Ilia Denisov
f5f45e7afb
Idempotent playbooks under deploy/ansible/ prepare both production hosts: docker-ce + compose plugin, a non-sudo deploy service account holding the CI deploy key, key-only sshd, default-deny ufw, fail2ban, unattended upgrades and chrony. The main host also opens 80/443/9443 and creates the external edge network; the tg host verifies direct Bot API egress (the no-VPN assumption). The application is deployed separately by the prod-deploy workflow (later phase), running as the deploy account this playbook provisions.
16 lines
267 B
YAML
16 lines
267 B
YAML
---
|
|
- name: restart docker
|
|
ansible.builtin.service:
|
|
name: docker
|
|
state: restarted
|
|
|
|
- name: reload sshd
|
|
ansible.builtin.service:
|
|
name: ssh
|
|
state: reloaded
|
|
|
|
- name: restart fail2ban
|
|
ansible.builtin.service:
|
|
name: fail2ban
|
|
state: restarted
|