All roles detect ansible_facts['os_family'] (RedHat / Debian) and ansible_facts['distribution'] automatically; a single inventory and playbook run can target a mix of both families. Where the underlying tooling differs fundamentally (SELinux vs. AppArmor, dnf-automatic vs. unattended-upgrades), a role runs only on its matching family - see the role table below.

Requirements

ansible-galaxy collection install -r requirements.yml

Target hosts must be reachable via SSH from the Ansible control node with an administrative sudo-capable account.

Getting started

Update inventories/production/hosts.ini for your environment (hostnames, IP addresses, internal/DMZ group membership).
Review and adjust inventories/production/group_vars/all.yml (domain, AD groups, syslog target, admin subnet, etc.).

Set up secrets:

cp vault/secrets.yml.example vault/secrets.yml
# fill in values (AD join account, CrowdStrike Falcon CID, ...)
ansible-vault encrypt vault/secrets.yml

Store the vault password in .vault_pass (chmod 600, do not commit it) or wire it up to your organization's secret store.

Running

# Dry run (recommended before every real run)
ansible-playbook playbooks/site.yml --check --diff

# Full rollout
ansible-playbook playbooks/site.yml

# Hardening roles only
ansible-playbook playbooks/site.yml --tags hardening

# Add a new server
ansible-playbook playbooks/baseline.yml --limit <new-hostname>

# Targeted patch run (e.g. for scheduled execution)
ansible-playbook playbooks/patch_only.yml

# Post-deployment sanity checks (read-only)
ansible-playbook playbooks/verify.yml

Quality checks

ansible-lint
ansible-playbook playbooks/site.yml --syntax-check

Role overview

Role	Purpose	Platforms
`base_os`	Base packages, time sync, hostname, disable unneeded services	all
`repo_management`	Internal repos always; EPEL/CRB (RedHat) or universe/backports (Debian) only with internet access	all
`identity_ad`	sssd/realmd, domain join	all
`sudo_rbac`	sudoers.d per AD group	all
`local_accounts`	Break-glass account, optional local service accounts	all
`banners`	Pre-auth login warning banners (`/etc/issue`, `/etc/issue.net`)	all
`ssh_hardening`	sshd_config, public-key-only	all
`fail2ban`	SSH brute-force protection (requires EPEL on RedHat family)	all
`pam_hardening`	Password complexity (pwquality), account lockout (faillock)	all
`cis_hardening`	CIS-style baseline: sysctl, mounts, module blacklist, umask, TMOUT, Ctrl-Alt-Del, sticky bit, journald, auditd, GRUB password	all
`selinux_config`	SELinux enforcing mode, booleans, file contexts	RedHat only
`apparmor_config`	AppArmor enforce mode, complain-mode exceptions	Debian only
`firewall_config`	firewalld default-deny	all
`falcon_onboarding`	CrowdStrike Falcon sensor (rpm/deb)	all
`logging_rsyslog`	Log forwarding to SIEM, CA certificate distribution	all
`aide_integrity`	File integrity monitoring (AIDE)	all
`patch_mgmt`	dnf-automatic (RedHat) or unattended-upgrades (Debian)	all
`backup_agent`	Veeam agent (optional, per host)	all

Open items before rollout

Finalize the IP scheme in hosts.ini (naming scheme: <site>-<function><number>, e.g. GS-AP00015).
TLS syslog (6514) vs. plain syslog (514) - depends on the SIEM.
Set falcon_onboarding_sensor_package_url or falcon_onboarding_sensor_package_src per host to the package matching that host's OS (rpm for RedHat family, deb for Debian family).
Set veeam_agent_repo_url (RedHat) or veeam_agent_apt_repo_line (Debian).
Set syslog_ca_cert_enabled/syslog_ca_cert_src once it's clear whether the SIEM certificate is signed by an internal CA (see roles/logging_rsyslog/files/README.md).
Populate custom_yum_repos/custom_apt_repos with real internal repo URLs; only enable epel_enabled/crb_enabled/ubuntu_universe_enabled/debian_backports_enabled where genuinely needed.
fail2ban requires EPEL on RedHat-family hosts - either enable epel_enabled: true or provide fail2ban via custom_yum_repos.
Set cis_grub_password_enabled and grub_bootloader_password_hash (generate with grub2-mkpasswd-pbkdf2) if a GRUB bootloader password is desired.
admin_space_left_action = halt in cis_hardening (auditd) is a strict setting - confirm this is acceptable, since it halts the system if the audit log volume fills up.
cis_boot_hardening_enabled is off by default since it edits /etc/fstab for /boot and requires a reboot to take effect - review before enabling.
The AIDE config-directory include mechanism and default database path/extension (roles/aide_integrity/vars/Debian.yml) should be verified against the actual installed aide/aide-common package version on first rollout - Debian/Ubuntu point releases have varied here.
Coordinate AIDE database updates (aide --update) with the patch-management maintenance window, since scheduled patch runs will otherwise show up as AIDE findings.
Define CIS Level 2 / AppArmor exceptions per application (see selinux_config, apparmor_config, and firewall_config defaults as a starting point).