121 lines
4.4 KiB
YAML
121 lines
4.4 KiB
YAML
---
|
|
# ============================================================================
|
|
# linux-baseline role defaults
|
|
# ============================================================================
|
|
# This role applies an idempotent baseline to any Linux host in mk-labs.
|
|
# Ubuntu is the first-class target; other distributions plug in via
|
|
# vars/<ansible_os_family>.yml.
|
|
# ============================================================================
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Feature flags - each capability can be toggled independently
|
|
# ---------------------------------------------------------------------------
|
|
baseline_features:
|
|
packages: true
|
|
timezone: true
|
|
time_sync: true
|
|
ssh_hardening: true
|
|
users: true
|
|
unattended_upgrades: true
|
|
sysctl: true
|
|
journald: true
|
|
motd: true
|
|
# Off by default: a full apt/dnf upgrade is intrusive. Use the dedicated
|
|
# day2 update playbook for that. Security patches are handled by
|
|
# unattended-upgrades.
|
|
full_upgrade: false
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Locale & time
|
|
# ---------------------------------------------------------------------------
|
|
baseline_timezone: America/Chicago
|
|
baseline_locale: en_US.UTF-8
|
|
baseline_ntp_server: sundial.local.mk-labs.cloud
|
|
baseline_ntp_fallback_pool: 2.pool.ntp.org
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Packages
|
|
# ---------------------------------------------------------------------------
|
|
# Distribution-agnostic baseline. Distro-specific additions are merged in
|
|
# from vars/<family>.yml at runtime.
|
|
baseline_packages_common:
|
|
- curl
|
|
- wget
|
|
- vim
|
|
- htop
|
|
- git
|
|
- jq
|
|
- unzip
|
|
- rsync
|
|
- ca-certificates
|
|
- gnupg
|
|
- net-tools
|
|
- dnsutils
|
|
- acl
|
|
- tree
|
|
- tmux
|
|
|
|
# Per-host opt-in extras. Set in host_vars or group_vars.
|
|
baseline_packages_extra: []
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Baseline users
|
|
# ---------------------------------------------------------------------------
|
|
# 'jarvis' is the universal admin / automation account that this role
|
|
# provisions on every host. Service users (e.g. 'cast' for podman
|
|
# workloads) are created by their respective application roles, not here.
|
|
baseline_users:
|
|
- name: jarvis
|
|
comment: "JARVIS automation account"
|
|
shell: /bin/bash
|
|
groups: "{{ baseline_sudo_group }}"
|
|
sudo_nopasswd: true
|
|
ssh_authorized_keys:
|
|
- "{{ jarvis_ssh_public_key }}"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# SSH hardening
|
|
# ---------------------------------------------------------------------------
|
|
# Delivered as a drop-in under /etc/ssh/sshd_config.d/ rather than editing
|
|
# the main config file. Safer to re-apply, easier to remove.
|
|
baseline_ssh_permit_root_login: "no"
|
|
baseline_ssh_password_authentication: "no"
|
|
baseline_ssh_pubkey_authentication: "yes"
|
|
baseline_ssh_permit_empty_passwords: "no"
|
|
baseline_ssh_x11_forwarding: "no"
|
|
baseline_ssh_client_alive_interval: 300
|
|
baseline_ssh_client_alive_count_max: 2
|
|
baseline_ssh_max_auth_tries: 4
|
|
baseline_ssh_login_grace_time: 30
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Unattended security upgrades (apt / dnf-automatic)
|
|
# ---------------------------------------------------------------------------
|
|
baseline_unattended_security_only: true
|
|
baseline_unattended_auto_reboot: false
|
|
baseline_unattended_auto_reboot_time: "03:00"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# sysctl
|
|
# ---------------------------------------------------------------------------
|
|
# Light hand here. The kernel defaults are generally sensible; we tune
|
|
# only what consistently bites us in a homelab.
|
|
baseline_sysctl:
|
|
vm.swappiness: 10
|
|
fs.inotify.max_user_watches: 524288
|
|
fs.inotify.max_user_instances: 512
|
|
net.ipv4.tcp_keepalive_time: 600
|
|
net.ipv4.tcp_keepalive_intvl: 60
|
|
net.ipv4.tcp_keepalive_probes: 6
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# journald retention caps
|
|
# ---------------------------------------------------------------------------
|
|
baseline_journald_max_use: "1G"
|
|
baseline_journald_max_retention: "30day"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# MOTD branding
|
|
# ---------------------------------------------------------------------------
|
|
baseline_motd_banner: "wdw-labs"
|