Add stunnel config in nfsserver role

11 files changed, 122 insertions, 0 deletions

diff --git a/host_vars/blackbird.home.casperlefantom.net/main.yml b/host_vars/blackbird.home.casperlefantom.net/main.yml
index 477829e..6851bb8 100644
--- a/host_vars/blackbird.home.casperlefantom.net/main.yml
+++ b/host_vars/blackbird.home.casperlefantom.net/main.yml
@@ -51,3 +51,5 @@ peers:
 cockpitname: nsa
 # bittorrent
 btname: bt4
+# nfsserver
+nfsport: "29391"
diff --git a/host_vars/manchester.home.casperlefantom.net/main.yml b/host_vars/manchester.home.casperlefantom.net/main.yml
index 7405f69..e334116 100644
--- a/host_vars/manchester.home.casperlefantom.net/main.yml
+++ b/host_vars/manchester.home.casperlefantom.net/main.yml
@@ -20,3 +20,5 @@ peers:
 cockpitname: nsa
 # bittorrent
 btname: bt1
+# nfsserver
+nfsport: "29351"
diff --git a/host_vars/ns2.casperlefantom.net/main.yml b/host_vars/ns2.casperlefantom.net/main.yml
index ee82bc0..b6e2558 100644
--- a/host_vars/ns2.casperlefantom.net/main.yml
+++ b/host_vars/ns2.casperlefantom.net/main.yml
@@ -13,3 +13,5 @@ imhidden: hzjexvat7cebtabc65p63s6faa44k4u2iqpdrv5yl3pbvjopylqlncyd.onion
 # torrelay
 process:
   - { id: 09, orport: 995 }
+# nfsserver
+nfsport: "29391"
diff --git a/roles/nfsserver/files/stunnel-nfsd@.service b/roles/nfsserver/files/stunnel-nfsd@.service
new file mode 100644
index 0000000..d4fba67
--- /dev/null
+++ b/roles/nfsserver/files/stunnel-nfsd@.service
@@ -0,0 +1,9 @@
+#
+# Ansible managed.
+#
+[Unit]
+Description=NFS over stunnel/TLS server
+
+[Service]
+ExecStart=-/usr/bin/stunnel /etc/stunnel/nfsd.conf
+StandardInput=socket
diff --git a/roles/nfsserver/handlers/main.yml b/roles/nfsserver/handlers/main.yml
new file mode 100644
index 0000000..8db0dde
--- /dev/null
+++ b/roles/nfsserver/handlers/main.yml
@@ -0,0 +1 @@
+- import_tasks: systemd.yml
diff --git a/roles/nfsserver/handlers/systemd.yml b/roles/nfsserver/handlers/systemd.yml
new file mode 100644
index 0000000..00cc177
--- /dev/null
+++ b/roles/nfsserver/handlers/systemd.yml
@@ -0,0 +1,9 @@
+- name: reload systemd
+  systemd:
+    daemon_reload: yes
+
+- name: launch nfsd socket
+  service:
+    name: stunnel-nfsd.socket
+    state: started
+    enabled: no
diff --git a/roles/nfsserver/tasks/fw.yml b/roles/nfsserver/tasks/fw.yml
index ad3d0a4..d4980bb 100644
--- a/roles/nfsserver/tasks/fw.yml
+++ b/roles/nfsserver/tasks/fw.yml
@@ -4,3 +4,10 @@
     permanent: yes
     immediate: yes
     state: enabled
+
+- name: Ouverture port secondaire IPv4 NAT
+  firewalld:
+    port: "{{ nfsport }}/tcp"
+    permanent: yes
+    immediate: yes
+    state: enabled
diff --git a/roles/nfsserver/tasks/main.yml b/roles/nfsserver/tasks/main.yml
index 600b109..b9705ba 100644
--- a/roles/nfsserver/tasks/main.yml
+++ b/roles/nfsserver/tasks/main.yml
@@ -1,2 +1,3 @@
 - import_tasks: crt.yml
+- import_tasks: stunnel.yml
 - import_tasks: fw.yml
diff --git a/roles/nfsserver/tasks/stunnel.yml b/roles/nfsserver/tasks/stunnel.yml
new file mode 100644
index 0000000..4f1b56c
--- /dev/null
+++ b/roles/nfsserver/tasks/stunnel.yml
@@ -0,0 +1,36 @@
+- name: Installation config stunnel
+  template:
+    src: "nfsd.conf.j2"
+    dest: "/etc/stunnel/nfsd.conf"
+    mode: 0644
+
+- name: Installation du service systemd
+  copy:
+    src: "stunnel-nfsd@.service"
+    dest: "/etc/systemd/system/"
+    owner: root
+    group: root
+    mode: 0644
+  notify: reload systemd
+
+- name: Installation du socket systemd
+  template:
+    src: "stunnel-nfsd.socket.j2"
+    dest: "/etc/systemd/system/stunnel-nfsd.socket"
+    mode: 0644
+  notify:
+    - reload systemd
+    - launch nfsd socket
+
+- name: Création du répertoire du chroot
+  file:
+    path: /var/stunnel/chroot/etc
+    state: directory
+
+- name: Création des fichiers du chroot
+  file:
+    path: "/var/stunnel/chroot/etc/{{ item }}"
+    state: touch
+  loop:
+    - hosts.allow
+    - hosts.deny
diff --git a/roles/nfsserver/templates/nfsd.conf.j2 b/roles/nfsserver/templates/nfsd.conf.j2
new file mode 100644
index 0000000..c1e9cf5
--- /dev/null
+++ b/roles/nfsserver/templates/nfsd.conf.j2
@@ -0,0 +1,39 @@
+#
+# {{ ansible_managed }}
+#
+#GLOBAL#######################################################
+
+TIMEOUTidle     =       600
+renegotiation   =       no
+        FIPS    =       no
+        options =       NO_SSLv2
+        options =       NO_SSLv3
+        options =       SINGLE_DH_USE
+        options =       SINGLE_ECDH_USE
+        options =       CIPHER_SERVER_PREFERENCE
+        syslog  =       yes
+        debug   =       5
+        setuid  =       nobody
+        setgid  =       nobody
+        chroot  =       /var/stunnel/chroot
+
+        service =       stunnel-nfsd
+        ; cd /var/empty; mkdir -p stunnel/etc; cd stunnel/etc;
+        ; echo 'MC-nfsd: ALL EXCEPT 5.6.7.8' >> hosts.deny;
+        ; chcon -t stunnel_etc_t hosts.deny
+
+        curve   =       secp521r1
+        ; https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
+        ciphers=ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
+
+#CREDENTIALS##################################################
+
+        verify  =       2
+        CAfile  =       /etc/pki/tls/certs/mon-ca.crt
+        CRLfile =       /etc/pki/tls/certs/crt-crl.pem
+        cert    =       /etc/pki/tls/certs/{{ maindomain }}.nfs.fullchain.crt
+        key     =       /etc/pki/tls/private/{{ maindomain }}.nfs.key
+
+#ROLE#########################################################
+
+        connect =       localhost:2049
diff --git a/roles/nfsserver/templates/stunnel-nfsd.socket.j2 b/roles/nfsserver/templates/stunnel-nfsd.socket.j2
new file mode 100644
index 0000000..32a06d1
--- /dev/null
+++ b/roles/nfsserver/templates/stunnel-nfsd.socket.j2
@@ -0,0 +1,14 @@
+#
+# {{ ansible_managed }}
+#
+[Unit]
+Description=NFS over stunnel/TLS server
+
+[Socket]
+ListenStream={{ nfsport }}
+ListenStream=443
+Accept=yes
+TimeoutSec=600
+
+[Install]
+WantedBy=sockets.target