jack
85a5857a5f
- Add 2 new Timeweb VPS (1vCPU/2GB/30GB, 550₽/мес each): visual-tools 85.193.83.9 — Outline, Uptime Kuma visual-mon 188.225.79.34 — Grafana, Prometheus, Loki, AlertManager - Restructure hosts.ini into groups: [main] [tools] [mon] [all_servers] - Update bootstrap.yml to target all_servers group - Fix vault.yml: replace invalid YAML escape \$ with single-quoted string in vault_authelia_admin_password_hash (caused YAML parse error) Budget: ~1000 + 550 + 550 = 2100₽/мес (well within 3000₽ limit) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
51 lines
1.2 KiB
YAML
51 lines
1.2 KiB
YAML
---
|
|
# First-run playbook executed as root before deploy user exists
|
|
# ansible-playbook playbooks/bootstrap.yml -u root
|
|
- name: Bootstrap server
|
|
hosts: all_servers
|
|
become: false
|
|
remote_user: root
|
|
|
|
tasks:
|
|
- name: Update apt cache
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
- name: Install essential packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- python3
|
|
- python3-pip
|
|
- sudo
|
|
- curl
|
|
- git
|
|
state: present
|
|
|
|
- name: Create deploy group
|
|
ansible.builtin.group:
|
|
name: deploy
|
|
state: present
|
|
|
|
- name: Create deploy user
|
|
ansible.builtin.user:
|
|
name: deploy
|
|
group: deploy
|
|
groups: sudo
|
|
shell: /bin/bash
|
|
create_home: true
|
|
state: present
|
|
|
|
- name: Set up authorized keys for deploy user
|
|
ansible.posix.authorized_key:
|
|
user: deploy
|
|
state: present
|
|
key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}"
|
|
|
|
- name: Allow deploy user passwordless sudo
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/sudoers.d/deploy
|
|
line: "deploy ALL=(ALL) NOPASSWD:ALL"
|
|
create: true
|
|
mode: "0440"
|
|
validate: "visudo -cf %s"
|