From eef4881ffd74f039910acb9199bdf71c073438f1 Mon Sep 17 00:00:00 2001 From: Zedhugh Chen Date: Tue, 18 Aug 2026 03:16:42 +0800 Subject: [PATCH] =?UTF-8?q?ansible:=20=E6=96=B0=E5=A2=9E=20VPS=20=E5=88=9D?= =?UTF-8?q?=E5=A7=8B=E5=8C=96=20playbook=20=E4=B8=8E=20shadowsocks-libev?= =?UTF-8?q?=20=E9=83=A8=E7=BD=B2=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ansible/group_vars/vps_debian.yml | 4 + ansible/inventory.ini | 2 + ansible/playbooks/shadowsocks-libev.yaml | 34 ++++++++ ansible/playbooks/vps_debian_provision.yaml | 88 +++++++++++++++++++++ ansible/templates/ss-config.json.j2 | 9 +++ ansible/vars/vault.yaml | 14 ++++ 6 files changed, 151 insertions(+) create mode 100644 ansible/group_vars/vps_debian.yml create mode 100644 ansible/inventory.ini create mode 100644 ansible/playbooks/shadowsocks-libev.yaml create mode 100644 ansible/playbooks/vps_debian_provision.yaml create mode 100644 ansible/templates/ss-config.json.j2 create mode 100644 ansible/vars/vault.yaml diff --git a/ansible/group_vars/vps_debian.yml b/ansible/group_vars/vps_debian.yml new file mode 100644 index 0000000..d487002 --- /dev/null +++ b/ansible/group_vars/vps_debian.yml @@ -0,0 +1,4 @@ +--- +ansible_user: zedhugh +ansible_python_interpreter: /usr/bin/python3 +ansible_ssh_port: 44444 diff --git a/ansible/inventory.ini b/ansible/inventory.ini new file mode 100644 index 0000000..f340097 --- /dev/null +++ b/ansible/inventory.ini @@ -0,0 +1,2 @@ +[vps_debian] +yunyoo-tokyo diff --git a/ansible/playbooks/shadowsocks-libev.yaml b/ansible/playbooks/shadowsocks-libev.yaml new file mode 100644 index 0000000..f6ab341 --- /dev/null +++ b/ansible/playbooks/shadowsocks-libev.yaml @@ -0,0 +1,34 @@ +--- +- name: 配置 shadowsocks-libev 服务器 + hosts: vps_debian + become: true + vars_files: + - ../vars/vault.yaml + + tasks: + - name: 安装 shadowsocks-libev + apt: + name: shadowsocks-libev + state: present + update_cache: true + + - name: 配置 shadowsocks-libev 服务器 + template: + src: ../templates/ss-config.json.j2 + dest: /etc/shadowsocks-libev/config.json + owner: root + group: root + mode: '0644' + notify: restart shadowsocks-libev server + + - name: 启动 shadowsocks-libev 服务器 + systemd: + name: shadowsocks-libev + enabled: true + state: started + + handlers: + - name: restart shadowsocks-libev server + systemd: + name: shadowsocks-libev + state: restarted diff --git a/ansible/playbooks/vps_debian_provision.yaml b/ansible/playbooks/vps_debian_provision.yaml new file mode 100644 index 0000000..192774c --- /dev/null +++ b/ansible/playbooks/vps_debian_provision.yaml @@ -0,0 +1,88 @@ +--- +- name: 新机器初始化 + hosts: vps_debian + gather_facts: yes + + vars: + ansible_user: root + ansible_ssh_port: 22 + + admin_user: zedhugh + ssh_port: 44444 + timezone: Asia/Shanghai + ssh_public_key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}" + + tasks: + - name: 启用 BBR + sysctl: + name: net.ipv4.tcp_congestion_control + value: bbr + sysctl_set: yes + reload: yes + + - name: 设置时区 + timezone: + name: "{{ timezone }}" + + - name: 创建管理员用户 + user: + name: "{{ admin_user }}" + shell: /bin/bash + create_home: yes + state: present + + - name: 确保 sudo 已安装 + apt: + name: sudo + state: present + + - name: 确保 sudoers.d 目录存在 + file: + path: /etc/sudoers.d + state: directory + owner: root + group: root + mode: '0755' + + - name: 配置 sudo 免密码 + copy: + content: "{{ admin_user }} ALL=(ALL) NOPASSWD: ALL\n" + dest: "/etc/sudoers.d/{{ admin_user }}" + owner: root + group: root + mode: '0440' + validate: '/usr/sbin/visudo -cf %s' + + - name: 复制 SSH 密钥 + authorized_key: + user: "{{ admin_user }}" + key: "{{ ssh_public_key }}" + state: present + + - name: 修改 SSH 端口 + lineinfile: + path: /etc/ssh/sshd_config + regexp: "^#?Port " + line: "Port {{ ssh_port }}" + notify: restart ssh + + - name: 禁止 root 密码登录 + lineinfile: + path: /etc/ssh/sshd_config + regexp: "^#?PermitRootLogin" + line: "PermitRootLogin prohibit-password" + notify: restart ssh + + - name: 禁止密码认证 + lineinfile: + path: /etc/ssh/sshd_config + regexp: "^#?PasswordAuthentication" + line: "PasswordAuthentication no" + notify: restart ssh + + + handlers: + - name: restart ssh + systemd: + name: sshd + state: restarted diff --git a/ansible/templates/ss-config.json.j2 b/ansible/templates/ss-config.json.j2 new file mode 100644 index 0000000..6d3afcb --- /dev/null +++ b/ansible/templates/ss-config.json.j2 @@ -0,0 +1,9 @@ +{ + "server": "0.0.0.0", + "mode": "{{ vault_ss_mode }}", + "server_port": {{ vault_ss_server_port }}, + "local_port": {{ vault_ss_local_port }}, + "password": "{{ vault_ss_password }}", + "timeout": 60, + "method": "{{ vault_ss_method }}" +} diff --git a/ansible/vars/vault.yaml b/ansible/vars/vault.yaml new file mode 100644 index 0000000..c0192bb --- /dev/null +++ b/ansible/vars/vault.yaml @@ -0,0 +1,14 @@ +$ANSIBLE_VAULT;1.1;AES256 +33313937633334633738393933643562333861303332623836313735383561396636333034616662 +3239633666346235303830346135663362666533353363620a313930393362393536383063326135 +34363462633030646566643531316466373062343437643863306463626532663761643432366434 +3964623835393037310a366534643464626161353739383639386264613861326533616164656238 +38326565616131643131386338363036363765313434316661666535333434396337323039613735 +32393137393631613333356238613265663839666237623664373431383463323833326164373264 +33383765393236303263623861376366633862303366356638336363333135623437636133653664 +64336231333531363339656530393438343265643836363736646438373964313236366437383863 +64626638363935383664633739363732366461313566393533353333623565313766326231316263 +36383434313966373461616562353862613237666464653530643431326366353230333735306436 +32623434306462633830356637626262613131386238656665653831353137356565353539623365 +38656232323266346266313235343662646137626163653439616334656335383631396438386436 +3239