mates
1af4127820
Firewall (UFW) neni pozadovan:
- smazana cela role roles/firewall/
- odstraneny reference z prepare-new-server.yml
- pridana poznamka v group_vars/all.yml.example
- doporuceni: firewall resit externe (Cloudflare Tunnel, security group)
Base packages - pridany chybejici utility:
+ btop (system monitor - lepsi nez htop)
+ mc (Midnight Commander - textovy file manager)
+ tree (struktura adresaru v terminalu)
Ponechany: curl, wget, git, vim, htop, ca-certificates, gnupg,
lsb-release, apt-transport-https, bash-completion,
software-properties-common, unzip, zip, rsync, net-tools
125 lines
3.7 KiB
YAML
125 lines
3.7 KiB
YAML
---
|
|
# Playbook: prepare-new-server.yml
|
|
#
|
|
# Kompletni priprava noveho Ubuntu serveru:
|
|
# 1. Update systemu (apt)
|
|
# 2. Deploy user (UID 1000, heslo zamknuto)
|
|
# 3. SSH klice (pro deploy uzivatele)
|
|
# 4. Adresarova struktura (/home/deploy/docker, ...)
|
|
# 5. Docker Engine + Compose plugin
|
|
# 6. Deploy user v docker group (docker bez sudo)
|
|
# 7. fail2ban
|
|
#
|
|
# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele
|
|
# neni firewalled nasazen potreba. Pro produkcni nasazeni doporucujeme
|
|
# nastavit firewall externe (Cloudflare Tunnel, security group na VPS, ...).
|
|
# Pouziti:
|
|
# # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
|
|
# # 2. ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
|
|
#
|
|
# Co playbook predpoklada:
|
|
# - Server ma Ubuntu 22.04 nebo 24.04 LTS
|
|
# - Pristup pres SSH s heslem (root nebo sudo user) pro ansible_become
|
|
# - V inventory.yml je nastaven ansible_host, ansible_user (s sudo prava)
|
|
#
|
|
- name: Priprav novy Ubuntu server
|
|
hosts: homeservers
|
|
become: true
|
|
gather_facts: true
|
|
|
|
vars:
|
|
# Default pro prepare-new-server.yml - lze prepsat v inventory
|
|
ssh_port: 22
|
|
fail2ban_maxretry: 5
|
|
fail2ban_bantime: 3600 # 1 hodina
|
|
|
|
pre_tasks:
|
|
- name: Varovani pred spustenim
|
|
ansible.builtin.pause:
|
|
prompt: |
|
|
|
|
============================================
|
|
PRIPRAVA NOVEHO SERVERU
|
|
|
|
Tento playbook:
|
|
- updatuje system
|
|
- vytvori deploy usera (UID 1000)
|
|
- nahraje SSH klice
|
|
- nainstaluje Docker + Compose
|
|
- vytvori adresarovou strukturu
|
|
- nainstaluje fail2ban
|
|
|
|
SSH pristup bude fungovat pro deploy usera s tvym verejnym klicem.
|
|
Pokud se neco pokazi, pripoj se pres puvodniho usera (z inventory).
|
|
|
|
Pokracovat? (Enter = ano, Ctrl+C = prerusit)
|
|
============================================
|
|
when: confirm_run | default(true) | bool
|
|
|
|
roles:
|
|
- role: common
|
|
tags: [common, base]
|
|
- role: deploy-user
|
|
tags: [user, deploy]
|
|
- role: ssh-keys
|
|
tags: [ssh, keys]
|
|
- role: docker
|
|
tags: [docker]
|
|
- role: directories
|
|
tags: [directories, docker]
|
|
|
|
post_tasks:
|
|
- name: Nainstaluj fail2ban
|
|
ansible.builtin.apt:
|
|
name:
|
|
- fail2ban
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Nastav fail2ban jail pro SSH
|
|
ansible.builtin.copy:
|
|
dest: /etc/fail2ban/jail.local
|
|
content: |
|
|
[DEFAULT]
|
|
bantime = {{ fail2ban_bantime }}
|
|
findtime = 10m
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = {{ ssh_port }}
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
mode: "0644"
|
|
notify: Restart fail2ban
|
|
|
|
- name: Aktivuj fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Vypis stav serveru
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
============================================
|
|
SERVER PRIPRAVEN
|
|
|
|
SSH pristup: deploy@{{ ansible_host | default(inventory_hostname) }}:{{ ssh_port }}
|
|
Docker: docker --version (bez sudo)
|
|
Sluzby: /home/{{ deploy_user }}/docker/<sluzba>/
|
|
|
|
Dalsi kroky:
|
|
1. SSH jako deploy: ssh deploy@<server-ip>
|
|
2. Klonuj docker services: git clone http://<server-ip>:3000/mates/mates-docker-services.git
|
|
3. Nasaď Portainer: cd docker/portainer && docker compose up -d
|
|
|
|
============================================
|
|
|
|
handlers:
|
|
- name: Restart fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: restarted
|