Ilia Denisov
f5f45e7afb
Idempotent playbooks under deploy/ansible/ prepare both production hosts: docker-ce + compose plugin, a non-sudo deploy service account holding the CI deploy key, key-only sshd, default-deny ufw, fail2ban, unattended upgrades and chrony. The main host also opens 80/443/9443 and creates the external edge network; the tg host verifies direct Bot API egress (the no-VPN assumption). The application is deployed separately by the prod-deploy workflow (later phase), running as the deploy account this playbook provisions.
19 lines
550 B
YAML
19 lines
550 B
YAML
---
|
|
# Main stack host: public web + bot-link ports and the external 'edge' network
|
|
# the compose stack attaches caddy to.
|
|
|
|
- name: Open public web and bot-link ports
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- "80" # HTTP (ACME challenge + redirect to HTTPS)
|
|
- "443" # HTTPS (caddy edge)
|
|
- "9443" # bot-link mTLS (remote bot dials in; mutual TLS gates access)
|
|
|
|
- name: Ensure the external 'edge' docker network exists
|
|
community.docker.docker_network:
|
|
name: edge
|
|
state: present
|