Initial commit
This commit is contained in:
@@ -0,0 +1,52 @@
|
||||
---
|
||||
- name: Ensure dependencies are installed
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- curl
|
||||
- ca-certificates
|
||||
- python3-requests
|
||||
state: present
|
||||
|
||||
- name: Create Docker GPG key directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/apt/keyrings
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Download Docker's official GPG key
|
||||
ansible.builtin.get_url:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
dest: /etc/apt/keyrings/docker.asc
|
||||
mode: "0644"
|
||||
|
||||
- name: Add Docker repository to Apt sources
|
||||
ansible.builtin.apt_repository:
|
||||
repo: "deb [signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu {{ ansible_facts['distribution_release'] }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
|
||||
- name: Update apt cache after adding Docker repository
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Install Docker and Docker Compose
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
|
||||
- name: Ensure Docker service is enabled and started
|
||||
ansible.builtin.service:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: Add matzman user to docker group
|
||||
ansible.builtin.user:
|
||||
name: matzman
|
||||
groups: docker
|
||||
append: yes
|
||||
@@ -0,0 +1,13 @@
|
||||
#SPDX-License-Identifier: MIT-0
|
||||
---
|
||||
# tasks file for ubuntu-docker-base
|
||||
|
||||
- name: Setup Ubuntu for Docker host
|
||||
ansible.builtin.import_tasks: setup-ubuntu.yml
|
||||
tags: [ setup-ubuntu ]
|
||||
become: true
|
||||
|
||||
- name: Install Docker on Ubuntu
|
||||
ansible.builtin.import_tasks: install-ubuntu-docker.yml
|
||||
tags: [ install-ubuntu-docker-base ]
|
||||
become: true
|
||||
@@ -0,0 +1,209 @@
|
||||
---
|
||||
- name: Show host IP
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ ansible_facts['default_ipv4'] }}"
|
||||
|
||||
|
||||
# --- Users & group ---
|
||||
|
||||
- name: Add group matzman
|
||||
ansible.builtin.group:
|
||||
name: matzman
|
||||
state: present
|
||||
gid: 1000
|
||||
|
||||
- name: Add user matzman
|
||||
ansible.builtin.user:
|
||||
name: matzman
|
||||
uid: 1000
|
||||
group: matzman
|
||||
create_home: yes
|
||||
|
||||
|
||||
# --- Install required packages ---
|
||||
|
||||
- name: Update apt cache
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
become: true
|
||||
|
||||
- name: Upgrade all packages
|
||||
ansible.builtin.apt:
|
||||
upgrade: dist
|
||||
update_cache: yes
|
||||
|
||||
- name: Check if reboot is required
|
||||
ansible.builtin.stat:
|
||||
path: /var/run/reboot-required
|
||||
register: reboot_required
|
||||
|
||||
- name: Reboot if required
|
||||
ansible.builtin.reboot:
|
||||
reboot_timeout: 300
|
||||
when: reboot_required.stat.exists
|
||||
|
||||
- name: Install custom packages
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
# Required by an ansible task later
|
||||
- python3-requests
|
||||
state: present
|
||||
|
||||
|
||||
# --- Unattended upgrades ---
|
||||
|
||||
- name: Install unattended-upgrades
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
state: present
|
||||
|
||||
- name: Enable automatic security upgrades
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
mode: "0644"
|
||||
|
||||
|
||||
# --- SSH setup ---
|
||||
|
||||
- name: Set authorized key for matzman
|
||||
ansible.posix.authorized_key:
|
||||
user: matzman
|
||||
state: present
|
||||
key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBi8TS/s2X7W7gb+rGm7A2PG9hRDLa3kYdNM9hLNY0w matzman+2025@matzman.net"
|
||||
|
||||
- name: Set authorized key for root
|
||||
ansible.posix.authorized_key:
|
||||
user: root
|
||||
state: present
|
||||
key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBi8TS/s2X7W7gb+rGm7A2PG9hRDLa3kYdNM9hLNY0w matzman+2025@matzman.net"
|
||||
|
||||
|
||||
# --- SSH hardening ---
|
||||
|
||||
- name: Disable SSH password authentication
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^#?PasswordAuthentication'
|
||||
line: 'PasswordAuthentication no'
|
||||
notify: Restart SSH
|
||||
|
||||
#- name: Disable SSH root login
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/ssh/sshd_config
|
||||
# regexp: '^#?PermitRootLogin'
|
||||
# line: 'PermitRootLogin no'
|
||||
# notify: Restart SSH
|
||||
|
||||
# --- fail2ban ---
|
||||
|
||||
- name: Install fail2ban
|
||||
ansible.builtin.package:
|
||||
name: fail2ban
|
||||
state: present
|
||||
|
||||
- name: Enable and start fail2ban
|
||||
ansible.builtin.service:
|
||||
name: fail2ban
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
|
||||
# --- Wireguard ---
|
||||
|
||||
- name: Install wireguard packages
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- wireguard-tools
|
||||
state: present
|
||||
|
||||
- name: Ensure /etc/wireguard directory exists
|
||||
ansible.builtin.file:
|
||||
path: /etc/wireguard
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0700"
|
||||
tags: wireguard
|
||||
|
||||
- name: "Deploy {{ wg_if }} config"
|
||||
ansible.builtin.template:
|
||||
src: "{{ wg_if }}.conf.j2"
|
||||
dest: "/etc/wireguard/{{ wg_if }}.conf"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
notify: Restart wg0
|
||||
tags: wireguard
|
||||
|
||||
- name: "Enable and start wg-quick@{{ wg_if }}"
|
||||
ansible.builtin.systemd:
|
||||
name: "wg-quick@{{ wg_if }}"
|
||||
enabled: yes
|
||||
state: started
|
||||
tags: wireguard
|
||||
|
||||
|
||||
# --- Firewall ---
|
||||
|
||||
- name: Install iptables-persistent
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- iptables-persistent
|
||||
- netfilter-persistent
|
||||
state: present
|
||||
|
||||
- name: Deploy iptables rules (IPv4)
|
||||
ansible.builtin.template:
|
||||
src: rules.v4.j2
|
||||
dest: /etc/iptables/rules.v4
|
||||
mode: "0640"
|
||||
notify:
|
||||
- Reload iptables
|
||||
- Restart Docker
|
||||
|
||||
- name: Deploy iptables rules (IPv6)
|
||||
ansible.builtin.template:
|
||||
src: rules.v6.j2
|
||||
dest: /etc/iptables/rules.v6
|
||||
mode: "0640"
|
||||
notify:
|
||||
- Reload ip6tables
|
||||
- Restart Docker
|
||||
|
||||
# --- sysctl hardening ---
|
||||
|
||||
- name: Configure sysctl security settings
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item.name }}"
|
||||
value: "{{ item.value }}"
|
||||
state: present
|
||||
reload: yes
|
||||
loop:
|
||||
- { name: 'net.ipv4.conf.all.rp_filter', value: '1' }
|
||||
- { name: 'net.ipv4.conf.default.rp_filter', value: '1' }
|
||||
- { name: 'net.ipv4.conf.all.accept_redirects', value: '0' }
|
||||
- { name: 'net.ipv4.conf.default.accept_redirects', value: '0' }
|
||||
- { name: 'net.ipv4.conf.all.send_redirects', value: '0' }
|
||||
- { name: 'net.ipv4.conf.default.send_redirects', value: '0' }
|
||||
|
||||
|
||||
# --- Audit logging ---
|
||||
|
||||
- name: Install auditd
|
||||
ansible.builtin.package:
|
||||
name: auditd
|
||||
state: present
|
||||
|
||||
- name: Enable and start auditd
|
||||
ansible.builtin.service:
|
||||
name: auditd
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user