ml
6115d9d48f
- Document architecture decisions in README (Ansible + Docker Compose + Traefik) - Scaffold Ansible layout: inventory, site.yml, group_vars, 9 service roles - Implement base role: package install, deploy user, SSH hardening, UFW firewall (22/80/443), fail2ban, unattended-upgrades - Add reinstall runbook in docs/runbook.md - Add ansible/requirements.yml for community.general and ansible.posix
24 lines
453 B
Django/Jinja
24 lines
453 B
Django/Jinja
# Managed by Ansible — do not edit manually
|
|
Port 22
|
|
Protocol 2
|
|
|
|
# Authentication
|
|
PermitRootLogin no
|
|
PasswordAuthentication no
|
|
ChallengeResponseAuthentication no
|
|
PubkeyAuthentication yes
|
|
AuthorizedKeysFile .ssh/authorized_keys
|
|
|
|
# Only allow the deploy user over SSH
|
|
AllowUsers {{ deploy_user }}
|
|
|
|
# Misc hardening
|
|
X11Forwarding no
|
|
PrintMotd no
|
|
MaxAuthTries 3
|
|
LoginGraceTime 30
|
|
|
|
UsePAM yes
|
|
AcceptEnv LANG LC_*
|
|
Subsystem sftp /usr/lib/openssh/sftp-server
|