4e72ddf4ef
Completed Issue #2: Ansible Base Configuration All objectives met: - ✅ Hetzner Cloud dynamic inventory (hcloud plugin) - ✅ Common role (SSH hardening, UFW firewall, fail2ban, auto-updates) - ✅ Docker role (Docker Engine + Compose + networks) - ✅ Traefik role (reverse proxy with Let's Encrypt SSL) - ✅ Setup playbook (orchestrates all base roles) - ✅ Successfully tested on live test server (91.99.210.204) Additional improvements: - Fixed ansible.cfg for Ansible 2.20+ compatibility - Updated ADR dates to 2025 - All roles follow Infrastructure Agent patterns Test Results: - SSH hardening applied (key-only auth) - UFW firewall active (ports 22, 80, 443) - Fail2ban protecting SSH - Automatic security updates enabled - Docker running with traefik network - Traefik deployed and ready for SSL Files added: - ansible/playbooks/setup.yml - ansible/roles/docker/* (complete) - ansible/roles/traefik/* (complete) Closes #2 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
36 lines
1 KiB
Django/Jinja
36 lines
1 KiB
Django/Jinja
# Traefik Reverse Proxy
|
|
# Managed by Ansible - do not edit manually
|
|
|
|
services:
|
|
traefik:
|
|
image: traefik:{{ traefik_version }}
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
{% if traefik_dashboard_enabled %}
|
|
- "8080:8080"
|
|
{% endif %}
|
|
volumes:
|
|
- /etc/localtime:/etc/localtime:ro
|
|
- {{ traefik_docker_socket }}:{{ traefik_docker_socket }}:ro
|
|
- ./traefik.yml:/etc/traefik/traefik.yml:ro
|
|
- ./dynamic.yml:/etc/traefik/dynamic.yml:ro
|
|
- ./letsencrypt:/letsencrypt
|
|
networks:
|
|
- {{ traefik_network }}
|
|
{% if traefik_dashboard_enabled %}
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.dashboard.rule=Host(`{{ traefik_dashboard_domain }}`)"
|
|
- "traefik.http.routers.dashboard.entrypoints=websecure"
|
|
- "traefik.http.routers.dashboard.service=api@internal"
|
|
- "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
|
|
{% endif %}
|
|
|
|
networks:
|
|
{{ traefik_network }}:
|
|
external: true
|