91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
linux-baseline
Idempotent baseline for any Linux host in mk-labs.
What it does
Applied on every host, this role guarantees a known-good operational baseline:
| Capability | Default | Description |
|---|---|---|
packages |
on | Installs curated common + OS-family packages, plus host extras |
timezone |
on | Sets timezone and locale |
time_sync |
on | Installs and configures chrony against sundial |
users |
on | Provisions baseline admin accounts (jarvis) with SSH + sudo |
ssh_hardening |
on | Deploys /etc/ssh/sshd_config.d/10-mk-labs-hardening.conf |
unattended_upgrades |
on | Security-only automatic upgrades on Debian-family hosts |
sysctl |
on | Drop-in at /etc/sysctl.d/99-mk-labs.conf |
journald |
on | Caps journal size + retention |
motd |
on | Branded MOTD |
full_upgrade |
off | Opt-in full dist-upgrade. Use the day2 update playbook instead |
Every capability sits behind a feature flag in baseline_features so it
can be disabled per-host without forking the role.
OS support
- First-class: Ubuntu (22.04, 24.04) and Debian (bullseye, bookworm).
- Placeholder: RHEL family — see
vars/RedHat.yml. Flesh out when a RHEL-family host joins the fleet.
OS-specific values are loaded from vars/{{ ansible_os_family }}.yml.
Required inventory variables
| Variable | Where | Example |
|---|---|---|
jarvis_ssh_public_key |
group_vars/all | ssh-ed25519 AAAA... jarvis@mk-labs |
Usage
- name: Apply linux-baseline
hosts: "{{ target | default('all') }}"
become: true
roles:
- linux-baseline
Per-host overrides
# host_vars/some-host/vars
baseline_packages_extra:
- postgresql-client
- redis-tools
baseline_features:
motd: false
Migration notes
This role supersedes the legacy day0-baseline and common roles, both
of which are slated for removal once the fleet has been re-baselined.