Adding geoip module and instituting a deny variable for vhosts to consume

.gitignore

@@ -1,12 +1,14 @@
 # Generated files
 roles/Node/files/*-vm.service
-roles/Nazara/files/dns
-roles/Nazara/files/dhcp
+roles/Chappaai/files/dns
+roles/Chappaai/files/dhcp
 roles/Node/files/vm-definitions/**
 roles/ShadowArch/files/mirrorlist
 roles/Sharingan/files/monit/checks/availability
 roles/Foundation/files/custom/public/img/**
+roles/Maat/files/pacoloco.yaml
 venv/**
+wiki/
 wiki/**
 **/pkg/**
 **/src/**

PKGBUILD

@@ -1,10 +1,6 @@
 pkgname="$(git config remote.origin.url | rev | cut -f 1 -d '/' | rev | sed 's/.git$//')"
-pkgver="$(git describe --tag --abbrev=0)"."$(git rev-parse --short HEAD)"
+pkgver="$(git describe --tag --abbrev=0)"."$(( `git log "$(git describe --tag --abbrev=0)"..HEAD | grep -c commit` + 1 ))"."$(git rev-parse --short HEAD)"
 pkgrel=1
-pkgrel() { 
-    git log "$(git describe --tag --abbrev=0)"..HEAD | grep -c commit
-}
-epoch="$(git log | grep -c commit)"
 pkgdesc="$(head -n 1 README.md)"
 arch=("x86_64")
 url="$(git config remote.origin.url | sed 's/.git$//')"

README.md

@@ -2,7 +2,9 @@ This project is our Infrastructure-as-Code solution, detailing the deployment &
 
 # Etymology
 
-It is named after the fictional Star Wars Imperial Intelligence organization that oversaw the various divisions of Intelligence and orchestrated their operations. Like its namesake, this project oversees the various tools within our ecosystem and enforces compliance with standards.
+It is named after flagship carrier Kapisi from the game [Homeworld: Deserts of Kharak](https://store.steampowered.com/app/281610?snr=5000_5100___primarylinks). The carrier was the command and production center of Operation Khadiim, an expedition to understand an anomaly on their world & escape the fanaticism of their Gaalsien rivals. The S'jet were able to succeed in this mission not only due to the military efficacy of their forces but also through the research and production capabilities available to the Kapisi.
+
+This project seeks to give other admins and engineers to launch their own infrastructures and break out of any strangleholds that may have entangled them, whether that is tribalism, vendor lock, or stigma.
 
 # Relevant Files and Software
 
@@ -12,7 +14,7 @@ export ANSIBLE_VAULT_PASSWORD_FILE=$HOME/password-store/${organization}.vault.pa
 export ANSIBLE_VAULT_FILE=$HOME/password-store/${organization}.vault
 ```
 
-Take a look at `examples/msn0.yml` as an example inventory -- make sure you populate one of your own. 
+Take a look at `examples/msn0.yml` as an example inventory -- make sure you populate one of your own. The scripts here expect inventories to have layers of groups -- the top group under `all` must be managed vs. unmanaged. The rest of the scripts use YAMLPath to sort out the rest of the groups.
 
 Once you have your vault and inventory, use [AniNIX/ShadowArch](/AniNIX/ShadowArch) with your hypervisor to provision the base image for your machines, or [Raspbian](https://www.raspberrypi.org/).
 

bin/deploy-role

@@ -1,5 +1,8 @@
 #!/bin/bash
 
+# Ensure we are in the source directory.
+cd $(dirname $0)/..
+
 # Role is first argument
 role="$1"
 if [ -z "$role" ]; then
@@ -25,7 +28,7 @@ fi
 while [ ! -d .git ]; do
     cd ..
     if [ "$PWD" == '/' ]; then
-        echo "This needs to be run from the Ubiqtorate checkout"
+        echo "This needs to be run from the Kapisi checkout"
         exit 3
     fi
 done

bin/deploy-tasks

@@ -0,0 +1,52 @@
+#!/bin/bash
+
+
+# Role is first argument
+taskfile="$1"
+if [ -z "$taskfile" ]; then
+    echo Need a taskfile as first argument.
+    exit 1
+fi
+
+# Ensure we are in the source directory.
+cd $(dirname $1)/..
+
+# Handle verbosity
+if [ "$1" == "-v" ]; then
+    set -x
+    shift
+    taskfile="$1"
+fi
+
+# Handle usage
+if [ "$taskfile" == "-h" ] || [ "$taskfile" == "--help" ]; then
+    echo "Usage: $0 -h"
+    echo "       $0 \$taskfile \$targetgroup [\$optional_inventory]"
+    exit 0
+fi
+
+# Find the root of the git clone
+while [ ! -d .git ]; do
+    cd ..
+    if [ "$PWD" == '/' ]; then
+        echo "This needs to be run from the Kapisi checkout"
+        exit 3
+    fi
+done
+
+# Get the targetgroup
+targetgroup="$2"
+if [ -z "$targetgroup" ]; then
+    targetgroup="$taskfile" # Deploy a taskfile to the server named for that function
+fi
+
+# Allow an inventory override
+inventory="$3"
+if [ -z "$inventory" ]; then
+    inventory=examples/msn0.yml
+fi
+
+# Invoke the one-taskfile playbook for the taskfile on the targetgroup
+ansible-playbook -i "$inventory" -e "taskfile=$taskfile" -e "targets=$targetgroup" "$(dirname $0)/../playbooks/one-taskfile.yml"
+# and return the exit status
+exit $?

bin/full-deploy

@@ -1,5 +1,8 @@
 #!/bin/bash
 
+# Ensure we are in the source directory.
+cd $(dirname $0)/..
+
 # Arguments
 inventory="$1"
 if [ "$inventory" == "-h" ] || [ "$inventory" == "--help" ]; then
@@ -14,7 +17,7 @@ fi
 while [ ! -d .git ]; do
     cd ..
     if [ "$PWD" == '/' ]; then
-        echo "This needs to be run from the Ubiqtorate checkout"
+        echo "This needs to be run from the Kapisi checkout"
         exit 3
     fi
 done

bin/generate-monitoring.py

@@ -3,7 +3,7 @@
 #
 # Description: This file generates the DNS and DHCP files for pihole.
 #
-# Package: AniNIX/Ubiqtorate
+# Package: AniNIX/Kapisi
 # Copyright: WTFPL
 #
 # Author: DarkFeather <darkfeather@aninix.net>
@@ -11,44 +11,40 @@
 import os
 import subprocess
 import sys
+import re
 import yaml
+from kapisi_lib import *
 
 rolepath='../roles/Sharingan/files'
 monfilepath=rolepath+"/monit/checks/availability"
 
-def WriteMonitoringEntry(content,hosttype,hostclass):
+def WriteMonitoringEntry(entryset):
     ### Create the ping-based monitoring entry
-    # param content: the yaml content to parse
-    # param hosttype: managed or unmanaged
-    # param hostclass: the type of host as classified in the yaml
+    # param entryset: Entries matched from the inventory
     global monfile
 
     with open(monfilepath,'a') as monfile:
 
         # Write host entries
-        for host in content['all']['children'][hosttype]['children'][hostclass]['hosts']:
+        for host in entryset:
             try:
-                hostname= host + '.' + content['all']['vars']['replica_domain']
-                monfile.write('check program ' + host + '_ping_mon with path "/usr/lib/monitoring-plugins/check_ping -H ' + hostname + ' -w 100,50% -c 1000,100% -p 3 -t 60 -4"\n')
-                monfile.write('    if status != 0 for 3 times within 5 cycles then exec "/etc/monit.d/scripts/critical ' + hostname + ' is not online."\n\n')
+                monfile.write('check program ' + host + '_ping_mon with path "/usr/lib/monitoring-plugins/check_ping -H ' + entryset[host][2] + ' -w 100,50% -c 1000,100% -p 3 -t 60 -4"\n')
+                monfile.write('    if status != 0 for 3 times within 5 cycles then exec "/etc/monit.d/scripts/critical ' + entryset[host][2] + ' is not online."\n\n')
             except:
                 print(host + ' is not complete for monitoring.')
 
-def WriteSSHMonitoringEntry(content,hosttype,hostclass):
+def WriteSSHMonitoringEntry(entryset):
     ### Create the ping-based monitoring entry
-    # param content: the yaml content to parse
-    # param hosttype: managed or unmanaged
-    # param hostclass: the type of host as classified in the yaml
+    # param entryset: Entries matched from the inventory
     global monfile
 
     with open(monfilepath,'a') as monfile:
 
         # Write host entries
-        for host in content['all']['children'][hosttype]['children'][hostclass]['hosts']:
+        for host in entryset:
             try:
-                hostname= host + '.' + content['all']['vars']['replica_domain']
-                monfile.write('check program ' + host + '_ssh_mon with path "/usr/lib/monitoring-plugins/check_ssh -H ' + hostname + '"\n')
-                monfile.write('    if status != 0 for 3 times within 5 cycles then exec "/etc/monit.d/scripts/critical ' + hostname + ' is not responding to SSH."\n\n')
+                monfile.write('check program ' + host + '_ssh_mon with path "/usr/lib/monitoring-plugins/check_ssh -H ' + entryset[host][2] + '"\n')
+                monfile.write('    if status != 0 for 3 times within 5 cycles then exec "/etc/monit.d/scripts/critical ' + host + ' is not responding to SSH."\n\n')
             except:
                 print(host + ' is not complete for monitoring.')
 
@@ -61,19 +57,12 @@ def GenerateFiles(file):
         os.mkdir(rolepath)
 
     # Parse the yaml
-    with open(file, 'r') as stream:
-        content = yaml.safe_load(stream)
+    entryset = TrackIPEntries(file,searchstring='all.children.managed.**.ip')
 
     if os.path.isfile(monfilepath): os.remove(monfilepath)
 
-    # Add DNS entries for each host
-    hosttype = 'managed'
-    for hostclass in ['physical','virtual','geth_hubs']:
-        #WriteMonitoringEntry(content,hosttype,hostclass)
-        WriteSSHMonitoringEntry(content,hosttype,hostclass)
-    hosttype = 'unmanaged'
-    for hostclass in ['ovas','appliances']:
-        WriteMonitoringEntry(content,hosttype,hostclass)
+    WriteSSHMonitoringEntry(entryset)
+    WriteMonitoringEntry(entryset)
 
 if __name__ == '__main__':
     if len(sys.argv) != 2:

bin/generate-pihole-dns-dhcp.py

@@ -2,50 +2,45 @@
 # File: generate-pihole-dns-dhcp.py
 #
 # Description: This file generates the DNS and DHCP files for pihole.
+#     It expects that the inventory has two levels of grouping.
 #
-# Package: AniNIX/Ubiqtorate
+# Package: AniNIX/Kapisi
 # Copyright: WTFPL
 #
 # Author: DarkFeather <darkfeather@aninix.net>
 
 import os
+import re
 import subprocess
 import sys
-import yaml
+from kapisi_lib import *
 
-rolepath='../roles/Nazara/files'
+rolepath='../roles/Chappaai/files'
 dnsfilepath=rolepath+"/dns"
 dhcpfilepath=rolepath+"/dhcp"
+entryset={}
 
-def WriteDHCPEntry(content,hosttype,hostclass):
+def WriteDHCPEntries(dhcpfile):
     ### Create the DHCP entry
     # param content: the yaml content to parse
     # param hosttype: managed or unmanaged
     # param hostclass: the type of host as classified in the yaml
-    global dhcpfile
+    global entryset
+    for host in entryset:
+        # Entries should be:
+        # dhcp-host=mac,ip,fqdn
+        dhcpfile.write('dhcp-host=' + entryset[host][1] + ',' + entryset[host][0] + ',' + entryset[host][2] + '\n')
 
-    with open(dhcpfilepath,'a') as dhcpfile: 
-        for host in content['all']['children'][hosttype]['children'][hostclass]['hosts']:
-            try:
-                dhcpfile.write('dhcp-host=' + content['all']['children'][hosttype]['children'][hostclass]['hosts'][host]['mac'] + ',' + content['all']['children'][hosttype]['children'][hostclass]['hosts'][host]['ip'] + ',' + host + '.' + content['all']['vars']['replica_domain'] + '\n')
-            except:
-                print(host + ' is not complete for DHCP.')
-
-def WriteDNSEntry(content,hosttype,hostclass):
+def WriteDNSEntries(dnsfile):
     ### Create the DNS entry
     # param content: the yaml content to parse
     # param hosttype: managed or unmanaged
     # param hostclass: the type of host as classified in the yaml
-    global dnsfile
-
-    with open(dnsfilepath,'a') as dnsfile: 
-
-        # Write host entries
-        for host in content['all']['children'][hosttype]['children'][hostclass]['hosts']:
-            try:
-                dnsfile.write(content['all']['children'][hosttype]['children'][hostclass]['hosts'][host]['ip'] + ' ' + host + '.' + content['all']['vars']['replica_domain'] + ' ' + host + '\n')
-            except:
-                print(host + ' is not complete for DNS.')
+    global entryset
+    for host in entryset:
+        # Entries should be:
+        # ip host fqdn
+        dnsfile.write(entryset[host][0] + ' ' + entryset[host][2] + ' ' + host + '\n')
 
 def GenerateFiles(file):
     ### Open the file and parse it
@@ -58,29 +53,29 @@ def GenerateFiles(file):
     # Parse the yaml
     with open(file, 'r') as stream:
         content = yaml.safe_load(stream)
+        external_domain = content['all']['vars']['external_domain']
 
         # Clear the DNS file
         with open(dhcpfilepath,'w') as dhcpfile:
             dhcpfile.write('dhcp-range='+content['all']['vars']['dhcprange']+'\n')
             dhcpfile.write('dhcp-option=option:dns-server,'+content['all']['vars']['dns']+'\n\n')
             dhcpfile.write('dhcp-range='+content['all']['vars']['staticrange']+'\n')
+            WriteDHCPEntries(dhcpfile)
         with open(dnsfilepath,'w') as dnsfile:
-            vips=subprocess.run(["/bin/bash", "-c", "echo | openssl s_client -connect "+content['all']['vars']['external_domain']+":443 | openssl x509 -text -noout | grep DNS: | tr ',' '\n'  | sed 's/\s\+DNS://' | grep -ivE ^"+content['all']['vars']['external_domain']+" | tr '\n' ' '"], capture_output=True).stdout.decode("utf-8")
-            dnsfile.write(content['all']['vars']['webfront']+' '+content['all']['vars']['external_domain']+' '+vips+"\n")
-
-        # Add DNS entries for each host
-        hosttype = 'managed'
-        for hostclass in ['physical','virtual','geth_hubs']:
-            WriteDNSEntry(content,hosttype,hostclass)
-            WriteDHCPEntry(content,hosttype,hostclass)
-        hosttype = 'unmanaged'
-        for hostclass in ['ovas','test_ovas','appliances','adhoc_appliances','iot']:
-            WriteDNSEntry(content,hosttype,hostclass)
-            WriteDHCPEntry(content,hosttype,hostclass)
+            dnsfile.write(content['all']['vars']['webfront']+' '+external_domain+' '+content['all']['vars']['internal_subdomains'].replace(' ','.'+external_domain+' ')+'.'+external_domain+' '+content['all']['vars']['external_subdomains'].replace(' ','.'+external_domain+' ')+'.'+external_domain+' '+content['all']['vars']['hosted_domains']+"\n")
+            WriteDNSEntries(dnsfile)
+            print('Files should be in '+rolepath);
 
+### Main function
+# param sys.argv: Input arguments
 if __name__ == '__main__':
-    if len(sys.argv) != 2:
+    if len(sys.argv) < 2:
         print("You need to supply an inventory file.")
         sys.exit(1)
+    if len(sys.argv) == 3:
+        entryset = TrackIPEntries(sys.argv[1],sys.argv[2])
+    else:
+        entryset = TrackIPEntries(sys.argv[1])
     GenerateFiles(sys.argv[1])
+    #dumper.dump(entryset)
     sys.exit(0)

bin/generate-ssh-keyscan

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# File: gen-ssh-keyscan
+# File: ./generate-ssh-keyscan
 #
 # Description: This file generates a known_host block for the inventory.
 #

bin/generate-systemd-vms.py

@@ -3,7 +3,7 @@
 # 
 # Description: This file generates the systemd.service files that run our VM's
 # 
-# Package: AniNIX/Ubiqtorate
+# Package: AniNIX/Kapisi
 # Copyright: WTFPL
 # 
 # Author: DarkFeather <darkfeather@aninix.net>
@@ -54,7 +54,7 @@ def WriteVMFile(content,hosttype,hostclass):
             vmfile.write('[Service]\n')
             vmfile.write('ExecStart=/usr/sbin/qemu-system-x86_64 -name AniNIX/' + host + ' -machine type=pc,accel=kvm')
             if 'uefi' in content['all']['children'][hosttype]['children'][hostclass]['hosts'][host].keys(): vmfile.write(' -bios /usr/share/edk2-ovmf/x64/OVMF.fd')
-            vmfile.write(' -cpu qemu64 -smp ' + cores + ' ' + disks + ' -net nic,macaddr=' + mac + ',model=virtio -net bridge,br=' + bridge + ' -vga std -nographic -vnc :' + str(vnc) + ' -m size=' + str(memory) + 'G -device virtio-rng-pci\n')
+            vmfile.write(' -cpu host -smp ' + cores + ' ' + disks + ' -net nic,macaddr=' + mac + ',model=virtio -net bridge,br=' + bridge + ' -vga std -nographic -vnc :' + str(vnc) + ' -m size=' + str(memory) + 'G -device virtio-rng-pci\n')
             vmfile.write('ExecReload=/bin/kill -HUP $MAINPID\n')
             vmfile.write('KillMode=process\n')
             vmfile.write('Restart=always\n')

bin/kapisi_lib.py

@@ -0,0 +1,72 @@
+import re
+import yaml
+from types import SimpleNamespace
+from yamlpath.common import Parsers
+from yamlpath.wrappers import ConsolePrinter
+from yamlpath import Processor
+from yamlpath import YAMLPath
+from yamlpath.exceptions import YAMLPathException
+
+def TrackIPEntries(yaml_file,searchstring='all.children.**.ip'):
+    ### Try to parse an Ansible inventory for hosts with the 'ip' attribute.
+    # param file: the file to parse
+    # return: a populated entry set in form [{Host,[ip,mac,fqdn]},...]
+
+    # Borrowing from upstream author's example at https://pypi.org/project/yamlpath/
+
+    entryset = {}
+    replicadomain = GetReplicaDomain(yaml_file)
+
+    # The various classes of this library must be able to write messages somewhere
+    # when things go bad.
+    #logging_args = SimpleNamespace(quiet=True, verbose=False, debug=False)
+    logging_args = SimpleNamespace(quiet=True, verbose=True, debug=True)
+    log = ConsolePrinter(logging_args)
+
+    # Prep the YAML parser
+    yaml = Parsers.get_yaml_editor()
+    (yaml_data, doc_loaded) = Parsers.get_yaml_data(yaml, log, yaml_file)
+    if not doc_loaded:
+        exit(1)
+    processor = Processor(log, yaml_data)
+
+    yaml_path = YAMLPath(searchstring)
+
+    # Create a regex pattern to remove the end of the path
+    ippattern = re.compile('\\.ip$')
+    try:
+        for node_coordinate in processor.get_nodes(yaml_path, mustexist=True):
+            # Strip the path to the host entry.
+            path = ippattern.sub("",str(node_coordinate.path))
+            # Pull the IP
+            ip = str(node_coordinate.node)
+            # Pull the hosname
+            splitpath = path.split('.')
+            hostname = splitpath[len(splitpath)-1]
+            #print("Got {} from '{}''.".format(ip,path))
+
+            # Path the MAC
+            mac_yaml_path = YAMLPath(path+".mac")
+            mac=""
+            try:
+                for node_coordinate in processor.get_nodes(mac_yaml_path, mustexist=True):
+                    mac = str(node_coordinate.node)
+            except YAMLPathException as ex:
+                log.error(ex)
+
+            # Add the host to the entryset.
+            entryset.update({ hostname : [ip,mac,hostname+'.'+replicadomain] })
+
+    except YAMLPathException as ex:
+        log.error(ex)
+
+    finally:
+        return entryset
+
+def GetReplicaDomain(file):
+    '''
+    Return the defined replica domain
+    '''
+    with open(file, 'r') as stream:
+        content = yaml.safe_load(stream)
+        return content['all']['vars']['replica_domain']

bin/tmux-hosts

@@ -21,7 +21,7 @@ function usage() {
     # Show helptext
     # param retcode: what to exit
     retcode="$1"
-    echo "Usage: $0 [ -o offset ] [-g group ] -i inventory.yml" 
+    echo "Usage: $0 [ -o offset ] [-g group ] [-i inventory.yml]"
     echo "       $0 -h"
     echo "Group is optional -- add it if you only want to look at a specific subset."
     echo "Add -v for verbosity."
@@ -78,8 +78,7 @@ if [ "$(basename $0)" == "tmux-hosts" ]; then
     done
 
     if [ -z "$inventory" ]; then
-        echo Need an inventory.
-        usage 2;
+        inventory=$(grep -E ^inventory ~/.ansible.cfg | cut -f 2 -d '=')
     fi
 
     tmuxHosts $(ansible -i "$inventory" --list-hosts "$group"\

examples/msn0.yml

@@ -1,10 +1,14 @@
 all:
     vars:
         # Environment-wide data
-        external_domain: aninix.net
+        external_domain: "aninix.net"
+        external_subdomains: "cyberbrain foundation irc lykos maat password sharingan singularity superintendent www yggdrasil"
+        internal_subdomains: "ircservices"
+        hosted_domains: "travelpawscvt.com"
         replica_domain: "MSN0.AniNIX.net"
         time_zone: "America/Chicago"
         # Services used by all
+        main_subnet: 10.0.1.0
         router: 10.0.1.1
         netmask: 24
         dhcprange: '10.0.1.224,10.0.1.254,255.255.255.0,12h'
@@ -19,84 +23,109 @@ all:
         ansible_become_method: sudo
         ansible_become_user: root
         static: false
-        wireless_ssid: 'Shadowfeed'
+        wireless_ssid: 'Shadownet'
         ansible_python_interpreter: auto_silent
+        aether_primary: 'Yggdrasil'
         ldap:
           server: "10.0.1.3"
           orgdn: "dc=aninix,dc=net"
           binduser: 'binduser'
           userou: 'ou=People'
+          groupou: 'ou=Group'
+          filter: '(&(objectClass=person)(!(pwdReset=TRUE)))'
         organization: # Information about the group
           admin: 'DarkFeather'
           email: 'ircs://irc.aninix.net:6697/DarkFeather'
           displayname: 'AniNIX'
           gpgkey: '904DE6275579CB589D85720C1CC1E3F4ED06F296'
         ssl: # Standard SSL cryptographic standards
-          identity: 'aninix.net-0001' # The Let's Encrypt identity to use
+          identity: 'aninix.net-0002' # The Let's Encrypt identity to use
           ciphersuite: "!NULL:!SSLv2:!SSLv3:!TLSv1:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
+        Aether_nodes:
+          - DedSec.msn0.aninix.net
+        operational_countries:
+          - 'US'
+
     children:
         managed:
             children:
                 physical: # 10.0.1.0/28
                     hosts:
-                        Nazara:
+                        Chappaai:
                             ipinterface: eth0
                             ip: 10.0.1.2
-                            mac: B8:27:EB:B6:AA:0C
+                            mac: e4:5f:01:01:ff:9b
                             static: true
+                    children:
+                        Node:
+                            hosts:
                                 Node1:
                                     ipinterface: enp1s0
                                     ip: 10.0.1.5
-                            mac: FA:EC:43:87:4D:2D
+                                    mac: fa:ec:43:87:4d:2d
                                     tap: true
                                     ups: 'aps'
+                                    active_vms:
+                                      - Yggdrasil
                                 Node2:
                                     ipinterface: enp1s0
                                     ip: 10.0.1.7
                                     mac: 56:02:ef:2c:1f:7c
                                     tap: true
-                            ups: 'cyberpower'
+                                    active_vms:
+                                      - DarkNet
+                                      - Maat
+                                      - Sharingan
+                                      - Superintendent
                                 Node3:
                                     ipinterface: enp1s0
                                     ip: 10.0.1.8
-                            mac: B2:C6:2C:02:B2:6E
+                                    mac: b2:c6:2c:02:b2:6e
                                     tap: true
-                        Nodelet0:
+                                    active_vms:
+                                      - TDS-Jump
+                        Geth:
+                            hosts:
+                                Geth0:
                                     ipinterface: eth0
                                     ip: 10.0.1.9
-                            mac: b8:27:eb:9a:73:dd
+                                    mac: b8:27:eb:09:a1:a0
                                     static: true
                                     k3s_primary: true
-                        Nodelet1:
+                                Geth1:
                                     ipinterface: eth0
                                     ip: 10.0.1.10
-                            mac: E4:5F:01:01:FF:9C
+                                    mac: e4:5f:01:01:ff:9c
                                     static: true
-                        Nodelet2:
+                                Geth2:
                                     ipinterface: eth0
                                     ip: 10.0.1.11
-                            mac: E4:5F:01:01:FF:D5
+                                    mac: e4:5f:01:01:ff:d5
                                     static: true
-                        Nodelet3:
+                                Geth3:
                                     ipinterface: eth0
                                     ip: 10.0.1.12
-                            mac: E4:5F:01:01:FF:96
+                                    mac: e4:5f:01:01:ff:96
                                     static: true
-                        Nodelet4:
+                                Geth4:
                                     ipinterface: eth0
                                     ip: 10.0.1.13
-                            mac: E4:5F:01:01:FF:E4
+                                    mac: e4:5f:01:01:ff:e4
+                                    static: true
+                                Geth5:
+                                    ipinterface: eth0
+                                    ip: 10.0.1.14
+                                    mac: b8:27:eb:81:f5:4b
                                     static: true
                 virtual: # 10.0.1.16/28
                     vars:
                     hosts:
                         Sharingan:
-                            node: Node2
                             ip: 10.0.1.16
                             ipinterface: ens3
-                            mac: 00:15:5D:01:02:10
+                            mac: 00:15:5d:01:02:10
                             cores: 4
-                            memory: 4
+                            memory: 6
                             vnc: 8
                             bridge: br0
                             uefi: true
@@ -106,63 +135,62 @@ all:
                             # On hold because of https://aninix.net/DarkFeather/MSN0/issues/6
                             holdpkg: "elasticsearch graylog mongodb44-bin mongodb-tools-bin"
                         DarkNet:
-                            node: Node2
                             ipinterface: ens3
                             ip: 10.0.1.17
-                            mac: 00:15:5D:01:02:05
-                            cores: 4
-                            memory: 4
+                            mac: 00:15:5d:01:02:05
+                            cores: 2
+                            memory: 2
                             vnc: 9
                             bridge: br0
                             disks:
                               - '-drive format=raw,index=0,media=disk,file=/dev/sdb'
                             wolfpack_config: 'gitea@foundation.aninix.net:DarkFeather/WolfPack-Config.git'
                         Maat:
-                            node: Node2
                             ip: 10.0.1.18
                             ipinterface: ens3
                             mac: 00:15:5d:01:02:07
                             cores: 2
                             memory: 2
                             bridge: br0
+                            vscan_enabled: true
                             vnc: 7
                             disks:
                               - '-drive format=qcow2,l2-cache-size=8M,file=/mnt/cage2/vm/Maat.qcow2'
                         Yggdrasil:
-                            node: Node1
-                            ipinterface: enp1s0f0
+                            ipinterface: ens3
                             ip: 10.0.1.3
                             mac: 00:25:90:0d:6e:86
                             static: true
-                            sslidentity: aninix.net-0001
+                            sslidentity: aninix.net-0002
                             secdetection: true
-                            iptv_location: "Milwaukee|Madison"
+                            iptv_location: "ToonamiAftermathEast.us|TVSClassicMovies.us|UniversalComedy|ABCNewsLive"
                             aether_source: true
                             cores: 8
-                            memory: 16
+                            memory: 10
                             bridge: br0
                             vnc: 1
+                            vscan_enabled: true
                             disks:
                               - '-drive format=raw,index=0,media=disk,file=/dev/sda'
                               - '-drive format=raw,index=0,media=disk,file=/dev/sdb'
                               - '-drive format=raw,index=0,media=disk,file=/dev/sdc'
                               - '-drive format=raw,index=0,media=disk,file=/dev/sdd'
-                geth_hubs: # 10.0.1.32/28
+                Vergil: # 10.0.1.32/28
                     vars:
                         motion_enabled: yes
                     hosts:
-                      Geth-Hub-1:
+                      Vergil1:
                             ip: 10.0.1.32
-                            mac: 84:16:F9:14:15:C5
+                            mac: b8:27:eb:e3:ff:59
                             rotate: 0
                             remote: NS-RC4NA-14
-                      Geth-Hub-2:
+                      Vergil2:
                             ip: 10.0.1.33
-                            mac: 84:16:F9:13:B6:E6
+                            mac: b8:27:eb:cf:26:88
                             motion_enabled: no
                             rotate: 180
                             remote: NS-RC4NA-14
-                      Geth-Hub-3:
+                      Vergil3:
                             ip: 10.0.1.34
                             mac: b8:27:eb:60:73:68
                             rotate: 90
@@ -172,10 +200,9 @@ all:
                 # Both OVA groups are in the same subnet -- test_ovas aren't monitored
                 ovas: # 10.0.1.48/28
                     hosts:
-                        Geth:
-                            node: Node2
+                        Superintendent:
                             ip: 10.0.1.49
-                            mac: DE:8B:9E:19:55:1E
+                            mac: de:8b:9e:19:55:1e
                             cores: 2
                             memory: 2
                             vnc: 6
@@ -186,7 +213,6 @@ all:
                 test_ovas: # 10.0.1.48/28
                     hosts:
                         TDS-Jump:
-                            node: Node2
                             ip: 10.0.1.48
                             mac: 00:15:5d:01:02:08
                             cores: 2
@@ -194,7 +220,7 @@ all:
                             vnc: 4
                             bridge: br0
                             disks:
-                              - '-drive format=qcow2,l2-cache-size=8M,file=/mnt/cage2/vm/TDSJump.qcow2'
+                              - '-drive format=qcow2,l2-cache-size=8M,file=/srv/node/vm/TDSJump.qcow2'
                         DedNet:
                             ip: 10.0.1.50
                             mac: 00:15:5d:01:02:09
@@ -248,15 +274,15 @@ all:
                 # appliances are monitored -- adhoc_appliances are convenience only and not monitored.
                 appliances:
                     hosts: # 10.0.1.64/27
-                        Shadowfeed: # Router must be at root
+                        Shadownet: # Router must be at root
                             ip: 10.0.1.1
                             mac: 2c:30:33:64:f4:03
                         Print: # Print is excepted for legacy setup reasons before we laid out subnets.
                             ip: 10.0.1.6
-                            mac: 00:80:92:77:CE:E4
+                            mac: 00:80:92:77:ce:e4
                         Geth-Eyes:
                             ip: 10.0.1.68
-                            mac: 9C:A3:AA:33:A3:99
+                            mac: 9c:a3:aa:33:a3:99
                         # "Core-Console":
                         #     ip: 10.0.1.74
                         #     mac: 00:25:90:0D:82:5B
@@ -267,41 +293,46 @@ all:
                     hosts: # 10.0.1.64/27
                         DarkFeather:
                             ip: 10.0.1.64
-                            mac: D0:40:EF:D4:14:CF
+                            mac: f4:2b:8c:10:31:44
                         Lykos:
                             ip: 10.0.1.65
-                            mac: 70:74:14:4F:8E:42
-                        Games:
+                            mac: 70:74:14:4f:8e:42
+                        Node0:
                             ip: 10.0.1.66
-                            mac: E0:BE:03:77:0E:88
+                            mac: 70:32:17:46:49:89
                         LivingRoomTV:
                             ip: 10.0.1.69
-                            mac: 80:D2:1D:17:63:0E
+                            mac: 80:d2:1d:17:63:0e
                         BedRoomTV:
                             ip: 10.0.1.70
-                            mac: 80:D2:1D:17:63:0F
+                            mac: a4:77:33:4c:2a:44
                         TrainingRoomTV:
                             ip: 10.0.1.71
-                            mac: 80:D2:1D:17:63:10
-                        Tachikoma:
+                            mac: 80:d2:1d:17:63:10
+                        BT:
                             ip: 10.0.1.72
-                            mac: 90:0f:0c:1a:d3:23
+                            mac: 8a:00:aa:7f:df:d1
                         DedSec:
                             ip: 10.0.1.73
-                            mac: 34:F6:4B:36:12:8F
+                            mac: d4:e9:8a:7d:79:b3
                # dhcp build space: 10.0.1.224/27
                 iot: # 10.0.2.0/24
                     hosts:
-                        LinKeuei:
+                        # Nest Thermostat
+                        LivingRoomRegulator:
                             ip: 10.0.2.2
-                            mac: 64:16:66:08:57:F5
-                        Canary:
+                            mac: 64:16:66:08:57:f5
+                        # Nest Protect
+                        Monitor:
                             ip: 10.0.2.3
-                            mac: 18:B4:30:2F:F1:37
-                        Charon:
+                            mac: 18:b4:30:2f:f1:37
+                        # Chamberlain My-Q
+                        Gatekeeper:
                             ip: 10.0.2.4
-                            mac: 64:52:99:14:28:2B
-                        # CanoptekAleph: physical, no network
-                        CanoptekBek:
+                            mac: 64:52:99:14:28:2b
+                        # iRobot Roomba
+                        # CaretakerAlpha has no network
+                        CaretakerBravo:
                             ip: 10.0.2.5
-                            mac: 40:9F:38:95:06:34
+                            mac: 40:9f:38:95:06:34
+                        # CaretakerCharlie has no network

playbooks/deploy.yml

@@ -6,70 +6,35 @@
 # Parameters:
 # threads: Number of threads to use; default is 16.
 #
-- hosts: Nazara
-  order: sorted
-  serial: "{{ threads | default('16') }}"
-  gather_facts: true
-  ignore_unreachable: true
-  vars_files:
-     - "{{ lookup('env', 'ANSIBLE_VAULT_FILE') }}"
-  vars:
-     - ansible_password: "{{ passwords[inventory_hostname] }}"
-     - ansible_become_password: "{{ passwords[inventory_hostname] }}"
-  roles:
-     - Nazara
-
 - hosts: managed
-  order: sorted
   serial: "{{ threads | default('16') }}"
   gather_facts: true
   ignore_unreachable: true
-  vars_files:
-     - "{{ lookup('env', 'ANSIBLE_VAULT_FILE') }}"
-  vars: # This is the only segment that should need these variables, as the basics role should take care of sudo and the SSH key.
-     - ansible_password: "{{ passwords[inventory_hostname] }}"
-     - ansible_become_password: "{{ passwords[inventory_hostname] }}"
   roles:
       - ShadowArch
       - SSH
       - Sharingan
 
+- hosts: physical
+  gather_facts: true
+  ignore_unreachable: true
+  roles:
+      - hardware
+
 - hosts: Yggdrasil
-  order: sorted
-  serial: "{{ threads | default('16') }}"
   gather_facts: true
   ignore_unreachable: true
-  vars_files:
-     - "{{ lookup('env', 'ANSIBLE_VAULT_FILE') }}"
   roles:
-      - hardware
-      - SSL
-      - WebServer
-      - IRC
-      - WolfPack
+      - Aether
       - Foundation
-      - Yggrasil
-
-- hosts: geth_hubs
-  order: sorted
-  serial: "{{ threads | default('16') }}"
-  gather_facts: true
-  ignore_unreachable: true
-  vars_files:
-     - "{{ lookup('env', 'ANSIBLE_VAULT_FILE') }}"
-  roles: 
-      - Geth-Hub
-
-- hosts: Node1,Node2,Node3
-  order: sorted
-  serial: "{{ threads | default('16') }}"
-  gather_facts: true
-  ignore_unreachable: true
-  vars_files:
-     - "{{ lookup('env', 'ANSIBLE_VAULT_FILE') }}"
-  roles: 
-      - hardware
-      - Node
+      - Grimoire
+      - IRC
+      - Password
+      - SSL
+      - TheRaven
+      - WebServer
+      - WolfPack
+      - Yggdrasil
 
 - hosts: DarkNet
   order: sorted
@@ -81,3 +46,23 @@
   roles:
       - DarkNet
       - WolfPack
+
+- hosts: "{{ item }}"
+  gather_facts: true
+  ignore_unreachable: true
+  roles:
+     - "{{ item }}"
+  loop:
+    - Chappaai
+    - Maat
+    - Geth
+    - Node
+    - Vergil
+    #- DedSec
+    #- BT
+
+- hosts: Node3
+  gather_facts: true
+  ignore_unreachable: true
+  roles:
+    - Cyberbrain

playbooks/patching.yml

@@ -9,36 +9,23 @@
 # Patch then restart a node
 #
 #
-- hosts: physical,virtual
+- hosts: "{{ targets | default('virtual') }}"
+  order: sorted
+  serial: 4
+  vars: 
+    ansible_become: yes
+    ansible_become_method: sudo
+  roles:
+    - patching
+
+- hosts: physical
   order: sorted
   serial: 4
   vars: 
     ansible_become: yes
     ansible_become_method: sudo
   tasks:
-       - package:
-             name: archlinux-keyring
-             state: latest
 
-- hosts: virtual,geth-hubs
-  order: sorted
-  serial: 4
-  vars: 
-    ansible_become: yes
-    ansible_become_method: sudo
-  vars_files:
-    - "{{ lookup('env', 'ANSIBLE_VAULT_FILE') }}"
-  roles:
-    - patching
-
-- hosts: physical
-  order: sorted
-  ignore_unreachable: true
-  serial: 4
-  vars: 
-    ansible_become: yes
-    ansible_become_method: sudo
-  vars_files:
-    - "{{ lookup('env', 'ANSIBLE_VAULT_FILE') }}"
-  roles:
-    - patching
+    - include_role:
+          name: patching
+      when: targets is unset

playbooks/rebuild-pacman-keyring.yml

@@ -0,0 +1,33 @@
+---
+
+ - hosts: "{{ targets | default('all') }}"
+   become: true
+   gather_facts: false
+
+   tasks:
+
+     - name: Clean
+       command: rm -Rf /etc/pacman.d/gnupg
+
+     - name: Initialize keyring
+       command: /usr/bin/pacman-key --init
+
+     - name: Add ArchLinux
+       command: /usr/bin/pacman-key --populate archlinux
+
+     - name: Add AniNIX
+       command: /usr/bin/pacman-key --populate aninix
+
+     - name: Locally sign AniNIX
+       command: /usr/bin/pacman-key --lsign 904DE6275579CB589D85720C1CC1E3F4ED06F296
+
+     - name: Update DB
+       command: /usr/bin/pacman-key --updatedb
+
+     - name: Update packages
+       pacman:
+         name:
+           - archlinux-keyring
+           - ShadowArch
+         state: latest
+         update_cache: true

playbooks/verify-inventory.yml

@@ -0,0 +1,52 @@
+---
+
+- hosts: "{{ targets | default('managed') }}"
+  become: true
+  tasks:
+
+      - name: Verify IP
+        ignore_errors: true
+        register: status
+        assert:
+          that:
+            - "ip in ansible_default_ipv4.address"
+
+      - debug:
+          msg: "Inventory IP {{ ip }} for {{ inventory_hostname }} doesn't match configured {{ ansible_default_ipv4.address }}"
+        when: status.failed
+
+
+      - name: Verify MAC
+        ignore_errors: true
+        register: status
+        assert:
+          that:
+            - "mac in ansible_default_ipv4.macaddress"
+
+      - debug:
+          msg: "Inventory MAC {{ mac }} for {{ inventory_hostname }} doesn't match configured {{ ansible_default_ipv4.macaddress }}"
+        when: status.failed
+
+      - name: Verify cores
+        ignore_errors: true
+        when: cores is defined
+        register: corescheck
+        assert:
+          that:
+            - "cores == ansible_processor_cores"
+
+      - debug:
+          msg: "Inventory {{ cores }} cores for {{ inventory_hostname }} doesn't match configured {{ ansible_processor_cores }}"
+        when: cores is defined and corescheck.failed
+
+      - name: Verify memory
+        ignore_errors: true
+        register: memcheck
+        when: memory is defined
+        assert:
+          that:
+            - "memory == (ansible_memtotal_mb - ansible_memtotal_mb % 1000)/ 1000 + 1 " # hasty rounding
+
+      - debug:
+          msg: "Inventory {{ memory }} GB memory for {{ inventory_hostname }} doesn't match configured {{ (ansible_memtotal_mb - ansible_memtotal_mb % 1000)/ 1000 + 1 }} GB"
+        when: memory is defined and memcheck.failed

precommit-hooks/ensure-apps-are-short

@@ -2,8 +2,11 @@
 
 # Webserver apps directory should be short -- apps that fail this category should become their own.
 
+retcode=0
 for file in `find roles/WebServer/files/apps -type f`; do
     if [[ $(wc -l "$file" | awk '{ print $1; }') -gt 10 ]]; then
         echo "$file" is too long to be deployed as a mini-app under the WebServer role.
+        retcode=1
     fi
 done
+exit $retcode

precommit-hooks/find-data-files

@@ -1,9 +0,0 @@
-#!/bin/bash
-
-result="$(find roles/*/{files,templates} -type f -exec file {} \; | grep -Ev ASCII\ text\|empty\|Unicode\ text | grep -v motd.txt.j2)"
-if [ -n "$result" ]; then
-    echo "These files need to be evaluated -- generally, don't commit data files to Git."
-    echo "$result"
-    exit 1
-fi
-exit 0

precommit-hooks/find-mismatched-macs

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+
+export IFS="
+"
+retcode=0
+
+for macline in `grep -E '^\s+mac: ' examples/*.yml`; do
+    if [ "${macline}" != "${macline,,}" ]; then
+        mac="$( echo "${macline}" | awk '{ print $2; }')"
+        retcode=1
+        echo "${mac} has mismatched case -- should be lower."
+        sed -i "s/${mac}/${mac,,}/g" examples/*.yml
+        echo "Attempted replacement."
+    fi
+done
+exit $retcode

precommit-hooks/find-passwords-in-files

@@ -28,3 +28,14 @@ if [ $? -ne 1 ]; then
     echo Otherwise, convert any files above to templates and encode the passphrase into your vault.
     exit 1;
 fi
+IFS="
+"
+
+for i in `ansible-vault decrypt --output - ${ANSIBLE_VAULT_FILE} | sed 's/\s\?-\?\s\?[A-Za-z0-9_]\+://' | grep -vE '\||password|^\s\?$|#|https://' | sed "s/^ \+['\"]\?//" | sed "s/[\"']\s\?//" | sort | uniq`; do
+
+    grep -rlF "${i}" .
+    if [ $? -ne 1 ]; then
+        echo "A secret starting with $(echo "$i" | cut -c 1-7) was found in the files above."
+        exit 1;
+    fi
+done

requirements.txt

@@ -1,4 +1,5 @@
 pyaml
+yamlpath
 pytest
 python3-nmap
 simplejson

roles/Aether/README.md

@@ -0,0 +1,7 @@
+See [AniNIX/Aether](/AniNIX/Aether) for complete details of the tool.
+
+Role requirements:
+ * `secrets['Aether']` in Vault
+ * A YAML list of nodes under the key `Aether_nodes` in Vault
+ * A host called 'Core' to act as the source
+ * 22/tcp/sftp access through firewalls to the Core host from any clients

roles/Aether/files/backup-entries/Yggdrasil/gitea.backup.script

@@ -0,0 +1,3 @@
+#!/bin/bash
+### Gitea ###
+tar cvzf "$BACKUPDIR"/gitea.tgz /var/lib/gitea/data

roles/Aether/files/backup-entries/Yggdrasil/grimoire.backup.script

@@ -0,0 +1,3 @@
+#!/bin/bash
+### Grimoire ###
+sudo -u postgres pg_dumpall > "$BACKUPDIR"/grimoire.sql

roles/Aether/files/backup-entries/Yggdrasil/irc.backup.script

@@ -0,0 +1,3 @@
+#!/bin/bash
+### IRC Services ###
+cp /opt/anope/data/anope.db "$BACKUPDIR"

roles/Aether/files/backup-entries/Yggdrasil/wiki.backup.script

@@ -0,0 +1,9 @@
+#!/bin/bash
+### Wiki ###
+mkdir "$BACKUPDIR"/wiki/
+for i in `find /usr/share/webapps/ -maxdepth 1 -type d | grep mediawiki`; do
+    foldername="$(echo "$i" | rev | cut -f 1 -d '/' | rev)"
+    dbname="$(grep '^\$wgDBname' "$i"/LocalSettings.php | cut -f 2 -d \")"
+    $BACKUPCMD "${i}"/LocalSettings.php "$BACKUPDIR"/wiki/"$foldername"-localsettings.php
+    sudo -u postgres pg_dump "$dbname" > "$BACKUPDIR"/wiki/"$dbname".psql
+done

roles/Aether/files/backup-entries/Yggdrasil/yggdrasil.backup.script

@@ -0,0 +1,3 @@
+#!/bin/bash
+### Yggdrasil -- File & SHA list only for space reasons ###
+cp /srv/yggdrasil/library.sha256 "$BACKUPDIR"/yggdrasil.library.sha256

roles/Aether/files/yggdrasil-check.conf

@@ -0,0 +1,146 @@
+# Example configuration file for AIDE.
+# More information about configuration options available in the aide.conf manpage.
+@@define DBDIR /var/lib/aide
+@@define LOGDIR /var/log/aide
+
+# The location of the database to be read.
+database_in=file:@@{DBDIR}/aide.db.gz
+
+# The location of the database to be written.
+#database_out=sql:host:port:database:login_name:passwd:table
+#database_out=file:aide.db.new
+database_out=file:@@{DBDIR}/aide.db.new.gz
+
+# Whether to gzip the output to database
+gzip_dbout=yes
+
+# Default.
+log_level=warning
+report_level=changed_attributes
+
+report_url=file:@@{LOGDIR}/aide.log
+report_url=stdout
+#report_url=stderr
+#
+# Here are all the attributes we can check
+#p:       permissions
+#i:       inode
+#n:       number of links
+#l:       link name
+#u:       user
+#g:       group
+#s:       size
+###b:        block count
+#m:       mtime
+#a:       atime
+#c:       ctime
+#S:       check for growing size
+#I:       ignore changed filename
+#ANF:     allow new files
+#ARF:     allow removed files
+#
+
+# Here are all the digests we can use
+#md5:           md5 checksum
+#sha1:          sha1 checksum
+#sha256:        sha256 checksum
+#sha512:        sha512 checksum
+#rmd160:        rmd160 checksum
+#tiger:         tiger checksum
+#haval:         haval checksum
+#crc32:         crc32 checksum
+#gost:          gost checksum
+#whirlpool:     whirlpool checksum
+
+# These are the default rules
+#R:             p+i+l+n+u+g+s+m+c+md5
+#L:             p+i+l+n+u+g
+#E:             Empty group
+#>:             Growing logfile p+l+u+g+i+n+S
+
+# You can create custom rules - my home made rule definition goes like this
+ALLXTRAHASHES = sha1+rmd160+sha256+sha512+whirlpool+tiger+haval+gost+crc32
+ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger
+# Everything but access time (Ie. all changes)
+EVERYTHING = R+ALLXTRAHASHES
+
+# Sane, with multiple hashes
+# NORMAL = R+rmd160+sha256+whirlpool
+NORMAL = R+rmd160+sha256
+
+# For directories, don't bother doing hashes
+DIR = p+i+n+u+g+acl+xattrs
+
+# Access control only
+PERMS = p+i+u+g+acl
+
+# Logfile are special, in that they often change
+LOG = >
+
+# Just do md5 and sha256 hashes
+LSPP = R+sha256
+
+# Some files get updated automatically, so the inode/ctime/mtime change
+# but we want to know when the data inside them changes
+DATAONLY =  p+n+u+g+s+acl+xattrs+md5+sha256+rmd160+tiger
+
+
+# Next decide what directories/files you want in the database.
+
+/boot   NORMAL
+/bin    NORMAL
+/sbin   NORMAL
+/lib    NORMAL
+/lib64  NORMAL
+/opt    NORMAL
+/usr    NORMAL
+/root   NORMAL
+# These are too volatile
+!/usr/src
+!/usr/tmp
+
+# Check only permissions, inode, user and group for /etc, but
+# cover some important files closely.
+/etc    PERMS
+!/etc/mtab
+# Ignore backup files
+!/etc/.*~
+/etc/exports  NORMAL
+/etc/fstab    NORMAL
+/etc/passwd   NORMAL
+/etc/group    NORMAL
+/etc/gshadow  NORMAL
+/etc/shadow   NORMAL
+/etc/security/opasswd   NORMAL
+
+/etc/hosts.allow   NORMAL
+/etc/hosts.deny    NORMAL
+
+/etc/sudoers NORMAL
+/etc/skel NORMAL
+
+/etc/logrotate.d NORMAL
+
+/etc/resolv.conf DATAONLY
+
+/etc/nscd.conf NORMAL
+/etc/securetty NORMAL
+
+# Shell/X starting files
+/etc/profile NORMAL
+/etc/bashrc NORMAL
+/etc/bash_completion.d/ NORMAL
+/etc/login.defs NORMAL
+/etc/zprofile NORMAL
+/etc/zshrc NORMAL
+/etc/zlogin NORMAL
+/etc/zlogout NORMAL
+/etc/profile.d/ NORMAL
+/etc/X11/ NORMAL
+
+# Ignore logs
+!/var/lib/pacman/.*
+!/var/cache/.*
+!/var/log/.*
+!/var/run/.*
+!/var/spool/.*

roles/Aether/tasks/client.yml

@@ -0,0 +1,27 @@
+---
+
+ - name: Copy the key
+   become: true
+   copy:
+     dest: /home/aether/.ssh/aether
+     content: "{{ aether_key.stdout }}"
+
+ - name: Copy the public key
+   become: true
+   copy:
+     dest: /home/aether/.ssh/aether.pub
+     content: "{{ aether_key.stdout }}"
+
+ - name: Enable the service
+   become: yes
+   service:
+     name: aether.timer
+     state: enabled
+     running: yes
+
+ - name: Enable the service - 2
+   become: yes
+   service:
+     name: aether-gen.timer
+     state: disabled
+     running: no

roles/Aether/tasks/main.yml

@@ -0,0 +1,64 @@
+---
+
+ - name: Install the package
+   become: true
+   ignore_errors: true
+   package:
+     name: Aether
+     state: present
+
+ - name: Validate the user
+   vars:
+     service_account: aether
+   include_tasks: ../roles/common/service_account.yml
+
+ - name: Ensure the Aether identity is protected.
+   become: true
+   file:
+     path: "{{ item }}"
+     state: directory
+     owner: aether
+     group: aether
+     mode: 0700
+   loop:
+     - /home/aether/.ssh
+     - /usr/local/etc/Aether
+     - /usr/local/etc/Aether/backup-entries
+     - /usr/local/backup
+
+ - name: Ensure the Aether identity exists
+   delegate_to: Core # Core will track the identity that will then be shared to everyone else.
+   become: true
+   command:
+     creates: /home/aether/.ssh/aether
+     chdir: /home/aether/.ssh/
+     cmd: ssh-keygen -t ed25519 -N "" -f ./aether
+
+ - name: Read the Aether identity
+   become: true
+   delegate_to: '{{ aether_primary }}'
+   command: cat /home/aether/.ssh/aether
+   register: aether_key
+
+ - name: Read the Aether public identity
+   become: true
+   delegate_to: '{{ aether_primary }}'
+   command: cat /home/aether/.ssh/aether.pub
+   register: aether_pubkey
+
+ - include_tasks: source.yml
+   when: "{{ inventory_hostname }} is {{ aether_primary }}"
+
+ - include_tasks: client.yml
+   when: "{{ inventory_hostname }} is {{ aether_primary }}"
+
+ - name: Ensure the Aether identity files are protected.
+   become: true
+   file:
+     path: "{{ item }}"
+     owner: aether
+     group: aether
+     mode: 0600
+   loop:
+     - /home/aether/.ssh/aether
+     - /home/aether/.ssh/aether.pub

roles/Aether/tasks/source.yml

@@ -0,0 +1,42 @@
+---
+
+ - name: Copy the backup scripts
+   become: yes
+   copy:
+     src: "backup-entries/{{ inventory_hostname }}"
+     dest: "/usr/local/etc/Aether/backup-entries"
+     owner: aether
+     group: aether
+
+ - name: Seed the backup passphrase
+   become: yes
+   copy:
+     content: "{{ passwords['Aether'] }}"
+     dest: "/usr/local/etc/Aether/pass.txt"
+     owner: aether
+     group: aether
+     mode: 0600
+
+ - name: Enable the generation service
+   become: yes
+   when: "{{ inventory_hostname }} == 'Core'"
+   service:
+     name: aether-gen.timer
+     state: enabled
+     running: yes
+
+ - name: Enable the generation service - 2
+   become: yes
+   when: "{{ inventory_hostname }} == 'Core'"
+   service:
+     name: aether.timer
+     state: disabled
+     running: no
+
+ - name: Set up the authorized_keys
+   template:
+     src: authorized_keys.j2
+     dest: /home/aether/.ssh/authorized_keys
+     mode: 0600
+     owner: aether
+     group: aether

roles/Chappaai/README.md

@@ -0,0 +1,18 @@
+A Chappaai host is a gateway to accessing other hosts. It is a safeguard against admin error.
+
+## Etymology
+Chappaai hosts are named to follow the non-English naming of the Stargate network by the other denizens of the galaxy.
+
+They are the first line of defense against administrative error -- similar to the way that [Stargate Command](https://stargate.fandom.com/wiki/Stargate_Command) was for Earth. They prevent admins from being locked out of correcting their changes and are connected to everything in the ecosystem. They also control DNS, which allows a sort of subliminal control of the entire ecosystem. This prevents infiltration by infections (similar to Goauld) and in fact can be the extinction of any DNS-enabled malware in the ecosystem by sinkholing the Command-and-Control.
+
+## Capacity and Components
+A Chappaai host needs minimal CPU or memory.
+
+## Hosted Services and Entities
+Chappaai should host a Pihole installation and [SSH](../Services/SSH.md). It should be linked by NAT to an obscure port to the outside world.
+
+## Connections
+Any host should be able to connect to a Chappaai with SSH and X11, and it should be able to dial to any service provider.
+
+## Additional Reference
+Chappaai hosts should be deployed alongside any Hypervisor. They can be as simple as a Pi-hole with SSH access, and they should be allowed to receive SSH connections from a non-tcp/22/ssh port.

roles/Chappaai/tasks/main.yml

@@ -17,7 +17,7 @@
 
  - name: Ensure pihole web admin password
    become: yes
-   command: "pihole -a -p {{ passwords['Nazara'] }}"
+   command: "pihole -a -p {{ passwords['Chappaai'] }}"
      # when: pihole_install.changed
 
  - name: Generate DNS/DHCP from inventory
@@ -25,7 +25,7 @@
    run_once: true
    command: "python3 ../bin/generate-pihole-dns-dhcp.py {{ inventory_file }}"
 
- - name: Nazara DNS
+ - name: Chappaai DNS
    become: yes
    register: dns_updated
    copy:
@@ -35,7 +35,7 @@
      group: pihole
      mode: 0644
 
- - name: Nazara DHCP
+ - name: Chappaai DHCP
    become: yes
    register: dhcp_updated
    copy:
@@ -45,7 +45,7 @@
      group: root
      mode: 0644
 
- - name: Nazara Configuration
+ - name: Chappaai Configuration
    become: yes
    register: conf_updated
    copy:
@@ -56,7 +56,7 @@
      mode: 0644
 
 
- - name: Nazara DHCP Leases dir
+ - name: Chappaai DHCP Leases dir
    become: yes
    file:
      path: /var/lib/misc/
@@ -65,7 +65,7 @@
      group: root
      mode: 0777
 
- - name: Nazara DHCP Leases
+ - name: Chappaai DHCP Leases
    become: yes
    file:
      path: /var/lib/misc/dnsmasq.leases

roles/DarkNet/tasks/main.yml

@@ -20,6 +20,8 @@
       mode: 0600
       owner: openvpn
       group: network
+      # Must ensure that we have the latest.
+      force: true
 
   - name: OpenVPN Auth part 1
     become: yes

roles/Foundation/README.md

@@ -3,26 +3,18 @@ The Foundation is a one-stop shop for source code from AniNIX developers -- it's
 # Etymology
 The etymology of the Foundation is twofold. First and foremost, the AniNIX attempts to automate any new package it is using as much as possible, and as such the Foundation holds the very basis on which the AniNIX is built.
 
-Secondly, the Foundation is the third piece of the charity trinity for the AniNIX, along with the Wiki and the [https://aninix.net/pages/charity.php short-term charity projects]. The AniNIX puts a lot of time into designing its projects and making sure they work. Rather than forcing others to redo this work, we offer commented code and documentation so that the process is transparent but the work-by-hand is minimized.[[Category:Charity]]
+Secondly, the Foundation is the third piece of the charity trinity for the AniNIX, along with the Wiki and the [https://aninix.net/pages/charity.php short-term charity projects]. The AniNIX puts a lot of time into designing its projects and making sure they work. Rather than forcing others to redo this work, we offer commented code and documentation so that the process is transparent but the work-by-hand is minimized.
 
 # Relevant Files and Software
-The Git system was created by the Linux project to manage changes to the kernel and has been on the rise for some time among Version Control Systems (VCS's) with projects like GitHub. The AniNIX self-hosts the repositories in [file:///srv/foundation/ the Foundation server folder] on [[Core]].
+The Git system was created by the Linux project to manage changes to the kernel and has been on the rise for some time among Version Control Systems (VCS's) with projects like GitHub. The AniNIX self-hosts the repositories in [the Foundation server folder](file:///srv/foundation/) on Yggdrasil for the sake of the largest filesystem.
 
-[[WebServer]] is configured to translate the repository to [https://aninix.net/foundation/ the Web-accessible format] via the ArchLinux cgit package. Review the package list at that link and identify the source packages you want to use. Then use the following to clone the source, generally best done to /usr/local/src/ on Linux. Please note that the AniNIX uses Webserver translation to eliminate the need for a .git suffix -- web requests will show in CGIT, while Git clone requests will pull the package all from the same URL. Right-click on your package of choice from the web interface's index page and then clone that address. <pre>
-git clone https://aninix.net/foundation/<packagename>
-</pre>
+[WebServer](../WebServer) is configured to translate the repository to [https://foundation.aninix.net/](foundation.aninix.net) via the Gitea package. AniNIX projects will live under that organization. Review the package list at that link and identify the source packages you want to use. The UI will tell you how to copy the link to clone.
 
-New packages should make sure to refer to the [[Development Best Practices]] to ensure they are compliant with standards; if you notice an issue with the Foundation's code, make sure to submit a [[QANs|QAN]]. [[TeamGreen|AniNIX::TeamGreen]] should be running regressions on these projects.
+New packages should make sure to refer to the [Development Best Practices](/AniNIX/Wiki/) to ensure they are compliant with standards; if you notice an issue with the Foundation's code, make sure to submit a [[QANs|QAN]]. [[TeamGreen|AniNIX::TeamGreen]] should be running regressions on these projects.
 
 You can use [https://aur.archlinux.org/packages/hexedit-advanced-search/ Hexedit] to edit [file:///usr/share/webapps/cgit/cgit.cgi cgit.cgi] to have a different name, such as "AniNIX::Foundation Web".
 
 ## Dependencies
-For CentOS, one needs to use the following steps to install Mono. Packages like Cryptoworkbench, Heartbeat, Cerberus, and others require this.
-* yum install bison gettext glib2 freetype fontconfig libpng libpng-devel libX11 libX11-devel glib2-devel libgdi* libexif glibc-devel urw-fonts java unzip gcc gcc-c++ automake autoconf libtool make bzip2 wget
-* [https://download.mono-project.com/sources/mono/ Download Mono source]
-* tar xjvf the source package
-* configure; make; make install
-
 *Note:* We used to declare the INSTALLER variable at the top of Makefiles, but no longer do. Non-ShadowArch installs should double check dependencies against the PKGBUILD files manually. We will try to keep this list short.
 
 # Available Clients
@@ -30,36 +22,30 @@ To get a client to access the Foundation, use one of the following or visit
 * ArchLinux: pacman -S git
 * Ubuntu: apt-get install git
 * RHEL/CentOS: yum install git
-* Windows: [https://git-scm.com/download/win Go here], but please be aware that file paths and such are coded for Linux. Windows users will need to conduct extensive code review to install these packages.
+* Windows: [https://git-scm.com/download/win Git-Bash] is the recommended client.
+  * Please be aware that file paths and such are coded for Linux. Windows users will need to conduct extensive code review to install these packages.
+  * Users are also strongly recommended to install [https://www.gpg4win.org/index.html gpg4win] in order to sign commits with their GPG key.
 * Mac: [https://git-scm.com/download/mac Go here]
 
 Each package will need to be checked out individually.
 
-**Alternatively**: ArchLinux users can add the following segment to the bottom of pacman.conf to install the packages as bundled by the AniNIX. We're working on adding GPG signing -- in the meantime, security-conscious users should build from source anyway.
-<pre>
-[AniNIX::Foundation]
-SigLevel = Optional TrustAll
-Server = https://aninix.net/foundation/
-</pre>
-
 # Equivalents or Competition
-The most famous equivalent is [https://github.com GitHub]. Other source code control systems exist, including some provided by employers or academic institutions -- GitLab provides an enterprise-style implementation. Other protocol implementations vary widely -- Mercurial, Bazaar, and SVN are other revision control systems others use. We appreciate the flexibility of Git.
+The most famous equivalent is [https://github.com](GitHub). Other source code control systems exist, including some provided by employers or academic institutions -- GitLab provides an enterprise-style implementation. Other protocol implementations vary widely -- Mercurial, Bazaar, and SVN are other revision control systems others use. We appreciate the flexibility of Git.
 
 # Additional Reference
 Some core Git tools are leveraged in specific ways for the AniNIX.
 
 ## Config for Author
-Even though the [[Talk:IRC#Why_Not_SMTP|AniNIX doesn't use SMTP]], we still use the @aninix.net suffix for the user.email config property on branches. All commits, therefore, should have the proper-case of the user's [[IRC|AniNIX::IRC]] handle as the user.name attribute, and the lower-cased username followed by @aninix.net for the user.email attribute.
+[We don't use SMTP.](/AniNIX/Wiki/issues/8) We recommend GPG keys be created with your IRC address included, in the format `ircs://aninix.net:6697/$username`. This will throw some complaints if your project gets mirrored to GitHub, as GitHub wants your key to be verified through email, but within our ecosystem the commits will be verified.
 
-## Tags for Semantic Versioning
-We version our projects according to [https://semver.org/ Semantic Versioning] -- this versioning is established using the git tag as major and minor version, the git commit as the patch, and the number of commits since the tag as the ArchLinux release note.
+To do this, see [our encryption article](https://aninix.net/AniNIX/Wiki/src/branch/main/Articles/Getting_Started_With_Encryption.md#GPG_Keys).
 
-[https://aninix.net/cgit/cgit.cgi/HelloWorld/tree/PKGBUILD Our HelloWorld PKGBUILD] demonstrates this -- most of the metadata for the package is populated directly by git, and only dependencies are tracked in the PKGBUILD itself.
+## Development Standards
+
+If you are developing projects for the AniNIX organization or want to use our standards, ensure that the project is cloned with [AniNIX/Uniglot](/AniNIX/Uniglot)'s `uniglot-clone`. This will run pre-commit hooks to check your project.
 
 ## Branches for Functional Improvements
-All major functional improvements being worked should be tracked in a branch. The branch name should be the same as the [[QANs|QAN]] for which the branch was started or the functional concept's shortname.
+All major functional improvements being worked should be tracked in a branch. The branch name should be linked to the issue for which the branch was started or the functional concept's shortname.
 
 ## Filter-branch to Prune
-Git maintains a history of all files. If you need to remove files permanently, GitHub maintains [https://help.github.com/articles/removing-sensitive-data-from-a-repository/ an article] on how to use "git filter-branch" to purge it.
-}}
-[[Category:Public_Service]]
+Git maintains a history of all files. If you need to remove files permanently, GitHub maintains [an article](https://help.github.com/articles/removing-sensitive-data-from-a-repository/) on how to use `git filter-branch` to purge it.

roles/Foundation/files/custom/bin/gen-aninix-custom

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-URI=https://aninix.net/assets/css/theme-arc-green.css
+URI=https://aninix.net/assets/css/theme-gitea-dark.css
 
 # Gitea arc-green palette
 BOLDTEXT='#87ab63'
@@ -52,7 +52,7 @@ a {
     | sed "s/$ROW/$ANINIXROW/gI" \
     | sed "s/$NAV/$ANINIXNAV/gI" \
     | sed "s/$HOVER/$ANINIXHOVER/gI" \
-    | sed "s/$BGCOLOR/$ANINIXBG/gI" > /var/lib/gitea/custom/public/css/theme-aninix.css
+    | sed "s/$BGCOLOR/$ANINIXBG/gI" > /var/lib/gitea/custom/public/assets/css/theme-aninix.css
 
 cd /var/lib/gitea/web-snippets
 head="$(curl -ks https://aninix.net/ | grep -B 99999 -E '^<div class="home"')"
@@ -60,5 +60,8 @@ foot="$(curl -ks https://aninix.net/ | grep -A 99999 -E '<footer>')"
 for i in `find . -type f`; do
     (echo "$head"
     cat "$i"
-    echo "$foot") > /var/lib/gitea/custom/public/"$i".html
+    echo "$foot") > /var/lib/gitea/custom/public/assets/"$i".html
 done
+
+# AniNIX Martial Arts Special Sauce
+sed -i 's#/user/login?redirect_to=%2f#/user/login?redirect_to=%2FMartialArts#g' /var/lib/gitea/custom/public/assets/martialarts/index.html

roles/Foundation/files/custom/public/assets/js/aninix.js

@@ -0,0 +1,31 @@
+/* RSS Reading */
+function insertNewsSnippet(snippet,tag) {
+    /* DOM XML handling has been too problematic, so we are now using git-hooks to pre-generate the snippet. This function injects that snippet.
+     * param snippet: URI for the snippet
+     * param tag: div tag to overwrite
+     */
+    var http_request = false;
+    http_request = new XMLHttpRequest();
+    http_request.open("GET",snippet,true);
+    http_request.setRequestHeader("Cache-Control", "no-cache");
+    http_request.setRequestHeader("Pragma", "no-cache");
+    http_request.onreadystatechange = function() {
+        if (http_request.readyState == 4) {
+            if (http_request.status == 200) {
+                if (http_request.responseText != null) {
+                    document.getElementById(tag).innerHTML = http_request.responseText;
+                } else {
+                    alert("Failed to receive RSS file from the server - file not found.");
+                    return false;
+                }
+            }
+        }
+    }
+
+    http_request.send(null);
+}
+
+/* Contact Obfuscation */
+function insertContactInfo() {
+    document.getElementById('contact-insert').innerHTML = '<b>Contact Us:</b><br/>Emai' + 'l: aninix' + '@' + 'proto' + 'n.me <br/>Phone: (60' + '8) 56' + '1-3607';
+}

roles/Foundation/files/custom/public/css/emby-web-dark-theme-BenZuser.css

@@ -1,472 +0,0 @@
-/* Borrowed from https://rawgit.com/BenZuser/Emby-Web-Dark-Themes-CSS/master/RED/theme.css */
-/* 
-_________________________________________________________________________
-------------------------- COLOR HEX & RGB CODES -------------------------
-		
-	RED 	    : #E81123 & (232, 17, 35)
-	DARK COLOR  : #94131E
-
-	ORANGE      : #FF8000 & (255, 128, 0)
-	DARK COLOR  : #BF6000
-
-	ORANGE PLEX : #CC7B19 & (204, 123, 25)
-	DARK COLOR  : #B35A00
-
-	YELLOW      : #BDBD00 & (189, 189, 0)
-	DARK COLOR  : #757500
-
-	GREEN       : #52B54B & (82, 181, 75)
-	DARK COLOR  : #3E8437
-
-	BLUE	    : #4285F4 & (66, 133, 244)
-	DARK COLOR  : #0C57D6
-	
-	BLUE DARK	: #3367d6 & (51,103,214)
-	BLUE DARK (DARK) : #1f4698
-
-	PURPLE      : #673AB7 & (103, 58, 183)
-	DARK COLOR  : #3F2471
-
-	GRAY	    : #7F7F7F & (127, 127, 127)
-	DARK COLOR  : #535353
-
-	PINK	    : #F707DF & (247, 7, 223)
-	DARK COLOR  : #C604B3
-	
-*/
-/*
-_________________________________________________________________________
------------------------ EMBY THEME : ACCENT COLORS ----------------------
-
-                 ---------- Table of Contents ---------- 
-
-	1. ACCENT COLORS
-	   1.1 Buttons
-	       1.1.1 Checkboxes
-		   1.1.2 Rectangles
-		   1.1.3 Links & Text buttons
-		   1.1.4 Others
-	   1.2 Details
-	       1.2.1 Circles
-		   1.2.2 Indicators
-		   1.2.3 Fonts
-		   1.2.4 Icons
-		   1.2.5 Dialogs & Action Sheets
-		   1.2.6 Others
-	   1.3 Fixes
-	   
-	2. MISCELLANEOUS MODIFICATIONS
-	   2.1 Buttons
-	   2.2 Details
-	       2.2.1 Scrollbars
-	       2.2.2 Logos
-	       2.2.3 Others
-	   2.3 Fixes
-	       2.3.1 Dark Colors		   
-		   
-*/
-/* ------------------------ 1. ACCENT COLORS ------------------------- */
-/* ----- 1.1 Buttons ----- */
-/* 1.1.1 Checkboxes */
-.emby-checkbox:checked + span + span + .checkboxOutline > .checkboxOutlineTick {
-  background-color: #E81123 !important; }
-
-.emby-checkbox:checked + span + span + .checkboxOutline,
-.progressring-spiner {
-  border-color: #E81123 !important; }
-
-.emby-checkbox:focus + span + .emby-checkbox-focushelper {
-  background-color: #E81123 !important;
-  opacity: 0.26 !important; }
-
-/* 1.1.2 Rectangles */
-.raised {
-  background: #404040 !important;
-  color: #fff !important; }
-
-.button-submit, .button-accent {
-  background: #E81123 !important;
-  color: #fff; }
-
-.raised-mini.emby-button {
-  background: #E81123 !important;
-  color: #ffffff !important; }
-
-/* Restart */
-.btnRestartContainer.emby-button {
-  background: #E81123 !important;
-  color: #fff; }
-
-/* Play & Resume */
-.btnPlaySimple.emby-button {
-  background: #E81123 !important;
-  color: #fff; }
-
-.btnResume.emby-button {
-  background: #94131E !important;
-  color: #fff; }
-
-/* 1.1.3 Links & Text buttons */
-.button-link, .button-flat-accent, .button-accent-flat,
-.textlink {
-  color: #E81123 !important; }
-
-.button-link:hover, .button-flat-accent:hover,
-.button-accent-flat:hover, .textlink:hover {
-  color: #9b9b9b !important; }
-
-.button-link:active, .button-flat-accent:active,
-.button-accent-flat:active, .textlink:active {
-  color: #94131E !important; }
-
-/* Top Header */
-.emby-tab-button-active {
-  color: #E81123 !important; }
-
-/* 1.1.4 Others */
-/* Alpha Picker */
-.alphaPickerButton-selected, .alphaPickerButton-tv:focus {
-  background-color: #E81123 !important;
-  color: #fff !important; }
-
-/* Radio Buttons */
-.mdl-radio__inner-circle {
-  background: #E81123 !important; }
-
-.mdl-radio__button:checked + .mdl-radio__label + .mdl-radio__outer-circle {
-  border: 2px solid #E81123 !important; }
-
-.mdl-radio__button:checked:focus + .mdl-radio__label + .mdl-radio__outer-circle + .mdl-radio__inner-circle {
-  -webkit-box-shadow: 0 0 0 10px rgba(232, 17, 35, 0.26) !important;
-  box-shadow: 0 0 0 10px rgba(232, 17, 35, 0.26) !important; }
-
-/* Control Group Buttons */
-div[data-role="controlgroup"] a.ui-btn-active[data-role='button'] {
-  background: #E81123 !important;
-  color: #ffffff !important; }
-
-/* ----- 1.2 Details ----- */
-/* 1.2.1 Circles */
-/*.listItemIcon:not(.listItemIcon-transparent) {
-    background-color: $accent-color !important; }*/
-.dashboardSection i.listItemIcon.md-icon {
-  background-color: #E81123 !important; }
-
-.scheduledTaskPaperIconItem[data-status="Running"] i.listItemIcon.md-icon {
-  background-color: #94131E !important; }
-
-/* Focus Helper circles */
-.paper-icon-button-light:focus {
-  color: #E81123 !important; }
-
-/* 1.2.2 Indicators */
-.countIndicator, .playedIndicator {
-  background: #E81123 !important; }
-
-.levelNormal {
-  background-color: #E81123 !important; }
-
-.fullSyncIndicator {
-  background: #E81123 !important;
-  color: #fff; }
-
-.playstatebutton-played i, .ratingbutton-withrating i {
-  color: #E81123 !important; }
-
-p#pUpToDate i.md-icon {
-  background-color: #E81123 !important; }
-
-/* Loading Spinners */
-.mdl-spinner__layer-1, .mdl-spinner__layer-2, .mdl-spinner__layer-3,
-.mdl-spinner__layer-4 {
-  border-color: #E81123 !important; }
-
-.progressring-spiner {
-  border: 0.25em solid #E81123 !important; }
-
-/* 1.2.3 Fonts */
-.selectLabelFocused, .textareaLabelFocused, .inputLabelFocused {
-  color: #E81123 !important; }
-
-.secondary.listItemBodyText span, div#divRunningTasks span {
-  color: #E81123 !important; }
-
-/* 1.2.4 Icons */
-.starIcon, .mediaInfoTimerIcon {
-  color: #E81123 !important; }
-
-/* Top Header */
-.btnActiveCast {
-  color: #E81123 !important; }
-
-/* Now Playing Bar & Now Playing Page */
-.repeatActive,
-button.btnCommand.repeatToggleButton.autoSize.nowPlayingPageRepeatActive {
-  color: #E81123 !important; }
-
-/* 1.2.5 Dialogs & Action Sheets */
-/* 1.2.6 Others */
-/* General Accent Color Modifications */
-:focus {
-  outline: #E81123 auto 5px; }
-
-select:focus {
-  border-color: #E81123 !important; }
-
-::selection {
-  background-color: #94131E !important; }
-
-.emby-input:focus, .emby-textarea:focus {
-  border-color: #E81123 !important; }
-
-/* Google Now Playing Bar & Now Playing Page */
-.iconOsdProgressInner, .mdl-slider__background-lower, .sliderBubble,
-.mdl-slider::-webkit-slider-thumb {
-  background: #E81123 !important; }
-
-.mdl-slider:focus::-webkit-slider-thumb {
-  -webkit-box-shadow: 0 0 0 10px rgba(232, 17, 35, 0.26);
-  box-shadow: 0 0 0 10px rgba(232, 17, 35, 0.26) !important; }
-
-/* Firefox Now Playing Bar & Now Playing Page */
-.mdl-slider::-moz-range-thumb, .mdl-slider::-moz-range-progress {
-  background: #E81123 !important; }
-
-.mdl-slider:focus::-moz-range-thumb {
-  box-shadow: 0 0 0 10px rgba(232, 17, 35, 0.26) !important; }
-
-/* Progress Bars */
-.itemProgressBarForeground {
-  background-color: #E81123 !important; }
-
-.taskProgressInner {
-  background: #E81123 !important; }
-
-/* Google Progress Bars */
-progress::-webkit-progress-value {
-  background: #E81123 !important; }
-
-/* Firefox Progress Bars */
-progress::-moz-progress-bar {
-  background: #E81123 !important; }
-
-/* Edge Progress Bars */
-progress {
-  background: #E81123 !important; }
-
-/* Main Drawers */
-.navMenuDivider {
-  background: #262626 !important; }
-
-.adminDrawerLogo {
-  border-bottom: 1px solid #262626 !important; }
-
-.mainDrawer {
-  background: #181818 !important; }
-
-.sidebarHeader {
-  color: #bbbbbb !important; }
-
-.navMenuOption {
-  color: #ffffff !important; }
-
-.navMenuOption.navMenuOption-selected {
-  background: #252528 !important;
-  color: #E81123 !important; }
-
-.navMenuOption:hover {
-  background: #252528 !important;
-  color: #9b9b9b !important; }
-
-/* Metadata Editor */
-div.jstree-wholerow.jstree-wholerow-clicked:hover,
-div.jstree-wholerow.jstree-wholerow-clicked,
-div.jstree-wholerow.jstree-wholerow-hovered {
-  background: #252528 !important; }
-
-.jstree-anchor.jstree-clicked,
-.jstree-anchor.jstree-clicked.jstree-hovered {
-  background: #252528 !important;
-  color: #E81123 !important; }
-
-/* Multi-select */
-.itemSelectionPanel {
-  border: 1px solid #E81123 !important; }
-
-.selectionCommandsPanel {
-  background: #E81123 !important;
-  color: #fff; }
-
-/* upNextDialog */
-.upNextDialog-countdownText {
-  color: #E81123 !important; }
-
-/* Selection Bars */
-.emby-select-selectionbar, .emby-textarea-selectionbar,
-.emby-input-selectionbar {
-  background-color: #E81123 !important; }
-
-/* Media Info Detail Image */
-.itemDetailImage.loaded:hover {
-  border: 1px solid #E81123 !important; }
-
-/* 1.3 Fixes */
-/* ------------------ 2. MISCELLANEOUS MODIFICATIONS ----------------- */
-/* ----- 2.1 Buttons ----- */
-/* Circles */
-.fab {
-  background-color: transparent !important;
-  -webkit-box-shadow: none !important;
-  box-shadow: none !important;
-  -webkit-transition: none !important;
-  -o-transition: none !important;
-  transition: none !important; }
-
-/* ----- 2.2 Details ----- */
-/* 2.2.1 Scrollbars */
-/* Google Chrome */
-::-webkit-scrollbar-corner {
-  background-color: #3B3B3B; }
-
-::-webkit-scrollbar {
-  width: 10px;
-  height: 10px;
-  background-color: #3B3B3B; }
-
-::-webkit-scrollbar-thumb {
-  -webkit-border-radius: 2px;
-  border-radius: 2px;
-  background: #888888; }
-
-/* Google Chrome - Dashboard Drawer */
-div.scrollContainer.smoothScrollY::-webkit-scrollbar-corner {
-  background-color: transparent !important; }
-
-div.scrollContainer.smoothScrollY::-webkit-scrollbar {
-  width: 2px;
-  height: 2px;
-  background-color: transparent !important; }
-
-div.scrollContainer.smoothScrollY::-webkit-scrollbar-thumb {
-  -webkit-border-radius: 2px;
-  border-radius: 2px;
-  background: #888888; }
-
-/* Google Chrome - Filter Dialog */
-.dynamicFilterDialog::-webkit-scrollbar-corner {
-  background-color: transparent !important; }
-
-.dynamicFilterDialog::-webkit-scrollbar {
-  width: 2px;
-  height: 2px;
-  background-color: transparent !important; }
-
-.dynamicFilterDialog::-webkit-scrollbar-thumb {
-  -webkit-border-radius: 2px;
-  border-radius: 2px;
-  background: #888888; }
-
-/* 2.2.2 Logos */
-/* Login Page */
-.imgLogoIcon {
-  content: url(https://cdn.rawgit.com/BenZuser/Emby-Dark-Themes-Resources/master/images/logos-and-icons/RED/logo.png) !important; }
-
-/* Main Drawer Mobile */
-.adminDrawerLogo img {
-  content: url(https://cdn.rawgit.com/BenZuser/Emby-Dark-Themes-Resources/master/images/logos-and-icons/RED/logo.png) !important; }
-
-/* Home Page */
-.pageTitleWithLogo {
-  background-image: url(https://cdn.rawgit.com/BenZuser/Emby-Dark-Themes-Resources/master/images/logos-and-icons/RED/logo.png) !important; }
-
-/* 2.2.3 Others	*/
-/* CSS Box */
-#txtCustomCss {
-  height: 300px !important;
-  overflow-y: scroll !important; }
-
-/* Select Box */
-select option {
-  background-color: #2b2b2b !important;
-  color: #ffffff !important; }
-
-/* Dialogs */
-.formDialogHeader:not(.formDialogHeader-clear),
-.formDialogFooter:not(.formDialogFooter-clear) {
-  background-color: #121212 !important;
-  color: #fff; }
-
-/* Headers */
-.skinHeader {
-  background-color: #080808 !important;
-  color: #fff !important; }
-
-.skinHeader-withBackground {
-  background-color: #080808 !important; }
-
-@supports (backdrop-filter: blur(1.5em)) or (-webkit-backdrop-filter: blur(1.5em)) {
-  .skinHeader-blurred {
-    background: rgba(20, 20, 20, 0.7) !important;
-    -webkit-backdrop-filter: blur(1.5em) !important;
-    backdrop-filter: blur(1.5em) !important; } }
-.skinHeader.semiTransparent {
-  -webkit-backdrop-filter: none !important;
-  backdrop-filter: none !important;
-  background-color: rgba(0, 0, 0, 0.4) !important;
-  background-image: -webkit-gradient(linear, left top, left bottom, color-stop(10%, rgba(0, 0, 0, 0.7)), color-stop(10%, transparent)) !important;
-  background-image: -webkit-linear-gradient(top, rgba(0, 0, 0, 0.7) 10%, transparent) !important;
-  background-image: -moz-linear-gradient(top, rgba(0, 0, 0, 0.7) 10%, transparent) !important;
-  background-image: -o-linear-gradient(top, rgba(0, 0, 0, 0.7) 10%, transparent) !important;
-  background-image: linear-gradient(to bottom, rgba(0, 0, 0, 0.7) 10%, transparent) !important; }
-
-.appfooter {
-  background: #080808 !important;
-  color: #fff !important; }
-
-@supports (backdrop-filter: blur(10px)) or (-webkit-backdrop-filter: blur(10px)) {
-  .appfooter-blurred {
-    background: rgba(24, 24, 24, 0.7) !important;
-    -webkit-backdrop-filter: blur(20px) !important;
-    backdrop-filter: blur(20px) !important; } }
-/* TV Global Modifications */
-.emby-tab-button-active.emby-button-tv {
-  color: #fff !important; }
-
-.guide-channelHeaderCell, .guide-channelTimeslotHeader {
-  background: #2e2e2e !important; }
-
-.guide-programTextIcon {
-  color: #1e1e1e !important;
-  background: #555 !important; }
-
-.guide-headerTimeslots {
-  color: #ccc !important; }
-
-/* ----- 2.3 Fixes ----- */
-/* 2.3.1 Dark Colors */
-.autoorganizetable tbody tr:nth-child(odd) td, .autoorganizetable tbody tr:nth-child(odd) th {
-  background-color: #222326 !important; }
-
-.autoorganizetable > .table > tbody > tr {
-  border: 1px solid #222326 !important; }
-
-/*
-_____________________________________________________________________
-
-    Emby Dark Themes is maintained by Ben Z (BenZuser)
-    with the contribution of Happy2Play.
-_____________________________________________________________________
-
-*/
-/* TEMPORARY FIXES */
-/* Links */
-.searchSuggestionsList a, .noItemsMessage a, a.lnkPremiere {
-  color: #E81123 !important; }
-
-.searchSuggestionsList a:hover, .noItemsMessage a:hover,
-a.lnkPremiere:hover {
-  color: #9b9b9b !important; }
-
-.searchSuggestionsList a:active, .noItemsMessage a:active,
-a.lnkPremiere:active {
-  color: #94131E !important; }

roles/Foundation/files/custom/public/thank-you.html

@@ -1,271 +0,0 @@
-<!DOCTYPE html>
-<html lang="en-US" class="theme-">
-<head data-suburl="">
-	<meta charset="utf-8">
-	<meta name="viewport" content="width=device-width, initial-scale=1">
-	<meta http-equiv="x-ua-compatible" content="ie=edge">
-	<title> AniNIX </title>
-	<link rel="manifest" href="/manifest.json" crossorigin="use-credentials">
-	<meta name="theme-color" content="#ff0000">
-	<meta name="author" content="AniNIX::Foundation" />
-	<meta name="description" content="AniNIX::Foundation \\ Code, documentation, and information sharing powered by Gitea (git with a cup of tea)" />
-	<meta name="keywords" content="go,git,self-hosted,gitea,aninix,aninix::foundation">
-	<meta name="referrer" content="no-referrer" />
-	<meta name="_csrf" content="iI1Kkrppem-yCnHGCll-UshSK6A6MTYwMDcwNjM3MTUxOTU5NzYxNg" />
-	
-	
-	
-
-	<script>
-	/*
-	@licstart  The following is the entire license notice for the
-        JavaScript code in this page.
-
-	Copyright (c) 2016 The Gitea Authors
-	Copyright (c) 2015 The Gogs Authors
-
-	Permission is hereby granted, free of charge, to any person obtaining a copy
-	of this software and associated documentation files (the "Software"), to deal
-	in the Software without restriction, including without limitation the rights
-	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-	copies of the Software, and to permit persons to whom the Software is
-	furnished to do so, subject to the following conditions:
-
-	The above copyright notice and this permission notice shall be included in
-	all copies or substantial portions of the Software.
-
-	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-	AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-	LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-	OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-	THE SOFTWARE.
-	---
-	Licensing information for additional javascript libraries can be found at:
-	  {{StaticUrlPrefix}}/vendor/librejs.html
-
-	@licend  The above is the entire license notice
-        for the JavaScript code in this page.
-	*/
-	</script>
-	<script>
-		window.config = {
-			AppVer: '1.12.4',
-			AppSubUrl: '',
-			StaticUrlPrefix: '',
-			UseServiceWorker:  true ,
-			csrf: 'iI1Kkrppem-yCnHGCll-UshSK6A6MTYwMDcwNjM3MTUxOTU5NzYxNg',
-			HighlightJS: false,
-			Minicolors: false,
-			SimpleMDE: false,
-			Tribute: false,
-			U2F: false,
-			Heatmap: false,
-			heatmapUser: null,
-			NotificationSettings: {
-				MinTimeout:  10000 ,
-				TimeoutStep:   10000 ,
-				MaxTimeout:  60000 ,
-				EventSourceUpdateTime:  10000 ,
-			},
-      
-		};
-	</script>
-	<link rel="shortcut icon" href="/img/favicon.png">
-	<link rel="mask-icon" href="/img/gitea-safari.svg" color="#609926">
-	<link rel="fluid-icon" href="/img/gitea-lg.png" title="AniNIX">
-	<link rel="stylesheet" href="/vendor/assets/font-awesome/css/font-awesome.min.css">
-
-
-
-	<link rel="stylesheet" href="/fomantic/semantic.min.css?v=d8d448774563cec3783c3b65d4e914b6">
-	<link rel="stylesheet" href="/css/index.css?v=d8d448774563cec3783c3b65d4e914b6">
-	<noscript>
-		<style>
-			.dropdown:hover > .menu { display: block; }
-			.ui.secondary.menu .dropdown.item > .menu { margin-top: 0; }
-		</style>
-	</noscript>
-
-	<style class="list-search-style"></style>
-
-	<meta property="og:title" content="AniNIX">
-	<meta property="og:type" content="website" />
-	<meta property="og:image" content="/img/gitea-lg.png" />
-	<meta property="og:url" content="https://foundation.aninix.net/" />
-	<meta property="og:description" content="AniNIX::Foundation \\ Code, documentation, and information sharing powered by Gitea (git with a cup of tea)">
-
-<meta property="og:site_name" content="AniNIX" />
-
-	<link rel="stylesheet" href="/css/theme-aninix.css?v=d8d448774563cec3783c3b65d4e914b6">
-
-<link rel="icon" type="image/png" href="/img/AniNIX.png" />
-<link rel="alternate" type="application/rss+xml" title="AniNIX::RSS" href="/aninix.xml" />
-<link rel='apple-touch-icon' sizes='180x180' href='/img/AniNIX.png' />
-<meta name='apple-mobile-web-app-capable' content='yes' />
-
-</head>
-<body>
-	
-
-	<div class="full height">
-		<noscript>This website works better with JavaScript.</noscript>
-
-		
-
-		
-			<div class="ui top secondary stackable main menu following bar light">
-				<div class="ui container" id="navbar">
-	<div class="item brand" style="justify-content: space-between;">
-		<a href="/">
-			<img class="ui mini image" src="/img/gitea-sm.png">
-		</a>
-		<div class="ui basic icon button mobile-only" id="navbar-expand-toggle">
-			<i class="sidebar icon"></i>
-		</div>
-	</div>
-
-	
-		<a class="item active" href="/">Home</a>
-		<a class="item " href="/explore/repos">Explore</a>
-	
-
-	<a class="item" target="_blank" id="chat" href="https://irc.aninix.net/">Chat</a>
-<a class="item" target="_blank" id="pwdchange" href="https://password.aninix.net/">Change Password</a>
-<a class="item" id="martialarts" href="/martialarts/">Martial Arts</a>
-
-
-	
-
-
-	
-		<a class="item" target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io">Help</a>
-		<div class="right stackable menu">
-			
-				<a class="item" href="/user/sign_up">
-					<svg class="svg octicon-person" width="16" height="16" aria-hidden="true"><use xlink:href="#octicon-person" /></svg> Register
-				</a>
-			
-			<a class="item" rel="nofollow" href="/user/login?redirect_to=">
-				<svg class="svg octicon-sign-in" width="16" height="16" aria-hidden="true"><use xlink:href="#octicon-sign-in" /></svg> Sign In
-			</a>
-		</div>
-	
-</div>
-
-			</div>
-		
-
-
-
-<div class="home">
-<h2>Thank you for your purchase!</h2>
-	<footer>
-	<div class="ui container">
-		<div class="ui left">
-			Powered by Gitea  Page: <strong>0ms</strong> Template: <strong>0ms</strong>
-		</div>
-		<div class="ui right links">
-			
-			<div class="ui language bottom floating slide up dropdown link item">
-				<i class="world icon"></i>
-				<div class="text">English</div>
-				<div class="menu">
-					
-						<a lang="en-US" class="item active selected" href="#">English</a>
-					
-						<a lang="zh-CN" class="item " href="?lang=zh-CN">简体中文</a>
-					
-						<a lang="zh-HK" class="item " href="?lang=zh-HK">繁體中文（香港）</a>
-					
-						<a lang="zh-TW" class="item " href="?lang=zh-TW">繁體中文（台灣）</a>
-					
-						<a lang="de-DE" class="item " href="?lang=de-DE">Deutsch</a>
-					
-						<a lang="fr-FR" class="item " href="?lang=fr-FR">français</a>
-					
-						<a lang="nl-NL" class="item " href="?lang=nl-NL">Nederlands</a>
-					
-						<a lang="lv-LV" class="item " href="?lang=lv-LV">latviešu</a>
-					
-						<a lang="ru-RU" class="item " href="?lang=ru-RU">русский</a>
-					
-						<a lang="uk-UA" class="item " href="?lang=uk-UA">Українська</a>
-					
-						<a lang="ja-JP" class="item " href="?lang=ja-JP">日本語</a>
-					
-						<a lang="es-ES" class="item " href="?lang=es-ES">español</a>
-					
-						<a lang="pt-BR" class="item " href="?lang=pt-BR">português do Brasil</a>
-					
-						<a lang="pl-PL" class="item " href="?lang=pl-PL">polski</a>
-					
-						<a lang="bg-BG" class="item " href="?lang=bg-BG">български</a>
-					
-						<a lang="it-IT" class="item " href="?lang=it-IT">italiano</a>
-					
-						<a lang="fi-FI" class="item " href="?lang=fi-FI">suomi</a>
-					
-						<a lang="tr-TR" class="item " href="?lang=tr-TR">Türkçe</a>
-					
-						<a lang="cs-CZ" class="item " href="?lang=cs-CZ">čeština</a>
-					
-						<a lang="sr-SP" class="item " href="?lang=sr-SP">српски</a>
-					
-						<a lang="sv-SE" class="item " href="?lang=sv-SE">svenska</a>
-					
-						<a lang="ko-KR" class="item " href="?lang=ko-KR">한국어</a>
-					
-				</div>
-			</div>
-			<a href="/vendor/librejs.html" data-jslicense="1">JavaScript licenses</a>
-			<a href="/api/swagger">API</a>
-			<a target="_blank" rel="noopener noreferrer" href="https://gitea.io">Website</a>
-			
-			
-		</div>
-	</div>
-</footer>
-
-
-	<script src="/js/jquery.js?v=d8d448774563cec3783c3b65d4e914b6"></script>
-
-
-
-
-
-
-
-
-	<script src="/fomantic/semantic.min.js?v=d8d448774563cec3783c3b65d4e914b6"></script>
-	<script src="/js/index.js?v=d8d448774563cec3783c3b65d4e914b6"></script>
-
-<script type="text/javascript">
-   var _gaq = _gaq || [];
-_gaq.push(['_setAccount', 'UA-18148792-3']);
-_gaq.push(['_trackPageview']);
-
-(function() {
-  var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
-  ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
-  var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
- })();
-
-</script>
-
-<script src="https://redalert.battleforthenet.com/widget.js" async></script>
-
-<script type="text/javascript">
-    document.getElementsByClassName('brand')[0].children[0].children[0].src="/img/AniNIX.png";
-    $('meta[property=og\\:image]').attr('content', '/img/AniNIX.png');
-    $('link[rel="mask-icon"]').attr('href', '/img/AniNIX.png');
-    $('link[rel="mask-icon"]').attr('color', '#000000');
-    document.getElementsById("pwdchange").setAttribute("target","_blank");
-    document.getElementsById("chat").setAttribute("target","_blank");
-</script>
-
-
-
-</body>
-</html>

roles/Foundation/files/custom/templates/custom/header.tmpl

@@ -2,3 +2,4 @@
 <link rel="alternate" type="application/rss+xml" title="AniNIX/RSS" href="/aninix.xml" />
 <link rel='apple-touch-icon' sizes='180x180' href='/assets/img/AniNIX.png' />
 <meta name='apple-mobile-web-app-capable' content='yes' />
+<script src="/assets/js/aninix.js"></script>

roles/Foundation/files/custom/templates/home.tmpl

@@ -1,78 +1,114 @@
 {{template "base/head" .}}
 <!-- BEGIN CUSTOM HOME -->
 <div class="home">
+
+    <!-- Title/Logo -->
     <div class="ui stackable middle very relaxed page grid">
         <div class="sixteen wide center aligned centered column">
             <div>
-				<img class="logo" src="{{AppSubUrl}}/assets/img/avatar_default.png" />
+                <img class="logo" src="/assets/img/avatar_default.png" />
             </div>
             <div class="hero">
-				<h1 class="ui icon header title">
-					AniNIX
-				</h1>
+                <h1 class="ui icon header title"> AniNIX </h1>
                 <h2>Welcome to the network</h2>
             </div>
         </div>
     </div>
+    <!-- End title/logo -->
+
+    <!-- Top row -->
     <div class="ui stackable middle very relaxed page grid">
+
+        <!-- Open-source widget -->
         <div class="eight wide center column">
             <h1 class="hero ui icon header">
-					<img width=20px height=20px src='/assets/img/icons/FoundationIcon.png'/>
-                    <a href="https://foundation.aninix.net/explore/repos">Open source security</a>
+            <img width=20px height=20px src='/assets/img/icons/Foundation.png'/>
+            <a href="/explore/repos">Open source security</a>
             </h1>
             <p class="large">
                 The AniNIX's primary goal is to ensure everyone has access to the knowledge they need to build a low-cost, secure platform. We make all our source-code accessible and open-source.
             </p>
         </div>
+
+        <!-- IRC Widget -->
         <div class="eight wide center column">
-				<h1 class="hero ui icon header">
-					<img width=20px height=20px src='/assets/img/icons/IRCIcon.png'/>
+            <h1 id="contact" class="hero ui icon header">
+            <img width=20px height=20px src='/assets/img/icons/IRC.png'/>
             <a href='ircs://aninix.net:6697/#lobby'>Contact us anytime</a>
             </h1>
             <p class="large">
                 We run an open IRC network -- we'd love to connect with you there. Not familiar with IRC? No worries -- we have a <a href="https://irc.aninix.net/" target=_blank alt="AniNIX/IRC (Web)" id="webchat">webchat</a> available.
-				</p> </div>
+            </p>
         </div>
+
+    </div>
+    <!-- End top row -->
+
+    <!-- Bottom row -->
     <div class="ui stackable middle very relaxed page grid">
+
+        <!-- AniNIX/Wiki widget -->
         <div class="eight wide center column">
             <h1 class="hero ui icon header">
-					<img width=20px height=20px src="/assets/img/icons/WikiIcon.png"/>
+            <img width=20px height=20px src="/assets/img/icons/Wiki.png"/>
             <a href="/AniNIX/Wiki">Open documentation</a>
             </h1>
             <p class="large">
                 We maintain a Wiki to document how and why we do what we do. Hopefully, it can both help others to learn more about computing and spark discussion with the community at large.
             </p>
         </div>
+
+        <!-- AniNIX/Maat widget -->
         <div class="eight wide center column">
             <h1 class="hero ui icon header">
-					<img width=20px height=20x src="/assets/img/icons/MaatIcon.png"/>
+            <img width=20px height=20x src="/assets/img/icons/Maat.png"/>
             <a href="https://maat.aninix.net/">Downloads</a>
             </h1>
             <p class="large">
-                    We offer downloads from our AniNIX::Maat continuous-deployment system, including static files and packages for <a href="https://archlinux.org/">ArchLinux-style distributions.</a>
+                We offer downloads from our AniNIX/Maat continuous-deployment system, including static files and packages for <a href="https://archlinux.org/">ArchLinux-style distributions.</a>
             </p>
         </div>
+
     </div>
+    <!-- End bottom row -->
+
     <hr style="margin-top: 50px;" />
-        <div class="sixteen wide center aligned centered column">
-            <div class="hero">
-                <h2>Webapps</h2>
+
+    <!-- Apps -->
+    <div class="ui stackable middle very relaxed page grid">
+        <div class="sixteen wide center aligned centered column hero">
+            <h2 id="apps">Webapps</h2>
             <p>We host a number of web apps to make our users' lives easier.
         </div>
+        <div class="four wide center column"><a title="AniNIX/Singularity" href="https://singularity.aninix.net"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" alt=RSS src="/assets/img/icons/Singularity.png" /><p>Singularity</p></a><p>News powered by TT-RSS</p></div>
+        <div class="four wide center column"><a title="AniNIX/Yggdrasil" href="https://yggdrasil.aninix.net"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" src="/assets/img/icons/Yggdrasil.png" /><p>Yggdrasil</p></a><p>Media powered by Emby</p></div>
+        <div class="four wide center column"><a title="AniNIX/Sharingan" href="https://sharingan.aninix.net"><img src="/assets/img/icons/Sharingan.png" style="width: 50px; height:auto; margin: 0; padding: 0 auto;" /><p>Sharingan</p></a><p>Monitoring powered by Graylog</p></div>
+        <div class="four wide center column"><a title="AniNIX/Cyberbrain" href="https://cyberbrain.aninix.net"><img src="/assets/img/icons/Cyberbrain.png" style="width: 50px; height:auto; margin: 0; padding: 0 auto;" /><p>Cyberbrain</p></a><p>SFTP Dropbox</p></div>
+    </div>
+    <!-- End apps -->
+
+    <hr style="margin-top: 50px;" />
+
+    <!-- News -->
     <div class="ui stackable middle very relaxed page grid">
-                <div class="four wide center column"><a title="AniNIX/Singularity" href="https://singularity.aninix.net"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" alt=RSS src="/assets/img/icons/SingularityIcon.png" /><p>AniNIX/Singularity (News powered by TT-RSS)</p></a></div>
-                <div class="four wide center column"><a title="AniNIX/Yggdrasil" href="https://yggdrasil.aninix.net"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" src="/assets/img/icons/YggdrasilIcon.png" /><p>AniNIX/Yggdrasil (Media powered by Emby)</p></a></div>
-                <div class="four wide center column"><a title="AniNIX/Sharingan" href="https://sharingan.aninix.net"><img src="/assets/img/icons/SharinganIcon.png" style="width: 50px; height:auto; margin: 0; padding: 0 auto;" /><p>AniNIX/Sharingan (Monitoring powered by Nagios)</p></a></div>
-                <div class="four wide center column"><a title="AniNIX/WolfPack" href="https://wolfpack.aninix.net"><img src="/assets/img/icons/WolfPackIcon.png" style="width: 50px; height:auto; margin: 0; padding: 0 auto;" /><p>AniNIX/WolfPack (Botnet download results)</p></a></div>
-            </div>
-        </div>
-<hr style="margin-top: 50px;" />
         <div class="sixteen wide center aligned centered column">
-            <div class="hero">
+            <div class="hero" id="news"></div>
+                <script type="text/javascript">
+                    insertNewsSnippet("https://aninix.net/assets/rss-snippets/aninix","news");
+                </script>
+            </div>
+        </div>
+    </div>
+
+    <!-- Social -->
+    <div class="ui stackable middle very relaxed page grid">
+        <div class="sixteen wide center aligned centered column">
+            <div class="hero" id="social">
                 <h2>Follow us on social media</h2>
                 <p>We want to stay in touch with you, so we are present on the social media platforms we find applicable.<br/> Have one you want us on? Contact us and let us know!</p>
             </div>
-            <div class="ui stackable middle very relaxed page grid">
+
+        </div>
         <div class="two wide center column"><!--placeholder--><p>&nbsp;</p></div>
         <div class="two wide center column"><a title=AniNIX/RSS href="/assets/aninix.xml"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" alt=RSS src="/assets/img/social/rss.png" /></a></div>
         <div class="two wide center column"><a title=Discord href="https://discord.gg/2bmggfR"><img alt=Discord style="width: 50px; height:auto; margin: 0; padding: 0 auto;" src="/assets/img/social/discord.ico" /></a></div>
@@ -82,7 +118,6 @@
         <div class="two wide center column"><a title=Facebook href="https://facebook.com/aninixnetwork"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" src="/assets/img/social/facebook.png" /></a></div>
         <div class="two wide center column"><!--placeholder--><p>&nbsp;</p></div>
     </div>
-        </div>
 </div>
 <!-- END CUSTOM HOME -->
 {{template "base/footer" .}}

roles/Foundation/files/web-snippets/martialarts/index

@@ -1,8 +1,9 @@
-                <div class="ui stackable middle very relaxed page grid">
+<!-- Title/logo-->
+<div class="ui stackable middle very relaxed page grid">
     <div class="sixteen wide center aligned centered column">
         <!--<div class="ui negative message"><p>We are open despite COVID-19 -- those attending in person will need to sign a waiver of health and follow all state requirements, including wearing a mask.</p></div>-->
         <div>
-                            <img class="logo" src="/assets/img/icons/MartialArtsIcon.png" />
+            <img class="logo" src="/assets/img/icons/MartialArts.png" />
         </div>
         <div class="hero">
             <h1 class="ui icon header title">
@@ -12,63 +13,99 @@
             <p>AniNIX Martial Arts is a small martial arts collective focusing on research-driven martial arts. Our core style is USHF HapKiDo, but we are influenced by HEMA, Razmafzar, Kali, Shaolin, Silat, JKD, BJJ, and many other systems. We are a research-driven group -- we encourage cross-training with other systems and will bring in new concepts regularly. The class is open to all experience levels, gender identity, gender expression, sexual orientation, religious or cultural identity, socioecomic status, or age (above 14), in Southcentral Wisconsin -- we will fit your training to your needs and goals.</p><p>Drop-ins are welcome, and registration is cheap. We hope you'll give us a chance to show you what we can do.</p>
         </div>
     </div>
-                </div>
-                <div class="ui stackable middle very relaxed page grid">
+</div>
+<!-- End title/logo -->
+
+<!-- Top row -->
+<div class="ui stackable middle very relaxed page grid">
+
+    <!-- Open-source widget -->
     <div class="eight wide center column">
         <h1 class="hero ui icon header">
-                            <img width=20px height=20px src='/assets/img/icons/FoundationIcon.png'/>
-                            <a href="/mawiki">Open-source</a>
+            <img width=20px height=20px src='/assets/img/icons/Foundation.png'/>
+            <a href="/MartialArts/Wiki/src/branch/main/README.md">Open-source</a>
         </h1>
-                        <p class="large">
+        <p>
         We want your training with our system to become a part of your life. This means that we provide access to a revision-controlled copy of our notes that all our students can download, keep, and contribute to. We're tired of the old era where how the system works is kept hidden from students and piecemealed out as a marketing ploy -- we want to be as trasparent as possible in how our program and our martial art function. Transparency keeps our instructors honest and our students engaged -- this means a better martial arts experience for everyone.
         </p>
     </div>
+
+    <!-- Research widget -->
     <div class="eight wide center column">
         <h1 class="hero ui icon header">
             <img width=20px height=20px src='/assets/img/ushf.jpg'/>
             <a href='https://ushapkidofederation.wordpress.com/'>Research-driven</a>
         </h1>
-                        <p class="large">
+        <p>
             Our system is always growing. We are a United States HapKiDo Federation (USHF) school, and that gives us access to high-quality instructors and seminar material each year from across the US. We also maintain good relationships with other schools in our area -- we want our students to examine what they're learing and make sure that it works, and that means looking at different perspectives.
-                        </p> </div>
+        </p>
     </div>
-                <div class="ui stackable middle very relaxed page grid">
+
+</div>
+<!-- End top row -->
+
+<!-- Bottom row -->
+<div class="ui stackable middle very relaxed page grid">
+
+    <!-- Low-cost widget -->
     <div class="eight wide center column">
         <h1 class="hero ui icon header">
-                            <img width=20px height=20px src="/assets/img/icons/MartialArtsIcon.png"/>
+            <img width=20px height=20px src="/assets/img/icons/MartialArts.png"/>
             <a href="/martialarts/index.html#storefront">Low-cost</a>
         </h1>
-                        <p class="large">We are non-profit group -- we train because we feel like it makes life better, not to make money. As such, our costs are publicly documented and our rates match the same. Classes will be informed of potential changes to costs well in advance, and we use recurring payments. We want you thinking about your training, not how you're going to pay for it.</p>
-                        <p class="large">
+        <p>We are non-profit group -- we train because we feel like it makes life better, not to make money. As such, our costs are publicly documented and our rates match the same. Classes will be informed of potential changes to costs well in advance, and we use recurring payments. We want you thinking about your training, not how you're going to pay for it.</p>
+        <p>
         <ul style="text-align: left;">
-                            <li><b>Cost:</b> $10 per month in-person; $5 per month livestream -- pay below.</li>
+            <li><b>Cost:</b> Free</li>
             <li><b>Lessons:</b>Tuesdays  7-8:30 p.m.</li>
             <li><b>Sparring:</b>Tuesdays 6-7 p.m.</li>
             <li><b>Shaolin Workouts:</b> Saturday mornings at 8 a.m. </li>
             <li><b>Location:</b> <a href="https://g.page/aninix-martial-arts?share">225 Blaser Drive, Belleville, WI</a></li>
             <li><b>What to bring:</b> Exercise clothes and water</li>
+            <li id='contact-insert'>
+                <script type="text/javascript">
+                    insertContactInfo();
+                </script>
+            </li>
         </ul></p>
     </div>
+
+    <!-- Real-life widget -->
     <div class="eight wide center column">
         <h1 class="hero ui icon header">
-                            <img width=20px height=20x src="/assets/img/icons/IRCIcon.png"/>
+            <img width=20px height=20x src="/assets/img/icons/IRC.png"/>
             <a href="/martialarts/index.html#social">Real-life First</a>
         </h1>
-                        <p class="large">
+        <p>
         Everyone is welcome! Class attendance is not mandated and belt-testing is not required to train. As a courtesy, please inform the class of your absence or intended late arrival -- real-life comes first, and we're happy to work with your needs. As long as one person shows, we'll have class -- the smaller the class, the more tailored it is, but the bigger classes mean more partners and body types.</p>
-                        <p class="large">
+        <p>
         Our focus is also on what you will actually use. While we appreciate traditional and esoteric training for self-development, our weekly classes are focused on modern techniques and training methods so that you get the most out of your time. Our goal is to help create a community of prepared and healthy citizens, and we believe martial arts helps build that in a way no other activity can.
         </p>
     </div>
-                </div>
-                <hr style="margin-top: 50px;" />
-                <div class="ui stackable middle very relaxed page grid" id="social">
+
+</div>
+<!-- End bottom row -->
+
+<!-- News -->
+<hr style="margin-top: 50px;" />
+<div class="ui stackable middle very relaxed page grid">
     <div class="sixteen wide center aligned centered column">
-                        <div class="hero">
-                            <h2 id=social>Follow us on social media</h2>
+        <div class=hero id=news>
+            <script type="text/javascript">
+                insertNewsSnippet("https://aninix.net/assets/rss-snippets/maqotw","news");
+            </script>
+        </div>
+    </div>
+</div>
+
+<!-- Social -->
+<div class="ui stackable middle very relaxed page grid">
+    <div class="sixteen wide center aligned centered column">
+        <div class="hero" id=social>
+            <h2>Follow us on social media</h2>
             <p class=large>We want to stay in touch with you, so we are present on the social media platforms we find applicable.<br/> Have one you want us on? Contact us and let us know!</p>
         </div>
-                        <div class="ui stackable middle very relaxed page grid" id="social">
+    </div>
     <div class="two wide center column"><p>&nbsp;</p></div>
     <div class="two wide center column"><a title=RSS href="/martialarts/maqotw.xml"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" alt=RSS src="/assets/img/social/rss.png" /></a></div>
     <div class="two wide center column"><a title=Discord href="https://discord.gg/2bmggfR"><img alt=Discord style="width: 50px; height:auto; margin: 0; padding: 0 auto;" src="/assets/img/social/discord.ico" /></a></div>
@@ -77,6 +114,4 @@
     <div class="two wide center column"><a title=Strava href="https://www.strava.com/clubs/aninixmartialarts"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" src="/assets/img/social/strava.png" /></a></div>
     <div class="two wide center column"><a title=Facebook href="https://www.facebook.com/groups/aninixmartialarts/"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" src="/assets/img/social/facebook.png" /></a></div>
     <div class="two wide center column"><p>&nbsp;</p></div>
-                        </div>
-                    </div>
-                </div>
+</div>

roles/Foundation/files/web-snippets/pay/index

@@ -1,107 +0,0 @@
-               <div class="ui stackable middle very relaxed page grid">
-                   <script src="https://js.stripe.com/v3"></script>
-                    <div class="sixteen wide center aligned centered column">
-                            <h1 class="ui icon header title">
-                                AniNIX
-                            </h1>
-                            <h2>Our Storefront</h2>
-                            <p>We have limited service offerings available. Please contact an admin on IRC first to arrange the contract, then use the item below to pay the invoice.</p>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="ui stackable middle very relaxed page grid">
-                    <div class="sixteen wide center column" >
-                        <h1 class="hero ui icon header">
-                            <img width=20px height=20px src='/assets/img/icons/CoreIcon.png'/>
-                            Cybersecurity Consulting
-                        </h1>
-                        <p class="large">The AniNIX offers cybersecurity consulting and advice services on a limited basis. We bill at $20 an hour -- please select your need below after negotiating with an admin.</p>
-                        <p class="large">
-                        <form action="./storefront.html" id="hours">
-                        <label for="hourcount">Hours required</label>
-                        <select name="hourcount" id="hourscount">
-                            <option value="1">1</option>
-                            <option value="2">2</option>
-                            <option value="3">3</option>
-                            <option value="4">4</option>
-                            <option value="5">5</option>
-                            <option value="6">6</option>
-                            <option value="7">7</option>
-                            <option value="8">8</option>
-                            <option value="9">9</option>
-                            <option value="10">10</option>
-                            <option value="11">11</option>
-                            <option value="12">12</option>
-                            <option value="13">13</option>
-                            <option value="14">14</option>
-                            <option value="15">15</option>
-                            <option value="16">16</option>
-                            <option value="17">17</option>
-                            <option value="18">18</option>
-                            <option value="19">19</option>
-                            <option value="20">20</option>
-                        </select>
-                        <br/>
-                        </form>
-                        <!-- START STRIPE CODE -->
-
-                        <!-- Create a button that your customers click to complete their purchase. Customize the styling to suit your branding. -->
-                        <button
-                          style="background-color:#6772E5;color:#FFF;padding:8px 12px;border:0;border-radius:4px;font-size:1em"
-                          id="checkout-button-price_1HTuehI49P1uFPoXCW9pJg5E"
-                          role="link"
-                          type="button"
-                        >
-                          Checkout
-                        </button>
-
-                        <div id="error-message"></div>
-
-                        <script>
-                        (function() {
-                          var stripe = Stripe('pk_live_51HThYnI49P1uFPoX5ARnHSpT9D08Gbfux6O25waFLpPBsnZoLDuqopFAZeLfu0CbbICxEnPZOOLkDLTlcNjkazs100ElKcF2QX');
-
-                          var checkoutButton = document.getElementById('checkout-button-price_1HTuehI49P1uFPoXCW9pJg5E');
-                          checkoutButton.addEventListener('click', function () {
-                            // When the customer clicks on the button, redirect
-                            // them to Checkout.
-                            stripe.redirectToCheckout({
-                              lineItems: [{price: 'price_1HTuehI49P1uFPoXCW9pJg5E', quantity: parseInt(document.getElementById('hourscount').value)}],
-                              mode: 'payment',
-                              // Do not rely on the redirect to the successUrl for fulfilling
-                              // purchases, customers may not always reach the success_url after
-                              // a successful payment.
-                              // Instead use one of the strategies described in
-                              // https://stripe.com/docs/payments/checkout/fulfill-orders
-                              successUrl: window.location.protocol + '//aninix.net/pay/thank-you.html',
-                              cancelUrl: window.location.protocol + '//aninix.net/pay/storefront.html',
-                            })
-                            .then(function (result) {
-                              if (result.error) {
-                                // If `redirectToCheckout` fails due to a browser or network
-                                // error, display the localized error message to your customer.
-                                var displayError = document.getElementById('error-message');
-                                displayError.textContent = result.error.message;
-                              }
-                            });
-                          });
-                        })();
-                        </script>
-                        <! -- END STRIPE CODE -->
-                        </p>
-                    </div>
-                </div>
-                <div class="ui stackable middle very relaxed page grid">
-                <div class="sixteen wide center column" >
-                <hr style="margin-top: 50px;" />
-                <h2>Donate</h2>
-                <p>If you like what we do, you can also donate on one of these platforms:</p>
-                <ul style="width:500px;text-align: left;margin:auto;">
-                <li><a href="https://store.steampowered.com/wishlist/id/darkfeather664/#sort=order">Steam (games)</a></li>
-                <li><a href="https://www.amazon.com/hz/wishlist/ls/3CORZU03RNWST?ref_=wl_share">Amazon (hardware)</a></li>
-                <li>BTC 38Nd3SgytdvSmcX3gfHeNAE2B6aPyYbS7s</li>
-                <li>Coinbase USDC 0x21a05e628Ed622F7594f62Ea3C764bAEF7fE3Bf3</li>
-                </ul>
-                </div>
-                </div>

roles/Foundation/files/web-snippets/pay/thank-you

@@ -1,12 +0,0 @@
-                <div class="ui stackable middle very relaxed page grid">
-                    <div class="sixteen wide center aligned centered column">
-                        <div>
-                            <img class="logo" src="/assets/img/icons/CoreIcon.png" />
-                        </div>
-                        <div class="hero">
-                            <h2 class="ui icon header title">
-                                Thank you for your purchase!
-                            </h2>
-                        </div>
-                    </div>
-                </div>

roles/Foundation/tasks/main.yml

@@ -5,12 +5,6 @@
      name:
        - gitea
 
- - name: BitBot
-   become: yes
-   git:
-     repo: https://github.com/jesopo/bitbot.git
-     dest: /opt/bitbot
-
  - name: Make directories
    become: yes
    file:
@@ -27,7 +21,7 @@
    register: config
    template:
      src: app.ini.j2
-     dest: /var/lib/gitea/custom/conf/app.ini
+     dest: /etc/gitea/app.ini
      owner: gitea
      group: gitea
      mode: 0750
@@ -53,7 +47,7 @@
    become: yes
    get_url:
      url: https://github.com/BenZuser/Emby-Web-Dark-Themes-CSS/raw/master/RED/theme.css
-     dest: /var/lib/gitea/custom/public/css/emby-web-dark-theme-BenZuser.css
+     dest: /var/lib/gitea/custom/public/assets/css/emby-web-dark-theme-BenZuser.css
      owner: gitea
      group: gitea
 
@@ -65,23 +59,6 @@
      owner: gitea
      group: gitea
 
- - name: Service file
-   become: yes
-   register: servicefile
-   copy:
-     src: foundation.service
-     dest: /usr/lib/systemd/system
-     owner: root
-     group: root
-     mode: 0755
-
- - name: Ensure default service disabled
-   become: yes
-   service:
-     name: gitea
-     state: stopped
-     enabled: no
-
  - name: Generate pages
    become: yes
    register: custompages
@@ -89,8 +66,8 @@
 
  - name: Restart service
    become: yes
-   when: config.changed or servicefile.changed or custompages.changed
+   when: config.changed or custompages.changed
    service:
-     name: foundation
+     name: gitea
      state: restarted
      enabled: yes

roles/Foundation/templates/app.ini.j2

@@ -8,6 +8,7 @@ APP_NAME = AniNIX
 RUN_USER = gitea
 ; Either "dev", "prod" or "test", default is "dev"
 RUN_MODE = prod
+WORK_PATH = /var/lib/gitea
 
 [repository]
 ROOT = repos
@@ -106,9 +107,11 @@ SHOW_USER_EMAIL        = true
 ; Set the default theme for the Gitea install
 DEFAULT_THEME = aninix
 ; All available themes. Allow users select personalized themes regardless of the value of `DEFAULT_THEME`.
-THEMES                 = gitea,arc-green,aninix
+THEMES = gitea-light,gitea-dark,aninix
 ; Whether the full name of the users should be shown where possible. If the full name isn't set, the username will be used.
 DEFAULT_SHOW_FULL_NAME = false
+; Disabling since we can check as a pre-commit hook
+AMBIGUOUS_UNICODE_DETECTION = false
 
 [ui.admin]
 ; Number of users that are displayed on one page
@@ -125,8 +128,8 @@ ORG_PAGING_NUM    = 50
 REPO_PAGING_NUM = 15
 
 [ui.meta]
-AUTHOR      = AniNIX::Foundation
-DESCRIPTION = AniNIX::Foundation \\ Code, documentation, and information sharing powered by Gitea (git with a cup of tea)
+AUTHOR = AniNIX/Foundation
+DESCRIPTION = AniNIX/Foundation | Code, documentation, and information sharing powered by Gitea (git with a cup of tea)
 KEYWORDS = go,git,self-hosted,gitea,aninix,aninix::foundation
 
 [markdown]
@@ -457,8 +460,8 @@ GC_INTERVAL_TIME  = 86400
 SESSION_LIFE_TIME = 86400
 
 [picture]
-AVATAR_UPLOAD_PATH               = data/avatars
-REPOSITORY_AVATAR_UPLOAD_PATH    = data/repo-avatars
+AVATAR_UPLOAD_PATH = avatars
+REPOSITORY_AVATAR_UPLOAD_PATH = repo-avatars
 ; How Gitea deals with missing repository avatars
 ; none = no avatar will be displayed; random = random avatar will be displayed; image = default image will be used
 REPOSITORY_AVATAR_FALLBACK = none
@@ -499,26 +502,21 @@ MAX_FILES     = 5
 FORMAT =
 
 [log]
-ROOT_PATH = %(GITEA_WORK_DIR)/log
-MODE = console
-LEVEL = Info
-STACKTRACE_LEVEL = None
-logger.router.MODE = ,
-logger.xorm.MODE = ,
-logger.access.MODE =
 ROOT_PATH = /var/log/gitea/
 ; Either "console", "file", "conn", "smtp" or "database", default is "console"
 ; Use comma to separate multiple modes, e.g. "console, file"
 MODE = console
+; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Trace"
+LEVEL = Warn
+; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "None"
+STACKTRACE_LEVEL = None
+logger.router.MODE = ,
+logger.xorm.MODE = ,
+logger.access.MODE = console
 ; Buffer length of the channel, keep it as it is if you don't know what it is.
 BUFFER_LEN = 10000
 ; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Info"
-ACCESS_LOG_TEMPLATE  = {{ '{{' }}.Ctx.RemoteAddr{{ '}}' }} - {{ '{{' }}.Identity{{ '}}' }} {{ '{{' }}.Start.Format "[02/Jan/2006:15:04:05 -0700]" {{ '}}' }} "{{ '{{' }}.Ctx.Req.Method{{ '}}' }} {{ '{{' }}.Ctx.Req.RequestURI{{ '}}' }} {{ '{{' }}.Ctx.Req.Proto{{ '}}' }}" {{ '{{' }}.ResponseWriter.Status{{ '}}' }} {{ '{{' }}.ResponseWriter.Size{{ '}}' }} "{{ '{{' }}.Ctx.Req.Referer{{ '}}' }}\" \"{{ '{{' }}.Ctx.Req.UserAgent{{ '}}' }}"
-logger.access.MODE   = console
-; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Trace"
-LEVEL                = Info
-; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "None"
-STACKTRACE_LEVEL     = Critical
+;ACCESS_LOG_TEMPLATE =
 
 ; Generic log modes
 [log.x]
@@ -741,4 +739,3 @@ IS_INPUT_FILE   = false
 ENABLED = false
 ; If you want to add authorization, specify a token here
 TOKEN =
-

roles/IRC/files/services/anope.service

@@ -6,10 +6,10 @@ After=network.target
 [Service]
 Type=simple
 PIDFile=/run/anope/anope.pid
-ExecStart=/opt/anope/bin/services --confdir=/etc/anope/ --dbdir=/opt/anope/data --localedir=/opt/anope/locale --logdir=/var/log/anope --modulesdir=/opt/anope/lib --nofork
+ExecStart=/usr/bin/services --confdir=/etc/anope/ --dbdir=/opt/anope/data --logdir=/var/log/anope --localedir=/usr/lib/anope/locale --modulesdir=/usr/lib/anope --nofork
 ExecReload=/bin/kill -1 $MAINPID
 Restart=always
-User=ircd
+User=anope
 Group=ircd
 
 [Install]

roles/IRC/files/services/inspircd.service

@@ -5,12 +5,12 @@ After=network.target
 
 [Service]
 Type=forking
-PIDFile=/var/lib/inspircd/inspircd.pid
-ExecStart=/usr/bin/inspircd
+PIDFile=/var/lib//inspircd.pid
+ExecStart=/usr/bin/
 ExecReload=kill -HUP $MAINPID
 ExecStop=kill $MAINPID
 Restart=always
-User=ircd
+User=inspircd
 Group=ircd
 
 [Install]

roles/IRC/files/services/ircweb.service

@@ -1,15 +0,0 @@
-[Unit]
-Description=AniNIX/IRC Web Client
-After=network.target irc.service ircservices.service
-
-[Service]
-WorkingDirectory=/usr/local/src/KiwiIRC/
-ExecStart=/bin/sh ./kiwi -f
-ExecReload=/bin/kill -HUP $MAINPID
-KillMode=control-group
-Restart=always
-User=ircd
-Group=ircd
-
-[Install]
-WantedBy=multi-user.target

roles/IRC/tasks/daemon.yml

@@ -5,12 +5,22 @@
    file:
      state: directory
      path: "{{ item }}"
-     owner: ircd
+     owner: inspircd
      group: ircd
      mode: 0750
    loop:
      - "/var/log/inspircd"
      - "/etc/inspircd"
+     - "/etc/inspircd/data/"
+
+ - name: Socket directory permissions
+   become: yes
+   file:
+     state: directory
+     path: /run/inspircd
+     owner: inspircd
+     group: ircd
+     mode: 0755
 
  - name: Generate dhparam
    become: yes
@@ -23,40 +33,24 @@
    file:
      state: file
      path: /etc/inspircd/dhparams.pem
-     owner: ircd
+     owner: inspircd
      group: ircd
      mode: 0640
 
- - name: Add ircd user to ssl
+ - name: Add inspircd user to ssl
    become: yes
    user:
-       name: ircd
-       groups: ssl
+       name: inspircd
+       groups: ssl,ircd
        append: yes
 
- - name: Copy service file
-   become: yes
-   register: servicesfile
-   copy:
-     src: services/irc.service
-     dest: /usr/lib/systemd/system/irc.service
-     owner: root
-     group: root
-     mode: 0644
-
- - name: Reload services
-   when: servicesfile.changed
-   become: yes
-   systemd:
-     daemon_reload: true
-
  - name: Copy config and fill in attributes
    register: templatefiles
    become: yes
    template:
      src: "inspircd/{{ item }}.j2"
      dest: "/etc/inspircd/{{ item }}"
-     owner: ircd
+     owner: inspircd
      group: ircd
      mode: 0600
    loop:
@@ -67,20 +61,11 @@
      - rules.txt
      - motd.txt
 
- - name: Tracking directory
-   become: yes
-   file:
-       dest: "/etc/inspircd/data/"
-       owner: ircd
-       group: ircd
-       mode: 0750
-       state: directory
-
  - name: Ensure tracking files
    become: yes
    file:
      dest: "/etc/inspircd/{{ item }}"
-     owner: ircd
+     owner: inspircd
      group: ircd
      mode: 0600
    loop:
@@ -90,13 +75,13 @@
  - name: Ensure service running
    become: yes
    service:
-     name: irc
+     name: inspircd
      state: started
      enabled: yes
 
  - name: Reload on config change
    become: yes
-   when: templatefiles.changed or servicesfile.changed
+   when: templatefiles.changed
    service:
-     name: irc
+     name: inspircd
      state: reloaded

roles/IRC/tasks/services.yml

@@ -1,11 +1,18 @@
 ---
 
+ - name: Add anope user to ircd
+   become: yes
+   user:
+       name: anope
+       groups: ircd
+       append: yes
+
  - name: Ensure directory permissions
    become: yes
    file:
      state: directory
      path: "{{ item }}"
-     owner: ircd
+     owner: anope
      group: ircd
      mode: 0700
    loop:
@@ -20,7 +27,7 @@
    template:
      src: "anope/{{ item }}.j2"
      dest: "/etc/anope/{{ item }}"
-     owner: ircd
+     owner: anope
      group: ircd
      mode: 0600
    loop:
@@ -38,8 +45,8 @@
    become: yes
    register: servicesfile
    copy:
-     src: services/ircservices.service
-     dest: /usr/lib/systemd/system/ircservices.service
+     src: services/anope.service
+     dest: /usr/lib/systemd/system/anope.service
      owner: root
      group: root
      mode: 0644
@@ -53,7 +60,7 @@
  - name: Ensure service running
    become: yes
    service:
-     name: ircservices
+     name: anope
      state: started
      enabled: yes
 
@@ -61,5 +68,5 @@
    become: yes
    when: templatefiles.changed or servicesfile.changed
    service:
-     name: ircservices
+     name: anope
      state: reloaded

roles/IRC/tasks/web.yml

@@ -1,58 +1,30 @@
 ---
 
- - name: Clone KiwiIRC
+- name: KiwiIRC Packages
   become: yes
-   git:
-     repo: https://github.com/prawnsalad/KiwiIRC.git
-     dest: /usr/local/src/KiwiIRC
-     update: no
+  package:
+    name:
+      - kiwiirc-server-bin
+    state: present
 
- # Need to capture AniNIX skinning of client as well as client build process.
-
- - name: Update permissions
+- name: Update permissions
   become: yes
   file:
-     path: /usr/local/src/KiwiIRC
+    path: "{{ item }}"
     recurse: yes
     owner: ircd
-     group: ircd
+    group: http
+  loop:
+    - /etc/kiwiirc
+    - /usr/share/kiwiirc
 
- - name: Populate config
+- name: Populate config
   become: yes
-   register: config
   template:
-     src: kiwiirc/config.js.j2
-     dest: /usr/local/src/KiwiIRC/config.js
+    src: "kiwiirc/{{ item }}.j2"
+    dest: "/etc/kiwiirc/{{ item }}"
     owner: ircd
-     group: ircd
-     mode: 0600
-
- - name: Copy service file
-   become: yes
-   register: servicesfile
-   copy:
-     src: services/ircweb.service
-     dest: /usr/lib/systemd/system/ircweb.service
-     owner: root
-     group: root
-     mode: 0644
-
- - name: Reload services
-   when: servicesfile.changed
-   become: yes
-   systemd:
-     daemon_reload: true
-
- - name: Ensure service running
-   become: yes
-   service:
-     name: ircweb
-     state: started
-     enabled: yes
-
- - name: Reload on config change
-   become: yes
-   when: config.changed or servicesfile.changed
-   service:
-     name: ircweb
-     state: reloaded
+    group: http
+    mode: 0640
+  loop:
+    - "client.json"

roles/IRC/templates/anope/modules.conf.j2

@@ -36,7 +36,7 @@ module
 		 * Admin credentials used for performing searches and adding users.
 		 */
 		admin_binddn = "uid=binduser,{{ ldap['userou'] }},{{ ldap['orgdn'] }}"
-		admin_password = "{{ secrets['Sora']['bindpassword'] }}"
+		admin_password = "{{ secrets['Password']['bindpassword'] }}"
 	}
 }
 
@@ -91,7 +91,7 @@ module
 	 *
 	 * If not set, then registration is not blocked.
 	 */
-	 #disable_register_reason = "To register on this network, contact a netadmin in #lobby. They will need to add an AniNIX/Sora LDAP account for you."
+	 #disable_register_reason = "To register on this network, contact a netadmin in #lobby. They will need to add an AniNIX/Password LDAP account for you."
 
 	/*
 	 * If set, the reason to give the users who try to "/msg NickServ SET EMAIL".

roles/IRC/templates/anope/services.conf.j2

@@ -135,7 +135,7 @@ uplink
 	 *
 	 * NOTE: On some shell providers, this will not be an option.
 	 */
-	host = "10.0.1.3"
+	host = "127.0.0.1"
 
 	/*
 	 * Enable if Services should connect using IPv6.
@@ -221,19 +221,10 @@ serverinfo
  *
  * This directive tells Anope which IRCd Protocol to speak when connecting.
  * You MUST modify this to match the IRCd you run.
- *
- * Supported:
- *  - bahamut
- *  - inspircd11
- *  - inspircd12
- *  - inspircd20
- *  - plexus
- *  - ratbox
- *  - unreal
  */
 module
 {
-	name = "inspircd20"
+	name = "inspircd3"
 
 	/*
 	 * Some protocol modules can enforce mode locks server-side. This reduces the spam caused by

roles/IRC/templates/inspircd/inspircd.conf.j2

@@ -1,5 +1,4 @@
 # Includes
-<config format="xml">
 <include file="/etc/inspircd/opers.conf">
 <include file="/etc/inspircd/links.conf">
 <include file="/etc/inspircd/modules.conf">
@@ -54,6 +53,7 @@
     limit="500"
     localmax="500"
     maxconnwarn="on"
+    maxchans="20"
     modes="+wx"
     pingfreq="120"
     port="6697"
@@ -81,7 +81,16 @@
     tlsv13="yes">
 <openssl onrehash="yes">
 
-
+# Websockets
+<connect
+    name="websockets"
+    allow="/run/inspircd/websocket.sock">
+<bind
+    path="/run/inspircd/websocket.sock"
+    type="clients"
+    hook="websocket"
+    permissions="0777"
+    replace="yes">
 
 # Performance
 <performance
@@ -91,6 +100,8 @@
     softlimit="1024"
     quietbursts="yes">
 <log method="file" type="* -USERINPUT -USEROUTPUT" level="default" target="/var/log/inspircd/inspircd.log" flush="1">
+# If things aren't working as intended, flip the commenting of the lines above and below here. Make sure to remove /tmp/ircd.log afterwards.
+#<log method="file" type="* -USERINPUT -USEROUTPUT" level="debug" target="/tmp/ircd.log" flush="5">
 <pid file="/var/lib/inspircd/inspircd.pid">
 <options
 
@@ -119,7 +130,7 @@
 
     defaultmodes="not"
 
-    moronbanner="You're banned! Contact {{ organization['email'] }} with the ERROR line below for help."
+    xlinemessage="You're banned! Contact {{ organization['email'] }} with the ERROR line below for help."
     exemptchanops="nonick:v flood:o"
     invitebypassmodes="yes"
     nosnoticestack="no"
@@ -134,7 +145,7 @@
     hidemodes="eI"
     hideulines="no"
     flatlinks="no"
-    hidewhois=""
+    hideserver=""
     hidebans="no"
     hidekills=""
     hidesplits="yes"
@@ -152,9 +163,8 @@
     maxquit="255"
     maxtopic="307"
     maxkick="255"
-    maxgecos="128"
+    maxreal="128"
     maxaway="200">
-<channels users="20" opers="60">
 <maxlist chan="*" limit="60">
 <whowas
     groupsize="10"

roles/IRC/templates/inspircd/links.conf.j2

@@ -3,7 +3,7 @@
 <link name="ircservices.{{ external_domain }}"
       ipaddr="core.{{ replica_domain }}"
       port="8067"
-      allowmask="10.0.1.3/32"
+      allowmask="127.0.0.1"
       sendpass="{{ secrets['IRC']['servicespass'] }}"
       recvpass="{{ secrets['IRC']['servicespass'] }}">
 

roles/IRC/templates/inspircd/modules.conf.j2

@@ -8,6 +8,8 @@
 # SHA256 module: Allows other modules to generate SHA256 hashes,
 # usually for cryptographic uses and security.
 <module name="m_sha256.so">
+# SHA1 module
+<module name="m_sha1.so">
 
 #-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
 # Abbreviation module: Provides the ability to abbreviate commands a-la
@@ -54,8 +56,8 @@
 
 #-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
 # Block CAPS module: Adds channel mode +B, blocks all-CAPS messages.
-<module name="m_blockcaps.so">
-<blockcaps percent="50"
+<module name="m_anticaps.so">
+<anticaps percent="50"
            minlen="5"
            capsmap="ABCDEFGHIJKLMNOPQRSTUVWXYZ! ">
 
@@ -402,15 +404,20 @@
 # integration with services packages.
 <module name="m_topiclock.so">
 
-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
-# Userip module: Adds the /USERIP command.
-# Allows users to query their own IP, also allows opers to query the IP
-# of anyone else.
-<module name="m_userip.so">
-
 #-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
 # Spanning tree module: Allows linking of servers using the spanning
 # tree protocol (see the READ THIS BIT section above).
 # You will almost always want to load this.
 #
 <module name="m_spanningtree.so">
+
+#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
+# CBAN module: This module adds the /CBAN command which allows server
+# operators to prevent channels matching a glob from being created.
+
+<module name="cban">
+
+#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#
+# Websocket module: allow websocket clients to connect
+<module name="websocket">
+<wsorigin allow="https://irc.{{ external_domain }}">

roles/IRC/templates/inspircd/motd.txt.j2

@@ -31,7 +31,7 @@ You should check which channels you want to join.
 Type the following to get a list:
 /list
 
-You will need to request an AniNIX/Sora LDAP
+You will need to request an AniNIX/Password LDAP
 account from an op or founder in #lobby to be
 able to log in. If you already have an account,
 use the following to authenticate:

roles/IRC/templates/inspircd/opers.conf.j2

@@ -8,5 +8,5 @@
 
 # Operators are tracked in the vault.
 {% for oper in secrets['IRC']['opers'] %}
-<oper name="{{ oper }}" password="{{ secrets['IRC']['opers'][oper] }}" hash="sha256" host="*@127.0.0.1 *@10.0.1.* *@localhost *@aninix.net" type="NetAdmin">
+<oper name="{{ oper }}" password="{{ secrets['IRC']['opers'][oper] }}" hash="sha256" host="*@127.0.0.1 *@10.0.1.* *@localhost *@{{ external_domain }}" type="NetAdmin" maxchans="60">
 {% endfor %}

roles/IRC/templates/kiwiirc/client.json.j2

@@ -0,0 +1,36 @@
+{
+    "windowTitle": "{{ organization['displayname'] }}/IRC | Web IRC client",
+    "startupScreen": "welcome",
+    "kiwiServer": "https://irc.{{ external_domain }}/webirc/websocket/",
+    "restricted": true,
+    "hideSettings": false,
+    "hideAdvancedSettings": true,
+    "theme": "Dark",
+    "themes": [
+        { "name": "Default", "url": "static/themes/default" },
+        { "name": "Dark", "url": "static/themes/dark" },
+        { "name": "Coffee", "url": "static/themes/coffee" },
+        { "name": "GrayFox", "url": "static/themes/grayfox" },
+        { "name": "Nightswatch", "url": "static/themes/nightswatch" },
+        { "name": "Osprey", "url": "static/themes/osprey" },
+        { "name": "Radioactive", "url": "static/themes/radioactive" },
+        { "name": "Sky", "url": "static/themes/sky" },
+        { "name": "Elite", "url": "static/themes/elite" }
+    ],
+    "startupOptions" : {
+        "infoContent": "<img src='https://{{ external_domain }}/assets/img/AniNIX.png' style='width:100%;height:auto;' /><h3>{{ organization['displayname'] }}/IRC</h3>Log in with your AniNIX account.",
+        "channel": "#lobby",
+        "nick": "Guest?",
+        "server": "irc.{{ external_domain }}",
+        "direct_path": "/websocket/",
+        "port": 443,
+        "direct": true,
+        "tls": true
+    },
+    "embedly": {
+        "key": ""
+    },
+    "plugins": [
+        { "name": "customise", "url": "static/plugins/customise.html" }
+    ]
+}

roles/IRC/templates/kiwiirc/config.js.j2

@@ -1,259 +0,0 @@
-var conf = {};
-
-// Run the Kiwi server under a different user/group
-conf.user = "ircd";
-conf.group = "ircd";
-
-
-// Log file location
-conf.log = "kiwi.log";
-
-
-
-/*
- * Server listen blocks
- */
-
-// Do not edit this line!
-conf.servers = [];
-
-// Example server block
-conf.servers.push({
-    port:   7778,
-    address: "127.0.0.1"
-});
-
-// Example SSL server block
-//conf.servers.push({
-//    port:     7777,
-//    address: "0.0.0.0",
-//
-//    ssl:   true,
-//    ssl_key: "server.key",
-//    ssl_cert: "cert.pem"
-//});
-
-// Network interface for outgoing connections
-conf.outgoing_address = {
-    IPv4: '0.0.0.0'
-    //IPv6: '::'
-};
-
-
-// Do we want to enable the built in Identd server?
-conf.identd = {
-    enabled: false,
-    port: 113,
-    address: "0.0.0.0"
-};
-
-
-
-
-
-
-// Where the client files are
-conf.public_http = "client/";
-
-// Transports available to the client.
-// Behind an Apache reverse proxy? Uncomment the below - Apache does not support websockets!
-//conf.client_transports = ['polling'];
-
-// Max connections per connection. 0 to disable
-conf.max_client_conns = 5;
-
-// Max connections per server. 0 to disable.
-// Setting is ignored if:
-//   - There is a WEBIRC password configured for the server,
-//   - Kiwi is configured to send the client's ip as a username for the server, or
-//   - Kiwi is running in restricted server mode.
-conf.max_server_conns = 0;
-
-/*
-* Default encoding to be used by the server
-* As specified and limited to iconv-lite library support.
-*/
-conf.default_encoding = 'utf8';
-
-
-/*
-* Default GECOS (real name) for IRC connections
-* %n will be replaced with the users nick
-* %h will be replaced with the users hostname
-*/
-conf.default_gecos = '%n@%h is using a Web IRC client';
-
-
-/*
-* Default ident / username for IRC connections
-* %n will be replaced with the users nick
-* %h will be replaced with the users hostname
-* %i will be replaced with a hexed value of the users IP
-*/
-conf.default_ident = '%i';
-
-
-/*
-* Default quit message
-* If a browser gets disconnected without sending a QUIT command, this
-* message will be used instead.
-*/
-conf.quit_message = 'http://www.kiwiirc.com/ - A hand-crafted IRC client';
-
-
-/*
-* Auto reconnect if the IRC server disconnects a kiwi user
-* Hundreds of connected users getting disconnected then reconnecting at once may see
-* high CPU usage causing further dropouts. Set to false if under high usage.
-*/
-conf.ircd_reconnect = true;
-
-
-/*
- * Client side plugins
- * Array of URLs that will be loaded into the browser when the client first loads up
- * See http://github.com/prawnsalad/KiwiIRC/wiki/Client-plugins
- */
-conf.client_plugins = [
-    // "http://server.com/kiwi/plugins/myplugin.html"
-];
-
-
-
-
-// Directory to find the server modules
-conf.module_dir = "../server_modules/";
-
-// Which modules to load
-conf.modules = [
-    // Open a TCP port to control the Kiwi server (default port 8888)
-    // "control",
-
-    // Automatically reload CSS files when a theme changes
-    // "client_file_watcher",
-];
-
-
-
-
-// WebIRC password enabled for this server
-conf.webirc_pass = "";
-
-// Use the above *OR* the below webirc_pass option
-
-// Multiple WebIRC passwords may be used for multiple servers
-//conf.webirc_pass = {
-//    "irc.network.com":  "configured_webirc_password",
-//    "127.0.0.1":        "foobar"
-//};
-
-
-// Whether to verify IRC servers' SSL certificates against built-in well-known certificate authorities
-conf.reject_unauthorised_certificates = false;
-
-
-
-/*
- * Reverse proxy settings
- * Reverse proxies that have been reported to work can be found at:
- *     https://kiwiirc.com/docs/installing/proxies
- */
-
-// Whitelisted HTTP proxies in CIDR format
-conf.http_proxies = ["127.0.0.1/32"];
-
-// Header that contains the real-ip from the HTTP proxy
-conf.http_proxy_ip_header = "x-forwarded-for";
-
-// Base HTTP path to the KIWI IRC client (eg. /kiwi)
-conf.http_base_path = "/kiwi";
-
-
-/*
- * SOCKS (version 5) proxy settings
- * This feature is only available on node 0.10.0 and above.
- * Do not enable it if you're running 0.8 or below or Bad Things will happen.
- */
-conf.socks_proxy = {};
-
-// Enable proxying outbound connections through a SOCKS proxy
-conf.socks_proxy.enabled = false;
-
-// Proxy *all* outbound connections through a SOCKS proxy
-conf.socks_proxy.all = false;
-
-// Use SOCKS proxy for these hosts only (if conf.sock_proxy.all === false)
-conf.socks_proxy.proxy_hosts = [
-    "irc.{{ external_domain }}"
-];
-
-// Host and port for the SOCKS proxy
-conf.socks_proxy.address = '127.0.0.1';
-conf.socks_proxy.port = 1080;
-
-// Username and password for the SOCKS proxy
-// Set user to null to disable password authentication
-conf.socks_proxy.user = null;
-conf.socks_proxy.pass = null;
-
-
-// Default settings for the client. These may be changed in the browser
-conf.client = {
-    server: 'localhost',
-    port:    6667,
-    ssl:     false,
-    channel: '#lobby',
-    channel_key: '',
-    nick:    'kiwi_?',
-    settings: {
-        theme: 'cli',
-        text_theme: 'default',
-        channel_list_style: 'tabs',
-        scrollback: 250,
-        show_joins_parts: true,
-        show_timestamps: false,
-        use_24_hour_timestamps: true,
-        mute_sounds: false,
-        show_emoticons: true,
-        ignore_new_queries: false,
-        count_all_activity: false,
-        show_autocomplete_slideout: true,
-        locale: null // null = use the browser locale settings
-    },
-    window_title: '{{ organization['displayname'] }}/IRC | KiwiIRC Webchat'
-};
-
-// List of themes available for the user to choose from
-conf.client_themes = [
-    'relaxed',
-    'mini',
-    'cli',
-    'basic'
-];
-
-
-// If set, the client may only connect to this 1 IRC server
-conf.restrict_server = "127.0.0.1";
-conf.restrict_server_port = 6667;
-conf.restrict_server_ssl = false;
-//conf.restrict_server_password = "";
-
-
-/*
- * If running multiple kiwi servers you may specify them here.
- * Note: All kiwi servers must have the same conf.http_base_path config option.
- *
- * To force the client to connect to one other kiwi server, use:
- *     conf.client.kiwi_server = 'https://kiwi-server2.com';
- *
- * To force the client to connect to a random kiwi server from a list, use:
- *     conf.client.kiwi_server = ['https://kiwi-server1.com', 'https://kiwi-server2.com'];
- */
-//conf.client.kiwi_server = '';
-
-
-
-/*
- * Do not amend the below lines unless you understand the changes!
- */
-module.exports.production = conf;

roles/Maat/files/aur.list

@@ -1,77 +1,56 @@
 https://aur.archlinux.org/acidrip.git
 https://aur.archlinux.org/aide.git
-https://aur.archlinux.org/animecheck-git.git
 https://aur.archlinux.org/anope.git
 https://aur.archlinux.org/ascii-invaders.git
 https://aur.archlinux.org/autopsy.git
+https://aur.archlinux.org/brave-bin.git
 https://aur.archlinux.org/brother-mfc-j430w.git
 https://aur.archlinux.org/brscan4.git
 https://aur.archlinux.org/carbonyl-bin.git
 https://aur.archlinux.org/castnow-git.git
 https://aur.archlinux.org/ccrypt.git
-https://aur.archlinux.org/chromium-pepper-flash.git
-https://aur.archlinux.org/defcon.git
-https://aur.archlinux.org/discord-cli-git.git
 https://aur.archlinux.org/discord-irc.git
-https://aur.archlinux.org/downgrader.git
 https://aur.archlinux.org/dotnet-core-bin.git
-https://aur.archlinux.org/dotnet-runtime-bin.git
 https://aur.archlinux.org/freeme2.git
 https://aur.archlinux.org/genymotion.git
 https://aur.archlinux.org/gnome-alsamixer.git
 https://aur.archlinux.org/google-chrome.git
-https://aur.archlinux.org/google-earth.git
 https://aur.archlinux.org/googlecl.git
 https://aur.archlinux.org/googler.git
 https://aur.archlinux.org/graylog.git
 https://aur.archlinux.org/graylog-collector-sidecar.git
-https://aur.archlinux.org/gsa.git
-https://aur.archlinux.org/gstreamer0.10-ffmpeg.git
 https://aur.archlinux.org/gtk-xfce-engine.git
-https://aur.archlinux.org/gvmd.git
 https://aur.archlinux.org/gyazo.git
-https://aur.archlinux.org/helloworld.git
 https://aur.archlinux.org/injection.git
 https://aur.archlinux.org/inspircd.git
 https://aur.archlinux.org/irker.git
 https://aur.archlinux.org/jmtpfs.git
-https://aur.archlinux.org/jpcsp.git
 https://aur.archlinux.org/js.git
-https://aur.archlinux.org/kpcli.git
-https://aur.archlinux.org/lib32-glib.git
+https://aur.archlinux.org/kiwiirc-server-bin.git
 https://aur.archlinux.org/libdaq.git
 https://aur.archlinux.org/libdwarf-20140413.git
-https://aur.archlinux.org/libiconv.git
-https://aur.archlinux.org/maya.git
-https://aur.archlinux.org/meshlab.git
 https://aur.archlinux.org/mkinitcpio-dropbear.git
 https://aur.archlinux.org/mkinitcpio-netconf.git
 https://aur.archlinux.org/mkinitcpio-utils.git
 https://aur.archlinux.org/mpir.git
 https://aur.archlinux.org/mongodb-bin.git
 https://aur.archlinux.org/mongodb-tools-bin.git
+https://aur.archlinux.org/mongosh-bin.git
 https://aur.archlinux.org/nordvpn-bin.git
 https://aur.archlinux.org/oinkmaster.git
 https://aur.archlinux.org/openresty.git
-https://aur.archlinux.org/openvas-scanner.git
 https://aur.archlinux.org/openvisualtraceroute.git
 https://aur.archlinux.org/ospd.git
-https://aur.archlinux.org/ospd-openvas.git
-https://aur.archlinux.org/ossec-local.git
-https://aur.archlinux.org/pwm.git
 https://aur.archlinux.org/pcmciautils.git
-https://aur.archlinux.org/pdfshuffler.git
 https://aur.archlinux.org/pear-net-ldap2.git
 https://aur.archlinux.org/perl-clipboard.git
 https://aur.archlinux.org/perl-crypt-rijndael.git
 https://aur.archlinux.org/perl-expect.git
-https://aur.archlinux.org/perl-file-keepass.git
 https://aur.archlinux.org/perl-net-sftp-foreign.git
 https://aur.archlinux.org/perl-php-serialization.git
 https://aur.archlinux.org/perl-sys-mmap.git
 https://aur.archlinux.org/perl-term-shellui.git
 https://aur.archlinux.org/php-pear.git
-https://aur.archlinux.org/php-zts.git
 https://aur.archlinux.org/pm-utils.git
 https://aur.archlinux.org/powerpanel.git
 https://aur.archlinux.org/python-aiohttp.git
@@ -92,16 +71,14 @@ https://aur.archlinux.org/savage.git
 https://aur.archlinux.org/self-service-password.git
 https://aur.archlinux.org/smarty3.git
 https://aur.archlinux.org/suricata.git
-https://aur.archlinux.org/swfdec.git
-https://aur.archlinux.org/swfdec-gnome.git
-https://aur.archlinux.org/systemdjournal2gelf.git
-https://aur.archlinux.org/tor-browser-en.git
+https://aur.archlinux.org/tor-browser-bin.git
 https://aur.archlinux.org/trid.git
 https://aur.archlinux.org/tt-rss-auth-ldap-git.git
 https://aur.archlinux.org/udisks.git
 https://aur.archlinux.org/undvd.git
 https://aur.archlinux.org/uniglot.git
 https://aur.archlinux.org/unvanquished.git
+https://aur.archlinux.org/unvanquished-data.git
 https://aur.archlinux.org/vbam-gtk.git
 https://aur.archlinux.org/xfce4-mixer.git
 https://aur.archlinux.org/xorg-server-utils.git

roles/Maat/files/pacoloco.yaml

@@ -1,14 +0,0 @@
-port: 9129
-download_timeout: 3600 # download will timeout after 3600 seconds
-cache_dir: /var/cache/pacoloco
-purge_files_after: 360000 # 360000 seconds or 100 hours, 0 to disable
-repos:
-  archlinux:
-    urls:
-      - http://mirrors.gigenet.com/archlinux/
-      - http://mnvoip.mm.fcix.net/archlinux/
-      - http://mirrors.kernel.org/archlinux/
-      - http://ftp.osuosl.org/pub/archlinux/
-      - https://mnvoip.mm.fcix.net/archlinux/
-      - http://southfront.mm.fcix.net/archlinux/
-user_agent: Pacoloco

roles/Maat/tasks/main.yml

@@ -17,6 +17,7 @@
 
  - name: Maat configuration
    become: yes
+   register: aurlist
    copy:
      src: aur.list
      dest: /usr/local/etc/Maat/aur.list
@@ -28,6 +29,13 @@
      state: restarted
      enabled: yes
 
+ - name: Start Maat build cycle
+   become: yes
+   when: aurlist.changed
+   service:
+     name: maat.service
+     state: started
+
  - name: Generate mirrorlist
    delegate_to: localhost
    run_once: yes

roles/Nazara/README.md

@@ -1,16 +0,0 @@
-A Nazara host is a gateway to accessing other hosts. It is a safeguard against admin error.
-
-## Etymology
-Nazara hosts are named because they are the first line of defense against administrative error -- they prevent admins from being locked out of correcting their changes and are connected to everything in the ecosystem. They also control DNS, which allows a sort of subliminal control of the entire ecosystem. This is akin to the mastermind [Reaper AI](https://masseffect.fandom.com/wiki/Sovereign) from the Mass Effect franchise, and in fact can be the extinction of any DNS-enabled malware in the ecosystem by sinkholing the Command-and-Control.
-
-## Capacity and Components
-A Nazara host needs minimal CPU or memory.
-
-## Hosted Services and Entities
-Nazara should host a Pihole installation and [SSH](../Services/SSH.md). It should be NAT'ed to an obscure port to the outside world.
-
-## Connections
-Any host should be able to connect to a Nazara with SSH and X11, and it should be able to dial to any service provider.
-
-## Additional Reference
-Nazara hosts should be deployed alongside any Hypervisor. They can be as simple as a Pi-hole with SSH access, and they should be allowed to receive SSH connections from a non-tcp/22/ssh port.

roles/Node/tasks/main.yml

@@ -61,3 +61,11 @@
    when: qemubr.changed or br0.changed
    debug:
      msg: You may need to restart VMs on the Node.
+
+ - name: Enable VMs
+   become: yes
+   with_items: "{{ active_vms }}"
+   service:
+     name: "{{ item }}-vm.service"
+     state: started
+     enabled: yes

roles/Node/templates/vm.service.j2

@@ -1,14 +0,0 @@
-[Unit]
-Description=AniNIX/{{ inventory_hostname }}
-After=network.target
-
-[Service]
-ExecStart=/usr/sbin/qemu-system-x86_64 -name AniNIX/{{ inventory_hostname }} -machine type=pc,accel=kvm -bios /usr/share/edk2-ovmf/x64/OVMF.fd -cpu host -smp {{ cores }} {{ disks }} -net nic,macaddr={{ mac }},model=virtio -net bridge,br={{ bridge }} -vga std -nographic -vnc :{{ vnc }} -m size={{ memory }}G -device virtio-rng-pci
-ExecReload=/bin/kill -HUP $MAINPID
-KillMode=process
-Restart=always
-User=root
-Group=root
-
-[Install]
-WantedBy=multi-user.target

roles/Password/README.md

@@ -0,0 +1,19 @@
+Sora is the [LDAP](https://en.wikipedia.org/wiki/LDAP)-enabled central credential store of the AniNIX -- end users will have accounts here.
+
+# Etymology
+A password is a ubiquitous method of asymmetric authentication. Militaries will use simple challenges & passwords to authenticate individuals b
+
+# Relevant Files and Software
+Most of the configuration initially is handled by the [https://aninix.net/foundation/ConfigPackages ConfigPackages'] Sora Makefile.
+
+We use [file:///etc/openldap/users.d](a users.d) folder to hold the default user definitions. uidNumber should generally start from 10000 and the .ldif files should never be deleted to track the maximum uidNumber.
+
+# Available Clients
+Most services on AniNIX, ranging from SSH & IRC to web services like AniNIX/Foundation and AniNIX/Singularity, are LDAP clients. Our exceptions are below:
+* MediaWiki (LDAP dropped out of support)
+* AniNIX/Superintendent (client path not yet identified)
+
+# Equivalents or Competition
+Both Google and Facebook offer distributed authentication systems. Google in particular is a good equivalent, as some of the services used by this network rely on its authentication for various products it provides internally.
+
+The AniNIX is not presently set up or planning to do distributed authentication.

roles/Password/bin/sora-dump-config

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+slapcat -a "(!(entryDN:dnSubtreeMatch:=ou=People,dc=aninix,dc=net))"

roles/Password/files/nsswitch.conf

@@ -0,0 +1,19 @@
+# Begin /etc/nsswitch.conf
+
+passwd: files ldap
+group: files ldap
+shadow: files ldap
+
+publickey: files
+
+hosts: files dns myhostname
+networks: files
+
+protocols: files
+services: files
+ethers: files
+rpc: files
+
+netgroup: files
+
+# End /etc/nsswitch.conf

roles/Password/files/pam.d/atd

@@ -0,0 +1,12 @@
+#%PAM-1.0
+
+auth		required	pam_unix.so
+auth		required	pam_env.so
+
+account		required	pam_access.so
+account		required	pam_unix.so
+account		required	pam_time.so
+
+session		required	pam_loginuid.so
+session		required	pam_limits.so
+session		required	pam_unix.so

roles/Password/files/pam.d/chfn

@@ -0,0 +1,6 @@
+#%PAM-1.0
+auth            sufficient      pam_rootok.so
+auth            required        pam_unix.so
+account         required        pam_unix.so
+session         required        pam_unix.so
+password        required        pam_permit.so

roles/Password/files/pam.d/chpasswd

@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth		sufficient	pam_rootok.so
+account		required	pam_permit.so
+password	include		system-auth

roles/Password/files/pam.d/chsh

@@ -0,0 +1,6 @@
+#%PAM-1.0
+auth            sufficient      pam_rootok.so
+auth            required        pam_unix.so
+account         required        pam_unix.so
+session         required        pam_unix.so
+password        required        pam_permit.so

roles/Password/files/pam.d/crond

@@ -0,0 +1,11 @@
+#
+# The PAM configuration file for the cron daemon
+#
+#
+# Although no PAM authentication is called, auth modules
+# are used for credential setting
+auth       include    system-auth
+account    required   pam_access.so
+account    include    system-auth
+session    required   pam_loginuid.so
+session    include    system-auth

roles/Password/files/pam.d/cups

@@ -0,0 +1,3 @@
+auth		required	pam_unix.so
+account		required	pam_unix.so
+session		required	pam_unix.so

roles/Password/files/pam.d/groupmems

@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth		sufficient	pam_rootok.so
+account		required	pam_permit.so
+password	include		system-auth

roles/Password/files/pam.d/login

@@ -0,0 +1,7 @@
+#%PAM-1.0
+
+auth       requisite    pam_nologin.so
+auth       include      system-local-login
+account    include      system-local-login
+session    include      system-local-login
+password   include      system-local-login

roles/Password/files/pam.d/newusers

@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth		sufficient	pam_rootok.so
+account		required	pam_permit.so
+password	include		system-auth

roles/Password/files/pam.d/other

@@ -0,0 +1,9 @@
+#%PAM-1.0
+auth      required   pam_deny.so
+auth      required   pam_warn.so
+account   required   pam_deny.so
+account   required   pam_warn.so
+password  required   pam_deny.so
+password  required   pam_warn.so
+session   required   pam_deny.so
+session   required   pam_warn.so

roles/Password/files/pam.d/passwd

@@ -0,0 +1,5 @@
+#%PAM-1.0
+#password	required	pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
+#password	required	pam_unix.so sha512 shadow use_authtok
+password    sufficient  pam_ldap.so
+password	required	pam_unix.so sha512 shadow nullok

roles/Password/files/pam.d/passwd.pacnew

@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth		include		system-auth
+account		include		system-auth
+password	include		system-auth

roles/Password/files/pam.d/postgresql

@@ -0,0 +1,3 @@
+auth		required	pam_unix.so
+account		required	pam_unix.so
+session		required	pam_unix.so

roles/Password/files/pam.d/remote

@@ -0,0 +1,8 @@
+#%PAM-1.0
+
+auth       required     pam_securetty.so
+auth       requisite    pam_nologin.so
+auth       include      system-remote-login
+account    include      system-remote-login
+session    include      system-remote-login
+password   include      system-remote-login

roles/Password/files/pam.d/rlogin

@@ -0,0 +1,13 @@
+#%PAM-1.0
+# For root login to succeed here with pam_securetty, "rlogin" must be
+# listed in /etc/securetty.
+auth       required     pam_nologin.so
+auth       required     pam_securetty.so
+auth       required     pam_env.so
+auth       sufficient   pam_rhosts.so
+auth       include      system-auth
+account    include      system-auth
+password   include      system-auth
+session	   optional     pam_keyinit.so    force revoke
+session    required     pam_loginuid.so
+session    include      system-auth

roles/Password/files/pam.d/rsh

@@ -0,0 +1,11 @@
+#%PAM-1.0
+# For root login to succeed here with pam_securetty, "rsh" must be
+# listed in /etc/securetty.
+auth       required     pam_nologin.so
+auth       required     pam_securetty.so
+auth       required     pam_env.so
+auth       required     pam_rhosts.so
+account    include      system-auth
+session	   optional     pam_keyinit.so    force revoke
+session    required     pam_loginuid.so
+session    include      system-auth

roles/Password/files/pam.d/runuser

@@ -0,0 +1,4 @@
+#%PAM-1.0
+
+auth    sufficient      pam_rootok.so
+session include         system-login

roles/Password/files/pam.d/runuser-l

@@ -0,0 +1,4 @@
+#%PAM-1.0
+
+auth    sufficient      pam_rootok.so
+session include         system-login

roles/Password/files/pam.d/screen

@@ -0,0 +1 @@
+auth		required	pam_unix.so

roles/Password/files/pam.d/sshd

@@ -0,0 +1,6 @@
+#%PAM-1.0
+
+auth      include   system-remote-login
+account   include   system-remote-login
+password  include   system-remote-login
+session   include   system-remote-login

roles/Password/files/pam.d/sssd-shadowutils

@@ -0,0 +1,6 @@
+#%PAM-1.0
+auth        [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
+auth        required      pam_deny.so
+
+account     required      pam_unix.so
+account     required      pam_permit.so

roles/Password/files/pam.d/su

@@ -0,0 +1,14 @@
+#%PAM-1.0
+auth        sufficient  pam_ldap.so
+auth		sufficient	pam_rootok.so
+# Uncomment the following line to implicitly trust users in the "wheel" group.
+#auth		sufficient	pam_wheel.so trust use_uid
+# Uncomment the following line to require a user to be in the "wheel" group.
+#auth		required	pam_wheel.so use_uid
+auth		required	pam_unix.so use_first_pass
+
+account     sufficient  pam_ldap.so
+account		required	pam_unix.so
+
+session     sufficient  pam_ldap.so
+session		required	pam_unix.so

roles/Password/files/pam.d/su-l

@@ -0,0 +1,12 @@
+#%PAM-1.0
+auth		sufficient	pam_rootok.so
+# Uncomment the following line to implicitly trust users in the "wheel" group.
+#auth		sufficient	pam_wheel.so trust use_uid
+# Uncomment the following line to require a user to be in the "wheel" group.
+#auth		required	pam_wheel.so use_uid
+auth        sufficient  pam_ldap.so
+auth		required	pam_unix.so use_first_pass
+account     sufficient  pam_ldap.so
+account		required	pam_unix.so
+session     sufficient  pam_ldap.so
+session		required	pam_unix.so

roles/Password/files/pam.d/su-l.pacnew

@@ -0,0 +1,10 @@
+#%PAM-1.0
+auth            sufficient      pam_rootok.so
+# Uncomment the following line to implicitly trust users in the "wheel" group.
+#auth           sufficient      pam_wheel.so trust use_uid
+# Uncomment the following line to require a user to be in the "wheel" group.
+#auth           required        pam_wheel.so use_uid
+auth            required        pam_unix.so
+account         required        pam_unix.so
+session	        required        pam_unix.so
+password        include         system-auth

roles/Password/files/pam.d/su.pacnew

@@ -0,0 +1,10 @@
+#%PAM-1.0
+auth            sufficient      pam_rootok.so
+# Uncomment the following line to implicitly trust users in the "wheel" group.
+#auth           sufficient      pam_wheel.so trust use_uid
+# Uncomment the following line to require a user to be in the "wheel" group.
+#auth           required        pam_wheel.so use_uid
+auth            required        pam_unix.so
+account         required        pam_unix.so
+session	        required        pam_unix.so
+password        include         system-auth

roles/Password/files/pam.d/sudo

@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth		include		system-auth
+account		include		system-auth
+session		include		system-auth