From b296f0308ea5c679a539e93cff65ba2c41d33555 Mon Sep 17 00:00:00 2001 From: boxswapper Date: Fri, 20 Mar 2026 12:32:24 -0600 Subject: [PATCH] updated with proper variables for environment --- README.md | 9 +---- deploy_matrix.yml | 68 +++++++++++++++++------------------- inventory/hosts.yml | 4 +-- secure.yml | 51 +++++++++++++++++++++++++++ templates/automatic.conf.j2 | 4 +++ templates/homeserver.yaml.j2 | 21 ++++++++++- templates/turnserver.conf.j2 | 2 +- vars/vars.yml | 17 +++++---- 8 files changed, 123 insertions(+), 53 deletions(-) create mode 100644 secure.yml create mode 100644 templates/automatic.conf.j2 diff --git a/README.md b/README.md index 08d0fa8..eb0895e 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,5 @@ ``` -# Ubuntu/Debian -sudo apt update && sudo apt install ansible -y - -# macOS (with Homebrew) -brew install ansible - -# Fedora/RHEL/CentOS -sudo dnf install ansible-core +ansible-playbook secure.yml -i inventory/hosts.yml --check --diff ``` ``` diff --git a/deploy_matrix.yml b/deploy_matrix.yml index fcb133f..399dcef 100644 --- a/deploy_matrix.yml +++ b/deploy_matrix.yml @@ -11,7 +11,7 @@ tasks: # ----------------------------------------------------------------- - # (unchanged) Install podman, create network, create volumes … + # Install podman, create network, create volumes … # ----------------------------------------------------------------- - name: Install podman package ansible.builtin.package: @@ -36,7 +36,36 @@ - "{{ vol_media }}" - "{{ vol_turn }}" - "{{ vol_nginx }}" - - "{{ vol_teamspeak }}" # <-- new volume + - "{{ vol_teamspeak }}" + + # ----------------------------------------------------------------- + # Pull required images (including Teamspeak) + # ----------------------------------------------------------------- + - name: Pull Traefik image + containers.podman.podman_image: + name: "{{ traefik_image }}" + state: present + + - name: Pull coturn image + containers.podman.podman_image: + name: "{{ turn_image }}" + state: present + + - name: Pull Synapse image + containers.podman.podman_image: + name: "{{ synapse_image }}" + state: present + + - name: Pull NGINX image + containers.podman.podman_image: + name: "{{ nginx_image }}" + state: present + + - name: Pull Teamspeak image + containers.podman.podman_image: + name: "{{ teamspeak_image }}" + state: present + # ----------------------------------------------------------------- # Render all configuration files from the templates @@ -88,34 +117,6 @@ restart_policy: always - # ----------------------------------------------------------------- - # Pull required images (including Teamspeak) - # ----------------------------------------------------------------- - - name: Pull Traefik image - containers.podman.podman_image: - name: "{{ traefik_image }}" - state: present - - - name: Pull coturn image - containers.podman.podman_image: - name: "{{ turn_image }}" - state: present - - - name: Pull Synapse image - containers.podman.podman_image: - name: "{{ synapse_image }}" - state: present - - - name: Pull NGINX image - containers.podman.podman_image: - name: "{{ nginx_image }}" - state: present - - - name: Pull Teamspeak image - containers.podman.podman_image: - name: "{{ teamspeak_image }}" - state: present - # ----------------------------------------------------------------- # Start containers (Traefik, TURN, Synapse, NGINX – unchanged) # ----------------------------------------------------------------- @@ -183,7 +184,7 @@ restart_policy: always # ----------------------------------------------------------------- - # **NEW** – Start Teamspeak container + # Start Teamspeak container # ----------------------------------------------------------------- - name: Start Teamspeak container containers.podman.podman_container: @@ -203,7 +204,7 @@ restart_policy: always # ----------------------------------------------------------------- - # (optional) generate systemd units for the new container + # generate systemd units for containers # ----------------------------------------------------------------- - name: Generate systemd unit for Teamspeak containers.podman.podman_generate_systemd: @@ -212,9 +213,6 @@ dest: "/etc/systemd/system/{{ teamspeak_container_name }}.service" when: generate_systemd | bool - # ----------------------------------------------------------------- - # (unchanged) systemd unit generation for the other containers - # ----------------------------------------------------------------- - name: Generate systemd unit for Traefik containers.podman.podman_generate_systemd: name: traefik diff --git a/inventory/hosts.yml b/inventory/hosts.yml index ce7c12a..27694ed 100644 --- a/inventory/hosts.yml +++ b/inventory/hosts.yml @@ -1,6 +1,6 @@ all: hosts: podman-host1: # <-- change to the host that will run Podman - ansible_host: 192.168.1.10 # its IP or DNS name - ansible_user: youruser # user that can sudo + ansible_host: 15.204.117.53 # its IP or DNS name + ansible_user: fedora # user that can sudo ansible_become: true \ No newline at end of file diff --git a/secure.yml b/secure.yml new file mode 100644 index 0000000..ae7ced0 --- /dev/null +++ b/secure.yml @@ -0,0 +1,51 @@ +--- +- name: Secure and Update Fedora 43 Server + hosts: all + become: true + gather_facts: true + + vars: + ansible_python_interpreter: /usr/bin/python3.14 + tasks: + # Update system + - name: Update all packages (safe upgrade) + ansible.builtin.dnf: + name: "*" + state: latest + update_cache: true + + - name: Install security tools + ansible.builtin.dnf: + name: + - audit + - fail2ban + - dnf-automatic + state: present + + + - name: Configure dnf-automatic for security updates only + ansible.builtin.template: + src: automatic.conf.j2 + dest: /etc/dnf/automatic.conf + + + - name: Ensure dnf-automatic timer is enabled + ansible.builtin.systemd: + name: dnf-automatic.timer + state: started + enabled: true + + # Ensure SELinux is enforcing + - name: Ensure SELinux is in enforcing mode + ansible.posix.selinux: + policy: targeted + state: enforcing + + # Enable and start fail2ban + - name: Enable and start fail2ban + ansible.builtin.service: + name: fail2ban + state: started + enabled: true + + diff --git a/templates/automatic.conf.j2 b/templates/automatic.conf.j2 new file mode 100644 index 0000000..05928e2 --- /dev/null +++ b/templates/automatic.conf.j2 @@ -0,0 +1,4 @@ +[commands] +upgrade_type = security +apply_updates = yes +download_updates = yes \ No newline at end of file diff --git a/templates/homeserver.yaml.j2 b/templates/homeserver.yaml.j2 index 69c8e1b..39d0e7f 100644 --- a/templates/homeserver.yaml.j2 +++ b/templates/homeserver.yaml.j2 @@ -1,4 +1,6 @@ server_name: "{{ matrix_domain }}" +trusted_key_servers: + - server_name: "{{ matrix_domain }}" listeners: - port: {{ synapse_http_port }} @@ -28,4 +30,21 @@ oidc_providers: issuer: "https://accounts.google.com" client_id: "{{ google_oidc_client_id }}" client_secret: "{{ google_oidc_client_secret }}" - scopes: {{ google_oidc_scopes | to_nice_yaml | indent(6) }} \ No newline at end of file + scopes: {{ google_oidc_scopes | to_nice_yaml | indent(6) }} + +# ----------------------------------------------------------------- +# Database provider +#------------------------------------------------------------------ +database: + name: sqlite3 + args: + database: /data/homeserver.db +log_config: "/data/my.matrix.host.log.config" +media_store_path: /data/media_store +registration_shared_secret: "{{ registration_shared_secret }}" +report_stats: true +macaroon_secret_key: "{{ macaroon_secret_key }} +form_secret: "{{ form_secret }}" +signing_key_path: "/data/my.matrix.host.signing.key" +trusted_key_servers: + - server_name: "matrix.org" \ No newline at end of file diff --git a/templates/turnserver.conf.j2 b/templates/turnserver.conf.j2 index d98173d..e7415e7 100644 --- a/templates/turnserver.conf.j2 +++ b/templates/turnserver.conf.j2 @@ -5,7 +5,7 @@ realm={{ matrix_domain }} static-auth-secret={{ turn_secret }} # If your host sits behind NAT and you need to force the public IP, uncomment: -# external-ip=YOUR_PUBLIC_IP +# external-ip={{ public_ipv4 }} allowed-peer-ip=0.0.0.0/0 diff --git a/vars/vars.yml b/vars/vars.yml index 9568c8d..335d7fa 100644 --- a/vars/vars.yml +++ b/vars/vars.yml @@ -1,6 +1,7 @@ # -------------------------------------------------------------- # General # -------------------------------------------------------------- +public_ipv4: 15.204.117.53 matrix_domain: "matrix.fpov.space" landing_domain: "org.fpov.space teamspeak_domain: "ts.fpov.space" # <-- new @@ -15,14 +16,18 @@ traefik_https_port: 443 # --- TURN ------------------------------------------------------- turn_listen_port: 3478 turn_tls_port: 5349 -turn_secret: "CHANGE-ME-TO-HEX-STRING" +turn_secret: "7A9F2C4E1B8D6035A2F7E9C1B4D68053" # --- Synapse ---------------------------------------------------- synapse_http_port: 8008 -synapse_version: "latest" + +# --- Matrix ------------------------------------------------------ +registration_shared_secret: "uC7Pv@:r=@Slvhx7Ex*An8QHXWnPRyI9+COZr_&;Kh*,~lGpql" +macaroon_secret_key: "+QUdDhvNc9*@MORp9K-TjuGp1j5Ff-mUBS+pjkmAFWR0Y3#da8" +form_secret: "meZSlI7K.EI-6hmXcjzCNf2IwrThcnoVr2X0iohOV7K5a_w^Ud" # --- Teamspeak --------------------------------------------------- -teamspeak_image: "docker.io/teamspeak:latest" +teamspeak_image: "docker.io/teamspeak:3.13.7" teamspeak_container_name: teamspeak teamspeak_udp_port: 9987 # voice (UDP) – exposed directly on the host teamspeak_tcp_port: 10011 # query (TCP) – will be routed via Traefik @@ -31,9 +36,9 @@ teamspeak_file_port: 30033 # file‑transfer (TCP) – optional, expose d # -------------------------------------------------------------- # Container images # -------------------------------------------------------------- -traefik_image: "docker.io/traefik:latest" -turn_image: "docker.io/coturn/coturn:latest" -synapse_image: "docker.io/matrixdotorg/synapse:{{ synapse_version }}" +traefik_image: "docker.io/traefik:v3.6.11" +turn_image: "docker.io/coturn/coturn:4.9.0" +synapse_image: "docker.io/matrixdotorg/synapse:latest" nginx_image: "docker.io/nginx:alpine" # --------------------------------------------------------------