Files
@ 6139a13fde7a
Branch filter:
Location: website/deploy/install.yml - annotation
6139a13fde7a
8.0 KiB
text/x-yaml
Add payment time column to Stripe export
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 | bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf 3c79fa50b554 bc4c5deec4bf bc4c5deec4bf 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 bc4c5deec4bf bc4c5deec4bf 3c79fa50b554 3c79fa50b554 bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf 3c79fa50b554 2352082ec91e 2352082ec91e 2352082ec91e 2352082ec91e 2352082ec91e 2352082ec91e 2352082ec91e 2352082ec91e 2352082ec91e 2352082ec91e 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf 1707c327e053 1707c327e053 1707c327e053 1707c327e053 1707c327e053 1707c327e053 1707c327e053 1707c327e053 1707c327e053 1707c327e053 1707c327e053 9f87feb19dbf 9f87feb19dbf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf a2f38653fb02 bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf 9f87feb19dbf 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 bc4c5deec4bf 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 6c0daf94103c bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 3c79fa50b554 bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf bc4c5deec4bf | # Ansible playbook for basic web server configuration.
#
# Run with:
# ANSIBLE_STDOUT_CALLBACK=debug ansible-playbook deploy/install.yml -i deploy/inventory.ini --verbose
# Notes:
#
# /etc/apache2 uses OS defaults aside from "site-available", "sites-enabled" and
# "conservancy.conf".
#
# Current site does not use "django.contrib.staticfiles", so no need to run
# `collectstatic`.
#
# SQLite database lives at /var/lib/www/database.
#
# Disabled Rackspace CDN videos.
- name: Configure web server
hosts: web
become: true
vars:
ansible_ssh_pipelining: true
tasks:
- name: Install unattended upgrades
apt:
name: unattended-upgrades
- name: Configure unattended upgrades overrides
# See defaults in 50unattended-upgrades.
copy:
dest: /etc/apt/apt.conf.d/20auto-upgrades
content: |
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
Unattended-Upgrade::Mail "root";
- name: Add extensive history logging
blockinfile:
path: /etc/bash.bashrc
block: |
# Write to history file immediately (rather than only when shell is
# closed). For setting history length see HISTSIZE and HISTFILESIZE in
# bash(1).
shopt -s histappend
PROMPT_COMMAND='history -a'
HISTSIZE=1000000
HISTFILESIZE=1000000
insertafter: EOF
- name: Mount the media volume
# OSUOSL VMs come with fixed storage that's tied to the cores and RAM
# selection. Easier to put this data on an external volume.
ansible.posix.mount:
src: /dev/sdb1
path: /var/www/media
fstype: ext4
state: mounted
boot: false
- name: Install Apache
apt:
name: apache2,libapache2-mod-wsgi-py3
- apache2_module:
state: present
name: ssl
- apache2_module:
state: present
name: rewrite
# The proxy and proxy-http modules are required to rewrite /.well-known/
# requests to the mail server if the file doesn't exist. This is use to
# renew Let's Encrypt certificates.
- apache2_module:
state: present
name: proxy
- apache2_module:
state: present
name: proxy-http
- name: Install Postfix
apt:
pkg:
- postfix
# libsasl2-modules fixes "SASL authentication failure: No worthy mechs found"
- libsasl2-modules
- mailutils
# # Commented because you only want this on first run ever.
# - name: Add file for SMTP credentials
# copy:
# dest: /etc/postfix/sasl_passwd
# content: |-
# # After updating, run `sudo postmap hash:/etc/postfix/sasl_passwd`.
# [mail.sfconservancy.org]:587 conference@sfconservancy.org:PASSWORD
- name: Configure Postfix for relaying
copy:
src: postfix/main.cf
dest: /etc/postfix/main.cf
notify:
- restart postfix
- name: Alias mail to root
copy:
dest: /etc/aliases
content: |-
postmaster: root
root: sysadmin@sfconservancy.org, sysadmin@sturm.com.au
notify:
- restart postfix
- name: Install Certbot
apt:
name: certbot, python3-certbot-apache
- name: Install Python dependencies
apt:
name: python3-django,python3-bs4,python3-html5lib,python3-django-countries
- name: Install Python essentials
apt:
name: python3-venv,python3-pip,python3-wheel
- name: Install Python build dependencies
apt:
name: build-essential,python3-dev,libffi-dev
- name: Security settings
apt:
name: fail2ban
- name: Disable SSH password authentication
lineinfile:
path: /etc/ssh/sshd_config
line: 'PasswordAuthentication no'
regexp: 'PasswordAuthentication '
notify:
- restart sshd
- name: Install utilities
apt:
name: tmux,curl,git,magic-wormhole,htop,rsync
- name: Create the project directory
file:
path: /var/www/website
state: directory
owner: www-data
group: www-data
mode: '0755'
# TODO: Needs to force owner to www-data:www-data
- name: Git checkout
ansible.builtin.git:
repo: 'https://k.sfconservancy.org/website'
dest: /var/www/website
version: master
remote: upstream
- name: Create the database directory
file:
path: /var/lib/www/database
state: directory
owner: www-data
group: www-data
mode: '0755'
- name: Create static dir
file:
path: /var/www/website/conservancy/static
state: directory
owner: www-data
group: www-data
mode: '0755'
- name: Install `netfilter-persistent` && `iptables-persistent` packages
apt:
pkg:
- iptables-persistent
- netfilter-persistent
- name: Install iptables # May need kernel reload/reboot
apt:
name: iptables,iptables-netflow-dkms
- name: Flush existing firewall rules
iptables:
flush: true
- name: Firewall rule - allow all loopback traffic
iptables:
action: append
chain: INPUT
in_interface: lo
jump: ACCEPT
- name: Firewall rule - allow established connections
iptables:
chain: INPUT
ctstate: ESTABLISHED,RELATED
jump: ACCEPT
- name: Firewall rule - allow port ping traffic
iptables:
chain: INPUT
jump: ACCEPT
protocol: icmp
- name: Firewall rule - allow port 22/SSH traffic
iptables:
chain: INPUT
destination_port: '22'
jump: ACCEPT
protocol: tcp
- name: Firewall rule - allow port 80/HTTP traffic
iptables:
chain: INPUT
destination_port: '80'
jump: ACCEPT
protocol: tcp
- name: Firewall rule - allow port 443/HTTPS traffic
iptables:
chain: INPUT
destination_port: '443'
jump: ACCEPT
protocol: tcp
- name: Firewall rule - drop any traffic without rule
iptables:
chain: INPUT
jump: DROP
- name: Flush existing firewall rules
iptables:
ip_version: ipv6
flush: true
- name: Firewall rule - allow all loopback traffic v6
iptables:
ip_version: ipv6
action: append
chain: INPUT
in_interface: lo
jump: ACCEPT
- name: Firewall rule - allow established connections v6
iptables:
ip_version: ipv6
chain: INPUT
ctstate: ESTABLISHED,RELATED
jump: ACCEPT
- name: Firewall rule - allow port ping traffic v6
iptables:
ip_version: ipv6
chain: INPUT
jump: ACCEPT
protocol: icmp
- name: Firewall rule - allow port 22/SSH traffic v6
iptables:
ip_version: ipv6
chain: INPUT
destination_port: '22'
jump: ACCEPT
protocol: tcp
- name: Firewall rule - allow port 80/HTTP traffic v6
iptables:
ip_version: ipv6
chain: INPUT
destination_port: '80'
jump: ACCEPT
protocol: tcp
- name: Firewall rule - allow port 443/HTTPS traffic v6
iptables:
ip_version: ipv6
chain: INPUT
destination_port: '443'
jump: ACCEPT
protocol: tcp
- name: Firewall rule - drop any traffic without rule v6
iptables:
ip_version: ipv6
chain: INPUT
jump: DROP
handlers:
- name: restart sshd
service:
name: ssh
state: reloaded
- name: restart postfix
service:
name: postfix
state: reloaded
|