You've already forked ansible-linux-infra
52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
---
|
|
# Full rollout of all roles.
|
|
# Full run: ansible-playbook playbooks/site.yml --ask-vault-pass
|
|
# Dry run: ansible-playbook playbooks/site.yml --check --diff
|
|
# Subset only: ansible-playbook playbooks/site.yml --tags hardening
|
|
|
|
- name: Deploy hardened Linux baseline configuration
|
|
hosts: linux_all
|
|
become: true
|
|
vars_files:
|
|
- ../vault/secrets.yml
|
|
roles:
|
|
- role: base_os
|
|
tags: [base_os]
|
|
- role: repo_management
|
|
tags: [repo_management]
|
|
- role: identity_ad
|
|
tags: [identity_ad, hardening]
|
|
- role: sudo_rbac
|
|
tags: [sudo_rbac, hardening]
|
|
- role: local_accounts
|
|
tags: [local_accounts, hardening]
|
|
- role: banners
|
|
tags: [banners, hardening]
|
|
- role: ssh_hardening
|
|
tags: [ssh_hardening, hardening]
|
|
- role: fail2ban
|
|
tags: [fail2ban, hardening]
|
|
- role: pam_hardening
|
|
tags: [pam_hardening, hardening]
|
|
- role: cis_hardening
|
|
tags: [cis_hardening, hardening]
|
|
- role: selinux_config
|
|
tags: [selinux_config, hardening]
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
- role: apparmor_config
|
|
tags: [apparmor_config, hardening]
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
- role: firewall_config
|
|
tags: [firewall_config, hardening]
|
|
- role: falcon_onboarding
|
|
tags: [falcon_onboarding, hardening]
|
|
- role: logging_rsyslog
|
|
tags: [logging_rsyslog, monitoring]
|
|
- role: aide_integrity
|
|
tags: [aide_integrity, monitoring]
|
|
- role: patch_mgmt
|
|
tags: [patch_mgmt, patching]
|
|
- role: backup_agent
|
|
tags: [backup_agent]
|
|
when: veeam_agent_enabled | default(false) | bool
|