Initial Ansible automation for hobbs.farm infrastructure

Complete IaC covering:
- 14 roles: common, docker, traefik, vaultwarden, monitoring, media, matrix,
  home_assistant, frigate, adguard, gitea, semaphore, openclaw, security, backup
- Inventory for all hosts (Peggy, Bart, Yoda, NAS, Firewalla)
- Stack playbooks: core-infrastructure, monitoring, media, communication,
  automation, smarthome, security-hardening
- Maintenance playbooks: update-containers, backup, health-check
- Production Docker Compose templates with Traefik labels
- Security hardening (sysctl, auditd, UFW, fail2ban)
- Automated backups with retention policy

roles/security/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+security_sysctl_hardening: true
+security_audit_enabled: true
+security_auto_updates: true
+security_ssh_max_auth_tries: 3

roles/security/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+- name: Reload sysctl
+  ansible.builtin.command: sysctl --system
+  changed_when: true
+
+- name: Restart auditd
+  ansible.builtin.systemd:
+    name: auditd
+    state: restarted

roles/security/tasks/main.yml

@@ -0,0 +1,73 @@
+---
+- name: Deploy hardened sysctl configuration
+  ansible.builtin.template:
+    src: sysctl.conf.j2
+    dest: /etc/sysctl.d/99-hardening.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload sysctl
+  when: security_sysctl_hardening
+  tags: [security, sysctl]
+
+- name: Install auditd
+  ansible.builtin.apt:
+    name:
+      - auditd
+      - audispd-plugins
+    state: present
+  when: security_audit_enabled
+  tags: [security, audit]
+
+- name: Deploy audit rules
+  ansible.builtin.template:
+    src: audit.rules.j2
+    dest: /etc/audit/rules.d/hardening.rules
+    owner: root
+    group: root
+    mode: "0640"
+  notify: Restart auditd
+  when: security_audit_enabled
+  tags: [security, audit]
+
+- name: Enable unattended upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+  when: security_auto_updates
+  tags: [security, updates]
+
+- name: Configure unattended upgrades
+  ansible.builtin.copy:
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+      APT::Periodic::AutocleanInterval "7";
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    owner: root
+    group: root
+    mode: "0644"
+  when: security_auto_updates
+  tags: [security, updates]
+
+- name: Disable core dumps
+  ansible.posix.sysctl:
+    name: fs.suid_dumpable
+    value: "0"
+    state: present
+    reload: true
+  tags: [security]
+
+- name: Set secure permissions on cron directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: "0700"
+  loop:
+    - /etc/cron.d
+    - /etc/cron.daily
+    - /etc/cron.hourly
+    - /etc/cron.weekly
+    - /etc/cron.monthly
+  tags: [security]

roles/security/templates/audit.rules.j2

@@ -0,0 +1,24 @@
+# Audit rules - Managed by Ansible
+# Monitor changes to authentication configuration
+-w /etc/pam.d/ -p wa -k auth_changes
+-w /etc/nsswitch.conf -p wa -k auth_changes
+-w /etc/ssh/sshd_config -p wa -k sshd_config
+
+# Monitor user/group changes
+-w /etc/passwd -p wa -k user_changes
+-w /etc/group -p wa -k group_changes
+-w /etc/shadow -p wa -k shadow_changes
+
+# Monitor sudo usage
+-w /etc/sudoers -p wa -k sudoers
+-w /etc/sudoers.d/ -p wa -k sudoers
+
+# Monitor Docker
+-w /usr/bin/docker -p rwxa -k docker
+-w /var/lib/docker -p wa -k docker
+-w /etc/docker -p wa -k docker
+-w /usr/lib/systemd/system/docker.service -p wa -k docker
+
+# Monitor cron
+-w /etc/crontab -p wa -k cron
+-w /etc/cron.d/ -p wa -k cron

roles/security/templates/sysctl.conf.j2

@@ -0,0 +1,24 @@
+# Network hardening - Managed by Ansible
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+net.ipv4.conf.all.log_martians = 1
+net.ipv4.conf.default.log_martians = 1
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+net.ipv4.icmp_ignore_bogus_error_responses = 1
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+net.ipv4.tcp_syncookies = 1
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv6.conf.default.accept_redirects = 0
+
+# Memory hardening
+kernel.randomize_va_space = 2
+fs.protected_hardlinks = 1
+fs.protected_symlinks = 1
+
+# Docker needs IP forwarding
+net.ipv4.ip_forward = 1