pluto
b9be45dc71
Complete IaC covering: - 14 roles: common, docker, traefik, vaultwarden, monitoring, media, matrix, home_assistant, frigate, adguard, gitea, semaphore, openclaw, security, backup - Inventory for all hosts (Peggy, Bart, Yoda, NAS, Firewalla) - Stack playbooks: core-infrastructure, monitoring, media, communication, automation, smarthome, security-hardening - Maintenance playbooks: update-containers, backup, health-check - Production Docker Compose templates with Traefik labels - Security hardening (sysctl, auditd, UFW, fail2ban) - Automated backups with retention policy
74 lines
1.6 KiB
YAML
74 lines
1.6 KiB
YAML
---
|
|
- name: Deploy hardened sysctl configuration
|
|
ansible.builtin.template:
|
|
src: sysctl.conf.j2
|
|
dest: /etc/sysctl.d/99-hardening.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Reload sysctl
|
|
when: security_sysctl_hardening
|
|
tags: [security, sysctl]
|
|
|
|
- name: Install auditd
|
|
ansible.builtin.apt:
|
|
name:
|
|
- auditd
|
|
- audispd-plugins
|
|
state: present
|
|
when: security_audit_enabled
|
|
tags: [security, audit]
|
|
|
|
- name: Deploy audit rules
|
|
ansible.builtin.template:
|
|
src: audit.rules.j2
|
|
dest: /etc/audit/rules.d/hardening.rules
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
notify: Restart auditd
|
|
when: security_audit_enabled
|
|
tags: [security, audit]
|
|
|
|
- name: Enable unattended upgrades
|
|
ansible.builtin.apt:
|
|
name: unattended-upgrades
|
|
state: present
|
|
when: security_auto_updates
|
|
tags: [security, updates]
|
|
|
|
- name: Configure unattended upgrades
|
|
ansible.builtin.copy:
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
APT::Periodic::AutocleanInterval "7";
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: security_auto_updates
|
|
tags: [security, updates]
|
|
|
|
- name: Disable core dumps
|
|
ansible.posix.sysctl:
|
|
name: fs.suid_dumpable
|
|
value: "0"
|
|
state: present
|
|
reload: true
|
|
tags: [security]
|
|
|
|
- name: Set secure permissions on cron directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
loop:
|
|
- /etc/cron.d
|
|
- /etc/cron.daily
|
|
- /etc/cron.hourly
|
|
- /etc/cron.weekly
|
|
- /etc/cron.monthly
|
|
tags: [security]
|