initial commit

merge.sh

@@ -0,0 +1,4 @@
+git checkout master
+git merge dev
+git push
+git checkout dev

pillars/roles/aurpkgs/calendar.sls

@@ -0,0 +1,2 @@
+aurpkgs:
+  baikal: []

pillars/roles/aurpkgs/git.sls

@@ -0,0 +1,3 @@
+aurpkgs:
+  glide-git: []
+  gogs: []

pillars/roles/aurpkgs/headphones.sls

@@ -0,0 +1,2 @@
+aurpkgs:
+  headphones: []

pillars/roles/aurpkgs/init.sls

@@ -0,0 +1,21 @@
+{% set states = salt['cp.list_states'](saltenv) %}
+include:
+  - roles.aurpkgs.none
+{%- if grains['roles'] is defined -%}
+  {%- if grains['roles'] is not none -%}
+    {%- if 'aurrepo' in grains['roles'] -%}
+      {%- for state in states %}
+        {%- if state.startswith("pillars.roles.aurpkgs.") -%}
+          {%- set role = state.split('.')[3] %}
+  - roles.aurpkgs.{{ role }}
+        {%- endif -%}
+      {%- endfor -%}
+    {%- else -%}
+      {%- for role in grains['roles'] %}
+        {%- if 'pillars.roles.aurpkgs.'+role in states %}
+  - roles.aurpkgs.{{ role }}
+        {%- endif -%}
+      {%- endfor -%}
+    {%- endif -%}
+  {%- endif -%}
+{%- endif -%}

pillars/roles/aurpkgs/jackett.sls

@@ -0,0 +1,2 @@
+aurpkgs:
+  jackett: []

pillars/roles/aurpkgs/lam.sls

@@ -0,0 +1,6 @@
+aurpkgs:
+  ldap-account-manager: []
+#  building php56 doesn't seem to work
+#  php56: []
+#  php56-fpm: []
+#  php56-ldap: []

pillars/roles/aurpkgs/none.sls

@@ -0,0 +1,2 @@
+aurpkgs:
+  wtf:[]

pillars/roles/aurpkgs/ombi.sls

@@ -0,0 +1,2 @@
+aurpkgs:
+  ombi: []

pillars/roles/aurpkgs/plexmediaserver.sls

@@ -0,0 +1,2 @@
+aurpkgs:
+  plex-media-server-plexpass: []

pillars/roles/aurpkgs/portal.sls

@@ -0,0 +1,2 @@
+aurpkgs:
+  byobu: []

pillars/roles/aurpkgs/radarr.sls

@@ -0,0 +1,2 @@
+aurpkgs:
+  radarr: []

pillars/roles/aurpkgs/sonarr.sls

@@ -0,0 +1,2 @@
+aurpkgs:
+  sonarr: []

pillars/roles/firewalld/certbot.sls

@@ -0,0 +1,5 @@
+firewalld:
+  70_internal:
+    service:
+      - http
+      - https

pillars/roles/firewalld/core.sls

@@ -0,0 +1,17 @@
+firewalld:
+  60_guest:
+    description: Guest zone. Only connections from the guest network are accepted.
+    include:
+      - 99_public
+    source:
+      - 192.168.42.0/24
+  70_internal:
+    description: Internal zone. Only connections from internal network are accepted.
+    include:
+      - 99_public
+    source:
+      - 172.16.0.0/16
+  99_public:
+    description: Public zone. Only selected connections are accepted from anywhere.
+    source:
+      - 0.0.0.0/0

pillars/roles/firewalld/deluge.sls

@@ -0,0 +1,12 @@
+firewalld:
+  70_internal:
+    service:
+      - http
+    port:
+      - 58846/tcp
+      - 8112/tcp
+  99_public:
+    port:
+      - 63150/tcp
+      - 63150/udp
+

pillars/roles/firewalld/git.sls

@@ -0,0 +1,7 @@
+firewalld:
+  70_internal:
+    port:
+      - 3000/tcp
+  99_public:
+    port:
+      - 5022/tcp

pillars/roles/firewalld/gitlab.sls

@@ -0,0 +1,7 @@
+firewalld:
+  70_internal:
+    port:
+      - 3000/tcp
+  99_public:
+    port:
+      - 5022/tcp

pillars/roles/firewalld/init.sls

@@ -0,0 +1,13 @@
+{% set states = salt['cp.list_states'](saltenv) %}
+include:
+  - roles.firewalld.core
+
+{%- if grains['roles'] is defined -%}
+  {%- if grains['roles'] is not none -%}
+    {%- for role in grains['roles'] %}
+      {%- if 'pillars.roles.firewalld.'+role in states %}
+  - roles.firewalld.{{ role }}
+      {%- endif -%}
+    {%- endfor -%}
+  {%- endif -%}
+{%- endif -%}

pillars/roles/firewalld/nginx-proxy.sls

@@ -0,0 +1,8 @@
+firewalld:
+  70_internal:
+    service:
+      - http
+      - https
+  50_server:
+    port:
+      - 8080/tcp

pillars/roles/firewalld/pepper.sls

@@ -0,0 +1,4 @@
+firewalld:
+  70_internal:
+    port:
+      - 80/tcp

pillars/roles/firewalld/plexmediaserver.sls

@@ -0,0 +1,4 @@
+firewalld:
+  99_public:
+    port:
+      - 32400/tcp

pillars/roles/firewalld/portal.sls

@@ -0,0 +1,5 @@
+firewalld:
+  99_public:
+    service:
+      - http
+      - https

pillars/roles/firewalld/saltmaster.sls

@@ -0,0 +1,14 @@
+firewalld:
+  70_internal:
+    port:
+      - 4505/tcp
+      - 4506/tcp
+#    rule:
+#      salt port 1:
+#        source: 192.168.41.29
+#        port: 4505/tcp
+#        action: accept
+#      salt port 2:
+#        source: 192.168.41.29
+#        port: 4506/tcp
+#        action: accept

pillars/roles/firewalld/saltminion.sls

@@ -0,0 +1,11 @@
+firewalld:
+  70_internal:
+    rule:
+      salt port 1:
+        source: 192.168.41.29
+        port: 4505/tcp
+        action: accept
+      salt port 2:
+        source: 192.168.41.29
+        port: 4506/tcp
+        action: accept

pillars/roles/firewalld/server.sls

@@ -0,0 +1,15 @@
+firewalld:
+  10_enduser:
+    description: End User zone. Only connections form end users are accepted.
+    include:
+      - 99_public
+      - 70_internal
+    source:
+      - 172.16.40.0/24
+  50_server:
+    description: Server zone. Only connections from servers are accepted.
+    include:
+      - 99_public
+      - 70_internal
+    source:
+      - 172.16.41.0/24

pillars/roles/firewalld/ssh.sls

@@ -0,0 +1,4 @@
+firewalld:
+  70_internal:
+    service:
+      - ssh

pillars/roles/git/init.sls

@@ -0,0 +1,13 @@
+{% set states = salt['cp.list_states'](saltenv) %}
+include:
+  - roles.git.none
+
+{%- if grains['roles'] is defined -%}
+  {%- if grains['roles'] is not none -%}
+    {%- for role in grains['roles'] %}
+      {%- if 'pillars.roles.git.'+role in states %}
+  - roles.git.{{ role }}
+      {%- endif -%}
+    {%- endfor -%}
+  {%- endif -%}
+{%- endif -%}

pillars/roles/git/portal.sls

@@ -0,0 +1,9 @@
+git:
+  tmux:
+    repo: "ssh://gogs@git.actcur.com:5022/actcur/tmux.git"
+    path: "/root/tmux"
+    branch: "master"
+    key: "git_actcur"
+    force: true
+    email: "actcur@actcur.com"
+    name: "Actaeus Curabitur"

pillars/roles/git/saltmaster.sls

@@ -0,0 +1,17 @@
+git:
+  salt:
+    repo: "ssh://gogs@git.actcur.com:5022/actcur/salt.git"
+    path: "/srv/salt/prod"
+    branch: "master"
+    key: "git_actcur"
+    force: true
+    email: "actcur@actcur.com"
+    name: "Actaeus Curabitur"
+  salt_dev:
+    repo: "ssh://gogs@git.actcur.com:5022/actcur/salt.git"
+    path: "/srv/salt/dev"
+    branch: "dev"
+    key: "git_actcur"
+    force: true
+    email: "actcur@actcur.com"
+    name: "Actaeus Curabitur"

pillars/roles/init.sls

@@ -0,0 +1,7 @@
+include:
+  - roles.maintainer
+  - roles.firewalld
+  - roles.nginx
+  - roles.aurpkgs
+  - roles.mount
+  - roles.git

pillars/roles/maintainer/deluge.sls

@@ -0,0 +1,4 @@
+roles:
+  pepper:
+    maintainer:
+      - masaufuku

pillars/roles/maintainer/init.sls

@@ -0,0 +1,7 @@
+include:
+  - roles.maintainer.saltmaster
+  - roles.maintainer.ssh
+  - roles.maintainer.server
+  - roles.maintainer.saltminion
+  - roles.maintainer.pepper
+  - roles.maintainer.deluge

pillars/roles/maintainer/pepper.sls

@@ -0,0 +1,4 @@
+roles:
+  pepper:
+    maintainer:
+      - masaufuku

pillars/roles/maintainer/saltmaster.sls

@@ -0,0 +1,4 @@
+roles:
+  saltmaster:
+    maintainer:
+      - masaufuku

pillars/roles/maintainer/saltminion.sls

@@ -0,0 +1,4 @@
+roles:
+  saltminion:
+    maintainer:
+      - masaufuku

pillars/roles/maintainer/server.sls

@@ -0,0 +1,5 @@
+roles:
+  server:
+    maintainer:
+      - masaufuku
+

pillars/roles/maintainer/ssh.sls

@@ -0,0 +1,5 @@
+roles:
+  ssh:
+    maintainer:
+      - masaufuku
+

pillars/roles/mount/gitlab.sls

@@ -0,0 +1,6 @@
+mount:
+  sshfs:
+    /var/lib/gitlab:
+      host: host.actcur.com
+      directory: /mnt/butter/git
+      user: git

pillars/roles/mount/init.sls

@@ -0,0 +1,13 @@
+{% set states = salt['cp.list_states'](saltenv) %}
+include:
+  - roles.mount.none
+
+{%- if grains['roles'] is defined -%}
+  {%- if grains['roles'] is not none -%}
+    {%- for role in grains['roles'] %}
+      {%- if 'pillars.roles.mount.'+role in states %}
+  - roles.mount.{{ role }}
+      {%- endif -%}
+    {%- endfor -%}
+  {%- endif -%}
+{%- endif -%}

pillars/roles/mount/pkg-cache.sls

@@ -0,0 +1,6 @@
+mount:
+  sshfs:
+    /mnt/pkgs:
+      host: host.actcur.com
+      directory: /mnt/butter/pkgs
+      user: pkgs

pillars/roles/mount/plexmediaserver.sls

@@ -0,0 +1,14 @@
+mount:
+  sshfs:
+    /mnt/video:
+      host: host.actcur.com
+      directory: /mnt/butter/video
+      user: mount
+    /mnt/music:
+      host: host.actcur.com
+      directory: /mnt/butter/music
+      user: mount
+  ext4:
+    /var/lib/plexmediaserver/Library:
+      device: UUID=0ab3f7fc-6525-40ba-905c-ff5fff2de1a3
+

pillars/roles/mount/saltmaster.sls

@@ -0,0 +1,6 @@
+mount:
+  sshfs:
+    /mnt:
+      host: host.actcur.com
+      directory: /mnt/butter/salt
+      user: mount

pillars/roles/nginx/authtypes.txt

@@ -0,0 +1,4 @@
+blocked: can't access
+none: public access
+simple: file-based auth
+ldap: directory based auth - not implemented

pillars/roles/nginx/baikal.sls

@@ -0,0 +1,12 @@
+nginx:
+  cal:
+    auth: none
+    https:
+      port: 8080
+      prot: http
+    default: no
+  baikal:
+    auth: none
+    https:
+      port: 8080
+      prot: http

pillars/roles/nginx/calandar.sls

@@ -0,0 +1,11 @@
+nginx:
+  cal:
+    auth: none
+    https:
+      port: 8081
+      prot: http
+  baikal:
+    auth: none
+    https:
+      port: 8081
+      prot: http

pillars/roles/nginx/git.sls

@@ -0,0 +1,6 @@
+nginx:
+  git:
+    auth: none
+    https:
+      port: 3000
+      prot: http

pillars/roles/nginx/gitlab.sls

@@ -0,0 +1,6 @@
+nginx:
+  git:
+    auth: none
+    https:
+      port: 3000
+      prot: http

pillars/roles/nginx/headphones.sls

@@ -0,0 +1,6 @@
+nginx:
+  headphones:
+    auth: blocked
+    https:
+      port: 8181
+      prot: http

pillars/roles/nginx/init.sls

@@ -0,0 +1,21 @@
+{% set states = salt['cp.list_states'](saltenv) %}
+include:
+  - roles.nginx.none
+{%- if grains['roles'] is defined -%}
+  {%- if grains['roles'] is not none -%}
+    {%- if 'portal' in grains['roles'] -%}
+      {%- for state in states %}
+        {%- if state.startswith("pillars.roles.nginx.") -%}
+          {%- set role = state.split('.')[3] %}
+  - roles.nginx.{{ role }}
+        {%- endif -%}
+      {%- endfor -%}
+    {%- else -%}
+      {%- for role in grains['roles'] %}
+        {%- if 'pillars.roles.nginx.'+role in states %}
+  - roles.nginx.{{ role }}
+        {%- endif -%}
+      {%- endfor -%}
+    {%- endif -%}
+  {%- endif -%}
+{%- endif -%}

pillars/roles/nginx/jackett.sls

@@ -0,0 +1,6 @@
+nginx:
+  jackett:
+    auth: blocked
+    https:
+      port: 9117
+      prot: http

pillars/roles/nginx/lam.sls

@@ -0,0 +1,6 @@
+nginx:
+  lam:
+    auth: none
+    https:
+      port: 8000
+      prot: http

pillars/roles/nginx/lamp.sls

@@ -0,0 +1,6 @@
+nginx:
+  lamp:
+    auth: none
+    https:
+      port: 8000
+      prot: http

pillars/roles/nginx/ldapui.sls

@@ -0,0 +1,6 @@
+nginx:
+  ldapui:
+    auth: simple
+    https:
+      port: 8000
+      prot: http

pillars/roles/nginx/ombi.sls

@@ -0,0 +1,6 @@
+nginx:
+  ombi:
+    auth: none
+    https:
+      port: 3579
+      prot: http

pillars/roles/nginx/pkg-cache.sls

@@ -0,0 +1,9 @@
+nginx:
+  pkg:
+    auth: blocked
+    https:
+      port: 8000
+      prot: http
+    http:
+      port: 8000
+      prot: http

pillars/roles/nginx/plexmediaserver.sls

@@ -0,0 +1,6 @@
+nginx:
+  plex:
+    auth: none
+    https:
+      port: 32400
+      prot: http

pillars/roles/nginx/radarr.sls

@@ -0,0 +1,6 @@
+nginx:
+  radarr:
+    auth: blocked
+    https:
+      port: 7878
+      prot: http

pillars/roles/nginx/sonarr.sls

@@ -0,0 +1,6 @@
+nginx:
+  sonarr:
+    auth: blocked
+    https:
+      port: 8989
+      prot: http

pillars/roles/nginx/sync.sls

@@ -0,0 +1,6 @@
+nginx:
+  sync:
+    auth: blocked
+    https:
+      port: 8080
+      prot: http

pillars/roles/nginx/ttrss.sls

@@ -0,0 +1,6 @@
+nginx:
+  tt:
+    auth: none
+    https:
+      port: 8080
+      prot: http

pillars/servers/env/init.sls

@@ -0,0 +1,2 @@
+include:
+  - servers.env.server.{{ grains['host'] }}

pillars/servers/env/server/.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archbaikal.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archcal.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archcouch.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archdeluge.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archgit.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archheadphones.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archjackett.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archlam.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archldap.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archldaptest.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archldapui.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archmail.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archombi.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archpkg.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archplex.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archportal.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archradarr.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archrequest.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archsalt.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archsonarr.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archssh.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archsync.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/archtt.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/base

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/centlamp.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/env/server/pisalt.sls

@@ -0,0 +1 @@
+env: prod

pillars/servers/init.sls

@@ -0,0 +1,4 @@
+include:
+  - servers.maintainer
+  - servers.env
+  - servers.roles

pillars/servers/maintainer/init.sls

@@ -0,0 +1,2 @@
+include:
+  - servers.maintainer.server.{{ grains['host'] }}

pillars/servers/maintainer/server/.sls

@@ -0,0 +1,3 @@
+maintainer:
+  - masaufuku
+

pillars/servers/maintainer/server/archbaikal.sls

@@ -0,0 +1,3 @@
+maintainer:
+  - masaufuku
+

pillars/servers/maintainer/server/archcal.sls

@@ -0,0 +1,3 @@
+maintainer:
+  - masaufuku
+

pillars/servers/maintainer/server/archcouch.sls

@@ -0,0 +1,3 @@
+maintainer:
+  - masaufuku
+

pillars/servers/maintainer/server/archdeluge.sls

@@ -0,0 +1,3 @@
+maintainer:
+  - masaufuku
+

pillars/servers/maintainer/server/archgit.sls

@@ -0,0 +1,3 @@
+maintainer:
+  - masaufuku
+