Skip to content

Commit fef4977

Browse files
instantlinuxinstantlinux
committed
SYS-678 ansible recovery logic; adjust splunk and snappymail charts
1 parent 3b07552 commit fef4977

9 files changed

Lines changed: 171 additions & 166 deletions

File tree

‎ansible/roles/docker_node/tasks/docker.yml‎

Lines changed: 53 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -69,56 +69,59 @@
6969
state: link
7070
changed_when: False
7171

72-
- name: Reload systemd
73-
ansible.builtin.systemd:
74-
daemon_reload: yes
75-
changed_when: False
76-
77-
- name: Docker engine package
78-
ansible.builtin.apt:
79-
name: "{{ docker.apt_repo.package_name }}={{ docker.apt_repo.package_ver }}"
80-
update_cache: yes
81-
82-
- name: Options directory
83-
ansible.builtin.file:
84-
dest: /etc/docker
85-
state: directory
86-
87-
- name: Docker options
88-
ansible.builtin.copy:
89-
content: "{{ docker.options|to_nice_json }}"
90-
dest: /etc/docker/daemon.json
91-
notify: Restart docker
92-
93-
- name: Systemd override path for docker.service
94-
ansible.builtin.file:
95-
dest: /lib/systemd/system/docker.service.d
96-
state: directory
97-
98-
- name: Deal with conflicting systemd-unit option, await vol mount
99-
ansible.builtin.template:
100-
dest: /lib/systemd/system/docker.service.d/docker.service.conf
101-
src: docker.service.conf.j2
102-
notify: Reload systemd
103-
104-
- name: Systemd unit file for enabling /var/lib/docker/volumes monitoring
105-
ansible.builtin.copy:
106-
dest: /etc/systemd/system/docker-permissions.service
107-
src: docker-permissions.service
108-
109-
# TODO parse fstab seeking last luks line
110-
111-
- name: Reenable systemctl start
112-
ansible.builtin.file:
113-
path: /usr/sbin/policy-rc.d
114-
state: absent
115-
changed_when: False
116-
117-
- name: Unmask docker.service
118-
ansible.builtin.file:
119-
dest: /etc/systemd/system/docker.service
120-
state: absent
121-
changed_when: False
72+
- name: Configure docker service
73+
block:
74+
- name: Reload systemd
75+
ansible.builtin.systemd:
76+
daemon_reload: yes
77+
changed_when: False
78+
79+
- name: Docker engine package
80+
ansible.builtin.apt:
81+
name: "{{ docker.apt_repo.package_name }}={{ docker.apt_repo.package_ver }}"
82+
update_cache: yes
83+
84+
- name: Options directory
85+
ansible.builtin.file:
86+
dest: /etc/docker
87+
state: directory
88+
89+
- name: Docker options
90+
ansible.builtin.copy:
91+
content: "{{ docker.options|to_nice_json }}"
92+
dest: /etc/docker/daemon.json
93+
notify: Restart docker
94+
95+
- name: Systemd override path for docker.service
96+
ansible.builtin.file:
97+
dest: /lib/systemd/system/docker.service.d
98+
state: directory
99+
100+
- name: Deal with conflicting systemd-unit option, await vol mount
101+
ansible.builtin.template:
102+
dest: /lib/systemd/system/docker.service.d/docker.service.conf
103+
src: docker.service.conf.j2
104+
notify: Reload systemd
105+
106+
- name: Systemd unit file for enabling /var/lib/docker/volumes monitoring
107+
ansible.builtin.copy:
108+
dest: /etc/systemd/system/docker-permissions.service
109+
src: docker-permissions.service
110+
111+
# TODO parse fstab seeking last luks line
112+
113+
always:
114+
- name: Reenable systemctl start
115+
ansible.builtin.file:
116+
path: /usr/sbin/policy-rc.d
117+
state: absent
118+
changed_when: False
119+
120+
- name: Unmask docker.service
121+
ansible.builtin.file:
122+
dest: /etc/systemd/system/docker.service
123+
state: absent
124+
changed_when: False
122125

123126
- name: Suppress annoying error on subcontainer 'ia_addr' logs
124127
ansible.builtin.replace:

‎ansible/roles/fileserver/defaults/main.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
---
2+
instantlinux_legacy:
3+
enabled: false
4+
25
nfs_exports:
36
/var/ftp: "*(ro,root_squash,crossmnt,fsid=0,no_subtree_check)"
47

‎ansible/roles/fileserver/tasks/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
when: nfs_exports | length == 0
3333

3434
- import_tasks: instantlinux.yml
35+
when: instantlinux_legacy.enabled
3536

3637
- import_tasks: samba.yml
3738
when: samba.enabled

‎ansible/roles/network/handlers/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@
1010

1111
- name: Restart sshd
1212
service:
13-
name: sshd
13+
name: ssh
1414
state: restarted

‎ansible/roles/network/tasks/sshd.yml‎

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,12 @@
11
---
22
# Tighten security in sshd: lock out brute-force scanners seeking weak ciphers
33

4-
- name: Set ciphers in sshd_config
5-
lineinfile:
6-
dest: /etc/ssh/sshd_config
7-
regexp: "(?i)^Ciphers .*"
8-
line: Ciphers {{ sshd_opts.ciphers|join(',') }}
9-
notify: Restart sshd
10-
11-
- name: Set macs in sshd_config
12-
lineinfile:
13-
dest: /etc/ssh/sshd_config
14-
regexp: "(?i)^MACs .*"
15-
line: MACs {{ sshd_opts.macs|join(',') }}
16-
notify: Restart sshd
17-
18-
- name: Set kexalgorithms in sshd_config
19-
lineinfile:
20-
dest: /etc/ssh/sshd_config
21-
regexp: "(?i)^KexAlgorithms .*"
22-
line: KexAlgorithms {{ sshd_opts.kexalgorithms|join(',') }}
4+
- name: Lock out brute-force scanners
5+
ansible.builtin.copy:
6+
content: |
7+
# ansible managed
8+
Ciphers {{ sshd_opts.ciphers|join(',') }}
9+
MACs {{ sshd_opts.macs|join(',') }}
10+
KexAlgorithms {{ sshd_opts.kexalgorithms|join(',') }}
11+
dest: /etc/ssh/sshd_config.d/10_ciphers.conf
2312
notify: Restart sshd

‎ansible/roles/volumes/tasks/encrypted.yml‎

Lines changed: 94 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -34,94 +34,97 @@
3434
state: mounted
3535
changed_when: False
3636

37-
- name: LUKS format volumes
38-
shell: >
39-
cryptsetup isLuks /dev/{{ item.value.vg }}/{{ item.key }} ||
40-
cryptsetup luksFormat --batch-mode --verbose --key-file={{
41-
masterkey.path }}/keys/{{ ansible_hostname }}/{{
42-
item.key }} /dev/{{ item.value.vg }}/{{ item.key }}
43-
register: luks_format
44-
changed_when: ("Command successful" in luks_format.stdout)
45-
with_dict: "{{ luks_volumes }}"
46-
47-
# Encountered bug in ansible crypttab module, lineinfile is good enough
48-
- name: Create crypttab
49-
copy:
50-
content: ""
51-
dest: /etc/crypttab.setup
52-
mode: 0644
53-
force: no
54-
55-
- name: Crypt table entries
56-
lineinfile:
57-
line: "{{ 'luks-%-16s /dev/mapper/%s-%-16s %s/keys/%s/%-12s luks' % (
58-
item.key, item.value.vg, item.key, masterkey.path, ansible_hostname,
59-
item.key) }}"
60-
path: /etc/crypttab.setup
61-
regexp: "^luks-{{ item.key }}.*"
62-
with_dict: "{{ luks_volumes }}"
63-
64-
# For unattended boot, we have a custom startup script, so we don't
65-
# leave /etc/crypttab in place (Ubuntu systemd will otherwise
66-
# insist on entering passphrase at reboot)
67-
68-
- name: Temporary crypttab symlink
69-
file:
70-
path: /etc/crypttab
71-
src: crypttab.setup
72-
state: link
73-
force: True
74-
changed_when: False
75-
76-
- name: LUKS start volumes
77-
command: cryptdisks_start luks-{{ item.key }}
78-
register: luks_start
79-
changed_when: ("(started)" in luks_start.stdout)
80-
with_dict: "{{ luks_volumes }}"
81-
82-
- name: Create filesystem
83-
filesystem:
84-
dev: /dev/mapper/luks-{{ item.key }}
85-
fstype: "{{ item.value.type if 'type' in item.value else fs_type }}"
86-
opts: "{{ '-N %s000' % item.value.inodes if 'inodes' in item.value
87-
else '' }} -m 0"
88-
with_dict: "{{ luks_volumes }}"
89-
90-
- name: Remove temporary crypttab symlink
91-
file:
92-
path: /etc/crypttab
93-
state: absent
94-
changed_when: False
95-
96-
- name: crypt-setup boot script
97-
template:
98-
src: crypt-activate.sh.j2
99-
dest: /etc/crypt-activate.sh
100-
mode: 0755
101-
102-
- name: Systemd unit file for crypt-vols
103-
copy:
104-
dest: /etc/systemd/system/crypt-vols.service
105-
src: crypt-vols.service
106-
107-
- name: Add fstab entries
108-
mount:
109-
fstype: "{{ item.value.type if 'type' in item.value else fs_type }}"
110-
path: "{{ item.value.path }}"
111-
src: "/dev/mapper/luks-{{ item.key }}"
112-
opts: "{{ item.value.options if 'options' in item.value else '_netdev,noauto' }}"
113-
state: present
114-
with_dict: "{{ luks_volumes }}"
115-
116-
- name: Enable crypt-vols
117-
systemd:
118-
name: crypt-vols
119-
enabled: yes
120-
state: restarted
121-
changed_when: False
122-
123-
- name: Unmount master key
124-
mount:
125-
path: "{{ masterkey.path }}"
126-
state: unmounted
127-
changed_when: False
37+
- name: Encrypted volume preparation
38+
block:
39+
- name: LUKS format volumes
40+
shell: >
41+
cryptsetup isLuks /dev/{{ item.value.vg }}/{{ item.key }} ||
42+
cryptsetup luksFormat --batch-mode --verbose --key-file={{
43+
masterkey.path }}/keys/{{ ansible_hostname }}/{{
44+
item.key }} /dev/{{ item.value.vg }}/{{ item.key }}
45+
register: luks_format
46+
changed_when: ("Command successful" in luks_format.stdout)
47+
with_dict: "{{ luks_volumes }}"
48+
49+
# Encountered bug in ansible crypttab module, lineinfile is good enough
50+
- name: Create crypttab
51+
copy:
52+
content: ""
53+
dest: /etc/crypttab.setup
54+
mode: 0644
55+
force: no
56+
57+
- name: Crypt table entries
58+
lineinfile:
59+
line: "{{ 'luks-%-16s /dev/mapper/%s-%-16s %s/keys/%s/%-12s luks' % (
60+
item.key, item.value.vg, item.key, masterkey.path, ansible_hostname,
61+
item.key) }}"
62+
path: /etc/crypttab.setup
63+
regexp: "^luks-{{ item.key }}.*"
64+
with_dict: "{{ luks_volumes }}"
65+
66+
# For unattended boot, we have a custom startup script, so we don't
67+
# leave /etc/crypttab in place (Ubuntu systemd will otherwise
68+
# insist on entering passphrase at reboot)
69+
70+
- name: Temporary crypttab symlink
71+
file:
72+
path: /etc/crypttab
73+
src: crypttab.setup
74+
state: link
75+
force: True
76+
changed_when: False
77+
78+
- name: LUKS start volumes
79+
command: cryptdisks_start luks-{{ item.key }}
80+
register: luks_start
81+
changed_when: ("(started)" in luks_start.stdout)
82+
with_dict: "{{ luks_volumes }}"
83+
84+
- name: Create filesystem
85+
filesystem:
86+
dev: /dev/mapper/luks-{{ item.key }}
87+
fstype: "{{ item.value.type if 'type' in item.value else fs_type }}"
88+
opts: "{{ '-N %s000' % item.value.inodes if 'inodes' in item.value
89+
else '' }} -m 0"
90+
with_dict: "{{ luks_volumes }}"
91+
92+
- name: Remove temporary crypttab symlink
93+
file:
94+
path: /etc/crypttab
95+
state: absent
96+
changed_when: False
97+
98+
- name: crypt-setup boot script
99+
template:
100+
src: crypt-activate.sh.j2
101+
dest: /etc/crypt-activate.sh
102+
mode: 0755
103+
104+
- name: Systemd unit file for crypt-vols
105+
copy:
106+
dest: /etc/systemd/system/crypt-vols.service
107+
src: crypt-vols.service
108+
109+
- name: Add fstab entries
110+
mount:
111+
fstype: "{{ item.value.type if 'type' in item.value else fs_type }}"
112+
path: "{{ item.value.path }}"
113+
src: "/dev/mapper/luks-{{ item.key }}"
114+
opts: "{{ item.value.options if 'options' in item.value else '_netdev,noauto' }}"
115+
state: present
116+
with_dict: "{{ luks_volumes }}"
117+
118+
- name: Enable crypt-vols
119+
systemd:
120+
name: crypt-vols
121+
enabled: yes
122+
state: restarted
123+
changed_when: False
124+
125+
always:
126+
- name: Unmount master key
127+
mount:
128+
path: "{{ masterkey.path }}"
129+
state: unmounted
130+
changed_when: False

‎k8s/helm/snappymail/values.yaml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,16 @@ deployment:
44
env:
55
debug: "false"
66
log_to_stdout: "true"
7-
memory_limit: 128M
7+
memory_limit: 256M
88
upload_max_size: 25M
99
containerPorts:
1010
- containerPort: 8888
11+
resources:
12+
limits:
13+
memory: 512Mi
14+
requests:
15+
cpu: 50m
16+
memory: 256Mi
1117
volumeMounts:
1218
- mountPath: /var/lib/snappymail/_data_
1319
name: share

‎k8s/helm/splunk/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ sources:
1515
- https://github.com/instantlinux/docker-tools
1616
- https://hub.docker.com/r/splunk/splunk
1717
type: application
18-
version: 0.1.16
19-
appVersion: "10.0.2"
18+
version: 0.1.17
19+
appVersion: "10.2.1"
2020
dependencies:
2121
- name: chartlib
2222
version: 0.1.8

‎k8s/helm/splunk/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,10 @@ statefulset:
3131
service.splunk: allow
3232
resources:
3333
limits:
34-
memory: 4096Mi
34+
memory: 8Gi
3535
requests:
3636
cpu: 200m
37-
memory: 384Mi
37+
memory: 1Gi
3838
volumeMounts:
3939
- mountPath: /opt/splunk/etc
4040
name: splunk

0 commit comments

Comments
 (0)