n0mad1k
7484a0e034
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
67 lines
1.8 KiB
YAML
67 lines
1.8 KiB
YAML
---
|
|
# Pi-hole native configuration
|
|
|
|
- name: Generate Pi-hole admin password
|
|
command: openssl rand -base64 16
|
|
register: pihole_password_gen
|
|
args:
|
|
creates: /etc/pihole/.phantom_password
|
|
|
|
- name: Save admin password
|
|
copy:
|
|
content: "{{ pihole_password_gen.stdout }}"
|
|
dest: /etc/pihole/.phantom_password
|
|
mode: "0600"
|
|
when: pihole_password_gen.changed
|
|
|
|
- name: Read saved password
|
|
slurp:
|
|
src: /etc/pihole/.phantom_password
|
|
register: pihole_password_file
|
|
|
|
- name: Set Pi-hole admin password
|
|
command: "pihole -a -p {{ (pihole_password_file.content | b64decode).strip() }}"
|
|
changed_when: true
|
|
|
|
- name: Set upstream DNS servers
|
|
command: "pihole -a setdns {{ pihole_upstream | replace(';', ' ') }}"
|
|
changed_when: true
|
|
|
|
- name: Configure blocklist level
|
|
block:
|
|
- name: Update gravity (standard blocklist)
|
|
command: pihole -g
|
|
changed_when: true
|
|
when: pihole_blocklist == "standard"
|
|
|
|
- name: Add aggressive blocklists
|
|
lineinfile:
|
|
path: /etc/pihole/adlists.list
|
|
line: "{{ item }}"
|
|
create: true
|
|
mode: "0644"
|
|
loop:
|
|
- "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
|
|
- "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt"
|
|
when: pihole_blocklist == "aggressive"
|
|
notify: update gravity
|
|
|
|
- name: Update gravity after blocklist changes
|
|
command: pihole -g
|
|
changed_when: true
|
|
when: pihole_blocklist == "aggressive"
|
|
|
|
- name: Enable DNSSEC
|
|
command: pihole -a dnssec on
|
|
changed_when: true
|
|
|
|
- name: Ensure pihole-FTL is running
|
|
service:
|
|
name: pihole-FTL
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Display admin credentials
|
|
debug:
|
|
msg: "Pi-hole admin password saved to /etc/pihole/.phantom_password — access admin at http://{{ ansible_default_ipv4.address | default('server_ip') }}/admin"
|