feat(cert-manager): Add Cloudns issuer and DNS-01 challenge support

- Introduced a new Cloudns issuer configuration for cert-manager. - Created separate tasks for DNS-01 and HTTP-01 challenge issuers. - Updated cert-manager tasks to include Cloudns provider and manage secrets. - Refactored existing LetsEncrypt issuer registration to use new task structure. - Added necessary Kubernetes resources for Cloudns integration, including RBAC and certificates. - Updated Terraform configurations to support new DNS records and service changes. - Adjusted deployment strategies for CoreDNS and Open WebUI applications.
2025-06-07 20:39:38 +02:00
parent 3cda0b5624
commit 01bf71f8d2
25 changed files with 590 additions and 17396 deletions
@@ -0,0 +1,130 @@
+hostname: dev-01.lab.alexpires.me
+ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
+
+# Users
+login_users:
+  - username: "{{ ansible_user }}"
+    comment: "Managed by Ansible"
+    sudoer: true
+    sudoer_root_only: true
+    sudoer_no_password: true
+    pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
+    password_disabled: true
+  - username: operator
+    comment: "Managed by Ansible"
+    sudoer: true
+    pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
+
+# SSH Connection and security
+sshd_port: 22
+ssh_allowed_networks:
+  - "10.5.5.5/32" # Wireguard VPN (Laptop)
+  - "10.19.4.0/24" # local network
+sshd_admin_net: "10.19.4.0/24" # local network
+sshd_allow_groups: "{{ ansible_user }} users"
+sshd_permit_root_login: "no"
+sshd_password_authentication: "no"
+sshd_allow_tcp_forwarding: "yes"
+
+# Due to an issue increase the number of max auth tries
+sshd_max_auth_tries: 10
+
+# Firewall ports
+ufw_enable: true
+fw_allowed_ports:
+  - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # SSH Access (VPN device)
+  - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # SSH Access (local network)
+  - { rule: "allow", port: "16443", proto: "tcp", from: "10.5.5.5/32" } # Kubernetes API (Laptop)
+  - { rule: "allow", port: "16443", proto: "tcp", from: "10.19.4.0/24" } # Kubernetes API (local network)
+  - { rule: "allow", port: "139", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network only)
+  - { rule: "allow", port: "445", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network only)
+  - { rule: "allow", port: "443", proto: "tcp", from: "10.5.5.2/32" } # HTTPS (Contabo VPN)
+  - { rule: "allow", port: "53", proto: "udp", from: "10.19.4.0/24" } # DNS (local network)
+  - { rule: "allow", port: "53", proto: "udp", from: "10.5.5.2/32" } # DNS (Contabo VPN)
+
+ufw_outgoing_traffic:
+  - 22 # SSH
+  - 53 # DNS
+  - 80 # HTTP
+  - 123 # NTP
+  - 443 # HTTPS
+  - 853 # DNS over TLS
+  - 10250 # Kubelet
+  - 8880 # Kokoro-FastAPI
+  - 11434 # Ollama
+  - 16443 # Kubernetes API
+  - 4443
+  - 9443
+  - 995 # POP3S
+
+ufw_default_forward_policy: "ACCEPT"
+
+ipv4_sysctl_settings:
+  net.ipv4.ip_forward: 1
+
+disable_ipv6: true
+
+# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
+custom_hosts_acls: true
+
+# fail2ban
+fail2ban_jails:
+  ssh:
+    enabled: true
+    port: "{{ sshd_port }}"
+    filter: "sshd"
+    logpath: "/var/log/auth.log"
+    maxretry: 5
+    findtime: 600
+    bantime: 3600
+
+# aide
+install_aide: false
+
+misc_modules_blocklist:
+  - bluetooth
+  - bnep
+  - btusb
+  - can
+  - cpia2
+  - firewire-core
+  - floppy
+  - ksmbd
+  - n_hdlc
+  - net-pf-31
+  - pcspkr
+  - soundcore
+  - thunderbolt
+  - usb-midi
+  - uvcvideo
+  - v4l2_common
+
+# Unattended upgrades
+unattended_reboot: true
+unattended_reboot_time: "04:30"
+
+# Duo Security
+duo_users: ["*", "!provision"]
+duo_api_hostname: api-7cda1654.duosecurity.com
+
+# Kubernetes specific settings
+microk8s_allowed_hosts:
+  - 10.19.4.0/24
+  - 10.5.5.5
+microk8s_alt_names: "{{ hostname }}"
+
+microk8s_certmgr_letsencrypt_issuer_email: c.alexandre.pires@alexpires.me
+# HTTP-01 Let's encrypt issuer is disable in dev
+microk8s_certmgr_letsencrypt_http01: false
+# DNS-01 issuer is enabled in dev
+microk8s_certmgr_letsencrypt_dns01: true
+microk8s_cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
+microk8s_cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
+
+microk8s_encryption_secret: "{{ lookup('env', 'MICROK8S_ENCRYPTION_SECRET') }}"
+microk8s_users:
+  - username: operator
+    enabled: true
+
+# podman services settings
+persistent_data: "/srv"