diff options
6 files changed, 34 insertions, 6 deletions
diff --git a/roles/bacula-dir/templates/etc/bacula/bacula-dir.conf.j2 b/roles/bacula-dir/templates/etc/bacula/bacula-dir.conf.j2 index 790ae64..42b5f74 100644 --- a/roles/bacula-dir/templates/etc/bacula/bacula-dir.conf.j2 +++ b/roles/bacula-dir/templates/etc/bacula/bacula-dir.conf.j2 @@ -1,36 +1,39 @@ # # Default Bacula Director Configuration file # For Bacula release 5.2.6 (21 February 2012) -- debian jessie/sid # Director { # define myself Name = {{ inventory_hostname_short }}-dir @|"sed -n '/^bconsole\\s/ {s//Password = /p; q}' /etc/bacula/passwords-dir" Messages = Daemon Working Directory = /var/lib/bacula Pid Directory = /var/run/bacula QueryFile = "/etc/bacula/scripts/query.sql" Maximum Concurrent Jobs = 1 DirAddress = 127.0.0.1 DirSourceAddress = 127.0.0.1 DirPort = 9101 + FDConnectTimeout = 5 min + SDConnectTimeout = 5 min + Heartbeat Interval = 1 min } JobDefs { Name = DefaultJob Type = Backup Level = Incremental Storage = {{ hostvars[ groups['bacula-sd'][0] ].inventory_hostname_short }}-sd Messages = Standard Accurate = yes #Rerun Failed Levels = yes Reschedule On Error = yes Reschedule Interval = 17 min Reschedule Times = 3 Pool = Default Priority = 10 Write Bootstrap = "/var/lib/bacula/%n.bsr" } JobDefs { @@ -374,40 +377,41 @@ Client { {% endif %} FDPort = 9112 Catalog = MyCatalog @|"sed -n '/^{{ hostvars[fd].inventory_hostname_short }}-fd\\s/ {s//Password = /p; q}' /etc/bacula/passwords-dir" File Retention = 4 months Job Retention = 5 months AutoPrune = yes #Maximum Bandwidth = 1mb/s } {% endfor %} # Definition of file storage device Storage { Name = {{ hostvars[ groups['bacula-sd'][0] ].inventory_hostname_short }}-sd Address = 127.0.0.1 SDPort = 9113 @|"sed -n '/^{{ hostvars[ groups['bacula-sd'][0] ].inventory_hostname_short }}-sd\\s/ {s//Password = /p; q}' /etc/bacula/passwords-dir" Device = FileStorage Media Type = File + Heartbeat Interval = 1 min } # Default pool definition Pool { Name = Default Pool Type = Backup Recycle = yes AutoPrune = yes Volume Retention = 3 months Maximum Volume Bytes = 5GB Label Format = "Default-${NumVols:p/4/0/r}" } # Scratch pool definition Pool { Name = Scratch Pool Type = Backup Maximum Volume Bytes = 5GB Label Format = "Scratch-${NumVols:p/4/0/r}" diff --git a/roles/bacula-dir/templates/etc/stunnel/bacula-dir.conf.j2 b/roles/bacula-dir/templates/etc/stunnel/bacula-dir.conf.j2 index e6ab105..6219aff 100644 --- a/roles/bacula-dir/templates/etc/stunnel/bacula-dir.conf.j2 +++ b/roles/bacula-dir/templates/etc/stunnel/bacula-dir.conf.j2 @@ -6,43 +6,51 @@ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = foreground = yes ; Only log messages at severity warning (4) and higher debug = 4 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem key = /etc/stunnel/certs/{{ inventory_hostname_short }}-dir.key client = yes socket = a:SO_BINDTODEVICE=lo -; Some performance tunings socket = l:TCP_NODELAY=1 +socket = l:SO_KEEPALIVE=1 +socket = l:TCP_KEEPIDLE=60 +socket = l:TCP_KEEPINTVL=15 +socket = l:TCP_KEEPCNT=116 + socket = r:TCP_NODELAY=1 +socket = r:SO_KEEPALIVE=1 +socket = r:TCP_KEEPIDLE=60 +socket = r:TCP_KEEPINTVL=15 +socket = r:TCP_KEEPCNT=116 ; Prevent MITM attacks verify = 4 ; Disable support for insecure protocols options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = NO_COMPRESSION ; These options provide additional security at some performance degradation options = SINGLE_ECDH_USE options = SINGLE_DH_USE ; Select permitted SSL ciphers ciphers = EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL ; ************************************************************************** diff --git a/roles/bacula-sd/templates/etc/bacula/bacula-sd.conf.j2 b/roles/bacula-sd/templates/etc/bacula/bacula-sd.conf.j2 index 683c70a..fbfdca5 100644 --- a/roles/bacula-sd/templates/etc/bacula/bacula-sd.conf.j2 +++ b/roles/bacula-sd/templates/etc/bacula/bacula-sd.conf.j2 @@ -1,39 +1,40 @@ # # Default Bacula Storage Daemon Configuration file # # For Bacula release 5.2.6 (21 February 2012) -- debian jessie/sid # # You may need to change the name of your tape drive # on the "Archive Device" directive in the Device # resource. If you change the Name and/or the # "Media Type" in the Device resource, please ensure # that dird.conf has corresponding changes. # Storage { # define myself Name = {{ inventory_hostname_short }}-sd Working Directory = /var/lib/bacula Pid Directory = /var/run/bacula Maximum Concurrent Jobs = 20 SDAddress = 127.0.0.1 SDPort = 9113 + Heartbeat Interval = 1 min } # # List Directors who are permitted to contact Storage daemon # {% for dir in groups['bacula-dir'] | sort %} Director { Name = {{ hostvars[dir].inventory_hostname_short }}-dir @|"sed -n '/^{{ hostvars[dir].inventory_hostname_short }}-dir\\s/ {s//Password = /p; q}' /etc/bacula/passwords-sd" } # # Send all messages to the Director, # mount messages also are sent to the email address # Messages { Name = Standard director = {{ hostvars[dir].inventory_hostname_short }}-dir = all } {% endfor %} diff --git a/roles/bacula-sd/templates/etc/stunnel/bacula-sd.conf.j2 b/roles/bacula-sd/templates/etc/stunnel/bacula-sd.conf.j2 index f0234fa..051412c 100644 --- a/roles/bacula-sd/templates/etc/stunnel/bacula-sd.conf.j2 +++ b/roles/bacula-sd/templates/etc/stunnel/bacula-sd.conf.j2 @@ -4,43 +4,51 @@ ; setuid()/setgid() to the specified user/group in daemon mode setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = foreground = yes ; Only log messages at severity warning (4) and higher debug = 4 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/certs/{{ inventory_hostname_short }}-sd.pem key = /etc/stunnel/certs/{{ inventory_hostname_short }}-sd.key -; Some performance tunings socket = l:TCP_NODELAY=1 +socket = l:SO_KEEPALIVE=1 +socket = l:TCP_KEEPIDLE=60 +socket = l:TCP_KEEPINTVL=15 +socket = l:TCP_KEEPCNT=116 + socket = r:TCP_NODELAY=1 +socket = r:SO_KEEPALIVE=1 +socket = r:TCP_KEEPIDLE=60 +socket = r:TCP_KEEPINTVL=15 +socket = r:TCP_KEEPCNT=116 ; Prevent MITM attacks verify = 4 ; Disable support for insecure protocols options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = NO_COMPRESSION ; These options provide additional security at some performance degradation options = SINGLE_ECDH_USE options = SINGLE_DH_USE ; Select permitted SSL ciphers ciphers = EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL ; ************************************************************************** diff --git a/roles/common/templates/etc/bacula/bacula-fd.conf.j2 b/roles/common/templates/etc/bacula/bacula-fd.conf.j2 index a47bb90..432768b 100644 --- a/roles/common/templates/etc/bacula/bacula-fd.conf.j2 +++ b/roles/common/templates/etc/bacula/bacula-fd.conf.j2 @@ -13,29 +13,28 @@ Director { } # Send all messages except skipped files back to Director Messages { Name = Standard director = {{ hostvars[dir].inventory_hostname_short }}-dir = all, !skipped, !restored } {% endfor %} # # "Global" File daemon configuration specifications # FileDaemon { # define myself Name = {{ inventory_hostname_short }}-fd Working Directory = /var/lib/bacula Pid Directory = /var/run/bacula Maximum Concurrent Jobs = 20 FDAddress = 127.0.0.1 FDPort = 9112 FDSourceAddress = 127.0.0.1 -{% if 'bacula-dir' not in group_names or 'bacula-sd' not in group_names %} - Heartbeat Interval = 60s -{% endif %} + SDConnectTimeout = 5 min + Heartbeat Interval = 1 min PKI Signatures = Yes # Enable Data Signing PKI Encryption = Yes # Enable Data Encryption PKI Keypair = /etc/bacula/ssl/{{ inventory_hostname_short }}.pem # Public and Private Keys PKI Master Key = /etc/bacula/ssl/master.pem # ONLY the Public Key } diff --git a/roles/common/templates/etc/stunnel/bacula-fd.conf.j2 b/roles/common/templates/etc/stunnel/bacula-fd.conf.j2 index 851f0ac..057dc48 100644 --- a/roles/common/templates/etc/stunnel/bacula-fd.conf.j2 +++ b/roles/common/templates/etc/stunnel/bacula-fd.conf.j2 @@ -4,43 +4,51 @@ ; setuid()/setgid() to the specified user/group in daemon mode setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = foreground = yes ; Only log messages at severity warning (4) and higher debug = 4 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem key = /etc/stunnel/certs/{{ inventory_hostname_short }}-fd.key -; Some performance tunings socket = l:TCP_NODELAY=1 +socket = l:SO_KEEPALIVE=1 +socket = l:TCP_KEEPIDLE=60 +socket = l:TCP_KEEPINTVL=15 +socket = l:TCP_KEEPCNT=116 + socket = r:TCP_NODELAY=1 +socket = r:SO_KEEPALIVE=1 +socket = r:TCP_KEEPIDLE=60 +socket = r:TCP_KEEPINTVL=15 +socket = r:TCP_KEEPCNT=116 ; Prevent MITM attacks verify = 4 ; Disable support for insecure protocols options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = NO_COMPRESSION ; These options provide additional security at some performance degradation options = SINGLE_ECDH_USE options = SINGLE_DH_USE ; Select permitted SSL ciphers ciphers = EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL ; ************************************************************************** |