add extrepo.yml: Workaround für einen ifupdown-Paketbug.

host_vars/backup.oopen.de/backup-common.yml

@@ -346,7 +346,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID82UUUkYKYFbJdmTcMYu+vl3M0FVQznXFbngqPoumP+ root@prometheus-nd'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIObY/MOgF4QVWROrQCaKCfBOfAwKVcja3q7Ngwo1MEDt root@psono-ndm'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJU5HzfGYZwWeaoAGGFF7/3VQP19ce6Rgn5wcOR98Q3o root@server26'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBRfCFz6mPdn3TKVCgffHQAKt3LN/0srS/gBsMoOyZpi root@shop-agr'
+      - '#ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBRfCFz6mPdn3TKVCgffHQAKt3LN/0srS/gBsMoOyZpi root@shop-agr'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHbeMf/CvAYIU/4UW8Ql59FgPo/3vcZ3vI3QzK2kOadE root@srv-cityslang'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINiVJ2QVuGz0bLlrJVa3CJ+DtwOv0pt6M53ipkGbW1JQ root@stolpersteine'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDVZ38bJGxecaM5cNj8U+3t1h7+qEEMyjNZ8hzwf2LIT root@test.mariadb'

host_vars/file-dissens.dissens.netz/file-dissens-common.yml

@@ -403,16 +403,21 @@ samba_user:
       - verwaltung
     password: '20/3l3n0r-fa3llg3em/24?'
 
+  - name: franziska.behringer
+    groups:
+      - projekte
+    password: '20-fr4nz1sk4.b3hr1ng3r-36!'
+
   - name: johanna.hess
     groups:
       - projekte
       - team
     password: '20_j0h4nn4_h3ss-24+'
 
-  - name: johanna.ruekgauer
-    groups:
-      - projekte
-    password: '20.j0hanna.ru3kgau3r+24!'
+#  - name: johanna.ruekgauer
+#    groups:
+#      - projekte
+#    password: '20.j0hanna.ru3kgau3r+24!'
 
 #  - name: laura.sasse
 #    groups:
@@ -426,10 +431,10 @@ samba_user:
       - team
     password: '20.l1no-ko3hl3r_25/'
 
-  - name: maite.gabriel
-    groups:
-      - projekte
-    password: '20+m4ite.g4briel-24+'
+#  - name: maite.gabriel
+#    groups:
+#      - projekte
+#    password: '20+m4ite.g4briel-24+'
 
   - name: malte.taeubrich
     groups:
@@ -469,10 +474,10 @@ samba_user:
 #      - projekte
 #    password: '20.ros1tsa-mahd1+24+'
 
-  - name: selma.albrecht
-    groups:
-      - projekte
-    password: '20-sel-ma.al-brecht/25!'
+#  - name: selma.albrecht
+#    groups:
+#      - projekte
+#    password: '20-sel-ma.al-brecht/25!'
 
   - name: sarah.klemm
     groups:
@@ -482,26 +487,27 @@ samba_user:
       - verwaltung
     password: '20.s4r4h_kl3mm-24!'
 
-  - name: selma.albrecht
-    groups:
-      - projekte
-    password: '20-sel-ma.al-brecht/25!'
-
   - name: scan
     groups:
       - team
     password: '20-sc4n.25!'
 
+  - name: sarah.ruege
+    groups:
+      - projekte
+      - team
+    password: '20.s4r4hRu3g3-26&'
+
 #  - name: sebastian.scheele
 #    groups:
 #      - projekte
 #      - team
 #    password: '20/s3-bast1an+sch33l3_24-'
 
-  - name: simon.krugmann
-    groups:
-      - projekte
-    password: '20%sim0n.krugm4nn.24?'
+#  - name: simon.krugmann
+#    groups:
+#      - projekte
+#    password: '20%sim0n.krugm4nn.24?'
 
   - name: tabea.koepp
     groups:
@@ -523,6 +529,12 @@ samba_user:
       - verwaltung
     password: '20+ull4_w1tt3nz3lln3r_24-'
 
+  - name: yan.friedrichs
+    groups:
+      - projekte
+      - team
+    password: '20_Y4nFr13dr1chs.26%'
+
   - name: yannik.markhof
     groups:
       - projekte
@@ -533,11 +545,12 @@ base_home: /data/home
 
 samba_homes_virusfilter: true
 
-remove_samba_users: []
-# remove_samba_users:
-#  - name: sebastian.scheele
-#  - name: rositsa.mahdi
-#  - name: laura.sasse
+#remove_samba_users: []
+remove_samba_users:
+ - name: johanna.ruekgauer
+ - name: maite.gabriel
+ - name: selma.albrecht
+ - name: simon.krugmann
 
 samba_shares:
 

host_vars/mm-irights.oopen.de/mm-irights-ipt-server.yml

@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "157.90.140.169"
+fw_ext_ips_v6:
+  - "2a01:4f8:2220:37c3::169"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip

host_vars/mm-nd.oopen.de/mm-nd-common.yml

@@ -171,6 +171,24 @@ cron_user_entries:
 # vars used by roles/common/tasks/webadmin-user.yml
 # ---
 
+extra_user:
+
+  - name: nd-admin
+    user_id: 1045
+    group_id: 1045
+    group: nd-admin
+    password: $y$j9T$1YJwHY0qdLimgtdOKlTxR1$/O9QWTpr0Y41TduR2GZ0FMCiIxFqOaXWSM9hmHRnv80
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTjd4XFBdF/V9VdSZjy9G7nupBwaMqsrtQSP4Uctkrz org@rdsgn.de'
+
+sudo_users:
+  - chris
+  - sysadm
+  - nd-admin
+
 
 # ---
 # vars used by roles/common/tasks/sudoers.yml

host_vars/mm-nd.oopen.de/mm-nd-ipt-server.yml

@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "135.181.239.139"
+fw_ext_ips_v6:
+  - "2a01:4f9:3080:3d2d::139"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip

host_vars/mm-rav.oopen.de/mm-rav-ipt-server.yml

@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "95.217.194.17"
+fw_ext_ips_v6:
+  - "2a01:4f9:4a:5114::17"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip

host_vars/mm.oopen.de/mm-ipt-server.yml

@@ -0,0 +1,41 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "159.69.74.147"
+fw_ext_ips_v6:
+  - "2a01:4f8:231:19a7::147"
+fw_local_interfaces:
+  - "eth1"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Outgoing / interfaces
+fw_unprotected_ifs: eth1
+
+# --- Access control IPv4
+fw_allow_local_service_v4: "8065:tcp"
+
+# --- Access control IPv6
+fw_allow_local_service_v6: "8065:tcp"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- Mattermost
+fw_mm_server_ips: $ext_1_ip
+
+# --- Protection / limits
+fw_limit_connections_per_source_IP: false

host_vars/o45.oopen.de/o45-ipt-server.yml

@@ -32,5 +32,4 @@ fw_do_not_firewall_lx_guest_systems: true
 
 # --- Forwarding
 fw_kernel_activate_forwarding: true
-fw_kernel_forward_between_interfaces: true
-
+fw_kernel_forward_between_interfaces: true

roles/common/tasks/fix-ifupdown-resolved-hook.yml

@@ -0,0 +1,75 @@
+---
+# Workaround für einen ifupdown-Paketbug: /etc/network/if-up.d/resolved verwendet
+# "return" auf oberster Ebene, was unter dash/bash fehlschlägt, wenn das Skript
+# von run-parts direkt ausgeführt (nicht gesourced) wird. Das lässt "ifup"/
+# "systemctl restart networking" abbrechen, bevor Interfaces konfiguriert werden.
+#
+# Betroffen nur, wenn:
+#  - das Paket ifupdown installiert ist, UND
+#  - die Datei /etc/network/if-up.d/resolved existiert (d.h. systemd-resolved-
+#    Integration von ifupdown vorhanden)
+
+- name: ifupdown resolved-Hook prüfen und ggf. patchen (return-Bug)
+  tags:
+    - fix-ifupdown-resolved-hook
+  block:
+    - name: Paketfakten einlesen (für ifupdown-Check)
+      ansible.builtin.package_facts:
+        manager: apt
+
+    - name: Vorhandensein von /etc/network/if-up.d/resolved prüfen
+      ansible.builtin.stat:
+        path: /etc/network/if-up.d/resolved
+      register: _ifupdown_resolved_hook
+
+    # Benötigt das Ansible-Modul community.general.dpkg_divert aus der
+    # Collection "community.general" (nicht Teil von ansible-core). Da es bei
+    # euch keine requirements.yml gibt, muss die Collection einmalig manuell
+    # auf der Ansible-Control-Node installiert werden:
+    #
+    #   ansible-galaxy collection install community.general
+    #
+    # Kontrolle, ob/welche Version bereits vorhanden ist:
+    #
+    #   ansible-galaxy collection list community.general
+    #
+    # Empfehlung: Sobald eine requirements.yml existiert, dort ergänzen:
+    #
+    #   collections:
+    #     - name: community.general
+    #
+    # und künftig per "ansible-galaxy collection install -r requirements.yml"
+    # installieren/aktualisieren, statt manuell.
+    - name: ifupdown resolved-Hook divertieren und patchen
+      when:
+        - "'ifupdown' in ansible_facts.packages"
+        - _ifupdown_resolved_hook.stat.exists
+      block:
+        - name: Originaldatei divertieren (dpkg-divert --rename --add)
+          community.general.dpkg_divert:
+            path: /etc/network/if-up.d/resolved
+            state: present
+            rename: true
+          register: _resolved_hook_divert
+
+        - name: Divertierte Version an Originalpfad kopieren (nur beim ersten Lauf)
+          ansible.builtin.copy:
+            src: /etc/network/if-up.d/resolved.distrib
+            dest: /etc/network/if-up.d/resolved
+            remote_src: true
+            force: false
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: "Bugfix: return -> exit 0 (Fall 'interface leer')"
+          ansible.builtin.replace:
+            path: /etc/network/if-up.d/resolved
+            regexp: '(if \[ ! "\$interface" \]; then\n\s*)return(\n\s*fi)'
+            replace: '\1exit 0\2'
+
+        - name: "Bugfix: return -> exit 0 (Fall 'interface = lo')"
+          ansible.builtin.replace:
+            path: /etc/network/if-up.d/resolved
+            regexp: '(if \[ "\$interface" = "lo" \]; then\n\s*)return(\n\s*fi)'
+            replace: '\1exit 0\2'

roles/common/tasks/main.yml

@@ -35,6 +35,21 @@
     - ansible_facts['distribution'] == "Debian"
   tags: apt
 
+# Workaround für einen ifupdown-Paketbug: /etc/network/if-up.d/resolved verwendet
+# "return" auf oberster Ebene, was unter dash/bash fehlschlägt, wenn das Skript
+# von run-parts direkt ausgeführt (nicht gesourced) wird. Das lässt "ifup"/
+# "systemctl restart networking" abbrechen, bevor Interfaces konfiguriert werden.
+#
+# Betroffen nur, wenn:
+#  - das Paket ifupdown installiert ist, UND
+#  - die Datei /etc/network/if-up.d/resolved existiert (d.h. systemd-resolved-
+#    Integration von ifupdown vorhanden)
+
+- name: Fix ifupdown resolved-Hook (return-Bug)
+  ansible.builtin.include_tasks: fix-ifupdown-resolved-hook.yml
+  tags:
+    - fix-ifupdown-resolved-hook
+
 # tags supported inside extrepo.yml
 #
 #   extrepo