91b5817e5f
Introduces a single, idempotent baseline role to supersede the overlapping day0-baseline and common roles. Capabilities are feature-flagged so they can be toggled per-host: - packages (common + OS-family + per-host extras) - timezone + locale - chrony time sync against sundial - baseline users (jarvis admin account with SSH key + NOPASSWD sudo) - SSH hardening via /etc/ssh/sshd_config.d/ drop-in - unattended security upgrades (Debian family) - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf - journald retention caps - branded MOTD Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder for future distros via the ansible_os_family pattern. The legacy day0-baseline and common roles remain in place for now and will be removed during the playbook cleanup sweep, alongside the existing playbook naming inconsistencies.
24 lines
920 B
YAML
24 lines
920 B
YAML
---
|
|
# ============================================================================
|
|
# day0_linux_baseline.yml
|
|
# ----------------------------------------------------------------------------
|
|
# Applies the mk-labs Linux baseline (linux-baseline role) to one or more
|
|
# hosts. Idempotent and safe to re-run.
|
|
#
|
|
# Usage:
|
|
# ansible-playbook playbooks/day0_linux_baseline.yml
|
|
# ansible-playbook playbooks/day0_linux_baseline.yml -e target=figment
|
|
# ansible-playbook playbooks/day0_linux_baseline.yml -e target=semaphore_server
|
|
#
|
|
# To trigger an opt-in full system upgrade:
|
|
# ansible-playbook playbooks/day0_linux_baseline.yml \
|
|
# -e target=figment -e 'baseline_features={"full_upgrade": true}'
|
|
# ============================================================================
|
|
|
|
- name: Apply mk-labs Linux baseline
|
|
hosts: "{{ target | default('all') }}"
|
|
become: true
|
|
gather_facts: true
|
|
roles:
|
|
- linux-baseline
|