Add extrepo tasks for managing external repositories in Debian

.devcontainer/devcontainer.json

@@ -0,0 +1,16 @@
+{
+    "name": "Ansible Development",
+    "image": "mcr.microsoft.com/devcontainers/python:3.12",
+    "features": {
+        "ghcr.io/devcontainers/features/ansible:1": {}
+    },
+    "customizations": {
+        "vscode": {
+            "extensions": [
+                "redhat.ansible",
+                "ms-python.python"
+            ]
+        }
+    },
+    "postCreateCommand": "pip install ansible-lint"
+}

.vscode/settings.json

@@ -0,0 +1,18 @@
+{
+  "python-envs.pythonProjects": [
+    {
+      "path": ".",
+      "envManager": "ms-python.python:venv",
+      "packageManager": "ms-python.python:pip"
+    }
+  ],
+  "python.defaultInterpreterPath": "${workspaceFolder}/.venv/bin/python",
+  "python.pythonPath": "${workspaceFolder}/.venv/bin/python", // legacy fallback for older Python extension versions
+  // Keep these Ansible executable paths absolute: parts of the extension use them verbatim.
+  "ansible.ansiblePath": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible", // legacy fallback for older Ansible extension versions
+  "ansible.ansibleLintPath": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-lint", // legacy fallback for older Ansible extension versions
+  "ansible.ansible.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible",
+  "ansible.python.interpreterPath": "${workspaceFolder}/.venv/bin/python3",
+  "ansible.validation.lint.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-lint",
+  "ansible.ansibleNavigator.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-navigator"
+}

.vscode/settings.json.bak.20260327-152321

@@ -0,0 +1,18 @@
+{
+  "python-envs.pythonProjects": [
+    {
+      "path": ".",
+      "envManager": "ms-python.python:venv",
+      "packageManager": "ms-python.python:pip"
+    }
+  ],
+  "python.defaultInterpreterPath": "${workspaceFolder}/.venv/bin/python",
+  "python.pythonPath": "${workspaceFolder}/.venv/bin/python", // legacy fallback for older Python extension versions
+  // Keep these Ansible executable paths absolute: parts of the extension use them verbatim.
+  "ansible.ansiblePath": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible", // legacy fallback for older Ansible extension versions
+  "ansible.ansibleLintPath": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-lint", // legacy fallback for older Ansible extension versions
+  "ansible.ansible.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible",
+  "ansible.python.interpreterPath": "${workspaceFolder}/.venv/bin/python3",
+  "ansible.validation.lint.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-lint",
+  "ansible.ansibleNavigator.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-navigator"
+}

host_vars/cl-fm.oopen.de.yml

@@ -99,6 +99,90 @@ resolved_fallback_nameserver:
    - 194.150.168.168
 
 
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if webservices sre running. Restart if necessary"
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_webservice_load.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check Postfix E-Mail LOG file for 'fatal' errors.."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/postfix/check-postfix-fatal-errors.sh
+
+  - name: "Optimize mysql tables"
+    minute: '53'
+    hour: '04'
+    job: /root/bin/mysql/optimize_mysql_tables.sh
+
+  - name: "Flush query cache for mysql tables"
+    minute: '27'
+    hour: '04'
+    job: /root/bin/mysql/flush_query_cache.sh
+
+  - name: "Flush Host cache"
+    minute: '17'
+    hour: '05'
+    job: /root/bin/mysql/flush_host_cache.sh
+
+  - name: "Run occ file:scan for each cloud account"
+    minute: '02'
+    hour: '22'
+    job: /root/bin/nextcloud/occ_maintenance.sh -s cloud.faire-mobilitaet.de
+
+  - name: "Background job for nextcloud instance 'cloud-irights.oopen.de"
+    minute: '*/15'
+    hour: '*'
+    job: sudo -u "www-data" /usr/local/php/bin/php  -f /var/www/cloud.faire-mobilitaet.de/htdocs/cron.php
+
+  - name: "Check if certificates for coolwsd service are up to date"
+    minute: '17'
+    hour: '05'
+    job: /root/bin/nextcloud/check_cert_coolwsd.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '23'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

host_vars/cl-nd.oopen.de.yml

@@ -0,0 +1,235 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+sshd_permit_root_login: !!str "prohibit-password"
+
+# ---
+# vars used by apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+  - 2a01:4ff:ff00::add:1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if webservices sre running. Restart if necessary"
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_webservice_load.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check Postfix E-Mail LOG file for 'fatal' errors.."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/postfix/check-postfix-fatal-errors.sh
+
+  - name: "Optimize mysql tables"
+    minute: '53'
+    hour: '04'
+    job: /root/bin/mysql/optimize_mysql_tables.sh
+
+  - name: "Flush query cache for mysql tables"
+    minute: '27'
+    hour: '04'
+    job: /root/bin/mysql/flush_query_cache.sh
+
+  - name: "Flush Host cache"
+    minute: '17'
+    hour: '05'
+    job: /root/bin/mysql/flush_host_cache.sh
+
+  - name: "Run occ file:scan for each cloud account"
+    minute: '02'
+    hour: '23'
+    job: /root/bin/nextcloud/occ_maintenance.sh -s cloud.nd.digital
+
+  - name: "Background job for nextcloud instance 'cloud-irights.oopen.de"
+    minute: '*/15'
+    hour: '*'
+    job: sudo -u "www-data" /usr/local/php/bin/php  -f /var/www/cloud.nd.digital/htdocs/cron.php
+
+  - name: "Check if certificates for coolwsd service are up to date"
+    minute: '17'
+    hour: '05'
+    job: /root/bin/nextcloud/check_cert_coolwsd.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '23'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+sudo_users:
+  - chris
+  - sysadm
+  - localadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+sudoers_file_user_privileges:
+  - name: back
+    entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+

roles/common/tasks/apache2.yml

@@ -1,5 +1,4 @@
 ---
-
 # ---
 # Apache2  Server
 # ---
@@ -7,31 +6,29 @@
 - name: Populate service facts
   ansible.builtin.service_facts:
 
-#- name: Print service facts
-#  ansible.builtin.debug:
-#    var: ansible_facts.services
-#  when: 
-#    - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'
-
+# - name: Print service facts
+#   ansible.builtin.debug:
+#     var: ansible_facts.services
+#   when:
+#     - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'
 
 - name: (apache2.yml) Ensure directory '/etc/systemd/system/apache2.service.d' is present
-  file:
+  ansible.builtin.file:
     path: /etc/systemd/system/apache2.service.d
     state: directory
     owner: root
     group: root
-    mode: '0755'
+    mode: "0755"
   when:
     - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'
 
-
 - name: (apache2.yml) Ensure file '/etc/systemd/system/apache2.service.d/limits.conf' exists
-  copy:
-    src: 'etc/systemd/system/apache2.service.d/limits.conf'
-    dest: '/etc/systemd/system/apache2.service.d/limits.conf'
+  ansible.builtin.copy:
+    src: "etc/systemd/system/apache2.service.d/limits.conf"
+    dest: "/etc/systemd/system/apache2.service.d/limits.conf"
     owner: root
     group: root
-    mode: '0644'
+    mode: "0644"
   notify: "Restart apache2"
   when:
     - ansible_facts['services']['apache2.service']['name'] | default('not-found') != 'not-found'

roles/common/tasks/cron.yml

@@ -1,5 +1,82 @@
 ---
 
+- name: (cron.yml) Define candidate paths for root crontab PATH
+  ansible.builtin.set_fact:
+    cron_root_path_candidates:
+      - /root/bin/admin-stuff
+      - /root/bin
+      - /usr/local/apache2/bin
+      - /usr/local/php/bin
+      - /usr/local/sbin
+      - /usr/local/bin
+      - /usr/sbin
+      - /usr/bin
+      - /sbin
+      - /bin
+  tags:
+    - user_crontab
+
+- name: (cron.yml) Check candidate paths for root crontab PATH
+  ansible.builtin.stat:
+    path: "{{ item }}"
+  loop: "{{ cron_root_path_candidates }}"
+  register: cron_root_path_stats
+  tags:
+    - user_crontab
+
+- name: (cron.yml) Build validated root crontab PATH
+  ansible.builtin.set_fact:
+    cron_root_path: >-
+      {{
+        cron_root_path_stats.results
+        | selectattr('stat.exists')
+        | map(attribute='stat.path')
+        | join(':')
+      }}
+  tags:
+    - user_crontab
+
+- name: (cron.yml) Check if root crontab already exists
+  ansible.builtin.stat:
+    path: /var/spool/cron/crontabs/root
+  register: root_crontab_file
+  tags:
+    - user_crontab
+
+- name: (cron.yml) Initialize root crontab with default header and env vars
+  ansible.builtin.copy:
+    dest: /var/spool/cron/crontabs/root
+    owner: root
+    group: crontab
+    mode: '0600'
+    content: |
+      # Edit this file to introduce tasks to be run by cron.
+      #
+      # Each task to run has to be defined through a single line
+      # indicating with different fields when the task will be run
+      # and what command to run for the task
+      #
+      # To define the time you can provide concrete values for
+      # minute (m), hour (h), day of month (dom), month (mon),
+      # and day of week (dow) or use '*' in these fields (for 'any').
+      #
+      # Notice that tasks will be started based on the cron's system
+      # daemon's notion of time and timezones.
+      #
+      # Output of the crontab jobs (including errors) is sent through
+      # email to the user the crontab file belongs to (unless redirected).
+      #
+      # For example, you can run a backup of all your user accounts
+      # at 5 a.m every week with:
+      # 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
+      #
+      PATH={{ cron_root_path }}
+      SHELL=/bin/bash
+  when:
+    - not root_crontab_file.stat.exists
+  tags:
+    - user_crontab
+
 - name: (cron.yml) Set env entries in user crontabs
   cron:
     name: '{{ item.name }}'

roles/common/tasks/extrepo.yml

@@ -0,0 +1,26 @@
+---
+
+- name: (extrepo.yml) Install extrepo package
+  ansible.builtin.apt:
+    name: extrepo
+    state: present
+  tags:
+    - extrepo
+
+- name: (extrepo.yml) Enable contrib policy in /etc/extrepo/config.yaml
+  ansible.builtin.lineinfile:
+    path: /etc/extrepo/config.yaml
+    regexp: '^(#\s*)?-\s*contrib$'
+    insertafter: '^- main$'
+    line: '- contrib'
+  tags:
+    - extrepo
+
+- name: (extrepo.yml) Enable non-free policy in /etc/extrepo/config.yaml
+  ansible.builtin.lineinfile:
+    path: /etc/extrepo/config.yaml
+    regexp: '^(#\s*)?-\s*non-free$'
+    insertafter: '^- contrib$'
+    line: '- non-free'
+  tags:
+    - extrepo

roles/common/tasks/git.yml

@@ -331,12 +331,17 @@
 # ---
 
 # Read in host specific vars file if exists
+- name: (git.yml) Check for host specific git vars file
+  stat:
+    path: "vars/git-{{ inventory_hostname }}.yml"
+  register: git_host_vars_file
+  tags:
+    - git-other-repositories
+
 - name: (git.yml) Include only files matching git-<hostname>.yml (2.2)
   include_vars:
-    dir: vars
-    extensions:
-      - yml
-    files_matching: "git-{{ inventory_hostname }}.yml"
+    file: "vars/git-{{ inventory_hostname }}.yml"
+  when: git_host_vars_file.stat.exists
   tags:
     - git-other-repositories
 

roles/common/tasks/main.yml

@@ -1,8 +1,7 @@
 ---
-
 - import_tasks: show.yml
   tags:
-   - show
+    - show
 
 # tags supported inside basic.yml
 #
@@ -13,7 +12,6 @@
   tags:
     - basic
 
-
 # tags supported inside apt.yml
 #
 #   apt-update
@@ -34,6 +32,15 @@
     - ansible_facts['distribution'] == "Debian"
   tags: apt
 
+# tags supported inside extrepo.yml
+#
+#   extrepo
+- import_tasks: extrepo.yml
+  when:
+    - ansible_facts['distribution'] == "Debian"
+    - (ansible_facts['distribution_major_version'] | int) >= 12
+  tags:
+    - extrepo
 
 # tags supported inside apt-gateway.yml:
 #
@@ -44,7 +51,6 @@
     - apt
     - apt-gateway-server
 
-
 #
 #    yum-update
 #    yum-base-install
@@ -55,7 +61,6 @@
     - ansible_facts.distribution == "CentOS" or ansible_facts.distribution == "Fedora"
   tags: yum
 
-
 # tags supportetd inside caching-nameserver.yml
 #
 # apt-caching-nameserver
@@ -65,7 +70,6 @@
   when: groups['caching_nameserver']|string is search(inventory_hostname)
   tags: caching-nameserver
 
-
 # tags supported inside systemd-resolved.yml
 #
 #    systemd-resolved
@@ -77,8 +81,6 @@
     - ansible_facts['distribution_major_version'] > "11"
     - systemd_resolved is defined and systemd_resolved|bool
 
-
-
 - import_tasks: tor.yml
   when:
     - inventory_hostname in groups['mail_server']
@@ -99,10 +101,9 @@
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
-     - shell-config
-     - vim-config
-     - zsh-config
-
+    - shell-config
+    - vim-config
+    - zsh-config
 
 # tags supported inside users.yml:
 #
@@ -118,7 +119,6 @@
   tags:
     - users
 
-
 # tags supported inside users-systemfiles.yml:
 #
 #   bash
@@ -129,7 +129,6 @@
     - users
     - users-systemfiles
 
-
 # tags supported inside webadmin-user.yml:
 #
 #   users-exists
@@ -145,14 +144,12 @@
     - users-systemfiles
     - webadmin
 
-
 # tags supported inside sshd.yml
 #
 #    sshd-config
 - import_tasks: sshd.yml
   tags: sshd
 
-
 # tags supported inside sudoers.yml:
 #
 #   sudoers-remove
@@ -161,11 +158,9 @@
 - import_tasks: sudoers.yml
   tags: sudoers
 
-
 - import_tasks: motd.yml
   tags: motd
 
-
 # tags supported inside ntp.yml:
 #
 #    ntp-server
@@ -175,7 +170,6 @@
   when:
     - "'lxc_guest' not in group_names"
 
-
 # tags supportetd inside git.yml
 #
 #   git-firewall-repository
@@ -198,7 +192,6 @@
 - import_tasks: git.yml
   tags: git
 
-
 # tags supported inside nfs.yml:
 #
 #    nfs-server
@@ -207,7 +200,6 @@
   tags:
     - nfs
 
-
 # tags supported inside x2go-server.yml:
 #
 #    x2go-server
@@ -216,7 +208,6 @@
   tags:
     - x2go
 
-
 # tags supported inside copy_files.yml:
 #
 #   copy-files
@@ -233,7 +224,6 @@
   tags:
     - symlink-files
 
-
 # tags supported inside config_files_mailsystem_scripts.yml:
 #
 - import_tasks: config_files_mailsystem_scripts.yml
@@ -277,8 +267,8 @@
 
 - import_tasks: redis-server.yml
   when: inventory_hostname in groups['nextcloud_server'] or
-        inventory_hostname in groups['apache2_webserver'] or
-        inventory_hostname in groups['nginx_webserver']
+    inventory_hostname in groups['apache2_webserver'] or
+    inventory_hostname in groups['nginx_webserver']
   tags:
     - redis-server
 
@@ -299,10 +289,8 @@
   tags:
     - services
 
-
 - import_tasks: systemd-services_redhat_based_OS.yml
   when:
     - ansible_facts.os_family == "RedHat"
   tags:
     - services
-