99 lines
3.6 KiB
YAML
99 lines
3.6 KiB
YAML
# @NOTE run 'ansible-playbook' command on this using 'sudo'
|
|
- name: Initialize VPS
|
|
hosts: "{{ chosen_host | default('staging0.test') }}"
|
|
remote_user: "{{ chosen_user | default('root') }}"
|
|
vars:
|
|
harden: true
|
|
vars_files:
|
|
- vars/local_facts.yml # REQUIRED
|
|
- vars/vpn_settings.yml # REQUIRED
|
|
- vars/wireguard_settings.yml # REQUIRED
|
|
- vars/headscale_settings.yml # REQUIRED
|
|
- vars/podpose_settings.yml # REQUIRED
|
|
- vars/certbot_settings@vps.yml # REQUIRED
|
|
- vars/users@{{ inventory_hostname | default('vps') }}.yml
|
|
- vars/config@{{ inventory_hostname | default('vps') }}.yml
|
|
tasks:
|
|
- name: Hardening SSH server
|
|
ansible.builtin.include_role:
|
|
name: init-server # required. The name of the role to be executed.
|
|
# apply: # not required. Accepts a hash of task keywords (e.g. C(tags), C(become)) that will be applied to all tasks within the included role.
|
|
tasks_from: harden # not required. File to load from a role's C(tasks/) directory.
|
|
# vars_from: main # not required. File to load from a role's C(vars/) directory.
|
|
# defaults_from: main # not required. File to load from a role's C(defaults/) directory.
|
|
# allow_duplicates: True # not required. Overrides the role's metadata setting to allow using a role more than once with the same parameters.
|
|
# handlers_from: main # not required. File to load from a role's C(handlers/) directory.
|
|
- name: Installing requisite packages
|
|
ansible.builtin.include_role:
|
|
name: init-server
|
|
tasks_from: core@install-pkgs
|
|
handlers_from: core
|
|
- name: Initializing groups and users
|
|
ansible.builtin.include_role:
|
|
name: init-server
|
|
tasks_from: ssh-users
|
|
- name: Flushing handlers
|
|
ansible.builtin.meta: flush_handlers
|
|
- name: Updating hostname
|
|
become: true
|
|
ansible.builtin.hostname:
|
|
name: "{{ fqdn | default(inventory_hostname) }}"
|
|
- name: Updating hosts file
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/hosts
|
|
regexp: "^127\\.0\\.1\\.1"
|
|
line: "127.0.1.1 {{ fqdn | default(inventory_hostname) }}"
|
|
insertbefore: BOF
|
|
state: present
|
|
- name: Updating host icon name
|
|
become: true
|
|
ansible.builtin.command:
|
|
cmd: "hostnamectl set-icon-name computer-server"
|
|
- name: Opening port 51820
|
|
become: true
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
protocol: "{{ item }}"
|
|
destination_port: 51820
|
|
jump: ACCEPT
|
|
comment: Open up port 51820
|
|
loop:
|
|
- udp
|
|
- tcp
|
|
- name: Opening port 443
|
|
become: true
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
protocol: "{{ item }}"
|
|
destination_port: 443
|
|
jump: ACCEPT
|
|
comment: Open up port 443
|
|
loop:
|
|
- udp
|
|
- tcp
|
|
- name: Opening ports
|
|
become: true
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
protocol: tcp
|
|
destination_port: "{{ item }}"
|
|
jump: ACCEPT
|
|
comment: "Open up port {{ (item | string) }}"
|
|
loop:
|
|
- 80
|
|
- 465
|
|
- 587
|
|
- 995
|
|
- 993
|
|
- name: Notifying user that all processes have finished
|
|
ansible.builtin.debug:
|
|
msg: All processes finished. Hit enter to reboot machine.
|
|
- name: Ensuring user has read prior message regarding upcoming reboot
|
|
ansible.builtin.pause:
|
|
- name: Rebooting machine for hostname change
|
|
become: true
|
|
ansible.builtin.reboot:
|
|
msg: "Rebooting machine.."
|
|
connect_timeout: 0
|
|
test_command: ~ |