# linux-baseline

Idempotent baseline for any Linux host in mk-labs.

## What it does

Applied on every host, this role guarantees a known-good operational baseline:

| Capability           | Default | Description                                                   |
|----------------------|---------|---------------------------------------------------------------|
| `packages`           | on      | Installs curated common + OS-family packages, plus host extras |
| `timezone`           | on      | Sets timezone and locale                                       |
| `time_sync`          | on      | Installs and configures chrony against `sundial`               |
| `users`              | on      | Provisions baseline admin accounts (jarvis) with SSH + sudo    |
| `ssh_hardening`      | on      | Deploys `/etc/ssh/sshd_config.d/10-mk-labs-hardening.conf`     |
| `unattended_upgrades`| on      | Security-only automatic upgrades on Debian-family hosts        |
| `sysctl`             | on      | Drop-in at `/etc/sysctl.d/99-mk-labs.conf`                     |
| `journald`           | on      | Caps journal size + retention                                  |
| `motd`               | on      | Branded MOTD                                                   |
| `full_upgrade`       | off     | Opt-in full dist-upgrade. Use the day2 update playbook instead |

Every capability sits behind a feature flag in `baseline_features` so it
can be disabled per-host without forking the role.

## OS support

- **First-class:** Ubuntu (22.04, 24.04) and Debian (bullseye, bookworm).
- **Placeholder:** RHEL family — see `vars/RedHat.yml`. Flesh out when a
  RHEL-family host joins the fleet.

OS-specific values are loaded from `vars/{{ ansible_os_family }}.yml`.

## Required inventory variables

| Variable                | Where           | Example                                   |
|-------------------------|-----------------|-------------------------------------------|
| `jarvis_ssh_public_key` | group_vars/all  | `ssh-ed25519 AAAA... jarvis@mk-labs`      |

## Usage

```yaml
- name: Apply linux-baseline
  hosts: "{{ target | default('all') }}"
  become: true
  roles:
    - linux-baseline
```

## Per-host overrides

```yaml
# host_vars/some-host/vars
baseline_packages_extra:
  - postgresql-client
  - redis-tools

baseline_features:
  motd: false
```

## Migration notes

This role supersedes the legacy `day0-baseline` and `common` roles, both
of which are slated for removal once the fleet has been re-baselined.