ansible.cfg

@@ -2,16 +2,10 @@
 retry_files_enabled=False
 force_handlers=True
 inventory=hosts
-gathering = smart
 # instead of using --ask-vault-pass
 ask_vault_pass=True
 remote_user = provisioning
 interpreter_python=auto
-# Don't warn on unknown SSH host keys because it's super annoying for new hosts
-# or if you get a new laptop and run Ansible there!
-#
-# See: https://docs.ansible.com/ansible/latest/user_guide/connection_details.html#managing-host-key-checking
-host_key_checking = False
 
 ansible_managed = This file is managed by Ansible.%n
   template: {file}

roles/common/files/ssh-pub-keys/aorth-thinkpad2-ed25519.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmRO6E0G4Ls3TifVfJ+mQjlfWiBZNJfsSXGhwQ/HA1M aorth@balozi

roles/common/tasks/firewall_Debian.yml

@@ -2,52 +2,37 @@
 # Debian 11 will use nftables directly, with no firewalld.
 
 - block:
-  - name: Install Debian firewall packages
+  - name: Set Debian firewall packages
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.package:
+    ansible.builtin.set_fact:
-      name:
+      debian_firewall_packages:
         - fail2ban
         - libnet-ip-perl # for aggregate-cidr-addresses.pl
         - nftables
         - python3-systemd
         - curl # for nftables update scripts
-      state: present
+
-      cache_valid_time: 3600
+  - name: Install firewall packages
+    ansible.builtin.apt: pkg={{ debian_firewall_packages }} state=present cache_valid_time=3600
 
   - name: Remove iptables on newer Debian
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.apt:
+    ansible.builtin.apt: pkg=iptables state=absent
-      pkg: iptables
-      state: absent
 
   - name: Copy nftables.conf
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.template:
+    ansible.builtin.template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
-      src: nftables.conf.j2
-      dest: /etc/nftables.conf
-      owner: root
-      mode: 0644
     notify:
       - restart nftables
       - restart fail2ban
 
   - name: Create /etc/nftables extra config directory
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.file:
+    ansible.builtin.file: path=/etc/nftables state=directory owner=root mode=0755
-      path: /etc/nftables
-      state: directory
-      owner: root
-      mode: 0755
 
   - name: Copy extra nftables configuration files
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.copy:
+    ansible.builtin.copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
-      src: "{{ item.src }}"
-      dest: "/etc/nftables/{{ item.src }}"
-      owner: root
-      group: root
-      mode: 0644
-      force: "{{ item.force }}"
     loop:
       - { src: "spamhaus-ipv4.nft", force: "no" }
       - { src: "spamhaus-ipv6.nft", force: "no" }
@@ -58,14 +43,9 @@
       - restart nftables
       - restart fail2ban
 
-  - name: Copy nftables update scripts
+  - name: Copy Spamhaus nftables update scripts
     when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.copy:
+    ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
-      src: "{{ item }}"
-      dest: "/usr/local/bin/{{ item }}"
-      mode: 0755
-      owner: root
-      group: root
     loop:
       - update-spamhaus-nftables.sh
       - aggregate-cidr-addresses.pl
@@ -73,41 +53,29 @@
 
   - name: Copy nftables systemd units
     when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.copy:
+    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-      src: "{{ item }}"
-      dest: "/etc/systemd/system/{{ item }}"
-      mode: 0644
-      owner: root
-      group: root
     loop:
-      - update-spamhaus-nftables.service
+        - update-spamhaus-nftables.service
-      - update-spamhaus-nftables.timer
+        - update-spamhaus-nftables.timer
-      - update-abusech-nftables.service
+        - update-abusech-nftables.service
-      - update-abusech-nftables.timer
+        - update-abusech-nftables.timer
     register: nftables_systemd_units
 
   # need to reload to pick up service/timer/environment changes
   - name: Reload systemd daemon
-    ansible.builtin.systemd:
+    ansible.builtin.systemd: daemon_reload=true
-      daemon_reload: true
     when: nftables_systemd_units is changed
 
   - name: Start and enable nftables update timers
     when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.systemd:
+    ansible.builtin.systemd: name={{ item }} state=started enabled=true
-      name: "{{ item }}"
-      state: started
-      enabled: true
     loop:
       - update-spamhaus-nftables.timer
       - update-abusech-nftables.timer
 
   - name: Start and enable nftables
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.systemd:
+    ansible.builtin.systemd: name=nftables state=started enabled=true
-      name: nftables
-      state: started
-      enabled: true
 
   - ansible.builtin.include_tasks: fail2ban.yml
     when: ansible_distribution_major_version is version('9', '>=')

roles/common/tasks/firewall_Ubuntu.yml

@@ -2,50 +2,37 @@
 # Ubuntu 20.04 will use nftables directly, with no firewalld.
 
 - block:
-  - name: Install Ubuntu firewall packages
+  - name: Set Ubuntu firewall packages
-    ansible.builtin.package:
+    when: ansible_distribution_version is version('20.04', '>=')
-      name:
+    ansible.builtin.set_fact:
+      ubuntu_firewall_packages:
         - fail2ban
         - libnet-ip-perl # for aggregate-cidr-addresses.pl
         - nftables
         - python3-systemd
         - curl # for nftables update scripts
-      state: present
+
-      cache_valid_time: 3600
+  - name: Install firewall packages
+    ansible.builtin.apt: pkg={{ ubuntu_firewall_packages }} state=present cache_valid_time=3600
 
   - name: Remove ufw
-    ansible.builtin.package:
+    when: ansible_distribution_version is version('16.04', '>=')
-      name: ufw
+    ansible.builtin.apt: pkg=ufw state=absent
-      state: absent
 
   - name: Copy nftables.conf
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.template:
+    ansible.builtin.template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
-      src: nftables.conf.j2
-      dest: /etc/nftables.conf
-      owner: root
-      mode: 0644
     notify:
       - restart nftables
       - restart fail2ban
 
   - name: Create /etc/nftables extra config directory
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.file:
+    ansible.builtin.file: path=/etc/nftables state=directory owner=root mode=0755
-      path: /etc/nftables
-      state: directory
-      owner: root
-      mode: 0755
 
   - name: Copy extra nftables configuration files
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy:
+    ansible.builtin.copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
-      src: "{{ item.src }}"
-      dest: "/etc/nftables/{{ item.src }}"
-      owner: root
-      group: root
-      mode: 0644
-      force: "{{ item.force }}"
     loop:
       - { src: "spamhaus-ipv4.nft", force: "no" }
       - { src: "spamhaus-ipv6.nft", force: "no" }
@@ -58,12 +45,7 @@
 
   - name: Copy nftables update scripts
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy:
+    ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
-      src: "{{ item }}"
-      dest: "/usr/local/bin/{{ item }}"
-      mode: 0755
-      owner: root
-      group: root
     loop:
       - update-spamhaus-nftables.sh
       - aggregate-cidr-addresses.pl
@@ -71,12 +53,7 @@
 
   - name: Copy nftables systemd units
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy:
+    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-      src: "{{ item }}"
-      dest: "/etc/systemd/system/{{ item }}"
-      mode: 0644
-      owner: root
-      group: root
     loop:
         - update-spamhaus-nftables.service
         - update-spamhaus-nftables.timer
@@ -86,26 +63,19 @@
 
   # need to reload to pick up service/timer/environment changes
   - name: Reload systemd daemon
-    ansible.builtin.systemd:
+    ansible.builtin.systemd: daemon_reload=true
-      daemon_reload: true
     when: nftables_systemd_units is changed
 
   - name: Start and enable nftables update timers
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.systemd:
+    ansible.builtin.systemd: name={{ item }} state=started enabled=true
-      name: "{{ item }}"
-      state: started
-      enabled: true
     loop:
       - update-spamhaus-nftables.timer
       - update-abusech-nftables.timer
 
   - name: Start and enable nftables
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.systemd:
+    ansible.builtin.systemd: name=nftables state=started enabled=true
-      name: nftables
-      state: started
-      enabled: true
 
   - ansible.builtin.include_tasks: fail2ban.yml
     when: ansible_distribution_version is version('16.04', '>=')