210 lines
5.1 KiB
YAML
210 lines
5.1 KiB
YAML
---
|
|
# VPS Scaleway : point d'entree public
|
|
# - Hardening Debian
|
|
# - WireGuard (tunnel vers gateway homelab)
|
|
# - Caddy (reverse proxy + TLS Let's Encrypt)
|
|
|
|
- name: Configuration VPS
|
|
hosts: vps
|
|
become: true
|
|
|
|
vars:
|
|
wg_vps_private_key: "{{ vault_wg_vps_private_key }}"
|
|
wg_gateway_public_key: "{{ vault_wg_gateway_public_key }}"
|
|
|
|
tasks:
|
|
# -- Hardening de base --
|
|
- name: Mise a jour des paquets
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
upgrade: dist
|
|
tags: [base]
|
|
|
|
- name: Installation paquets utilitaires
|
|
ansible.builtin.apt:
|
|
name:
|
|
- vim
|
|
- curl
|
|
- wget
|
|
- ufw
|
|
- wireguard
|
|
- python3
|
|
state: present
|
|
tags: [base]
|
|
|
|
- name: Creation utilisateur {{ admin_user }}
|
|
ansible.builtin.user:
|
|
name: "{{ admin_user }}"
|
|
groups: sudo
|
|
shell: /bin/bash
|
|
create_home: true
|
|
password: "{{ vault_admin_password | password_hash('sha512') }}"
|
|
state: present
|
|
tags: [base]
|
|
|
|
- name: Cle SSH pour {{ admin_user }}
|
|
ansible.posix.authorized_key:
|
|
user: "{{ admin_user }}"
|
|
key: "{{ lookup('file', '~/.ssh/homelab.pub') }}"
|
|
state: present
|
|
tags: [base]
|
|
|
|
- name: Sudo sans mot de passe pour sudo group
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/sudoers.d/sudo-nopasswd
|
|
line: "%sudo ALL=(ALL) NOPASSWD: ALL"
|
|
create: true
|
|
mode: "0440"
|
|
validate: "visudo -cf %s"
|
|
tags: [base]
|
|
|
|
- name: Desactiver login root SSH
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PermitRootLogin"
|
|
line: "PermitRootLogin no"
|
|
notify: restart sshd
|
|
tags: [base]
|
|
|
|
- name: Desactiver auth par mot de passe SSH
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^#?PasswordAuthentication"
|
|
line: "PasswordAuthentication no"
|
|
notify: restart sshd
|
|
tags: [base]
|
|
|
|
# -- Firewall UFW --
|
|
- name: Autoriser SSH
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "22"
|
|
proto: tcp
|
|
tags: [firewall]
|
|
|
|
- name: Autoriser HTTP
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "80"
|
|
proto: tcp
|
|
tags: [firewall]
|
|
|
|
- name: Autoriser HTTPS
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "443"
|
|
proto: tcp
|
|
tags: [firewall]
|
|
|
|
- name: Autoriser WireGuard
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "51820"
|
|
proto: udp
|
|
tags: [firewall]
|
|
|
|
- name: Activer UFW
|
|
community.general.ufw:
|
|
state: enabled
|
|
policy: deny
|
|
tags: [firewall]
|
|
|
|
# -- WireGuard --
|
|
- name: Activation IP forwarding
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: "1"
|
|
sysctl_set: true
|
|
reload: true
|
|
tags: [wireguard]
|
|
|
|
- name: Creation repertoire WireGuard
|
|
ansible.builtin.file:
|
|
path: /etc/wireguard
|
|
state: directory
|
|
mode: "0700"
|
|
tags: [wireguard]
|
|
|
|
- name: Deploiement config WireGuard VPS
|
|
ansible.builtin.template:
|
|
src: wg0-vps.conf.j2
|
|
dest: /etc/wireguard/wg0.conf
|
|
mode: "0600"
|
|
notify: restart wireguard
|
|
tags: [wireguard]
|
|
|
|
- name: Activation WireGuard au boot
|
|
ansible.builtin.systemd:
|
|
name: wg-quick@wg0
|
|
state: started
|
|
enabled: true
|
|
tags: [wireguard]
|
|
|
|
# -- Caddy --
|
|
- name: Installation des prerequis Caddy
|
|
ansible.builtin.apt:
|
|
name:
|
|
- debian-keyring
|
|
- debian-archive-keyring
|
|
- apt-transport-https
|
|
state: present
|
|
tags: [caddy]
|
|
|
|
- name: Ajout cle GPG Caddy
|
|
ansible.builtin.shell: |
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
|
|
| gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
|
args:
|
|
creates: /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
|
tags: [caddy]
|
|
|
|
- name: Ajout repo Caddy
|
|
ansible.builtin.shell: |
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
|
|
| tee /etc/apt/sources.list.d/caddy-stable.list
|
|
args:
|
|
creates: /etc/apt/sources.list.d/caddy-stable.list
|
|
notify: apt update
|
|
tags: [caddy]
|
|
|
|
- name: Installation Caddy
|
|
ansible.builtin.apt:
|
|
name: caddy
|
|
state: present
|
|
update_cache: true
|
|
tags: [caddy]
|
|
|
|
- name: Deploiement Caddyfile
|
|
ansible.builtin.template:
|
|
src: Caddyfile-vps.j2
|
|
dest: /etc/caddy/Caddyfile
|
|
mode: "0644"
|
|
notify: restart caddy
|
|
tags: [caddy]
|
|
|
|
- name: Activation Caddy
|
|
ansible.builtin.systemd:
|
|
name: caddy
|
|
state: started
|
|
enabled: true
|
|
tags: [caddy]
|
|
|
|
handlers:
|
|
- name: restart sshd
|
|
ansible.builtin.systemd:
|
|
name: sshd
|
|
state: restarted
|
|
|
|
- name: restart wireguard
|
|
ansible.builtin.systemd:
|
|
name: wg-quick@wg0
|
|
state: restarted
|
|
|
|
- name: restart caddy
|
|
ansible.builtin.systemd:
|
|
name: caddy
|
|
state: restarted
|
|
|
|
- name: apt update
|
|
ansible.builtin.apt:
|
|
update_cache: true
|