History

Tobias Petrich 0141bce9ee add wait for network		2024-08-24 18:53:04 +02:00
..
my_service_templates	add wait for network	2024-08-24 18:53:04 +02:00
rootless-podman-service	initial commit	2024-07-15 16:03:01 +02:00
traefik_config	initial commit	2024-07-15 16:03:01 +02:00
allow_privileged_ports_rootless.yml	initial commit	2024-07-15 16:03:01 +02:00
custom_hardening.yml	initial commit	2024-07-15 16:03:01 +02:00
deploy_services.yml	initial commit	2024-07-15 16:03:01 +02:00
deploy_traefik_config.yml	initial commit	2024-07-15 16:03:01 +02:00
hardening.yml	initial commit	2024-07-15 16:03:01 +02:00
README.md	initial commit	2024-07-15 16:03:01 +02:00

Ansible MicroOS VM setup

ansible-galaxy collection install devsec.hardening

Create the inventory.txt file for the server
Run the hardening playbook. Does not run completely through because of MicroOS immutability. At some point, a PR properly supporting MicroOS could be opened to https://github.com/dev-sec/ansible-os-hardening

ansible-playbook -i inventory.txt hardening.yml

Run the custom_hardening playbook. This mostly sets SSH parameters to best practice values.

ansible-playbook -i inventory.txt custom_hardening.yml

Run the allow_privileged_ports_rootless playbook. This allows a rootless traefik container to use ports 80 and 443.

ansible-playbook -i inventory.txt allow_privileged_ports_rootless.yml

Run the deploy_services playbook. This creates groups and users for each service, creates a btrfs subvolume for data and copies the quadlet files to the correct location, then activates the service.

ansible-playbook -i inventory.txt deploy_services.yml

Run the deploy_traefik_config playbool. This copies the traefik configuration to the correct location.

ansible-playbook -i inventory.txt deploy_traefik_config.yml