rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ansible): add linux-baseline role and day0_linux_baseline playbook

Browse Source 
Introduces a single, idempotent baseline role to supersede the
overlapping day0-baseline and common roles. Capabilities are
feature-flagged so they can be toggled per-host:

  - packages (common + OS-family + per-host extras)
  - timezone + locale
  - chrony time sync against sundial
  - baseline users (jarvis admin account with SSH key + NOPASSWD sudo)
  - SSH hardening via /etc/ssh/sshd_config.d/ drop-in
  - unattended security upgrades (Debian family)
  - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf
  - journald retention caps
  - branded MOTD

Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder
for future distros via the ansible_os_family pattern.

The legacy day0-baseline and common roles remain in place for now and
will be removed during the playbook cleanup sweep, alongside the
existing playbook naming inconsistencies.
This commit is contained in:
Hermes Agent service account
2026-05-29 20:40:04 -05:00
parent 1dfa7889ab
commit 91b5817e5f
25 changed files with 741 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
ansible/roles/linux-baseline/templates/motd.j2 Normal file
View File

@@ -0,0 +1,11 @@
╔═══════════════════════════════════════════════════════════════╗
║ ║
║ {{ baseline_motd_banner }} - {{ inventory_hostname }}{{ ' ' * (50 - (baseline_motd_banner | length) - (inventory_hostname | length)) }}║
║ ║
║ {{ ansible_distribution }} {{ ansible_distribution_version }} ({{ ansible_kernel }}){{ ' ' * (53 - (ansible_distribution | length) - (ansible_distribution_version | length) - (ansible_kernel | length)) }}║
║ ║
║ Managed by Ansible. Local changes will be overwritten. ║
║ ║
╚═══════════════════════════════════════════════════════════════╝