Ansible playbook for provisioning my servers

Requirements

On VPS - Debian 12+. On VPS provider - opened ports: SSH (server_ssh_port), 80/tcp, 443/tcp, 443/udp, and role-specific public ports such as 3x-ui Hysteria2 UDP. On Cloudflare - token (DNS propagated during setup) On PC - just ansible. For MacOS also passlib because of some crypto module.

Instructions

Initial setup

git clone https://github.com/Mayurifag/mayurifag.ru.git
cd mayurifag.ru
cp -rfp inventories/sample inventories/my-provision # and change it directly
ansible-galaxy install -r requirements.yml

Production deployment

TL;DR

make bootstrap HOST=hostname # run once, its cleaning known_hosts and makes ssh configuration
make deploy hostname "traefik,mus" # or make deploy-all if you are sure

Optional steps

• Enroll this workstation in NetBird's remote-admins group from a host with NetBird enabled:

make deploy netbird_enroll HOST='<netbird-host>'

• Make new ssh config section for convenience and using tssh' udp by default

# ~/.ssh/config
Host change_that_provider change_that_website.com
    HostName change.that
    User admin_user # Change user
    Port 2222 # change port
    #!! UdpMode KCP
    #!! TsshdPort 12345 # change this

Applications List

This list changed a lot through years, I'm trying to remove things I do not use.

Name	Subdomain	Auth	Watchtower	UFW ports
3x-ui	3x	app	+	36500/udp (hysteria2)
BentoPDF	pdf	ldap	+
Beszel	beszel	app	+
ConvertX	convert	ldap	+
Docmost	doc	app
EchoIP	ip	none	+
Dynacat	rss	ldap	+
Excalidraw	draw	none
Mini-QR	qr	ldap	+
mayurifag.github.io		none	+
mus	mus	ldap	+
Navidrome	navidrome	app	+
lldap	ldap	ldap	+
MailFlow	mail	app
NetBird	netbird	OIDC		3478/udp (STUN)
OpenCloud	cloud	ldap
Portainer	portainer	app	+
SnapOtter	images	ldap	+
TG AI Manager	tg	ldap	+
Traefik / Crowdsec	traefik	ldap		80/tcp, 443/tcp, 443/udp (http3)
Tinyauth	auth	OIDC	+
Watchtower HTTP API	watchtower	app	+

Refer to POST_INSTALL.md for after deployment info.

Homelab

Proxmox, Home Assistant, Immich, HomeKit, Qwen, private DNS, and HTTPS are documented in HOMELAB.md. homelab.yml separates the Proxmox host and photo guest from VPS provisioning. Deploy with explicit inventory hosts and tags.

Notes:

• ufw also allows ssh tcp port
• traefik is not autoupdated because they add breaking changes on patch versions
• opencloud is not autoupdated because requires running migration scripts

TODO

• High priority: Deploy SearXNG and configure it as web search for the local AI agent.
• Apple Home access for wife: choose a second HomeKit Bridge for her separate Apple Home, or buy a HomePod for shared-home access.
• Homelab follow-up: bare-metal network bootstrap. See HOMELAB.md.

On hold

• https://github.com/pranshuparmar/witr - wait debian 14 update
• Bandwhich - will require downloading binary to root - wait for deb repo
• When Tinyauth will be an OIDC provider
  • make it work for opencloud
  • Portainer - setup automatic LDAP
• zerobyte - webapp for restic backups - wait until developed stable version

Thinking if I need it / probably wont do - ideas / notes

• Crowdsec - for several countries or specific shit first text into telegram to ban or not with a reason. Opencloud issue with PROPFIND perhaps needed to be whitelisted idk
• motd ideas
  • maybe also show taken ports?
• try https://dockhand.pro/manual/ for possible portainer alternative
  • For now i think no need until replaces watchtower API
• try https://github.com/stalwartlabs/stalwart for email
  • Extract dns into another role?
• Add simple secret sharing app
  • Hemmelig - too much things, analytics and so on
  • also maybe url shorten like https://github.com/anhostfr/nah.pet
  • I also might need to share files
  • https://github.com/Luzifer/ots seems fine
• Watchtowerrr
  • use config.json for auth to dockerhub to prevent limits
• VPS security
  • Kernel params to have less /var/log/syslog noise - add to crowdsec btw
  • https://madaidans-insecurities.github.io/guides/linux-hardening.html
  • (wait for update) https://github.com/docker/docker-bench-security
  • (not sure) https://github.com/quay/clair
  • Make connection to docker through proxy
  • https://github.com/imthenachoman/How-To-Secure-A-Linux-Server
• SSH tunnel/bastion
  • Cloudflare + tailscale ips only.
  • Is it compatible with ansible deployment then?
  • 443 traffic might be gone through cloudflare proxy then
  • Whitelist for cf/tailscale, more enforcing rules for spammers
  • cf rules for spammers?
  • proxies-cfg will work fine? ssh with proxies?
• Grimmory - for Kindle KOReader - sync progress and books download
• Grafana/Prometheus stack
• Track finances selfhosted
  • Has to support auto import crypto, ibkr, russian brokers, banks, georgian banks - no way today
  • Save data to opencloud
  • https://github.com/we-promise/sure
• ufw-docker integration
  • Maybe use https://github.com/shinebayar-g/ufw-docker-automated
  • Problem for docker is that on server reboot or else address of docker container is changing so rules have to be updated
  • Block everything. There are a lot of exceptions: ssh/web/dns/dhcp/ntp
  • open port if needed in each ansible role
  • IP Masquerading ?
  • research https://github.com/capnspacehook/whalewall (not updated though)