Dirk Wirts
2 years ago
3 changed files with 352 additions and 0 deletions
@ -0,0 +1,242 @@ |
|||
--- |
|||
- name: Setup and Configure Mail Relay Docker Container |
|||
hosts: your_target_host |
|||
become: true |
|||
vars: |
|||
mail_relay_dir: /mnt/docker/mail-relay |
|||
conf_dir: "{{ mail_relay_dir }}/conf" |
|||
mail_relay_password: "{{ lookup('community.general.random_string', length=10, special=false) }}" |
|||
certificate_subject: "/C=DE/ST=Germany/L=NRW/O=Asmodee Group/OU=Mail-Relay/CN=localhost/name=Mail-Relay/emailAddress=it-admin@asmodee.de" |
|||
|
|||
tasks: |
|||
- name: Create necessary directories |
|||
file: |
|||
path: "{{ item }}" |
|||
state: directory |
|||
loop: |
|||
- "{{ mail_relay_dir }}" |
|||
- "{{ conf_dir }}" |
|||
- "{{ mail_relay_dir }}/spool" |
|||
- "{{ mail_relay_dir }}/sasl2" |
|||
|
|||
- name: Create Dockerfile for mail relay |
|||
copy: |
|||
dest: /mnt/docker/mail-relay/mail-relay.Dockerfile |
|||
content: | |
|||
FROM alpine:3.17 |
|||
RUN apk add --no-cache bash net-tools tzdata busybox-extras postfix cyrus-sasl cyrus-sasl-static cyrus-sasl-login |
|||
RUN echo 'saslauthd -a sasldb -V; postfix start-fg' | tee /start.sh; chmod 755 /start.sh |
|||
CMD /start.sh |
|||
|
|||
- name: Create Docker Compose file |
|||
copy: |
|||
dest: /mnt/docker/mail-relay/docker-compose.yaml |
|||
content: | |
|||
version: "3" |
|||
services: |
|||
mail-relay: |
|||
image: mail-relay-custom |
|||
build: |
|||
context: . |
|||
dockerfile: ./mail-relay.Dockerfile |
|||
container_name: mail-relay |
|||
restart: unless-stopped |
|||
healthcheck: |
|||
test: ( grep -qr "master" /proc/*/status && grep -qr "saslauthd" /proc/*/status ) || exit 1 |
|||
interval: 1m |
|||
timeout: 30s |
|||
retries: 3 |
|||
volumes: |
|||
- /etc/timezone:/etc/timezone:ro |
|||
- /etc/localtime:/etc/localtime:ro |
|||
- ./main.cf:/etc/postfix/main.cf:ro |
|||
- ./master.cf:/etc/postfix/master.cf:ro |
|||
- ./conf:/etc/postfix/conf |
|||
- ./spool:/var/spool/postfix |
|||
- ./sasl2:/etc/sasl2 |
|||
networks: |
|||
default: |
|||
name: build |
|||
external: true |
|||
|
|||
- name: Create main.cf Postfix configuration file |
|||
copy: |
|||
dest: "{{ conf_dir }}/main.cf" |
|||
content: | |
|||
# Global Postfix configuration file |
|||
alias_maps = lmdb:/etc/postfix/conf/aliases |
|||
alias_database = lmdb:/etc/postfix/conf/aliases |
|||
myhostname = mail-relay |
|||
mynetworks_style = host |
|||
inet_interfaces = all |
|||
inet_protocols = ipv4 |
|||
message_size_limit = 10240000 |
|||
soft_bounce = no |
|||
|
|||
# Queue Time |
|||
bounce_queue_lifetime = 10h |
|||
maximal_queue_lifetime = 12h |
|||
maximal_backoff_time = 15m |
|||
minimal_backoff_time = 5m |
|||
queue_run_delay = 5m |
|||
|
|||
# TLS for smtp |
|||
smtp_tls_session_cache_database = lmdb:${data_directory}/smtp_scache |
|||
smtp_tls_loglevel = 1 |
|||
smtp_tls_security_level = secure |
|||
smtp_tls_mandatory_ciphers = high |
|||
smtp_tls_secure_cert_match = nexthop |
|||
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt |
|||
|
|||
# Send over Smarthost (outgoing Emails) |
|||
smtp_connection_cache_on_demand = no |
|||
smtp_sender_dependent_authentication = yes |
|||
smtp_sasl_type = cyrus |
|||
smtp_sasl_auth_enable = yes |
|||
smtp_sasl_auth_soft_bounce = yes |
|||
smtp_sasl_security_options = noplaintext, noanonymous |
|||
smtp_sasl_tls_security_options = noanonymous |
|||
smtp_sasl_password_maps = lmdb:/etc/postfix/conf/smtp_sasl_password_maps |
|||
sender_dependent_relayhost_maps = lmdb:/etc/postfix/conf/sender_dependent_relayhost_maps |
|||
|
|||
# Cleanup the Header |
|||
smtp_header_checks = regexp:/etc/postfix/conf/smtp_header_checks |
|||
|
|||
# SASL authentication (incoming Emails) |
|||
broken_sasl_auth_clients = no |
|||
smtpd_tls_auth_only = no |
|||
smtpd_sasl_auth_enable = yes |
|||
smtpd_sasl_security_options = noanonymous |
|||
smtpd_sasl_tls_security_options = noanonymous |
|||
smtpd_sender_restrictions = permit_sasl_authenticated, reject_unauth_destination |
|||
smtpd_relay_restrictions = $smtpd_sender_restrictions |
|||
|
|||
# TLS for smtpd |
|||
smtpd_tls_security_level = may |
|||
smtpd_tls_cert_file = /etc/postfix/conf/server.crt |
|||
smtpd_tls_key_file = /etc/postfix/conf/server.key |
|||
|
|||
# connection limits |
|||
smtpd_client_connection_rate_limit = 0 |
|||
smtpd_client_connection_count_limit = 0 |
|||
|
|||
# Logging for Docker Container |
|||
maillog_file = /dev/stdout |
|||
|
|||
- name: Create master.cf Postfix configuration file |
|||
copy: |
|||
dest: "{{ conf_dir }}/master.cf" |
|||
content: | |
|||
# Postfix master process configuration file |
|||
# |
|||
# ========================================================================== |
|||
# service type private unpriv chroot wakeup maxproc command + args |
|||
# (yes) (yes) (no) (never) (100) |
|||
# ========================================================================== |
|||
smtp inet n - n - - smtpd |
|||
-o syslog_name=postfix/smtp |
|||
submission inet n - n - - smtpd |
|||
-o syslog_name=postfix/submission |
|||
-o smtpd_tls_security_level=encrypt |
|||
-o smtpd_sasl_auth_enable=yes |
|||
-o smtpd_tls_auth_only=yes |
|||
smtps inet n - n - - smtpd |
|||
-o syslog_name=postfix/smtps |
|||
-o smtpd_tls_wrappermode=yes |
|||
-o smtpd_sasl_auth_enable=yes |
|||
pickup unix n - n 60 1 pickup |
|||
cleanup unix n - n - 0 cleanup |
|||
qmgr unix n - n 300 1 qmgr |
|||
tlsmgr unix - - n 1000? 1 tlsmgr |
|||
rewrite unix - - n - - trivial-rewrite |
|||
bounce unix - - n - 0 bounce |
|||
defer unix - - n - 0 bounce |
|||
trace unix - - n - 0 bounce |
|||
verify unix - - n - 1 verify |
|||
flush unix n - n 1000? 0 flush |
|||
proxymap unix - - n - - proxymap |
|||
proxywrite unix - - n - 1 proxymap |
|||
smtp unix - - n - - smtp |
|||
relay unix - - n - - smtp |
|||
-o syslog_name=postfix/$service_name |
|||
showq unix n - n - - showq |
|||
error unix - - n - - error |
|||
retry unix - - n - - error |
|||
discard unix - - n - - discard |
|||
local unix - n n - - local |
|||
virtual unix - n n - - virtual |
|||
lmtp unix - - n - - lmtp |
|||
anvil unix - - n - 1 anvil |
|||
scache unix - - n - 1 scache |
|||
postlog unix-dgram n - n - 1 postlogd |
|||
|
|||
- name: Generate RSA private key |
|||
openssl_privatekey: |
|||
path: "{{ conf_dir }}/server.key" |
|||
size: 4096 |
|||
|
|||
- name: Generate a Self Signed OpenSSL certificate |
|||
openssl_certificate: |
|||
path: "{{ conf_dir }}/server.crt" |
|||
privatekey_path: "{{ conf_dir }}/server.key" |
|||
subject: "{{ certificate_subject }}" |
|||
provider: selfsigned |
|||
|
|||
- name: Set permissions for server.key |
|||
file: |
|||
path: "{{ conf_dir }}/server.key" |
|||
mode: '0644' |
|||
|
|||
- name: Create smtp_sasl_password_maps file |
|||
copy: |
|||
dest: "{{ conf_dir }}/smtp_sasl_password_maps" |
|||
content: "mail@notifications.asmodee.de apikey:{{ password }}" |
|||
mode: '0600' |
|||
|
|||
- name: Create sender_dependent_relayhost_maps file |
|||
copy: |
|||
dest: "{{ conf_dir }}/sender_dependent_relayhost_maps" |
|||
content: "mail@notifications.asmodee.de [smtp.sendgrid.net]:" |
|||
|
|||
- name: Create aliases file |
|||
file: |
|||
path: "{{ conf_dir }}/aliases" |
|||
state: touch |
|||
|
|||
- name: Create smtp_header_checks file |
|||
copy: |
|||
dest: "{{ conf_dir }}/smtp_header_checks" |
|||
content: | |
|||
/^Received:/ IGNORE |
|||
/^User-Agent:/ IGNORE |
|||
/^Message-ID:/ IGNORE |
|||
/^X-Originating-ip:/ IGNORE |
|||
/^X-Forward:/ IGNORE |
|||
/^X-Mailer:/ IGNORE |
|||
/^X-Virus-/ IGNORE |
|||
/^X-Spam-/ IGNORE |
|||
|
|||
- name: Start Docker container with Docker Compose |
|||
community.docker.docker_compose: |
|||
project_src: "{{ mail_relay_dir }}" |
|||
state: present |
|||
restarted: yes |
|||
|
|||
- name: Update Postfix maps and aliases |
|||
community.docker.docker_container_exec: |
|||
container: mail-relay |
|||
command: "{{ item }}" |
|||
loop: |
|||
- "postmap /etc/postfix/conf/smtp_sasl_password_maps" |
|||
- "postmap /etc/postfix/conf/sender_dependent_relayhost_maps" |
|||
- "postalias /etc/postfix/conf/aliases" |
|||
|
|||
- name: Configure SASL password and permissions |
|||
community.docker.docker_container_exec: |
|||
container: mail-relay |
|||
command: "sh -c 'echo {{ mail_relay_password }} | saslpasswd2 -c -p -u mail-relay relay-apikey; chmod 640 /etc/sasl2/sasldb2; chown root:postfix /etc/sasl2/sasldb2'" |
|||
|
|||
- name: List SASL users |
|||
community.docker.docker_container_exec: |
|||
container: mail-relay |
|||
command: "sasldblistusers2" |
|||
@ -0,0 +1,71 @@ |
|||
--- |
|||
- name: Setup UniFi Controller Docker Container |
|||
hosts: your_target_host |
|||
become: true |
|||
vars: |
|||
unifi_dir: /mnt/docker/unifi-controller |
|||
cert_dir: "{{ unifi_dir }}/data/cert" |
|||
cert_files: |
|||
- unifi-controller.asmodee.local.crt |
|||
- unifi-controller.asmodee.local.key |
|||
- root-ca.crt |
|||
|
|||
tasks: |
|||
- name: Create necessary directories |
|||
file: |
|||
path: "{{ item }}" |
|||
state: directory |
|||
loop: |
|||
- "{{ unifi_dir }}" |
|||
- "{{ cert_dir }}" |
|||
|
|||
- name: Create Docker Compose file for UniFi Controller |
|||
copy: |
|||
dest: "{{ unifi_dir }}/docker-compose.yaml" |
|||
content: | |
|||
version: "3" |
|||
services: |
|||
unifi-controller: |
|||
image: jacobalberty/unifi:latest |
|||
container_name: unifi-controller |
|||
restart: unless-stopped |
|||
healthcheck: |
|||
test: grep -qr "java" /proc/*/status || exit 1 |
|||
interval: 1m |
|||
timeout: 30s |
|||
retries: 3 |
|||
ports: |
|||
- 6789:6789 |
|||
- 8080:8080 |
|||
- 8443:8443 |
|||
- 8843:8843 |
|||
- 8880:8880 |
|||
- 3478:3478/udp |
|||
environment: |
|||
- RUNAS_UID0=false |
|||
volumes: |
|||
- /etc/timezone:/etc/timezone:ro |
|||
- /etc/localtime:/etc/localtime:ro |
|||
- ./data:/unifi |
|||
- ./run:/var/run/unifi |
|||
networks: |
|||
default: |
|||
name: build |
|||
external: true |
|||
|
|||
- name: Copy certificate files to UniFi directory |
|||
copy: |
|||
src: "{{ item }}" |
|||
dest: "{{ cert_dir }}/{{ item }}" |
|||
mode: '0600' |
|||
loop: "{{ cert_files }}" |
|||
|
|||
- name: Append certificate to chain file |
|||
command: |
|||
cmd: "cat {{ cert_dir }}/{{ cert_files[0] }} >> {{ cert_dir }}/chain.pem" |
|||
|
|||
- name: Start Docker container with Docker Compose |
|||
community.docker.docker_compose: |
|||
project_src: "{{ unifi_dir }}" |
|||
state: present |
|||
restarted: yes |
|||
@ -0,0 +1,39 @@ |
|||
#!/bin/bash |
|||
|
|||
# Ensure the script is run as root |
|||
if [ "$(id -u)" != "0" ]; then |
|||
echo "This script must be run as root" 1>&2 |
|||
exit 1 |
|||
fi |
|||
|
|||
# Update and Upgrade the System |
|||
apt update && apt upgrade -y |
|||
|
|||
# Install sudo and other necessary packages |
|||
apt install -y sudo openssh-server |
|||
|
|||
# Create the ansible user |
|||
useradd -m -s /bin/bash ansible |
|||
|
|||
# Set up SSH for the ansible user |
|||
mkdir -p /home/ansible/.ssh |
|||
chmod 700 /home/ansible/.ssh |
|||
touch /home/ansible/.ssh/authorized_keys |
|||
chmod 600 /home/ansible/.ssh/authorized_keys |
|||
|
|||
# Replace 'your_public_key' with the actual public key |
|||
echo 'your_public_key' > /home/ansible/.ssh/authorized_keys |
|||
|
|||
# Change ownership of the .ssh directory to the ansible user |
|||
chown -R ansible:ansible /home/ansible/.ssh |
|||
|
|||
# Configure sudo privileges |
|||
echo 'ansible ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/ansible |
|||
|
|||
# Ensure the sudoers file is secure |
|||
chmod 0440 /etc/sudoers.d/ansible |
|||
|
|||
# Install Ansible |
|||
apt install -y ansible |
|||
|
|||
echo "Ansible and user setup complete." |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue