initial commit

playbooks/baseline.yml

@@ -0,0 +1,33 @@
+---
+# Onboarding process for a newly added server.
+# Run scoped to exactly the new host:
+#   ansible-playbook playbooks/baseline.yml --limit GS-AP00023 --ask-vault-pass
+#
+# Prerequisite: the host has already been added to
+# inventories/production/hosts.ini (and group_vars/host_vars as needed).
+
+- name: Baseline rollout for a newly added Linux server
+  hosts: "{{ target_host | default('linux_all') }}"
+  become: true
+  vars_files:
+    - ../vault/secrets.yml
+  roles:
+    - role: base_os
+    - role: repo_management
+    - role: identity_ad
+    - role: sudo_rbac
+    - role: local_accounts
+    - role: banners
+    - role: ssh_hardening
+    - role: fail2ban
+    - role: pam_hardening
+    - role: cis_hardening
+    - role: selinux_config
+      when: ansible_facts['os_family'] == "RedHat"
+    - role: apparmor_config
+      when: ansible_facts['os_family'] == "Debian"
+    - role: firewall_config
+    - role: falcon_onboarding
+    - role: logging_rsyslog
+    - role: aide_integrity
+    - role: patch_mgmt