first push with basic outline

group_vars/all/main.yml

@@ -0,0 +1,28 @@
+---
+# Vars for every VPS in the fleet. Keep this file plaintext and readable
+# in diffs - actual secret values live in group_vars/all/vault.yml.
+
+timezone: "America/Chicago"
+
+# The non-root user created/used for all future Ansible runs
+deploy_user: ansible
+deploy_user_shell: /bin/bash
+
+# SSH public keys granted access to deploy_user on every host
+deploy_user_ssh_keys:
+  - "{{ ssh_key_ansible }}"
+
+# Hardening toggles (see roles/security)
+ssh_permit_root_login: "no"
+ssh_password_authentication: "no"
+ssh_port: 25456
+ansible_port: 25456
+
+ufw_allowed_tcp_ports:
+  - "{{ ssh_port }}"
+
+unattended_upgrades_enabled: true
+
+# Example of referencing a vault-held secret from a plaintext var.
+# The value itself is defined in group_vars/all/vault.yml as vault_smtp_password.
+smtp_password: "{{ vault_smtp_password }}"

group_vars/all/vault.yml

@@ -0,0 +1,45 @@
+---
+# IMPORTANT: this file must be encrypted before it is committed.
+#   ansible-vault encrypt group_vars/all/vault.yml
+# To edit later:
+#   EDITOR="codium --wait" ansible-vault edit group_vars/all/vault.yml
+#
+# Convention: every var in here is prefixed with vault_ so it's obvious
+# in vars.yml which values come from the vault.
+
+vault_smtp_password: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  61323135353935366635363664393830363336363636326334643338383762653737656563663338
+  3733363334363066383532303565613136396130646364630a343738323264616137313165633338
+  61306662313264653136363836643331353437366233626432386564633237653537646335356631
+  6163623832336234650a316136346232326331663931313762303964303632663866633031633038
+  3765
+ssh_port: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  62383936303362623464643165643162643961656466303662393263666634356530366362656135
+  3963383332363835653838383637366639666532326530610a323635373236303238653138336362
+  33306663663835343063376434363231313837363531353237616239393630633061643662663239
+  3038396433376265320a623063646363303166373338666531353937336131383566343865336138
+  6338
+ssh_key_root: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  39383066306265616139386537326635363864623261623966666237363863386233373065626239
+  3838373338326535613338386661363366633765643839380a323961303466316633396431383836
+  61353265333638643962383062343535666133353162613761323461336464623236623737666330
+  3936343765366233350a336533346662356233663834336265623137326638623038346631393365
+  36323130333430353632306330343339663962393039653831343064336261396565613530663261
+  32376262376462393030666431353538316337323439333764643566353565373437383265643866
+  39376162636264306465313138316164376533646437626361626532633265303362343662623537
+  32323562303062386464666464666162373038613639366135633563393437613438323632626665
+  3838
+ssh_key_ansible: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  63323264313237376633336661303737616439333765306239633836323563663433323334633665
+  6135393039316536336636333463656234346264333632310a633134393036626132623736313834
+  33333430353533356532393038393936383138383364613036363764323065373838316463643630
+  3163346264303161390a366539343365626131623435376264373236653632356466663365346631
+  36613734626532656330363564303833623661656336323539373666613762373333616138306166
+  30376330386639663938633331636264646364333438313961303063363135666466323163383831
+  64646366656263346435353138626633343430626166343761663131396535633633616462613534
+  34626438646634393266303034353362363365313366306465633334663631353639323739656432
+  3164

group_vars/dbservers/vars.yml

@@ -0,0 +1,10 @@
+---
+postgres_version: 16
+postgres_databases:
+  - name: app_production
+postgres_users:
+  - name: app_user
+    password: "{{ vault_postgres_app_user_password }}"
+
+ufw_allowed_tcp_ports_extra:
+  - 5432

group_vars/dbservers/vault.yml

@@ -0,0 +1,9 @@
+---
+# ansible-vault encrypt group_vars/dbservers/vault.yml
+vault_postgres_app_user_password: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  33303539306334343565623232393134626264383662376531646339636433373235623733386239
+  3139663334353234346436616163656366616364333636650a373265366666666163393263313433
+  35366662323130363332373263323264346633633635346331323534376439666363383863393830
+  6565336230636638660a323838643534383664306631643933633931383461633533663535346635
+  3133

group_vars/webservers.yml

@@ -0,0 +1,9 @@
+---
+nginx_sites:
+  - name: example.com
+    server_name: "example.com www.example.com"
+    root: /var/www/example.com
+
+ufw_allowed_tcp_ports_extra:
+  - 80
+  - 443