From 42189ba6136f53b25b279b02d1a236395f311347 Mon Sep 17 00:00:00 2001 From: Ludovic Poujol Date: Tue, 17 Aug 2021 16:38:02 +0200 Subject: [PATCH 001/125] Configure php7.4 for evoadmin-web on bullseye --- webapps/evoadmin-web/tasks/web.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/webapps/evoadmin-web/tasks/web.yml b/webapps/evoadmin-web/tasks/web.yml index 7f95c96c..9778da4e 100644 --- a/webapps/evoadmin-web/tasks/web.yml +++ b/webapps/evoadmin-web/tasks/web.yml @@ -27,6 +27,15 @@ notify: reload apache2 when: ansible_distribution_major_version is version('10', '=') +- name: "Set custom values for PHP config (Debian 11)" + ini_file: + dest: /etc/php/7.4/apache2/conf.d/zzz-evolinux-custom.ini + section: PHP + option: "disable_functions" + value: "shell-exec,system,passthru,putenv,popen" + notify: reload apache2 + when: ansible_distribution_major_version is version('11', '=') + - name: Install evoadmin VHost template: src: "{{ item }}" From bd92ff95c8c6381fddd78aa0965fd9389a34b452 Mon Sep 17 00:00:00 2001 From: Eric Morino Date: Fri, 20 Aug 2021 11:32:16 +0200 Subject: [PATCH 002/125] use absolute path in evacme cron --- evoacme/files/evoacme.cron | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/evoacme/files/evoacme.cron b/evoacme/files/evoacme.cron index 4d849673..ea78f2c2 100755 --- a/evoacme/files/evoacme.cron +++ b/evoacme/files/evoacme.cron @@ -15,12 +15,12 @@ find "${CRT_DIR}" \ -maxdepth 1 \ -mindepth 1 \ -type d \ - ! -path "*accounts" \ - ! -path "*archive" \ - ! -path "*csr" \ - ! -path "*hooks" \ - ! -path "*keys" \ - ! -path "*live" \ - ! -path "*renewal" \ + ! -path "${CRT_DIR}/accounts" \ + ! -path "${CRT_DIR}/archive" \ + ! -path "${CRT_DIR}/csr" \ + ! -path "${CRT_DIR}/hooks" \ + ! -path "${CRT_DIR}/keys" \ + ! -path "${CRT_DIR}/live" \ + ! -path "${CRT_DIR}/renewal" \ -printf "%f\n" \ | xargs --max-args=1 --no-run-if-empty evoacme From 5a83a30a4c0149e4e0a8cb08381b4a7c3d6f8b8b Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Tue, 24 Aug 2021 18:16:11 +0200 Subject: [PATCH 003/125] whitespace --- evolinux-base/tasks/hardware.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/evolinux-base/tasks/hardware.yml b/evolinux-base/tasks/hardware.yml index 9f0c6da3..7fa04a70 100644 --- a/evolinux-base/tasks/hardware.yml +++ b/evolinux-base/tasks/hardware.yml @@ -35,8 +35,8 @@ # HP gen <10: Hewlett-Packard Company Smart Array # HP gen >=10: Adaptec Smart Storage PQI - name: Detect if RAID is installed - shell: - cmd: "set -o pipefail && lspci -q | grep -e 'RAID bus controller' -e 'Serial Attached SCSI controller'" + shell: + cmd: "lspci -q | grep -e 'RAID bus controller' -e 'Serial Attached SCSI controller'" executable: /bin/bash check_mode: no register: raidmodel From 916138575a24c7b7e83badf8f3311705da8fc485 Mon Sep 17 00:00:00 2001 From: Eric Morino Date: Wed, 25 Aug 2021 11:48:10 +0200 Subject: [PATCH 004/125] Add generate dhparam and update variables for dovecot 2.3 --- dovecot/tasks/main.yml | 4 ++++ dovecot/templates/z-evolinux-defaults.conf.j2 | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/dovecot/tasks/main.yml b/dovecot/tasks/main.yml index aa817086..7558afd5 100644 --- a/dovecot/tasks/main.yml +++ b/dovecot/tasks/main.yml @@ -10,6 +10,10 @@ tags: - dovecot +- name: Generate Diffie-Hellman parameters with the default size (4096 bits) + openssl_dhparam: + path: /etc/ssl/dhparams.pem + - name: disable pam auth replace: dest: /etc/dovecot/conf.d/10-auth.conf diff --git a/dovecot/templates/z-evolinux-defaults.conf.j2 b/dovecot/templates/z-evolinux-defaults.conf.j2 index 2c067b99..ab74ec0d 100644 --- a/dovecot/templates/z-evolinux-defaults.conf.j2 +++ b/dovecot/templates/z-evolinux-defaults.conf.j2 @@ -38,9 +38,9 @@ mail_max_userip_connections = 42 # SSL/TLS ssl = yes ssl_prefer_server_ciphers = yes -ssl_dh_parameters_length = 2048 +ssl_dh= Date: Wed, 25 Aug 2021 11:52:10 +0200 Subject: [PATCH 005/125] Add "may take several minutes" for task generate dhparam --- dovecot/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dovecot/tasks/main.yml b/dovecot/tasks/main.yml index 7558afd5..efe0644e 100644 --- a/dovecot/tasks/main.yml +++ b/dovecot/tasks/main.yml @@ -10,7 +10,7 @@ tags: - dovecot -- name: Generate Diffie-Hellman parameters with the default size (4096 bits) +- name: Generate Diffie-Hellman parameters with the default size 4096 bits (may take several minutes) openssl_dhparam: path: /etc/ssl/dhparams.pem From 2c7380240cc5ef2a6e900db12bf1848f12407e2f Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Wed, 25 Aug 2021 10:43:02 +0200 Subject: [PATCH 006/125] nagios-nrpe + evolinux-users: new checks for bkctld --- CHANGELOG.md | 1 + evolinux-users/templates/sudoers_jessie.j2 | 2 ++ evolinux-users/templates/sudoers_stretch.j2 | 2 ++ nagios-nrpe/templates/evolix.cfg.j2 | 3 +++ 4 files changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 930d2696..853cfbfd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,7 @@ The **patch** part changes incrementally at each release. * listupgrade: crontab is configurable * mongodb: create munin plugins directory if missing * mysql: script "mysql_connections" to display a compact list of connections +* nagios-nrpe + evolinux-users: new checks for bkctld * redis: instance service for Debian 11 ### Changed diff --git a/evolinux-users/templates/sudoers_jessie.j2 b/evolinux-users/templates/sudoers_jessie.j2 index b82c67ac..c0703c49 100644 --- a/evolinux-users/templates/sudoers_jessie.j2 +++ b/evolinux-users/templates/sudoers_jessie.j2 @@ -7,6 +7,8 @@ nagios ALL = NOPASSWD: /usr/lib/nagios/plugins/check_procs nagios ALL = NOPASSWD: /usr/local/lib/nagios/plugins/check_minifirewall nagios ALL = NOPASSWD: /usr/local/lib/nagios/plugins/check_haproxy_stats nagios ALL = NOPASSWD: /usr/sbin/bkctld check +nagios ALL = NOPASSWD: /usr/sbin/bkctld check-jails +nagios ALL = NOPASSWD: /usr/sbin/bkctld check-setup nagios ALL = (clamav) NOPASSWD: /usr/bin/clamscan /tmp/safe.txt ADMINS ALL = (ALL:ALL) ALL diff --git a/evolinux-users/templates/sudoers_stretch.j2 b/evolinux-users/templates/sudoers_stretch.j2 index 539f871e..7874a19a 100644 --- a/evolinux-users/templates/sudoers_stretch.j2 +++ b/evolinux-users/templates/sudoers_stretch.j2 @@ -6,6 +6,8 @@ nagios ALL = NOPASSWD: /usr/lib/nagios/plugins/check_procs nagios ALL = NOPASSWD: /usr/local/lib/nagios/plugins/check_minifirewall nagios ALL = NOPASSWD: /usr/local/lib/nagios/plugins/check_haproxy_stats nagios ALL = NOPASSWD: /usr/sbin/bkctld check +nagios ALL = NOPASSWD: /usr/sbin/bkctld check-jails +nagios ALL = NOPASSWD: /usr/sbin/bkctld check-setup nagios ALL = NOPASSWD: /usr/local/lib/nagios/plugins/check_phpfpm_multi /var/lib/lxc/php56/rootfs/etc/php5/fpm/pool.d/ nagios ALL = NOPASSWD: /usr/local/lib/nagios/plugins/check_phpfpm_multi /var/lib/lxc/php70/rootfs/etc/php/7.0/fpm/pool.d/ nagios ALL = NOPASSWD: /usr/local/lib/nagios/plugins/check_phpfpm_multi /var/lib/lxc/php73/rootfs/etc/php/7.3/fpm/pool.d/ diff --git a/nagios-nrpe/templates/evolix.cfg.j2 b/nagios-nrpe/templates/evolix.cfg.j2 index 7306b9cb..148314ab 100644 --- a/nagios-nrpe/templates/evolix.cfg.j2 +++ b/nagios-nrpe/templates/evolix.cfg.j2 @@ -51,6 +51,9 @@ command[check_ssl]=/usr/lib/nagios/plugins/check_http -f follow -I 127.0.0.1 -S command[check_elasticsearch]=/usr/lib/nagios/plugins/check_http -I 127.0.0.1 -u /_cat/health?h=st -p 9200 -r 'red' --invert-regex command[check_memcached]=/usr/lib/nagios/plugins/check_tcp -H 127.0.0.1 -p 11211 command[check_opendkim]=/usr/lib/nagios/plugins/check_tcp -H 127.0.0.1 -p 54321 +command[check_bkctld_setup]=sudo /usr/sbin/bkctld check-setup +command[check_bkctld_jails]=sudo /usr/sbin/bkctld check-jails +# "check_bkctld" is here as backward compatibility, but is replaced by "check_bkctld_jails" command[check_bkctld]=sudo /usr/sbin/bkctld check command[check_postgrey]=/usr/lib/nagios/plugins/check_tcp -p10023 From ecba57ad75a8fbe71913296595ee0a3218d78883 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Wed, 25 Aug 2021 17:57:38 +0200 Subject: [PATCH 007/125] evolinux-base: install molly-guard by default --- CHANGELOG.md | 1 + evolinux-base/tasks/packages.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 853cfbfd..f14be146 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ The **patch** part changes incrementally at each release. * Preliminary support for Debian 11 « Bullseye » * apache: new variable for mpm mode (+ updated default config accordingly) * certbot: add script for manual deploy hooks execution +* evolinux-base: install molly-guard by default * listupgrade: crontab is configurable * mongodb: create munin plugins directory if missing * mysql: script "mysql_connections" to display a compact list of connections diff --git a/evolinux-base/tasks/packages.yml b/evolinux-base/tasks/packages.yml index 8df64abd..9d9a6d6a 100644 --- a/evolinux-base/tasks/packages.yml +++ b/evolinux-base/tasks/packages.yml @@ -34,6 +34,7 @@ - telnet - traceroute - man + - molly-guard when: evolinux_packages_diagnostic | bool - name: Install/Update hardware tools From 6c21c3b505b5719d2c1b2df1a4bbd71acbe13944 Mon Sep 17 00:00:00 2001 From: Eric Morino Date: Thu, 26 Aug 2021 09:51:09 +0200 Subject: [PATCH 008/125] Add configuration for listener stats write and read with correct right --- dovecot/templates/z-evolinux-defaults.conf.j2 | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/dovecot/templates/z-evolinux-defaults.conf.j2 b/dovecot/templates/z-evolinux-defaults.conf.j2 index ab74ec0d..74081a57 100644 --- a/dovecot/templates/z-evolinux-defaults.conf.j2 +++ b/dovecot/templates/z-evolinux-defaults.conf.j2 @@ -35,6 +35,21 @@ service login { } mail_max_userip_connections = 42 +# Configuration pour stats dovecot +service stats { + unix_listener stats-reader { + user = vmail + group = vmail + mode = 0660 + } + + unix_listener stats-writer { + user = vmail + group = vmail + mode = 0660 + } +} + # SSL/TLS ssl = yes ssl_prefer_server_ciphers = yes From 5e794cd2b6e26f6b18c38af7e2868a31ab20e850 Mon Sep 17 00:00:00 2001 From: Gregory Colpart Date: Thu, 26 Aug 2021 11:42:02 +0200 Subject: [PATCH 009/125] commit whitespace --- evolinux-base/files/logs/logrotate.disabled/ldap | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/evolinux-base/files/logs/logrotate.disabled/ldap b/evolinux-base/files/logs/logrotate.disabled/ldap index 59372a33..4be35fa8 100644 --- a/evolinux-base/files/logs/logrotate.disabled/ldap +++ b/evolinux-base/files/logs/logrotate.disabled/ldap @@ -2,8 +2,8 @@ weekly missingok rotate 3 - compress - notifempty + compress + notifempty create 640 root adm } From d2ef3fe27f6718b220768e22c85869315bb57d7e Mon Sep 17 00:00:00 2001 From: Eric Morino Date: Fri, 27 Aug 2021 10:50:11 +0200 Subject: [PATCH 010/125] Fix syntax on task "plugins are installed for" --- rbenv/tasks/main.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/rbenv/tasks/main.yml b/rbenv/tasks/main.yml index 08f8242e..de366e78 100644 --- a/rbenv/tasks/main.yml +++ b/rbenv/tasks/main.yml @@ -68,8 +68,7 @@ version: '{{ item.version }}' accept_hostkey: yes force: yes - loop: - - "{{ rbenv_plugins }}" + loop: "{{ rbenv_plugins }}" become_user: "{{ username }}" become: yes tags: From 74ab96d67fba699b334b6e90ffb1197dcc797c3f Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Fri, 27 Aug 2021 11:01:26 +0200 Subject: [PATCH 011/125] loop syntax and whitespaces --- clamav/tasks/main.yml | 106 +++++++++++++-------------- evolinux-base/tasks/kernel.yml | 8 +- evolinux-base/tasks/system.yml | 8 +- java/tasks/oracle.yml | 6 +- kvm-host/tasks/ssh.yml | 6 +- lxc-solr/tasks/main.yml | 6 +- opendkim/tasks/main.yml | 4 +- postfix/tasks/packmail.yml | 44 +++++------ postgresql/tasks/munin.yml | 10 +-- postgresql/tasks/packages_jessie.yml | 6 +- redmine/tasks/config.yml | 6 +- vrrpd/tasks/main.yml | 12 +-- webapps/evoadmin-web/tasks/user.yml | 6 +- 13 files changed, 111 insertions(+), 117 deletions(-) diff --git a/clamav/tasks/main.yml b/clamav/tasks/main.yml index be9e5b00..6d1da3eb 100644 --- a/clamav/tasks/main.yml +++ b/clamav/tasks/main.yml @@ -6,48 +6,48 @@ value: "{{ item.value }}" vtype: "{{ item.type }}" loop: - - { key: 'clamav-daemon/debconf', type: 'boolean', value: 'true' } - - { key: 'clamav-daemon/MaxHTMLNormalize', type: 'string', value: '10M' } - - { key: 'clamav-daemon/StatsPEDisabled', type: 'boolean', value: 'true' } - - { key: 'clamav-daemon/FollowDirectorySymlinks', type: 'boolean', value: 'false' } - - { key: 'clamav-daemon/StreamMaxLength', type: 'string', value: '25' } - - { key: 'clamav-daemon/ReadTimeout', type: 'string', value: '180' } - - { key: 'clamav-daemon/StatsEnabled', type: 'boolean', value: 'false' } - - { key: 'clamav-daemon/MaxConnectionQueueLength', type: 'string', value: '15' } - - { key: 'clamav-daemon/LogRotate', type: 'boolean', value: 'true' } - - { key: 'clamav-daemon/AllowAllMatchScan', type: 'boolean', value: 'true' } - - { key: 'clamav-daemon/ScanOnAccess', type: 'boolean', value: 'false' } - - { key: 'clamav-daemon/LogFile', type: 'string', value: '/var/log/clamav/clamav.log' } - - { key: 'clamav-daemon/ScanMail', type: 'boolean', value: 'true' } - - { key: 'clamav-daemon/BytecodeTimeout', type: 'string', value: '60000' } - - { key: 'clamav-daemon/LogTime', type: 'boolean', value: 'true' } - - { key: 'clamav-daemon/OnAccessMaxFileSize', type: 'string', value: '5M' } - - { key: 'clamav-daemon/TcpOrLocal', type: 'select', value: 'UNIX' } - - { key: 'clamav-daemon/MaxEmbeddedPE', type: 'string', value: '10M' } - - { key: 'clamav-daemon/FixStaleSocket', type: 'boolean', value: 'true' } - - { key: 'clamav-daemon/User', type: 'string', value: 'clamav' } - - { key: 'clamav-daemon/BytecodeSecurity', type: 'select', value: 'TrustSigned' } - - { key: 'clamav-daemon/ScanSWF', type: 'boolean', value: 'true' } - - { key: 'clamav-daemon/MaxDirectoryRecursion', type: 'string', value: '0' } - - { key: 'clamav-daemon/MaxThreads', type: 'string', value: '12' } - - { key: 'clamav-daemon/LocalSocketGroup', type: 'string', value: 'clamav' } - - { key: 'clamav-daemon/MaxScriptNormalize', type: 'string', value: '5M' } - - { key: 'clamav-daemon/ForceToDisk', type: 'boolean', value: 'false' } - - { key: 'clamav-daemon/StatsHostID', type: 'string', value: 'auto' } - - { key: 'clamav-daemon/FollowFileSymlinks', type: 'boolean', value: 'false' } - - { key: 'clamav-daemon/TCPSocket', type: 'string', value: '3310' } - - { key: 'clamav-daemon/TCPAddr', type: 'string', value: 'any' } - - { key: 'clamav-daemon/DisableCertCheck', type: 'boolean', value: 'false' } - - { key: 'clamav-daemon/SelfCheck', type: 'string', value: '3600' } - - { key: 'clamav-daemon/LocalSocket', type: 'string', value: '/var/run/clamav/clamd.ctl' } - - { key: 'clamav-daemon/LocalSocketMode', type: 'string', value: '666' } - - { key: 'clamav-daemon/StatsTimeout', type: 'string', value: '10' } - - { key: 'clamav-daemon/MaxZipTypeRcg', type: 'string', value: '1M' } - - { key: 'clamav-daemon/MaxHTMLNoTags', type: 'string', value: '2M' } - - { key: 'clamav-daemon/LogSyslog', type: 'boolean', value: 'false' } - - { key: 'clamav-daemon/AddGroups', type: 'string', value: '' } - - { key: 'clamav-daemon/Bytecode', type: 'boolean', value: 'true' } - - { key: 'clamav-daemon/ScanArchive', type: 'boolean', value: 'true' } + - { key: 'clamav-daemon/debconf', type: 'boolean', value: 'true' } + - { key: 'clamav-daemon/MaxHTMLNormalize', type: 'string', value: '10M' } + - { key: 'clamav-daemon/StatsPEDisabled', type: 'boolean', value: 'true' } + - { key: 'clamav-daemon/FollowDirectorySymlinks', type: 'boolean', value: 'false' } + - { key: 'clamav-daemon/StreamMaxLength', type: 'string', value: '25' } + - { key: 'clamav-daemon/ReadTimeout', type: 'string', value: '180' } + - { key: 'clamav-daemon/StatsEnabled', type: 'boolean', value: 'false' } + - { key: 'clamav-daemon/MaxConnectionQueueLength', type: 'string', value: '15' } + - { key: 'clamav-daemon/LogRotate', type: 'boolean', value: 'true' } + - { key: 'clamav-daemon/AllowAllMatchScan', type: 'boolean', value: 'true' } + - { key: 'clamav-daemon/ScanOnAccess', type: 'boolean', value: 'false' } + - { key: 'clamav-daemon/LogFile', type: 'string', value: '/var/log/clamav/clamav.log' } + - { key: 'clamav-daemon/ScanMail', type: 'boolean', value: 'true' } + - { key: 'clamav-daemon/BytecodeTimeout', type: 'string', value: '60000' } + - { key: 'clamav-daemon/LogTime', type: 'boolean', value: 'true' } + - { key: 'clamav-daemon/OnAccessMaxFileSize', type: 'string', value: '5M' } + - { key: 'clamav-daemon/TcpOrLocal', type: 'select', value: 'UNIX' } + - { key: 'clamav-daemon/MaxEmbeddedPE', type: 'string', value: '10M' } + - { key: 'clamav-daemon/FixStaleSocket', type: 'boolean', value: 'true' } + - { key: 'clamav-daemon/User', type: 'string', value: 'clamav' } + - { key: 'clamav-daemon/BytecodeSecurity', type: 'select', value: 'TrustSigned' } + - { key: 'clamav-daemon/ScanSWF', type: 'boolean', value: 'true' } + - { key: 'clamav-daemon/MaxDirectoryRecursion', type: 'string', value: '0' } + - { key: 'clamav-daemon/MaxThreads', type: 'string', value: '12' } + - { key: 'clamav-daemon/LocalSocketGroup', type: 'string', value: 'clamav' } + - { key: 'clamav-daemon/MaxScriptNormalize', type: 'string', value: '5M' } + - { key: 'clamav-daemon/ForceToDisk', type: 'boolean', value: 'false' } + - { key: 'clamav-daemon/StatsHostID', type: 'string', value: 'auto' } + - { key: 'clamav-daemon/FollowFileSymlinks', type: 'boolean', value: 'false' } + - { key: 'clamav-daemon/TCPSocket', type: 'string', value: '3310' } + - { key: 'clamav-daemon/TCPAddr', type: 'string', value: 'any' } + - { key: 'clamav-daemon/DisableCertCheck', type: 'boolean', value: 'false' } + - { key: 'clamav-daemon/SelfCheck', type: 'string', value: '3600' } + - { key: 'clamav-daemon/LocalSocket', type: 'string', value: '/var/run/clamav/clamd.ctl' } + - { key: 'clamav-daemon/LocalSocketMode', type: 'string', value: '666' } + - { key: 'clamav-daemon/StatsTimeout', type: 'string', value: '10' } + - { key: 'clamav-daemon/MaxZipTypeRcg', type: 'string', value: '1M' } + - { key: 'clamav-daemon/MaxHTMLNoTags', type: 'string', value: '2M' } + - { key: 'clamav-daemon/LogSyslog', type: 'boolean', value: 'false' } + - { key: 'clamav-daemon/AddGroups', type: 'string', value: '' } + - { key: 'clamav-daemon/Bytecode', type: 'boolean', value: 'true' } + - { key: 'clamav-daemon/ScanArchive', type: 'boolean', value: 'true' } tags: - clamav @@ -58,17 +58,17 @@ value: "{{ item.value }}" vtype: "{{ item.type }}" loop: - - { key: 'clamav-freshclam/autoupdate_freshclam', type: 'select', value: 'daemon' } - - { key: 'clamav-freshclam/proxy_user', type: 'string', value: '' } - - { key: 'clamav-freshclam/NotifyClamd', type: 'boolean', value: 'true' } - - { key: 'clamav-freshclam/local_mirror', type: 'select', value: 'db.fr.clamav.net' } - - { key: 'clamav-freshclam/http_proxy', type: 'string', value: '' } - - { key: 'clamav-freshclam/LogRotate', type: 'boolean', value: 'true' } - - { key: 'clamav-freshclam/Bytecode', type: 'boolean', value: 'true' } - - { key: 'clamav-freshclam/update_interval', type: 'string', value: '24' } - - { key: 'clamav-freshclam/SafeBrowsing', type: 'boolean', value: 'false' } - - { key: 'clamav-freshclam/PrivateMirror', type: 'string', value: '' } - - { key: 'clamav-freshclam/internet_interface', type: 'string', value: '' } + - { key: 'clamav-freshclam/autoupdate_freshclam', type: 'select', value: 'daemon' } + - { key: 'clamav-freshclam/proxy_user', type: 'string', value: '' } + - { key: 'clamav-freshclam/NotifyClamd', type: 'boolean', value: 'true' } + - { key: 'clamav-freshclam/local_mirror', type: 'select', value: 'db.fr.clamav.net' } + - { key: 'clamav-freshclam/http_proxy', type: 'string', value: '' } + - { key: 'clamav-freshclam/LogRotate', type: 'boolean', value: 'true' } + - { key: 'clamav-freshclam/Bytecode', type: 'boolean', value: 'true' } + - { key: 'clamav-freshclam/update_interval', type: 'string', value: '24' } + - { key: 'clamav-freshclam/SafeBrowsing', type: 'boolean', value: 'false' } + - { key: 'clamav-freshclam/PrivateMirror', type: 'string', value: '' } + - { key: 'clamav-freshclam/internet_interface', type: 'string', value: '' } tags: - clamav diff --git a/evolinux-base/tasks/kernel.yml b/evolinux-base/tasks/kernel.yml index b49968f1..6ddeb57f 100644 --- a/evolinux-base/tasks/kernel.yml +++ b/evolinux-base/tasks/kernel.yml @@ -8,8 +8,8 @@ state: present reload: yes loop: - - { name: kernel.panic_on_oops, value: 1 } - - { name: kernel.panic, value: 60 } + - { name: kernel.panic_on_oops, value: 1 } + - { name: kernel.panic, value: 60 } when: evolinux_kernel_reboot_after_panic | bool - name: Don't reboot after panic @@ -19,8 +19,8 @@ state: absent reload: yes loop: - - kernel.panic_on_oops - - kernel.panic + - kernel.panic_on_oops + - kernel.panic when: not evolinux_kernel_reboot_after_panic | bool - name: Disable net.ipv4.tcp_timestamps diff --git a/evolinux-base/tasks/system.yml b/evolinux-base/tasks/system.yml index 554bb02a..486dc2e8 100644 --- a/evolinux-base/tasks/system.yml +++ b/evolinux-base/tasks/system.yml @@ -119,10 +119,10 @@ regexp: "{{ item.regexp }}" replace: "{{ item.replace }}" loop: - - { regexp: '^17((\s*\*){4})', replace: '{{ 59|random(start=1) }}\1' } - - { regexp: '^25\s*6((\s*\*){3})', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1' } - - { regexp: '^47\s*6((\s*\*){2}\s*7)', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1' } - - { regexp: '^52\s*6(\s*1(\s*\*){2})', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1' } + - { regexp: '^17((\s*\*){4})', replace: '{{ 59|random(start=1) }}\1' } + - { regexp: '^25\s*6((\s*\*){3})', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1' } + - { regexp: '^47\s*6((\s*\*){2}\s*7)', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1' } + - { regexp: '^52\s*6(\s*1(\s*\*){2})', replace: '{{ 59|random(start=1) }} {{ [0,1,3,4,5,6,7]|random }}\1' } when: - is_cron_installed.rc == 0 - evolinux_system_cron_random | bool diff --git a/java/tasks/oracle.yml b/java/tasks/oracle.yml index c2ab5ebf..0b057695 100644 --- a/java/tasks/oracle.yml +++ b/java/tasks/oracle.yml @@ -14,9 +14,9 @@ state: directory mode: "0777" loop: - - /srv/java-package - - /srv/java-package/src - - /srv/java-package/tmp + - /srv/java-package + - /srv/java-package/src + - /srv/java-package/tmp tags: - java diff --git a/kvm-host/tasks/ssh.yml b/kvm-host/tasks/ssh.yml index fe71c287..c48722a3 100644 --- a/kvm-host/tasks/ssh.yml +++ b/kvm-host/tasks/ssh.yml @@ -34,8 +34,7 @@ special_time: "hourly" user: root job: "rsync -a --delete /etc/libvirt/qemu/ {{ hostvars[item]['ansible_hostname'] }}:/root/libvirt-{{ inventory_hostname }}/" - loop: - - "{{ groups['hypervisors'] }}" + loop: "{{ groups['hypervisors'] }}" when: item != inventory_hostname - name: Crontab for sync list of running vm @@ -45,6 +44,5 @@ special_time: "daily" user: root job: "virsh list --all | ssh {{ hostvars[item]['ansible_hostname'] }} 'cat >/root/libvirt-{{ inventory_hostname }}/virsh-list.txt'" - loop: - - "{{ groups['hypervisors'] }}" + loop: "{{ groups['hypervisors'] }}" when: item != inventory_hostname diff --git a/lxc-solr/tasks/main.yml b/lxc-solr/tasks/main.yml index 3fad863f..d629bbf6 100644 --- a/lxc-solr/tasks/main.yml +++ b/lxc-solr/tasks/main.yml @@ -8,9 +8,7 @@ path: "/var/lib/lxc/{{ item.name }}/rootfs" state: directory mode: '0755' - loop: - - "{{ lxc_containers }}" + loop: "{{ lxc_containers }}" - include: "solr.yml name={{item.name}} solr_version={{item.solr_version}} solr_port={{item.solr_port}}" - loop: - - "{{ lxc_containers }}" + loop: "{{ lxc_containers }}" diff --git a/opendkim/tasks/main.yml b/opendkim/tasks/main.yml index 1db961e2..94aa3dfd 100644 --- a/opendkim/tasks/main.yml +++ b/opendkim/tasks/main.yml @@ -39,8 +39,8 @@ group: opendkim mode: "0640" loop: - - 'KeyTable' - - 'SigningTable' + - 'KeyTable' + - 'SigningTable' changed_when: False tags: - opendkim diff --git a/postfix/tasks/packmail.yml b/postfix/tasks/packmail.yml index 80f90232..90d424b2 100644 --- a/postfix/tasks/packmail.yml +++ b/postfix/tasks/packmail.yml @@ -38,17 +38,17 @@ dest: "/etc/postfix/{{ item }}" force: no loop: - - virtual - - client.access - - client.access_local - - header_kill - - header_kill_local - - recipient.access - - recipient.access_local - - sa-blacklist.access - - sender.access - - sender.access_local - - spamd.cidr + - virtual + - client.access + - client.access_local + - header_kill + - header_kill_local + - recipient.access + - recipient.access_local + - sa-blacklist.access + - sender.access + - sender.access_local + - spamd.cidr register: postfix_copy_filter tags: - postfix @@ -56,17 +56,17 @@ - name: postmap filter files command: "postmap /etc/postfix/{{ item }}" loop: - - virtual - - client.access - - client.access_local - - header_kill - - header_kill_local - - recipient.access - - recipient.access_local - - sa-blacklist.access - - sender.access - - sender.access_local - - spamd.cidr + - virtual + - client.access + - client.access_local + - header_kill + - header_kill_local + - recipient.access + - recipient.access_local + - sa-blacklist.access + - sender.access + - sender.access_local + - spamd.cidr when: postfix_copy_filter is changed tags: - postfix diff --git a/postgresql/tasks/munin.yml b/postgresql/tasks/munin.yml index 4e62ddf6..ed2cc883 100644 --- a/postgresql/tasks/munin.yml +++ b/postgresql/tasks/munin.yml @@ -15,11 +15,11 @@ src: '/usr/share/munin/plugins/{{item}}' dest: '/etc/munin/plugins/{{item}}' loop: - - postgres_bgwriter - - postgres_checkpoints - - postgres_connections_db - - postgres_users - - postgres_xlog + - postgres_bgwriter + - postgres_checkpoints + - postgres_connections_db + - postgres_users + - postgres_xlog notify: restart munin-node when: etc_munin_plugins.stat.exists and usr_share_munin_plugins.stat.exists diff --git a/postgresql/tasks/packages_jessie.yml b/postgresql/tasks/packages_jessie.yml index cf8f0879..b9f9b31b 100644 --- a/postgresql/tasks/packages_jessie.yml +++ b/postgresql/tasks/packages_jessie.yml @@ -12,6 +12,6 @@ apt: name: '{{item}}' loop: - - "postgresql-{{postgresql_version}}" - - ptop - - libdbd-pg-perl + - "postgresql-{{postgresql_version}}" + - ptop + - libdbd-pg-perl diff --git a/redmine/tasks/config.yml b/redmine/tasks/config.yml index d65f8172..e45bcea5 100644 --- a/redmine/tasks/config.yml +++ b/redmine/tasks/config.yml @@ -7,9 +7,9 @@ owner: "{{ redmine_user }}" group: "{{ redmine_user }}" loop: - - ".config" - - ".config/systemd" - - ".config/systemd/user" + - ".config" + - ".config/systemd" + - ".config/systemd/user" tags: - redmine diff --git a/vrrpd/tasks/main.yml b/vrrpd/tasks/main.yml index 84d4f4ee..74dfa5c2 100644 --- a/vrrpd/tasks/main.yml +++ b/vrrpd/tasks/main.yml @@ -19,11 +19,11 @@ sysctl_set: yes state: present loop: - - { name: 'net.ipv4.conf.default.rp_filter', value: 0 } - - { name: 'net.ipv4.conf.eth0.rp_filter', value: 0 } - - { name: 'net.ipv4.conf.all.rp_filter', value: 0 } - - { name: 'net.ipv4.conf.all.arp_ignore', value: 1 } - - { name: 'net.ipv4.conf.all.arp_announce', value: 2 } - - { name: 'net.ipv4.ip_nonlocal_bind', value: 1 } + - { name: 'net.ipv4.conf.default.rp_filter', value: 0 } + - { name: 'net.ipv4.conf.eth0.rp_filter', value: 0 } + - { name: 'net.ipv4.conf.all.rp_filter', value: 0 } + - { name: 'net.ipv4.conf.all.arp_ignore', value: 1 } + - { name: 'net.ipv4.conf.all.arp_announce', value: 2 } + - { name: 'net.ipv4.ip_nonlocal_bind', value: 1 } tags: - vrrpd diff --git a/webapps/evoadmin-web/tasks/user.yml b/webapps/evoadmin-web/tasks/user.yml index 68ac91de..bbad1b8f 100644 --- a/webapps/evoadmin-web/tasks/user.yml +++ b/webapps/evoadmin-web/tasks/user.yml @@ -38,10 +38,8 @@ regexp: "{{ item.regexp }}" state: present loop: - - line: 'evoadmin: root' - regexp: '^evoadmin:' - - line: 'www-evoadmin: root' - regexp: '^www-evoadmin:' + - { line: 'evoadmin: root', regexp: '^evoadmin:' } + - { line: 'www-evoadmin: root', regexp: '^www-evoadmin:' } notify: "newaliases" when: etc_aliases.stat.exists From 65750d2aa6199d06fe78a089aa9d5ce96c4289f7 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Mon, 30 Aug 2021 09:24:57 +0200 Subject: [PATCH 012/125] evomaintenance: extract a config.yyml tasks file --- CHANGELOG.md | 1 + evomaintenance/tasks/config.yml | 18 ++++++++++++++++++ evomaintenance/tasks/install_vendor_debian.yml | 13 +------------ evomaintenance/tasks/main.yml | 11 ++--------- evomaintenance/tasks/minifirewall.yml | 3 +++ 5 files changed, 25 insertions(+), 21 deletions(-) create mode 100644 evomaintenance/tasks/config.yml diff --git a/CHANGELOG.md b/CHANGELOG.md index f14be146..31ef9b18 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -31,6 +31,7 @@ The **patch** part changes incrementally at each release. * certbot: silence letsencrypt deprecation warnings * elasticsearch: 7.x by default * evoadmin-web: simpler PHP packages lists +* evomaintenance: extract a config.yyml tasks file * evocheck: upstream release 21.07 * evolinux-base: alert5 comes after the network * evolinux-base: force Debian version to buster for Evolix repository (temporary) diff --git a/evomaintenance/tasks/config.yml b/evomaintenance/tasks/config.yml new file mode 100644 index 00000000..097e9770 --- /dev/null +++ b/evomaintenance/tasks/config.yml @@ -0,0 +1,18 @@ +--- + +- assert: + that: + - evomaintenance_api_endpoint is not none + - evomaintenance_api_key is not none + msg: evomaintenance api variables must be set + +- name: Configuration is installed + template: + src: evomaintenance.j2 + dest: /etc/evomaintenance.cf + owner: root + group: root + mode: "0600" + force: "{{ evomaintenance_force_config | bool }}" + tags: + - evomaintenance diff --git a/evomaintenance/tasks/install_vendor_debian.yml b/evomaintenance/tasks/install_vendor_debian.yml index 2faaac79..99448e3c 100644 --- a/evomaintenance/tasks/install_vendor_debian.yml +++ b/evomaintenance/tasks/install_vendor_debian.yml @@ -46,15 +46,4 @@ - { src: 'evomaintenance.sh', dest: '/usr/share/scripts/', mode: '0700' } - { src: 'evomaintenance.tpl', dest: '/usr/share/scripts/', mode: '0600' } tags: - - evomaintenance - -- name: Configuration is installed - template: - src: evomaintenance.j2 - dest: /etc/evomaintenance.cf - owner: root - group: root - mode: "0600" - force: "{{ evomaintenance_force_config | bool }}" - tags: - - evomaintenance + - evomaintenance \ No newline at end of file diff --git a/evomaintenance/tasks/main.yml b/evomaintenance/tasks/main.yml index 9826089b..0a4e5010 100644 --- a/evomaintenance/tasks/main.yml +++ b/evomaintenance/tasks/main.yml @@ -1,14 +1,5 @@ --- -- set_fact: - minifirewall_restart_handler_name: "{{ minifirewall_restart_if_needed | bool | ternary('restart minifirewall', 'restart minifirewall (noop)') }}" - -- assert: - that: - - evomaintenance_api_endpoint is not none - - evomaintenance_api_key is not none - msg: evomaintenance api variables must be set - - include: install_package_debian.yml when: - not (evomaintenance_install_vendor | bool) @@ -19,6 +10,8 @@ - evomaintenance_install_vendor | bool - ansible_distribution == "Debian" +- include: config.yml + - include: minifirewall.yml when: - evomaintenance_hook_db | bool diff --git a/evomaintenance/tasks/minifirewall.yml b/evomaintenance/tasks/minifirewall.yml index ad48e856..98dad15b 100644 --- a/evomaintenance/tasks/minifirewall.yml +++ b/evomaintenance/tasks/minifirewall.yml @@ -1,5 +1,8 @@ --- +- set_fact: + minifirewall_restart_handler_name: "{{ minifirewall_restart_if_needed | bool | ternary('restart minifirewall', 'restart minifirewall (noop)') }}" + - name: Is minifirewall installed? stat: path: /etc/default/minifirewall From 73f55a42fa58a54b3e4f098a45f426a983c0d873 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Mon, 30 Aug 2021 09:26:04 +0200 Subject: [PATCH 013/125] forgotten file --- evomaintenance/tasks/install_package_debian.yml | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/evomaintenance/tasks/install_package_debian.yml b/evomaintenance/tasks/install_package_debian.yml index a5da77ea..ce9d90e7 100644 --- a/evomaintenance/tasks/install_package_debian.yml +++ b/evomaintenance/tasks/install_package_debian.yml @@ -12,15 +12,4 @@ name: evomaintenance allow_unauthenticated: yes tags: - - evomaintenance - -- name: Configuration is installed - template: - src: evomaintenance.j2 - dest: /etc/evomaintenance.cf - owner: root - group: root - mode: "0600" - force: "{{ evomaintenance_force_config | bool }}" - tags: - - evomaintenance + - evomaintenance \ No newline at end of file From e45ee59801f8c9f6a5e1057b05d28c7646d48d67 Mon Sep 17 00:00:00 2001 From: Jeremy Lecour Date: Mon, 30 Aug 2021 14:05:15 +0200 Subject: [PATCH 014/125] mysql: script "mysql-queries-killer.sh" to kill MySQL queries --- CHANGELOG.md | 1 + mysql/files/mysql-queries-killer.sh | 168 ++++++++++++++++++++++++++++ mysql/tasks/utils.yml | 9 ++ 3 files changed, 178 insertions(+) create mode 100644 mysql/files/mysql-queries-killer.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index 31ef9b18..890631f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,7 @@ The **patch** part changes incrementally at each release. * listupgrade: crontab is configurable * mongodb: create munin plugins directory if missing * mysql: script "mysql_connections" to display a compact list of connections +* mysql: script "mysql-queries-killer.sh" to kill MySQL queries * nagios-nrpe + evolinux-users: new checks for bkctld * redis: instance service for Debian 11 diff --git a/mysql/files/mysql-queries-killer.sh b/mysql/files/mysql-queries-killer.sh new file mode 100644 index 00000000..203d992e --- /dev/null +++ b/mysql/files/mysql-queries-killer.sh @@ -0,0 +1,168 @@ +#!/bin/sh + +VERSION="21.07.1" + +show_version() { + cat <, + Jérémy Lecour + and others. + +mysql-queries-killer comes with ABSOLUTELY NO WARRANTY. This is free software, +and you are welcome to redistribute it under certain conditions. +See the GNU General Public Licence for details. +END +} + +show_help() { + cat <] --list [--time