From 110c5ae715e2afbb63490dc122ee396f61a7fd7b Mon Sep 17 00:00:00 2001 From: tolerryan Date: Tue, 1 Sep 2026 15:58:27 +0000 Subject: [PATCH] adding firstrun playbook --- group_vars/all/main.yml | 11 ++----- group_vars/firstrun/main.yml | 16 +++++++++ group_vars/firstrun/vault.yml | 0 inventory.yml | 2 +- roles/common/tasks/main.yml | 25 -------------- roles/firstrun/defaults/main.yml | 12 +++++++ roles/firstrun/tasks/main.yml | 56 ++++++++++++++++++++++++++++++++ site.yml | 9 +++++ 8 files changed, 97 insertions(+), 34 deletions(-) create mode 100644 group_vars/firstrun/main.yml create mode 100644 group_vars/firstrun/vault.yml create mode 100644 roles/firstrun/defaults/main.yml create mode 100644 roles/firstrun/tasks/main.yml diff --git a/group_vars/all/main.yml b/group_vars/all/main.yml index 46c6f43..196c8e7 100644 --- a/group_vars/all/main.yml +++ b/group_vars/all/main.yml @@ -2,21 +2,16 @@ # Vars for every VPS in the fleet. Keep this file plaintext and readable # in diffs - actual secret values live in group_vars/all/vault.yml. -timezone: "America/Chicago" -# The non-root user created/used for all future Ansible runs -deploy_user: ansible -deploy_user_shell: /bin/bash -# SSH public keys granted access to deploy_user on every host -deploy_user_ssh_keys: - - "{{ ssh_key_ansible }}" + + # Hardening toggles (see roles/security) ssh_permit_root_login: "no" ssh_password_authentication: "no" ssh_port: 25456 -ansible_port: 25456 +: 25456 ufw_allowed_tcp_ports: - "{{ ssh_port }}" diff --git a/group_vars/firstrun/main.yml b/group_vars/firstrun/main.yml new file mode 100644 index 0000000..4c78819 --- /dev/null +++ b/group_vars/firstrun/main.yml @@ -0,0 +1,16 @@ +--- +# vars that are only used for the first setup. after this the defaults change to not use root. +# this is to setup the ansible user, basic tools and security measures. + +# setup needed connection information +ansible_port: 22 + +# The non-root user created/used for all future Ansible runs +deploy_user: ansible +deploy_user_shell: /bin/bash + +# SSH public keys granted access to deploy_user on every host +deploy_user_ssh_keys: + - "{{ ssh_key_ansible }}" + +timezone: "America/Chicago" \ No newline at end of file diff --git a/group_vars/firstrun/vault.yml b/group_vars/firstrun/vault.yml new file mode 100644 index 0000000..e69de29 diff --git a/inventory.yml b/inventory.yml index 23c89ea..5f881a3 100644 --- a/inventory.yml +++ b/inventory.yml @@ -17,7 +17,7 @@ all: #vps3: # ansible_host: 203.0.113.12 - misc: + firstrun: hosts: dal14: ansible_host: 192.3.228.229 diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index fa25150..7f79b16 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -9,31 +9,6 @@ name: "{{ common_base_packages }}" state: present -- name: Set timezone - community.general.timezone: - name: "{{ timezone }}" - -- name: Ensure deploy user exists - ansible.builtin.user: - name: "{{ deploy_user }}" - shell: "{{ deploy_user_shell }}" - groups: sudo - append: true - create_home: true - -- name: Allow deploy user passwordless sudo - ansible.builtin.copy: - dest: "/etc/sudoers.d/{{ deploy_user }}" - content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n" - mode: "0440" - validate: "visudo -cf %s" - -- name: Install SSH keys for deploy user - ansible.posix.authorized_key: - user: "{{ deploy_user }}" - key: "{{ item }}" - loop: "{{ deploy_user_ssh_keys }}" - - name: Install extra host-specific packages (if defined) ansible.builtin.apt: name: "{{ extra_packages }}" diff --git a/roles/firstrun/defaults/main.yml b/roles/firstrun/defaults/main.yml new file mode 100644 index 0000000..a7fe95f --- /dev/null +++ b/roles/firstrun/defaults/main.yml @@ -0,0 +1,12 @@ +--- +common_base_packages: + - curl + - wget + - vim + - btop + - git + - unzip + - ca-certificates + - gnupg + - restic + - sudo \ No newline at end of file diff --git a/roles/firstrun/tasks/main.yml b/roles/firstrun/tasks/main.yml new file mode 100644 index 0000000..fa25150 --- /dev/null +++ b/roles/firstrun/tasks/main.yml @@ -0,0 +1,56 @@ +--- +- name: Update apt cache + ansible.builtin.apt: + update_cache: true + cache_valid_time: 3600 + +- name: Install base packages + ansible.builtin.apt: + name: "{{ common_base_packages }}" + state: present + +- name: Set timezone + community.general.timezone: + name: "{{ timezone }}" + +- name: Ensure deploy user exists + ansible.builtin.user: + name: "{{ deploy_user }}" + shell: "{{ deploy_user_shell }}" + groups: sudo + append: true + create_home: true + +- name: Allow deploy user passwordless sudo + ansible.builtin.copy: + dest: "/etc/sudoers.d/{{ deploy_user }}" + content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n" + mode: "0440" + validate: "visudo -cf %s" + +- name: Install SSH keys for deploy user + ansible.posix.authorized_key: + user: "{{ deploy_user }}" + key: "{{ item }}" + loop: "{{ deploy_user_ssh_keys }}" + +- name: Install extra host-specific packages (if defined) + ansible.builtin.apt: + name: "{{ extra_packages }}" + state: present + when: extra_packages is defined + +- name: Enable unattended-upgrades + ansible.builtin.apt: + name: unattended-upgrades + state: present + when: unattended_upgrades_enabled | bool + +- name: Configure unattended-upgrades to auto-reboot if needed + ansible.builtin.copy: + dest: /etc/apt/apt.conf.d/52unattended-upgrades-local + content: | + Unattended-Upgrade::Automatic-Reboot "true"; + Unattended-Upgrade::Automatic-Reboot-Time "03:30"; + mode: "0644" + when: unattended_upgrades_enabled | bool diff --git a/site.yml b/site.yml index 21a6460..9a7fb0b 100644 --- a/site.yml +++ b/site.yml @@ -1,5 +1,12 @@ --- - name: Baseline configuration for every VPS + hosts: firstrun + become: true + roles: + - firstrun + - security + +- name: Base line hosts: all become: true roles: @@ -18,3 +25,5 @@ become: true roles: - postgres + +