mates
a102c83db8
Playbooky (novy nazev -> co dela):
- priprav-novy-server.yml (kompletni setup noveho serveru)
- nasad-sluzby.yml (nasadi Docker sluzby z docker-services/)
- aktualizuj-sluzby.yml (docker compose pull && up -d)
- zabezpec-server.yml (sysctl, auditd, unattended-upgrades)
- bootstrap-server.yml SMAZAN (duplicitni s priprav-novy-server)
Role (novy nazev -> co dela):
- zaklad (update + base baliky + timezone)
- uzivatel-deploy (vytvori deploy usera UID 1000)
- ssh-klice (authorized_keys deployment)
- docker (Docker Engine + Compose plugin) - ponechan anglicky (IT konvence)
- adresare (/home/deploy/{docker,scripts,backups,logs,...})
- firewall SMAZAN (nepouziva se)
Reference v playbooku aktualizovany na nove nazvy roli.
README.md kompletne prepracovan v cestine pro zacatecniky - vysvetluje
co Ansible je, jak nainstalovat, jak vytvorit inventory, jak spustit
playbook, jak overit ze vse funguje.
127 lines
3.8 KiB
YAML
127 lines
3.8 KiB
YAML
---
|
|
# Playbook: priprav-novy-server.yml
|
|
#
|
|
# Kompletni priprava noveho Ubuntu serveru (od nuly):
|
|
# 1. Update systemu (apt)
|
|
# 2. Zakladni baliky (btop, mc, tree, curl, wget, git, ...)
|
|
# 3. Uzivatel deploy (UID 1000, heslo zamknuto)
|
|
# 4. SSH klice (z keychainu / group_vars)
|
|
# 5. Docker Engine + Compose plugin
|
|
# 6. Uzivatel deploy v docker group (docker bez sudo)
|
|
# 7. Adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
|
|
# 8. fail2ban (SSH jail)
|
|
#
|
|
# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele.
|
|
# Pro produkcni nasazeni doporucujeme nastavit firewall externe
|
|
# (Cloudflare Tunnel, security group na VPS, docker-network oddeleni, ...).
|
|
#
|
|
# Pouziti:
|
|
# # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
|
|
# # 2. ansible-playbook -i inventory.yml playbooks/priprav-novy-server.yml
|
|
#
|
|
# Co playbook predpoklada:
|
|
# - Server ma Ubuntu 22.04 nebo 24.04 LTS
|
|
# - Pristup pres SSH s heslem (root nebo sudo user) pro ansible_become
|
|
# - V inventory.yml je nastaven ansible_host, ansible_user (s sudo prava)
|
|
#
|
|
- name: Priprav novy Ubuntu server
|
|
hosts: homeservers
|
|
become: true
|
|
gather_facts: true
|
|
|
|
vars:
|
|
# Default pro prepare-new-server.yml - lze prepsat v inventory
|
|
ssh_port: 22
|
|
fail2ban_maxretry: 5
|
|
fail2ban_bantime: 3600 # 1 hodina
|
|
|
|
pre_tasks:
|
|
- name: Varovani pred spustenim
|
|
ansible.builtin.pause:
|
|
prompt: |
|
|
|
|
============================================
|
|
PRIPRAVA NOVEHO SERVERU
|
|
|
|
Tento playbook:
|
|
- updatuje system
|
|
- vytvori deploy usera (UID 1000)
|
|
- nahraje SSH klice
|
|
- nainstaluje Docker + Compose
|
|
- vytvori adresarovou strukturu
|
|
- nainstaluje fail2ban
|
|
|
|
SSH pristup bude fungovat pro deploy usera s tvym verejnym klicem.
|
|
Pokud se neco pokazi, pripoj se pres puvodniho usera (z inventory).
|
|
|
|
Pokracovat? (Enter = ano, Ctrl+C = prerusit)
|
|
============================================
|
|
when: confirm_run | default(true) | bool
|
|
|
|
roles:
|
|
- role: zaklad
|
|
tags: [zaklad, base]
|
|
- role: uzivatel-deploy
|
|
tags: [uzivatel, deploy]
|
|
- role: ssh-klice
|
|
tags: [ssh, klice]
|
|
- role: docker
|
|
tags: [docker]
|
|
- role: adresare
|
|
tags: [adresare, docker]
|
|
|
|
post_tasks:
|
|
- name: Nainstaluj fail2ban
|
|
ansible.builtin.apt:
|
|
name:
|
|
- fail2ban
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Nastav fail2ban jail pro SSH
|
|
ansible.builtin.copy:
|
|
dest: /etc/fail2ban/jail.local
|
|
content: |
|
|
[DEFAULT]
|
|
bantime = {{ fail2ban_bantime }}
|
|
findtime = 10m
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = {{ ssh_port }}
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
mode: "0644"
|
|
notify: Restart fail2ban
|
|
|
|
- name: Aktivuj fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Vypis stav serveru
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
============================================
|
|
SERVER PRIPRAVEN
|
|
|
|
SSH pristup: deploy@{{ ansible_host | default(inventory_hostname) }}:{{ ssh_port }}
|
|
Docker: docker --version (bez sudo)
|
|
Sluzby: /home/{{ deploy_user }}/docker/<sluzba>/
|
|
|
|
Dalsi kroky:
|
|
1. SSH jako deploy: ssh deploy@<server-ip>
|
|
2. Klonuj docker services: git clone http://<server-ip>:3000/mates/mates-docker-services.git
|
|
3. Nasaď Portainer: cd docker/portainer && docker compose up -d
|
|
|
|
============================================
|
|
|
|
handlers:
|
|
- name: Restart fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: restarted
|