[GIT] refactor submodules: add all to own repo

README.md

@@ -0,0 +1,41 @@
+Server
+=========
+
+Essential server setup tasks, like sshd config, ddns cronjobs (+ mail output), etc.
+
+Requirements
+------------
+
+none TODO!!
+
+Role Variables
+--------------
+
+If borgbackup is used, the following variables need to be set for each host.
+Multiple hosts using the same backup account is currently not supported by the borgbackup script.
+- borgbackup_host
+- borgbackup_sub
+
+Dependencies
+------------
+
+none
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+GPLv3
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

defaults/main.yml

@@ -0,0 +1,5 @@
+---
+# defaults file for server
+
+telegraf_docker_file: "telegraf-docker.conf"
+telegraf_snmp_file: "telegraf-SNMP.conf"

files/caddy.service

@@ -0,0 +1,44 @@
+[Unit]
+Description=Caddy HTTP/2 web server
+Documentation=https://caddyserver.com/docs
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Restart=on-abnormal
+
+User=www-data
+Group=www-data
+Environment=CADDYPATH=/etc/ssl/caddy
+
+PIDFile=/run/caddy.pid
+ExecStart=/usr/local/bin/caddy -log stdout -agree -email=code@jannikbeyerstedt.de -conf=/etc/caddy/Caddyfile -root=/var/tmp
+ExecReload=/bin/kill -USR1 $MAINPID
+
+KillMode=mixed
+KillSignal=SIGQUIT
+TimeoutStopSec=5s
+
+LimitNOFILE=8192
+LimitNPROC=64
+
+StartLimitInterval=600
+;StartLimitBurst=5
+RestartSec=60
+PermissionsStartOnly=true
+
+PrivateTmp=true
+;PrivateDevices=true
+;ProtectHome=true
+;ProtectSystem=full
+ReadWriteDirectories=/etc/ssl/caddy
+
+; The following additional security directives only work with systemd v229 or later.
+; They further restrict privileges that can be gained by caddy.
+; Note that you may have to add capabilities required by any plugins in use.
+;CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+;AmbientCapabilities=CAP_NET_BIND_SERVICE
+;NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target

files/ddns-hosts.sh

@@ -0,0 +1,54 @@
+#!/bin/sh
+passwd='dyndnshosts'
+hostname=$(hostname | tr '[:upper:]' '[:lower:]')
+
+platform='unknown'
+unamestr=$(uname)
+if [ "$unamestr" = 'Linux' ]; then
+  platform='linux'
+elif [ "$unamestr" = 'FreeBSD' ]; then
+  platform='freebsd'
+fi
+
+ip6addr=''
+ip4addr=''
+if [ $platform = 'linux' ]; then
+  ip6addr=$(ip -6 addr show scope global | grep inet6 | tail -1 | egrep -o '([0-9abcdef]{4}[0-9:abcdef]*)')
+  # filter local IPv4 address ranges (172.16.0.0/12, 10.0.0.0/8, 192.168.0.0/16)
+  ip4addr=$(ip -4 addr show scope global | grep inet | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | grep -Ev '172.(1[6-9]|2[0-9]|3[0-1])' | grep -Ev '10.' | grep -Ev '192.168.' | head -n 1)
+elif [ $platform = 'freebsd' ]; then
+  ip6addr=$(ifconfig em0 | grep inet6 | tail -1 | egrep -o '([0-9abcdef]{4}[0-9:abcdef]*)')
+  ip4addr=$(ifconfig em0 inet | grep inet | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | head -n 1)
+fi
+
+echo "Current IP addresses of $hostname are: $ip4addr, $ip6addr"
+
+
+if [ $ip4addr ]; then
+  echo "Updating IPv4 DNS entry..."
+else
+  echo "No public IPv4 address, updating DNS entry anyway..."
+fi
+
+# API always returns 200, so check for response payload to begin with {"Success":true,
+url="https://dyndns.jtbx.de/update?secret=$passwd&domain=$hostname&addr=$ip4addr"
+statuscode=$(curl -s $url)
+case "$statuscode" in
+  {\"Success\":true*) echo "IPv4 Success" ;;
+  *) (>&2 echo "IPv4 DynDNS update failed: API response:\n$statuscode") ;;
+esac
+
+
+if [ $ip6addr ]; then
+  echo "Updating IPv6 DNS entry..."
+
+  # API always returns 200, so check for response payload to begin with {"Success":true,
+  url="https://dyndns.jtbx.de/update?secret=$passwd&domain=$hostname&addr=$ip6addr"
+  statuscode=$(curl -s $url)
+  case "$statuscode" in
+    {\"Success\":true*) echo "IPv6 Success" ;;
+    *) (>&2 echo "IPv6 DynDNS update failed: API response:\n$statuscode") ;;
+  esac
+else
+  echo "No public IPv6 Address, skipping DNS update."
+fi

files/ddns-namecheap.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+passwd='dyndnshosts'
+hostname=$(hostname | tr '[:upper:]' '[:lower:]')
+domain=jtbx.space
+
+/usr/bin/curl -4 -s "http://dynamicdns.park-your-domain.com/update?host=$hostname&domain=$domain&password=$passwd" > /dev/null

files/sshd_config

@@ -0,0 +1,70 @@
+# Standard sshd config of Jannik Beyerstedt
+
+Protocol 2
+#Port 4422
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+# Ciphers and keying
+#RekeyLimit default none
+KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
+
+# Logging
+#SyslogFacility AUTH
+LogLevel VERBOSE
+
+# Authentication:
+#LoginGraceTime 2m
+PermitRootLogin no
+#StrictModes yes
+MaxAuthTries 2
+MaxSessions 2
+
+IgnoreRhosts yes
+
+# Password based logins are disabled - only public key based logins are allowed.
+AuthenticationMethods publickey
+PasswordAuthentication no
+PermitEmptyPasswords no
+ChallengeResponseAuthentication no
+
+UsePAM yes
+
+AllowAgentForwarding no
+AllowTcpForwarding no
+#GatewayPorts no
+X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+PrintMotd no
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#UsePrivilegeSeparation sandbox
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+ClientAliveCountMax 2
+UseDNS no
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+# override default of no subsystems
+Subsystem	sftp	/usr/lib/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server

handlers/main.yml

@@ -0,0 +1,41 @@
+---
+# handlers file for server
+
+- name: Restart sshd
+  service:
+    name: ssh
+    state: restarted
+
+
+- name: Enable telegraf
+  service:
+    name: telegraf
+    enabled: yes
+
+- name: Restart telegraf
+  service:
+    name: telegraf
+    state: restarted
+
+- name: Enable and restart telegraf
+  service:
+    name: telegraf
+    state: restarted
+    enabled: yes
+
+
+- name: Enable caddy
+  service:
+    name: caddy
+    enabled: yes
+
+- name: Restart caddy
+  service:
+    name: caddy
+    state: restarted
+
+- name: Enable and restart caddy
+  service:
+    name: caddy
+    state: restarted
+    enabled: yes

meta/main.yml

@@ -0,0 +1,20 @@
+galaxy_info:
+  author: Jannik Beyerstedt
+  description: General server setup
+
+  # issue_tracker_url: http://example.com/issue/tracker
+  license: GPLv3
+  min_ansible_version: 2.4
+
+  platforms:
+  - name: Debian
+    versions:
+    - all
+
+  galaxy_tags: []
+    # List tags for your role here, one per line.
+    # Be sure to remove the '[]' above, if you add tags to this list.
+
+dependencies: []
+  # List your role dependencies here, one per line.
+  # Be sure to remove the '[]' above, if you add tags to this list.

tasks/borgbackup-Debian-stretch.yml

@@ -0,0 +1,35 @@
+---
+# Server/Borgbackup: Install and Setup Borgbackup Backup Crobjob - Debian Stretch Version
+# Variables (must be set!):
+# - borgbackup_host
+# - borgbackup_sub
+
+# For Debian Stretch, use a newer package version from backports
+
+- name: borgbackup - Add debian repo key
+  become: yes
+  apt_key:
+    keyserver: pgpkeys.mit.edu
+    id: 8B48AD6246925553
+    state: present
+  when:
+    - ansible_distribution_release == 'stretch'
+- name: borgbackup - Add stretch-backports
+  become: yes
+  apt_repository:
+    repo: deb http://ftp.debian.org/debian stretch-backports main
+    state: present
+  when:
+    - ansible_distribution_release == 'stretch'
+- name: borgbackup - Install borgbackup from stretch-backports
+  become: yes
+  apt:
+    name: borgbackup
+    state: latest
+    default_release: stretch-backports
+    update_cache: yes
+    cache_valid_time: 3600
+  when:
+    - borgbackup_host is defined
+    - borgbackup_sub is defined
+    - ansible_distribution_release == 'stretch'

tasks/borgbackup-Debian.yml

@@ -0,0 +1,19 @@
+---
+# Server/Borgbackup: Install and Setup Borgbackup Backup Crobjob - Default Debian Version
+# Variables (must be set!):
+# - borgbackup_host
+# - borgbackup_sub
+
+# For all other Debian versions, simply install borgbackup
+
+- name: borgbackup - Install borgbackup
+  become: yes
+  apt:
+    name: borgbackup
+    state: latest
+    update_cache: yes
+    cache_valid_time: 3600
+  when:
+    - borgbackup_host is defined
+    - borgbackup_sub is defined
+    - ansible_distribution_release != 'stretch'

tasks/borgbackup.yml

@@ -0,0 +1,57 @@
+---
+# Server/Borgbackup: Install and Setup Borgbackup Backup Crobjob
+# Variables (must be set!):
+# - borgbackup_host
+# - borgbackup_sub
+
+- name: borgbackup - Install
+  include_tasks: "{{ item }}"
+  with_first_found:
+    - "borgbackup-{{ ansible_distribution }}.{{ ansible_distribution_release }}.yml"
+    - "borgbackup-{{ ansible_distribution }}.yml"
+    - "borgbackup-{{ ansible_os_family }}.yml"
+
+
+# copy backup script and enable cronjob
+- name: borgbackup - Copy Borgbackup script
+  become: yes
+  template:
+    src: "{{ role_path }}/templates/borgbackup.sh"
+    dest: /usr/local/bin/borgbackup.sh
+    owner: "{{ ansible_user_id }}"
+    group: "{{ ansible_user_id }}"
+    mode: 0775
+  when:
+    - borgbackup_host is defined
+    - borgbackup_sub is defined
+- name: borgbackup - Run Borgbackup script at 1:00 daily
+  become: yes
+  cron:
+    name: "Create Backup"
+    minute: "0"
+    hour: "1"
+    job: "/usr/local/bin/borgbackup.sh"
+  when:
+    - borgbackup_host is defined
+    - borgbackup_sub is defined
+
+# safeguard, if the host variables were removed
+- name: borgbackup - Remove Borgbackup script if no borgbackup config
+  become: yes
+  file:
+    path: /usr/local/bin/borgbackup.sh
+    state: absent
+  when:
+    - borgbackup_host is not defined
+    - borgbackup_sub is not defined
+- name: borgbackup - Remove Cronjob if no borgbackup config
+  become: yes
+  cron:
+    name: "Create Backup"
+    minute: "0"
+    hour: "1"
+    job: "/usr/local/bin/borgbackup.sh"
+    state: absent
+  when:
+    - borgbackup_host is not defined
+    - borgbackup_sub is not defined

tasks/caddy-install.yml

@@ -0,0 +1,43 @@
+---
+# Server/Caddyserver-Install: Install/Update Caddy Webserver (with some modules)
+
+- name: caddyserver - Stop caddy
+  become: yes
+  service:
+    name: caddy
+    state: stopped
+
+- name: caddyserver - Make temp download directory
+  file:
+    path: /tmp/caddy
+    state: directory
+- name: caddyserver - Download caddy webserver
+  get_url:
+    url: https://caddyserver.com/download/linux/amd64?plugins=http.ratelimit&license=personal
+    dest: /tmp/caddy/caddy.tar.gz
+- name: caddyserver - Extract caddy
+  shell: "cd /tmp/caddy && tar -xvf caddy.tar.gz"
+  # unarchive:
+  #   src: /tmp/caddy/caddy.tar.gz
+  #   dest: /tmp/caddy
+  #   copy: no
+- name: caddyserver - Copy caddy to a PATH location
+  become: yes
+  shell: "cp /tmp/caddy/caddy /usr/local/bin"
+- name: caddyserver - Clean up download files
+  become: yes
+  file:
+    path: /tmp/caddy
+    state: absent
+- name: caddyserver - Install caddy APT dependencies
+  become: yes
+  apt:
+    name: libcap2-bin
+    state: latest
+- name: caddyserver - Give caddy port binding capabilities
+  become: yes
+  shell: "setcap cap_net_bind_service=+ep /usr/local/bin/caddy"
+  # capabilities:
+  #   path: "{{ caddy_bin }}"
+  #   capability: cap_net_bind_service+ep
+  #   state: present

tasks/caddy-setup.yml

@@ -0,0 +1,46 @@
+---
+# Server/Caddyserver-Setup: Setup Caddy Webserver (user, directories, etc)
+
+- name: caddyserver - Add www-data system user
+  become: yes
+  user:
+    name: www-data
+    create_home: no
+    system: yes
+    shell: /bin/false
+    state: present
+- name: caddyserver - Add Caddy directories
+  become: yes
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: www-data
+    group: www-data
+    mode: 0770
+  with_items:
+    - /etc/ssl/caddy
+    - /etc/caddy
+- name: caddyserver - Add Caddy home directory
+  become: yes
+  file:
+    path: /var/www
+    state: directory
+    owner: www-data
+    group: www-data
+    mode: 0555
+- name: caddyserver - Copy Caddy systemd service file
+  become: yes
+  copy:
+    src: "{{ role_path }}/files/caddy.service"
+    dest: /etc/systemd/system/caddy.service
+    owner: root
+    group: root
+    mode: 0644
+
+
+- name: caddyserver - Add standard user to www-data group
+  become: yes
+  user:
+    name: "{{ ansible_user_id }}"
+    groups: www-data
+    append: yes

tasks/caddyserver.yml

@@ -0,0 +1,9 @@
+---
+# Server/Caddyserver: Install Caddy Webserver (with some modules)
+# ATTENTION: No Caddyfile is created yet and caddy is not enabled or started!
+
+- name: caddyserver - Install caddy server
+  include_tasks: "caddy-install.yml"
+
+- name: caddyserver - Setup caddy server
+  include_tasks: "caddy-setup.yml"

tasks/cronmails.yml

@@ -0,0 +1,49 @@
+---
+# Server/Cronmails: Setup Mails from Cronjobs (install exim)
+
+# Install and configure exim
+- name: cronmails - Install exim4 as MTA
+  become: yes
+  apt:
+    name: "{{ packages }}"
+    state: latest
+  vars:
+    packages:
+    - exim4
+    - mailutils
+- name: cronmails - Create exim4 config folder
+  become: yes
+  file: path=/etc/exim4 state=directory
+- name: cronmails - Copy exim4 config template
+  become: yes
+  copy:
+    src: "{{ role_path }}/files/exim4.conf.template"
+    dest: /etc/exim4/exim4.conf.template
+- name: cronmails - Copy exim4 config file
+  become: yes
+  template:
+    src: "{{ role_path }}/templates/update-exim4.conf.conf"
+    dest: /etc/exim4/update-exim4.conf.conf
+- name: cronmails - Run update-exim4.conf
+  become: yes
+  shell: "update-exim4.conf"
+- name: cronmails - Enable and start exim4
+  become: yes
+  service:
+    name: exim4
+    state: started
+    enabled: yes
+
+# Set crobjob env variables/ settings
+- name: cronmails - Crontab set path
+  become: yes
+  cron:
+    name: PATH
+    env: yes
+    value: /bin:/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin
+- name: cronmails - Crontab set mailto
+  become: yes
+  cron:
+    name: MAILTO
+    env: yes
+    value: "device-{{ ansible_hostname }}@jtbx.de"

tasks/docker.yml

@@ -0,0 +1,54 @@
+---
+# Server/Docker: Install Docker and Docker-Compose
+
+# Install docker CE
+- name: docker - Install docker CE APT dependencies
+  become: yes
+  apt:
+    name: "{{ packages }}"
+    state: latest
+  vars:
+    packages:
+    - apt-transport-https
+    - ca-certificates
+    - curl
+    - gnupg2
+    - software-properties-common
+- name: docker - Add docker CE repo key
+  become: yes
+  apt_key:
+    url: https://download.docker.com/linux/debian/gpg
+    state: present
+- name: docker - Add docker CE add repo
+  become: yes
+  apt_repository:
+    repo: deb [arch=amd64] https://download.docker.com/linux/debian stretch stable
+    state: present
+- name: docker - Install docker CE
+  become: yes
+  apt:
+    name: docker-ce
+    state: latest
+    update_cache: yes
+    cache_valid_time: 3600
+
+# Install docker-compose (TODO: do not use a static docker-compose version)
+- name: docker - Install docker-compose
+  become: yes
+  get_url:
+    url: https://github.com/docker/compose/releases/download/1.23.2/docker-compose-Linux-x86_64
+    dest: /usr/local/bin/docker-compose
+- name: docker - Make docker-compose executable
+  become: yes
+  file:
+    path: /usr/local/bin/docker-compose
+    mode: 0755
+
+
+# Other setup tasks
+- name: docker - Add standard user to docker group
+  become: yes
+  user:
+    name: "{{ ansible_user_id }}"
+    groups: docker
+    append: yes

tasks/dyndns.yml

@@ -0,0 +1,24 @@
+---
+# Server/Dyndns: Setup dynDNS Script
+
+- name: dyndns - Install needed tools
+  become: yes
+  package:
+    name: curl
+    state: present
+
+- name: dyndns - Copy hosts.jtbx.de dynDNS script
+  become: yes
+  copy:
+    src: "{{ role_path }}/files/ddns-hosts.sh"
+    dest: /usr/local/bin/ddns-hosts.sh
+    owner: "{{ ansible_user_id }}"
+    group: "{{ ansible_user_id }}"
+    mode: 0775
+- name: dyndns - Create cronjob for hosts.jtbx.de dynDNS script
+  become: yes
+  cron:
+    name: "hosts.jtbx.de dynDNS"
+    minute: "*/5"
+    hour: "*"
+    job: "/usr/local/bin/ddns-hosts.sh > /dev/null"

tasks/main.yml

@@ -0,0 +1,2 @@
+---
+# tasks file for server

tasks/setup.yml

@@ -0,0 +1,12 @@
+---
+# Server/Setup: Generic Setup Tasks (sshd)
+
+# SSH
+- name: setup - Copy sshd_config
+  become: yes
+  copy:
+    src: "{{ role_path }}/files/sshd_config"
+    dest: "/etc/ssh/sshd_config"
+    backup: yes
+  notify:
+  - Restart sshd

tasks/telegraf.yml

@@ -0,0 +1,36 @@
+---
+# Server/Telegraf: Install and Setup Telegraf Monitoring
+# Variables:
+# - telegraf_snmp: boolean, enable SNMP monitoring
+# - telegraf_docker: boolean, enable docker monitoring
+
+- name: telegraf - Install apt-transport-https
+  become: yes
+  apt:
+    name: apt-transport-https
+    state: latest
+- name: telegraf - Add telegraf repo key
+  become: yes
+  apt_key:
+    url: https://repos.influxdata.com/influxdb.key
+    state: present
+- name: telegraf - Add Telegraf repo
+  become: yes
+  apt_repository:
+    repo: deb https://repos.influxdata.com/debian stretch stable
+    state: present
+- name: telegraf - Install telegraf
+  become: yes
+  apt:
+    name: telegraf
+    state: latest
+    update_cache: yes
+    cache_valid_time: 3600
+
+- name: telegraf - Copy telegraf config
+  become: yes
+  template:
+    src: "{{ role_path }}/templates/telegraf.conf"
+    dest: /etc/telegraf/telegraf.conf
+  notify:
+  - Enable and restart telegraf

templates/borgbackup.sh

@@ -0,0 +1,67 @@
+#!/bin/sh
+# pass an arbitrary number of additional arguments to borg create by using
+# borgbackup.sh $option1 $option2 ... $optionN
+#   pass -v --stats to show more information
+#   pass --list --filter AME to show all fiels Added Modified or with Error
+
+#export BORG_RSH='ssh -i /home/jannik/.ssh/id_rsa'
+export BORG_RSH='ssh -i /home/jannik/.ssh/id_ed25519'
+export BORG_PASSPHRASE='borgbackup.{{ borgbackup_host }}@hetznerbx'
+export BORG_REPO='ssh://u182062-sub{{ borgbackup_sub }}@u182062.your-storagebox.de:23/./borg'
+
+# some helpers and error handling:
+info() { printf "\n%s %s\n\n" "$( date )" "$*" >&2; }
+trap 'echo $( date ) Backup interrupted >&2; exit 2' INT TERM
+
+
+# Backup the most important directories
+borg create                                 \
+    $@                                      \
+    --compression lz4                       \
+    --exclude-caches                        \
+    --exclude '/home/*/.cache/*'            \
+    --exclude '/var/run'                    \
+    --exclude '/var/cache/*'                \
+    --exclude '/var/tmp/*'                  \
+    --exclude '/var/lib/apt/*'              \
+    --exclude '/var/lib/dpkg/*'             \
+    --exclude '/var/lib/yum/*'              \
+    --exclude '/var/lib/docker/overlay2'    \
+    --exclude '/var/lib/docker/containers'  \
+    --exclude '/var/lib/docker/image'       \
+    --exclude '/var/lib/docker/tmp'         \
+    --exclude '/var/lib/lxcfs'              \
+    --exclude '/var/log/*'                  \
+                                            \
+    $BORG_REPO::'{{ borgbackup_host }}-{now:%Y%m%d_%H%M}' \
+    /etc                                    \
+    /var                                    \
+    /root                                   \
+    /home                                   \
+
+backup_exit=$?
+
+
+# Prune old backups: keep 7 daily, 4 weekly and 3 monthly
+borg prune                          \
+    --prefix '{{ borgbackup_host }}-' \
+    --keep-daily    7               \
+    --keep-weekly   4               \
+    --keep-monthly  3
+
+prune_exit=$?
+
+# use highest exit code as global exit code
+global_exit=$(( backup_exit > prune_exit ? backup_exit : prune_exit ))
+
+if [ ${global_exit} -eq 1 ];
+then
+    info "Backup and/or Prune finished with a warning"
+fi
+
+if [ ${global_exit} -gt 1 ];
+then
+    info "Backup and/or Prune finished with an error"
+fi
+
+exit ${global_exit}

templates/telegraf-SNMP.conf

@@ -0,0 +1,350 @@
+##
+## SNMP Input For Unifi APs (Gen 2/Gen 3)
+##
+[[inputs.snmp]]
+  agents = [ "192.168.4.11", "192.168.4.12", "192.168.8.13" ]
+  interval = "5m"
+  timeout = "10s"
+  retries = 3
+  # SNMP version, UAP only supports v1
+  version = 2
+  community = "public"
+  max_repetitions = 10
+  name = "snmp.UAP"
+
+  ##
+  ## System Details
+  ##
+  #  System name (hostname)
+  [[inputs.snmp.field]]
+    is_tag = true
+    name = "sysName"
+    oid = "RFC1213-MIB::sysName.0"
+  #  System vendor OID
+  [[inputs.snmp.field]]
+    name = "sysObjectID"
+    oid = "RFC1213-MIB::sysObjectID.0"
+  #  System description
+  [[inputs.snmp.field]]
+    name = "sysDescr"
+    oid = "RFC1213-MIB::sysDescr.0"
+  #  UAP model
+  [[inputs.snmp.field]]
+    name = "unifiApSystemModel"
+    oid = "UBNT-UniFi-MIB::unifiApSystemModel"
+  #  System uptime
+  [[inputs.snmp.field]]
+    name = "sysUpTime"
+    oid = "RFC1213-MIB::sysUpTime.0"
+
+  ##
+  ## Host Resources
+  ##
+  #  Total memory
+  #[[inputs.snmp.field]]
+  #  name = "memTotal"
+  #  oid = "FROGFOOT-RESOURCES-MIB::memTotal.0"
+  #  Free memory
+  #[[inputs.snmp.field]]
+  #  name = "memFree"
+  #  oid = "FROGFOOT-RESOURCES-MIB::memFree.0"
+  #  Buffer memory
+  #[[inputs.snmp.field]]
+  #  name = "memBuffer"
+  #  oid = "FROGFOOT-RESOURCES-MIB::memBuffer.0"
+  #  Cache memory
+  #[[inputs.snmp.field]]
+  #  name = "memCache"
+  #  oid = "FROGFOOT-RESOURCES-MIB::memCache.0"
+
+  ##
+  ## Interface Details & Metrics
+  ##
+  #  Wireless interfaces
+  [[inputs.snmp.table]]
+    oid = "UBNT-UniFi-MIB::unifiRadioTable"
+    [[inputs.snmp.table.field]]
+      is_tag = true
+      oid = "UBNT-UniFi-MIB::unifiRadioName"
+    [[inputs.snmp.table.field]]
+      is_tag = true
+      oid = "UBNT-UniFi-MIB::unifiRadioRadio"
+  #  BSS instances
+  [[inputs.snmp.table]]
+    oid = "UBNT-UniFi-MIB::unifiVapTable"
+    [[inputs.snmp.table.field]]
+      is_tag = true
+      oid = "UBNT-UniFi-MIB::unifiVapName"
+    [[inputs.snmp.table.field]]
+      is_tag = true
+      oid = "UBNT-UniFi-MIB::unifiVapRadio"
+  #  Ethernet interfaces
+  [[inputs.snmp.table]]
+    oid = "UBNT-UniFi-MIB::unifiIfTable"
+    [[inputs.snmp.table.field]]
+      is_tag = true
+      oid = "UBNT-UniFi-MIB::unifiIfName"
+
+  ##
+  ## System Performance
+  ##
+  #  System load averages
+  #[[inputs.snmp.table]]
+  #  oid = "FROGFOOT-RESOURCES-MIB::loadTable"
+  #  [[inputs.snmp.table.field]]
+  #    is_tag = true
+  #    oid = "FROGFOOT-RESOURCES-MIB::loadDescr"
+
+
+##
+## SNMP Input For EdgeRouter/ Unifi USG
+##
+  [[inputs.snmp]]
+    agents = [ "192.168.2.1" ]
+    interval = "5m"
+    timeout = "5s"
+    retries = 3
+    # SNMP version, values can be 1, 2, or 3
+    version = 2
+    community = "public"
+    max_repetitions = 10
+    name = "snmp.EdgeOS"
+
+  ##
+  ## Exclusions
+  ##
+  # Don't want these columns from UCD-SNMP-MIB::laTable
+  fielddrop = [ "laErrorFlag", "laErrMessage" ]
+  # Don't want these rows from UCD-DISKIO-MIB::diskIOTable
+  [inputs.snmp.tagdrop]
+    diskIODevice = [ "loop*", "ram*" ]
+
+  ##
+  ## System details
+  ##
+  #  System name (hostname)
+  [[inputs.snmp.field]]
+    name = "sysName"
+    oid = "SNMPv2-MIB::sysName.0"
+    is_tag = true
+  #  System vendor OID
+  [[inputs.snmp.field]]
+    name = "sysObjectID"
+    oid = "SNMPv2-MIB::sysObjectID.0"
+  #  System description
+  [[inputs.snmp.field]]
+    name = "sysDescr"
+    oid = "SNMPv2-MIB::sysDescr.0"
+  #  System uptime
+  [[inputs.snmp.field]]
+    name = "sysUpTime"
+    oid = "HOST-RESOURCES-MIB::hrSystemUptime.0"
+
+  #  Device Listing
+  [[inputs.snmp.table]]
+    oid = "HOST-RESOURCES-MIB::hrDeviceTable"
+    [[inputs.snmp.table.field]]
+      oid = "HOST-RESOURCES-MIB::hrDeviceIndex"
+      is_tag = true
+
+  ##
+  ## Host performance metrics
+  ##
+  #  System Load Average
+  [[inputs.snmp.table]]
+    oid = "UCD-SNMP-MIB::laTable"
+    [[inputs.snmp.table.field]]
+      oid = "UCD-SNMP-MIB::laNames"
+      is_tag = true
+
+  ##
+  ## CPU utilization
+  ##
+  #  Number of 'ticks' spent on user-level
+  [[inputs.snmp.field]]
+    name = "ssCpuRawUser"
+    oid = "UCD-SNMP-MIB::ssCpuRawUser.0"
+  #  Number of 'ticks' spent on reduced-priority
+  [[inputs.snmp.field]]
+    name = "ssCpuRawNice"
+    oid = "UCD-SNMP-MIB::ssCpuRawNice.0"
+  #  Number of 'ticks' spent on system-level
+  [[inputs.snmp.field]]
+    name = "ssCpuRawSystem"
+    oid = "UCD-SNMP-MIB::ssCpuRawSystem.0"
+  #  Number of 'ticks' spent idle
+  [[inputs.snmp.field]]
+    name = "ssCpuRawIdle"
+    oid = "UCD-SNMP-MIB::ssCpuRawIdle.0"
+  #  Number of 'ticks' spent waiting on I/O
+  [[inputs.snmp.field]]
+    name = "ssCpuRawWait"
+    oid = "UCD-SNMP-MIB::ssCpuRawWait.0"
+  #  Number of 'ticks' spent in kernel
+  [[inputs.snmp.field]]
+    name = "ssCpuRawKernel"
+    oid = "UCD-SNMP-MIB::ssCpuRawKernel.0"
+  #  Number of 'ticks' spent on hardware interrupts
+  [[inputs.snmp.field]]
+    name = "ssCpuRawInterrupt"
+    oid = "UCD-SNMP-MIB::ssCpuRawInterrupt.0"
+  #  Number of 'ticks' spent on software interrupts
+  [[inputs.snmp.field]]
+    name = "ssCpuRawSoftIRQ"
+    oid = "UCD-SNMP-MIB::ssCpuRawSoftIRQ.0"
+
+  ##
+  ## System Memory (physical/virtual)
+  ##
+  #  Size of phsyical memory (RAM)
+  [[inputs.snmp.field]]
+    name = "hrMemorySize"
+    oid = "HOST-RESOURCES-MIB::hrMemorySize.0"
+  #  Size of real/phys mem installed
+  [[inputs.snmp.field]]
+    name = "memTotalReal"
+    oid = "UCD-SNMP-MIB::memTotalReal.0"
+  #  Size of real/phys mem unused/avail
+  [[inputs.snmp.field]]
+    name = "memAvailReal"
+    oid = "UCD-SNMP-MIB::memAvailReal.0"
+  #  Total amount of mem unused/avail
+  [[inputs.snmp.field]]
+    name = "memTotalFree"
+    oid = "UCD-SNMP-MIB::memTotalFree.0"
+  #  Size of mem used as shared memory
+  [[inputs.snmp.field]]
+    name = "memShared"
+    oid = "UCD-SNMP-MIB::memShared.0"
+  #  Size of mem used for buffers
+  [[inputs.snmp.field]]
+    name = "memBuffer"
+    oid = "UCD-SNMP-MIB::memBuffer.0"
+  #  Size of mem used for cache
+  [[inputs.snmp.field]]
+    name = "memCached"
+    oid = "UCD-SNMP-MIB::memCached.0"
+
+  ##
+  ## Interface metrics
+  ##
+  #  Per-interface traffic, errors, drops
+  [[inputs.snmp.table]]
+    oid = "IF-MIB::ifTable"
+    [[inputs.snmp.table.field]]
+      oid = "IF-MIB::ifName"
+      is_tag = true
+  #  Per-interface high-capacity (HC) counters
+  [[inputs.snmp.table]]
+    oid = "IF-MIB::ifXTable"
+    [[inputs.snmp.table.field]]
+      oid = "IF-MIB::ifName"
+      is_tag = true
+
+  ##
+  ## IP metrics
+  ##
+  #  System-wide IP metrics
+  [[inputs.snmp.table]]
+    index_as_tag = true
+    oid = "IP-MIB::ipSystemStatsTable"
+
+  ##
+  ## ICMP Metrics
+  ##
+  #  ICMP statistics
+  [[inputs.snmp.table]]
+    index_as_tag = true
+    oid = "IP-MIB::icmpStatsTable"
+  #  ICMP per-type statistics
+  [[inputs.snmp.table]]
+    index_as_tag = true
+    oid = "IP-MIB::icmpMsgStatsTable"
+
+  ##
+  ## UDP statistics
+  ##
+  #  Datagrams delivered to app
+  [[inputs.snmp.field]]
+    name = "udpInDatagrams"
+    oid = "UDP-MIB::udpInDatagrams.0"
+  #  Datagrams received with no app
+  [[inputs.snmp.field]]
+    name = "udpNoPorts"
+    oid = "UDP-MIB::udpNoPorts.0"
+  #  Datagrams received with error
+  [[inputs.snmp.field]]
+    name = "udpInErrors"
+    oid = "UDP-MIB::udpInErrors.0"
+  #  Datagrams sent
+  [[inputs.snmp.field]]
+    name = "udpOutDatagrams"
+    oid = "UDP-MIB::udpOutDatagrams.0"
+
+  ##
+  ## TCP statistics
+  ##
+  #  Number of CLOSED -> SYN-SENT transitions
+  [[inputs.snmp.field]]
+    name = "tcpActiveOpens"
+    oid = "TCP-MIB::tcpActiveOpens.0"
+  #  Number of SYN-RCVD -> LISTEN transitions
+  [[inputs.snmp.field]]
+    name = "tcpPassiveOpens"
+    oid = "TCP-MIB::tcpPassiveOpens.0"
+  #  Number of SYN-SENT/RCVD -> CLOSED transitions
+  [[inputs.snmp.field]]
+    name = "tcpAttemptFails"
+    oid = "TCP-MIB::tcpAttemptFails.0"
+  #  Number of ESTABLISHED/CLOSE-WAIT -> CLOSED transitions
+  [[inputs.snmp.field]]
+    name = "tcpEstabResets"
+    oid = "TCP-MIB::tcpEstabResets.0"
+  #  Number of ESTABLISHED or CLOSE-WAIT
+  [[inputs.snmp.field]]
+    name = "tcpCurrEstab"
+    oid = "TCP-MIB::tcpCurrEstab.0"
+  #  Number of segments received
+  [[inputs.snmp.field]]
+    name = "tcpInSegs"
+    oid = "TCP-MIB::tcpInSegs.0"
+  #  Number of segments sent
+  [[inputs.snmp.field]]
+    name = "tcpOutSegs"
+    oid = "TCP-MIB::tcpOutSegs.0"
+  #  Number of segments retransmitted
+  [[inputs.snmp.field]]
+    name = "tcpRetransSegs"
+    oid = "TCP-MIB::tcpRetransSegs.0"
+  #  Number of segments received with error
+  [[inputs.snmp.field]]
+    name = "tcpInErrs"
+    oid = "TCP-MIB::tcpInErrs.0"
+  #  Number of segments sent w/RST
+  [[inputs.snmp.field]]
+    name = "tcpOutRsts"
+    oid = "TCP-MIB::tcpOutRsts.0"
+
+  ##
+  ## IP routing statistics
+  ##
+  #  Number of valid routing entries
+  [[inputs.snmp.field]]
+    name = "inetCidrRouteNumber"
+    oid = "IP-FORWARD-MIB::inetCidrRouteNumber.0"
+  #  Number of valid entries discarded
+  [[inputs.snmp.field]]
+    name = "inetCidrRouteDiscards"
+    oid = "IP-FORWARD-MIB::inetCidrRouteDiscards.0"
+  #  Number of valid forwarding entries
+  [[inputs.snmp.field]]
+    name = "ipForwardNumber"
+    oid = "IP-FORWARD-MIB::ipForwardNumber.0"
+
+  ##
+  ## IP routing statistics
+  ##
+  # Number of valid routes discarded
+  [[inputs.snmp.field]]
+    name = "ipRoutingDiscards"
+    oid = "RFC1213-MIB::ipRoutingDiscards.0"

templates/telegraf-docker.conf

@@ -0,0 +1,10 @@
+[[inputs.docker]]
+  endpoint = "unix:///var/run/docker.sock"
+  perdevice = false
+  total = true
+  container_name_include = []
+  container_name_exclude = []
+  # container_state_include = []
+  # container_state_exclude = []
+  docker_label_include = []
+  docker_label_exclude = []

templates/telegraf.conf

@@ -0,0 +1,77 @@
+[agent]
+  interval = "300s"
+  hostname = ""
+
+[[outputs.influxdb]]
+  urls = ["https://influx.jtbx.de:65086"]
+  database = "servers"
+  skip_database_creation = true
+
+  ## Name of existing retention policy to write to.
+  retention_policy = ""
+
+  ## Write timeout (for the InfluxDB client), formatted as a string.
+  timeout = "5s"
+  username = "servers"
+  password = "Servers-w.influx@home"
+
+
+# Read metrics about cpu usage
+[[inputs.cpu]]
+  percpu = false
+  totalcpu = true
+  collect_cpu_time = false  ## If true, collect raw CPU time metrics
+  report_active = true  ## If true, compute and report the sum of all non-idle CPU states.
+
+  fieldpass = ["usage_user", "usage_system", "usage_iowait", "usage_irq", "usage_active"]
+
+# Read metrics about memory usage
+[[inputs.mem]]
+  #fieldpass = ["total", "used_percent"]
+
+# Read metrics about disk usage by mount point
+[[inputs.disk]]
+  # By default, telegraf gather stats for all mountpoints.
+  mount_points = ["/"]
+  ignore_fs = ["tmpfs", "devtmpfs", "devfs", "overlay", "aufs", "squashfs"]
+  fieldpass = ["total", "free", "used_percent"]
+
+# Read metrics about disk IO by device
+[[inputs.diskio]]
+  ## By default, telegraf will gather stats for all devices including partitions.
+  ## Setting devices will restrict the stats to the specified devices.
+  devices = ["sd[a-d]", "mmcblk[0-1]", "ada[0-9]", "nvd[0-9]"]
+  ## Uncomment the following line if you need disk serial numbers.
+  # skip_serial_number = false
+  fieldpass = ["read_bytes", "write_bytes", "io_time", "weighted_io_time", "iops_in_progress"]
+
+# Read metrics about system load & uptime
+[[inputs.system]]
+  # default config, pass all fields
+
+# Get TCP connection state and UDP socket counts using lsof
+[[inputs.netstat]]
+  fieldpass = ["tcp_established", "tcp_listen", "udp_socket"]
+
+# Gather metrics about network interface and protocol usage (Linux only)
+[[inputs.net]]
+  interfaces = ["eth*", "enp0s[0-1]"]
+  ignore_protocol_stats = true
+  fieldpass = ["bytes_sent", "bytes_recv"]
+
+
+{% if telegraf_docker|default(false)|bool %}
+{% include telegraf_docker_file %}
+{% endif %}
+
+
+{% if telegraf_snmp|default(false)|bool %}
+{% include telegraf_snmp_file %}
+{% endif %}
+
+
+# # Monitor sensors, requires lm-sensors package
+# [[inputs.sensors]]
+#   ## Remove numbers from field names.
+#   ## If true, a field name like 'temp1_input' will be changed to 'temp_input'.
+#   # remove_numbers = true

templates/update-exim4.conf.conf

@@ -0,0 +1,31 @@
+# /etc/exim4/update-exim4.conf.conf
+#
+# Edit this file and /etc/mailname by hand and execute update-exim4.conf
+# yourself or use 'dpkg-reconfigure exim4-config'
+#
+# Please note that this is _not_ a dpkg-conffile and that automatic changes
+# to this file might happen. The code handling this will honor your local
+# changes, so this is usually fine, but will break local schemes that mess
+# around with multiple versions of the file.
+#
+# update-exim4.conf uses this file to determine variable values to generate
+# exim configuration macros for the configuration file.
+#
+# Most settings found in here do have corresponding questions in the
+# Debconf configuration, but not all of them.
+#
+# This is a Debian specific file
+
+dc_eximconfig_configtype='internet'
+dc_other_hostnames='{{ ansible_hostname }}, localhost.localdomain, localhost'
+dc_local_interfaces='127.0.0.1 ; ::1'
+dc_readhost=''
+dc_relay_domains=''
+dc_minimaldns='false'
+dc_relay_nets=''
+dc_smarthost=''
+CFILEMODE='644'
+dc_use_split_config='false'
+dc_hide_mailname=''
+dc_mailname_in_oh='true'
+dc_localdelivery='maildir_home'

vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for server