Created ansible files to create server with initial sane defaults

ansible/roles/server-setup/defaults/main.yaml

@@ -0,0 +1,6 @@
+---
+basic_firewall: basic-firewall
+server_image: ubuntu-22.04
+server_location: fsn1
+server_placement_group: default
+server_type: cax11

ansible/roles/server-setup/tasks/create-server.yaml

@@ -0,0 +1,22 @@
+---
+- name: create SSH key
+  hetzner.hcloud.hcloud_ssh_key:
+    api_token: "{{ hcloud_api_token }}"
+    public_key: "{{ ssh_key_admin_user }}"
+    name: "{{ ssh_key_admin_user_name }}"
+    state: present
+- name: create server via HCloud
+  hetzner.hcloud.hcloud_server:
+    api_token: "{{ hcloud_api_token }}"
+    firewalls:
+      - "{{ basic_firewall }}"
+    image: "{{ server_image }}"
+    location: "{{ server_location }}"
+    name: "{{ server_name }}"
+    placement_group: "{{ server_placement_group }}"
+    server_type: "{{ server_type }}"
+    ssh_keys:
+      - "{{ ssh_key_admin_user_name }}"
+    user_data: "{{ lookup('ansible.builtin.template', 'basic-ssh-hardening.yaml.j2', convert_data=false) }}"
+    state: present
+  register: server

ansible/roles/server-setup/tasks/main.yaml

@@ -0,0 +1,2 @@
+---
+- import_tasks: create-server.yaml

ansible/roles/server-setup/templates/basic-ssh-hardening.yaml.j2

@@ -0,0 +1,27 @@
+#cloud-config
+users:
+  - name: {{ admin_user }}
+    groups: users, admin
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - {{ ssh_key_admin_user }}
+packages:
+  - fail2ban
+  - ufw
+package_update: true
+package_upgrade: true
+runcmd:
+  - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
+  - systemctl enable fail2ban
+  - ufw allow OpenSSH
+  - ufw enable
+  - sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)X11Forwarding/s/^.*$/X11Forwarding no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 2/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)AllowTcpForwarding/s/^.*$/AllowTcpForwarding no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
+  - sed -i '$a AllowUsers {{ admin_user }}' /etc/ssh/sshd_config
+  - reboot