platform/platform-infra/ansible/ansible.cfg at 21ff7026a09579e0dcde7f8bc5d54d8f24481d7b - bart/platform - Forgejo: Beyond coding. We Forge.

bart/platform

Bart Van Geyt d715244b76 Phase 1: Ansible host baseline for Ubuntu VM

Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a
dedicated second disk. Role-based platform-infra/ansible:

- base: apt packages, timezone, unattended security upgrades.
- zfs: install ZFS, create pool on a dedicated disk (guarded against
  wiping a non-empty disk), create platform datasets + customers parent
  per docs/03; docker dataset mounted at /var/lib/docker.
- docker: Docker Engine + Compose plugin, daemon.json written before first
  start so the native zfs storage driver initializes on the ZFS data-root;
  per-site network address pool preconfigured.
- firewall: nftables inbound default-deny in a dedicated table that never
  flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER
  jump applied by a systemd oneshot.
- ssh_hardening: key-first SSH with an anti-lockout assertion, config
  validation gate, and the sftponly group for Phase 4 SFTP accounts.

Includes ansible.cfg, requirements.yml, inventory example, group_vars with
safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-07 12:45:42 +02:00

12 lines

272 B

INI

Raw Blame History

 [defaults]
 inventory = inventory/hosts.yml
 roles_path = roles
 host_key_checking = True
 retry_files_enabled = False
 stdout_callback = yaml
 interpreter_python = auto_silent
 collections_path = ./.ansible/collections
 [privilege_escalation]
 become = True
 become_method = sudo