Introduction

noixdev.infra is an Ansible collection of reusable, tested roles for Docker-based Linux servers. It covers the baseline of a host (packages, time, upgrades, swap, SSH hardening), Docker itself, a private network (Tailscale), a reverse proxy with certificates (Traefik), container management (Portainer), intrusion prevention (fail2ban, CrowdSec) and the Pulsix manager and workers.

Every role is configured only through variables. Each variable is declared in the role’s meta/argument_specs.yml, so Ansible validates your input before the role runs, and has a default in defaults/main.yml. The complete list is in the variables reference.

The roles

Role	Purpose
base	Packages, time zone, unattended upgrades, swap, journald limit, sshd hardening
docker	Docker CE with the compose plugin and a managed daemon.json
tailscale	Tailscale node, optionally a subnet router
traefik	Standalone Traefik with DNS-01 certificates and a Docker socket proxy
portainer	Portainer server or agent
pulsix_manager	Pulsix manager, its database and any number of local workers
pulsix_worker	Any number of remote Pulsix workers, enrolled with one-time tokens
fail2ban	fail2ban on the systemd journal with nftables bans: sshd and repeat offenders
crowdsec	CrowdSec agent and its firewall bouncer, which also covers published Docker ports

fail2ban and crowdsec share one variable, security_allowlist, which keeps your management networks from ever being banned. Read the lockout guard before you use either.

Requirements

Control node

• ansible-core 2.16.0 or newer (requires_ansible: ">=2.16.0"). The CI runs the tests on the current ansible-core release.

• These collections, which ansible-galaxy installs together with noixdev.infra when you install from a requirements.yml:

  Collection	Version
  community.docker	4.0.0 or newer
  ansible.posix	1.5.0 or newer
  community.general	8.0.0 or newer

Managed servers

• Ubuntu 24.04 or 26.04. These are the releases the roles are tested on; the host roles (base, docker, fail2ban, crowdsec, tailscale) run on both in CI. Other Debian-family releases may work but are not tested.
• systemd, and python3 for Ansible.
• Root access through become.
• The container roles (traefik, portainer, pulsix_manager, pulsix_worker) need Docker on the host, so apply docker first.

Compatibility

The collection is at version 0.x. Variables can still change between minor releases; the changelog lists what changed. Pin a tag in your requirements.yml and read the changelog before you move it.

Next steps

1. Install the collection.
2. Run your first playbook.