anchor.diff:  
   `./run all -i dev -a "apt list --upgradable"`
   
  -To upgrade I use link:provision/upgrade.yml[a very short Ansible playbook], to run the playbook I can do:
  +To upgrade I use link:provision/upgrade.yml[a short Ansible playbook]. To run the playbook I can do:
   
   `./play -i dev upgrade.yml`
  -
  
positive.code: 
  === Ansible main playbook
  
  My main playbook is called link:provision/site[`site`] and should be possible to run at all times.
  
  The complete ansible command to run it is:
  
  
negative.code: 
  ==== Ansible pre-reqs
  
  My VPS did not have all the required packages for many ansible modules, e.g python.
  
  To fix this I started with link:provision/roles/ansible-prereqs[a role for getting the prereq's in place].
  
  ==== Firewall using Uncomplicated Firewall (ufw) and fail2ban
  
  I use https://wiki.debian.org/Uncomplicated%20Firewall%20(ufw)[ufw] for my firewall; it is a bit easier to use than iptables. Ansible also has https://docs.ansible.com/ansible/ufw_module.html[a module for it]. The role has link:provision/roles/firewalled/tasks/main.yml[a simple set of tasks].
  
  Also, to limit the chance of brute-forcing password-based SSH-users I added fail2ban. Thankfully someone has already created https://galaxy.ansible.com/nickjj/fail2ban/[a role for fail2ban] (pulled from https://galaxy.ansible.com/[Ansible Galaxy]), all I did was put it in my link:provision/base-setup.yml[base-setup], add some host-specific variables and press play.
  
  ==== Ansible-roles
  
  I use roles from https://galaxy.ansible.com/[Ansible Galaxy]. You need to run `ansible-galaxy install <name.role>` before provisioning to install these roles.
  
  List of roles in use:
  
  * https://galaxy.ansible.com/nickjj/fail2ban/[nickjj.fail2ban] - for installing fail2ban
  
  === Ansible command helpers
  
  To use the same arguments over and over is a bit tedious so I have made a couple of helper scripts: 
  
  * link:provision/run[`run`] - to run ansible commands, e.g `./run all -i dev -a "apt list --upgradeable"` or `./run all -i prod -m ping`
  * link:provision/play[`play`] - to run ansible playbooks, e.g `./play all -i dev site.yml`
  