adding firstrun playbook

group_vars/all/main.yml

@@ -2,21 +2,16 @@
 # Vars for every VPS in the fleet. Keep this file plaintext and readable
 # in diffs - actual secret values live in group_vars/all/vault.yml.
 
-timezone: "America/Chicago"
 
-# The non-root user created/used for all future Ansible runs
-deploy_user: ansible
-deploy_user_shell: /bin/bash
 
-# SSH public keys granted access to deploy_user on every host
+
-deploy_user_ssh_keys:
+
-  - "{{ ssh_key_ansible }}"
 
 # Hardening toggles (see roles/security)
 ssh_permit_root_login: "no"
 ssh_password_authentication: "no"
 ssh_port: 25456
-ansible_port: 25456
+: 25456
 
 ufw_allowed_tcp_ports:
   - "{{ ssh_port }}"

group_vars/firstrun/main.yml

@@ -0,0 +1,16 @@
+---
+# vars that are only used for the first setup. after this the defaults change to not use root.
+# this is to setup the ansible user, basic tools and security measures. 
+
+# setup needed connection information
+ansible_port: 22
+
+# The non-root user created/used for all future Ansible runs
+deploy_user: ansible
+deploy_user_shell: /bin/bash
+
+# SSH public keys granted access to deploy_user on every host
+deploy_user_ssh_keys:
+  - "{{ ssh_key_ansible }}"
+
+timezone: "America/Chicago"

inventory.yml

@@ -17,7 +17,7 @@ all:
         #vps3:
         #  ansible_host: 203.0.113.12
 
-    misc:
+    firstrun:
       hosts:
         dal14:
           ansible_host: 192.3.228.229

roles/common/tasks/main.yml

@@ -9,31 +9,6 @@
     name: "{{ common_base_packages }}"
     state: present
 
-- name: Set timezone
-  community.general.timezone:
-    name: "{{ timezone }}"
-
-- name: Ensure deploy user exists
-  ansible.builtin.user:
-    name: "{{ deploy_user }}"
-    shell: "{{ deploy_user_shell }}"
-    groups: sudo
-    append: true
-    create_home: true
-
-- name: Allow deploy user passwordless sudo
-  ansible.builtin.copy:
-    dest: "/etc/sudoers.d/{{ deploy_user }}"
-    content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
-    mode: "0440"
-    validate: "visudo -cf %s"
-
-- name: Install SSH keys for deploy user
-  ansible.posix.authorized_key:
-    user: "{{ deploy_user }}"
-    key: "{{ item }}"
-  loop: "{{ deploy_user_ssh_keys }}"
-
 - name: Install extra host-specific packages (if defined)
   ansible.builtin.apt:
     name: "{{ extra_packages }}"

roles/firstrun/defaults/main.yml

@@ -0,0 +1,12 @@
+---
+common_base_packages:
+  - curl
+  - wget
+  - vim
+  - btop
+  - git
+  - unzip
+  - ca-certificates
+  - gnupg
+  - restic
+  - sudo

roles/firstrun/tasks/main.yml

@@ -0,0 +1,56 @@
+---
+- name: Update apt cache
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Install base packages
+  ansible.builtin.apt:
+    name: "{{ common_base_packages }}"
+    state: present
+
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ timezone }}"
+
+- name: Ensure deploy user exists
+  ansible.builtin.user:
+    name: "{{ deploy_user }}"
+    shell: "{{ deploy_user_shell }}"
+    groups: sudo
+    append: true
+    create_home: true
+
+- name: Allow deploy user passwordless sudo
+  ansible.builtin.copy:
+    dest: "/etc/sudoers.d/{{ deploy_user }}"
+    content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
+    mode: "0440"
+    validate: "visudo -cf %s"
+
+- name: Install SSH keys for deploy user
+  ansible.posix.authorized_key:
+    user: "{{ deploy_user }}"
+    key: "{{ item }}"
+  loop: "{{ deploy_user_ssh_keys }}"
+
+- name: Install extra host-specific packages (if defined)
+  ansible.builtin.apt:
+    name: "{{ extra_packages }}"
+    state: present
+  when: extra_packages is defined
+
+- name: Enable unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+  when: unattended_upgrades_enabled | bool
+
+- name: Configure unattended-upgrades to auto-reboot if needed
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
+    content: |
+      Unattended-Upgrade::Automatic-Reboot "true";
+      Unattended-Upgrade::Automatic-Reboot-Time "03:30";
+    mode: "0644"
+  when: unattended_upgrades_enabled | bool

site.yml

@@ -1,5 +1,12 @@
 ---
 - name: Baseline configuration for every VPS
+  hosts: firstrun
+  become: true
+  roles:
+    - firstrun
+    - security
+
+- name: Base line
   hosts: all
   become: true
   roles:
@@ -18,3 +25,5 @@
   become: true
   roles:
     - postgres
+
+