mates
ec2f1d639c
playbook prepare-new-server.yml:
- update systemu
- deploy user (UID 1000, heslo zamknuto)
- SSH klic pro deploy uzivatele
- adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
- Docker Engine + Compose plugin (bez sudo)
- UFW firewall (22, 80, 443)
- fail2ban
- overeni docker bez sudo
Role (kazda v samostatnem adresari):
- common: update, base packages, timezone
- deploy-user: vytvoreni usera UID 1000
- ssh-keys: authorized_keys deployment
- firewall: UFW konfigurace
- docker: Docker Engine + Compose + daemon.json
- directories: /home/deploy/{docker/<sluzba>,backups,scripts,logs}
Pouziti:
ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
75 lines
1.8 KiB
Plaintext
75 lines
1.8 KiB
Plaintext
---
|
|
# Spolecne promenne pro vsechny playbooky
|
|
# Zkopiruj na group_vars/all.yml a dopln
|
|
|
|
# ============================================
|
|
# DEPLOY USER (UID 1000)
|
|
# ============================================
|
|
deploy_user: deploy
|
|
deploy_uid: 1000
|
|
deploy_groups:
|
|
- docker
|
|
- sudo
|
|
- adm
|
|
- systemd-journal
|
|
|
|
# Verejne SSH klice pro deploy uzivatele
|
|
# Pridej sve klice (verejnou cast z `cat ~/.ssh/id_ed25519.pub`)
|
|
deploy_ssh_public_keys:
|
|
- "ssh-ed25519 AAAAC3Nz... hermes@mac" # <-- nahrad svym klicem
|
|
|
|
# ============================================
|
|
# DOCKER
|
|
# ============================================
|
|
docker_compose_version: "v2.27.0"
|
|
docker_daemon_config:
|
|
log-driver: json-file
|
|
log-opts:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
storage-driver: overlay2
|
|
live-restore: true
|
|
userland-proxy: false
|
|
|
|
# Sluzby k nasazeni (seznam nazvu adresaru v docker-services/)
|
|
services_to_deploy:
|
|
- portainer
|
|
- nginx-proxy-manager
|
|
- vaultwarden
|
|
- gitea
|
|
- jotty
|
|
- nextcloud-aio
|
|
- rustdesk
|
|
- audiobookshelf
|
|
- calibre-web
|
|
- plex
|
|
- erugo
|
|
- jswiki
|
|
- speedtest
|
|
- watchtower
|
|
|
|
# ============================================
|
|
# NETWORK / FIREWALL
|
|
# ============================================
|
|
ssh_port: 22
|
|
allowed_ports:
|
|
- { port: 22, proto: tcp, comment: "SSH" }
|
|
- { port: 80, proto: tcp, comment: "HTTP" }
|
|
- { port: 443, proto: tcp, comment: "HTTPS" }
|
|
|
|
# ============================================
|
|
# SECURITY (fail2ban)
|
|
# ============================================
|
|
fail2ban_maxretry: 5
|
|
fail2ban_bantime: 3600
|
|
|
|
# ============================================
|
|
# SLUZBY (credentials po prvnim spusteni)
|
|
# ============================================
|
|
npm_default_email: admin@example.com
|
|
npm_default_password: changeme
|
|
|
|
gitea_admin_user: admin
|
|
gitea_admin_password: changeme
|
|
gitea_admin_email: admin@example.com
|