fix: directory traversal permission

README.md

@@ -1,3 +1,5 @@
-Opinionated set of roles to configure reasonable defaults for newly provisioned virtual machines. The repository provides a ready-to-use Ansible Collection (`studiovitali.ansible`) containing reusable roles.
+# Ansible Collection
+
+Opinionated set of roles to configure reasonable defaults for newly provisioned virtual machines. The repository provides a ready-to-use Ansible Collection (`studio.ansible`) containing reusable roles.
 
 Currently only supports Debian-based systems.

galaxy.yml

@@ -1,9 +1,9 @@
 ## galaxy.yml
 
-namespace: studiovitali
+namespace: studio
 name: ansible
 readme: README.md
-version: 0.1.1
+version: 0.0.1
 authors:
   - Studio Vitali
 description: Studio Ansible collection containing common roles

roles/base/defaults/main.yml

@@ -9,6 +9,6 @@ base_packages:
   - rsync
   - unzip
   - unattended-upgrades
-  # - acl ## needed for ansible to become unprivileged user
+  # - acl ## needed for Ansible to become unprivileged user
   # - python3-pip
   # - wget

roles/base/handlers/main.yml

@@ -1,13 +0,0 @@
----
-- name: Reboot system
-  block:
-    - name: Check if reboot is required
-      ansible.builtin.stat:
-        path: /var/run/reboot-required
-      register: reboot_required_file
-
-    - name: Reboot host if necessary
-      become: true
-      ansible.builtin.reboot:
-        post_reboot_delay: 10
-      when: reboot_required_file.stat.exists

roles/base/tasks/main.yml

@@ -1,20 +1,18 @@
 ---
 - name: Set system timezone
-  become: true
   community.general.timezone:
     # name: "{{ base_timezone }}"
     name: Europe/Zurich
+  become: true
 
 - name: Fully upgrade system
-  become: true
   ansible.builtin.apt:
     update_cache: true
     upgrade: dist
     cache_valid_time: 3600
-  notify: Reboot system
+  become: true
 
 - name: Install essential system utilities
-  become: true
   ansible.builtin.apt:
     # name: "{{ base_packages }}"
     name:
@@ -27,7 +25,8 @@
       - unattended-upgrades
     state: present
     update_cache: true
-
+  become: true
+#
 # - name: Enable unattended-upgrades
 #   ansible.builtin.copy:
 #     dest: /etc/apt/apt.conf.d/20auto-upgrades

roles/coolify/defaults/main.yml

@@ -0,0 +1,16 @@
+---
+coolify_installer_url: "https://cdn.coollabs.io/coolify/install.sh"
+coolify_installer_dest: "/tmp/coolify-install.sh"
+coolify_data_dir: "/data/coolify"
+coolify_compose_file: "{{ coolify_data_dir }}/source/docker-compose.yml"
+
+## Pin to a release or leave empty for latest
+coolify_version: ""
+
+## Set to false to manage upgrades manually
+coolify_autoupdate: true
+
+## All 3 needed for sucessful user creation
+coolify_root_username: ""
+coolify_root_user_email: ""
+coolify_root_user_password: ""

roles/coolify/tasks/main.yml

@@ -0,0 +1,30 @@
+---
+- name: Check if Coolify is already installed
+  become: true
+  ansible.builtin.stat:
+    path: "{{ coolify_compose_file }}"
+  register: coolify_installed
+
+- name: Download Coolify installer
+  ansible.builtin.get_url:
+    url: "{{ coolify_installer_url }}"
+    dest: "{{ coolify_installer_dest }}"
+    mode: "0755"
+  when: not coolify_installed.stat.exists
+
+- name: Run Coolify installer
+  become: true
+  ansible.builtin.command:
+    argv:
+      - "{{ coolify_installer_dest }}"
+      - "{{ coolify_version }}"
+  environment:
+    AUTOUPDATE: "{{ coolify_autoupdate | bool | ternary('true', 'false') }}"
+    ROOT_USERNAME: "{{ coolify_root_username }}"
+    ROOT_USER_EMAIL: "{{ coolify_root_user_email }}"
+    ROOT_USER_PASSWORD: "{{ coolify_root_user_password }}"
+  when: not coolify_installed.stat.exists
+  changed_when: true
+  async: 1800
+  poll: 15
+  no_log: true

roles/security/handlers/main.yml

@@ -1,6 +1,5 @@
 ---
 - name: Restart sshd
-  become: true
   ansible.builtin.service:
     name: ssh
     state: restarted

roles/security/tasks/main.yml

@@ -17,7 +17,6 @@
         owner: root
         group: root
         mode: "0644"
-        validate: /usr/sbin/sshd -t -f %s
       notify: Restart sshd
 
 - name: Enable fail2ban
@@ -33,4 +32,4 @@
       ansible.builtin.service:
         name: fail2ban
         state: started
-        enabled: true
+        enabled: yes