2024-09-24 15:19:51 +02:00
|
|
|
# Hostname and other host settings
|
2024-09-24 17:09:20 +02:00
|
|
|
hostname: contabo01.a13labs.pt
|
2024-09-24 15:19:51 +02:00
|
|
|
|
|
|
|
|
# SSH Connection and security
|
|
|
|
|
sshd_port: 22
|
|
|
|
|
ssh_allowed_networks:
|
|
|
|
|
- "0.0.0.0/0"
|
|
|
|
|
sshd_admin_net: "0.0.0.0/0"
|
|
|
|
|
sshd_allow_groups: "provision git users"
|
|
|
|
|
sshd_permit_root_login: "no"
|
|
|
|
|
sshd_password_authentication: "no"
|
|
|
|
|
sshd_allow_tcp_forwarding: "yes"
|
|
|
|
|
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
|
|
|
|
|
ssh_users:
|
|
|
|
|
- username: operator
|
|
|
|
|
comment: "Managed by Ansible"
|
|
|
|
|
sudoer: true
|
|
|
|
|
pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
|
|
|
|
|
- username: git
|
|
|
|
|
comment: "Managed by Ansible"
|
|
|
|
|
shell: "/usr/local/bin/gitea-shell"
|
|
|
|
|
|
|
|
|
|
# Due to an issue increase the number of max auth tries
|
|
|
|
|
sshd_max_auth_tries: 10
|
|
|
|
|
|
|
|
|
|
# Firewall ports
|
|
|
|
|
ufw_enable: true
|
|
|
|
|
fw_allowed_ports:
|
|
|
|
|
- { rule: "allow", port: "80", proto: "tcp" }
|
|
|
|
|
- { rule: "allow", port: "443", proto: "tcp" }
|
|
|
|
|
- { rule: "allow", port: "22", proto: "tcp" }
|
|
|
|
|
- { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" }
|
|
|
|
|
- { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" }
|
|
|
|
|
- { rule: "allow", port: "10254", proto: "tcp", from: "147.78.131.194" }
|
|
|
|
|
|
|
|
|
|
ufw_outgoing_traffic:
|
|
|
|
|
- 22 # SSH
|
|
|
|
|
- 53 # DNS
|
|
|
|
|
- 80 # HTTP
|
|
|
|
|
- 123 # NTP
|
|
|
|
|
- 443 # HTTPS
|
|
|
|
|
- 853 # DNS over TLS
|
|
|
|
|
- 10250 # Kubelet
|
|
|
|
|
- 16443 # Kube API Server
|
|
|
|
|
- 4443
|
|
|
|
|
- 9443
|
|
|
|
|
|
|
|
|
|
ufw_default_forward_policy: "ACCEPT"
|
|
|
|
|
|
|
|
|
|
ipv4_sysctl_settings:
|
|
|
|
|
net.ipv4.ip_forward: 1
|
|
|
|
|
|
|
|
|
|
disable_ipv6: true
|
|
|
|
|
|
|
|
|
|
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
|
|
|
|
|
custom_hosts_acls: true
|
|
|
|
|
|
|
|
|
|
# GeoIP subscription
|
|
|
|
|
geoip_sshd_enabled: true
|
|
|
|
|
ssh_allowed_zones:
|
|
|
|
|
- "BE"
|
|
|
|
|
- "PT"
|
|
|
|
|
|
|
|
|
|
# fail2ban
|
|
|
|
|
fail2ban_jails:
|
|
|
|
|
ssh:
|
|
|
|
|
enabled: true
|
|
|
|
|
port: "{{ sshd_port }}"
|
|
|
|
|
filter: "sshd"
|
|
|
|
|
logpath: "/var/log/auth.log"
|
|
|
|
|
maxretry: 5
|
|
|
|
|
findtime: 600
|
|
|
|
|
bantime: 3600
|
|
|
|
|
|
|
|
|
|
# Unattended upgrades
|
|
|
|
|
unattended_reboot: true
|
|
|
|
|
unattended_reboot_time: "04:30"
|
|
|
|
|
|
|
|
|
|
# Kubernetes specific settings
|
|
|
|
|
microk8s_alt_names: "{{ hostname }}"
|
|
|
|
|
k8s_version: 1.29
|
|
|
|
|
k8s_allowed_hosts:
|
|
|
|
|
- 87.67.163.177
|
|
|
|
|
|
|
|
|
|
k8s_users:
|
|
|
|
|
- username: operator
|
|
|
|
|
enabled: true
|
|
|
|
|
- username: git
|
|
|
|
|
namespace: "gitea"
|
|
|
|
|
enabled: true
|
|
|
|
|
|
|
|
|
|
# Let's encrypt issuer
|
|
|
|
|
issuer_email: c.alexandre.pires@alexpires.me
|
|
|
|
|
|
|
|
|
|
duo_users: ["*", "!provision", "!git"]
|
|
|
|
|
duo_api_hostname: api-7cda1654.duosecurity.com
|
