diff options
| -rw-r--r-- | Makefile | 4 | ||||
| -rw-r--r-- | README.md | 1 | ||||
| -rw-r--r-- | playbooks/bootstrap.yaml | 4 | ||||
| -rw-r--r-- | playbooks/files/nginx.conf | 83 | ||||
| -rw-r--r-- | playbooks/http.yaml | 81 | ||||
| -rw-r--r-- | playbooks/tasks/test_and_restart_nginx.yaml | 10 | ||||
| -rw-r--r-- | playbooks/templates/nginx/http.conf.j2 | 16 | ||||
| -rw-r--r-- | playbooks/templates/ssh/hardening.conf.j2 (renamed from playbooks/templates/sshd_hardening.conf.j2) | 0 | ||||
| -rw-r--r-- | playbooks/templates/ssh/listen.conf.j2 (renamed from playbooks/templates/ssh.socket.conf.j2) | 0 |
9 files changed, 197 insertions, 2 deletions
@@ -33,3 +33,7 @@ bootstrap: .PHONY: security security: $(BIN)/ansible-playbook -e @vault.yaml playbooks/security.yaml + +.PHONY: http +http: + $(BIN)/ansible-playbook -e @vault.yaml playbooks/http.yaml @@ -34,6 +34,7 @@ _Listed in applicable order._ | ----------------------- | ------------------ | | `bootstrap`<sup>*</sup> | Bootstrap access | | `security` | Security hardening | +| `http` | Web server | ### <sup>*</sup>Pre-bootstraped targets diff --git a/playbooks/bootstrap.yaml b/playbooks/bootstrap.yaml index 73da248..3f5f872 100644 --- a/playbooks/bootstrap.yaml +++ b/playbooks/bootstrap.yaml @@ -4,7 +4,7 @@ tasks: - name: Configure ssh hardening ansible.builtin.template: - src: sshd_hardening.conf.j2 + src: ssh/hardening.conf.j2 dest: /etc/ssh/sshd_config.d/99-hardening.conf mode: "0644" backup: true @@ -13,7 +13,7 @@ - name: Configure ssh socket port ansible.builtin.template: - src: ssh.socket.conf.j2 + src: ssh/listen.conf.j2 dest: /etc/systemd/system/ssh.socket.d/10-listen.conf mode: "0644" backup: true diff --git a/playbooks/files/nginx.conf b/playbooks/files/nginx.conf new file mode 100644 index 0000000..6e7d27f --- /dev/null +++ b/playbooks/files/nginx.conf @@ -0,0 +1,83 @@ +user www-data; +worker_processes auto; +pid /run/nginx.pid; +error_log /var/log/nginx/error.log; +include /etc/nginx/modules-enabled/*.conf; + +events { + worker_connections 768; + # multi_accept on; +} + +http { + + ## + # Basic Settings + ## + + sendfile on; + tcp_nopush on; + types_hash_max_size 2048; + # server_tokens off; + + # server_names_hash_bucket_size 64; + # server_name_in_redirect off; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + ## + # SSL Settings + ## + + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE + ssl_prefer_server_ciphers on; + + ## + # Logging Settings + ## + + access_log /var/log/nginx/access.log; + + ## + # Gzip Settings + ## + + gzip on; + + gzip_vary on; # <- uncommented + gzip_proxied any; # <- uncommented + gzip_comp_level 6; # <- uncommented + gzip_buffers 16 8k; # <- uncommented + gzip_http_version 1.1; # <- uncommented + gzip_types text/plain text/css application/json application/javascript image/avif text/xml application/xml application/xml+rss text/javascript; # <- uncommented + + ## + # Virtual Host Configs + ## + + include /etc/nginx/conf.d/*.conf; + include /etc/nginx/sites-enabled/*; +} + + +#mail { +# # See sample authentication script at: +# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript +# +# # auth_http localhost/auth.php; +# # pop3_capabilities "TOP" "USER"; +# # imap_capabilities "IMAP4rev1" "UIDPLUS"; +# +# server { +# listen localhost:110; +# protocol pop3; +# proxy on; +# } +# +# server { +# listen localhost:143; +# protocol imap; +# proxy on; +# } +#} diff --git a/playbooks/http.yaml b/playbooks/http.yaml new file mode 100644 index 0000000..3c43e2f --- /dev/null +++ b/playbooks/http.yaml @@ -0,0 +1,81 @@ +- name: Web server + hosts: hollyhock + become: true + tasks: + - name: Install nginx + ansible.builtin.apt: + name: nginx + state: present + update_cache: true + + - name: Start and enable nginx + ansible.builtin.systemd: + name: nginx + state: started + enabled: true + + - name: Configure nginx + ansible.builtin.copy: + src: nginx.conf + dest: /etc/nginx/nginx.conf + mode: "0644" + backup: true + notify: Test and restart nginx + + - name: Create log directories + ansible.builtin.file: + path: "/var/log/nginx/{{ item.name }}" + state: directory + owner: "{{ nginx_user }}" + group: "{{ nginx_log_group }}" + mode: "0755" + loop: "{{ sites }}" + + - name: Copy initial http-only sites + ansible.builtin.template: + src: nginx/http.conf.j2 + dest: "/etc/nginx/sites-available/{{ item.name }}-http" + mode: "0644" + loop: "{{ sites }}" + notify: Test and restart nginx + + - name: Check if initial https sites have been enabled + ansible.builtin.stat: + path: "/etc/nginx/sites-enabled/{{ item.name }}-https" + register: https_sites + loop: "{{ sites }}" + + - name: Check if final sites have been enabled + ansible.builtin.stat: + path: "/etc/nginx/sites-enabled/{{ item.name }}" + register: final_sites + loop: "{{ sites }}" + + - name: Enable initial http-only sites + ansible.builtin.file: + src: "/etc/nginx/sites-available/{{ item.name }}-http" + dest: "/etc/nginx/sites-enabled/{{ item.name }}-http" + state: link + loop: "{{ sites }}" + loop_control: + index_var: index + when: + - not https_sites.results[index].stat.exists + - not final_sites.results[index].stat.exists + notify: Test and restart nginx + + - name: Disable default nginx site + ansible.builtin.file: + path: /etc/nginx/sites-enabled/default + state: absent + notify: Test and restart nginx + + - name: Allow http traffic through firewall + community.general.ufw: + rule: allow + port: 80 + proto: tcp + + handlers: + - name: Test and restart nginx + ansible.builtin.include_tasks: tasks/test_and_restart_nginx.yaml diff --git a/playbooks/tasks/test_and_restart_nginx.yaml b/playbooks/tasks/test_and_restart_nginx.yaml new file mode 100644 index 0000000..626db1d --- /dev/null +++ b/playbooks/tasks/test_and_restart_nginx.yaml @@ -0,0 +1,10 @@ +- name: Test nginx configuration + ansible.builtin.command: nginx -t + register: nginx_config_test + changed_when: false + +- name: Restart nginx + ansible.builtin.systemd: + name: nginx + state: restarted + when: nginx_config_test.rc == 0 diff --git a/playbooks/templates/nginx/http.conf.j2 b/playbooks/templates/nginx/http.conf.j2 new file mode 100644 index 0000000..3657d35 --- /dev/null +++ b/playbooks/templates/nginx/http.conf.j2 @@ -0,0 +1,16 @@ +server { + server_name {{ item.domains | join(' ') }}; + + listen 80; + listen [::]:80; + + root /var/www/html; + index index.nginx-debian.html; + + location / { + try_files $uri $uri/ =404; + } + + access_log /var/log/nginx/{{ item.name }}/access.log; + error_log /var/log/nginx/{{ item.name }}/error.log; +} diff --git a/playbooks/templates/sshd_hardening.conf.j2 b/playbooks/templates/ssh/hardening.conf.j2 index 77815bd..77815bd 100644 --- a/playbooks/templates/sshd_hardening.conf.j2 +++ b/playbooks/templates/ssh/hardening.conf.j2 diff --git a/playbooks/templates/ssh.socket.conf.j2 b/playbooks/templates/ssh/listen.conf.j2 index 48c68dd..48c68dd 100644 --- a/playbooks/templates/ssh.socket.conf.j2 +++ b/playbooks/templates/ssh/listen.conf.j2 |