diff --git a/ansible/borg-server-install.yml b/ansible/borg-server-install.yml deleted file mode 100644 index a084842..0000000 --- a/ansible/borg-server-install.yml +++ /dev/null @@ -1,71 +0,0 @@ -- hosts: backup - vars: - user: backup - group: backup - home: /home/backup - pool: "{{ home }}/repos" - auth_users: - - host: node00.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/node00.grinminer.net.pub') }}" - - host: node01.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/node01.grinminer.net.pub') }}" - - host: node02.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/ha-testnet.grinminer.net.pub') }}" - - host: node03.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/ha-testnet.grinminer.net.pub') }}" - - host: core00.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/core00.grinminer.net.pub') }}" - - host: core01.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/core01.grinminer.net.pub') }}" - - host: freenode00.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/freenode00.grinminer.net.pub') }}" - - host: freenode01.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/freenode01.grinminer.net.pub') }}" - - host: freenode02.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/freenode02.grinminer.net.pub') }}" - - host: freenode03.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/freenode03.grinminer.net.pub') }}" - - host: freenode04.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/freenode04.grinminer.net.pub') }}" - - host: freenode05.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/freenode05.grinminer.net.pub') }}" - - host: ha-mainnet.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/ha-testnet.grinminer.net.pub') }}" - - host: ha-testnet.grinminer.net - key: "{{ lookup('file', '/etc/ssh/ha-testnet.grinminer.net.pub') }}" - - host: ha-node.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/ha-node.grinminer.net.pub') }}" - - host: ha-testnode.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/ha-testnode.grinminer.net.pub') }}" - - host: ha-mine.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/ha-mine.grinminer.net.pub') }}" - - host: dns.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/dns.grinminer.net.pub') }}" - - host: dns1.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/dns1.grinminer.net.pub') }}" - - host: www.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/www.grinminer.net.pub') }}" - - host: proxy.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/proxy.grinminer.net.pub') }}" - - host: stats.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/stats.grinminer.net.pub') }}" - - host: zabbix.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/zabbix.grinminer.net.pub') }}" - - host: matrix.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/matrix.grinminer.net.pub') }}" - - host: ansible.grinminer.net - key: "{{ lookup('file', '/etc/ssh/keys/ansible.grinminer.net.pub') }}" - tasks: - - package: name=borg state=present - - group: name="{{ group }}" state=present - - user: name="{{ user }}" shell=/bin/bash home="{{ home }}" createhome=yes group="{{ group }}" groups= state=present - - file: path="{{ home }}" owner="{{ user }}" group="{{ group }}" mode=0700 state=directory - - file: path="{{ home }}/.ssh" owner="{{ user }}" group="{{ group }}" mode=0700 state=directory - - file: path="{{ pool }}" owner="{{ user }}" group="{{ group }}" mode=0700 state=directory - - authorized_key: user="{{ user }}" - key="{{ item.key }}" - key_options='command="cd {{ pool }}/{{ item.host }};borg serve --restrict-to-path {{ pool }}/{{ item.host }}",restrict' - with_items: "{{ auth_users }}" - - file: path="{{ home }}/.ssh/authorized_keys" owner="{{ user }}" group="{{ group }}" mode=0600 state=file - - file: path="{{ pool }}/{{ item.host }}" owner="{{ user }}" group="{{ group }}" mode=0700 state=directory - with_items: "{{ auth_users }}" \ No newline at end of file diff --git a/ansible/ssh-hardening.yml b/ansible/ssh-hardening.yml new file mode 100644 index 0000000..b46a64e --- /dev/null +++ b/ansible/ssh-hardening.yml @@ -0,0 +1,32 @@ +- hosts: all + remote_user: root + tasks: + + - name: Install fail2ban + ansible.builtin.apt: + pkg: + - fail2ban + state: latest + update_cache: yes + + - name: Download and install fail2ban + ansible.builtin.shell: + cmd: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local + cmd: systemctl enable fail2ban + cmd: systemctl start fail2ban + + - name: Replace PermitRootLogin + ansible.builtin.replace: + path: /etc/ssh/sshd_config + regexp: PermitRootLogin yes + replace: PermitRootLogin prohibit-password + + - name: Replace PasswordAuthentication + ansible.builtin.replace: + path: /etc/ssh/sshd_config + regexp: PasswordAuthentication yes + replace: PasswordAuthentication no + + - name: Restart SSH + ansible.builtin.shell: + cmd: systemctl restart ssh \ No newline at end of file diff --git a/ansible/vaultwarden-server-install.yml b/ansible/vaultwarden-server-install.yml deleted file mode 100644 index 26f39b9..0000000 --- a/ansible/vaultwarden-server-install.yml +++ /dev/null @@ -1,38 +0,0 @@ -- hosts: vaultwarden - remote_user: root - tasks: - - - name: Create user vaultwarden - ansible.builtin.user: - name: vaultwarden - password: $6$rKRPJwebeYGVL1tm$iDBNbMkfGaTJ1odReOEA.lD7jVndeBN2AQNo9AHxCRcx6HFKQg8MQT.P3bmfEbrnhdDBDlB1WRpH/sTyjSgrX/ - - - - name: Download vaultwarden-server - get_url: - url: https://github.com/dionysius/vaultwarden-deb/releases/download/debian%2F1.32.6-0/vaultwarden_1.32.6-0.bookworm_amd64.deb - dest: /tmp/ - mode: '0775' - force: 'yes' - - - name: Download vaultwarden-vault - get_url: - url: https://github.com/dionysius/vaultwarden-web-vault-deb/releases/download/debian%2F2024.6.2-0/vaultwarden-web-vault_2024.6.2-0.bookworm_all.deb - dest: /tmp/ - mode: '0775' - force: 'yes' - - - name: Install dependencies - ansible.builtin.apt: - name: mariadb-server - name: libpq5 - state: latest - - - name: Install web-vault - ansible.builtin.shell: - cmd: dpkg -i /tmp/vaultwarden-web-vault_2024.6.2-0.bookworm_all.deb - - - name: install server - ansible.builtin.shell: - cmd: dpkg -i /tmp/vaultwarden_1.32.6-0.bookworm_amd64.deb - diff --git a/ansible/www-server-replication.yml b/ansible/www-server-replication.yml deleted file mode 100644 index 1e04a37..0000000 --- a/ansible/www-server-replication.yml +++ /dev/null @@ -1,11 +0,0 @@ -- hosts: www - remote_user: root - tasks: - - - name: Replicate /var/www/html/ to all webservers - ansible.builtin.shell: - cmd: scp /var/www/html/* https://www1.grinminer.net:/var/www/html/ - cmd: scp /var/www/html/* https://www2.grinminer.net:/var/www/html/ - cmd: scp /var/www/html/* https://www3.grinminer.net:/var/www/html/ - cmd: scp /var/www/html/* https://www4.grinminer.net:/var/www/html/ - cmd: scp /var/www/html/* https://www5.grinminer.net:/var/www/html/ \ No newline at end of file diff --git a/ansible/zabbix-agent-install.yml b/ansible/zabbix-agent-install.yml deleted file mode 100644 index 18f224a..0000000 --- a/ansible/zabbix-agent-install.yml +++ /dev/null @@ -1,60 +0,0 @@ -- hosts: all - remote_user: root - tasks: - - - name: Create user zabbix - ansible.builtin.user: - name: zabbix - password: - - - name: Download zabbix repository - get_url: - url: https://repo.zabbix.com/zabbix/7.2/release/debian/pool/main/z/zabbix-release/zabbix-release_latest_7.2+debian12_all.deb - dest: /tmp/ - mode: '0775' - force: 'yes' - - - name: Unpack and update repository - ansible.builtin.shell: - cmd: dpkg -i /tmp/zabbix-release_latest_7.2+debian12_all.deb - - - name: Install zabbix-agent - ansible.builtin.apt: - name: zabbix-agent - name: ufw - state: latest - update_cache: yes - - - name: Enable zabbix-agent.service - ansible.builtin.shell: - cmd: systemctl enable zabbix-agent - - - name: DNS config overwrite - ansible.builtin.shell: - cmd: echo "domain grinminer.net \nsearch grinminer.net \nnameserver 10.0.0.2 \nnameserver 10.0.0.3 \nnameserver 1.1.1.1" > /etc/resolv.conf - - - name: zabbix-agent config1 - ansible.builtin.replace: - path: /etc/zabbix/zabbix_agentd.conf - backup: true - regexp: 127.0.0.1 - replace: 10.0.0.5 - - - name: zabbix-agent config2 - ansible.builtin.replace: - path: /etc/zabbix/zabbix_agentd.conf - backup: true - regexp: '#Hostname' - replace: 'Hostname' - - - name: zabbix-agent config3 - ansible.builtin.replace: - path: /etc/zabbix/zabbix_agentd.conf - backup: true - regexp: 'Hostname=' - replace: 'Hostname=zabbix.grinminer.net' - - - name: restart zabbix-agent and open fw - ansible.builtin.shell: - cmd: systemctl restart zabbix-agent - cmd: ufw allow 10050 \ No newline at end of file