♻️ Reworked base role into more parametrized and secure role

.gitignore

@@ -11,7 +11,6 @@ src/regex/conf/uwsgi.ini
 /media/
 /private_media/
 /src/static/css
-/src/static/bower_components
 node_modules
 
 # testing

.travis.yml

@@ -19,9 +19,8 @@ install:
 before_script:
   - mkdir log
   - export DJANGO_SETTINGS_MODULE=regex.conf.settings.test
-  - npm install bower grunt-cli -g
+  - npm install grunt-cli -g
   - npm install
-  - bower install
   - src/manage.py collectstatic --noinput --link
   - grunt sass:dist
 

deployment/backupserver.yml

@@ -6,12 +6,15 @@
 
   vars:
     firewall_open_ports:
-      - "{{ ssh_port | default('ssh') }}"
       - '25565'
     postgresql_enabled: false
     nginx_enabled: false
     redis_enabled: false
     nodejs_enabled: false
+    django_enabled: false
+
+    application_user: minecraft
 
   roles:
-    - base2
+    - base
+    - app_user

deployment/provision.yml

@@ -3,8 +3,18 @@
 - name: Provision the server with all required packages and user accounts
   hosts: "{{ target|default('staging') }}"
   remote_user: root
+  vars:
+    bigstore: no
+    postgresql_enabled: yes
+    apache_enabled: no
+    nginx_enabled: yes
+    redis_enabled: yes
+    memcached_enabled: no
+    nodejs_enabled: yes
+    django_enabled: yes
   roles:
     - base
+    - app_user
     - postgres
     - ssl
     - nginx

deployment/roles/app_user/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+
+users_url_pubkeys:
+  - https://github.com/sergei-maertens.keys

deployment/roles/app_user/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+
+- name: Create the application user group
+  group:
+    name: "{{ application_user }}"
+    state: present
+
+- name: Create the application user
+  user:
+    name: "{{ application_user }}"
+    group: "{{ application_user }}"
+    shell: /bin/bash
+    generate_ssh_key: yes
+
+- name: Set application user password
+  user:
+    name: "{{ application_user }}"
+    password: "{{ crypted_password }}"
+  when: crypted_password is defined
+
+- name: Install public keys to authorized_keys.
+  authorized_key:
+    user: "{{ application_user }}"
+    key: "{{ item }}"
+    state: present
+  with_items: "{{ users_url_pubkeys }}"

deployment/roles/base2/defaults/main.yml → deployment/roles/base/defaults/main.yml

@@ -6,7 +6,6 @@ admin_email: root@localhost
 firewall_open_ports:
   - http
   - https
-  - "{{ ssh_port | default('ssh') }}"
 
 # big storage (Tansip)
 bigstorage: no
@@ -35,3 +34,25 @@ memcached_enabled: no
 # NodeJS
 nodejs_enabled: false
 nodejs_version: 10
+
+# Django
+django_enabled: false
+django_packages:
+  - python3-dev
+  - python3-setuptools
+  - python3-pip
+  - python-virtualenv
+  # lxml depend on these
+  - libxml2
+  - libxml2-dev
+  - libxslt1.1
+  - libxslt1-dev
+  # Pillow
+  - swig
+  - libjpeg-dev
+  # weasyprint
+  - libcairo2
+  - libpango1.0-0
+  - libgdk-pixbuf2.0-0
+  - libffi-dev
+  - shared-mime-info

deployment/roles/base/tasks/django.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Install Django system packages
+  package:
+    name: "{{ django_packages }}"
+  when: django_enabled

deployment/roles/base2/tasks/firewall.yml → deployment/roles/base/tasks/firewall.yml

@@ -17,6 +17,15 @@
   notify:
     - restart ufw
 
+- name: Always allow SSH
+  ufw:
+    proto: tcp
+    direction: in
+    rule: allow
+    port: "{{ ssh_port | default('ssh') }}"
+  notify:
+    - restart ufw
+
 - name: Open ports
   ufw:
     proto: tcp

deployment/roles/base/tasks/main.yml

@@ -1,5 +1,31 @@
 ---
-# Set up the base system
+# Set up the base system: security settings, basic system packages...
 
-- include: packages.yml
-- include: users.yml
+- include_tasks: build-tools.yml
+
+- include_tasks: auto-updates.yml
+
+- include_tasks: sshd.yml
+
+- include_tasks: firewall.yml
+
+- include_tasks: fail2ban.yml
+
+- include_tasks: bigstorage.yml
+  when: bigstorage
+
+- include_tasks: logwatch.yml
+
+- include_tasks: databases.yml
+
+- include_tasks: webservers.yml
+
+- include_tasks: caches.yml
+
+- include_tasks: vcs.yml
+
+- include_tasks: nodejs.yml
+  when: nodejs_enabled
+
+- include_tasks: django.yml
+  when: django_enabled

deployment/sentry.yml

@@ -9,6 +9,11 @@
     - vars/ssl.yml
 
   vars:
+    application_user: sentry
+    postgresql_enabled: no
+    nginx_enabled: yes
+    redis_enabled: no
+
     # nginx role overrides
     prefix: sentry
     nginx_vhost_template: proxy.conf.j2
@@ -19,6 +24,8 @@
     nginx_hostname: sentry.regex-it.nl
 
   roles:
+    - base
+    - app_user
     - geerlingguy.docker
     - sentry
     - ssl