PhilandClaude Opus 5.5
0c14ee5b1d
The READMEs, CLAUDE.md and todo.md still described Authentik, services removed long ago (Ghost, MMDL, Postiz, Pinchflat...) and two servers. Now they list the 24 services actually deployed (checked against docker ps), explain that netcup and docker-01 are one machine, document Gondulf, StarPunk, Listmonk, Gokapi and dockcheck, and use bin/deploy throughout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.2 KiB
1.2 KiB
Bootstrap Role
First-time setup for a fresh Debian/Ubuntu server. Run once, against the
server's public IP (inventory group bootstrap, host netcup), before
site.yml can reach it over Tailscale.
What it does
- Installs
aptitude,curl,vim,gitandufw. - Gives the
sudogroup passwordless sudo. - Creates the user
created_username(set tophilinbootstrap.yml) in thesudogroup, with your local~/.ssh/id_ed25519.pubas its SSH key. - Sets
PermitRootLogin prohibit-password(root can still log in with a key). - UFW: allows OpenSSH, enables the firewall with default deny.
bootstrap.yml then runs the artis3n.tailscale role to join the tailnet,
using vault_infrastructure.tailscale_key from the vault.
Requirements
ansible-galaxy install -r requirements.yml(forartis3n.tailscale).~/.ssh/id_ed25519.pubon the machine running Ansible.- Root (or another sudo user) SSH access to the new server.
Usage
.venv/bin/ansible-playbook bootstrap.yml -i hosts.yml --vault-password-file vault_pass
Once the server is on Tailscale, put its Tailscale IP in hosts.yml under
docker and use bin/deploy from then on.