automate all the things

inventory.yaml

@@ -28,4 +28,5 @@ all:
         bitwarden:
         nexus:
         nextcloud:
+        neko:
 ...

roles/neko/defaults/main.yaml

@@ -0,0 +1,4 @@
+---
+datadog:
+  apikey: ""
+...

roles/neko/files/certbot

@@ -0,0 +1,4 @@
+#! /bin/bash
+systemctl stop haproxy
+certbot renew --standalone --cert-name neko.tormakristof.eu
+systemctl start haproxy

roles/neko/files/datadog.list

@@ -0,0 +1 @@
+deb [signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg] https://apt.datadoghq.com/ stable 7

roles/neko/files/haproxy.cfg

@@ -0,0 +1,55 @@
+global
+        log /dev/log    local0
+        log /dev/log    local1 notice
+        chroot /var/lib/haproxy
+        stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
+        stats timeout 30s
+        user haproxy
+        group haproxy
+        daemon
+
+        # Default SSL material locations
+        ca-base /etc/ssl/certs
+        crt-base /etc/ssl/private
+
+        # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
+        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
+
+defaults
+        log     global
+        mode    http
+        option  httplog
+        option  dontlognull
+        timeout connect 5000
+        timeout client  50000
+        timeout server  50000
+        errorfile 400 /etc/haproxy/errors/400.http
+        errorfile 403 /etc/haproxy/errors/403.http
+        errorfile 408 /etc/haproxy/errors/408.http
+        errorfile 500 /etc/haproxy/errors/500.http
+        errorfile 502 /etc/haproxy/errors/502.http
+        errorfile 503 /etc/haproxy/errors/503.http
+        errorfile 504 /etc/haproxy/errors/504.http
+
+frontend http-in
+   bind *:80
+   mode http
+   redirect scheme https code 301
+
+frontend https-front
+   bind :443
+   mode tcp
+   use_backend https-back
+
+backend https-back
+   mode tcp
+   balance roundrobin
+   server docker 127.0.0.1:8080 check
+
+listen stats # Define a listen section called "stats"
+        bind 127.0.0.1:9000 # Listen on localhost:9000
+        mode http
+        stats enable  # Enable stats page
+        stats uri /haproxy_stats  # Stats URI

roles/neko/tasks/main.yaml

@@ -6,6 +6,14 @@
     name:
      - haproxy
 
+- name: Copy haproxy configuration
+  copy:
+    src: haproxy.cfg
+    dest: /etc/haproxy/haproxy.cfg
+    mode: 0644
+    owner: root
+    group: root
+
 - name: Enable haproxy
   service:
     name: haproxy
@@ -19,6 +27,18 @@
     name:
      - python3-certbot
 
+- name: Generate certificate for all proxied domains
+  command:
+    cmd: certbot certonly --non-interactive --agree-tos -m tormakristof@tormakristof.eu --nginx -d neko.tormakristof.eu
+
+- name: Copy certbot cronjob
+  copy:
+    src: certbot
+    dest: /etc/cron.weekly/certbot
+    mode: 0755
+    owner: root
+    group: root
+
 - name: Reset ufw rules to default
   community.general.ufw:
     state: reset
@@ -26,4 +46,27 @@
 - name: Enable ufw
   community.general.ufw:
     state: enabled
+
+- name: Copy datadog repo config
+  copy:
+    src: datadog.list
+    dest: /etc/apt/sources.list.d/datadog.list
+    mode: 0655
+    owner: root
+    group: root
+
+- name: "Install datadog-agent"
+  apt:
+    update_cache: yes
+    state: present
+    name:
+      - datadog-agent
+
+- name: "Generate datadog configuration"
+  ansible.builtin.template:
+    src: datadog.yaml
+    dest: /etc/datadog-agnet/datadog.yaml
+    owner: dd-agent
+    group: dd-agent
+    mode: '0640'
 ...

roles/openvpn/tasks/main.yaml

@@ -14,14 +14,36 @@
     state: present
     reload: yes
 
-- name: Upload openvpn config to server
-  ansible.posix.synchronize:
-    src: openvpn-config
-    dest: /etc/openvpn/server
-
 - name: Enable and restart openvpn daemon
   service:
     name: openvpn
     state: restarted
     enabled: yes
+
+- name: Check if AllowUsers is defined
+  lineinfile:
+    state: absent
+    path: /etc/ufw/before.rules
+    regexp: "^# START OPENVPN"
+  check_mode: true
+  changed_when: false
+  register: checkufwrules
+
+- name: Insert openvpn iptables rules
+  blockinfile:
+    path: /etc/ufw/before.rules
+    block: |
+      # START OPENVPN RULES
+      # NAT table rules
+      *nat
+      :POSTROUTING ACCEPT [0:0]
+      # Allow traffic from OpenVPN client to everywhere
+      -A POSTROUTING -s 192.168.37.0/24 -o eth0 -j MASQUERADE
+      -A POSTROUTING -s 192.168.37.0/24 -o eth2 -j MASQUERADE
+      COMMIT
+      # END OPENVPN RULES
+
+- name: Reload ufw
+  community.general.ufw:
+    state: reloaded
 ...