refactor: ceske nazvy playbooku a roli bez diakritiky
Playbooky (novy nazev -> co dela):
- priprav-novy-server.yml (kompletni setup noveho serveru)
- nasad-sluzby.yml (nasadi Docker sluzby z docker-services/)
- aktualizuj-sluzby.yml (docker compose pull && up -d)
- zabezpec-server.yml (sysctl, auditd, unattended-upgrades)
- bootstrap-server.yml SMAZAN (duplicitni s priprav-novy-server)
Role (novy nazev -> co dela):
- zaklad (update + base baliky + timezone)
- uzivatel-deploy (vytvori deploy usera UID 1000)
- ssh-klice (authorized_keys deployment)
- docker (Docker Engine + Compose plugin) - ponechan anglicky (IT konvence)
- adresare (/home/deploy/{docker,scripts,backups,logs,...})
- firewall SMAZAN (nepouziva se)
Reference v playbooku aktualizovany na nove nazvy roli.
README.md kompletne prepracovan v cestine pro zacatecniky - vysvetluje
co Ansible je, jak nainstalovat, jak vytvorit inventory, jak spustit
playbook, jak overit ze vse funguje.
This commit is contained in:
@@ -1,119 +1,255 @@
|
|||||||
# mates-ansible
|
# mates-ansible
|
||||||
|
|
||||||
Ansible role a playbooky pro přípravu nového serveru a nasazení home infrastruktury.
|
Ansible playbooky pro přípravu nového serveru a správu home infrastruktury.
|
||||||
|
|
||||||
## Playbooky
|
> **Jsi začátečník?** Čti od [Začínáme](#zaciname) – vše je tu vysvětleno krok za krokem.
|
||||||
|
|
||||||
| Playbook | Účel |
|
---
|
||||||
|
|
||||||
|
## 📚 Co je Ansible?
|
||||||
|
|
||||||
|
Ansible je nástroj, který **automatizuje konfiguraci serverů**. Místo toho, aby ses ručně přihlašoval přes SSH a psal 50 příkazů, napíšeš **jeden příkaz** a Ansible udělá všechno za tebe.
|
||||||
|
|
||||||
|
**Příklad:** Místo
|
||||||
|
```bash
|
||||||
|
ssh server "apt update && apt install -y docker docker-compose-plugin && usermod -aG docker deploy"
|
||||||
|
```
|
||||||
|
|
||||||
|
napíšeš
|
||||||
|
```bash
|
||||||
|
ansible-playbook -i inventory.yml playbooks/priprav-novy-server.yml
|
||||||
|
```
|
||||||
|
|
||||||
|
a Ansible to udělá **na všech serverech** najednou.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📦 Obsah repozitáře
|
||||||
|
|
||||||
|
### 🎯 Playbooky (hlavní úkoly)
|
||||||
|
|
||||||
|
| Playbook | Co dělá |
|
||||||
|---|---|
|
|---|---|
|
||||||
| `prepare-new-server.yml` | Kompletní příprava nového serveru (od nuly) |
|
| **`priprav-novy-server.yml`** | Kompletní příprava nového serveru od nuly (update + user + SSH + Docker + adresáře + fail2ban) |
|
||||||
| `deploy-services.yml` | Nasaď Docker služby z `mates-docker-services/` |
|
| **`nasad-sluzby.yml`** | Nasaď Docker služby z `mates-docker-services/` (Portainer, Vaultwarden, Gitea, …) |
|
||||||
| `update-services.yml` | Update všech služeb (`docker compose pull && up -d`) |
|
| **`aktualizuj-sluzby.yml`** | Aktualizuj všechny běžící služby (`docker compose pull && up -d`) |
|
||||||
| `security-hardening.yml` | Sysctl, auditd, auto-updates |
|
| **`zabezpec-server.yml`** | Bezpečnostní hardening (sysctl, auditd, automatické security updaty) |
|
||||||
|
|
||||||
## Quickstart pro nový server
|
### 🧩 Role (znovupoužitelné bloky)
|
||||||
|
|
||||||
### 1. Příprava inventory
|
| Role | Co dělá |
|
||||||
|
|---|---|
|
||||||
|
| `zaklad` | Základ: update systému, base balíky (btop, mc, tree, curl, …), timezone |
|
||||||
|
| `uzivatel-deploy` | Vytvoří uživatele `deploy` (UID 1000) s uzamknutým heslem |
|
||||||
|
| `ssh-klice` | Nasadí SSH klíč pro `deploy` (heslo = klíč, ne heslo) |
|
||||||
|
| `docker` | Docker Engine + Compose plugin + nastavení daemon.json |
|
||||||
|
| `adresare` | `/home/deploy/{docker,scripts,backups,logs,~/.local/bin}` + 14 složek pro služby |
|
||||||
|
|
||||||
|
### ⚙️ Konfigurace
|
||||||
|
|
||||||
|
| Soubor | Co obsahuje |
|
||||||
|
|---|---|
|
||||||
|
| `inventory.example.yml` | Ukázkový inventory – seznam serverů |
|
||||||
|
| `group_vars/all.yml.example` | Společné proměnné (SSH klíč, porty, balíky, …) |
|
||||||
|
| `ansible.cfg` | Konfigurace Ansible (cesty, SSH optimalizace, …) |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🚀 Začínáme
|
||||||
|
|
||||||
|
### Krok 1: Nainstaluj Ansible
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# macOS
|
||||||
|
brew install ansible
|
||||||
|
|
||||||
|
# Linux (apt)
|
||||||
|
sudo apt install -y ansible
|
||||||
|
```
|
||||||
|
|
||||||
|
### Krok 2: Naklonuj repo
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git clone http://<server-ip>:3000/mates/mates-ansible.git
|
||||||
|
cd mates-ansible
|
||||||
|
```
|
||||||
|
|
||||||
|
### Krok 3: Vytvoř inventory.yml
|
||||||
|
|
||||||
|
Zkopíruj ukázkový soubor a uprav:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cp inventory.example.yml inventory.yml
|
cp inventory.example.yml inventory.yml
|
||||||
nano inventory.yml # nastavit IP a SSH klíč
|
nano inventory.yml
|
||||||
```
|
```
|
||||||
|
|
||||||
### 2. Přidání svého SSH klíče
|
**Co v inventory nastavit:**
|
||||||
|
|
||||||
```bash
|
|
||||||
# Verejny klic z Macu
|
|
||||||
cat ~/.ssh/id_ed25519.pub
|
|
||||||
|
|
||||||
# Pridej do group_vars/all.yml:
|
|
||||||
deploy_ssh_public_keys:
|
|
||||||
- "ssh-ed25519 AAAAC3Nz... hermes@mac"
|
|
||||||
```
|
|
||||||
|
|
||||||
### 3. První připojení (s heslem)
|
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
# inventory.yml - pro prvni pripojeni (jeste pred SSH klicem)
|
all:
|
||||||
|
vars:
|
||||||
|
ansible_user: ubuntu # SSH user na novém serveru
|
||||||
|
ansible_become: true # potřebuje sudo (povinné)
|
||||||
|
ansible_ssh_pass: tvujHeslo # heslo pro první připojení (jen dočasně!)
|
||||||
|
|
||||||
|
children:
|
||||||
homeservers:
|
homeservers:
|
||||||
hosts:
|
hosts:
|
||||||
novy-server:
|
novy-server:
|
||||||
ansible_host: <server-ip>
|
ansible_host: 192.168.1.50 # IP nového serveru
|
||||||
ansible_user: ubuntu # nebo root
|
|
||||||
ansible_ssh_pass: heslo # POZOR: jen docasne
|
|
||||||
ansible_become_pass: heslo # POZOR: jen docasne
|
|
||||||
```
|
```
|
||||||
|
|
||||||
### 4. Spuštění playbooku
|
### Krok 4: Přidej svůj SSH klíč
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
|
# Na Macu – zobraz svuj verejny klic
|
||||||
|
cat ~/.ssh/id_ed25519.pub
|
||||||
|
# ssh-ed25519 AAAAC3Nz... hermes@mac
|
||||||
|
|
||||||
|
# Pridej do group_vars/all.yml.example
|
||||||
|
cp group_vars/all.yml.example group_vars/all.yml
|
||||||
|
nano group_vars/all.yml
|
||||||
```
|
```
|
||||||
|
|
||||||
Playbook provede:
|
V souboru najdi řádek:
|
||||||
- ✅ Update systému (apt)
|
```yaml
|
||||||
- ✅ Vytvoří `deploy` usera (UID 1000) bez hesla
|
deploy_ssh_public_keys:
|
||||||
- ✅ Nastaví SSH klíč pro `deploy`
|
- "ssh-ed25519 AAAAC3Nz... hermes@mac" # ← sem vlož svůj klíč
|
||||||
- ✅ Vytvoří adresářovou strukturu (`/home/deploy/docker/<sluzba>/`)
|
```
|
||||||
- ✅ Nainstaluje Docker Engine + Compose plugin
|
|
||||||
- ✅ Přidá `deploy` do `docker` group (docker bez sudo)
|
|
||||||
- ✅ Nastaví UFW firewall (povoleno 22, 80, 443)
|
|
||||||
- ✅ Nainstaluje fail2ban
|
|
||||||
|
|
||||||
### 5. Po dokončení
|
### Krok 5: Spusť playbook
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# Prihlas se jako deploy
|
ansible-playbook -i inventory.yml playbooks/priprav-novy-server.yml
|
||||||
|
```
|
||||||
|
|
||||||
|
**Co se stane:**
|
||||||
|
1. ✅ Ansible se připojí na server přes SSH (s heslem)
|
||||||
|
2. ✅ Stáhne seznam balíků (`apt update`)
|
||||||
|
3. ✅ Nainstaluje 17 základních balíků (btop, mc, tree, curl, …)
|
||||||
|
4. ✅ Vytvoří uživatele `deploy` (UID 1000)
|
||||||
|
5. ✅ Zamkne mu heslo (přístup jen přes SSH klíč)
|
||||||
|
6. ✅ Přidá tvůj SSH klíč do `~/.ssh/authorized_keys`
|
||||||
|
7. ✅ Nainstaluje Docker Engine + Compose plugin
|
||||||
|
8. ✅ Přidá `deploy` do `docker` group (docker **bez sudo**)
|
||||||
|
9. ✅ Vytvoří adresářovou strukturu pro 14 Docker služeb
|
||||||
|
10. ✅ Nainstaluje fail2ban (ochrana proti brute-force SSH)
|
||||||
|
|
||||||
|
**Trvání:** 5-10 minut.
|
||||||
|
|
||||||
|
### Krok 6: Ověř
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Prihlas se jako deploy (s klicem, bez hesla)
|
||||||
ssh deploy@<server-ip>
|
ssh deploy@<server-ip>
|
||||||
|
|
||||||
# Over Docker bez sudo
|
# Over Docker
|
||||||
docker ps
|
docker ps # melo by fungovat bez sudo
|
||||||
|
docker compose version
|
||||||
|
|
||||||
# Nasad sluzby z docker-services
|
# Adresare
|
||||||
git clone http://<server-ip>:3000/mates/mates-docker-services.git
|
ls /home/deploy/ # melo byt: docker, scripts, backups, logs, ...
|
||||||
cd mates-docker-services/portainer
|
|
||||||
cp .env.example .env
|
|
||||||
docker compose up -d
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## Role
|
---
|
||||||
|
|
||||||
| Role | Účel |
|
## 🎬 Práce s playbooky
|
||||||
|---|---|
|
|
||||||
| `common` | Update systému, base packages, timezone |
|
|
||||||
| `deploy-user` | Vytvoření `deploy` usera (UID 1000) |
|
|
||||||
| `ssh-keys` | Nasazení authorized_keys |
|
|
||||||
| `firewall` | UFW konfigurace |
|
|
||||||
| `docker` | Docker Engine + Compose + user v docker group |
|
|
||||||
| `directories` | `/home/deploy/{docker,scripts,backups,logs,...}` |
|
|
||||||
|
|
||||||
## Struktura
|
### Příprava nového serveru (úplně od nuly)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
ansible-playbook -i inventory.yml playbooks/priprav-novy-server.yml
|
||||||
|
```
|
||||||
|
|
||||||
|
### Nasazení Docker služeb
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Nasaď všechny (portainer, gitea, vaultwarden, ...)
|
||||||
|
ansible-playbook -i inventory.yml playbooks/nasad-sluzby.yml
|
||||||
|
|
||||||
|
# Nasaď jen vybrané
|
||||||
|
ansible-playbook -i inventory.yml playbooks/nasad-sluzby.yml \
|
||||||
|
--extra-vars "sluzby=[portainer,vaultwarden]"
|
||||||
|
```
|
||||||
|
|
||||||
|
### Aktualizace služeb
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Aktualizuj všechny běžící služby (docker compose pull && up -d)
|
||||||
|
ansible-playbook -i inventory.yml playbooks/aktualizuj-sluzby.yml
|
||||||
|
```
|
||||||
|
|
||||||
|
### Bezpečnostní hardening
|
||||||
|
|
||||||
|
```bash
|
||||||
|
ansible-playbook -i inventory.yml playbooks/zabezpec-server.yml
|
||||||
|
```
|
||||||
|
|
||||||
|
Tento playbook nastavuje:
|
||||||
|
- **sysctl** – hardening síťových parametrů jádra
|
||||||
|
- **auditd** – logování bezpečnostních událostí
|
||||||
|
- **unattended-upgrades** – automatické bezpečnostní aktualizace
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🏗 Struktura projektu
|
||||||
|
|
||||||
```
|
```
|
||||||
mates-ansible/
|
mates-ansible/
|
||||||
├── README.md
|
├── README.md # Tento soubor
|
||||||
├── ansible.cfg
|
├── LICENSE # MIT
|
||||||
├── inventory.example.yml
|
├── ansible.cfg # Konfigurace Ansible
|
||||||
├── group_vars/all.yml.example
|
├── inventory.example.yml # Ukázkový inventory
|
||||||
|
├── group_vars/
|
||||||
|
│ └── all.yml.example # Společné proměnné
|
||||||
├── playbooks/
|
├── playbooks/
|
||||||
│ ├── prepare-new-server.yml
|
│ ├── priprav-novy-server.yml # Příprava nového serveru
|
||||||
│ ├── deploy-services.yml
|
│ ├── nasad-sluzby.yml # Nasaď Docker služby
|
||||||
│ ├── update-services.yml
|
│ ├── aktualizuj-sluzby.yml # Aktualizuj služby
|
||||||
│ └── security-hardening.yml
|
│ └── zabezpec-server.yml # Bezpečnostní hardening
|
||||||
├── roles/
|
└── roles/
|
||||||
│ ├── common/
|
├── zaklad/ # Update + base balíky
|
||||||
│ ├── deploy-user/
|
├── uzivatel-deploy/ # Vytvoření deploy usera
|
||||||
│ ├── ssh-keys/
|
├── ssh-klice/ # Nasazení SSH klíče
|
||||||
│ ├── firewall/
|
├── docker/ # Docker Engine + Compose
|
||||||
│ ├── docker/
|
└── adresare/ # Adresářová struktura
|
||||||
│ └── directories/
|
|
||||||
└── requirements.yml
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## Detailní návody
|
---
|
||||||
|
|
||||||
|
## 🔑 Kde co nastavit
|
||||||
|
|
||||||
|
| Co | Kde |
|
||||||
|
|---|---|
|
||||||
|
| IP serverů | `inventory.yml` |
|
||||||
|
| SSH klíč pro deploy | `group_vars/all.yml` → `deploy_ssh_public_keys` |
|
||||||
|
| Base balíky | `roles/zaklad/defaults/main.yml` → `base_packages` |
|
||||||
|
| Porty | `group_vars/all.yml` → `allowed_ports` |
|
||||||
|
| Docker daemon nastavení | `roles/docker/defaults/main.yml` → `docker_daemon_config` |
|
||||||
|
| Služby k nasazení | `group_vars/all.yml` → `services_to_deploy` |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🔐 Bezpečnost
|
||||||
|
|
||||||
|
- ✅ **Deploy user má zamknuté heslo** – přístup jen přes SSH klíč
|
||||||
|
- ✅ **Bez hesel v inventory** – použij `ansible-vault` nebo SSH klíče
|
||||||
|
- ✅ **Docker bez sudo** – user `deploy` je v `docker` group
|
||||||
|
- ✅ **fail2ban** – 3 pokusy o SSH = ban na 1 hodinu
|
||||||
|
- ✅ **Firewall se nenastavuje automaticky** – viz `priprav-novy-server.yml` pro vysvětlení
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📚 Další zdroje
|
||||||
|
|
||||||
Detailní postupy najdeš v Jotty knowledge base.
|
Detailní postupy najdeš v Jotty knowledge base.
|
||||||
|
|
||||||
## Licence
|
---
|
||||||
|
|
||||||
|
## 📜 Licence
|
||||||
|
|
||||||
MIT – viz [LICENSE](LICENSE)
|
MIT – viz [LICENSE](LICENSE)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Poslední update:** 2026-08-01
|
||||||
|
|||||||
@@ -1,147 +0,0 @@
|
|||||||
---
|
|
||||||
# Bootstrap noveho Ubuntu serveru
|
|
||||||
# - aktualizace systemu
|
|
||||||
# - deploy user (UID 1000)
|
|
||||||
# - SSH hardening
|
|
||||||
# - UFW firewall
|
|
||||||
# - fail2ban
|
|
||||||
# - Docker
|
|
||||||
#
|
|
||||||
# Pouziti:
|
|
||||||
# ansible-playbook -i inventory.yml playbooks/bootstrap-server.yml
|
|
||||||
#
|
|
||||||
- name: Bootstrap home server
|
|
||||||
hosts: homeservers
|
|
||||||
become: true
|
|
||||||
gather_facts: true
|
|
||||||
|
|
||||||
vars:
|
|
||||||
deploy_user: deploy
|
|
||||||
deploy_uid: 1000
|
|
||||||
ssh_port: 22
|
|
||||||
# Verejny klic pro deploy uzivatele (nastav pred spustenim)
|
|
||||||
# deploy_ssh_key: "ssh-ed25519 AAAAC3Nz... hermes@mac"
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Update apt cache
|
|
||||||
ansible.builtin.apt:
|
|
||||||
update_cache: true
|
|
||||||
cache_valid_time: 3600
|
|
||||||
|
|
||||||
- name: Upgrade vsech baliku
|
|
||||||
ansible.builtin.apt:
|
|
||||||
upgrade: dist
|
|
||||||
update_cache: true
|
|
||||||
|
|
||||||
- name: Instalace zakladnich baliku
|
|
||||||
ansible.builtin.apt:
|
|
||||||
name:
|
|
||||||
- curl
|
|
||||||
- wget
|
|
||||||
- git
|
|
||||||
- vim
|
|
||||||
- htop
|
|
||||||
- ca-certificates
|
|
||||||
- gnupg
|
|
||||||
- ufw
|
|
||||||
- fail2ban
|
|
||||||
- bash-completion
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Nastav timezone
|
|
||||||
community.general.timezone:
|
|
||||||
name: "{{ timezone }}"
|
|
||||||
|
|
||||||
- name: Vytvor deploy uzivatele
|
|
||||||
ansible.builtin.user:
|
|
||||||
name: "{{ deploy_user }}"
|
|
||||||
uid: "{{ deploy_uid }}"
|
|
||||||
shell: /bin/bash
|
|
||||||
create_home: true
|
|
||||||
password: ""
|
|
||||||
|
|
||||||
- name: Nastav SSH klic pro deploy uzivatele
|
|
||||||
ansible.posix.authorized_key:
|
|
||||||
user: "{{ deploy_user }}"
|
|
||||||
state: present
|
|
||||||
key: "{{ deploy_ssh_key }}"
|
|
||||||
when: deploy_ssh_key is defined
|
|
||||||
|
|
||||||
- name: Povol deploy uzivateli sudo bez hesla
|
|
||||||
ansible.builtin.copy:
|
|
||||||
dest: "/etc/sudoers.d/{{ deploy_user }}"
|
|
||||||
content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
|
|
||||||
mode: "0440"
|
|
||||||
|
|
||||||
- name: SSH hardening
|
|
||||||
ansible.builtin.lineinfile:
|
|
||||||
path: /etc/ssh/sshd_config
|
|
||||||
regexp: "^#?{{ item.key }}"
|
|
||||||
line: "{{ item.key }} {{ item.value }}"
|
|
||||||
state: present
|
|
||||||
loop:
|
|
||||||
- { key: "Port", value: "{{ ssh_port }}" }
|
|
||||||
- { key: "PermitRootLogin", value: "no" }
|
|
||||||
- { key: "PasswordAuthentication", value: "no" }
|
|
||||||
- { key: "X11Forwarding", value: "no" }
|
|
||||||
- { key: "ClientAliveInterval", value: "300" }
|
|
||||||
- { key: "ClientAliveCountMax", value: "2" }
|
|
||||||
notify: Restart ssh
|
|
||||||
|
|
||||||
- name: UFW vychozi pravidla
|
|
||||||
community.general.ufw:
|
|
||||||
direction: incoming
|
|
||||||
policy: deny
|
|
||||||
notify: Reload ufw
|
|
||||||
|
|
||||||
- name: Povol SSH pres UFW
|
|
||||||
community.general.ufw:
|
|
||||||
rule: allow
|
|
||||||
port: "{{ ssh_port }}"
|
|
||||||
proto: tcp
|
|
||||||
|
|
||||||
- name: Povol HTTP a HTTPS
|
|
||||||
community.general.ufw:
|
|
||||||
rule: allow
|
|
||||||
port: "{{ item }}"
|
|
||||||
proto: tcp
|
|
||||||
loop:
|
|
||||||
- "80"
|
|
||||||
- "443"
|
|
||||||
|
|
||||||
- name: Aktivuj UFW
|
|
||||||
community.general.ufw:
|
|
||||||
state: enabled
|
|
||||||
|
|
||||||
- name: Konfigurace fail2ban
|
|
||||||
ansible.builtin.copy:
|
|
||||||
dest: /etc/fail2ban/jail.local
|
|
||||||
content: |
|
|
||||||
[DEFAULT]
|
|
||||||
bantime = 1h
|
|
||||||
findtime = 10m
|
|
||||||
maxretry = 5
|
|
||||||
|
|
||||||
[sshd]
|
|
||||||
enabled = true
|
|
||||||
port = {{ ssh_port }}
|
|
||||||
filter = sshd
|
|
||||||
logpath = /var/log/auth.log
|
|
||||||
maxretry = 3
|
|
||||||
mode: "0644"
|
|
||||||
notify: Restart fail2ban
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
- name: Restart ssh
|
|
||||||
ansible.builtin.service:
|
|
||||||
name: sshd
|
|
||||||
state: restarted
|
|
||||||
|
|
||||||
- name: Reload ufw
|
|
||||||
community.general.ufw:
|
|
||||||
state: reloaded
|
|
||||||
|
|
||||||
- name: Restart fail2ban
|
|
||||||
ansible.builtin.service:
|
|
||||||
name: fail2ban
|
|
||||||
state: restarted
|
|
||||||
@@ -1,21 +1,23 @@
|
|||||||
---
|
---
|
||||||
# Playbook: prepare-new-server.yml
|
# Playbook: priprav-novy-server.yml
|
||||||
#
|
#
|
||||||
# Kompletni priprava noveho Ubuntu serveru:
|
# Kompletni priprava noveho Ubuntu serveru (od nuly):
|
||||||
# 1. Update systemu (apt)
|
# 1. Update systemu (apt)
|
||||||
# 2. Deploy user (UID 1000, heslo zamknuto)
|
# 2. Zakladni baliky (btop, mc, tree, curl, wget, git, ...)
|
||||||
# 3. SSH klice (pro deploy uzivatele)
|
# 3. Uzivatel deploy (UID 1000, heslo zamknuto)
|
||||||
# 4. Adresarova struktura (/home/deploy/docker, ...)
|
# 4. SSH klice (z keychainu / group_vars)
|
||||||
# 5. Docker Engine + Compose plugin
|
# 5. Docker Engine + Compose plugin
|
||||||
# 6. Deploy user v docker group (docker bez sudo)
|
# 6. Uzivatel deploy v docker group (docker bez sudo)
|
||||||
# 7. fail2ban
|
# 7. Adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
|
||||||
|
# 8. fail2ban (SSH jail)
|
||||||
|
#
|
||||||
|
# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele.
|
||||||
|
# Pro produkcni nasazeni doporucujeme nastavit firewall externe
|
||||||
|
# (Cloudflare Tunnel, security group na VPS, docker-network oddeleni, ...).
|
||||||
#
|
#
|
||||||
# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele
|
|
||||||
# neni firewalled nasazen potreba. Pro produkcni nasazeni doporucujeme
|
|
||||||
# nastavit firewall externe (Cloudflare Tunnel, security group na VPS, ...).
|
|
||||||
# Pouziti:
|
# Pouziti:
|
||||||
# # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
|
# # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
|
||||||
# # 2. ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
|
# # 2. ansible-playbook -i inventory.yml playbooks/priprav-novy-server.yml
|
||||||
#
|
#
|
||||||
# Co playbook predpoklada:
|
# Co playbook predpoklada:
|
||||||
# - Server ma Ubuntu 22.04 nebo 24.04 LTS
|
# - Server ma Ubuntu 22.04 nebo 24.04 LTS
|
||||||
@@ -57,16 +59,16 @@
|
|||||||
when: confirm_run | default(true) | bool
|
when: confirm_run | default(true) | bool
|
||||||
|
|
||||||
roles:
|
roles:
|
||||||
- role: common
|
- role: zaklad
|
||||||
tags: [common, base]
|
tags: [zaklad, base]
|
||||||
- role: deploy-user
|
- role: uzivatel-deploy
|
||||||
tags: [user, deploy]
|
tags: [uzivatel, deploy]
|
||||||
- role: ssh-keys
|
- role: ssh-klice
|
||||||
tags: [ssh, keys]
|
tags: [ssh, klice]
|
||||||
- role: docker
|
- role: docker
|
||||||
tags: [docker]
|
tags: [docker]
|
||||||
- role: directories
|
- role: adresare
|
||||||
tags: [directories, docker]
|
tags: [adresare, docker]
|
||||||
|
|
||||||
post_tasks:
|
post_tasks:
|
||||||
- name: Nainstaluj fail2ban
|
- name: Nainstaluj fail2ban
|
||||||
Reference in New Issue
Block a user