Tubby1981 System Ansible Collection
A comprehensive Ansible collection for Linux system management, featuring roles for Foomuuri multizone firewall, Apache webserver, MariaDB database server, Hetzner Cloud network automation, production-ready mail server, and full support for PHP and phpMyAdmin configuration.
Quick Install
ansible-galaxy collection install tubby1981.system
Included Roles
🔒 Foomuuri Firewall
- Multi-zone architecture
- Advanced NAT (SNAT/DNAT/masquerading)
- Dynamic IP lists from DNS or URLs
- Declarative nftables configuration
🌐 Apache Webserver
- Automated Let's Encrypt SSL/TLS provisioning
- Security enhancements and hardening
- Multi-domain support with aliases
- Pre-flight DNS validation
🗄️ MariaDB Database
- Installation and security hardening
- User and database management
- Master/Slave replication configuration
- Performance tuning (InnoDB, buffers)
☁️ Hetzner Network Override
- Static network configuration on Hetzner Cloud
- PowerDNS Recursor for recursive DNS
- DNSSEC validation support
- Spamhaus compliant (essential for mail servers)
- Disables cloud-init network management
📧 Mail Server
- Complete stack: Postfix + Dovecot
- PostfixAdmin for web management
- SpamAssassin spam filtering
- ClamAV antivirus protection
- OpenDKIM email authentication
🐘 PHP Support
- PHP versions 7.4 to 8.4
- Flexible configuration management
- Multiple PHP version support
- Performance optimization
💻 phpMyAdmin
- Easy installation and configuration
- Secure access configuration
- Integration with Apache and MariaDB
- Web-based database management
Key Features
- ✅ Multi-distribution support: Debian, Ubuntu, Arch Linux
- 🔄 Idempotent operations: Safe to run multiple times
- 🚀 Production-ready: Battle-tested configurations
- 🔒 Security-first: Hardened by default
- 📖 Well-documented: Comprehensive guides and examples
- 🎯 Declarative: Infrastructure as Code approach
- ☁️ Cloud-optimized: Special support for Hetzner Cloud
Why Hetzner Network Override?
The hetzner_network_override role is essential for mail servers and other services on Hetzner Cloud that require true recursive DNS resolution. It configures PowerDNS Recursor which queries authoritative nameservers directly (starting from root servers), rather than forwarding to public DNS resolvers.
Benefits:
- ✅ Spamhaus compliant: Prevents spam filter issues that occur when using DNS forwarders
- ✅ Better email deliverability: Improves mail server reputation
- ✅ DNSSEC validation: Built-in security validation
- ✅ Reliable networking: Static configuration prevents cloud-init interference
- ✅ No external dependencies: Works during DNS resolver outages
Requirements
- Ansible: >= 2.10
- Python: >= 3.6
- Target Systems: Debian 10+, Ubuntu 20.04+, Arch Linux (varies by role)
- Privileges: Root or sudo access required
- Hetzner Cloud: Auto-detected by hetzner_network_override role
Links
Ansible Galaxy
GitHub Repository
Documentation
Quick Example
---
- name: Deploy complete system on Hetzner Cloud
hosts: servers
roles:
- tubby1981.system.hetzner_network_override
- tubby1981.system.foomuuri
- tubby1981.system.mariadb
- tubby1981.system.apache
- tubby1981.system.mailserver
Keywords: ansible collection, nftables firewall, foomuuri ansible, multizone firewall, linux firewall automation, debian ansible role, ubuntu firewall configuration, archlinux security, infrastructure as code, nat configuration, system hardening, devops automation, network security, apache, webserver, certbot, letsencrypt, mariadb, mysql, database, replication, sql, php, phpmyadmin, php 7.4, php 8.4, hetzner cloud, cloud-init override, powerdns recursor, recursive dns, dnssec, network automation, static networking, mail server, postfix, dovecot, postfixadmin, spamassassin, clamav, opendkim, email server, smtp, imap, virtual mailboxes, spam filtering
© 2024 Tubby1981 | Licensed under MIT License