You've already forked ansible-linux-infra
34 lines
1002 B
YAML
34 lines
1002 B
YAML
---
|
|
# Onboarding process for a newly added server.
|
|
# Run scoped to exactly the new host:
|
|
# ansible-playbook playbooks/baseline.yml --limit GS-AP00023 --ask-vault-pass
|
|
#
|
|
# Prerequisite: the host has already been added to
|
|
# inventories/production/hosts.ini (and group_vars/host_vars as needed).
|
|
|
|
- name: Baseline rollout for a newly added Linux server
|
|
hosts: "{{ target_host | default('linux_all') }}"
|
|
become: true
|
|
vars_files:
|
|
- ../vault/secrets.yml
|
|
roles:
|
|
- role: base_os
|
|
- role: repo_management
|
|
- role: identity_ad
|
|
- role: sudo_rbac
|
|
- role: local_accounts
|
|
- role: banners
|
|
- role: ssh_hardening
|
|
- role: fail2ban
|
|
- role: pam_hardening
|
|
- role: cis_hardening
|
|
- role: selinux_config
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
- role: apparmor_config
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
- role: firewall_config
|
|
- role: falcon_onboarding
|
|
- role: logging_rsyslog
|
|
- role: aide_integrity
|
|
- role: patch_mgmt
|