n0mad1k
97 lines
2.8 KiB
YAML
97 lines
2.8 KiB
YAML
---
|
|
# FlokiNET Redirector-only Configuration Playbook
|
|
# Note: FlokiNET requires pre-provisioned servers
|
|
|
|
- name: Prepare FlokiNET redirector configuration
|
|
hosts: localhost
|
|
gather_facts: false
|
|
connection: local
|
|
vars_files:
|
|
- vars.yaml
|
|
vars:
|
|
# Generate random shell handler port if not provided
|
|
shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"
|
|
redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
|
|
|
|
tasks:
|
|
- name: Validate required FlokiNET configuration
|
|
assert:
|
|
that:
|
|
- redirector_ip is defined and redirector_ip != ""
|
|
fail_msg: "FlokiNET requires redirector IP address. Set redirector_ip in vars.yaml or via --flokinet-redirector-ip."
|
|
|
|
- name: Add redirector to inventory
|
|
add_host:
|
|
name: "redirector"
|
|
groups: "redirectors"
|
|
ansible_host: "{{ redirector_ip }}"
|
|
ansible_user: "{{ ssh_user | default('root') }}"
|
|
ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}"
|
|
ansible_ssh_port: "{{ ssh_port | default(22) }}"
|
|
ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
|
|
|
|
- name: Verify SSH connection to redirector
|
|
wait_for:
|
|
host: "{{ redirector_ip }}"
|
|
port: "{{ ssh_port | default(22) }}"
|
|
delay: 10
|
|
timeout: 60
|
|
state: started
|
|
ignore_errors: true
|
|
|
|
- name: Provision FlokiNET redirector
|
|
hosts: redirectors
|
|
become: true
|
|
gather_facts: true
|
|
vars_files:
|
|
- vars.yaml
|
|
tasks:
|
|
- name: Wait for apt to be available
|
|
apt:
|
|
update_cache: yes
|
|
register: apt_result
|
|
until: apt_result is success
|
|
retries: 5
|
|
delay: 10
|
|
|
|
- name: Set hostname
|
|
hostname:
|
|
name: "redirector"
|
|
|
|
- name: Update apt cache
|
|
apt:
|
|
update_cache: yes
|
|
|
|
- name: Upgrade all packages
|
|
apt:
|
|
upgrade: dist
|
|
|
|
- name: Install base security packages
|
|
apt:
|
|
name:
|
|
- apt-transport-https
|
|
- ca-certificates
|
|
- curl
|
|
- gnupg
|
|
- lsb-release
|
|
- unattended-upgrades
|
|
- ufw
|
|
- fail2ban
|
|
- secure-delete
|
|
state: present
|
|
|
|
- name: Include common security hardening tasks
|
|
include_tasks: "../tasks/security_hardening.yml"
|
|
|
|
- name: Include common redirector configuration tasks
|
|
include_tasks: "../tasks/configure_redirector.yml"
|
|
|
|
- name: Print deployment summary
|
|
debug:
|
|
msg:
|
|
- "Redirector Configuration Complete!"
|
|
- "---------------------------------"
|
|
- "Redirector IP: {{ ansible_host }}"
|
|
- "Redirector Domain: {{ redirector_subdomain }}.{{ domain }} (Update DNS A record)"
|
|
- "Shell Handler Port: {{ shell_handler_port }}"
|
|
when: not disable_summary | default(false) |