From 04e38f42b5e823f54bbfec2b9ab1d2caab432cd8 Mon Sep 17 00:00:00 2001 From: alessandrovitali Date: Wed, 17 Jun 2026 14:08:04 +0200 Subject: [PATCH] initial commit --- .gitignore | 4 +++ README.md | 3 ++ ansible.cfg | 3 ++ galaxy.yml | 10 +++++++ roles/base/defaults/main.yml | 14 +++++++++ roles/base/tasks/main.yml | 41 +++++++++++++++++++++++++++ roles/docker/tasks/main.yml | 35 +++++++++++++++++++++++ roles/security/handlers/main.yml | 5 ++++ roles/security/tasks/main.yml | 35 +++++++++++++++++++++++ roles/security/templates/sshd.conf.j2 | 5 ++++ roles/users/tasks/main.yml | 38 +++++++++++++++++++++++++ 11 files changed, 193 insertions(+) create mode 100644 .gitignore create mode 100644 README.md create mode 100644 ansible.cfg create mode 100644 galaxy.yml create mode 100644 roles/base/defaults/main.yml create mode 100644 roles/base/tasks/main.yml create mode 100644 roles/docker/tasks/main.yml create mode 100644 roles/security/handlers/main.yml create mode 100644 roles/security/tasks/main.yml create mode 100644 roles/security/templates/sshd.conf.j2 create mode 100644 roles/users/tasks/main.yml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4c2058c --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +## OS generated files +# macOS +.DS_Store +._* diff --git a/README.md b/README.md new file mode 100644 index 0000000..a5b04a9 --- /dev/null +++ b/README.md @@ -0,0 +1,3 @@ +# Ansible Collection + +Opinionated set of roles to configure reasonable defaults for newly provisioned Debian / Ubuntu VMs running Docker. The repository provides a ready-to-use Ansible Collection (`studio.ansible`) containing reusable roles. diff --git a/ansible.cfg b/ansible.cfg new file mode 100644 index 0000000..ade6677 --- /dev/null +++ b/ansible.cfg @@ -0,0 +1,3 @@ +[defaults] +inventory = inventory/hosts.ini +roles_path = roles diff --git a/galaxy.yml b/galaxy.yml new file mode 100644 index 0000000..9e0f03e --- /dev/null +++ b/galaxy.yml @@ -0,0 +1,10 @@ +## galaxy.yml + +namespace: studio +name: ansible +readme: README.md +version: 1.0.0 +authors: + - Studio Vitali +description: Studio Ansible collection containing common roles +license: MIT diff --git a/roles/base/defaults/main.yml b/roles/base/defaults/main.yml new file mode 100644 index 0000000..696eb59 --- /dev/null +++ b/roles/base/defaults/main.yml @@ -0,0 +1,14 @@ +--- +## roles/base/defaults/main.yml + +base_timezone: "Europe/Zurich" +base_packages: + - curl + - git + - htop + - rsync + - unzip + - unattended-upgrades + # - acl ## needed for Ansible to become unprivileged user + # - python3-pip + # - wget diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml new file mode 100644 index 0000000..c398fff --- /dev/null +++ b/roles/base/tasks/main.yml @@ -0,0 +1,41 @@ +--- +- name: Set system timezone + community.general.timezone: + # name: "{{ base_timezone }}" + name: Europe/Zurich + become: true + +- name: Fully upgrade system + ansible.builtin.apt: + update_cache: true + upgrade: dist + cache_valid_time: 3600 + when: ansible_facts['os_family'] == "Debian" ## only on Debian / Ubuntu systems + become: true + +- name: Install essential system utilities + ansible.builtin.apt: + # name: "{{ base_packages }}" + name: + - acl + - curl + - git + - htop + - rsync + - unzip + - unattended-upgrades + state: present + update_cache: true + when: ansible_facts['os_family'] == "Debian" + become: true +# +# - name: Enable unattended-upgrades +# ansible.builtin.copy: +# dest: /etc/apt/apt.conf.d/20auto-upgrades +# content: | +# APT::Periodic::Update-Package-Lists "1"; +# APT::Periodic::Unattended-Upgrade "1"; +# mode: "0644" +# when: ansible_facts['os_family'] == "Debian" + +## SCHEDULE REBOOTS 4 kernel upgrades: with cron, unattended-upgrades or action workflows? diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml new file mode 100644 index 0000000..4229019 --- /dev/null +++ b/roles/docker/tasks/main.yml @@ -0,0 +1,35 @@ +--- +- name: Install necessary Docker packages + ansible.builtin.apt: + name: + - docker.io + - docker-compose + state: present + when: ansible_facts['os_family'] == "Debian" ## Debian / Ubuntu + become: true + +- name: Ensure Docker service is running + ansible.builtin.service: + name: docker + state: started + enabled: true + +- name: Create docker user for container execution + ansible.builtin.user: + name: docker + state: present + system: true + shell: /usr/sbin/nologin + groups: docker + append: true + create_home: false + become: true + +- name: Create target for docker compose + ansible.builtin.file: + path: /opt/docker + state: directory + owner: deployment + group: deployment + mode: "0755" + become: true diff --git a/roles/security/handlers/main.yml b/roles/security/handlers/main.yml new file mode 100644 index 0000000..6998953 --- /dev/null +++ b/roles/security/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: Restart sshd + ansible.builtin.service: + name: sshd + state: restarted diff --git a/roles/security/tasks/main.yml b/roles/security/tasks/main.yml new file mode 100644 index 0000000..a0b5b33 --- /dev/null +++ b/roles/security/tasks/main.yml @@ -0,0 +1,35 @@ +--- +- name: Create SSH drop-in directory + ansible.builtin.file: + path: /etc/ssh/sshd_config.d + state: directory + owner: root + group: root + mode: "0755" + become: true + +- name: Harden SSH configuration with drop-in template + ansible.builtin.template: + src: sshd.conf.j2 + dest: /etc/ssh/sshd_config.d/sshd.conf + owner: root + group: root + mode: "0644" + validate: "sshd -t -f %s" + notify: Restart sshd + become: true + +- name: Install fail2ban + ansible.builtin.apt: + name: + - fail2ban + state: present + when: ansible_facts['os_family'] == "Debian" + become: true + +- name: Start fail2ban + ansible.builtin.service: + name: fail2ban + state: started + enabled: yes + when: ansible_facts['os_family'] == "Debian" diff --git a/roles/security/templates/sshd.conf.j2 b/roles/security/templates/sshd.conf.j2 new file mode 100644 index 0000000..5bc4370 --- /dev/null +++ b/roles/security/templates/sshd.conf.j2 @@ -0,0 +1,5 @@ +## Disable root login +PermitRootLogin no + +## Disable password authentication +PasswordAuthentication no diff --git a/roles/users/tasks/main.yml b/roles/users/tasks/main.yml new file mode 100644 index 0000000..6628891 --- /dev/null +++ b/roles/users/tasks/main.yml @@ -0,0 +1,38 @@ +--- +# - name: Create primary admin user +# ansible.builtin.user: +# name: sysadmin +# groups: sudo +# append: yes +# shell: /bin/bash +# create_home: yes +# become: true + +# - name: Add SSH public key for sysadmin +# ansible.posix.authorized_key: +# user: sysadmin +# state: present +# key: "{{ sysadmin_public_ssh_key }}" +# become: true + +# - name: Allow passwordless sudo to sysadmin user +# ansible.builtin.copy: +# dest: /etc/sudoers.d/sysadmin +# content: "sysadmin ALL=(ALL) NOPASSWD: ALL" +# mode: "0440" +# validate: /usr/sbin/visudo -cf %s +# become: true + +- name: Create deployment user for CI/CD + ansible.builtin.user: + name: deployment + shell: /bin/bash + create_home: yes + become: true + +- name: Add SSH public key for deployment user + ansible.posix.authorized_key: + user: deployment + state: present + key: "{{ deployment_public_ssh_key }}" + become: true