directlx
/
dlx-ansible
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
26 Commits 1 Branch 0 Tags 168 KiB
Commit Graph

8 Commits

Author SHA1 Message Date
directlx 94180f6e8b Remove hiveops/odoo, clean up DNS entries, document Kafka fix 
- Remove hiveops (192.168.200.112) and odoo (192.168.200.61) from inventory
- Remove hiveops host_vars
- Remove hiveops/odoo DNS records from pihole-dns.yml and configure-directlx-dev-dns.yml
- Remove decommissioned domains (incident, mgmt, release, browser, hiveops) from local DNS playbook
- Add KAFKA-LOCALHOST-FIX.md documenting the localhost:9092 admin client issue and fix

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-02-20 12:35:52 -05:00
directlx 9be34947b2 Fix www.directlx.dev accessibility with nginx firewall and DNS config 
This commit resolves connectivity issues for www.directlx.dev by:

1. Add nginx firewall configuration (host_vars/nginx.yml)
   - Allow ports 80/tcp (HTTP) and 443/tcp (HTTPS)
   - Enables NPM to proxy traffic to nginx backend

2. Add www.directlx.dev DNS record via Pi-hole
   - Configure playbooks/configure-directlx-dev-dns.yml
   - Route www.directlx.dev → NPM (192.168.200.71)
   - NPM then proxies to nginx (192.168.200.65)

Problem: After firewall changes, nginx server only allowed SSH (port 22),
blocking HTTP/HTTPS from NPM. Additionally, Pi-hole had no DNS record for
www.directlx.dev subdomain.

Solution: Applied firewall rules and DNS configuration to complete the
proxy chain: Browser → Pi-hole DNS → NPM → nginx.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2026-02-14 09:14:59 -05:00
directlx 538feb79c2 Add comprehensive security audit and Jenkins connectivity fixes 
Security Audit Infrastructure:
- Add security-audit.yml and security-audit-v2.yml playbooks
- Comprehensive security checks: SSH config, firewall, open ports,
  failed logins, auto-updates, password policies
- Generate per-server reports in /tmp/security-audit-*/
- Add SECURITY-AUDIT-SUMMARY.md with prioritized findings

Docker Server Security (Ready for Execution):
- Add secure-docker-server-firewall.yml playbook
- Three firewall modes: internal (recommended), selective, custom
- Add DOCKER-SERVER-SECURITY.md execution guide
- Security updates applied (107 packages upgraded)
- Firewall configuration saved for future execution

Jenkins Connectivity Fixes:
- Fixed Jenkins and SonarQube port blocking (opened 8080, 9000)
- Created jenkins host_vars with firewall configuration
- Restarted SonarQube containers (postgresql, sonarqube)
- Add JENKINS-CONNECTIVITY-FIX.md documentation

Jenkins SSH Agent Configuration:
- Add setup-jenkins-agent-ssh.yml for SSH key generation
- Enable password authentication for AWS Jenkins Master
- Created jenkins user SSH key pair
- Add comprehensive troubleshooting guide

NPM SSH Proxy Setup:
- Configure NPM as SSH proxy for Jenkins agents (port 2222)
- Update npm.yml host_vars with port 2222
- Add configure-npm-ssh-proxy.yml playbook
- Create nginx stream config at /data/nginx/stream/jenkins.conf
- Add NPM-SSH-PROXY-FOR-JENKINS.md full documentation
- Add JENKINS-NPM-PROXY-QUICK-REFERENCE.md quick guide

DNS Configuration:
- Add jenkins.directlx.dev to Pi-hole DNS
- Points to NPM server (192.168.200.71) for internal resolution

Key Security Findings:
- 16 servers audited
- Critical: Root SSH login enabled on 2 servers
- Critical: No firewall on several servers
- High: 65 pending security updates on docker server (now applied)
- High: Automatic updates not configured on most servers

Documentation:
- SECURITY-AUDIT-SUMMARY.md: Executive summary and remediation plan
- DOCKER-SERVER-SECURITY.md: Docker server security guide
- JENKINS-CONNECTIVITY-FIX.md: Jenkins firewall fix documentation
- JENKINS-SSH-AGENT-TROUBLESHOOTING.md: SSH troubleshooting guide
- NPM-SSH-PROXY-FOR-JENKINS.md: NPM proxy configuration
- JENKINS-NPM-PROXY-QUICK-REFERENCE.md: Quick reference guide

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2026-02-09 13:27:36 -05:00
directlx 7754585436 Enable MySQL connectivity for Docker applications 
- Add MySQL host_vars with firewall rules for port 3306
- Enable IP forwarding on Docker hosts (hiveops, smartjournal)
- Fix container-to-external-network connectivity issue

The IP forwarding setting was previously disabled by the common role's
security defaults, preventing Docker containers from reaching external
databases. This change overrides that setting for hosts running Docker.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2026-02-06 11:30:14 -05:00
directlx d7c7b82314 Disable firewall on smartjournal 
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-02-04 09:50:29 -05:00
directlx 047b485a13 Add host_vars for firewall configuration 
- docker.yml: Disable firewall (Docker manages iptables)
- hiveops.yml: Disable firewall (many ports needed)
- npm.yml: Allow ports 22, 80, 443, 81 (admin)
- smartjournal.yml: Allow ports 22, 80, 443

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-02-04 09:49:31 -05:00
directlx b2151858da Add Pi-hole host_vars for firewall ports 
Allow required ports for Pi-hole:
- 22/tcp (SSH)
- 53/tcp, 53/udp (DNS)
- 80/tcp (Web admin)
- 443/tcp (HTTPS)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-02-04 09:25:46 -05:00
directlx c781ec25a2 Initial Ansible project structure 
Set up standard directory layout with:
- ansible.cfg with sensible defaults
- YAML inventory with example groups
- Main site playbook template
- Directories for roles, group_vars, host_vars, files, templates
- .gitignore for secrets, vault files, and SSH keys

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-02-04 06:37:33 -05:00