Upload files to "/"

2025-11-13 04:41:54 +00:00
commit 59795fe71b
5 changed files with 363 additions and 0 deletions
@@ -0,0 +1,126 @@
+- name: Bootstrap new Linux servers
+  hosts: all
+  become: yes
+
+  tasks:
+
+    - name: Install packages on Debian/Ubuntu
+      apt:
+        name:
+          - vim
+          - htop
+          - nmap
+          - curl
+          - wget
+          - iperf3
+          - fail2ban
+          - net-tools
+          - lsof
+          - unzip
+          - zip
+          - git
+          - sudo
+          - tree
+          - traceroute
+          - dnsutils
+          - ca-certificates
+          - python3
+          - python3-pip
+          - software-properties-common
+          - rsync
+          - apt-transport-https
+          - sysstat
+          - screen
+          - mtr
+        state: present
+        update_cache: yes
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Ensure EPEL repo is enabled (RHEL/CentOS/AlmaLinux)
+      yum:
+        name: epel-release
+        state: present
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Install packages on RHEL/CentOS/AlmaLinux
+      yum:
+        name:
+          - vim
+          - htop
+          - nmap
+          - curl
+          - mtr
+          - wget
+          - iperf3
+          - fail2ban
+          - net-tools
+          - lsof
+          - unzip
+          - zip
+          - git
+          - sudo
+          - tmux
+          - tree
+          - bash-completion
+          - traceroute
+          - bind-utils        # provides dig, nslookup
+          - ca-certificates
+          - python3
+          - python3-pip
+          - rsync
+          - sysstat
+          - screen
+        state: present
+        update_cache: yes
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Ensure root's .ssh directory exists
+      file:
+        path: /root/.ssh
+        state: directory
+        owner: root
+        group: root
+        mode: '0700'
+
+    - name: Set authorized_keys for root
+      copy:
+        dest: /root/.ssh/authorized_keys
+        content: |
+          ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINegitHaQG8i+s412h3wTWf/KvpeX1CEpYFva9MhHR+7 ansible-key
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Permit root login via public key
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PermitRootLogin\s+'
+        line: 'PermitRootLogin prohibit-password'
+        state: present
+        backup: yes
+
+    - name: Ensure PubkeyAuthentication is enabled
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PubkeyAuthentication\s+'
+        line: 'PubkeyAuthentication yes'
+        state: present
+
+    - name: Ensure PasswordAuthentication is enabled
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PasswordAuthentication\s+'
+        line: 'PasswordAuthentication yes'
+        state: present
+
+    - name: Restart SSH service (Debian)
+      service:
+        name: ssh
+        state: restarted
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Restart SSH service (RHEL)
+      service:
+        name: sshd
+        state: restarted
+      when: ansible_facts['os_family'] == "RedHat"