first push with basic outline

roles/common/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+common_base_packages:
+  - curl
+  - wget
+  - vim
+  - btop
+  - git
+  - unzip
+  - ca-certificates
+  - gnupg
+  - restic

roles/common/tasks/main.yml

@@ -0,0 +1,56 @@
+---
+- name: Update apt cache
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Install base packages
+  ansible.builtin.apt:
+    name: "{{ common_base_packages }}"
+    state: present
+
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ timezone }}"
+
+- name: Ensure deploy user exists
+  ansible.builtin.user:
+    name: "{{ deploy_user }}"
+    shell: "{{ deploy_user_shell }}"
+    groups: sudo
+    append: true
+    create_home: true
+
+- name: Allow deploy user passwordless sudo
+  ansible.builtin.copy:
+    dest: "/etc/sudoers.d/{{ deploy_user }}"
+    content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
+    mode: "0440"
+    validate: "visudo -cf %s"
+
+- name: Install SSH keys for deploy user
+  ansible.posix.authorized_key:
+    user: "{{ deploy_user }}"
+    key: "{{ item }}"
+  loop: "{{ deploy_user_ssh_keys }}"
+
+- name: Install extra host-specific packages (if defined)
+  ansible.builtin.apt:
+    name: "{{ extra_packages }}"
+    state: present
+  when: extra_packages is defined
+
+- name: Enable unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+  when: unattended_upgrades_enabled | bool
+
+- name: Configure unattended-upgrades to auto-reboot if needed
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
+    content: |
+      Unattended-Upgrade::Automatic-Reboot "true";
+      Unattended-Upgrade::Automatic-Reboot-Time "03:30";
+    mode: "0644"
+  when: unattended_upgrades_enabled | bool

roles/docker/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+- name: Check if docker is already installed
+  ansible.builtin.command: docker --version
+  register: docker_check
+  changed_when: false
+  failed_when: false
+
+- name: Install docker via convenience script
+  ansible.builtin.shell: |
+    set -o pipefail
+    curl -fsSL https://get.docker.com | sh
+  args:
+    executable: /bin/bash
+  when: docker_check.rc != 0
+
+- name: Add deploy user to docker group
+  ansible.builtin.user:
+    name: "{{ deploy_user }}"
+    groups: docker
+    append: true
+
+- name: Ensure docker is running and enabled
+  ansible.builtin.service:
+    name: docker
+    state: started
+    enabled: true

roles/nginx/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+- name: Install nginx
+  ansible.builtin.apt:
+    name: nginx
+    state: present
+
+- name: Ensure nginx is running and enabled
+  ansible.builtin.service:
+    name: nginx
+    state: started
+    enabled: true
+
+# TODO: template out vhosts from the `nginx_sites` var defined in
+# group_vars/webservers.yml, e.g.:
+#
+# - name: Deploy vhost configs
+#   ansible.builtin.template:
+#     src: vhost.conf.j2
+#     dest: "/etc/nginx/sites-available/{{ item.name }}"
+#   loop: "{{ nginx_sites }}"
+#   notify: Reload nginx

roles/postgres/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Install postgresql
+  ansible.builtin.apt:
+    name:
+      - "postgresql-{{ postgres_version }}"
+      - python3-psycopg2
+    state: present
+
+- name: Ensure postgresql is running and enabled
+  ansible.builtin.service:
+    name: postgresql
+    state: started
+    enabled: true
+
+- name: Create databases
+  become_user: postgres
+  community.postgresql.postgresql_db:
+    name: "{{ item.name }}"
+  loop: "{{ postgres_databases }}"
+
+- name: Create users
+  become_user: postgres
+  community.postgresql.postgresql_user:
+    name: "{{ item.name }}"
+    password: "{{ item.password }}"
+  loop: "{{ postgres_users }}"
+  no_log: true

roles/security/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+ufw_allowed_tcp_ports_extra: []

roles/security/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart sshd
+  ansible.builtin.service:
+    name: ssh
+    state: restarted

roles/security/tasks/main.yml

@@ -0,0 +1,58 @@
+---
+- name: Install ufw and fail2ban
+  ansible.builtin.apt:
+    name:
+      - ufw
+      - fail2ban
+    state: present
+
+- name: Harden sshd_config - PermitRootLogin
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?PermitRootLogin"
+    line: "PermitRootLogin {{ ssh_permit_root_login }}"
+  notify: Restart sshd
+
+- name: Harden sshd_config - PasswordAuthentication
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?PasswordAuthentication"
+    line: "PasswordAuthentication {{ ssh_password_authentication }}"
+  notify: Restart sshd
+
+- name: Set sshd Port
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?Port"
+    line: "Port {{ ssh_port }}"
+  notify: Restart sshd
+
+- name: Reset ufw defaults (deny incoming, allow outgoing)
+  community.general.ufw:
+    state: reset
+  changed_when: false
+
+- name: Set ufw default policies
+  community.general.ufw:
+    direction: "{{ item.direction }}"
+    policy: "{{ item.policy }}"
+  loop:
+    - { direction: incoming, policy: deny }
+    - { direction: outgoing, policy: allow }
+
+- name: Allow required TCP ports through ufw
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop: "{{ (ufw_allowed_tcp_ports + ufw_allowed_tcp_ports_extra) | unique }}"
+
+- name: Enable ufw
+  community.general.ufw:
+    state: enabled
+
+- name: Ensure fail2ban is running and enabled
+  ansible.builtin.service:
+    name: fail2ban
+    state: started
+    enabled: true