0Pricing
Ansible Academy · Lesson

Provision, Harden & Bootstrap Hosts

Bring fresh servers to a baseline.

Provision, Harden & Bootstrap Hosts is a free Ansible Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ansible Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

From Bare Server to Baseline

Fresh hosts are blank slates. The common role brings every server to one safe, consistent baseline before app code lands. 🛠️

Update the Package Cache

Start by refreshing packages so installs use current versions. The apt module can update the cache in one idempotent task.

- name: Update apt cache
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 3600

Install Base Packages

Use a loop to install the tools every host needs, like curl, vim and ufw, in a single readable task.

- name: Base packages
  ansible.builtin.apt:
    name:
      - curl
      - ufw
      - fail2ban
    state: present

Create a Deploy User

Never run app work as root. The user module creates a dedicated deploy account that owns the application going forward.

- name: Create deploy user
  ansible.builtin.user:
    name: deploy
    groups: sudo
    shell: /bin/bash

Push the SSH Key

Use authorized_key to grant your deploy user key-based login, so future runs connect without passwords.

- name: Add deploy key
  ansible.posix.authorized_key:
    user: deploy
    key: "{{ deploy_pubkey }}"

Lock Down SSH

Harden the daemon: disable root login and password auth. The lineinfile module edits sshd_config safely and idempotently.

- ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^PermitRootLogin"
    line: "PermitRootLogin no"
  notify: Restart sshd

Open Only Needed Ports

Configure the firewall with ufw: allow SSH and your app ports, deny the rest. Least exposure by default.

- community.general.ufw:
    rule: allow
    port: "22"
    proto: tcp

Set Timezone & NTP

Consistent clocks matter for logs and certs. Set the timezone and enable time sync so every host agrees on now.

- community.general.timezone:
    name: UTC

Make It a Handler

Restart sshd only when its config changed by using notify plus a handler, never on every single run.

handlers:
  - name: Restart sshd
    ansible.builtin.service:
      name: sshd
      state: restarted

Run It Idempotently

Run the common role twice; the second pass reports mostly ok, not changed. That proves your baseline truly converged.

Baseline Before App

Hardening first means the app deploys onto a known-good, secured host. Bootstrap is the foundation everything else rests on. 🔒

Quick Check

One choice keeps SSH config edits clean.

Recap

You provisioned a baseline: packages, a deploy user, SSH keys, hardened sshd, a firewall and time sync, all idempotent. ✅

Frequently asked questions

Is the “Provision, Harden & Bootstrap Hosts” lesson free?

Yes — the full text of “Provision, Harden & Bootstrap Hosts” is free to read here on the web, and the Ansible Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ansible Academy course, upgrade to CoddyKit PRO.

What will I learn in “Provision, Harden & Bootstrap Hosts”?

Bring fresh servers to a baseline. You practise Ansible Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ansible Academy?

No prior experience is required. Ansible Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Provision, Harden & Bootstrap Hosts” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ansible Academy lesson?

Yes. Every Ansible Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Architect the Project: Roles & Inventory
  2. Provision, Harden & Bootstrap Hosts
  3. Rolling Deploy Behind the Load Balancer
  4. Smoke Tests, Rollback & Notifications
← Back to Ansible Academy