d715244b76
Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a dedicated second disk. Role-based platform-infra/ansible: - base: apt packages, timezone, unattended security upgrades. - zfs: install ZFS, create pool on a dedicated disk (guarded against wiping a non-empty disk), create platform datasets + customers parent per docs/03; docker dataset mounted at /var/lib/docker. - docker: Docker Engine + Compose plugin, daemon.json written before first start so the native zfs storage driver initializes on the ZFS data-root; per-site network address pool preconfigured. - firewall: nftables inbound default-deny in a dedicated table that never flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER jump applied by a systemd oneshot. - ssh_hardening: key-first SSH with an anti-lockout assertion, config validation gate, and the sftponly group for Phase 4 SFTP accounts. Includes ansible.cfg, requirements.yml, inventory example, group_vars with safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
62 lines
1.8 KiB
YAML
62 lines
1.8 KiB
YAML
---
|
|
- name: Create Docker apt keyring dir
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Add Docker's official GPG key
|
|
ansible.builtin.get_url:
|
|
url: https://download.docker.com/linux/ubuntu/gpg
|
|
dest: /etc/apt/keyrings/docker.asc
|
|
mode: "0644"
|
|
|
|
- name: Add Docker apt repository
|
|
ansible.builtin.apt_repository:
|
|
repo: >-
|
|
deb [arch={{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}
|
|
signed-by=/etc/apt/keyrings/docker.asc]
|
|
https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable
|
|
filename: docker
|
|
state: present
|
|
|
|
- name: Ensure the ZFS docker dataset is mounted at the data-root
|
|
ansible.builtin.command: "zfs get -H -o value mounted {{ zfs_pool_name }}/platform/docker"
|
|
register: docker_ds_mounted
|
|
changed_when: false
|
|
failed_when: docker_ds_mounted.stdout != "yes"
|
|
# The zfs role creates tank/platform/docker with mountpoint=/var/lib/docker.
|
|
# This guards against installing Docker onto the wrong (non-ZFS) filesystem.
|
|
|
|
- name: Ensure /etc/docker exists
|
|
ansible.builtin.file:
|
|
path: /etc/docker
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Write Docker daemon configuration (before first start, so the zfs
|
|
storage driver initializes on the empty ZFS data-root)
|
|
ansible.builtin.template:
|
|
src: daemon.json.j2
|
|
dest: /etc/docker/daemon.json
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart docker
|
|
|
|
- name: Install Docker Engine + Compose plugin
|
|
ansible.builtin.apt:
|
|
name:
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
- docker-compose-plugin
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Ensure Docker is enabled and running
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
enabled: true
|
|
state: started
|