Minor fixes in Makefile and ansible tasks

Makefile

@@ -12,6 +12,9 @@ SHELL := /bin/bash
 INVENTORY ?= staging
 VERSION   ?= latest
 
+ANSIBLE_CONFIG := ansible/ansible.cfg
+export ANSIBLE_CONFIG
+
 ANSIBLE := ansible-playbook -i ansible/inventory/$(INVENTORY).yml
 
 # =============================================================================

README.md

@@ -48,6 +48,56 @@ ansible/
 observability/           # Prometheus rules, Grafana dashboards
 ```
 
+## New server setup
+
+Before running Ansible, prepare the server manually:
+
+1. Generate an SSH key pair (if you don't have one):
+   ```bash
+   ssh-keygen -t ed25519 -C "guitar0-deploy"
+   ```
+
+2. Add your public key to the server via the hosting control panel, or copy it as root:
+   ```bash
+   ssh root@<server-ip>
+   mkdir -p /home/deploy/.ssh
+   echo "<your public key>" >> /home/deploy/.ssh/authorized_keys
+   ```
+
+3. Create the `deploy` user with passwordless sudo:
+   ```bash
+   adduser deploy
+   echo "deploy ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/deploy
+   mkdir -p /home/deploy/.ssh
+   cp /root/.ssh/authorized_keys /home/deploy/.ssh/
+   chown -R deploy:deploy /home/deploy/.ssh
+   chmod 700 /home/deploy/.ssh && chmod 600 /home/deploy/.ssh/authorized_keys
+   ```
+
+4. Update `ansible/inventory/production.yml` with the new server IP/hostname.
+
+5. Create the vault password file:
+   ```bash
+   echo "<vault-password>" > ansible/.vault_pass
+   chmod 600 ansible/.vault_pass
+   ```
+
+6. Remove the old host key and trust the new server:
+   ```bash
+   ssh-keygen -R <server-hostname>
+   ssh-keyscan -H <server-hostname> >> ~/.ssh/known_hosts
+   ```
+
+7. Verify connectivity:
+   ```bash
+   make ping INVENTORY=production SSH_PRIVATE_KEY_FILE=~/.ssh/<your-key>
+   ```
+
+8. Run one-time setup:
+   ```bash
+   make setup INVENTORY=production SSH_PRIVATE_KEY_FILE=~/.ssh/<your-key>
+   ```
+
 ## Usage
 
 ```bash

ansible/roles/backend/tasks/deploy.yml

@@ -65,7 +65,7 @@
         services:
           - db
         state: present
-        pull: never
+        pull: missing
 
     - name: Run migrations
       ansible.builtin.command:

ansible/roles/backend/tasks/directories.yml

@@ -13,7 +13,16 @@
   loop:
     - "{{ backend_app_dir }}"
     - "{{ backend_shared_dir }}"
+    - "{{ backend_backup_dir }}"
+
+- name: Create backend directories writable by container appuser (uid=1001)
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "1001"
+    group: "1001"
+    mode: "0755"
+  loop:
     - "{{ backend_shared_dir }}/staticfiles"
     - "{{ backend_shared_dir }}/media"
-    - "{{ backend_backup_dir }}"
     - "{{ backend_log_dir }}"

ansible/roles/common/defaults/main.yml

@@ -16,3 +16,6 @@ firewall_allowed_ports:
 fail2ban_bantime: 3600
 fail2ban_findtime: 600
 fail2ban_maxretry: 3
+
+# Log directory
+log_dir: /var/log

ansible/roles/common/templates/jail.local.j2

@@ -34,3 +34,10 @@ logpath = {{ log_dir }}/nginx/error.log
 maxretry = 10
 findtime = 60
 bantime = 600
+
+[recidive]
+enabled = true
+logpath = /var/log/fail2ban.log
+bantime = 1w
+findtime = 1d
+maxretry = 5