d715244b76
Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a dedicated second disk. Role-based platform-infra/ansible: - base: apt packages, timezone, unattended security upgrades. - zfs: install ZFS, create pool on a dedicated disk (guarded against wiping a non-empty disk), create platform datasets + customers parent per docs/03; docker dataset mounted at /var/lib/docker. - docker: Docker Engine + Compose plugin, daemon.json written before first start so the native zfs storage driver initializes on the ZFS data-root; per-site network address pool preconfigured. - firewall: nftables inbound default-deny in a dedicated table that never flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER jump applied by a systemd oneshot. - ssh_hardening: key-first SSH with an anti-lockout assertion, config validation gate, and the sftponly group for Phase 4 SFTP accounts. Includes ansible.cfg, requirements.yml, inventory example, group_vars with safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
36 lines
561 B
Text
36 lines
561 B
Text
# Secrets — never commit plaintext. Use SOPS/age (*.enc.yaml is allowed).
|
|
*.env
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
secrets/
|
|
*.key
|
|
*.pem
|
|
!*.pub
|
|
|
|
# SOPS-encrypted files ARE allowed to be committed:
|
|
!*.enc.*
|
|
!*.sops.*
|
|
|
|
# Rendered runtime state that should not be tracked
|
|
deployments/**/.state/
|
|
deployments/**/data/
|
|
|
|
# OS / editor cruft
|
|
.DS_Store
|
|
Thumbs.db
|
|
*.swp
|
|
.idea/
|
|
.vscode/
|
|
|
|
# Ansible
|
|
*.retry
|
|
platform-infra/ansible/inventory/hosts.yml
|
|
platform-infra/ansible/.ansible/
|
|
platform-infra/ansible/collections/
|
|
|
|
# Python (control-panel CLI)
|
|
__pycache__/
|
|
*.pyc
|
|
.venv/
|
|
venv/
|