pluto
b9be45dc71
Complete IaC covering: - 14 roles: common, docker, traefik, vaultwarden, monitoring, media, matrix, home_assistant, frigate, adguard, gitea, semaphore, openclaw, security, backup - Inventory for all hosts (Peggy, Bart, Yoda, NAS, Firewalla) - Stack playbooks: core-infrastructure, monitoring, media, communication, automation, smarthome, security-hardening - Maintenance playbooks: update-containers, backup, health-check - Production Docker Compose templates with Traefik labels - Security hardening (sysctl, auditd, UFW, fail2ban) - Automated backups with retention policy
25 lines
700 B
Django/Jinja
25 lines
700 B
Django/Jinja
# Audit rules - Managed by Ansible
|
|
# Monitor changes to authentication configuration
|
|
-w /etc/pam.d/ -p wa -k auth_changes
|
|
-w /etc/nsswitch.conf -p wa -k auth_changes
|
|
-w /etc/ssh/sshd_config -p wa -k sshd_config
|
|
|
|
# Monitor user/group changes
|
|
-w /etc/passwd -p wa -k user_changes
|
|
-w /etc/group -p wa -k group_changes
|
|
-w /etc/shadow -p wa -k shadow_changes
|
|
|
|
# Monitor sudo usage
|
|
-w /etc/sudoers -p wa -k sudoers
|
|
-w /etc/sudoers.d/ -p wa -k sudoers
|
|
|
|
# Monitor Docker
|
|
-w /usr/bin/docker -p rwxa -k docker
|
|
-w /var/lib/docker -p wa -k docker
|
|
-w /etc/docker -p wa -k docker
|
|
-w /usr/lib/systemd/system/docker.service -p wa -k docker
|
|
|
|
# Monitor cron
|
|
-w /etc/crontab -p wa -k cron
|
|
-w /etc/cron.d/ -p wa -k cron
|