Base system.

7 files changed, 357 insertions, 0 deletions

diff --git a/tasks/apt.yml b/tasks/apt.yml
new file mode 100644
index 0000000..1023908
--- /dev/null
+++ b/tasks/apt.yml
@@ -0,0 +1,46 @@
+- name: Install various APT tools (1)
+  apt: pkg={{ packages }}
+  vars:
+    packages:
+    - apt
+    - lsb-release
+
+- name: Remove /etc/apt/sources.list
+  file: path=/etc/apt/sources.list state=absent
+  notify:
+    - apt-get update
+
+- name: Remove /etc/apt/sources.list.d/hetzner-*
+  file: path={{ item }} state=absent
+  with_fileglob: /etc/apt/sources.list.d/hetzner-*
+  notify:
+    - apt-get update
+
+- name: Copy /etc/apt/sources.list.d/debian.sources
+  template: src=etc/apt/sources.list.d/debian.sources.j2
+            dest=/etc/apt/sources.list.d/debian.sources
+            owner=root group=root
+            mode=0644
+  notify:
+    - apt-get update
+
+- name: Remove /etc/apt/apt.conf.d/*hetzner
+  file: path={{ item }} state=absent
+  with_fileglob: /etc/apt/apt.conf.d/*hetzner
+
+# We should run 'apt-get update' before proceeding to any other task.
+- meta: flush_handlers
+
+- name: Install various APT tools (2)
+  apt: pkg={{ packages }}
+  vars:
+    packages:
+    - apt-listchanges
+    - needrestart
+    - unattended-upgrades
+
+- name: Configure apt-listchanges
+  copy: src=etc/apt/listchanges.conf
+        dest=/etc/apt/listchanges.conf
+        owner=root group=root
+        mode=0644
diff --git a/tasks/base.yml b/tasks/base.yml
new file mode 100644
index 0000000..7086ce9
--- /dev/null
+++ b/tasks/base.yml
@@ -0,0 +1,141 @@
+- name: Remove some packages
+  apt: pkg={{ packages }} state=absent purge=yes
+  vars:
+    packages:
+    - aptitude
+    - byobu
+    - at
+    - bc
+    - cryptsetup*
+    - mdadm
+    - netcat-traditional
+    - nano
+    - emacs-*
+    - hc-utils
+    - shorewall
+    - iptables
+    - lvm2
+    - dosfstools
+    - eatmydata
+    - acpid
+    - acl
+    - fdisk
+    - gdisk
+    - genisoimage
+    - gnupg*
+    - gpg-wks-*
+    - mtr-tiny
+    - net-tools
+    - mtr-tiny
+    - net-tools
+    - xfsprogs
+    - traceroute
+    - wget
+    - python3-lib2to3
+    - efibootmgr
+    - busybox
+    - console-setup
+    - debconf-i18n
+    - dmidecode
+    - task-*
+    - tasksel-*
+    - inetutils-telnet
+    - os-prober
+    ##
+    - chkrootkit
+    - debian-faq
+    - debian-handbook
+    - debian-policy
+    - debian-reference
+    - doc-debian
+    - iamerican
+    - ibritish
+    - ienglish-common
+    - installation-report
+    - laptop-detect
+    - lynx
+    - manpages-de
+    - mutt
+    - reportbug
+    - rkhunter
+    - vnstati
+    - wmanx
+    - python3-reportbug
+    - python3-debianbts
+    - locales-all
+    ##
+    - wamerican
+    - wamerican-huge
+    - wamerican-insane
+    - wamerican-large
+    - wamerican-small
+    - wbrazilian
+    - wbritish
+    - wbritish-huge
+    - wbritish-insane
+    - wbritish-large
+    - wbritish-small
+    - wbulgarian
+    - wcanadian
+    - wcanadian-huge
+    - wcanadian-insane
+    - wcanadian-large
+    - wcanadian-small
+    - wcatalan
+    - wdanish
+    - wdutch
+    - wfaroese
+    - wfrench
+    - wgaelic
+    - wgalician-minimos
+    - wgerman-medical
+    - wirish
+    - witalian
+    - wngerman
+    - wnorwegian
+    - wogerman
+    - wpolish
+    - wportuguese
+    - wspanish
+    - wswedish
+    - wswiss
+    - wukrainian
+    - xauth
+
+- name: Install some common packages
+  apt: pkg={{ packages }}
+  vars:
+    packages:
+        - bind9-dnsutils
+        - bzip2
+        - htop
+        - ca-certificates
+        - rsync
+        - python3
+        - less
+        - iproute2
+        - git
+        - curl
+        - screen
+        - sudo
+        - vim-nox
+        - qemu-guest-agent
+        # Useful for `getent passwd dynamic_user`
+        - libnss-systemd
+
+- name: Set /etc/timezone
+  copy: dest=/etc/timezone content="Europe/Stockholm\n"
+        owner=root group=root
+        mode=0644
+
+- name: Remove ~root/.ssh/authorized_keys
+  file: path=/root/.ssh/authorized_keys state=absent
+
+- name: Disable root password
+  user: name=root password="!" update_password=always
+
+- name: Set RESUME=none in initramfs.conf
+  copy: dest=/etc/initramfs-tools/conf.d/resume content="RESUME=none\n"
+        owner=root group=root
+        mode=0644
+  notify: Update initramfs
diff --git a/tasks/firewall.yml b/tasks/firewall.yml
new file mode 100644
index 0000000..fa46ade
--- /dev/null
+++ b/tasks/firewall.yml
@@ -0,0 +1,13 @@
+- name: Install nftables
+  apt: pkg=nftables
+
+- name: Configure nftables
+  copy: src=etc/nftables.conf
+        dest=/etc/nftables
+        owner=root group=root
+        mode=0644
+  notify:
+    - Restart nftables
+
+- name: Start nftables
+  service: name=nftables.service enabled=true state=started
diff --git a/tasks/hosts.yml b/tasks/hosts.yml
new file mode 100644
index 0000000..b8e5931
--- /dev/null
+++ b/tasks/hosts.yml
@@ -0,0 +1,31 @@
+- name: Set hostname
+  # Use double quoted scalars to force expansion of escape sequences
+  # cf. https://groups.google.com/forum/#!topic/ansible-project/ZaB6o-eqDzw
+  copy: "content='{{ inventory_hostname_short }}\n'
+         dest=/etc/hostname
+         owner=root group=root
+         mode=0644"
+  tags: hostname
+  notify:
+    - Refresh hostname
+
+- name: Set mailname
+  copy: "content='{{ inventory_hostname }}\n'
+         dest=/etc/mailname
+         owner=root group=root
+         mode=0644"
+  tags: mailname
+
+- name: Fix /etc/hosts (1)
+  lineinfile: "dest=/etc/hosts create=yes
+               regexp='^127\\.0\\.0\\.1\\s+'
+               line='127.0.0.1\tlocalhost'"
+  tags: hosts
+
+- name: Fix /etc/hosts (2)
+  lineinfile: "dest=/etc/hosts create=yes
+               regexp='^127\\.0\\.1\\.1\\s+'
+               line='127.0.1.1\t{{ inventory_hostname }} {{ inventory_hostname_short }}'"
+  tags: hosts
+
+- meta: flush_handlers
diff --git a/tasks/network.yml b/tasks/network.yml
new file mode 100644
index 0000000..6b282f8
--- /dev/null
+++ b/tasks/network.yml
@@ -0,0 +1,84 @@
+- name: Copy systemd.network(5) configuration
+  template: src=etc/systemd/network/01-wired.network.j2
+            dest=/etc/systemd/network/01-wired.network
+            owner=root group=root
+            mode=0644
+  notify:
+    - Restart systemd-networkd
+
+- name: Start systemd-networkd
+  service: name=systemd-networkd.service enabled=true state=started
+
+- meta: flush_handlers
+
+- name: Remove ifupdown and isc-dhcp-*
+  apt: pkg={{ packages }} state=absent purge=yes
+  vars:
+    packages:
+    - ifupdown
+    - isc-dhcp-client
+    - isc-dhcp-common
+
+- name: Remove /etc/network/interfaces and /etc/network/interfaces.d
+  file: path={{ item }} state=absent
+  with_items:
+    - /etc/network/interfaces
+    - /etc/network/interfaces.d/
+
+
+- name: Install systemd-resolved
+  apt: pkg={{ packages }}
+  vars:
+    packages:
+    - systemd-resolved
+    - libnss-resolve
+
+- name: Create directory /etc/systemd/resolved.conf.d
+  file: path=/etc/systemd/resolved.conf.d
+        state=directory
+        owner=root group=root
+        mode=0755
+
+- name: Configure systemd-resolved
+  copy: src=etc/systemd/resolved.conf.d/local.conf
+        dest=/etc/systemd/resolved.conf.d/local.conf
+        owner=root group=root
+        mode=0644
+  notify:
+    - Restart systemd-resolved
+
+- name: Start systemd-resolved
+  service: name=systemd-resolved.service enabled=true state=started
+
+- name: Remove resolvconf
+  apt: pkg=resolvconf state=absent purge=yes
+
+
+- name: Install systemd-timesyncd
+  apt: pkg=systemd-timesyncd
+
+- name: Create directory /etc/systemd/timesyncd.conf.d
+  file: path=/etc/systemd/timesyncd.conf.d
+        state=directory
+        owner=root group=root
+        mode=0755
+
+- name: Configure systemd-timesyncd
+  copy: src=etc/systemd/timesyncd.conf.d/local.conf
+        dest=/etc/systemd/timesyncd.conf.d/local.conf
+        owner=root group=root
+        mode=0644
+  notify:
+    - Restart systemd-timesyncd
+
+- name: Start systemd-timesyncd
+  service: name=systemd-timesyncd.service enabled=true state=started
+
+- name: Remove ntp
+  apt: pkg={{ packages }} state=absent purge=yes
+  vars:
+    packages:
+    - ntp
+    - ntpdate
+    - ntpsec
+    - ntpsec-ntpdate
diff --git a/tasks/ssh.yml b/tasks/ssh.yml
new file mode 100644
index 0000000..341a96d
--- /dev/null
+++ b/tasks/ssh.yml
@@ -0,0 +1,20 @@
+---
+- name: Install OpenSSH server
+  apt: pkg={{ packages }}
+  vars:
+    packages:
+      - openssh-server
+
+- name: Create system group 'ssh-login'
+  group: name=ssh-login system=true
+
+- name: Copy sshd_config configuration
+  copy: src=etc/ssh/sshd_config.d/local.conf
+        dest=/etc/ssh/sshd_config.d/local.conf
+        owner=root group=root
+        mode=0644
+  notify:
+    - Restart OpenSSH
+
+- name: Start Openssh
+  service: name=ssh enabled=true state=started
diff --git a/tasks/sysctl.yml b/tasks/sysctl.yml
new file mode 100644
index 0000000..0f0a985
--- /dev/null
+++ b/tasks/sysctl.yml
@@ -0,0 +1,22 @@
+- name: Configure network-related sysctl.conf(5).
+  sysctl: name={{ item.key }} value={{ item.val }}
+          sysctl_file=/etc/sysctl.d/network.conf reload=true
+  with_items:
+    - { key: net.ipv4.tcp_timestamps,                   val: 0  }
+    - { key: net.ipv4.conf.default.accept_source_route, val: 0  }
+    - { key: net.ipv4.conf.default.send_redirects,      val: 0  }
+    - { key: net.ipv4.conf.all.accept_source_route,     val: 0  }
+    - { key: net.ipv4.conf.all.send_redirects,          val: 0  }
+    - { key: net.ipv6.conf.default.autoconf,            val: 0  }
+    - { key: net.ipv6.conf.default.accept_ra,           val: 0  }
+    - { key: net.ipv6.conf.default.accept_ra_defrtr,    val: 0  }
+    - { key: net.ipv6.conf.default.accept_ra_rtr_pref,  val: 0  }
+    - { key: net.ipv6.conf.default.accept_ra_pinfo,     val: 0  }
+    - { key: net.ipv6.conf.default.accept_source_route, val: 0  }
+    - { key: net.ipv6.conf.all.autoconf,                val: 0  }
+    - { key: net.ipv6.conf.all.accept_ra,               val: 0  }
+    - { key: net.ipv6.conf.all.accept_ra_defrtr,        val: 0  }
+    - { key: net.ipv6.conf.all.accept_ra_rtr_pref,      val: 0  }
+    - { key: net.ipv6.conf.all.accept_ra_pinfo,         val: 0  }
+    - { key: net.ipv6.conf.all.accept_source_route,     val: 0  }
+    - { key: net.ipv6.conf.all.accept_redirects,        val: 0  }