135 lines
3.3 KiB
YAML
135 lines
3.3 KiB
YAML
- name: Initial server setup
|
|
tags: [setup]
|
|
block:
|
|
- name: Create default user
|
|
user:
|
|
name: "{{ default_user }}"
|
|
password: "{{ default_user_password | password_hash('sha512') }}"
|
|
groups: sudo
|
|
create_home: yes
|
|
shell: /bin/zsh
|
|
generate_ssh_key: yes
|
|
ssh_key_bits: 2048
|
|
ssh_key_file: .ssh/id_rsa
|
|
update_password: always
|
|
state: present
|
|
|
|
- name: Ensure sudo group has passwordless sudo privileges
|
|
lineinfile:
|
|
dest: /etc/sudoers
|
|
state: present
|
|
regexp: "^%sudo"
|
|
line: "%sudo ALL=(ALL) NOPASSWD:ALL"
|
|
validate: "/usr/sbin/visudo -cf %s"
|
|
|
|
- name: Upgrade apt packages
|
|
apt:
|
|
update_cache: yes
|
|
upgrade: full
|
|
|
|
- name: Install apt packages
|
|
apt:
|
|
name: "{{ packages_to_install }}"
|
|
|
|
- name: Add Debian backports
|
|
include_role:
|
|
name: jnv.debian-backports
|
|
|
|
- name: Add unattended-upgrades
|
|
include_role:
|
|
name: jnv.unattended-upgrades
|
|
|
|
- name: Install mozilla/sops
|
|
get_url:
|
|
url: https://github.com/mozilla/sops/releases/download/v3.5.0/sops-v3.5.0.linux
|
|
dest: /usr/bin/sops
|
|
mode: "0755"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Enable dm_crypt module
|
|
modprobe:
|
|
name: dm_crypt
|
|
state: present
|
|
|
|
- name: Enable compress on logrotate
|
|
lineinfile:
|
|
dest: /etc/logrotate.conf
|
|
regexp: "^#?compress"
|
|
line: "compress"
|
|
state: present
|
|
|
|
- name: Configure timezone
|
|
timezone:
|
|
name: "{{ timezone }}"
|
|
|
|
- name: Configure ntp client and restart it
|
|
template:
|
|
src: ntp.conf.j2
|
|
dest: /etc/ntp.conf
|
|
notify:
|
|
- restart ntp
|
|
- restart cron
|
|
|
|
# - name: Set up exim4 conf
|
|
# template:
|
|
# src: update-exim4.conf.conf.j2
|
|
# dest: /etc/exim4/update-exim4.conf.conf
|
|
# owner: root
|
|
# group: root
|
|
# mode: 0644
|
|
|
|
# - name: Set up exim4 password file
|
|
# template:
|
|
# src: passwd.client.j2
|
|
# dest: /etc/exim4/passwd.client
|
|
# owner: root
|
|
# group: Debian-exim
|
|
# mode: 0640
|
|
|
|
# - name: Set up exim4 localmacros
|
|
# copy:
|
|
# src: exim4.conf.localmacros
|
|
# dest: /etc/exim4/exim4.conf.localmacros
|
|
# owner: root
|
|
# group: root
|
|
# mode: 0644
|
|
# notify: restart exim4
|
|
|
|
# - name: Set up FROM addresses
|
|
# template:
|
|
# src: email-addresses.j2
|
|
# dest: /etc/email-addresses
|
|
# owner: root
|
|
# group: root
|
|
# mode: 0644
|
|
# notify: restart exim4
|
|
|
|
- name: Make fail2ban work with ufw
|
|
lineinfile:
|
|
dest: "{{ item }}"
|
|
regexp: "^banaction"
|
|
line: "banaction = ufw"
|
|
state: present
|
|
with_items:
|
|
- /etc/fail2ban/jail.conf
|
|
- /etc/fail2ban/jail.local
|
|
notify:
|
|
- restart fail2ban
|
|
|
|
- name: Add neofetch to motd
|
|
copy:
|
|
src: 11-neofetch
|
|
dest: /etc/update-motd.d/11-neofetch
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
|
|
- name: Remove default motd messages
|
|
file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
with_items:
|
|
- /etc/update-motd.d/00-header
|
|
- /etc/update-motd.d/10-help-text
|