ml
6115d9d48f
- Document architecture decisions in README (Ansible + Docker Compose + Traefik) - Scaffold Ansible layout: inventory, site.yml, group_vars, 9 service roles - Implement base role: package install, deploy user, SSH hardening, UFW firewall (22/80/443), fail2ban, unattended-upgrades - Add reinstall runbook in docs/runbook.md - Add ansible/requirements.yml for community.general and ansible.posix
89 lines
2.0 KiB
Markdown
89 lines
2.0 KiB
Markdown
# Reinstall Runbook
|
|
|
|
Follow these steps to provision a fresh server from scratch.
|
|
|
|
## Prerequisites
|
|
|
|
On your local machine:
|
|
- Ansible installed (`pip install ansible`)
|
|
- SSH access to the server as root using `keys/root_cloud_ladkau_de`
|
|
|
|
## Steps
|
|
|
|
### 1. Install Ansible collections
|
|
|
|
From the repo root:
|
|
|
|
```bash
|
|
ansible-galaxy collection install -r ansible/requirements.yml
|
|
```
|
|
|
|
Required collections:
|
|
- `community.general` — ufw, timezone modules
|
|
- `ansible.posix` — authorized_key module
|
|
|
|
### 2. Initial root login
|
|
|
|
Connect as root and verify the server is reachable:
|
|
|
|
```
|
|
ssh -i keys/root_cloud_ladkau_de root@217.154.207.148
|
|
```
|
|
|
|
### 3. Create the deploy user (one-time, manual)
|
|
|
|
On the server as root:
|
|
|
|
```bash
|
|
adduser deploy
|
|
usermod -aG sudo deploy
|
|
mkdir -p /home/deploy/.ssh
|
|
cat >> /home/deploy/.ssh/authorized_keys <<'EOF'
|
|
<paste contents of keys/notroot_cloud_ladkau_de.pub>
|
|
EOF
|
|
chown -R deploy:deploy /home/deploy/.ssh
|
|
chmod 700 /home/deploy/.ssh
|
|
chmod 600 /home/deploy/.ssh/authorized_keys
|
|
```
|
|
|
|
### 4. Run the Ansible master playbook
|
|
|
|
From the repo root:
|
|
|
|
```bash
|
|
ansible-playbook -i ansible/inventory.ini ansible/site.yml
|
|
```
|
|
|
|
This runs all roles in order:
|
|
1. `base` — OS hardening, SSH config, ufw firewall
|
|
2. `docker` — Docker Engine + Compose plugin
|
|
3. `traefik` — reverse proxy, TLS via Let's Encrypt
|
|
4. `gitea` — self-hosted Git
|
|
5. `nextcloud` — file storage
|
|
6. `sso` — Single Sign-On
|
|
7. `mail` — mail server
|
|
8. `registry` — container registry
|
|
9. `k8s` — k3s node
|
|
|
|
### 5. DNS
|
|
|
|
Ensure the following DNS A records point to `217.154.207.148` before running:
|
|
|
|
- cloud.ladkau.de
|
|
- gitea.ladkau.de
|
|
- nextcloud.ladkau.de
|
|
- sso.ladkau.de
|
|
- mail.ladkau.de
|
|
- cr.ladkau.de
|
|
- k8s.ladkau.de
|
|
|
|
Traefik will attempt ACME certificate issuance on first start; DNS must resolve first.
|
|
|
|
## Re-running after changes
|
|
|
|
The playbook is idempotent. To apply a single role only:
|
|
|
|
```bash
|
|
ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags <role>
|
|
```
|