d715244b76
Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a dedicated second disk. Role-based platform-infra/ansible: - base: apt packages, timezone, unattended security upgrades. - zfs: install ZFS, create pool on a dedicated disk (guarded against wiping a non-empty disk), create platform datasets + customers parent per docs/03; docker dataset mounted at /var/lib/docker. - docker: Docker Engine + Compose plugin, daemon.json written before first start so the native zfs storage driver initializes on the ZFS data-root; per-site network address pool preconfigured. - firewall: nftables inbound default-deny in a dedicated table that never flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER jump applied by a systemd oneshot. - ssh_hardening: key-first SSH with an anti-lockout assertion, config validation gate, and the sftponly group for Phase 4 SFTP accounts. Includes ansible.cfg, requirements.yml, inventory example, group_vars with safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
802 B
Markdown
21 lines
802 B
Markdown
# platform-infra
|
|
|
|
Host baseline and platform services as code.
|
|
|
|
## `ansible/` — Phase 1 host baseline ✅
|
|
|
|
Idempotent Ubuntu 24.04 host config. See
|
|
[ansible/README.md](ansible/README.md) for how to run it.
|
|
|
|
Roles: `base` (packages, timezone, unattended-upgrades) → `zfs` (pool on a
|
|
dedicated disk + platform datasets) → `docker` (Engine + Compose, data-root on
|
|
ZFS, zfs storage driver) → `firewall` (nftables inbound + container SMTP egress
|
|
block) → `ssh_hardening` (key-first SSH, `sftponly` group).
|
|
|
|
## Planned (later phases)
|
|
|
|
- **Phase 2 base compose projects:** Traefik, shared MariaDB, Forgejo + registry,
|
|
Prometheus/Grafana/Loki, Uptime-Kuma.
|
|
- **Phase 5 Ansible:** automysqlbackup, ZFS snapshot/`send` jobs.
|
|
|
|
See [../docs/07-repo-layout-gitops.md](../docs/07-repo-layout-gitops.md).
|