conf added

roles/autofs_client/tasks/main.yml

@@ -0,0 +1,42 @@
+- block:
+  - name: include vault
+    ansible.builtin.include_vars:
+      file: jaydee.yml
+  - name: Install autofs
+    ansible.builtin.apt:
+      name: 
+        - autofs
+        - cifs-utils
+      state: present
+
+  - name: Creating a file with content
+    copy:
+      dest: "/etc/auto.auth"
+      content: |
+        username={{ samba_user }}
+        password={{ samba_password }}
+        
+  - name: Creating a file with content
+    copy:
+      dest: "/etc/auto.nas"
+      content: |
+        nas-data   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Data
+        nas-docker-data   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/docker_data
+        nas-photo   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Photo
+        nas-public   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Public
+        nas-install   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/install
+        nas-media   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Media
+        nas-downloads   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/downloads
+
+  - name: Reconfigure zabbix agent Server
+    ansible.builtin.lineinfile:
+      path: /etc/auto.master
+      regexp: "^/media/nas.*"
+      insertafter: '^/media/nas'
+      line: "/media/nas   /etc/auto.nas --timeout 360 --ghost"
+
+  - name: Restart docker service
+    ansible.builtin.service:
+      name: autofs
+      state: restarted
+  become: true

roles/fail2ban/files/action.d/banan.conf

@@ -0,0 +1,8 @@
+[Definition]
+
+#actionban = ssh -i /config/fail2ban/id_rsa2 admin@192.168.77.1 'firewall ban ip <ip> "<name>"'
+#actionban = touch  /ban/<ip>
+actionban = docker exec blockips-unifi php /add_block_firewall.php <ip> >> /tmp/lala
+
+#actionunban = touch  /unban/<ip>
+actionunban = docker exec blockips-unifi php /del_block_firewall.php <ip> >> /tmp/lala

roles/fail2ban/files/filter.d/bad-auth.conf

@@ -0,0 +1,4 @@
+# Fail2Ban configuration file
+[Definition]
+failregex = .* client login failed: .+ client:\ <HOST>
+ignoreregex =

roles/fail2ban/files/filter.d/nextcloud.conf

@@ -0,0 +1,5 @@
+[Definition]
+_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
+failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
+            ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
+datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"

roles/fail2ban/files/filter.d/sshd.conf

@@ -0,0 +1,138 @@
+# Fail2Ban filter for openssh
+#
+# If you want to protect OpenSSH from being bruteforced by password
+# authentication then get public key authentication working before disabling
+# PasswordAuthentication in sshd_config.
+#
+#
+# "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config
+#
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+[DEFAULT]
+
+_daemon = sshd
+
+# optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "
+__pref = (?:(?:error|fatal): (?:PAM: )?)?
+# optional suffix (logged from several ssh versions) like " [preauth]"
+#__suff = (?: port \d+)?(?: \[preauth\])?\s*
+__suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*
+__on_port_opt = (?: (?:port \d+|on \S+)){0,2}
+# close by authenticating user:
+__authng_user = (?: (?:invalid|authenticating) user <F-USER>\S+|.*?</F-USER>)?
+
+# for all possible (also future) forms of "no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found",
+# see ssherr.c for all possible SSH_ERR_..._ALG_MATCH errors.
+__alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+)
+
+# PAM authentication mechanism, can be overridden, e. g. `filter = sshd[__pam_auth='pam_ldap']`:
+__pam_auth = pam_[a-z]+
+
+[Definition]
+
+prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID>%(__pref)s<F-CONTENT>.+</F-CONTENT>$
+
+cmnfailre = ^[aA]uthentication (?:failure|error|failed) for <F-USER>.*</F-USER> from <HOST>( via \S+)?%(__suff)s$
+            ^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>%(__suff)s$
+            <cmnfailre-failed-pub-<publickey>>
+            ^Failed <cmnfailed> for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
+            ^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST>
+            ^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>%(__suff)s$
+            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because not listed in AllowUsers%(__suff)s$
+            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because listed in DenyUsers%(__suff)s$
+            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because not in any group%(__suff)s$
+            ^refused connect from \S+ \(<HOST>\)
+            ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*3: .*: Auth fail%(__suff)s$
+            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because a group is listed in DenyGroups%(__suff)s$
+            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because none of user's groups are listed in AllowGroups%(__suff)s$
+            ^<F-NOFAIL>%(__pam_auth)s\(sshd:auth\):\s+authentication failure;</F-NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT_USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>)?%(__suff)s$
+            ^maximum authentication attempts exceeded for <F-USER>.*</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?%(__suff)s$
+            ^User <F-USER>\S+|.*?</F-USER> not allowed because account is locked%(__suff)s
+            ^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+</F-USER> <HOST>%(__on_port_opt)s:\s*Change of username or service not allowed:\s*.*\[preauth\]\s*$
+            ^Disconnecting: Too many authentication failures(?: for <F-USER>\S+|.*?</F-USER>)?%(__suff)s$
+            ^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>%(__on_port_opt)s:\s*11:
+            <mdre-<mode>-other>
+            ^<F-MLFFORGET><F-MLFGAINED>Accepted \w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\S+</F-USER> from <HOST>(?:\s|$)
+
+cmnfailed-any = \S+
+cmnfailed-ignore = \b(?!publickey)\S+
+cmnfailed-invalid = <cmnfailed-ignore>
+cmnfailed-nofail = (?:<F-NOFAIL>publickey</F-NOFAIL>|\S+)
+cmnfailed = <cmnfailed-<publickey>>
+
+mdre-normal =
+# used to differentiate "connection closed" with and without `[preauth]` (fail/nofail cases in ddos mode)
+mdre-normal-other = ^<F-NOFAIL><F-MLFFORGET>(Connection (?:closed|reset)|Disconnected)</F-MLFFORGET></F-NOFAIL> (?:by|from)%(__authng_user)s <HOST>(?:%(__suff)s|\s*)$
+
+mdre-ddos = ^Did not receive identification string from <HOST>
+            ^kex_exchange_identification: (?:read: )?(?:[Cc]lient sent invalid protocol identifier|[Cc]onnection (?:closed by remote host|reset by peer))
+            ^Bad protocol version identification '.*' from <HOST>
+            ^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+:
+            ^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET> by peer
+            ^banner exchange: Connection from <HOST><__on_port_opt>: invalid format
+# same as mdre-normal-other, but as failure (without <F-NOFAIL> with [preauth] and with <F-NOFAIL> on no preauth phase as helper to identify address):
+mdre-ddos-other = ^<F-MLFFORGET>(Connection (?:closed|reset)|Disconnected)</F-MLFFORGET> (?:by|from)%(__authng_user)s <HOST>%(__on_port_opt)s\s+\[preauth\]\s*$
+                  ^<F-NOFAIL><F-MLFFORGET>(Connection (?:closed|reset)|Disconnected)</F-MLFFORGET></F-NOFAIL> (?:by|from)%(__authng_user)s <HOST>(?:%(__on_port_opt)s|\s*)$
+
+mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*14: No(?: supported)? authentication methods available
+            ^Unable to negotiate with <HOST>%(__on_port_opt)s: no matching <__alg_match> found.
+            ^Unable to negotiate a <__alg_match>
+            ^no matching <__alg_match> found:
+# part of mdre-ddos-other, but user name is supplied (invalid/authenticating) on [preauth] phase only:
+mdre-extra-other = ^<F-MLFFORGET>Disconnected</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+|.*?</F-USER> <HOST>%(__on_port_opt)s \[preauth\]\s*$
+
+mdre-aggressive = %(mdre-ddos)s
+                  %(mdre-extra)s
+# mdre-extra-other is fully included within mdre-ddos-other:
+mdre-aggressive-other = %(mdre-ddos-other)s
+
+# Parameter "publickey": nofail (default), invalid, any, ignore
+publickey = nofail
+# consider failed publickey for invalid users only:
+cmnfailre-failed-pub-invalid = ^Failed publickey for invalid user <F-USER>(?P<cond_user>\S+)|(?:(?! from ).)*?</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
+# consider failed publickey for valid users too (don't need RE, see cmnfailed):
+cmnfailre-failed-pub-any =
+# same as invalid, but consider failed publickey for valid users too, just as no failure (helper to get IP and user-name only, see cmnfailed):
+cmnfailre-failed-pub-nofail = <cmnfailre-failed-pub-invalid>
+# don't consider failed publickey as failures (don't need RE, see cmnfailed):
+cmnfailre-failed-pub-ignore =
+
+cfooterre = ^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>
+
+failregex = %(cmnfailre)s
+            <mdre-<mode>>
+            %(cfooterre)s
+
+# Parameter "mode": normal (default), ddos, extra or aggressive (combines all)
+# Usage example (for jail.local):
+#   [sshd]
+#   mode = extra
+#   # or another jail (rewrite filter parameters of jail):
+#   [sshd-aggressive]
+#   filter = sshd[mode=aggressive]
+#
+mode = normal
+
+#filter = sshd[mode=aggressive]
+
+ignoreregex =
+
+maxlines = 1
+
+journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd
+
+# DEV Notes:
+#
+#   "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
+#   it is coming before use of <HOST> which is not hard-anchored at the end as well,
+#   and later catch-all's could contain user-provided input, which need to be greedily
+#   matched away first.
+#
+# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black and Sergey Brester aka sebres
+# Rewritten using prefregex (and introduced "mode" parameter) by Serg G. Brester.

roles/fail2ban/files/jail.d/bad-auth.conf

@@ -0,0 +1,14 @@
+[bad-auth]
+enabled = true
+backend = systemd
+filter = bad-auth
+journalmatch='CONTAINER_TAG=mailu-front'
+bantime = 36000000
+findtime = 36000
+maxretry = 2
+sender = fail2ban@sectorq.eu
+destemail = jaydee@sectorq.eu
+ignoreip = 192.168.77.0/24 87.197.162.37
+#action = %(action_mwl)s
+action =  banan
+          %(action_mwl)s

roles/fail2ban/files/jail.d/nextcloud.conf

@@ -0,0 +1,15 @@
+[nextcloud]
+backend = auto
+enabled = true
+port = 80,443
+protocol = tcp
+filter = nextcloud
+bantime = 36000000
+findtime = 36000
+maxretry = 2
+ignoreip = 192.168.77.0/24 87.197.162.37
+sender = fail2ban@sectorq.eu
+destemail = jaydee@sectorq.eu
+logpath = /share/docker_data/nextcloud/app/data/nextcloud.log
+action =  banan
+          %(action_mwl)s

roles/fail2ban/files/jail.d/sshd.conf

@@ -0,0 +1,17 @@
+[sshd]
+
+# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
+# normal (default), ddos, extra or aggressive (combines all).
+# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
+#mode   = normal
+enabled = true
+port    = ssh
+bantime = 36000000
+findtime = 36000
+maxretry = 2
+sender = fail2ban@sectorq.eu
+destemail = jaydee@sectorq.eu
+ignoreip = 192.168.77.0/24 87.197.162.37
+backend = systemd
+action = %(action_mwl)s
+        banan

roles/fail2ban/tasks/main.yml

@@ -0,0 +1,149 @@
+- block:
+  - name: Install ldap packages
+    ansible.builtin.apt:
+      name: 
+        - libpam-ldapd
+        - ldap-utils
+        - libnss-ldapd
+  # - name: Reconfigure ldap base
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/ldap.conf
+  #     regexp: "^base "
+  #     line: "base dc=sectorq,dc=eu"
+
+  # - name: Reconfigure ldap uri
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/ldap.conf
+  #     regexp: "^uri ldap.*"
+  #     line: "uri ldaps://ldap-server.loc/"
+  # - name: Reconfigure ldap version
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/ldap.conf
+  #     regexp: "^ldap_version.*"
+  #     line: "ldap_version 3"
+
+  # - name: Reconfigure ldap rootbinddn
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/ldap.conf
+  #     regexp: "^rootbinddn.*"
+  #     line: "rootbinddn cn=admin,dc=sectorq,dc=eu"
+  - name: Reconfigure common-session
+    ansible.builtin.lineinfile:
+      path: /etc/pam.d/common-session
+      regexp: "^session optional pam_mkhomedir.so.*"
+      line: "session optional pam_mkhomedir.so skel=/etc/skel umask=077"
+  - name: Reconfigure common-session
+    ansible.builtin.lineinfile:
+      path: /etc/pam.d/common-session
+      regexp: "^session.*pam_ldap.so.*"
+      line: "session [success=ok default=ignore]     pam_ldap.so minimum_uid=1000"      
+  - name: Reconfigure common-password
+    ansible.builtin.lineinfile:
+      path: /etc/pam.d/common-password
+      regexp: "^password.*success=1 user_unknown=ignore default=die.*"
+      line: "password        [success=1 default=ignore]     pam_ldap.so minimum_uid=1000 try_first_pass"
+  - name: Reconfigure nsswitch passwd
+    ansible.builtin.lineinfile:
+      path: /etc/nsswitch.conf
+      regexp: "^passwd:.*"
+      line: "passwd:         compat systemd ldap"
+  - name: Reconfigure nsswitch group
+    ansible.builtin.lineinfile:
+      path: /etc/nsswitch.conf
+      regexp: "^group:.*"
+      line: "group:          compat systemd ldap"
+  - name: Reconfigure nsswitch shadow
+    ansible.builtin.lineinfile:
+      path: /etc/nsswitch.conf
+      regexp: "^shadow:.*"
+      line: "shadow:         compat ldap"
+
+  - name: Reconfigure nslcd uri
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^uri ldap.*"
+      line: "uri ldap://192.168.77.101:2389/"
+
+
+  - name: Reconfigure ldap base
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^base "
+      line: "base dc=sectorq,dc=eu"
+
+
+  - name: Reconfigure nslcd binddn
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^binddn"
+      line: "binddn cn=jaydee,dc=users,dc=sectorq,dc=eu"
+      
+  - name: Reconfigure nslcd bindpw
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^bindpw"
+      line: "bindpw {{ ldap_admin_password }}"
+  # - name: Reconfigure ldap base
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/nslcd.conf
+  #     regexp: "^#ssl"
+  #     line: "ssl start_tls"
+  - name: Reconfigure nslcd tls_reqcert
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^tls_reqcert"
+      line: "tls_reqcert allow"
+  - name: Restart nslcd service
+    ansible.builtin.service:
+      name: nslcd.service
+      state: restarted
+
+  - name: Creating a file with content
+    copy:
+      dest: "/usr/local/bin/fetchSSHKeysFromLDAP"
+      content: |
+        #!/usr/bin/bash
+        ldapsearch  -x '(&(objectClass=ldapPublicKey)(cn='"$1"'))' 'sshPublicKey' |     sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'  
+      mode: '0755'
+  - name: Reconfigure sshd
+    ansible.builtin.lineinfile:
+      path: /etc/ssh/sshd_config
+      regexp: "^#AuthorizedKeysCommand *"
+      line: "AuthorizedKeysCommand /usr/local/bin/fetchSSHKeysFromLDAP"
+
+  - name: Reconfigure sshd
+    ansible.builtin.lineinfile:
+      path: /etc/ssh/sshd_config
+      regexp: "^#AuthorizedKeysCommandUser *"
+      line: "AuthorizedKeysCommandUser root"
+  - name: Create a directory LDAP if it does not exist
+    ansible.builtin.file:
+      path: /etc/ldap/
+      state: directory
+      mode: '0755'
+  - name: Creating a file with content
+    copy:
+      dest: "/etc/ldap/ldap.conf"
+      content: |
+        #
+        # LDAP Defaults
+        #
+
+        # See ldap.conf(5) for details
+        # This file should be world readable but not world writable.
+
+        BASE    dc=sectorq,dc=eu
+        URI     ldap://192.168.77.101:2389
+
+        #SIZELIMIT      12
+        #TIMELIMIT      15
+        #DEREF          never
+
+        # TLS certificates (needed for GnuTLS)
+        TLS_CACERT      /etc/ssl/certs/ca-certificates.crt
+  
+  - name: Restart sshd service
+    ansible.builtin.service:
+      name: sshd.service
+      state: restarted
+  become: true

roles/ldap_client/tasks/main.yml

@@ -0,0 +1,149 @@
+- block:
+  - name: Install ldap packages
+    ansible.builtin.apt:
+      name: 
+        - libpam-ldapd
+        - ldap-utils
+        - libnss-ldapd
+  # - name: Reconfigure ldap base
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/ldap.conf
+  #     regexp: "^base "
+  #     line: "base dc=sectorq,dc=eu"
+
+  # - name: Reconfigure ldap uri
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/ldap.conf
+  #     regexp: "^uri ldap.*"
+  #     line: "uri ldaps://ldap-server.loc/"
+  # - name: Reconfigure ldap version
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/ldap.conf
+  #     regexp: "^ldap_version.*"
+  #     line: "ldap_version 3"
+
+  # - name: Reconfigure ldap rootbinddn
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/ldap.conf
+  #     regexp: "^rootbinddn.*"
+  #     line: "rootbinddn cn=admin,dc=sectorq,dc=eu"
+  - name: Reconfigure common-session
+    ansible.builtin.lineinfile:
+      path: /etc/pam.d/common-session
+      regexp: "^session optional pam_mkhomedir.so.*"
+      line: "session optional pam_mkhomedir.so skel=/etc/skel umask=077"
+  - name: Reconfigure common-session
+    ansible.builtin.lineinfile:
+      path: /etc/pam.d/common-session
+      regexp: "^session.*pam_ldap.so.*"
+      line: "session [success=ok default=ignore]     pam_ldap.so minimum_uid=1000"      
+  - name: Reconfigure common-password
+    ansible.builtin.lineinfile:
+      path: /etc/pam.d/common-password
+      regexp: "^password.*success=1 user_unknown=ignore default=die.*"
+      line: "password        [success=1 default=ignore]     pam_ldap.so minimum_uid=1000 try_first_pass"
+  - name: Reconfigure nsswitch passwd
+    ansible.builtin.lineinfile:
+      path: /etc/nsswitch.conf
+      regexp: "^passwd:.*"
+      line: "passwd:         compat systemd ldap"
+  - name: Reconfigure nsswitch group
+    ansible.builtin.lineinfile:
+      path: /etc/nsswitch.conf
+      regexp: "^group:.*"
+      line: "group:          compat systemd ldap"
+  - name: Reconfigure nsswitch shadow
+    ansible.builtin.lineinfile:
+      path: /etc/nsswitch.conf
+      regexp: "^shadow:.*"
+      line: "shadow:         compat ldap"
+
+  - name: Reconfigure nslcd uri
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^uri ldap.*"
+      line: "uri ldap://192.168.77.101:2389/"
+
+
+  - name: Reconfigure ldap base
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^base "
+      line: "base dc=sectorq,dc=eu"
+
+
+  - name: Reconfigure nslcd binddn
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^binddn"
+      line: "binddn cn=jaydee,dc=users,dc=sectorq,dc=eu"
+      
+  - name: Reconfigure nslcd bindpw
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^bindpw"
+      line: "bindpw {{ ldap_admin_password }}"
+  # - name: Reconfigure ldap base
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/nslcd.conf
+  #     regexp: "^#ssl"
+  #     line: "ssl start_tls"
+  - name: Reconfigure nslcd tls_reqcert
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^tls_reqcert"
+      line: "tls_reqcert allow"
+  - name: Restart nslcd service
+    ansible.builtin.service:
+      name: nslcd.service
+      state: restarted
+
+  - name: Creating a file with content
+    copy:
+      dest: "/usr/local/bin/fetchSSHKeysFromLDAP"
+      content: |
+        #!/usr/bin/bash
+        ldapsearch  -x '(&(objectClass=ldapPublicKey)(cn='"$1"'))' 'sshPublicKey' |     sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'  
+      mode: '0755'
+  - name: Reconfigure sshd
+    ansible.builtin.lineinfile:
+      path: /etc/ssh/sshd_config
+      regexp: "^#AuthorizedKeysCommand *"
+      line: "AuthorizedKeysCommand /usr/local/bin/fetchSSHKeysFromLDAP"
+
+  - name: Reconfigure sshd
+    ansible.builtin.lineinfile:
+      path: /etc/ssh/sshd_config
+      regexp: "^#AuthorizedKeysCommandUser *"
+      line: "AuthorizedKeysCommandUser root"
+  - name: Create a directory LDAP if it does not exist
+    ansible.builtin.file:
+      path: /etc/ldap/
+      state: directory
+      mode: '0755'
+  - name: Creating a file with content
+    copy:
+      dest: "/etc/ldap/ldap.conf"
+      content: |
+        #
+        # LDAP Defaults
+        #
+
+        # See ldap.conf(5) for details
+        # This file should be world readable but not world writable.
+
+        BASE    dc=sectorq,dc=eu
+        URI     ldap://192.168.77.101:2389
+
+        #SIZELIMIT      12
+        #TIMELIMIT      15
+        #DEREF          never
+
+        # TLS certificates (needed for GnuTLS)
+        TLS_CACERT      /etc/ssl/certs/ca-certificates.crt
+  
+  - name: Restart sshd service
+    ansible.builtin.service:
+      name: sshd.service
+      state: restarted
+  become: true

roles/vnc_server/tasks/main.yml

@@ -0,0 +1,24 @@
+- name: Install vnc packages
+  ansible.builtin.apt:
+    name: 
+      - tigervnc-standalone-server
+      - tigervnc-common
+    update_cache: yes
+
+
+- name: Creating a file with content
+  copy:
+    dest: "/home/jd/.vnc/config"
+    content: |
+      session=cinnamon
+      geometry=1200x721
+      localhost
+      alwaysshared
+
+  - name: Reconfigure zabbix agent Server
+    ansible.builtin.lineinfile:
+      path: "/etc/tigervnc/vncserver.users"
+      regexp: "^:1=jd"
+      line: ":1=jd"
+    become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+