91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
65 lines
2.5 KiB
Markdown
65 lines
2.5 KiB
Markdown
# linux-baseline
|
|
|
|
Idempotent baseline for any Linux host in mk-labs.
|
|
|
|
## What it does
|
|
|
|
Applied on every host, this role guarantees a known-good operational baseline:
|
|
|
|
| Capability | Default | Description |
|
|
|----------------------|---------|---------------------------------------------------------------|
|
|
| `packages` | on | Installs curated common + OS-family packages, plus host extras |
|
|
| `timezone` | on | Sets timezone and locale |
|
|
| `time_sync` | on | Installs and configures chrony against `sundial` |
|
|
| `users` | on | Provisions baseline admin accounts (jarvis) with SSH + sudo |
|
|
| `ssh_hardening` | on | Deploys `/etc/ssh/sshd_config.d/10-mk-labs-hardening.conf` |
|
|
| `unattended_upgrades`| on | Security-only automatic upgrades on Debian-family hosts |
|
|
| `sysctl` | on | Drop-in at `/etc/sysctl.d/99-mk-labs.conf` |
|
|
| `journald` | on | Caps journal size + retention |
|
|
| `motd` | on | Branded MOTD |
|
|
| `full_upgrade` | off | Opt-in full dist-upgrade. Use the day2 update playbook instead |
|
|
|
|
Every capability sits behind a feature flag in `baseline_features` so it
|
|
can be disabled per-host without forking the role.
|
|
|
|
## OS support
|
|
|
|
- **First-class:** Ubuntu (22.04, 24.04) and Debian (bullseye, bookworm).
|
|
- **Placeholder:** RHEL family — see `vars/RedHat.yml`. Flesh out when a
|
|
RHEL-family host joins the fleet.
|
|
|
|
OS-specific values are loaded from `vars/{{ ansible_os_family }}.yml`.
|
|
|
|
## Required inventory variables
|
|
|
|
| Variable | Where | Example |
|
|
|-------------------------|-----------------|-------------------------------------------|
|
|
| `jarvis_ssh_public_key` | group_vars/all | `ssh-ed25519 AAAA... jarvis@mk-labs` |
|
|
|
|
## Usage
|
|
|
|
```yaml
|
|
- name: Apply linux-baseline
|
|
hosts: "{{ target | default('all') }}"
|
|
become: true
|
|
roles:
|
|
- linux-baseline
|
|
```
|
|
|
|
## Per-host overrides
|
|
|
|
```yaml
|
|
# host_vars/some-host/vars
|
|
baseline_packages_extra:
|
|
- postgresql-client
|
|
- redis-tools
|
|
|
|
baseline_features:
|
|
motd: false
|
|
```
|
|
|
|
## Migration notes
|
|
|
|
This role supersedes the legacy `day0-baseline` and `common` roles, both
|
|
of which are slated for removal once the fleet has been re-baselined.
|