PhilandClaude Opus 5.5
750d4dacad
The server now runs Debian 13.7. systemd 257's ssh generator logs a harmless AF_VSOCK error on netcup VMs, so the common role masks it. The plan file now records how the upgrade went and what's left. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
54 lines
1.6 KiB
YAML
54 lines
1.6 KiB
YAML
- name: Install common packages
|
|
apt:
|
|
name:
|
|
- aptitude
|
|
- jq
|
|
state: latest
|
|
update_cache: true
|
|
|
|
- name: UFW - Enable and deny by default
|
|
community.general.ufw:
|
|
state: enabled
|
|
default: deny
|
|
# Security updates install themselves each day (Debian's default origins:
|
|
# the -security archive only). No automatic reboots.
|
|
- name: Install unattended-upgrades
|
|
ansible.builtin.apt:
|
|
name: unattended-upgrades
|
|
state: present
|
|
|
|
- name: Turn on daily unattended upgrades
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
owner: root
|
|
mode: '0644'
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
|
|
# Keys only. sshd_config's Include comes first and sshd keeps the first value
|
|
# it reads, so this drop-in overrides the defaults further down. Root has no
|
|
# keys, and Ansible logs in as the regular user.
|
|
- name: SSH - keys only, no root login, no X11
|
|
ansible.builtin.copy:
|
|
dest: /etc/ssh/sshd_config.d/10-hardening.conf
|
|
owner: root
|
|
mode: '0644'
|
|
content: |
|
|
PasswordAuthentication no
|
|
KbdInteractiveAuthentication no
|
|
PermitRootLogin no
|
|
X11Forwarding no
|
|
validate: /usr/sbin/sshd -t -f %s
|
|
notify: reload ssh
|
|
|
|
# systemd 257 (Debian 13) adds a generator that offers SSH over VSOCK. netcup
|
|
# VMs have no VSOCK device, so it only logs "Failed to query local AF_VSOCK
|
|
# CID" to the console. Normal SSH doesn't use it.
|
|
- name: Turn off systemd's SSH-over-VSOCK generator
|
|
ansible.builtin.file:
|
|
src: /dev/null
|
|
dest: /etc/systemd/system-generators/systemd-ssh-generator
|
|
state: link
|
|
force: true
|