updating the rest of the cojnfig from 1Y to 12M

.gitignore

@@ -0,0 +1,4 @@
+.vault_pass
+*.retry
+.ansible/
+*.log

README.md

@@ -0,0 +1,83 @@
+# VPS-ansible
+
+Ansible playbooks to provision and maintain a small fleet (~4) of VPSs.
+
+## Layout
+
+- `inventory.yml` - all hosts, grouped by role (`webservers`, `dbservers`, `misc`)
+- `group_vars/all/` - vars shared by every host (`vars.yml` plaintext, `vault.yml` encrypted secrets)
+- `group_vars/<group>.yml` or `group_vars/<group>/` - vars for one group of hosts
+- `host_vars/<hostname>.yml` - overrides unique to a single VPS
+- `roles/common` - baseline: packages, timezone, deploy user, unattended-upgrades
+- `roles/security` - SSH hardening, ufw, fail2ban
+- `roles/nginx`, `roles/docker`, `roles/postgres` - role-specific stacks, only applied to the relevant group
+- `site.yml` - top-level playbook: `common` + `security` run on `all`, then group-specific plays
+
+## First-time setup
+
+```bash
+ansible-galaxy collection install -r requirements.yml
+```
+
+Create your vault password file (gitignored, never commit it):
+
+```bash
+echo "your-vault-password" > .vault_pass
+chmod 600 .vault_pass
+```
+
+Encrypt the placeholder vault files before you fill in real secrets:
+
+```bash
+ansible-vault encrypt group_vars/all/vault.yml
+ansible-vault encrypt group_vars/dbservers/vault.yml
+```
+
+Edit an encrypted vault file (opens in VSCodium):
+
+```bash
+EDITOR="codium --wait" ansible-vault edit group_vars/all/vault.yml
+```
+
+Update `inventory.yml` with your real VPS IPs/hostnames, and
+`group_vars/all/vars.yml` with your real SSH public key(s).
+
+## Running
+
+Whole fleet:
+
+```bash
+ansible-playbook site.yml
+```
+
+Just one host:
+
+```bash
+ansible-playbook site.yml --limit vps1
+```
+
+Just one group:
+
+```bash
+ansible-playbook site.yml --limit webservers
+```
+
+Check mode (dry run) before applying anything for real:
+
+```bash
+ansible-playbook site.yml --check --diff
+```
+
+## Bootstrapping a brand-new VPS
+
+The `common` role assumes it can `become: true` (sudo) as `deploy_user`,
+which doesn't exist yet on a fresh VPS. For the very first run against a new
+box, connect as `root` (or whatever the provider gives you) and override the
+remote user on the command line:
+
+```bash
+ansible-playbook site.yml --limit vps1 -u root --ask-pass
+```
+
+After that first run creates `deploy_user` and installs your SSH key,
+subsequent runs will use `deploy_user` automatically via `ansible.cfg`. 

ansible.cfg

@@ -0,0 +1,13 @@
+[defaults]
+inventory       = inventory.yml
+remote_user     = root
+host_key_checking = True
+retry_files_enabled = False
+interpreter_python = auto_silent
+roles_path      = roles
+vault_password_file = .vault_pass
+
+# Speeds up repeated runs against the same small set of hosts
+[ssh_connection]
+pipelining = True
+control_path = ~/.ansible/cp/%%h-%%p-%%r

group_vars/all/main.yml

@@ -0,0 +1,20 @@
+---
+# Vars for every VPS in the fleet. Keep this file plaintext and readable
+# in diffs - actual secret values live in group_vars/all/vault.yml.
+
+# settings used to connect to remote host
+ansible_user: "ansible"
+ansible_port: 25456
+
+# remote used for all playbooks except firstrun
+deploy_user: ansible
+deploy_user_shell: /bin/bash
+
+ufw_allowed_tcp_ports:
+  - "{{ ssh_port }}"
+
+unattended_upgrades_enabled: true
+
+# Example of referencing a vault-held secret from a plaintext var.
+# The value itself is defined in group_vars/all/vault.yml as vault_smtp_password.
+smtp_password: "{{ vault_smtp_password }}"

group_vars/all/vault.yml

@@ -0,0 +1,34 @@
+---
+# IMPORTANT: this file must be encrypted before it is committed.
+#   ansible-vault encrypt group_vars/all/vault.yml
+# To edit later:
+#   EDITOR="codium --wait" ansible-vault edit group_vars/all/vault.yml
+#
+# Convention: every var in here is prefixed with vault_ so it's obvious
+# in vars.yml which values come from the vault.
+
+vault_smtp_password: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  61323135353935366635363664393830363336363636326334643338383762653737656563663338
+  3733363334363066383532303565613136396130646364630a343738323264616137313165633338
+  61306662313264653136363836643331353437366233626432386564633237653537646335356631
+  6163623832336234650a316136346232326331663931313762303964303632663866633031633038
+  3765
+ssh_port: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  62383936303362623464643165643162643961656466303662393263666634356530366362656135
+  3963383332363835653838383637366639666532326530610a323635373236303238653138336362
+  33306663663835343063376434363231313837363531353237616239393630633061643662663239
+  3038396433376265320a623063646363303166373338666531353937336131383566343865336138
+  6338
+ssh_key_root: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  39383066306265616139386537326635363864623261623966666237363863386233373065626239
+  3838373338326535613338386661363366633765643839380a323961303466316633396431383836
+  61353265333638643962383062343535666133353162613761323461336464623236623737666330
+  3936343765366233350a336533346662356233663834336265623137326638623038346631393365
+  36323130333430353632306330343339663962393039653831343064336261396565613530663261
+  32376262376462393030666431353538316337323439333764643566353565373437383265643866
+  39376162636264306465313138316164376533646437626361626532633265303362343662623537
+  32323562303062386464666464666162373038613639366135633563393437613438323632626665
+  3838

group_vars/authelia/vars.yml

@@ -0,0 +1,3 @@
+ufw_allowed_tcp_ports_extra:
+  - 80
+  - 443

group_vars/authelia/vault.yml

@@ -0,0 +1,317 @@
+authelia_users:
+  - username: ryan
+    displayname: "Ryan Toler"
+    email: ryan.toler@localhost.com
+    password_hash: !vault |
+      $ANSIBLE_VAULT;1.1;AES256
+      35333736646162393564633031316663303034313931346530623137343430643761363939376139
+      6339643131363361363931633836353666666232396665390a323436303536386134626365303730
+      32343662303437313430306438323061313562343633333136633161623434333665373237363562
+      6537363864616537650a616536303237646165306333333436343063356637363863323535646161
+      63373939333865646565623131313931343735666236623232656231613365313931366535346537
+      65303733303166396335376436383230616439656163356266373735666630376664366366623138
+      34323637613133343663613563316231653763363235633837643131393130643937386438333337
+      64653665336534303235363833623333346538333263336438623837643035303832343736643337
+      61633261326332346366353137313330373732616634343732316136303832333935
+    groups:
+      - admin
+      - user
+  - username: yulia
+    displayname: "Yulia Toler"
+    email: yulia.toler@localhost.com
+    password_hash: !vault |
+      $ANSIBLE_VAULT;1.1;AES256
+      37313261393630383935643135386462303538623437613535616536373036333838626431656533
+      6161313235633130333830313466333434383433386330620a333965656563386563666363383036
+      65616534353534393638373635616531323937363531393763343630633463666438396633323664
+      3366626565633839350a326562316635663731633938386566313537653530613061396431316438
+      64663939396561313532656331313735386434376535316438333865613561366563323962663532
+      64306663313237353337623434306463653733626337643139303238656265306132396536353738
+      61356133646365653633643932616264323635383364666534313765346564383963633339373534
+      33303066343632616336353765376631353762313538373635363637663765393133376431316332
+      39643130343932643561653830353733633234656338313465313031353463313732
+    groups:
+      - users
+wikijs_uuid: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  62303565643064643732353839373834353436363532313538303231623765363632663361666364
+  6631326465643739353130656132303462333530656236300a646630383964353235346136393961
+  34343363613138373566613539396130303539353335383934306231373634313831383135613439
+  3636626464323035620a633435623664306461616363346665336134363138646232353132653265
+  30643533396436303536646638633633313539316133653336343931613363313737636366653331
+  3734323836363861306638373262343035313938626132366664
+wikijs_client_secret: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  64656630646633666130653734633463366364363035363238323539303731326261363230636431
+  6661353065636435653638623262366331633465616333640a313966366631396366346532306431
+  65333037303665373434613632303062613133383631333963366435313562643439613130353065
+  3430303561656335300a656337613862346439643139626634653563643732643064393939303134
+  62386537626138333361653364323935626437363766326362643931336532373631383266653764
+  33363366343164613234616232613763356433393537313436343736646438363261656236353863
+  31353532643339633635316332643562346435393664303265346534353665313065393564656166
+  36616664613139303734623662663934313435353536343932363834623038343535623738386661
+  38393862326636616165393134313964373936346566356264316639623630396131383233613862
+  37353432346530353161373831393633646464656265363138393961306361316563363433393465
+  323561653539386238623663343066363832
+authelia_jwt_secret: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  34306239616233393235376564646464613833313332353365666264663735656536663133643736
+  3030653434396436666536386464353333353264353062360a356437633837636461393637633439
+  33363130373666376539343362366665386138366630343566613736303863383337636535323466
+  3938396138373162620a333633396431366564356436613535343065376330393137353662333264
+  62353536376535353465636265656330326463613431353438326663366234346133336332643830
+  37333139363462636463393535366438316166316265393534636162336635626662663161393836
+  62396332363166396134343065653834333634646631393631633565373234393331343337303230
+  34333163616434303830
+authelia_session_secret: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  65386636666564643734643436356430333432373663316236396534306135346236646639313963
+  6136393261353662313365346664333866633537396166610a303739316536376531353264306362
+  39363630393161363131663438666238356237313835626435643434313364616666333039646166
+  3335613634616634380a353731623033383232393436663139623933343464346165386563323462
+  66376262383935613064646661393462393266346537313662613238656266663466336166336136
+  63323933376561353035623036663131393362623264303863613339313366623932356537303562
+  65623862643037646133363465643265373332303364346137326330626265663130333632666165
+  65666339626438356231
+authelia_storage_encryption_key: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  31623232316430323331386337623939326431336666663763363932353337393236353963616534
+  3465623361306534326337363964386564373465613265650a373666366638303030323431326264
+  37323932353866383734366561383961653937386162666166313337653834313866336230646162
+  6331663763613830610a623334316334306366373532333731353831653034373965353465376462
+  35333766353532373462323631316435363431303963616132663761323039366439636238633731
+  31656562363863626462323435303937363463616666306432353430346636316632316631626461
+  65373433383233323466613064633961393838636238626665343831636239336364363539306665
+  35386536653836316366
+authelia_semaphore_oidcsecret: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  35343063616134656339623064656131643638386261333563613839336364366539343337616231
+  6236613632383430353566353234303430356333623334360a666236363630646661653733313835
+  61616336323232323462643261633561373130396632623631353361323565356138666663646233
+  3937343935333463350a646631653035636235343032303261346531643339383763636133323365
+  65313838306333333563613533643662393432623137336533386466383431396236613163323962
+  3236323333636131373034633234363939373661663130323338
+authelia_jwks_privatekey: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  37313866663734666635636332613162666237383333623234623962386264373664623866376233
+  6336306139373930343536303833393366393734346135330a313236373232616630343432303937
+  34333066653166646134323133323231613565633463353939326234353838336465363130323563
+  6232303836386631620a353362646566333866343163643837383864343639653663346131393132
+  38366462356233313839356161336634646132663035343365646137386337653236343063633237
+  66366166626132383635643165623362356136353661333161366434663431363365373133323866
+  31346634336233633761363263623731313533326235326166396164316633383731303164663737
+  66643634373865653630623431633236646238656333323633616264336138316539303864316534
+  62356461633938656461306561613761393565616234646630643633303235623761376131626634
+  35653033313532323334646433363864663931313565323930373432333234643031376130383139
+  32333832356166656361356632376630653930303533366632643264323536306430666530663065
+  31653937346135643263316434383535643365333764636532366263623935306239663161383064
+  38643433623430373363316634663735346665363662613366376539303437393162663531363534
+  31383563663365343939666163653836653236343865636365326239306230353964346135663430
+  38653866633733316665383639623636303330633834376233636231306639353937613537303062
+  34666239663961343331633164333362623964653437323737346339623934643532613831633539
+  63643762343861393435323734353730633139366235626265393665343738646361613238393438
+  30336534626664383838396262623736613836373831333664356634666561653663656263383231
+  38303730303366656132343335653335613866643131663733366437353235626238653365353162
+  35373662326431393136393862356131343762356235363162646662306534316334646263306330
+  31383639393166383166656466623036666534373964376664653766643539306133343336346233
+  36613035636139316164623532363839626137303530353736646532323262656432653661633036
+  66356338663338656264623066393332616365333837636133623461396333373666373433346639
+  34333836343466633065656330646466326333646235333934366431316133636139643932306361
+  30303836643965613433393138366436653835303033326332383264393739383633373830656461
+  30616361303064383631616134326134323935653334356238613135633166356332643330336532
+  65353461353039326637613366663331633935656361326362393134663465313837303335316539
+  63313266346139386338383932393761363438386133643536363436386138353134313737626161
+  35356464343061393933646330303766303461343365626161623738326165626535346338376136
+  37343230653163393062313333306635306339353236306337366232396330636333396238386235
+  35373664396338306234366335333032333066663730653337393861623966316366313734646334
+  30656262333564386664393462353462356134316638393937373631303432333262613033303564
+  66643031353838643766386434356633386530363336396166326136643630303432316136363065
+  33306264636537303634383361323039303763323832393966636231313937623936376238323762
+  33623238323039343365303631343165623766336665313432373761623763396334666135363732
+  36323364393737393631343136333837373334633535663239333431613032303439656164663130
+  31316562633638353130663365383934323933613466333665346535313034643232313137373637
+  33353661666362303664643838343231306338313533303836366166363734303634663539383165
+  39636666346133633734633862316665346662353933356261393364386362313933303966346233
+  31626331383263376661333737353539333831303164653332363336396133363866613334313731
+  38656237623638336139366435353234656166343839663536363862393930663632643863636532
+  66623461613961363137356334356338653838336333633062636233653539653531333632623338
+  35343734363738333637633236623832306463353837383339623130303035626364376334303161
+  32623661353864313761326162363930636139633731623462313439333664636161363533656666
+  65653266333334623764306439383461326663396139326231373039313363623964316435383439
+  63643037613930303339333031303863333239643935343234623838663163373461626131393630
+  62646535306437613431396336613866643566303434323761366433636337663534393934396433
+  66303334626235343331316334393637316463623438316166326338623265643162653465366333
+  35653663316537346431636231346237313936613961663564346566326538336165633933353562
+  36333930396231326463616530623937323536363634323466366165336533646439646362323562
+  64613838383964336132376633353933363734353730356565626166386635336130656130386336
+  33653734633661623962616638323639653835653833376566373535333939306365386333663439
+  65346236656136356261333836653832363937393334396363346466623461616635363163626337
+  65386439393032313937323165373465373162313161366331386232613665306436366166366530
+  66353564636533623865663865346666316638393432663136656137646337376565303833623838
+  31373230366361656431663531396538616630363033636338353734613366316136323131393837
+  37356237386336636637303230343138343930323033613539616534613131393164663038376335
+  64663663623934653363663032656464626138303039343464663439636666383139316164396163
+  39366338313535303434303131363830656661643130396634666438373433366364306162383034
+  64646334383665313564643732373861653136653132313665613162353338613638313334333563
+  34343634373232653935623839323364326665366636333632363033336637623231343438663530
+  38386334346665303861363835323261353335653939376433653062323862356439373261323537
+  35353233323561646137643662616431653763373562623164303961346266643635333134653161
+  34393730316437323964633635333364313132646136376461616363353630323237663537303135
+  61346236313231663035343735323638373230363166316439653435313263323233353264363662
+  39343166323338666537373634363835613062333130633833616436323631356533656636613632
+  65343362316137373338336436653139653563613933373237613935343934383763366239653239
+  66356266353764663433623263366230663332396266333138643765376435383231313834373061
+  32633433396266346164616532626336366563376331376434633338613035373637616564316436
+  65636337663037343861346233633636623461616132353130353261666234376564366264623361
+  39396439353566316636613933313638623366386330653634613738363838323663633330623839
+  34393739353932663530356431303061306138356632343434633865303730363830303431663831
+  33626630616266323462636463376238353063643035656162356135346564643134633633393930
+  66313434613462356638346331326364633235653964373435666234346261616130396464636536
+  37336263353835326439646363323566626164366537353234323938313030646438383832646531
+  39643130363133653564313937636132323564656161383336653361363536323263613932653134
+  31383165333466373765623063383963616237313433313031626338666436646330363836336363
+  64343732616265616430613130353731383338353564346531333932313430316634653939633561
+  32326533653832653737386564333866386535303234323361633338373936613235323866306262
+  66393135393534393563366434633839343464343438636330363737333566393932363637393363
+  64303264386239663730613135656436663736636436303532356530333830366364336265333366
+  35643562336537653439363865316465643264656435326561653838623261333938343735373062
+  30316366356361343664316430376139333862323961303139363762303661626234356330633138
+  62393932316230333363303034346333656237626434633665333134316365343132636537636232
+  35653965326233656437633837303737366464373363643663616461353066616539333966633430
+  35356339613364396565363838636237363933373566663934623331353766646238393462663663
+  37613934376162313838333235366230653864663264346232396432393663623335656533336432
+  39396231396335613765393566623033376162363430633731313633323863653637663533323665
+  61636436626639313030363735343230663235316132653131303237653036613539383865623337
+  61656639396563346539333837306534653234306566363436633536356532316633326164326266
+  66383764333731643734386665633264663937643737633563663934656135666133363665343635
+  38663430396365623732653931616638333736316331613930306533343034346462333761383032
+  61333866343464613230613937653030666635336566623633363561363663393361373536666239
+  39373836323961376262623135613132366632343862643266346136326334646439643538313565
+  63626639373038383161306339383332663438356163396434393565316630306234626666383363
+  61376534663930646230313365623365653431376230383037636436363738323733353265363030
+  36623464343062383938343439336531663962663732623430653733373364396365623738303262
+  38376336346532326139623266626334376632313238653734613562613937666539633064396166
+  66343362656536306137663039656165653134616461396534623031356563623366616563386437
+  33666233346339636462383464333264656333353134353761623366386363336130663430353539
+  31666533343039633465363131653337646633653634336261663862313137303563653864653535
+  33653338333164366338396161316633376363346230313563326234363832386133316435653435
+  31663462333230643566373337323235386264343265343830346334666134396438323937396331
+  63633035366132656631343936663439323066353537373538663130333333643734343465333964
+  65633033383236396666666565663935306164333965373330626139336536373734343436653139
+  35383062383264356137383138636263636464346133313663333766643639353638646534653133
+  30373466323065633230323739353034623361326133383764646562353131393538653335346563
+  66323033376531383836613964353233343961386238353461663030313437386337313439333030
+  39333333383637623765613830316137653766363430366362303536376638346636366130666161
+  39383534306366313564346234323063323665353439663732643530323537623361303139393233
+  64343061313435306634363066633730313765333632373863643639666335363361373034656236
+  31306561633964383563623231666439313432363830653930313536666266326133653836653333
+  37623730353463373733613061646337353761646536376365363030326236376536336664373830
+  34393233373134316437303431313064633935383237373264353330646462663661366435366161
+  37653463303339633562306461313264303430323562366466356339653531643464363461373538
+  38336461333362633639643764626265306439613333356361363837396163373932336334343666
+  34383262626263396632366361633038303638663139353739646234663230313263316235656362
+  38623137383737633638363739373364323435623537386239396339653462313834616663636662
+  66653134636336316631316336666233616139376466306563656439636432366137393666656565
+  37653131343432306139363832396531343761623934616430333632333331343266306432353033
+  39353261373165386534666239653566323466646364646535643638633738313964623033376138
+  31316163666464343431616631313437323734326630346230386434373536373861643862353035
+  64656234663961393831626466623166343962383666343036373762336639323262643033393034
+  33343931346338326466636431383037306333653830323666313639393665646135363634653635
+  63623563623530616536616461613531613362386230626438653764613561363435343032323335
+  36303139323034613731393161653138653130326666353639366330326130343333626230633234
+  39656636633133396239303563336539663733626130623332636232376263636165363538393737
+  61336166313632623864363536343965373662336332343439336635323966383936623435613431
+  39363939626434653965653932363033643635663238663839303735613363656365656465396364
+  34643166386262353462353930376662636266653531316466343232326265623662656364626166
+  39366139626135636533646464613334646164613437663032393139626465653964333964306465
+  65366331363532386338373932613634376163383839386636333032376133376337633833656339
+  34306362366236643966323963643939353563616239393732323535393233386534393137646430
+  61653365363735623130363338343238656231643738653031326266313862313935366264613438
+  30633362333933393838376261343839636263323264326636646462323961343132643261373234
+  62663138633433666535396436666533343032633732303863396334626632366362636139646333
+  37613237363934376162346230373733623435373730636462373537383363626538396333353461
+  37333331643833373162306364343766363438643835646638353130353166373933646634306338
+  66653165323332323062323734633866353536623266646363613664373161306364336132663764
+  30323164613061373638646665363930306436393231383964366532306530646534353036323766
+  63653933373330383138643463653435393865663566356236373134666462313464353161643734
+  35643930666239343638636539346132363262383730323766333762313933636430353439376661
+  33306661616638636132323235383063393662333332633963613536343861316634316432326133
+  36663332653632666335383264333036646466653333643030313566356438373232363732643638
+  38653032623737376634393064336535313266656236333438366433653865353530373734323132
+  36663631643033386231616561666263333432626361343237396534626339316263326431326364
+  35373462663531376232323264303266636139343431306463346232363832666638373666656161
+  34393534316237633433333437376331346134356461343765396463333437323266623466663662
+  66373933386231356338663933663938626439656131383464643361386434366531383039343330
+  64343438343739303438393663393331653037633238653861313033356531643963616230626435
+  66663238363861303537313637633938666239613233653864336131623439306662356432373437
+  32643031373936383363616665306266353265646637656230326336653437623830653131353166
+  64336161313562663064393630663133653438373637363762343964333337623962386232323535
+  63326135636334373164313437356666343039383835646566383937383236646364663833383664
+  32356131313064386132336439666638316131303838323962303634333437313463363466363065
+  33383065613632626136666161373866343831663933393536306430366162373661356539653862
+  63396431616561616230343266303564346534383438363030313534353464663836656130633962
+  65323137353336613536326230643334643233353131616362366665646632333463636530633664
+  63343166303237343539663634633031396566623562323534326463343932376539663366353130
+  32346535313431323835333737666566616331633562633730623034383066383935313465626632
+  66316435343033303762613066636264653331393238373830343933386130333432333131303061
+  34343266373435643339366662373064316361323735323135343064353366623061373530326164
+  32363265646135653165383331316234376436623361633265353636616463383633656563343739
+  38346462613562613531366335653337623932616666336332353961656237333330313236366663
+  65343032626162363965306230626465353833653334303835656134353734666266363862646561
+  36633063373966313361363832616432656266303561396538616163613664306134363861616535
+  35316337626462326330646333346437333161643361636366663465313564383636336130333532
+  62383434383032346339393837653735323161386630343533303534373438303563636561313561
+  34306337653434303965396439346436366636643535643339613966663061333838663436656364
+  34313631376133396536663838653664383766383736386136356261366437633463343639303163
+  33363762623865376236356137346537653464363634646464643335353333326439653463306264
+  34313366356532643137663961363663636237303534326239323535356630393762333938623839
+  33366230363766366334343066353333356362306166333662626464663966666664353761646239
+  39373933633637383734333036373437653362643362306465646561346331353733373336653732
+  65623137326136376339383361626337363037346665656566383761643830666130373433386534
+  61373065656161633131366466306330643461326431326466666236653165643438303437653464
+  63393236643363653731376335303436383366373262353639346265356338663161623564336461
+  61326465306636353631316330373230383134363365393364326132366563303830376263353435
+  35316635386633353734356263363733616533333763366536373734656161303732306332666136
+  65373231633932333039316334353361396164393865666566333731663539393361663765313736
+  62303131353535653132323633656134316136343038353263363166666337383231353532386632
+  39646136653439323436303962353837313537626438376462656638303863636363623138643331
+  32396139646462383336376539646233613763306530353664346539663262656263653632353231
+  39383137356637623166313363653233333263643335386534353530396236396136613830326661
+  36373065643937343234613865633264396664623335386532616563383432646438333865326466
+  64383530653362373263306365353832343737346261383362393561613931303037666565613434
+  61663333323932333134663735303365366638656563366138326461633338336138366161643532
+  66353538306664663236643362366264353761343965376166323461353736346530316165613366
+  63316562663830303035623339323130343561623163313164323536616232353439656366636266
+  66343464376263383434386433383438663037663936333462306332363032353034373638663863
+  61633035333535323561396262656332323139343561616437656136363137363465343933653234
+  64633232396339663033313035323035373837663964623136626234646430393663353061643462
+  62613136663561386466636338323961396161636465313064353663393263633534323163386163
+  31363837643432643665346133653332613766356264656235303031333734373730383632663130
+  35636631316531653666323739646131393662363364373531373239626334663766356365373166
+  61663538343835613732313532343930393935303738356333396663343631353763383835653036
+  35386361373930633932333461326232313837666431376161373932363865373736376333623065
+  66333966333338353465646666343266333332303936613538663861663531616232303335383164
+  31346564353663306566363230386334336366643135323539663736306131343762346530383339
+  34396239343035386639316537366435356632343466633166313163323965653665353035316635
+  61306237393039353133323736623835633935343163313765613431333263666163323065356465
+  35396466653263313330366336303762326162373466613133646163393338356232313835343336
+  62623937643663353434656430376237653664393164353831653536353632376165643064383066
+  66653161656230623566356263656631353232353634313662333634383632363663383835386565
+  30356362353166633061326163373136306338333663333061323130313366396439613363356435
+  32356330663964666334376238633266366264613830636136323130633039393165303133316462
+  64306639363838306336313032613235353162373766663439613864636466313665346639633865
+  61393539373861313636336330656366653234383736343361623761616461613062323237653936
+  33646533643863643166353162303762636661633266643466356639643533353933313034663134
+  39663664646139666430343731643630386231316361376366363234353139363532663031376465
+  37353431633065396230393731383232353930333831623034303032353865653531303733323635
+  63313630383035393938306364323230663737656261303037303438653639383461336564366666
+  34666336373031633339306166623438613964653561343932343731353563313966663735303634
+  36663063386633613531333338663461396664356462343538666365613133353835356435343539
+  34336663393539623632356634363237663533383161623637323238303862616336306337326163
+  32633364346463646661393739393636343931616137643138316539336534323662366262663933
+  35643862326664313864303336666231613135633135366463323263393963616435323137646536
+  39303237663637613638613037393031623637663161363637626163376333636132643865363736
+  39643633343363613365633963613038313738386434353635313463356230643832653262333035
+  36373166363735313734356361393031366264373936313932313032613033623331633562396463
+  61643131393839393035316332653661613961393736646536363365643161316364346533326131
+  6432343163363339313439376664386233623062643462653633

group_vars/dbservers/vars.yml

@@ -0,0 +1,10 @@
+---
+postgres_version: 16
+postgres_databases:
+  - name: app_production
+postgres_users:
+  - name: app_user
+    password: "{{ vault_postgres_app_user_password }}"
+
+ufw_allowed_tcp_ports_extra:
+  - 5432

group_vars/dbservers/vault.yml

@@ -0,0 +1,9 @@
+---
+# ansible-vault encrypt group_vars/dbservers/vault.yml
+vault_postgres_app_user_password: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  33303539306334343565623232393134626264383662376531646339636433373235623733386239
+  3139663334353234346436616163656366616364333636650a373265366666666163393263313433
+  35366662323130363332373263323264346633633635346331323534376439666363383863393830
+  6565336230636638660a323838643534383664306631643933633931383461633533663535346635
+  3133

group_vars/firstrun/main.yml

@@ -0,0 +1,15 @@
+---
+# vars that are only used for the first setup. after this the defaults change to not use root.
+# this is to setup the ansible user, basic tools and security measures.
+
+# setup needed connection information, overrides the values in all group
+ansible_user: "root"
+ansible_port: 22
+
+# SSH public keys granted access to deploy_user on every host
+deploy_user_ssh_keys:
+  - "{{ ssh_key_ansible }}"
+
+timezone: "America/Chicago"
+ufw_allowed_tcp_ports_extr:
+  - 25456

group_vars/firstrun/vault.yml

@@ -0,0 +1,11 @@
+$ANSIBLE_VAULT;1.1;AES256
+33393934663533643031643263653461636330326461333939303639343266616665316166343136
+6536653866326536646361396136306365663730353036370a333765636538646662333565333234
+35306561613465326562303333643164323931306337353832663532663139623862343364363539
+3334666430316464390a623332386666343834633964643836336232616366363739353331346530
+37626131633430663539643331303538306163306264643064636235666132336635343135376136
+36386136393436386433333763356431363034646438383933333936343136346133343761663530
+65633232353864393935383237656162383531643664393366366261316561613831346565613739
+64353331386635653434613065323038343566393037303331313635393965323562333661663730
+39336539646136343961613434613736346431383033303462313231626661643166343262653935
+3939346666653863363534613065336534353736326665643061

group_vars/webservers.yml

@@ -0,0 +1,9 @@
+---
+nginx_sites:
+  - name: example.com
+    server_name: "example.com www.example.com"
+    root: /var/www/example.com
+
+ufw_allowed_tcp_ports_extra:
+  - 80
+  - 443

host_vars/dal14.yml

@@ -0,0 +1,2 @@
+---
+# extra_packages: ""

host_vars/vps1.yml

@@ -0,0 +1,4 @@
+---
+# Anything here overrides group_vars/all.yml and group_vars/webservers.yml
+# for this host only. Example: vps1 runs SSH on a nonstandard port.
+

host_vars/vps4.yml

@@ -0,0 +1,6 @@
+---
+# vps4 is a standalone "misc" box - not in webservers or dbservers,
+# so it only ever gets the common + security roles from site.yml.
+#extra_packages:
+#  - restic
+

inventory.yml

@@ -0,0 +1,24 @@
+---
+all:
+  vars:
+    ansible_python_interpreter: /usr/bin/python3
+    
+  children:
+
+    webservers:
+        #vps2:
+        #  ansible_host: 203.0.113.11
+
+    dbservers:
+      hosts:
+        #vps3:
+        #  ansible_host: 203.0.113.12
+
+    authelia:
+      hosts:
+        dal14:
+          ansible_host: 192.3.228.229
+
+    firstrun:
+      hosts:
+        

requirements.yml

@@ -0,0 +1,5 @@
+---
+collections:
+  - name: community.general
+  - name: ansible.posix
+  - name: community.postgresql

roles/authelia/defaults/main.yml

@@ -0,0 +1,12 @@
+authelia_base_dir: /opt/authelia
+authelia_config_dir: "{{ authelia_base_dir }}/config"
+authelia_data_dir: "{{ authelia_base_dir }}/data"
+
+authelia_image: authelia/authelia:4
+authelia_container_name: authelia
+authelia_network_name: authelia_net
+
+authelia_domain: frantecrt.duckdns.org
+authelia_port: 9091
+
+authelia_log_level: info

roles/authelia/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart authelia
+  community.docker.docker_compose_v2:
+    project_src: "{{ authelia_base_dir }}"
+    state: present
+    recreate: always

roles/authelia/tasks/main.yml

@@ -0,0 +1,78 @@
+---
+
+- name: Remove nginx, avoids port 80 conflict
+  ansible.builtin.apt:
+    name: nginx
+    state: absent
+
+- name: Remove nginx service, avoids port 80 conflict
+  ansible.builtin.service:
+    name: nginx
+    state: stopped
+    enabled: false
+
+- name: Create authelia directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0750"
+  loop:
+    - "{{ authelia_base_dir }}"
+    - "{{ authelia_config_dir }}"
+    - "{{ authelia_data_dir }}"
+
+- name: Check if Caddyfile path is wrongly a directory
+  ansible.builtin.stat:
+    path: "{{ authelia_base_dir }}/Caddyfile"
+  register: caddyfile_stat
+
+- name: Remove Caddyfile if it was created as a directory
+  ansible.builtin.file:
+    path: "{{ authelia_base_dir }}/Caddyfile"
+    state: absent
+  when: caddyfile_stat.stat.exists and caddyfile_stat.stat.isdir
+
+- name: Deploy Caddyfile
+  ansible.builtin.template:
+    src: Caddyfile.j2
+    dest: "{{ authelia_base_dir }}/Caddyfile"
+    owner: root
+    group: root
+    mode: "0640"
+  notify: restart authelia
+
+- name: Deploy configuration.yml
+  ansible.builtin.template:
+    src: configuration.yml.j2
+    dest: "{{ authelia_config_dir }}/configuration.yml"
+    owner: root
+    group: root
+    mode: "0640"
+  notify: restart authelia
+
+- name: Deploy users_database.yml
+  ansible.builtin.template:
+    src: users_database.yml.j2
+    dest: "{{ authelia_config_dir }}/users_database.yml"
+    owner: root
+    group: root
+    mode: "0640"
+  notify: restart authelia
+  when: authelia_users is defined
+
+- name: Deploy docker-compose.yml
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ authelia_base_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0640"
+  register: compose_file
+
+- name: Pull and start authelia via docker compose
+  community.docker.docker_compose_v2:
+    project_src: "{{ authelia_base_dir }}"
+    state: present
+    pull: missing

roles/authelia/templates/Caddyfile.j2

@@ -0,0 +1,55 @@
+auth.{{ authelia_domain }} {
+    reverse_proxy 127.0.0.1:{{ authelia_port }}
+}
+
+# Reusable snippet for Authelia Forward Auth
+(authelia_auth) {
+    forward_auth http://127.0.0.1:9091 { # Replace with your Authelia IP/Port or container name
+        uri /api/verify?rd=https://auth.frantecrt.duckdns.org # Replace with your public Authelia URL
+        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+    }
+}
+
+semaphore.frantecrt.duckdns.org {
+    # Import the auth configuration block
+    import authelia_auth
+
+    # Route the traffic to your backend application if authenticated
+    reverse_proxy semaphore.netbird.cloud:3000
+}
+
+git.frantecrt.duckdns.org {
+    # Import the auth configuration block
+
+    # Route the traffic to your backend application if authenticated
+    reverse_proxy gitea.netbird.cloud:3000
+}
+
+wikijs.frantecrt.duckdns.org {
+    # Not using authelia_auth as it breaks the app's login page. 
+    reverse_proxy wikijs.netbird.cloud:3000
+    
+}
+
+vault.frantecrt.duckdns.org {
+    # Route the traffic to your backend application if authenticated
+    reverse_proxy wikijs.netbird.cloud:8080
+    reverse_proxy /notifications/hub* wikijs.netbird.cloud:3012
+    reverse_proxy /notifications/anonymous_hub* wikijs.netbird.cloud:3012
+}
+
+slskd.frantecrt.duckdns.org {
+    # Import the auth configuration block
+    import authelia_auth
+
+    # Route the traffic to your backend application if authenticated
+    reverse_proxy navidrome.netbird.cloud:5030
+}
+
+navidrome.frantecrt.duckdns.org {
+    # Import the auth configuration block
+    import authelia_auth
+
+    # Route the traffic to your backend application if authenticated
+    reverse_proxy navidrome.netbird.cloud:4533
+}

roles/authelia/templates/configuration.yml.j2

@@ -0,0 +1,114 @@
+theme: light
+default_2fa_method: totp
+
+server:
+  address: 'tcp://0.0.0.0:{{ authelia_port }}'
+
+log:
+  level: {{ authelia_log_level }}
+
+totp:
+  issuer: {{ authelia_domain }}
+
+authentication_backend:
+  file:
+    path: /config/users_database.yml
+
+access_control:
+  default_policy: deny
+  rules:
+    - domain: "*.{{ authelia_domain }}"
+      policy: two_factor
+
+session:
+  secret: {{ authelia_session_secret }}
+  cookies:
+    - name: authelia_session
+      domain: {{ authelia_domain }}
+      authelia_url: "https://auth.{{ authelia_domain }}"
+      expiration: 12h
+      inactivity: 1h
+
+regulation:
+  max_retries: 3
+  find_time: 2m
+  ban_time: 5m
+
+storage:
+  encryption_key: {{ authelia_storage_encryption_key }}
+  local:
+    path: /config/db.sqlite3
+
+notifier:
+  filesystem:
+    filename: /config/notification.txt
+
+identity_validation:
+  reset_password:
+    jwt_secret: {{ authelia_jwt_secret }}
+
+identity_providers:
+  oidc:
+    jwks:
+      - key_id: 'main-signing-key'
+        algorithm: 'RS256'
+        use: 'sig'
+        key: |
+          {{ authelia_jwks_privatekey | b64decode | indent(10) }}
+    claims_policies:
+      semaphore_claims_policy:
+        id_token:
+          - groups
+          - email
+          - email_verified
+          - alt_emails
+          - preferred_username
+          - name
+      wikijs_claims_policy:
+        id_token:
+          - groups
+          - email
+          - email_verified
+          - alt_emails
+          - preferred_username
+          - name
+    clients:
+      - client_id: semaphore
+        client_name: Semaphore
+        client_secret: {{ authelia_semaphore_oidcsecret }}
+        claims_policy: semaphore_claims_policy
+        public: false
+        authorization_policy: two_factor
+        consent_mode: 'pre-configured'
+        pre_configured_consent_duration: '12M' # Reask consent for data share 1 year after first login
+        redirect_uris:
+          - https://semaphore.{{ authelia_domain }}/api/auth/oidc/authelia/redirect
+        scopes:
+          - openid
+          - profile
+          - email
+        userinfo_signed_response_alg: none
+      - client_id: wikijs
+        client_name: Wiki
+        client_secret: {{ wikijs_client_secret }}
+        claims_policy: wikijs_claims_policy
+        public: false
+        authorization_policy: two_factor
+        consent_mode: 'pre-configured'
+        pre_configured_consent_duration: '12M' # Reask consent for data share 1 year after first login
+        require_pkce: false
+        pkce_challenge_method: ''
+        redirect_uris:
+          - 'https://wikijs.{{ authelia_domain }}/login/{{ wikijs_uuid }}/callback'  # Note this must be copied during step 7 of the Application configuration.
+        scopes:
+          - openid
+          - profile
+          - email
+          - groups
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_post'

roles/authelia/templates/docker-compose.yml.j2

@@ -0,0 +1,22 @@
+services:
+  authelia:
+    image: {{ authelia_image }}
+    container_name: {{ authelia_container_name }}
+    restart: unless-stopped
+    volumes:
+      - {{ authelia_config_dir }}:/config
+    ports:
+      - "127.0.0.1:{{ authelia_port }}:{{ authelia_port }}"
+    environment:
+      - TZ={{ ansible_facts.timezone | default('UTC') }}
+
+  caddy:
+    image: caddy:2
+    container_name: authelia_caddy
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - /etc/resolv.conf:/etc/resolv.conf:ro
+      - {{ authelia_base_dir }}/Caddyfile:/etc/caddy/Caddyfile
+      - {{ authelia_data_dir }}/caddy_data:/data
+      - {{ authelia_data_dir }}/caddy_config:/config

roles/authelia/templates/users_database.yml.j2

@@ -0,0 +1,11 @@
+users:
+{% for user in authelia_users %}
+  {{ user.username }}:
+    displayname: "{{ user.displayname }}"
+    password: "{{ user.password_hash }}"
+    email: {{ user.email }}
+    groups:
+{% for group in user.groups %}
+      - {{ group }}
+{% endfor %}
+{% endfor %}

roles/common/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+common_base_packages:
+  - curl
+  - wget
+  - vim
+  - btop
+  - git
+  - unzip
+  - ca-certificates
+  - gnupg
+  - restic

roles/common/tasks/main.yml

@@ -0,0 +1,31 @@
+---
+- name: Update apt cache
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Install base packages
+  ansible.builtin.apt:
+    name: "{{ common_base_packages }}"
+    state: present
+
+- name: Install extra host-specific packages (if defined)
+  ansible.builtin.apt:
+    name: "{{ extra_packages }}"
+    state: present
+  when: extra_packages is defined
+
+- name: Enable unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+  when: unattended_upgrades_enabled | bool
+
+- name: Configure unattended-upgrades to auto-reboot if needed
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
+    content: |
+      Unattended-Upgrade::Automatic-Reboot "true";
+      Unattended-Upgrade::Automatic-Reboot-Time "03:30";
+    mode: "0644"
+  when: unattended_upgrades_enabled | bool

roles/docker/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Check if docker is already installed
+  ansible.builtin.command: docker --version
+  register: docker_check
+  changed_when: false
+  failed_when: false
+
+- name: Install docker via convenience script
+  ansible.builtin.shell: |
+    set -o pipefail
+    curl -fsSL https://get.docker.com | sh
+  args:
+    executable: /bin/bash
+  when: docker_check.rc != 0
+  changed_when: true
+
+- name: Add deploy user to docker group
+  ansible.builtin.user:
+    name: "{{ deploy_user }}"
+    groups: docker
+    append: true
+
+- name: Ensure docker is running and enabled
+  ansible.builtin.service:
+    name: docker
+    state: started
+    enabled: true

roles/firstrun/defaults/main.yml

@@ -0,0 +1,12 @@
+---
+firstrun_common_base_packages:
+  - curl
+  - wget
+  - vim
+  - btop
+  - git
+  - unzip
+  - ca-certificates
+  - gnupg
+  - restic
+  - sudo

roles/firstrun/tasks/main.yml

@@ -0,0 +1,55 @@
+---
+- name: Update apt cache
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Install base packages
+  ansible.builtin.apt:
+    name: "{{ firstrun_common_base_packages }}"
+    state: present
+
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ timezone }}"
+
+- name: Ensure deploy user exists
+  ansible.builtin.user:
+    name: "{{ deploy_user }}"
+    shell: "{{ deploy_user_shell }}"
+    groups: sudo
+    append: true
+    create_home: true
+
+- name: Allow deploy user passwordless sudo
+  ansible.builtin.copy:
+    dest: "/etc/sudoers.d/{{ deploy_user }}"
+    content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
+    mode: "0440"
+    validate: "visudo -cf %s"
+
+- name: Install SSH keys for deploy user
+  ansible.posix.authorized_key:
+    user: "{{ deploy_user }}"
+    key: "{{ ssh_key_ansible }}"
+
+- name: Install extra host-specific packages (if defined, skipped if not defined)
+  ansible.builtin.apt:
+    name: "{{ extra_packages | default([]) }}"
+    state: present
+
+
+- name: Enable unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+  when: unattended_upgrades_enabled | bool
+
+- name: Configure unattended-upgrades to auto-reboot if needed
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
+    content: |
+      Unattended-Upgrade::Automatic-Reboot "true";
+      Unattended-Upgrade::Automatic-Reboot-Time "03:30";
+    mode: "0644"
+  when: unattended_upgrades_enabled | bool

roles/nginx/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+- name: Install nginx
+  ansible.builtin.apt:
+    name: nginx
+    state: present
+
+- name: Ensure nginx is running and enabled
+  ansible.builtin.service:
+    name: nginx
+    state: started
+    enabled: true
+
+# TODO: template out vhosts from the `nginx_sites` var defined in
+# group_vars/webservers.yml, e.g.:
+#
+# - name: Deploy vhost configs
+#   ansible.builtin.template:
+#     src: vhost.conf.j2
+#     dest: "/etc/nginx/sites-available/{{ item.name }}"
+#   loop: "{{ nginx_sites }}"
+#   notify: Reload nginx

roles/postgres/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Install postgresql
+  ansible.builtin.apt:
+    name:
+      - "postgresql-{{ postgres_version }}"
+      - python3-psycopg2
+    state: present
+
+- name: Ensure postgresql is running and enabled
+  ansible.builtin.service:
+    name: postgresql
+    state: started
+    enabled: true
+
+# - name: Create databases
+#   become_user: postgres
+#   community.postgresql.postgresql_db:
+#     name: "{{ item.name }}"
+#   loop: "{{ postgres_databases }}"
+
+# - name: Create users
+#   become_user: postgres
+#   community.postgresql.postgresql_user:
+#     name: "{{ item.name }}"
+#     password: "{{ item.password }}"
+#   loop: "{{ postgres_users }}"
+#   no_log: true

roles/security/defaults/main.yml

@@ -0,0 +1,17 @@
+---
+security_ufw_allowed_tcp_ports_extra: []
+
+#sshd config
+ssh_permit_root_login: "no"
+ssh_password_authentication: "no"
+ssh_port: 25456
+
+# Netbird Setup key
+netbird_setup_key: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  31643131346238616338346361313638623035643365366238663836393434373334623233653630
+  3161653330363836303238323739383464383261316630300a626463316164353535303331643962
+  31393937376565646234643263643836336137376635306636666631356262363538386266363964
+  6436306166313239360a373531626666343135623363333539626536303338303562633065373064
+  30636432356633653735333836313339346265656263363365323031656339646230313233386263
+  3433323337643565333564656365343063343163333035663233

roles/security/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart sshd
+  ansible.builtin.service:
+    name: ssh
+    state: restarted

roles/security/tasks/main.yml

@@ -0,0 +1,117 @@
+---
+- name: Install ufw and fail2ban
+  ansible.builtin.apt:
+    name:
+      - ufw
+      - fail2ban
+    state: present
+
+- name: Harden sshd_config - PermitRootLogin
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?PermitRootLogin"
+    line: "PermitRootLogin {{ ssh_permit_root_login }}"
+  notify: Restart sshd
+
+- name: Harden sshd_config - PasswordAuthentication
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?PasswordAuthentication"
+    line: "PasswordAuthentication {{ ssh_password_authentication }}"
+  notify: Restart sshd
+
+- name: Set sshd Port
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?Port"
+    line: "Port {{ ssh_port }}"
+  notify: Restart sshd
+
+- name: Reset ufw defaults (deny incoming, allow outgoing)
+  community.general.ufw:
+    state: reset
+  changed_when: false
+
+- name: Set ufw default policies
+  community.general.ufw:
+    direction: "{{ item.direction }}"
+    policy: "{{ item.policy }}"
+  loop:
+    - { direction: incoming, policy: deny }
+    - { direction: outgoing, policy: allow }
+
+- name: Allow required TCP ports through ufw
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop: "{{ (ufw_allowed_tcp_ports + ufw_allowed_tcp_ports_extra) | unique }}"
+
+- name: Enable ufw
+  community.general.ufw:
+    state: enabled
+
+- name: Ensure fail2ban is running and enabled
+  ansible.builtin.service:
+    name: fail2ban
+    state: started
+    enabled: true
+
+- name: Install required packages for netbird
+  apt:
+    name:
+      - curl
+      - gnupg
+      - ca-certificates
+    state: present
+    update_cache: false
+
+- name: Configure network buffer sizes (increased speed)
+  ansible.posix.sysctl:
+    name: "{{ item.key }}"
+    value: "{{ item.value }}"
+    state: present
+    reload: true
+    ignoreerrors: true
+  loop:
+    - { key: 'net.core.rmem_max', value: '7500000' }
+    - { key: 'net.core.wmem_max', value: '7500000' }
+
+- name: Add repository with key
+  ansible.builtin.deb822_repository:
+    name: netbird
+    types: [deb]
+    uris: "https://pkgs.netbird.io/debian"
+    components: [main]
+    suites: ["stable"]
+    signed_by: https://pkgs.netbird.io/debian/public.key
+    state: present
+    enabled: true
+
+- name: Install netbird
+  ansible.builtin.apt:
+    name:
+      - netbird
+    state: present
+    update_cache: true
+
+- name: Enable netbird service
+  ansible.builtin.systemd:
+    name: netbird
+    state: started
+    enabled: true
+
+- name: Check NetBird status
+  ansible.builtin.command: netbird status
+  register: netbird_status
+  ignore_errors: true
+  changed_when: false
+
+- name: Start NetBird if needed
+  ansible.builtin.command: netbird up --management-url https://api.netbird.io --setup-key "{{ netbird_setup_key }}"
+  when: >
+    "NeedsLogin" in netbird_status.stdout or
+    "LoginFailed" in netbird_status.stdout
+  vars:
+    ansible_command_timeout: 3600
+  changed_when: true

site.yml

@@ -0,0 +1,34 @@
+---
+- name: Baseline configuration for every VPS
+  hosts: firstrun
+  become: true
+  roles:
+    - firstrun
+    - security
+
+- name: Base line
+  hosts: all
+  become: true
+  roles:
+    - common
+    - security
+
+- name: Web servers
+  hosts: webservers
+  become: true
+  roles:
+    - docker
+    - nginx
+
+- name: Database servers
+  hosts: dbservers
+  become: true
+  roles:
+    - postgres
+
+- name: authelia servers
+  hosts: authelia
+  become: true
+  roles:
+    - docker
+    - authelia