Add SELinux certbot_acmesh bool for Certbot DNS-01

- Configure SELinux to permit nginx network connections

dev/host_vars/podman.yml

@@ -1,6 +1,8 @@
 ##############
 #### base ####
 ##############
+selinux:
+  state: enforcing
 
 base_allow_reboot: false
 base_manage_network: false

playbooks/podman.yml

@@ -0,0 +1,7 @@
+- name: Install Podman server
+  hosts: "{{ PLAYBOOK_HOST | default('none') }}"
+  become: true
+  roles:
+    - base
+    - proxy
+    - podman

roles/base/handlers/main.yml

@@ -7,7 +7,9 @@
 
 - name: Reconfigure locales
   ansible.builtin.command: dpkg-reconfigure -f noninteractive locales
+  changed_when: false
   listen: reconfigure_locales
+  when: not ansible_check_mode
 
 - name: Restart WireGuard
   ansible.builtin.service:

roles/base/tasks/system.yml

@@ -4,6 +4,18 @@
     state: present
     update_cache: true
 
+- name: Get the default policy and basic SELinux utilities
+  ansible.builtin.apt:
+    name: ["selinux-basics", "selinux-policy-default", "auditd"]
+    state: present
+  when: selinux is defined and selinux is not false
+
+- name: Configure SELinux
+  ansible.posix.selinux:
+    state: "{{ selinux.state | default('permissive') }}"
+    policy: "{{ selinux.policy | default('default') }}"
+  when: selinux is defined and selinux is not false
+
 - name: Install GPG
   ansible.builtin.apt:
     name: gpg

roles/base/templates/wireguard.j2

@@ -6,6 +6,17 @@ Address = {{ wireguard.address }}
 {% if wireguard.listenport is defined %}
 ListenPort = {{ wireguard.listenport }}
 {% endif %}
+{%- if wireguard.table is defined %}
+Table = {{ wireguard.table }}
+{% endif -%}
+
+{%- if wireguard.postup is defined %}
+PostUp = {{ wireguard.postup }}
+{% endif -%}
+
+{%- if wireguard.predown is defined %}
+PreDown = {{ wireguard.predown }}
+{% endif %}
 
 {% for peer in wireguard.peers %}
 {% if peer.name is defined %}

roles/podman/tasks/deploy.yml

@@ -65,7 +65,7 @@
 
 - name: Generate OpenSSH deploy keys for docker compose (podman) clones
   community.crypto.openssh_keypair:
-    path: "{{ podman_ssh_key_path }}/podman-id_{{ podman_repos_keytype }}"
+    path: "{{ podman_homedir }}/.ssh/podman-id_{{ podman_repos_keytype }}"
     type: "{{ podman_repos_keytype }}"
     comment: "{{ ansible_hostname }}-{{ podman_user }}-deploy-key"
     owner: "{{ podman_user }}"
@@ -105,7 +105,7 @@
         )
         else false
       }}
-    key_file: "{{ podman_ssh_key_path }}/podman-id_{{ podman_repos_keytype }}"
+    key_file: "{{ podman_homedir }}/.ssh/podman-id_{{ podman_repos_keytype }}"
   become: true
   become_user: "{{ podman_user }}"
   loop: "{{ podman_project }}"

roles/podman/tasks/login.yml

@@ -0,0 +1,20 @@
+- name: "Get UID for {{ podman_user.key }}"
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ podman_user.key }}"
+
+- name: Login to private Podman registry via Docker CLI
+  community.docker.docker_login:
+    registry_url: "{{ registry.key }}"
+    username: "{{ registry.value.username }}"
+    password: "{{ registry.value.password }}"
+    docker_host: "unix:///run/user/{{ podman_uid }}/podman/podman.sock"
+  vars:
+    podman_uid: "{{ ansible_facts.getent_passwd[podman_user.key][1] }}"
+  loop: "{{ podman_user.value | dict2items }}"
+  loop_control:
+    loop_var: registry
+    label: "{{ podman_user.key }} => {{ registry.key }}"
+  become: true
+  become_user: "{{ podman_user.key }}"
+  no_log: true

roles/podman/tasks/main.yml

@@ -105,6 +105,13 @@
     state: present
   when: podman_compose is defined
 
+- name: Login to private Podman registries with Docker CLI for each user
+  ansible.builtin.include_tasks: login.yml
+  loop: "{{ podman_login | dict2items }}"
+  loop_control:
+    loop_var: podman_user
+  when: podman_login is defined
+
 - name: Deploy Podman compose projects for each user
   ansible.builtin.include_tasks: deploy.yml
   vars:

roles/proxy/defaults/main.yml

@@ -1 +1 @@
-cached_dhparams_pem: /vagrant/scratch/dhparams.pem
+proxy_cached_dhparams_pem: /vagrant/scratch/dhparams.pem

roles/proxy/tasks/main.yml

@@ -12,12 +12,12 @@
 
 - name: Check for cached dhparams.pem file
   ansible.builtin.stat:
-    path: "{{ cached_dhparams_pem }}"
+    path: "{{ proxy_cached_dhparams_pem }}"
   register: dhparams_file
 
 - name: Copy cached dhparams.pem to /etc/ssl/
   ansible.builtin.copy:
-    src: "{{ cached_dhparams_pem }}"
+    src: "{{ proxy_cached_dhparams_pem }}"
     dest: /etc/ssl/dhparams.pem
     mode: "600"
     remote_src: true
@@ -41,6 +41,8 @@
     dest: "/etc/nginx/sites-available/{{ item.domain }}.conf"
     mode: "400"
   loop: "{{ proxy.servers }}"
+  loop_control:
+    label: "{{ item.domain }}"
   notify: reload_nginx
   register: nginx_sites
 
@@ -63,14 +65,14 @@
 
 - name: Grab Cloudflare API token for configuration
   ansible.builtin.slurp:
-    src: /root/.cloudflare-api
+    src: /etc/letsencrypt/cloudflare-api.key
   register: cfapi
   when: proxy.production is defined and proxy.production and proxy.dns_cloudflare is defined
 
 - name: Install Cloudflare API token
   ansible.builtin.template:
     src: cloudflare.ini.j2
-    dest: /root/.cloudflare.ini
+    dest: /etc/letsencrypt/cloudflare.ini
     mode: "400"
   diff: false
   when: proxy.production is defined and proxy.production and proxy.dns_cloudflare is defined
@@ -89,22 +91,46 @@
     mode: "0755"
   when: proxy.production is defined and proxy.production
 
+- name: Enable SELinux bool certbot_acmesh to allow sh access for DNS-01
+  ansible.posix.seboolean:
+    name: certbot_acmesh
+    state: true
+    persistent: true
+  when:
+    - selinux is defined
+    - selinux is not false
+    - proxy is defined
+    - proxy.production is defined
+    - proxy.production
+    - proxy.dns_cloudflare is defined
+
 - name: Run Cloudflare DNS-01 challenges on wildcard domains
   ansible.builtin.shell: '/usr/bin/certbot certonly \
     --non-interactive \
     --agree-tos \
     --email "{{ proxy.dns_cloudflare.email }}" \
     --dns-cloudflare \
-    --dns-cloudflare-credentials /root/.cloudflare.ini \
+    --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
     -d "*.{{ item }}" \
     -d "{{ item }}" \
-    {{ proxy.dns_cloudflare.opts | default("") }}'
+    {{ proxy.dns_cloudflare.opts | default("") }}
+    < /dev/null'
   args:
     creates: "/etc/letsencrypt/live/{{ item }}/fullchain.pem"
   loop: "{{ proxy.dns_cloudflare.wildcard_domains }}"
   when: proxy.production is defined and proxy.production and proxy.dns_cloudflare is defined
   notify: reload_nginx
 
+- name: Enable SELinux bool httpd_can_network_connect to give nginx networking
+  ansible.posix.seboolean:
+    name: httpd_can_network_connect
+    state: true
+    persistent: true
+  when:
+    - selinux is defined
+    - selinux is not false
+    - proxy is defined
+
 - name: Add HTTP and HTTPS firewall rule
   community.general.ufw:
     rule: allow

roles/proxy/templates/server-nginx.conf.j2

@@ -1,13 +1,17 @@
 server {
   listen 80;
+{% if proxy.ipv6 is defined and proxy.ipv6 %}
   listen [::]:80;
+{% endif %}
   server_name {{ item.domain }};
   return 301 https://{{ item.domain }}$request_uri;
 }
 
 server {
   listen              443      ssl http2;
+{% if proxy.ipv6 is defined and proxy.ipv6 %}
   listen              [::]:443 ssl http2;
+{% endif %}
   server_name         {{ item.domain }};
   access_log          /var/log/nginx/{{ item.domain }}.log main;
 {% if proxy.production is defined and proxy.production and proxy.dns_cloudflare.wildcard_domains is defined and item.tls.cert is not defined %}