roles/setup/handlers/main.yml

@@ -8,11 +8,11 @@
 # ===================================================================================================
 
 ---
-- name: apt_update
+- name: Update apt
-  apt:
+  ansible.builtin.apt:
-    update_cache: true
+    update-cache: true
 
-- name: restart_sshd
+- name: Restart sshd
-  service:
+  ansible.builtin.service:
     name: "{{ openssh_service }}"
     state: restarted

roles/setup/tasks/main.yml

@@ -9,16 +9,22 @@
 # ===================================================================================================
 
 ---
-- include_vars: "{{ ansible_distribution }}.yml"
+- name: Include distribution variables
+  ansible.builtin.include_vars: "{{ ansible_distribution }}.yml"
 
 # Setup the ansible user
-- include_tasks: users/ansible.yml
+- name: Create ansible user
-- include_tasks: users/noahk.yml
+  ansible.builtin.include_tasks: users/ansible.yml
+- name: Create usable user
+  ansible.builtin.include_tasks: users/noahk.yml
 
-# Setup the sshd
+  # Setup the sshd
-- include_tasks: system/openssh.yml
+- name: Setup openssh
+  ansible.builtin.include_tasks: system/openssh.yml
 
 # Setup the repositories for Debian based systems
-- include_tasks: software/repositories.yml
+- name: Setup Debian based repositories
+  ansible.builtin.include_tasks: software/repositories.yml
 
-- include_tasks: software/acl.yml
+- name: Install and configure UFW
+  ansible.builtin.include_tasks: software/ufw.yml

roles/setup/tasks/software/acl.yml

@@ -1,15 +0,0 @@
-# ===================================================================================================
-#  ?                                           ABOUT
-#  @author         :  Noah Knegt
-#  @email          :  personal@noahknegt.com
-#  @repo           :  https://git.noahknegt.com/noah.knegt/ansible-automations
-#  @createdOn      :  01-06-2023
-#  @description    :
-# ===================================================================================================
-
----
-- name: Install acl
-  package:
-    name:
-      - acl
-    state: latest

roles/setup/tasks/software/repositories.yml

@@ -9,9 +9,9 @@
 
 ---
 - name: Install aptitude and software-properties-common
-  package:
+  ansible.builtin.package:
     name:
       - aptitude
       - software-properties-common
-    state: latest
+    state: present
   when: ansible_distribution in ["Debian", "Pop!_OS", "Ubuntu"]

roles/setup/tasks/software/ufw.yml

@@ -0,0 +1,47 @@
+# ===================================================================================================
+#  ?                                           ABOUT
+#  @author         :  Noah Knegt
+#  @email          :  personal@noahknegt.com
+#  @repo           :  https://git.noahknegt.com/noah.knegt/ansible-automations
+#  @createdOn      :  01-06-2023
+#  @description    :
+# ===================================================================================================
+
+---
+- name: Install UFW
+  ansible.builtin.package:
+    name: ufw
+    state: present
+
+- name: UFW deny all incoming traffic
+  community.general.ufw:
+    default: deny
+    direction: incoming
+
+- name: UFW allow all outbound traffic
+  community.general.ufw:
+    default: allow
+    direction: outgoing
+
+- name: Allow all access from RFC1918 networks to this host
+  community.general.ufw:
+    direction: incoming
+    rule: allow
+    src: "{{ item }}"
+  loop:
+    - 10.0.0.0/8
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+
+- name: UFW allow default ssh port
+  community.general.ufw:
+    direction: incoming
+    rule: limit
+    port: ssh
+
+- name: UFW allow custom ssh port
+  when: setup_openssh_port is defined
+  community.general.ufw:
+    direction: incoming
+    rule: allow
+    port: "{{ setup_openssh_port }}"

roles/setup/tasks/system/openssh.yml

@@ -9,20 +9,22 @@
 
 ---
 - name: Install or update openssh
-  package:
+  ansible.builtin.package:
-    name: "{{ openssh_package }}"
+    name: "{{ setup_openssh_package }}"
-    state: latest
+    state: present
   notify:
     - restart_sshd
 
-- name: enable ssh daemon
+- name: Enable ssh daemon
-  service:
+  when: inventory_hostname in groups['datacenter']
+  ansible.builtin.service:
     name: "{{ openssh_service }}"
     state: started
     enabled: true
 
-- name: configure sshd
+- name: Configure sshd
-  template:
+  when: inventory_hostname in groups['datacenter']
+  ansible.builtin.template:
     src: sshd_config.j2
     dest: /etc/ssh/sshd_config
     owner: root
@@ -31,10 +33,24 @@
   notify:
     - restart_sshd
 
-- name: copy sshd banner
+- name: Copy sshd banner
-  copy:
+  ansible.builtin.copy:
     src: ssh_banner.net
     dest: /etc/issue.net
     owner: root
     group: root
     mode: 0644
+
+- name: Copy ssh public key
+  ansible.builtin.authorized_key:
+    user: ansible
+    key: "{{ item }}"
+  with_file:
+    - ansible/ansible.pub
+
+- name: Copy ssh public key
+  ansible.builtin.authorized_key:
+    user: noahk
+    key: "{{ item }}"
+  with_file:
+    - noahk/noahk.pub

roles/setup/tasks/users/ansible.yml

@@ -9,12 +9,12 @@
 
 ---
 - name: Add ansible group
-  group:
+  ansible.builtin.group:
     name: ansible
     state: present
 
 - name: Add new ansible user
-  user:
+  ansible.builtin.user:
     name: ansible
     group: ansible
     groups: ansible,{{ sudo_group }}
@@ -23,7 +23,7 @@
     shell: /bin/bash
 
 - name: Add ansible user to sudoers
-  copy:
+  ansible.builtin.copy:
     src: ansible/ansible_sudoers
     dest: /etc/sudoers.d/ansible
     owner: root
@@ -31,18 +31,9 @@
     mode: 0440
 
 - name: Create .ssh directory
-  file:
+  ansible.builtin.file:
     path: /home/ansible/.ssh
     state: directory
     owner: ansible
     group: ansible
     mode: 0700
-  with_items:
-    - dir: /home/ansible/.ssh
-
-- name: Copy ssh public key
-  authorized_key:
-    user: ansible
-    key: "{{ item }}"
-  with_file:
-    - ansible/ansible.pub

roles/setup/tasks/users/noahk.yml

@@ -9,21 +9,21 @@
 
 ---
 - name: Create the group
-  group:
+  ansible.builtin.group:
     name: noahk
     state: present
 
 - name: Create the user
-  user:
+  ansible.builtin.user:
     name: noahk
     group: noahk
-    groups: noahk,{{ sudo_group }}
+    groups: noahk,{{ setup_sudo_group }}
-    password: "{{ noahk_password }}"
+    password: "{{ setup_noahk_password }}"
     state: present
     shell: /bin/bash
 
 - name: Add user to sudoers
-  copy:
+  ansible.builtin.copy:
     src: noahk/noahk_sudoers
     dest: /etc/sudoers.d/noahk
     owner: root
@@ -31,18 +31,9 @@
     mode: 0440
 
 - name: Create .ssh directory
-  file:
+  ansible.builtin.file:
     path: /home/noahk/.ssh
     state: directory
     owner: noahk
     group: noahk
     mode: 0700
-  with_items:
-    - dir: /home/noahk/.ssh
-
-- name: Copy ssh public key
-  authorized_key:
-    user: noahk
-    key: "{{ item }}"
-  with_file:
-    - noahk/noahk.pub

roles/setup/vars/Archlinux.yml

@@ -8,7 +8,7 @@
 # ===================================================================================================
 
 ---
-sudo_group: wheel
+setup_sudo_group: wheel
-openssh_service: sshd
+setup_openssh_service: sshd
-openssh_package: openssh
+setup_openssh_package: openssh
-sftp_path: /usr/lib/ssh/sftp-server
+setup_sftp_path: /usr/lib/ssh/sftp-server

roles/setup/vars/Debian.yml

@@ -8,7 +8,7 @@
 # ===================================================================================================
 
 ---
-sudo_group: sudo
+setup_sudo_group: sudo
-openssh_service: ssh
+setup_openssh_service: ssh
-openssh_package: openssh-server
+setup_openssh_package: openssh-server
-sftp_path: /usr/lib/openssh/sftp-server
+setup_sftp_path: /usr/lib/openssh/sftp-server

roles/setup/vars/Ubuntu.yml

@@ -8,8 +8,7 @@
 # ===================================================================================================
 
 ---
-sudo_group: sudo
+setup_sudo_group: sudo
-openssh_service: ssh
+setup_openssh_service: ssh
-openssh_package: openssh-server
+setup_openssh_package: openssh-server
-sftp_path: /usr/lib/openssh/sftp-server
+setup_sftp_path: /usr/lib/openssh/sftp-server
-ssh_port: 4422

roles/setup/vars/main.yml

@@ -8,5 +8,5 @@
 # ===================================================================================================
 
 ---
-ansible_password: '$6$8eLzx6DNI/aamHAp$ZJK3kpbXDaMDUxuCFzRbbYL78aqdDnRRd1zbQPO2ED.pQQdcuAEnwBI2Vf3a36j7I5ED4STx6TLQnB8RiY3Vw/'
+setup_ansible_password: "$6$8eLzx6DNI/aamHAp$ZJK3kpbXDaMDUxuCFzRbbYL78aqdDnRRd1zbQPO2ED.pQQdcuAEnwBI2Vf3a36j7I5ED4STx6TLQnB8RiY3Vw/"
-noahk_password: '$6$8eLzx6DNI/aamHAp$ZJK3kpbXDaMDUxuCFzRbbYL78aqdDnRRd1zbQPO2ED.pQQdcuAEnwBI2Vf3a36j7I5ED4STx6TLQnB8RiY3Vw/'
+setup_noahk_password: "$6$8eLzx6DNI/aamHAp$ZJK3kpbXDaMDUxuCFzRbbYL78aqdDnRRd1zbQPO2ED.pQQdcuAEnwBI2Vf3a36j7I5ED4STx6TLQnB8RiY3Vw/"