platform/platform-infra/ansible/roles/docker/handlers/main.yml at 7b15fa9bcaccdf03df279cc7f47c20d6cf401023 - bart/platform - Forgejo: Beyond coding. We Forge.

bart/platform

Bart Van Geyt d715244b76 Phase 1: Ansible host baseline for Ubuntu VM

Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a
dedicated second disk. Role-based platform-infra/ansible:

- base: apt packages, timezone, unattended security upgrades.
- zfs: install ZFS, create pool on a dedicated disk (guarded against
  wiping a non-empty disk), create platform datasets + customers parent
  per docs/03; docker dataset mounted at /var/lib/docker.
- docker: Docker Engine + Compose plugin, daemon.json written before first
  start so the native zfs storage driver initializes on the ZFS data-root;
  per-site network address pool preconfigured.
- firewall: nftables inbound default-deny in a dedicated table that never
  flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER
  jump applied by a systemd oneshot.
- ssh_hardening: key-first SSH with an anti-lockout assertion, config
  validation gate, and the sftponly group for Phase 4 SFTP accounts.

Includes ansible.cfg, requirements.yml, inventory example, group_vars with
safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-07 12:45:42 +02:00

5 lines

92 B

YAML

Raw Blame History

 ---
 - name: Restart docker
   ansible.builtin.systemd:
     name: docker
     state: restarted