commit 17d19d8daa5eeb84f920bdcf3172d99525915158
Author: Chris Roberts <chris.roberts@learningunix.net>
Date: Fri, 19 Jun 2026 11:56:51 -0500
added scaffolding and ufw setup
Diffstat:
6 files changed, 126 insertions(+), 0 deletions(-)
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -0,0 +1,28 @@
+# CLAUDE.md — Cachy-workstation
+
+## Project Purpose
+
+Infrastructure-as-Code for a CachyOS Linux workstation using Ansible.
+Target is always `localhost`. This is a learning project.
+
+## How to Work With Me
+
+- **Guide, don't do.** Explain concepts and let me implement. Ask before writing Ansible code on my behalf.
+- **Cite sources.** Link to official Ansible documentation or other authoritative references when explaining features or patterns.
+- **Don't guess.** If you don't know something, say so.
+- **Present options.** When there is ambiguity or multiple valid approaches, list all options with pros and cons before proceeding.
+- **Wait for answers.** Do not move on to the next step or ask a new question until I have answered all currently open questions.
+
+## Project Conventions
+
+- **Strategy:** Site-based — `site.yml` is the main entry point.
+- **Roles:** All configuration is broken into roles under `roles/`.
+- **Tags:** Used for selective execution. Applied at the role and task level.
+- **Target:** `localhost` only (connection: local).
+
+## Key References
+
+- Ansible Docs: https://docs.ansible.com/ansible/latest/
+- Ansible Roles: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_reuse_roles.html
+- Ansible Tags: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_tags.html
+- Ansible Best Practices: https://docs.ansible.com/ansible/latest/tips_tricks/ansible_tips_tricks.html
diff --git a/README.md b/README.md
@@ -0,0 +1,52 @@
+# Cachy-workstation
+
+Infrastructure-as-Code for a CachyOS Linux workstation, managed with Ansible.
+
+## Goals
+
+- Describe and reproduce the workstation configuration declaratively
+- Learn Ansible patterns: site-based playbooks, roles, and tags
+
+## Design
+
+- **Tool:** Ansible
+- **Target:** `localhost` only
+- **Entry point:** `site.yml`
+- **Structure:** Roles with tags for selective execution
+
+## Prerequisites
+
+- Ansible installed on the workstation
+- A working Python environment (required by Ansible)
+
+## Usage
+
+Run the full site playbook:
+
+```bash
+ansible-playbook site.yml
+```
+
+Run only tasks matching a specific tag:
+
+```bash
+ansible-playbook site.yml --tags <tagname>
+```
+
+Skip tasks matching a tag:
+
+```bash
+ansible-playbook site.yml --skip-tags <tagname>
+```
+
+## Structure
+
+```
+.
+├── site.yml # Main entry point
+├── inventory/ # Inventory files
+├── roles/ # Ansible roles
+└── group_vars/ # Variables by group
+```
+
+> Structure will grow as roles are added.
diff --git a/inventory/hosts.yml b/inventory/hosts.yml
@@ -0,0 +1,5 @@
+---
+cachy:
+ hosts:
+ localhost:
+ ansible_connection: local
diff --git a/roles/firewall/meta/main.yml b/roles/firewall/meta/main.yml
@@ -0,0 +1,6 @@
+---
+galaxy_info:
+ author: cjr
+ description: Configure and enable ufw firewall
+ license: BSD-3-Clause
+ min_ansible_version: "2.1"
diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml
@@ -0,0 +1,26 @@
+---
+- name: Install packages needed for ufw
+ community.general.pacman:
+ name:
+ - ufw
+ - ufw-extras
+ state: present
+
+- name: Configure the firewall incoming connection policy
+ community.general.ufw:
+ direction: incoming
+ policy: deny
+
+- name: Configure the firewall outgoing connection policy
+ community.general.ufw:
+ direction: outgoing
+ policy: allow
+
+- name: Allow incoming ports
+ community.general.ufw:
+ rule: allow
+ port: "22"
+ proto: tcp
+- name: Enable UFW
+ community.general.ufw:
+ state: enabled
diff --git a/site.yml b/site.yml
@@ -0,0 +1,9 @@
+---
+- name: Configure CachyOS workstation
+ hosts: cachy
+ connection: local
+ become: true
+
+ roles:
+ - role: firewall
+ tags: firewall
