jmdroplet.yml

# export ANSIBLE_BECOME_PASS=....
#
# adduser jm && usermod -aG sudo jm
# mkdir -p /home/jm/.ssh && chmod 0700 /home/jm/.ssh && cp /root/.ssh/authorized_keys /home/jm/.ssh/authorized_keys && chmod 0600 /home/jm/.ssh/authorized_keys && chown -R jm:jm /home/jm/.ssh
# sudo apt update
#
---
- hosts: jmdroplet
  vars:
  roles:
    - base
  tasks:
    - name: install nginx
      apt: pkg=nginx state=present
      become: True
      tags: [nginx]

    - name: install fail2ban
      apt: pkg=fail2ban state=present
      become: true

    - name: Delete root password
      user:
        name: root
        password: ""
      become: yes

    - name: Remove authorized_keys file for root user
      file:
        path: /root/.ssh/authorized_keys
        state: absent
      become: yes

    - name: Disallow root SSH access
      lineinfile:
        dest: /etc/ssh/sshd_config
        regexp: "^PermitRootLogin"
        line: "PermitRootLogin no"
        state: present
      become: yes
      notify: Restart sshd

    - name: Disallow password authentication
      lineinfile:
        dest: /etc/ssh/sshd_config
        regexp: "^PasswordAuthentication"
        line: "PasswordAuthentication no"
        state: present
      become: yes
      notify: Restart sshd

    - name: create the website directory
      become: yes
      file: path=/opt/apps state=directory

    - name: create the website config
      become: yes
      file: path=/opt/nginx state=directory

    - name: add certbot PPA
      become: True
      apt_repository: repo=ppa:certbot/certbot

    - name: install certbot
      apt: pkg=python-certbot-nginx state=present
      become: true

    - name: install DO certbot
      apt: pkg=python3-certbot-dns-digitalocean state=present
      become: true

    - name: install redis
      apt: pkg=redis state=present
      become: true

    - name: install msmtp
      apt: pkg=msmtp state=present
      become: true

  handlers:
    - name: Restart sshd
      service:
        name: ssh
        state: restarted
      become: yes