ADD: Bash script to run apt upgrade playbook

.gitignore

@@ -1 +0,0 @@
-secrets.yml

example_secrets.yml

@@ -1,7 +1,2 @@
 # Copy this into secrets.yml and replate with a real values
-ansible_password: 'REPLACE_WITH_ROOT_PASSWORD'
-# Zabbix proxy parameters for connecting to Zabbix server
-zabbix_server_address: 'x.x.x.x'
-zabbix_psk_identity: '<zabbix_psk_identity'
-zabbix_proxy_hostname: '<zabbix_proxy_hostname>' # if needed, in the actual playbook it is set to the hostname of the target
-zabbix_proxy_psk: 'REPLACE_WITH_ZABBIX_PSK'
+ansible_password: 'REPLACE_WITH_ROOT_PASSWORD'

inventory/hosts.ini

@@ -19,11 +19,13 @@ truenas ansible_host=10.0.0.200
 [lxc]
 gitea ansible_host=10.0.0.108
 zabbix-proxy ansible_host=10.0.0.110 
-
+pi-hole ansible_host=10.0.0.104
 ansible ansible_host=10.0.0.111
 automate ansible_host=10.0.0.112
+
 #localhost ansible_connection=local # for testing playbooks on the control node
 
+
 [pbs]
 proxmox-backup ansible_host=10.0.0.201
 
@@ -31,7 +33,4 @@ proxmox-backup ansible_host=10.0.0.201
 [ubuntu:children]
 docker
 ubuntu_servers
-lxc
-
-[new]
-pi-hole ansible_host=10.0.0.104 ansible_user=root
+lxc

playbooks/lxc_setup_ubuntu.yml

@@ -1,41 +1,43 @@
 ---
-- name: 1. Secure and Configure a New LXC Container
-  hosts: 'new' # Target hosts in the [new] group
-  remote_user: root # Connect as root, as defined in the inventory for this group
-  gather_facts: no
-  vars:
-    target_user: mbuz
-    my_public_keys:
-      - "{{ lookup('file', '/home/mbuz/.ssh/id_ed25519.pub') }}"
+- name: Secure and Configure a New LXC Container
+  hosts: 'lxc' # Hosts or group defined in your inventory
+  remote_user: root
   tasks:
-    - name: Create user '{{ target_user }}'
+    - name: 1. Create user '{{ target_user }}'
       ansible.builtin.user:
         name: '{{ target_user }}'
         shell: /bin/bash
-        groups: sudo
+        groups: sudo # Add to sudo (for Debian/Ubuntu)
         state: present
 
-    - name: Allow '{{ target_user }}' to use sudo without a password
+    - name: 1.1. Allow '{{ target_user }}' to use sudo without a password
       ansible.builtin.copy:
         dest: /etc/sudoers.d/90-{{ target_user }}-nopasswd
         content: '{{ target_user }} ALL=(ALL) NOPASSWD: ALL'
         mode: '0440'
         validate: /usr/sbin/visudo -cf %s
 
-    - name: Set up authorized_keys for '{{ target_user }}'
+    - name: 2. Set up authorized_keys for '{{ target_user }}'
       ansible.posix.authorized_key:
         user: '{{ target_user }}'
         key: "{{ item }}"
         state: present
         path: /home/{{ target_user }}/.ssh/authorized_keys
       loop: "{{ my_public_keys }}"
+      # ansible.posix.authorized_key will create an .ssh directory with the correct permissions.
 
-    - name: Lock password for '{{ target_user }}'
+    - name: 3. Lock password for '{{ target_user }}'
       ansible.builtin.user:
         name: '{{ target_user }}'
         password_lock: yes
 
-    - name: Disallow root login over SSH
+    - name: 4.0. Install software-properties-common
+      ansible.builtin.apt:
+        name: software-properties-common
+        state: present
+        update_cache: yes
+
+    - name: 4.1. Disallow root login over SSH
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^#?PermitRootLogin'
@@ -43,7 +45,7 @@
         validate: /usr/sbin/sshd -t -f %s
       notify: restart sshd
 
-    - name: Disallow password authentication
+    - name: 4.2. Disallow password authentication
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^#?PasswordAuthentication'
@@ -52,30 +54,10 @@
       notify: restart sshd
 
   handlers:
-    - name: Restart sshd server
+    # This block will only run if at least one task sends a notification.
+    # This prevents unnecessary service restarts.
+    - name: 5. Restart sshd server
       listen: "restart sshd"
       ansible.builtin.service:
         name: sshd
         state: restarted
-
-# --- Move host from NEW to LXC group ---
-- name: 2. Graduate Host from [new] to [lxc] in Inventory
-  hosts: localhost
-  connection: local
-  gather_facts: no
-  tasks:
-    - name: Remove host from the [new] group
-      ansible.builtin.lineinfile:
-        path: /opt/ansible/inventory/hosts.ini
-        regexp: "^{{ item }}\\s" # Match the start of the line with the hostname
-        state: absent
-      loop: "{{ groups['new'] }}" # Loop over all hosts in the 'new' group
-
-    - name: Add host to the [lxc] group
-      ansible.builtin.blockinfile:
-        path: /opt/ansible/inventory/hosts.ini
-        block: |
-          {{ item }} ansible_host={{ hostvars[item]['ansible_host'] }}
-        insertafter: "[lxc]"
-        marker: "# {mark} ANSIBLE MANAGED BLOCK FOR LXC"
-      loop: "{{ groups['new'] }}" # Loop over all hosts in the 'new' group