ragleap-ansible

version — loading live from PyPI…

Ansible roles that prepare and harden a fresh Ubuntu server: user, sudo, updates, SSH and firewall. Version 0.1.0 covers the server base only; it does not install k3s, Helm or the charts yet.

pip install ragleap-ansible

Highlights

• ragleap_base: packages, a deploy user with key-only login, passwordless sudo and unattended-upgrades. Tested in a throwaway Ubuntu 22.04 container, run twice, and the second run changes nothing
• Opt-in SSH hardening (ragleap_base_harden_ssh): effective settings checked with sshd -T, idempotent, a bad configuration is rolled back. All in a container; a real key login against a running sshd was not tested
• Opt-in firewall (ragleap_base_enable_firewall): rules and defaults checked in a container, idempotent, and the sshd port is always opened. ufw enable and real enforcement were not tested
• Known limits: Ubuntu 22.04 on x86_64 only; Helm, k3s and installing the charts are not implemented yet; a container cannot run systemd, sshd or a firewall

Quickstart

cp inventory.example.ini inventory.ini   # then list your server under [ragleap_servers]
echo 'ragleap_base_deploy_ssh_public_key: "ssh-ed25519 AAAA... you@host"' > vars.yml
ansible-playbook -i inventory.ini playbooks/bootstrap.yml -e @vars.yml

SSH hardening is off by default, because a mistake can lock you out of the server. Keep one session open while you run it. Pass the key through a vars file or JSON: a plain -e name=value splits at spaces and would cut the key short.