pluto
b9be45dc71
Complete IaC covering: - 14 roles: common, docker, traefik, vaultwarden, monitoring, media, matrix, home_assistant, frigate, adguard, gitea, semaphore, openclaw, security, backup - Inventory for all hosts (Peggy, Bart, Yoda, NAS, Firewalla) - Stack playbooks: core-infrastructure, monitoring, media, communication, automation, smarthome, security-hardening - Maintenance playbooks: update-containers, backup, health-check - Production Docker Compose templates with Traefik labels - Security hardening (sysctl, auditd, UFW, fail2ban) - Automated backups with retention policy
99 lines
2.0 KiB
YAML
99 lines
2.0 KiB
YAML
---
|
|
- name: Set hostname
|
|
ansible.builtin.hostname:
|
|
name: "{{ common_hostname }}"
|
|
tags: [common, hostname]
|
|
|
|
- name: Set timezone
|
|
community.general.timezone:
|
|
name: "{{ common_timezone }}"
|
|
tags: [common, timezone]
|
|
|
|
- name: Update apt cache
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
tags: [common, packages]
|
|
|
|
- name: Install common packages
|
|
ansible.builtin.apt:
|
|
name: "{{ common_packages }}"
|
|
state: present
|
|
tags: [common, packages]
|
|
|
|
- name: Upgrade all packages
|
|
ansible.builtin.apt:
|
|
upgrade: safe
|
|
tags: [common, packages, upgrade]
|
|
when: apt_upgrade | default(false) | bool
|
|
|
|
- name: Configure SSH daemon
|
|
ansible.builtin.template:
|
|
src: sshd_config.j2
|
|
dest: /etc/ssh/sshd_config
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
validate: "sshd -t -f %s"
|
|
notify: Restart sshd
|
|
tags: [common, ssh]
|
|
|
|
- name: Ensure SSH is running
|
|
ansible.builtin.systemd:
|
|
name: sshd
|
|
state: started
|
|
enabled: true
|
|
tags: [common, ssh]
|
|
|
|
- name: Configure UFW defaults
|
|
community.general.ufw:
|
|
direction: incoming
|
|
policy: deny
|
|
tags: [common, firewall]
|
|
|
|
- name: Allow SSH through UFW
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ sshd_port }}"
|
|
proto: tcp
|
|
tags: [common, firewall]
|
|
|
|
- name: Allow traffic from local network
|
|
community.general.ufw:
|
|
rule: allow
|
|
src: 192.168.86.0/24
|
|
tags: [common, firewall]
|
|
|
|
- name: Enable UFW
|
|
community.general.ufw:
|
|
state: enabled
|
|
tags: [common, firewall]
|
|
|
|
- name: Configure fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
tags: [common, security]
|
|
|
|
- name: Set vm.swappiness
|
|
ansible.posix.sysctl:
|
|
name: vm.swappiness
|
|
value: "10"
|
|
state: present
|
|
reload: true
|
|
tags: [common, sysctl]
|
|
|
|
- name: Configure NTP
|
|
ansible.builtin.apt:
|
|
name: chrony
|
|
state: present
|
|
tags: [common, ntp]
|
|
|
|
- name: Start chrony
|
|
ansible.builtin.systemd:
|
|
name: chrony
|
|
state: started
|
|
enabled: true
|
|
tags: [common, ntp]
|