feat: initial import of RailianceHosts starter

ansible/roles/base/tasks/main.yml

@@ -0,0 +1,45 @@
+---
+- name: Ensure base packages
+  ansible.builtin.package:
+    name:
+      - apt-transport-https
+      - ca-certificates
+      - curl
+      - git
+      - vim
+      - ufw
+      - python3
+      - python3-venv
+    state: present
+    update_cache: true
+
+- name: Harden SSH
+  ansible.builtin.copy:
+    dest: /etc/ssh/sshd_config.d/10-hardening.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      PasswordAuthentication no
+      PermitRootLogin no
+      PubkeyAuthentication yes
+
+- name: Restart sshd
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+
+- name: Configure UFW
+  ansible.builtin.ufw:
+    state: enabled
+    policy: deny
+    direction: incoming
+
+- name: Allow SSH in UFW
+  ansible.builtin.ufw:
+    rule: allow
+    name: OpenSSH
+
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ timezone | default('UTC') }}"

ansible/roles/sops_agent/tasks/main.yml

@@ -0,0 +1,30 @@
+---
+- name: Install age
+  ansible.builtin.shell: |
+    set -euo pipefail
+    if ! command -v age >/dev/null; then
+      curl -fsSL https://github.com/FiloSottile/age/releases/download/v1.1.1/age-v1.1.1-linux-amd64.tar.gz         | tar xz -C /usr/local/bin --strip-components=1 age/age
+    fi
+  args:
+    executable: /bin/bash
+
+- name: Install sops
+  ansible.builtin.get_url:
+    url: https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64
+    dest: /usr/local/bin/sops
+    mode: '0755'
+
+- name: Create SOPS age dir
+  ansible.builtin.file:
+    path: /root/.config/sops/age
+    state: directory
+    mode: '0700'
+
+# In production, you would inject the private key at runtime; do NOT store it on hosts by default.
+# This task is intentionally a placeholder (disabled by default).
+# - name: (optional) Drop SOPS_AGE_KEY for automation
+#   ansible.builtin.copy:
+#     dest: /root/.config/sops/age/keys.txt
+#     content: "{{ sops_age_private_key }}"
+#     mode: '0600'
+#   when: sops_age_private_key is defined

ansible/roles/wireguard/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+# Placeholder role. Define variables:
+# wireguard_interface, wireguard_private_key (from SOPS), peers[], etc.
+- name: Install wireguard
+  ansible.builtin.package:
+    name: wireguard
+    state: present
+    update_cache: true