ansible

ansible/inventory/host_vars/asxpio-ops.yaml

@@ -0,0 +1,47 @@
+---
+# WireGuard VPN Configuration for asxpio-ops
+wireguard_port: 60101
+wireguard_interface: wg0
+wireguard_ipv4: 10.20.0.10
+wireguard_ipv6: fd69:69:69::1
+wireguard_ipv4_network: 10.20.0.0/24
+wireguard_ipv6_network: fd69:69:69::/64
+
+# Enable UFW firewall rules (set to false to use iptables PostUp/PostDown)
+wireguard_enable_ufw: false
+
+# WireGuard clients
+wireguard_clients:
+  - name: asxpio-services
+    ipv4: 10.20.0.20
+    ipv6: fd69:69:69::20
+    preshared_key: true
+    persistent_keepalive: 25
+  - name: laptop
+    ipv4: 10.20.0.2
+    ipv6: fd69:69:69::2
+    preshared_key: true
+    persistent_keepalive: 25
+  - name: phone
+    ipv4: 10.20.0.3
+    ipv6: fd69:69:69::3
+    preshared_key: true
+    persistent_keepalive: 25
+  - name: pixel9
+    ipv4: 10.20.0.4
+    ipv6: fd69:69:69::4
+    preshared_key: true
+    persistent_keepalive: 25
+
+# Optional: DNS servers for clients
+wireguard_dns_servers:
+   - 1.1.1.1
+   - 1.0.0.1
+
+# Optional: Additional routes for split tunneling
+# wireguard_additional_routes:
+#   - 192.168.1.0/24
+
+# SSH Hardening Configuration
+# Allow public SSH access for Forgejo git operations
+ssh_allow_public_git: true

ansible/inventory/host_vars/asxpio-services.yaml

@@ -0,0 +1,4 @@
+---
+# SSH Hardening Configuration
+# Restrict SSH to VPC and WireGuard networks only
+ssh_allow_public_git: false

ansible/inventory/hosts.yaml

@@ -0,0 +1,45 @@
+---
+# Ansible inventory for asxpio infrastructure
+# Update IP addresses after running terraform apply
+
+all:
+  vars:
+    ansible_user: root
+    ansible_python_interpreter: /usr/bin/python3
+
+  children:
+    asxpio:
+      vars:
+        # Common variables for all asxpio servers
+        timezone: UTC
+        locale: en_US.UTF-8
+
+      children:
+        ops_servers:
+          hosts:
+            asxpio-ops:
+              ansible_host: 10.20.0.10 #65.109.14.216
+              server_role: ops
+              server_type: cx22
+              services:
+                - traefik
+                - forgejo
+                - grafana
+                - prometheus
+                - loki
+                - static_sites
+
+        services_servers:
+          hosts:
+            asxpio-services:
+              ansible_host: 10.20.0.20 #95.217.15.42
+              server_role: services
+              server_type: cx43
+              services:
+                - forgejo_runner
+                - immich
+                - minecraft
+                - valheim
+                - factorio
+                - prosody
+                - coturn