first commit
This commit is contained in:
commit
1dff8396d7
12 changed files with 284 additions and 0 deletions
4
README.md
Normal file
4
README.md
Normal file
|
@ -0,0 +1,4 @@
|
|||
Ansible Role dmarc-srg
|
||||
======================
|
||||
|
||||
A role to install [dmarc-srg](https://github.com/liuch/dmarc-srg), a DMARC report analyzer.
|
8
defaults/main.yml
Normal file
8
defaults/main.yml
Normal file
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
dmarcsrg_user: dmarcsrg
|
||||
dmarcsrg_home: /opt/dmarc-srg
|
||||
overrides_path: "{{ dmarcsrg_home }}/local.d"
|
||||
dmarcsrg_github_api_url: https://api.github.com/repos/liuch/dmarc-srg/releases/latest
|
||||
|
||||
dmarcsrg_database: dmarcsrg
|
||||
dmarcsrg_database_password: "{{ lookup('password', '/tmp/dmarcsrg_db_pwd length=42 chars=ascii_letters,digits') }}"
|
2
handlers/main.yml
Normal file
2
handlers/main.yml
Normal file
|
@ -0,0 +1,2 @@
|
|||
---
|
||||
# handlers file for .
|
10
meta/main.yml
Normal file
10
meta/main.yml
Normal file
|
@ -0,0 +1,10 @@
|
|||
galaxy_info:
|
||||
author: Sense.Lab admins
|
||||
description: A role to install dmarc-srg
|
||||
company: Sense.Lab e.V.
|
||||
license: GPLv3
|
||||
min_ansible_version: "2.11"
|
||||
platforms:
|
||||
- name: Debian
|
||||
versions:
|
||||
- bookworm
|
20
tasks/database.yml
Normal file
20
tasks/database.yml
Normal file
|
@ -0,0 +1,20 @@
|
|||
---
|
||||
- name: "Database | Crate database"
|
||||
community.mysql.mysql_db:
|
||||
name: "{{ dmarcsrg_database }}"
|
||||
state: present
|
||||
login_unix_socket: "{{ mysql_socket }}"
|
||||
login_user: root
|
||||
register: mariadb_created
|
||||
delegate_to: "{{ database_host }}"
|
||||
|
||||
- name: "Database | Create database user"
|
||||
community.mysql.mysql_user:
|
||||
name: "{{ dmarcsrg_database }}"
|
||||
password: "{{ dmarcsrg_database_password }}"
|
||||
priv: "{{ dmarcsrg_database }}.*:ALL"
|
||||
host: "{{ inventory_hostname }}"
|
||||
state: present
|
||||
login_unix_socket: "{{ mysql_socket }}"
|
||||
login_user: root
|
||||
delegate_to: "{{ database_host }}"
|
56
tasks/install.yml
Normal file
56
tasks/install.yml
Normal file
|
@ -0,0 +1,56 @@
|
|||
---
|
||||
- name: "Install | Check for latest version"
|
||||
ansible.builtin.shell:
|
||||
cmd: curl -sL "{{ dmarcsrg_github_api_url }}" | jq -r ".tag_name"
|
||||
changed_when: false
|
||||
register: latest_version
|
||||
|
||||
- name: "Install | Get download URL"
|
||||
ansible.builtin.shell:
|
||||
cmd: curl -sL "{{ dmarcsrg_github_api_url }}" | jq -r ".tarball_url"
|
||||
changed_when: false
|
||||
register: download_url
|
||||
|
||||
- name: "Install | Create directories"
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
loop:
|
||||
- "{{ dmarcsrg_home }}"
|
||||
- "{{ dmarcsrg_home }}/{{ latest_version.stdout }}"
|
||||
- "{{ overrides_path }}"
|
||||
|
||||
- name: "Install | Download install files"
|
||||
ansible.builtin.unarchive:
|
||||
src: "{{ download_url.stdout }}"
|
||||
dest: "{{ dmarcsrg_home }}/{{ latest_version.stdout }}"
|
||||
remote_src: true
|
||||
extra_opts:
|
||||
- "--strip-components=1"
|
||||
|
||||
- name: "Install | Copy configuration file"
|
||||
ansible.builtin.template:
|
||||
src: conf.php.j2
|
||||
dest: "{{ overrides_path }}/conf.php"
|
||||
mode: "0640"
|
||||
owner: "{{ dmarcsrg_user }}"
|
||||
group: "{{ dmarcsrg_user }}"
|
||||
|
||||
- name: "Install | Link data"
|
||||
ansible.builtin.file:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
state: link
|
||||
loop:
|
||||
- src: "{{ dmarcsrg_home }}/{{ latest_version.stdout }}"
|
||||
dest: "{{ dmarcsrg_home }}/current"
|
||||
- src: "{{ overrides_path }}/conf.php"
|
||||
dest: "{{ dmarcsrg_home }}/{{ latest_version.stdout }}/conf.php"
|
||||
|
||||
- name: "Install | Initiate database"
|
||||
ansible.builtin.command:
|
||||
cmd: php utils/database_admin.php init
|
||||
chdir: "{{ dmarcsrg_home }}/current"
|
||||
become: true
|
||||
become_user: "{{ dmarcsrg_user }}"
|
16
tasks/main.yml
Normal file
16
tasks/main.yml
Normal file
|
@ -0,0 +1,16 @@
|
|||
---
|
||||
- name: Create user
|
||||
ansible.builtin.import_tasks: user.yml
|
||||
tags: user
|
||||
|
||||
- name: Create database
|
||||
ansible.builtin.import_tasks: database.yml
|
||||
tags: database
|
||||
|
||||
- name: Install dmarc-srg
|
||||
ansible.builtin.import_tasks: install.yml
|
||||
tags: install
|
||||
|
||||
- name: Configure PHP-FPM
|
||||
ansible.builtin.import_tasks: phpfpm.yml
|
||||
tags: phpfpm
|
47
tasks/phpfpm.yml
Normal file
47
tasks/phpfpm.yml
Normal file
|
@ -0,0 +1,47 @@
|
|||
---
|
||||
- name: "PHPFPM | Create logfile"
|
||||
ansible.builtin.file:
|
||||
path: "{{ php_fpm_log_dir }}/{{ dmarcsrg_user }}.log"
|
||||
state: touch
|
||||
mode: "0644"
|
||||
owner: "{{ dmarcsrg_user }}"
|
||||
group: "{{ dmarcsrg_user }}"
|
||||
|
||||
- name: "PHPFPM | Copy configuration"
|
||||
ansible.builtin.template:
|
||||
src: fpmpool.j2
|
||||
dest: "/etc/php/{{ php_version.stdout }}/fpm/pool.d/{{ dmarcsrg_user }}.cfg"
|
||||
mode: "0644"
|
||||
notify:
|
||||
- stop php-fpm-socket
|
||||
- stop php-fpm-service
|
||||
- start php-fpm-socket
|
||||
|
||||
- name: "PHPFPM | Create systemd override directory"
|
||||
ansible.builtin.file:
|
||||
path: "/etc/systemd/system/php-fpm@{{ dmarcsrg_user }}.service.d"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: "PHPFPM | Copy systemd override configuration"
|
||||
ansible.builtin.template:
|
||||
src: systemd/override.conf.j2
|
||||
dest: "/etc/systemd/system/php-fpm@{{ dmarcsrg_user }}.service.d/override.conf"
|
||||
mode: "0644"
|
||||
notify:
|
||||
- stop php-fpm-socket
|
||||
- stop php-fpm-service
|
||||
- start php-fpm-socket
|
||||
|
||||
- name: "PHPFPM | Enable systemd socket"
|
||||
ansible.builtin.systemd:
|
||||
name: "php-fpm@{{ dmarcsrg_user }}.socket"
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
|
||||
- name: "PHPFPM | Enable systemd service"
|
||||
ansible.builtin.systemd:
|
||||
name: "php-fpm@{{ dmarcsrg_user }}.service"
|
||||
enabled: true
|
||||
daemon-reload: true
|
14
tasks/user.yml
Normal file
14
tasks/user.yml
Normal file
|
@ -0,0 +1,14 @@
|
|||
---
|
||||
- name: "User | Create system user"
|
||||
ansible.builtin.user:
|
||||
name: "{{ dmarcsrg_user }}"
|
||||
shell: /bin/false
|
||||
create_home: false
|
||||
password_lock: true
|
||||
system: true
|
||||
|
||||
- name: "User | Add www-data to user group"
|
||||
ansible.builtin.user:
|
||||
name: www-data
|
||||
groups: "{{ dmarcsrg }}"
|
||||
append: true
|
72
templates/conf.php.j2
Normal file
72
templates/conf.php.j2
Normal file
|
@ -0,0 +1,72 @@
|
|||
<?php
|
||||
|
||||
// {{ ansible_managed }}
|
||||
|
||||
$debug = 0;
|
||||
$database = [
|
||||
'host' => '{{ database_host }}',
|
||||
'type' => 'mysql',
|
||||
'name' => '{{ dmarcsrg_database }}',
|
||||
'user' => '{{ dmarcsrg_datababse }}',
|
||||
'password' => '{{ dmarcsrg_datababse_password }}',
|
||||
'table_prefix' => ''
|
||||
];
|
||||
|
||||
/**
|
||||
* It is only required if you want to get reports from a mailbox automatically.
|
||||
* In order to collect reports from several mailboxes, you should put each
|
||||
* mailbox settings in an array.
|
||||
*/
|
||||
$mailboxes = [
|
||||
'name' => 'Dmarc-Rua',
|
||||
'host' => 'yourdomain.net',
|
||||
'encryption' => 'ssl',
|
||||
'novalidate-cert' => false,
|
||||
'username' => 'dmarc-rua@yourdomain.net',
|
||||
'password' => 'password',
|
||||
'mailbox' => 'INBOX',
|
||||
'auth_exclude' => []
|
||||
];
|
||||
|
||||
$admin = [
|
||||
'password' => 'null',
|
||||
'user_management' => false
|
||||
];
|
||||
|
||||
//
|
||||
$fetcher = [
|
||||
'mailboxes' => [
|
||||
'messages_maximum' => 10,
|
||||
'when_done' => 'mark_seen',
|
||||
'when_failed' => 'move_to:failed'
|
||||
],
|
||||
'allowed_domains' => ''
|
||||
];
|
||||
|
||||
$mailer = [
|
||||
'from' => 'postmaster@yourdomain.net',
|
||||
'default' => 'user@yourdomain.net'
|
||||
];
|
||||
|
||||
//
|
||||
$cleaner = [
|
||||
'mailboxes' => [
|
||||
'days_old' => 30,
|
||||
'delete_maximum' => 50,
|
||||
'leave_minimum' => 100,
|
||||
'done' => 'seen',
|
||||
'failed' => 'none'
|
||||
],
|
||||
|
||||
'reports' => [
|
||||
'days_old' => 30,
|
||||
'delete_maximum' => 50,
|
||||
'leave_minimum' => 100
|
||||
],
|
||||
|
||||
'reportlog' => [
|
||||
'days_old' => 30,
|
||||
'delete_maximum' => 50,
|
||||
'leave_minimum' => 100
|
||||
]
|
||||
];
|
25
templates/fpmpool.j2
Normal file
25
templates/fpmpool.j2
Normal file
|
@ -0,0 +1,25 @@
|
|||
;{{ ansible_managed }}
|
||||
|
||||
[global]
|
||||
error_log = ${FPM_ERROR_LOG}
|
||||
|
||||
[{{ dmarcsrg_user }}]
|
||||
listen = ${FPM_SOCKET_PATH}
|
||||
pm = ondemand
|
||||
pm.max_children = 5
|
||||
pm.process_idle_timeout = 10s
|
||||
pm.max_requests = 200
|
||||
pm.status_path = /status
|
||||
chdir = /
|
||||
clear_env = no
|
||||
security.limit_extensions = .php .php3 .php4 .php5
|
||||
php_admin_value[opcache.validate_permission] = 1
|
||||
php_admin_value[opcache.validate_root] = 1
|
||||
php_admin_value[session.cookie_samesite] = Lax
|
||||
php_admin_value[openssl.capath] = /etc/ssl/certs
|
||||
php_flag[display_errors] = off
|
||||
php_admin_flag[log_errors] = on
|
||||
php_admin_value[memory_limit] = 256M
|
||||
php_admin_value[upload_max_filesize] = {{ postfix_message_size_limit | human_readable(unit='M') | replace (' MB','') | int | round }}M
|
||||
php_admin_value[post_max_size] = {{ postfix_message_size_limit | human_readable(unit='M') | replace (' MB','') | int | round }}M
|
||||
php_admin_value[disable_functions] = mail,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_exec,passthru,system,proc_nice,proc_terminate,curl_ini,parse_ini_file,show_source,dl,symlink,system_exec,exec,shell_exec,phpinfo
|
10
templates/systemd/override.conf.j2
Normal file
10
templates/systemd/override.conf.j2
Normal file
|
@ -0,0 +1,10 @@
|
|||
# {{ ansible_managed }}
|
||||
|
||||
[Service]
|
||||
LockPersonality=true
|
||||
NoNewPrivileges=true
|
||||
ProtectSystem=strict
|
||||
ReadWritePaths=-{{ php_fpm_log_dir }}/
|
||||
ReadWritePaths=-/var/run/
|
||||
ReadWritePaths=-/run/
|
||||
InaccessiblePaths=-/root/
|
Loading…
Reference in a new issue