initial commit

playbooks/site.yml

@@ -0,0 +1,51 @@
+---
+# Full rollout of all roles.
+# Full run:    ansible-playbook playbooks/site.yml --ask-vault-pass
+# Dry run:     ansible-playbook playbooks/site.yml --check --diff
+# Subset only: ansible-playbook playbooks/site.yml --tags hardening
+
+- name: Deploy hardened Linux baseline configuration
+  hosts: linux_all
+  become: true
+  vars_files:
+    - ../vault/secrets.yml
+  roles:
+    - role: base_os
+      tags: [base_os]
+    - role: repo_management
+      tags: [repo_management]
+    - role: identity_ad
+      tags: [identity_ad, hardening]
+    - role: sudo_rbac
+      tags: [sudo_rbac, hardening]
+    - role: local_accounts
+      tags: [local_accounts, hardening]
+    - role: banners
+      tags: [banners, hardening]
+    - role: ssh_hardening
+      tags: [ssh_hardening, hardening]
+    - role: fail2ban
+      tags: [fail2ban, hardening]
+    - role: pam_hardening
+      tags: [pam_hardening, hardening]
+    - role: cis_hardening
+      tags: [cis_hardening, hardening]
+    - role: selinux_config
+      tags: [selinux_config, hardening]
+      when: ansible_facts['os_family'] == "RedHat"
+    - role: apparmor_config
+      tags: [apparmor_config, hardening]
+      when: ansible_facts['os_family'] == "Debian"
+    - role: firewall_config
+      tags: [firewall_config, hardening]
+    - role: falcon_onboarding
+      tags: [falcon_onboarding, hardening]
+    - role: logging_rsyslog
+      tags: [logging_rsyslog, monitoring]
+    - role: aide_integrity
+      tags: [aide_integrity, monitoring]
+    - role: patch_mgmt
+      tags: [patch_mgmt, patching]
+    - role: backup_agent
+      tags: [backup_agent]
+      when: veeam_agent_enabled | default(false) | bool