Setup and SSH Migration

Setup and SSH Migration

playbooks/setup.yaml is safe to rerun. It configures the server baseline and switches the Ansible connection to the hardened SSH port.

First run from port 22

The default hardened port is 22571, but a fresh server normally still listens on 22. Tell the playbook where it can connect now:

uv run ansible-playbook \
  -i inventories/production/hosts.yaml \
  --ask-vault-pass \
  playbooks/setup.yaml \
  -e 'setup_ssh_port=22'

Before this command:

1. Allow TCP 22571 in the cloud security group, provider firewall, and any NAT.
2. Confirm the bootstrap user can use sudo -n true.
3. Keep console or provider serial access available.

The setup pre-task temporarily permits both the old current SSH port and the new hardened port in the local firewall. It flushes firewall handlers before the SSH service is reconfigured, then resets Ansible's SSH connection.

Later runs

After migration, the default setup_ssh_port resolves to the hardened port:

uv run ansible-playbook \
  -i inventories/production/hosts.yaml \
  --ask-vault-pass \
  playbooks/setup.yaml

Changing the hardened port again

Example: migrate from 22571 to 2223.

# First open TCP 2223 in every upstream network control.

uv run ansible-playbook \
  -i inventories/production/hosts.yaml \
  --ask-vault-pass \
  playbooks/setup.yaml \
  -e 'setup_ssh_port=22571' \
  -e 'ssh_hardening_port=2223'

ssh -i ~/.ssh/id_ed25519 -p 2223 bootstraper@203.0.113.10 'sudo -n true'

Only remove the old upstream firewall rule after the new SSH command succeeds.

NAT rule

ssh_hardening_current_port is the port visible to the managed host's local firewall during migration. If your public/NAT port differs from that local port, set it explicitly. Example:

uv run ansible-playbook playbooks/setup.yaml \
  -e 'setup_ssh_port=22571' \
  -e 'ssh_hardening_current_port=22'

Do not copy this example blindly. Set the value to the port that the server actually receives after NAT translation.

Role order

Setup runs, in order:

1. ssh_hardening
2. iptables_firewall
3. system_tools
4. docker and traefik on traefik_hosts
5. crowdsec on every host

If setup fails, rerun the same command after correcting the error. Do not skip directly to apps.yaml.