main.yml

---
- hosts: all
  become: true
  roles:
    - role: base
      tags: base

    - role: nickjj.docker
      tags: docker
      docker__users: [
        "{{ ansible_ssh_user }}"
      ]
      ignore_errors: true

    - role: weareinteractive.ufw
      tags: ufw
      ufw_enabled: true
      ufw_packages: ["ufw"]
      ufw_rules:
        - logging: "full"
        - rule: allow
          to_port: "443"
        - rule: allow
          to_port: "80"
        - rule: allow
          to_port: "{{ ssh_port }}"
        # Wireguard
        - rule: allow
          to_port: "51820"
          proto: udp
        # Delete default rule
        - rule: allow
          name: Anywhere
          delete: true
      ufw_manage_config: true
      ufw_config:
        IPV6: "yes"
        DEFAULT_INPUT_POLICY: DROP
        DEFAULT_OUTPUT_POLICY: ACCEPT
        DEFAULT_FORWARD_POLICY: DROP
        DEFAULT_APPLICATION_POLICY: SKIP
        MANAGE_BUILTINS: "no"
        IPT_SYSCTL: /etc/ufw/sysctl.conf
        IPT_MODULES: ""

    - role: shell
      tags: shell

    - role: profile
      tags: profile

    - role: services
      tags: services

    - role: vitalk.secure-ssh
      tags: ssh
      ssh_user: "{{ ansible_ssh_user }}"
      ssh_identity_key: "{{ ssh_identity_key_path }}"

    - role: security
      tags: security