d715244b76
Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a dedicated second disk. Role-based platform-infra/ansible: - base: apt packages, timezone, unattended security upgrades. - zfs: install ZFS, create pool on a dedicated disk (guarded against wiping a non-empty disk), create platform datasets + customers parent per docs/03; docker dataset mounted at /var/lib/docker. - docker: Docker Engine + Compose plugin, daemon.json written before first start so the native zfs storage driver initializes on the ZFS data-root; per-site network address pool preconfigured. - firewall: nftables inbound default-deny in a dedicated table that never flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER jump applied by a systemd oneshot. - ssh_hardening: key-first SSH with an anti-lockout assertion, config validation gate, and the sftponly group for Phase 4 SFTP accounts. Includes ansible.cfg, requirements.yml, inventory example, group_vars with safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
652 B
Django/Jinja
21 lines
652 B
Django/Jinja
# heleos SSH hardening — managed by Ansible. Do not edit by hand.
|
|
|
|
PermitRootLogin prohibit-password
|
|
PubkeyAuthentication yes
|
|
PasswordAuthentication {{ 'no' if ssh_disable_password_auth else 'yes' }}
|
|
KbdInteractiveAuthentication no
|
|
X11Forwarding no
|
|
AllowAgentForwarding no
|
|
MaxAuthTries 4
|
|
LoginGraceTime 30
|
|
ClientAliveInterval 300
|
|
ClientAliveCountMax 2
|
|
|
|
# SFTP-only tenant accounts (created per customer in Phase 4). ChrootDirectory
|
|
# is set per user at provision time; this block enforces the shared restrictions.
|
|
Match Group sftponly
|
|
ForceCommand internal-sftp
|
|
AllowTcpForwarding no
|
|
X11Forwarding no
|
|
PermitTunnel no
|
|
PermitTTY no
|