// Things we want standard on all server boxes, primarily: // - Security // - Look and feel // - default users, groups etc {

"name": "server",
"description": "A server of some kind...",
"default_attributes": {
  "apt" : {
    "compile_time_update": true,
    "unattended_upgrades" : {
      "enable" : true,
      "allowed_origins" : [
        "${distro_id} stable",
        "${distro_id} ${distro_codename}-security",
        "${distro_id} ${distro_codename}-updates"
      ],
      "automatic_reboot" : false
    }
  },
  "authorization": {
    "sudo": {
      // everyone in the group sysadmin gets sudo rights
      "groups": ["sudo"],
      // the deploy user specifically gets sudo rights
      "users": ["deploy"],
      // whether a user with sudo rights can execute sudo
      // commands without entering their password.
      "passwordless": true
    }
  },
  "build-essential": {
    "compile_time": true
  },
  "locales" : {
    "locale_file": "/etc/locale.gen",
    "packages" : ["locales"],
    "default" : "en_US.utf8"
  },
  "openssh" : {
    "server" : {
      "password_authentication" : "no",
      "challenge_response_authentication" : "no",
      "permit_empty_passwords" : "no",
      "use_pam" : "no",
      "x11_forwarding" : "no",
      "permit_root_login" : "no"
    }
  }
},
"json_class": "Chef::Role",
"run_list": [
  "recipe[apt]",
  // required for generating secure passwords
  "recipe[openssl::default]",
  // required for building from source
  "recipe[build-essential::default]",
  // enable unattended upgrades
  "recipe[apt::unattended-upgrades]",
  // enable automatic time sync
  "recipe[ntp::default]",
  // make sure deploy user has sudo rights
  "recipe[sudo::default]",
  // Make sure we have a valid locale setup
  "recipe[locales::default]",
  // Block repeated failed login attempts
  "recipe[fail2ban::default]"
],
"chef_type": "role",
"override_attributes": {
}

}