From 97c89d822ab3bfd70cc8f238e4b8fec7eaf0d278 Mon Sep 17 00:00:00 2001 From: cinnaboot Date: Sat, 10 Apr 2021 13:34:04 -0400 Subject: [PATCH] update dokuwiki playbook --- lxd_host_playbook.yml | 51 ++++++++++---- site_vars.yml | 6 +- tasks/container_common.yml | 16 +---- tasks/dokuwiki.yml | 139 ++++++++++++++++++++++++++++--------- templates/lighttpd.conf.j2 | 32 +++++++++ templates/sshd_config.j2 | 106 ---------------------------- 6 files changed, 185 insertions(+), 165 deletions(-) create mode 100644 templates/lighttpd.conf.j2 diff --git a/lxd_host_playbook.yml b/lxd_host_playbook.yml index 91dd760..096dfeb 100644 --- a/lxd_host_playbook.yml +++ b/lxd_host_playbook.yml @@ -1,6 +1,7 @@ --- -- name: top level playbook for lxd server provisioning +- name: top level play for lxd server provisioning hosts: lxd_host + tags: install_lxd tasks: - name: include variables include_vars: @@ -11,8 +12,8 @@ copy: src: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}" dest: "{{ tmp_pubkey }}" - when: not debug_skip + # TODO: might make sense to add a cache redirect for alpine packages - include_tasks: tasks/container_common.yml vars: container_name: "{{ item.key }}" @@ -21,17 +22,23 @@ tmp_sshd_config: "/tmp/sshd_config_{{ item.key }}" with_items: "{{ containers | dict2items }}" - # NOTE: do container specific provisioning - - import_tasks: tasks/dokuwiki.yml - vars: - doku_lxc_cmd: "{{ lxc_cmd }}" - when: not debug_skip + #- name: testing ssh connection to container + # hosts: dokuwiki + # tags: containers + # tasks: + # - include_tasks: tasks/dokuwiki.yml +- import_playbook: tasks/dokuwiki.yml - # NOTE: do host routing last so we can can on no sudo pass - # TODO: add task for installing iptables & iptables-persistent on debian - # TODO: save rules after updating - - name: add DNAT rules for ssh to containers - iptables: +# NOTE: do host routing last so we can fail on no sudo pass +# TODO: add task for installing iptables & iptables-persistent on debian +# TODO: save rules after updating +- name: add DNAT rules for ssh to containers + hosts: lxd_host + tags: dnat_route + tasks: + - include_vars: + file: site_vars.yml + - iptables: table: nat chain: PREROUTING in_interface: "{{ host_iface }}" @@ -42,6 +49,24 @@ destination_port: "{{ item.value.sshd_port }}" to_destination: "{{ item.value.ip }}" become: yes - when: not debug_skip + #when: not debug_skip_iptables with_items: "{{ containers | dict2items }}" +- name: add DNAT rules for individual containers + hosts: lxd_host + tags: dnat_route_2 + tasks: + - include_vars: + file: site_vars.yml + + - iptables: + table: nat + chain: PREROUTING + in_interface: "{{ host_iface }}" + protocol: tcp + match: tcp + source: "{{ host_cidr }}" + jump: DNAT + destination_port: "{{ hostvars['dokuwiki']['dnat_dest_port'] }}" + to_destination: "{{ hostvars['dokuwiki']['internal_ip'] }}" + become: yes diff --git a/site_vars.yml b/site_vars.yml index fd90407..db940b3 100644 --- a/site_vars.yml +++ b/site_vars.yml @@ -1,8 +1,10 @@ --- -debug_skip: False # NOTE: skip tasks when debugging +# NOTE: skip tasks when debugging +debug_skip: True +debug_skip_iptables: True img_server: https://images.linuxcontainers.org -alp_img_alias: alpine/edge/amd64 +alp_img_alias: alpine/3.13/amd64 lxc_cmd: /snap/bin/lxc lxd_subnet_pfx: 10.98.46 lxd_bridge: lxdbr0 diff --git a/tasks/container_common.yml b/tasks/container_common.yml index 837ddc4..a208ade 100644 --- a/tasks/container_common.yml +++ b/tasks/container_common.yml @@ -17,51 +17,41 @@ nictype: bridged parent: "{{ lxd_bridge }}" ipv4.address: "{{ container_ip }}" - when: not debug_skip - name: update container packages command: "{{ lxc_cmd }} exec {{ container_name }} -- apk upgrade -U" - when: not debug_skip - name: install openssh, rsync, and shadow packages in containers - command: "{{ lxc_cmd }} exec {{ container_name }} -- apk add openssh rsync shadow" - when: not debug_skip + command: "{{ lxc_cmd }} exec {{ container_name }} -- \ + apk add openssh rsync shadow python3" - name: "copy container sshd_config for {{ container_name }} to lxd host" template: src: templates/sshd_config.j2 dest: "{{ tmp_sshd_config }}" - when: not debug_skip - name: use lxc file push to get sshd_config into container command: "{{ lxc_cmd }} file push {{ tmp_sshd_config}} \ {{ container_name }}/etc/ssh/sshd_config" - when: not debug_skip - name: mkdir /root/.ssh in {{ container_name }} command: "{{ lxc_cmd }} exec {{ container_name }} -- mkdir -p /root/.ssh" - when: not debug_skip - name: add controller public key to {{ container_name }} authorized keys command: "{{ lxc_cmd }} file push {{ tmp_pubkey }} \ {{ container_name }}/root/.ssh/authorized_keys \ --gid 0 --uid 0 --mode 600" - when: not debug_skip - name: make hash of a random password set_fact: root_pass: "{{ lookup('password', '/dev/null length=15 chars=ascii_letters') | password_hash('sha512') }}" - when: not debug_skip - name: "set password to unlock root account (NOTE: still using pubkey only)" shell: '{{ lxc_cmd }} exec {{ container_name }} -- usermod -p {{ root_pass }} root' - when: not debug_skip - name: ensure sshd service is enabled command: "{{ lxc_cmd }} exec {{ container_name }} -- rc-update add sshd" - when: not debug_skip -- name: ensure sshd service is enabled +- name: ensure sshd service is started command: "{{ lxc_cmd }} exec {{ container_name }} -- rc-service sshd start" - when: not debug_skip diff --git a/tasks/dokuwiki.yml b/tasks/dokuwiki.yml index 93fb943..64dce77 100644 --- a/tasks/dokuwiki.yml +++ b/tasks/dokuwiki.yml @@ -1,36 +1,113 @@ --- # NOTE: https://wiki.alpinelinux.org/wiki/DokuWiki +- name: testing ssh connection to container + hosts: dokuwiki + tags: containers + vars: + lighttpd_user: lighttpd + lighttpd_group: lighttpd + docroot: /var/www/localhost/htdocs + doku_url: https://download.dokuwiki.org/src/dokuwiki/dokuwiki-stable.tgz + doku_tar: /tmp/dokuwiki-stable.tgz + doku_dir: "{{ docroot }}/dokuwiki" + tasks: + - name: install packages + vars: + packages: + - lighttpd + - php7-common + - php7-session + - php7-iconv + - php7-json + - php7-gd + - php7-curl + - php7-xml + - php7-mysqli + - php7-imap + - php7-cgi + - php7-pdo + - php7-pdo_mysql + - php7-soap + - php7-xmlrpc + - php7-posix + - php7-mcrypt + - php7-gettext + - php7-ldap + - php7-ctype + - php7-dom + - fcgi + - tar + apk: + name: "{{ packages | join(' ') }}" + state: present -- name: test task variables - debug: - var: doku_lxc_cmd + # TODO: break out lighttpd default config to a separate playlist -- name: install packages - vars: - packages: - - lighttpd - - php7-common - - php7-session - - php7-iconv - - php7-json - - php7-gd - - php7-curl - - php7-xml - - php7-mysqli - - php7-imap - - php7-cgi - - php7-pdo - - php7-pdo_mysql - - php7-soap - - php7-xmlrpc - - php7-posix - - php7-mcrypt - - php7-gettext - - php7-ldap - - php7-ctype - - php7-dom - - fcgi - command: - "{{ lxc_cmd }} exec dokuwiki -- apk add {{ packages | join(' ') }}" - when: True + - name: copy lighttpd.conf + copy: + src: ../templates/lighttpd.conf.j2 + dest: /etc/lighttpd/lighttpd.conf + + - name: ensure lighttpd service is started + service: + name: lighttpd + enabled: yes + state: started + + - name: test if dokuwiki was already installed + find: + paths: "{{ doku_dir }}" + pattern: README + register: doku_find_result + + - name: download dokuwiki stable + get_url: + url: "{{ doku_url }}" + dest: "{{ doku_tar }}" + when: doku_find_result.matched == 0 + + - name: make directory for dokiwiki in docroot + file: + path: "{{ doku_dir }}" + state: directory + owner: "{{ lighttpd_user }}" + group: "{{ lighttpd_group }}" + when: doku_find_result.matched == 0 + + - name: unarchive downloaded file + unarchive: + remote_src: yes + src: "{{ doku_tar }}" + dest: /tmp + owner: "{{ lighttpd_user }}" + group: "{{ lighttpd_group }}" + when: doku_find_result.matched == 0 + + - name: find doku temporary directory + find: + paths: /tmp/ + file_type: directory + pattern: "dokuwiki-20*" + use_regex: true + register: doku_tmp_dir + + - name: copy dokuwiki files to webroot + copy: + remote_src: yes + src: "{{ doku_tmp_dir.files[0].path }}" + dest: "{{ doku_dir }}" + when: doku_tmp_dir.matched > 0 + + - name: remove archive + file: + path: "{{ doku_tar }}" + state: absent + + - name: remove temporary files + file: + path: "{{ doku_tmp_dir.files[0].path }}" + state: absent + when: doku_tmp_dir.matched > 0 + + # TODO: copy archived dokuwiki files diff --git a/templates/lighttpd.conf.j2 b/templates/lighttpd.conf.j2 new file mode 100644 index 0000000..4b4b8be --- /dev/null +++ b/templates/lighttpd.conf.j2 @@ -0,0 +1,32 @@ + +var.basedir = "/var/www/localhost" +var.logdir = "/var/log/lighttpd" +var.statedir = "/var/lib/lighttpd" + +server.modules = ( + "mod_access", + "mod_accesslog", + "mod_rewrite" +) + +include "mime-types.conf" +include "mod_fastcgi.conf" + +server.username = "lighttpd" +server.groupname = "lighttpd" +server.document-root = var.basedir + "/htdocs" +server.pid-file = "/run/lighttpd.pid" +server.errorlog = var.logdir + "/error.log" +server.indexfiles = ("index.php", "index.html", "index.htm", "default.htm") +server.follow-symlink = "enable" + +static-file.exclude-extensions = (".php", ".pl", ".cgi", ".fcgi") + +accesslog.filename = var.logdir + "/access.log" + +url.access-deny = ("~", ".inc") + +$HTTP["url"] =~ "^/dokuwiki/(data|conf|bin|inc|vendor)/+." { + url.access-deny = ("") +} + diff --git a/templates/sshd_config.j2 b/templates/sshd_config.j2 index fd03a18..9366102 100644 --- a/templates/sshd_config.j2 +++ b/templates/sshd_config.j2 @@ -1,117 +1,11 @@ -# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $ - -# This is the sshd server system-wide configuration file. See -# sshd_config(5) for more information. - -# This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin - -# The strategy used for options in the default sshd_config shipped with -# OpenSSH is to specify options with their default value where -# possible, but leave them commented. Uncommented options override the -# default value. Port {{ container_sshd_port }} -#AddressFamily any -#ListenAddress 0.0.0.0 -#ListenAddress :: - -#HostKey /etc/ssh/ssh_host_rsa_key -#HostKey /etc/ssh/ssh_host_ecdsa_key -#HostKey /etc/ssh/ssh_host_ed25519_key - -# Ciphers and keying -#RekeyLimit default none - -# Logging -#SyslogFacility AUTH -#LogLevel INFO - -# Authentication: - -#LoginGraceTime 2m PermitRootLogin yes -#StrictModes yes -#MaxAuthTries 6 -#MaxSessions 10 - -#PubkeyAuthentication yes - -# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 -# but this is overridden so installations will only check .ssh/authorized_keys AuthorizedKeysFile .ssh/authorized_keys - -#AuthorizedPrincipalsFile none - -#AuthorizedKeysCommand none -#AuthorizedKeysCommandUser nobody - -# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts -#HostbasedAuthentication no -# Change to yes if you don't trust ~/.ssh/known_hosts for -# HostbasedAuthentication -#IgnoreUserKnownHosts no -# Don't read the user's ~/.rhosts and ~/.shosts files -#IgnoreRhosts yes - -# To disable tunneled clear text passwords, change to no here! PasswordAuthentication no -#PermitEmptyPasswords no - -# Change to no to disable s/key passwords -#ChallengeResponseAuthentication yes -# Kerberos options -#KerberosAuthentication no -#KerberosOrLocalPasswd yes -#KerberosTicketCleanup yes -#KerberosGetAFSToken no - -# GSSAPI options -#GSSAPIAuthentication no -#GSSAPICleanupCredentials yes - -# Set this to 'yes' to enable PAM authentication, account processing, -# and session processing. If this is enabled, PAM authentication will -# be allowed through the ChallengeResponseAuthentication and -# PasswordAuthentication. Depending on your PAM configuration, -# PAM authentication via ChallengeResponseAuthentication may bypass -# the setting of "PermitRootLogin without-password". -# If you just want the PAM account and session checks to run without -# PAM authentication, then enable this but set PasswordAuthentication -# and ChallengeResponseAuthentication to 'no'. -#UsePAM no - -#AllowAgentForwarding yes -# Feel free to re-enable these if your use case requires them. AllowTcpForwarding no GatewayPorts no X11Forwarding no -#X11DisplayOffset 10 -#X11UseLocalhost yes -#PermitTTY yes -#PrintMotd yes -#PrintLastLog yes -#TCPKeepAlive yes -#PermitUserEnvironment no -#Compression delayed -#ClientAliveInterval 0 -#ClientAliveCountMax 3 -#UseDNS no -#PidFile /run/sshd.pid -#MaxStartups 10:30:100 -#PermitTunnel no -#ChrootDirectory none -#VersionAddendum none - -# no default banner path -#Banner none - -# override default of no subsystems Subsystem sftp /usr/lib/ssh/sftp-server -# Example of overriding settings on a per-user basis -#Match User anoncvs -# X11Forwarding no -# AllowTcpForwarding no -# PermitTTY no -# ForceCommand cvs server