.. _rolereference:

Role Reference
==============


Common parameters
-----------------

A number of common parameters are used by all of the roles during
deployment. This section lists such parameters.

**tls_private_key_dir** (string, optional if paths to private keys for all roles are explicitly specified)
  Path to directory on Ansible host that contains the private keys used by
  services deployed by various roles. When TLS key path is not explicitly
  defined in a role, this is the directory where the TLS key will be looked-up
  during Ansible run. Expected filename pattern is ``FQDN_SERVICE.key`` (for
  example, ``mail.example.com_smtp.key`` or ``xmpp.example.com_xmpp.key``).

**tls_certificate_dir** (string, optional if paths to certificate files for all roles are explicitly specified)
  Path to directory on Ansible host that contains the X.509 certificate files
  used by services deployed by various roles. When X.509 certificate path is not
  explicitly defined in a role, this is the directory where the X.509
  certificate will be looked-up during Ansible run. Expected filename pattern is
  ``FQDN_SERVICE.pem`` (for example, ``mail.example.com_smtp.pem`` or
  ``xmpp.example.com_xmpp.pem``).


Preseed
-------

The ``preseed`` role can be used for generating simple preseed files for Debian
Wheezy installations.

The generated preseed files allow simplified installation, with a single root
partition. There is a number of parameters that allow for customising the
content of preseed files.

It is possible to specify parameter values that should be used for all servers,
as well for individual servers. It is also possible to combine this approach,
defining global parameters that get overridden per server.

The role will by default process all hosts from the inventory, generating one
preseed file per server.


Parameters
~~~~~~~~~~

**ansible_key** (string, optional, ``{{ lookup('file', '~/.ssh/id_rsa.pub') }}``)
  SSH public key that should be deployed to authorized_keys truststore for
  operating system user ``root``. This is necessary for the bootstrap process
  to work since Debian Jessie does not allow password-based logins for root.

**preseed_country** (string, optional, ``SE``)
  Country.

**preseed_directory** (string, optional, ``../preseed_files/``)
  Destination directory where the preseed files should be stored.

  .. warning::
     Do not name this directory ``preseed`` if it lies on a path where Ansible
     would normally look-up the roles (it will conflict with the role name).

**preseed_dns** (string, mandatory if **preseed_network_auto** is ``no``)
  Comma-separated list of DNS servers.

**preseed_domain** (string, mandatory if **preseed_network_auto** is ``no``)
  Server domain.

**preseed_gateway** (string, mandatory if **preseed_network_auto** is ``no``)
  Default gateway for the server.

**preseed_hostname** (string, mandatory if **preseed_network_auto** is ``no``)
  Server hostname.

**preseed_ip** (string, mandatory if **preseed_network_auto** is ``no``)
  IP address for the server network interface.

**preseed_keymap** (string, optional, ``us``)
  Keymap.

**preseed_language** (string, optional, ``en``)
  Language.

**preseed_locale** (string, optional, ``en_US.UTF-8``)
  Locale.

**preseed_mirror_directory** (string, optional, ``/debian``)
  Directory under which the Debian apt repositories can be found on the
  specified mirror.

**preseed_mirror_hostname** (string, optional, ``ftp.se.debian.org``)
  Resolvable hostname of FQDN where the Debian apt repositories can be
  found. Only HTTP mirrors are supported.

**preseed_mirror_proxy** (string, optional, ``None``)
  An HTTP proxy that should be used for accessing the Debian apt
  repositories.

**preseed_netmask** (string, mandatory if **preseed_network_auto** is ``no``)
  Netmask for the server network interface.

**preseed_network_auto** (boolean, optional, ``yes``)
  Specifies whether the network configuration should be automatic (using DHCP)
  or manual. If manual configuration is selected a number of additional options
  needs to be specified: ``preseed_hostname``, ``preseed_domain``,
  ``preseed_ip``, ``preseed_netmask``, ``preseed_gateway``,
  ``preseed_dns``. For some of these values you may want to use per-server
  overrides - see parameter ``preseed_server_overrides``.

**preseed_network_interface** (string, optional, ``eth0``)
  Name of network interface (for example ``eth0``, ``eth1`` etc) that should be
  configured.

**preseed_root_password** (string, optional, ``root``)
  Initial password that should be set for the server during the installation.

**preseed_server_overrides** (string, optional, ``{}``)
  A dictionary consisting out of one or more entries where individual values for
  preseed files can be overridden per-server. Each entry's key should be the
  name of the server, as specified in the inventory. Each value should also be a
  dictionary, where valid keys are: ``country``, ``dns``, ``domain``,
  ``gateway``, ``hostname``, ``ip``, ``keymap``, ``language``, ``locale``,
  ``mirror_directory``, ``mirror_hostname``, ``mirror_proxy``, ``netmask``,
  ``network_auto``, ``network_interface``, ``root_password``,
  ``timezone``. These have the same meaning as their ``preseed_`` counterparts.

**preseed_timezone** (string, optional, ``Europe/Stockholm``)
  Timezone that should be used when calculating server time. It is assumed that
  the local hardware clock is set to UTC.


Examples
~~~~~~~~

Here is an example configuration for a preseed file that sets some global
defaults to be used for all servers, and then overrides it for one server:

.. code-block:: yaml

  ---

  ansible_key: /root/ansible/private.key
  preseed_country: UK
  preseed_directory: /var/www/preseed
  preseed_keymap: UK
  preseed_language: en
  preseed_locale: en_UK.UTF-8
  preseed_mirror_directory: /debian
  preseed_mirror_hostname: ftp.uk.debian.org
  preseed_mirror_proxy: ""
  preseed_network_auto: yes
  preseed_network_interface: eth0
  preseed_root_password: secret
  preseed_timezone: Europe/London
  preseed_server_overrides:
    ldap.example.com:
      network_auto: no
      hostname: ldap
      domain: example.com
      ip: 192.168.1.20
      netmask: 255.255.255.0
      gateway: 192.168.1.1
      dns: 192.168.1.1,192.168.1.2
      timezone: Europe/Stockholm


Bootstrap
---------

The ``bootstrap`` role can be used for bootstraping a new server with
Ansible. In order to apply this role to a server, all that is necessary is root
access to the server (either via SSH or locally).

The role implements the following:

* Installs sudo package.
* Creates operating system user and group for Ansible (``ansible``).
* Sets-up an authorized_key for operating system user ``ansible`` (for remote
  SSH access).
* Configures sudo to allow operating system user ``ansible`` to run sudo
  commands without password authentication.
* Removes the Ansible user's key from the list of authorized keys for user root
  at the end of bootstrap process. This key was necessary only for the bootstrap
  process.


Parameters
~~~~~~~~~~

**ansible_key** (string, optional, ``{{ lookup('file', '~/.ssh/id_rsa.pub') }}``)
  SSH public key that should be deployed to authorized_keys truststore for
  operating system user ``ansible``.


Examples
~~~~~~~~

Since the role is meant to be used just after the server has been installed, and
using the ``root`` account, it is probably going to be invoked from a separate
playbook.

For example, a playbook (``bootstrap.yml``) could look something similar to:

.. code-block:: yaml

  ---

  - hosts: "{{ server }}"
    remote_user: root
    roles:
      - bootstrap
    vars:
      ansible_key: "{{ lookup('file', 'authorized_keys/ansible.pub') }}"

With such a playbook in place, it would be invoked with:

  ansible-playbook --ask-pass -e server=test1.example.com bootstrap.yml


Common
------

The ``common`` role can be used for applying a common configuration and
hardening across all servers, no matter what services they provide.

The role implements the following:

* Configures apt to use caching proxy (if any was specified).
* Sets-up umask for all logins to ``0027``.
* Installs sudo.
* Installs additional base packages, as configured.
* Creates additional operating system groups, as configured.
* Creates additional operating system users, as configured.
* Hardens the SSH server by disabling remote ``root`` logins and password-based
  authentication.
* Allows traversing of directory ``/etc/ssl/private/`` to everyone. This lets
  you put TLS private keys in central location where any operating system user
  can reach them provided they have appropriate read/write rights on the file
  itself, and provided they know the exact path of the file.
* Deploys CA certificate files, normally used for truststore purposes, to
  ``/etc/ssl/certs/``.
* Installs ``ferm`` (for iptables management), configuring a basic firewall
  which allows ICMP echo requests (PING), incoming connection on TCP port 22
  (SSH), and also introduces rate-limitting for incoming ICMP echo request
  pacakges and (new) TCP connections. The rate-limitting is based on the source
  IP address, using the ``iptables hashlimit`` module.


Parameters
~~~~~~~~~~

**apt_proxy** (string, optional, ``None``)
  URI of a caching proxy that should be used when retrieving the packages via
  apt.

**os_users** (list, optional, ``[]``)
  A list of operating system users that should be set-up on a server. Each item
  is a dictionary with the following options describing the user parameters:

  **name** (string, mandatory)
    Name of the operating system user that should be created. User's default
    group will have the same name as the user.

  **uid** (number, optional, ``whatever OS picks``)
    UID for the operating system user. User's default group will have a GID
    identical to the user's UID if specified. Otherwise user's default group
    will have OS-determined GID.

  **additional_groups** (list, optional, ``[]``)
    Comma-separated list of additional groups that a user should belong to.

  **authorized_keys** (list, optional, ``[]``)
    List of SSH public keys that should be deployed to user's authorized_keys
    truststore.

  **password** (string, optional, ``!`` - no password)
    Encrypted password that should be set for the user.

**os_groups** (list, optional, ``[]``)
  A list of operating system groups that should be set-up on a server. Each item
  is a dictionary with the following options describing the group parameters:

  **name** (string, mandatory)
    Name of the operating system group that should be created.

  **gid** (number, optional, ``whatever OS picks``)
    GID for the operating system group.

**common_packages** (list, optional, ``[]``)
  List of additional operating system packages that should be installed on the
  server. Each element of the list should be a simple string denoting the name
  of the package.

**ca_certificates** (list, optional, ``[]``)
  List of additional CA certificate files that should be deployed on the
  server. Each element of the list should be a filepath to a CA certificate file
  on originating (Ansible) host that should be copied to destination
  server.

**incoming_connection_limit** (string, optional, ``3/second``)
  Rate at which the incoming ICMP echo-request packages and new TCP connections
  will be accepted at. The value should be specified in the same format as value
  for the ``iptables hashlimit`` option ``--hashlimit-upto``.

**incoming_connection_limit_burst** (string, optional, ``9``)
  Initial burst of packages that should be accepted when the client with
  distinct source IP address connects to the server for the first time (usually
  higher than ``incoming_connection_limit``), even if it would go above the
  specified connection limit.


Examples
~~~~~~~~

Here is an example configuration for setting-up some common users, groups, and
packages on all servers:

.. code-block:: yaml

  ---

  os_users:
    - name: admin
      uid: 1000
      additional_groups:
        - sudo
      authorized_keys:
        - "{{ lookup('file', '/home/admin/.ssh/id_rsa.pub') }}"
      password: '$6$AaJRWtqyX5pk$IP8DUjgY0y2zqMom9BAc.O9qHoQWLFCmEsPRCika6l/Xh87cp2SnlMywH0.r4uEcbHnoicQG46V9VrJ8fxp2d.'
    - name: john
      uid: 1001
      password: '$6$AaJRWtqyX5pk$IP8DUjgY0y2zqMom9BAc.O9qHoQWLFCmEsPRCika6l/Xh87cp2SnlMywH0.r4uEcbHnoicQG46V9VrJ8fxp2d.'

  os_groups:
    - name: localusers
      gid: 2500

  common_packages:
    - emacs23-nox
    - screen
    - debconf-utils

  ca_certificates:
    - ../certs/truststore.pem

  incoming_connection_limit: 2/second

  incoming_connection_limit_burst: 6

.. _ldap_client:

LDAP Client
-----------

The ``ldap_client`` role can be used for setting-up an OpenLDAP client on
destination machine.

The role implements the following:

* Installs OpenLDAP client tools.
* Sets-up global configuration file for OpenLDAP clients at /etc/ldap/ldap.conf.


Parameters
~~~~~~~~~~

**ldap_client_config** (list, optional, ``[]``)
  A list of configuration options that should be put into the LDAP configuration
  file. Each item is a dictionary with the following options defining the
  configuration parameter:

  **comment** (string, mandatory)
    Comment that will be shown in the file just above the configuration option.

  **option** (string, mandatory)
    Name of configuration option.

  **value** (string, mandatory)
    Value for configuration option.


Examples
~~~~~~~~

Here is an example configuration for setting some common LDAP client options:

.. code-block:: yaml

  ---

  ldap_client_config:
    - comment: Set the base DN
      option: BASE
      value: dc=example,dc=com
    - comment: Set the default URI
      option: URI
      value: ldap://ldap.example.com/
    - comment: Set the truststore for TLS/SSL
      option: TLS_CACERT
      value: /etc/ssl/certs/example_ca.pem
    - commment: Force basic server certificate verification
      option: TLS_REQCERT
      value: demand
    - comment: Disable CRL checks for server certificate
      option: TLS_CRLCHECK
      value: none


LDAP Server
-----------

The ``ldap_server`` role can be used for setting-up an OpenLDAP server on
destination machine.

The role implements the following:

* Deploys LDAP TLS private key and certificate.
* Installs OpenLDAP server (package ``slapd``).
* Configures OpenLDAP server (base DN - domain, organisation, TLS, SSF, log levels).
* Sets-up separate log file for OpenLDAP server at ``/var/log/slapd.log`` (with
  log rotation included).
* Enables the ``misc`` LDAP schema (from ``/etc/ldap/schema/misc.ldif``). This
  is necessary for the mail server role.
* Enables the ``memberof`` overlay on top of default database. The overlay is
  configured to keep track of membership changes for object class
  ``groupOfUniqueNames`` via attribute ``uniqueMember``. Enforcement of
  referential integrity is turned on as well (modifications of ``memberof``
  attribute will update corresponding group as well.
* Creates a basic directory structure used by most of the other roles.
* Creates a basic directory structure used by the mail server role.
* Creates login entries for services that need to consume LDAP directory data in
  some way.
* Creates user-supplied groups in LDAP.
* Configures permissions.
* Creates LDAP entries.
* Configures firewall to allow incoming connections to the LDAP server.
* Sets the LDAP server administrator's password.


Parameters
~~~~~~~~~~

**ldap_admin_password** (string, mandatory)
  Password for the default administrator account of LDAP server (the
  ``cn=admin,DOMAIN`` entry/user).

**ldap_entries** (list, optional, ``[]``)
  List of entries that should be kept in the LDAP directory. Each item is a
  dictionary describing a single LDAP entry, with all of its attributes
  listed. The keys in this dictionary should be the attribute names. The values
  should be either strings, for setting a single attribute value, or a list of
  strings if it is necessary to set multiple values for the same attribute.

**ldap_permissions** (list, optional, ``see below``)
  List of LDAP access rules to apply to base DN served by the LDAP server. The
  listed access control rules will *replace* all existing rules, and will be
  added in the same order they are listed in. Each item is a string that
  constitutes a single access control rule. The format should be the same as
  described in `OpenLDAP Administrator's Guide
  <http://www.openldap.org/doc/admin24/access-control.html#Access%20Control%20via%20Dynamic%20Configuration>`.

  Default value is:

  .. code-block:: yaml

    - >
      to *
      by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
      by * break
    - >
      to attrs=userPassword,shadowLastChange
      by self write
      by anonymous auth
      by dn="cn=admin,BASEDN" write
      by * none
    - >
      to dn.base=""
      by * read
    - >
      to *
      by self write
      by dn="cn=admin,BASEDN" write
      by * none

**ldap_server_consumers** (list, optional, ``[]``)
  List of items describing additional login entries that should be created for
  services that want to be able to log-in into the LDAP server and consume the
  data present within. Each item should be a dictionary, with the following keys
  avaialable:

  - **name** (name of the service, mandatory, this will be used to construct the
    login entry DN in format of ``cn=NAME,ou=services,BASE_DN``)
  - **password** (password for the login entry, mandatory)
  - **state** (state of the service, optional, defaults to ``present``, this
    should be ``present`` or ``absent``, allowing for removal of old services)

**ldap_server_groups** (list, optional, ``[]``)
  List of groups that should be created in the LDAP directory. Each item should
  be a dictionary containing the following keys:

  - **name** (name of the group, mandatory, this will be used to construct the
    group DN in format of ``cn=NAME,ou=groups,BASE_DN``)
  - **state** (state of the group, optional, defaults to ``present``, this
    should be ``present`` or ``absent``, allowing for removal of old groups)

**ldap_server_domain** (string, optional, ``{{ ansible_domain }}``)
  Domain that should be used for constructing the base DN of default user LDAP
  database. This should be a sub-domain dedicated to organisation. The base DN
  will be constructed by putting all elements of the sub-domain as ``dc``
  entries (as per standard Debian convention). I.e. ``example.com`` would get
  transformed into ``dc=example,dc=com``.

**ldap_server_organization** (string, optional, ``Private``)
  Organization that should be specified in the base DN entry.

**ldap_server_log_level** (string, optional, ``256``)
  Log level to use for the server. This should be compatible with OpenLDAP
  configuration option ``olcLogLevel``. See `OpenLDAP Administrator's Guide
  <http://www.openldap.org/doc/admin24/slapdconf2.html#cn=config>` for value
  description and syntax.

**ldap_server_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_fqdn }}_ldap.pem``)
  Path to file on Ansible host that contains the X.509 certificate used for TLS
  for LDAP service. The file will be copied to directory ``/etc/ssl/certs/``.

**ldap_server_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_fqdn }}_ldap.key``)
  Path to file on Ansible host that contains the private key used for TLS for
  LDAP service. The file will be copied to directory ``/etc/ssl/private/``.

**ldap_server_ssf** (number, optional, ``128``)
  Minimum *Security Strength Factor* to require from all incoming
  connections. This applies for both remote and local connections.


Examples
~~~~~~~~

Here is an example configuration for setting-up LDAP server:

.. code-block:: yaml

  ---

  ldap_server_domain: "example.com"
  ldap_server_organization: "Example Corporation"
  ldap_server_log_level: 256
  ldap_server_tls_certificate: ~/tls/ldap.example.com_ldap.pem
  ldap_server_tls_key: ~/tls/ldap.example.com_ldap.key
  ldap_server_ssf: 128
  
  ldap_permissions:
    - >
      to *
      by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
      by * break
    - >
      to attrs=userPassword,shadowLastChange
      by self write
      by anonymous auth
      by dn="cn=admin,dc=example,dc=com" write
      by * none
    - >
      to dn.base=""
      by * read
    - >
      to *
      by self write
      by dn="cn=admin,dc=example,dc=com" write
      by users read
      by * none
  
  ldap_entries:
    - dn: ou=people,dc=example,dc=com
      objectClass: organizationalUnit
      ou: people
    - dn: ou=groups,dc=example,dc=com
      objectClass: organizationalUnit
      ou: groups
    - dn: uid=john,dc=example,dc=com
      objectClass:
        - inetOrgPerson
        - simpleSecurityObject
      userPassword: somepassword
      uid: john
      cn: John Doe
      sn: Doe


XMPP Server
-----------

The ``xmpp_server`` role can be used for setting-up Prosody, an XMPP server, on
destination machine.

The role implements the following:

* Sets-up the Prosody apt repository.
* Deploys XMPP TLS private key and certificate.
* Installs Prosody.
* Configures Prosody.
* Configures firewall to allow incoming connections to the XMPP server.

Prosody is configured as follows:

* Modules enabled: roster, saslauth, tls, dialback, posix, private, vcard,
  version, uptime, time, ping, pep, register, admin_adhoc, announce, legacyauth.
* Self-registration is not allowed.
* TLS is configured. Legacy TLS is available on port 5223.
* Client-to-server communication requires encryption (TLS).
* Authentication is done via LDAP. For setting the LDAP TLS truststore, see
  :ref:`LDAP Client <ldap_client>`.
* Internal storage is used.
* For each domain specified, a dedicated conference/multi-user chat (MUC)
  service is set-up, with FQDN set to ``conference.DOMAIN``.
* For each domain specified, a dedicated file proxy service will be set-up, with
  FQDN set to ``proxy.DOMAIN``.

Prosody expects a specific directory structure in LDAP when doing look-ups:

* Prosody will log-in to LDAP as user
  ``cn=prosody,ou=services,XMPP_LDAP_BASE_DN``.
* User entries are read from sub-tree (first-level only)
  ``ou=people,XMPP_LDAP_BASE_DN``. Query filter used for finding users is
  ``(&(mail=$user@$host)(memberOf=cn=xmpp,ou=groups,XMPP_LDAP_BASE_DN))``. This
  allows group-based granting of XMPP service to users.


Parameters
~~~~~~~~~~

**xmpp_administrators** (list, mandatory)
  List of Prosody users that should be granted administrator privileges over
  Prosody. Each item is a string with value equal to XMPP user ID
  (i.e. ``john.doe@example.com``).

**xmpp_domains** (list, optional, ``{{ ansible_domain }}``)
  List of domains that are served by this Prosody instance. Each item is a
  string specifying a domain.

**xmpp_ldap_base_dn** (string, mandatory)
  Base DN on the LDAP server. A specific directory structure is expected under
  this entry (as explained above) in order to locate the available domains,
  users, aliases etc.

**xmpp_ldap_password** (string, mandatory)
  Password used for authenticating to the LDAP server.

**xmpp_ldap_server** (string, mandatory)
  Fully qualified domain name, hostname, or IP address of the LDAP server used
  for user authentication and listing.

**xmpp_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_fqdn }}_xmpp.pem``)
  Path to file on Ansible host that contains the X.509 certificate used for TLS
  for SMTP service. The file will be copied to directory ``/etc/ssl/certs/``.

**xmpp_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_fqdn }}_xmpp.key``)
  Path to file on Ansible host that contains the private key used for TLS for
  XMPP service. The file will be copied to directory ``/etc/ssl/private/``.


Examples
~~~~~~~~

Here is an example configuration for setting-up XMPP server using Prosody:

.. code-block:: yaml

  ---

  xmpp_administrators:
    - john.doe@example.com
  xmpp_domains:
    - example.com
  xmpp_ldap_base_dn: dc=example,dc=com
  xmpp_ldap_password: xmpp
  xmpp_ldap_server: ldap.example.com
  # These are default key and certificate that generated during Prosody
  # installation. Possibly you want to deploy your own.
  xmpp_tls_key: /etc/prosody/certs/localhost.key
  xmpp_tls_certificate: /etc/prosody/certs/localhost.crt


Mail Server
-----------

The ``mail_server`` role can be used for setting-up a complete mail server
solution, which includes both SMTP and IMAP service, on destination machine.

Postfix is used SMTP, while Dovecot is used for IMAP.

The role implements the following:

* Installs rsync.
* Deploys IMAP/SMTP TLS private keys and certificates.
* Installs and configures Dovecot, Postfix, ClamAV, and ClamAV Milter.
* Purges Exim4 configuration (just in case).
* Installs SWAKS (utility for testing SMTP servers).
* Sets-up the necessary directories and files under Postfix chroot.
* Configures firewall to allow incoming connections to the mail server. This
  includes set-up of redirection from TCP port 26 to TCP port 25 (alternate SMTP
  to work around common network blocks).

Deployed services are configured as follows:

* Both Postfix and Dovecot look-up available domains, users, and aliases in
  LDAP.
* Incoming and outgoing mail is scanned with ClamAV (via ClamAV
  Milter). Infected mails are rejected.
* Mail is stored in directory ``/var/MAIL_USER/DOMAIN/USER``, using ``Maildir``
  format.
* TLS is required for user log-ins for both SMTP and IMAP.
* RBL's are used for combating spam (if any is specified in configuration, see
  below).

Both Postfix and Dovecot expect a specific directory structure in LDAP when
doing look-ups:

* Postfix will log-in to LDAP as user
  ``cn=postfix,ou=services,MAIL_LDAP_BASE_DN``.
* Dovecot will log-in to LDAP as user
  ``cn=dovecot,ou=services,MAIL_LDAP_BASE_DN``.
* Domain entries need to be available as
  ``dc=DOMAIN,ou=domains,ou=mail,ou=services,MAIL_LDAP_BASE_DN``.
* Alias entries need to be available as
  ``cn=ALIAS,ou=aliases,ou=mail,ou=services,MAIL_LDAP_BASE_DN``.
* User entries are read from sub-tree (first-level only)
  ``ou=people,MAIL_LDAP_BASE_DN``. Query filter used for finding users is
  ``(&(mail=%s)(memberOf=cn=mail,ou=groups,MAIL_LDAP_BASE_DN))``. This allows
  group-based granting of mail services to users.


Parameters
~~~~~~~~~~

**mail_ldap_base_dn** (string, mandatory)
  Base DN on the LDAP server. A specific directory structure is expected under
  this entry (as explained above) in order to locate the available domains,
  users, aliases etc.

**mail_ldap_url** (string, mandatory)
  LDAP URL that should be used for connecting to the LDAP server for doing
  domain/user look-ups.

**mail_ldap_tls_truststore** (string, optional, ``/etc/ssl/certs/truststore.pem``)
  Path to TLS truststore used for verifying the LDAP certificate. Should be in
  PEM format.

**mail_ldap_postfix_password** (string, mandatory)
  Password for authenticating the Postfix LDAP user.

**mail_ldap_dovecot_password** (string, mandatory)
  Password for authenticating the Dovecot LDAP user.

**mail_user** (string, optional, ``vmail``)
  Name of the user that owns all the mail files.

**mail_user_uid** (integer, optional, ``whatever OS picks``)
  UID of the user that owns all the mail files.

**mail_user_gid** (integer, optional, ``whatever OS picks``)
  GID of the user that owns all the mail files.

**imap_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_fqdn }}_imap.pem``)
  Path to file on Ansible host that contains the X.509 certificate used for TLS
  for IMAP and ManageSieve services. The file will be copied to directory
  ``/etc/ssl/certs/``.

**imap_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_fqdn }}_imap.key``)
  Path to file on Ansible host that contains the private key used for TLS for
  IMAP and ManageSieve services. The file will be copied to directory
  ``/etc/ssl/private/``.

**smtp_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_fqdn }}_smtp.pem``)
  Path to file on Ansible host that contains the X.509 certificate used for TLS
  for SMTP service. The file will be copied to directory ``/etc/ssl/certs/``.

**smtp_tls_key** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_fqdn }}_smtp.key``)
  Path to file on Ansible host that contains the private key used for TLS for
  SMTP service. The file will be copied to directory ``/etc/ssl/private/``.

**imap_folder_separator** (string, optional, ``/``)
  Character used for separating the IMAP folders when clients are requesting
  listing from the server. Usually either slash(``/``) or dot(``.``).

**smtp_rbl** (list, optional, ``[]``)
  List of RBLs to use for detecting servers which send out spam. Each item is a
  string resembling the RBL domain.

**mail_postmaster** (string, optional, ``postmaster@{{ ansible_domain}}``)
  Mail address to use for the postmaster account in Dovecot.

**smtp_allow_relay_from** (list, optional, [])
  List of networks from which mail relaying is allowed even without
  authentication. Each item in the list is a string defining a network. The
  format must be compatible with Postfix ``mynetworks`` setting (for example:
  ``192.168.1.0/24``, ``myhost.example.com`` etc).


Examples
~~~~~~~~

Here is an example configuration for setting-up XMPP server using Prosody:

.. code-block:: yaml

  ---

  mail_ldap_url: ldap://ldap.example.com/
  mail_ldap_tls_truststore: /etc/ssl/certs/truststore.pem
  mail_ldap_base_dn: dc=example,dc=com
  mail_ldap_postfix_password: postfix
  mail_ldap_dovecot_password: dovecot

  mail_user: vmail
  mail_user_uid: 5000
  mail_user_gid: 5000

  imap_tls_certificate: ~/tls/mail.example.com_imap.pem
  imap_tls_key: ~/tls/mail.example.com_imap.key
  smtp_tls_certificate: ~/tls/mail.example.com_smtp.pem
  smtp_tls_key: ~/tls/mail.example.com_smtp.key
  imap_folder_separator: /
  smtp_rbl:
    - bl.spamcop.net
    - zen.spamhaus.org
  mail_postmaster: postmaster@example.com

  smtp_allow_relay_from:
    - ldap.example.com
    - xmpp.example.com


Mail Forwarder
--------------

The ``mail_forwarder`` role can be used for setting-up a local SMTP server for
sending out mails and receiving mails for local users. The SMTP server is
provided by Postfix.

SMTP service on server set-up this way is not meant to be exposed to the
Internet directly, and should receive delivery failures from the relay server
instead.

The role implements the following:

* Installs and configures Postfix.
* Purges Exim4 configuration (just in case).
* Sets-up aliases for the local recipients.
* Installs SWAKS (utility for testing SMTP servers).

Postfix is configured as follows:

* Local destinations are set-up.
* A relay host is set.
* TLS is enforced for relaying mails, with configurable truststore for server
  certificate verification.


Parameters
~~~~~~~~~~

**local_mail_aliases** (dictionary, optional, ``[]``)
  Dictionary defining the local aliases. Aliases defined this way will either be
  appended to default aliases on the server, or replace the existing entries (if
  the alias/recipient is already present). Keys in the dictionary are the local
  recipients/aliases, while the value provided should be a space-separated list
  of mail addresses (or local users) where the mails should be forwarded.

**smtp_relay_host** (string, optional, ``None``)
  SMTP server via which the mails are sent out for non-local recipients.

**smtp_relay_truststore** (string, optional, ``/etc/ssl/certs/truststore.pem``)
  Path to the file containing full X.509 CA certificate chain used for
  validating the server certificate presented by the relay server.


Examples
~~~~~~~~

Here is an example configuration for setting-up the mail forwarder:

.. code-block:: yaml

  ---

  # All mails sent to local user root will be forwarded to external account as
  # well.
  local_mail_aliases:
    root: "root john.doe@example.com"

  smtp_relay_host: mail.example.com

  smtp_relay_truststore: /etc/ssl/certs/example_ca_chain.pem


Web Server
----------

The ``web_server`` role can be used for setting-up a web server on destination
machine.

The role is supposed to be very lightweight, providing a basis for deployment of
web applications.

The role implements the following:

* Installs and configures nginx with a single, default vhost with a small static
  index page.
* Deploys the HTTPS TLS private key and certificate (for default vhost).
* Configures firewall to allow incoming connections to the web server.
* Installs and configures virtualenv and virtualenvwrapper as a common base for
  Python apps.
* Installs and configures PHP FPM as a common base for PHP apps.


Parameters
~~~~~~~~~~

**https_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_fqdn }}_https.key``)
  Path to file on Ansible host that contains the private key used for TLS for
  HTTPS service. The file will be copied to directory ``/etc/ssl/private/``.

**https_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_fqdn }}_https.pem``)
  Path to file on Ansible host that contains the X.509 certificate used for TLS
  for HTTPS service. The file will be copied to directory ``/etc/ssl/certs/``.

**web_default_title** (string, optional, ``Welcome``)
  Title for the default web page shown to users (if no other vhosts were matched).

**web_default_message** (string, optional, ``You are attempting to access the web server using a wrong name or an IP address. Please check your URL.``)
  Message for the default web page shown to users (if no other vhosts were
  matched).


Examples
~~~~~~~~

Here is an example configuration for setting-up web server:

.. code-block:: yaml

  ---

  https_tls_key: "{{ inventory_dir }}/tls/web.example.com_https.key"
  https_tls_certificate: "{{ inventory_dir }}/tls/web.example.com_https.pem"

  web_default_title: "Welcome to Example Inc."
  web_default_message: "You are attempting to access the web server using a wrong name or an IP address. Please check your URL."


PHP Website
-----------

The ``php_website`` role can be used for setting-up a website powered by PHP on
destination machine.

This role is normally not supposed to be used directly, but should instead serve
as the basis for writing website-specific roles. Therefore the role is written
in quite generic way, allowing the integrator to write his/her own logic for
deploying the necessary PHP applications, while still reusing a common base and
reducing the workload.

The role implements the following:

* Creates a dedicated user/group for running the PHP scripts.
* Creates a base directory where the website-specific code and data should be
  stored at.
* Adds nginx to website's group, so nginx could read the necessary files.
* Adds website administrator to website's group, so administrator could manage
  the code and data.
* Installs additional packages required for running the role (as configured).
* Deploys the HTTPS TLS private key and certificate (for website vhost).
* Configures PHP FPM and nginx to serve the website.

The role is implemented with the following layout/logic in mind:

* Website users are named after the ``FQDN`` (fully qualified domain name) of
  website, in format of ``web-ESCAPEDFQDN``, where ``ESCAPEDFQDN`` is equal to
  ``FQDN`` where dots have been replaced by underscores (for example,
  ``web-cloud_example_com``).
* All websites reside within a dedicated sub-directory in ``/var/www``. The
  sub-directory name is equal to the ``FQDN`` used for accessing the
  website. Owner of the directory is set to be the application administrator,
  while group is set to be the website group. Additionally, ``SGID`` bit is set
  on the directory. This allows admin, with correct umask, to create necessary
  files and directories that should be readable (and eventually writeable) by
  the website user (running the PHP scripts) without having to become root.
* All files placed in the website directory should be either created there
  directly, or copied to the directory in order to make sure the ``SGID`` gets
  honored. **Do not move the files, the permissions will not be set correctly.**
* Within the website directory, nginx/php5-fpm will expect to find the relevant
  files within the htdocs sub-directory (this can be symlink too).
* nginx communicates with PHP FPM over a dedicated Unix socket for each website.


Parameters
~~~~~~~~~~

**admin** (string, optional, ``web-{{ fqdn | replace('.', '_') }}``)
  Name of the operating system user in charge of maintaining the website. This
  user is capable of making modifications to website configuration and data
  stored within the website directory.

**deny_files_regex** (list, optional, ``[]``)
  List of regular expressions for matching files/locations to which the web
  server should deny access. This is useful to block access to any sensitive
  files that should not be served directly by the web server. The format must be
  compatible with regular expressions used by ``nginx`` for ``location ~``
  syntax.

**fqdn** (string, mandatory)
  Fully-qualified domain name where the website is reachable. This value is used
  for calculating the user/group name for dedicated website user, as well as
  home directory of the website user (where data/code should be stored at).

**index** (string, optional, ``index.php``)
  Space-separated list of files which should be treated as index files by the
  web server. The web server will attempt opening these index files, in
  succession, until the first match, or until it runs out of matches, when a
  client requests an URI pointing to directory.

**https_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ fqdn }}_https.pem``)
  Path to file on Ansible host that contains the X.509 certificate used for TLS
  for HTTPS service. The file will be copied to directory ``/etc/ssl/certs/``.

**https_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ fqdn }}_https.key``)
  Path to file on Ansible host that contains the private key used for TLS for
  HTTPS service. The file will be copied to directory ``/etc/ssl/private/``.

**php_file_regex** (string, optional, ``\.php$``)
  Regular expression used for determining which file should be interepted via
  PHP.

**php_rewrite_urls** (list, optional, ``[]``)
  A list of rewrite rules that are applied to incoming requests. These rewrite
  rules are specifically targetted at prettying-up the URLs used by the PHP
  scripts. Each element of the list should be a string value compatible with the
  format of ``nginx`` option ``rewrite``. The keyword ``rewrite`` itself should
  be omitted, as well as trailing semi-colon (``;``).

**rewrites** (list, optional, ``[]``)
  A list of rewrite rules that are applied to incoming requests. Each element of
  the list should be a string value compatible with the format of ``nginx``
  option ``rewrite``. The keyword ``rewrite`` itself should be omitted, as well
  as trailing semi-colon (``;``).

**packages** (list, optional, ``[]``)
  A list of additional packages to install for this particular PHP
  appliction. This is usually going to be different PHP extensions.

**uid** (integer, optional, ``whatever OS picks``)
  UID/GID (they are set-up to be the same) of the dedicated website
  user/group.


Examples
~~~~~~~~

Here is an example configuration for setting-up two (base) PHP websites (for
running *ownCloud* and *The Bug Genie* applications):

.. code-block:: yaml

    - role: php_website
      fqdn: cloud.example.com
      uid: 2001
      admin: admin
      php_file_regex: \.php($|/)
      rewrites:
        - ^/\.well-known/host-meta /public.php?service=host-meta
        - ^/\.well-known/host-meta\.json /public.php?service=host-meta-json
        - ^/\.well-known/carddav /remote.php/carddav/ redirect
        - ^/\.well-known/caldav /remote.php/caldav/ redirect
        - ^/apps/calendar/caldav\.php /remote.php/caldav/
        - ^/apps/contacts/carddav\.php /remote.php/carddav/
        - ^/remote/(.*) /remote.php
      deny_files_regex:
        - ^(\.|autotest|occ|issue|indie|db_|console|build/|tests/|config/|lib/|3rdparty/|templates/).*
      packages:
        # For ownCloud
        - php5-gd
        - php5-json
        - php5-mysql
        - php5-curl
      https_tls_key: "{{ inventory_dir }}/tls/cloud.example.com_https.key"
      https_tls_certificate: "{{ inventory_dir }}/tls/cloud.example.com_https.pem"
    - role: php_website
      admin: admin
      deny_files_regex:
        - ^\..*
      php_rewrite_urls:
        - ^(.*) /index.php?url=$1
      fqdn: tbg.example.com
      uid: 2007
      https_tls_key: "{{ inventory_dir }}/tls/tbg.example.com_https.key"
      https_tls_certificate: "{{ inventory_dir }}/tls/tbg.example.com_https.pem"


WSGI Website
------------

The ``wsgi_website`` role can be used for setting-up a website powered by Python
on destination machine. The website needs to use the WSGI specification for
making the Python web application(s) available.

This role is normally not supposed to be used directly, but should instead serve
as the basis for writing website-specific roles. Therefore the role is written
in quite generic way, allowing the integrator to write his/her own logic for
deploying the necessary Python applications/packages, while still reusing a
common base and reducing the workload.

The role implements the following:

* Creates a dedicated user/group for running the WSGI application.
* Creates a base directory where the website-specific code and data should be
  stored at.
* Adds nginx to website's group, so nginx could read the necessary files.
* Adds website administrator to website's group, so administrator could manage
  the code and data.
* Installs additional packages required for running the role (as configured).
* Sets-up a dedicated Python virtual environment for website.
* Install Gunicorn in Python virtual environment.
* Installs additional packages required for running the role in Python virtual
  environment (as configured).
* Configures systemd to run the website code (using Gunicorn)
* Deploys the HTTPS TLS private key and certificate (for website vhost).
* Configures nginx to serve the website (static files served directly, requests
  passed on to Gunicorn).

The role is implemented with the following layout/logic in mind:

* Website users are named after the ``FQDN`` (fully qualified domain name) of
  website, in format of ``web-ESCAPEDFQDN``, where ``ESCAPEDFQDN`` is equal to
  ``FQDN`` where dots have been replaced by underscores (for example,
  ``web-wiki_example_com``).
* All websites reside within a dedicated sub-directory in ``/var/www``. The
  sub-directory name is equal to the ``FQDN`` used for accessing the
  website. Owner of the directory is set to be the application administrator,
  while group is set to be the website group. Additionally, ``SGID`` bit is set
  on the directory. This allows admin, with correct umask, to create necessary
  files and directories that should be readable (and eventually writeable) by
  the website user (running the WSGI application) without having to become root.
* All files placed in the website directory should be either created there
  directly, or copied to the directory in order to make sure the ``SGID`` gets
  honored. **Do not move the files, the permissions will not be set correctly.**
* Within the website directory, Python virtual environment can be found within
  the ``virtualenv`` sub-directory. The virtual environment is also symlinked to
  website admin's ``~/.virtualenvs/`` directory for easier access (and
  auto-completion with virtualenvwrapper).
* Within the website directory, nginx will expect to find the static files
  within the ``htdocs`` sub-directory (this can be symlink too). Locations/aliases
  can be configured for static file serving.
* Within the website directory, systemd service will expect to find the website
  code within the ``code`` sub-directory (this can be symlink too).
* nginx communicates with WSGI server over a dedicated Unix socket for each
  website.


Parameters
~~~~~~~~~~

**admin** (string, optional, ``web-{{ fqdn | replace('.', '_') }}``)
  Name of the operating system user in charge of maintaining the website. This
  user is capable of making modifications to website configuration anda data
  stored within the website directory.

**fqdn** (string, mandatory)
  Fully-qualified domain name where the website is reachable. This value is used
  for calculating the user/group name for dedicated website user, as well as
  home directory of the website user (where data/code should be stored at).

**https_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ fqdn }}_https.pem``)
  Path to file on Ansible host that contains the X.509 certificate used for TLS
  for HTTPS service. The file will be copied to directory ``/etc/ssl/certs/``.

**https_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ fqdn }}_https.key``)
  Path to file on Ansible host that contains the private key used for TLS for
  HTTPS service. The file will be copied to directory ``/etc/ssl/private/``.

**packages** (list, optional, ``[]``)
  A list of additional packages to install for this particular WSGI
  website. This is usually going to be development libraries for building Python
  packages.

**rewrites** (list, optional, ``[]``)
  A list of rewrite rules that are applied to incoming requests. Each element of
  the list should be a string value compatible with the format of ``nginx``
  option ``rewrite``. The keyword ``rewrite`` itself should be omitted, as well
  as trailing semi-colon (``;``).

**static_locations** (list, optional, ``[]``)
  List of locations that should be treated as static-only, and not processed by
  the WSGI application at all. This is normally used for designating serving of
  static/media files by Nginx (for example, in case of Django projects for
  ``/static/`` and ``/media/``).

**uid** (integer, optional, ``whatever OS picks``)
  UID/GID (they are set-up to be the same) of the dedicated website
  user/group.

**use_paste** (boolean, optional, ``False``)
  Tell Gunicorn to assume that the passed-in ``wsgi_application`` value is a
  filename of a Python Paste ``ini`` file instead of WSGI application.

**virtuaelnv_packages** (list, optional, ``[]``)
  A list of additional packages to install for this particular WSGI appliction
  in its virtual environment using ``pip``.

**wsgi_application** (string, mandatory)
  WSGI application that should be started by Gunicorn. The format should be
  conformant to what the ``gunicorn`` command-line tool accepts. If the
  ``use_paste`` option is enabled, the value should be equal to filename of the
  Python Paste ini file, located in the ``code`` sub-directory.


Examples
~~~~~~~~

Here is an example configuration for setting-up a (base) WSGI website (for
running a bare Django project):

.. code-block:: yaml

    - role: wsgi_website
      admin: admin
      fqdn: django.example.com
      static_locations:
        - /static
        - /media
      uid: 2004
      virtualenv_packages:
        - django
      wsgi_application: django_example_com.wsgi:application
      https_tls_key: "{{ inventory_dir }}/tls/wsgi.example.com_https.key"
      https_tls_certificate: "{{ inventory_dir }}/tls/wsgi.example.com_https.pem"


Database Server
---------------

The ``database_server`` role can be used for setting-up a MariaDB database
server on destination machine.

The role implements the following:

* Installs MariaDB server and client.
* Configures MariaDB server and client to use *UTF-8* encoding by default.
* Sets password for the database root user.
* Deploys MariaDB client configuration in location ``/root/.my.cnf`` that
  contains username and password for the root database user.


Parameters
~~~~~~~~~~

**db_root_password** (string, mandatory)
  Password for the *root* database user.


Examples
~~~~~~~~

Here is an example configuration for setting-up the database server:

.. code-block:: yaml

   ---

   db_root_password: root


Database
--------

The ``database`` role can be used for creating a MariaDB database and
accompanying user on destination machine.

The role implements the following:

* Creates MariaDB database.
* Creates a dedicated user capable of performing any operation on the created
  database. Username is set to be same as the name of database.


Parameters
~~~~~~~~~~

**db_name** (string, mandatory)
  Name of the database that should be created.

**db_password** (string, mandatory)
  Password for the database user.


Examples
~~~~~~~~

Here is an example configuration for creating a single database (for some
website):

.. code-block:: yaml

  - role: database
    db_name: phpinfo_example_com
    db_password: phpinfo_example_com


Backup Server
-------------

The ``backup_server`` role can be used for setting-up a server to act as backup
storage for the backup clients. Storage is made available to the clients
exclusively via SFTP on a dedicated port and dedicated OpenSSH server
instance. This instance is specifically configured and tailored for this
purpose.

The role is primarily aimed for use with `Duplicity
<http://duplicity.nongnu.org/>`_, but should be also usable for generic SFTP
uploads.

The role implements the following:

* Installs backup software (Duplicity, Duply).
* Creates a dedicated directory structure for backups with the following structure:

  * ``/srv/backups/`` - main directory under which all the backups reside.
  * ``/srv/backups/SERVER_NAME/`` - home directory for the backup user, name
    after the server. Backup users are confined to their respective home
    directory via chroot. Backup users can't write to their own home directory,
    though.
  * ``/srv/backups/SERVER_NAME/duplicity/`` - directory where the Duplicity
    backups are stored at. This directory is writable by the respective backup
    user.
  * ``SERVER_NAME/.ssh/`` - directory where authorized keys are stored. Backup
    user is not allowed to make modifications to this directory and files
    contained within (i.e. backup users can't add more keys to the
    ``authorized_keys`` file).
* Creates dedicated operating system users for backup clients. These users will
  be made members of the ``backup`` group as well (as an additional group).
* Sets-up ``authorized_keys`` for the backup clients.
* Makes sure the backup users can't log-in via regular OpenSSH server instance.
* Sets-up dedicated OpenSSH server instances to be used exclusively by backup
  clients. The instance listens on TCP port ``2222``.
* Updates firewall to allow incoming TCP connections to port
  ``2222``. Connections are allowed only from the configured IP addresses
  associated with backup clients.


Parameters
~~~~~~~~~~

**backup_clients** (list, optional)
  List of backup clients that are connecting to the backup server. This is
  usually done on a per-server basis. Each item in the list is a dictionary
  describing the backup client. The following keys are available:

  **server** (string, mandatory)
    Name of the server that is backed up. It is highly recommended to use
    server's FQDN for this purpose. The dedicated operating system user created
    will have the name of format ``bak-ESCAPED_SERVER_NAME``, where
    ``ESCAPED_SERVER_NAME`` is calculated by taking the passed-in server name
    and replacing all dots (``.``) with undescores (``_``). For example,
    ``web.example.com`` will be turned into ``bak-web_example_com``.

  **uid** (integer, optional, ``whatever OS picks``)
    Uid for the operating system user. User's default group will have a GID
    identical to the user's UID if specified. Otherwise user's default group
    will have OS-determined GID.

  **ip** (IPv4 address, mandatory)
    IPv4 address from which the backup client server is connecting to the backup
    server. Used for introducing stricter firewall rules.

**backup_host_ssh_private_keys** (dictionary, mandatory)
  Defines host keys used for the dedicated OpenSSH server instance for
  backup. Key values that must be provided are: **dsa**, **rsa**, **ed25519**,
  and **ecdsa**, with values for each one of them corresponding to a private key
  generated using the appropriate algorithm. Keys for this purpose can be easily
  created via commands::

    ssh-keygen -f backup_server_dsa_key -N '' -t dsa
    ssh-keygen -f backup_server_rsa_key -N '' -t rsa
    ssh-keygen -f backup_server_ed25519_key -N '' -t ed25519
    ssh-keygen -f backup_server_ecdsa_key -N '' -t ecdsa