Ilia Denisov
f5f45e7afb
Idempotent playbooks under deploy/ansible/ prepare both production hosts: docker-ce + compose plugin, a non-sudo deploy service account holding the CI deploy key, key-only sshd, default-deny ufw, fail2ban, unattended upgrades and chrony. The main host also opens 80/443/9443 and creates the external edge network; the tg host verifies direct Bot API egress (the no-VPN assumption). The application is deployed separately by the prod-deploy workflow (later phase), running as the deploy account this playbook provisions.
12 lines
235 B
INI
12 lines
235 B
INI
[defaults]
|
|
inventory = inventory.ini
|
|
roles_path = roles
|
|
interpreter_python = /usr/bin/python3
|
|
host_key_checking = True
|
|
stdout_callback = yaml
|
|
deprecation_warnings = False
|
|
retry_files_enabled = False
|
|
|
|
[ssh_connection]
|
|
pipelining = True
|