jakub
b7f4ba6502
Tagged never,dockhand_install so it only runs when explicitly requested. Installs docker.io + docker-compose-v2, templates a compose file for fnsys/dockhand:latest at /docker/dockhand, and wires a oneshot systemd unit that brings the stack up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
47 lines
771 B
YAML
47 lines
771 B
YAML
---
|
|
- name: Baseline system setup
|
|
hosts: all
|
|
become: true
|
|
|
|
roles:
|
|
- role: baseline_sudo
|
|
tags: sudo
|
|
|
|
- role: users
|
|
tags: users
|
|
|
|
# ==============================
|
|
# FREEIPA / SSSD (optional)
|
|
# ==============================
|
|
|
|
- name: FreeIPA client setup
|
|
hosts: all
|
|
become: true
|
|
tags: never,sssd
|
|
|
|
roles:
|
|
- role: freeipa_client
|
|
|
|
# ==============================
|
|
# DOCKHAND (optional)
|
|
# ==============================
|
|
|
|
- name: Install dockhand
|
|
hosts: all
|
|
become: true
|
|
tags: never,dockhand_install
|
|
|
|
roles:
|
|
- role: dockhand
|
|
|
|
# ==============================
|
|
# SSH HARDENING (run last!)
|
|
# ==============================
|
|
|
|
- name: SSH hardening
|
|
hosts: all
|
|
become: true
|
|
tags: never,hardening
|
|
|
|
roles:
|
|
- role: ssh_hardening |