main.yml

---
# http://ryaneschinger.com/blog/securing-a-server-with-ansible/

# hostname
- name: Set the hostname in /etc/hostname
  hostname: name={{ server_hostname }}
  register: hostname

- name: Create /etc/hosts file
  template: src=etc/hosts.j2 dest=/etc/hosts
  when: hostname.changed

- name: install aptitude package needed for following packages install via ansible apt module
  command: apt-get install -y aptitude

# basic system packages installation
- name: Update APT package cache
  become: yes
  apt: update_cache=yes

- name: Run apt-get upgrade
  become: yes
  apt: upgrade=safe

- name: apt - install basic system packages
  become: yes
  apt: pkg={{item}} state=latest update-cache=yes
  with_items:
    - curl
    - git
    - tree
    - htop
    - mlocate
    - fail2ban

# time-related tasks
- name: install system packages for time management
  apt: pkg=ntp,tzdata state=latest update-cache=yes

- name: set timezone to {{ timezone }}
  template: src=etc/timezone dest=/etc/timezone owner=root group=root mode=0644
  notify: update-tzdata

- name: NTP sync cronjob
  cron: minute="01"
        hour="01"
        name="NTP sync"
        user="root"
        job="/usr/sbin/ntpdate fr.pool.ntp.org"

# user configuration
- name: Add deployment user
  user: name=deploy password={{ deploy_password_hash }} state=present append=yes groups=sudo shell={{ deploy_shell }}

- name: Add ssh user keys
  authorized_key: user={{ item.user }} key="{{ item.key }}"
  with_items: "{{ ssh_users }}"

  # - name: Remove sudo group rights
  #   action: lineinfile dest=/etc/sudoers regexp="^%sudo" state=absent

- name: Add .bashrc to user deploy for custom prompt
  copy: src=home/deploy/.bashrc dest=/home/deploy/.bashrc group=deploy owner=deploy

- name: Add .bashrc to user root for custom prompt
  copy: src=root/.bashrc dest=/root/.bashrc group=root owner=root

- name: deploy user can sudo without password prompt
  action: lineinfile dest=/etc/sudoers regexp="deploy ALL" state=present line="deploy ALL=(ALL) NOPASSWD:ALL"


# automatic upgrades
- name: Install unattended-upgrades
  action: apt pkg=unattended-upgrades state=present

- name: Adjust APT update intervals
  template: src=etc/apt/apt.conf.d/10periodic dest=/etc/apt/apt.conf.d/10periodic group=root owner=root

- name: Make sure unattended-upgrades only installs from $ubuntu_release-security
  template: src=etc/apt/apt.conf.d/50unattended-upgrades dest=/etc/apt/apt.conf.d/50unattended-upgrades group=root owner=root

# enable server to send emails
- name: Set up Postfix to relay mail
  debconf: name=postfix
           question='{{ item.question }}'
           value='{{ item.value }}'
           vtype='{{ item.vtype }}'
  with_items:
    - { question: 'postfix/mailname', value: '{{ server_hostname }}.{{ server_domain_name }}', vtype: 'string' }
    - { question: 'postfix/main_mailer_type', value: 'Internet Site', vtype: 'string' }

# setup logwatch
- name: Install logwatch
  apt: pkg=logwatch state=installed

- name: Make logwatch mail $logwatch_email daily
  action: lineinfile dest=/etc/cron.daily/00logwatch regexp="^/usr/sbin/logwatch" line="/usr/sbin/logwatch --output mail --mailto $logwatch_email --detail high" state=present create=yes

# configure and enable firewall
- name: Install uncomplicated firewall
  apt: pkg=ufw state=installed

- name: Set firewall rules
  command: ufw allow {{ item }}
  register: ufw_result
  changed_when: "ufw_result.stdout.startswith('Rule')"
  with_items:
    - 80/tcp
    - 443/tcp
    - 22/tcp
    - ssh

- name: Configure ufw logging
  ufw: logging=on
  notify: restart ufw

- name: Check status of ufw
  command: ufw status
  register: ufw_status
  changed_when: False  # never report as "changed"

- name: Check config of ufw
  command: cat /etc/ufw/ufw.conf
  register: ufw_config
  changed_when: False  # never report as "changed"

- name: Enable ufw
  command: ufw --force enable
  when: "ufw_status.stdout.startswith('Status: inactive') or 'ENABLED=yes' not in ufw_config.stdout"


# login configuration (sshd). Must be kept as last item to rerun the playbook easily if an error occurs
- name: Disallow root SSH access
  action: lineinfile dest=/etc/ssh/sshd_config regexp="^PermitRootLogin" line="PermitRootLogin no" state=present
  notify: Restart sshd

- name: Disallow password authentication
  action: lineinfile dest=/etc/ssh/sshd_config regexp="^PasswordAuthentication" line="PasswordAuthentication no" state=present
  notify: Restart sshd