1 files changed, 153 insertions, 0 deletions
diff --git a/bootstrap/tasks/main.yml b/bootstrap/tasks/main.yml
new file mode 100644
index 0000000..4512804
--- /dev/null
+++ b/bootstrap/tasks/main.yml
@@ -0,0 +1,153 @@
+# SPDX-FileCopyrightText: 2026 Matthew Fennell <matthew@fennell.dev>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+
+- name: Ensure all authorized keys are copied to root account
+  remote_user: root
+  ansible.posix.authorized_key:
+   key: |
+    {% for key in authorized_key_files %}
+    {{ lookup('file', key) }}
+    {% endfor %}
+   user: root
+   exclusive: true
+
+# Now, we create a non-root user with sudo privileges
+- name: Ensure wheel group exists
+  remote_user: root
+  ansible.builtin.group:
+   name: wheel
+   state: present
+
+- name: Ensure wheel group allows passwordless sudo
+  remote_user: root
+  ansible.builtin.lineinfile:
+   dest: /etc/sudoers
+   state: present
+   regexp: "^%wheel"
+   line: "%wheel ALL=(ALL) NOPASSWD: ALL"
+   validate: visudo -cf %s
+
+- name: Ensure non-root admin account is created in wheel group
+  remote_user: root
+  ansible.builtin.user:
+   name: admin
+   groups: wheel
+   append: true
+
+- name: Ensure admin ssh directory exists
+  remote_user: root
+  ansible.builtin.file:
+   path: /home/admin/.ssh
+   state: directory
+   owner: admin
+   group: admin
+   mode: "0700"
+
+- name: Copy authorised keys to admin account
+  remote_user: root
+  ansible.builtin.copy:
+   src: /root/.ssh/authorized_keys
+   dest: /home/admin/.ssh/authorized_keys
+   remote_src: true
+   owner: admin
+   group: admin
+   mode: preserve
+
+- name: Ensure cloud-init is disabled
+  ansible.builtin.copy:
+   content: ""
+   dest: /etc/cloud/cloud-init.disabled
+   force: false
+   owner: root
+   group: root
+   mode: "0644"
+  become: true
+
+- name: Ensure hostname is set
+  ansible.builtin.hostname:
+   name: "{{ hostname }}"
+  become: true
+
+- name: Ensure hostname is configured in /etc/hosts
+  ansible.builtin.template:
+   src: hosts.j2
+   dest: /etc/hosts
+   owner: root
+   group: root
+   mode: "0644"
+  become: true
+
+# This is needed by ansible.builtin.deb822_repository to interact with the
+# sources lists. In ansible-core 2.20 and above, there is a builtin
+# install_python_debian parameter that handles that without this extra step,
+# but we are currently running 2.19.
+# TODO(debian-forky) use deb822_repository's install_python_debian parameter
+- name: Ensure python3-debian is installed
+  ansible.builtin.apt:
+   name:
+    - python3-debian
+   state: present
+   update_cache: true
+  become: true
+
+- name: Ensure debian apt repositories are configured
+  ansible.builtin.deb822_repository:
+   name: debian
+   uris: "{{ debian_uri }}"
+   suites:
+    - "{{ debian_version }}"
+    - "{{ debian_version }}-updates"
+   components: main
+   signed_by: /usr/share/keyrings/debian-archive-keyring.gpg
+  become: true
+
+- name: Ensure debian-security apt repositories are configured
+  ansible.builtin.deb822_repository:
+   name: debian-security
+   uris: "{{ debian_security_uri }}"
+   suites: "{{ debian_version }}-security"
+   components: main
+   signed_by: /usr/share/keyrings/debian-archive-keyring.gpg
+  become: true
+
+- name: Ensure required packages are installed
+  ansible.builtin.apt:
+   name:
+    - rsync  # Backups
+    - systemd-timesyncd  # Used to make sure the date is correct
+    - ufw  # Firewall
+    - unattended-upgrades  # Not every hosting provider installs by default
+   state: present
+   update_cache: true
+  become: true
+
+# Vultr adds a custom sshd_config file that enabled password authentication.
+# I don't want this to be enabled, since I'm already copying the public key.
+- name: Ensure password authentication is not explicitly enabled
+  ansible.builtin.file:
+   path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
+   state: absent
+  become: true
+  notify: Restart sshd
+
+- name: Ensure password based authentication is disabled
+  ansible.builtin.copy:
+   src: 50-disable-password-auth.conf
+   dest: "/etc/ssh/sshd_config.d/50-disable-password-auth.conf"
+   owner: root
+   group: root
+   mode: "0644"
+  become: true
+  notify: Restart sshd
+
+- name: Ensure unattended upgrades config is installed
+  ansible.builtin.copy:
+   src: 50unattended-upgrades
+   dest: "/etc/apt/apt.conf.d/50unattended-upgrades"
+   owner: root
+   group: root
+   mode: "0644"
+  become: true