Seeding the Cyberbrain role

roles/Cyberbrain/README.md

@@ -0,0 +1,15 @@
+Cyberbrain is a way to ensure that so long as a person is connected to the Internet and authorized, they're able to connect to, use, and control the AniNIX. It's a web-based shell emulator for connecting to the system.
+
+**Warning**: This is a fallback measure -- browsers are still inherently less secure than hard clients like [Git Bash](https://git-scm.com/download/win) or [OpenSSH](https://www.openssh.com/portable.html).
+
+# Etymology
+A [cyberbrain](https://ghostintheshell.fandom.com/wiki/Cyberbrain) is a concept from the series *Ghost in the Shell*. It's the integration of a normal brain with electronic, usually networked components. Similarly, this app serves as a core bridge between the shell environment of the AniNIX and any authorized user.
+
+# Relevant Files and Software
+This service uses a file, [/etc/conf.d/webssh](file:///etc/conf.d/webssh), to control the service. Additionally, there's a password file [/opt/openresty/nginx/passwords/cyberbrain.htpasswd](file:///opt/openresty/nginx/passwords/cyberbrain.htpasswd) that controls an initial authentication to the webserver socket.
+
+## Backups
+No backup is needed.
+
+# Available Clients
+This uses the same clients as [AniNIX/WebServer](../WebServer). Any browser will do.

roles/Cyberbrain/files/cyberbrain.conf

@@ -0,0 +1,22 @@
+server {
+    listen      443 ssl http2;
+    server_name cyberbrain.aninix.net;
+
+    include sec.conf;
+    include default.csp.conf;
+    include letsencrypt.conf;
+
+    location /
+    {
+      auth_basic "Cyberbrain";
+      auth_basic_user_file ../passwords/cyberbrain.htpasswd;
+      proxy_pass       http://127.0.0.1:8822;
+      proxy_http_version 1.1;
+      proxy_read_timeout 300;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+      proxy_set_header Host $http_host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Real-PORT $remote_port;
+    }
+}

roles/Cyberbrain/files/cyberbrain.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=AniNIX/Cyberbrain | SSH Web Front End, powered by python-webssh
+
+[Service]
+User=webssh
+EnvironmentFile=/etc/conf.d/webssh
+ExecStart=/usr/bin/wssh $WEBSSH_ARGS
+
+[Install]
+WantedBy=multi-user.target

roles/Cyberbrain/tasks/main.yml

@@ -0,0 +1,71 @@
+---
+ - name: Install python-webssh
+   become: yes
+   package:
+     name: python-webssh
+     state: present
+
+ - name: Standardize the servicefile
+   become: yes
+   register: servicefile
+   copy: 
+     src: cyberbrain.service
+     dest: /usr/lib/systemd/system/cyberbrain.service
+     owner: root
+     group: root
+     mode: 0644
+
+ - name: Ensure default webssh service file is off.
+   become: yes
+   service:
+     name: webssh
+     state: stopped
+     enabled: no 
+
+ - systemd:
+     daemon_reload: true
+   when: servicefile.changed
+   become: yes
+
+ - name: Ensure service is restarted
+   when: servicefile.changed
+   become: yes
+   service:
+     name: cyberbrain.service
+     enabled: yes
+     state: started
+
+ - name: Ensure service is started
+   when: not servicefile.changed
+   become: yes
+   service:
+     name: cyberbrain.service
+     enabled: yes
+     state: started
+
+ - name: Add the webserver conf file
+   become: yes
+   register: webserver_conf
+   copy:
+     src: cyberbrain.conf
+     dest: /opt/openresty/nginx/conf.d/cyberbrain.conf
+     owner: root
+     group: http
+     mode: 0750
+
+ - name: Ensure the password file is seeded
+   become: yes
+   template:
+     src: cyberbrain.htpasswd.j2
+     dest: /opt/openresty/nginx/passwords/cyberbrain.htpasswd
+     owner: root
+     group: http
+     mode: 0750
+
+ - name: Reload openresty
+   become: yes
+   when: webserver_conf.changed
+   service:
+     name: openresty.service
+     state: reloaded
+

roles/Cyberbrain/templates/cyberbrain.htpasswd.j2

@@ -0,0 +1 @@
+cyberbrain:{PLAIN}{{ passwords.Cyberbrain }}