Build out bootstrap role: admin user, sudoers, motd, keyboard, openssh, sysctl, bashrc, ssh keys

roles/bootstrap/tasks/add-ssh-keys.yml

@@ -0,0 +1,17 @@
+---
+- name: Create .ssh directory for admin user
+  file:
+    path: /home/admin/.ssh
+    state: directory
+    owner: admin
+    group: admin
+    mode: '0700'
+
+- name: Deploy authorized SSH keys for admin user
+  template:
+    src: authorized_keys.j2
+    dest: /home/admin/.ssh/authorized_keys
+    owner: admin
+    group: admin
+    mode: '0600'
+  when: admin_authorized_keys is defined and admin_authorized_keys | length > 0

roles/bootstrap/tasks/configure-ssh.yml

@@ -0,0 +1,10 @@
+---
+- name: Configure SSH daemon
+  template:
+    src: sshd.conf.j2
+    dest: /etc/ssh/sshd_config
+    owner: root
+    group: root
+    mode: '0600'
+    validate: /usr/sbin/sshd -T -f %s
+  notify: Restart sshd

roles/bootstrap/tasks/configure-sysctl.yml

@@ -0,0 +1,9 @@
+---
+- name: Configure swappiness to reduce swap usage
+  become: yes
+  ansible.posix.sysctl:
+    name: vm.swappiness
+    value: 10
+    state: present
+    reload: yes
+  when: ansible_facts['virtualization_type'] != "lxc"

roles/bootstrap/tasks/create-admin-user.yml

@@ -6,10 +6,20 @@
     shell: /bin/bash
     createhome: yes
     state: present
+    password: "{{ admin_password }}"
+    password_lock: no
+
+- name: Create sudoers.d directory if not exists
+  file:
+    path: /etc/sudoers.d
+    state: directory
+    mode: '0755'
 
 - name: Set sudo privileges for admin user
-  lineinfile:
-    path: /etc/sudoers.d/10-admin
-    line: "admin ALL=(ALL) NOPASSWD:ALL"
-    validate: 'visudo -cf %s'
-    state: present
+  template:
+    src: sudoers-admin.j2
+    dest: /etc/sudoers.d/10-admin
+    owner: root
+    group: root
+    mode: '0440'
+    validate: 'visudo -cf %s'

roles/bootstrap/tasks/install-basicpackages.yml

@@ -0,0 +1,19 @@
+---
+- name: Install basic packages
+  ansible.builtin.apt:
+    name:
+      - fastfetch
+      - htop
+      - curl
+      - wget
+      - git
+      - sudo
+      - console-setup
+      - qemu-guest-agent
+      - cron
+      - net-tools
+      - tcpdump
+      - locales-all
+    update_cache: yes
+    install_recommends: no
+    state: present

roles/bootstrap/tasks/install-openssh.yml

@@ -0,0 +1,13 @@
+---
+- name: Remove openssh-client if ssh package is installed
+  package:
+    name: ssh
+    state: absent
+
+- name: Install OpenSSH server
+  ansible.builtin.apt:
+    name:
+      - openssh-server
+      - openssh-client
+    update_cache: yes
+    state: present

roles/bootstrap/tasks/install-sudo.yml

@@ -1,6 +0,0 @@
----
-- name: Install sudo
-  apt:
-    name: sudo
-    state: present
-  become: yes

roles/bootstrap/tasks/main.yml

@@ -0,0 +1,32 @@
+---
+- import_tasks: install-basicpackages.yml
+
+- import_tasks: create-admin-user.yml
+
+- import_tasks: set-motd.yml
+  tags: motd
+
+- import_tasks: set-keyboardlayout.yml
+
+- import_tasks: install-openssh.yml
+  tags: ssh
+
+- import_tasks: configure-ssh.yml
+  tags: ssh
+
+- import_tasks: add-ssh-keys.yml
+  tags: ssh
+
+- import_tasks: setup-bashrc.yml
+  tags: bashrc
+
+- import_tasks: configure-sysctl.yml
+  tags: sysctl
+
+- import_role:
+    name: docker
+  when: not skip_docker | default(false)
+
+- import_role:
+    name: monitoring
+  when: not skip_monitoring | default(false)

roles/bootstrap/tasks/set-keyboardlayout.yml

@@ -0,0 +1,9 @@
+---
+- name: Set keyboard layout to QWERTZ
+  template:
+    src: keyboard.j2
+    dest: /etc/default/keyboard
+    owner: root
+    group: root
+    mode: '0644'
+  notify: Reload keyboard layout

roles/bootstrap/tasks/set-motd.yml

@@ -0,0 +1,19 @@
+- name: Set MOTD to display fastfetch on login
+  copy:
+    content: |
+      #!/bin/bash
+      # Managed by Ansible - Do not edit manually
+      if [[ -z "${FASTFETCH_MOTD_SHOWN:-}" && -z "${SUDO_USER:-}" ]]; then
+        fastfetch -s os:kernel:uptime:packages:shell:disk:cpu:memory:localip:colors
+        export FASTFETCH_MOTD_SHOWN=1
+      fi
+    dest: /etc/profile.d/motd.sh
+    owner: root
+    group: root
+    mode: '0755'
+
+- name: Remove default MOTD file if it exists
+  file:
+    path: /etc/motd
+    state: absent
+  

roles/bootstrap/tasks/setup-bashrc.yml

@@ -0,0 +1,46 @@
+---
+- name: Get all regular users from /etc/passwd (including root)
+  shell: |
+    getent passwd | awk -F: '($3 >= 1000 && $3 < 65534 && $7 !~ /nologin|false/) || $3 == 0 {print $1":"$6}'
+  register: system_users
+  changed_when: false
+
+- name: Create user list with home directories
+  set_fact:
+    user_list: "{{ system_users.stdout_lines | map('split', ':') | list }}"
+
+- name: Ensure .bashrc exists for all users
+  file:
+    path: "{{ item[1] }}/.bashrc"
+    state: touch
+    owner: "{{ item[0] }}"
+    mode: '0644'
+    modification_time: preserve
+    access_time: preserve
+  loop: "{{ user_list }}"
+  when: item[1] is defined and item[1] != ""
+
+- name: Add useful aliases to .bashrc
+  blockinfile:
+    path: "{{ item[1] }}/.bashrc"
+    marker: "# {mark} ANSIBLE MANAGED ALIASES"
+    block: |
+      # Useful Aliases
+      alias ll='ls -la'
+      alias la='ls -A'
+      alias l='ls -CF'
+      alias ..='cd ..'
+      alias ...='cd ../..'
+      alias grep='grep --color=auto'
+      alias fgrep='fgrep --color=auto'
+      alias egrep='egrep --color=auto'
+      
+      # Additional useful shortcuts
+      alias df='df -h'
+      alias du='du -h'
+      alias free='free -h'
+    owner: "{{ item[0] }}"
+    mode: '0644'
+    create: no
+  loop: "{{ user_list }}"
+  when: item[1] is defined and item[1] != ""