mates
444191d16d
- docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower) - install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore - ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton - hermes-install: Hermes CLI setup on macOS - macos-setup: Brewfile + osx-defaults + fish-config - home-nas-tools: metadata index for NAS projects (no binaries) - docs: architecture, security, contributing - README, LICENSE (MIT), .gitignore
89 lines
2.6 KiB
Markdown
89 lines
2.6 KiB
Markdown
# 🎭 Ansible Playbooks
|
||
|
||
> Ansible role a playbooks pro nasazení a správu home infrastruktury.
|
||
> Idempotentní, testovatelné, čitelné.
|
||
|
||
## 📁 Struktura
|
||
|
||
```
|
||
ansible/
|
||
├── README.md # Tento soubor
|
||
├── ansible.cfg # Konfigurace
|
||
├── requirements.yml # Ansible Galaxy role
|
||
├── inventory.example.yml # Ukázkový inventory
|
||
├── playbooks/
|
||
│ ├── bootstrap-server.yml # Úvodní setup nového serveru
|
||
│ ├── deploy-services.yml # Nasaď všechny Docker služby
|
||
│ ├── update-services.yml # Update všech služeb
|
||
│ └── security-hardening.yml # Bezpečnostní hardening
|
||
├── roles/
|
||
│ ├── common/ # Společné úkoly (update, packages, users)
|
||
│ ├── docker/ # Docker + compose
|
||
│ ├── portainer/ # Portainer compose
|
||
│ ├── nginx-proxy/ # Nginx Proxy Manager
|
||
│ ├── vaultwarden/ # Vaultwarden
|
||
│ ├── gitea/ # Gitea
|
||
│ └── ...
|
||
└── group_vars/
|
||
└── all.yml.example # Společné proměnné
|
||
```
|
||
|
||
## 🚀 Quickstart
|
||
|
||
```bash
|
||
# 1. Příprava
|
||
pip install ansible
|
||
ansible-galaxy install -r requirements.yml
|
||
|
||
# 2. Inventory
|
||
cp inventory.example.yml inventory.yml
|
||
nano inventory.yml # nastavit IP a SSH user
|
||
|
||
# 3. Test připojení
|
||
ansible all -m ping
|
||
|
||
# 4. Bootstrap
|
||
ansible-playbook -i inventory.yml playbooks/bootstrap-server.yml
|
||
|
||
# 5. Nasaď služby
|
||
ansible-playbook -i inventory.yml playbooks/deploy-services.yml --extra-vars "services=[portainer,vaultwarden,gitea]"
|
||
|
||
# 6. Update
|
||
ansible-playbook -i inventory.yml playbooks/update-services.yml
|
||
```
|
||
|
||
## 🎯 Playbooky
|
||
|
||
### `bootstrap-server.yml`
|
||
- Update OS
|
||
- Setup deploy user (UID 1000)
|
||
- SSH hardening
|
||
- UFW firewall
|
||
- fail2ban
|
||
- Základní utility
|
||
|
||
### `deploy-services.yml`
|
||
- Nasaď vybrané Docker služby
|
||
- Idempotentní – můžeš spustit víckrát
|
||
|
||
### `update-services.yml`
|
||
- `docker compose pull && up -d` pro všechny služby
|
||
- Watchtower notifikace
|
||
|
||
### `security-hardening.yml`
|
||
- Sysctl hardening
|
||
- AppArmor profily
|
||
- Auditd pravidla
|
||
- Automatické security updaty
|
||
|
||
## 🔐 Bezpečnost
|
||
|
||
- **Bez hesel v inventory** – použij `ansible-vault` nebo SSH klíče
|
||
- **Privilege escalation** – `become: true` jen kde potřeba
|
||
- **Idempotence** – každý task kontroluje stav
|
||
|
||
## 📚 Dokumentace
|
||
|
||
- [Ansible docs](https://docs.ansible.com/)
|
||
- [Best practices](https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html)
|