90 lines
2.4 KiB
YAML
90 lines
2.4 KiB
YAML
---
|
|
# Post-install bootstrap - Idempotent: safe to
|
|
# re-run against an already-bootstrapped host.
|
|
|
|
- name: Update apt cache and upgrade packages
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
upgrade: dist
|
|
cache_valid_time: 3600
|
|
|
|
- name: Install Docker Engine and the Compose plugin
|
|
ansible.builtin.apt:
|
|
name:
|
|
- docker.io
|
|
- docker-compose-v2
|
|
state: present
|
|
|
|
- name: Ensure Docker is enabled and running
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Create non-root sudo user, given the same key root was provisioned with
|
|
ansible.builtin.user:
|
|
name: "{{ deploy_user }}"
|
|
shell: /bin/bash
|
|
groups: sudo,docker
|
|
append: true
|
|
create_home: true
|
|
|
|
- name: Ensure deploy user's .ssh directory exists
|
|
ansible.builtin.file:
|
|
path: "/home/{{ deploy_user }}/.ssh"
|
|
state: directory
|
|
owner: "{{ deploy_user }}"
|
|
group: "{{ deploy_user }}"
|
|
mode: "0700"
|
|
|
|
- name: Give deploy user the same authorized_keys as root
|
|
ansible.builtin.copy:
|
|
src: /root/.ssh/authorized_keys
|
|
dest: "/home/{{ deploy_user }}/.ssh/authorized_keys"
|
|
remote_src: true
|
|
owner: "{{ deploy_user }}"
|
|
group: "{{ deploy_user }}"
|
|
mode: "0600"
|
|
|
|
- name: Grant deploy user passwordless sudo
|
|
ansible.builtin.copy:
|
|
content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
|
|
dest: "/etc/sudoers.d/90-{{ deploy_user }}"
|
|
validate: "visudo -cf %s"
|
|
mode: "0440"
|
|
|
|
# Root keeps key-only login as a fallback rather than being fully locked out,
|
|
# in case deploy user setup above ever fails silently on a future image.
|
|
- name: Restrict root login to key-only
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PermitRootLogin"
|
|
line: "PermitRootLogin prohibit-password"
|
|
notify: Reload sshd
|
|
|
|
- name: Disable SSH password authentication
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PasswordAuthentication"
|
|
line: "PasswordAuthentication no"
|
|
notify: Reload sshd
|
|
|
|
- name: Install unattended-upgrades
|
|
ansible.builtin.apt:
|
|
name: unattended-upgrades
|
|
state: present
|
|
|
|
- name: Enable automatic security upgrades
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
mode: "0644"
|
|
|
|
- name: Enable and start unattended-upgrades
|
|
ansible.builtin.systemd:
|
|
name: unattended-upgrades
|
|
enabled: true
|
|
state: started
|