Looking for the self-hosted AI employee system? This page documents the open-source pip install ragleap-ansible package. To install and run ragleap-core (AI employees, channels, Docker), see docs.ragleap.com; the project home is ragleap.com.

Tested in a container; not yet on a real server

ragleap-ansible

Ansible roles that prepare and harden a fresh Ubuntu 22.04 server: deploy user, sudo, unattended upgrades, plus opt-in SSH hardening and an opt-in firewall. They do not install k3s, Helm or the charts yet.

0.1.0

PyPI version

Changes on a second run (container test)

Install

The role and playbook files ship inside the wheel under ragleap_ansible/playbooks, and in the repo under packages/ragleap-ansible/. This package does not install Ansible; ansible-core 2.16 was used for testing. Running from the installed wheel was not tested, so the tested path is a repository checkout.

pip install ragleap-ansible
# or, with uv
uv add ragleap-ansible

cd packages/ragleap-ansible
cp inventory.example.ini inventory.ini        # list your server under [ragleap_servers]
echo 'ragleap_base_deploy_ssh_public_key: "ssh-ed25519 AAAA... you@host"' > vars.yml
ansible-playbook -i inventory.ini playbooks/bootstrap.yml -e @vars.yml

Variables

ragleap_base_deploy_user

Default ragleap. Must be a lowercase account name and not root.

ragleap_base_deploy_ssh_public_key

A full OpenSSH public key line. A truncated key is rejected, because it would lock the deploy user out once SSH hardening is on. Pass it through a vars file; a plain -e name=value splits at spaces.

ragleap_base_deploy_passwordless_sudo

Default true. The deploy user has no password, so sudo needs it. The sudoers file is checked with visudo.

ragleap_base_harden_ssh

Default false. Turns off password and keyboard-interactive logins through a drop-in at /etc/ssh/sshd_config.d/10-ragleap.conf, checked with sshd -t and removed again if the check fails. Refuses to run without a deploy key.

ragleap_base_ssh_permit_root_login

Default prohibit-password. no is allowed only with passwordless sudo, and only after you switch ansible_user to the deploy user.

ragleap_base_enable_firewall

Default false. ufw with deny-incoming and allow-outgoing defaults. The ports sshd really listens on are always opened first. ragleap_base_firewall_allow_tcp (default empty) lists extra ports.

ragleap_base_manage_services

Default true. Set it to false only inside a container, where there is no service manager to reload sshd or enable ufw.

What was tested

Everything below ran in a throwaway Ubuntu 22.04 container, on x86_64, using ansible-core 2.16.

The base role is idempotent. The playbook ran twice and the second run reported no changes. The deploy user, its key and the sudoers file were checked afterwards, and a truncated key was rejected.
SSH hardening takes effect and is safe to run twice. The effective settings from sshd -T show password logins off. Hardening without a key is refused, and a configuration that fails sshd -t is removed again with the play failing.
The firewall rules are right. Ports 22, 80 and 443 appear, the default policies are in place, an sshd on port 2222 gets that port opened, and an invalid port is refused. A second run changes nothing.

Known limitations

Not tested on a real server. A container cannot run systemd, sshd or the kernel firewall. A real key login against hardened sshd, ufw enable with real enforcement, and become: true against a real host were not tested.
The firewall role only adds rules. It never removes one, so a port opened earlier stays open until you remove it with ufw.
No k3s, Helm or chart installation yet. Those would be unverified without a real VM, so they are not in 0.1.0.
Keep a second session open. Hardening SSH or enabling the firewall on a server you cannot reach another way can lock you out.