Files

T

ml 6115d9d48f Set up repo structure and implement base role

- Document architecture decisions in README (Ansible + Docker Compose + Traefik)
- Scaffold Ansible layout: inventory, site.yml, group_vars, 9 service roles
- Implement base role: package install, deploy user, SSH hardening,
  UFW firewall (22/80/443), fail2ban, unattended-upgrades
- Add reinstall runbook in docs/runbook.md
- Add ansible/requirements.yml for community.general and ansible.posix

2026-06-27 15:02:21 +02:00

2.0 KiB

Raw Blame History

Reinstall Runbook

Follow these steps to provision a fresh server from scratch.

Prerequisites

On your local machine:

Ansible installed (pip install ansible)
SSH access to the server as root using keys/root_cloud_ladkau_de

Steps

1. Install Ansible collections

From the repo root:

ansible-galaxy collection install -r ansible/requirements.yml

Required collections:

community.general — ufw, timezone modules
ansible.posix — authorized_key module

Connect as root and verify the server is reachable:

ssh -i keys/root_cloud_ladkau_de root@217.154.207.148

3. Create the deploy user (one-time, manual)

On the server as root:

adduser deploy
usermod -aG sudo deploy
mkdir -p /home/deploy/.ssh
cat >> /home/deploy/.ssh/authorized_keys <<'EOF'
<paste contents of keys/notroot_cloud_ladkau_de.pub>
EOF
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

4. Run the Ansible master playbook

From the repo root:

ansible-playbook -i ansible/inventory.ini ansible/site.yml

This runs all roles in order:

base — OS hardening, SSH config, ufw firewall
docker — Docker Engine + Compose plugin
traefik — reverse proxy, TLS via Let's Encrypt
gitea — self-hosted Git
nextcloud — file storage
sso — Single Sign-On
mail — mail server
registry — container registry
k8s — k3s node

5. DNS

Ensure the following DNS A records point to 217.154.207.148 before running:

cloud.ladkau.de
gitea.ladkau.de
nextcloud.ladkau.de
sso.ladkau.de
mail.ladkau.de
cr.ladkau.de
k8s.ladkau.de

Traefik will attempt ACME certificate issuance on first start; DNS must resolve first.

Re-running after changes

The playbook is idempotent. To apply a single role only:

ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags <role>

2.0 KiB Raw Blame History