first vps

ansible/roles/backup/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+# Restic backup setup — installs restic and deploys the backup script
+- name: Install restic
+  apt:
+    name: restic
+    state: present
+
+- name: Create secrets directory
+  file:
+    path: /srv/secrets
+    state: directory
+    mode: "0700"
+
+- name: Deploy backup script
+  template:
+    src: backup.sh.j2
+    dest: /usr/local/bin/backup.sh
+    mode: "0700"
+
+- name: Setup daily backup cron (3 AM)
+  cron:
+    name: "restic daily backup"
+    hour: "3"
+    minute: "0"
+    job: "/usr/local/bin/backup.sh >> /var/log/backup.log 2>&1"

ansible/roles/backup/templates/backup.sh.j2

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Managed by Ansible — do not edit manually
+
+export B2_ACCOUNT_ID="{{ b2_account_id | default('YOUR_KEY_ID') }}"
+export B2_ACCOUNT_KEY="{{ b2_account_key | default('YOUR_APPLICATION_KEY') }}"
+export RESTIC_PASSWORD="{{ restic_password | default('YOUR_BACKUP_PASSWORD') }}"
+
+REPO="b2:{{ b2_bucket | default('your-bucket') }}:/backup"
+
+restic -r "$REPO" backup \
+  --exclude /home/papyrus/apps/navidrome/music \
+  /var/lib/docker/volumes \
+  /srv/secrets \
+  /home/papyrus/apps
+
+restic -r "$REPO" forget --keep-last 7 --keep-weekly 4 --prune

ansible/roles/base/tasks/main.yml

@@ -0,0 +1,24 @@
+---
+# Base packages and system updates
+- name: Update apt cache
+  apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Upgrade all packages
+  apt:
+    upgrade: dist
+
+- name: Install essential packages
+  apt:
+    name:
+      - curl
+      - git
+      - unzip
+      - vim
+      - htop
+      - wget
+      - ca-certificates
+      - gnupg
+      - lsb-release
+    state: present

ansible/roles/docker/tasks/main.yml

@@ -0,0 +1,47 @@
+---
+# Docker CE + Docker Compose v2 plugin
+- name: Remove old Docker packages
+  apt:
+    name:
+      - docker
+      - docker-engine
+      - docker.io
+      - containerd
+      - runc
+    state: absent
+
+- name: Add Docker GPG key
+  ansible.builtin.get_url:
+    url: https://download.docker.com/linux/ubuntu/gpg
+    dest: /etc/apt/keyrings/docker.asc
+    mode: "0644"
+
+- name: Add Docker apt repository
+  ansible.builtin.apt_repository:
+    repo: >-
+      deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc]
+      https://download.docker.com/linux/ubuntu
+      {{ ansible_distribution_release }} stable
+    state: present
+
+- name: Install Docker CE
+  apt:
+    name:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-compose-plugin
+    state: present
+    update_cache: true
+
+- name: Enable and start Docker
+  systemd:
+    name: docker
+    enabled: true
+    state: started
+
+- name: Add admin user to docker group
+  user:
+    name: "{{ ansible_user }}"
+    groups: docker
+    append: true

ansible/roles/security/tasks/main.yml

@@ -0,0 +1,46 @@
+---
+# Security hardening — UFW firewall + fail2ban
+- name: Install security packages
+  apt:
+    name:
+      - ufw
+      - fail2ban
+    state: present
+
+- name: Set UFW default deny incoming
+  community.general.ufw:
+    direction: incoming
+    default: deny
+
+- name: Set UFW default allow outgoing
+  community.general.ufw:
+    direction: outgoing
+    default: allow
+
+- name: Allow SSH through UFW
+  community.general.ufw:
+    rule: allow
+    port: "22"
+    proto: tcp
+
+- name: Allow HTTP through UFW
+  community.general.ufw:
+    rule: allow
+    port: "80"
+    proto: tcp
+
+- name: Allow HTTPS through UFW
+  community.general.ufw:
+    rule: allow
+    port: "443"
+    proto: tcp
+
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled
+
+- name: Enable and start fail2ban
+  systemd:
+    name: fail2ban
+    enabled: true
+    state: started