initial commit

This commit is contained in:
Kazuhiro MUSASHI 2019-03-03 16:50:49 +08:00
commit 39fbe6669b
221 changed files with 6774 additions and 0 deletions

4
.gitignore vendored Normal file
View File

@ -0,0 +1,4 @@
vendor
*.swp
.bundle/
./nodes/

14
.rubocop-todo.yml Normal file
View File

@ -0,0 +1,14 @@
MethodLength:
Enabled: false
LineLength:
Enabled: false
NumericLiterals:
Enabled: false
AmbiguousRegexpLiteral:
Enabled: false
AbcSize:
Enabled: false

16
.rubocop.yml Normal file
View File

@ -0,0 +1,16 @@
inherit_from: .rubocop-todo.yml
AllCops:
Exclude:
- 'cookbooks/**/*'
- 'tmp/**/*'
- 'vendor/bundle/**/*'
- 'site-cookbooks/sensu-custom/files/default/tw.rb'
- 'images/**/*'
Style/CommandLiteral:
EnforcedStyle: mixed
AllowInnerBackticks: true
Style/PerlBackrefs:
Enabled: false

1
.ruby-version Normal file
View File

@ -0,0 +1 @@
2.4.1

9
Gemfile Normal file
View File

@ -0,0 +1,9 @@
source 'https://rubygems.org'
gem 'itamae'
gem 'serverspec'
gem 'itamae-plugin-resource-encrypted_remote_file'
gem 'reversible_cryptography'
gem 'rubocop'

81
Gemfile.lock Normal file
View File

@ -0,0 +1,81 @@
GEM
remote: https://rubygems.org/
specs:
ansi (1.5.0)
ast (2.4.0)
diff-lcs (1.3)
hashie (3.6.0)
itamae (1.10.1)
ansi
hashie
schash (~> 0.1.0)
specinfra (>= 2.64.0, < 3.0.0)
thor
itamae-plugin-resource-encrypted_remote_file (0.0.2)
itamae (>= 1.2)
reversible_cryptography
jaro_winkler (1.5.1)
multi_json (1.13.1)
net-scp (1.2.1)
net-ssh (>= 2.6.5)
net-ssh (5.0.2)
net-telnet (0.1.1)
parallel (1.12.1)
parser (2.5.3.0)
ast (~> 2.4.0)
powerpack (0.1.2)
rainbow (3.0.0)
reversible_cryptography (0.5.0)
thor
rspec (3.8.0)
rspec-core (~> 3.8.0)
rspec-expectations (~> 3.8.0)
rspec-mocks (~> 3.8.0)
rspec-core (3.8.0)
rspec-support (~> 3.8.0)
rspec-expectations (3.8.2)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.8.0)
rspec-its (1.2.0)
rspec-core (>= 3.0.0)
rspec-expectations (>= 3.0.0)
rspec-mocks (3.8.0)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.8.0)
rspec-support (3.8.0)
rubocop (0.61.1)
jaro_winkler (~> 1.5.1)
parallel (~> 1.10)
parser (>= 2.5, != 2.5.1.1)
powerpack (~> 0.1)
rainbow (>= 2.2.2, < 4.0)
ruby-progressbar (~> 1.7)
unicode-display_width (~> 1.4.0)
ruby-progressbar (1.10.0)
schash (0.1.2)
serverspec (2.41.3)
multi_json
rspec (~> 3.0)
rspec-its
specinfra (~> 2.72)
sfl (2.3)
specinfra (2.76.3)
net-scp
net-ssh (>= 2.7)
net-telnet (= 0.1.1)
sfl
thor (0.20.3)
unicode-display_width (1.4.0)
PLATFORMS
ruby
DEPENDENCIES
itamae
itamae-plugin-resource-encrypted_remote_file
reversible_cryptography
rubocop
serverspec
BUNDLED WITH
1.16.1

3
Rakefile Normal file
View File

@ -0,0 +1,3 @@
#!/usr/bin/env rake
Dir['tasks/**/*.rake'].each { |path| load path }

27
cookbooks/base/aws_ec2.rb Normal file
View File

@ -0,0 +1,27 @@
# Make swap file:
[
'dd if=/dev/zero of=/swap.img bs=1M count=2048 && chomod 600 /swap.img',
'mkswap /swap.img'
].each do |cmd|
execute cmd do
user 'root'
only_if 'test ! -f /swap.img -a `cat /proc/swaps | wc -l` -eq 1'
end
end
# Add the fstab entry:
file '/etc/fstab' do
action :edit
block do |content|
content << "/swap.img /dev/null swap defaults 0 2\n"
end
not_if 'grep swap.img /etc/fstab'
end
# Mount the swap file:
execute 'swapon -ae' do
only_if 'test `cat /proc/swaps | wc -l` -eq 1'
end

View File

@ -0,0 +1,44 @@
# Install `cron-apt`:
package 'cron-apt'
# From here, we are going to set up `cron-apt` to
# install the important security updates every day.
remote_file '/etc/cron-apt/config' do
user 'root'
owner 'root'
group 'root'
mode '644'
end
remote_file '/etc/cron-apt/action.d/3-download' do
user 'root'
owner 'root'
group 'root'
mode '644'
end
execute 'grep security /etc/apt/sources.list > /etc/apt/security.sources.list' do
user 'root'
not_if 'test -e /etc/apt/security.sources.list'
end
file '/var/log/cron-apt/log' do
user 'root'
content 'foo\n'
owner 'root'
group 'root'
mode '666'
not_if 'test -e /var/log/cron-apt/log'
end
execute '/usr/sbin/logrotate -f /etc/logrotate.d/cron-apt' do
user 'root'
not_if 'test -e /var/log/cron-apt/log'
end

74
cookbooks/base/default.rb Normal file
View File

@ -0,0 +1,74 @@
[
# only install amd64 package
# http://d.hatena.ne.jp/ritchey/20121229
'dpkg --remove-architecture i386',
# Execute `apt update`
'apt update',
].each do |cmd|
execute cmd do
user 'root'
only_if 'dpkg --print-architecture | grep i386'
end
end
# Create /etc/sudoers.d/
directory '/etc/sudoers.d/' do
owner 'root'
group 'root'
mode '750'
end
# motd configurations:
remote_file '/etc/motd.tail' do
owner 'root'
group 'root'
mode '644'
end
remote_file '/etc/update-motd.d/99-motd-update' do
owner 'root'
group 'root'
mode '755'
end
# Install the necessary packages:
include_recipe './packages.rb'
# Lang Setting:
include_recipe './lang.rb'
# `cron-apt` settings:
include_recipe './cron-apt.rb'
# `ufw` configurations:
include_recipe './ufw.rb'
# `sshd` configurations:
include_recipe './ssh.rb'
# `fortune` configurations:
include_recipe './fortune.rb'
# timezone configurations:
include_recipe './timezone.rb'
# ntp configurations:
include_recipe './ntp.rb'
# kernel configurations:
include_recipe './kernel.rb'
# Install mc command:
include_recipe './mc.rb'
# unnecessary configurations:
if node['platform_version'].to_f == 16.04
include_recipe './unnecessary.rb'
end
# AWS EC2 Swap Setting:
if node['is_ec2']
include_recipe './aws_ec2.rb'
end

View File

@ -0,0 +1,2 @@
autoclean -y
upgrade -y -o APT::Get::Show-Upgraded=true

View File

@ -0,0 +1,11 @@
# Configuration for cron-apt. For further information about the possible
# configuration settings see the README file.
SYSLOGON="always"
DEBUG="verbose"
MAILON=""
APTCOMMAND=/usr/bin/apt
OPTIONS="-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list"

View File

@ -0,0 +1,15 @@
        
        
        
                    
                                
                                                        
                                                                    
                                                                                
                                                                                
                                                                                
                                                                                
                                                                    
                                            

View File

@ -0,0 +1,66 @@
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
driftfile /var/lib/ntp/ntp.drift
# Enable this if you want statistics to be logged.
#statsdir /var/log/ntpstats/
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable
# Specify one or more NTP servers.
# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board
# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for
# more information.
pool 0.ubuntu.pool.ntp.org iburst
pool 1.ubuntu.pool.ntp.org iburst
pool 2.ubuntu.pool.ntp.org iburst
pool 3.ubuntu.pool.ntp.org iburst
# Use Ubuntu's ntp server as a fallback.
pool ntp.ubuntu.com
# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
# details. The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
# might also be helpful.
#
# Note that "restrict" applies to both servers and clients, so a configuration
# that might be intended to block requests from certain clients could also end
# up blocking replies from your own upstream servers.
# By default, exchange time with everybody, but don't allow configuration.
restrict -4 default kod notrap nomodify nopeer noquery limited
restrict -6 default kod notrap nomodify nopeer noquery limited
# Local users may interrogate the ntp server more closely.
restrict 127.0.0.1
restrict ::1
# Needed for adding pool entries
restrict source notrap nomodify noquery
# Clients from this (example!) subnet have unlimited access, but only if
# cryptographically authenticated.
#restrict 192.168.123.0 mask 255.255.255.0 notrust
# If you want to provide time to your local subnet, change the next line.
# (Again, the address is an example only.)
#broadcast 192.168.123.255
# If you want to listen to time broadcasts on your local subnet, de-comment the
# next lines. Please do this only if you trust everybody on the network!
#disable auth
#broadcastclient
#Changes recquired to use pps synchonisation as explained in documentation:
#http://www.ntp.org/ntpfaq/NTP-s-config-adv.htm#AEN3918
#server 127.127.8.1 mode 135 prefer # Meinberg GPS167 with PPS
#fudge 127.127.8.1 time1 0.0042 # relative to PPS for my hardware
#server 127.127.22.1 # ATOM(PPS)
#fudge 127.127.22.1 flag3 1 # enable PPS API

View File

@ -0,0 +1,91 @@
# Package generated configuration file
# See the sshd_config(5) manpage for details
# What ports, IPs and protocols we listen for
Port 10022
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024
# Logging
SyslogFacility AUTH
LogLevel INFO
# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no
#MaxStartups 10:30:60
#Banner /etc/issue.net
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
# Do not use DNS:
UseDNS no

View File

@ -0,0 +1,122 @@
# $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
Port 10022
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key
# Ciphers and keying
#RekeyLimit default none
# Logging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
#PubkeyAuthentication yes
# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
#AuthorizedPrincipalsFile none
#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
#PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
# no default banner path
#Banner none
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
# override default of no subsystems
Subsystem sftp /usr/lib/openssh/sftp-server
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server

View File

@ -0,0 +1,8 @@
# `vfs_cache_pressure` configures how much the system will choose to cache inode
# and dentry information over other data.
#
# Basically, this is access data about the filesystem.
# This is generally very costly to look up and very frequently requested,
# so it's an excellent thing for your system to cache.
vm.vfs_cache_pressure = 50

View File

@ -0,0 +1,9 @@
# The swappiness parameter configures how often your system swaps data out of RAM to the swap space.
# This is a value between 0 and 100 that represents a percentage.
#
# With values close to zero, the kernel will not swap data to the disk unless absolutely necessary.
# Remember, interactions with the swap file are "expensive" in that they take a lot longer than
# interactions with RAM and they can cause a significant reduction in performance.
# Telling the system not to rely on the swap much will generally make your system faster.
vm.swappiness = 10

View File

@ -0,0 +1 @@
Asia/Tokyo

View File

@ -0,0 +1,4 @@
#!/bin/sh
echo
cat /etc/motd.tail

View File

@ -0,0 +1,17 @@
#!/bin/sh
# if the commit is first one, then pass
if [ -z "$(git branch)" ]; then
exit 0
fi
# Otherwise, check if the branch is master, and if it is, fail.
branch="$(git symbolic-ref HEAD 2>/dev/null)" || \
"$(git describe --contains --all HEAD)"
if [ "${branch##refs/heads/}" = "master" ]; then
echo "Do not commit on the master branch!"
exit 1
fi

View File

@ -0,0 +1,18 @@
#!/bin/sh
if [ "$2" = "" ]; then
mv $1 $1.tmp
ID=`git branch | grep ^\* | awk '{print $2}' | cut -f 2 -d "/"`
cat <<EOF > $1
This commit refs/fixes #${ID}.
# ^^^^^^^^^^
EOF
cat $1.tmp >> $1
fi
exit 0

21
cookbooks/base/fortune.rb Normal file
View File

@ -0,0 +1,21 @@
# Install `fortune` package:
package 'fortune' do
not_if 'test -e /usr/games/fortune'
end
URL='http://www.splitbrain.org/_media/projects/fortunes/fortune-starwars.tgz'
TGZ='fortune-starwars.tgz'
[
"wget #{URL} -O #{TGZ}",
"tar xf #{TGZ}",
'cp fortune-starwars/starwars.dat /usr/share/games/fortunes/',
'cp fortune-starwars/starwars /usr/share/games/fortunes/'
].each do |cmd|
execute cmd do
user 'root'
cwd '/tmp/itamae_tmp/'
not_if 'test -e /usr/share/games/fortunes/starwars.dat'
end
end

12
cookbooks/base/kernel.rb Normal file
View File

@ -0,0 +1,12 @@
STORAGE = '/etc/sysctl.d'
[
"#{STORAGE}/90-vm-swappiness.conf",
"#{STORAGE}/90-vfs-cache-pressure.conf"
].each do |conf|
remote_file conf do
owner 'root'
group 'root'
mode '644'
end
end

20
cookbooks/base/lang.rb Normal file
View File

@ -0,0 +1,20 @@
# Language Settings:
package 'language-pack-ja-base'
execute 'locale-gen ja_JP.UTF-8' do
user 'root'
not_if 'locale -a | grep ja_JP.utf8'
end
execute 'dpkg-reconfigure --frontend=noninteractive locales' do
user 'root'
not_if 'locale -a | grep ja_JP.utf8'
end
execute 'update-locale LANG=ja_JP.UTF-8' do
user 'root'
not_if 'strings /etc/default/locale | grep ja_JP.UTF-8'
end

12
cookbooks/base/mc.rb Normal file
View File

@ -0,0 +1,12 @@
MC = 'https://dl.minio.io/client/mc/release/linux-amd64/mc'
LOCATION = '/usr/local/bin/mc'
execute "wget #{MC} -O #{LOCATION}" do
not_if "test -e #{LOCATION}"
end
file LOCATION do
mode '755'
user 'root'
group 'root'
end

18
cookbooks/base/ntp.rb Normal file
View File

@ -0,0 +1,18 @@
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
when "18.04"
# do nothing
else
package 'ntp'
remote_file '/etc/ntp.conf' do
owner 'root'
group 'root'
mode '644'
notifies :restart, 'service[ntp]'
end
service 'ntp' do
action :nothing
end
end

View File

@ -0,0 +1,64 @@
# Execute `apt update`:
execute 'apt update'
# Install the necessary packages:
%w[build-essential zsh vim-nox debian-keyring screen curl dstat].each do |pkg|
package pkg
end
# Install the extra kernel:
unless node['is_ec2']
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
when "18.04"
package 'linux-image-extra-virtual'
else
KERNEL = run_command("uname -r").stdout.chomp
package "linux-image-extra-#{KERNEL}"
end
end
### Here we are going to install git.
# Constants:
KEYSRV = 'hkp://keyserver.ubuntu.com:80'
ID = 'E1DF1F24'
GIT_PREPUSH = '/usr/share/git-core/templates/hooks/pre-push'
PREPUSH = 'https://gist.github.com/kazu634/8267388/raw/e9202cd4c29a66723c88d2be05f3cd19413d2137/pre-push'
# Retrieve the Ubuntu code:
DIST = run_command('lsb_release -cs').stdout.chomp
# Add the public key file to install `git`
execute "apt-key adv --keyserver #{KEYSRV} --recv-keys #{ID}" do
not_if 'apt-key list | grep E1DF1F24'
end
# Deploy the `apt` sources:
template '/etc/apt/sources.list.d/git.list' do
action :create
variables(distribution: DIST)
end
execute 'apt update' do
not_if 'LANG=C apt-cache policy git | grep Installed | grep ppa'
end
execute 'apt install git -y' do
not_if 'LANG=C apt-cache policy git | grep Installed | grep ppa'
end
execute "wget #{PREPUSH} -O #{GIT_PREPUSH}" do
not_if "test -e #{GIT_PREPUSH}"
end
[
'/usr/share/git-core/templates/hooks/pre-commit',
'/usr/share/git-core/templates/hooks/prepare-commit-msg',
].each do |conf|
remote_file conf do
user 'root'
owner 'root'
group 'root'
mode '644'
end
end

35
cookbooks/base/ssh.rb Normal file
View File

@ -0,0 +1,35 @@
# ToDo: `iptables` setting must be here:
execute 'ufw allow 10022' do
user 'root'
not_if 'LANG=c ufw status | grep 10022'
notifies :run, 'execute[ufw reload-or-enable]'
end
# Deploy the `sshd` configuration file:
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
when "18.04"
remote_file '/etc/ssh/sshd_config' do
user 'root'
owner 'root'
group 'root'
mode '644'
source 'files/etc/ssh/sshd_config.1804'
end
else
remote_file '/etc/ssh/sshd_config' do
user 'root'
owner 'root'
group 'root'
mode '644'
end
end
# Apply the changes:
execute 'systemctl reload ssh.service ' do
action :nothing
subscribes :run, 'remote_file[/etc/ssh/sshd_config]'
end

View File

@ -0,0 +1 @@
deb "http://ppa.launchpad.net/git-core/ppa/ubuntu" <%= @distribution %> main

View File

@ -0,0 +1,23 @@
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
when "18.04"
execute 'timedatectl set-timezone Asia/Tokyo' do
not_if 'timedatectl | grep Tokyo'
end
else
remote_file '/etc/timezone' do
user 'root'
owner 'root'
group 'root'
mode '644'
end
[
'cp -f /usr/share/zoneinfo/Asia/Tokyo /etc/localtime'
].each do |cmd|
execute cmd do
user 'root'
not_if 'diff /usr/share/zoneinfo/Asia/Tokyo /etc/localtime'
end
end
end

6
cookbooks/base/ufw.rb Normal file
View File

@ -0,0 +1,6 @@
execute 'ufw reload-or-enable' do
user 'root'
command 'LANG=C ufw reload | grep skipping && ufw --force enable || exit 0'
action :nothing
end

View File

@ -0,0 +1,5 @@
%w( apparmor iscsid lxc lxcfs lxd-containers lxd open-iscsi ).each do |s|
service s do
action :disable
end
end

View File

@ -0,0 +1,9 @@
# -------------------------------------------
# Specifying the default settings:
# -------------------------------------------
node.reverse_merge!({
'blog' => {
'FQDN' => 'blog.kazu634.com',
'production' => true
}
})

View File

@ -0,0 +1,6 @@
include_recipe './attributes.rb'
if node['blog']['production']
include_recipe './ssl.rb'
include_recipe './nginx.rb'
end

View File

@ -0,0 +1,2 @@
@reboot webadm cp -pr /home/webadm/works/public/* /var/www/blog/
12 3 * * * root openssl rand 48 > /etc/letsencrypt/live/blog.kazu634.com/ticket.key

View File

@ -0,0 +1,13 @@
-----BEGIN DH PARAMETERS-----
MIICCAKCAgEAqY1i3j1m5Udr7eJxrsxBDK3NqsXJbPgfj2tdH+RlY8Bb7NuTPl9Z
e5KtZ2UQlPcth9sSPgulg/V+g4GQhge8xACSl1joAenDpPF8BGyBcv/o9QwNpdzj
yP9o4X/TQkDxGKTJItpfKMHdmBPYC8Sxv0NpPlkKT27kfwOpSRuj17ZWAl+AnOjS
TjLzSq85/Ao7C0rgAhJRG38iZ36DXGWYtrA7n/F6wTlmelRwkNCGEypF79GWSU8P
xCpVLTY6MIhDq5NBO3mzkeYyl0M1M8c7dwUAPAMCK43Fl6nfQbbbwSIxlxQy8WIq
48s5TaJEp1hU2CXTgTa+cmm1JQziFBlwOZNAeAAIi6JcJRHCFhpUrTVirqPRIoUc
c99xUs91aELi/nZggt0vrGd4kyQ6eB5pxB6kAJwNfP3URMjucttcukyhuu/jzDMd
GNg1J75dAF606yunta8ZohecrabpkACQz9ZR+VOM0z4IGbI39M+EohFcxL7+8gSU
VP537jDrlAjU2DtbE2Dr+dotg1LfIE4P5AGFIAPfKYE+YXJ85SNin7POMttw8TP2
WlMVFAG159CBjPvGPuXqInBv6U5QHWxINSevHL6vdD12d7L9LjUHQQNaAborPe2Z
rN7fPDbDib5vnxUBAayHgic8qw1/eqWIhAXyBGRG/EOuwKgr2DU5U3sCAQI=
-----END DH PARAMETERS-----

View File

@ -0,0 +1,2 @@
check file nginx-blog with path /var/log/nginx/blog.access.log
if timestamp > 2 minutes for 5 cycles then exec "/bin/systemctl restart nginx"

View File

@ -0,0 +1,90 @@
server {
# allow access from localhost
listen 80 reuseport backlog=1024;
listen 443 ssl http2 backlog=1024;
server_name blog.kazu634.com;
ssl_certificate /etc/letsencrypt/live/blog.kazu634.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/blog.kazu634.com/privkey.pem;
ssl_dhparam /etc/letsencrypt/live/blog.kazu634.com/dhparams_4096.pem;
ssl_session_cache shared:SSL:3m;
ssl_buffer_size 4k;
ssl_session_timeout 10m;
ssl_session_tickets on;
ssl_session_ticket_key /etc/letsencrypt/live/blog.kazu634.com/ticket.key;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DES-CBC3-SHA;
ssl_prefer_server_ciphers on;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
# Enable HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
root /var/www/blog;
index index.html index.htm;
access_log /var/log/nginx/blog.access.log ltsv;
error_log /var/log/nginx/blog.error.log;
location / {
gzip on;
gunzip on;
gzip_vary on;
# http2 server push:
http2_push_preload on;
http2_push /css/sanitize.css;
http2_push /css/responsive.css;
http2_push /css/highlight_monokai.css;
http2_push /css/theme.css;
http2_push /css/custom.css;
http2_push /images/profile.png;
http2_push /js/highlight.pack.js;
if (-e "/tmp/maintenance") {
return 503;
}
location /feed {
return 301 http://blog.kazu634.com/index.xml;
}
location /wp-content {
return 404;
}
location ~* \.css {
gzip_static always;
expires max;
}
location ~* \.js {
gzip_static always;
expires max;
}
location /images {
gzip_static always;
expires max;
}
location = /favicon.ico {
access_log off;
empty_gif;
expires max;
}
try_files $uri $uri/ /index.html;
}
}

63
cookbooks/blog/nginx.rb Normal file
View File

@ -0,0 +1,63 @@
# Deploy the nginx configuration file:
remote_file '/etc/nginx/sites-available/blog' do
owner 'root'
group 'root'
mode '644'
end
# Deploy cron tab configuration for nginx
remote_file '/etc/cron.d/blog' do
owner 'root'
group 'root'
mode '644'
end
# Create link:
link '/etc/nginx/sites-enabled/blog' do
user 'root'
to '/etc/nginx/sites-available/blog'
notifies :restart, 'service[nginx]'
end
service 'nginx' do
action :nothing
end
# Create the nginx directory:
directory '/var/www/blog' do
owner 'www-data'
group 'webadm'
mode '770'
end
# Add the fstab entry:
file '/etc/fstab' do
action :edit
block do |content|
content << "tmpfs /var/www/blog tmpfs size=250m,noatime 0 0\n"
end
not_if 'grep /var/www/blog /etc/fstab'
notifies :run, 'execute[fstab -a]'
end
execute 'mount -a' do
action :nothing
end
# Add monit configuration file for monitoring nginx logs:
remote_file '/etc/monit/conf.d/blog-log.conf' do
owner 'root'
group 'root'
mode '644'
notifies :reload, 'service[monit]'
end
service 'monit' do
action :nothing
end

16
cookbooks/blog/ssl.rb Normal file
View File

@ -0,0 +1,16 @@
[
'rm -f /etc/nginx/sites-enabled/*',
'ln -f -s /etc/nginx/sites-available/maintenance /etc/nginx/sites-enabled/maintenance',
'systemctl reload nginx',
"test -e /etc/letsencrypt/live/#{node['blog']['FQDN']}/cert.pem || certbot certonly --webroot -d #{node['blog']['FQDN']} --webroot-path /usr/share/nginx/html/ --email simoom634@yahoo.co.jp --agree-tos -n",
'/home/webadm/bin/nginx-config.sh',
].each do |cmd|
execute cmd
end
remote_file "/etc/letsencrypt/live/#{node['blog']['FQDN']}/dhparams_4096.pem" do
owner 'root'
group 'root'
end
execute "openssl rand 48 > /etc/letsencrypt/live/#{node['blog']['FQDN']}/ticket.key"

View File

@ -0,0 +1,10 @@
# -------------------------------------------
# Specifying the default settings:
# -------------------------------------------
node.reverse_merge!({
'consul-template' => {
'base_binary_url' => 'https://releases.hashicorp.com/consul-template/',
'arch' => node['kernel']['machine'] =~ /x86_64/ ? 'amd64' : '386',
'tmp_path' => '/tmp/itamae_tmp/consul-template.zip'
}
})

View File

@ -0,0 +1,6 @@
include_recipe './attributes.rb'
include_recipe './prerequisites.rb'
include_recipe './install.rb'
include_recipe './setup.rb'

View File

@ -0,0 +1,47 @@
# -------------------------------------------
# Calculating the latest `consul-template` version:
# -------------------------------------------
download_url = ''
begin
require 'net/http'
uri = URI.parse('https://releases.hashicorp.com/consul-template/')
Timeout.timeout(3) do
response = Net::HTTP.get_response(uri)
if response.body =~ /consul-template_(\d+\.\d+\.\d+)/
tag_version = $1
download_url = \
"#{node['consul-template']['base_binary_url']}#{tag_version}/consul-template_#{tag_version}_linux_#{node['consul-template']['arch']}.zip"
end
end
rescue
# Abort the chef client process:
raise 'Cannot connect to https://releases.hashicorp.com/consul-template/'
end
# -------------------------------------------
# Main Part
# -------------------------------------------
# Download:
execute "wget #{download_url} -O #{node['consul-template']['tmp_path']}"
# Unzip:
execute "unzip -qo #{node['consul-template']['tmp_path']}" do
cwd '/opt/consul/bin/'
end
file '/opt/consul/bin/consul-template' do
owner 'root'
group 'root'
mode '755'
end
# Create link:
link '/usr/local/bin/consul-template' do
user 'root'
to '/opt/consul/bin/consul-template'
end

View File

@ -0,0 +1,14 @@
# Ensure that `unzip` and `dnsmasq` are available:
%w( unzip ).each do |p|
package p do
action :install
end
end
%w( /opt/consul/bin ).each do |d|
directory d do
owner 'root'
group 'root'
mode '755'
end
end

View File

@ -0,0 +1,9 @@
# `consul-template`-related paths:
%w( /etc/consul-template.d ).each do |d|
directory d do
owner 'root'
group 'root'
mode '755'
end
end

View File

@ -0,0 +1,21 @@
# -------------------------------------------
# Specifying the default settings:
# -------------------------------------------
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
when "18.04"
cmd = 'LANG=C /sbin/ifconfig | grep "inet " | grep -v 127.0.0.1 | cut -d" " -f10'
else
cmd = 'LANG=C /sbin/ifconfig | grep "inet addr" | grep -v 127.0.0.1 | awk "{print $2;}" | cut -d: -f2 | cut -f 1 -d " " | tail -1'
end
ipaddr = run_command(cmd).stdout.chomp
node.reverse_merge!({
'consul' => {
'base_binary_url' => 'https://releases.hashicorp.com/consul/',
'arch' => node['kernel']['machine'] =~ /x86_64/ ? 'amd64' : '386',
'tmp_path' => '/tmp/itamae_tmp/consul.zip',
'manager' => true,
'manager_hosts' => '["192.168.10.110", "192.168.10.101", "192.168.10.111", "192.168.10.115"]',
'ipaddr' => ipaddr
}
})

View File

@ -0,0 +1,11 @@
include_recipe './attributes.rb'
include_recipe './prerequisites.rb'
include_recipe './install.rb'
include_recipe './setup.rb'
include_recipe './dnsmasq.rb'
include_recipe './monitoring.rb'

View File

@ -0,0 +1,47 @@
%w(dnsmasq resolvconf systemd-resolved).each do |s|
service s do
action :nothing
end
end
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
when "18.04"
remote_file '/etc/dnsmasq.conf' do
owner 'root'
group 'root'
mode '644'
source 'files/etc/dnsmasq.conf.1804'
notifies :reload, 'service[dnsmasq]'
end
else
remote_file '/etc/dnsmasq.conf' do
owner 'root'
group 'root'
mode '644'
source 'files/etc/dnsmasq.conf.1804'
notifies :reload, 'service[dnsmasq]'
end
end
case run_command('grep VERSION_ID /etc/os-release | awk -F\" \'{print $2}\'').stdout.chomp
when "18.04"
remote_file '/etc/systemd/resolved.conf' do
owner 'root'
group 'root'
mode '644'
notifies :restart, 'service[systemd-resolved]'
end
else
remote_file '/etc/resolvconf/resolv.conf.d/head' do
owner 'root'
group 'root'
mode '644'
notifies :restart, 'service[resolvconf]'
end
end

View File

@ -0,0 +1,9 @@
{
"check": {
"id": "disk-capacity",
"name": "Check for Disk Capacity",
"args": ["/usr/lib/nagios/plugins/check_disk", "-w", "25%", "-c", "10%", "-p", "/"],
"interval": "3600s",
"timeout": "10s"
}
}

View File

@ -0,0 +1,9 @@
{
"check": {
"id": "load-average",
"name": "Check for Load Average",
"args": ["/usr/lib/nagios/plugins/check_load", "-r", "--warning=1,1,1", "--critical=2,2,2"],
"interval": "60s",
"timeout": "10s"
}
}

View File

@ -0,0 +1,9 @@
{
"check": {
"id": "memory",
"name": "Check for Memory",
"args": ["/usr/lib/nagios/plugins/check_memory"],
"interval": "60s",
"timeout": "10s"
}
}

View File

@ -0,0 +1,9 @@