Traditionally, when a new host was provisioned, several playbooks were usually needed to configure things like monitoring and backups. needed. This playbook repository serves the purpose of unifying this the changes needed on most new hosts. It uses to following roles to achieve this task:

ansible-sshd forked from Thomas Sjögren et al.
ansible-fail2ban forked from Robert Debock
ansible-unattended-upgrades forked from Jan Vlnas et al.
ansible-fsfe-backup contained in this repository
ansible-fsfe-monitoring contained in this repository
ansible-fsfe-baseconfig contained in this repository

Security

This playbook repository contains secrets that are encrypted using the Ansible vault. The passphrase to decrypt the vault lives in the GPG-encrypted file vault_passphrase.gpg. If you need access to the encrypted parts of this playbook or you want to be able to encrypt variables whilst setting up a new host, simply create an issue in this repository and we will review your request.

Install

You need a host that runs at least Debian 10 and an up-to-date version of our inventory, the latter of which can be attained by running:

git clone --recurse-submodules git@git.fsfe.org:fsfe-system-hackers/baseline.git

or when you have already cloned the repository without recursing into submodules:

git submodule update --remote inventory

To use this repository to provision a new host, you need to activate the virtual environment using pipenv which you can install via pip or your favourite package manager. Then, simply run

Next, you obviously need Ansible (at least version 2.10). The easiest way to install Ansible is pipx. After installing it, you can simply run:

pipx install --include-deps ansible

Usage

In order to configure a new host, you need to do the following:

Apply the label baseline to the desired host in the inventory.
Add a host configuration file in host_vars. Take a look at this example to get an idea.
Then, simply run

ansible-playbook playbook.yml

If you just want to run certain parts of the playbook, take a look at the available tags and then simply limit the playbook run tasks with those tags.

ansible-playbook playbook.yml -t hardening

Available tags are:

hardening
sshd
fail2ban
unattended-upgrades
monitoring
backup
baseconfig

Example: add/change configuration of client monitoring

In order to add a new server to the monitoring, or update it's client plugins, and including the necessary change on the monitoring server, run:

ansible-playbook playbook.yml -l example.fsfeurope.org -t monitoring

You won't have to define the icinga2 server, the playbook integrates it on its own.

Also read the detailed wiki entry on how to add a new server to the monitoring and adding client plugins if you're interested.

Gotchas

Note that if you run this for multiple servers at once, please add -f 1 as a parameter. Otherwise, rewriting the authorized_keys file that happens during backup initialisation on the remote storage might cause issues if accessed by multiple processes at once.

Configuration

To configure the behaviour of the roles for the host in question take a look at group_vars/all.yml. This file specifies the default configuration for our hosts.

If you want to change those variables for a new host, say example.fsfeurope.org, simply copy the relevant entries from above to the relevant file in host_vars (e.g. example.fsfeurope.org.yml) and amend them as you see fit. For more information on which variables take precedence over others, refer to Ansible documentation