summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.gitmodules3
-rw-r--r--files/etc/nginx/sites-available/webmap (renamed from files/etc/nginx/sites-enabled/webmap)0
-rw-r--r--files/etc/postfix/master.cf44
-rw-r--r--files/etc/postfix/tls_policy2
-rw-r--r--files/etc/systemd/system/webmap-download@.service38
-rw-r--r--files/etc/systemd/system/webmap-update@.target3
-rw-r--r--files/etc/systemd/system/webmap-update@.timer11
-rw-r--r--group_vars/all.yml9
-rw-r--r--setup.yml1
-rw-r--r--tasks/base.yml2
-rw-r--r--tasks/httpd.yml13
-rw-r--r--tasks/mail.yml10
-rw-r--r--tasks/webmap.yml110
-rw-r--r--templates/etc/postfix/main.cf.j25
m---------webmap-tools0
15 files changed, 243 insertions, 8 deletions
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..a9b9b64
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "webmap-tools"]
+ path = webmap-tools
+ url = https://git.guilhem.org/KlimatanalysNorr/tools.git
diff --git a/files/etc/nginx/sites-enabled/webmap b/files/etc/nginx/sites-available/webmap
index d16ab60..d16ab60 100644
--- a/files/etc/nginx/sites-enabled/webmap
+++ b/files/etc/nginx/sites-available/webmap
diff --git a/files/etc/postfix/master.cf b/files/etc/postfix/master.cf
new file mode 100644
index 0000000..3c60f31
--- /dev/null
+++ b/files/etc/postfix/master.cf
@@ -0,0 +1,44 @@
+#
+# Postfix master process configuration file. For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master" or
+# on-line: http://www.postfix.org/master.5.html).
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type private unpriv chroot wakeup maxproc command + args
+# (yes) (yes) (no) (never) (100)
+# ==========================================================================
+smtp inet n - y - - smtpd
+pickup unix n - y 60 1 pickup
+cleanup unix n - y - 0 cleanup
+qmgr unix n - n 300 1 qmgr
+tlsmgr unix - - y 1000? 1 tlsmgr
+rewrite unix - - y - - trivial-rewrite
+bounce unix - - y - 0 bounce
+defer unix - - y - 0 bounce
+trace unix - - y - 0 bounce
+verify unix - - y - 1 verify
+flush unix n - y 1000? 0 flush
+proxymap unix - - n - - proxymap
+proxywrite unix - - n - 1 proxymap
+smtp unix - - y - - smtp
+relay unix - - y - - smtp
+ -o syslog_name=postfix/$service_name
+# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+ -o smtp_tls_security_level=fingerprint
+relay-smtps unix - - y - - smtp
+ -o syslog_name=postfix/$service_name
+# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+ -o smtp_tls_wrappermode=yes
+ -o smtp_tls_security_level=fingerprint
+showq unix n - y - - showq
+error unix - - y - - error
+retry unix - - y - - error
+discard unix - - y - - discard
+local unix - n n - - local
+virtual unix - n n - - virtual
+lmtp unix - - y - - lmtp
+anvil unix - - y - 1 anvil
+scache unix - - y - 1 scache
+postlog unix-dgram n - n - 1 postlogd
diff --git a/files/etc/postfix/tls_policy b/files/etc/postfix/tls_policy
index 2af19c5..c5641d3 100644
--- a/files/etc/postfix/tls_policy
+++ b/files/etc/postfix/tls_policy
@@ -1,3 +1,3 @@
# WARN: smtp_tls_fingerprint_digest MUST be sha256!
-[smtp.guilhem.org]:587 fingerprint ciphers=high protocols=!SSLv2:!SSLv3:!TLSv1:!TLSv1.1:!TLSv1.2
+[smtp.guilhem.org]:465 fingerprint ciphers=high protocols=!SSLv2:!SSLv3:!TLSv1:!TLSv1.1:!TLSv1.2
match=B2:37:09:EC:B9:54:DC:51:FA:77:A1:31:0D:30:06:84:7E:10:81:5B:9B:30:B0:31:6E:9A:7B:53:13:C8:37:62
diff --git a/files/etc/systemd/system/webmap-download@.service b/files/etc/systemd/system/webmap-download@.service
new file mode 100644
index 0000000..a928a13
--- /dev/null
+++ b/files/etc/systemd/system/webmap-download@.service
@@ -0,0 +1,38 @@
+[Unit]
+Description=Webmap updater service (download %I)
+# Chaining logic from https://serverfault.com/questions/1079993/why-does-my-systemd-timer-only-trigger-once-when-the-unit-is-a-target#answer-1128671
+# XXX Looks like Upholds= prevents running a single unit, as it causes
+# webmap-update@%i.target to start upon `systemctl start webmap-download@foo.service`
+After=network-online.target webmap-update@%i.target
+Upholds=webmap-update@%i.target
+
+[Service]
+User=_webmap-download
+Group=nogroup
+
+Nice=15
+IOSchedulingClass=idle
+
+Type=oneshot
+ExecStart=/usr/local/bin/webmap-download \
+ --cachedir=/var/cache/webmap \
+ --lockdir=%t/webmap-download \
+ --no-exit-code \
+ --quiet \
+ -- %I
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/var/cache/webmap
+RuntimeDirectory=webmap-download
+RuntimeDirectoryPreserve=yes
+
+[Install]
+WantedBy=webmap-update@%i.target
diff --git a/files/etc/systemd/system/webmap-update@.target b/files/etc/systemd/system/webmap-update@.target
new file mode 100644
index 0000000..3d9fb7f
--- /dev/null
+++ b/files/etc/systemd/system/webmap-update@.target
@@ -0,0 +1,3 @@
+[Unit]
+Description=Webmap updater (target unit %I)
+StopWhenUnneeded=true
diff --git a/files/etc/systemd/system/webmap-update@.timer b/files/etc/systemd/system/webmap-update@.timer
new file mode 100644
index 0000000..74fb848
--- /dev/null
+++ b/files/etc/systemd/system/webmap-update@.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Webmap updater (timer unit)
+
+[Timer]
+OnCalendar=*-*-* 01:00:00
+AccuracySec=1s
+RandomizedDelaySec=3599
+Unit=webmap-update@%i.target
+
+[Install]
+WantedBy=timers.target
diff --git a/group_vars/all.yml b/group_vars/all.yml
new file mode 100644
index 0000000..a0d35c6
--- /dev/null
+++ b/group_vars/all.yml
@@ -0,0 +1,9 @@
+---
+# The list of layer groups to process, see
+# webmap-tools/config.yml:layer-groups.
+webmap_layer_groups:
+ - mrr
+ - nvr
+ - sks
+ - st
+ - vbk
diff --git a/setup.yml b/setup.yml
index fd85241..0d27ec7 100644
--- a/setup.yml
+++ b/setup.yml
@@ -12,6 +12,7 @@
- import_tasks: ./tasks/ssh.yml
- import_tasks: ./tasks/base.yml
- import_tasks: ./tasks/mail.yml
+ - import_tasks: ./tasks/webmap.yml
- import_tasks: ./tasks/httpd.yml
handlers:
- import_tasks: ./handlers/main.yml
diff --git a/tasks/base.yml b/tasks/base.yml
index 623d209..608131f 100644
--- a/tasks/base.yml
+++ b/tasks/base.yml
@@ -122,6 +122,8 @@
- qemu-guest-agent
# Useful for `getent passwd dynamic_user`
- libnss-systemd
+ - tig
+ - jq
- name: Set timezone
timezone: name=Europe/Stockholm
diff --git a/tasks/httpd.yml b/tasks/httpd.yml
index 2138d35..22757d5 100644
--- a/tasks/httpd.yml
+++ b/tasks/httpd.yml
@@ -29,13 +29,20 @@
mode=0644
notify: Reload nginx
-- name: Copy /etc/nginx/sites-enabled/webmap
- copy: src=etc/nginx/sites-enabled/webmap
- dest=/etc/nginx/sites-enabled/webmap
+- name: Copy /etc/nginx/sites-available/webmap
+ copy: src=etc/nginx/sites-available/webmap
+ dest=/etc/nginx/sites-available/webmap
owner=root group=root
mode=0644
notify: Reload nginx
+- name: Create /etc/nginx/sites-enabled/webmap
+ file: src=../sites-available/webmap
+ dest=/etc/nginx/sites-enabled/webmap
+ owner=root group=root
+ state=link force=yes
+ notify: Reload nginx
+
- name: Create directory /var/www/webmap
file: path=/var/www/webmap
state=directory
diff --git a/tasks/mail.yml b/tasks/mail.yml
index 89d8530..8f58c8a 100644
--- a/tasks/mail.yml
+++ b/tasks/mail.yml
@@ -13,7 +13,7 @@
notify:
- Run newaliases
-- name: Configure Postfix
+- name: Configure Postfix (main.cf)
template: src=etc/postfix/main.cf.j2
dest=/etc/postfix/main.cf
owner=root group=root
@@ -21,6 +21,14 @@
notify:
- Reload Postfix
+- name: Configure Postfix (master.cf)
+ copy: src=etc/postfix/master.cf
+ dest=/etc/postfix/master.cf
+ owner=root group=root
+ mode=0644
+ notify:
+ - Restart Postfix
+
- name: Start Postfix
service: name=postfix.service enabled=true state=started
diff --git a/tasks/webmap.yml b/tasks/webmap.yml
new file mode 100644
index 0000000..2fff3bc
--- /dev/null
+++ b/tasks/webmap.yml
@@ -0,0 +1,110 @@
+- name: Install gdal-bin
+ apt: pkg=gdal-bin install-recommends=true
+
+- name: Install python dependencies
+ apt: pkg={{ packages }}
+ vars:
+ packages:
+ - python3
+ - python3-gdal
+ - python3-lxml
+ - python3-requests
+ - python3-tqdm
+ - python3-urllib3
+ - python3-xdg
+ - python3-yaml
+
+- name: Create directory /etc/webmap
+ file: path=/etc/webmap
+ state=directory
+ owner=root group=root
+ mode=0755
+
+- name: Copy /etc/webmap/config.yml
+ copy: src=webmap-tools/config.yml
+ dest=/etc/webmap/config.yml
+ owner=root group=root
+ mode=0644
+
+- name: Create directory /usr/local/share/webmap
+ file: path=/usr/local/share/webmap
+ state=directory
+ owner=root group=root
+ mode=0755
+
+- name: Copy /usr/local/share/webmap/common.py
+ copy: src=webmap-tools/common.py
+ dest=/usr/local/share/webmap/common.py
+ owner=root group=root
+ mode=0644
+
+- name: Copy webmap-update@.target
+ copy: src=etc/systemd/system/webmap-update@.target
+ dest=/etc/systemd/system/webmap-update@.target
+ owner=root group=root
+ mode=0644
+ notify:
+ - systemctl daemon-reload
+
+- name: Copy webmap-update@.timer
+ copy: src=etc/systemd/system/webmap-update@.timer
+ dest=/etc/systemd/system/webmap-update@.timer
+ owner=root group=root
+ mode=0644
+ notify:
+ - systemctl daemon-reload
+
+- name: Enable webmap-update.timer
+ service: name=webmap-update@{{ item }}.timer state=started enabled=true
+ with_items: "{{ webmap_layer_groups }}"
+
+- meta: flush_handlers
+
+
+- name: Create system user '_webmap-download'
+ user: name=_webmap-download system=true
+ group=nogroup
+ createhome=false
+ home=/nonexistent
+ shell=/usr/sbin/nologin
+ comment="Webmap update (download)"
+ password="!"
+ state=present
+
+- name: Copy /usr/local/share/webmap/download.py
+ copy: src=webmap-tools/webmap-download
+ dest=/usr/local/share/webmap/download.py
+ owner=root group=root
+ mode=0755
+
+- name: Create /usr/local/bin/webmap-download
+ file: src=../share/webmap/download.py
+ dest=/usr/local/bin/webmap-download
+ owner=root group=root
+ state=link force=yes
+
+- name: Copy /usr/local/share/webmap/webmap-download-mrr.py
+ copy: src=webmap-tools/webmap-download-mrr.py
+ dest=/usr/local/share/webmap/webmap-download-mrr.py
+ owner=root group=root
+ mode=0644
+
+- name: Create directory /var/cache/webmap
+ file: path=/var/cache/webmap
+ state=directory
+ owner=_webmap-download group=nogroup
+ mode=0755
+
+- name: Copy webmap-download@.service
+ copy: src=etc/systemd/system/webmap-download@.service
+ dest=/etc/systemd/system/webmap-download@.service
+ owner=root group=root
+ mode=0644
+ notify:
+ - systemctl daemon-reload
+
+- name: Enable webmap-download@.service
+ service: name=webmap-download@{{ item }}.service enabled=true
+ with_items: "{{ webmap_layer_groups }}"
+
+- meta: flush_handlers
diff --git a/templates/etc/postfix/main.cf.j2 b/templates/etc/postfix/main.cf.j2
index 9557cc4..35a6790 100644
--- a/templates/etc/postfix/main.cf.j2
+++ b/templates/etc/postfix/main.cf.j2
@@ -29,10 +29,9 @@ alias_database = $virtual_alias_maps
mailbox_size_limit = 0
# Forward everything to our internal outgoing proxy
-# TODO: User relay-smtps on 465/tcp once Hetzner opens it
relay_domains =
-relayhost = [smtp.guilhem.org]:587
-default_transport = relay
+relayhost = [smtp.guilhem.org]:465
+default_transport = relay-smtps
smtpd_tls_security_level = none
smtp_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
diff --git a/webmap-tools b/webmap-tools
new file mode 160000
+Subproject 729a5df4ba9889aebcd51787ec11a4d0d1ea547
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-10 07:06:37 +0000