mates
f91234c8fb
roles/netbird/tasks/main.yml: - apt balicek 'netbird' (oficialni NetBird Linux klient) - neni Docker, neni sluzba - je to VPN klient roles/netbird/defaults/main.yml: - odebrano netbird_run_as_system_service (nepotreba) - pridana poznamka o instalaci playbook priprav-novy-server.yml: - hlavicka: 'NetBird (mesh VPN klient - apt balicek, NE Docker)' group_vars/all.yml.example: - pridana dokumentace https://docs.netbird.io/get-started/install - komentare rikaji, ze to neni Docker sluzba README.md: - tabulka roli: 'apt balicek, ne Docker' - krok 8: 'NetBird (mesh VPN klient - apt balicek)' Postup instalace: - Linux server: ansible role -> apt install netbird - macOS workstation: brew install --cask netbird (v Brewfile) - Windows: instalator z netbird.io - Registrace: netbird up --setup-key <key> (z app.netbird.io)
131 lines
4.0 KiB
YAML
131 lines
4.0 KiB
YAML
---
|
|
# Playbook: priprav-novy-server.yml
|
|
#
|
|
# Kompletni priprava noveho Ubuntu serveru (od nuly):
|
|
# 1. Update systemu (apt)
|
|
# 2. Zakladni baliky (btop, mc, tree, curl, wget, git, ...)
|
|
# 3. Uzivatel deploy (UID 1000, heslo zamknuto)
|
|
# 4. SSH klice (z keychainu / group_vars)
|
|
# 5. Docker Engine + Compose plugin
|
|
# 6. Uzivatel deploy v docker group (docker bez sudo)
|
|
# 7. Adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
|
|
# 8. NetBird (mesh VPN klient - apt balicek, NE Docker)
|
|
# 9. fail2ban (SSH jail)
|
|
#
|
|
# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele.
|
|
# Pro produkcni nasazeni doporucujeme nastavit firewall externe
|
|
# (Cloudflare Tunnel, security group na VPS, docker-network oddeleni, ...).
|
|
#
|
|
# Pouziti:
|
|
# # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
|
|
# # 2. ansible-playbook -i inventory.yml playbooks/priprav-novy-server.yml
|
|
#
|
|
# Co playbook predpoklada:
|
|
# - Server ma Ubuntu 22.04 nebo 24.04 LTS
|
|
# - Pristup pres SSH s heslem (root nebo sudo user) pro ansible_become
|
|
# - V inventory.yml je nastaven ansible_host, ansible_user (s sudo prava)
|
|
#
|
|
- name: Priprav novy Ubuntu server
|
|
hosts: homeservers
|
|
become: true
|
|
gather_facts: true
|
|
|
|
vars:
|
|
# Default pro prepare-new-server.yml - lze prepsat v inventory
|
|
ssh_port: 22
|
|
fail2ban_maxretry: 5
|
|
fail2ban_bantime: 3600 # 1 hodina
|
|
|
|
pre_tasks:
|
|
- name: Varovani pred spustenim
|
|
ansible.builtin.pause:
|
|
prompt: |
|
|
|
|
============================================
|
|
PRIPRAVA NOVEHO SERVERU
|
|
|
|
Tento playbook:
|
|
- updatuje system
|
|
- vytvori deploy usera (UID 1000)
|
|
- nahraje SSH klice
|
|
- nainstaluje Docker + Compose
|
|
- vytvori adresarovou strukturu
|
|
- nainstaluje fail2ban
|
|
|
|
SSH pristup bude fungovat pro deploy usera s tvym verejnym klicem.
|
|
Pokud se neco pokazi, pripoj se pres puvodniho usera (z inventory).
|
|
|
|
Pokracovat? (Enter = ano, Ctrl+C = prerusit)
|
|
============================================
|
|
when: confirm_run | default(true) | bool
|
|
|
|
roles:
|
|
- role: zaklad
|
|
tags: [zaklad, base]
|
|
- role: uzivatel-deploy
|
|
tags: [uzivatel, deploy]
|
|
- role: ssh-klice
|
|
tags: [ssh, klice]
|
|
- role: docker
|
|
tags: [docker]
|
|
- role: adresare
|
|
tags: [adresare, docker]
|
|
- role: netbird
|
|
tags: [netbird, vpn]
|
|
|
|
post_tasks:
|
|
- name: Nainstaluj fail2ban
|
|
ansible.builtin.apt:
|
|
name:
|
|
- fail2ban
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Nastav fail2ban jail pro SSH
|
|
ansible.builtin.copy:
|
|
dest: /etc/fail2ban/jail.local
|
|
content: |
|
|
[DEFAULT]
|
|
bantime = {{ fail2ban_bantime }}
|
|
findtime = 10m
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = {{ ssh_port }}
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
mode: "0644"
|
|
notify: Restart fail2ban
|
|
|
|
- name: Aktivuj fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Vypis stav serveru
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
============================================
|
|
SERVER PRIPRAVEN
|
|
|
|
SSH pristup: deploy@{{ ansible_host | default(inventory_hostname) }}:{{ ssh_port }}
|
|
Docker: docker --version (bez sudo)
|
|
NetBird: netbird status (mesh VPN klient, ne Docker)
|
|
Sluzby: /home/{{ deploy_user }}/docker/<sluzba>/
|
|
|
|
Dalsi kroky:
|
|
1. SSH jako deploy: ssh deploy@<server-ip>
|
|
2. Klonuj docker services: git clone http://<server-ip>:3000/mates/mates-docker-services.git
|
|
3. Nasaď Portainer: cd docker/portainer && docker compose up -d
|
|
|
|
============================================
|
|
|
|
handlers:
|
|
- name: Restart fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: restarted
|