The SSH proxy or bastion server is a barrier between your internal machines (without public or floating IPs) and the public internet. With the SSH proxy, you'll have an extra layer of security on top of your instances. It's equipped with Fail2ban, intrusion prevention software designed to prevent brute-force attacks.

This is a configuration template (i.e. an Ansible Playbook) to customize your environment in the European Weather Cloud (EWC).

The template is designed to:

• Provision an instance via Terraform, with your specified Linux distribution and desired flavor (a.k.a VM plan):

  • If a terraform.tfstate state file is not found under the user-defined directory, attempts to create the instance from scratch

  OR

  • if terraform.tfstate file is found, leverages Terraform's out-of-the-box functionality to update the instance referenced on it

• Configure the existing or newly provisioned RockyLinux virtual machines (with public IP address), as entrypoint for users who wish to reach private EWC networks from the public internet via SSH.

After successful provisioning, you can take advantage of Terraform built-in functionality to safely modify or delete the instance. You'll find the definition of your instance in main.tf, and its current state in terraform.tfstate, under the user-defined tf_project_path directory.

To learn the basics about managing infrastructure with Terraform, checkout the official documentation examples.

Prerequisites

💡 Versions listed correspond to minimal prerequisites.

To successfully run this playbook, the following packages should be available in your work environment:

Usage

1. Download Ansible dependencies

💡 By default, Ansible Roles are installed under the ~/.ansible/roles directory within your working environment.

Download the correct version of the Ansible dependencies, if you haven't done so already:

ansible-galaxy role install -r requirements.yml

2. Configure and apply the template

2.1. Interactive Mode

By running the following command, you can trigger an interactive session that prompts you for the necessary user inputs, and then applies changes to your target EWC environment:

ansible-playbook ssh-bastion-provisioning.yml

2.2. Non-Interactive Mode

💡 To learn more about defining variables at runtime, checkout the official Ansible documentation.

You can also run in non-interactive mode by passing the --extra-vars or -e flag, followed by a map of key-value pairs; one for each and every available input (see inputs section below). For example:

ansible-playbook \
  -e '{
        "ewc_provider": "eumetsat",
        "tf_project_path": "~/iac/ssh-bastion-1",
        "app_name": "ssh",
        "instance_name":"bastion",
        "instance_index": 1,
        "flavor_name": "eo2.medium",
        "image_name": "Rocky-8.10-20250204105303",
        "public_keypair_name": "john-claudy-publickey",
        "private_keypair_path": "~/.ssh/id_rsa",
        "private_network_name": "private",
        "security_group_name": "ssh"
    }' \
  ssh-bastion-provisioning.yml

Inputs

Dependencies

⚠️ Only RockyLinux 9.5 and RockyLinux 8.10 instances are currently supported due to constrains imposed by the required ewc-ansible-role-ssh-bastion Ansible Role.

💡 A VM plan with at least 4GB of RAM is recommended for successful setup and stable operation.