Asara/infra
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix up lnd, add haproxy + lego for certs

Browse source
This commit is contained in:
Amarpreet Minhas 2021-01-12 20:12:49 -05:00
parent 788987a33c
commit 88439a2a8d
18 changed files with 280 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ansible/group_vars/all/main.yml
View file

@ -66,5 +66,8 @@ nomad_podman_driver_version: 0.1.0
podman_version: 2.1.1+dfsg1-4
# lnd
lnd_version: v0.12.0-beta.rc3
lnd_version: 0.11.1-beta
# lego
lego_version: 4.1.3
...

4
ansible/group_vars/haproxy/main.yml Normal file
View file

@ -0,0 +1,4 @@
---
lego_email_address: amarpreet@minhas.io
letsencrypt_account_id: "{{ lookup('hashi_vault', 'secret=kv/data/acme:data')['account_id'] }}"
...

9
ansible/host_vars/ivyking.minhas.io/haproxy.yml Normal file
View file

@ -0,0 +1,9 @@
---
haproxy_domains:
- { name: "gitea", url: "git.minhas.io" }
- { name: "freshrss", url: "rss.minhas.io" }
- { name: "radicale", url: "dav.minhas.io" }
- { name: "wallabag", url: "wallabag.minhas.io" }
- { name: "kanban", url: "kanban.minhas.io" }
- { name: "api", url: "api.sudoscientist.com" }
...

5
ansible/host_vars/ivyking.minhas.io/lego.yml Normal file
View file

@ -0,0 +1,5 @@
---
lego_certs:
- { name: "_.minhas.io", domain: "*.minhas.io", dns: "namecheap" }
- { name: "api.sudoscientist.com", domain: "api.sudoscientist.com", dns: "route53" }
...

0
ansible/host_vars/ivyking.minhas.io/main.yml → ansible/host_vars/ivyking.minhas.io/nexus.yml
View file

3
ansible/inventory.txt
View file

@ -28,3 +28,6 @@ sedan.minhas.io
[wekan]
sedan.minhas.io
[haproxy]
ivyking.minhas.io

6
ansible/playbooks/haproxy.yml Normal file
View file

@ -0,0 +1,6 @@
---
- hosts: haproxy
roles:
- role: lego
- role: haproxy
...

1
ansible/playbooks/site.yml
View file

@ -7,4 +7,5 @@
- import_playbook: nexus.yml
- import_playbook: lnd.yml
- import_playbook: wekan.yml
- import_playbook: haproxy.yml
...

6
ansible/roles/haproxy/handlers/main.yml Normal file
View file

@ -0,0 +1,6 @@
---
- name: reload haproxy
systemd:
name: haproxy
state: reloaded
...

28
ansible/roles/haproxy/tasks/main.yml Normal file
View file

@ -0,0 +1,28 @@
---
- name: ensure haproxy exists
apt:
name: haproxy
state: present
- name: ensure haproxy certs dir exists
file:
path: /etc/haproxy/certs
state: directory
owner: haproxy
group: haproxy
mode: 0750
- name: template haproxy config
template:
src: templates/haproxy.cfg.j2
dest: /etc/haproxy/haproxy.cfg
owner: haproxy
group: haproxy
mode: 0644
notify: reload haproxy
- name: ensure haproxy is started and enabled
systemd:
name: haproxy
state: started
enabled: True

63
ansible/roles/haproxy/templates/haproxy.cfg.j2 Normal file
View file

@ -0,0 +1,63 @@
global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
stats timeout 30s
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
frontend fe_default
mode http
bind :443 ssl crt /etc/haproxy/certs/ alpn h2,http/1.1
bind :80
redirect scheme https code 301 if !{ ssl_fc }
http-response set-header Strict-Transport-Security max-age=63072000
{% for domain in haproxy_domains %}
acl host_{{ domain.name }} hdr(host) -i {{ domain.url }}
{% endfor %}
{% for domain in haproxy_domains %}
use_backend be_{{ domain.name }} if host_{{ domain.name }}
{% endfor %}
{% for domain in haproxy_domains %}
{% if domain.name != 'api' %}
backend be_{{ domain.name }}
balance leastconn
server-template {{ domain.name }} 1 _{{ domain.name }}._tcp.service.masked.name resolvers consul resolve-opts allow-dup-ip resolve-prefer ipv4 check
{% endif %}
{% endfor %}
backend be_api
balance leastconn
server server1 192.168.122.77:8080
resolvers consul
nameserver consul 127.0.0.1:8600
accepted_payload_size 8192
hold valid 5s

3
ansible/roles/lego/defaults/main.yml Normal file
View file

@ -0,0 +1,3 @@
---
lego_path: /etc/lego/
...

117
ansible/roles/lego/tasks/main.yml Normal file
View file

@ -0,0 +1,117 @@
---
- name: ensure lego group
group:
name: lego
state: present
system: True
- name: ensure lego user
user:
name: lego
state: present
group: lego
system: True
home: /etc/lego
shell: /bin/bash
- name: check lego version
shell:
cmd: "/usr/local/bin/lego --version | cut -d ' ' -f3"
args:
executable: /bin/bash
changed_when: False
register: installed_lego_version
check_mode: False
- name: get lego
unarchive:
src: "https://github.com/go-acme/lego/releases/download/v{{ lego_version }}/lego_v{{ lego_version }}_linux_amd64.tar.gz"
dest: /usr/local/bin/
mode: 0755
owner: root
group: root
remote_src: True
when: installed_lego_version.stdout != lego_version
register: installed_lego
- name: remove LICENSE/CHANGELOG
file:
path: "{{ item }}"
state: absent
loop:
- /usr/local/bin/CHANGELOG.md
- /usr/local/bin/LICENSE
changed_when: False
when: installed_lego.changed
- name: ensure lego account directory exists
file:
path: /etc/lego/accounts/acme-v02.api.letsencrypt.org/{{ lego_email_address }}/keys/
state: directory
owner: lego
group: lego
mode: 0700
- name: ensure account.json exists
template:
src: templates/account.json.j2
dest: /etc/lego/accounts/acme-v02.api.letsencrypt.org/{{ lego_email_address }}/account.json
owner: lego
group: lego
mode: 0600
- name: ensure account private key exists
template:
src: templates/{{ lego_email_address }}.key.j2
dest: /etc/lego/accounts/acme-v02.api.letsencrypt.org/{{ lego_email_address }}/keys/{{ lego_email_address }}.key
owner: lego
group: lego
mode: 0600
- name: ensure namecheap api info exists
template:
src: templates/defaults
dest: /etc/default/lego
owner: lego
group: lego
mode: 0400
- name: check if certs exist
stat:
path: /etc/lego/certificates/{{ item.name }}.pem
loop: "{{ lego_certs }}"
register: statted
- name: create new certs
shell:
cmd: 'source /etc/default/lego && /usr/local/bin/lego --pem --path {{ lego_path }} --email {{ lego_email_address }} --dns {{ item.item.dns }} --domains "{{ item.item.domain }}" run'
args:
executable: /bin/bash
when: item.stat.exists == False
loop: "{{ statted.results }}"
check_mode: False
- name: create reload hook for domain
template:
src: templates/lego_reload.sh.j2
dest: /usr/local/bin/lego_reload_{{ item.name }}.sh
owner: lego
group: lego
mode: 0700
loop: "{{ lego_certs }}"
- name: create renewal crontabs
cron:
name: "{{ item.name }} renewal"
hour: "4"
user: lego
job: 'source /etc/default/lego && /usr/local/bin/lego --pem --path {{ lego_path }} --email {{ lego_email_address }} --dns {{ item.dns }} --domains "{{ item.domain }}" renew --days 30'
loop: "{{ lego_certs }}"
- name: create haproxy reload crontab
cron:
name: "{{ item.name }} haproxy reload"
hour: "5"
user: root
job: '/usr/local/bin/lego_reload_{{ item.name }}.sh'
loop: "{{ lego_certs }}"

12
ansible/roles/lego/templates/account.json.j2 Normal file
View file

@ -0,0 +1,12 @@
{
"email": "amarpreet@minhas.io",
"registration": {
"body": {
"status": "valid",
"contact": [
"mailto:amarpreet@minhas.io"
]
},
"uri": "https://acme-v02.api.letsencrypt.org/acme/acct/{{ letsencrypt_account_id }}"
}
}

1
ansible/roles/lego/templates/amarpreet@minhas.io.key.j2 Normal file
View file

@ -0,0 +1 @@
{{ lookup('hashi_vault', 'secret=kv/data/acme:data')['private_key'] }}

5
ansible/roles/lego/templates/defaults Normal file
View file

@ -0,0 +1,5 @@
export NAMECHEAP_API_USER={{ lookup('hashi_vault', 'secret=kv/data/namecheap:data')['api_user'] }}
export NAMECHEAP_API_KEY={{ lookup('hashi_vault', 'secret=kv/data/namecheap:data')['api_key'] }}
export AWS_ACCESS_KEY_ID={{ lookup('hashi_vault', 'secret=kv/data/aws:data')['access_key'] }}
export AWS_SECRET_ACCESS_KEY={{ lookup('hashi_vault', 'secret=kv/data/aws:data')['secret_key'] }}
export AWS_HOSTED_ZONE_ID={{ lookup('hashi_vault', 'secret=kv/data/aws:data')['hosted_zone_id'] }}

12
ansible/roles/lego/templates/lego_reload.sh.j2 Normal file
View file

@ -0,0 +1,12 @@
#!/bin/bash
SOURCE_PEM=/etc/lego/certificates/{{ item.name }}.pem
DEST_PEM=/etc/haproxy/certs/{{ item.name }}.pem
if [ -e ${DEST_PEM} ]; then
if [ $(diff ${SOURCE_PEM} ${DEST_PEM}) == 0 ]; then
exit
fi
cp ${SOURCE_PEM} ${DEST_PEM}
chown haproxy:haproxy ${DEST_PEM}
systemctl reload haproxy
fi

2
ansible/roles/lnd/tasks/main.yml
View file

@ -20,7 +20,7 @@
- name: update lnd
unarchive:
src: 'https://github.com/lightningnetwork/lnd/releases/download/{{ lnd_version }}/lnd-linux-{{ lnd_arch }}-{{ lnd_version }}.tar.gz'
src: 'https://github.com/lightningnetwork/lnd/releases/download/v{{ lnd_version }}/lnd-linux-{{ lnd_arch }}-v{{ lnd_version }}.tar.gz'
dest: /home/bitcoind/go/bin/
owner: bitcoind
group: bitcoind