From d8176ea43c91e428563a1dd5ab97f35f7e09cceb Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Fri, 3 Jan 2020 15:02:16 +0100
Subject: [PATCH] Added common ansible role

---
 common/defaults/main.yml                      |  5 +++++
 common/tasks/apt.yml                          |  4 ++++
 common/tasks/apticron.yml                     | 19 +++++++++++++++++++
 common/tasks/disk-check.yml                   |  9 +++++++++
 common/tasks/fail2ban.yml                     | 11 +++++++++++
 common/tasks/main.yml                         | 17 +++++++++++++++++
 common/tasks/tools.yml                        | 19 +++++++++++++++++++
 common/tasks/ufw.yml                          |  8 ++++++++
 .../templates/etc/apticron/apticron.conf.j2   |  6 ++++++
 .../etc/cron.hourly/check-disk-space.sh.j2    | 15 +++++++++++++++
 10 files changed, 113 insertions(+)
 create mode 100644 common/defaults/main.yml
 create mode 100644 common/tasks/apt.yml
 create mode 100644 common/tasks/apticron.yml
 create mode 100644 common/tasks/disk-check.yml
 create mode 100644 common/tasks/fail2ban.yml
 create mode 100644 common/tasks/main.yml
 create mode 100644 common/tasks/tools.yml
 create mode 100644 common/tasks/ufw.yml
 create mode 100644 common/templates/etc/apticron/apticron.conf.j2
 create mode 100644 common/templates/etc/cron.hourly/check-disk-space.sh.j2

diff --git a/common/defaults/main.yml b/common/defaults/main.yml
new file mode 100644
index 0000000..d871e4b
--- /dev/null
+++ b/common/defaults/main.yml
@@ -0,0 +1,5 @@
+---
+sshport: 22
+openports_list:
+  - 22
+#blacklist_ip_list:
diff --git a/common/tasks/apt.yml b/common/tasks/apt.yml
new file mode 100644
index 0000000..22fc140
--- /dev/null
+++ b/common/tasks/apt.yml
@@ -0,0 +1,4 @@
+---
+- name: update the package list
+  apt: update_cache=yes
+
diff --git a/common/tasks/apticron.yml b/common/tasks/apticron.yml
new file mode 100644
index 0000000..323ee72
--- /dev/null
+++ b/common/tasks/apticron.yml
@@ -0,0 +1,19 @@
+---
+- name: ensure apticron packages are installed
+  apt:
+    pkg: "{{ packages }}"
+    state: latest
+    update_cache: yes
+    cache_valid_time: 600
+  vars:
+    packages:
+      - apticron
+
+- name: configure apticron
+  template:
+    src: etc/apticron/apticron.conf.j2
+    dest: /etc/apticron/apticron.conf
+    owner: root
+    group: root
+    mode: 0644
+
diff --git a/common/tasks/disk-check.yml b/common/tasks/disk-check.yml
new file mode 100644
index 0000000..7da6e6c
--- /dev/null
+++ b/common/tasks/disk-check.yml
@@ -0,0 +1,9 @@
+---
+- name: set up check disk space cron script
+  template:
+    src: etc/cron.hourly/check-disk-space.sh.j2
+    dest: /etc/cron.hourly/check-disk-space.sh
+    owner: root
+    group: root
+    mode: 0750
+
diff --git a/common/tasks/fail2ban.yml b/common/tasks/fail2ban.yml
new file mode 100644
index 0000000..ee2939d
--- /dev/null
+++ b/common/tasks/fail2ban.yml
@@ -0,0 +1,11 @@
+---
+- name: install fail2ban
+  apt:
+    name: fail2ban
+    state: latest
+    update_cache: yes
+- name: enable fail2ban
+  service:
+    name: fail2ban
+    enabled: yes
+    started: started
diff --git a/common/tasks/main.yml b/common/tasks/main.yml
new file mode 100644
index 0000000..f2c1f63
--- /dev/null
+++ b/common/tasks/main.yml
@@ -0,0 +1,17 @@
+---
+- include: apt.yml
+  tags:
+    - apt
+- include: apticron.yml
+  tags:
+    - apticron
+- include: disk-check.yml
+  tags:
+    - disk
+- include: ufw.yml
+  tags:
+    - firewall
+- include: fail2ban.yml
+  tags:
+    - firewall
+- include: tools.yml
diff --git a/common/tasks/tools.yml b/common/tasks/tools.yml
new file mode 100644
index 0000000..b85fd78
--- /dev/null
+++ b/common/tasks/tools.yml
@@ -0,0 +1,19 @@
+---
+- name: ensure all tools packages are installed
+  apt:
+    pkg: "{{ packages }}"
+    state: latest
+    update_cache: yes
+    cache_valid_time: 600
+  vars:
+    packages:
+      - curl
+      - debsums
+      - iperf3
+      - mosh
+      - net-tools
+      - needrestart
+      - sqlite3
+      - sudo
+      - tmux
+
diff --git a/common/tasks/ufw.yml b/common/tasks/ufw.yml
new file mode 100644
index 0000000..d55194c
--- /dev/null
+++ b/common/tasks/ufw.yml
@@ -0,0 +1,8 @@
+---
+- name: allow ssh through firewall
+  ufw:
+    name: OpenSSH
+    rule: allow
+- name: enable ufw firewall
+  command:
+    cmd: ufw enable
diff --git a/common/templates/etc/apticron/apticron.conf.j2 b/common/templates/etc/apticron/apticron.conf.j2
new file mode 100644
index 0000000..41d8402
--- /dev/null
+++ b/common/templates/etc/apticron/apticron.conf.j2
@@ -0,0 +1,6 @@
+# apticron.conf
+#
+# Set EMAIL to a space separated list of addresses which will be notified of
+# impending updates. By default the root account will be notified.
+
+EMAIL="root@{{ ansible_domain }}"
diff --git a/common/templates/etc/cron.hourly/check-disk-space.sh.j2 b/common/templates/etc/cron.hourly/check-disk-space.sh.j2
new file mode 100644
index 0000000..b9f1648
--- /dev/null
+++ b/common/templates/etc/cron.hourly/check-disk-space.sh.j2
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+# Check disk space
+CURRENT=$(df / --output=pcent | tail --lines=1 | cut --delimiter='%' --field=1)
+THRESHOLD=90
+ADMIN="root@{{ ansible_domain }}"
+SUBJECT="[Disk Space Alert] The free space on {{ ansible_fqdn }} is critically low"
+MESSAGE=
+
+if [ "$CURRENT" -gt "$THRESHOLD" ]; then
+  mail -s "$SUBJECT" "$ADMIN" << EOF
+Your root partition remaining free space is critically low. Used: $CURRENT%
+EOF
+fi
+