91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
19 lines
741 B
YAML
19 lines
741 B
YAML
---
|
|
# ============================================================================
|
|
# Preflight: fail fast on unsupported platforms.
|
|
# ============================================================================
|
|
|
|
- name: Assert a supported OS family
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_os_family in ["Debian", "RedHat"]
|
|
fail_msg: >-
|
|
linux-baseline currently supports the Debian and RedHat OS families.
|
|
Host {{ inventory_hostname }} is running {{ ansible_distribution }}
|
|
{{ ansible_distribution_version }} ({{ ansible_os_family }}).
|
|
success_msg: "Detected {{ ansible_distribution }} {{ ansible_distribution_version }}."
|
|
|
|
- name: Gather package facts
|
|
ansible.builtin.package_facts:
|
|
manager: auto
|