d715244b76
Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a dedicated second disk. Role-based platform-infra/ansible: - base: apt packages, timezone, unattended security upgrades. - zfs: install ZFS, create pool on a dedicated disk (guarded against wiping a non-empty disk), create platform datasets + customers parent per docs/03; docker dataset mounted at /var/lib/docker. - docker: Docker Engine + Compose plugin, daemon.json written before first start so the native zfs storage driver initializes on the ZFS data-root; per-site network address pool preconfigured. - firewall: nftables inbound default-deny in a dedicated table that never flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER jump applied by a systemd oneshot. - ssh_hardening: key-first SSH with an anti-lockout assertion, config validation gate, and the sftponly group for Phase 4 SFTP accounts. Includes ansible.cfg, requirements.yml, inventory example, group_vars with safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ansible | ||
| README.md | ||
platform-infra
Host baseline and platform services as code.
ansible/ — Phase 1 host baseline ✅
Idempotent Ubuntu 24.04 host config. See ansible/README.md for how to run it.
Roles: base (packages, timezone, unattended-upgrades) → zfs (pool on a
dedicated disk + platform datasets) → docker (Engine + Compose, data-root on
ZFS, zfs storage driver) → firewall (nftables inbound + container SMTP egress
block) → ssh_hardening (key-first SSH, sftponly group).
Planned (later phases)
- Phase 2 base compose projects: Traefik, shared MariaDB, Forgejo + registry, Prometheus/Grafana/Loki, Uptime-Kuma.
- Phase 5 Ansible: automysqlbackup, ZFS snapshot/
sendjobs.