SYS-678 ansible recovery logic; adjust splunk and snappymail charts

ansible/roles/docker_node/tasks/docker.yml

@@ -69,56 +69,59 @@
     state: link
   changed_when: False
 
-- name: Reload systemd
-  ansible.builtin.systemd:
-    daemon_reload: yes
-  changed_when: False
-
-- name: Docker engine package
-  ansible.builtin.apt:
-    name: "{{ docker.apt_repo.package_name }}={{ docker.apt_repo.package_ver }}"
-    update_cache: yes
-
-- name: Options directory
-  ansible.builtin.file:
-    dest: /etc/docker
-    state: directory
-
-- name: Docker options
-  ansible.builtin.copy:
-    content: "{{ docker.options|to_nice_json }}"
-    dest: /etc/docker/daemon.json
-  notify: Restart docker
-
-- name: Systemd override path for docker.service
-  ansible.builtin.file:
-    dest: /lib/systemd/system/docker.service.d
-    state: directory
-
-- name: Deal with conflicting systemd-unit option, await vol mount
-  ansible.builtin.template:
-    dest: /lib/systemd/system/docker.service.d/docker.service.conf
-    src: docker.service.conf.j2
-  notify: Reload systemd
-
-- name: Systemd unit file for enabling /var/lib/docker/volumes monitoring
-  ansible.builtin.copy:
-    dest: /etc/systemd/system/docker-permissions.service
-    src: docker-permissions.service
-
-# TODO parse fstab seeking last luks line
-
-- name: Reenable systemctl start
-  ansible.builtin.file:
-    path: /usr/sbin/policy-rc.d
-    state: absent
-  changed_when: False
-
-- name: Unmask docker.service
-  ansible.builtin.file:
-    dest: /etc/systemd/system/docker.service
-    state: absent
-  changed_when: False
+- name: Configure docker service
+  block:
+    - name: Reload systemd
+      ansible.builtin.systemd:
+        daemon_reload: yes
+      changed_when: False
+
+    - name: Docker engine package
+      ansible.builtin.apt:
+        name: "{{ docker.apt_repo.package_name }}={{ docker.apt_repo.package_ver }}"
+        update_cache: yes
+
+    - name: Options directory
+      ansible.builtin.file:
+        dest: /etc/docker
+        state: directory
+
+    - name: Docker options
+      ansible.builtin.copy:
+        content: "{{ docker.options|to_nice_json }}"
+        dest: /etc/docker/daemon.json
+      notify: Restart docker
+
+    - name: Systemd override path for docker.service
+      ansible.builtin.file:
+        dest: /lib/systemd/system/docker.service.d
+        state: directory
+
+    - name: Deal with conflicting systemd-unit option, await vol mount
+      ansible.builtin.template:
+        dest: /lib/systemd/system/docker.service.d/docker.service.conf
+        src: docker.service.conf.j2
+      notify: Reload systemd
+
+    - name: Systemd unit file for enabling /var/lib/docker/volumes monitoring
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/docker-permissions.service
+        src: docker-permissions.service
+
+    # TODO parse fstab seeking last luks line
+
+  always:
+    - name: Reenable systemctl start
+      ansible.builtin.file:
+        path: /usr/sbin/policy-rc.d
+        state: absent
+      changed_when: False
+
+    - name: Unmask docker.service
+      ansible.builtin.file:
+        dest: /etc/systemd/system/docker.service
+        state: absent
+      changed_when: False
 
 - name: Suppress annoying error on subcontainer 'ia_addr' logs
   ansible.builtin.replace:

ansible/roles/fileserver/defaults/main.yml

@@ -1,4 +1,7 @@
 ---
+instantlinux_legacy:
+  enabled: false
+
 nfs_exports:
   /var/ftp: "*(ro,root_squash,crossmnt,fsid=0,no_subtree_check)"
 

ansible/roles/fileserver/tasks/main.yml

@@ -32,6 +32,7 @@
   when: nfs_exports | length == 0
 
 - import_tasks: instantlinux.yml
+  when: instantlinux_legacy.enabled
 
 - import_tasks: samba.yml
   when: samba.enabled

ansible/roles/network/handlers/main.yml

@@ -10,5 +10,5 @@
 
 - name: Restart sshd
   service:
-    name: sshd
+    name: ssh
     state: restarted

ansible/roles/network/tasks/sshd.yml

@@ -1,23 +1,12 @@
 ---
 # Tighten security in sshd: lock out brute-force scanners seeking weak ciphers
 
-- name: Set ciphers in sshd_config
-  lineinfile:
-    dest: /etc/ssh/sshd_config
-    regexp: "(?i)^Ciphers .*"
-    line: Ciphers {{ sshd_opts.ciphers|join(',') }}
-  notify: Restart sshd
-
-- name: Set macs in sshd_config
-  lineinfile:
-    dest: /etc/ssh/sshd_config
-    regexp: "(?i)^MACs .*"
-    line: MACs {{ sshd_opts.macs|join(',') }}
-  notify: Restart sshd
-
-- name: Set kexalgorithms in sshd_config
-  lineinfile:
-    dest: /etc/ssh/sshd_config
-    regexp: "(?i)^KexAlgorithms .*"
-    line: KexAlgorithms {{ sshd_opts.kexalgorithms|join(',') }}
+- name: Lock out brute-force scanners 
+  ansible.builtin.copy:
+    content: |
+      # ansible managed
+      Ciphers {{ sshd_opts.ciphers|join(',') }}
+      MACs {{ sshd_opts.macs|join(',') }}
+      KexAlgorithms {{ sshd_opts.kexalgorithms|join(',') }}
+    dest: /etc/ssh/sshd_config.d/10_ciphers.conf
   notify: Restart sshd

ansible/roles/volumes/tasks/encrypted.yml

@@ -34,94 +34,97 @@
     state: mounted
   changed_when: False
 
-- name: LUKS format volumes
-  shell: >
-    cryptsetup isLuks /dev/{{ item.value.vg }}/{{ item.key }} ||
-    cryptsetup luksFormat --batch-mode --verbose --key-file={{
-      masterkey.path }}/keys/{{ ansible_hostname }}/{{
-      item.key }} /dev/{{ item.value.vg }}/{{ item.key }}
-  register: luks_format
-  changed_when: ("Command successful" in luks_format.stdout)
-  with_dict: "{{ luks_volumes }}"
-
-# Encountered bug in ansible crypttab module, lineinfile is good enough
-- name: Create crypttab
-  copy:
-    content: ""
-    dest: /etc/crypttab.setup
-    mode: 0644
-    force: no
-
-- name: Crypt table entries
-  lineinfile:
-    line: "{{ 'luks-%-16s /dev/mapper/%s-%-16s %s/keys/%s/%-12s luks' % (
-          item.key, item.value.vg, item.key, masterkey.path, ansible_hostname,
-          item.key) }}"
-    path: /etc/crypttab.setup
-    regexp: "^luks-{{ item.key }}.*"
-  with_dict: "{{ luks_volumes }}"
-
-# For unattended boot, we have a custom startup script, so we don't
-#  leave /etc/crypttab in place (Ubuntu systemd will otherwise
-#  insist on entering passphrase at reboot)
-
-- name: Temporary crypttab symlink
-  file:
-    path: /etc/crypttab
-    src: crypttab.setup
-    state: link
-    force: True
-  changed_when: False
-
-- name: LUKS start volumes
-  command: cryptdisks_start luks-{{ item.key }}
-  register: luks_start
-  changed_when: ("(started)" in luks_start.stdout)
-  with_dict: "{{ luks_volumes }}"
-
-- name: Create filesystem
-  filesystem:
-    dev: /dev/mapper/luks-{{ item.key }}
-    fstype: "{{ item.value.type if 'type' in item.value else fs_type }}"
-    opts: "{{ '-N %s000' % item.value.inodes if 'inodes' in item.value
-      else '' }} -m 0"
-  with_dict: "{{ luks_volumes }}"
-
-- name: Remove temporary crypttab symlink
-  file:
-    path: /etc/crypttab
-    state: absent
-  changed_when: False
-
-- name: crypt-setup boot script
-  template:
-    src: crypt-activate.sh.j2
-    dest: /etc/crypt-activate.sh
-    mode: 0755
-
-- name: Systemd unit file for crypt-vols
-  copy:
-    dest: /etc/systemd/system/crypt-vols.service
-    src: crypt-vols.service
-
-- name: Add fstab entries
-  mount:
-    fstype: "{{ item.value.type if 'type' in item.value else fs_type }}"
-    path: "{{ item.value.path }}"
-    src: "/dev/mapper/luks-{{ item.key }}"
-    opts: "{{ item.value.options if 'options' in item.value else '_netdev,noauto' }}"
-    state: present
-  with_dict: "{{ luks_volumes }}"
-
-- name: Enable crypt-vols
-  systemd:
-    name: crypt-vols
-    enabled: yes
-    state: restarted
-  changed_when: False
-
-- name: Unmount master key
-  mount:
-    path: "{{ masterkey.path }}"
-    state: unmounted
-  changed_when: False
+- name: Encrypted volume preparation
+  block:
+    - name: LUKS format volumes
+      shell: >
+        cryptsetup isLuks /dev/{{ item.value.vg }}/{{ item.key }} ||
+        cryptsetup luksFormat --batch-mode --verbose --key-file={{
+          masterkey.path }}/keys/{{ ansible_hostname }}/{{
+          item.key }} /dev/{{ item.value.vg }}/{{ item.key }}
+      register: luks_format
+      changed_when: ("Command successful" in luks_format.stdout)
+      with_dict: "{{ luks_volumes }}"
+
+    # Encountered bug in ansible crypttab module, lineinfile is good enough
+    - name: Create crypttab
+      copy:
+        content: ""
+        dest: /etc/crypttab.setup
+        mode: 0644
+        force: no
+
+    - name: Crypt table entries
+      lineinfile:
+        line: "{{ 'luks-%-16s /dev/mapper/%s-%-16s %s/keys/%s/%-12s luks' % (
+              item.key, item.value.vg, item.key, masterkey.path, ansible_hostname,
+              item.key) }}"
+        path: /etc/crypttab.setup
+        regexp: "^luks-{{ item.key }}.*"
+      with_dict: "{{ luks_volumes }}"
+
+    # For unattended boot, we have a custom startup script, so we don't
+    #  leave /etc/crypttab in place (Ubuntu systemd will otherwise
+    #  insist on entering passphrase at reboot)
+
+    - name: Temporary crypttab symlink
+      file:
+        path: /etc/crypttab
+        src: crypttab.setup
+        state: link
+        force: True
+      changed_when: False
+
+    - name: LUKS start volumes
+      command: cryptdisks_start luks-{{ item.key }}
+      register: luks_start
+      changed_when: ("(started)" in luks_start.stdout)
+      with_dict: "{{ luks_volumes }}"
+
+    - name: Create filesystem
+      filesystem:
+        dev: /dev/mapper/luks-{{ item.key }}
+        fstype: "{{ item.value.type if 'type' in item.value else fs_type }}"
+        opts: "{{ '-N %s000' % item.value.inodes if 'inodes' in item.value
+          else '' }} -m 0"
+      with_dict: "{{ luks_volumes }}"
+
+    - name: Remove temporary crypttab symlink
+      file:
+        path: /etc/crypttab
+        state: absent
+      changed_when: False
+
+    - name: crypt-setup boot script
+      template:
+        src: crypt-activate.sh.j2
+        dest: /etc/crypt-activate.sh
+        mode: 0755
+
+    - name: Systemd unit file for crypt-vols
+      copy:
+        dest: /etc/systemd/system/crypt-vols.service
+        src: crypt-vols.service
+
+    - name: Add fstab entries
+      mount:
+        fstype: "{{ item.value.type if 'type' in item.value else fs_type }}"
+        path: "{{ item.value.path }}"
+        src: "/dev/mapper/luks-{{ item.key }}"
+        opts: "{{ item.value.options if 'options' in item.value else '_netdev,noauto' }}"
+        state: present
+      with_dict: "{{ luks_volumes }}"
+
+    - name: Enable crypt-vols
+      systemd:
+        name: crypt-vols
+        enabled: yes
+        state: restarted
+      changed_when: False
+
+  always:
+    - name: Unmount master key
+      mount:
+        path: "{{ masterkey.path }}"
+        state: unmounted
+      changed_when: False

k8s/helm/snappymail/Chart.yaml

@@ -6,7 +6,7 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/the-djmaze/snappymail
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "v2.38.2"
 dependencies:
 - name: chartlib

k8s/helm/snappymail/values.yaml

@@ -4,10 +4,16 @@ deployment:
   env:
     debug: "false"
     log_to_stdout: "true"
-    memory_limit: 128M
+    memory_limit: 256M
     upload_max_size: 25M
   containerPorts:
   - containerPort: 8888
+  resources:
+    limits:
+      memory: 512Mi
+    requests:
+      cpu: 50m
+      memory: 256Mi
 volumeMounts:
 - mountPath: /var/lib/snappymail/_data_
   name: share

k8s/helm/splunk/Chart.yaml

@@ -15,8 +15,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://hub.docker.com/r/splunk/splunk
 type: application
-version: 0.1.16
-appVersion: "10.0.2"
+version: 0.1.17
+appVersion: "10.2.1"
 dependencies:
 - name: chartlib
   version: 0.1.8