91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
26 lines
505 B
YAML
26 lines
505 B
YAML
---
|
|
galaxy_info:
|
|
role_name: linux_baseline
|
|
author: JARVIS
|
|
description: >-
|
|
Idempotent Linux baseline for mk-labs hosts. Ubuntu first-class,
|
|
pluggable for other distributions via vars/<os_family>.yml.
|
|
license: MIT
|
|
min_ansible_version: "2.14"
|
|
platforms:
|
|
- name: Ubuntu
|
|
versions:
|
|
- jammy
|
|
- noble
|
|
- name: Debian
|
|
versions:
|
|
- bullseye
|
|
- bookworm
|
|
galaxy_tags:
|
|
- baseline
|
|
- bootstrap
|
|
- hardening
|
|
- homelab
|
|
|
|
dependencies: []
|