136 lines
3.1 KiB
YAML
136 lines
3.1 KiB
YAML
|
#code: language=ansible
|
||
|
|
|
||
|
|
- name: Disable link local addressing
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
backrefs: false
|
||
|
|
backup: true
|
||
|
|
create: false
|
||
|
|
encoding: "utf-8"
|
||
|
|
firstmatch: true
|
||
|
|
group: root
|
||
|
|
insertafter: '^\[Network\]\s*$'
|
||
|
|
line: "LinkLocalAddressing=no"
|
||
|
|
mode: "0664"
|
||
|
|
owner: root
|
||
|
|
path: "/etc/systemd/network/10-cloud-init-eth0.network"
|
||
|
|
regexp: '^LinkLocalAddressing\s*=.*$'
|
||
|
|
state: present
|
||
|
|
notify:
|
||
|
|
- Restart systemd-networkd
|
||
|
|
|
||
|
|
- name: Set link wait-online requirements
|
||
|
|
ansible.builtin.blockinfile:
|
||
|
|
append_newline: true
|
||
|
|
backup: true
|
||
|
|
block: |
|
||
|
|
[Link]
|
||
|
|
ActivationPolicy=always-up
|
||
|
|
RequiredForOnline=yes
|
||
|
|
RequiredFamilyForOnline=both
|
||
|
|
create: false
|
||
|
|
group: root
|
||
|
|
insertbefore: '^\[Network\]\s*$'
|
||
|
|
mode: "0664"
|
||
|
|
owner: root
|
||
|
|
path: "/etc/systemd/network/10-cloud-init-eth0.network"
|
||
|
|
prepend_newline: true
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: Disable global systemd-networkd-wait-online
|
||
|
|
ansible.builtin.systemd_service:
|
||
|
|
enabled: false
|
||
|
|
name: systemd-networkd-wait-online.service
|
||
|
|
scope: system
|
||
|
|
state: stopped
|
||
|
|
|
||
|
|
- name: Enable instantiated systemd-networkd-wait-online
|
||
|
|
ansible.builtin.systemd_service:
|
||
|
|
enabled: true
|
||
|
|
name: systemd-networkd-wait-online@eth0.service
|
||
|
|
scope: system
|
||
|
|
state: started
|
||
|
|
|
||
|
|
- name: Create sshd.service override directory
|
||
|
|
ansible.builtin.file:
|
||
|
|
group: root
|
||
|
|
mode: "0775"
|
||
|
|
owner: root
|
||
|
|
path: /etc/systemd/system/sshd.service.d
|
||
|
|
state: directory
|
||
|
|
|
||
|
|
- name: Create sshd.service override config
|
||
|
|
ansible.builtin.copy:
|
||
|
|
dest: /etc/systemd/system/sshd.service.d/sshd_override.conf
|
||
|
|
group: root
|
||
|
|
mode: "0664"
|
||
|
|
owner: root
|
||
|
|
remote_src: false
|
||
|
|
src: "{{ role_path }}/files/sshd_override.conf"
|
||
|
|
notify:
|
||
|
|
- Restart sshd
|
||
|
|
|
||
|
|
- name: Configure sshd_config
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
backrefs: false
|
||
|
|
create: true
|
||
|
|
encoding: "utf-8"
|
||
|
|
firstmatch: false
|
||
|
|
group: root
|
||
|
|
line: "{{ item.line }}"
|
||
|
|
mode: "0664"
|
||
|
|
owner: root
|
||
|
|
path: "/etc/ssh/sshd_config"
|
||
|
|
regexp: "{{ item.pattern }}"
|
||
|
|
state: present
|
||
|
|
loop: "{{ sshd_config_lines }}"
|
||
|
|
loop_control:
|
||
|
|
label: "{{ item.label }}"
|
||
|
|
notify:
|
||
|
|
- Restart sshd
|
||
|
|
|
||
|
|
- name: Install UFW
|
||
|
|
community.general.pacman:
|
||
|
|
name:
|
||
|
|
- ufw
|
||
|
|
state: present
|
||
|
|
update_cache: true
|
||
|
|
|
||
|
|
- name: Configure UFW IPv4 rules
|
||
|
|
community.general.ufw:
|
||
|
|
comment: "{{ item.comment }}"
|
||
|
|
direction: "in"
|
||
|
|
from_ip: "{{ item.source }}"
|
||
|
|
log: true
|
||
|
|
proto: tcp
|
||
|
|
rule: "allow"
|
||
|
|
to_ip: "{{ ipv4_address }}"
|
||
|
|
to_port: "22"
|
||
|
|
loop: "{{ sshd_ufw_ipv4_rules }}"
|
||
|
|
loop_control:
|
||
|
|
label: "{{ item.comment }}"
|
||
|
|
|
||
|
|
- name: Configure UFW IPv6 rules
|
||
|
|
community.general.ufw:
|
||
|
|
comment: "{{ item.comment }}"
|
||
|
|
direction: "in"
|
||
|
|
from_ip: "{{ item.source }}"
|
||
|
|
log: true
|
||
|
|
proto: tcp
|
||
|
|
rule: "allow"
|
||
|
|
to_ip: "{{ ipv6_address }}"
|
||
|
|
to_port: "22"
|
||
|
|
loop: "{{ sshd_ufw_ipv6_rules }}"
|
||
|
|
loop_control:
|
||
|
|
label: "{{ item.comment }}"
|
||
|
|
|
||
|
|
- name: Enable UFW
|
||
|
|
community.general.ufw:
|
||
|
|
state: enabled
|
||
|
|
|
||
|
|
- name: Enable and start UFW service
|
||
|
|
ansible.builtin.systemd_service:
|
||
|
|
enabled: true
|
||
|
|
name: ufw.service
|
||
|
|
scope: system
|
||
|
|
state: started
|