124 lines
3.4 KiB
YAML
124 lines
3.4 KiB
YAML
---
|
|
# Post-install bootstrap - replaces infra/scripts/bootstrap.sh.tftpl. Runs as
|
|
# root (see ansible_user override in playbooks/bootstrap.yml) since the deploy
|
|
# user doesn't exist yet on a freshly created server. Idempotent: safe to
|
|
# re-run against an already-bootstrapped host.
|
|
|
|
- name: Update apt cache and upgrade packages
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
upgrade: dist
|
|
cache_valid_time: 3600
|
|
|
|
- name: Install Docker prerequisites
|
|
ansible.builtin.apt:
|
|
name:
|
|
- ca-certificates
|
|
- curl
|
|
- gnupg
|
|
state: present
|
|
|
|
- name: Create apt keyrings directory
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Download Docker's GPG key
|
|
ansible.builtin.get_url:
|
|
url: https://download.docker.com/linux/ubuntu/gpg
|
|
dest: /etc/apt/keyrings/docker.asc
|
|
mode: "0644"
|
|
force: false
|
|
|
|
- name: Determine dpkg architecture
|
|
ansible.builtin.command: dpkg --print-architecture
|
|
register: _dpkg_arch
|
|
changed_when: false
|
|
|
|
- name: Add Docker apt repository
|
|
ansible.builtin.apt_repository:
|
|
repo: >-
|
|
deb [arch={{ _dpkg_arch.stdout }} signed-by=/etc/apt/keyrings/docker.asc]
|
|
https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable
|
|
filename: docker
|
|
state: present
|
|
|
|
- name: Install Docker Engine and Compose plugin
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
name:
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
- docker-compose-plugin
|
|
state: present
|
|
|
|
- name: Create non-root sudo user, given the same key root was provisioned with
|
|
ansible.builtin.user:
|
|
name: "{{ deploy_user }}"
|
|
shell: /bin/bash
|
|
groups: sudo,docker
|
|
append: true
|
|
create_home: true
|
|
|
|
- name: Ensure deploy user's .ssh directory exists
|
|
ansible.builtin.file:
|
|
path: "/home/{{ deploy_user }}/.ssh"
|
|
state: directory
|
|
owner: "{{ deploy_user }}"
|
|
group: "{{ deploy_user }}"
|
|
mode: "0700"
|
|
|
|
- name: Give deploy user the same authorized_keys as root
|
|
ansible.builtin.copy:
|
|
src: /root/.ssh/authorized_keys
|
|
dest: "/home/{{ deploy_user }}/.ssh/authorized_keys"
|
|
remote_src: true
|
|
owner: "{{ deploy_user }}"
|
|
group: "{{ deploy_user }}"
|
|
mode: "0600"
|
|
|
|
- name: Grant deploy user passwordless sudo
|
|
ansible.builtin.copy:
|
|
content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
|
|
dest: "/etc/sudoers.d/90-{{ deploy_user }}"
|
|
validate: "visudo -cf %s"
|
|
mode: "0440"
|
|
|
|
# Root keeps key-only login as a fallback rather than being fully locked out,
|
|
# in case deploy user setup above ever fails silently on a future image.
|
|
- name: Restrict root login to key-only
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PermitRootLogin"
|
|
line: "PermitRootLogin prohibit-password"
|
|
notify: Reload sshd
|
|
|
|
- name: Disable SSH password authentication
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PasswordAuthentication"
|
|
line: "PasswordAuthentication no"
|
|
notify: Reload sshd
|
|
|
|
- name: Install unattended-upgrades
|
|
ansible.builtin.apt:
|
|
name: unattended-upgrades
|
|
state: present
|
|
|
|
- name: Enable automatic security upgrades
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
mode: "0644"
|
|
|
|
- name: Enable and start unattended-upgrades
|
|
ansible.builtin.systemd:
|
|
name: unattended-upgrades
|
|
enabled: true
|
|
state: started
|