feat: initial import of RailianceHosts starter

ansible/roles/base/tasks/main.yml

@@ -0,0 +1,45 @@
+---
+- name: Ensure base packages
+  ansible.builtin.package:
+    name:
+      - apt-transport-https
+      - ca-certificates
+      - curl
+      - git
+      - vim
+      - ufw
+      - python3
+      - python3-venv
+    state: present
+    update_cache: true
+
+- name: Harden SSH
+  ansible.builtin.copy:
+    dest: /etc/ssh/sshd_config.d/10-hardening.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      PasswordAuthentication no
+      PermitRootLogin no
+      PubkeyAuthentication yes
+
+- name: Restart sshd
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+
+- name: Configure UFW
+  ansible.builtin.ufw:
+    state: enabled
+    policy: deny
+    direction: incoming
+
+- name: Allow SSH in UFW
+  ansible.builtin.ufw:
+    rule: allow
+    name: OpenSSH
+
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ timezone | default('UTC') }}"