96 lines
2.9 KiB
YAML
96 lines
2.9 KiB
YAML
---
|
|
# Post-install bootstrap - replaces infra/scripts/bootstrap.sh.tftpl. Runs as
|
|
# root (see ansible_user override in playbooks/bootstrap.yml) since the deploy
|
|
# user doesn't exist yet on a freshly created server. Idempotent: safe to
|
|
# re-run against an already-bootstrapped host.
|
|
|
|
- name: Update apt cache and upgrade packages
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
upgrade: dist
|
|
cache_valid_time: 3600
|
|
|
|
# Docker straight from Ubuntu's own repositories - no external apt repo, GPG
|
|
# key or architecture juggling. docker.io is the engine, docker-compose-v2 is
|
|
# the `docker compose` plugin. A little behind Docker's own channel, but far
|
|
# simpler and plenty for these hosts.
|
|
- name: Install Docker Engine and the Compose plugin
|
|
ansible.builtin.apt:
|
|
name:
|
|
- docker.io
|
|
- docker-compose-v2
|
|
state: present
|
|
|
|
- name: Ensure Docker is enabled and running
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Create non-root sudo user, given the same key root was provisioned with
|
|
ansible.builtin.user:
|
|
name: "{{ deploy_user }}"
|
|
shell: /bin/bash
|
|
groups: sudo,docker
|
|
append: true
|
|
create_home: true
|
|
|
|
- name: Ensure deploy user's .ssh directory exists
|
|
ansible.builtin.file:
|
|
path: "/home/{{ deploy_user }}/.ssh"
|
|
state: directory
|
|
owner: "{{ deploy_user }}"
|
|
group: "{{ deploy_user }}"
|
|
mode: "0700"
|
|
|
|
- name: Give deploy user the same authorized_keys as root
|
|
ansible.builtin.copy:
|
|
src: /root/.ssh/authorized_keys
|
|
dest: "/home/{{ deploy_user }}/.ssh/authorized_keys"
|
|
remote_src: true
|
|
owner: "{{ deploy_user }}"
|
|
group: "{{ deploy_user }}"
|
|
mode: "0600"
|
|
|
|
- name: Grant deploy user passwordless sudo
|
|
ansible.builtin.copy:
|
|
content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
|
|
dest: "/etc/sudoers.d/90-{{ deploy_user }}"
|
|
validate: "visudo -cf %s"
|
|
mode: "0440"
|
|
|
|
# Root keeps key-only login as a fallback rather than being fully locked out,
|
|
# in case deploy user setup above ever fails silently on a future image.
|
|
- name: Restrict root login to key-only
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PermitRootLogin"
|
|
line: "PermitRootLogin prohibit-password"
|
|
notify: Reload sshd
|
|
|
|
- name: Disable SSH password authentication
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PasswordAuthentication"
|
|
line: "PasswordAuthentication no"
|
|
notify: Reload sshd
|
|
|
|
- name: Install unattended-upgrades
|
|
ansible.builtin.apt:
|
|
name: unattended-upgrades
|
|
state: present
|
|
|
|
- name: Enable automatic security upgrades
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
mode: "0644"
|
|
|
|
- name: Enable and start unattended-upgrades
|
|
ansible.builtin.systemd:
|
|
name: unattended-upgrades
|
|
enabled: true
|
|
state: started
|