Added pastebin bin role.

5 files changed, 74 insertions, 0 deletions

diff --git a/bin/server/defaults/main.yaml b/bin/server/defaults/main.yaml
new file mode 100644
index 0000000..4862a99
--- /dev/null
+++ b/bin/server/defaults/main.yaml
@@ -0,0 +1,4 @@
+---
+
+bin_user: "pastebin"
+bin_port: 8820
diff --git a/bin/server/handlers/main.yaml b/bin/server/handlers/main.yaml
new file mode 100644
index 0000000..a5d6c7c
--- /dev/null
+++ b/bin/server/handlers/main.yaml
@@ -0,0 +1,5 @@
+---
+
+- name: restart service
+  become: yes
+  systemd: name="bin@{{bin_port}}.service" state="restarted" daemon_reload="yes"
diff --git a/bin/server/tasks/main.yaml b/bin/server/tasks/main.yaml
new file mode 100644
index 0000000..2b7634e
--- /dev/null
+++ b/bin/server/tasks/main.yaml
@@ -0,0 +1,24 @@
+---
+
+- name: add bin user
+  become: yes
+  user: name="{{bin_user}}" shell="/bin/false" system="yes"
+
+- name: install bin binary
+  become: yes
+  get_url:
+    url: "{{bin_url}}"
+    dest: "/usr/local/bin/bin"
+    mode: "0755"
+  notify: restart service
+
+- name: install systemd service
+  become: yes
+  template:
+    src: "[email protected]"
+    dest: "/lib/systemd/system/[email protected]"
+  notify: restart service
+
+- name: ensure service is started
+  become: yes
+  systemd: name="bin@{{bin_port}}.service" enabled="yes" state="started"
diff --git a/bin/server/templates/[email protected] b/bin/server/templates/[email protected]
new file mode 100644
index 0000000..697bb79
--- /dev/null
+++ b/bin/server/templates/[email protected]
@@ -0,0 +1,11 @@
+[Unit]
+Description=Bin pastebin server bound on port %i
+After=syslog.target network.target
+
+[Service]
+ExecStart=/usr/local/bin/bin 127.0.0.1:%i --buffer-size 10 --max-paste-size 16kB
+Restart=always
+User={{bin_user}}
+
+[Install]
+WantedBy=multi-user.target
diff --git a/bin/server/templates/nginx.conf.j2 b/bin/server/templates/nginx.conf.j2
new file mode 100644
index 0000000..e07be7e
--- /dev/null
+++ b/bin/server/templates/nginx.conf.j2
@@ -0,0 +1,30 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{nginx_server_name}};
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    # listen [::]:443 ssl ipv6only=on;
+    server_name {{nginx_server_name}};
+
+    ssl_certificate {{nginx_ssl_cert}};
+    ssl_certificate_key {{nginx_ssl_privkey}};
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    location / {
+        proxy_pass http://127.0.0.1:{{nginx_proxy_port}};
+        proxy_redirect off;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}