---
id: MOD-001
type: module
status: active
title: Bootstrap Role
created: 2026-09-09
updated: 2026-09-09
tags: [module, bootstrap, ansible]
related: [MOD-002, MOD-003, REQ-001]
source_paths:
- roles/bootstrap/
confidence: confirmed
---

# Bootstrap Role

## Responsibility

Full initial setup of a Debian host: packages, admin user, SSH, MOTD,
keyboard layout, bashrc, sysctl; then composes Docker and monitoring.

## Source Paths

- `roles/bootstrap/tasks/main.yml` - orchestration only
- Subtasks: `install-basicpackages.yml`, `create-admin-user.yml`,
  `set-motd.yml`, `set-keyboardlayout.yml`, `install-openssh.yml`,
  `configure-ssh.yml`, `add-ssh-keys.yml`, `setup-bashrc.yml`,
  `configure-sysctl.yml`
- Templates: `authorized_keys.j2`, `keyboard.j2`, `sshd.conf.j2`,
  `sudoers-admin.j2`

## Public Interfaces

- Playbook: `bootstrap.yml` (top level, Debian guard, `become`, `user: admin`,
  `vars_files: vault.yml`)
- Skip flags: `skip_docker`, `skip_monitoring` (control role composition)
- Tags: `motd`, `ssh`, `bashrc`, `sysctl`

## Important Flows

1. Basic packages → admin user (+sudo via `sudoers-admin.j2`, authorized
   keys via `authorized_keys.j2`) → MOTD → keyboard layout.
2. OpenSSH install, hardening config (`sshd.conf.j2`), authorized keys.
3. bashrc, sysctl.
4. `import_role: docker` (when `not skip_docker`), then
   `import_role: monitoring` (when `not skip_monitoring`).

## Dependencies

- Composed roles: [docker](./MOD-002-docker-role.md),
  [monitoring](./MOD-003-monitoring-role.md).
- `admin_authorized_keys` (public keys, plaintext OK) from
  `defaults/main.yml`; `admin_password` (SHA-512 hash) lives encrypted in
  `vault.yml`, loaded via `vars_files` in `bootstrap.yml` (resolved
  ALERT-20260909-001).

## Tests

- None automated; manual runs via `./execute.sh`.

## Notes For Agents

- `sshd` service name differs per host (`ssh_service_name`, set for `gitea`
  and `ipam` in `inventory/cloudlorean.yml`).
- Keep `tasks/main.yml` as pure import list when extending.