91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
64 lines
2.1 KiB
YAML
64 lines
2.1 KiB
YAML
---
|
|
# ============================================================================
|
|
# linux-baseline / main entrypoint
|
|
# ============================================================================
|
|
# Orchestrates baseline application. Each capability sits behind a
|
|
# feature flag in baseline_features so individual concerns can be
|
|
# disabled per-host without forking the role.
|
|
# ============================================================================
|
|
|
|
- name: Preflight checks
|
|
ansible.builtin.import_tasks: preflight.yml
|
|
tags: [baseline, preflight, always]
|
|
|
|
- name: Load OS-family-specific variables
|
|
ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
|
|
tags: [baseline, always]
|
|
|
|
- name: Apply package baseline
|
|
ansible.builtin.import_tasks: packages.yml
|
|
when: baseline_features.packages | bool
|
|
tags: [baseline, packages]
|
|
|
|
- name: Configure timezone and locale
|
|
ansible.builtin.import_tasks: timezone.yml
|
|
when: baseline_features.timezone | bool
|
|
tags: [baseline, timezone]
|
|
|
|
- name: Configure time synchronisation
|
|
ansible.builtin.import_tasks: time_sync.yml
|
|
when: baseline_features.time_sync | bool
|
|
tags: [baseline, time-sync]
|
|
|
|
- name: Provision baseline users
|
|
ansible.builtin.import_tasks: users.yml
|
|
when: baseline_features.users | bool
|
|
tags: [baseline, users]
|
|
|
|
- name: Harden SSH
|
|
ansible.builtin.import_tasks: ssh_hardening.yml
|
|
when: baseline_features.ssh_hardening | bool
|
|
tags: [baseline, ssh, hardening]
|
|
|
|
- name: Configure unattended security upgrades
|
|
ansible.builtin.import_tasks: unattended_upgrades.yml
|
|
when:
|
|
- baseline_features.unattended_upgrades | bool
|
|
- ansible_os_family == "Debian"
|
|
tags: [baseline, unattended-upgrades]
|
|
|
|
- name: Apply sysctl baseline
|
|
ansible.builtin.import_tasks: sysctl.yml
|
|
when: baseline_features.sysctl | bool
|
|
tags: [baseline, sysctl]
|
|
|
|
- name: Configure journald retention
|
|
ansible.builtin.import_tasks: journald.yml
|
|
when: baseline_features.journald | bool
|
|
tags: [baseline, journald]
|
|
|
|
- name: Apply MOTD branding
|
|
ansible.builtin.import_tasks: motd.yml
|
|
when: baseline_features.motd | bool
|
|
tags: [baseline, motd]
|