second commit

ansible/site.yml

@@ -0,0 +1,23 @@
+---
+# Jumphost-Deployment. Siehe Konzeptdokument Kap. 7 fuer Hintergrund.
+#
+# Steuerung ueber group_vars:
+#   enable_nginx_proxy: true|false   (Kap. 7.2)
+#   tls_mode: internal_pki | external_reverse_proxy | acme_public  (Kap. 7.2a)
+
+- hosts: jumphosts
+  become: true
+  vars_files:
+    - inventory/group_vars/all.yml
+  roles:
+    - os_hardening
+    - firewall_nftables
+    - fail2ban
+    - frontend_assets   # baut static/js/vendor/* lokal VOR dem Sync in python_runtime
+    - python_runtime
+    - sqlite_init
+    - guacd
+    - jumphost_app
+    - tls_certificates
+    - { role: nginx_proxy, when: enable_nginx_proxy | default(false) }
+    - backup