n0mad1k
7484a0e034
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
79 lines
2.3 KiB
YAML
79 lines
2.3 KiB
YAML
---
|
|
# Provision a Linode instance for phantom deployment
|
|
# Requires: LINODE_API_TOKEN or api_token variable
|
|
|
|
- name: Provision Linode Instance
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: false
|
|
vars:
|
|
deploy_id: "{{ deployment_id }}"
|
|
linode_token: "{{ api_token }}"
|
|
linode_region: "{{ region | default('us-east') }}"
|
|
linode_plan: "{{ plan | default('g6-nanode-1') }}"
|
|
linode_image: "{{ image | default('linode/debian12') }}"
|
|
linode_label: "ph-{{ deployment_id }}"
|
|
ssh_key_path: "{{ ssh_key }}.pub"
|
|
|
|
tasks:
|
|
- name: Read SSH public key
|
|
slurp:
|
|
src: "{{ ssh_key_path }}"
|
|
register: ssh_pubkey
|
|
|
|
- name: Generate root password (required by API, SSH key auth used instead)
|
|
command: openssl rand -base64 32
|
|
register: root_pass_gen
|
|
|
|
- name: Create Linode instance
|
|
uri:
|
|
url: https://api.linode.com/v4/linode/instances
|
|
method: POST
|
|
headers:
|
|
Authorization: "Bearer {{ linode_token }}"
|
|
Content-Type: application/json
|
|
body_format: json
|
|
body:
|
|
type: "{{ linode_plan }}"
|
|
region: "{{ linode_region }}"
|
|
image: "{{ linode_image }}"
|
|
label: "{{ linode_label }}"
|
|
root_pass: "{{ root_pass_gen.stdout }}"
|
|
authorized_keys:
|
|
- "{{ ssh_pubkey.content | b64decode | trim }}"
|
|
booted: true
|
|
status_code: 200
|
|
register: linode_result
|
|
|
|
- name: Set target host fact
|
|
set_fact:
|
|
target_host: "{{ linode_result.json.ipv4[0] }}"
|
|
|
|
- name: Display instance info
|
|
debug:
|
|
msg: |
|
|
Linode provisioned:
|
|
ID: {{ linode_result.json.id }}
|
|
IP: {{ linode_result.json.ipv4[0] }}
|
|
Region: {{ linode_region }}
|
|
Plan: {{ linode_plan }}
|
|
|
|
- name: Write provisioned host IP for phantom
|
|
copy:
|
|
content: "{{ target_host }}"
|
|
dest: "{{ _host_output_file }}"
|
|
when: _host_output_file is defined
|
|
|
|
- name: Write instance ID for teardown
|
|
copy:
|
|
content: "{{ linode_result.json.id }}"
|
|
dest: "{{ _host_output_file | dirname }}/instance_id"
|
|
when: _host_output_file is defined
|
|
|
|
- name: Wait for SSH
|
|
wait_for:
|
|
host: "{{ target_host }}"
|
|
port: 22
|
|
delay: 10
|
|
timeout: 300
|