91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
29 lines
721 B
Django/Jinja
29 lines
721 B
Django/Jinja
# {{ ansible_managed }}
|
|
# Managed by Ansible - linux-baseline role
|
|
# Local edits will be overwritten.
|
|
|
|
# Primary NTP source: mk-labs internal NTP server (sundial)
|
|
server {{ baseline_ntp_server }} iburst prefer
|
|
|
|
# Fallback: public NTP pool
|
|
pool {{ baseline_ntp_fallback_pool }} iburst maxsources 2
|
|
|
|
driftfile /var/lib/chrony/chrony.drift
|
|
|
|
# Step the clock if the adjustment is >1s on the first 3 corrections
|
|
makestep 1.0 3
|
|
|
|
# Sync RTC from system clock
|
|
rtcsync
|
|
|
|
# Allow chronyd to use the keyfile for hardware refclock
|
|
{% if ansible_os_family == "Debian" %}
|
|
keyfile /etc/chrony/chrony.keys
|
|
{% else %}
|
|
keyfile /etc/chrony.keys
|
|
{% endif %}
|
|
|
|
# Log selective events
|
|
logdir /var/log/chrony
|
|
log measurements statistics tracking
|