Ilia Denisov
f5f45e7afb
Idempotent playbooks under deploy/ansible/ prepare both production hosts: docker-ce + compose plugin, a non-sudo deploy service account holding the CI deploy key, key-only sshd, default-deny ufw, fail2ban, unattended upgrades and chrony. The main host also opens 80/443/9443 and creates the external edge network; the tg host verifies direct Bot API egress (the no-VPN assumption). The application is deployed separately by the prod-deploy workflow (later phase), running as the deploy account this playbook provisions.
20 lines
715 B
YAML
20 lines
715 B
YAML
---
|
|
# Telegram bot host: holds no inbound port beyond SSH (the bot dials out to the
|
|
# Bot API and into the main host's bot-link). We only verify direct Bot API
|
|
# egress here, since the "no VPN" decision depends on it.
|
|
|
|
- name: Verify direct Telegram Bot API egress (no VPN on this host)
|
|
ansible.builtin.uri:
|
|
url: https://api.telegram.org/
|
|
method: GET
|
|
status_code: [200, 301, 302, 401, 404] # any HTTP reply proves reachability
|
|
timeout: 10
|
|
register: tg_egress
|
|
failed_when: false
|
|
|
|
- name: Report Telegram reachability
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
api.telegram.org reachable:
|
|
{{ (tg_egress.status | default(0) | int) > 0 }} (status {{ tg_egress.status | default('none') }})
|