first commit

tasks/docker.yml

@@ -0,0 +1,26 @@
+---
+
+# install docker using geerlingguy docker role
+- name: 'Use geerlingguy.docker role'
+  include_role:
+    name: ansible-role-docker
+  tags: docker
+
+- name: 'Use geerlingguy.pip role to install docker via pip'
+  vars:
+    pip_install_packages:
+      - name: docker
+      - name: docker-compose
+
+  include_role:
+    name: ansible-role-pip
+  tags: docker
+
+- name: Add adminstrator to docker group
+  user:
+    name: "{{ main_user }}"
+    groups: docker
+    append: yes
+
+- name: reset ssh connection to allow user changes to affect 'current login user'
+  meta: reset_connection

tasks/harden.yml

@@ -0,0 +1,11 @@
+---
+
+# harden the ubuntu server via ubuntu2004_cis
+- name: 'Use ubuntu2004_cis role'
+  include_role:
+    name: ubuntu2004_cis
+  tags: harden
+
+- name: 'Include fail2ban/install using apt'
+  apt: name=fail2ban state=latest update_cache=yes force_apt_get=yes
+  tags: harden

tasks/main.yml

@@ -0,0 +1,20 @@
+---
+# tasks file for setting up an assetto server on ubuntu20.04
+- include: ssh_port_fallback.yml
+- include: harden.yml
+#  become: true
+#  apply tags,become
+#  when: harden_os
+#  tags: harden
+
+- include: docker.yml
+#  become: true
+#  apply tags,become
+#  when: harden_os
+#  tags: harden
+
+- include: rocketchat.yml
+#  become: true
+#  apply tags,become
+#  when: harden_os
+#  tags: harden

tasks/rocketchat.yml

@@ -0,0 +1,55 @@
+---
+- name: Install unzip using apt
+  apt: name=unzip state=latest update_cache=yes force_apt_get=yes
+
+- name: "NOTSCORED | 3.5.1.6 | PATCH | Ensure firewall rules exist for all open ports"
+  ufw:
+    rule: allow
+    proto: tcp
+    port: "{{ item }}"
+  loop:
+    - '3000'
+    - '80'
+    - '443'
+    - '22'
+
+- name: Creates directory structure for assetto content
+  file:
+    path: /home/{{ main_user }}/data
+    state: directory
+    owner: "{{ main_user }}"
+    group: "{{ main_user }}"
+    mode: 0775
+
+- name: bring down server-manager docker-compose
+  become_user: "{{ main_user }}"
+  docker_compose:
+    project_src: /home/{{ main_user }}/server-manager/
+    state: absent
+  register: __remove_assetto_server_manager
+  tags:
+    - bring-down
+
+- name: update permissions
+  file:
+    path: /home/{{ main_user }}
+    state: directory
+    recurse: yes
+    owner: "{{ main_user }}"
+    group: "{{ main_user }}"
+    mode: 0775
+
+- name: docker compose up
+  become_user: "{{ main_user }}"
+  docker_compose:
+    project_src: /home/{{ main_user }}/server-manager/
+    state: present
+  register: __assetto_server_manager
+
+- name: debug docker compose down
+  debug:
+    var: __remove_assetto_server_manager
+
+- name: debug docker compose up
+  debug:
+    var: __assetto_server_manager

tasks/ssh_port_fallback.yml

@@ -0,0 +1,55 @@
+---
+#
+# https://gist.github.com/triplepoint/1ad6c6060c0f12112403d98180bcf0b4
+#
+# This task list is intended to be imported by playbooks, before any
+# other tasks are performed.  It lets us determine whether the configured SSH
+# port is available, and lets us fall back to the default port if necessary.
+#
+# The use case here is when a role in the playbook is configured to change the
+# sshd port, but the first time the role is executed the host is still
+# listening on the default port.  With this check in place, we can fall back
+# to the default port on the first run, and then on subsequent runs use the
+# configured port.
+#
+# Be advised that running this task list in a `gather_facts: false` state as
+# required means simple failures can go unexplained.  For example, if python2
+# is not available, the `wait_for_connection` calls will just time out without
+# explanation.
+#
+# Execute these tasks as the first thing in a playbook like so:
+# - hosts: some-host-group
+#   gather_facts: false
+#   tasks:
+#     - import_tasks: _sshd_port_juggling.yml
+
+- name: SSH Port Juggle | define the fallback default SSH port
+  set_fact:
+    _default_ssh_port: 22
+
+- name: SSH Port Juggle | Try configured ansible_port {{ ansible_port }}
+  wait_for_connection:
+    timeout: 10
+  ignore_errors: true
+  register: _ssh_port_result
+
+- name: SSH Port Juggle | Set the ansible_port to the fallback default port {{ _default_ssh_port }}
+  set_fact:
+    ansible_port: "{{ _default_ssh_port }}"
+  when:
+    - _ssh_port_result is failed
+
+- name: SSH Port Juggle | Check fallback default port {{ ansible_port }}
+  wait_for_connection:
+    timeout: 10
+  ignore_errors: true
+  register: _ssh_port_default_result
+  when:
+    - _ssh_port_result is failed
+
+- name: SSH Port Juggle | Fail
+  fail: msg="Neither the configured ansible_port {{ ansible_port }} nor the fallback port {{ _default_ssh_port }} were reachable"
+  when:
+    - _ssh_port_result is failed
+    - _ssh_port_default_result is defined
+    - _ssh_port_default_result is failed