152 lines
3.4 KiB
YAML
152 lines
3.4 KiB
YAML
---
|
|
- tags: [ debian-upgrade, never ]
|
|
ansible.builtin.import_tasks:
|
|
file: debian-upgrade.yaml
|
|
when: ansible_facts['distribution_release'] != "bookworm"
|
|
|
|
- tags: debian_backports
|
|
ansible.builtin.import_tasks:
|
|
file: debian-backports.yaml
|
|
|
|
- tags: unattended_updates
|
|
ansible.builtin.import_tasks:
|
|
file: unattended-updates.yaml
|
|
|
|
- tags: apt-minimal
|
|
ansible.builtin.import_tasks:
|
|
file: apt-minimal.yaml
|
|
|
|
- tags: network
|
|
ansible.builtin.import_tasks:
|
|
file: network.yaml
|
|
|
|
- tags: node-exporter
|
|
ansible.builtin.import_tasks:
|
|
file: node-exporter.yaml
|
|
|
|
- tags: vm
|
|
ansible.builtin.import_tasks:
|
|
file: node-exporter.yaml
|
|
when: is_vm
|
|
|
|
- name: Remove Vim
|
|
ansible.builtin.apt:
|
|
name: vim
|
|
state: absent
|
|
autoremove: true
|
|
|
|
- name: Install utilities
|
|
ansible.builtin.apt:
|
|
name:
|
|
- curl
|
|
- fzf
|
|
- git
|
|
- htop
|
|
- iptables
|
|
- iptables-persistent
|
|
- jq
|
|
- net-tools
|
|
- netcat-openbsd
|
|
- ripgrep
|
|
- rsync
|
|
- tree
|
|
- neovim
|
|
|
|
- name: Remove netcat-traditional
|
|
ansible.builtin.apt:
|
|
name: netcat-traditional
|
|
|
|
- name: Configure FZF for Bash
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/bash.bashrc
|
|
insertafter: EOF
|
|
regexp: "^source /usr/share/doc/fzf/examples/key-bindings.bash"
|
|
line: "source /usr/share/doc/fzf/examples/key-bindings.bash # Managed by Ansible"
|
|
|
|
- name: Configure FZF for Bash (Bookworm)
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/bash.bashrc
|
|
insertafter: EOF
|
|
regexp: "^source /usr/share/doc/fzf/examples/completion.bash"
|
|
state: absent
|
|
|
|
- name: Shorten Grub timeout
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/default/grub
|
|
regexp: '^GRUB_TIMEOUT='
|
|
line: "GRUB_TIMEOUT=1 # Managed by Ansible"
|
|
notify: update grub
|
|
|
|
- name: Configure cron email
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/crontab
|
|
insertafter: '^PATH'
|
|
line: 'MAILTO={{ notify_email }}'
|
|
|
|
- name: Configure SSH
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
with_items:
|
|
- regexp: '^#?Port'
|
|
line: 'Port {{ ssh_port }}'
|
|
- regexp: '^#?PasswordAuthentication'
|
|
line: 'PasswordAuthentication no'
|
|
- regexp: '^#?DebianBanner'
|
|
line: 'DebianBanner no'
|
|
notify: reload sshd
|
|
|
|
- name: Allow SSH
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
protocol: tcp
|
|
destination_port: "{{ ssh_port }}"
|
|
ctstate: NEW
|
|
jump: ACCEPT
|
|
ip_version: "{{ item }}"
|
|
with_items:
|
|
- ipv4
|
|
- ipv6
|
|
notify: persist iptables
|
|
|
|
- name: Allow ICMP
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
protocol: "{{ item.proto }}"
|
|
jump: ACCEPT
|
|
ip_version: "{{ item.ip }}"
|
|
with_items:
|
|
- { ip: ipv4, proto: icmp }
|
|
- { ip: ipv6, proto: ipv6-icmp }
|
|
notify: persist iptables
|
|
|
|
- name: Allow related and established connections
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
ctstate: ESTABLISHED,RELATED
|
|
jump: ACCEPT
|
|
ip_version: "{{ item }}"
|
|
with_items:
|
|
- ipv4
|
|
- ipv6
|
|
notify: persist iptables
|
|
|
|
- name: Allow local connections
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
source: "{{ item.cidr }}"
|
|
jump: ACCEPT
|
|
ip_version: "{{ item.v }}"
|
|
with_items: "{{ trusted_ranges }}"
|
|
notify: persist iptables
|
|
|
|
- name: Deny inbound connections
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
policy: DROP
|
|
ip_version: "{{ item }}"
|
|
with_items:
|
|
- ipv4
|
|
- ipv6
|
|
notify: persist iptables
|