d715244b76
Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a dedicated second disk. Role-based platform-infra/ansible: - base: apt packages, timezone, unattended security upgrades. - zfs: install ZFS, create pool on a dedicated disk (guarded against wiping a non-empty disk), create platform datasets + customers parent per docs/03; docker dataset mounted at /var/lib/docker. - docker: Docker Engine + Compose plugin, daemon.json written before first start so the native zfs storage driver initializes on the ZFS data-root; per-site network address pool preconfigured. - firewall: nftables inbound default-deny in a dedicated table that never flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER jump applied by a systemd oneshot. - ssh_hardening: key-first SSH with an anti-lockout assertion, config validation gate, and the sftponly group for Phase 4 SFTP accounts. Includes ansible.cfg, requirements.yml, inventory example, group_vars with safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
36 lines
1.2 KiB
YAML
36 lines
1.2 KiB
YAML
---
|
|
- name: Guard against lock-out when disabling password auth
|
|
ansible.builtin.assert:
|
|
that:
|
|
- not ssh_disable_password_auth or (admin_authorized_keys | length > 0)
|
|
fail_msg: >-
|
|
ssh_disable_password_auth is true but admin_authorized_keys is empty.
|
|
Add the admin's public key(s) first, or you will lock yourself out.
|
|
|
|
- name: Install admin authorized keys
|
|
ansible.posix.authorized_key:
|
|
user: "{{ admin_user }}"
|
|
key: "{{ item }}"
|
|
state: present
|
|
loop: "{{ admin_authorized_keys }}"
|
|
when: admin_authorized_keys | length > 0
|
|
|
|
- name: Create sftponly group (per-customer SFTP users join this in Phase 4)
|
|
ansible.builtin.group:
|
|
name: sftponly
|
|
state: present
|
|
|
|
- name: Deploy SSH hardening drop-in
|
|
ansible.builtin.template:
|
|
src: 10-heleos-hardening.conf.j2
|
|
dest: /etc/ssh/sshd_config.d/10-heleos-hardening.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart ssh
|
|
|
|
- name: Validate the effective sshd configuration
|
|
ansible.builtin.command: /usr/sbin/sshd -t
|
|
changed_when: false
|
|
# Runs after the template task; if the config is invalid the play fails here
|
|
# and the Restart ssh handler never fires, leaving the running sshd untouched.
|