diff --git a/deploy-mail.yml b/deploy-mail.yml index 457edcb..dbc6746 100644 --- a/deploy-mail.yml +++ b/deploy-mail.yml @@ -2,3 +2,7 @@ hosts: mail roles: - mail +- name: roundcube setup + hosts: roundcube + roles: + - roundcube diff --git a/deploy-roundcube.yml b/deploy-roundcube.yml new file mode 100644 index 0000000..10c3973 --- /dev/null +++ b/deploy-roundcube.yml @@ -0,0 +1,4 @@ +- name: roundcube setup + hosts: roundcube + roles: + - roundcube diff --git a/group_vars/roundcube.yml b/group_vars/roundcube.yml new file mode 100644 index 0000000..e69de29 diff --git a/inventory b/inventory index 2e8c9cc..fc218c6 100644 --- a/inventory +++ b/inventory @@ -6,6 +6,7 @@ mail.simponic.xyz ansible_user=root ansible_connection=ssh [private] johan ansible_user=root ansible_connection=ssh +europa ansible_user=root ansible_connection=ssh [webservers] levi ansible_user=root ansible_connection=ssh @@ -41,3 +42,6 @@ johan ansible_user=root ansible_connection=ssh [mail] mail.simponic.xyz ansible_user=root ansible_connection=ssh + +[roundcube] +europa ansible_user=root ansible_connection=ssh diff --git a/roles/nameservers/templates/db.simponic.xyz.j2 b/roles/nameservers/templates/db.simponic.xyz.j2 index e154765..a5c31a3 100644 --- a/roles/nameservers/templates/db.simponic.xyz.j2 +++ b/roles/nameservers/templates/db.simponic.xyz.j2 @@ -23,6 +23,8 @@ mail.simponic.xyz. 1 IN A 192.3.248.205 levi.simponic.xyz. 1 IN A 23.95.214.176 simponic.xyz. 1 IN A 23.95.214.176 +chesshbot.simponic.xyz. 1 IN A 129.123.76.14 + ;; CNAME Records static.simponic.xyz. 1 IN CNAME simponic.xyz. www.simponic.xyz. 1 IN CNAME simponic.xyz. diff --git a/roles/private/files/europa/http.roundcube.internal.simponic.xyz.conf b/roles/private/files/europa/http.roundcube.internal.simponic.xyz.conf new file mode 100644 index 0000000..09ce1a6 --- /dev/null +++ b/roles/private/files/europa/http.roundcube.internal.simponic.xyz.conf @@ -0,0 +1,13 @@ +server { + listen 80; + server_name roundcube.internal.simponic.xyz; + + location /.well-known/acme-challenge { + root /var/www/letsencrypt; + try_files $uri $uri/ =404; + } + + location / { + rewrite ^ https://roundcube.internal.simponic.xyz$request_uri? permanent; + } +} diff --git a/roles/private/files/europa/https.roundcube.internal.simponic.xyz.conf b/roles/private/files/europa/https.roundcube.internal.simponic.xyz.conf new file mode 100644 index 0000000..f21b186 --- /dev/null +++ b/roles/private/files/europa/https.roundcube.internal.simponic.xyz.conf @@ -0,0 +1,32 @@ +server { + listen 443 ssl; + server_name roundcube.internal.simponic.xyz; + + ssl_certificate /etc/letsencrypt/live/roundcube.internal.simponic.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/roundcube.internal.simponic.xyz/privkey.pem; + ssl_trusted_certificate /etc/letsencrypt/live/roundcube.internal.simponic.xyz/fullchain.pem; + + ssl_session_cache shared:SSL:50m; + ssl_session_timeout 5m; + ssl_stapling on; + ssl_stapling_verify on; + + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; + + ssl_dhparam /etc/nginx/dhparams.pem; + ssl_prefer_server_ciphers on; + + location / { + proxy_pass http://127.0.0.1:9002; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $server_name; + proxy_buffering off; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; + } +} diff --git a/roles/private/files/nginx.conf b/roles/private/files/nginx.conf index f978052..6ddd8ab 100644 --- a/roles/private/files/nginx.conf +++ b/roles/private/files/nginx.conf @@ -1,7 +1,6 @@ user www-data; worker_processes 4; pid /run/nginx.pid; -load_module modules/ndk_http_module.so; events { worker_connections 768; diff --git a/roles/roundcube/tasks/main.yml b/roles/roundcube/tasks/main.yml new file mode 100644 index 0000000..d838433 --- /dev/null +++ b/roles/roundcube/tasks/main.yml @@ -0,0 +1,22 @@ +--- +- name: ensure rouncube docker/compose exist + file: + path: /etc/docker/compose/roundcube + state: directory + owner: root + group: root + mode: 0700 + +- name: build roundcube docker-compose.yml.j2 + template: + src: ../templates/docker-compose.yml.j2 + dest: /etc/docker/compose/roundcube/docker-compose.yml + owner: root + group: root + mode: u=rw,g=r,o=r + +- name: daemon-reload and enable roundcube + ansible.builtin.systemd_service: + state: restarted + enabled: true + name: docker-compose@roundcube diff --git a/roles/roundcube/templates/docker-compose.yml.j2 b/roles/roundcube/templates/docker-compose.yml.j2 new file mode 100644 index 0000000..c185aa2 --- /dev/null +++ b/roles/roundcube/templates/docker-compose.yml.j2 @@ -0,0 +1,22 @@ +version: '3' + +services: + roundcube: + image: roundcube/roundcubemail:latest + container_name: roundcubemail + restart: unless-stopped + hostname: roundcube.internal.simponic.xyz + volumes: + - ./www:/var/www/html + - ./db/sqlite:/var/roundcube/db + ports: + - 127.0.0.1:9002:80 + dns: + - {{ johan_ip }} + environment: + - ROUNDCUBEMAIL_DB_TYPE=sqlite + - ROUNDCUBEMAIL_SKIN=elastic + - ROUNDCUBEMAIL_DEFAULT_HOST=ssl://mail.simponic.xyz + - ROUNDCUBEMAIL_DEFAULT_PORT=993 + - ROUNDCUBEMAIL_SMTP_SERVER=tls://mail.simponic.xyz + - ROUNDCUBEMAIL_SMTP_PORT=587