Add common roles from polyfloyd's playbookds

roles/common/tasks/main.yaml

@@ -0,0 +1,116 @@
+---
+- tags: debian_backports
+  import_tasks: debian-backports.yaml
+
+- tags: unattended_updates
+  import_tasks: unattended-updates.yaml
+
+- tags: network
+  import_tasks: network.yaml
+
+- tags: node-exporter
+  import_tasks: node-exporter.yaml
+
+- name: Install utilities
+  apt:
+    name:
+      - curl
+      - fzf
+      - git
+      - htop
+      - iptables
+      - iptables-persistent
+      - jq
+      - net-tools
+      - ripgrep
+      - rsync
+      - tree
+      - vim
+
+- name: Configure FZF for Bash
+  lineinfile:
+    path: /etc/bash.bashrc
+    insertafter: EOF
+    regexp: "^source /usr/share/doc/fzf/{{ item }}"
+    line: "source /usr/share/doc/fzf/examples/{{ item }} # Managed by Ansible"
+  with_items:
+    - key-bindings.bash
+    - completion.bash
+
+- name: Shorten Grub timeout
+  lineinfile:
+    path: /etc/default/grub
+    regexp: '^GRUB_TIMEOUT='
+    line: "GRUB_TIMEOUT=1 # Managed by Ansible"
+  notify: update grub
+
+- name: Configure cron email
+  lineinfile:
+    path: /etc/crontab
+    insertafter: '^PATH'
+    line: 'MAILTO={{ notify_email }}'
+
+- name: Turn off SSH password auth
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^#?PasswordAuthentication'
+    line: 'PasswordAuthentication no'
+  notify: reload sshd
+
+- name: Configure SSH port
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^#?Port'
+    line: 'Port {{ ssh_port }}'
+  notify: reload sshd
+
+- name: Allow SSH
+  iptables:
+    chain: INPUT
+    protocol: tcp
+    destination_port: "{{ ssh_port }}"
+    ctstate: NEW
+    jump: ACCEPT
+    ip_version: "{{ item }}"
+  with_items:
+    - ipv4
+    - ipv6
+  notify: persist iptables
+
+- name: Allow IPv6 ICMP
+  iptables:
+    chain: INPUT
+    protocol: ipv6-icmp
+    jump: ACCEPT
+    ip_version: ipv6
+  notify: persist iptables
+
+- name: Allow related and established connections
+  iptables:
+    chain: INPUT
+    ctstate: ESTABLISHED,RELATED
+    jump: ACCEPT
+    ip_version: "{{ item }}"
+  with_items:
+    - ipv4
+    - ipv6
+  notify: persist iptables
+
+- name: Allow local connections
+  iptables:
+    chain: INPUT
+    source: "{{ item.cidr }}"
+    jump: ACCEPT
+    ip_version: "{{ item.v }}"
+  with_items: "{{ trusted_ranges }}"
+  notify: persist iptables
+
+- name: Deny inbound connections
+  iptables:
+    chain: INPUT
+    policy: DROP
+    ip_version: "{{ item }}"
+  with_items:
+    - ipv4
+    - ipv6
+  notify: persist iptables