103 lines
2.5 KiB
YAML
103 lines
2.5 KiB
YAML
---
|
|
# Bootstrap remote Debian host for Veza V5 Ultra deployment
|
|
# Ensures python3, sudo, and essential tools are available
|
|
|
|
- name: Bootstrap Debian host for Veza deployment
|
|
hosts: edge
|
|
gather_facts: false
|
|
become: true
|
|
|
|
pre_tasks:
|
|
- name: Install essential packages
|
|
raw: |
|
|
apt-get update && apt-get install -y \
|
|
python3 \
|
|
python3-pip \
|
|
sudo \
|
|
curl \
|
|
gnupg \
|
|
net-tools \
|
|
ca-certificates \
|
|
apt-transport-https \
|
|
lsb-release \
|
|
wget \
|
|
unzip \
|
|
git \
|
|
vim \
|
|
htop \
|
|
iotop \
|
|
nethogs
|
|
|
|
- name: Ensure python3 is available
|
|
raw: which python3
|
|
register: python3_check
|
|
failed_when: false
|
|
|
|
- name: Create symlink for python if needed
|
|
raw: ln -sf /usr/bin/python3 /usr/bin/python
|
|
when: python3_check.rc != 0
|
|
|
|
- name: Install additional packages
|
|
raw: |
|
|
apt-get install -y \
|
|
python3-pip \
|
|
python3-venv \
|
|
snapd
|
|
|
|
- name: Ensure user has sudo access
|
|
raw: |
|
|
if ! grep -q "senke ALL=(ALL) NOPASSWD:ALL" /etc/sudoers.d/senke; then
|
|
echo "senke ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/senke
|
|
chmod 440 /etc/sudoers.d/senke
|
|
fi
|
|
|
|
- name: Configure SSH for better performance
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
state: present
|
|
loop:
|
|
- { regexp: "^#?ClientAliveInterval", line: "ClientAliveInterval 60" }
|
|
- { regexp: "^#?ClientAliveCountMax", line: "ClientAliveCountMax 3" }
|
|
- { regexp: "^#?TCPKeepAlive", line: "TCPKeepAlive yes" }
|
|
notify: restart ssh
|
|
|
|
- name: Ensure SSH service is enabled and running
|
|
systemd:
|
|
name: ssh
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Install UFW
|
|
apt:
|
|
name: ufw
|
|
state: present
|
|
|
|
- name: Configure firewall for Veza ports
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- "22" # SSH
|
|
- "80" # HTTP
|
|
- "443" # HTTPS
|
|
- "8080" # Backend API
|
|
- "8081" # Chat WebSocket
|
|
- "8082" # Stream HLS
|
|
|
|
- name: Enable UFW
|
|
community.general.ufw:
|
|
state: enabled
|
|
policy: deny
|
|
|
|
handlers:
|
|
- name: restart ssh
|
|
systemd:
|
|
name: ssh
|
|
state: restarted
|
|
|
|
post_tasks:
|
|
- name: Test connectivity
|
|
ping:
|