resturcure the setup.yaml and hosts safer this way and add CSP for grafana

Author: Grotax

.github/copilot/README.md

@@ -17,7 +17,7 @@ This project provisions Freifunk Südholstein gateways and related services. The
 
 - README.md: deployment, usage, and vault guidance
 - setup.yml: main playbook with gateway, service, and monitoring roles
-- hosts.yml: inventory for gateways, services, and monitoring hosts
+- hosts.yml: inventory for gateways, split service groups, and monitoring hosts
 - group_vars/versions.yml: shared software versions
 - group_vars/secrets.yml: shared encrypted vars
 - host_vars/: host-specific secret and config values
@@ -26,15 +26,18 @@ This project provisions Freifunk Südholstein gateways and related services. The
 ## Host groups
 
 - gateways: complete production router deployment
-- services: lightweight service-only hosts
+- services_map: map service host roles
+- services_web: web service host roles
 - monitoring: Prometheus/Grafana stack
 
 ## Typical workflow
 
 ```bash
 ansible-playbook --vault-id=fastd_key@prompt setup.yml
 ansible-playbook --vault-id=fastd_key@prompt setup.yml --limit gateways
-ansible-playbook --vault-id=fastd_key@prompt setup.yml --limit services
+ansible-playbook --vault-id=fastd_key@prompt setup.yml --limit "services_map:services_web"
+ansible-playbook --vault-id=fastd_key@prompt setup.yml --limit services_map
+ansible-playbook --vault-id=fastd_key@prompt setup.yml --limit services_web
 ansible-playbook --vault-id=fastd_key@prompt setup.yml --check
 ansible-lint
 ```

README.md

@@ -1,7 +1,7 @@
 # Ansible
 [![Ansible Lint](https://github.com/ffsh/ansible/actions/workflows/ansible-lint.yml/badge.svg?branch=main)](https://github.com/ffsh/ansible/actions/workflows/ansible-lint.yml)
 
-This repository holds the Ansible playbook to deploy a ffsh gateway in the standard configuration and to provision batman-only service hosts.
+This repository holds the Ansible playbook to deploy a ffsh gateway in the standard configuration and to provision dedicated service hosts.
 It is based on https://docs.freifunk-suedholstein.de/de/1.5/gateway.html but changes were made where it was plausible.
 
 ## requirements
@@ -48,7 +48,10 @@ That way Ansible will be able to automatically detect the right ssh key and conn
 ## hosts
 If you want to deploy to a new gateway you need to add it to the `hosts.yml` file in the repo, just compare it to brunsbach and add your own details.
 
-If you want to add a batman-only service host, add it to the `services` group in `hosts.yml`. These hosts only receive the `batman` and `batctl` roles.
+If you want to add a service host, place it in the dedicated service group in `hosts.yml`:
+
+- `services_map` for the map stack (`batman`, `batctl`, `grafana_public`, `meshviewer`)
+- `services_web` for the web stack (`batman`, `batctl`, `website`, `firmware_release`, `firmware_selector`)
 
 The standalone DNS host belongs to the `dns` group. The DNS play only installs
 node_exporter and bind_exporter; it does not manage the existing BIND service,
@@ -129,10 +132,22 @@ Run playbook on all gateways listed in `hosts`:
 ansible-playbook --vault-id=fastd_key@prompt setup.yml --limit gateways
 ```
 
-Run the batman-only service hosts (web-server map-server):
+Run both service hosts:
+
+```bash
+ansible-playbook --vault-id=fastd_key@prompt setup.yml --limit "services_map:services_web"
+```
+
+Run only the map service host:
+
+```bash
+ansible-playbook --vault-id=fastd_key@prompt setup.yml --limit services_map
+```
+
+Run only the web service host:
 
 ```bash
-ansible-playbook --vault-id=fastd_key@prompt setup.yml --limit services
+ansible-playbook --vault-id=fastd_key@prompt setup.yml --limit services_web
 ```
 
 Run the monitoring host:

group_vars/services.yml group_vars/services_web.ymlgroup_vars/services.yml renamed to group_vars/services_web.yml

@@ -45,11 +45,16 @@ gateways:
   vars:
     ansible_user: root
 
-services:
+services_map:
   hosts:
     map-ffsh:
       ansible_ssh_host: 116.203.148.80
       blackbox_http_url: https://map.freifunk-suedholstein.de/
+  vars:
+    ansible_user: root
+
+services_web:
+  hosts:
     web-ffsh:
       ansible_ssh_host: 116.203.27.68
       blackbox_http_url: https://freifunk-suedholstein.de/

hosts.yml

@@ -1,7 +1,3 @@
-- name: Skip firmware release helper on non-target hosts
-  ansible.builtin.meta: end_role
-  when: inventory_hostname != firmware_release_target_host
-
 - name: Install firmware release helper dependencies
   ansible.builtin.apt:
     name:

roles/firmware_release/tasks/main.yml

@@ -1,7 +1,3 @@
-- name: Skip firmware selector on non-target hosts
-  ansible.builtin.meta: end_role
-  when: inventory_hostname != firmware_selector_target_host
-
 - name: Install firmware selector dependency
   ansible.builtin.apt:
     name: git

roles/firmware_selector/tasks/main.yml

@@ -1,8 +1,3 @@
----
-- name: Skip public Grafana on non-map hosts
-  ansible.builtin.meta: end_role
-  when: inventory_hostname != "map-ffsh"
-
 - name: Install prerequisites for Grafana repository
   ansible.builtin.apt:
     name: gnupg

roles/grafana_public/tasks/main.yml

@@ -22,6 +22,7 @@ server {
     ssl_prefer_server_ciphers off;
 
     add_header Strict-Transport-Security "max-age=31536000" always;
+    add_header Content-Security-Policy "frame-ancestors https://freifunk-suedholstein.de https://*.freifunk-suedholstein.de" always;
 
     location / {
         proxy_pass http://127.0.0.1:3000;

roles/grafana_public/templates/grafana.conf.j2

@@ -1,8 +1,3 @@
----
-- name: Skip meshviewer on non-target hosts
-  ansible.builtin.meta: end_role
-  when: inventory_hostname != meshviewer_target_host
-
 - name: Install meshviewer dependencies
   ansible.builtin.apt:
     name:

roles/meshviewer/tasks/main.yml

@@ -66,8 +66,67 @@
       tags:
         - always
 
-- name: Services Deployment
-  hosts: services
+- name: Services Deployment (map)
+  hosts: services_map
+  serial: "{{ deploy_serial | default(1) }}"
+  vars_files:
+    - group_vars/versions.yml
+  vars:
+    users:
+      - username: root
+  pre_tasks:
+    - name: Load shared deployment secrets
+      ansible.builtin.include_vars:
+        file: group_vars/secrets.yml
+        name: vault_secrets
+      tags:
+        - always
+
+    - name: Abort if target OS is not Ubuntu 24.04
+      ansible.builtin.assert:
+        that:
+          - ansible_facts["distribution"] == "Ubuntu"
+          - ansible_facts["distribution_version"] == "24.04"
+        fail_msg: >-
+          Unsupported target OS: {{ ansible_facts["distribution"] }} {{
+          ansible_facts["distribution_version"] }}. This playbook supports
+          Ubuntu 24.04 only.
+        success_msg: "Target OS check passed: Ubuntu 24.04"
+      tags:
+        - always
+
+    - name: Update apt cache
+      ansible.builtin.apt:
+        update_cache: true
+  roles:
+    - {role: batman, tags: "batman-adv"}
+    - {role: batctl, tags: "batctl"}
+    - {role: grafana_public, tags: "grafana-public"}
+    - {role: meshviewer, tags: "meshviewer"}
+
+  post_tasks:
+    - name: Check if reboot is required
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+      register: system_reboot_required
+      changed_when: false
+      tags:
+        - always
+
+    - name: Reboot if required
+      ansible.builtin.reboot:
+        msg: Reboot triggered by Ansible because /var/run/reboot-required exists.
+        reboot_timeout: 900
+        connect_timeout: 10
+        post_reboot_delay: 15
+      when:
+        - system_reboot_required.stat.exists
+        - not ansible_check_mode
+      tags:
+        - always
+
+- name: Services Deployment (web)
+  hosts: services_web
   serial: "{{ deploy_serial | default(1) }}"
   vars_files:
     - group_vars/versions.yml
@@ -104,8 +163,6 @@
     - {role: firmware_release, tags: "firmware-release"}
     - {role: firmware_selector, tags: "firmware-selector"}
     - {role: website, tags: "website"}
-    - {role: grafana_public, tags: "grafana-public"}
-    - {role: meshviewer, tags: "meshviewer"}
 
   post_tasks:
     - name: Check if reboot is required