91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
20 lines
651 B
YAML
20 lines
651 B
YAML
---
|
|
# ============================================================================
|
|
# RedHat-family overrides (Rocky, AlmaLinux, RHEL) - placeholder
|
|
# ============================================================================
|
|
# This file exists to make the OS abstraction visible. It is not exercised
|
|
# today because mk-labs is all-Ubuntu. Flesh out when a RHEL-family host
|
|
# enters the fleet.
|
|
|
|
baseline_packages_family:
|
|
- dnf-automatic
|
|
- python3-dnf
|
|
|
|
baseline_sudo_group: wheel
|
|
|
|
baseline_chrony_service: chronyd
|
|
baseline_chrony_config_path: /etc/chrony.conf
|
|
baseline_sshd_service: sshd
|
|
|
|
baseline_unattended_config_dir: /etc/dnf/automatic.conf.d
|