updated with proper variables for environment

README.md

@@ -1,12 +1,5 @@
 ```
-# Ubuntu/Debian
+ansible-playbook secure.yml -i inventory/hosts.yml --check --diff
-sudo apt update && sudo apt install ansible -y
-
-# macOS (with Homebrew)
-brew install ansible
-
-# Fedora/RHEL/CentOS
-sudo dnf install ansible-core
 ```
 
 ```

deploy_matrix.yml

@@ -11,7 +11,7 @@
   tasks:
 
     # -----------------------------------------------------------------
-    # (unchanged) Install podman, create network, create volumes …
+    # Install podman, create network, create volumes …
     # -----------------------------------------------------------------
     - name: Install podman package
       ansible.builtin.package:
@@ -36,7 +36,36 @@
         - "{{ vol_media }}"
         - "{{ vol_turn }}"
         - "{{ vol_nginx }}"
-        - "{{ vol_teamspeak }}"            # <-- new volume
+        - "{{ vol_teamspeak }}"            
+
+    # -----------------------------------------------------------------
+    # Pull required images (including Teamspeak)
+    # -----------------------------------------------------------------
+    - name: Pull Traefik image
+      containers.podman.podman_image:
+        name: "{{ traefik_image }}"
+        state: present
+
+    - name: Pull coturn image
+      containers.podman.podman_image:
+        name: "{{ turn_image }}"
+        state: present
+
+    - name: Pull Synapse image
+      containers.podman.podman_image:
+        name: "{{ synapse_image }}"
+        state: present
+
+    - name: Pull NGINX image
+      containers.podman.podman_image:
+        name: "{{ nginx_image }}"
+        state: present
+
+    - name: Pull Teamspeak image
+      containers.podman.podman_image:
+        name: "{{ teamspeak_image }}"
+        state: present
+
 
     # -----------------------------------------------------------------
     # Render all configuration files from the templates
@@ -88,34 +117,6 @@
         restart_policy: always
 
 
-    # -----------------------------------------------------------------
-    # Pull required images (including Teamspeak)
-    # -----------------------------------------------------------------
-    - name: Pull Traefik image
-      containers.podman.podman_image:
-        name: "{{ traefik_image }}"
-        state: present
-
-    - name: Pull coturn image
-      containers.podman.podman_image:
-        name: "{{ turn_image }}"
-        state: present
-
-    - name: Pull Synapse image
-      containers.podman.podman_image:
-        name: "{{ synapse_image }}"
-        state: present
-
-    - name: Pull NGINX image
-      containers.podman.podman_image:
-        name: "{{ nginx_image }}"
-        state: present
-
-    - name: Pull Teamspeak image
-      containers.podman.podman_image:
-        name: "{{ teamspeak_image }}"
-        state: present
-
     # -----------------------------------------------------------------
     # Start containers (Traefik, TURN, Synapse, NGINX – unchanged)
     # -----------------------------------------------------------------
@@ -183,7 +184,7 @@
         restart_policy: always
 
     # -----------------------------------------------------------------
-    # **NEW** – Start Teamspeak container
+    # Start Teamspeak container
     # -----------------------------------------------------------------
     - name: Start Teamspeak container
       containers.podman.podman_container:
@@ -203,7 +204,7 @@
         restart_policy: always
 
     # -----------------------------------------------------------------
-    # (optional) generate systemd units for the new container
+    # generate systemd units for containers 
     # -----------------------------------------------------------------
     - name: Generate systemd unit for Teamspeak
       containers.podman.podman_generate_systemd:
@@ -212,9 +213,6 @@
         dest: "/etc/systemd/system/{{ teamspeak_container_name }}.service"
       when: generate_systemd | bool
 
-    # -----------------------------------------------------------------
-    # (unchanged) systemd unit generation for the other containers
-    # -----------------------------------------------------------------
     - name: Generate systemd unit for Traefik
       containers.podman.podman_generate_systemd:
         name: traefik

inventory/hosts.yml

@@ -1,6 +1,6 @@
 all:
   hosts:
     podman-host1:                # <-- change to the host that will run Podman
-      ansible_host: 192.168.1.10 # its IP or DNS name
+      ansible_host: 15.204.117.53 # its IP or DNS name
-      ansible_user: youruser      # user that can sudo
+      ansible_user: fedora      # user that can sudo
       ansible_become: true

secure.yml

@@ -0,0 +1,51 @@
+---
+- name: Secure and Update Fedora 43 Server
+  hosts: all
+  become: true
+  gather_facts: true
+  
+  vars:
+    ansible_python_interpreter: /usr/bin/python3.14
+  tasks:
+    # Update system
+    - name: Update all packages (safe upgrade)
+      ansible.builtin.dnf:
+        name: "*"
+        state: latest
+        update_cache: true
+
+    - name: Install security tools
+      ansible.builtin.dnf:
+        name:
+          - audit
+          - fail2ban
+          - dnf-automatic
+        state: present
+
+
+    - name: Configure dnf-automatic for security updates only
+      ansible.builtin.template:
+        src: automatic.conf.j2
+        dest: /etc/dnf/automatic.conf
+
+
+    - name: Ensure dnf-automatic timer is enabled
+      ansible.builtin.systemd:
+        name: dnf-automatic.timer
+        state: started
+        enabled: true
+
+    # Ensure SELinux is enforcing
+    - name: Ensure SELinux is in enforcing mode
+      ansible.posix.selinux:
+        policy: targeted
+        state: enforcing
+
+    # Enable and start fail2ban
+    - name: Enable and start fail2ban
+      ansible.builtin.service:
+        name: fail2ban
+        state: started
+        enabled: true
+
+

templates/automatic.conf.j2

@@ -0,0 +1,4 @@
+[commands]
+upgrade_type = security
+apply_updates = yes
+download_updates = yes   

templates/homeserver.yaml.j2

@@ -1,4 +1,6 @@
 server_name: "{{ matrix_domain }}"
+trusted_key_servers:
+  - server_name: "{{ matrix_domain }}"
 
 listeners:
   - port: {{ synapse_http_port }}
@@ -29,3 +31,20 @@ oidc_providers:
     client_id: "{{ google_oidc_client_id }}"
     client_secret: "{{ google_oidc_client_secret }}"
     scopes: {{ google_oidc_scopes | to_nice_yaml | indent(6) }}
+
+# -----------------------------------------------------------------
+# Database provider
+#------------------------------------------------------------------
+database:
+  name: sqlite3
+  args:
+    database: /data/homeserver.db
+log_config: "/data/my.matrix.host.log.config"
+media_store_path: /data/media_store
+registration_shared_secret: "{{ registration_shared_secret }}"
+report_stats: true
+macaroon_secret_key: "{{ macaroon_secret_key }}
+form_secret: "{{ form_secret }}"
+signing_key_path: "/data/my.matrix.host.signing.key"
+trusted_key_servers:
+  - server_name: "matrix.org"

templates/turnserver.conf.j2

@@ -5,7 +5,7 @@ realm={{ matrix_domain }}
 static-auth-secret={{ turn_secret }}
 
 # If your host sits behind NAT and you need to force the public IP, uncomment:
-# external-ip=YOUR_PUBLIC_IP
+# external-ip={{ public_ipv4 }}
 
 allowed-peer-ip=0.0.0.0/0
 

vars/vars.yml

@@ -1,6 +1,7 @@
 # --------------------------------------------------------------
 # General
 # --------------------------------------------------------------
+public_ipv4: 15.204.117.53
 matrix_domain: "matrix.fpov.space"
 landing_domain: "org.fpov.space
 teamspeak_domain: "ts.fpov.space"          # <-- new
@@ -15,14 +16,18 @@ traefik_https_port: 443
 # --- TURN -------------------------------------------------------
 turn_listen_port: 3478
 turn_tls_port: 5349
-turn_secret: "CHANGE-ME-TO-HEX-STRING"
+turn_secret: "7A9F2C4E1B8D6035A2F7E9C1B4D68053"
 
 # --- Synapse ----------------------------------------------------
 synapse_http_port: 8008
-synapse_version: "latest"
+
+# --- Matrix ------------------------------------------------------
+registration_shared_secret: "uC7Pv@:r=@Slvhx7Ex*An8QHXWnPRyI9+COZr_&;Kh*,~lGpql"
+macaroon_secret_key: "+QUdDhvNc9*@MORp9K-TjuGp1j5Ff-mUBS+pjkmAFWR0Y3#da8"
+form_secret: "meZSlI7K.EI-6hmXcjzCNf2IwrThcnoVr2X0iohOV7K5a_w^Ud"
 
 # --- Teamspeak ---------------------------------------------------
-teamspeak_image: "docker.io/teamspeak:latest"
+teamspeak_image: "docker.io/teamspeak:3.13.7"
 teamspeak_container_name: teamspeak
 teamspeak_udp_port: 9987          # voice (UDP) – exposed directly on the host
 teamspeak_tcp_port: 10011         # query (TCP) – will be routed via Traefik
@@ -31,9 +36,9 @@ teamspeak_file_port: 30033        # file‑transfer (TCP) – optional, expose d
 # --------------------------------------------------------------
 # Container images
 # --------------------------------------------------------------
-traefik_image: "docker.io/traefik:latest"
+traefik_image: "docker.io/traefik:v3.6.11"
-turn_image:    "docker.io/coturn/coturn:latest"
+turn_image:    "docker.io/coturn/coturn:4.9.0"
-synapse_image: "docker.io/matrixdotorg/synapse:{{ synapse_version }}"
+synapse_image: "docker.io/matrixdotorg/synapse:latest"
 nginx_image:   "docker.io/nginx:alpine"
 
 # --------------------------------------------------------------