website/deploy/install.yml

# Ansible playbook for basic web server configuration.
#
# Run with:
# ANSIBLE_STDOUT_CALLBACK=debug ansible-playbook deploy/install.yml -i deploy/inventory.ini --verbose

# Notes:
#
# /etc/apache2 uses OS defaults aside from "site-available", "sites-enabled" and
# "conservancy.conf".
#
# Current site does not use "django.contrib.staticfiles", so no need to run
# `collectstatic`.
#
# SQLite database lives at /var/lib/www/database.
#
# Disabled Rackspace CDN videos.

 - name: Configure web server
   hosts: web
   become: true
   vars:
     ansible_ssh_pipelining: true
   tasks:
     - name: Install unattended upgrades
       apt:
         name: unattended-upgrades

     - name: Configure unattended upgrades overrides
       # See defaults in 50unattended-upgrades.
       copy:
         dest: /etc/apt/apt.conf.d/20auto-upgrades
         content: |
           APT::Periodic::Update-Package-Lists "1";
           APT::Periodic::Unattended-Upgrade "1";
           Unattended-Upgrade::Automatic-Reboot "true";
           Unattended-Upgrade::Automatic-Reboot-Time "02:00";
           Unattended-Upgrade::Mail "root";

     - name: Add extensive history logging
       blockinfile:
         path: /etc/bash.bashrc
         block: |
           # Write to history file immediately (rather than only when shell is
           # closed). For setting history length see HISTSIZE and HISTFILESIZE in
           # bash(1).
           shopt -s histappend
           PROMPT_COMMAND='history -a'
           HISTSIZE=1000000
           HISTFILESIZE=1000000
         insertafter: EOF

     - name: Mount the media volume
       # OSUOSL VMs come with fixed storage that's tied to the cores and RAM
       # selection. Easier to put this data on an external volume.
       ansible.posix.mount:
         src: /dev/sdb1
         path: /var/www/media
         fstype: ext4
         state: mounted
         boot: false

     - name: Install Apache
       apt:
         name: apache2,libapache2-mod-wsgi-py3

     - apache2_module:
         state: present
         name: ssl

     - apache2_module:
         state: present
         name: rewrite

     # The proxy and proxy-http modules are required to rewrite /.well-known/
     # requests to the mail server if the file doesn't exist. This is use to
     # renew Let's Encrypt certificates.
     - apache2_module:
         state: present
         name: proxy

     - apache2_module:
         state: present
         name: proxy-http

     - name: Install Postfix
       apt:
         pkg:
           - postfix
           # libsasl2-modules fixes "SASL authentication failure: No worthy mechs found"
           - libsasl2-modules
           - mailutils

     # # Commented because you only want this on first run ever.
     # - name: Add file for SMTP credentials
     #   copy:
     #     dest: /etc/postfix/sasl_passwd
     #     content: |-
     #       # After updating, run `sudo postmap hash:/etc/postfix/sasl_passwd`.
     #       [mail.sfconservancy.org]:587 conference@sfconservancy.org:PASSWORD

     - name: Configure Postfix for relaying
       copy:
         src: postfix/main.cf
         dest: /etc/postfix/main.cf
       notify:
         - restart postfix

     - name: Alias mail to root
       copy:
         dest: /etc/aliases
         content: |-
           postmaster: root
           root: sysadmin@sfconservancy.org, sysadmin@sturm.com.au
       notify:
         - restart postfix

     - name: Install Certbot
       apt:
         name: certbot, python3-certbot-apache

     - name: Install Python dependencies
       apt:
         name: python3-django,python3-bs4,python3-html5lib,python3-django-countries

     - name: Install Python essentials
       apt:
         name: python3-venv,python3-pip,python3-wheel

     - name: Install Python build dependencies
       apt:
         name: build-essential,python3-dev,libffi-dev

     - name: Security settings
       apt:
         name: fail2ban

     - name: Disable SSH password authentication
       lineinfile:
         path: /etc/ssh/sshd_config
         line: 'PasswordAuthentication no'
         regexp: 'PasswordAuthentication '
       notify:
         - restart sshd

     - name: Install utilities
       apt:
         name: tmux,curl,git,magic-wormhole,htop,rsync

     - name: Create the project directory
       file:
         path: /var/www/website
         state: directory
         owner: www-data
         group: www-data
         mode: '0755'

     # TODO: Needs to force owner to www-data:www-data
     - name: Git checkout
       ansible.builtin.git:
         repo: 'https://k.sfconservancy.org/website'
         dest: /var/www/website
         version: master
         remote: upstream

     - name: Create the database directory
       file:
         path: /var/lib/www/database
         state: directory
         owner: www-data
         group: www-data
         mode: '0755'

     - name: Create static dir
       file:
         path: /var/www/website/conservancy/static
         state: directory
         owner: www-data
         group: www-data
         mode: '0755'

     - name: Install `netfilter-persistent` && `iptables-persistent` packages
       apt:
         pkg:
           - iptables-persistent
           - netfilter-persistent

     - name: Install iptables  # May need kernel reload/reboot
       apt:
         name: iptables,iptables-netflow-dkms

     - name: Flush existing firewall rules
       iptables:
         flush: true

     - name: Firewall rule - allow all loopback traffic
       iptables:
         action: append
         chain: INPUT
         in_interface: lo
         jump: ACCEPT

     - name: Firewall rule - allow established connections
       iptables:
         chain: INPUT
         ctstate: ESTABLISHED,RELATED
         jump: ACCEPT

     - name: Firewall rule - allow port ping traffic
       iptables:
         chain: INPUT
         jump: ACCEPT
         protocol: icmp

     - name: Firewall rule - allow port 22/SSH traffic
       iptables:
         chain: INPUT
         destination_port: '22'
         jump: ACCEPT
         protocol: tcp

     - name: Firewall rule - allow port 80/HTTP traffic
       iptables:
         chain: INPUT
         destination_port: '80'
         jump: ACCEPT
         protocol: tcp

     - name: Firewall rule - allow port 443/HTTPS traffic
       iptables:
         chain: INPUT
         destination_port: '443'
         jump: ACCEPT
         protocol: tcp

     - name: Firewall rule - drop any traffic without rule
       iptables:
         chain: INPUT
         jump: DROP

     - name: Flush existing firewall rules
       iptables:
         ip_version: ipv6
         flush: true

     - name: Firewall rule - allow all loopback traffic v6
       iptables:
         ip_version: ipv6
         action: append
         chain: INPUT
         in_interface: lo
         jump: ACCEPT

     - name: Firewall rule - allow established connections v6
       iptables:
         ip_version: ipv6
         chain: INPUT
         ctstate: ESTABLISHED,RELATED
         jump: ACCEPT

     - name: Firewall rule - allow port ping traffic v6
       iptables:
         ip_version: ipv6
         chain: INPUT
         jump: ACCEPT
         protocol: icmp

     - name: Firewall rule - allow port 22/SSH traffic v6
       iptables:
         ip_version: ipv6
         chain: INPUT
         destination_port: '22'
         jump: ACCEPT
         protocol: tcp

     - name: Firewall rule - allow port 80/HTTP traffic v6
       iptables:
         ip_version: ipv6
         chain: INPUT
         destination_port: '80'
         jump: ACCEPT
         protocol: tcp

     - name: Firewall rule - allow port 443/HTTPS traffic v6
       iptables:
         ip_version: ipv6
         chain: INPUT
         destination_port: '443'
         jump: ACCEPT
         protocol: tcp

     - name: Firewall rule - drop any traffic without rule v6
       iptables:
         ip_version: ipv6
         chain: INPUT
         jump: DROP

   handlers:
     - name: restart sshd
       service:
         name: ssh
         state: reloaded

     - name: restart postfix
       service:
         name: postfix
         state: reloaded