chore: база

src/serverus/playbooks/bootstrap.yml

@@ -0,0 +1,72 @@
+# extravars: login_password, public_key, new_password, ssh_port
+#
+# Порт ssh меняется в два шага, чтобы не потерять сервер:
+# сначала sshd слушает старый и новый порт, после проверки входа по ключу на новом порту старый закрывается.
+
+- name: Prepare fresh server (password login)
+  hosts: target
+  gather_facts: true
+  vars:
+    ansible_password: "{{ login_password }}"
+  tasks:
+    - name: Require Debian 13
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.distribution == 'Debian'
+          - ansible_facts.distribution_major_version == '13'
+        fail_msg: "Supported only Debian 13, got {{ ansible_facts.distribution }} {{ ansible_facts.distribution_version }}"
+
+    - name: Create .ssh directory
+      ansible.builtin.file:
+        path: /root/.ssh
+        state: directory
+        mode: "0700"
+
+    - name: Authorize key
+      ansible.builtin.lineinfile:
+        path: /root/.ssh/authorized_keys
+        line: "{{ public_key }}"
+        create: true
+        mode: "0600"
+
+    - ansible.builtin.import_tasks: tasks/root_password.yml
+
+    - name: Upgrade system
+      ansible.builtin.apt:
+        update_cache: true
+        upgrade: dist
+
+    - ansible.builtin.import_tasks: tasks/firewall.yml
+      vars:
+        firewall_tcp_ports: [ "{{ ansible_port }}", "{{ ssh_port }}" ]
+
+    - ansible.builtin.import_tasks: tasks/sshd.yml
+      vars:
+        sshd_ports: [ "{{ ansible_port }}", "{{ ssh_port }}" ]
+        sshd_keys_only: false
+
+- name: Harden ssh (key login on new port)
+  hosts: target
+  gather_facts: false
+  vars:
+    ansible_port: "{{ ssh_port }}"
+  tasks:
+    - name: Check key login on new port
+      ansible.builtin.wait_for_connection:
+        timeout: 60
+
+    - ansible.builtin.import_tasks: tasks/firewall.yml
+      vars:
+        firewall_tcp_ports: [ "{{ ssh_port }}" ]
+
+    - ansible.builtin.import_tasks: tasks/sshd.yml
+      vars:
+        sshd_ports: [ "{{ ssh_port }}" ]
+        sshd_keys_only: true
+
+    - name: Reset ssh connection
+      ansible.builtin.meta: reset_connection
+
+    - name: Check hardened ssh
+      ansible.builtin.wait_for_connection:
+        timeout: 60

src/serverus/playbooks/facts.yml

@@ -0,0 +1,16 @@
+- name: Collect server facts
+  hosts: target
+  gather_facts: true
+  tasks:
+    - name: Read uname
+      ansible.builtin.command: uname -a
+      register: uname
+      changed_when: false
+
+    - name: Return facts
+      ansible.builtin.set_stats:
+        aggregate: false
+        data:
+          uname: "{{ uname.stdout }}"
+          distribution: "{{ ansible_facts.distribution }}"
+          version: "{{ ansible_facts.distribution_major_version }}"

src/serverus/playbooks/release.yml

@@ -0,0 +1,39 @@
+# extravars: new_password
+- name: Release server to owner
+  hosts: target
+  gather_facts: false
+  tasks:
+    - ansible.builtin.import_tasks: tasks/root_password.yml
+
+    - name: Restore default nftables config
+      ansible.builtin.copy:
+        dest: /etc/nftables.conf
+        mode: "0755"
+        content: |
+          #!/usr/sbin/nft -f
+          flush ruleset
+
+    - name: Flush and disable nftables
+      ansible.builtin.systemd_service:
+        name: nftables
+        enabled: false
+        state: stopped
+
+    - name: Remove sshd drop-in
+      ansible.builtin.file:
+        path: /etc/ssh/sshd_config.d/00-serverus.conf
+        state: absent
+
+    - name: Validate sshd config
+      ansible.builtin.command: /usr/sbin/sshd -t
+      changed_when: false
+
+    - name: Remove authorized keys
+      ansible.builtin.file:
+        path: /root/.ssh/authorized_keys
+        state: absent
+
+    - name: Restart ssh
+      ansible.builtin.systemd_service:
+        name: ssh
+        state: restarted

src/serverus/playbooks/tasks/firewall.yml

@@ -0,0 +1,18 @@
+# vars: firewall_tcp_ports, firewall_udp_ports (optional)
+- name: Install nftables
+  ansible.builtin.apt:
+    name: nftables
+    state: present
+
+- name: Write nftables config
+  ansible.builtin.template:
+    src: templates/nftables.conf.j2
+    dest: /etc/nftables.conf
+    mode: "0755"
+    validate: /usr/sbin/nft -c -f %s
+
+- name: Apply nftables
+  ansible.builtin.systemd_service:
+    name: nftables
+    enabled: true
+    state: restarted

src/serverus/playbooks/tasks/root_password.yml

@@ -0,0 +1,6 @@
+# vars: new_password
+- name: Set root password
+  ansible.builtin.shell: chpasswd
+  args:
+    stdin: "root:{{ new_password }}"
+  no_log: true

src/serverus/playbooks/tasks/sshd.yml

@@ -0,0 +1,16 @@
+# vars: sshd_ports, sshd_keys_only
+- name: Write sshd drop-in
+  ansible.builtin.template:
+    src: templates/sshd.conf.j2
+    dest: /etc/ssh/sshd_config.d/00-serverus.conf
+    mode: "0644"
+    validate: /usr/sbin/sshd -t -f %s
+
+- name: Validate full sshd config
+  ansible.builtin.command: /usr/sbin/sshd -t
+  changed_when: false
+
+- name: Restart ssh
+  ansible.builtin.systemd_service:
+    name: ssh
+    state: restarted

src/serverus/playbooks/templates/nftables.conf.j2

@@ -0,0 +1,28 @@
+#!/usr/sbin/nft -f
+# {{ ansible_managed }}
+
+flush ruleset
+
+table inet filter {
+	chain input {
+		type filter hook input priority filter; policy drop;
+
+		iif "lo" accept
+		ct state established,related accept
+		ct state invalid drop
+		meta l4proto { icmp, ipv6-icmp } accept
+
+		tcp dport { {{ firewall_tcp_ports | join(', ') }} } accept
+{% if firewall_udp_ports | default([]) %}
+		udp dport { {{ firewall_udp_ports | join(', ') }} } accept
+{% endif %}
+	}
+
+	chain forward {
+		type filter hook forward priority filter; policy drop;
+	}
+
+	chain output {
+		type filter hook output priority filter; policy accept;
+	}
+}

src/serverus/playbooks/templates/sshd.conf.j2

@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+# Удаление этого файла возвращает настройки ssh, которые были до serverus.
+{% for port in sshd_ports %}
+Port {{ port }}
+{% endfor %}
+{% if sshd_keys_only %}
+PermitRootLogin prohibit-password
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+AuthenticationMethods publickey
+{% endif %}