initial commit
This commit is contained in:
commit
39fbe6669b
|
@ -0,0 +1,4 @@
|
|||
vendor
|
||||
*.swp
|
||||
.bundle/
|
||||
./nodes/
|
|
@ -0,0 +1,14 @@
|
|||
MethodLength:
|
||||
Enabled: false
|
||||
|
||||
LineLength:
|
||||
Enabled: false
|
||||
|
||||
NumericLiterals:
|
||||
Enabled: false
|
||||
|
||||
AmbiguousRegexpLiteral:
|
||||
Enabled: false
|
||||
|
||||
AbcSize:
|
||||
Enabled: false
|
|
@ -0,0 +1,16 @@
|
|||
inherit_from: .rubocop-todo.yml
|
||||
|
||||
AllCops:
|
||||
Exclude:
|
||||
- 'cookbooks/**/*'
|
||||
- 'tmp/**/*'
|
||||
- 'vendor/bundle/**/*'
|
||||
- 'site-cookbooks/sensu-custom/files/default/tw.rb'
|
||||
- 'images/**/*'
|
||||
|
||||
Style/CommandLiteral:
|
||||
EnforcedStyle: mixed
|
||||
AllowInnerBackticks: true
|
||||
|
||||
Style/PerlBackrefs:
|
||||
Enabled: false
|
|
@ -0,0 +1 @@
|
|||
2.4.1
|
|
@ -0,0 +1,9 @@
|
|||
source 'https://rubygems.org'
|
||||
|
||||
gem 'itamae'
|
||||
gem 'serverspec'
|
||||
|
||||
gem 'itamae-plugin-resource-encrypted_remote_file'
|
||||
gem 'reversible_cryptography'
|
||||
|
||||
gem 'rubocop'
|
|
@ -0,0 +1,81 @@
|
|||
GEM
|
||||
remote: https://rubygems.org/
|
||||
specs:
|
||||
ansi (1.5.0)
|
||||
ast (2.4.0)
|
||||
diff-lcs (1.3)
|
||||
hashie (3.6.0)
|
||||
itamae (1.10.1)
|
||||
ansi
|
||||
hashie
|
||||
schash (~> 0.1.0)
|
||||
specinfra (>= 2.64.0, < 3.0.0)
|
||||
thor
|
||||
itamae-plugin-resource-encrypted_remote_file (0.0.2)
|
||||
itamae (>= 1.2)
|
||||
reversible_cryptography
|
||||
jaro_winkler (1.5.1)
|
||||
multi_json (1.13.1)
|
||||
net-scp (1.2.1)
|
||||
net-ssh (>= 2.6.5)
|
||||
net-ssh (5.0.2)
|
||||
net-telnet (0.1.1)
|
||||
parallel (1.12.1)
|
||||
parser (2.5.3.0)
|
||||
ast (~> 2.4.0)
|
||||
powerpack (0.1.2)
|
||||
rainbow (3.0.0)
|
||||
reversible_cryptography (0.5.0)
|
||||
thor
|
||||
rspec (3.8.0)
|
||||
rspec-core (~> 3.8.0)
|
||||
rspec-expectations (~> 3.8.0)
|
||||
rspec-mocks (~> 3.8.0)
|
||||
rspec-core (3.8.0)
|
||||
rspec-support (~> 3.8.0)
|
||||
rspec-expectations (3.8.2)
|
||||
diff-lcs (>= 1.2.0, < 2.0)
|
||||
rspec-support (~> 3.8.0)
|
||||
rspec-its (1.2.0)
|
||||
rspec-core (>= 3.0.0)
|
||||
rspec-expectations (>= 3.0.0)
|
||||
rspec-mocks (3.8.0)
|
||||
diff-lcs (>= 1.2.0, < 2.0)
|
||||
rspec-support (~> 3.8.0)
|
||||
rspec-support (3.8.0)
|
||||
rubocop (0.61.1)
|
||||
jaro_winkler (~> 1.5.1)
|
||||
parallel (~> 1.10)
|
||||
parser (>= 2.5, != 2.5.1.1)
|
||||
powerpack (~> 0.1)
|
||||
rainbow (>= 2.2.2, < 4.0)
|
||||
ruby-progressbar (~> 1.7)
|
||||
unicode-display_width (~> 1.4.0)
|
||||
ruby-progressbar (1.10.0)
|
||||
schash (0.1.2)
|
||||
serverspec (2.41.3)
|
||||
multi_json
|
||||
rspec (~> 3.0)
|
||||
rspec-its
|
||||
specinfra (~> 2.72)
|
||||
sfl (2.3)
|
||||
specinfra (2.76.3)
|
||||
net-scp
|
||||
net-ssh (>= 2.7)
|
||||
net-telnet (= 0.1.1)
|
||||
sfl
|
||||
thor (0.20.3)
|
||||
unicode-display_width (1.4.0)
|
||||
|
||||
PLATFORMS
|
||||
ruby
|
||||
|
||||
DEPENDENCIES
|
||||
itamae
|
||||
itamae-plugin-resource-encrypted_remote_file
|
||||
reversible_cryptography
|
||||
rubocop
|
||||
serverspec
|
||||
|
||||
BUNDLED WITH
|
||||
1.16.1
|
|
@ -0,0 +1,3 @@
|
|||
#!/usr/bin/env rake
|
||||
|
||||
Dir['tasks/**/*.rake'].each { |path| load path }
|
|
@ -0,0 +1,27 @@
|
|||
# Make swap file:
|
||||
[
|
||||
'dd if=/dev/zero of=/swap.img bs=1M count=2048 && chomod 600 /swap.img',
|
||||
'mkswap /swap.img'
|
||||
].each do |cmd|
|
||||
execute cmd do
|
||||
user 'root'
|
||||
|
||||
only_if 'test ! -f /swap.img -a `cat /proc/swaps | wc -l` -eq 1'
|
||||
end
|
||||
end
|
||||
|
||||
# Add the fstab entry:
|
||||
file '/etc/fstab' do
|
||||
action :edit
|
||||
|
||||
block do |content|
|
||||
content << "/swap.img /dev/null swap defaults 0 2\n"
|
||||
end
|
||||
|
||||
not_if 'grep swap.img /etc/fstab'
|
||||
end
|
||||
|
||||
# Mount the swap file:
|
||||
execute 'swapon -ae' do
|
||||
only_if 'test `cat /proc/swaps | wc -l` -eq 1'
|
||||
end
|
|
@ -0,0 +1,44 @@
|
|||
# Install `cron-apt`:
|
||||
package 'cron-apt'
|
||||
|
||||
# From here, we are going to set up `cron-apt` to
|
||||
# install the important security updates every day.
|
||||
remote_file '/etc/cron-apt/config' do
|
||||
user 'root'
|
||||
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
end
|
||||
|
||||
remote_file '/etc/cron-apt/action.d/3-download' do
|
||||
user 'root'
|
||||
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
end
|
||||
|
||||
execute 'grep security /etc/apt/sources.list > /etc/apt/security.sources.list' do
|
||||
user 'root'
|
||||
|
||||
not_if 'test -e /etc/apt/security.sources.list'
|
||||
end
|
||||
|
||||
file '/var/log/cron-apt/log' do
|
||||
user 'root'
|
||||
|
||||
content 'foo\n'
|
||||
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '666'
|
||||
|
||||
not_if 'test -e /var/log/cron-apt/log'
|
||||
end
|
||||
|
||||
execute '/usr/sbin/logrotate -f /etc/logrotate.d/cron-apt' do
|
||||
user 'root'
|
||||
|
||||
not_if 'test -e /var/log/cron-apt/log'
|
||||
end
|
|
@ -0,0 +1,74 @@
|
|||
[
|
||||
# only install amd64 package
|
||||
# http://d.hatena.ne.jp/ritchey/20121229
|
||||
'dpkg --remove-architecture i386',
|
||||
|
||||
# Execute `apt update`
|
||||
'apt update',
|
||||
].each do |cmd|
|
||||
execute cmd do
|
||||
user 'root'
|
||||
|
||||
only_if 'dpkg --print-architecture | grep i386'
|
||||
end
|
||||
end
|
||||
|
||||
# Create /etc/sudoers.d/
|
||||
directory '/etc/sudoers.d/' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '750'
|
||||
end
|
||||
|
||||
# motd configurations:
|
||||
remote_file '/etc/motd.tail' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
end
|
||||
|
||||
remote_file '/etc/update-motd.d/99-motd-update' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '755'
|
||||
end
|
||||
|
||||
# Install the necessary packages:
|
||||
include_recipe './packages.rb'
|
||||
|
||||
# Lang Setting:
|
||||
include_recipe './lang.rb'
|
||||
|
||||
# `cron-apt` settings:
|
||||
include_recipe './cron-apt.rb'
|
||||
|
||||
# `ufw` configurations:
|
||||
include_recipe './ufw.rb'
|
||||
|
||||
# `sshd` configurations:
|
||||
include_recipe './ssh.rb'
|
||||
|
||||
# `fortune` configurations:
|
||||
include_recipe './fortune.rb'
|
||||
|
||||
# timezone configurations:
|
||||
include_recipe './timezone.rb'
|
||||
|
||||
# ntp configurations:
|
||||
include_recipe './ntp.rb'
|
||||
|
||||
# kernel configurations:
|
||||
include_recipe './kernel.rb'
|
||||
|
||||
# Install mc command:
|
||||
include_recipe './mc.rb'
|
||||
|
||||
# unnecessary configurations:
|
||||
if node['platform_version'].to_f == 16.04
|
||||
include_recipe './unnecessary.rb'
|
||||
end
|
||||
|
||||
# AWS EC2 Swap Setting:
|
||||
if node['is_ec2']
|
||||
include_recipe './aws_ec2.rb'
|
||||
end
|
|
@ -0,0 +1,2 @@
|
|||
autoclean -y
|
||||
upgrade -y -o APT::Get::Show-Upgraded=true
|
|
@ -0,0 +1,11 @@
|
|||
# Configuration for cron-apt. For further information about the possible
|
||||
# configuration settings see the README file.
|
||||
|
||||
SYSLOGON="always"
|
||||
DEBUG="verbose"
|
||||
|
||||
MAILON=""
|
||||
|
||||
APTCOMMAND=/usr/bin/apt
|
||||
|
||||
OPTIONS="-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list"
|
|
@ -0,0 +1,15 @@
|
|||
|
||||
[104m [0m[104m [0m [101m [0m[101m [0m [47m [0m[47m [0m
|
||||
[104m [0m[104m [0m [101m [0m[101m [0m [47m [0m[47m [0m
|
||||
[104m [0m[104m [0m [101m [0m[101m [0m [47m [0m[47m [0m
|
||||
[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m [101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m [47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m
|
||||
[107m [0m[107m [0m[107m [0m[107m [0m[104m [0m[104m [0m[44m [0m[44m [0m[104m [0m[104m [0m [107m [0m[107m [0m[107m [0m[107m [0m[101m [0m[101m [0m[41m [0m[41m [0m[101m [0m[101m [0m [107m [0m[107m [0m[107m [0m[107m [0m[47m [0m[47m [0m[100m [0m[100m [0m[47m [0m[47m [0m
|
||||
[107m [0m[107m [0m[107m [0m[107m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[44m [0m[44m [0m[104m [0m[104m [0m[104m [0m[104m [0m [107m [0m[107m [0m[107m [0m[107m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[41m [0m[41m [0m[101m [0m[101m [0m[101m [0m[101m [0m [107m [0m[107m [0m[107m [0m[107m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[100m [0m[100m [0m[47m [0m[47m [0m[47m [0m[47m [0m
|
||||
[107m [0m[107m [0m[107m [0m[107m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[104m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[104m [0m[104m [0m [107m [0m[107m [0m[107m [0m[107m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[101m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[101m [0m[101m [0m [107m [0m[107m [0m[107m [0m[107m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[47m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[47m [0m[47m [0m
|
||||
[104m [0m[104m [0m[107m [0m[107m [0m[104m [0m[104m [0m[104m [0m[104m [0m[107m [0m[107m [0m[104m [0m[104m [0m[104m [0m[104m [0m[44m [0m[44m [0m[107m [0m[107m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[104m [0m[104m [0m [101m [0m[101m [0m[107m [0m[107m [0m[101m [0m[101m [0m[101m [0m[101m [0m[107m [0m[107m [0m[101m [0m[101m [0m[101m [0m[101m [0m[41m [0m[41m [0m[107m [0m[107m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[101m [0m[101m [0m [47m [0m[47m [0m[107m [0m[107m [0m[47m [0m[47m [0m[47m [0m[47m [0m[107m [0m[107m [0m[47m [0m[47m [0m[47m [0m[47m [0m[100m [0m[100m [0m[107m [0m[107m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[47m [0m[47m [0m
|
||||
[104m [0m[104m [0m[44m [0m[44m [0m[104m [0m[104m [0m[107m [0m[107m [0m[40m [0m[40m [0m[107m [0m[107m [0m[44m [0m[44m [0m[107m [0m[107m [0m[40m [0m[40m [0m[107m [0m[107m [0m[44m [0m[44m [0m[44m [0m[44m [0m[104m [0m[104m [0m [101m [0m[101m [0m[41m [0m[41m [0m[101m [0m[101m [0m[107m [0m[107m [0m[40m [0m[40m [0m[107m [0m[107m [0m[41m [0m[41m [0m[107m [0m[107m [0m[40m [0m[40m [0m[107m [0m[107m [0m[41m [0m[41m [0m[41m [0m[41m [0m[101m [0m[101m [0m [47m [0m[47m [0m[100m [0m[100m [0m[47m [0m[47m [0m[107m [0m[107m [0m[40m [0m[40m [0m[107m [0m[107m [0m[100m [0m[100m [0m[107m [0m[107m [0m[40m [0m[40m [0m[107m [0m[107m [0m[100m [0m[100m [0m[100m [0m[100m [0m[47m [0m[47m [0m
|
||||
[104m [0m[104m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[107m [0m[107m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[107m [0m[107m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m [101m [0m[101m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[107m [0m[107m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[107m [0m[107m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m [47m [0m[47m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[107m [0m[107m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[107m [0m[107m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m
|
||||
[104m [0m[104m [0m[44m [0m[44m [0m[44m [0m[44m [0m[41m [0m[41m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[41m [0m[41m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m [101m [0m[101m [0m[41m [0m[41m [0m[41m [0m[41m [0m[100m [0m[100m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[100m [0m[100m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m [47m [0m[47m [0m[100m [0m[100m [0m[100m [0m[100m [0m[41m [0m[41m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[41m [0m[41m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m
|
||||
[104m [0m[104m [0m[44m [0m[44m [0m[44m [0m[44m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m [101m [0m[101m [0m[41m [0m[41m [0m[41m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m [47m [0m[47m [0m[100m [0m[100m [0m[100m [0m[100m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m
|
||||
[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m[44m [0m [41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m[41m [0m [100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m[100m [0m
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
|
||||
|
||||
driftfile /var/lib/ntp/ntp.drift
|
||||
|
||||
# Enable this if you want statistics to be logged.
|
||||
#statsdir /var/log/ntpstats/
|
||||
|
||||
statistics loopstats peerstats clockstats
|
||||
filegen loopstats file loopstats type day enable
|
||||
filegen peerstats file peerstats type day enable
|
||||
filegen clockstats file clockstats type day enable
|
||||
|
||||
# Specify one or more NTP servers.
|
||||
|
||||
# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board
|
||||
# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for
|
||||
# more information.
|
||||
pool 0.ubuntu.pool.ntp.org iburst
|
||||
pool 1.ubuntu.pool.ntp.org iburst
|
||||
pool 2.ubuntu.pool.ntp.org iburst
|
||||
pool 3.ubuntu.pool.ntp.org iburst
|
||||
|
||||
# Use Ubuntu's ntp server as a fallback.
|
||||
pool ntp.ubuntu.com
|
||||
|
||||
# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
|
||||
# details. The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
|
||||
# might also be helpful.
|
||||
#
|
||||
# Note that "restrict" applies to both servers and clients, so a configuration
|
||||
# that might be intended to block requests from certain clients could also end
|
||||
# up blocking replies from your own upstream servers.
|
||||
|
||||
# By default, exchange time with everybody, but don't allow configuration.
|
||||
restrict -4 default kod notrap nomodify nopeer noquery limited
|
||||
restrict -6 default kod notrap nomodify nopeer noquery limited
|
||||
|
||||
# Local users may interrogate the ntp server more closely.
|
||||
restrict 127.0.0.1
|
||||
restrict ::1
|
||||
|
||||
# Needed for adding pool entries
|
||||
restrict source notrap nomodify noquery
|
||||
|
||||
# Clients from this (example!) subnet have unlimited access, but only if
|
||||
# cryptographically authenticated.
|
||||
#restrict 192.168.123.0 mask 255.255.255.0 notrust
|
||||
|
||||
|
||||
# If you want to provide time to your local subnet, change the next line.
|
||||
# (Again, the address is an example only.)
|
||||
#broadcast 192.168.123.255
|
||||
|
||||
# If you want to listen to time broadcasts on your local subnet, de-comment the
|
||||
# next lines. Please do this only if you trust everybody on the network!
|
||||
#disable auth
|
||||
#broadcastclient
|
||||
|
||||
#Changes recquired to use pps synchonisation as explained in documentation:
|
||||
#http://www.ntp.org/ntpfaq/NTP-s-config-adv.htm#AEN3918
|
||||
|
||||
#server 127.127.8.1 mode 135 prefer # Meinberg GPS167 with PPS
|
||||
#fudge 127.127.8.1 time1 0.0042 # relative to PPS for my hardware
|
||||
|
||||
#server 127.127.22.1 # ATOM(PPS)
|
||||
#fudge 127.127.22.1 flag3 1 # enable PPS API
|
|
@ -0,0 +1,91 @@
|
|||
# Package generated configuration file
|
||||
# See the sshd_config(5) manpage for details
|
||||
|
||||
# What ports, IPs and protocols we listen for
|
||||
Port 10022
|
||||
# Use these options to restrict which interfaces/protocols sshd will bind to
|
||||
#ListenAddress ::
|
||||
ListenAddress 0.0.0.0
|
||||
Protocol 2
|
||||
# HostKeys for protocol version 2
|
||||
HostKey /etc/ssh/ssh_host_rsa_key
|
||||
HostKey /etc/ssh/ssh_host_dsa_key
|
||||
HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
#Privilege Separation is turned on for security
|
||||
UsePrivilegeSeparation yes
|
||||
|
||||
# Lifetime and size of ephemeral version 1 server key
|
||||
KeyRegenerationInterval 3600
|
||||
ServerKeyBits 1024
|
||||
|
||||
# Logging
|
||||
SyslogFacility AUTH
|
||||
LogLevel INFO
|
||||
|
||||
# Authentication:
|
||||
LoginGraceTime 120
|
||||
PermitRootLogin no
|
||||
StrictModes yes
|
||||
|
||||
RSAAuthentication yes
|
||||
PubkeyAuthentication yes
|
||||
#AuthorizedKeysFile %h/.ssh/authorized_keys
|
||||
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
IgnoreRhosts yes
|
||||
# For this to work you will also need host keys in /etc/ssh_known_hosts
|
||||
RhostsRSAAuthentication no
|
||||
# similar for protocol version 2
|
||||
HostbasedAuthentication no
|
||||
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
|
||||
#IgnoreUserKnownHosts yes
|
||||
|
||||
# To enable empty passwords, change to yes (NOT RECOMMENDED)
|
||||
PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication no
|
||||
|
||||
# Change to no to disable tunnelled clear text passwords
|
||||
PasswordAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosGetAFSToken no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
|
||||
X11Forwarding yes
|
||||
X11DisplayOffset 10
|
||||
PrintMotd no
|
||||
PrintLastLog yes
|
||||
TCPKeepAlive yes
|
||||
#UseLogin no
|
||||
|
||||
#MaxStartups 10:30:60
|
||||
#Banner /etc/issue.net
|
||||
|
||||
# Allow client to pass locale environment variables
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
UsePAM yes
|
||||
|
||||
# Do not use DNS:
|
||||
UseDNS no
|
|
@ -0,0 +1,122 @@
|
|||
# $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
# possible, but leave them commented. Uncommented options override the
|
||||
# default value.
|
||||
|
||||
Port 10022
|
||||
#AddressFamily any
|
||||
#ListenAddress 0.0.0.0
|
||||
#ListenAddress ::
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
#RekeyLimit default none
|
||||
|
||||
# Logging
|
||||
#SyslogFacility AUTH
|
||||
#LogLevel INFO
|
||||
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
PermitRootLogin no
|
||||
#StrictModes yes
|
||||
#MaxAuthTries 6
|
||||
#MaxSessions 10
|
||||
|
||||
#PubkeyAuthentication yes
|
||||
|
||||
# Expect .ssh/authorized_keys2 to be disregarded by default in future.
|
||||
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
|
||||
|
||||
#AuthorizedPrincipalsFile none
|
||||
|
||||
#AuthorizedKeysCommand none
|
||||
#AuthorizedKeysCommandUser nobody
|
||||
|
||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||
#HostbasedAuthentication no
|
||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||
# HostbasedAuthentication
|
||||
#IgnoreUserKnownHosts no
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
PasswordAuthentication no
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
#KerberosGetAFSToken no
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
#GSSAPIStrictAcceptorCheck yes
|
||||
#GSSAPIKeyExchange no
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
UsePAM yes
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
#AllowTcpForwarding yes
|
||||
#GatewayPorts no
|
||||
X11Forwarding yes
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
PrintMotd no
|
||||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#UseLogin no
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
|
||||
# Allow client to pass locale environment variables
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
|
@ -0,0 +1,8 @@
|
|||
# `vfs_cache_pressure` configures how much the system will choose to cache inode
|
||||
# and dentry information over other data.
|
||||
#
|
||||
# Basically, this is access data about the filesystem.
|
||||
# This is generally very costly to look up and very frequently requested,
|
||||
# so it's an excellent thing for your system to cache.
|
||||
|
||||
vm.vfs_cache_pressure = 50
|
|
@ -0,0 +1,9 @@
|
|||
# The swappiness parameter configures how often your system swaps data out of RAM to the swap space.
|
||||
# This is a value between 0 and 100 that represents a percentage.
|
||||
#
|
||||
# With values close to zero, the kernel will not swap data to the disk unless absolutely necessary.
|
||||
# Remember, interactions with the swap file are "expensive" in that they take a lot longer than
|
||||
# interactions with RAM and they can cause a significant reduction in performance.
|
||||
# Telling the system not to rely on the swap much will generally make your system faster.
|
||||
|
||||
vm.swappiness = 10
|
|
@ -0,0 +1 @@
|
|||
Asia/Tokyo
|
|
@ -0,0 +1,4 @@
|
|||
#!/bin/sh
|
||||
|
||||
echo
|
||||
cat /etc/motd.tail
|
|
@ -0,0 +1,17 @@
|
|||
#!/bin/sh
|
||||
|
||||
# if the commit is first one, then pass
|
||||
|
||||
if [ -z "$(git branch)" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Otherwise, check if the branch is master, and if it is, fail.
|
||||
|
||||
branch="$(git symbolic-ref HEAD 2>/dev/null)" || \
|
||||
"$(git describe --contains --all HEAD)"
|
||||
|
||||
if [ "${branch##refs/heads/}" = "master" ]; then
|
||||
echo "Do not commit on the master branch!"
|
||||
exit 1
|
||||
fi
|
|
@ -0,0 +1,18 @@
|
|||
#!/bin/sh
|
||||
|
||||
if [ "$2" = "" ]; then
|
||||
mv $1 $1.tmp
|
||||
|
||||
ID=`git branch | grep ^\* | awk '{print $2}' | cut -f 2 -d "/"`
|
||||
|
||||
cat <<EOF > $1
|
||||
|
||||
|
||||
This commit refs/fixes #${ID}.
|
||||
# ^^^^^^^^^^
|
||||
EOF
|
||||
|
||||
cat $1.tmp >> $1
|
||||
fi
|
||||
|
||||
exit 0
|
|
@ -0,0 +1,21 @@
|
|||
# Install `fortune` package:
|
||||
package 'fortune' do
|
||||
not_if 'test -e /usr/games/fortune'
|
||||
end
|
||||
|
||||
URL='http://www.splitbrain.org/_media/projects/fortunes/fortune-starwars.tgz'
|
||||
TGZ='fortune-starwars.tgz'
|
||||
|
||||
[
|
||||
"wget #{URL} -O #{TGZ}",
|
||||
"tar xf #{TGZ}",
|
||||
'cp fortune-starwars/starwars.dat /usr/share/games/fortunes/',
|
||||
'cp fortune-starwars/starwars /usr/share/games/fortunes/'
|
||||
].each do |cmd|
|
||||
execute cmd do
|
||||
user 'root'
|
||||
cwd '/tmp/itamae_tmp/'
|
||||
|
||||
not_if 'test -e /usr/share/games/fortunes/starwars.dat'
|
||||
end
|
||||
end
|
|
@ -0,0 +1,12 @@
|
|||
STORAGE = '/etc/sysctl.d'
|
||||
|
||||
[
|
||||
"#{STORAGE}/90-vm-swappiness.conf",
|
||||
"#{STORAGE}/90-vfs-cache-pressure.conf"
|
||||
].each do |conf|
|
||||
remote_file conf do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
end
|
||||
end
|
|
@ -0,0 +1,20 @@
|
|||
# Language Settings:
|
||||
package 'language-pack-ja-base'
|
||||
|
||||
execute 'locale-gen ja_JP.UTF-8' do
|
||||
user 'root'
|
||||
|
||||
not_if 'locale -a | grep ja_JP.utf8'
|
||||
end
|
||||
|
||||
execute 'dpkg-reconfigure --frontend=noninteractive locales' do
|
||||
user 'root'
|
||||
|
||||
not_if 'locale -a | grep ja_JP.utf8'
|
||||
end
|
||||
|
||||
execute 'update-locale LANG=ja_JP.UTF-8' do
|
||||
user 'root'
|
||||
|
||||
not_if 'strings /etc/default/locale | grep ja_JP.UTF-8'
|
||||
end
|
|
@ -0,0 +1,12 @@
|
|||
MC = 'https://dl.minio.io/client/mc/release/linux-amd64/mc'
|
||||
LOCATION = '/usr/local/bin/mc'
|
||||
|
||||
execute "wget #{MC} -O #{LOCATION}" do
|
||||
not_if "test -e #{LOCATION}"
|
||||
end
|
||||
|
||||
file LOCATION do
|
||||
mode '755'
|
||||
user 'root'
|
||||
group 'root'
|
||||
end
|
|
@ -0,0 +1,18 @@
|
|||
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
|
||||
when "18.04"
|
||||
# do nothing
|
||||
else
|
||||
package 'ntp'
|
||||
|
||||
remote_file '/etc/ntp.conf' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
|
||||
notifies :restart, 'service[ntp]'
|
||||
end
|
||||
|
||||
service 'ntp' do
|
||||
action :nothing
|
||||
end
|
||||
end
|
|
@ -0,0 +1,64 @@
|
|||
# Execute `apt update`:
|
||||
execute 'apt update'
|
||||
|
||||
# Install the necessary packages:
|
||||
%w[build-essential zsh vim-nox debian-keyring screen curl dstat].each do |pkg|
|
||||
package pkg
|
||||
end
|
||||
|
||||
# Install the extra kernel:
|
||||
unless node['is_ec2']
|
||||
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
|
||||
when "18.04"
|
||||
package 'linux-image-extra-virtual'
|
||||
else
|
||||
KERNEL = run_command("uname -r").stdout.chomp
|
||||
package "linux-image-extra-#{KERNEL}"
|
||||
end
|
||||
end
|
||||
|
||||
### Here we are going to install git.
|
||||
# Constants:
|
||||
KEYSRV = 'hkp://keyserver.ubuntu.com:80'
|
||||
ID = 'E1DF1F24'
|
||||
|
||||
GIT_PREPUSH = '/usr/share/git-core/templates/hooks/pre-push'
|
||||
PREPUSH = 'https://gist.github.com/kazu634/8267388/raw/e9202cd4c29a66723c88d2be05f3cd19413d2137/pre-push'
|
||||
|
||||
# Retrieve the Ubuntu code:
|
||||
DIST = run_command('lsb_release -cs').stdout.chomp
|
||||
|
||||
# Add the public key file to install `git`
|
||||
execute "apt-key adv --keyserver #{KEYSRV} --recv-keys #{ID}" do
|
||||
not_if 'apt-key list | grep E1DF1F24'
|
||||
end
|
||||
|
||||
# Deploy the `apt` sources:
|
||||
template '/etc/apt/sources.list.d/git.list' do
|
||||
action :create
|
||||
variables(distribution: DIST)
|
||||
end
|
||||
|
||||
execute 'apt update' do
|
||||
not_if 'LANG=C apt-cache policy git | grep Installed | grep ppa'
|
||||
end
|
||||
|
||||
execute 'apt install git -y' do
|
||||
not_if 'LANG=C apt-cache policy git | grep Installed | grep ppa'
|
||||
end
|
||||
|
||||
execute "wget #{PREPUSH} -O #{GIT_PREPUSH}" do
|
||||
not_if "test -e #{GIT_PREPUSH}"
|
||||
end
|
||||
|
||||
[
|
||||
'/usr/share/git-core/templates/hooks/pre-commit',
|
||||
'/usr/share/git-core/templates/hooks/prepare-commit-msg',
|
||||
].each do |conf|
|
||||
remote_file conf do
|
||||
user 'root'
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
end
|
||||
end
|
|
@ -0,0 +1,35 @@
|
|||
# ToDo: `iptables` setting must be here:
|
||||
execute 'ufw allow 10022' do
|
||||
user 'root'
|
||||
|
||||
not_if 'LANG=c ufw status | grep 10022'
|
||||
|
||||
notifies :run, 'execute[ufw reload-or-enable]'
|
||||
end
|
||||
|
||||
# Deploy the `sshd` configuration file:
|
||||
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
|
||||
when "18.04"
|
||||
remote_file '/etc/ssh/sshd_config' do
|
||||
user 'root'
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
|
||||
source 'files/etc/ssh/sshd_config.1804'
|
||||
end
|
||||
else
|
||||
remote_file '/etc/ssh/sshd_config' do
|
||||
user 'root'
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
# Apply the changes:
|
||||
execute 'systemctl reload ssh.service ' do
|
||||
action :nothing
|
||||
subscribes :run, 'remote_file[/etc/ssh/sshd_config]'
|
||||
end
|
|
@ -0,0 +1 @@
|
|||
deb "http://ppa.launchpad.net/git-core/ppa/ubuntu" <%= @distribution %> main
|
|
@ -0,0 +1,23 @@
|
|||
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
|
||||
when "18.04"
|
||||
execute 'timedatectl set-timezone Asia/Tokyo' do
|
||||
not_if 'timedatectl | grep Tokyo'
|
||||
end
|
||||
else
|
||||
remote_file '/etc/timezone' do
|
||||
user 'root'
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
end
|
||||
|
||||
[
|
||||
'cp -f /usr/share/zoneinfo/Asia/Tokyo /etc/localtime'
|
||||
].each do |cmd|
|
||||
execute cmd do
|
||||
user 'root'
|
||||
|
||||
not_if 'diff /usr/share/zoneinfo/Asia/Tokyo /etc/localtime'
|
||||
end
|
||||
end
|
||||
end
|
|
@ -0,0 +1,6 @@
|
|||
execute 'ufw reload-or-enable' do
|
||||
user 'root'
|
||||
command 'LANG=C ufw reload | grep skipping && ufw --force enable || exit 0'
|
||||
|
||||
action :nothing
|
||||
end
|
|
@ -0,0 +1,5 @@
|
|||
%w( apparmor iscsid lxc lxcfs lxd-containers lxd open-iscsi ).each do |s|
|
||||
service s do
|
||||
action :disable
|
||||
end
|
||||
end
|
|
@ -0,0 +1,9 @@
|
|||
# -------------------------------------------
|
||||
# Specifying the default settings:
|
||||
# -------------------------------------------
|
||||
node.reverse_merge!({
|
||||
'blog' => {
|
||||
'FQDN' => 'blog.kazu634.com',
|
||||
'production' => true
|
||||
}
|
||||
})
|
|
@ -0,0 +1,6 @@
|
|||
include_recipe './attributes.rb'
|
||||
|
||||
if node['blog']['production']
|
||||
include_recipe './ssl.rb'
|
||||
include_recipe './nginx.rb'
|
||||
end
|
|
@ -0,0 +1,2 @@
|
|||
@reboot webadm cp -pr /home/webadm/works/public/* /var/www/blog/
|
||||
12 3 * * * root openssl rand 48 > /etc/letsencrypt/live/blog.kazu634.com/ticket.key
|
|
@ -0,0 +1,13 @@
|
|||
-----BEGIN DH PARAMETERS-----
|
||||
MIICCAKCAgEAqY1i3j1m5Udr7eJxrsxBDK3NqsXJbPgfj2tdH+RlY8Bb7NuTPl9Z
|
||||
e5KtZ2UQlPcth9sSPgulg/V+g4GQhge8xACSl1joAenDpPF8BGyBcv/o9QwNpdzj
|
||||
yP9o4X/TQkDxGKTJItpfKMHdmBPYC8Sxv0NpPlkKT27kfwOpSRuj17ZWAl+AnOjS
|
||||
TjLzSq85/Ao7C0rgAhJRG38iZ36DXGWYtrA7n/F6wTlmelRwkNCGEypF79GWSU8P
|
||||
xCpVLTY6MIhDq5NBO3mzkeYyl0M1M8c7dwUAPAMCK43Fl6nfQbbbwSIxlxQy8WIq
|
||||
48s5TaJEp1hU2CXTgTa+cmm1JQziFBlwOZNAeAAIi6JcJRHCFhpUrTVirqPRIoUc
|
||||
c99xUs91aELi/nZggt0vrGd4kyQ6eB5pxB6kAJwNfP3URMjucttcukyhuu/jzDMd
|
||||
GNg1J75dAF606yunta8ZohecrabpkACQz9ZR+VOM0z4IGbI39M+EohFcxL7+8gSU
|
||||
VP537jDrlAjU2DtbE2Dr+dotg1LfIE4P5AGFIAPfKYE+YXJ85SNin7POMttw8TP2
|
||||
WlMVFAG159CBjPvGPuXqInBv6U5QHWxINSevHL6vdD12d7L9LjUHQQNaAborPe2Z
|
||||
rN7fPDbDib5vnxUBAayHgic8qw1/eqWIhAXyBGRG/EOuwKgr2DU5U3sCAQI=
|
||||
-----END DH PARAMETERS-----
|
|
@ -0,0 +1,2 @@
|
|||
check file nginx-blog with path /var/log/nginx/blog.access.log
|
||||
if timestamp > 2 minutes for 5 cycles then exec "/bin/systemctl restart nginx"
|
|
@ -0,0 +1,90 @@
|
|||
server {
|
||||
# allow access from localhost
|
||||
listen 80 reuseport backlog=1024;
|
||||
listen 443 ssl http2 backlog=1024;
|
||||
server_name blog.kazu634.com;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/blog.kazu634.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/blog.kazu634.com/privkey.pem;
|
||||
ssl_dhparam /etc/letsencrypt/live/blog.kazu634.com/dhparams_4096.pem;
|
||||
|
||||
ssl_session_cache shared:SSL:3m;
|
||||
ssl_buffer_size 4k;
|
||||
ssl_session_timeout 10m;
|
||||
|
||||
ssl_session_tickets on;
|
||||
ssl_session_ticket_key /etc/letsencrypt/live/blog.kazu634.com/ticket.key;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
|
||||
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DES-CBC3-SHA;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
resolver 8.8.4.4 8.8.8.8 valid=300s;
|
||||
resolver_timeout 10s;
|
||||
|
||||
# Enable HSTS (HTTP Strict Transport Security)
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
|
||||
|
||||
root /var/www/blog;
|
||||
index index.html index.htm;
|
||||
|
||||
access_log /var/log/nginx/blog.access.log ltsv;
|
||||
error_log /var/log/nginx/blog.error.log;
|
||||
|
||||
location / {
|
||||
gzip on;
|
||||
gunzip on;
|
||||
gzip_vary on;
|
||||
|
||||
# http2 server push:
|
||||
http2_push_preload on;
|
||||
|
||||
http2_push /css/sanitize.css;
|
||||
http2_push /css/responsive.css;
|
||||
http2_push /css/highlight_monokai.css;
|
||||
http2_push /css/theme.css;
|
||||
http2_push /css/custom.css;
|
||||
http2_push /images/profile.png;
|
||||
http2_push /js/highlight.pack.js;
|
||||
|
||||
if (-e "/tmp/maintenance") {
|
||||
return 503;
|
||||
}
|
||||
|
||||
location /feed {
|
||||
return 301 http://blog.kazu634.com/index.xml;
|
||||
}
|
||||
|
||||
location /wp-content {
|
||||
return 404;
|
||||
}
|
||||
|
||||
location ~* \.css {
|
||||
gzip_static always;
|
||||
|
||||
expires max;
|
||||
}
|
||||
|
||||
location ~* \.js {
|
||||
gzip_static always;
|
||||
|
||||
expires max;
|
||||
}
|
||||
|
||||
location /images {
|
||||
gzip_static always;
|
||||
|
||||
expires max;
|
||||
}
|
||||
|
||||
location = /favicon.ico {
|
||||
access_log off;
|
||||
empty_gif;
|
||||
expires max;
|
||||
}
|
||||
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
}
|
|
@ -0,0 +1,63 @@
|
|||
# Deploy the nginx configuration file:
|
||||
remote_file '/etc/nginx/sites-available/blog' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
end
|
||||
|
||||
# Deploy cron tab configuration for nginx
|
||||
remote_file '/etc/cron.d/blog' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
end
|
||||
|
||||
# Create link:
|
||||
link '/etc/nginx/sites-enabled/blog' do
|
||||
user 'root'
|
||||
to '/etc/nginx/sites-available/blog'
|
||||
|
||||
notifies :restart, 'service[nginx]'
|
||||
end
|
||||
|
||||
service 'nginx' do
|
||||
action :nothing
|
||||
end
|
||||
|
||||
# Create the nginx directory:
|
||||
directory '/var/www/blog' do
|
||||
owner 'www-data'
|
||||
group 'webadm'
|
||||
mode '770'
|
||||
end
|
||||
|
||||
# Add the fstab entry:
|
||||
file '/etc/fstab' do
|
||||
action :edit
|
||||
|
||||
block do |content|
|
||||
content << "tmpfs /var/www/blog tmpfs size=250m,noatime 0 0\n"
|
||||
end
|
||||
|
||||
not_if 'grep /var/www/blog /etc/fstab'
|
||||
|
||||
notifies :run, 'execute[fstab -a]'
|
||||
end
|
||||
|
||||
execute 'mount -a' do
|
||||
action :nothing
|
||||
end
|
||||
|
||||
# Add monit configuration file for monitoring nginx logs:
|
||||
remote_file '/etc/monit/conf.d/blog-log.conf' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
|
||||
notifies :reload, 'service[monit]'
|
||||
end
|
||||
|
||||
service 'monit' do
|
||||
action :nothing
|
||||
end
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
[
|
||||
'rm -f /etc/nginx/sites-enabled/*',
|
||||
'ln -f -s /etc/nginx/sites-available/maintenance /etc/nginx/sites-enabled/maintenance',
|
||||
'systemctl reload nginx',
|
||||
"test -e /etc/letsencrypt/live/#{node['blog']['FQDN']}/cert.pem || certbot certonly --webroot -d #{node['blog']['FQDN']} --webroot-path /usr/share/nginx/html/ --email simoom634@yahoo.co.jp --agree-tos -n",
|
||||
'/home/webadm/bin/nginx-config.sh',
|
||||
].each do |cmd|
|
||||
execute cmd
|
||||
end
|
||||
|
||||
remote_file "/etc/letsencrypt/live/#{node['blog']['FQDN']}/dhparams_4096.pem" do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
end
|
||||
|
||||
execute "openssl rand 48 > /etc/letsencrypt/live/#{node['blog']['FQDN']}/ticket.key"
|
|
@ -0,0 +1,10 @@
|
|||
# -------------------------------------------
|
||||
# Specifying the default settings:
|
||||
# -------------------------------------------
|
||||
node.reverse_merge!({
|
||||
'consul-template' => {
|
||||
'base_binary_url' => 'https://releases.hashicorp.com/consul-template/',
|
||||
'arch' => node['kernel']['machine'] =~ /x86_64/ ? 'amd64' : '386',
|
||||
'tmp_path' => '/tmp/itamae_tmp/consul-template.zip'
|
||||
}
|
||||
})
|
|
@ -0,0 +1,6 @@
|
|||
include_recipe './attributes.rb'
|
||||
|
||||
include_recipe './prerequisites.rb'
|
||||
include_recipe './install.rb'
|
||||
|
||||
include_recipe './setup.rb'
|
|
@ -0,0 +1,47 @@
|
|||
# -------------------------------------------
|
||||
# Calculating the latest `consul-template` version:
|
||||
# -------------------------------------------
|
||||
download_url = ''
|
||||
|
||||
begin
|
||||
require 'net/http'
|
||||
|
||||
uri = URI.parse('https://releases.hashicorp.com/consul-template/')
|
||||
|
||||
Timeout.timeout(3) do
|
||||
response = Net::HTTP.get_response(uri)
|
||||
|
||||
if response.body =~ /consul-template_(\d+\.\d+\.\d+)/
|
||||
tag_version = $1
|
||||
download_url = \
|
||||
"#{node['consul-template']['base_binary_url']}#{tag_version}/consul-template_#{tag_version}_linux_#{node['consul-template']['arch']}.zip"
|
||||
end
|
||||
end
|
||||
rescue
|
||||
# Abort the chef client process:
|
||||
raise 'Cannot connect to https://releases.hashicorp.com/consul-template/'
|
||||
end
|
||||
|
||||
# -------------------------------------------
|
||||
# Main Part
|
||||
# -------------------------------------------
|
||||
|
||||
# Download:
|
||||
execute "wget #{download_url} -O #{node['consul-template']['tmp_path']}"
|
||||
|
||||
# Unzip:
|
||||
execute "unzip -qo #{node['consul-template']['tmp_path']}" do
|
||||
cwd '/opt/consul/bin/'
|
||||
end
|
||||
|
||||
file '/opt/consul/bin/consul-template' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '755'
|
||||
end
|
||||
|
||||
# Create link:
|
||||
link '/usr/local/bin/consul-template' do
|
||||
user 'root'
|
||||
to '/opt/consul/bin/consul-template'
|
||||
end
|
|
@ -0,0 +1,14 @@
|
|||
# Ensure that `unzip` and `dnsmasq` are available:
|
||||
%w( unzip ).each do |p|
|
||||
package p do
|
||||
action :install
|
||||
end
|
||||
end
|
||||
|
||||
%w( /opt/consul/bin ).each do |d|
|
||||
directory d do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '755'
|
||||
end
|
||||
end
|
|
@ -0,0 +1,9 @@
|
|||
# `consul-template`-related paths:
|
||||
%w( /etc/consul-template.d ).each do |d|
|
||||
directory d do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
|
||||
mode '755'
|
||||
end
|
||||
end
|
|
@ -0,0 +1,21 @@
|
|||
# -------------------------------------------
|
||||
# Specifying the default settings:
|
||||
# -------------------------------------------
|
||||
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
|
||||
when "18.04"
|
||||
cmd = 'LANG=C /sbin/ifconfig | grep "inet " | grep -v 127.0.0.1 | cut -d" " -f10'
|
||||
else
|
||||
cmd = 'LANG=C /sbin/ifconfig | grep "inet addr" | grep -v 127.0.0.1 | awk "{print $2;}" | cut -d: -f2 | cut -f 1 -d " " | tail -1'
|
||||
end
|
||||
ipaddr = run_command(cmd).stdout.chomp
|
||||
|
||||
node.reverse_merge!({
|
||||
'consul' => {
|
||||
'base_binary_url' => 'https://releases.hashicorp.com/consul/',
|
||||
'arch' => node['kernel']['machine'] =~ /x86_64/ ? 'amd64' : '386',
|
||||
'tmp_path' => '/tmp/itamae_tmp/consul.zip',
|
||||
'manager' => true,
|
||||
'manager_hosts' => '["192.168.10.110", "192.168.10.101", "192.168.10.111", "192.168.10.115"]',
|
||||
'ipaddr' => ipaddr
|
||||
}
|
||||
})
|
|
@ -0,0 +1,11 @@
|
|||
include_recipe './attributes.rb'
|
||||
|
||||
include_recipe './prerequisites.rb'
|
||||
|
||||
include_recipe './install.rb'
|
||||
|
||||
include_recipe './setup.rb'
|
||||
|
||||
include_recipe './dnsmasq.rb'
|
||||
|
||||
include_recipe './monitoring.rb'
|
|
@ -0,0 +1,47 @@
|
|||
%w(dnsmasq resolvconf systemd-resolved).each do |s|
|
||||
service s do
|
||||
action :nothing
|
||||
end
|
||||
end
|
||||
|
||||
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
|
||||
when "18.04"
|
||||
remote_file '/etc/dnsmasq.conf' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
|
||||
source 'files/etc/dnsmasq.conf.1804'
|
||||
|
||||
notifies :reload, 'service[dnsmasq]'
|
||||
end
|
||||
else
|
||||
remote_file '/etc/dnsmasq.conf' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
|
||||
source 'files/etc/dnsmasq.conf.1804'
|
||||
|
||||
notifies :reload, 'service[dnsmasq]'
|
||||
end
|
||||
end
|
||||
|
||||
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
|
||||
when "18.04"
|
||||
remote_file '/etc/systemd/resolved.conf' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
|
||||
notifies :restart, 'service[systemd-resolved]'
|
||||
end
|
||||
else
|
||||
remote_file '/etc/resolvconf/resolv.conf.d/head' do
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '644'
|
||||
|
||||
notifies :restart, 'service[resolvconf]'
|
||||
end
|
||||
end
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"check": {
|
||||
"id": "disk-capacity",
|
||||
"name": "Check for Disk Capacity",
|
||||
"args": ["/usr/lib/nagios/plugins/check_disk", "-w", "25%", "-c", "10%", "-p", "/"],
|
||||
"interval": "3600s",
|
||||
"timeout": "10s"
|
||||
}
|
||||
}
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"check": {
|
||||
"id": "load-average",
|
||||
"name": "Check for Load Average",
|
||||
"args": ["/usr/lib/nagios/plugins/check_load", "-r", "--warning=1,1,1", "--critical=2,2,2"],
|
||||
"interval": "60s",
|
||||
"timeout": "10s"
|
||||
}
|
||||
}
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"check": {
|
||||
"id": "memory",
|
||||
"name": "Check for Memory",
|
||||
"args": ["/usr/lib/nagios/plugins/check_memory"],
|
||||
"interval": "60s",
|
||||
"timeout": "10s"
|
||||
}
|
||||
}
|
|
@ -0,0 +1,9 @@
|
|||