Archive Legacy Setup And Add Ansible Control Plane

2026-07-08 12:47:37 +03:00
parent 841d56380b
commit 4bafa7d09e
203 changed files with 1663 additions and 11 deletions
@@ -0,0 +1,5 @@
+bootstrap_user: ada
+bootstrap_ssh_public_keys: [ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWNsUQmppB6cQccXX1ZaBbFIcmM6RmghsTVbG9TgoZB ada@ada-x1]
+docker_registry_mirrors:
+  - https://mirror.gcr.io
+  - https://dockerhub.timeweb.cloud
@@ -0,0 +1,4 @@
+- name: restart sshd
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
@@ -0,0 +1,85 @@
+- name: Ensure user exists
+  ansible.builtin.user:
+    name: "{{ bootstrap_user }}"
+    shell: /bin/bash
+    groups: sudo
+    append: true
+    create_home: true
+    state: present
+
+# docker group создаётся только после установки Docker.
+# Добавление происходит в роли docker, не здесь.
+
+- name: Add SSH authorized keys
+  ansible.posix.authorized_key:
+    user: "{{ bootstrap_user }}"
+    key: "{{ item }}"
+    state: present
+  loop: "{{ bootstrap_ssh_public_keys }}"
+  when: bootstrap_ssh_public_keys | length > 0
+
+- name: Gather service facts
+  ansible.builtin.service_facts:
+
+- name: Ensure Docker config directory exists
+  ansible.builtin.file:
+    path: /etc/docker
+    state: directory
+    mode: "0755"
+
+- name: Configure Docker registry mirrors
+  ansible.builtin.copy:
+    dest: /etc/docker/daemon.json
+    content: "{{ {'registry-mirrors': docker_registry_mirrors} | to_nice_json }}\n"
+    mode: "0644"
+  register: docker_daemon_config
+  when: docker_registry_mirrors | length > 0
+
+- name: Restart Docker after daemon config change
+  ansible.builtin.service:
+    name: docker
+    state: restarted
+  when:
+    - docker_daemon_config is changed
+    - "'docker.service' in ansible_facts.services"
+
+# Команды, которые реально нужны без пароля:
+#   apt / apt-get  — обновление пакетов
+#   systemctl      — управление сервисами
+#   ufw            — фаервол
+#   resticprofile  — установка systemd-таймеров бэкапа
+#
+# Ansible become НЕ входит в этот список намеренно:
+# для плейбуков запускать с -K. Это сознательный компромисс
+# между удобством и тем, чтобы не давать python3 NOPASSWD (= root).
+- name: Configure sudoers — NOPASSWD for specific commands
+  ansible.builtin.copy:
+    dest: /etc/sudoers.d/{{ bootstrap_user }}
+    content: |
+      {{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/bin/apt, /usr/bin/apt-get
+      {{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/bin/systemctl
+      {{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/bin/ufw
+      {{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/local/bin/resticprofile
+    validate: /usr/sbin/visudo -cf %s
+    mode: "0440"
+
+# Drop-in конфиг — не трогаем основной sshd_config.
+# Требует Debian 12+ (OpenSSH 8.9+).
+- name: Harden SSH
+  ansible.builtin.copy:
+    dest: /etc/ssh/sshd_config.d/99-hardening.conf
+    content: |
+      PasswordAuthentication no
+      PermitRootLogin no
+      PubkeyAuthentication yes
+    mode: "0644"
+  notify: restart sshd
+
+- name: Ensure sshd_config.d is included
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    line: Include /etc/ssh/sshd_config.d/*.conf
+    state: present
+    insertbefore: BOF
+    validate: /usr/sbin/sshd -t -f %s
+  notify: restart sshd