91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
23 lines
645 B
YAML
23 lines
645 B
YAML
---
|
|
# ============================================================================
|
|
# Debian-family overrides (Ubuntu, Debian)
|
|
# ============================================================================
|
|
|
|
# Package facts module needs python3-apt on the target.
|
|
baseline_packages_family:
|
|
- python3-apt
|
|
- apt-transport-https
|
|
- software-properties-common
|
|
- lsb-release
|
|
- unattended-upgrades
|
|
|
|
baseline_sudo_group: sudo
|
|
|
|
# Service names
|
|
baseline_chrony_service: chrony
|
|
baseline_chrony_config_path: /etc/chrony/chrony.conf
|
|
baseline_sshd_service: ssh
|
|
|
|
# Unattended-upgrades file locations
|
|
baseline_unattended_config_dir: /etc/apt/apt.conf.d
|