From 52dbb3e6e03f226563bcbf6bdc390a17322ac6a5 Mon Sep 17 00:00:00 2001 From: Daniel Berteaud Date: Fri, 19 Feb 2021 15:00:08 +0100 Subject: [PATCH] Update to 2021-02-19 15:00 --- roles/lemonldap_ng/defaults/main.yml | 2 + roles/lemonldap_ng/files/logos/metabase.png | Bin 0 -> 7672 bytes roles/lemonldap_ng/tasks/main.yml | 22 ++++--- roles/lemonldap_ng/templates/lemonldap-ng.ini.j2 | 1 + .../lemonldap_ng/templates/llng-fastcgi-server.j2 | 9 +++ .../templates/llng-fastcgi-server.service.j2 | 13 +---- roles/metabase/defaults/.main.yml.swp | Bin 0 -> 12288 bytes roles/metabase/defaults/main.yml | 65 +++++++++++++++++++++ roles/metabase/handlers/main.yml | 4 ++ roles/metabase/meta/main.yml | 5 ++ roles/metabase/tasks/archive_post.yml | 10 ++++ roles/metabase/tasks/archive_pre.yml | 36 ++++++++++++ roles/metabase/tasks/cleanup.yml | 8 +++ roles/metabase/tasks/conf.yml | 6 ++ roles/metabase/tasks/directories.yml | 23 ++++++++ roles/metabase/tasks/facts.yml | 29 +++++++++ roles/metabase/tasks/install.yml | 46 +++++++++++++++ roles/metabase/tasks/iptables.yml | 8 +++ roles/metabase/tasks/main.yml | 16 +++++ roles/metabase/tasks/services.yml | 5 ++ roles/metabase/tasks/user.yml | 5 ++ roles/metabase/tasks/write_version.yml | 5 ++ roles/metabase/templates/env.j2 | 43 ++++++++++++++ roles/metabase/templates/metabase.service.j2 | 25 ++++++++ roles/squid/files/acl/software_various.domains | 1 + 25 files changed, 368 insertions(+), 19 deletions(-) create mode 100644 roles/lemonldap_ng/files/logos/metabase.png create mode 100644 roles/lemonldap_ng/templates/llng-fastcgi-server.j2 create mode 100644 roles/metabase/defaults/.main.yml.swp create mode 100644 roles/metabase/defaults/main.yml create mode 100644 roles/metabase/handlers/main.yml create mode 100644 roles/metabase/meta/main.yml create mode 100644 roles/metabase/tasks/archive_post.yml create mode 100644 roles/metabase/tasks/archive_pre.yml create mode 100644 roles/metabase/tasks/cleanup.yml create mode 100644 roles/metabase/tasks/conf.yml create mode 100644 roles/metabase/tasks/directories.yml create mode 100644 roles/metabase/tasks/facts.yml create mode 100644 roles/metabase/tasks/install.yml create mode 100644 roles/metabase/tasks/iptables.yml create mode 100644 roles/metabase/tasks/main.yml create mode 100644 roles/metabase/tasks/services.yml create mode 100644 roles/metabase/tasks/user.yml create mode 100644 roles/metabase/tasks/write_version.yml create mode 100644 roles/metabase/templates/env.j2 create mode 100644 roles/metabase/templates/metabase.service.j2 diff --git a/roles/lemonldap_ng/defaults/main.yml b/roles/lemonldap_ng/defaults/main.yml index ea2a90b..e4e8de7 100644 --- a/roles/lemonldap_ng/defaults/main.yml +++ b/roles/lemonldap_ng/defaults/main.yml @@ -62,3 +62,5 @@ llng_handler_db_user: lemonldapnghandler # llng_db_pass: s3cr3t. # llng_handler_db_pass +# Number of llng-fastcgi-server workers. The upstream default is 7 which is often too much +llng_fcgi_workers: 5 diff --git a/roles/lemonldap_ng/files/logos/metabase.png b/roles/lemonldap_ng/files/logos/metabase.png new file mode 100644 index 0000000000000000000000000000000000000000..aa76ff24f0c41b7600b030fce78a6a423f962044 GIT binary patch literal 7672 zcmeHMc|4SB-yc*YTMs&sG)4(!%nW82`)*>)*ve8EvoJD?Ss0Zzl$2I27$ZrGqDYA& zN|Z_>g%a6SluDu~?=@4W^gic3&wD8dENDGz}_ z6mf1&-rzS>{E?FZcc+snw;+(Y_c!?Z^Snv1P&S7}qeoGpyf`)$N)^y)5QyOEW&eQU z-iwM;g9e;g(X->Um}l-Pa;8k}Rvj50Oh39RY#(0n{%kuL#jf;E7q%3Ck`1;=yP4=_ zaX3w>!eMT$pH(0ETK?vC-4~^m&%Vx`-cp}AB)ijKU(%zbk^JVMYq<(pP48N%^8z=AjQR2DJR%(E^dxKbhjdxWBtTi+kmaTHweAsGsN?NkMPfkX> zlEpxpLHHr}!di7@&YorJhGl8qE8qp@WnrhH46K5ChB!g}hHhLSSO=C$k_AMv`hJks;P z!6aVJjsmB_`Kw?cb=DE+H;D$oSly3R_Cjcd@prCS375I<%*9 zREJQ<*s>U(rJ~VtjB%xDL$}3M%wC&IHJR{p!uJY;+L?j0b;`D(Lq){_XwhwCP^?;O zbxSU50+#<<1JyqJGzGAts*2HdF>_?~=Ep7wwH^ zyYZ8gn)~s`Yix|q>a@%r*t3HXfHGgLarJ5XP9L4OR;xa^-+8Ff*LcJ~XZa!>`5H(k zIxbNzdgb*auiR1-2xcx0XS&}}RWwi*JudsTb#Sp4Mw*vA-jrZJtCOQ!F~2gINy9zA zzl3@{PUXPhi6;g22ea?rBn)o#xTJT{OQ+E}KgPl^zpk0^`XSB0tcPb%*S)LO<+4Kc z6AhvMv3jo!!LDw8mrFnFan9o*6xztNl;(rO73lPKc>2NAFv}owJ>=puu2&(a<}rNT zMr+vvuJ^7%M2btvd{vJzSo#3f=Zsp1ftP~-PW})PZtKali^5RU6Cy_+`JFy;?MBJ= zQu%f1QwY!Q9rc-40~>T@b{nh=MqG%Q$MHN-m##cC)wh^>l~V{mU10H>RYzjFwgTyk=O=A=a%}Yo`+y>hqwZ|7lX1 zG;6wI!8-XZhaaEc`ToOZmCKoLH@}OI{&KJ=))MC)8(E4l+=a=kn&arubai`o1w}#N zbfPxc@yQCF%ty}M;6*x1HO_gb1ea|q_)I%@D#|Y~amXNGo#FM%S-2MqObZ{Ttk^zj zX>-M4vMs+h1=`8DGD9w-f2m@!=*Lsir;^KNQbNXqB5rdRWQ zubKb3(=D<`&mDy{v@1-w$4^=NoczWz3U_nCt|(uM!LjI3Wnsf{*%sd&ZPJDpS37=9 z(JapGtkG0tz+M@a6>sG2UZxv=+1)Uq{#abhCd!=>!_8a6n-vn@IPe<|H=;xtd-GmK zCl}_=EC1Kck-PbYJJlYJlp9+9j(UH>TlfQ9G-5kVC6>o9i5PA#l3A-y>oUxd+4=hor9vUtgx%4L|!> zCsXGceeH)V_0~#xtK3bG?YzARTJ1H8UliY49sca&&1VTRvimUslgKY0XxObJ4u9IWMjd+T?qHZRZPQc#|*EoW-OO`W2*SzRq3Ik7dO%-cGS>{$_=x!m-4iN z1L`{G?K&5!#qc}%sw-61H%cGZd?{jTUYU_)Em8Rv+Igl}-Q+7u5 zQ)4|}nT*suZLIJM(2iZFHhWyD4w&A5{(9wO^f)ha@A%Yb`8@~ND-5oc_)BL6EZ|(( zSHq+bl8X}Z8X_Ve=(V-Ft4!+DnPps%{u1-7f1A`^wqlTj?7gFYrU?^L!REgo+u;1+ ztIXrA6KEG6J`rtxq6;1cwOJ;Ji##p8AoT^S-~L_Qi;L5W{WMF+Sm74|1R|A4cXTA; z93B67u>-Gj!uSK$Za3|;YD0YTU`9%>p*{O^UWMhHNzPrJBd6|A(3qcaCoiP&qz*1R zT5at-rOhi>FJ3F;^V#aNZYZl@Fw32PGkCWJm*ae1_VyP+>`3&ul8UDKsQ~L}yJm(- zmPhiFXZZ^SNm~&P3mw~VdH5=MP7!Z@} zldbK6ALJIc&4CxTXB5k>eFI4#?1;Ks*mv4MP5%0%M!b)b+;izK>w{SZ@j@Gj#w$a< zjFy&kuJhgCk@s&Z8#=#QH@_N@&8Xs(mTFtlArR%=bnv3>kN3cmSqwOd!V06p1q?QL z5r;smYz1r*c|DZ}4WowBnbxq8->YCyI>j2c#te_ZvmL1sbhiy0s?P>bU-E|aWD5$+ z)<)h+fCU5$DvtyeFrt`TtiT#3;l+ZnSZoY~N+7)T)-ZoO5$ed|P@$%9Q#iuNSwN3L z!EEHARvZcq>+R(7odV3PVG%qY8*6MF8ygFcHG#7@;l@Y{3kzce${2+*0th2+9Fs>9 z7%{oJVv27ZPE;z8$*nCcu1VbSkQ=_O1;0PBmBY(m3=(L{&`XwIm%D*`R%>Cg11^q|9B)&-U zigjX<`C_9uCu^A4Uo3@1rcy_&_?Da76>C#Gb9>~!Jte?Xz~mS z0*4NE0x4>yS7Is(ph8p8B&4Yc%E%mP2B;_&G$V^J62{1cOe0f)$buARE};_F0c%gh zS;J6p#7_w^io~O_I1Fo;2c5|m{9N#*GpIg1k~nEdG|~iP3K|h*iZDT&pnrl^Q#oAF zXZ5XJ-GDBO6F0-Y4>kJR z?Aw79MVF)s3Y8oJSQ7bL`njYSDn(KPkjHOJ|1%ER>tB3^^fqZ#77PukDZwSEAf$p#fdx5htFn5(W#tY6Z1!- z{13Pp`rn)KKdH}zebaVivE#s|jo=YtnSW{iPk`STJm_R9lgs)m*Jnb$rDeu*2l)I= z2A*f&@o4?S-RwZe#53R!HZrj`2MWPX6r&A(hG(M1q-c^&U1WOw`Jw|ZywLLk$tGP>O| z+VR3}Vosk|4j}CIOYiqc?+;0@_sr?TXZ3o5OV}5b{oGU7_9x*Jdo0tV+93hJO2${Xa?C&H5Q4ax(#p=C; z%pRg>07!^Jzz+c5u3isOucz1|panc)u*4z&OH2TmL;_3zpT#_qyO$8e^&E`-QURb( ztRf)+L5ZUS{)lONJVA64>k{T3@9ciyo|s4C6;J``1+frC-5z=Uo+6;t1+oefg$Ff~ z5c(V+BnUxb2Z%yoNF1p+1h53AqINMAh*w-t$tBVC%jqYALV&^nd3v{43%~{+eFcA= zk>YuK`atXk+Q5HAAyQ%Pu1=8T*^Ax4WG>q+fD3`lQx$)tAQ{4iKq$+@;hkmsrBxO6 zrRSEn`T`5DhAu-dAHhBRBDO?qp&{p(a)^tD~?2nB(vLh$5Hw@PVBME#vb60|94K}@c93K@%R5XKVj@2z}LW^fKLDcTmeo2 z?>@)aYrrGm5cmaf2Kd{vjC~G#27Cy-2PohOxC!h4CxO5In6WWl2=sv$fD-@%zW5PiuLI|SbHLAlPk+eR+kgeG z0}r1@d`~g6@C?xc-`oj!hTvzU#^`7N9J6`>PZUR~SW z*{boEXsVS$ho!lR2!~=eN-GK%`8^&lFmz*wELM)?F($@Z__AKReY;g_)|%wF(d0Fg zZoNYBCQaHWi=QHIH29-O8*G^vx-#V9_7Gwl@cJ20lLuVd|GOd7&G3%&-HsMXvPCW$ z#fWfnZ0vL^#!Vy>HR`cdAvnv>*_NN-n6M~=8H&aPV@cU?L)pz1(HbTR5VW5V(&N|YUO*V zj{%=J7Z2KP$d8H;gM);4MM|It0~qF2NM(evHvIouY0X2Vj%#&S>M4&TWZM}&l*r

~8s^8Ty?~_QZbf%1Og-D)JXZlDHDN%Qa8%Tx6_!$y}NRXhD{-z zi>}=p(ORMp6~ir_NG9YalKeh}jxc>33Q=ayssy}AFv#6RBGFFpKw0QC*u<8X=R0xi zMDZYE2Q&EyK)S-Cif2B8!pZJ0OF<@~i@n4N>zszPWSK69lGz_CJDGJRJ4Grlyy5|?=GTS}xb8UQ~sX(y*jl8rnq7xYfs572bd$L$PvL^J37RV)UGXh<) zo?fD--cmQByx{l>*32Abu4gWhiU`FsotMF44-teaDmEb{N~S2l&?}9@G4;h|>OyWt zS)wxYa!~|BZc9c-^*TRa8ZL`)I89#F-fX1wRiZXeTrT6M`N8zYul9L>YNcm*x!kPpsd&JD`#UhU zuh8TmZ10exop$ziuXCYENwaoeZcLBPw>VjT+D@knKZhh9CgS%es?^FeJ~j4`QRxKM z80Ue(0dJew&2LbX8v#vAqd?lVp3s*nLZ@gggT+Bs$j;?!(Zle21je}VeUqZd9`E0# z&C>SnuH;{1k zB1LLY1c9&1P)aiRCK{=6V_ttVr==M02 0) | ternary('present','absent') }}" + rules: "-A INPUT -m state --state NEW -p tcp --dport {{ metabase_port }} -s {{ metabase_src_ip | join(',') }} -j ACCEPT" + tags: firewall,metabase diff --git a/roles/metabase/tasks/main.yml b/roles/metabase/tasks/main.yml new file mode 100644 index 0000000..a6c6732 --- /dev/null +++ b/roles/metabase/tasks/main.yml @@ -0,0 +1,16 @@ +--- + +- include: user.yml +- include: directories.yml +- include: facts.yml +- include: archive_pre.yml + when: metabase_install_mode == 'upgrade' +- include: install.yml +- include: conf.yml +- include: iptables.yml + when: iptables_manage | default(True) +- include: services.yml +- include: write_version.yml +- include: archive_post.yml + when: metabase_install_mode == 'upgrade' +- include: cleanup.yml diff --git a/roles/metabase/tasks/services.yml b/roles/metabase/tasks/services.yml new file mode 100644 index 0000000..bbcc30b --- /dev/null +++ b/roles/metabase/tasks/services.yml @@ -0,0 +1,5 @@ +--- + +- name: Start and enable the service + service: name=metabase state=started enabled=True + tags: metabase diff --git a/roles/metabase/tasks/user.yml b/roles/metabase/tasks/user.yml new file mode 100644 index 0000000..c19344d --- /dev/null +++ b/roles/metabase/tasks/user.yml @@ -0,0 +1,5 @@ +--- + +- name: Create metabase user account + user: name={{ metabase_user }} home={{ metabase_root_dir }} system=True + tags: metabase diff --git a/roles/metabase/tasks/write_version.yml b/roles/metabase/tasks/write_version.yml new file mode 100644 index 0000000..44f1aa6 --- /dev/null +++ b/roles/metabase/tasks/write_version.yml @@ -0,0 +1,5 @@ +--- + +- name: Write installed version + copy: content={{ metabase_version }} dest={{ metabase_root_dir }}/meta/ansible_version + tags: metabase diff --git a/roles/metabase/templates/env.j2 b/roles/metabase/templates/env.j2 new file mode 100644 index 0000000..28f6d7d --- /dev/null +++ b/roles/metabase/templates/env.j2 @@ -0,0 +1,43 @@ +MB_ADMIN_EMAIL={{ metabase_admin_email }} +MB_EMAIL_FROM_ADDRESS={{ metabase_from_email }} +MB_EMAIL_SMTP_HOST={{metabase_smtp_server }} +MB_EMAIL_SMTP_PORT={{ metabase_smtp_port }} +{% if metabase_smtp_user is defined and metabase_smtp_pass is defined %} +MB_EMAIL_SMTP_USERNAME={{ metabase_smtp_user }} +MB_EMAIL_SMTP_PASSWORD={{ metabase_smtp_pass }} +{% endif %} +MB_EMAIL_SMTP_SECURITY={{ metabase_smtp_starttls | ternary('starttls','none') }} +MB_ANON_TRACKING_ENABLED=false +MB_DB_FILE={{ metabase_root_dir }}/data/metabase.db +MB_DB_DBNAME={{ metabase_db_name }} +MB_DB_HOST={{ metabase_db_server }} +MB_DB_USER={{ metabase_db_user }} +MB_DB_PASS={{ metabase_db_pass | quote }} +MB_DB_PORT={{ metabase_db_port }} +MB_DB_TYPE=mysql +MB_ENABLE_QUERY_CACHING=true +MB_ENABLE_PUBLIC_SHARING=true +MB_ENABLE_EMBEDDING=true +MB_ENCRYPTION_SECRET_KEY={{ metabase_encryption_key | quote }} +MB_JETTY_HOST=0.0.0.0 +MB_JETTY_PORT={{ metabase_port }} +MB_PLUGINS_DIR={{ metabase_root_dir }}/plugins +MB_SITE_LOCALE={{ metabase_lang }} +MB_SITE_URL={{ metabase_public_url }} +{% if metabase_ldap %} +MB_LDAP_ENABLED=true +MB_LDAP_HOST={{ metabase_ldap_server }} +MB_LDAP_PORT={{ metabase_ldap_port }} +MB_LDAP_SECURITY=tls +{% if metabase_ldap_user is defined and metabase_ldap_pass is defined %} +MB_LDAP_BIND_DN={{ metabase_ldap_user | quote }} +MB_LDAP_PASSWORD={{ metabase_ldap_pass | quote }} +{% endif %} +MB_LDAP_ATTRIBUTE_EMAIL={{ metabase_ldap_attr_email }} +MB_LDAP_ATTRIBUTE_FIRSTNAME={{ metabase_ldap_attr_firstname }} +MB_LDAP_ATTRIBUTE_LASTNAME={{ metabase_ldap_attr_lastname }} +MB_LDAP_USER_BASE={{ metabase_ldap_user_base }} +MB_LDAP_USER_FILTER={{ metabase_ldap_user_filter | quote }} +MB_LDAP_GROUP_SYNC=true +MB_LDAP_GROUP_BASE={{ metabase_ldap_group_base }} +{% endif %} diff --git a/roles/metabase/templates/metabase.service.j2 b/roles/metabase/templates/metabase.service.j2 new file mode 100644 index 0000000..f78f310 --- /dev/null +++ b/roles/metabase/templates/metabase.service.j2 @@ -0,0 +1,25 @@ +[Unit] +Description=Metabase opensource BI +After=syslog.target network.target + +[Service] +Type=simple +User={{ metabase_user }} +WorkingDirectory={{ metabase_root_dir }}/app +EnvironmentFile={{ metabase_root_dir }}/etc/env +ExecStart=/usr/bin/java -Djava.net.preferIPv4Stack=true \ +{% if system_proxy is defined and system_proxy != '' %} + -Dhttp.proxyHost={{ system_proxy | urlsplit('hostname') }} -Dhttp.proxyPort={{ system_proxy | urlsplit('port') }} \ + -Dhttps.proxyHost={{ system_proxy | urlsplit('hostname') }} -Dhttps.proxyPort={{ system_proxy | urlsplit('port') }} \ +{% endif %} + -jar {{ metabase_root_dir }}/app/metabase.jar +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=full +ProtectHome=yes +NoNewPrivileges=yes +Restart=on-failure + +[Install] +WantedBy=multi-user.target + diff --git a/roles/squid/files/acl/software_various.domains b/roles/squid/files/acl/software_various.domains index 74a73f3..31e25a7 100644 --- a/roles/squid/files/acl/software_various.domains +++ b/roles/squid/files/acl/software_various.domains @@ -347,3 +347,4 @@ store.itophub.io # Crowdsec crowdsec-statics-assets.s3-eu-west-1.amazonaws.com api.crowdsec.com +www.cloudflare.com