added scaffolding and ufw setup

CLAUDE.md

@@ -0,0 +1,28 @@
+# CLAUDE.md — Cachy-workstation
+
+## Project Purpose
+
+Infrastructure-as-Code for a CachyOS Linux workstation using Ansible.
+Target is always `localhost`. This is a learning project.
+
+## How to Work With Me
+
+- **Guide, don't do.** Explain concepts and let me implement. Ask before writing Ansible code on my behalf.
+- **Cite sources.** Link to official Ansible documentation or other authoritative references when explaining features or patterns.
+- **Don't guess.** If you don't know something, say so.
+- **Present options.** When there is ambiguity or multiple valid approaches, list all options with pros and cons before proceeding.
+- **Wait for answers.** Do not move on to the next step or ask a new question until I have answered all currently open questions.
+
+## Project Conventions
+
+- **Strategy:** Site-based — `site.yml` is the main entry point.
+- **Roles:** All configuration is broken into roles under `roles/`.
+- **Tags:** Used for selective execution. Applied at the role and task level.
+- **Target:** `localhost` only (connection: local).
+
+## Key References
+
+- Ansible Docs: https://docs.ansible.com/ansible/latest/
+- Ansible Roles: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_reuse_roles.html
+- Ansible Tags: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_tags.html
+- Ansible Best Practices: https://docs.ansible.com/ansible/latest/tips_tricks/ansible_tips_tricks.html

README.md

@@ -0,0 +1,52 @@
+# Cachy-workstation
+
+Infrastructure-as-Code for a CachyOS Linux workstation, managed with Ansible.
+
+## Goals
+
+- Describe and reproduce the workstation configuration declaratively
+- Learn Ansible patterns: site-based playbooks, roles, and tags
+
+## Design
+
+- **Tool:** Ansible
+- **Target:** `localhost` only
+- **Entry point:** `site.yml`
+- **Structure:** Roles with tags for selective execution
+
+## Prerequisites
+
+- Ansible installed on the workstation
+- A working Python environment (required by Ansible)
+
+## Usage
+
+Run the full site playbook:
+
+```bash
+ansible-playbook site.yml
+```
+
+Run only tasks matching a specific tag:
+
+```bash
+ansible-playbook site.yml --tags <tagname>
+```
+
+Skip tasks matching a tag:
+
+```bash
+ansible-playbook site.yml --skip-tags <tagname>
+```
+
+## Structure
+
+```
+.
+├── site.yml          # Main entry point
+├── inventory/        # Inventory files
+├── roles/            # Ansible roles
+└── group_vars/       # Variables by group
+```
+
+> Structure will grow as roles are added.

inventory/hosts.yml

@@ -0,0 +1,5 @@
+---
+cachy:
+  hosts:
+    localhost:
+      ansible_connection: local

roles/firewall/meta/main.yml

@@ -0,0 +1,6 @@
+---
+galaxy_info:
+  author: cjr
+  description: Configure and enable ufw firewall
+  license: BSD-3-Clause
+  min_ansible_version: "2.1"

roles/firewall/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+- name: Install packages needed for ufw
+  community.general.pacman:
+    name:
+      - ufw
+      - ufw-extras
+    state: present
+
+- name: Configure the firewall incoming connection policy
+  community.general.ufw:
+    direction: incoming
+    policy: deny
+
+- name: Configure the firewall outgoing connection policy
+  community.general.ufw:
+    direction: outgoing
+    policy: allow
+
+- name: Allow incoming ports
+  community.general.ufw:
+    rule: allow
+    port: "22"
+    proto: tcp
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled

site.yml

@@ -0,0 +1,9 @@
+---
+- name: Configure CachyOS workstation
+  hosts: cachy
+  connection: local
+  become: true
+
+  roles:
+    - role: firewall
+      tags: firewall