listen: "443 ssl"
-      server_name: "supysonic.{{domain.name}}"
-      filename: "supysonic.conf"
-      state: "present"
-      template: "{{ nginx_vhost_template }}"
-      access_log: /var/log/nginx/supysonic.access.log
-      error_log: /var/log/nginx/supysonic.error.log
-      extra_parameters: |
-        include /etc/nginx/conf.d/{{domain.name}}.ssl;
-        location / {
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-Host $host:$server_port;
-          proxy_set_header X-Forwarded-Server $host;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-          proxy_pass http://localhost:8001;
-        }
-    - listen: "443 ssl"
-      server_name: "file.{{domain.name}}"
-      filename: "nextcloud.conf"
-      state: "present"
-      template: "{{ nginx_vhost_template }}"
-      access_log: /var/log/nginx/nextcloud.access.log
-      error_log: /var/log/nginx/nextcloud.error.log
-      extra_parameters: |
-        include /etc/nginx/conf.d/{{domain.name}}.ssl;
-        add_header X-Content-Type-Options nosniff;
-        add_header X-XSS-Protection "1; mode=block";
-        add_header X-Robots-Tag none;
-        add_header X-Download-Options noopen;
-        add_header X-Permitted-Cross-Domain-Policies none;
-
-        # Path to the root of your installation
-        root /usr/share/webapps/nextcloud/;
-
-        location = /robots.txt {
-            allow all;
-            log_not_found off;
-            access_log off;
-        }
-
-        # The following 2 rules are only needed for the user_webfinger app.
-        # Uncomment it if you're planning to use this app.
-        #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
-        # last;
-
-        location = /.well-known/carddav {
-          return 301 $scheme://$host/remote.php/dav;
-        }
-        location = /.well-known/caldav {
-          return 301 $scheme://$host/remote.php/dav;
-        }
-
-        # set max upload size
-        client_max_body_size 512M;
-        fastcgi_buffers 64 4K;
-
-        # Enable gzip but do not remove ETag headers
-        gzip on;
-        gzip_vary on;
-        gzip_comp_level 4;
-        gzip_min_length 256;
-        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-        gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-
-        # Uncomment if your server is build with the ngx_pagespeed module
-        # This module is currently not supported.
-        #pagespeed off;
-
-        location / {
-            rewrite ^ /index.php$request_uri;
-        }
-
-        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
-            deny all;
-        }
-        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
-            deny all;
-        }
-
-        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy)\.php(?:$|\/) {
-            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-            include fastcgi_params;
-            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_param PATH_INFO $fastcgi_path_info;
-            #fastcgi_param HTTPS on;
-            #Avoid sending the security headers twice
-            fastcgi_param modHeadersAvailable true;
-            fastcgi_param front_controller_active true;
-            fastcgi_pass Nextcloud-PHP-handler;
-            fastcgi_intercept_errors on;
-            fastcgi_request_buffering off;
-        }
-
-        location ~ ^/(?:updater|ocs-provider)(?:$|/) {
-            try_files $uri/ =404;
-            index index.php;
-        }
-
-        # Adding the cache control header for js and css files
-        # Make sure it is BELOW the PHP block
-        location ~ \.(?:css|js|woff|svg|gif)$ {
-            try_files $uri /index.php$request_uri;
-            add_header Cache-Control "public, max-age=15778463";
-            # Add headers to serve security related headers (It is intended to
-            # have those duplicated to the ones above)
-            # Before enabling Strict-Transport-Security headers please read into
-            # this topic first.
-            # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
-            #
-            # WARNING: Only add the preload option once you read about
-            # the consequences in https://hstspreload.org/. This option
-            # will add the domain to a hardcoded list that is shipped
-            # in all major browsers and getting removed from this list
-            # could take several months.
-            add_header X-Content-Type-Options nosniff;
-            add_header X-XSS-Protection "1; mode=block";
-            add_header X-Robots-Tag none;
-            add_header X-Download-Options noopen;
-            add_header X-Permitted-Cross-Domain-Policies none;
-            # Optional: Don't log access to assets
-            access_log off;
-        }
-
-        location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
-            try_files $uri /index.php$request_uri;
-            # Optional: Don't log access to other assets
-            access_log off;
-        }
-    - listen: "443 ssl"
-      server_name: "hass.{{domain.name}}"
-      filename: "hass.conf"
-      state: "present"
-      template: "{{ nginx_vhost_template }}"
-      access_log: /var/log/nginx/hass.access.log
-      error_log: /var/log/nginx/hass.error.log
-      extra_parameters: |
-        include /etc/nginx/conf.d/{{domain.name}}.ssl;
-        location / {
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-Host $host:$server_port;
-          proxy_set_header X-Forwarded-Server $host;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-          proxy_pass http://localhost:8123;
-        }
-        location /api/websocket {
-          proxy_pass http://localhost:8123/api/websocket;
-          proxy_set_header Host $host;
-          proxy_http_version 1.1;
-          proxy_set_header Upgrade $http_upgrade;
-          proxy_set_header Connection "upgrade";
-        }
-    - listen: "443 ssl"
-      server_name: "ww.{{domain.name}}"
-      filename: "chisel.conf"
-      state: "present"
-      template: "{{ nginx_vhost_template }}"
-      access_log: /var/log/nginx/chisel.access.log
-      error_log: /var/log/nginx/chisel.error.log
-      extra_parameters: |
-        include /etc/nginx/conf.d/{{domain.name}}.ssl;
-        location / {
-          proxy_http_version 1.1;
-          proxy_set_header Upgrade $http_upgrade;
-          proxy_set_header Connection "upgrade";
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-Host $host:$server_port;
-          proxy_set_header X-Forwarded-Server $host;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-          proxy_pass http://localhost:9090;
-        }
-    - listen: "443 ssl"
-      server_name: "vault.{{domain.name}}"
-      filename: "vault.conf"
-      state: present
-      template: "{{ nginx_vhost_template }}"
-      access_log: /var/log/nginx/vault.access.log
-      error_log: /var/log/nginx/vault.error.log
-      extra_parameters: |
-        client_max_body_size 128M;
-
-        location / {
-          proxy_pass http://localhost:8081;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-             proxy_set_header X-Forwarded-Proto $scheme;
-           }
-
-           location /notifications/hub {
-             proxy_pass http://localhost:3012;
-             proxy_set_header Upgrade $http_upgrade;
-             proxy_set_header Connection "upgrade";
-           }
-
-           location /notifications/hub/negotiate {
-             proxy_pass http://localhost:8081;
-           }
-
-    - listen: "443 ssl"
-      server_name: "drone.{{domain.name}}"
-      filename: "drone.conf"
-      state: "present"
-      template: "{{ nginx_vhost_template }}"
-      access_log: /var/log/nginx/drone.access.log
-      error_log: /var/log/nginx/drone.error.log
-      extra_parameters: |
-        include /etc/nginx/conf.d/{{domain.name}}.ssl;
-        location / {
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-Host $host:$server_port;
-          proxy_set_header X-Forwarded-Server $host;
-          proxy_set_header X-Forwarded-Proto $scheme;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-          proxy_pass http://localhost:3001;
-        }
-        location /api/websocket {
-          proxy_pass http://localhost:8123/api/websocket;
-          proxy_set_header Host $host;
-          proxy_http_version 1.1;
-          proxy_set_header Upgrade $http_upgrade;
-          proxy_set_header Connection "upgrade";
-        }
-    - listen: 80
-      server_name: "arch.{{domain.name}}"
-      filename: "archMirror.conf"
-      template: "{{ nginx_vhost_template }}"
-      root: "{{arch_mirror_location}}"
-      access_log: /var/log/nginx/archmirror.access.log
-      error_log: /var/log/nginx/archmirror.error.log
-      extra_parameters: |
-        autoindex   on;
-
-        # Requests for package db, signature files and files db should redirect upstream without caching
-        location ~ \.(db|sig|files)$ {
-            proxy_pass http://archMirrorUp$request_uri;
-        }
-
-        # Requests for actual packages should be served directly from cache if available.
-        #   If not available, retrieve and save the package from an upstream mirror.
-        location ~ \.tar\.(xz|zst)$ {
-            try_files $uri @pkg_mirror;
-        }
-
-        # Retrieve package from upstream mirrors and cache for future requests
-        location @pkg_mirror {
-            proxy_store    on;
-            proxy_redirect off;
-            proxy_store_access  user:rw group:rw all:r;
-            proxy_next_upstream error timeout http_404;
-            proxy_pass          http://archMirrorUp$request_uri;
-        }
-    - listen:  "127.0.0.1:7001"
-      server_name: "_"
-      filename: "archMirrorUpstream1.conf"
-      template: "{{ nginx_vhost_template }}"
-      extra_parameters: |
-        location / {
-          proxy_pass       http://archlinux.mailtunnel.eu$request_uri;
-        }
-    - listen:  "127.0.0.1:7002"
-      server_name: "_"
-      filename: "archMirrorUpstream2.conf"
-      template: "{{ nginx_vhost_template }}"
-      extra_parameters: |
-        location / {
-          proxy_pass       http://mirror.cyberbits.eu/archlinux$request_uri;
-        }
-    - listen:  "127.0.0.1:7003"
-      server_name: "_"
-      filename: "archMirrorUpstream3.conf"
-      template: "{{ nginx_vhost_template }}"
-      extra_parameters: |
-        location / {
-          proxy_pass       http://mirrors.niyawe.de/archlinux$request_uri;
-        }

playbooks/server.yml

@@ -9,14 +9,6 @@
     - msmtp
     - cronie
     - rsyncd
-    - gandi-dyn-dns
-    - fail2ban
-    - role: ansible-role-certbot
-      become: true # need to have a external connection on 80
-    - role: ansible-rsync-certs
-      become: true # need to have a external connection on 80
-    - role: nginx
-      become: true
     - role: ansible-role-postgresql
       become: true
     - role: ansible-role-samba