Improved workflows and actions

2024-09-29 18:01:42 +02:00
parent 9ae5a6446b
commit 360269fa0b
15 changed files with 312 additions and 224 deletions
@@ -0,0 +1,32 @@
+name: Weekly Reconciliation
+
+on:
+  schedule:
+    - cron: "0 2 * * 0"
+
+jobs:
+  ansible-apply:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Setup environment
+        uses: ./.github/actions/setup-env
+
+      - name: Setup Ansible environment
+        uses: ./.github/actions/setup-ansible-env
+
+      - name: Apply Hardening Playbook
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          cd ansible
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_login.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_cis.yml --skip-tags roles::cis::suid
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_wordpress.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_m3uproxy.yml