Initial ansible onboard

ansible/roles/bootstrap/.ansible-lint

@@ -0,0 +1,10 @@
+---
+exclude_paths:
+  - .git/
+  - .github/
+  - tests/
+enable_list:
+  - fqcn-builtins  # opt-in
+warn_list:
+  - line-length
+  - yaml[line-length]

ansible/roles/bootstrap/.yamllint.yml

@@ -0,0 +1,15 @@
+---
+extends: default
+ignore: ".tox*\n.git*"
+rules:
+  line-length:
+    max: 120
+    level: warning
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: false
+  braces:
+    max-spaces-inside: 1
+  octal-values:
+    forbid-implicit-octal: true
+    forbid-explicit-octal: true

ansible/roles/bootstrap/tasks/main.yml

@@ -0,0 +1,130 @@
+---
+- name: Check if we're using the default SSH port
+  ansible.builtin.wait_for:
+    port: 22
+    state: started
+    host: "{{ ansible_ssh_host }}"
+    connect_timeout: 5
+    timeout: 10
+  register: default_ssh
+  ignore_errors: true
+  ignore_unreachable: true
+
+- name: Check custom SSH port
+  when: sshd_port is defined
+  block:
+    - name: Change to port '{{ sshd_port }}'
+      ansible.builtin.set_fact:
+        ansible_port: "{{ sshd_port }}"
+
+    - name: Check if we're using the SSH port '{{ sshd_port }}'
+      ansible.builtin.wait_for:
+        port: "{{ sshd_port }}"
+        state: started
+        host: "{{ ansible_ssh_host }}"
+        connect_timeout: 5
+        timeout: 10
+      ignore_errors: true
+      register: configured_ssh
+      ignore_unreachable: true
+
+- name: Set inventory ansible_port to default
+  ansible.builtin.set_fact:
+    ansible_port: 22
+  when: default_ssh is defined
+    and default_ssh.state | d() == "started"
+  register: sshd_port_set
+
+- name: SSH is properly configured at port '{{ sshd_port }}'
+  ansible.builtin.set_fact:
+    ansible_port: "{{ sshd_port }}"
+  when: configured_ssh is defined
+    and configured_ssh.state is defined
+    and configured_ssh.state | d() == "started"
+  register: sshd_port_set
+
+- name: Configure custom SSH port
+  when: sshd_port is defined
+    and default_ssh is defined
+    and default_ssh.state | d() == "started"
+  block:
+    - name: Changing default ssh port to '{{ sshd_port }}'
+      become: true
+      ansible.builtin.lineinfile:
+        dest: /etc/ssh/sshd_config
+        regexp: '^Port\s'
+        line: "Port {{ sshd_port }}"
+        state: present
+      register: sshd_port_config
+
+    - name: Force sshd to restart # noqa no-handler
+      when: sshd_port_config.changed
+      become: true
+      ansible.builtin.service:
+        name: ssh
+        state: restarted
+
+    - name: Change to port '{{ sshd_port }}' # noqa no-handler
+      when: sshd_port_config.changed
+      ansible.builtin.set_fact:
+        ansible_port: "{{ sshd_port }}"
+
+    - name: Check if we're using the SSH port '{{ sshd_port }}' # noqa no-handler
+      when: sshd_port_config.changed
+      ansible.builtin.wait_for:
+        port: "{{ sshd_port }}"
+        state: started
+        host: "{{ ansible_ssh_host }}"
+        connect_timeout: 5
+        timeout: 10
+      ignore_errors: true
+      register: configured_ssh
+
+    - name: SSH is properly configured at port '{{ sshd_port }}'
+      when: sshd_port_config.changed
+        and configured_ssh is defined
+        and configured_ssh.state is defined
+        and configured_ssh.state | d() == "started"
+      ansible.builtin.set_fact:
+        ansible_port: "{{ sshd_port }}"
+      register: sshd_port_set
+
+- name: Fail if SSH port was not auto-detected (unknown)
+  ansible.builtin.fail:
+    msg: "Host was unreachable! Check ssh port!"
+  when: sshd_port_set is undefined
+
+- name: Confirm host connection works
+  ansible.builtin.ping:
+
+- name: Run deferred setup to gather facts
+  ansible.builtin.setup:
+
+- name: Setting hostname '{{ hostname }}'
+  become: true
+  ansible.builtin.hostname:
+    name: "{{ hostname }}"
+
+- name: Update Package Cache (apt/Ubuntu)
+  become: true
+  tags: always
+  ansible.builtin.apt:
+    update_cache: true
+  changed_when: false
+  when: ansible_distribution == "Ubuntu"
+
+- name: Update Package Cache (dnf/CentOS)
+  become: true
+  tags: always
+  ansible.builtin.dnf:
+    update_cache: true
+  changed_when: false
+  when: ansible_distribution == "CentOS"
+
+- name: Update Package Cache (yum/Amazon)
+  become: true
+  tags: always
+  ansible.builtin.dnf:
+    update_cache: true
+  changed_when: false
+  when: ansible_distribution == "Amazon"