initial commit

.gitignore

@@ -0,0 +1,4 @@
+## OS generated files
+# macOS
+.DS_Store
+._*

README.md

@@ -0,0 +1,3 @@
+# Ansible Collection
+
+Opinionated set of roles to configure reasonable defaults for newly provisioned Debian / Ubuntu VMs running Docker. The repository provides a ready-to-use Ansible Collection (`studio.ansible`) containing reusable roles.

ansible.cfg

@@ -0,0 +1,3 @@
+[defaults]
+inventory = inventory/hosts.ini
+roles_path = roles

galaxy.yml

@@ -0,0 +1,10 @@
+## galaxy.yml
+
+namespace: studio
+name: ansible
+readme: README.md
+version: 1.0.0
+authors:
+  - Studio Vitali
+description: Studio Ansible collection containing common roles
+license: MIT

roles/base/defaults/main.yml

@@ -0,0 +1,14 @@
+---
+## roles/base/defaults/main.yml
+
+base_timezone: "Europe/Zurich"
+base_packages:
+  - curl
+  - git
+  - htop
+  - rsync
+  - unzip
+  - unattended-upgrades
+  # - acl ## needed for Ansible to become unprivileged user
+  # - python3-pip
+  # - wget

roles/base/tasks/main.yml

@@ -0,0 +1,41 @@
+---
+- name: Set system timezone
+  community.general.timezone:
+    # name: "{{ base_timezone }}"
+    name: Europe/Zurich
+  become: true
+
+- name: Fully upgrade system
+  ansible.builtin.apt:
+    update_cache: true
+    upgrade: dist
+    cache_valid_time: 3600
+  when: ansible_facts['os_family'] == "Debian" ## only on Debian / Ubuntu systems
+  become: true
+
+- name: Install essential system utilities
+  ansible.builtin.apt:
+    # name: "{{ base_packages }}"
+    name:
+      - acl
+      - curl
+      - git
+      - htop
+      - rsync
+      - unzip
+      - unattended-upgrades
+    state: present
+    update_cache: true
+  when: ansible_facts['os_family'] == "Debian"
+  become: true
+#
+# - name: Enable unattended-upgrades
+#   ansible.builtin.copy:
+#     dest: /etc/apt/apt.conf.d/20auto-upgrades
+#     content: |
+#       APT::Periodic::Update-Package-Lists "1";
+#       APT::Periodic::Unattended-Upgrade "1";
+#     mode: "0644"
+#   when: ansible_facts['os_family'] == "Debian"
+
+## SCHEDULE REBOOTS 4 kernel upgrades: with cron, unattended-upgrades or action workflows?

roles/docker/tasks/main.yml

@@ -0,0 +1,35 @@
+---
+- name: Install necessary Docker packages
+  ansible.builtin.apt:
+    name:
+      - docker.io
+      - docker-compose
+    state: present
+  when: ansible_facts['os_family'] == "Debian" ## Debian / Ubuntu
+  become: true
+
+- name: Ensure Docker service is running
+  ansible.builtin.service:
+    name: docker
+    state: started
+    enabled: true
+
+- name: Create docker user for container execution
+  ansible.builtin.user:
+    name: docker
+    state: present
+    system: true
+    shell: /usr/sbin/nologin
+    groups: docker
+    append: true
+    create_home: false
+  become: true
+
+- name: Create target for docker compose
+  ansible.builtin.file:
+    path: /opt/docker
+    state: directory
+    owner: deployment
+    group: deployment
+    mode: "0755"
+  become: true

roles/security/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart sshd
+  ansible.builtin.service:
+    name: sshd
+    state: restarted

roles/security/tasks/main.yml

@@ -0,0 +1,35 @@
+---
+- name: Create SSH drop-in directory
+  ansible.builtin.file:
+    path: /etc/ssh/sshd_config.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+
+- name: Harden SSH configuration with drop-in template
+  ansible.builtin.template:
+    src: sshd.conf.j2
+    dest: /etc/ssh/sshd_config.d/sshd.conf
+    owner: root
+    group: root
+    mode: "0644"
+    validate: "sshd -t -f %s"
+  notify: Restart sshd
+  become: true
+
+- name: Install fail2ban
+  ansible.builtin.apt:
+    name:
+      - fail2ban
+    state: present
+  when: ansible_facts['os_family'] == "Debian"
+  become: true
+
+- name: Start fail2ban
+  ansible.builtin.service:
+    name: fail2ban
+    state: started
+    enabled: yes
+  when: ansible_facts['os_family'] == "Debian"

roles/security/templates/sshd.conf.j2

@@ -0,0 +1,5 @@
+## Disable root login
+PermitRootLogin no
+
+## Disable password authentication
+PasswordAuthentication no

roles/users/tasks/main.yml

@@ -0,0 +1,38 @@
+---
+# - name: Create primary admin user
+#   ansible.builtin.user:
+#     name: sysadmin
+#     groups: sudo
+#     append: yes
+#     shell: /bin/bash
+#     create_home: yes
+#   become: true
+
+# - name: Add SSH public key for sysadmin
+#   ansible.posix.authorized_key:
+#     user: sysadmin
+#     state: present
+#     key: "{{ sysadmin_public_ssh_key }}"
+#   become: true
+
+# - name: Allow passwordless sudo to sysadmin user
+#   ansible.builtin.copy:
+#     dest: /etc/sudoers.d/sysadmin
+#     content: "sysadmin ALL=(ALL) NOPASSWD: ALL"
+#     mode: "0440"
+#     validate: /usr/sbin/visudo -cf %s
+#   become: true
+
+- name: Create deployment user for CI/CD
+  ansible.builtin.user:
+    name: deployment
+    shell: /bin/bash
+    create_home: yes
+  become: true
+
+- name: Add SSH public key for deployment user
+  ansible.posix.authorized_key:
+    user: deployment
+    state: present
+    key: "{{ deployment_public_ssh_key }}"
+  become: true