62 lines
1.5 KiB
YAML
62 lines
1.5 KiB
YAML
|
- name: Initialize System
|
||
|
|
hosts: all
|
||
|
|
user: root
|
||
|
|
tasks:
|
||
|
|
- name: Install Prerequisites
|
||
|
|
apt: name=aptitude update_cache=yes state=latest force_apt_get=yes
|
||
|
|
|
||
|
|
# Sudo Group Setup
|
||
|
|
- name: Make sure we have a 'wheel' group
|
||
|
|
group:
|
||
|
|
name: wheel
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: Allow 'wheel' group to have passwordless sudo
|
||
|
|
lineinfile:
|
||
|
|
path: /etc/sudoers
|
||
|
|
state: present
|
||
|
|
regexp: '^%wheel'
|
||
|
|
line: '%wheel ALL=(ALL) NOPASSWD: ALL'
|
||
|
|
validate: '/usr/sbin/visudo -cf %s'
|
||
|
|
|
||
|
|
# User + Key Setup
|
||
|
|
- name: Create a new regular user with sudo privileges
|
||
|
|
user:
|
||
|
|
name: "{{ create_user }}"
|
||
|
|
state: present
|
||
|
|
groups: wheel
|
||
|
|
append: true
|
||
|
|
create_home: true
|
||
|
|
shell: /bin/bash
|
||
|
|
|
||
|
|
- name: Set authorized key for remote user
|
||
|
|
authorized_key:
|
||
|
|
user: "{{ create_user }}"
|
||
|
|
state: present
|
||
|
|
key: "{{ copy_local_key }}"
|
||
|
|
|
||
|
|
- name: Set authorized key for remote user
|
||
|
|
authorized_key:
|
||
|
|
user: root
|
||
|
|
state: present
|
||
|
|
key: "{{ copy_local_key }}"
|
||
|
|
|
||
|
|
# Install Packages
|
||
|
|
- name: Update apt
|
||
|
|
apt: update_cache=yes
|
||
|
|
|
||
|
|
- name: Install required system packages
|
||
|
|
apt: name={{ sys_packages }} state=latest
|
||
|
|
|
||
|
|
# UFW Setup
|
||
|
|
- name: UFW - Allow SSH connections
|
||
|
|
ufw:
|
||
|
|
rule: allow
|
||
|
|
name: OpenSSH
|
||
|
|
|
||
|
|
- name: UFW - Deny all other incoming traffic by default
|
||
|
|
ufw:
|
||
|
|
state: enabled
|
||
|
|
policy: deny
|
||
|
|
direction: incoming
|