76 lines
2.1 KiB
YAML
76 lines
2.1 KiB
YAML
---
|
|
- name: Preparation
|
|
hosts: vpn
|
|
pre_tasks:
|
|
- name: Verify only one embassy
|
|
ansible.builtin.assert:
|
|
that: >
|
|
groups['embassy'] | length == 1 and
|
|
groups['vpn_server'] | length == 1 and
|
|
groups['vpn_server'] | intersect(groups['embassy']) | length == 1
|
|
msg: Expected only one embassy host
|
|
- name: Verify ipv6_subnet is set
|
|
when: inventory_hostname == groups['embassy'][0]
|
|
ansible.builtin.assert:
|
|
that: ipv6_subnet is defined
|
|
msg: >
|
|
Expected ipv6_subnet to be defined.
|
|
This should have been done in Terraform or otherwise.
|
|
tasks:
|
|
# As mentioned in the other file, if I set this statically on group_vars,
|
|
# things seem to break.
|
|
- set_fact:
|
|
public_ipv6_subnet: "{{ hostvars[groups['embassy'][0]].ipv6_subnet }}"
|
|
|
|
- name: Prepare embassy
|
|
hosts: embassy
|
|
become: true
|
|
tasks:
|
|
- name: Disable password-based authentication
|
|
lineinfile:
|
|
path: "/etc/ssh/sshd_config"
|
|
regexp: '^()PasswordAuthentication yes()$'
|
|
line: 'PasswordAuthentication no'
|
|
register: passwordauthentication
|
|
|
|
- name: Enable public key authentication in SSH
|
|
lineinfile:
|
|
path: "/etc/ssh/sshd_config"
|
|
regexp: '^()PubkeyAuthentication()$'
|
|
line: 'PubkeyAuthentication yes'
|
|
register: publickeyauthentication
|
|
|
|
- name: Restart SSH
|
|
service:
|
|
name: ssh
|
|
state: restarted
|
|
when: passwordauthentication.changed or publickeyauthentication.changed
|
|
|
|
- name: Set up VPN
|
|
hosts: vpn
|
|
become: true
|
|
roles:
|
|
- githubixx.ansible_role_wireguard
|
|
|
|
# - name: Install wings
|
|
# hosts: moirai_wings
|
|
# remote_user: ubuntu
|
|
# # Don't forget to create a new disk if creating new wings. This is
|
|
# # purposefully manual to give more fine-grained control
|
|
# vars:
|
|
# pv_disks:
|
|
# - /dev/sda
|
|
# vg_name: vg1
|
|
# lv_name: pvs
|
|
# lv_size: +100%FREE
|
|
# fs_type: ext4
|
|
# mount_path: /var/lib/pterodactyl
|
|
# extra_docker_daemon_options: |
|
|
# "dns": ["10.0.123.123"],
|
|
# roles:
|
|
# - dns-client
|
|
# - lvm
|
|
# - docker
|
|
# - wings
|
|
|