blob: 1b11d22472ab04a53120bda9d0d8f9a9bb361f0c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
|
# -*- mode: yaml; -*-
---
# NOTE:
# Ansible Best Practices - Variables and Vaults
# https://docs.ansible.com/ansible/latest/playbooks_best_practices.html#best-practices-for-variables-and-vaults
deploy_user: ansible
ansible_ssh_private_key_file: "{{ playbook_dir }}/private/ssh/ansible.key"
pf:
# number of simulataneous connections allowed from one host
max_conn: 100
# rate of new connections allowed from one host
max_conn_rate: 15/5 # 15 of connections per 5 seconds
domains:
- name: liwt.net
# sub-domains for which to request certificates
sub:
- mail
- www
- git
- dav
- name: aaronly.me
sub:
- www
- name: 233233.xyz
sub:
- www
- d # duckduckgo
- g # google
- w # wikipedia
- zw # zh wikipedia
- name: 1314233.xyz
sub:
- www
dns:
ttl: 1h
refresh: 10800
retry: 1800
expire: 4w
minimum: 1d
nameservers:
- name: afraid
xfr_ip: 69.65.50.192
ns:
- ns2.afraid.org
- name: 1984hosting
xfr_ip: 93.95.224.6
ns:
- ns0.1984.is
- ns1.1984.is
- ns2.1984.is
mail:
domains:
- liwt.net # primary
- aaronly.me
# user database, for both Postfix (receiving mails and transport to
# Dovecot) and Dovecot (auth users and deliver mails to disk)
userdb:
- name: root
aliases:
- postmaster
- hostmaster
- webmaster
- abuse
pass: "{{ vault_mail_userdb_root_pass }}"
- name: aly
pass: "{{ vault_mail_userdb_aly_pass }}"
# for app/device-specific passwords
devices:
- name: laptop
pass: "{{ vault_mail_userdb_aly_pass_laptop }}"
- name: office
pass: "{{ vault_mail_userdb_aly_pass_office }}"
- name: phone
pass: "{{ vault_mail_userdb_aly_pass_phone }}"
- name: tablet
pass: "{{ vault_mail_userdb_aly_pass_tablet }}"
- name: lulu
pass: "{{ vault_mail_userdb_lulu_pass }}"
- name: wt
aliases:
- weitian
pass: "{{ vault_mail_userdb_wt_pass }}"
devices:
- name: laptop
pass: "{{ vault_mail_userdb_wt_pass_laptop }}"
- name: office
pass: "{{ vault_mail_userdb_wt_pass_office }}"
- name: phone
pass: "{{ vault_mail_userdb_wt_pass_phone }}"
- name: tablet
pass: "{{ vault_mail_userdb_wt_pass_tablet }}"
# Virtual user for local mail delivery (e.g., by Dovecot)
vuser:
name: vmail # user & group name
id: 5000 # uid & gid
home: /home/vmail
dkim:
selector: default
bits: 2048
port: 8901
dmarc:
p: none # policy for the domain
sp: none # policy for subdomains of this domain
pct: 100 # percent of messages subjected to filtering
adkim: r # alignment mode for DKIM (r: relaxed; s: strict)
aspf: r # alignment mode for SPF (r: relaxed; s: strict)
fo: 1 # Forensic options
# (0: DKIM & SPF fail; 1: DKIM / SPF fail;
# d: DKIM fail; s: SPF fail)
# Aggregate reports URI email (required)
# Free DMARC weekly digests by https://dmarc.postmarkapp.com/
rua:
liwt.net: re+yis1v8izxn0@dmarc.postmarkapp.com
aaronly.me: re+f6lpmirefcg@dmarc.postmarkapp.com
# Forensic reports URI email (optional)
ruf:
liwt.net: abuse@liwt.net
# To avoid trashing by GMail
google-site-verification:
liwt.net: n-dVRtkDeJ8k4BuSphkV-GVso0zJJWO-Z6GYoz6ayOQ
aaronly.me: rSh99lenrfS-HnzvEahEDYTj9UvoKeX4NdWmDzD-pxo
# ShadowSocks servers
shadowsocks:
# common parameters
method: "chacha20-ietf-poly1305"
timeout: 600
fast_open: false # not supported on dfly
reuse_port: true
no_delay: true
user: "nobody"
#
profiles:
- name: default
port: 8989
password: "{{ vault_shadowsocks_password_default }}"
- name: share
port: 9090
password: "{{ vault_shadowsocks_password_share }}"
vpn:
interface: tun0
network4: 10.6.20.0
port: 8080
znc:
data_dir: /home/znc
# Admin & client user, as well as IRC nickname
username: aly
realname: "{{ vault_znc_realname }}"
password: "{{ vault_znc_password }}"
port: 6697 # SSL/TLS
# Buffer size for each channel/query playback
buffer_size: 5000
# Whether channel buffers are automatically cleared after playback
auto_clear_chan_buffer: "true"
# Quit message when disconnecting or shutting down
quit_msg: "see you"
# IRC networks
networks:
# EFNet: http://www.efnet.org/?module=servers
- name: efnet
server: efnet.port80.se
port: 6667
ssl: false
# Without the beginning '#'
channels:
- dragonflybsd
radicale:
home: /home/radicale
etcdir: /usr/local/etc/radicale2
wwwdir: /usr/local/www/radicale2
# Enable versioning with git
git: true
users:
- name: aly
pass: "{{ vault_radicale_users_aly_pass }}"
devices:
- name: laptop
pass: "{{ vault_radicale_users_aly_pass_laptop }}"
- name: office
pass: "{{ vault_radicale_users_aly_pass_office }}"
- name: phone
pass: "{{ vault_radicale_users_aly_pass_phone }}"
- name: tablet
pass: "{{ vault_radicale_users_aly_pass_tablet }}"
- name: lulu
pass: "{{ vault_radicale_users_lulu_pass }}"
devices:
- name: phone
pass: "{{ vault_radicale_users_lulu_pass_phone }}"
- name: tablet
pass: "{{ vault_radicale_users_lulu_pass_tablet }}"
git:
user:
name: git # user & group name
id: 5001 # uid & gid
home: /home/git
# Sync public repos to GitHub
# NOTE: an unencrypted ssh keypair is required and been added to GitHub
github:
sync: true
user: liweitianux
api: "https://api.github.com"
url: "git@github.com"
keyfile: "{{ playbook_dir }}/private/ssh/github.key"
keytype: ed25519
# Export public repositories
cgit:
# Root of cgit files (config, filters, static, etc.)
root: /home/www/cgit
# Name of the git repo from which to checkout the static resources
static_repo: cgit-static.git
# vim: set ft=yaml sw=2: #
|
