From 17d19d8daa5eeb84f920bdcf3172d99525915158 Mon Sep 17 00:00:00 2001
From: Chris Roberts <chris.roberts@learningunix.net>
Date: Fri, 19 Jun 2026 11:56:51 -0500
Subject: [PATCH] added scaffolding and ufw setup

---
 CLAUDE.md                     | 28 +++++++++++++++++++
 README.md                     | 52 +++++++++++++++++++++++++++++++++++
 inventory/hosts.yml           |  5 ++++
 roles/firewall/meta/main.yml  |  6 ++++
 roles/firewall/tasks/main.yml | 26 ++++++++++++++++++
 site.yml                      |  9 ++++++
 6 files changed, 126 insertions(+)
 create mode 100644 CLAUDE.md
 create mode 100644 README.md
 create mode 100644 inventory/hosts.yml
 create mode 100644 roles/firewall/meta/main.yml
 create mode 100644 roles/firewall/tasks/main.yml
 create mode 100644 site.yml

diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..eb13239
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,28 @@
+# CLAUDE.md — Cachy-workstation
+
+## Project Purpose
+
+Infrastructure-as-Code for a CachyOS Linux workstation using Ansible.
+Target is always `localhost`. This is a learning project.
+
+## How to Work With Me
+
+- **Guide, don't do.** Explain concepts and let me implement. Ask before writing Ansible code on my behalf.
+- **Cite sources.** Link to official Ansible documentation or other authoritative references when explaining features or patterns.
+- **Don't guess.** If you don't know something, say so.
+- **Present options.** When there is ambiguity or multiple valid approaches, list all options with pros and cons before proceeding.
+- **Wait for answers.** Do not move on to the next step or ask a new question until I have answered all currently open questions.
+
+## Project Conventions
+
+- **Strategy:** Site-based — `site.yml` is the main entry point.
+- **Roles:** All configuration is broken into roles under `roles/`.
+- **Tags:** Used for selective execution. Applied at the role and task level.
+- **Target:** `localhost` only (connection: local).
+
+## Key References
+
+- Ansible Docs: https://docs.ansible.com/ansible/latest/
+- Ansible Roles: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_reuse_roles.html
+- Ansible Tags: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_tags.html
+- Ansible Best Practices: https://docs.ansible.com/ansible/latest/tips_tricks/ansible_tips_tricks.html
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..3b773d6
--- /dev/null
+++ b/README.md
@@ -0,0 +1,52 @@
+# Cachy-workstation
+
+Infrastructure-as-Code for a CachyOS Linux workstation, managed with Ansible.
+
+## Goals
+
+- Describe and reproduce the workstation configuration declaratively
+- Learn Ansible patterns: site-based playbooks, roles, and tags
+
+## Design
+
+- **Tool:** Ansible
+- **Target:** `localhost` only
+- **Entry point:** `site.yml`
+- **Structure:** Roles with tags for selective execution
+
+## Prerequisites
+
+- Ansible installed on the workstation
+- A working Python environment (required by Ansible)
+
+## Usage
+
+Run the full site playbook:
+
+```bash
+ansible-playbook site.yml
+```
+
+Run only tasks matching a specific tag:
+
+```bash
+ansible-playbook site.yml --tags <tagname>
+```
+
+Skip tasks matching a tag:
+
+```bash
+ansible-playbook site.yml --skip-tags <tagname>
+```
+
+## Structure
+
+```
+.
+├── site.yml          # Main entry point
+├── inventory/        # Inventory files
+├── roles/            # Ansible roles
+└── group_vars/       # Variables by group
+```
+
+> Structure will grow as roles are added.
diff --git a/inventory/hosts.yml b/inventory/hosts.yml
new file mode 100644
index 0000000..a02fc28
--- /dev/null
+++ b/inventory/hosts.yml
@@ -0,0 +1,5 @@
+---
+cachy:
+  hosts:
+    localhost:
+      ansible_connection: local
diff --git a/roles/firewall/meta/main.yml b/roles/firewall/meta/main.yml
new file mode 100644
index 0000000..f284367
--- /dev/null
+++ b/roles/firewall/meta/main.yml
@@ -0,0 +1,6 @@
+---
+galaxy_info:
+  author: cjr
+  description: Configure and enable ufw firewall
+  license: BSD-3-Clause
+  min_ansible_version: "2.1"
diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml
new file mode 100644
index 0000000..ecc7852
--- /dev/null
+++ b/roles/firewall/tasks/main.yml
@@ -0,0 +1,26 @@
+---
+- name: Install packages needed for ufw
+  community.general.pacman:
+    name:
+      - ufw
+      - ufw-extras
+    state: present
+
+- name: Configure the firewall incoming connection policy
+  community.general.ufw:
+    direction: incoming
+    policy: deny
+
+- name: Configure the firewall outgoing connection policy
+  community.general.ufw:
+    direction: outgoing
+    policy: allow
+
+- name: Allow incoming ports
+  community.general.ufw:
+    rule: allow
+    port: "22"
+    proto: tcp
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled
diff --git a/site.yml b/site.yml
new file mode 100644
index 0000000..01676a9
--- /dev/null
+++ b/site.yml
@@ -0,0 +1,9 @@
+---
+- name: Configure CachyOS workstation
+  hosts: cachy
+  connection: local
+  become: true
+
+  roles:
+    - role: firewall
+      tags: firewall