From 9c6094cef8936dc08a88d25aea277ba611f0f049 Mon Sep 17 00:00:00 2001 From: Christoph Date: Thu, 30 Jul 2026 12:54:19 +0200 Subject: [PATCH] add host ki-fm.oopen.de --- host_vars/ki-fm.oopen.de/ki-fm-common.yml | 171 ++++++++++++++++++ host_vars/ki-fm.oopen.de/ki-fm-ipt-server.yml | 24 +++ hosts | 21 +++ 3 files changed, 216 insertions(+) create mode 100644 host_vars/ki-fm.oopen.de/ki-fm-common.yml create mode 100644 host_vars/ki-fm.oopen.de/ki-fm-ipt-server.yml diff --git a/host_vars/ki-fm.oopen.de/ki-fm-common.yml b/host_vars/ki-fm.oopen.de/ki-fm-common.yml new file mode 100644 index 0000000..7d68d98 --- /dev/null +++ b/host_vars/ki-fm.oopen.de/ki-fm-common.yml @@ -0,0 +1,171 @@ +--- + +# --- +# vars used by roles/ansible_dependencies +# --- + + +# --- +# vars used by roles/ansible_user +# --- + + +# --- +# vars used by roles/common/tasks/basic.yml +# --- + + +# --- +# vars used by roles/common/tasks/sshd.yml +# --- + +sshd_permit_root_login: !!str "prohibit-password" + +# --- +# vars used by apt.yml +# --- + + +# --- +# vars used by roles/common/tasks/systemd-resolved.yml +# --- + +systemd_resolved: true + +# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie +# Primäre DNS-Adresse: 38.132.106.139 +# Sekundäre DNS-Adresse: 194.187.251.67 +# +# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen +# primäre DNS-Adresse +# IPv4: 1.1.1.1 +# IPv6: 2606:4700:4700::1111 +# sekundäre DNS-Adresse +# IPv4: 1.0.0.1 +# IPv6: 2606:4700:4700::1001 +# +# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit +# primäre DNS-Adresse +# IPv4: 8.8.8.8 +# IPv6: 2001:4860:4860::8888 +# sekundäre DNS-Adresse +# IPv4: 8.8.4.4 +# IPv6: 2001:4860:4860::8844 +# +# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug +# primäre DNS-Adresse +# IPv4: 9.9.9.9 +# IPv6: 2620:fe::fe +# sekundäre DNS-Adresse +# IPv4: 149.112.112.112 +# IPv6: 2620:fe::9 +# +# OpenNIC - https://www.opennic.org/ +# IPv4: 195.10.195.195 - ns31.de +# IPv4: 94.16.114.254 - ns28.de +# IPv4: 51.254.162.59 - ns9.de +# IPv4: 194.36.144.87 - ns29.de +# IPv6: 2a00:f826:8:2::195 - ns31.de +# +# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) +# IPv4: 5.1.66.255 +# IPv6: 2001:678:e68:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# IPv4: 185.150.99.255 +# IPv6: 2001:678:ed0:f000:: +# Servername für DNS-over-TLS: dot.ffmuc.net +# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb) +resolved_nameserver: + - 185.12.64.2 + - 185.12.64.1 + - 2a01:4ff:ff00::add:2 + - 2a01:4ff:ff00::add:1 + +# search domains +# +# If there are more than one search domains, then specify them here in the order in which +# the resolver should also search them +# +# resolved_domains: [] +resolved_domains: + - ~. + - oopen.de + +resolved_dnssec: false + +# dns.as250.net: 194.150.168.168 +# +resolved_fallback_nameserver: + - 194.150.168.168 + + +# --- +# vars used by roles/common/tasks/cron.yml +# --- + +cron_env_entries: + - name: PATH + job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + + - name: SHELL + job: /bin/bash + insertafter: PATH + + +cron_user_special_time_entries: + + - name: "Restart DNS Cache service 'systemd-resolved'" + special_time: reboot + job: "sleep 5 ; /bin/systemctl restart systemd-resolved" + insertafter: PATH + + +# --- +# vars used by roles/common/tasks/users.yml +# --- + +sudo_users: + - chris + - sysadm + - localadmin + + +# --- +# vars used by roles/common/tasks/users-systemfiles.yml +# --- + + +# --- +# vars used by roles/common/tasks/webadmin-user.yml +# --- + + +# --- +# vars used by roles/common/tasks/sudoers.yml +# --- +# +# see: roles/common/tasks/vars + +sudoers_file_user_privileges: + - name: back + entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php' + + +# --- +# vars used by roles/common/tasks/caching-nameserver.yml +# --- + + +# --- +# vars used by roles/common/tasks/git.yml +# --- +# +# see: roles/common/tasks/vars + + +# ============================== + + +# --- +# vars used by scripts/reset_root_passwd.yml +# --- diff --git a/host_vars/ki-fm.oopen.de/ki-fm-ipt-server.yml b/host_vars/ki-fm.oopen.de/ki-fm-ipt-server.yml new file mode 100644 index 0000000..60bcf91 --- /dev/null +++ b/host_vars/ki-fm.oopen.de/ki-fm-ipt-server.yml @@ -0,0 +1,24 @@ +--- +# ipt-firewall configuration for cl-fm.oopen.de +# Generated by extract-fw-host-vars.py - review before committing! +# Place in: host_vars//ipt_firewall.yml + +fw_manage_config: true + +# --- Network +fw_ext_interfaces: + - "eth0" +fw_ext_ips_v4: + - "5.75.224.214" +fw_ext_ips_v6: + - "2a01:4f8:c015:c4b7::1" + +# --- Munin +munin_remote_ipv4: 37.27.121.227 +munin_remote_ipv6: "2a01:4f9:3070:2bda::227" + +# --- HTTP +fw_http_server_ips: $ext_1_ip + +# --- Mail +fw_mail_client_ips: $ext_1_ip diff --git a/hosts b/hosts index 6bb60cf..a2e3e8c 100644 --- a/hosts +++ b/hosts @@ -215,6 +215,9 @@ o27.oopen.de cl-fm.oopen.de mail.faire-mobilitaet.de +# Hetzner cloud (CPX22) +ki-fm.oopen.de + # - o28 NDM - neue deutsche Medienmacher*innen o28.oopen.de cl-ndm.oopen.de @@ -440,6 +443,9 @@ o27.oopen.de cl-fm.oopen.de mail.faire-mobilitaet.de +# Hetzner cloud (CPX22) +ki-fm.oopen.de + # - o28 NDM - neue deutsche Medienmacher*innen o28.oopen.de cl-ndm.oopen.de @@ -760,6 +766,9 @@ o26.oopen.de cl-fm.oopen.de mail.faire-mobilitaet.de +# Hetzner cloud (CPX22) +ki-fm.oopen.de + # - o28 neue deutsche Medienmacher*innen - NDM Host System cl-ndm.oopen.de psono-ndm.oopen.de @@ -1176,6 +1185,9 @@ o26.oopen.de # o27.oopen.de cl-fm.oopen.de +# Hetzner cloud (CPX22) +ki-fm.oopen.de + # - o28 neue deutsche Medienmacher*innen - NDM Host System cl-ndm.oopen.de psono-ndm.oopen.de @@ -1297,6 +1309,9 @@ o26.oopen.de # o27.oopen.de cl-fm.oopen.de +# Hetzner cloud (CPX22) +ki-fm.oopen.de + # - o28 neue deutsche Medienmacher*innen - NDM Host System cl-ndm.oopen.de psono-ndm.oopen.de @@ -1695,6 +1710,9 @@ mm-irights.oopen.de cl-fm.oopen.de mail.faire-mobilitaet.de +# Hetzner cloud (CPX22) +ki-fm.oopen.de + # Hetzner Cloud CX31 - AK # o28.oopen.de NDM - neue deutsche Medienmacher*innen @@ -1926,6 +1944,9 @@ o27.oopen.de cl-fm.oopen.de mail.faire-mobilitaet.de +# Hetzner cloud (CPX22) +ki-fm.oopen.de + # o28.oopen.de NDM - neue deutsche Medienmacher*innen o28.oopen.de cl-ndm.oopen.de