---
# Onboarding process for a newly added server.
# Run scoped to exactly the new host:
#   ansible-playbook playbooks/baseline.yml --limit GS-AP00023 --ask-vault-pass
#
# Prerequisite: the host has already been added to
# inventories/production/hosts.ini (and group_vars/host_vars as needed).

- name: Baseline rollout for a newly added Linux server
  hosts: "{{ target_host | default('linux_all') }}"
  become: true
  vars_files:
    - ../vault/secrets.yml
  roles:
    - role: base_os
    - role: repo_management
    - role: identity_ad
    - role: sudo_rbac
    - role: local_accounts
    - role: banners
    - role: ssh_hardening
    - role: fail2ban
    - role: pam_hardening
    - role: cis_hardening
    - role: selinux_config
      when: ansible_facts['os_family'] == "RedHat"
    - role: apparmor_config
      when: ansible_facts['os_family'] == "Debian"
    - role: firewall_config
    - role: falcon_onboarding
    - role: logging_rsyslog
    - role: aide_integrity
    - role: patch_mgmt