Ilia Denisov
f5f45e7afb
Idempotent playbooks under deploy/ansible/ prepare both production hosts: docker-ce + compose plugin, a non-sudo deploy service account holding the CI deploy key, key-only sshd, default-deny ufw, fail2ban, unattended upgrades and chrony. The main host also opens 80/443/9443 and creates the external edge network; the tg host verifies direct Bot API egress (the no-VPN assumption). The application is deployed separately by the prod-deploy workflow (later phase), running as the deploy account this playbook provisions.
32 lines
846 B
YAML
32 lines
846 B
YAML
---
|
|
# Stage 18 host provisioning. Idempotent: safe to re-run after a host resize.
|
|
# Prepares hosts only (docker, hardening, service account, firewall); the
|
|
# application is deployed separately by .gitea/workflows/prod-deploy.yaml.
|
|
|
|
- name: Common baseline (both hosts)
|
|
hosts: prod
|
|
become: true
|
|
pre_tasks:
|
|
- name: Require a well-formed CI deploy public key
|
|
ansible.builtin.assert:
|
|
that:
|
|
- deploy_ci_pubkey | length > 0
|
|
- deploy_ci_pubkey is search('^(ssh|ecdsa)-')
|
|
fail_msg: >-
|
|
deploy_ci_pubkey is empty or malformed. Generate the key first
|
|
(see deploy/ansible/README.md) or override deploy_ci_pubkey_path.
|
|
roles:
|
|
- common
|
|
|
|
- name: Main stack host
|
|
hosts: main
|
|
become: true
|
|
roles:
|
|
- main
|
|
|
|
- name: Telegram bot host
|
|
hosts: tg
|
|
become: true
|
|
roles:
|
|
- tg
|