Initial commit

tasks/host.yml

@@ -0,0 +1,15 @@
+- name: copy hostname
+  template:
+    src: "hostname.j2"
+    dest: "/etc/hostname"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: copy hosts
+  template:
+    src: "hosts.j2"
+    dest: "/etc/hosts"
+    owner: root
+    group: root
+    mode: "0644"

tasks/known_hosts.yml

@@ -0,0 +1,39 @@
+- name: load OS specific vars
+  include_vars: "{{ item }}"
+  with_first_found:
+    - files:
+        - "{{ ansible_distribution|lower }}-{{ ansible_distribution_release|lower }}.yml"
+        - "{{ ansible_distribution|lower }}.yml"
+        - "{{ ansible_os_family|lower }}.yml"
+      paths:
+        - "{{ role_path }}/vars"
+
+- name: install packages
+  become: yes
+  package:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ known_hosts_packages }}"
+
+- name: retrieve user $HOME
+  shell: "echo $HOME" # noqa 301
+  become_user: "{{ user }}"
+  register: home_stats
+
+- name: set user $HOME
+  set_fact:
+    user_home: "{{ home_stats.stdout }}"
+
+- name: create local ssh directory
+  become_user: "{{ user }}"
+  file:
+    path: "{{ user_home }}/.ssh"
+    state: directory
+    mode: "0755"
+
+- name: add items to known hosts
+  become_user: "{{ user }}"
+  known_hosts:
+    name: "{{ item.domain }}"
+    key: "{{ item.key }}"
+  loop: "{{ items }}"

tasks/main.yml

@@ -0,0 +1,51 @@
+- include_tasks: "sudoers.yml"
+  loop:
+    - { src: "sudoers.j2", dest: "/etc/sudoers.d/20-ansible-extra" }
+
+- name: copy ssh template
+  template:
+    src: "sshd_config.j2"
+    dest: "/etc/ssh/sshd_config"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload ssh
+
+- name: viva la hollande
+  locale_gen:
+    name: nl_NL.UTF-8
+    state: present
+
+- name: ensure basic tooling is installed
+  apt:
+    name:
+      - acl
+      - man
+      - apt-transport-https
+      - ca-certificates
+      - software-properties-common
+      - policykit-1
+      - libpolkit-agent-1-0
+      - nftables
+      - openssh-client
+      - bash-completion
+      - git
+      - vim
+      - curl
+      - tree
+      - haveged
+      - rsync
+    state: present
+
+- name: copy firewall template
+  template:
+    src: "nftables.j2"
+    dest: "/etc/nftables.conf"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: restart nftables
+
+# see https://wiki.debian.org/systemd#Orphaned_processes
+- name: enable loginctl user-linger
+  command: "loginctl enable-linger {{ default_user|quote }}" # noqa 301

tasks/network.yml

@@ -0,0 +1,27 @@
+- name: check old network configuration
+  stat: path=/etc/network/interfaces
+  register: old_config
+
+- name: move old network configuration
+  command: mv /etc/network/interfaces /etc/network/interfaces.save
+  when: old_config.stat.exists
+
+- name: copy network configuration
+  template:
+    src: "network.j2"
+    dest: "/etc/systemd/network/50-default.network"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart systemd-networkd
+
+- name: copy dns configuration
+  file:
+    src: "/run/systemd/resolve/resolv.conf"
+    dest: "/etc/resolv.conf"
+    owner: root
+    group: root
+    state: link
+    force: yes
+    mode: "0644"
+  notify: restart systemd-resolved

tasks/nginx.yml

@@ -0,0 +1,18 @@
+- name: install nginx
+  apt:
+    name: nginx
+    state: present
+
+- name: copy nginx config
+  template:
+    src: "nginx.conf.j2"
+    dest: "/etc/nginx/nginx.conf"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: remove default site
+  file:
+    path: "/etc/nginx/sites-enabled/default"
+    state: absent
+  notify: restart nginx

tasks/poetry.yml

@@ -0,0 +1,73 @@
+- name: retrieve user $HOME # noqa 301
+  shell: "echo $HOME"
+  become_user: "{{ poetry_user }}"
+  register: home_stats
+
+- name: retrieve user $PATH # noqa 301
+  shell: "echo $PATH"
+  become_user: "{{ poetry_user }}"
+  register: path_stats
+
+- name: set poetry user variables
+  set_fact:
+    poetry_user_home: "{{ home_stats.stdout }}"
+    poetry_user_path: "{{ path_stats.stdout }}"
+
+- name: create user folder for binaries
+  become_user: "{{ poetry_user }}"
+  file:
+    state: directory
+    mode: "0755"
+    path: "{{ poetry_user_home }}/.local/bin"
+
+- name: set default python binary # noqa 208
+  become: true
+  file:
+    state: link
+    src: "/usr/bin/python3"
+    dest: "/usr/bin/python"
+  when: ansible_distribution == "Ubuntu"
+
+- name: setup poetry for Ubuntu/Debian derived distro's
+  block:
+    - name: check poetry existence
+      become_user: "{{ poetry_user }}"
+      stat:
+        path: "{{ poetry_dir }}"
+      register: poetry_stats
+
+    - name: download poetry installer
+      become_user: "{{ poetry_user }}"
+      get_url:
+        url: "{{ poetry_url }}"
+        dest: /tmp/
+        mode: "0750"
+      when: poetry_stats.stat.isdir is not defined
+
+    - name: install poetry
+      become_user: "{{ poetry_user }}"
+      command: "python /tmp/get-poetry.py --yes" # noqa 305
+      environment:
+        POETRY_HOME: "{{ poetry_dir }}"
+      when: poetry_stats.stat.isdir is not defined
+
+    - name: add poetry to user binaries # noqa 208
+      become_user: "{{ poetry_user }}"
+      file:
+        state: link
+        src: "{{ poetry_dir }}/bin/poetry"
+        dest: "{{ poetry_user_home }}/.local/bin/poetry"
+  when: ansible_distribution == "Debian" or ansible_distribution == "Ubuntu"
+
+- name: setup poetry for Archlinux
+  become: true
+  pacman:
+    name: poetry
+    state: present
+  when: ansible_facts['os_family'] == "Archlinux"
+
+- name: update poetry config
+  become_user: "{{ poetry_user }}"
+  command: "poetry config virtualenvs.in-project true" # noqa 301
+  environment:
+    PATH: "{{ poetry_user_home }}/.local/bin:{{ poetry_user_path }}"

tasks/ssl.yml

@@ -0,0 +1,39 @@
+- name: install SSL packages
+  apt:
+    name:
+      - python3-openssl
+      - python3-crypto
+      - python3-cryptography
+      - python-openssl
+      - python-crypto
+      - python-cryptography
+    state: present
+
+- name: create ssl directory
+  file:
+    path: "/etc/ssl/{{ app_name }}"
+    state: directory
+    owner: "{{ app_user }}"
+    group: "{{ app_user }}"
+    mode: 0750
+
+- name: generate an OpenSSL private key with the default values (4096 bits, RSA)
+  become_user: "{{ app_user }}"
+  openssl_privatekey:
+    path: "/etc/ssl/{{ app_name }}/local.pem"
+
+- name: generate an OpenSSL certificate signing request
+  become_user: "{{ app_user }}"
+  openssl_csr:
+    path: "/etc/ssl/{{ app_name }}/local.csr"
+    privatekey_path: "/etc/ssl/{{ app_name }}/local.pem"
+    common_name: fudiggity.nl
+
+- name: generate a self signed OpenSSL certificate
+  become_user: "{{ app_user }}"
+  openssl_certificate:
+    force: yes
+    path: "/etc/ssl/{{ app_name }}/{{ app_name }}.crt"
+    privatekey_path: "/etc/ssl/{{ app_name }}/local.pem"
+    csr_path: "/etc/ssl/{{ app_name }}/local.csr"
+    provider: selfsigned

tasks/sudoers.yml

@@ -0,0 +1,7 @@
+- name: copy extra sudoers file
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: root
+    group: root
+    mode: "0644"