mates
ec2f1d639c
playbook prepare-new-server.yml:
- update systemu
- deploy user (UID 1000, heslo zamknuto)
- SSH klic pro deploy uzivatele
- adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
- Docker Engine + Compose plugin (bez sudo)
- UFW firewall (22, 80, 443)
- fail2ban
- overeni docker bez sudo
Role (kazda v samostatnem adresari):
- common: update, base packages, timezone
- deploy-user: vytvoreni usera UID 1000
- ssh-keys: authorized_keys deployment
- firewall: UFW konfigurace
- docker: Docker Engine + Compose + daemon.json
- directories: /home/deploy/{docker/<sluzba>,backups,scripts,logs}
Pouziti:
ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
120 lines
2.9 KiB
Markdown
120 lines
2.9 KiB
Markdown
# mates-ansible
|
||
|
||
Ansible role a playbooky pro přípravu nového serveru a nasazení home infrastruktury.
|
||
|
||
## Playbooky
|
||
|
||
| Playbook | Účel |
|
||
|---|---|
|
||
| `prepare-new-server.yml` | Kompletní příprava nového serveru (od nuly) |
|
||
| `deploy-services.yml` | Nasaď Docker služby z `mates-docker-services/` |
|
||
| `update-services.yml` | Update všech služeb (`docker compose pull && up -d`) |
|
||
| `security-hardening.yml` | Sysctl, auditd, auto-updates |
|
||
|
||
## Quickstart pro nový server
|
||
|
||
### 1. Příprava inventory
|
||
|
||
```bash
|
||
cp inventory.example.yml inventory.yml
|
||
nano inventory.yml # nastavit IP a SSH klíč
|
||
```
|
||
|
||
### 2. Přidání svého SSH klíče
|
||
|
||
```bash
|
||
# Verejny klic z Macu
|
||
cat ~/.ssh/id_ed25519.pub
|
||
|
||
# Pridej do group_vars/all.yml:
|
||
deploy_ssh_public_keys:
|
||
- "ssh-ed25519 AAAAC3Nz... hermes@mac"
|
||
```
|
||
|
||
### 3. První připojení (s heslem)
|
||
|
||
```yaml
|
||
# inventory.yml - pro prvni pripojeni (jeste pred SSH klicem)
|
||
homeservers:
|
||
hosts:
|
||
novy-server:
|
||
ansible_host: <server-ip>
|
||
ansible_user: ubuntu # nebo root
|
||
ansible_ssh_pass: heslo # POZOR: jen docasne
|
||
ansible_become_pass: heslo # POZOR: jen docasne
|
||
```
|
||
|
||
### 4. Spuštění playbooku
|
||
|
||
```bash
|
||
ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
|
||
```
|
||
|
||
Playbook provede:
|
||
- ✅ Update systému (apt)
|
||
- ✅ Vytvoří `deploy` usera (UID 1000) bez hesla
|
||
- ✅ Nastaví SSH klíč pro `deploy`
|
||
- ✅ Vytvoří adresářovou strukturu (`/home/deploy/docker/<sluzba>/`)
|
||
- ✅ Nainstaluje Docker Engine + Compose plugin
|
||
- ✅ Přidá `deploy` do `docker` group (docker bez sudo)
|
||
- ✅ Nastaví UFW firewall (povoleno 22, 80, 443)
|
||
- ✅ Nainstaluje fail2ban
|
||
|
||
### 5. Po dokončení
|
||
|
||
```bash
|
||
# Prihlas se jako deploy
|
||
ssh deploy@<server-ip>
|
||
|
||
# Over Docker bez sudo
|
||
docker ps
|
||
|
||
# Nasad sluzby z docker-services
|
||
git clone http://<server-ip>:3000/mates/mates-docker-services.git
|
||
cd mates-docker-services/portainer
|
||
cp .env.example .env
|
||
docker compose up -d
|
||
```
|
||
|
||
## Role
|
||
|
||
| Role | Účel |
|
||
|---|---|
|
||
| `common` | Update systému, base packages, timezone |
|
||
| `deploy-user` | Vytvoření `deploy` usera (UID 1000) |
|
||
| `ssh-keys` | Nasazení authorized_keys |
|
||
| `firewall` | UFW konfigurace |
|
||
| `docker` | Docker Engine + Compose + user v docker group |
|
||
| `directories` | `/home/deploy/{docker,scripts,backups,logs,...}` |
|
||
|
||
## Struktura
|
||
|
||
```
|
||
mates-ansible/
|
||
├── README.md
|
||
├── ansible.cfg
|
||
├── inventory.example.yml
|
||
├── group_vars/all.yml.example
|
||
├── playbooks/
|
||
│ ├── prepare-new-server.yml
|
||
│ ├── deploy-services.yml
|
||
│ ├── update-services.yml
|
||
│ └── security-hardening.yml
|
||
├── roles/
|
||
│ ├── common/
|
||
│ ├── deploy-user/
|
||
│ ├── ssh-keys/
|
||
│ ├── firewall/
|
||
│ ├── docker/
|
||
│ └── directories/
|
||
└── requirements.yml
|
||
```
|
||
|
||
## Detailní návody
|
||
|
||
Detailní postupy najdeš v Jotty knowledge base.
|
||
|
||
## Licence
|
||
|
||
MIT – viz [LICENSE](LICENSE)
|