118 lines
2.9 KiB
YAML
118 lines
2.9 KiB
YAML
---
|
|
- name: Install ufw and fail2ban
|
|
ansible.builtin.apt:
|
|
name:
|
|
- ufw
|
|
- fail2ban
|
|
state: present
|
|
|
|
- name: Harden sshd_config - PermitRootLogin
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PermitRootLogin"
|
|
line: "PermitRootLogin {{ ssh_permit_root_login }}"
|
|
notify: Restart sshd
|
|
|
|
- name: Harden sshd_config - PasswordAuthentication
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PasswordAuthentication"
|
|
line: "PasswordAuthentication {{ ssh_password_authentication }}"
|
|
notify: Restart sshd
|
|
|
|
- name: Set sshd Port
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?Port"
|
|
line: "Port {{ ssh_port }}"
|
|
notify: Restart sshd
|
|
|
|
- name: Reset ufw defaults (deny incoming, allow outgoing)
|
|
community.general.ufw:
|
|
state: reset
|
|
changed_when: false
|
|
|
|
- name: Set ufw default policies
|
|
community.general.ufw:
|
|
direction: "{{ item.direction }}"
|
|
policy: "{{ item.policy }}"
|
|
loop:
|
|
- { direction: incoming, policy: deny }
|
|
- { direction: outgoing, policy: allow }
|
|
|
|
- name: Allow required TCP ports through ufw
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop: "{{ (ufw_allowed_tcp_ports + ufw_allowed_tcp_ports_extra) | unique }}"
|
|
|
|
- name: Enable ufw
|
|
community.general.ufw:
|
|
state: enabled
|
|
|
|
- name: Ensure fail2ban is running and enabled
|
|
ansible.builtin.service:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Install required packages for netbird
|
|
apt:
|
|
name:
|
|
- curl
|
|
- gnupg
|
|
- ca-certificates
|
|
state: present
|
|
update_cache: false
|
|
|
|
- name: Configure network buffer sizes (increased speed)
|
|
ansible.posix.sysctl:
|
|
name: "{{ item.key }}"
|
|
value: "{{ item.value }}"
|
|
state: present
|
|
reload: true
|
|
ignoreerrors: true
|
|
loop:
|
|
- { key: 'net.core.rmem_max', value: '7500000' }
|
|
- { key: 'net.core.wmem_max', value: '7500000' }
|
|
|
|
- name: Add repository with key
|
|
ansible.builtin.deb822_repository:
|
|
name: netbird
|
|
types: [deb]
|
|
uris: "https://pkgs.netbird.io/debian"
|
|
components: [main]
|
|
suites: ["stable"]
|
|
signed_by: https://pkgs.netbird.io/debian/public.key
|
|
state: present
|
|
enabled: true
|
|
|
|
- name: Install netbird
|
|
ansible.builtin.apt:
|
|
name:
|
|
- netbird
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Enable netbird service
|
|
ansible.builtin.systemd:
|
|
name: netbird
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Check NetBird status
|
|
ansible.builtin.command: netbird status
|
|
register: netbird_status
|
|
ignore_errors: true
|
|
changed_when: false
|
|
|
|
- name: Start NetBird if needed
|
|
ansible.builtin.command: netbird up --management-url https://api.netbird.io --setup-key "{{ netbird_setup_key }}"
|
|
when: >
|
|
"NeedsLogin" in netbird_status.stdout or
|
|
"LoginFailed" in netbird_status.stdout
|
|
vars:
|
|
ansible_command_timeout: 3600
|
|
changed_when: true
|