PhilandClaude Opus 5.5
0c14ee5b1d
The READMEs, CLAUDE.md and todo.md still described Authentik, services removed long ago (Ghost, MMDL, Postiz, Pinchflat...) and two servers. Now they list the 24 services actually deployed (checked against docker ps), explain that netcup and docker-01 are one machine, document Gondulf, StarPunk, Listmonk, Gokapi and dockcheck, and use bin/deploy throughout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
30 lines
1.2 KiB
Markdown
30 lines
1.2 KiB
Markdown
# Bootstrap Role
|
|
|
|
First-time setup for a fresh Debian/Ubuntu server. Run once, against the
|
|
server's public IP (inventory group `bootstrap`, host `netcup`), before
|
|
`site.yml` can reach it over Tailscale.
|
|
|
|
## What it does
|
|
- Installs `aptitude`, `curl`, `vim`, `git` and `ufw`.
|
|
- Gives the `sudo` group passwordless sudo.
|
|
- Creates the user `created_username` (set to `phil` in `bootstrap.yml`) in
|
|
the `sudo` group, with your local `~/.ssh/id_ed25519.pub` as its SSH key.
|
|
- Sets `PermitRootLogin prohibit-password` (root can still log in with a key).
|
|
- UFW: allows OpenSSH, enables the firewall with default deny.
|
|
|
|
`bootstrap.yml` then runs the `artis3n.tailscale` role to join the tailnet,
|
|
using `vault_infrastructure.tailscale_key` from the vault.
|
|
|
|
## Requirements
|
|
- `ansible-galaxy install -r requirements.yml` (for `artis3n.tailscale`).
|
|
- `~/.ssh/id_ed25519.pub` on the machine running Ansible.
|
|
- Root (or another sudo user) SSH access to the new server.
|
|
|
|
## Usage
|
|
```bash
|
|
.venv/bin/ansible-playbook bootstrap.yml -i hosts.yml --vault-password-file vault_pass
|
|
```
|
|
|
|
Once the server is on Tailscale, put its Tailscale IP in `hosts.yml` under
|
|
`docker` and use `bin/deploy` from then on.
|