91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
26 lines
661 B
YAML
26 lines
661 B
YAML
---
|
|
# ============================================================================
|
|
# Time synchronisation via chrony
|
|
# ============================================================================
|
|
|
|
- name: Install chrony
|
|
ansible.builtin.package:
|
|
name: chrony
|
|
state: present
|
|
|
|
- name: Deploy chrony configuration
|
|
ansible.builtin.template:
|
|
src: chrony.conf.j2
|
|
dest: "{{ baseline_chrony_config_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
backup: true
|
|
notify: Restart chrony
|
|
|
|
- name: Ensure chrony is enabled and running
|
|
ansible.builtin.systemd:
|
|
name: "{{ baseline_chrony_service }}"
|
|
state: started
|
|
enabled: true
|