d715244b76
Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a dedicated second disk. Role-based platform-infra/ansible: - base: apt packages, timezone, unattended security upgrades. - zfs: install ZFS, create pool on a dedicated disk (guarded against wiping a non-empty disk), create platform datasets + customers parent per docs/03; docker dataset mounted at /var/lib/docker. - docker: Docker Engine + Compose plugin, daemon.json written before first start so the native zfs storage driver initializes on the ZFS data-root; per-site network address pool preconfigured. - firewall: nftables inbound default-deny in a dedicated table that never flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER jump applied by a systemd oneshot. - ssh_hardening: key-first SSH with an anti-lockout assertion, config validation gate, and the sftponly group for Phase 4 SFTP accounts. Includes ansible.cfg, requirements.yml, inventory example, group_vars with safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
74 lines
2 KiB
YAML
74 lines
2 KiB
YAML
---
|
|
# Host inbound filtering lives in a DEDICATED nftables table (inet heleos) so it
|
|
# never flushes or clobbers the ip/ip6 filter+nat tables that Docker manages.
|
|
- name: Ensure nftables include dir exists
|
|
ansible.builtin.file:
|
|
path: /etc/nftables.d
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Install root nftables config (include-only, no global flush)
|
|
ansible.builtin.copy:
|
|
dest: /etc/nftables.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
content: |
|
|
#!/usr/sbin/nft -f
|
|
# Managed by heleos platform-infra. Include per-table files WITHOUT
|
|
# flushing the global ruleset, so Docker's own tables are left intact.
|
|
include "/etc/nftables.d/*.nft"
|
|
notify: Reload nftables
|
|
|
|
- name: Install heleos host input table
|
|
ansible.builtin.template:
|
|
src: heleos-input.nft.j2
|
|
dest: /etc/nftables.d/heleos-input.nft
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Reload nftables
|
|
|
|
- name: Enable and start nftables
|
|
ansible.builtin.systemd:
|
|
name: nftables
|
|
enabled: true
|
|
state: started
|
|
|
|
# --- Container egress SMTP filtering (via DOCKER-USER) -----------------------
|
|
- name: Install container egress filter script
|
|
ansible.builtin.template:
|
|
src: heleos-docker-egress.sh.j2
|
|
dest: /usr/local/sbin/heleos-docker-egress.sh
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
notify: Reapply docker egress rules
|
|
|
|
- name: Install container egress systemd unit
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/heleos-docker-egress.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
[Unit]
|
|
Description=heleos: block outbound SMTP from containers (DOCKER-USER)
|
|
After=docker.service
|
|
Requires=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/heleos-docker-egress.sh
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
notify: Reapply docker egress rules
|
|
|
|
- name: Enable container egress service
|
|
ansible.builtin.systemd:
|
|
name: heleos-docker-egress.service
|
|
enabled: true
|
|
daemon_reload: true
|
|
state: started
|