Minimal dependencies and configuration used on Debian system.
- Install the dependencies
- ansible
- ansible galaxy dependencies
ansible-galaxy install -r requirements.yml
- Configure a vault password (a filepass is better)
- Configure an inventory
- Configure a playbook
- Inventory (if needed)
- Replace variables
- Encrypt the needed ones
- Run the playbook
ansible-playbook \
-i inventory.yml \
--vault-password-file .vault_pass \
main.yml
We assume you run the playbook as root.
In this configuration, we are using knockd
to manage the openSSH firewall (ufw
) rules. It can be very risky. If you want to be safe you can exclude the knockd
task by commenting the following line in roles/security/tasks/main.yml:
- include_tasks: knockd.yml
And then add a rule for ufw
that allow you SSH connections.
nickjj.docker
: Setup and configure Docker + docker-compose.weareinteractive.ufw
: Setup the firewall and configure it.base
: Install basics needed packages for the other roles.profile
: Setup some default configuration for new users.security
: Setup system security tools/services like ssh, knockd, etc.shell
: Setup a shell environment with fish + tmux .
ssh_identity_key_path
: SSH public key used to auth.ssh_port
: Change the default SSH port.
knockd_open_ssh_seq
: Knockd open SSH (should be encrypted).knockd_close_ssh_seq
: knockd close SSH (should be encrypted).knockd_tmp_open_ssh_seq
: Temporary open SSH (should be encrypted).knockd_opts
: knockd CLI arguments used by the service.