Adding ansible section

ansible/roles/bastion/tasks/firewall.yml

@@ -0,0 +1,44 @@
+- name: ensure nftables service is started and enabled
+  ansible.builtin.systemd:
+    name: nftables
+    state: started
+    enabled: true
+  tags: all,firewall
+
+- name: deploying nftables configuration
+  ansible.builtin.template:
+    src: nftables.conf.j2
+    dest: /etc/nftables.conf
+    owner: root
+    group: root
+    mode: '0755'
+    backup: true
+    validate: "nft -c -f %s"
+  notify:
+    - reload nftables
+    - restart fail2ban
+  tags: all,firewall
+
+- name: ensure fail2ban is installed
+  ansible.builtin.apt:
+    name: fail2ban
+    state: present
+    update_cache: true
+  tags: all,firewall
+
+- name: ensure fail2ban is enabled and running
+  ansible.builtin.systemd:
+    name: fail2ban
+    state: started
+    enabled: true
+  tags: all,firewall
+
+- name: deploying fail2ban ssh conf
+  ansible.builtin.template:
+    src: sshd.conf.j2
+    dest: /etc/fail2ban/jail.d/sshd.conf
+    owner: root
+    group: root
+    mode: '0644'
+  notify: reload fail2ban
+  tags: all,firewall

ansible/roles/bastion/tasks/main.yml

@@ -0,0 +1,13 @@
+---
+
+- name: user deployment related tasks
+  include_tasks: users.yml
+  tags: all,users,rootonly
+
+- name: firewall deployment related tasks
+  include_tasks: firewall.yml
+  tags: all,firewall
+
+- name: ssh deployment related tasks
+  include_tasks: ssh.yml
+  tags: all,ssh

ansible/roles/bastion/tasks/ssh.yml

@@ -0,0 +1,28 @@
+---
+
+- name: ensure sshd is enabled
+  ansible.builtin.systemd:
+    name: sshd
+    enabled: true
+  tags: all,ssh
+
+- name: deploy sshd_config
+  ansible.builtin.template:
+    src: sshd_config.j2
+    dest: /etc/ssh/sshd_config
+    owner: root
+    group: root
+    mode: 0644
+    validate: "sshd -T -f %s"
+  notify: restart ssh
+  tags: all,ssh
+
+- name: deploy rsyslog conf
+  ansible.builtin.template:
+    src: auth.conf.j2
+    dest: /etc/rsyslog.d/auth.conf
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart rsyslog
+  tags: all,ssh

ansible/roles/bastion/tasks/users.yml

@@ -0,0 +1,53 @@
+---
+
+- name: installing sudo
+  ansible.builtin.apt:
+    name: sudo
+    update_cache: true
+    state: present
+  tags: all,users
+
+- name: adding targetpw directive for sudo
+  ansible.builtin.lineinfile:
+    path: /etc/sudoers
+    line: "{{ item }}"
+    state: present
+  with_items:
+    - "Defaults        targetpw"
+    - "Defaults        insults"
+  tags: all,users
+
+- name: creating admin users
+  ansible.builtin.user:
+    name: "{{ item.username }}"
+    shell: /bin/bash
+    groups: sudo
+  with_items: "{{ admin_users }}"
+  tags: all,users
+
+- name: creating dev users
+  ansible.builtin.user:
+    name: "{{ item.username }}"
+    shell: /bin/bash
+    groups: sudo
+  with_items: "{{ dev_users }}"
+  tags: all,users
+
+- name: adding authorized_keys for regular users
+  ansible.builtin.authorized_key:
+    user: "{{ item.username }}"
+    key: "{{ item.public_key }}"
+    state: "{{ item.state | default('present') }}"
+  with_items:
+    - "{{ admin_users }}"
+    - "{{ dev_users }}"
+  tags: all,users
+
+- name: adding authorized_keys for root users
+  ansible.builtin.authorized_key:
+    user: "root"
+    key: "{{ item.public_key }}"
+    key_options: 'from="{{ private_networks }}"'
+    state: "{{ item.state }}"
+  with_items: "{{ admin_users }}"
+  tags: all,users,rootonly