Harwinder Sekhon
686080a493
- inventory: add proxmox host, lxc and vms groups, critical_services per host - retarget bootstrap and time-region to ubuntu:rocky so the Proxmox host is untouched - add ansible.cfg, collections/requirements.yml, .gitignore, .yamllint, .ansible-lint - remove stale root new_lxc.yml duplicate and the Nextcloud upgrade playbook Claude-Session: https://claude.ai/code/session_01JEczyvRjfakkiDNkbZA7PR
145 lines
3.3 KiB
YAML
145 lines
3.3 KiB
YAML
---
|
|
- name: Bootstrap - Install packages on Ubuntu
|
|
hosts: ubuntu
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Install packages via apt
|
|
ansible.builtin.apt:
|
|
name:
|
|
- vim
|
|
- htop
|
|
- nmap
|
|
- curl
|
|
- wget
|
|
- iperf3
|
|
- fail2ban
|
|
- net-tools
|
|
- lsof
|
|
- unzip
|
|
- zip
|
|
- git
|
|
- sudo
|
|
- tree
|
|
- traceroute
|
|
- dnsutils
|
|
- ca-certificates
|
|
- python3
|
|
- python3-pip
|
|
- software-properties-common
|
|
- rsync
|
|
- apt-transport-https
|
|
- sysstat
|
|
- screen
|
|
- mtr
|
|
- tar
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Bootstrap - Install packages on Rocky Linux
|
|
hosts: rocky
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Ensure EPEL repo is enabled
|
|
ansible.builtin.dnf:
|
|
name: epel-release
|
|
state: present
|
|
|
|
- name: Install packages via dnf
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- tar
|
|
- vim
|
|
- htop
|
|
- nmap
|
|
- curl
|
|
- mtr
|
|
- wget
|
|
- iperf3
|
|
- fail2ban
|
|
- net-tools
|
|
- lsof
|
|
- unzip
|
|
- zip
|
|
- git
|
|
- sudo
|
|
- tmux
|
|
- tree
|
|
- bash-completion
|
|
- traceroute
|
|
- bind-utils
|
|
- ca-certificates
|
|
- python3
|
|
- python3-pip
|
|
- rsync
|
|
- sysstat
|
|
- screen
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Bootstrap - Configure SSH access
|
|
hosts: ubuntu:rocky
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Ensure root's .ssh directory exists
|
|
ansible.builtin.file:
|
|
path: /root/.ssh
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0700'
|
|
|
|
- name: Set authorized_keys for root
|
|
ansible.builtin.copy:
|
|
dest: /root/.ssh/authorized_keys
|
|
content: |
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINegitHaQG8i+s412h3wTWf/KvpeX1CEpYFva9MhHR+7 ansible-key
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
|
|
- name: Permit root login via public key
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?PermitRootLogin\s+'
|
|
line: 'PermitRootLogin prohibit-password'
|
|
state: present
|
|
backup: true
|
|
|
|
- name: Ensure PubkeyAuthentication is enabled
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?PubkeyAuthentication\s+'
|
|
line: 'PubkeyAuthentication yes'
|
|
state: present
|
|
|
|
# NOTE: playbooks/ssh_harden.yml overrides this via /etc/ssh/sshd_config.d/00-ansible.conf
|
|
- name: Ensure PasswordAuthentication is enabled
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?PasswordAuthentication\s+'
|
|
line: 'PasswordAuthentication yes'
|
|
state: present
|
|
|
|
- name: Bootstrap - Restart SSH on Ubuntu
|
|
hosts: ubuntu
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Restart ssh service
|
|
ansible.builtin.service:
|
|
name: ssh
|
|
state: restarted
|
|
|
|
- name: Bootstrap - Restart SSH on Rocky Linux
|
|
hosts: rocky
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Restart sshd service
|
|
ansible.builtin.service:
|
|
name: sshd
|
|
state: restarted
|