ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
59 lines
1.5 KiB
YAML
59 lines
1.5 KiB
YAML
---
|
|
# Baseline hardening applied to both rn-platform-01 and rn-lab-host-01 before anything
|
|
# RootNode-specific — idempotent, safe to re-run (Phase 4 §20 requirement).
|
|
|
|
- name: Set timezone
|
|
community.general.timezone:
|
|
name: "{{ common_timezone }}"
|
|
|
|
- name: Install base packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- curl
|
|
- ca-certificates
|
|
- gnupg
|
|
- iptables
|
|
- iptables-persistent
|
|
- unattended-upgrades
|
|
- fail2ban
|
|
- jq
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
- name: Enable unattended security upgrades
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
mode: "0644"
|
|
when: common_unattended_upgrades
|
|
|
|
- name: Create the rootnode-deploy service account (if not the connecting user already)
|
|
ansible.builtin.user:
|
|
name: rootnode-deploy
|
|
shell: /bin/bash
|
|
groups: docker
|
|
append: true
|
|
create_home: true
|
|
register: deploy_user_result
|
|
failed_when: false # non-fatal — some hosts may already use this as ansible_user
|
|
|
|
- name: Ensure fail2ban is enabled for SSH
|
|
ansible.builtin.service:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Create /opt/rootnode and /etc/rootnode base directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
loop:
|
|
- /opt/rootnode
|
|
- /etc/rootnode
|