testing.yml

---
- hosts: testing
  become: true
  tasks:
  vars_files:
    - "secret_group_vars/ftp.yml"
    - "secret_group_vars/all.yml"
  vars:
    hostname: testing.usegalaxy.eu
    certbot_auto_renew: yes
    certbot_auto_renew_user: root
    certbot_auto_renew_hour: 17
    certbot_auto_renew_minute: 28

    certbot_environment: staging
    certbot_domains:
      - testing.usegalaxy.eu
      - bravo.usegalaxy.eu
    certbot_agree_tos: --agree-tos
    certbot_admin_email: hxr@informatik.uni-freiburg.de

    apache_remove_default_vhost: true
    apache_mods_enabled:
      - rewrite
      - ssl
      - headers
      - proxy
      - proxy_http

    apache_vhosts:
      - servername: "testing.usegalaxy.eu"
        serveradmin: admin@usegalaxy.eu
        documentroot: "/var/www/html/"
        extra_parameters: |
            RewriteEngine on
            RewriteCond %{SERVER_NAME} =testing.usegalaxy.eu
            RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
            ErrorLog ${APACHE_LOG_DIR}/testing.usegalaxy.eu-error.log
            CustomLog ${APACHE_LOG_DIR}/testing.usegalaxy.eu-access.log combined

      - servername: "bravo.usegalaxy.eu"
        serveradmin: admin@usegalaxy.eu
        documentroot: "/var/www/html/"
        extra_parameters: |
            RewriteEngine on
            RewriteCond %{SERVER_NAME} =bravo.usegalaxy.eu
            RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
            ErrorLog ${APACHE_LOG_DIR}/bravo.usegalaxy.eu-error.log
            CustomLog ${APACHE_LOG_DIR}/bravo.usegalaxy.eu-access.log combined

    apache_vhosts_ssl:
      - servername: "testing.usegalaxy.eu"
        serveradmin: admin@usegalaxy.eu
        documentroot: "/var/www/html/"
        apache_ssl_protocol: "All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1"
        apache_ssl_cipher_suite: "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
        apache_allow_override: "All"
        apache_options: "-Indexes +FollowSymLinks"
        extra_parameters: |
            Header always set X-Frame-Options DENY
            Header always set X-Content-Type-Options nosniff
        certificate_file: "/etc/letsencrypt/live/testing.usegalaxy.eu/cert.pem"
        certificate_key_file: "/etc/letsencrypt/live/testing.usegalaxy.eu/privkey.pem"
        certificate_chain_file: "/etc/letsencrypt/live/testing.usegalaxy.eu/chain.pem"

      - servername: "bravo.usegalaxy.eu"
        serveradmin: admin@usegalaxy.eu
        documentroot: "/var/www/html/"
        apache_ssl_protocol: "All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1"
        apache_ssl_cipher_suite: "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
        apache_allow_override: "All"
        apache_options: "-Indexes +FollowSymLinks"
        extra_parameters: |
            Header always set X-Frame-Options DENY
            Header always set X-Content-Type-Options nosniff
        certificate_file: "/etc/letsencrypt/live/testing.usegalaxy.eu/cert.pem"
        certificate_key_file: "/etc/letsencrypt/live/testing.usegalaxy.eu/privkey.pem"
        certificate_chain_file: "/etc/letsencrypt/live/testing.usegalaxy.eu/chain.pem"

  roles:
    - hostname
    - hxr.certbot
    - geerlingguy.apache
    #- jnv.unattended-upgrades
    #- galaxy
    #- galaxy-net
    #- autofs
    #- dj-wasabi.telegraf
    #- dev-sec.os-hardening
    #- dev-sec.ssh-hardening