--- ansible_python_interpreter: /usr/bin/python3 syslogfacility: LOG_LOCAL2 network_nameservers: "{{ dns_servers }}" network_search: kill0.net postfix_aliases: postmaster: root hostmaster: root webmaster: root abuse: root administrator: root admin: root root: sysops@kill0.net devnull: /dev/null #firewall_ssh_whitelist: # - "{{ lookup('dig', 'jump0.kill0.net/A') }}" # - "{{ lookup('dig', 'jump0.kill0.net/AAAA') }}" # - 192.168.255.17 # - 2600:3c00:e000:343::11/128 firewall_ipset_mgmt: - "{{ lookup('dig', 'jump0.kill0.net/A') }}" - "{{ lookup('dig', 'jump0.kill0.net/AAAA') }}" firewall_limited_tcp_ports: - 22 #unattended_upgrades_mailto: sysops@kill0.net unattended_upgrades_mailto: devnull unattended_upgrades_automatic_reboot: yes unattended_upgrades_automatic_reboot_time: '8:00' unattended_upgrades_reboot_with_users: no openssh_sshd_config: PermitRootLogin: prohibit-password autossh_config: - name: influx host: jump0.kill0.net options: - -L 127.254.254.1:8086:127.0.0.1:8086 - name: syslog host: jump0.kill0.net options: - -L 127.254.254.1:1514:127.0.0.1:514 user_authorized_keys_hash: ryan: - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGznaofIstAxYsX1MH8xQiZU4aOO4SUw9OlRbyFMfQTx - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKdWuh9fbKNubIWaYGwOcbGNkh1Osifh/22KE5pKlVxfVqTT2MiEY6LlvlqR0UkU0hos5F0aEigK7wsABy0KEP2Z0hlx1IwO89rX1TbeqbNVvFk34+jBFflNhBTwE4fekBc4WyvQ3MtlygUTqUnPiQNMBL6uV3rHfh015C5ZqRHSqT7O/+bIbuLSOLizQPph/EJ7U7ti5gfZb5J8uSLdaK0vCLSIokleht3dE1DxfNq4LaVcNCGfNXHIzhaew7L4IkJ7nSWGRtGD7aHKcPV8PRJCt3Mn1IDXrVwFYx0tmFF4eyJ5h9l7fTiRs8PjJ8zD8BePtAP/LFCrhCS+vYbGJT # windows 10 - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCe1dmofrPBmchiBs1NQxJVEiAyNfd/eG/U6xh8buekKpEYu6vY9oLN3fk1TdIQoq5gl6qVMaT8cRXQkN7zPBHdwpX55ifmM8O5sQJ3Q2Wioi+6W2elVG58kDIaWFUiQLFm3CXUQ43Ec3+SMo2xlr8b7tUUbCc7690TNJx4gB1t+mYQMIv5OBuzRgUJLSclT0Tp5luJgVKVimPKXTqawDPIKwEZHHvJjs1S4irDdIP4OJJHfHmegapXbMexfEEmgt82axlSjywlMDOKCxnJphOSxtzbUGHkdNMM8VBQC/iMEHprmp75LQzgL5tk9cdIe6T8b1XyuD3tdO/xguChBPpV # work - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICndorpp/6aKlLq2K1YP81r8zA80VGp1qAUeCZtdVhAw rcavicchioni@NMLT072 - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCW02T3dkh1Ra9n+Ql86e/C2ZdtwY5if5RZoc2BYwFCcygwP3GUKOrR6c9SW25B3X048+tVdTiOUhqfsqWf6jxCJ5h17lJ2sigMxEZOht0hUQZSgmQgdviYv3WYrqC4hlStumwEgEsJjRl9PP5LnIcdjWWINslaweFdfD7KhTRPlok1T2ycd0wEvsSCVATW32xV4Dpof5HLgLqnNwtK3VKSl7YIQu5i9SimtRDijwPnOkeMoknGjatpOu5VrnOP03GaExqXnjaIaUz++5GhCGEQEKhlcQrBCYlxubH+L4r6bka1S5r1GeeZNL6g+uUVUP5XaG8HcA9vArilmQfDj3xd rick: - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTt13M/kyXmm8ORhefa6b4e0j1XczLu+R/asgTSdvhDCljo1LLtDvXWdUVQCwXxMXw8aPKjskBr+k1KJOFsdfVi65dExHhmaHk4qeGgkSkLNLPaMkKcNv3h+hS7VGmZjsxU0+bwl0b3g6woKEuMjnD5MfCsKIs6TOB5XjoDw8PMC+BsOiafFPeXGL8UA4yBtdNXFk6B4Ev6lZflPvenJXXJjYeePnhXjPaI6cNjSPhByy8mPU0AzWhtq8akbXlOCUrjuq2XoatwVOd1ZWj344PHfav7zmZkYLWOE7AR++ng+4pNxrfeiCxBcgSluKNYkZFac04OX8PSNbvqTWA29GIDlmcomaSJOWslVoVOiWYQ+7wWIb0d2+RgH/6UvVS500NyacOSkSlfI8SyqC5VVb2jjUC+GQ2zW/IMfYlwRutXT3MRgVtuoQ2i/aXizPLsH6iBqKxQDMV48avTNIitN29owOBPpDNsd1o4iy4kdMPrAFmrPBYSA939nOUzPmCCwU= users_interactive: - name: ryan groups: - users - sudo - adm comment: Ryan Cavicchioni password: "{{ vault_user_password_hashes['ryan'] }}" - name: rick groups: - users comment: Rick Elias password: users_authorized_keys: - name: ryan keys: "{{ user_authorized_keys_hash['ryan'] }}" - name: rick keys: "{{ user_authorized_keys_hash['rick'] }}" - name: root keys: "{{ user_authorized_keys_hash['ryan'] }}" telegraf_config_outputs: influxdb: urls: - http://127.254.254.1:8086 telegraf_config_d: - name: ping config: inputs.ping: - urls: - 10.255.0.1 count: 10 ipv6: false binary: ping4 rsyslog_archival_format_enabled: true rsyslog_outputs: - name: omfwd params: target: 169.254.0.1 port: 514 protocol: tcp action.resumeretrycount: -1 queue.type: linkedlist queue.size: 1000000 queue.filename: fwd queue.saveonshutdown: "on" keepalive: "on" template: RSYSLOG_SyslogProtocol23Format tcp_framing: octet-counted sudo_aliases: host: - name: minecraft items: - mine[[\:digit\:]]* - name: jumphosts items: - jump[[\:digit\:]]* sudo_rules: - name: "%sudo" hosts: ALL runas: users: ALL groups: ALL tags: - NOPASSWD commands: ALL restic_repos: - name: b2 repo: "b2:kill0-infra-backup:/{{ inventory_hostname_short }}" environment: RESTIC_PASSWORD: "{{ vault_restic_repo_b2_password }}" B2_ACCOUNT_ID: "{{ vault_restic_repo_b2_account_id }}" B2_ACCOUNT_KEY: "{{ vault_restic_repo_b2_account_key }}" restic_jobs: - name: system repo: b2 paths: - / certs_trusted_ca: chill9-root-ca: | subject=C = US, O = chill9, CN = chill9 Root CA issuer=C = US, O = chill9, CN = chill9 Root CA notBefore=May 16 17:36:20 2020 GMT notAfter=May 14 17:36:20 2030 GMT -----BEGIN CERTIFICATE----- MIIFOjCCAyKgAwIBAgIQdRhWyOcUQ+uIEypQfJLvqTANBgkqhkiG9w0BAQsFADA3 MQswCQYDVQQGEwJVUzEPMA0GA1UECgwGY2hpbGw5MRcwFQYDVQQDDA5jaGlsbDkg Um9vdCBDQTAeFw0yMDA1MTYxNzM2MjBaFw0zMDA1MTQxNzM2MjBaMDcxCzAJBgNV BAYTAlVTMQ8wDQYDVQQKDAZjaGlsbDkxFzAVBgNVBAMMDmNoaWxsOSBSb290IENB MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAswTensn+vA45WGRp3o/5 LX+wh6PTHAGNluLaZRyUNOg+EunnXAvMBF912D587wLAiC1G9FGOn+8JVws2QITX +U8Y8L2vhnfGQNCQYvqBfJc5PJt3ZZ35to5tdTRJTeVhNWzIA7qOZh8ualFbCDYd m6K74SlfEbvKzS02pYWN6wCVXtGOPl7VoOtjg8cOUX6u1pZpBKQfzq3lgLS2oMp0 VuBJeUMiki/O8nCC10VCXcZ9q4bsUvWH9lJB/IqlKt+bG9TjO+vigb9eOSfaILkM d7NMziP5OQXMjv6NwmJQY7N5TiKWdh9h4G3KS41dr2Oeo+A1FcMEP9nkZb1lX3Ft 9Xzw8jJ99SD36mCEiqndvKA66/pcgMCvPAkkDwoSS+Er4LPcNmY2TVN+mIaF1OaS Dc1EAXUfjnX8mZlclS/AfCg8TIPCc8o6Neg3DECT2j+IC9bgeoLqZLIuzzLNFrG5 aPNhG+24phHqdZvAkdhHWeEh1GS5uMutvV02hF5MrZLz8ou+56feFpUmeuPzQAfR 0Xbz0ot2JdETmcCTcmZBQ+9oP5DIszJt85wCHJ5S5FewUzsXJs1MQue3NLSM5FBS hhOq+w6Pp64aaGKKyPi1GeZ1m31sM6w1yFVTQsqqy28GSjd/fQu55ESQ1sM0UhIo DCUBbNPxycJGh9Ivxii1RqMCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFHFG9UxX+vMe4E0uEZ2LqyldmHkbMA0GCSqG SIb3DQEBCwUAA4ICAQCC1jksFZp38JTGFIrNJJ6PgI6xXigtD2Z3KstS1cAIJi/P /3NPu8iTgoyhNiq7a20tojPJGPlumezy3R5twA16UCq8guGFVEEEkJX+wOM0T4p0 jwtcMOeA6GchzS3+u74kk8oIvvw41K5gU2VU/W2axxnejt/HQMAYaMsD/zcNPXrP oHAgEP5i7G7fX0FXqERnLU9lgbtTTTuszBnZHIdaUKSoK0Oji46y15pEdhxkVB6t /BiNPAYM1Pc/Hi366eb6yuY8eJCK94QMQBvYpIjNwThAKclFh8n62KF6gXqj7Hcu UQr1Z55KOuAlAM7fIBsqL4G2Ihs8yBeJe4YZrkdBqBzpJwOYNj7IsUnxgXYQpkVQ u5coTbrB8w4Mw8ak+L2McMAYhG5FIndy9GAFEEanrmyiHJW96MHqTD1xY9TyvdN/ Kt/lsYt0W/y6jknv7hU9uP4X/xkZk8z1D+m4jZHRQpnUPL1eSOUPSJ0t+68GQUVJ NJFmTx/qv1/9lXNy40jecX6sO4ZPLoQydMjwRmSerxki7MP4gxGNuBEpOvoj+ABM MBlD7BhUn5++BZQOLUU+JYr5kNi0WmFFN1v2SpoMyDydTgA+cJsS/TiOeMrY9Szs ZEFa3PSiA1fP03SRKC9tqjc7d6vQU0fE93wzcUCgyyf5mln6NV7cxOfDJNO8gA== -----END CERTIFICATE----- openvpn_config: client: client: remote: vpn-jump0.kill0.net 1194 ca: "{{ openvpn_etc_path }}/client/ca.pem" cert: "{{ openvpn_etc_path }}/client/cert.pem" key: "{{ openvpn_etc_path }}/client/key.pem" tls-auth: "{{ openvpn_etc_path }}/client/ta.key 1" verb: 3 dev: tun teleport_service_state: stopped teleport_service_enabled: false firewall_teleport_node_enabled: false teleport_roles: [ node ] teleport_config: teleport: auth_token: "{{ vault_teleport_static_token }}" ca_pin: sha256:4ef484a5949aadedf983bc1f1d43f6f31356ca37f9608267424ddc0d9b68e010 auth_servers: - "jump0.kill0.net:3025" firewall_ipset_node_exporter: - "{{ lookup('dig', 'jump0.kill0.net./A') }}" - "{{ lookup('dig', 'jump0.kill0.net./AAAA') }}" - 169.254.0.1 firewall_ipset_blackbox_exporter: - "{{ lookup('dig', 'jump0.kill0.net./A') }}" - "{{ lookup('dig', 'jump0.kill0.net./AAAA') }}" - 169.254.0.1 firewall_ipset_mtail: - "{{ lookup('dig', 'jump0.kill0.net./A') }}" - "{{ lookup('dig', 'jump0.kill0.net./AAAA') }}" - 169.254.0.1 node_exporter_du_directories: - /var/log/syslog - /var/spool/rsyslog wireguard_iptables: wg0: input: true wireguard_network_prefix: 169.254.0 wireguard_peers: wg0: - public_key: 1ipGUnK8XDbIoBIEF440BhwLUe0yHa5l3kZZc4eFxV8= endpoint: "{{ lookup('dig', 'jump0.kill0.net./A') }}:{{ wireguard_port }}" allowed_ips: "{{ hostvars['jump0.kill0.net'].wireguard_interfaces.wg0.address }}" supervisor_unix_http_server_socket_chown: root:node_exporter supervisor_unix_http_server_socket_chmod: "0770" firewall_ipset_loki: - 169.254.0.0/24 firewall_ipset_promtail: - "{{ lookup('dig', 'jump0.kill0.net./A') }}" - "{{ lookup('dig', 'jump0.kill0.net./AAAA') }}" - 169.264.0.0/24 promtail_clients: - url: http://169.254.0.1:3100/loki/api/v1/push external_labels: region: dallas provider: linode promtail_scrape_configs: - job_name: system static_configs: - targets: - localhost labels: job: syslog __path__: "/var/log/syslog/{{ ansible_hostname }}/**/*.log" - job_name: nginx static_configs: - targets: - localhost labels: job: nginx host: "{{ ansible_hostname }}" __path__: /var/log/nginx/*.log pipeline_stages: - match: selector: '{job="nginx"}' stages: - regex: expression: '^(?P[^ ]+) - (?P[^ ]*) \[(?P.*)\] "(?P[^ ]*) (?P[^ ]*) (?P[^ ]*)" (?P[\d]+) (?P[\d]+) "(?P[^"]*)" "(?P[^"]*)"?' - metrics: nginx_requests_total: type: Counter description: requests in nginx access logs source: method config: action: inc - labels: #remote_addr: #remote_user: #time_local: method: #request: #protocol: status: body_bytes_sent: #http_referer: #http_user_agent: loki_service_enabled: false loki_service_state: stopped promtail_service_enabled: false promtail_service_state: stopped influxdb_service_enabled: false influxdb_service_state: stopped influxdb_package_state: absent telegraf_service_enabled: false telegraf_service_state: stopped telegraf_package_state: absent