Repository: matteodcr/vps
Pull request #1: feat: ssh config playbook
Author: login: matteodcr
Created: 2025-05-08T19:16:20Z | Merged: 2025-05-11T20:03:35Z



Diff:
diff --git a/ansible/playbooks/base-setup.yml b/ansible/playbooks/base-setup.yml
deleted file mode 100644
index d745f71..0000000
--- a/ansible/playbooks/base-setup.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-- name: Update APT package index
-  hosts: all
-  become: true
-
-  tasks:
-    - name: Update the APT package index
-      ansible.builtin.apt:
-        update_cache: true
diff --git a/ansible/playbooks/ssh-setup.yml b/ansible/playbooks/ssh-setup.yml
new file mode 100644
index 0000000..ee15c68
--- /dev/null
+++ b/ansible/playbooks/ssh-setup.yml
@@ -0,0 +1,165 @@
+---
+- name: Update APT package index
+  hosts: all
+  become: true
+
+  tasks:
+    - name: Update the APT package index
+      ansible.builtin.apt:
+        update_cache: true
+
+- name: Configuration SSH
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Change port SSH
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?Port'
+        line: "Port {{ ssh_port }}"
+      notify: Restart SSH
+
+    - name: Disable root login with SSH
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PermitRootLogin'
+        line: 'PermitRootLogin no'
+      notify: Restart SSH 
+
+  handlers:
+    - name: Restart SSH
+      service:
+        name: ssh
+        state: restarted
+
+
+- name: Install UFW
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Install UFW package
+      apt:
+        name: ufw
+        state: present
+
+- name: Configure firewall UFW
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Allow SSH
+      ufw:
+        rule: allow
+        port: "{{ ssh_port }}"
+        proto: tcp
+
+    - name: Allow HTTP
+      ufw:
+        rule: allow
+        port: 80
+        proto: tcp
+
+    - name: Allow HTTPS
+      ufw:
+        rule: allow
+        port: 443
+        proto: tcp
+
+    - name: Default deny policy
+      ufw:
+        state: enabled
+        policy: deny
+
+- name: Install Fail2Ban
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Install Fail2Ban
+      apt:
+        name: fail2ban
+        state: present
+        update_cache: yes
+
+- name: Configure Fail2Ban for SSH
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Configure jail.local
+      copy:
+        dest: /etc/fail2ban/jail.local
+        content: |
+          [DEFAULT]
+          bantime = 3600
+          findtime = 300
+          maxretry = 10
+          backend = systemd
+          destemail = {{ fail2ban_mail }}
+          action = %(action_mwl)s
+
+          [sshd]
+          enabled = true
+          port = {{ ssh_port }}
+          logpath = %(sshd_log)s
+          backend = systemd
+      notify: Restart Fail2Ban
+
+  handlers:
+    - name: Restart Fail2Ban
+      service:
+        name: fail2ban
+        state: restarted
+
+
+- name: Create SSH users
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+  
+  tasks:
+    - name: Create user
+      user:
+        name: "{{ item.username }}"
+        state: present
+        shell: /bin/bash
+        create_home: yes
+      with_items: "{{ users }}"
+    
+    - name: Create .ssh file
+      file:
+        path: "/home/{{ item.username }}/.ssh"
+        state: directory
+        owner: "{{ item.username }}"
+        group: "{{ item.username }}"
+        mode: '0700'
+      with_items: "{{ users }}"
+
+    - name: Add SSH key
+      authorized_key:
+        user: "{{ item.username }}"
+        state: present
+        key: "{{ item.ssh_key }}"
+      with_items: "{{ users }}"
+
+    - name: Set admin (optional)
+      user:
+        name: "{{ item.username }}"
+        groups: "{{ admin_group }}"
+        append: yes
+      with_items: "{{ users }}"
+
+    - name: No password access (optional)
+      user:
+        name: "{{ item.username }}"
+        password: 'fromage'
+      with_items: "{{ users }}"
\ No newline at end of file
diff --git a/ansible/playbooks/vault-vars.yml b/ansible/playbooks/vault-vars.yml
new file mode 100644
index 0000000..00ff6da
--- /dev/null
+++ b/ansible/playbooks/vault-vars.yml
@@ -0,0 +1,16 @@
+$ANSIBLE_VAULT;1.1;AES256
+39343037633839303963333031303865316262316333663038356439663239656161373837366438
+3432616365383865356364316239663866363865306162660a613766613839383533653435313838
+61366333336136653737636136333238393331656537373662393361346232356331616637326131
+3035376537643831640a366234393230386265623539643232616661343734303836366539343630
+31393432353038326137656465323135386231653335373462373338393631643235393434656664
+34393836663436653738316130356166363535346561393264303466353566363933333130636538
+37373665646361663231363536303261663561306131393735393131623137636165313865616634
+64353538326136643331323330366238306638373436376636636233333735376361333733623939
+65663762303164373930623833366534356463656532633335633165323762313161353261323333
+64316561386330333166383636363435373435303138303930646336653034326162623563373235
+65656162393464363236643337316637383666353039396234383738386639323566623530636535
+30383934336639633738306266363565666364656162626663376461663463393432336365373565
+62316539636364663862316261356461643530306539343261316138336238616633353063386132
+34616465306166383863306366366233656134613236656664613432393230643563313834646430
+356632323764623837643635343264313139


Reviews:
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

This pull request adds a new SSH configuration playbook along with supplementary tasks to configure the firewall (UFW) and Fail2Ban, and to manage SSH user accounts, while replacing an existing base setup playbook.
- Adds an encrypted vault vars file for storing sensitive data.
- Introduces a comprehensive playbook (ssh-setup.yml) to configure SSH, firewall, and Fail2Ban.
- Removes the older base-setup playbook.

### Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

| File                                 | Description                                                |
| ------------------------------------ | ---------------------------------------------------------- |
| ansible/playbooks/vault-vars.yml     | Added vault variables as an encrypted file.              |
| ansible/playbooks/ssh-setup.yml      | New playbook covering SSH configuration, firewall, Fail2Ban configuration, and SSH user management. |
| ansible/playbooks/base-setup.yml     | Removed redundant base setup playbook.                     |




state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-08T19:17:20Z
user: login: LonyRd
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-05-11T20:03:25Z

Review comments:
diff_hunk: @@ -0,0 +1,165 @@
+---
+- name: Update APT package index
+  hosts: all
+  become: true
+
+  tasks:
+    - name: Update the APT package index
+      ansible.builtin.apt:
+        update_cache: true
+
+- name: Configuration SSH
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Change port SSH
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?Port'
+        line: "Port {{ ssh_port }}"
+      notify: Restart SSH
+
+    - name: Disable root login with SSH
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PermitRootLogin'
+        line: 'PermitRootLogin no'
+      notify: Restart SSH 
+
+  handlers:
+    - name: Restart SSH
+      service:
+        name: ssh
+        state: restarted
+
+
+- name: Install UFW
+  hosts: all
+  become: yes
+
+  tasks:
+    - name:
path: ansible/playbooks/ssh-setup.yml
user: login: Copilot
body: The task at line 44 is missing a descriptive name. Please provide a meaningful name to improve clarity and maintainability.
```suggestion
    - name: Install UFW package
```
created_at: 2025-05-08T19:17:19Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,165 @@
+---
+- name: Update APT package index
+  hosts: all
+  become: true
+
+  tasks:
+    - name: Update the APT package index
+      ansible.builtin.apt:
+        update_cache: true
+
+- name: Configuration SSH
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Change port SSH
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?Port'
+        line: "Port {{ ssh_port }}"
+      notify: Restart SSH
+
+    - name: Disable root login with SSH
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PermitRootLogin'
+        line: 'PermitRootLogin no'
+      notify: Restart SSH 
+
+  handlers:
+    - name: Restart SSH
+      service:
+        name: ssh
+        state: restarted
+
+
+- name: Install UFW
+  hosts: all
+  become: yes
+
+  tasks:
+    - name:
+      apt:
+        name: ufw
+        state: present
+
+- name: Configure firewall UFW
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Allow SSH
+      ufw:
+        rule: allow
+        port: "{{ ssh_port }}"
+        proto: tcp
+
+    - name: Allow HTTP
+      ufw:
+        rule: allow
+        port: 80
+        proto: tcp
+
+    - name: Allow HTTPS
+      ufw:
+        rule: allow
+        port: 443
+        proto: tcp
+
+    - name: Default deny policy
+      ufw:
+        state: enabled
+        policy: deny
+
+- name: Install Fail2Ban
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Installer Fail2Ban
path: ansible/playbooks/ssh-setup.yml
user: login: Copilot
body: The task name 'Installer Fail2Ban' appears to be a typo. Consider changing it to 'Install Fail2Ban' for clarity.
```suggestion
    - name: Install Fail2Ban
```
created_at: 2025-05-08T19:17:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,165 @@
+---
+- name: Update APT package index
+  hosts: all
+  become: true
+
+  tasks:
+    - name: Update the APT package index
+      ansible.builtin.apt:
+        update_cache: true
+
+- name: Configuration SSH
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Change port SSH
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?Port'
+        line: "Port {{ ssh_port }}"
+      notify: Restart SSH
+
+    - name: Disable root login with SSH
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PermitRootLogin'
+        line: 'PermitRootLogin no'
+      notify: Restart SSH 
+
+  handlers:
+    - name: Restart SSH
+      service:
+        name: ssh
+        state: restarted
+
+
+- name: Install UFW
+  hosts: all
+  become: yes
+
+  tasks:
+    - name:
+      apt:
+        name: ufw
+        state: present
+
+- name: Configure firewall UFW
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Allow SSH
+      ufw:
+        rule: allow
+        port: "{{ ssh_port }}"
+        proto: tcp
+
+    - name: Allow HTTP
+      ufw:
+        rule: allow
+        port: 80
+        proto: tcp
+
+    - name: Allow HTTPS
+      ufw:
+        rule: allow
+        port: 443
+        proto: tcp
+
+    - name: Default deny policy
+      ufw:
+        state: enabled
+        policy: deny
+
+- name: Install Fail2Ban
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Installer Fail2Ban
+      apt:
+        name: fail2ban
+        state: present
+        update_cache: yes
+
+- name: Configure Fail2Ban for SSH
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Configure jail.local
+      copy:
+        dest: /etc/fail2ban/jail.local
+        content: |
+          [DEFAULT]
+          bantime = 3600
+          findtime = 300
+          maxretry = 10
+          backend = systemd
+          destemail = {{ fail2ban_mail }}
+          action = %(action_mwl)s
+
+          [sshd]
+          enabled = true
+          port = {{ ssh_port }}
+          logpath = %(sshd_log)s
+          backend = systemd
+      notify: Restart Fail2Ban
+
+  handlers:
+    - name: Restart Fail2Ban
+      service:
+        name: fail2ban
+        state: restarted
+
+
+- name: Create SSH users
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+  
+  tasks:
+    - name: Create user
+      user:
+        name: "{{ item.username }}"
+        state: present
+        shell: /bin/bash
+        create_home: yes
+      with_items: "{{ users }}"
+    
+    - name: Create .ssh file
+      file:
+        path: "/home/{{ item.username }}/.ssh"
+        state: directory
+        owner: "{{ item.username }}"
+        group: "{{ item.username }}"
+        mode: '0700'
+      with_items: "{{ users }}"
+
+    - name: Add SSH key
+      authorized_key:
+        user: "{{ item.username }}"
+        state: present
+        key: "{{ item.ssh_key }}"
+      with_items: "{{ users }}"
+
+    - name: Set admin (optionnal)
+      user:
+        name: "{{ item.username }}"
+        groups: "{{ admin_group }}"
+        append: yes
+      with_items: "{{ users }}"
+
+    - name: No password access (optionnal)
path: ansible/playbooks/ssh-setup.yml
user: login: Copilot
body: The word 'optionnal' is misspelled. Please change it to 'optional' in the task name.
```suggestion
    - name: Set admin (optional)
      user:
        name: "{{ item.username }}"
        groups: "{{ admin_group }}"
        append: yes
      with_items: "{{ users }}"

    - name: No password access (optional)
```
created_at: 2025-05-08T19:17:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,165 @@
+---
+- name: Update APT package index
+  hosts: all
+  become: true
+
+  tasks:
+    - name: Update the APT package index
+      ansible.builtin.apt:
+        update_cache: true
+
+- name: Configuration SSH
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Change port SSH
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?Port'
+        line: "Port {{ ssh_port }}"
+      notify: Restart SSH
+
+    - name: Disable root login with SSH
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PermitRootLogin'
+        line: 'PermitRootLogin no'
+      notify: Restart SSH 
+
+  handlers:
+    - name: Restart SSH
+      service:
+        name: ssh
+        state: restarted
+
+
+- name: Install UFW
+  hosts: all
+  become: yes
+
+  tasks:
+    - name:
+      apt:
+        name: ufw
+        state: present
+
+- name: Configure firewall UFW
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Allow SSH
+      ufw:
+        rule: allow
+        port: "{{ ssh_port }}"
+        proto: tcp
+
+    - name: Allow HTTP
+      ufw:
+        rule: allow
+        port: 80
+        proto: tcp
+
+    - name: Allow HTTPS
+      ufw:
+        rule: allow
+        port: 443
+        proto: tcp
+
+    - name: Default deny policy
+      ufw:
+        state: enabled
+        policy: deny
+
+- name: Install Fail2Ban
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Installer Fail2Ban
+      apt:
+        name: fail2ban
+        state: present
+        update_cache: yes
+
+- name: Configure Fail2Ban for SSH
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+
+  tasks:
+    - name: Configure jail.local
+      copy:
+        dest: /etc/fail2ban/jail.local
+        content: |
+          [DEFAULT]
+          bantime = 3600
+          findtime = 300
+          maxretry = 10
+          backend = systemd
+          destemail = {{ fail2ban_mail }}
+          action = %(action_mwl)s
+
+          [sshd]
+          enabled = true
+          port = {{ ssh_port }}
+          logpath = %(sshd_log)s
+          backend = systemd
+      notify: Restart Fail2Ban
+
+  handlers:
+    - name: Restart Fail2Ban
+      service:
+        name: fail2ban
+        state: restarted
+
+
+- name: Create SSH users
+  hosts: all
+  become: yes
+  vars_files:
+    - vault-vars.yml
+  
+  tasks:
+    - name: Create user
+      user:
+        name: "{{ item.username }}"
+        state: present
+        shell: /bin/bash
+        create_home: yes
+      with_items: "{{ users }}"
+    
+    - name: Create .ssh file
+      file:
+        path: "/home/{{ item.username }}/.ssh"
+        state: directory
+        owner: "{{ item.username }}"
+        group: "{{ item.username }}"
+        mode: '0700'
+      with_items: "{{ users }}"
+
+    - name: Add SSH key
+      authorized_key:
+        user: "{{ item.username }}"
+        state: present
+        key: "{{ item.ssh_key }}"
+      with_items: "{{ users }}"
+
+    - name: Set admin (optionnal)
+      user:
+        name: "{{ item.username }}"
+        groups: "{{ admin_group }}"
+        append: yes
+      with_items: "{{ users }}"
+
+    - name: No password access (optionnal)
path: ansible/playbooks/ssh-setup.yml
user: login: Copilot
body: The word 'optionnal' is misspelled. Please change it to 'optional' in the task name.
```suggestion
    - name: Set admin (optional)
      user:
        name: "{{ item.username }}"
        groups: "{{ admin_group }}"
        append: yes
      with_items: "{{ users }}"

    - name: No password access (optional)
```
created_at: 2025-05-08T19:17:20Z
author_association: CONTRIBUTOR

PR comments:
user: login: matteodcr
created_at: 2025-05-10T01:42:02Z
body: @LonyRd Normalement c'est bon ;) Je te te laisse squash and merge.
author_association: OWNER
user: login: Jasonzon
created_at: 2025-05-10T17:47:18Z
body: 👍
author_association: NONE