# Ansible playbook for basic web server configuration. # # Run with: # ANSIBLE_STDOUT_CALLBACK=debug ansible-playbook deploy/install.yml -i deploy/inventory.ini --verbose # Notes: # # /etc/apache2 uses OS defaults aside from "site-available", "sites-enabled" and # "conservancy.conf". # # Current site does not use "django.contrib.staticfiles", so no need to run # `collectstatic`. # # SQLite database lives at /var/lib/www/database. # # Disabled Rackspace CDN videos. - name: Configure web server hosts: web become: true vars: ansible_ssh_pipelining: true tasks: - name: Install unattended upgrades apt: name: unattended-upgrades - name: Configure unattended upgrades overrides # See defaults in 50unattended-upgrades. copy: dest: /etc/apt/apt.conf.d/20auto-upgrades content: | APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade "1"; Unattended-Upgrade::Automatic-Reboot "true"; Unattended-Upgrade::Automatic-Reboot-Time "02:00"; Unattended-Upgrade::Mail "root"; - name: Add extensive history logging blockinfile: path: /etc/bash.bashrc block: | # Write to history file immediately (rather than only when shell is # closed). For setting history length see HISTSIZE and HISTFILESIZE in # bash(1). shopt -s histappend PROMPT_COMMAND='history -a' HISTSIZE=1000000 HISTFILESIZE=1000000 insertafter: EOF - name: Mount the media volume # OSUOSL VMs come with fixed storage that's tied to the cores and RAM # selection. Easier to put this data on an external volume. ansible.posix.mount: src: /dev/sdb1 path: /var/www/media fstype: ext4 state: mounted boot: false - name: Install Apache apt: name: apache2,libapache2-mod-wsgi-py3 - apache2_module: state: present name: ssl - apache2_module: state: present name: rewrite # The proxy and proxy-http modules are required to rewrite /.well-known/ # requests to the mail server if the file doesn't exist. This is use to # renew Let's Encrypt certificates. - apache2_module: state: present name: proxy - apache2_module: state: present name: proxy-http - name: Install Postfix apt: pkg: - postfix # libsasl2-modules fixes "SASL authentication failure: No worthy mechs found" - libsasl2-modules - mailutils # # Commented because you only want this on first run ever. # - name: Add file for SMTP credentials # copy: # dest: /etc/postfix/sasl_passwd # content: |- # # After updating, run `sudo postmap hash:/etc/postfix/sasl_passwd`. # [mail.sfconservancy.org]:587 conference@sfconservancy.org:PASSWORD - name: Configure Postfix for relaying copy: src: postfix/main.cf dest: /etc/postfix/main.cf notify: - restart postfix - name: Alias mail to root copy: dest: /etc/aliases content: |- postmaster: root root: sysadmin@sfconservancy.org, sysadmin@sturm.com.au notify: - restart postfix - name: Install Certbot apt: name: certbot, python3-certbot-apache - name: Install Python dependencies apt: name: python3-django,python3-bs4,python3-html5lib,python3-django-countries - name: Install Python essentials apt: name: python3-venv,python3-pip,python3-wheel - name: Install Python build dependencies apt: name: build-essential,python3-dev,libffi-dev - name: Security settings apt: name: fail2ban - name: Disable SSH password authentication lineinfile: path: /etc/ssh/sshd_config line: 'PasswordAuthentication no' regexp: 'PasswordAuthentication ' notify: - restart sshd - name: Install utilities apt: name: tmux,curl,git,magic-wormhole,htop,rsync - name: Create the project directory file: path: /var/www/website state: directory owner: www-data group: www-data mode: '0755' # TODO: Needs to force owner to www-data:www-data - name: Git checkout ansible.builtin.git: repo: 'https://f.sfconservancy.org/Conservancy/website' dest: /var/www/website version: master remote: upstream - name: Create the database directory file: path: /var/lib/www/database state: directory owner: www-data group: www-data mode: '0755' - name: Create static dir file: path: /var/www/website/conservancy/static state: directory owner: www-data group: www-data mode: '0755' - name: Install `netfilter-persistent` && `iptables-persistent` packages apt: pkg: - iptables-persistent - netfilter-persistent - name: Install iptables # May need kernel reload/reboot apt: name: iptables,iptables-netflow-dkms - name: Flush existing firewall rules iptables: flush: true - name: Firewall rule - allow all loopback traffic iptables: action: append chain: INPUT in_interface: lo jump: ACCEPT - name: Firewall rule - allow established connections iptables: chain: INPUT ctstate: ESTABLISHED,RELATED jump: ACCEPT - name: Firewall rule - allow port ping traffic iptables: chain: INPUT jump: ACCEPT protocol: icmp - name: Firewall rule - allow port 22/SSH traffic iptables: chain: INPUT destination_port: '22' jump: ACCEPT protocol: tcp - name: Firewall rule - allow port 80/HTTP traffic iptables: chain: INPUT destination_port: '80' jump: ACCEPT protocol: tcp - name: Firewall rule - allow port 443/HTTPS traffic iptables: chain: INPUT destination_port: '443' jump: ACCEPT protocol: tcp - name: Firewall rule - drop any traffic without rule iptables: chain: INPUT jump: DROP - name: Flush existing firewall rules iptables: ip_version: ipv6 flush: true - name: Firewall rule - allow all loopback traffic v6 iptables: ip_version: ipv6 action: append chain: INPUT in_interface: lo jump: ACCEPT - name: Firewall rule - allow established connections v6 iptables: ip_version: ipv6 chain: INPUT ctstate: ESTABLISHED,RELATED jump: ACCEPT - name: Firewall rule - allow port ping traffic v6 iptables: ip_version: ipv6 chain: INPUT jump: ACCEPT protocol: icmp - name: Firewall rule - allow port 22/SSH traffic v6 iptables: ip_version: ipv6 chain: INPUT destination_port: '22' jump: ACCEPT protocol: tcp - name: Firewall rule - allow port 80/HTTP traffic v6 iptables: ip_version: ipv6 chain: INPUT destination_port: '80' jump: ACCEPT protocol: tcp - name: Firewall rule - allow port 443/HTTPS traffic v6 iptables: ip_version: ipv6 chain: INPUT destination_port: '443' jump: ACCEPT protocol: tcp - name: Firewall rule - drop any traffic without rule v6 iptables: ip_version: ipv6 chain: INPUT jump: DROP handlers: - name: restart sshd service: name: ssh state: reloaded - name: restart postfix service: name: postfix state: reloaded