source: main/waeup-ansible/bootstrap.yml @ 13847

---
# This ansible-playbook prepares fresh-from-hetzner
# servers for work with ansible.
#
# What it does:
#   secures sshd (according to bettercrypto.org)
#   adds accounts uli/henrik/deploy
#   disables root access
#
# This playbook should be executed as first thing
# after getting your hands over new hardware
#
# It will normally be run with ``ask-pass``
#
- hosts: yet-untouched
  vars:
    deploy_user: 'deploy'
    deploy_public_key: "{{ lookup('file', 'files/id-deploy.pub') }}"
  tasks:

    - name: "bootstrap | create 'deploy' user"
      user:
        name="{{ deploy_user }}"
        append=yes
        uid=2222

    - name: "bootstrap | update authorized key of 'deploy'"
      authorized_key:
        user="{{ deploy_user }}"
        key="{{ deploy_public_key }}"

    - name: "bootstrap | grant sudoers perms to 'deploy'"
      lineinfile:
        dest=/etc/sudoers
        insertafter="^root"
        line="{{ deploy_user }}  ALL=(ALL) NOPASSWD{{ ':' }} ALL"
        state=present

    - name: "bootstrap | disable dsa keys in sshd_config"
      lineinfile:
        dest=/etc/ssh/sshd_config
        backrefs=yes
        line='# HostKey /etc/ssh/ssh_host_dsa_key'
        regexp='^HostKey /etc/ssh/ssh_host_dsa_key'
        state=present

    - name: "bootstrap | disable ecdsa keys in sshd_config"
      lineinfile:
        dest=/etc/ssh/sshd_config
        backrefs=yes
        line='# HostKey /etc/ssh/ssh_host_ecdsa_key'
        regexp='^HostKey /etc/ssh/ssh_host_ecdsa_key'
        state=present

    - name: "bootstrap | set key bits in sshd_config to 4096"
      lineinfile:
        dest=/etc/ssh/sshd_config
        backrefs=yes
        line='ServerKeyBits 4096'
        regexp='^ServerKeyBits 1024'
        state=present

    - name: "bootstrap | restart sshd"
      service:
        name="ssh"
        enabled=yes
        state=restarted