portfolio/professional-infra/linux-operations-automation/roles/base_provision

Base Provision Role

Provision basic infrastructure on enterprise nodes with security hardening.

Features

• Idempotent: All tasks use proper idempotency markers (changed_when, failed_when)
• Handlers: SSH and fail2ban restarts use handlers instead of direct service calls
• Variables: All configuration in defaults/main.yml - no hardcoding
• Validation: Pre-flight checks for system requirements
• Firewall: UFW firewall configuration with configurable rules
• SSH Security: Root login disabled, password auth disabled, key-based auth only

Role Variables

See defaults/main.yml for all available variables.

Key Variables

• node_timezone: System timezone (default: UTC)
• admin_user: Admin username for infrastructure access
• ssh_port: SSH service port (default: 22)
• base_packages: List of base packages to install
• firewall_enabled: Enable UFW firewall (default: true)
• firewall_allowed_tcp_ports: Allowed TCP ports for firewall

Secret Variables

This portfolio demo does not require secrets for offline validation. If you extend it with real passwords or keys, copy group_vars/vault.example.yml into an encrypted Ansible Vault file and keep real values out of normal git history.

Usage

- role: base_provision
  vars:
    node_timezone: "Europe/Warsaw"
    firewall_enabled: true

Handlers

• restart sshd: Restarts SSH service (triggered by config changes)
• restart fail2ban: Restarts fail2ban service (triggered by config changes)

Tags

• provision: All provisioning tasks
• base: Base provision role tasks