slfhst/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

✨: dynamic inventory with proxmox
Some checks failed
ansible-lint / lint-everything (push) Failing after 1m12s
Details

Browse Source
This commit is contained in:
VC
2025-03-21 09:06:39 +01:00
parent 064c28f0a7
commit 609ee99d57
34 changed files with 169 additions and 239 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
inventory/host_vars/baybay-ponay.mateu.be.yml → inventory/host_vars/baybay-ponay.yml
View File

0
inventory/host_vars/bt.dmz.mateu.be.yml → inventory/host_vars/bt.yml
View File

0
inventory/host_vars/frederica.dmz.mateu.be.yml → inventory/host_vars/frederica.yml
View File

0
inventory/host_vars/garage1.dmz.mateu.be.yml → inventory/host_vars/garage1.yml
View File

0
inventory/host_vars/git1.dmz.mateu.be.yml → inventory/host_vars/git1.yml
View File

0
inventory/host_vars/jabber.dmz.mateu.be.yml → inventory/host_vars/jabber.yml
View File

0
inventory/host_vars/mail.dmz.mateu.be.yml → inventory/host_vars/mail.yml
View File

0
inventory/host_vars/masto1.dmz.mateu.be.yml → inventory/host_vars/masto1.yml
View File

0
inventory/host_vars/munin.dmz.mateu.be.yml → inventory/host_vars/munin.yml
View File

0
inventory/host_vars/muse-HP-EliteBook-820-G2.home.arpa.yml → inventory/host_vars/muse-HP-EliteBook-820-G2.yml
View File

0
inventory/host_vars/pinkypie.home.arpa.yml → inventory/host_vars/pinkypie.yml
View File

0
inventory/host_vars/pt1.dmz.mateu.be.yml → inventory/host_vars/pt1.yml
View File

0
inventory/host_vars/vlt1.dmz.mateu.be.yml → inventory/host_vars/vlt1.yml
View File

0
inventory/host_vars/voice1.dmz.mateu.be.yml → inventory/host_vars/voice1.yml
View File

0
inventory/host_vars/voice3.dmz.mateu.be.yml → inventory/host_vars/voice3.yml
View File

0
inventory/host_vars/web1.dmz.mateu.be.yml → inventory/host_vars/web1.yml
View File

0
inventory/host_vars/web2.dmz.mateu.be.yml → inventory/host_vars/web2.yml
View File

0
inventory/host_vars/web3.dmz.mateu.be.yml → inventory/host_vars/web3.yml
View File

190
inventory/production.yml
View File

@@ -1,190 +0,0 @@
---
router:
hosts:
machinbox.mateu.be:
physicalservers:
hosts:
frederica.dmz.mateu.be:
serenor.dmz.mateu.be:
hypervisors:
hosts:
serenor.dmz.mateu.be:
nasservers:
hosts:
frederica.dmz.mateu.be:
zfsservers:
hosts:
serenor.dmz.mateu.be:
frederica.dmz.mateu.be:
resticservers:
hosts:
baybay-ponay.mateu.be:
bt.dmz.mateu.be:
es1.dmz.mateu.be:
frederica.dmz.mateu.be:
garage1.dmz.mateu.be:
git1.dmz.mateu.be:
jabber.dmz.mateu.be:
mail.dmz.mateu.be:
masto1.dmz.mateu.be:
muse-HP-EliteBook-820-G2.home.arpa:
pinkypie.home.arpa:
pt1.dmz.mateu.be:
voice1.dmz.mateu.be:
vlt1.dmz.mateu.be:
web[1:3].dmz.mateu.be:
garageservers:
children:
garage_prd_cluster:
hosts:
garage1.dmz.mateu.be:
garage_bck_cluster:
hosts:
frederica.dmz.mateu.be:
elasticsearchservers:
hosts:
es1.dmz.mateu.be:
nut:
children:
nut_client:
hosts:
serenor.dmz.mateu.be:
frederica.dmz.mateu.be:
nut_server:
hosts:
serenor.dmz.mateu.be:
webservers:
hosts:
bt.dmz.mateu.be:
garage1.dmz.mateu.be:
git1.dmz.mateu.be:
jabber.dmz.mateu.be:
mail.dmz.mateu.be:
masto1.dmz.mateu.be:
pt1.dmz.mateu.be:
voice3.dmz.mateu.be:
munin.dmz.mateu.be:
vlt1.dmz.mateu.be:
web[1:3].dmz.mateu.be:
peertubeservers:
hosts:
pt1.dmz.mateu.be:
phpservers:
hosts:
web[1:3].dmz.mateu.be:
mariadbservers:
hosts:
web[2:3].dmz.mateu.be:
pgsqlservers:
hosts:
masto1.dmz.mateu.be:
pt1.dmz.mateu.be:
web1.dmz.mateu.be:
git1.dmz.mateu.be:
giteaservers:
hosts:
git1.dmz.mateu.be:
actrunnerservers:
hosts:
git1.dmz.mateu.be:
mastodonservers:
hosts:
masto1.dmz.mateu.be:
rorservers:
hosts:
masto1.dmz.mateu.be:
mailservers:
hosts:
mail.dmz.mateu.be:
xmppservers:
hosts:
jabber.dmz.mateu.be:
loadbalancers:
hosts:
haproxy.dmz.mateu.be:
transmission:
hosts:
bt.dmz.mateu.be:
mumbleservers:
hosts:
voice1.dmz.mateu.be:
icecastservers:
hosts:
voice3.dmz.mateu.be:
rsyslogservers:
hosts:
syslog.dmz.mateu.be:
vaultservers:
hosts:
vlt1.dmz.mateu.be:
muninservers:
hosts:
munin.dmz.mateu.be:
disabled_loadbalanced_webservers:
hosts:
disabled_system:
hosts:
baybay-ponay.mateu.be:
machinbox.mateu.be:
muse-HP-EliteBook-820-G2.home.arpa:
pinkypie.home.arpa:
disabled_munin:
hosts:
baybay-ponay.mateu.be:
muse-HP-EliteBook-820-G2.home.arpa:
pinkypie.home.arpa:
disabled_syslog:
hosts:
baybay-ponay.mateu.be:
machinbox.mateu.be:
muse-HP-EliteBook-820-G2.home.arpa:
pinkypie.home.arpa:
# Those are not servers and should not be configured as such
disabled_server_conf:
hosts:
baybay-ponay.mateu.be:
muse-HP-EliteBook-820-G2.home.arpa:
pinkypie.home.arpa:
ftpservers:
hosts:
ftp.dmz.mateu.be:
domservers:
hosts:
dom.dmz.mateu.be:
unifiservers:
hosts:
unifi.dmz.mateu.be:

28
inventory/proxmox.yml Normal file
View File

@@ -0,0 +1,28 @@
---
plugin: community.general.proxmox
url: https://serenor.dmz.mateu.be:8006
user: !vault |
$ANSIBLE_VAULT;1.1;AES256
32383264316162623632343363653539363432386663393431643463313038373736353332306636
3032376462316331333337313136653137323436396536380a633038323762303461626332346632
38643362643638333339626232386465626161303336613139646364356661383430316436636639
6130383863636331610a666662643565393664613533366237646539663230313631623431643261
3238
password: !vault |
$ANSIBLE_VAULT;1.1;AES256
30343833663162373334373732653433373866376635396633356637656235373233613531376433
3033353465313336356562336137623836356163666334650a306131393434656130383239353765
38656165633861623863363966383435633331666565616464396336653161626136356130623539
3061636531363338380a313265653134333264303730323464306565393838363630626266376237
30363735303434323062636437663761346534666266353334396531303561346165
validate_certs: false
want_facts: true
want_proxmox_nodes_ansible_host: false
keyed_groups:
- key: proxmox_tags_parsed
separator: ""
compose:
ansible_host: proxmox_hostname ~ '.dmz.mateu.be'

92
inventory/static.yml Normal file
View File

@@ -0,0 +1,92 @@
---
all:
hosts:
machinbox:
ansible_host: machinbox.mateu.be
serenor:
ansible_host: serenor.dmz.mateu.be
frederica:
ansible_host: frederica.dmz.mateu.be
baybay-ponay:
ansible_host: baybay-ponay.mateu.be
muse-HP-EliteBook-820-G2:
ansible_host: muse-HP-EliteBook-820-G2.home.arpa
pinkypie:
ansible_host: pinkypie.home.arpa
router:
hosts:
machinbox:
physicalservers:
hosts:
frederica:
serenor:
hypervisors:
children:
proxmox_nodes:
nasservers:
hosts:
frederica:
zfsservers:
hosts:
serenor:
frederica:
garageservers:
children:
garage_prd_cluster:
garage_bck_cluster:
hosts:
frederica:
nut:
children:
nut_client:
hosts:
serenor:
frederica:
nut_server:
hosts:
serenor:
resticservers:
hosts:
frederica:
baybay-ponay:
muse-HP-EliteBook-820-G2:
pinkypie:
disabled_loadbalanced_webservers:
hosts:
disabled_system:
hosts:
baybay-ponay:
machinbox:
muse-HP-EliteBook-820-G2:
pinkypie:
disabled_munin:
hosts:
baybay-ponay:
muse-HP-EliteBook-820-G2:
pinkypie:
disabled_syslog:
hosts:
baybay-ponay:
machinbox:
muse-HP-EliteBook-820-G2:
pinkypie:
# Those are not servers and should not be configured as such
disabled_server_conf:
hosts:
baybay-ponay:
muse-HP-EliteBook-820-G2:
pinkypie:

2
playbooks/bittorrent.yml
View File

@@ -1,7 +1,7 @@
---
- name: Deploy transmission
hosts: transmission
hosts: btservers
diff: true
roles:
- transmission

2
playbooks/firewall.yml
View File

@@ -1,7 +1,7 @@
---
- name: Retrieve network info
hosts: all:!disabled_server_conf:!machinbox.mateu.be
hosts: all:!disabled_server_conf:!machinbox
gather_facts: true
gather_subset:
- network

2
playbooks/loadbalancinghttp.yml
View File

@@ -8,7 +8,7 @@
tasks: []
- name: Deploy haproxy
hosts: loadbalancers
hosts: lbservers
diff: true
roles:
- haproxy

2
playbooks/smtprelay.yml
View File

@@ -1,7 +1,7 @@
---
- name: Deploy smtp relay
hosts: all:!disabled_server_conf:!machinbox.mateu.be:!mail.dmz.mateu.be
hosts: all:!disabled_server_conf:!machinbox:!mail
diff: true
roles:
- smtprelay

4
playbooks/webapps.yml
View File

@@ -1,7 +1,7 @@
---
- name: Install libertus webapplications
hosts: web1.dmz.mateu.be
hosts: web1
diff: true
roles:
- role: bac
@@ -20,7 +20,7 @@
tags: [never, nextcloud]
- name: Install dojo webapplications
hosts: web2.dmz.mateu.be
hosts: web2
diff: true
roles:
- wordpress

2
playbooks/webservers.yml
View File

@@ -1,7 +1,7 @@
---
- name: Retrieve network info
hosts: loadbalancers
hosts: lbservers
gather_facts: true
gather_subset:
- network

56
roles/firewall/templates/firewall.j2
View File

@@ -120,7 +120,7 @@ config rule
config rule
option name 'Allow-DMZ-Syslog'
option dest 'dmz'
option dest_ip '{{ hostvars['syslog.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['syslog']['ansible_default_ipv4']['address'] }}'
option dest_port '514'
list proto 'udp'
option target 'ACCEPT'
@@ -173,7 +173,7 @@ config redirect
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['haproxy.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['haproxy']['ansible_default_ipv4']['address'] }}'
option dest_port '80'
option target 'DNAT'
@@ -184,14 +184,14 @@ config redirect
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['haproxy.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['haproxy']['ansible_default_ipv4']['address'] }}'
option dest_port '443'
option target 'DNAT'
# Allow Web traffic IN
{% for host in groups['webservers'] %}
{% for host in groups['webservers'] | sort %}
config rule
option name 'Allow-INPUT-{{ host }}-Web'
option name 'Allow-INPUT-{{ hostvars[host]['ansible_host'] }}-Web'
option src 'wan'
list proto 'tcp'
list proto 'udp'
@@ -207,7 +207,7 @@ config rule
config rule
option name 'Allow-OUTPUT-BT'
option src 'dmz'
option src_ip '{{ hostvars['bt.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option src_ip '{{ hostvars['bt']['ansible_default_ipv4']['address'] }}'
list proto 'tcp'
list proto 'udp'
option dest 'wan'
@@ -217,7 +217,7 @@ config rule
config rule
option name 'Allow-OUTPUT-BT'
option src 'dmz'
option src_ip '{{ hostvars['bt.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option src_ip '{{ hostvars['bt']['ansible_default_ipv6']['address'] }}'
list proto 'tcp'
list proto 'udp'
option dest 'wan'
@@ -230,7 +230,7 @@ config rule
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['bt.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option dest_ip '{{ hostvars['bt']['ansible_default_ipv6']['address'] }}'
option dest_port '10010'
option target 'ACCEPT'
option family 'ipv6'
@@ -242,7 +242,7 @@ config redirect
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['bt.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['bt']['ansible_default_ipv4']['address'] }}'
option dest_port '10010'
option target 'DNAT'
@@ -275,7 +275,7 @@ config redirect
config rule
option name 'Allow-OUTPUT-XMPP-s2s'
option src 'dmz'
option src_ip '{{ hostvars['jabber.dmz.mateu.be']['ansible_default_ipv4']['address']}}'
option src_ip '{{ hostvars['jabber']['ansible_default_ipv4']['address']}}'
list proto 'tcp'
list proto 'udp'
option dest 'wan'
@@ -286,7 +286,7 @@ config rule
config rule
option name 'Allow-OUTPUT-XMPP-s2s'
option src 'dmz'
option src_ip '{{ hostvars['jabber.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option src_ip '{{ hostvars['jabber']['ansible_default_ipv6']['address'] }}'
list proto 'tcp'
list proto 'udp'
option dest 'wan'
@@ -301,7 +301,7 @@ config redirect
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['jabber.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['jabber']['ansible_default_ipv4']['address'] }}'
option dest_port '5222'
option target 'DNAT'
@@ -312,7 +312,7 @@ config redirect
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['jabber.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['jabber']['ansible_default_ipv4']['address'] }}'
option dest_port '5269'
option target 'DNAT'
@@ -322,7 +322,7 @@ config rule
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['jabber.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option dest_ip '{{ hostvars['jabber']['ansible_default_ipv6']['address'] }}'
option dest_port '5222 5269'
option target 'ACCEPT'
option family 'ipv6'
@@ -334,7 +334,7 @@ config rule
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['voice1.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option dest_ip '{{ hostvars['voice1']['ansible_default_ipv6']['address'] }}'
option dest_port '64738'
option target 'ACCEPT'
option family 'ipv6'
@@ -346,7 +346,7 @@ config redirect
list proto 'tcp'
list proto 'udp'
option dest 'dmz'
option dest_ip '{{ hostvars['voice1.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['voice1']['ansible_default_ipv4']['address'] }}'
option dest_port '64738'
option target 'DNAT'
@@ -354,7 +354,7 @@ config redirect
config rule
option name 'Allow-OUTPUT-SMTP'
option src 'dmz'
option src_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option src_ip '{{ hostvars['mail']['ansible_default_ipv4']['address'] }}'
list proto 'tcp'
option dest 'wan'
option dest_port '25'
@@ -366,7 +366,7 @@ config rule
option src 'wan'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option dest_ip '{{ hostvars['mail']['ansible_default_ipv6']['address'] }}'
option dest_port '25 465 587'
option target 'ACCEPT'
option family 'ipv6'
@@ -376,7 +376,7 @@ config rule
option src 'wan'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv6']['address'] }}'
option dest_ip '{{ hostvars['mail']['ansible_default_ipv6']['address'] }}'
option dest_port '143 993'
option target 'ACCEPT'
option family 'ipv6'
@@ -387,7 +387,7 @@ config redirect
option src_dport '25'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['mail']['ansible_default_ipv4']['address'] }}'
option dest_port '25'
option target 'DNAT'
@@ -397,7 +397,7 @@ config redirect
option src_dport '465'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['mail']['ansible_default_ipv4']['address'] }}'
option dest_port '465'
option target 'DNAT'
@@ -407,7 +407,7 @@ config redirect
option src_dport '587'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['mail']['ansible_default_ipv4']['address'] }}'
option dest_port '587'
option target 'DNAT'
@@ -417,7 +417,7 @@ config redirect
option src_dport '143'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['mail']['ansible_default_ipv4']['address'] }}'
option dest_port '143'
option target 'DNAT'
@@ -427,7 +427,7 @@ config redirect
option src_dport '993'
list proto 'tcp'
option dest 'lan'
option dest_ip '{{ hostvars['mail.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['mail']['ansible_default_ipv4']['address'] }}'
option dest_port '993'
option target 'DNAT'
@@ -435,7 +435,7 @@ config redirect
config rule
option name 'Allow-INPUT-Munin'
option src 'dmz'
option src_ip '{{ hostvars['munin.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option src_ip '{{ hostvars['munin']['ansible_default_ipv4']['address'] }}'
list proto 'tcp'
option dest_port '4949'
option target 'ACCEPT'
@@ -444,7 +444,7 @@ config rule
config rule
option name 'Allow-FORWARD-Munin-Mikrotik-Garregmach'
option src 'dmz'
option src_ip '{{ hostvars['munin.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option src_ip '{{ hostvars['munin']['ansible_default_ipv4']['address'] }}'
list proto 'tcp'
list proto 'udp'
option dest 'lan'
@@ -456,7 +456,7 @@ config rule
config rule
option name 'Allow-FORWARD-Munin-Mikrotik-Derdriu'
option src 'dmz'
option src_ip '{{ hostvars['munin.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option src_ip '{{ hostvars['munin']['ansible_default_ipv4']['address'] }}'
list proto 'tcp'
list proto 'udp'
option dest 'lan'
@@ -530,7 +530,7 @@ config rule
option src 'iot'
list proto 'tcp'
option dest 'dmz'
option dest_ip '{{ hostvars['ftp.dmz.mateu.be']['ansible_default_ipv4']['address'] }}'
option dest_ip '{{ hostvars['ftp']['ansible_default_ipv4']['address'] }}'
option dest_port '21 10100-10110'
option target 'ACCEPT'

14
roles/haproxy/templates/haproxy.cfg.j2
View File

@@ -45,7 +45,7 @@ frontend http
{% for hostname in hostvars[server]['web_hostname'] | sort(attribute='host') %}
## {{ hostname.host }} configuration
acl host_{{ hostname.host }} hdr(host) -i {{ hostname.host }}
use_backend http_{{ server }} if letsencrypt host_{{ hostname.host }}
use_backend http_{{ hostvars[server].ansible_host }} if letsencrypt host_{{ hostname.host }}
{% endfor %}
{% endfor %}
@@ -64,21 +64,21 @@ frontend https
acl network_allowed_{{ hostname.host }} src {% for addrv4 in hostname.allowlistv4 %}{{ addrv4 }}{% endfor %}
{% endif %}
use_backend https_{{ server }} if host_{{ hostname.host }}{% if hostname.allowlistv4 is defined %} network_allowed_{{ hostname.host }}{% endif %}
use_backend https_{{ hostvars[server].ansible_host }} if host_{{ hostname.host }}{% if hostname.allowlistv4 is defined %} network_allowed_{{ hostname.host }}{% endif %}
{% endfor %}
{% endfor %}
{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %}
## {{ server }} configuration
backend http_{{ server }}
## {{ hostvars[server].ansible_host }} configuration
backend http_{{ hostvars[server].ansible_host }}
mode http
server host_{{ server.split('.')|join('_') }} {{ hostvars[server]['ansible_default_ipv4']['address'] }}:80
server host_{{ hostvars[server].ansible_host.split('.')|join('_') }} {{ hostvars[server]['ansible_default_ipv4']['address'] }}:80
backend https_{{ server }}
backend https_{{ hostvars[server].ansible_host }}
mode tcp
server host_{{ server.split('.')|join('_') }} {{ hostvars[server]['ansible_default_ipv4']['address'] }}:443
server host_{{ hostvars[server].ansible_host.split('.')|join('_') }} {{ hostvars[server]['ansible_default_ipv4']['address'] }}:443
{% endfor %}

4
roles/munin_client/tasks/main.yml
View File

@@ -41,7 +41,7 @@
update_cache: true
notify:
- Restart munin-node
when: "'webservers' in group_names or 'loadbalancers' in group_names"
when: "'webservers' in group_names or 'lbservers' in group_names"
# for HAProxy servers
- name: Add haproxy backend module
@@ -51,7 +51,7 @@
state: link
notify:
- Restart munin-node
when: "'loadbalancers' in group_names"
when: "'lbservers' in group_names"
# For MariaDB servers
- name: Install MariaDB servers

4
roles/munin_client/templates/munin-node.conf.j2
View File

@@ -34,14 +34,14 @@ ignore_file \.pod$
# Set this if the client doesn't report the correct hostname when
# telnetting to localhost, port 4949
#
host_name {{ inventory_hostname }}
host_name {{ ansible_host }}
# A list of addresses that are allowed to connect. This must be a
# regular expression, since Net::Server does not understand CIDR-style
# network notation unless the perl module Net::CIDR is installed. You
# may repeat the allow line as many times as you'd like
allow ^{{ hostvars['munin.dmz.mateu.be']['ansible_default_ipv4']['address'].split('.')|join('\.') }}
allow ^{{ hostvars['munin']['ansible_default_ipv4']['address'].split('.')|join('\.') }}
allow ^127\.0\.0\.1$
allow ^::1$

2
roles/munin_server/templates/munin.conf.j2
View File

@@ -97,7 +97,7 @@ includedir /etc/munin/munin-conf.d
# a simple host tree
{% for host in groups['all'] | difference(groups['disabled_munin']) | sort %}
[{{ host }}]
[{{ hostvars[host].ansible_host }}]
address {{ hostvars[host]['ansible_default_ipv4']['address'] }}
{% endfor %}

2
roles/nginx/templates/header.conf.j2
View File

@@ -9,7 +9,7 @@
error_log /var/log/nginx/{{ item.host }}.error.log;
error_log syslog:server=unix:/dev/log;
{% if item.allowlistv4 is defined %}
allow {{ hostvars['haproxy.dmz.mateu.be'].ansible_default_ipv4.address }};
allow {{ hostvars['haproxy']['ansible_default_ipv4']['address'] }};
{% endif %}
{% if item.allowlistv6 is defined %}
{% for addrv6 in item.allowlistv6 %}

2
roles/restic/vars/main.yml
View File

@@ -6,4 +6,4 @@ restic_architecture: "amd64"
restic_system: "{{ ansible_facts['system'] | lower }}"
restic_download_url: "https://github.com/restic/restic/releases/download/v{{ restic_version }}/restic_{{ restic_version }}_{{ restic_system }}_{{ restic_architecture }}.bz2"
restic_repository: "{{ restic_s3_url }}/{{ inventory_hostname }}"
restic_repository: "{{ restic_s3_url }}/{{ ansible_host }}"