mates
ec2f1d639c
playbook prepare-new-server.yml:
- update systemu
- deploy user (UID 1000, heslo zamknuto)
- SSH klic pro deploy uzivatele
- adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
- Docker Engine + Compose plugin (bez sudo)
- UFW firewall (22, 80, 443)
- fail2ban
- overeni docker bez sudo
Role (kazda v samostatnem adresari):
- common: update, base packages, timezone
- deploy-user: vytvoreni usera UID 1000
- ssh-keys: authorized_keys deployment
- firewall: UFW konfigurace
- docker: Docker Engine + Compose + daemon.json
- directories: /home/deploy/{docker/<sluzba>,backups,scripts,logs}
Pouziti:
ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
125 lines
3.6 KiB
YAML
125 lines
3.6 KiB
YAML
---
|
|
# Playbook: prepare-new-server.yml
|
|
#
|
|
# Kompletni priprava noveho Ubuntu serveru:
|
|
# 1. Update systemu (apt)
|
|
# 2. Deploy user (UID 1000, heslo zamknuto)
|
|
# 3. SSH klice (pro deploy uzivatele)
|
|
# 4. Adresarova struktura (/home/deploy/docker, ...)
|
|
# 5. Docker Engine + Compose plugin
|
|
# 6. Deploy user v docker group (docker bez sudo)
|
|
# 7. UFW firewall (povoleno SSH, HTTP, HTTPS)
|
|
# 8. fail2ban
|
|
#
|
|
# Pouziti:
|
|
# # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
|
|
# # 2. ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
|
|
#
|
|
# Co playbook predpoklada:
|
|
# - Server ma Ubuntu 22.04 nebo 24.04 LTS
|
|
# - Pristup pres SSH s heslem (root nebo sudo user) pro ansible_become
|
|
# - V inventory.yml je nastaven ansible_host, ansible_user (s sudo prava)
|
|
#
|
|
- name: Priprav novy Ubuntu server
|
|
hosts: homeservers
|
|
become: true
|
|
gather_facts: true
|
|
|
|
vars:
|
|
# Default pro prepare-new-server.yml - lze prepsat v inventory
|
|
ssh_port: 22
|
|
fail2ban_maxretry: 5
|
|
fail2ban_bantime: 3600 # 1 hodina
|
|
|
|
pre_tasks:
|
|
- name: Varovani pred spustenim
|
|
ansible.builtin.pause:
|
|
prompt: |
|
|
|
|
============================================
|
|
PRIPRAVA NOVEHO SERVERU
|
|
|
|
Tento playbook:
|
|
- updatuje system
|
|
- vytvori deploy usera (UID 1000)
|
|
- nahraje SSH klice
|
|
- nainstaluje Docker + Compose
|
|
- vytvori adresarovou strukturu
|
|
- nastavi firewall
|
|
|
|
SSH pristup bude fungovat pro deploy usera s tvym verejnym klicem.
|
|
Pokud se neco pokazi, pripoj se pres puvodniho usera (z inventory).
|
|
|
|
Pokracovat? (Enter = ano, Ctrl+C = prerusit)
|
|
============================================
|
|
when: confirm_run | default(true) | bool
|
|
|
|
roles:
|
|
- role: common
|
|
tags: [common, base]
|
|
- role: deploy-user
|
|
tags: [user, deploy]
|
|
- role: ssh-keys
|
|
tags: [ssh, keys]
|
|
- role: firewall
|
|
tags: [firewall, ufw]
|
|
- role: docker
|
|
tags: [docker]
|
|
- role: directories
|
|
tags: [directories, docker]
|
|
|
|
post_tasks:
|
|
- name: Nainstaluj fail2ban
|
|
ansible.builtin.apt:
|
|
name:
|
|
- fail2ban
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Nastav fail2ban jail pro SSH
|
|
ansible.builtin.copy:
|
|
dest: /etc/fail2ban/jail.local
|
|
content: |
|
|
[DEFAULT]
|
|
bantime = {{ fail2ban_bantime }}
|
|
findtime = 10m
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = {{ ssh_port }}
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
mode: "0644"
|
|
notify: Restart fail2ban
|
|
|
|
- name: Aktivuj fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Vypis stav serveru
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
============================================
|
|
SERVER PRIPRAVEN
|
|
|
|
SSH pristup: deploy@{{ ansible_host | default(inventory_hostname) }}:{{ ssh_port }}
|
|
Docker: docker --version (bez sudo)
|
|
Sluzby: /home/{{ deploy_user }}/docker/<sluzba>/
|
|
|
|
Dalsi kroky:
|
|
1. SSH jako deploy: ssh deploy@<server-ip>
|
|
2. Klonuj docker services: git clone http://<server-ip>:3000/mates/mates-docker-services.git
|
|
3. Nasaď Portainer: cd docker/portainer && docker compose up -d
|
|
|
|
============================================
|
|
|
|
handlers:
|
|
- name: Restart fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: restarted
|