feat: agregar configuración group_vars para host testing

- Definir host_ip: 157.180.114.62
- Requerido por rol knsupdate y certbot

abyayala.yml

@@ -14,8 +14,8 @@ matrix:
     roles:
       - rap
     nodos:
+      - llavero
       - marmite
-      - ka
       - nodochasqui
       - yanapak
       - comun01
@@ -57,6 +57,8 @@ matrix:
       - kipu
       - resistencia
       - carabobolibre
+      - samatuun
+      - kaasavi
 
   - service_name: respaldos
     domains:
@@ -70,12 +72,6 @@ matrix:
     nodo: marmite.comun
     force_https: yes
 
-  - service_name: ka
-    domains:
-      - 2012k.abyaya.la
-    nodo: ka.comun
-    force_https: yes
-
   - service_name: yanapak
     domains:
       - yanapak.abyaya.la
@@ -93,16 +89,8 @@ matrix:
       - pilmaiken.abyaya.la
     nodo: pilmaiken.comun
     force_https: yes
-    dns_extras:
-    - 'del pilmaiken mx'
-    - 'del pilmaiken txt'
-    - 'del pilmaiken spf'
-    - 'add pilmaiken mx 10 correspondencia.latina.red.'
-    - 'add pilmaiken txt "v=spf1 mx a:correspondencia.latina.red -all"'
-    - 'add pilmaiken spf "v=spf1 mx a:correspondencia.latina.red -all"'
-    - 'add dkim._domainkey.pilmaiken txt "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQ6JwPaawDzMXuscSgDpvipRFLGXSqgmvvI6jk18lcg0kK2lfxsvXGJ/6U7oCtKa35IEVzdigxD0o7DzklKxAsNIVbcExPJkFWzQuKuP6ATBESo7YUn7Z5qjfxBiNPS0FJp8XpbpUzN+zg/NTgmkggnwwC0tKgcEQ6HnI9AOa1LQIDAQAB"'
-    - 'add _dmarc.pilmaiken txt "v=DMARC1; p=reject; rua=mailto:postmaster@correspondencia.latina.red; ruf=mailto:postmaster@correspondencia.latina.red; adkim=s; aspf=s"'
-
+    ports: 
+      - 222
 
   - service_name: fundeps
     domains:
@@ -218,6 +206,8 @@ matrix:
     domains:
       - kipu.abyaya.la
     nodo: kipu.comun
+    ports:
+      - 223
     force_https: yes
 
   - service_name: carabobolibre
@@ -226,3 +216,14 @@ matrix:
     nodo: carabobolibre.comun
     force_https: yes
 
+  - service_name: samatuun
+    domains:
+      - samatuun.abyaya.la
+    nodo: samatuun.comun
+    force_https: yes
+
+  - service_name: kaasavi
+    domains:
+      - kaasavi.abyaya.la
+    nodo: kaasavi.comun
+    force_https: yes

deploy.yml

@@ -3,15 +3,14 @@
 ---
 - hosts: "{{ host }}"
   tasks:
-    - name: "unnattended upgrades"
-      apt:
-        name: "unnattended-upgrades"
-        state: "present"
     - name: import matrix
       local_action: "include_vars dir=./ files_matching={{ alt }}.yml"
 
     - include_role: name=althost
 
+    - include_role: name=firewall
+      tags: firewall
+    
     - include_role: name=proxy
       tags: proxy
 

group_vars/all/ssh_users.yml

@@ -1,6 +1,6 @@
 ---
 ssh_users:
-  - name: numerica
+  - name: berto
     comment: "Roberto Soto"
     sudo: yes
     servers_allow:

group_vars/testing/vars

@@ -0,0 +1 @@
+host_ip: 157.180.114.62

hosts.production

@@ -11,3 +11,9 @@ ansible_ssh_user=root
 sutty.nl
 
 [sutty:vars]
+
+[testing]
+157.180.114.62
+
+[testing:vars]
+ansible_ssh_user=root

roles/althost/tasks/main.yml

@@ -1,7 +1,11 @@
     # DOCKER CE this is specific for Debian
     # https://docs.docker.com/install/linux/docker-ce/debian/
     - block:
-    
+      - name: "unattended upgrades"
+        apt:
+          name: "unattended-upgrades"
+          state: "present"
+              
       - name: required packages
         apt:
           name: ['apt-transport-https', 'ca-certificates', 'curl', 'gnupg2', 'software-properties-common', 'python3-pip']
@@ -56,18 +60,6 @@
           state: present
           break_system_packages: true
 
-#      # https://stackoverflow.com/questions/77490435/attributeerror-cython-sources
-#      - name: fix python package Cython version
-#        pip:
-#          name: Cython
-#          state: present
-#          version: <3.0.0
-#          break_system_packages: true
-#        changed_when: false
-
-#      - name: fix python package PyYAML version
-#        shell: pip install "pyyaml==5.4.1" --no-build-isolation --break-system-packages
-
       - name: ensure python package docker-compose is present
         pip:
           name: docker-compose
@@ -76,7 +68,6 @@
 
       tags: installation
 
-
     # DOCKER COMPOSITION IN MASTER
     - block:
       - name: make sure compose path exists

roles/firewall/tasks/main.yml

@@ -0,0 +1,14 @@
+    - name: "Paquetes"
+      apt:
+        name:
+        - "iptables-persistent"
+        - "ipset-persistent"
+        state: "present"
+
+    - name: "Rules"
+      with_items:
+      - "rules.v4"
+      - "rules.v6"
+      template:
+        src: "{{ item }}.j2"
+        dest: "/etc/iptables/{{ item }}"

roles/firewall/templates/rules.v4.j2

@@ -0,0 +1,18 @@
+*filter
+:INPUT DROP [106:5591]
+:FORWARD DROP [28:1715]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -m conntrack --ctstate INVALID -j DROP
+-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -i comun -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
+-A INPUT -p udp -m udp --dport 53 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
+-A INPUT -p udp -m udp --dport 655 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 655 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 3000 -j ACCEPT
+COMMIT

roles/firewall/templates/rules.v6.j2

@@ -0,0 +1,5 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT

roles/proxy/files/custom_proxy_includes/sutty.abyaya.la

@@ -4,3 +4,8 @@ proxy_redirect off;
 proxy_connect_timeout 3m;
 proxy_send_timeout 3m;
 proxy_read_timeout 3m;
+
+limit_conn connection_limit 50;
+limit_req zone=request_limit nodelay burst=20;
+
+add_header Retry-After $retry_after always;

roles/proxy/files/custom_server_includes/sutty.abyaya.la

@@ -0,0 +1,4 @@
+add_header X-Frame-Options "sameorigin";
+add_header X-XSS-Protection "1; mode=block";
+add_header X-Content-Type-Options "nosniff";
+add_header Referrer-Policy "strict-origin-when-cross-origin";

roles/proxy/tasks/main.yml

@@ -10,17 +10,13 @@
       include_role: name=certbot
       tags: certbot
 
-    - include_tasks: ../../althost/tasks/compose.yml
-      vars: # forcing since this role is included statically
-        service_name: proxy
-
-    - name: configuration path
-      file: path={{ conf_path }} state=directory
-
-#   TODO leaving unused vhosts bugs proxy    
-    - name: clean vhosts_path
-      file: path={{ vhosts_path }} state=absent
-      when: clean_vhosts is defined
+    - name: configuration paths
+      file: path={{ comun }} state=directory
+      with_items:
+        - "{{ stream_path }}"
+        - "{{ conf_path }}"
+      loop_control:
+        loop_var: comun
 
     - name: virtual hosts path
       file: path={{ vhosts_path }} state=directory
@@ -35,6 +31,7 @@
       with_items:
         - common.conf
         - common_ssl.conf
+        - nginx.conf
       loop_control:
         loop_var: common
 
@@ -62,3 +59,22 @@
           loop_control:
             loop_var: vhost
           when: (service is undefined) or (service is defined and service == vhost.service_name)
+        
+        - name: streams loop
+          include_tasks: stream.yml
+          with_items: "{{ matrix_loop }}"
+          loop_control:
+            loop_var: vhost
+          when: (service is undefined) or (service is defined and service == vhost.service_name)
+
+        - name: slice matrix with those having ports defined
+          set_fact:
+            matrix_ports: "{{ matrix_ports | default([]) | union(ma.ports) }}"
+          with_items: "{{ matrix }}"
+          when: (ma.ports is defined)
+          loop_control:
+            loop_var: ma
+    
+    - include_tasks: ../../althost/tasks/compose.yml
+      vars: # forcing since this role is included statically
+        service_name: proxy

roles/proxy/tasks/stream.yml

@@ -0,0 +1,10 @@
+- set_fact:
+    vhost_dest: "{{ stream_path }}/{{ vhost.domains[0] }}.conf"
+    
+- name: default stream for ssh
+  template:
+    src: "{{ default_stream }}"
+    dest: "{{ vhost_dest }}"
+  when: vhost.ports is defined
+  notify:
+    - reload proxy

roles/proxy/templates/common_ssl.conf

@@ -6,6 +6,14 @@
     #   openssl dhparam -outform pem -out dhparam2048.pem 2048
     ssl_dhparam /etc/nginx/conf/dhparam2048.pem;
 
-    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
-    ssl_prefer_server_ciphers on;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ecdh_curve X25519:prime256v1:secp384r1;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
+    ssl_prefer_server_ciphers off;
 
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:MozSSL:10m;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+
+    ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

roles/proxy/templates/nginx.conf

@@ -0,0 +1,56 @@
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    server_tokens off;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    keepalive_timeout  65;
+
+    # Limitar cada dirección IP a 50 peticiones por segundo por IP y
+    # servidor.
+    limit_req_zone $server_name$binary_remote_addr zone=request_limit:10m rate=10r/s;
+    limit_req_status 429;
+
+    # Limita la cantidad de conexiones concurrentes por IP. Según la
+    # documentación de Nginx, cada request en HTTP/2 se cuenta como una
+    # conexión separada aunque sean la misma.
+    limit_conn_zone $binary_remote_addr zone=connection_limit:10m;
+    limit_conn_status 429;
+
+    # Informar a los navegadores que cuando reciban un error de muchas
+    # conexiones, esperen un segundo antes de reintentar.
+    map $status $retry_after {
+      default '';
+      429 '1';
+    }
+
+    #gzip  on;
+
+    include /etc/nginx/conf.d/*.conf;
+}
+
+stream {
+    include /etc/nginx/stream.d/*.conf;
+}
+

roles/proxy/templates/services.yml

@@ -8,11 +8,14 @@
     ports:
       - "80:80"
       - "443:443"
+{% for port in matrix_ports %}
+      - "{{ port }}:{{ port }}"
+{% endfor %}
     networks:
       - proxy
     volumes:
       - "{{ vhosts_path }}:/etc/nginx/conf.d/"
       - "{{ conf_path }}:/etc/nginx/conf/"
       - "certs_data:{{ nginx_certs_path }}:ro"
-
-
+      - "{{ conf_path }}/nginx.conf:/etc/nginx/nginx.conf:ro"
+      - "{{ stream_path }}:/etc/nginx/stream.d/"

roles/proxy/templates/stream.conf

@@ -0,0 +1,11 @@
+upstream ssh_{{ vhost.nodo | replace(".", "") }} {
+    server {{ vhost.nodo }}:22;
+}
+
+server {
+    listen {{ vhost.ports[0] }};
+
+    server_name  .{{ vhost.domains | join(' .') }};
+
+    proxy_pass ssh_{{ vhost.nodo | replace(".", "") }};
+}

roles/proxy/vars/main.yml

@@ -3,12 +3,14 @@ domains_default_force_https: no
 
 # nginx
 vhosts_path: "{{ compose_path }}/proxy/vhosts"
+stream_path: "{{ compose_path }}/proxy/stream"
 conf_path: "{{ compose_path }}/proxy/conf"
 nginx_certs_path: /etc/nginx/certs
 
 # defaults
 needs_vhost: no
 default_vhost: roles/proxy/templates/vhost.conf
+default_stream: roles/proxy/templates/stream.conf
 
 # certbot
 webmaster_email: webmaster@numerica.cl

roles/rap/tasks/main.yml

@@ -4,16 +4,20 @@
         state: present
       tags: installation
 
-# TODO: ERROR! conflicting action statements: synchronize, creates
-#    - name: copiar el codigo fuente
-#      synchronize:
-#        src: ../roles/rap/code/rap/
-#        dest: "{{ rap_path }}"
-#        perms: true
-#        rsync_opts:
-#          - "--exclude=.git"
-#      tags: rap
-#      creates: "{{ rap_path }}"
+    - name: Verificar si ya existe el codigo fuente
+      stat:
+        path: "{{ rap_path }}"
+      register: rap_status
+
+    - name: copiar el codigo fuente, si no existe
+      synchronize:
+        src: ../roles/rap/code/rap/
+        dest: "{{ rap_path }}"
+        perms: true
+        rsync_opts:
+          - "--exclude=.git"
+      tags: rap
+      when: not rap_status.stat.exists
 
     - name: agregar nodos a la VPN
       shell: 

tasks/files/ssh/berto.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCrhho0oQcAWX6ndpwxkNykJTohUg6vvEplqBa5pENU1gD61eahP4BU4weGrOWY28fBy3BhXOYFITWOxmdv7V7T9fG8WKXqT8MHkC9zaLzAZJ11tHq8OeDo0QGkBOoetf0dv0e3+FNijA9QKhqiwz+v0t5Ev0bSuSl28zHI3Tr0vF98SZulIR9CxDTTPA+Hel2Tl+LcVDZb80/tG9oAFBctzMK7AWB80X/DgXVfY0qgP97809JPX+Cqo/Q+LK55HxeDnfqDsA3m3KXQPODZm6ATEfmcx3MBYqJ8m0rdMKBwR16xDvAyB/LezHVCgmQvmzTRgzTwwwitOX83F5oIEArTK64s1dm0VLzj+Pw5Tetkde4YPHfajffXUbUxGTgD6M3NCvCLHedDMQDQT3LNOfFJGngGcwWJdStmMCWR6dd81epzPZiWHEZ093UWCPtE8kvrL4fRfIc/qSKWNCIyAoagKw4SwwyOfg0ONBJpjOfI7+vBKJVCZSDZQYyU/+Bo60k= berto@concon

testnet.yml

@@ -0,0 +1,23 @@
+althost: testnet
+matrix:
+  - service_name: comun
+    roles:
+      - kemal
+    domains:
+      - comun.abyayala.red
+
+  - service_name: dns
+    roles:
+      - knsupdate
+
+  - service_name: vpn
+    roles:
+      - rap
+    nodos:
+      - qi
+
+  - service_name: qi
+    domains:
+      - qi.abyayala.red
+    nodo: qi.comun
+#    force_https: yes