forked from lab-in-a-box/liab-deployments
Michael Hanke
04f2bca104
This is required, because `pyinfra` may call `setfacl` under certain circumstances.
121 lines
2.6 KiB
Python
121 lines
2.6 KiB
Python
#
|
|
# Basic server setup.
|
|
#
|
|
# This deployment is usable, but mostly here as documentation that defined the baseline
|
|
# of a deployment target for other deployment implementations. It takes no parameters.
|
|
#
|
|
# The machine is assumed to have a minimal Debian (12) installation.
|
|
# The details of initial SSH-access are flexible and must be handled
|
|
# via passing global arguments
|
|
#
|
|
# pyinfra inventories/....py deployments/bootstrap_labserver.py --ssh-user root --ssh-password "$(pass ...)"
|
|
#
|
|
|
|
from pyinfra import (
|
|
host,
|
|
)
|
|
from pyinfra.operations import (
|
|
apt,
|
|
files,
|
|
server,
|
|
systemd,
|
|
)
|
|
|
|
server.hostname(
|
|
name='Set hostname',
|
|
hostname=host.name,
|
|
)
|
|
|
|
apt.packages(
|
|
name='Install system packages (no recommends)',
|
|
packages=[
|
|
'etckeeper',
|
|
'rsync',
|
|
'ufw',
|
|
# for pyinfra
|
|
'acl',
|
|
# personal choices
|
|
'htop',
|
|
'mc',
|
|
'ncdu',
|
|
'net-tools',
|
|
'pipx',
|
|
'tig',
|
|
'tree',
|
|
'vim',
|
|
],
|
|
present=True,
|
|
latest=True,
|
|
update=True,
|
|
upgrade=True,
|
|
no_recommends=True,
|
|
)
|
|
|
|
apt.packages(
|
|
name='Install system packages (with recommends)',
|
|
packages=[
|
|
'caddy',
|
|
'fail2ban',
|
|
'git-annex',
|
|
'podman',
|
|
'sudo',
|
|
],
|
|
present=True,
|
|
latest=True,
|
|
update=False,
|
|
upgrade=False,
|
|
no_recommends=False,
|
|
)
|
|
|
|
server.shell(
|
|
name='Configure firewall',
|
|
commands=[
|
|
'ufw allow ssh',
|
|
'ufw allow https',
|
|
'ufw allow www',
|
|
'echo "y" | ufw enable',
|
|
],
|
|
)
|
|
|
|
fail2ban_config = files.block(
|
|
name='Ensure fail2ban uses systemd log',
|
|
path='/etc/fail2ban/jail.d/defaults-debian.conf',
|
|
content='backend = systemd',
|
|
present=True,
|
|
after=True,
|
|
line='^\[sshd\]$'
|
|
)
|
|
|
|
systemd.service(
|
|
name='Apply fail2ban config change',
|
|
service='fail2ban.service',
|
|
running=True,
|
|
restarted=True,
|
|
enabled=True,
|
|
# we are not making this conditional, because we want to ensure the
|
|
# service is up even when the config did not change
|
|
#_if=fail2ban_config.did_change,
|
|
)
|
|
|
|
server.user(
|
|
name='Set up sudo-enabled admin user',
|
|
user='thedude',
|
|
present=True,
|
|
shell='/bin/bash',
|
|
groups=['sudo'],
|
|
# TODO should move into a parameter
|
|
public_keys=[
|
|
'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPZQ2MqvVPThtV/mbLHir5Sv/MRqtNaIwLyrHnSCuS35 mih@meiner',
|
|
],
|
|
# prevent password-based login
|
|
password='!',
|
|
)
|
|
|
|
files.block(
|
|
name='Make sudo ask for the root password',
|
|
path='/etc/sudoers.d/passwd',
|
|
content='Defaults:%sudo rootpw',
|
|
present=True,
|
|
)
|
|
|
|
# TODO disable root login
|