51 lines
1.3 KiB
YAML
51 lines
1.3 KiB
YAML
---
|
|
- name: Update all packages
|
|
ansible.builtin.apt:
|
|
update_cache: yes
|
|
upgrade: dist
|
|
|
|
- name: Install essential packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- net-tools
|
|
- curl
|
|
- wget
|
|
- htop
|
|
- vim
|
|
state: present
|
|
|
|
- name: Add 1GB swap file
|
|
ansible.builtin.shell: |
|
|
fallocate -l 1G /swapfile
|
|
chmod 600 /swapfile
|
|
mkswap /swapfile
|
|
swapon /swapfile
|
|
args:
|
|
creates: /swapfile
|
|
|
|
- name: Make swap persistent
|
|
ansible.builtin.lineinfile:
|
|
dest: /etc/fstab
|
|
line: '/swapfile none swap sw 0 0'
|
|
state: present
|
|
|
|
- name: Configure iptables firewall rules
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
protocol: "{{ item.protocol }}"
|
|
destination_port: "{{ item.port }}"
|
|
jump: ACCEPT
|
|
action: insert
|
|
rule_num: 1
|
|
loop:
|
|
- { protocol: tcp, port: '80', description: 'HTTP for Lets Encrypt ACME challenge' }
|
|
- { protocol: tcp, port: '443', description: 'HTTPS for secure web traffic' }
|
|
- { protocol: udp, port: '51820', description: 'WireGuard VPN traffic' }
|
|
become: true
|
|
register: iptables_result
|
|
|
|
- name: Display iptables configuration status
|
|
ansible.builtin.debug:
|
|
msg: "Configured firewall rules for ports: 80 (HTTP), 443 (HTTPS), 51820 (WireGuard UDP)"
|
|
when: iptables_result is changed
|