Initial VPS operations handbook

2026-08-03 12:26:42 +08:00
commit b73125e5bc
97 changed files with 3641 additions and 0 deletions
@@ -0,0 +1,44 @@
+---
+- name: Audit SSH daemon effective configuration
+  ansible.builtin.command:
+    argv:
+      - sshd
+      - -T
+  register: baseline_sshd_effective
+  changed_when: false
+  failed_when: false
+
+- name: Report SSH hardening observations without changing SSH
+  ansible.builtin.debug:
+    msg:
+      permit_root_login: >-
+        {{ baseline_sshd_effective.stdout_lines | select('match', '^permitrootlogin ') | list }}
+      password_authentication: >-
+        {{ baseline_sshd_effective.stdout_lines | select('match', '^passwordauthentication ') | list }}
+
+- name: Audit time synchronization service state
+  ansible.builtin.command:
+    argv:
+      - systemctl
+      - is-active
+      - systemd-timesyncd
+  register: baseline_timesync_state
+  changed_when: false
+  failed_when: false
+
+- name: Install baseline logrotate policy only with explicit opt-in
+  ansible.builtin.copy:
+    dest: /etc/logrotate.d/vps-baseline
+    content: |
+      /var/log/vps-health/*.log /var/log/vps-restic/*.log {
+          weekly
+          rotate 8
+          missingok
+          notifempty
+          compress
+          create 0640 root root
+      }
+    owner: root
+    group: root
+    mode: "0644"
+  when: baseline_manage_logrotate | bool