jack
fccbd1a45a
Cloudflare DNS-01 ACME: - Switch Traefik cert resolver from httpChallenge to dnsChallenge using Cloudflare provider (resolvers: 1.1.1.1, 1.0.0.1) - Add CLOUDFLARE_DNS_API_TOKEN env to Traefik container - Add CF_ZONE_ID + cloudflare_dns_api_token to all/main.yml - Store API token in Ansible Vault Docker daemon hardening: - Add log-driver: json-file with max-size 10m / max-file 3 (prevents disk fill from unbounded container logs) - Add live-restore: true (containers survive Docker daemon restart) Kernel hardening (sysctl): - New roles/base/tasks/sysctl.yml via ansible.posix.sysctl - IP spoofing protection (rp_filter) - Disable ICMP redirects and broadcast pings - SYN flood protection (syncookies, backlog) - Disable IPv6 (not used) - Restrict kernel pointers and dmesg to root - Disable SysRq, suid core dumps Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
87 lines
2 KiB
YAML
87 lines
2 KiB
YAML
---
|
|
- name: Remove old Docker versions
|
|
ansible.builtin.apt:
|
|
name:
|
|
- docker
|
|
- docker-engine
|
|
- docker.io
|
|
- containerd
|
|
- runc
|
|
state: absent
|
|
purge: true
|
|
|
|
- name: Create keyrings directory
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Add Docker GPG key
|
|
ansible.builtin.get_url:
|
|
url: https://download.docker.com/linux/ubuntu/gpg
|
|
dest: /etc/apt/keyrings/docker.asc
|
|
mode: "0644"
|
|
retries: 5
|
|
delay: 10
|
|
register: gpg_key
|
|
until: gpg_key is succeeded
|
|
|
|
- name: Add Docker repository
|
|
ansible.builtin.apt_repository:
|
|
repo: >-
|
|
deb [arch={{ ansible_facts['architecture'] | replace('x86_64', 'amd64') }}
|
|
signed-by=/etc/apt/keyrings/docker.asc]
|
|
https://download.docker.com/linux/ubuntu
|
|
{{ ansible_facts['distribution_release'] }} stable
|
|
filename: docker
|
|
state: present
|
|
retries: 3
|
|
delay: 10
|
|
register: docker_repo
|
|
until: docker_repo is succeeded
|
|
|
|
- name: Install Docker Engine and Compose plugin
|
|
ansible.builtin.apt:
|
|
name:
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
- docker-compose-plugin
|
|
state: present
|
|
update_cache: true
|
|
retries: 3
|
|
delay: 10
|
|
register: docker_install
|
|
until: docker_install is succeeded
|
|
notify: Restart Docker
|
|
|
|
- name: Configure Docker daemon
|
|
ansible.builtin.copy:
|
|
dest: /etc/docker/daemon.json
|
|
content: |
|
|
{
|
|
"registry-mirrors": [
|
|
"https://dockerhub.timeweb.cloud"
|
|
],
|
|
"log-driver": "json-file",
|
|
"log-opts": {
|
|
"max-size": "10m",
|
|
"max-file": "3"
|
|
},
|
|
"live-restore": true
|
|
}
|
|
mode: "0644"
|
|
notify: Restart Docker
|
|
|
|
- name: Ensure Docker is started and enabled
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Add deploy user to docker group
|
|
ansible.builtin.user:
|
|
name: "{{ deploy_user }}"
|
|
groups: docker
|
|
append: true
|