migrate

2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
@@ -0,0 +1,143 @@
+- hosts: all
+  gather_facts: yes
+  become: yes
+  tasks:
+    ################## SSH and Security Configuration ##################
+    - name: Set SSH configuration permissions
+      file:
+        path: /etc/ssh/sshd_config
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Backup original SSH configuration file (if not exists)
+      copy:
+        src: /etc/ssh/sshd_config
+        dest: /etc/ssh/sshd_config.bak
+        owner: root
+        group: root
+        mode: '0600'
+        remote_src: yes
+        force: no
+
+    - name: Remove undesired PermitRootLogin and PasswordAuthentication lines
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^(?!#).*PermitRootLogin.*$|^(?!#).*PasswordAuthentication.*$|^(?!#).*PermitEmptyPasswords.*$'
+        state: absent
+
+    - name: Apply consolidated SSH config settings
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^(#)?{{ item.key }}"
+        line: "{{ item.key }} {{ item.value }}"
+        state: present
+      loop:
+        - { key: "PermitRootLogin", value: "no" }
+        - { key: "PasswordAuthentication", value: "no" }
+        - { key: "PermitEmptyPasswords", value: "no" }
+        - { key: "AllowUsers", value: "miker" }
+        - { key: "Protocol", value: "2" }
+        - { key: "PubkeyAuthentication", value: "yes" }
+        - { key: "Ciphers", value: "aes256-ctr,aes192-ctr,aes128-ctr" }
+        - { key: "KexAlgorithms", value: "curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256" }
+        - { key: "LoginGraceTime", value: "30" }
+        - { key: "X11Forwarding", value: "no" }
+        - { key: "AllowTcpForwarding", value: "no" }
+        - { key: "PermitUserEnvironment", value: "no" }
+
+    - name: Restart sshd to apply changes
+      systemd:
+        name: sshd
+        state: restarted
+
+    - name: Setup passwordless sudo for sudo group
+      lineinfile:
+        path: /etc/sudoers
+        state: present
+        regexp: '^%sudo'
+        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
+        validate: '/usr/sbin/visudo -cf %s'
+
+    ################## System Package Management ##################
+    - name: Update apt cache and upgrade all packages
+      apt:
+        update_cache: yes
+        upgrade: dist
+        force_apt_get: yes
+
+    - name: Enable removal of unused dependencies in unattended-upgrades
+      lineinfile:
+        path: /etc/apt/apt.conf.d/50unattended-upgrades
+        regexp: '^Unattended-Upgrade::Remove-Unused-Dependencies'
+        line: 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
+        state: present
+        create: yes
+
+    - name: Enable auto updates via debconf
+      debconf:
+        name: unattended-upgrades
+        question: unattended-upgrades/enable_auto_updates
+        vtype: boolean
+        value: 'true'
+
+    - name: Install unattended-upgrades package
+      apt:
+        name: unattended-upgrades
+        state: latest
+
+    - name: Run dpkg reconfigure for unattended-upgrades
+      command:
+        cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
+        creates: /etc/apt/apt.conf.d/20auto-upgrades
+
+    ################## Install and Configure Fail2ban ##################
+    - name: Install required system packages including fail2ban
+      apt:
+        name:
+          - curl
+          - wget
+          - git
+          - unattended-upgrades
+          - qemu-guest-agent
+          - fail2ban
+        state: latest
+        update_cache: yes
+
+    - name: Setup fail2ban jail.local for sshd
+      copy:
+        dest: /etc/fail2ban/jail.d/sshd.local
+        content: |
+          [sshd]
+          enabled = true
+          port = ssh
+          filter = sshd
+          logpath = /var/log/auth.log
+          maxretry = 3
+          bantime = 600
+          ignoreip = 127.0.0.1/8 ::1
+          action = iptables-multiport
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Restart fail2ban service
+      systemd:
+        name: fail2ban
+        state: restarted
+
+    ################## Kernel Update & Reboot ##################
+    - name: Check for pending reboot
+      stat:
+        path: /var/run/reboot-required
+      register: reboot_required_file
+
+    - name: Reboot if kernel updated
+      reboot:
+        msg: "Reboot initiated by Ansible for kernel updates"
+        connect_timeout: 5
+        reboot_timeout: 300
+        pre_reboot_delay: 0
+        post_reboot_delay: 30
+        test_command: uptime
+      when: reboot_required_file.stat.exists