91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
33 lines
992 B
YAML
33 lines
992 B
YAML
---
|
|
# ============================================================================
|
|
# Package baseline
|
|
# ============================================================================
|
|
|
|
- name: Update apt cache (Debian family)
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Install baseline packages (common)
|
|
ansible.builtin.package:
|
|
name: "{{ baseline_packages_common }}"
|
|
state: present
|
|
|
|
- name: Install baseline packages (OS family)
|
|
ansible.builtin.package:
|
|
name: "{{ baseline_packages_family }}"
|
|
state: present
|
|
|
|
- name: Install baseline packages (host extras)
|
|
ansible.builtin.package:
|
|
name: "{{ baseline_packages_extra }}"
|
|
state: present
|
|
when: baseline_packages_extra | length > 0
|
|
|
|
- name: Perform full system upgrade (opt-in)
|
|
ansible.builtin.package:
|
|
name: "*"
|
|
state: latest # noqa package-latest - intentional under feature flag
|
|
when: baseline_features.full_upgrade | bool
|