From 18ee68f74ae2fca6c1c5c5a09e4c8a912d935bfb Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Mon, 6 Jul 2026 15:15:09 +0000 Subject: [PATCH 01/30] FEATURE: basic utils installation task added --- .../tasks/install_basic_utils.yaml | 26 +++++++++++++++++++ roles/0_basic_postinstall/tasks/main.yaml | 5 +++- 2 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 roles/0_basic_postinstall/tasks/install_basic_utils.yaml diff --git a/roles/0_basic_postinstall/tasks/install_basic_utils.yaml b/roles/0_basic_postinstall/tasks/install_basic_utils.yaml new file mode 100644 index 0000000..b0c386f --- /dev/null +++ b/roles/0_basic_postinstall/tasks/install_basic_utils.yaml @@ -0,0 +1,26 @@ +--- +- name: Installing basic utils for comfort work (apt-based system) + when: (ansible_facts['distribution'] == "Debian") or + (ansible_facts['distribution'] == "Ubuntu") + apt: + name: + - vim + - ranger + - zsh + - rsync + - git + - curl + - kitty + - unattended-upgrades + update-cache: yes # Run apt update before installation + become: yes + + +# The same commands for Alpine +- name: Update Alpine packages + when: (ansible_facts['distribution'] == "Alpine") + command: /sbin/apk update + +- name: Install the packages on Alpine + when: (ansible_facts['distribution'] == "Alpine") + command: /sbin/apk add vim ranger zsh rsync git curl kitty \ No newline at end of file diff --git a/roles/0_basic_postinstall/tasks/main.yaml b/roles/0_basic_postinstall/tasks/main.yaml index fc3092a..b42f03d 100644 --- a/roles/0_basic_postinstall/tasks/main.yaml +++ b/roles/0_basic_postinstall/tasks/main.yaml @@ -3,4 +3,7 @@ ansible.builtin.include_tasks: prepare_ansible_user.yaml - name: Improve SSH configuration - ansible.builtin.include_tasks: harden_ssh.yaml \ No newline at end of file + ansible.builtin.include_tasks: harden_ssh.yaml + +- name: Install basic utils + ansible.builtin.include_tasks: install_basic_utils.yaml \ No newline at end of file From 0d83a8609940de016495de8941ea27547ddaad98 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Mon, 6 Jul 2026 15:19:46 +0000 Subject: [PATCH 02/30] FIX: remote user changed in the new task --- roles/0_basic_postinstall/tasks/install_basic_utils.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/roles/0_basic_postinstall/tasks/install_basic_utils.yaml b/roles/0_basic_postinstall/tasks/install_basic_utils.yaml index b0c386f..0b4c609 100644 --- a/roles/0_basic_postinstall/tasks/install_basic_utils.yaml +++ b/roles/0_basic_postinstall/tasks/install_basic_utils.yaml @@ -14,13 +14,16 @@ - unattended-upgrades update-cache: yes # Run apt update before installation become: yes + remote_user: ansible # The same commands for Alpine - name: Update Alpine packages when: (ansible_facts['distribution'] == "Alpine") command: /sbin/apk update + remote_user: ansible - name: Install the packages on Alpine when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk add vim ranger zsh rsync git curl kitty \ No newline at end of file + command: /sbin/apk add vim ranger zsh rsync git curl kitty + remote_user: ansible \ No newline at end of file From 1a02e37ce8959cb5a6b22ec7b33ee8655056ca10 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Mon, 6 Jul 2026 15:23:31 +0000 Subject: [PATCH 03/30] FIX: default user is ansible now. root is specified manually when needed --- playbooks/deploy.yaml | 2 +- roles/0_basic_postinstall/tasks/harden_ssh.yaml | 1 + roles/0_basic_postinstall/tasks/install_basic_utils.yaml | 5 +---- roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml | 6 ++++++ 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index 16d5029..cb1d8fe 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -1,7 +1,7 @@ --- - name: Basic Proxmox guest deployment hosts: all - remote_user: root + remote_user: ansible roles: - ../roles/0_basic_postinstall vars_files: diff --git a/roles/0_basic_postinstall/tasks/harden_ssh.yaml b/roles/0_basic_postinstall/tasks/harden_ssh.yaml index 0938667..c3f58a9 100644 --- a/roles/0_basic_postinstall/tasks/harden_ssh.yaml +++ b/roles/0_basic_postinstall/tasks/harden_ssh.yaml @@ -1,6 +1,7 @@ --- - name: Configure ssh-server daemon + remote_user: root copy: src: ../files/hardened_sshd.conf dest: /etc/ssh/sshd_config.d/hardened_sshd.conf diff --git a/roles/0_basic_postinstall/tasks/install_basic_utils.yaml b/roles/0_basic_postinstall/tasks/install_basic_utils.yaml index 0b4c609..b0c386f 100644 --- a/roles/0_basic_postinstall/tasks/install_basic_utils.yaml +++ b/roles/0_basic_postinstall/tasks/install_basic_utils.yaml @@ -14,16 +14,13 @@ - unattended-upgrades update-cache: yes # Run apt update before installation become: yes - remote_user: ansible # The same commands for Alpine - name: Update Alpine packages when: (ansible_facts['distribution'] == "Alpine") command: /sbin/apk update - remote_user: ansible - name: Install the packages on Alpine when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk add vim ranger zsh rsync git curl kitty - remote_user: ansible \ No newline at end of file + command: /sbin/apk add vim ranger zsh rsync git curl kitty \ No newline at end of file diff --git a/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml b/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml index b44f405..f89040b 100644 --- a/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml +++ b/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml @@ -1,6 +1,7 @@ --- ## Installing packages - name: Install sudo on apt systems + remote_user: root when: (ansible_facts['distribution'] == "Debian") or (ansible_facts['distribution'] == "Ubuntu") apt: @@ -9,10 +10,12 @@ update-cache: yes - name: Update Alpine packages + remote_user: root when: (ansible_facts['distribution'] == "Alpine") command: /sbin/apk update - name: Install sudo package on Alpine + remote_user: root when: (ansible_facts['distribution'] == "Alpine") command: /sbin/apk add sudo @@ -20,12 +23,14 @@ ## Creating and setting up the ansible user ## First, create sshusers group to grant ssh access - name: Ensure group "sshusers" exists + remote_user: root ansible.builtin.group: name: sshusers state: present ## Add the user to sshusers (for ssh access) and sudo (gain root access) - name: Create a new user with a password for Ansible + remote_user: root user: name: ansible password: "{{ ansible_user_passwd_hash }}" @@ -35,6 +40,7 @@ ## Since password authentication in SSH will be disabled, we need to add an authorized key - name: Set authorized key taken from file + remote_user: root ansible.posix.authorized_key: user: ansible state: present From a798d42b4299f77b42ffb3a4e5b2909be668ae41 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Mon, 6 Jul 2026 15:45:22 +0000 Subject: [PATCH 04/30] FIX: hardened_sshd config improved --- .../files/hardened_sshd.conf | 32 +++++++++++-------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/roles/0_basic_postinstall/files/hardened_sshd.conf b/roles/0_basic_postinstall/files/hardened_sshd.conf index b28a15a..21f4436 100644 --- a/roles/0_basic_postinstall/files/hardened_sshd.conf +++ b/roles/0_basic_postinstall/files/hardened_sshd.conf @@ -1,23 +1,29 @@ -# Disable root login entirely -PermitRootLogin no - +PubkeyAuthentication yes +AuthorizedKeysFile .ssh/authorized_keys +PasswordAuthentication no +KbdInteractiveAuthentication no +UsePAM no # Disable password authentication — keys only PasswordAuthentication no ChallengeResponseAuthentication no -UsePAM no + + +AllowGroups sshusers +PrintMotd no +AcceptEnv LANG LC_* +ClientAliveCountMax 0 +ClientAliveInterval 300 +Port 22 + + +# Disable root login entirely +PermitRootLogin no # Limit authentication attempts MaxAuthTries 3 -MaxSessions 2 - -# Allow only your specific user -AllowUsers deploy +MaxSessions 3 # Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup) KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com -MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com - -# Connection timeout -ClientAliveInterval 300 -ClientAliveCountMax 2 \ No newline at end of file +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com \ No newline at end of file From eb268a00fb247c7bf1edffcef2fd7f4c36693f81 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Mon, 6 Jul 2026 15:57:24 +0000 Subject: [PATCH 05/30] FIX: default user is root, ansible is specified manually --- playbooks/deploy.yaml | 2 +- roles/0_basic_postinstall/tasks/harden_ssh.yaml | 2 +- roles/0_basic_postinstall/tasks/install_basic_utils.yaml | 5 ++++- roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml | 6 ------ 4 files changed, 6 insertions(+), 9 deletions(-) diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index cb1d8fe..16d5029 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -1,7 +1,7 @@ --- - name: Basic Proxmox guest deployment hosts: all - remote_user: ansible + remote_user: root roles: - ../roles/0_basic_postinstall vars_files: diff --git a/roles/0_basic_postinstall/tasks/harden_ssh.yaml b/roles/0_basic_postinstall/tasks/harden_ssh.yaml index c3f58a9..d4a2180 100644 --- a/roles/0_basic_postinstall/tasks/harden_ssh.yaml +++ b/roles/0_basic_postinstall/tasks/harden_ssh.yaml @@ -1,7 +1,6 @@ --- - name: Configure ssh-server daemon - remote_user: root copy: src: ../files/hardened_sshd.conf dest: /etc/ssh/sshd_config.d/hardened_sshd.conf @@ -10,6 +9,7 @@ - name: Configure ssh client + remote_user: ansible copy: src: ../files/hardened_ssh.conf dest: /etc/ssh/ssh_config.d/hardened_ssh.conf diff --git a/roles/0_basic_postinstall/tasks/install_basic_utils.yaml b/roles/0_basic_postinstall/tasks/install_basic_utils.yaml index b0c386f..0b4c609 100644 --- a/roles/0_basic_postinstall/tasks/install_basic_utils.yaml +++ b/roles/0_basic_postinstall/tasks/install_basic_utils.yaml @@ -14,13 +14,16 @@ - unattended-upgrades update-cache: yes # Run apt update before installation become: yes + remote_user: ansible # The same commands for Alpine - name: Update Alpine packages when: (ansible_facts['distribution'] == "Alpine") command: /sbin/apk update + remote_user: ansible - name: Install the packages on Alpine when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk add vim ranger zsh rsync git curl kitty \ No newline at end of file + command: /sbin/apk add vim ranger zsh rsync git curl kitty + remote_user: ansible \ No newline at end of file diff --git a/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml b/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml index f89040b..b44f405 100644 --- a/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml +++ b/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml @@ -1,7 +1,6 @@ --- ## Installing packages - name: Install sudo on apt systems - remote_user: root when: (ansible_facts['distribution'] == "Debian") or (ansible_facts['distribution'] == "Ubuntu") apt: @@ -10,12 +9,10 @@ update-cache: yes - name: Update Alpine packages - remote_user: root when: (ansible_facts['distribution'] == "Alpine") command: /sbin/apk update - name: Install sudo package on Alpine - remote_user: root when: (ansible_facts['distribution'] == "Alpine") command: /sbin/apk add sudo @@ -23,14 +20,12 @@ ## Creating and setting up the ansible user ## First, create sshusers group to grant ssh access - name: Ensure group "sshusers" exists - remote_user: root ansible.builtin.group: name: sshusers state: present ## Add the user to sshusers (for ssh access) and sudo (gain root access) - name: Create a new user with a password for Ansible - remote_user: root user: name: ansible password: "{{ ansible_user_passwd_hash }}" @@ -40,7 +35,6 @@ ## Since password authentication in SSH will be disabled, we need to add an authorized key - name: Set authorized key taken from file - remote_user: root ansible.posix.authorized_key: user: ansible state: present From 1951bf191f75c8ab480fda343641d413c370922c Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Mon, 6 Jul 2026 16:09:22 +0000 Subject: [PATCH 06/30] MINOR: test host is changed --- inventory/hosts.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inventory/hosts.yaml b/inventory/hosts.yaml index 1e49217..e56d517 100644 --- a/inventory/hosts.yaml +++ b/inventory/hosts.yaml @@ -1,5 +1,5 @@ --- physical: hosts: - 192.168.0.5: - ansible_become_password: "{{ ansible_become_passwd }}" \ No newline at end of file + 192.168.0.40: + ansible_become_password: "{{ ansible_become_passwd }}" From e4089273ca82d6fd30ef720910ce8ebd01199bf5 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Mon, 6 Jul 2026 17:21:08 +0000 Subject: [PATCH 07/30] FEATURE: task for creating and setting up a new user added, supplementary scripts and configs added --- roles/0_basic_postinstall/files/.vimrc | 16 +++ roles/0_basic_postinstall/files/.zshrc | 109 ++++++++++++++++++ .../0_basic_postinstall/files/install_omz.sh | 15 +++ .../tasks/create_new_user.yaml | 65 +++++++++++ roles/0_basic_postinstall/tasks/main.yaml | 5 +- .../tasks/remove_packages.yml | 27 +++++ 6 files changed, 236 insertions(+), 1 deletion(-) create mode 100644 roles/0_basic_postinstall/files/.vimrc create mode 100644 roles/0_basic_postinstall/files/.zshrc create mode 100644 roles/0_basic_postinstall/files/install_omz.sh create mode 100644 roles/0_basic_postinstall/tasks/create_new_user.yaml create mode 100644 roles/0_basic_postinstall/tasks/remove_packages.yml diff --git a/roles/0_basic_postinstall/files/.vimrc b/roles/0_basic_postinstall/files/.vimrc new file mode 100644 index 0000000..70d5a79 --- /dev/null +++ b/roles/0_basic_postinstall/files/.vimrc @@ -0,0 +1,16 @@ +set number +set tabstop=2 +" Disable compatibility with vi which can cause unexpected issues. +set nocompatible + +" Enable type file detection. Vim will be able to try to detect the type of file in use. +filetype on + +" Enable plugins and load plugin for the detected file type. +filetype plugin on + +" Load an indent file for the detected file type. +filetype indent on + +" Turn syntax highlighting on. +syntax on diff --git a/roles/0_basic_postinstall/files/.zshrc b/roles/0_basic_postinstall/files/.zshrc new file mode 100644 index 0000000..fdc37d9 --- /dev/null +++ b/roles/0_basic_postinstall/files/.zshrc @@ -0,0 +1,109 @@ +export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH + +# Path to your Oh My Zsh installation. +export ZSH="$HOME/.oh-my-zsh" + +export GTK_THEME=Adwaita-dark + +# Set name of the theme to load --- if set to "random", it will +# load a random theme each time Oh My Zsh is loaded, in which case, +# to know which specific one was loaded, run: echo $RANDOM_THEME +# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes +ZSH_THEME="gnzh" + +# Set list of themes to pick from when loading at random +# Setting this variable when ZSH_THEME=random will cause zsh to load +# a theme from this variable instead of looking in $ZSH/themes/ +# If set to an empty array, this variable will have no effect. +# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" ) + +# Uncomment the following line to use case-sensitive completion. +# CASE_SENSITIVE="true" + +# Uncomment the following line to use hyphen-insensitive completion. +# Case-sensitive completion must be off. _ and - will be interchangeable. +# HYPHEN_INSENSITIVE="true" + +# Uncomment one of the following lines to change the auto-update behavior +# zstyle ':omz:update' mode disabled # disable automatic updates +# zstyle ':omz:update' mode auto # update automatically without asking +# zstyle ':omz:update' mode reminder # just remind me to update when it's time + +# Uncomment the following line to change how often to auto-update (in days). +# zstyle ':omz:update' frequency 13 + +# Uncomment the following line if pasting URLs and other text is messed up. +# DISABLE_MAGIC_FUNCTIONS="true" + +# Uncomment the following line to disable colors in ls. +# DISABLE_LS_COLORS="true" + +# Uncomment the following line to disable auto-setting terminal title. +# DISABLE_AUTO_TITLE="true" + +# Uncomment the following line to enable command auto-correction. +# ENABLE_CORRECTION="true" + +# Uncomment the following line to display red dots whilst waiting for completion. +# You can also set it to another string to have that shown instead of the default red dots. +# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f" +# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765) +# COMPLETION_WAITING_DOTS="true" + +# Uncomment the following line if you want to disable marking untracked files +# under VCS as dirty. This makes repository status check for large repositories +# much, much faster. +# DISABLE_UNTRACKED_FILES_DIRTY="true" + +# Uncomment the following line if you want to change the command execution time +# stamp shown in the history command output. +# You can set one of the optional three formats: +# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd" +# or set a custom format using the strftime function format specifications, +# see 'man strftime' for details. +# HIST_STAMPS="mm/dd/yyyy" + +# Would you like to use another custom folder than $ZSH/custom? +# ZSH_CUSTOM=/path/to/new-custom-folder + +# Which plugins would you like to load? +# Standard plugins can be found in $ZSH/plugins/ +# Custom plugins may be added to $ZSH_CUSTOM/plugins/ +# Example format: plugins=(rails git textmate ruby lighthouse) +# Add wisely, as too many plugins slow down shell startup. +#plugins=(git) + +source $ZSH/oh-my-zsh.sh + +# User configuration + +# export MANPATH="/usr/local/man:$MANPATH" + +# You may need to manually set your language environment +# export LANG=en_US.UTF-8 + +# Preferred editor for local and remote sessions +# if [[ -n $SSH_CONNECTION ]]; then +# export EDITOR='vim' +# else +# export EDITOR='nvim' +# fi + +# Compilation flags +# export ARCHFLAGS="-arch $(uname -m)" + +# Set personal aliases, overriding those provided by Oh My Zsh libs, +# plugins, and themes. Aliases can be placed here, though Oh My Zsh +# users are encouraged to define aliases within a top-level file in +# the $ZSH_CUSTOM folder, with .zsh extension. Examples: +# - $ZSH_CUSTOM/aliases.zsh +# - $ZSH_CUSTOM/macos.zsh +# For a full list of active aliases, run `alias`. +# +# Example aliases +# alias zshconfig="mate ~/.zshrc" +# alias ohmyzsh="mate ~/.oh-my-zsh" +alias run_jabref="/home/max/projects/utils/jabref/build/image/bin/JabRef" +alias run_freecad="/home/max/Soft/gnu_linux/FreeCAD_1.0.0-conda-Linux-aarch64-py311.AppImage" +alias run_freecad_new="COIN_GL_NO_CURRENT_CONTEXT_CHECK=yes /home/max/projects/utils/freecad-source/build/bin/FreeCAD" +alias run_orca="/home/max/utils/OrcaSlicer_Linux_AppImage_V2.3.0.AppImage" diff --git a/roles/0_basic_postinstall/files/install_omz.sh b/roles/0_basic_postinstall/files/install_omz.sh new file mode 100644 index 0000000..e0e5f8d --- /dev/null +++ b/roles/0_basic_postinstall/files/install_omz.sh @@ -0,0 +1,15 @@ +#!/bin/sh + +FILE=/home/$USER/.oh-my-zsh/oh-my-zsh.sh +if [ -f "$FILE" ]; then + echo "$FILE exists and we not installing ohmyzsh" + exit 0 +else + echo "$FILE does not exist and we install ohmyzsh" + cd /home/max + wget https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh + chmod +x /home/max/install.sh + timeout -s 15 -k 30s 20s /home/max/install.sh --unattendend --keep-zshrc || exit 0 + exit 0 +fi + diff --git a/roles/0_basic_postinstall/tasks/create_new_user.yaml b/roles/0_basic_postinstall/tasks/create_new_user.yaml new file mode 100644 index 0000000..6129c1e --- /dev/null +++ b/roles/0_basic_postinstall/tasks/create_new_user.yaml @@ -0,0 +1,65 @@ +--- +- name: Create a new user with a password, set shell + remote_user: ansible + user: + name: max + groups: sshusers + password: "{{ user_passwd_hash }}" + shell: /bin/zsh + +- name: Set authorized key taken from file + remote_user: ansible + ansible.posix.authorized_key: + user: max + state: present + key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}" + +- name: Copy omz installation wrapper script to the target machine + remote_user: ansible + copy: + src: ../files/install_omz.sh + dest: /home/max/install_omz.sh + owner: max + group: max + mode: u=rwx,g=r,o-rwx + +# WARNING: UNPRIVILEGED USER (not ansible) COMMANDS +- name: Install oh my zsh + remote_user: max + become: no + command: /home/max/install_omz.sh + +- name: Configure oh my zsh, by pushing the config file + remote_user: ansible + copy: + src: ../files/.zshrc + dest: /home/max/.zshrc + owner: max + group: max + mode: u=rw,g=r,o-rwx + +- name: Configure vim, by pushing the config + remote_user: ansible + copy: + src: ../files/.vimrc + dest: /home/max/.vimrc + owner: max + group: max + mode: u=rw,g=r,o-rwx + + +# WARNING: we've finished with the initial setup, drop ansible key +# Push regular user key +- name: Set authorized key taken from file + remote_user: ansible + ansible.posix.authorized_key: + user: max + state: absent + key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}" + +- name: Set authorized key taken from file + remote_user: ansible + ansible.posix.authorized_key: + user: max + state: present + key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/max_regular_key.pub') }}" diff --git a/roles/0_basic_postinstall/tasks/main.yaml b/roles/0_basic_postinstall/tasks/main.yaml index b42f03d..89d7d9d 100644 --- a/roles/0_basic_postinstall/tasks/main.yaml +++ b/roles/0_basic_postinstall/tasks/main.yaml @@ -6,4 +6,7 @@ ansible.builtin.include_tasks: harden_ssh.yaml - name: Install basic utils - ansible.builtin.include_tasks: install_basic_utils.yaml \ No newline at end of file + ansible.builtin.include_tasks: install_basic_utils.yaml + +- name: Create and set up a new user + ansible.builtin.include_tasks: create_new_user.yaml \ No newline at end of file diff --git a/roles/0_basic_postinstall/tasks/remove_packages.yml b/roles/0_basic_postinstall/tasks/remove_packages.yml new file mode 100644 index 0000000..ac5835e --- /dev/null +++ b/roles/0_basic_postinstall/tasks/remove_packages.yml @@ -0,0 +1,27 @@ +--- +# Remove multiple packages at once +- name: Remove unnecessary packages + remote_user: ansible + when: (ansible_facts['distribution'] == "Debian") or + (ansible_facts['distribution'] == "Ubuntu") + apt: + name: + - nano + state: absent + become: yes + + +# Clean up all orphaned packages +- name: Remove all orphaned dependencies + remote_user: ansible + when: (ansible_facts['distribution'] == "Debian") or + (ansible_facts['distribution'] == "Ubuntu") + apt: + autoremove: yes + purge: yes + + +- name: Install sudo package on Alpine + remote_user: ansible + when: (ansible_facts['distribution'] == "Alpine") + command: /sbin/apk del nano From d6cddf13eb296cf4dc49f1d28cf92163e624a723 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 09:07:03 +0000 Subject: [PATCH 08/30] FEATURE: basic maintanance routines added: internet connection, disk space --- .../group_vars/all/secrets template.yaml | 8 ++- inventory/group_vars/all/secrets.yaml | 49 +++++++++++-------- playbooks/maintain.yml | 12 +++++ roles/1_common_healthcheck/files/ca.pem | 31 ++++++++++++ roles/1_common_healthcheck/tasks/main.yml | 38 ++++++++++++++ run_playbook.sh | 2 +- 6 files changed, 118 insertions(+), 22 deletions(-) create mode 100644 playbooks/maintain.yml create mode 100644 roles/1_common_healthcheck/files/ca.pem create mode 100644 roles/1_common_healthcheck/tasks/main.yml diff --git a/inventory/group_vars/all/secrets template.yaml b/inventory/group_vars/all/secrets template.yaml index dad995a..1ae1423 100644 --- a/inventory/group_vars/all/secrets template.yaml +++ b/inventory/group_vars/all/secrets template.yaml @@ -4,4 +4,10 @@ ansible_become_password: p@a$$word # SSH key for Ansible user ansible_ssh_key: $$h_key # Password for the default unprivileged user -user_password: p@a$$word \ No newline at end of file +user_password: p@a$$word +# ntfy topic +ntfy_topic: https://x.y.z/topic +# ntfy topic token +ntfy_topic_token: t0ken +# Home Assistant Webhook token +ha_webhook_token: h@_t0ken \ No newline at end of file diff --git a/inventory/group_vars/all/secrets.yaml b/inventory/group_vars/all/secrets.yaml index 83ec629..76c6c81 100644 --- a/inventory/group_vars/all/secrets.yaml +++ b/inventory/group_vars/all/secrets.yaml @@ -1,21 +1,30 @@ $ANSIBLE_VAULT;1.1;AES256 -37386438323934313261326132383539643062353335333661326131643032316239326161373930 -3264633766303937353938343565326562626535343830370a303632386666613033323132616561 -33353565616333346663396535613738343439323535663932633134663139623032353764633333 -6533366164393164300a303963343863323133303565323635313030396532336237313837633231 -35653733306565386665333739323433646238343961396234666232666238363264333639346265 -31323037356665366138663365653666623066393661353035636239656136323466633461323765 -34323836623766643562363035313465343863633534646466376437633761373665636233646532 -39616362353930376464626136336133333639636638623138313065383934666237383738396334 -34323930306536663131333639373764393135653161663431373563323837313964333736643238 -61353861656431396366616534633935636332323665336536353337646133653333663436623633 -34616333393666356632656238333935636562366237393162653864306462316231376666653932 -32373336373231306134343337373736656638343439373564343464653030623034333734656462 -63633634396631333233323939663763313163373863326634306663656638373239306634643337 -32343262393761643237653538376163633066376538616537653139376637663339646234383535 -62396663396161396130303135396330303530333533363533366330303831326661653138333336 -37386436373337613064343138373433393435653066303364326461303565336539396362373135 -31663538383030326566303166353934626639653432356562613938646364666337383835353234 -62383838346339653766393233383563356363383039303862393564353464343534373666376434 -33323136613337366566393535633730643064353664393436363830333561643265623163386165 -62323337363238643166 +38616132653531633164316632376332616261393136373235356332646132663735646563653033 +3835343662356664633163366638383534383238623561350a313862376637383731663636663962 +36326233376135623338383631636364353864663965336335303632363263323733333238363436 +3939343938366361660a313933326563363638356531323162613039363662376537396631346230 +37666639323638613063646434663135373332316165336662396632363439363737383434383035 +39626232613439366166646465346231393330383266386234313633643132643530323361653735 +35326230396136616339376339636233336231316231303536666638623130323030616535646461 +61626466343136343532616261613635366534373138343333353732646664313864613732376562 +30376366613165336135313264373934313334316130613038393963653061343561383931343736 +34383739623831636539353165323062336365356633366131323236636434326666666238333962 +38643436386633353261373964633361316432633066323837383563383431633034663135366363 +38373463306565656164653134643232643532626661633263386436333134626435623563633933 +64343666363930333232353836666464656137666534643038343933366336393036656433336237 +63653933666566376462353132393337303064353361316434353466333239386634623063313836 +63363039376335306266666236626530346335353537626533326437336663633530396139323235 +33643331366330303862313864653566323430623866353434623735346135616165643535363662 +32633434386237336132663731353233663834616138353363343632613234643835386464376639 +36366433363766396361306261386439336561396633663630663764386565306531643664663239 +37373431656337346363333639333734623231393865613762666339356537313563333465626536 +34333535376362633235313535373331663961376365356661336635396239636461383663356361 +31353731356135396365663536336133303731653437623435666230386534373237323731316336 +37656261323530623564316438613735313138336236356630393737393663626461653936306564 +63626133343339343837626133343833323264633634623461366335336232316439613762366162 +64316638366434313636373265343230373934373034366130333737626137613935386637633832 +64616161633965373661626165393136323039383064383539613335363264613664346533346430 +33633732363362363563353034616637363962646166353335656265336463323537666665663566 +30353264623966373033656364636634643064613331383464643536366234363831366531363138 +31303232663633303462373461616662666564376233323637343630646331663465373537376132 +62616132363136306334336661656264336131393039346431363661663438396438 diff --git a/playbooks/maintain.yml b/playbooks/maintain.yml new file mode 100644 index 0000000..7e0714d --- /dev/null +++ b/playbooks/maintain.yml @@ -0,0 +1,12 @@ +--- +- name: Physical machines maintanance play + hosts: all + remote_user: ansible + roles: + - ../roles/1_common_healthcheck + vars_files: + ../inventory/group_vars/all/secrets.yaml + vars: + ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}" + user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" + ha_addr: https://ha.lan diff --git a/roles/1_common_healthcheck/files/ca.pem b/roles/1_common_healthcheck/files/ca.pem new file mode 100644 index 0000000..3f23b8e --- /dev/null +++ b/roles/1_common_healthcheck/files/ca.pem @@ -0,0 +1,31 @@ +-----BEGIN CERTIFICATE----- +MIIFRTCCAy2gAwIBAgIUEYfbZs1nFB1sEyTb/W2AcKn9whwwDQYJKoZIhvcNAQEL +BQAwMTEQMA4GA1UEAwwHaG9tZS5jYTELMAkGA1UEBhMCUlUxEDAOBgNVBAcMB25v +d2hlcmUwIBcNMjYwMjAzMTg0NTA3WhgPMjA1MzA2MjAxODQ1MDdaMDExEDAOBgNV +BAMMB2hvbWUuY2ExCzAJBgNVBAYTAlJVMRAwDgYDVQQHDAdub3doZXJlMIICIjAN +BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhZJPmln1+iZ5b35U1KBPxGdfd2ra +V55vzjBA+9EeVJ7SgHqwvE6T7uXc/ZOpum/TiGAeU1bBtqilCwxXLLiL4Mkn6p1m +/ePosqE4lb7vMaZmAwxTcjmvekqnrcme+V1DSY5PtQljp+YBn/npOCHWe3WHNppc +3dUW6Y06hWk26C5xq4xdcIbs5LohMcJmMYI1kcaJPtys7RyW13Wy5dH8wF4Efdco +J4CU0yWBhF0Ys56YPbkWu1u2DqrFRiJr53LfJ90P88R4sSeBtLZVvEzWj+kWZEfJ +Oke7B1jXVJ40yBJ+brGQoFsD9o2x9JyNXHOUVcx1XH3a+NUFVKMJRCYPa5uaxq9h +B2gCBD4rBlOADchwSdNk1oGmtDg8xs3fcLxUqsO2jVA2T7w9iP4arvzqHuIWwVss +WdtcyQ/x8tjVC6cp8I8WH5CV8iWptH9exGnKbVjAWEkL6xbT7f09WDAheaXY1b59 +Opuw9KAGIvqj4NCPpdd7zwDivNFJWYfz7SkEiM9I6NMDP9BoYBVMIyxJR83NOgl0 +0gUPoEFT81k5w8k4S7kqa7YdMj3PLxGowIQb9xoQuXyAFtPhbXbHn/igKx62H/Lq +IOBvm55+GOaSnWAlVoze6rE+qCRWr6fS4bTcGEDb8INHPriwxX+YehqxLdqcGRLG +n8fd6ldOvS/BfXkCAwEAAaNTMFEwHQYDVR0OBBYEFBehubXS/4xlJz1AA6iVi2HA +HPfFMB8GA1UdIwQYMBaAFBehubXS/4xlJz1AA6iVi2HAHPfFMA8GA1UdEwEB/wQF +MAMBAf8wDQYJKoZIhvcNAQELBQADggIBACH/M9xbPuKmluznwtwofLod+4w5nTtU +bFpGmqSRNRjnL4j0aL+Gr/lcD2tGQXf01dOVdSbBjmBmW1p/2trVdVPxTLTaIhCw +Q8QuVmQJUkwnG1uv7W9Of9akJ4TadPKc5GfzYJJ+e71Z8sFXxFqfr0nF1fPdpPp8 +xkKsIwZopcjqLEzJydGOcHUbDWvR2fkG01DjgSevP34ZJQBm/bSAwlSs6b1119jw +ofQD462YLtXfavSz/MzRNNgCZlEAGVNt42CDOES6aZvOIt1pCKo8hIhptKgU4GpQ +vTE0kdekJWTUNQzbfWSF42FwllxVa4LJYXzmW7Jf30Q5xCZICH1Ofdk3qLK/B7tf +Fo/bNP3aLU4qBWShmCzYAyW4LPKL6AfODL5X45nESQDoAlfcdfeSXrbdG7P0NAcN +g4nROb5NNy/CgLNq2zDnq/JKdW3xvvNKT2FsNvOf3+9a99gB/L2dt8nX5SSLiWlN +50ynzOK21Z/YHCXutLiK2ugQf9dqj2rw7/C9oktoyvqwoVILhcsA0mhpN4343zI4 +PK2/zIjd0nZWaZLpJCj0yREnhhqgV3Par9d5biRfgFUuIoBnXIh4fr75xdkxqECX +pKu2rt3D0YGkPsP5lausvPbUy4nYcT1UkMwtdi0JZLNx04m22ZTzXpATo96LoWob +9eRPR6uW/Kmp +-----END CERTIFICATE----- diff --git a/roles/1_common_healthcheck/tasks/main.yml b/roles/1_common_healthcheck/tasks/main.yml new file mode 100644 index 0000000..826a285 --- /dev/null +++ b/roles/1_common_healthcheck/tasks/main.yml @@ -0,0 +1,38 @@ +--- +- name: Internet connection test block + block: + - name: Test reachability to ya.ru + become: yes # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine + shell: ping -c 5 ya.ru > /dev/null + changed_when: false # This task does not change the system + + rescue: + # This won't work for now. CA certificate reissuing is required!git + - name: Create a test file + become: no + ansible.builtin.uri: + url: "{{ ha_addr }}/api/webhook/{{ ha_webhook_token }}" + ca_path: ../files/ca.pem + delegate_to: 127.0.0.1 + # TODO: REMOVE THIS AFTER REISSUING CA CERTIFICATE! + failed_when: false + +- name: Disk free space test block + block: + - name: Test free disk space in root + become: no + shell: df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}' + register: result + failed_when: result.stdout | int > 85 + changed_when: false # This task does not change the system + + rescue: + - name: Notify with ntfy + become: no + ansible.builtin.command: | + curl -H "Authorization: Bearer {{ ntfy_topic_token }}" \ + -d "{{ ansible_facts['hostname'] }}: Disk space is low" \ + {{ ntfy_topic }} + delegate_to: 127.0.0.1 + failed_when: false + changed_when: false # This task does not change the system diff --git a/run_playbook.sh b/run_playbook.sh index edd598b..8fd8521 100755 --- a/run_playbook.sh +++ b/run_playbook.sh @@ -1,4 +1,4 @@ #!/bin/sh -ansible-playbook -i inventory/hosts.yaml playbooks/deploy.yaml \ +ansible-playbook -i inventory/hosts.yaml $1 \ --private-key inventory/group_vars/secret/ansible_key \ --vault-password-file inventory/group_vars/secret/.vault_pass \ No newline at end of file From e033652d3ec6dd69cf2890e988ef781774861ae0 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 11:40:00 +0000 Subject: [PATCH 09/30] FEATURE: automatic LXC creation added --- playbooks/deploy.yaml | 24 ++++++++++++++-------- roles/00_basic_proxmox_lxc/tasks/main.yaml | 24 ++++++++++++++++++++++ 2 files changed, 39 insertions(+), 9 deletions(-) create mode 100644 roles/00_basic_proxmox_lxc/tasks/main.yaml diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index 16d5029..1a29210 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -1,14 +1,20 @@ --- -- name: Basic Proxmox guest deployment - hosts: all - remote_user: root +- name: Deplot simple test LXC on Proxmox VE + hosts: localhost + gather_facts: false roles: - - ../roles/0_basic_postinstall - vars_files: - ../inventory/group_vars/all/secrets.yaml - vars: - ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}" - user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" + - ../roles/00_basic_proxmox_lxc + +#- name: Basic Proxmox guest deployment +# hosts: all +# remote_user: root +# roles: +# - ../roles/01_basic_postinstall +# vars_files: +# ../inventory/group_vars/all/secrets.yaml +# vars: +# ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}" +# user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" handlers: - name: restart sshd diff --git a/roles/00_basic_proxmox_lxc/tasks/main.yaml b/roles/00_basic_proxmox_lxc/tasks/main.yaml new file mode 100644 index 0000000..9f808d2 --- /dev/null +++ b/roles/00_basic_proxmox_lxc/tasks/main.yaml @@ -0,0 +1,24 @@ +--- + +- name: Create new container with minimal options defining network interface with static ip + become: no + community.proxmox.proxmox: + node: proxmox-server + api_user: root@pam + api_host: 192.168.0.2 + api_token_id: ansible + api_token_secret: "{{ proxmox_token_secret }}" + + vmid: 1040 + password: ansible-test + hostname: "ansible-test" + ostemplate: 'main:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst' + memory: 2048 + cores: 5 + state: started + disk_volume: + size: 2 # 2GB rootfs + storage: local + pubkey: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}" + netif: + net0: "name=eth0,gw=192.168.0.1,ip=192.168.0.40/24,bridge=vmbr0" \ No newline at end of file From efa9dfcbacfa24b306cd436b29bd3c841c6451b9 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 11:41:21 +0000 Subject: [PATCH 10/30] Directory structures and names changed to be follow the order of creation->provisioning->maintainance --- .../group_vars/all/secrets template.yaml | 4 +- inventory/group_vars/all/secrets.yaml | 63 ++++++++++--------- playbooks/deploy.yaml | 20 +++--- playbooks/maintain.yml | 2 +- .../files/.vimrc | 0 .../files/.zshrc | 0 .../files/hardened_ssh.conf | 0 .../files/hardened_sshd.conf | 0 .../files/install_omz.sh | 0 .../tasks/create_new_user.yaml | 0 .../tasks/harden_ssh.yaml | 0 .../tasks/install_basic_utils.yaml | 0 .../tasks/main.yaml | 0 .../tasks/prepare_ansible_user.yaml | 0 .../tasks/remove_packages.yml | 0 .../files/ca.pem | 0 .../tasks/main.yml | 0 17 files changed, 48 insertions(+), 41 deletions(-) rename roles/{0_basic_postinstall => 01_basic_postinstall}/files/.vimrc (100%) rename roles/{0_basic_postinstall => 01_basic_postinstall}/files/.zshrc (100%) rename roles/{0_basic_postinstall => 01_basic_postinstall}/files/hardened_ssh.conf (100%) rename roles/{0_basic_postinstall => 01_basic_postinstall}/files/hardened_sshd.conf (100%) rename roles/{0_basic_postinstall => 01_basic_postinstall}/files/install_omz.sh (100%) rename roles/{0_basic_postinstall => 01_basic_postinstall}/tasks/create_new_user.yaml (100%) rename roles/{0_basic_postinstall => 01_basic_postinstall}/tasks/harden_ssh.yaml (100%) rename roles/{0_basic_postinstall => 01_basic_postinstall}/tasks/install_basic_utils.yaml (100%) rename roles/{0_basic_postinstall => 01_basic_postinstall}/tasks/main.yaml (100%) rename roles/{0_basic_postinstall => 01_basic_postinstall}/tasks/prepare_ansible_user.yaml (100%) rename roles/{0_basic_postinstall => 01_basic_postinstall}/tasks/remove_packages.yml (100%) rename roles/{1_common_healthcheck => 02_common_healthcheck}/files/ca.pem (100%) rename roles/{1_common_healthcheck => 02_common_healthcheck}/tasks/main.yml (100%) diff --git a/inventory/group_vars/all/secrets template.yaml b/inventory/group_vars/all/secrets template.yaml index 1ae1423..a36dbc8 100644 --- a/inventory/group_vars/all/secrets template.yaml +++ b/inventory/group_vars/all/secrets template.yaml @@ -10,4 +10,6 @@ ntfy_topic: https://x.y.z/topic # ntfy topic token ntfy_topic_token: t0ken # Home Assistant Webhook token -ha_webhook_token: h@_t0ken \ No newline at end of file +ha_webhook_token: h@_t0ken +# Proxmox API token secret +proxmox_token_secret: t0ken_$ecret \ No newline at end of file diff --git a/inventory/group_vars/all/secrets.yaml b/inventory/group_vars/all/secrets.yaml index 76c6c81..d382ff1 100644 --- a/inventory/group_vars/all/secrets.yaml +++ b/inventory/group_vars/all/secrets.yaml @@ -1,30 +1,35 @@ $ANSIBLE_VAULT;1.1;AES256 -38616132653531633164316632376332616261393136373235356332646132663735646563653033 -3835343662356664633163366638383534383238623561350a313862376637383731663636663962 -36326233376135623338383631636364353864663965336335303632363263323733333238363436 -3939343938366361660a313933326563363638356531323162613039363662376537396631346230 -37666639323638613063646434663135373332316165336662396632363439363737383434383035 -39626232613439366166646465346231393330383266386234313633643132643530323361653735 -35326230396136616339376339636233336231316231303536666638623130323030616535646461 -61626466343136343532616261613635366534373138343333353732646664313864613732376562 -30376366613165336135313264373934313334316130613038393963653061343561383931343736 -34383739623831636539353165323062336365356633366131323236636434326666666238333962 -38643436386633353261373964633361316432633066323837383563383431633034663135366363 -38373463306565656164653134643232643532626661633263386436333134626435623563633933 -64343666363930333232353836666464656137666534643038343933366336393036656433336237 -63653933666566376462353132393337303064353361316434353466333239386634623063313836 -63363039376335306266666236626530346335353537626533326437336663633530396139323235 -33643331366330303862313864653566323430623866353434623735346135616165643535363662 -32633434386237336132663731353233663834616138353363343632613234643835386464376639 -36366433363766396361306261386439336561396633663630663764386565306531643664663239 -37373431656337346363333639333734623231393865613762666339356537313563333465626536 -34333535376362633235313535373331663961376365356661336635396239636461383663356361 -31353731356135396365663536336133303731653437623435666230386534373237323731316336 -37656261323530623564316438613735313138336236356630393737393663626461653936306564 -63626133343339343837626133343833323264633634623461366335336232316439613762366162 -64316638366434313636373265343230373934373034366130333737626137613935386637633832 -64616161633965373661626165393136323039383064383539613335363264613664346533346430 -33633732363362363563353034616637363962646166353335656265336463323537666665663566 -30353264623966373033656364636634643064613331383464643536366234363831366531363138 -31303232663633303462373461616662666564376233323637343630646331663465373537376132 -62616132363136306334336661656264336131393039346431363661663438396438 +37396233623362356239383039306566316433613761383032386566643964326638663830343837 +3031613035666339666634393439386463373734336130320a646331343036626234316131313265 +36666134646236333162316237326362333430616235633130633364666261343133306637623165 +6565633434353035390a323665636234616230373430663030666564363434623930656264343231 +39623465326661393832633661393437396535363434646261323737303163623230366161366163 +35373561636233313764366631373261316635386463353464306437323461613033313836383238 +36316133343737373666386534663939636234363831633738383738386433663533306465333230 +64633161396538316535346333343937306431386364363736656131613939336438663364323262 +34636633366464306231373739343764333935623434633331316463323961363364393865383732 +31393834626561643235393035666263646334613837666436333632393665346638623965346461 +35343966633631386330653834623234626537353739323938323339663836616139633832303465 +66356564636233663230633732333363343732396264653339396562353734643561643536616237 +34366536623535313533623634653632316538326137363034653030346337646264653765316662 +30613430636433303661353266666635333362613964383337643130316563633438653631373665 +37393465343561333966303137373636613937383261616365613463393263303863333134653630 +66386165303135343662346335653537366230316332666439326639613063383931313839376237 +64626362386666613362616666373565336666623837323064386262393135343834323161366163 +63393765653964633861663765343735626462303064383063643563393332653738343633313466 +61613264303139623530393765636162373136363837626134653930376230343463623433643063 +62393337623566616431306632333337616263633031613437643334363162623331653535396233 +63323939633563373137346537363834306261613738333636303762353639366136373734346632 +39333135616335343561626133386539333833366339613463626637326337333430376430393538 +33373234353064326435376432383139623561646361303063386531373164353335323265616566 +61643765313264626232366161313232323437306333316161663433643534363063393864666563 +35353966396164633534386663616233383236663466356465306361613039353366343630343063 +61643131343731366237313666626366656639663136393834376531323136653064383533383436 +31313038303766633339323465316236356536623362656432346233306434643236373831613339 +65663031326630303665306265623937623965633333363736373237333732306566386138396633 +36386461633762326466383436623263303935643133383365333664663665396134383730373030 +62663264363438336638663161366637663232383032633762373232396366633631666265323934 +62366536336435306539393662623962656335356439376466396539653263653033313964363364 +30303238646338396663323262653562353332346136323862616165663066373163313132396633 +31346438616130396332613736613635306530626663623634636434643137343262663635613061 +3762346665393865336666386163616430633731326237623733 diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index 1a29210..600b084 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -5,16 +5,16 @@ roles: - ../roles/00_basic_proxmox_lxc -#- name: Basic Proxmox guest deployment -# hosts: all -# remote_user: root -# roles: -# - ../roles/01_basic_postinstall -# vars_files: -# ../inventory/group_vars/all/secrets.yaml -# vars: -# ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}" -# user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" +- name: Basic Proxmox guest deployment + hosts: all + remote_user: root + roles: + - ../roles/01_basic_postinstall + vars_files: + ../inventory/group_vars/all/secrets.yaml + vars: + ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}" + user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" handlers: - name: restart sshd diff --git a/playbooks/maintain.yml b/playbooks/maintain.yml index 7e0714d..8d0afa3 100644 --- a/playbooks/maintain.yml +++ b/playbooks/maintain.yml @@ -3,7 +3,7 @@ hosts: all remote_user: ansible roles: - - ../roles/1_common_healthcheck + - ../roles/02_common_healthcheck vars_files: ../inventory/group_vars/all/secrets.yaml vars: diff --git a/roles/0_basic_postinstall/files/.vimrc b/roles/01_basic_postinstall/files/.vimrc similarity index 100% rename from roles/0_basic_postinstall/files/.vimrc rename to roles/01_basic_postinstall/files/.vimrc diff --git a/roles/0_basic_postinstall/files/.zshrc b/roles/01_basic_postinstall/files/.zshrc similarity index 100% rename from roles/0_basic_postinstall/files/.zshrc rename to roles/01_basic_postinstall/files/.zshrc diff --git a/roles/0_basic_postinstall/files/hardened_ssh.conf b/roles/01_basic_postinstall/files/hardened_ssh.conf similarity index 100% rename from roles/0_basic_postinstall/files/hardened_ssh.conf rename to roles/01_basic_postinstall/files/hardened_ssh.conf diff --git a/roles/0_basic_postinstall/files/hardened_sshd.conf b/roles/01_basic_postinstall/files/hardened_sshd.conf similarity index 100% rename from roles/0_basic_postinstall/files/hardened_sshd.conf rename to roles/01_basic_postinstall/files/hardened_sshd.conf diff --git a/roles/0_basic_postinstall/files/install_omz.sh b/roles/01_basic_postinstall/files/install_omz.sh similarity index 100% rename from roles/0_basic_postinstall/files/install_omz.sh rename to roles/01_basic_postinstall/files/install_omz.sh diff --git a/roles/0_basic_postinstall/tasks/create_new_user.yaml b/roles/01_basic_postinstall/tasks/create_new_user.yaml similarity index 100% rename from roles/0_basic_postinstall/tasks/create_new_user.yaml rename to roles/01_basic_postinstall/tasks/create_new_user.yaml diff --git a/roles/0_basic_postinstall/tasks/harden_ssh.yaml b/roles/01_basic_postinstall/tasks/harden_ssh.yaml similarity index 100% rename from roles/0_basic_postinstall/tasks/harden_ssh.yaml rename to roles/01_basic_postinstall/tasks/harden_ssh.yaml diff --git a/roles/0_basic_postinstall/tasks/install_basic_utils.yaml b/roles/01_basic_postinstall/tasks/install_basic_utils.yaml similarity index 100% rename from roles/0_basic_postinstall/tasks/install_basic_utils.yaml rename to roles/01_basic_postinstall/tasks/install_basic_utils.yaml diff --git a/roles/0_basic_postinstall/tasks/main.yaml b/roles/01_basic_postinstall/tasks/main.yaml similarity index 100% rename from roles/0_basic_postinstall/tasks/main.yaml rename to roles/01_basic_postinstall/tasks/main.yaml diff --git a/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml b/roles/01_basic_postinstall/tasks/prepare_ansible_user.yaml similarity index 100% rename from roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml rename to roles/01_basic_postinstall/tasks/prepare_ansible_user.yaml diff --git a/roles/0_basic_postinstall/tasks/remove_packages.yml b/roles/01_basic_postinstall/tasks/remove_packages.yml similarity index 100% rename from roles/0_basic_postinstall/tasks/remove_packages.yml rename to roles/01_basic_postinstall/tasks/remove_packages.yml diff --git a/roles/1_common_healthcheck/files/ca.pem b/roles/02_common_healthcheck/files/ca.pem similarity index 100% rename from roles/1_common_healthcheck/files/ca.pem rename to roles/02_common_healthcheck/files/ca.pem diff --git a/roles/1_common_healthcheck/tasks/main.yml b/roles/02_common_healthcheck/tasks/main.yml similarity index 100% rename from roles/1_common_healthcheck/tasks/main.yml rename to roles/02_common_healthcheck/tasks/main.yml From 1e504ad18aba2e9e374b17d872e30376b0a83cdc Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 14:11:44 +0000 Subject: [PATCH 11/30] FIX: useless aliases from .zshrc are removed --- roles/01_basic_postinstall/files/.zshrc | 4 ---- 1 file changed, 4 deletions(-) diff --git a/roles/01_basic_postinstall/files/.zshrc b/roles/01_basic_postinstall/files/.zshrc index fdc37d9..4423d1f 100644 --- a/roles/01_basic_postinstall/files/.zshrc +++ b/roles/01_basic_postinstall/files/.zshrc @@ -103,7 +103,3 @@ source $ZSH/oh-my-zsh.sh # Example aliases # alias zshconfig="mate ~/.zshrc" # alias ohmyzsh="mate ~/.oh-my-zsh" -alias run_jabref="/home/max/projects/utils/jabref/build/image/bin/JabRef" -alias run_freecad="/home/max/Soft/gnu_linux/FreeCAD_1.0.0-conda-Linux-aarch64-py311.AppImage" -alias run_freecad_new="COIN_GL_NO_CURRENT_CONTEXT_CHECK=yes /home/max/projects/utils/freecad-source/build/bin/FreeCAD" -alias run_orca="/home/max/utils/OrcaSlicer_Linux_AppImage_V2.3.0.AppImage" From 6f996d1da32e709d98b7214f8190931e17772344 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 15:00:17 +0000 Subject: [PATCH 12/30] FEATURE: systemd unit and timer added to schedule and run maintenance playbook --- systemd/ansible-maintenance.service | 19 +++++++++++++++++++ systemd/ansible-maintenance.timer | 11 +++++++++++ 2 files changed, 30 insertions(+) create mode 100644 systemd/ansible-maintenance.service create mode 100644 systemd/ansible-maintenance.timer diff --git a/systemd/ansible-maintenance.service b/systemd/ansible-maintenance.service new file mode 100644 index 0000000..2717b2b --- /dev/null +++ b/systemd/ansible-maintenance.service @@ -0,0 +1,19 @@ +[Unit] +Description=Run Ansible playbook for daily maintenance +After=network-online.target +Wants=network-online.target + +[Service] +Type=oneshot +# CAHNGE TO MATCH YOUR REQUIREMENTS +User=max +Group=max +WorkingDirectory=/home/max/projects/ansible_home +ExecStart=/home/max/projects/ansible_home/run_playbook.sh /home/max/projects/ansible_home/playbooks/maintain.yaml +StandardOutput=journal +StandardError=journal +# Optional: prevent runaway if the playbook hangs +TimeoutStopSec=3600 + +[Install] +WantedBy=multi-user.target diff --git a/systemd/ansible-maintenance.timer b/systemd/ansible-maintenance.timer new file mode 100644 index 0000000..e5bdb81 --- /dev/null +++ b/systemd/ansible-maintenance.timer @@ -0,0 +1,11 @@ +[Unit] +Description=Timer for daily Ansible playbook +Requires=ansible-maintenance.service + +[Timer] +OnUnitActiveSec=10min +Persistent=true +Unit=ansible-maintenance.service + +[Install] +WantedBy=timers.target From 5bcca3f268bd6ffccd870f2e73017a8ced2c08bd Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 15:03:00 +0000 Subject: [PATCH 13/30] FIX: all .yml are renamed with .yaml to follow the name convention --- playbooks/{maintain.yml => maintain.yaml} | 0 roles/01_basic_postinstall/tasks/main.yaml | 3 +++ .../tasks/{remove_packages.yml => remove_packages.yaml} | 0 roles/02_common_healthcheck/tasks/{main.yml => main.yaml} | 0 4 files changed, 3 insertions(+) rename playbooks/{maintain.yml => maintain.yaml} (100%) rename roles/01_basic_postinstall/tasks/{remove_packages.yml => remove_packages.yaml} (100%) rename roles/02_common_healthcheck/tasks/{main.yml => main.yaml} (100%) diff --git a/playbooks/maintain.yml b/playbooks/maintain.yaml similarity index 100% rename from playbooks/maintain.yml rename to playbooks/maintain.yaml diff --git a/roles/01_basic_postinstall/tasks/main.yaml b/roles/01_basic_postinstall/tasks/main.yaml index 89d7d9d..b982519 100644 --- a/roles/01_basic_postinstall/tasks/main.yaml +++ b/roles/01_basic_postinstall/tasks/main.yaml @@ -8,5 +8,8 @@ - name: Install basic utils ansible.builtin.include_tasks: install_basic_utils.yaml +- name: Remove unnecessary packages + ansible.builtin.include_tasks: remove_packages.yaml + - name: Create and set up a new user ansible.builtin.include_tasks: create_new_user.yaml \ No newline at end of file diff --git a/roles/01_basic_postinstall/tasks/remove_packages.yml b/roles/01_basic_postinstall/tasks/remove_packages.yaml similarity index 100% rename from roles/01_basic_postinstall/tasks/remove_packages.yml rename to roles/01_basic_postinstall/tasks/remove_packages.yaml diff --git a/roles/02_common_healthcheck/tasks/main.yml b/roles/02_common_healthcheck/tasks/main.yaml similarity index 100% rename from roles/02_common_healthcheck/tasks/main.yml rename to roles/02_common_healthcheck/tasks/main.yaml From 342a76766907dbfcdb1d8b6e0c7810d1c47fc30e Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 15:11:05 +0000 Subject: [PATCH 14/30] FIX: systemd timer description changed --- systemd/ansible-maintenance.timer | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/systemd/ansible-maintenance.timer b/systemd/ansible-maintenance.timer index e5bdb81..6e606e0 100644 --- a/systemd/ansible-maintenance.timer +++ b/systemd/ansible-maintenance.timer @@ -1,5 +1,5 @@ [Unit] -Description=Timer for daily Ansible playbook +Description=Timer for Ansible maintenance playbook, runs every 10 minutes Requires=ansible-maintenance.service [Timer] From 356301d59eb217682f38737662fbed10745b26ce Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 15:35:10 +0000 Subject: [PATCH 15/30] FEATURE: deployment playbook takes care of locale and time too --- roles/01_basic_postinstall/tasks/main.yaml | 5 ++++- .../tasks/set_locale_and_time.yaml | 11 +++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 roles/01_basic_postinstall/tasks/set_locale_and_time.yaml diff --git a/roles/01_basic_postinstall/tasks/main.yaml b/roles/01_basic_postinstall/tasks/main.yaml index b982519..5114da1 100644 --- a/roles/01_basic_postinstall/tasks/main.yaml +++ b/roles/01_basic_postinstall/tasks/main.yaml @@ -12,4 +12,7 @@ ansible.builtin.include_tasks: remove_packages.yaml - name: Create and set up a new user - ansible.builtin.include_tasks: create_new_user.yaml \ No newline at end of file + ansible.builtin.include_tasks: create_new_user.yaml + +- name: Set locale and time + ansible.builtin.include_tasks: set_locale_and_time.yaml \ No newline at end of file diff --git a/roles/01_basic_postinstall/tasks/set_locale_and_time.yaml b/roles/01_basic_postinstall/tasks/set_locale_and_time.yaml new file mode 100644 index 0000000..bd88db0 --- /dev/null +++ b/roles/01_basic_postinstall/tasks/set_locale_and_time.yaml @@ -0,0 +1,11 @@ +--- +- name: Set locale + ansible.builtin.locale_gen: + name: + - en_US.UTF-8 + - ru_RU.UTF-8 + state: present + +- name: Set time + ansible.builtin.timezone: + name: Europe/Samara \ No newline at end of file From c35abf3e24683b3bdbab54e08f94bb3c9bb9818f Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 15:35:51 +0000 Subject: [PATCH 16/30] FIX: LXC is created first, then we make sure that it is actually running --- roles/00_basic_proxmox_lxc/tasks/main.yaml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/roles/00_basic_proxmox_lxc/tasks/main.yaml b/roles/00_basic_proxmox_lxc/tasks/main.yaml index 9f808d2..3456368 100644 --- a/roles/00_basic_proxmox_lxc/tasks/main.yaml +++ b/roles/00_basic_proxmox_lxc/tasks/main.yaml @@ -15,10 +15,22 @@ ostemplate: 'main:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst' memory: 2048 cores: 5 - state: started + state: present disk_volume: size: 2 # 2GB rootfs storage: local pubkey: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}" netif: - net0: "name=eth0,gw=192.168.0.1,ip=192.168.0.40/24,bridge=vmbr0" \ No newline at end of file + net0: "name=eth0,gw=192.168.0.1,ip=192.168.0.40/24,bridge=vmbr0" + +- name: Make sure the container has started + become: no + community.proxmox.proxmox: + node: proxmox-server + api_user: root@pam + api_host: 192.168.0.2 + api_token_id: ansible + api_token_secret: "{{ proxmox_token_secret }}" + + vmid: 1040 + state: started \ No newline at end of file From b124ae352ed267849f7c0cb14726987965b85bbb Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 15:47:07 +0000 Subject: [PATCH 17/30] FIX: new human user also added to sudo group --- roles/01_basic_postinstall/tasks/create_new_user.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/01_basic_postinstall/tasks/create_new_user.yaml b/roles/01_basic_postinstall/tasks/create_new_user.yaml index 6129c1e..e86d789 100644 --- a/roles/01_basic_postinstall/tasks/create_new_user.yaml +++ b/roles/01_basic_postinstall/tasks/create_new_user.yaml @@ -3,7 +3,7 @@ remote_user: ansible user: name: max - groups: sshusers + groups: sshusers,sudo password: "{{ user_passwd_hash }}" shell: /bin/zsh From e906b214ea6c8adcc8eca2765ca978214fd705fd Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 15:47:52 +0000 Subject: [PATCH 18/30] FEATURE: now we also set locale, not only generate --- .../tasks/set_locale_and_time.yaml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/roles/01_basic_postinstall/tasks/set_locale_and_time.yaml b/roles/01_basic_postinstall/tasks/set_locale_and_time.yaml index bd88db0..cffbf2e 100644 --- a/roles/01_basic_postinstall/tasks/set_locale_and_time.yaml +++ b/roles/01_basic_postinstall/tasks/set_locale_and_time.yaml @@ -1,11 +1,19 @@ --- -- name: Set locale +- name: Generate locales ansible.builtin.locale_gen: name: - en_US.UTF-8 - ru_RU.UTF-8 state: present +- name: Set locale + ansible.builtin.copy: + dest: /etc/locale.conf + mode: '0644' + content: | + LANG=en_US.UTF-8 + LC_ALL=en_US.UTF-8 + - name: Set time ansible.builtin.timezone: name: Europe/Samara \ No newline at end of file From ad30e3648622a6be4358e83bdb88c8aecd60a953 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Tue, 7 Jul 2026 17:45:47 +0000 Subject: [PATCH 19/30] FIX: roles naming style changed --- playbooks/deploy.yaml | 4 ++-- playbooks/maintain.yaml | 2 +- .../{01_basic_postinstall => basic_postinstall}/files/.vimrc | 0 .../{01_basic_postinstall => basic_postinstall}/files/.zshrc | 0 .../files/hardened_ssh.conf | 0 .../files/hardened_sshd.conf | 0 .../files/install_omz.sh | 0 .../tasks/create_new_user.yaml | 0 .../tasks/harden_ssh.yaml | 0 .../tasks/install_basic_utils.yaml | 0 .../tasks/main.yaml | 0 .../tasks/prepare_ansible_user.yaml | 0 .../tasks/remove_packages.yaml | 0 .../tasks/set_locale_and_time.yaml | 0 .../tasks/main.yaml | 0 .../files/ca.pem | 0 .../tasks/main.yaml | 0 17 files changed, 3 insertions(+), 3 deletions(-) rename roles/{01_basic_postinstall => basic_postinstall}/files/.vimrc (100%) rename roles/{01_basic_postinstall => basic_postinstall}/files/.zshrc (100%) rename roles/{01_basic_postinstall => basic_postinstall}/files/hardened_ssh.conf (100%) rename roles/{01_basic_postinstall => basic_postinstall}/files/hardened_sshd.conf (100%) rename roles/{01_basic_postinstall => basic_postinstall}/files/install_omz.sh (100%) rename roles/{01_basic_postinstall => basic_postinstall}/tasks/create_new_user.yaml (100%) rename roles/{01_basic_postinstall => basic_postinstall}/tasks/harden_ssh.yaml (100%) rename roles/{01_basic_postinstall => basic_postinstall}/tasks/install_basic_utils.yaml (100%) rename roles/{01_basic_postinstall => basic_postinstall}/tasks/main.yaml (100%) rename roles/{01_basic_postinstall => basic_postinstall}/tasks/prepare_ansible_user.yaml (100%) rename roles/{01_basic_postinstall => basic_postinstall}/tasks/remove_packages.yaml (100%) rename roles/{01_basic_postinstall => basic_postinstall}/tasks/set_locale_and_time.yaml (100%) rename roles/{00_basic_proxmox_lxc => basic_proxmox_lxc}/tasks/main.yaml (100%) rename roles/{02_common_healthcheck => common_healthcheck}/files/ca.pem (100%) rename roles/{02_common_healthcheck => common_healthcheck}/tasks/main.yaml (100%) diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index 600b084..badae34 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -3,13 +3,13 @@ hosts: localhost gather_facts: false roles: - - ../roles/00_basic_proxmox_lxc + - ../roles/basic_proxmox_lxc - name: Basic Proxmox guest deployment hosts: all remote_user: root roles: - - ../roles/01_basic_postinstall + - ../roles/basic_postinstall vars_files: ../inventory/group_vars/all/secrets.yaml vars: diff --git a/playbooks/maintain.yaml b/playbooks/maintain.yaml index 8d0afa3..368befe 100644 --- a/playbooks/maintain.yaml +++ b/playbooks/maintain.yaml @@ -3,7 +3,7 @@ hosts: all remote_user: ansible roles: - - ../roles/02_common_healthcheck + - ../roles/common_healthcheck vars_files: ../inventory/group_vars/all/secrets.yaml vars: diff --git a/roles/01_basic_postinstall/files/.vimrc b/roles/basic_postinstall/files/.vimrc similarity index 100% rename from roles/01_basic_postinstall/files/.vimrc rename to roles/basic_postinstall/files/.vimrc diff --git a/roles/01_basic_postinstall/files/.zshrc b/roles/basic_postinstall/files/.zshrc similarity index 100% rename from roles/01_basic_postinstall/files/.zshrc rename to roles/basic_postinstall/files/.zshrc diff --git a/roles/01_basic_postinstall/files/hardened_ssh.conf b/roles/basic_postinstall/files/hardened_ssh.conf similarity index 100% rename from roles/01_basic_postinstall/files/hardened_ssh.conf rename to roles/basic_postinstall/files/hardened_ssh.conf diff --git a/roles/01_basic_postinstall/files/hardened_sshd.conf b/roles/basic_postinstall/files/hardened_sshd.conf similarity index 100% rename from roles/01_basic_postinstall/files/hardened_sshd.conf rename to roles/basic_postinstall/files/hardened_sshd.conf diff --git a/roles/01_basic_postinstall/files/install_omz.sh b/roles/basic_postinstall/files/install_omz.sh similarity index 100% rename from roles/01_basic_postinstall/files/install_omz.sh rename to roles/basic_postinstall/files/install_omz.sh diff --git a/roles/01_basic_postinstall/tasks/create_new_user.yaml b/roles/basic_postinstall/tasks/create_new_user.yaml similarity index 100% rename from roles/01_basic_postinstall/tasks/create_new_user.yaml rename to roles/basic_postinstall/tasks/create_new_user.yaml diff --git a/roles/01_basic_postinstall/tasks/harden_ssh.yaml b/roles/basic_postinstall/tasks/harden_ssh.yaml similarity index 100% rename from roles/01_basic_postinstall/tasks/harden_ssh.yaml rename to roles/basic_postinstall/tasks/harden_ssh.yaml diff --git a/roles/01_basic_postinstall/tasks/install_basic_utils.yaml b/roles/basic_postinstall/tasks/install_basic_utils.yaml similarity index 100% rename from roles/01_basic_postinstall/tasks/install_basic_utils.yaml rename to roles/basic_postinstall/tasks/install_basic_utils.yaml diff --git a/roles/01_basic_postinstall/tasks/main.yaml b/roles/basic_postinstall/tasks/main.yaml similarity index 100% rename from roles/01_basic_postinstall/tasks/main.yaml rename to roles/basic_postinstall/tasks/main.yaml diff --git a/roles/01_basic_postinstall/tasks/prepare_ansible_user.yaml b/roles/basic_postinstall/tasks/prepare_ansible_user.yaml similarity index 100% rename from roles/01_basic_postinstall/tasks/prepare_ansible_user.yaml rename to roles/basic_postinstall/tasks/prepare_ansible_user.yaml diff --git a/roles/01_basic_postinstall/tasks/remove_packages.yaml b/roles/basic_postinstall/tasks/remove_packages.yaml similarity index 100% rename from roles/01_basic_postinstall/tasks/remove_packages.yaml rename to roles/basic_postinstall/tasks/remove_packages.yaml diff --git a/roles/01_basic_postinstall/tasks/set_locale_and_time.yaml b/roles/basic_postinstall/tasks/set_locale_and_time.yaml similarity index 100% rename from roles/01_basic_postinstall/tasks/set_locale_and_time.yaml rename to roles/basic_postinstall/tasks/set_locale_and_time.yaml diff --git a/roles/00_basic_proxmox_lxc/tasks/main.yaml b/roles/basic_proxmox_lxc/tasks/main.yaml similarity index 100% rename from roles/00_basic_proxmox_lxc/tasks/main.yaml rename to roles/basic_proxmox_lxc/tasks/main.yaml diff --git a/roles/02_common_healthcheck/files/ca.pem b/roles/common_healthcheck/files/ca.pem similarity index 100% rename from roles/02_common_healthcheck/files/ca.pem rename to roles/common_healthcheck/files/ca.pem diff --git a/roles/02_common_healthcheck/tasks/main.yaml b/roles/common_healthcheck/tasks/main.yaml similarity index 100% rename from roles/02_common_healthcheck/tasks/main.yaml rename to roles/common_healthcheck/tasks/main.yaml From 87f68b2f87f9364bed766aff6f5f612d0c564f6a Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Sun, 12 Jul 2026 11:26:34 +0000 Subject: [PATCH 20/30] REFACTOR: harden_ssh task refactored according to ansible-lint --- roles/basic_postinstall/tasks/harden_ssh.yaml | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/roles/basic_postinstall/tasks/harden_ssh.yaml b/roles/basic_postinstall/tasks/harden_ssh.yaml index d4a2180..2f0a845 100644 --- a/roles/basic_postinstall/tasks/harden_ssh.yaml +++ b/roles/basic_postinstall/tasks/harden_ssh.yaml @@ -1,16 +1,24 @@ --- - name: Configure ssh-server daemon - copy: - src: ../files/hardened_sshd.conf + ansible.builtin.copy: + src: "{{ role_path }}/files/hardened_sshd.conf" dest: /etc/ssh/sshd_config.d/hardened_sshd.conf mode: u=rw,g=r,o=r - notify: restart sshd + notify: restart ssh-server + when: ansible_facts['distribution'] == 'Ubuntu' +- name: Configure ssh-server daemon + ansible.builtin.copy: + src: "{{ role_path }}/files/hardened_sshd.conf" + dest: /etc/ssh/sshd_config.d/hardened_sshd.conf + mode: u=rw,g=r,o=r + notify: restart sshd-server + when: ansible_facts['distribution'] == 'Debian' - name: Configure ssh client remote_user: ansible - copy: - src: ../files/hardened_ssh.conf + ansible.builtin.copy: + src: "{{ role_path }}/files/hardened_ssh.conf" dest: /etc/ssh/ssh_config.d/hardened_ssh.conf - mode: u=rw,g=r,o=r \ No newline at end of file + mode: u=rw,g=r,o=r From 0394a49c939dfe385eefcd339956123b4bb8044c Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Sun, 12 Jul 2026 12:36:18 +0000 Subject: [PATCH 21/30] FEATURE_REFACTOR: Alpine apk builtin module used. qemu-guest-agent for VMs is used. Refactored according to ansible-lint --- .../tasks/install_basic_utils.yaml | 35 +++++++++++++------ 1 file changed, 24 insertions(+), 11 deletions(-) diff --git a/roles/basic_postinstall/tasks/install_basic_utils.yaml b/roles/basic_postinstall/tasks/install_basic_utils.yaml index 0b4c609..03a9b37 100644 --- a/roles/basic_postinstall/tasks/install_basic_utils.yaml +++ b/roles/basic_postinstall/tasks/install_basic_utils.yaml @@ -1,8 +1,8 @@ --- - name: Installing basic utils for comfort work (apt-based system) - when: (ansible_facts['distribution'] == "Debian") or + when: (ansible_facts['distribution'] == "Debian") or (ansible_facts['distribution'] == "Ubuntu") - apt: + ansible.builtin.apt: name: - vim - ranger @@ -12,18 +12,31 @@ - curl - kitty - unattended-upgrades - update-cache: yes # Run apt update before installation - become: yes + - ssh + - openssh-server + update-cache: true # Run apt update before installation + become: true remote_user: ansible +- name: Install qemu-guest-agent on VM + when: + - ansible_facts['os_family'] == "Debian" + - ansible_facts['virtualization_type'] == "kvm" + ansible.builtin.apt: + name: qemu-guest-agent + state: present + update-cache: true # Run apt update before installation + become: true + remote_user: ansible + tags: + - kvm-guests + - packages + # The same commands for Alpine -- name: Update Alpine packages +- name: Update and install packages on Alpine when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk update + community.general.apk: + name: vim ranger zsh rsync git curl kitty + update_cache: true remote_user: ansible - -- name: Install the packages on Alpine - when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk add vim ranger zsh rsync git curl kitty - remote_user: ansible \ No newline at end of file From ff43d53f53bed2bcc52fe086e4ed0b6453a9c00b Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Sun, 12 Jul 2026 12:37:17 +0000 Subject: [PATCH 22/30] CHANGE: restart ssh handler name changed --- playbooks/deploy.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index badae34..cd5802c 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -17,7 +17,12 @@ user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" handlers: - - name: restart sshd + - name: restart ssh-server + service: + name: ssh + state: restarted + + - name: restart sshd-server service: name: sshd state: restarted \ No newline at end of file From 28791acfda122841d11c5c28d0919d5c1f2daf83 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Sun, 12 Jul 2026 12:39:16 +0000 Subject: [PATCH 23/30] FEATURE_REFACTOR: 1-minute delay added at the end. Refactored according to ansible-lint --- roles/basic_proxmox_lxc/tasks/main.yaml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/roles/basic_proxmox_lxc/tasks/main.yaml b/roles/basic_proxmox_lxc/tasks/main.yaml index 3456368..d5033dc 100644 --- a/roles/basic_proxmox_lxc/tasks/main.yaml +++ b/roles/basic_proxmox_lxc/tasks/main.yaml @@ -1,14 +1,16 @@ --- - name: Create new container with minimal options defining network interface with static ip - become: no + become: false community.proxmox.proxmox: + validate_certs: false node: proxmox-server api_user: root@pam api_host: 192.168.0.2 api_token_id: ansible api_token_secret: "{{ proxmox_token_secret }}" + cmode: "shell" vmid: 1040 password: ansible-test hostname: "ansible-test" @@ -19,13 +21,14 @@ disk_volume: size: 2 # 2GB rootfs storage: local - pubkey: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}" + pubkey: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}" netif: net0: "name=eth0,gw=192.168.0.1,ip=192.168.0.40/24,bridge=vmbr0" - name: Make sure the container has started - become: no + become: false community.proxmox.proxmox: + validate_certs: false node: proxmox-server api_user: root@pam api_host: 192.168.0.2 @@ -33,4 +36,11 @@ api_token_secret: "{{ proxmox_token_secret }}" vmid: 1040 - state: started \ No newline at end of file + state: started + +- name: Sleep for a minute to ensure that ssh is ready + become: false + ansible.builtin.wait_for: + timeout: 60 + delegate_to: localhost + changed_when: false From 95f059c0a85a6eb48dd08696d43b592a4dbe8cb0 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Sun, 12 Jul 2026 12:40:36 +0000 Subject: [PATCH 24/30] FEATURE: Setting Proxmox VM up from cloud-init template added --- playbooks/deploy_vm_from_cloud_init.yaml | 28 +++++++++++++ roles/basic_proxmox_vm/tasks/main.yaml | 53 ++++++++++++++++++++++++ 2 files changed, 81 insertions(+) create mode 100644 playbooks/deploy_vm_from_cloud_init.yaml create mode 100644 roles/basic_proxmox_vm/tasks/main.yaml diff --git a/playbooks/deploy_vm_from_cloud_init.yaml b/playbooks/deploy_vm_from_cloud_init.yaml new file mode 100644 index 0000000..96c045c --- /dev/null +++ b/playbooks/deploy_vm_from_cloud_init.yaml @@ -0,0 +1,28 @@ +--- +- name: Deploy a virtual machine from a cloud init image + hosts: localhost + gather_facts: false + roles: + - ../roles/basic_proxmox_vm + +- name: Basic Proxmox guest deployment + hosts: all + remote_user: ansible + roles: + - ../roles/basic_postinstall + vars_files: + ../inventory/group_vars/all/secrets.yaml + vars: + ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}" + user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" + + handlers: + - name: restart ssh-server + service: + name: ssh + state: restarted + + - name: restart sshd-server + service: + name: sshd + state: restarted \ No newline at end of file diff --git a/roles/basic_proxmox_vm/tasks/main.yaml b/roles/basic_proxmox_vm/tasks/main.yaml new file mode 100644 index 0000000..990fec3 --- /dev/null +++ b/roles/basic_proxmox_vm/tasks/main.yaml @@ -0,0 +1,53 @@ +--- +- name: Create a new VM with minimal options + become: false + community.proxmox.proxmox_kvm: + validate_certs: false + node: proxmox-server + api_user: root@pam + api_host: 192.168.0.2 + api_token_id: ansible + api_token_secret: "{{ proxmox_token_secret }}" + + clone: debian-13-cloud-init-template + newid: 1041 + name: ansible-ci-test + storage: main + format: qcow2 + full: true + timeout: 500 + +- name: Tweak the hardware settings + become: false + community.proxmox.proxmox_kvm: + validate_certs: false + node: proxmox-server + api_user: root@pam + api_host: 192.168.0.2 + api_token_id: ansible + api_token_secret: "{{ proxmox_token_secret }}" + + vmid: 1041 + cores: 4 + memory: 4096 # Minimal value for debian based OS for smooth workflow + update: true + +- name: Make sure the VM has started + become: false + community.proxmox.proxmox_kvm: + validate_certs: false + node: proxmox-server + api_user: root@pam + api_host: 192.168.0.2 + api_token_id: ansible + api_token_secret: "{{ proxmox_token_secret }}" + + vmid: 1041 + state: started + +- name: Sleep for 3 minutes to ensure that cloud-init's done its thing + become: false + ansible.builtin.wait_for: + timeout: 180 + delegate_to: localhost + changed_when: false From 9a9bfa7e23c73e59e9fefc6b1042bf079742333c Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Sun, 12 Jul 2026 12:41:37 +0000 Subject: [PATCH 25/30] FEATURE: python virtual environment is used for ansible now --- .gitignore | 5 ++++- requirements.txt | 30 ++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 requirements.txt diff --git a/.gitignore b/.gitignore index e554ece..2ea602c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,6 @@ # ---> Ansible *.retry -inventory/group_vars/secret/ \ No newline at end of file +inventory/group_vars/secret/ + +# Ignore python venv +.venv \ No newline at end of file diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..1d11f18 --- /dev/null +++ b/requirements.txt @@ -0,0 +1,30 @@ +ansible-compat==26.6.0 +ansible-core==2.21.1 +ansible-lint==26.6.0 +attrs==26.1.0 +black==26.5.1 +bracex==3.0 +cffi==2.1.0 +click==8.4.2 +cryptography==49.0.0 +distro==1.9.0 +filelock==3.29.7 +Jinja2==3.1.6 +jsonschema==4.26.0 +jsonschema-specifications==2025.9.1 +MarkupSafe==3.0.3 +mypy_extensions==1.1.0 +packaging==26.2 +pathspec==1.1.1 +platformdirs==4.10.0 +pycparser==3.0 +pytokens==0.4.1 +PyYAML==6.0.3 +referencing==0.37.0 +resolvelib==1.2.1 +rpds-py==2026.6.3 +ruamel.yaml==0.19.1 +ruamel.yaml.clib==0.2.15 +subprocess-tee==0.4.2 +wcmatch==11.0 +yamllint==1.38.0 From d1568586e97a8ce49228ea1fd4112036abdf1647 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Sun, 12 Jul 2026 15:36:55 +0000 Subject: [PATCH 26/30] REFACTOR: files fixed according to ansible-lint --- inventory/group_vars/all/main.yaml | 2 +- .../group_vars/all/secrets template.yaml | 2 +- .../tasks/create_new_user.yaml | 25 ++++++------ roles/basic_postinstall/tasks/main.yaml | 2 +- .../tasks/prepare_ansible_user.yaml | 26 ++++++------ .../tasks/remove_packages.yaml | 20 ++++++---- .../tasks/set_locale_and_time.yaml | 10 ++--- roles/common_healthcheck/tasks/main.yaml | 40 +++++++++++-------- 8 files changed, 69 insertions(+), 58 deletions(-) diff --git a/inventory/group_vars/all/main.yaml b/inventory/group_vars/all/main.yaml index a1632cc..8e4ba15 100644 --- a/inventory/group_vars/all/main.yaml +++ b/inventory/group_vars/all/main.yaml @@ -1,3 +1,3 @@ --- -ansible_become_passwd: "{{ ansible_password }}" \ No newline at end of file +ansible_become_passwd: "{{ ansible_password }}" diff --git a/inventory/group_vars/all/secrets template.yaml b/inventory/group_vars/all/secrets template.yaml index a36dbc8..5fb266d 100644 --- a/inventory/group_vars/all/secrets template.yaml +++ b/inventory/group_vars/all/secrets template.yaml @@ -12,4 +12,4 @@ ntfy_topic_token: t0ken # Home Assistant Webhook token ha_webhook_token: h@_t0ken # Proxmox API token secret -proxmox_token_secret: t0ken_$ecret \ No newline at end of file +proxmox_token_secret: t0ken_$ecret diff --git a/roles/basic_postinstall/tasks/create_new_user.yaml b/roles/basic_postinstall/tasks/create_new_user.yaml index e86d789..8ba891b 100644 --- a/roles/basic_postinstall/tasks/create_new_user.yaml +++ b/roles/basic_postinstall/tasks/create_new_user.yaml @@ -1,7 +1,7 @@ --- - name: Create a new user with a password, set shell remote_user: ansible - user: + ansible.builtin.user: name: max groups: sshusers,sudo password: "{{ user_passwd_hash }}" @@ -12,12 +12,12 @@ ansible.posix.authorized_key: user: max state: present - key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}" + key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}" - name: Copy omz installation wrapper script to the target machine remote_user: ansible - copy: - src: ../files/install_omz.sh + ansible.builtin.copy: + src: "{{ role_path }}/files/install_omz.sh" dest: /home/max/install_omz.sh owner: max group: max @@ -26,13 +26,14 @@ # WARNING: UNPRIVILEGED USER (not ansible) COMMANDS - name: Install oh my zsh remote_user: max - become: no - command: /home/max/install_omz.sh + become: false + ansible.builtin.command: /home/max/install_omz.sh + changed_when: true - name: Configure oh my zsh, by pushing the config file remote_user: ansible - copy: - src: ../files/.zshrc + ansible.builtin.copy: + src: "{{ role_path }}/files/.zshrc" dest: /home/max/.zshrc owner: max group: max @@ -40,8 +41,8 @@ - name: Configure vim, by pushing the config remote_user: ansible - copy: - src: ../files/.vimrc + ansible.builtin.copy: + src: "{{ role_path }}/files/.vimrc" dest: /home/max/.vimrc owner: max group: max @@ -55,11 +56,11 @@ ansible.posix.authorized_key: user: max state: absent - key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}" + key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}" - name: Set authorized key taken from file remote_user: ansible ansible.posix.authorized_key: user: max state: present - key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/max_regular_key.pub') }}" + key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/max_regular_key.pub') }}" diff --git a/roles/basic_postinstall/tasks/main.yaml b/roles/basic_postinstall/tasks/main.yaml index 5114da1..b886049 100644 --- a/roles/basic_postinstall/tasks/main.yaml +++ b/roles/basic_postinstall/tasks/main.yaml @@ -15,4 +15,4 @@ ansible.builtin.include_tasks: create_new_user.yaml - name: Set locale and time - ansible.builtin.include_tasks: set_locale_and_time.yaml \ No newline at end of file + ansible.builtin.include_tasks: set_locale_and_time.yaml diff --git a/roles/basic_postinstall/tasks/prepare_ansible_user.yaml b/roles/basic_postinstall/tasks/prepare_ansible_user.yaml index b44f405..2097ae9 100644 --- a/roles/basic_postinstall/tasks/prepare_ansible_user.yaml +++ b/roles/basic_postinstall/tasks/prepare_ansible_user.yaml @@ -1,20 +1,20 @@ --- ## Installing packages - name: Install sudo on apt systems - when: (ansible_facts['distribution'] == "Debian") or + when: (ansible_facts['distribution'] == "Debian") or (ansible_facts['distribution'] == "Ubuntu") - apt: + ansible.builtin.apt: name: - sudo - update-cache: yes + update-cache: true -- name: Update Alpine packages +# The same commands for Alpine +- name: Update and install packages on Alpine when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk update - -- name: Install sudo package on Alpine - when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk add sudo + community.general.apk: + name: sudo + update_cache: true + remote_user: ansible ## Creating and setting up the ansible user @@ -26,16 +26,16 @@ ## Add the user to sshusers (for ssh access) and sudo (gain root access) - name: Create a new user with a password for Ansible - user: + ansible.builtin.user: name: ansible password: "{{ ansible_user_passwd_hash }}" groups: sshusers,sudo - append: yes + append: true -## Since password authentication in SSH will be disabled, we need to add an authorized key +## Since password authentication in SSH will be disabled, we need to add an authorized key - name: Set authorized key taken from file ansible.posix.authorized_key: user: ansible state: present - key: "{{ ansible_ssh_key }}" \ No newline at end of file + key: "{{ ansible_ssh_key }}" diff --git a/roles/basic_postinstall/tasks/remove_packages.yaml b/roles/basic_postinstall/tasks/remove_packages.yaml index ac5835e..c0116fd 100644 --- a/roles/basic_postinstall/tasks/remove_packages.yaml +++ b/roles/basic_postinstall/tasks/remove_packages.yaml @@ -2,26 +2,30 @@ # Remove multiple packages at once - name: Remove unnecessary packages remote_user: ansible - when: (ansible_facts['distribution'] == "Debian") or + when: (ansible_facts['distribution'] == "Debian") or (ansible_facts['distribution'] == "Ubuntu") - apt: + ansible.builtin.apt: name: - nano state: absent - become: yes + become: true # Clean up all orphaned packages - name: Remove all orphaned dependencies remote_user: ansible - when: (ansible_facts['distribution'] == "Debian") or + when: (ansible_facts['distribution'] == "Debian") or (ansible_facts['distribution'] == "Ubuntu") - apt: - autoremove: yes - purge: yes + ansible.builtin.apt: + autoremove: true + purge: true - name: Install sudo package on Alpine remote_user: ansible when: (ansible_facts['distribution'] == "Alpine") - command: /sbin/apk del nano + community.general.apk: + name: + - nano + state: absent + become: true diff --git a/roles/basic_postinstall/tasks/set_locale_and_time.yaml b/roles/basic_postinstall/tasks/set_locale_and_time.yaml index cffbf2e..37eb4f6 100644 --- a/roles/basic_postinstall/tasks/set_locale_and_time.yaml +++ b/roles/basic_postinstall/tasks/set_locale_and_time.yaml @@ -1,9 +1,9 @@ --- - name: Generate locales - ansible.builtin.locale_gen: + community.general.locale_gen: name: - - en_US.UTF-8 - - ru_RU.UTF-8 + - en_US.UTF-8 + - ru_RU.UTF-8 state: present - name: Set locale @@ -15,5 +15,5 @@ LC_ALL=en_US.UTF-8 - name: Set time - ansible.builtin.timezone: - name: Europe/Samara \ No newline at end of file + community.general.timezone: + name: Europe/Samara diff --git a/roles/common_healthcheck/tasks/main.yaml b/roles/common_healthcheck/tasks/main.yaml index 826a285..e06a136 100644 --- a/roles/common_healthcheck/tasks/main.yaml +++ b/roles/common_healthcheck/tasks/main.yaml @@ -2,14 +2,14 @@ - name: Internet connection test block block: - name: Test reachability to ya.ru - become: yes # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine - shell: ping -c 5 ya.ru > /dev/null + become: true # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine + ansible.builtin.shell: ping -c 5 ya.ru > /dev/null changed_when: false # This task does not change the system - + rescue: - # This won't work for now. CA certificate reissuing is required!git + # This won't work for now. CA certificate reissuing is required! - name: Create a test file - become: no + become: false ansible.builtin.uri: url: "{{ ha_addr }}/api/webhook/{{ ha_webhook_token }}" ca_path: ../files/ca.pem @@ -20,19 +20,25 @@ - name: Disk free space test block block: - name: Test free disk space in root - become: no - shell: df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}' - register: result - failed_when: result.stdout | int > 85 + become: false + ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}' + register: common_healthcheck_result + failed_when: common_healthcheck_result.stdout | int > 1 changed_when: false # This task does not change the system - + rescue: - name: Notify with ntfy - become: no - ansible.builtin.command: | - curl -H "Authorization: Bearer {{ ntfy_topic_token }}" \ - -d "{{ ansible_facts['hostname'] }}: Disk space is low" \ - {{ ntfy_topic }} - delegate_to: 127.0.0.1 - failed_when: false + become: false + ansible.builtin.uri: + url: "{{ ntfy_topic }}" + method: POST + body_format: json + status_code: [200, 202] + return_content: true + headers: + Authorization: "Bearer {{ ntfy_topic_token }}" + body: + - "{{ ansible_facts['hostname'] }}: Disk space is low" + delegate_to: 127.0.0.1 + failed_when: false changed_when: false # This task does not change the system From 37aeddca6ca3544a53b3dfaa86be019af8ac4981 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Sun, 12 Jul 2026 15:54:39 +0000 Subject: [PATCH 27/30] REFACTOR: handlers moved from LXC setting up playbook to harden ssh task --- playbooks/deploy.yaml | 13 +------------ roles/basic_postinstall/tasks/harden_ssh.yaml | 16 ++++++++++++++-- 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index cd5802c..b492713 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -14,15 +14,4 @@ ../inventory/group_vars/all/secrets.yaml vars: ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}" - user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" - - handlers: - - name: restart ssh-server - service: - name: ssh - state: restarted - - - name: restart sshd-server - service: - name: sshd - state: restarted \ No newline at end of file + user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}" \ No newline at end of file diff --git a/roles/basic_postinstall/tasks/harden_ssh.yaml b/roles/basic_postinstall/tasks/harden_ssh.yaml index 2f0a845..a1486dd 100644 --- a/roles/basic_postinstall/tasks/harden_ssh.yaml +++ b/roles/basic_postinstall/tasks/harden_ssh.yaml @@ -5,7 +5,6 @@ src: "{{ role_path }}/files/hardened_sshd.conf" dest: /etc/ssh/sshd_config.d/hardened_sshd.conf mode: u=rw,g=r,o=r - notify: restart ssh-server when: ansible_facts['distribution'] == 'Ubuntu' - name: Configure ssh-server daemon @@ -13,7 +12,6 @@ src: "{{ role_path }}/files/hardened_sshd.conf" dest: /etc/ssh/sshd_config.d/hardened_sshd.conf mode: u=rw,g=r,o=r - notify: restart sshd-server when: ansible_facts['distribution'] == 'Debian' - name: Configure ssh client @@ -22,3 +20,17 @@ src: "{{ role_path }}/files/hardened_ssh.conf" dest: /etc/ssh/ssh_config.d/hardened_ssh.conf mode: u=rw,g=r,o=r + +- name: Restart ssh-server Debian + remote_user: ansible + ansible.builtin.service: + name: sshd + state: restarted + when: ansible_facts['distribution'] == 'Debian' + +- name: Restart ssh-server Ubuntu + remote_user: ansible + ansible.builtin.service: + name: ssh + state: restarted + when: ansible_facts['distribution'] == 'Ubuntu' From 1c0e994bfb94a6f9b90a01029c15f71486d66696 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Sun, 12 Jul 2026 15:56:29 +0000 Subject: [PATCH 28/30] REFACTOR: deploy playbook renamed with deploy_lxc --- playbooks/{deploy.yaml => deploy_lxc.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename playbooks/{deploy.yaml => deploy_lxc.yaml} (100%) diff --git a/playbooks/deploy.yaml b/playbooks/deploy_lxc.yaml similarity index 100% rename from playbooks/deploy.yaml rename to playbooks/deploy_lxc.yaml From f289a3b3bc9665968cf54dd1c98e20a462835a67 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Mon, 13 Jul 2026 07:24:43 +0000 Subject: [PATCH 29/30] MINOR: some minor constants changed --- inventory/hosts.yaml | 2 +- roles/basic_postinstall/tasks/install_basic_utils.yaml | 2 +- roles/common_healthcheck/tasks/main.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/inventory/hosts.yaml b/inventory/hosts.yaml index e56d517..3fd09b0 100644 --- a/inventory/hosts.yaml +++ b/inventory/hosts.yaml @@ -1,5 +1,5 @@ --- physical: hosts: - 192.168.0.40: + 192.168.0.45: ansible_become_password: "{{ ansible_become_passwd }}" diff --git a/roles/basic_postinstall/tasks/install_basic_utils.yaml b/roles/basic_postinstall/tasks/install_basic_utils.yaml index 03a9b37..5a6ed89 100644 --- a/roles/basic_postinstall/tasks/install_basic_utils.yaml +++ b/roles/basic_postinstall/tasks/install_basic_utils.yaml @@ -37,6 +37,6 @@ - name: Update and install packages on Alpine when: (ansible_facts['distribution'] == "Alpine") community.general.apk: - name: vim ranger zsh rsync git curl kitty + name: vim ranger zsh rsync git curl kitty openssh update_cache: true remote_user: ansible diff --git a/roles/common_healthcheck/tasks/main.yaml b/roles/common_healthcheck/tasks/main.yaml index e06a136..6a08e66 100644 --- a/roles/common_healthcheck/tasks/main.yaml +++ b/roles/common_healthcheck/tasks/main.yaml @@ -23,7 +23,7 @@ become: false ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}' register: common_healthcheck_result - failed_when: common_healthcheck_result.stdout | int > 1 + failed_when: common_healthcheck_result.stdout | int > 85 changed_when: false # This task does not change the system rescue: From 6d352d59be4352218eea17d9df3b402bf2749b41 Mon Sep 17 00:00:00 2001 From: Maxim Vershinin Date: Fri, 24 Jul 2026 12:23:51 +0000 Subject: [PATCH 30/30] Default LXC image was changed to the golden image --- roles/basic_proxmox_lxc/tasks/main.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/basic_proxmox_lxc/tasks/main.yaml b/roles/basic_proxmox_lxc/tasks/main.yaml index d5033dc..f5a96d6 100644 --- a/roles/basic_proxmox_lxc/tasks/main.yaml +++ b/roles/basic_proxmox_lxc/tasks/main.yaml @@ -14,7 +14,8 @@ vmid: 1040 password: ansible-test hostname: "ansible-test" - ostemplate: 'main:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst' + # ostemplate: 'main:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst' + ostemplate: 'main:vztmpl/debian-13-golden-image.tar.gz' memory: 2048 cores: 5 state: present