[GIT] refactor submodules: add all to own repo

This commit is contained in:
Jannik Beyerstedt 2019-10-06 22:55:56 +02:00
commit be2b9bf3c0
27 changed files with 3311 additions and 0 deletions

41
README.md Normal file
View file

@ -0,0 +1,41 @@
Server
=========
Essential server setup tasks, like sshd config, ddns cronjobs (+ mail output), etc.
Requirements
------------
none TODO!!
Role Variables
--------------
If borgbackup is used, the following variables need to be set for each host.
Multiple hosts using the same backup account is currently not supported by the borgbackup script.
- borgbackup_host
- borgbackup_sub
Dependencies
------------
none
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
GPLv3
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

5
defaults/main.yml Normal file
View file

@ -0,0 +1,5 @@
---
# defaults file for server
telegraf_docker_file: "telegraf-docker.conf"
telegraf_snmp_file: "telegraf-SNMP.conf"

44
files/caddy.service Normal file
View file

@ -0,0 +1,44 @@
[Unit]
Description=Caddy HTTP/2 web server
Documentation=https://caddyserver.com/docs
After=network-online.target
Wants=network-online.target
[Service]
Restart=on-abnormal
User=www-data
Group=www-data
Environment=CADDYPATH=/etc/ssl/caddy
PIDFile=/run/caddy.pid
ExecStart=/usr/local/bin/caddy -log stdout -agree -email=code@jannikbeyerstedt.de -conf=/etc/caddy/Caddyfile -root=/var/tmp
ExecReload=/bin/kill -USR1 $MAINPID
KillMode=mixed
KillSignal=SIGQUIT
TimeoutStopSec=5s
LimitNOFILE=8192
LimitNPROC=64
StartLimitInterval=600
;StartLimitBurst=5
RestartSec=60
PermissionsStartOnly=true
PrivateTmp=true
;PrivateDevices=true
;ProtectHome=true
;ProtectSystem=full
ReadWriteDirectories=/etc/ssl/caddy
; The following additional security directives only work with systemd v229 or later.
; They further restrict privileges that can be gained by caddy.
; Note that you may have to add capabilities required by any plugins in use.
;CapabilityBoundingSet=CAP_NET_BIND_SERVICE
;AmbientCapabilities=CAP_NET_BIND_SERVICE
;NoNewPrivileges=true
[Install]
WantedBy=multi-user.target

54
files/ddns-hosts.sh Normal file
View file

@ -0,0 +1,54 @@
#!/bin/sh
passwd='dyndnshosts'
hostname=$(hostname | tr '[:upper:]' '[:lower:]')
platform='unknown'
unamestr=$(uname)
if [ "$unamestr" = 'Linux' ]; then
platform='linux'
elif [ "$unamestr" = 'FreeBSD' ]; then
platform='freebsd'
fi
ip6addr=''
ip4addr=''
if [ $platform = 'linux' ]; then
ip6addr=$(ip -6 addr show scope global | grep inet6 | tail -1 | egrep -o '([0-9abcdef]{4}[0-9:abcdef]*)')
# filter local IPv4 address ranges (172.16.0.0/12, 10.0.0.0/8, 192.168.0.0/16)
ip4addr=$(ip -4 addr show scope global | grep inet | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | grep -Ev '172.(1[6-9]|2[0-9]|3[0-1])' | grep -Ev '10.' | grep -Ev '192.168.' | head -n 1)
elif [ $platform = 'freebsd' ]; then
ip6addr=$(ifconfig em0 | grep inet6 | tail -1 | egrep -o '([0-9abcdef]{4}[0-9:abcdef]*)')
ip4addr=$(ifconfig em0 inet | grep inet | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | head -n 1)
fi
echo "Current IP addresses of $hostname are: $ip4addr, $ip6addr"
if [ $ip4addr ]; then
echo "Updating IPv4 DNS entry..."
else
echo "No public IPv4 address, updating DNS entry anyway..."
fi
# API always returns 200, so check for response payload to begin with {"Success":true,
url="https://dyndns.jtbx.de/update?secret=$passwd&domain=$hostname&addr=$ip4addr"
statuscode=$(curl -s $url)
case "$statuscode" in
{\"Success\":true*) echo "IPv4 Success" ;;
*) (>&2 echo "IPv4 DynDNS update failed: API response:\n$statuscode") ;;
esac
if [ $ip6addr ]; then
echo "Updating IPv6 DNS entry..."
# API always returns 200, so check for response payload to begin with {"Success":true,
url="https://dyndns.jtbx.de/update?secret=$passwd&domain=$hostname&addr=$ip6addr"
statuscode=$(curl -s $url)
case "$statuscode" in
{\"Success\":true*) echo "IPv6 Success" ;;
*) (>&2 echo "IPv6 DynDNS update failed: API response:\n$statuscode") ;;
esac
else
echo "No public IPv6 Address, skipping DNS update."
fi

6
files/ddns-namecheap.sh Normal file
View file

@ -0,0 +1,6 @@
#!/bin/bash
passwd='dyndnshosts'
hostname=$(hostname | tr '[:upper:]' '[:lower:]')
domain=jtbx.space
/usr/bin/curl -4 -s "http://dynamicdns.park-your-domain.com/update?host=$hostname&domain=$domain&password=$passwd" > /dev/null

2107
files/exim4.conf.template Normal file

File diff suppressed because it is too large Load diff

70
files/sshd_config Normal file
View file

@ -0,0 +1,70 @@
# Standard sshd config of Jannik Beyerstedt
Protocol 2
#Port 4422
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
# Ciphers and keying
#RekeyLimit default none
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
# Logging
#SyslogFacility AUTH
LogLevel VERBOSE
# Authentication:
#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
MaxAuthTries 2
MaxSessions 2
IgnoreRhosts yes
# Password based logins are disabled - only public key based logins are allowed.
AuthenticationMethods publickey
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes
AllowAgentForwarding no
AllowTcpForwarding no
#GatewayPorts no
X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation sandbox
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
ClientAliveCountMax 2
UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
# override default of no subsystems
Subsystem sftp /usr/lib/openssh/sftp-server
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server

41
handlers/main.yml Normal file
View file

@ -0,0 +1,41 @@
---
# handlers file for server
- name: Restart sshd
service:
name: ssh
state: restarted
- name: Enable telegraf
service:
name: telegraf
enabled: yes
- name: Restart telegraf
service:
name: telegraf
state: restarted
- name: Enable and restart telegraf
service:
name: telegraf
state: restarted
enabled: yes
- name: Enable caddy
service:
name: caddy
enabled: yes
- name: Restart caddy
service:
name: caddy
state: restarted
- name: Enable and restart caddy
service:
name: caddy
state: restarted
enabled: yes

20
meta/main.yml Normal file
View file

@ -0,0 +1,20 @@
galaxy_info:
author: Jannik Beyerstedt
description: General server setup
# issue_tracker_url: http://example.com/issue/tracker
license: GPLv3
min_ansible_version: 2.4
platforms:
- name: Debian
versions:
- all
galaxy_tags: []
# List tags for your role here, one per line.
# Be sure to remove the '[]' above, if you add tags to this list.
dependencies: []
# List your role dependencies here, one per line.
# Be sure to remove the '[]' above, if you add tags to this list.

View file

@ -0,0 +1,35 @@
---
# Server/Borgbackup: Install and Setup Borgbackup Backup Crobjob - Debian Stretch Version
# Variables (must be set!):
# - borgbackup_host
# - borgbackup_sub
# For Debian Stretch, use a newer package version from backports
- name: borgbackup - Add debian repo key
become: yes
apt_key:
keyserver: pgpkeys.mit.edu
id: 8B48AD6246925553
state: present
when:
- ansible_distribution_release == 'stretch'
- name: borgbackup - Add stretch-backports
become: yes
apt_repository:
repo: deb http://ftp.debian.org/debian stretch-backports main
state: present
when:
- ansible_distribution_release == 'stretch'
- name: borgbackup - Install borgbackup from stretch-backports
become: yes
apt:
name: borgbackup
state: latest
default_release: stretch-backports
update_cache: yes
cache_valid_time: 3600
when:
- borgbackup_host is defined
- borgbackup_sub is defined
- ansible_distribution_release == 'stretch'

View file

@ -0,0 +1,19 @@
---
# Server/Borgbackup: Install and Setup Borgbackup Backup Crobjob - Default Debian Version
# Variables (must be set!):
# - borgbackup_host
# - borgbackup_sub
# For all other Debian versions, simply install borgbackup
- name: borgbackup - Install borgbackup
become: yes
apt:
name: borgbackup
state: latest
update_cache: yes
cache_valid_time: 3600
when:
- borgbackup_host is defined
- borgbackup_sub is defined
- ansible_distribution_release != 'stretch'

57
tasks/borgbackup.yml Normal file
View file

@ -0,0 +1,57 @@
---
# Server/Borgbackup: Install and Setup Borgbackup Backup Crobjob
# Variables (must be set!):
# - borgbackup_host
# - borgbackup_sub
- name: borgbackup - Install
include_tasks: "{{ item }}"
with_first_found:
- "borgbackup-{{ ansible_distribution }}.{{ ansible_distribution_release }}.yml"
- "borgbackup-{{ ansible_distribution }}.yml"
- "borgbackup-{{ ansible_os_family }}.yml"
# copy backup script and enable cronjob
- name: borgbackup - Copy Borgbackup script
become: yes
template:
src: "{{ role_path }}/templates/borgbackup.sh"
dest: /usr/local/bin/borgbackup.sh
owner: "{{ ansible_user_id }}"
group: "{{ ansible_user_id }}"
mode: 0775
when:
- borgbackup_host is defined
- borgbackup_sub is defined
- name: borgbackup - Run Borgbackup script at 1:00 daily
become: yes
cron:
name: "Create Backup"
minute: "0"
hour: "1"
job: "/usr/local/bin/borgbackup.sh"
when:
- borgbackup_host is defined
- borgbackup_sub is defined
# safeguard, if the host variables were removed
- name: borgbackup - Remove Borgbackup script if no borgbackup config
become: yes
file:
path: /usr/local/bin/borgbackup.sh
state: absent
when:
- borgbackup_host is not defined
- borgbackup_sub is not defined
- name: borgbackup - Remove Cronjob if no borgbackup config
become: yes
cron:
name: "Create Backup"
minute: "0"
hour: "1"
job: "/usr/local/bin/borgbackup.sh"
state: absent
when:
- borgbackup_host is not defined
- borgbackup_sub is not defined

43
tasks/caddy-install.yml Normal file
View file

@ -0,0 +1,43 @@
---
# Server/Caddyserver-Install: Install/Update Caddy Webserver (with some modules)
- name: caddyserver - Stop caddy
become: yes
service:
name: caddy
state: stopped
- name: caddyserver - Make temp download directory
file:
path: /tmp/caddy
state: directory
- name: caddyserver - Download caddy webserver
get_url:
url: https://caddyserver.com/download/linux/amd64?plugins=http.ratelimit&license=personal
dest: /tmp/caddy/caddy.tar.gz
- name: caddyserver - Extract caddy
shell: "cd /tmp/caddy && tar -xvf caddy.tar.gz"
# unarchive:
# src: /tmp/caddy/caddy.tar.gz
# dest: /tmp/caddy
# copy: no
- name: caddyserver - Copy caddy to a PATH location
become: yes
shell: "cp /tmp/caddy/caddy /usr/local/bin"
- name: caddyserver - Clean up download files
become: yes
file:
path: /tmp/caddy
state: absent
- name: caddyserver - Install caddy APT dependencies
become: yes
apt:
name: libcap2-bin
state: latest
- name: caddyserver - Give caddy port binding capabilities
become: yes
shell: "setcap cap_net_bind_service=+ep /usr/local/bin/caddy"
# capabilities:
# path: "{{ caddy_bin }}"
# capability: cap_net_bind_service+ep
# state: present

46
tasks/caddy-setup.yml Normal file
View file

@ -0,0 +1,46 @@
---
# Server/Caddyserver-Setup: Setup Caddy Webserver (user, directories, etc)
- name: caddyserver - Add www-data system user
become: yes
user:
name: www-data
create_home: no
system: yes
shell: /bin/false
state: present
- name: caddyserver - Add Caddy directories
become: yes
file:
path: "{{ item }}"
state: directory
owner: www-data
group: www-data
mode: 0770
with_items:
- /etc/ssl/caddy
- /etc/caddy
- name: caddyserver - Add Caddy home directory
become: yes
file:
path: /var/www
state: directory
owner: www-data
group: www-data
mode: 0555
- name: caddyserver - Copy Caddy systemd service file
become: yes
copy:
src: "{{ role_path }}/files/caddy.service"
dest: /etc/systemd/system/caddy.service
owner: root
group: root
mode: 0644
- name: caddyserver - Add standard user to www-data group
become: yes
user:
name: "{{ ansible_user_id }}"
groups: www-data
append: yes

9
tasks/caddyserver.yml Normal file
View file

@ -0,0 +1,9 @@
---
# Server/Caddyserver: Install Caddy Webserver (with some modules)
# ATTENTION: No Caddyfile is created yet and caddy is not enabled or started!
- name: caddyserver - Install caddy server
include_tasks: "caddy-install.yml"
- name: caddyserver - Setup caddy server
include_tasks: "caddy-setup.yml"

49
tasks/cronmails.yml Normal file
View file

@ -0,0 +1,49 @@
---
# Server/Cronmails: Setup Mails from Cronjobs (install exim)
# Install and configure exim
- name: cronmails - Install exim4 as MTA
become: yes
apt:
name: "{{ packages }}"
state: latest
vars:
packages:
- exim4
- mailutils
- name: cronmails - Create exim4 config folder
become: yes
file: path=/etc/exim4 state=directory
- name: cronmails - Copy exim4 config template
become: yes
copy:
src: "{{ role_path }}/files/exim4.conf.template"
dest: /etc/exim4/exim4.conf.template
- name: cronmails - Copy exim4 config file
become: yes
template:
src: "{{ role_path }}/templates/update-exim4.conf.conf"
dest: /etc/exim4/update-exim4.conf.conf
- name: cronmails - Run update-exim4.conf
become: yes
shell: "update-exim4.conf"
- name: cronmails - Enable and start exim4
become: yes
service:
name: exim4
state: started
enabled: yes
# Set crobjob env variables/ settings
- name: cronmails - Crontab set path
become: yes
cron:
name: PATH
env: yes
value: /bin:/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin
- name: cronmails - Crontab set mailto
become: yes
cron:
name: MAILTO
env: yes
value: "device-{{ ansible_hostname }}@jtbx.de"

54
tasks/docker.yml Normal file
View file

@ -0,0 +1,54 @@
---
# Server/Docker: Install Docker and Docker-Compose
# Install docker CE
- name: docker - Install docker CE APT dependencies
become: yes
apt:
name: "{{ packages }}"
state: latest
vars:
packages:
- apt-transport-https
- ca-certificates
- curl
- gnupg2
- software-properties-common
- name: docker - Add docker CE repo key
become: yes
apt_key:
url: https://download.docker.com/linux/debian/gpg
state: present
- name: docker - Add docker CE add repo
become: yes
apt_repository:
repo: deb [arch=amd64] https://download.docker.com/linux/debian stretch stable
state: present
- name: docker - Install docker CE
become: yes
apt:
name: docker-ce
state: latest
update_cache: yes
cache_valid_time: 3600
# Install docker-compose (TODO: do not use a static docker-compose version)
- name: docker - Install docker-compose
become: yes
get_url:
url: https://github.com/docker/compose/releases/download/1.23.2/docker-compose-Linux-x86_64
dest: /usr/local/bin/docker-compose
- name: docker - Make docker-compose executable
become: yes
file:
path: /usr/local/bin/docker-compose
mode: 0755
# Other setup tasks
- name: docker - Add standard user to docker group
become: yes
user:
name: "{{ ansible_user_id }}"
groups: docker
append: yes

24
tasks/dyndns.yml Normal file
View file

@ -0,0 +1,24 @@
---
# Server/Dyndns: Setup dynDNS Script
- name: dyndns - Install needed tools
become: yes
package:
name: curl
state: present
- name: dyndns - Copy hosts.jtbx.de dynDNS script
become: yes
copy:
src: "{{ role_path }}/files/ddns-hosts.sh"
dest: /usr/local/bin/ddns-hosts.sh
owner: "{{ ansible_user_id }}"
group: "{{ ansible_user_id }}"
mode: 0775
- name: dyndns - Create cronjob for hosts.jtbx.de dynDNS script
become: yes
cron:
name: "hosts.jtbx.de dynDNS"
minute: "*/5"
hour: "*"
job: "/usr/local/bin/ddns-hosts.sh > /dev/null"

2
tasks/main.yml Normal file
View file

@ -0,0 +1,2 @@
---
# tasks file for server

12
tasks/setup.yml Normal file
View file

@ -0,0 +1,12 @@
---
# Server/Setup: Generic Setup Tasks (sshd)
# SSH
- name: setup - Copy sshd_config
become: yes
copy:
src: "{{ role_path }}/files/sshd_config"
dest: "/etc/ssh/sshd_config"
backup: yes
notify:
- Restart sshd

36
tasks/telegraf.yml Normal file
View file

@ -0,0 +1,36 @@
---
# Server/Telegraf: Install and Setup Telegraf Monitoring
# Variables:
# - telegraf_snmp: boolean, enable SNMP monitoring
# - telegraf_docker: boolean, enable docker monitoring
- name: telegraf - Install apt-transport-https
become: yes
apt:
name: apt-transport-https
state: latest
- name: telegraf - Add telegraf repo key
become: yes
apt_key:
url: https://repos.influxdata.com/influxdb.key
state: present
- name: telegraf - Add Telegraf repo
become: yes
apt_repository:
repo: deb https://repos.influxdata.com/debian stretch stable
state: present
- name: telegraf - Install telegraf
become: yes
apt:
name: telegraf
state: latest
update_cache: yes
cache_valid_time: 3600
- name: telegraf - Copy telegraf config
become: yes
template:
src: "{{ role_path }}/templates/telegraf.conf"
dest: /etc/telegraf/telegraf.conf
notify:
- Enable and restart telegraf

67
templates/borgbackup.sh Normal file
View file

@ -0,0 +1,67 @@
#!/bin/sh
# pass an arbitrary number of additional arguments to borg create by using
# borgbackup.sh $option1 $option2 ... $optionN
# pass -v --stats to show more information
# pass --list --filter AME to show all fiels Added Modified or with Error
#export BORG_RSH='ssh -i /home/jannik/.ssh/id_rsa'
export BORG_RSH='ssh -i /home/jannik/.ssh/id_ed25519'
export BORG_PASSPHRASE='borgbackup.{{ borgbackup_host }}@hetznerbx'
export BORG_REPO='ssh://u182062-sub{{ borgbackup_sub }}@u182062.your-storagebox.de:23/./borg'
# some helpers and error handling:
info() { printf "\n%s %s\n\n" "$( date )" "$*" >&2; }
trap 'echo $( date ) Backup interrupted >&2; exit 2' INT TERM
# Backup the most important directories
borg create \
$@ \
--compression lz4 \
--exclude-caches \
--exclude '/home/*/.cache/*' \
--exclude '/var/run' \
--exclude '/var/cache/*' \
--exclude '/var/tmp/*' \
--exclude '/var/lib/apt/*' \
--exclude '/var/lib/dpkg/*' \
--exclude '/var/lib/yum/*' \
--exclude '/var/lib/docker/overlay2' \
--exclude '/var/lib/docker/containers' \
--exclude '/var/lib/docker/image' \
--exclude '/var/lib/docker/tmp' \
--exclude '/var/lib/lxcfs' \
--exclude '/var/log/*' \
\
$BORG_REPO::'{{ borgbackup_host }}-{now:%Y%m%d_%H%M}' \
/etc \
/var \
/root \
/home \
backup_exit=$?
# Prune old backups: keep 7 daily, 4 weekly and 3 monthly
borg prune \
--prefix '{{ borgbackup_host }}-' \
--keep-daily 7 \
--keep-weekly 4 \
--keep-monthly 3
prune_exit=$?
# use highest exit code as global exit code
global_exit=$(( backup_exit > prune_exit ? backup_exit : prune_exit ))
if [ ${global_exit} -eq 1 ];
then
info "Backup and/or Prune finished with a warning"
fi
if [ ${global_exit} -gt 1 ];
then
info "Backup and/or Prune finished with an error"
fi
exit ${global_exit}

View file

@ -0,0 +1,350 @@
##
## SNMP Input For Unifi APs (Gen 2/Gen 3)
##
[[inputs.snmp]]
agents = [ "192.168.4.11", "192.168.4.12", "192.168.8.13" ]
interval = "5m"
timeout = "10s"
retries = 3
# SNMP version, UAP only supports v1
version = 2
community = "public"
max_repetitions = 10
name = "snmp.UAP"
##
## System Details
##
# System name (hostname)
[[inputs.snmp.field]]
is_tag = true
name = "sysName"
oid = "RFC1213-MIB::sysName.0"
# System vendor OID
[[inputs.snmp.field]]
name = "sysObjectID"
oid = "RFC1213-MIB::sysObjectID.0"
# System description
[[inputs.snmp.field]]
name = "sysDescr"
oid = "RFC1213-MIB::sysDescr.0"
# UAP model
[[inputs.snmp.field]]
name = "unifiApSystemModel"
oid = "UBNT-UniFi-MIB::unifiApSystemModel"
# System uptime
[[inputs.snmp.field]]
name = "sysUpTime"
oid = "RFC1213-MIB::sysUpTime.0"
##
## Host Resources
##
# Total memory
#[[inputs.snmp.field]]
# name = "memTotal"
# oid = "FROGFOOT-RESOURCES-MIB::memTotal.0"
# Free memory
#[[inputs.snmp.field]]
# name = "memFree"
# oid = "FROGFOOT-RESOURCES-MIB::memFree.0"
# Buffer memory
#[[inputs.snmp.field]]
# name = "memBuffer"
# oid = "FROGFOOT-RESOURCES-MIB::memBuffer.0"
# Cache memory
#[[inputs.snmp.field]]
# name = "memCache"
# oid = "FROGFOOT-RESOURCES-MIB::memCache.0"
##
## Interface Details & Metrics
##
# Wireless interfaces
[[inputs.snmp.table]]
oid = "UBNT-UniFi-MIB::unifiRadioTable"
[[inputs.snmp.table.field]]
is_tag = true
oid = "UBNT-UniFi-MIB::unifiRadioName"
[[inputs.snmp.table.field]]
is_tag = true
oid = "UBNT-UniFi-MIB::unifiRadioRadio"
# BSS instances
[[inputs.snmp.table]]
oid = "UBNT-UniFi-MIB::unifiVapTable"
[[inputs.snmp.table.field]]
is_tag = true
oid = "UBNT-UniFi-MIB::unifiVapName"
[[inputs.snmp.table.field]]
is_tag = true
oid = "UBNT-UniFi-MIB::unifiVapRadio"
# Ethernet interfaces
[[inputs.snmp.table]]
oid = "UBNT-UniFi-MIB::unifiIfTable"
[[inputs.snmp.table.field]]
is_tag = true
oid = "UBNT-UniFi-MIB::unifiIfName"
##
## System Performance
##
# System load averages
#[[inputs.snmp.table]]
# oid = "FROGFOOT-RESOURCES-MIB::loadTable"
# [[inputs.snmp.table.field]]
# is_tag = true
# oid = "FROGFOOT-RESOURCES-MIB::loadDescr"
##
## SNMP Input For EdgeRouter/ Unifi USG
##
[[inputs.snmp]]
agents = [ "192.168.2.1" ]
interval = "5m"
timeout = "5s"
retries = 3
# SNMP version, values can be 1, 2, or 3
version = 2
community = "public"
max_repetitions = 10
name = "snmp.EdgeOS"
##
## Exclusions
##
# Don't want these columns from UCD-SNMP-MIB::laTable
fielddrop = [ "laErrorFlag", "laErrMessage" ]
# Don't want these rows from UCD-DISKIO-MIB::diskIOTable
[inputs.snmp.tagdrop]
diskIODevice = [ "loop*", "ram*" ]
##
## System details
##
# System name (hostname)
[[inputs.snmp.field]]
name = "sysName"
oid = "SNMPv2-MIB::sysName.0"
is_tag = true
# System vendor OID
[[inputs.snmp.field]]
name = "sysObjectID"
oid = "SNMPv2-MIB::sysObjectID.0"
# System description
[[inputs.snmp.field]]
name = "sysDescr"
oid = "SNMPv2-MIB::sysDescr.0"
# System uptime
[[inputs.snmp.field]]
name = "sysUpTime"
oid = "HOST-RESOURCES-MIB::hrSystemUptime.0"
# Device Listing
[[inputs.snmp.table]]
oid = "HOST-RESOURCES-MIB::hrDeviceTable"
[[inputs.snmp.table.field]]
oid = "HOST-RESOURCES-MIB::hrDeviceIndex"
is_tag = true
##
## Host performance metrics
##
# System Load Average
[[inputs.snmp.table]]
oid = "UCD-SNMP-MIB::laTable"
[[inputs.snmp.table.field]]
oid = "UCD-SNMP-MIB::laNames"
is_tag = true
##
## CPU utilization
##
# Number of 'ticks' spent on user-level
[[inputs.snmp.field]]
name = "ssCpuRawUser"
oid = "UCD-SNMP-MIB::ssCpuRawUser.0"
# Number of 'ticks' spent on reduced-priority
[[inputs.snmp.field]]
name = "ssCpuRawNice"
oid = "UCD-SNMP-MIB::ssCpuRawNice.0"
# Number of 'ticks' spent on system-level
[[inputs.snmp.field]]
name = "ssCpuRawSystem"
oid = "UCD-SNMP-MIB::ssCpuRawSystem.0"
# Number of 'ticks' spent idle
[[inputs.snmp.field]]
name = "ssCpuRawIdle"
oid = "UCD-SNMP-MIB::ssCpuRawIdle.0"
# Number of 'ticks' spent waiting on I/O
[[inputs.snmp.field]]
name = "ssCpuRawWait"
oid = "UCD-SNMP-MIB::ssCpuRawWait.0"
# Number of 'ticks' spent in kernel
[[inputs.snmp.field]]
name = "ssCpuRawKernel"
oid = "UCD-SNMP-MIB::ssCpuRawKernel.0"
# Number of 'ticks' spent on hardware interrupts
[[inputs.snmp.field]]
name = "ssCpuRawInterrupt"
oid = "UCD-SNMP-MIB::ssCpuRawInterrupt.0"
# Number of 'ticks' spent on software interrupts
[[inputs.snmp.field]]
name = "ssCpuRawSoftIRQ"
oid = "UCD-SNMP-MIB::ssCpuRawSoftIRQ.0"
##
## System Memory (physical/virtual)
##
# Size of phsyical memory (RAM)
[[inputs.snmp.field]]
name = "hrMemorySize"
oid = "HOST-RESOURCES-MIB::hrMemorySize.0"
# Size of real/phys mem installed
[[inputs.snmp.field]]
name = "memTotalReal"
oid = "UCD-SNMP-MIB::memTotalReal.0"
# Size of real/phys mem unused/avail
[[inputs.snmp.field]]
name = "memAvailReal"
oid = "UCD-SNMP-MIB::memAvailReal.0"
# Total amount of mem unused/avail
[[inputs.snmp.field]]
name = "memTotalFree"
oid = "UCD-SNMP-MIB::memTotalFree.0"
# Size of mem used as shared memory
[[inputs.snmp.field]]
name = "memShared"
oid = "UCD-SNMP-MIB::memShared.0"
# Size of mem used for buffers
[[inputs.snmp.field]]
name = "memBuffer"
oid = "UCD-SNMP-MIB::memBuffer.0"
# Size of mem used for cache
[[inputs.snmp.field]]
name = "memCached"
oid = "UCD-SNMP-MIB::memCached.0"
##
## Interface metrics
##
# Per-interface traffic, errors, drops
[[inputs.snmp.table]]
oid = "IF-MIB::ifTable"
[[inputs.snmp.table.field]]
oid = "IF-MIB::ifName"
is_tag = true
# Per-interface high-capacity (HC) counters
[[inputs.snmp.table]]
oid = "IF-MIB::ifXTable"
[[inputs.snmp.table.field]]
oid = "IF-MIB::ifName"
is_tag = true
##
## IP metrics
##
# System-wide IP metrics
[[inputs.snmp.table]]
index_as_tag = true
oid = "IP-MIB::ipSystemStatsTable"
##
## ICMP Metrics
##
# ICMP statistics
[[inputs.snmp.table]]
index_as_tag = true
oid = "IP-MIB::icmpStatsTable"
# ICMP per-type statistics
[[inputs.snmp.table]]
index_as_tag = true
oid = "IP-MIB::icmpMsgStatsTable"
##
## UDP statistics
##
# Datagrams delivered to app
[[inputs.snmp.field]]
name = "udpInDatagrams"
oid = "UDP-MIB::udpInDatagrams.0"
# Datagrams received with no app
[[inputs.snmp.field]]
name = "udpNoPorts"
oid = "UDP-MIB::udpNoPorts.0"
# Datagrams received with error
[[inputs.snmp.field]]
name = "udpInErrors"
oid = "UDP-MIB::udpInErrors.0"
# Datagrams sent
[[inputs.snmp.field]]
name = "udpOutDatagrams"
oid = "UDP-MIB::udpOutDatagrams.0"
##
## TCP statistics
##
# Number of CLOSED -> SYN-SENT transitions
[[inputs.snmp.field]]
name = "tcpActiveOpens"
oid = "TCP-MIB::tcpActiveOpens.0"
# Number of SYN-RCVD -> LISTEN transitions
[[inputs.snmp.field]]
name = "tcpPassiveOpens"
oid = "TCP-MIB::tcpPassiveOpens.0"
# Number of SYN-SENT/RCVD -> CLOSED transitions
[[inputs.snmp.field]]
name = "tcpAttemptFails"
oid = "TCP-MIB::tcpAttemptFails.0"
# Number of ESTABLISHED/CLOSE-WAIT -> CLOSED transitions
[[inputs.snmp.field]]
name = "tcpEstabResets"
oid = "TCP-MIB::tcpEstabResets.0"
# Number of ESTABLISHED or CLOSE-WAIT
[[inputs.snmp.field]]
name = "tcpCurrEstab"
oid = "TCP-MIB::tcpCurrEstab.0"
# Number of segments received
[[inputs.snmp.field]]
name = "tcpInSegs"
oid = "TCP-MIB::tcpInSegs.0"
# Number of segments sent
[[inputs.snmp.field]]
name = "tcpOutSegs"
oid = "TCP-MIB::tcpOutSegs.0"
# Number of segments retransmitted
[[inputs.snmp.field]]
name = "tcpRetransSegs"
oid = "TCP-MIB::tcpRetransSegs.0"
# Number of segments received with error
[[inputs.snmp.field]]
name = "tcpInErrs"
oid = "TCP-MIB::tcpInErrs.0"
# Number of segments sent w/RST
[[inputs.snmp.field]]
name = "tcpOutRsts"
oid = "TCP-MIB::tcpOutRsts.0"
##
## IP routing statistics
##
# Number of valid routing entries
[[inputs.snmp.field]]
name = "inetCidrRouteNumber"
oid = "IP-FORWARD-MIB::inetCidrRouteNumber.0"
# Number of valid entries discarded
[[inputs.snmp.field]]
name = "inetCidrRouteDiscards"
oid = "IP-FORWARD-MIB::inetCidrRouteDiscards.0"
# Number of valid forwarding entries
[[inputs.snmp.field]]
name = "ipForwardNumber"
oid = "IP-FORWARD-MIB::ipForwardNumber.0"
##
## IP routing statistics
##
# Number of valid routes discarded
[[inputs.snmp.field]]
name = "ipRoutingDiscards"
oid = "RFC1213-MIB::ipRoutingDiscards.0"

View file

@ -0,0 +1,10 @@
[[inputs.docker]]
endpoint = "unix:///var/run/docker.sock"
perdevice = false
total = true
container_name_include = []
container_name_exclude = []
# container_state_include = []
# container_state_exclude = []
docker_label_include = []
docker_label_exclude = []

77
templates/telegraf.conf Normal file
View file

@ -0,0 +1,77 @@
[agent]
interval = "300s"
hostname = ""
[[outputs.influxdb]]
urls = ["https://influx.jtbx.de:65086"]
database = "servers"
skip_database_creation = true
## Name of existing retention policy to write to.
retention_policy = ""
## Write timeout (for the InfluxDB client), formatted as a string.
timeout = "5s"
username = "servers"
password = "Servers-w.influx@home"
# Read metrics about cpu usage
[[inputs.cpu]]
percpu = false
totalcpu = true
collect_cpu_time = false ## If true, collect raw CPU time metrics
report_active = true ## If true, compute and report the sum of all non-idle CPU states.
fieldpass = ["usage_user", "usage_system", "usage_iowait", "usage_irq", "usage_active"]
# Read metrics about memory usage
[[inputs.mem]]
#fieldpass = ["total", "used_percent"]
# Read metrics about disk usage by mount point
[[inputs.disk]]
# By default, telegraf gather stats for all mountpoints.
mount_points = ["/"]
ignore_fs = ["tmpfs", "devtmpfs", "devfs", "overlay", "aufs", "squashfs"]
fieldpass = ["total", "free", "used_percent"]
# Read metrics about disk IO by device
[[inputs.diskio]]
## By default, telegraf will gather stats for all devices including partitions.
## Setting devices will restrict the stats to the specified devices.
devices = ["sd[a-d]", "mmcblk[0-1]", "ada[0-9]", "nvd[0-9]"]
## Uncomment the following line if you need disk serial numbers.
# skip_serial_number = false
fieldpass = ["read_bytes", "write_bytes", "io_time", "weighted_io_time", "iops_in_progress"]
# Read metrics about system load & uptime
[[inputs.system]]
# default config, pass all fields
# Get TCP connection state and UDP socket counts using lsof
[[inputs.netstat]]
fieldpass = ["tcp_established", "tcp_listen", "udp_socket"]
# Gather metrics about network interface and protocol usage (Linux only)
[[inputs.net]]
interfaces = ["eth*", "enp0s[0-1]"]
ignore_protocol_stats = true
fieldpass = ["bytes_sent", "bytes_recv"]
{% if telegraf_docker|default(false)|bool %}
{% include telegraf_docker_file %}
{% endif %}
{% if telegraf_snmp|default(false)|bool %}
{% include telegraf_snmp_file %}
{% endif %}
# # Monitor sensors, requires lm-sensors package
# [[inputs.sensors]]
# ## Remove numbers from field names.
# ## If true, a field name like 'temp1_input' will be changed to 'temp_input'.
# # remove_numbers = true

View file

@ -0,0 +1,31 @@
# /etc/exim4/update-exim4.conf.conf
#
# Edit this file and /etc/mailname by hand and execute update-exim4.conf
# yourself or use 'dpkg-reconfigure exim4-config'
#
# Please note that this is _not_ a dpkg-conffile and that automatic changes
# to this file might happen. The code handling this will honor your local
# changes, so this is usually fine, but will break local schemes that mess
# around with multiple versions of the file.
#
# update-exim4.conf uses this file to determine variable values to generate
# exim configuration macros for the configuration file.
#
# Most settings found in here do have corresponding questions in the
# Debconf configuration, but not all of them.
#
# This is a Debian specific file
dc_eximconfig_configtype='internet'
dc_other_hostnames='{{ ansible_hostname }}, localhost.localdomain, localhost'
dc_local_interfaces='127.0.0.1 ; ::1'
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost=''
CFILEMODE='644'
dc_use_split_config='false'
dc_hide_mailname=''
dc_mailname_in_oh='true'
dc_localdelivery='maildir_home'

2
vars/main.yml Normal file
View file

@ -0,0 +1,2 @@
---
# vars file for server