brainsys base configuration

This role sets up a base configuration for servers, including locales, timezone, time synchronization, standard packages, SSH hardening, and Python utilities. It handles differences between Debian versions (e.g., NTP vs systemd-timesyncd, Python venv management).

Supported Platforms

• Debian 10+ (Buster, Bullseye, Bookworm, Trixie...)

Features & Details

1. Locales & Timezone

• Sets locale to fr_FR.UTF-8.
• Sets timezone to Europe/Paris (customizable).
• Configures NTP:
  • Debian < 13: Installs ntp package.
  • Debian >= 13: Installs and enables systemd-timesyncd.

2. Standard Packages

Installs a set of essential tools including:

• bash-completion, curl, git-core, htop, iotop, ncdu, rsync, screen, tmux, vim, net-tools, telnet, sudo, etc.

3. Python Utilities (ps_mem, bpytop)

Installs ps_mem and bpytop.

• Debian < 12: Installed globally via pip3.
• Debian >= 12: Installed in a dedicated virtual environment at /opt/python/venv/brainsys. Binaries are symlinked to /usr/local/bin.

4. Needrestart (Debian only)

Installs and configures needrestart to automatically restart services after upgrades.

• Sets auto-restart mode.
• Allows defining exclusions via variables (see below).

5. SSH Configuration

• Hardens SSH root login:
  • PermitRootLogin set to no by default.
  • Allows prohibit-password login only from specific IP addresses defined in variables (see below).
• Manages /root/.ssh/authorized_keys with a list of keys (see below).

Role Variables

Variable	Description	Default
timezone	System timezone to configure.	Europe/Paris
needrestart_exclude	List of services to exclude from needrestart checks (keys in perl hash format).	[]
ssh_root_authorized_ips	List of IP addresses allowed to SSH as root (with key only).	undefined
ssh_root_authorized_keys	List of public keys to add to /root/.ssh/authorized_keys. Warning: Overwrites file.	undefined
ssh_root_authorized_keys_file	Custom path for the authorized_keys file destination.	/root/.ssh/authorized_keys

Usage Example

- hosts: servers
  roles:
    - role: base
      vars:
        timezone: "Etc/UTC"
        needrestart_exclude:
          - mysql
          - postgresql
        ssh_root_authorized_ips:
          - "192.168.1.10"
          - "10.0.0.5"
        ssh_root_authorized_keys:
          - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA..."
          - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA..."

License

MIT

Author Information

Written by Ludovic Cartier ludovic.cartier@brainsys.io