125 lines
2.5 KiB
YAML
125 lines
2.5 KiB
YAML
---
|
|
- name: Install baseline packages
|
|
apt:
|
|
name:
|
|
- nftables
|
|
- nginx
|
|
- fail2ban
|
|
- jq
|
|
- curl
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Ensure directories
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop:
|
|
- /etc/nftables.d
|
|
- /etc/edge
|
|
- /var/www/letsencrypt
|
|
|
|
- name: Deploy nftables edge policy
|
|
copy:
|
|
src: "nftables/edge.nft"
|
|
dest: "/etc/nftables.d/edge.nft"
|
|
mode: "0644"
|
|
|
|
- name: Ensure nftables.conf includes /etc/nftables.d/*.nft
|
|
lineinfile:
|
|
path: /etc/nftables.conf
|
|
line: 'include "/etc/nftables.d/*.nft"'
|
|
create: true
|
|
|
|
- name: Enable and apply nftables
|
|
systemd:
|
|
name: nftables
|
|
enabled: true
|
|
state: restarted
|
|
|
|
- name: Deploy nginx site
|
|
copy:
|
|
src: "nginx/erplibre.conf"
|
|
dest: "/etc/nginx/sites-available/erplibre.conf"
|
|
mode: "0644"
|
|
|
|
- name: Enable nginx site
|
|
file:
|
|
src: /etc/nginx/sites-available/erplibre.conf
|
|
dest: /etc/nginx/sites-enabled/erplibre.conf
|
|
state: link
|
|
force: true
|
|
|
|
- name: Remove default nginx site if present
|
|
file:
|
|
path: /etc/nginx/sites-enabled/default
|
|
state: absent
|
|
|
|
- name: Test nginx configuration
|
|
command: nginx -t
|
|
changed_when: false
|
|
|
|
- name: Reload nginx
|
|
systemd:
|
|
name: nginx
|
|
state: reloaded
|
|
enabled: true
|
|
|
|
- name: Deploy fail2ban jail
|
|
copy:
|
|
src: "fail2ban/jail.local"
|
|
dest: "/etc/fail2ban/jail.d/erplibre.local"
|
|
mode: "0644"
|
|
|
|
- name: Deploy fail2ban filters
|
|
copy:
|
|
src: "fail2ban/filters/"
|
|
dest: "/etc/fail2ban/filter.d/"
|
|
mode: "0644"
|
|
|
|
- name: Restart fail2ban
|
|
systemd:
|
|
name: fail2ban
|
|
state: restarted
|
|
enabled: true
|
|
|
|
- name: Deploy ASN mitigation script and lists
|
|
copy:
|
|
src: "asn-mitigation/update-asn-ttl-blocklist.sh"
|
|
dest: "/usr/local/sbin/update-asn-ttl-blocklist.sh"
|
|
mode: "0750"
|
|
|
|
- name: Deploy ASN deny/allow lists (templates)
|
|
copy:
|
|
src: "asn-mitigation/{{ item }}"
|
|
dest: "/etc/edge/{{ item }}"
|
|
mode: "0644"
|
|
loop:
|
|
- asn-denylist.txt
|
|
- asn-allowlist-v4.txt
|
|
|
|
- name: Deploy systemd units for ASN timer
|
|
copy:
|
|
src: "asn-mitigation/{{ item }}"
|
|
dest: "/etc/systemd/system/{{ item }}"
|
|
mode: "0644"
|
|
loop:
|
|
- asn-ttl-blocklist.service
|
|
- asn-ttl-blocklist.timer
|
|
|
|
- name: systemd daemon-reload
|
|
systemd:
|
|
daemon_reload: true
|
|
|
|
- name: Enable ASN timer
|
|
systemd:
|
|
name: asn-ttl-blocklist.timer
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Deploy logrotate rule
|
|
copy:
|
|
src: "logrotate/nginx-erplibre"
|
|
dest: "/etc/logrotate.d/nginx-erplibre"
|
|
mode: "0644"
|