You've already forked base
Ludovic Cartier
82 lines
2.8 KiB
Markdown
82 lines
2.8 KiB
Markdown
brainsys base configuration
|
|
===========================
|
|
|
|
This role sets up a base configuration for servers, including locales, timezone, time synchronization, standard packages, SSH hardening, and Python utilities. It handles differences between Debian versions (e.g., NTP vs systemd-timesyncd, Python venv management).
|
|
|
|
Supported Platforms
|
|
-------------------
|
|
|
|
- Debian 10+ (Buster, Bullseye, Bookworm, Trixie...)
|
|
|
|
Features & Details
|
|
------------------
|
|
|
|
### 1. Locales & Timezone
|
|
- Sets locale to `fr_FR.UTF-8`.
|
|
- Sets timezone to `Europe/Paris` (customizable).
|
|
- Configures NTP:
|
|
- **Debian < 13**: Installs `ntp` package.
|
|
- **Debian >= 13**: Installs and enables `systemd-timesyncd`.
|
|
|
|
### 2. Standard Packages
|
|
Installs a set of essential tools including:
|
|
- `bash-completion`, `curl`, `git-core`, `htop`, `iotop`, `ncdu`, `rsync`, `screen`, `tmux`, `vim`, `net-tools`, `telnet`, `sudo`, etc.
|
|
|
|
### 3. Python Utilities (ps_mem, bpytop)
|
|
Installs `ps_mem` and `bpytop`.
|
|
- **Debian < 12**: Installed globally via `pip3`.
|
|
- **Debian >= 12**: Installed in a dedicated virtual environment at `/opt/python/venv/brainsys`. Binaries are symlinked to `/usr/local/bin`.
|
|
|
|
### 4. Needrestart (Debian only)
|
|
Installs and configures `needrestart` to automatically restart services after upgrades.
|
|
- Sets auto-restart mode.
|
|
- Allows defining exclusions via variables (see below).
|
|
|
|
### 5. SSH Configuration
|
|
- Hardens SSH root login:
|
|
- `PermitRootLogin` set to `no` by default.
|
|
- Allows `prohibit-password` login only from specific IP addresses defined in variables (see below).
|
|
- Manages `/root/.ssh/authorized_keys` with a list of keys (see below).
|
|
|
|
Role Variables
|
|
--------------
|
|
|
|
| Variable | Description | Default |
|
|
|----------|-------------|---------|
|
|
| `timezone` | System timezone to configure. | `Europe/Paris` |
|
|
| `needrestart_exclude` | List of services to exclude from needrestart checks (keys in perl hash format). | `[]` |
|
|
| `ssh_root_authorized_ips` | List of IP addresses allowed to SSH as root (with key only). | `undefined` |
|
|
| `ssh_root_authorized_keys` | List of public keys to add to `/root/.ssh/authorized_keys`. **Warning: Overwrites file**. | `undefined` |
|
|
| `ssh_root_authorized_keys_file` | Custom path for the authorized_keys file destination. | `/root/.ssh/authorized_keys` |
|
|
|
|
Usage Example
|
|
-------------
|
|
|
|
```yaml
|
|
- hosts: servers
|
|
roles:
|
|
- role: base
|
|
vars:
|
|
timezone: "Etc/UTC"
|
|
needrestart_exclude:
|
|
- mysql
|
|
- postgresql
|
|
ssh_root_authorized_ips:
|
|
- "192.168.1.10"
|
|
- "10.0.0.5"
|
|
ssh_root_authorized_keys:
|
|
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA..."
|
|
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA..."
|
|
```
|
|
|
|
License
|
|
-------
|
|
|
|
MIT
|
|
|
|
Author Information
|
|
------------------
|
|
|
|
Written by Ludovic Cartier <ludovic.cartier@brainsys.io>
|
|
|