Initial ansible onboard

ansible/roles/geoip/tasks/install.yml

@@ -0,0 +1,10 @@
+- name: Install required packages
+  become: true
+  ansible.builtin.package:
+    pkg: "{{ item }}"
+    state: present
+  loop:
+    - geoip-bin
+    - geoip-database
+    - geoipupdate
+    - grepcidr

ansible/roles/geoip/tasks/main.yml

@@ -0,0 +1,18 @@
+- name: Install requirements
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+  tags:
+    - "role::geoip"
+    - "role::geoip::install"
+
+- name: Configure geoip
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/manage_config.yml"
+  tags:
+    - "role::geoip"
+    - "role::geoip::config"
+
+- name: Configure sshd (geoip)
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/manage_sshd.yml"
+  when: geoip_sshd_enabled
+  tags:
+    - "role::geoip"
+    - "role::geoip::sshd"

ansible/roles/geoip/tasks/manage_config.yml

@@ -0,0 +1,16 @@
+- name: Configure geoipupdate
+  become: true
+  ansible.builtin.template:
+    src: etc/GeoIP.conf.j2
+    dest: /etc/GeoIP.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+
+- name: Register cron job for geoipupdate
+  become: true
+  ansible.builtin.cron:
+    name: "Update GeoIP"
+    special_time: "{{ geoip_cron_job }}"
+    job: "/usr/bin/geoipupdate"

ansible/roles/geoip/tasks/manage_sshd.yml

@@ -0,0 +1,28 @@
+- name: Add SSH filter script
+  become: true
+  ansible.builtin.template:
+    src: usr/bin/sshfilter.sh.j2
+    dest: /usr/bin/sshfilter.sh
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Add acl to use sshfilter.sh
+  become: true
+  ansible.builtin.template:
+    src: etc/hosts.allow.j2
+    dest: /etc/hosts.allow
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+
+- name: Deny all hosts for sshd
+  become: true
+  ansible.builtin.template:
+    src: etc/hosts.deny.j2
+    dest: /etc/hosts.deny
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true