ansible: 新增 VPS 初始化 playbook 与 shadowsocks-libev 部署配置

ansible/group_vars/vps_debian.yml

@@ -0,0 +1,4 @@
+---
+ansible_user: zedhugh
+ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_port: 44444

ansible/inventory.ini

@@ -0,0 +1,2 @@
+[vps_debian]
+yunyoo-tokyo

ansible/playbooks/shadowsocks-libev.yaml

@@ -0,0 +1,34 @@
+---
+- name: 配置 shadowsocks-libev 服务器
+  hosts: vps_debian
+  become: true
+  vars_files:
+    - ../vars/vault.yaml
+
+  tasks:
+    - name: 安装 shadowsocks-libev
+      apt:
+        name: shadowsocks-libev
+        state: present
+        update_cache: true
+
+    - name: 配置 shadowsocks-libev 服务器
+      template:
+        src: ../templates/ss-config.json.j2
+        dest: /etc/shadowsocks-libev/config.json
+        owner: root
+        group: root
+        mode: '0644'
+      notify: restart shadowsocks-libev server
+
+    - name: 启动 shadowsocks-libev 服务器
+      systemd:
+        name: shadowsocks-libev
+        enabled: true
+        state: started
+
+  handlers:
+    - name: restart shadowsocks-libev server
+      systemd:
+        name: shadowsocks-libev
+        state: restarted

ansible/playbooks/vps_debian_provision.yaml

@@ -0,0 +1,88 @@
+---
+- name: 新机器初始化
+  hosts: vps_debian
+  gather_facts: yes
+
+  vars:
+    ansible_user: root
+    ansible_ssh_port: 22
+
+    admin_user: zedhugh
+    ssh_port: 44444
+    timezone: Asia/Shanghai
+    ssh_public_key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
+
+  tasks:
+    - name: 启用 BBR
+      sysctl:
+        name: net.ipv4.tcp_congestion_control
+        value: bbr
+        sysctl_set: yes
+        reload: yes
+
+    - name: 设置时区
+      timezone:
+        name: "{{ timezone }}"
+
+    - name: 创建管理员用户
+      user:
+        name: "{{ admin_user }}"
+        shell: /bin/bash
+        create_home: yes
+        state: present
+
+    - name: 确保 sudo 已安装
+      apt:
+        name: sudo
+        state: present
+
+    - name: 确保 sudoers.d 目录存在
+      file:
+        path: /etc/sudoers.d
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+
+    - name: 配置 sudo 免密码
+      copy:
+        content: "{{ admin_user }} ALL=(ALL) NOPASSWD: ALL\n"
+        dest: "/etc/sudoers.d/{{ admin_user }}"
+        owner: root
+        group: root
+        mode: '0440'
+        validate: '/usr/sbin/visudo -cf %s'
+
+    - name: 复制 SSH 密钥
+      authorized_key:
+        user: "{{ admin_user }}"
+        key: "{{ ssh_public_key }}"
+        state: present
+
+    - name: 修改 SSH 端口
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?Port "
+        line: "Port {{ ssh_port }}"
+      notify: restart ssh
+
+    - name: 禁止 root 密码登录
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?PermitRootLogin"
+        line: "PermitRootLogin prohibit-password"
+      notify: restart ssh
+
+    - name: 禁止密码认证
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?PasswordAuthentication"
+        line: "PasswordAuthentication no"
+      notify: restart ssh
+
+
+  handlers:
+    - name: restart ssh
+      systemd:
+        name: sshd
+        state: restarted

ansible/templates/ss-config.json.j2

@@ -0,0 +1,9 @@
+{
+    "server": "0.0.0.0",
+    "mode": "{{ vault_ss_mode }}",
+    "server_port": {{ vault_ss_server_port }},
+    "local_port": {{ vault_ss_local_port }},
+    "password": "{{ vault_ss_password }}",
+    "timeout": 60,
+    "method": "{{ vault_ss_method }}"
+}

ansible/vars/vault.yaml

@@ -0,0 +1,14 @@
+$ANSIBLE_VAULT;1.1;AES256
+33313937633334633738393933643562333861303332623836313735383561396636333034616662
+3239633666346235303830346135663362666533353363620a313930393362393536383063326135
+34363462633030646566643531316466373062343437643863306463626532663761643432366434
+3964623835393037310a366534643464626161353739383639386264613861326533616164656238
+38326565616131643131386338363036363765313434316661666535333434396337323039613735
+32393137393631613333356238613265663839666237623664373431383463323833326164373264
+33383765393236303263623861376366633862303366356638336363333135623437636133653664
+64336231333531363339656530393438343265643836363736646438373964313236366437383863
+64626638363935383664633739363732366461313566393533353333623565313766326231316263
+36383434313966373461616562353862613237666464653530643431326366353230333735306436
+32623434306462633830356637626262613131386238656665653831353137356565353539623365
+38656232323266346266313235343662646137626163653439616334656335383631396438386436
+3239