alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into feature/terraform-onboard

Browse Source
This commit is contained in:
Alexandre Pires
2024-09-24 21:23:09 +02:00
parent 78ce7b2485 5ea3ad7b3d
commit 38ea438751
30 changed files with 510 additions and 151 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ansible-apply.yaml
+49 -12
View File
@@ -1,16 +1,15 @@
name: Validate ansible playbooks
name: Apply ansible playbooks
on:
pull_request:
push:
branches:
- main
paths:
- "ansible/**"
types:
- closed
- .github/workflows/ansible-apply.yaml
jobs:
plan:
apply-playbooks:
runs-on: ubuntu-latest
steps:
@@ -31,19 +30,57 @@ jobs:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
sectool ssh unlock ansible
cp ssh-keys/ansible ~/.ssh/id_rsa
mkdir -p ~/.ssh
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
chmod 600 ~/.ssh/id_ecdsa
- name: Read SSH Trusted Hosts keys
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
run: |
mkdir -p ~/.ssh
for HOST in $TRUSTED_HOSTS; do
ssh-keyscan $HOST >> ~/.ssh/known_hosts
done
chmod 600 ~/.ssh/known_hosts
- name: Enable SSH host key algorithms
run: |
echo "Host *" >> ~/.ssh/config
echo " HostKeyAlgorithms +sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com"
chmod 600 ~/.ssh/config
- name: Start SSH Agent
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
ssh-agent -a $SSH_AUTH_SOCK > /dev/null
echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
rm ~/.ssh_askpass
- name: Check SSH Connection
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
for HOST in $TRUSTED_HOSTS; do
ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
done
- name: Apply Ansible Playbook
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
ANSIBLE_HOST_KEY_CHECKING: False
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
cd ansible
sectool exec ansible-playbook -i inventory/hosts playbook_microk8s.yml
sectool exec ansible-playbook -i inventory/hosts playbook_gitea.yml
sectool exec ansible-playbook -i inventory/hosts playbook_nextcloud.yml
sectool exec ansible-playbook -i inventory/hosts playbook_wordpress.yml
# Currently, the playbook_hardening.yml is failing due to the aide package and UFW
# sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_hardening.yml
sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml
sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml
sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml
sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml
.github/workflows/ansible-validate.yaml
+2 -4
View File
@@ -3,16 +3,14 @@ name: Validate ansible playbooks
on:
pull_request:
branches:
- feature/**
paths:
- "ansible/**"
- main
types:
- opened
- synchronize
- reopened
jobs:
plan:
validate-playbooks:
runs-on: ubuntu-latest
steps:
.github/workflows/terraform-apply.yaml
-40
View File
@@ -1,40 +0,0 @@
name: Build and Release
on:
push:
branches:
- main
paths:
- "k8sapps/**"
jobs:
apply:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v2
- name: Setup Terraform
uses: hashicorp/setup-terraform@v1
with:
terraform_version: 1.9.6
- name: Setup Sectool
uses: a13labs/setup-sectool@v1
with:
version: 0.0.3
- name: Terraform Init
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
cd k8sapps
sectool exec terraform init
- name: Terraform Apply
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
cd k8sapps
sectool exec terraform apply --auto-approve
.github/workflows/terraform-k8apps-apply.yaml
+94
View File
@@ -0,0 +1,94 @@
name: Build and Release
on:
push:
branches:
- main
paths:
- "terraform/k8sapps/**"
- .github/workflows/terraform-k8apps-apply.yaml
jobs:
apply:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v2
- name: Setup Terraform
uses: hashicorp/setup-terraform@v1
with:
terraform_version: 1.9.6
- name: Setup Sectool
uses: a13labs/setup-sectool@v1
- name: Install Python and required packages
run: |
sudo apt-get update
sudo apt-get install -y python3-pip
python3 -m pip install -r requirements.txt
- name: Setup SSH Key
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
sectool ssh unlock ansible
mkdir -p ~/.ssh
chmod 700 ~/.ssh
cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
chmod 600 ~/.ssh/id_ecdsa
- name: Read SSH Trusted Hosts keys
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
run: |
mkdir -p ~/.ssh
for HOST in $TRUSTED_HOSTS; do
ssh-keyscan $HOST >> ~/.ssh/known_hosts
done
chmod 600 ~/.ssh/known_hosts
- name: Start SSH Agent
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
ssh-agent -a $SSH_AUTH_SOCK > /dev/null
echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
rm ~/.ssh_askpass
- name: Check SSH Connection
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
for HOST in $TRUSTED_HOSTS; do
ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
done
- name: Copy Kube Config from remote host
env:
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
mkdir -p ~/.kube
ansible -i ansible/inventory/hosts -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
- name: Terraform Init
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
cd terraform/k8sapps
sectool exec terraform init
- name: Terraform Apply
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
cd terraform/k8sapps
sectool exec terraform apply --auto-approve
.github/workflows/terraform-k8apps-validate.yaml
+97
View File
@@ -0,0 +1,97 @@
name: Validate Terraform
on:
pull_request:
branches:
- main
paths:
- "terraform/k8sapps/**"
- .github/workflows/terraform-k8apps-validate.yaml
types:
- opened
- synchronize
- reopened
jobs:
apply:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v2
- name: Setup Terraform
uses: hashicorp/setup-terraform@v1
with:
terraform_version: 1.9.6
- name: Setup Sectool
uses: a13labs/setup-sectool@v1
- name: Install Python and required packages
run: |
sudo apt-get update
sudo apt-get install -y python3-pip
python3 -m pip install -r requirements.txt
- name: Setup SSH Key
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
sectool ssh unlock ansible
mkdir -p ~/.ssh
chmod 700 ~/.ssh
cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
chmod 600 ~/.ssh/id_ecdsa
- name: Read SSH Trusted Hosts keys
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
run: |
mkdir -p ~/.ssh
for HOST in $TRUSTED_HOSTS; do
ssh-keyscan $HOST >> ~/.ssh/known_hosts
done
chmod 600 ~/.ssh/known_hosts
- name: Start SSH Agent
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
ssh-agent -a $SSH_AUTH_SOCK > /dev/null
echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
rm ~/.ssh_askpass
- name: Check SSH Connection
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
for HOST in $TRUSTED_HOSTS; do
ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
done
- name: Copy Kube Config from remote host
env:
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
mkdir -p ~/.kube
ansible -i ansible/inventory/hosts -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
- name: Terraform Init
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
cd terraform/k8sapps
sectool exec terraform init
- name: Terraform Apply
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
cd terraform/k8sapps
sectool exec terraform plan
.github/workflows/terraform-validate.yaml
-40
View File
@@ -1,40 +0,0 @@
name: Validate Terraform
on:
push:
branches:
- feature/**
paths:
- "k8sapps/**"
jobs:
plan:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v2
- name: Setup Terraform
uses: hashicorp/setup-terraform@v1
with:
terraform_version: 1.9.6
- name: Setup Sectool
uses: a13labs/setup-sectool@v1
with:
version: 0.0.3
- name: Terraform Init
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
cd k8sapps
sectool exec terraform init
- name: Terraform Plan
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
cd k8sapps
sectool exec terraform plan
.gitignore
+2
View File
@@ -1,5 +1,7 @@
repository.vault.*
id_rsa
id_ecdsa
id_ed25519
.idea
.vscode
.terraform*
ansible/host_vars/contabo01.a13labs.pt.yaml
+1 -1
View File
@@ -1,5 +1,5 @@
# Hostname and other host settings
hostname: contabo01.alexpires.me
hostname: contabo01.a13labs.pt
# SSH Connection and security
sshd_port: 22
ansible/host_vars/jammy.simple_server.yml
+3
View File
@@ -0,0 +1,3 @@
# Hostname and other host settings
hostname: jammy.local
ansible/host_vars/jammy.virtualization_server.yml
+3
View File
@@ -0,0 +1,3 @@
# Hostname and other host settings
hostname: jammy.local
ansible/inventory/hosts
+3
View File
@@ -24,3 +24,6 @@ contabo01.a13labs.pt
[nextcloud]
contabo01.a13labs.pt
[microk8s]
contabo01.a13labs.pt
ansible/playbook_hardening.yml
-2
View File
@@ -19,8 +19,6 @@
tags:
- roles
- roles::cis
- roles::cis::ufw
- roles::cis::sysctl
- role: "fail2ban"
tags:
- roles
ansible/playbook_kvm.yml
-3
View File
@@ -19,8 +19,6 @@
tags:
- roles
- roles::cis
- roles::cis::ufw
- roles::cis::sysctl
- role: "fail2ban"
tags:
- roles
@@ -33,7 +31,6 @@
tags:
- roles
- roles::duosecurity
- role: "virtualization"
tags:
- role::virtualization
ansible/playbook_microk8s.yml
-25
View File
@@ -4,35 +4,10 @@
gather_facts: true
roles:
- role: "bootstrap"
tags:
- roles
- roles::bootstrap
- role: "manage_users"
tags:
- roles
- roles::users
- role: "cis_hardening"
vars:
# currently aide is failing
install_aide: false
tags:
- roles
- roles::cis
- roles::cis::ufw
- roles::cis::sysctl
- role: "fail2ban"
tags:
- roles
- roles::fail2ban
- role: "geoip"
tags:
- roles
- roles::geoip
- role: "duo_security"
tags:
- roles
- roles::duosecurity
- role: "microk8s"
tags:
- role::microk8s
ansible/playbook_nextcloud.yml
+4 -4
View File
@@ -10,9 +10,9 @@
nextcloud_home: "/var/lib/nextcloud"
nextcloud_mysql_home: "/var/lib/mysql.nextcloud"
nextcloud_user_id: 33
nextcloud_group_id: 26
mysql_user_id: 999
mysql_group_id: 107
nextcloud_group_id: 33
mysql_user_id: 0
mysql_group_id: 0
tags: always
- name: Create required nextcloud data folder
@@ -32,7 +32,7 @@
ansible.builtin.file:
state: directory
path: "{{ nextcloud_mysql_home }}"
mode: "0750"
mode: "0755"
owner: "{{ mysql_user_id }}"
group: "{{ mysql_group_id }}"
tags:
ansible/roles/cis_hardening/defaults/main/sshd.yml
+1 -1
View File
@@ -15,7 +15,7 @@ sshd_client_alive_interval: 200
sshd_compression: "no"
sshd_gssapi_authentication: "no"
sshd_hostbased_authentication: "no"
sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com
sshd_ignore_user_known_hosts: "yes"
sshd_kerberos_authentication: "no"
sshd_kex_algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
ansible/roles/cis_hardening/tasks/main.yml
+82 -10
View File
@@ -19,137 +19,209 @@
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
when: ufw_enable
tags:
- ufw
- roles::cis::ufw
- name: Configure sysctl
ansible.builtin.include_tasks: sysctl.yml
tags:
- roles::cis::sysctl
- name: Disable kernel network modules
ansible.builtin.include_tasks: disablenet.yml
tags:
- roles::cis::modules
- name: Disable file system kernel modules
ansible.builtin.include_tasks: disablefs.yml
tags:
- roles::cis::modules
- name: Disable IPv6
ansible.builtin.include_tasks: ipv6.yml
when: disable_ipv6
tags:
- roles::cis::ipv6
- name: Configure systemd system and users
ansible.builtin.include_tasks: systemdconf.yml
tags:
- roles::cis::users
- name: Configure systemd journald and logrotate
ansible.builtin.include_tasks: journalconf.yml
tags:
- roles::cis::log
- name: Configure systemd timesyncd
ansible.builtin.include_tasks: timesyncd.yml
tags:
- roles::cis::systemd
- name: Clean fstab
ansible.builtin.include_tasks: fstab.yml
tags:
- roles::cis::fstab
- name: Configure shm and tmp mounts
ansible.builtin.include_tasks: mount.yml
tags:
- roles::cis::mounts
- name: Disable prelink
ansible.builtin.include_tasks: prelink.yml
tags:
- roles::cis::prelink
- name: Configure package managers, update caches and install updates
ansible.builtin.include_tasks: packagemgmt.yml
tags:
- roles::cis::packages
- name: Configure hosts.allow and hosts.deny
when: not custom_hosts_acls
ansible.builtin.include_tasks: hosts.yml
tags:
- roles::cis::hosts
- name: Configure login.defs
ansible.builtin.include_tasks: logindefs.yml
tags:
- roles::cis::logindefs
- name: Set limits
ansible.builtin.include_tasks: limits.yml
tags:
- roles::cis::limits
- name: Configure adduser and useradd
ansible.builtin.include_tasks: adduser.yml
tags:
- roles::cis::adduser
- name: Restrict root access
ansible.builtin.include_tasks: rootaccess.yml
tags:
- roles::cis::root
- name: Configure needrestart, install and remove various packages
ansible.builtin.include_tasks: packages.yml
tags:
- roles::cis::packages
- name: Configure ssh server and client
ansible.builtin.include_tasks: sshconfig.yml
tags:
- roles::cis::sshd
- roles::cis::ssh
- name: Configure PAM
ansible.builtin.include_tasks: password.yml
tags:
- roles::cis::pam
- name: Configure and clean at and cron
ansible.builtin.include_tasks: cron.yml
tags:
- roles::cis::cron
- name: Disable systemd ctrl-alt-del.target
ansible.builtin.include_tasks: ctrlaltdel.yml
tags:
- roles::cis::ctrlaltdel
- name: Configure auditd
ansible.builtin.include_tasks: auditd.yml
tags:
- roles::cis::auditd
- name: Configure AppArmor
ansible.builtin.include_tasks: apparmor.yml
tags:
- roles::cis::apparmor
- name: Disable misc kernel modules
ansible.builtin.include_tasks: disablemod.yml
tags:
- roles::cis::modules
- name: Disable wireless interfaces
ansible.builtin.include_tasks: disablewireless.yml
when: disable_wireless
# https://bugs.launchpad.net/ubuntu/+source/aide/+bug/1903298
- name: Configure AIDE
ansible.builtin.include_tasks: aide.yml
when: >
install_aide | bool and
(not (ansible_os_family == "Debian" and
(ansible_lsb.codename == "groovy" or
ansible_lsb.codename == "hirsute")))
tags:
- roles::cis::wireless
- name: Manage users
ansible.builtin.include_tasks: users.yml
tags:
- roles::cis::users
- name: Remove suid/sgid permissions
ansible.builtin.include_tasks: suid.yml
when: suid_sgid_permissions | bool
tags:
- roles::cis::suid
- name: Configure compiler permissions
ansible.builtin.include_tasks: compilers.yml
tags:
- roles::cis::compilers
- name: Set umask
ansible.builtin.include_tasks: umask.yml
tags:
- roles::cis::umask
- name: Configure paths
ansible.builtin.include_tasks: path.yml
tags:
- roles::cis::path
- name: Configure systemd logind
ansible.builtin.include_tasks: logindconf.yml
tags:
- roles::cis::logind
- name: Configure rkhunter
ansible.builtin.include_tasks: rkhunter.yml
tags:
- roles::cis::rkhunter
- name: Add issue message
ansible.builtin.include_tasks: issue.yml
tags:
- roles::cis::issue
- name: Configure apport
ansible.builtin.include_tasks: apport.yml
tags:
- roles::cis::apport
- name: Lock root account
ansible.builtin.include_tasks: lockroot.yml
tags:
- roles::cis::root
- name: Configure Postfix
ansible.builtin.include_tasks: postfix.yml
tags:
- roles::cis::postfix
- name: Configure motdnews
ansible.builtin.include_tasks: motdnews.yml
tags:
- roles::cis::motdnews
- name: Configure sudo
ansible.builtin.include_tasks: sudo.yml
tags:
- roles::cis::sudo
- name: Miscellaneous extra tasks
ansible.builtin.include_tasks: extras.yml
tags:
- roles::cis::extras
- name: Miscellaneous tasks after all handlers
ansible.builtin.include_tasks: post.yml
tags:
- always
ansible/roles/cis_hardening/tasks/sshconfig.yml
+14
View File
@@ -6,6 +6,7 @@
failed_when: false
register: ssh_version
tags:
- roles::cis::sshd
- sshd
- sshd_config
@@ -13,6 +14,7 @@
ansible.builtin.set_fact:
ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing]
tags:
- roles::cis::sshd
- sshd
- sshd_config
@@ -21,6 +23,7 @@
path: /etc/sysconfig/sshd
register: sysconfig_sshd
tags:
- roles::cis::sshd
- sshd
- sshd_config
- M1041
@@ -33,6 +36,7 @@
regexp: ^\s*CRYPTO_POLICY.*$
when: sysconfig_sshd.stat.exists
tags:
- roles::cis::sshd
- sshd
- CCE-80939-2
- M1041
@@ -44,6 +48,7 @@
changed_when: false
failed_when: false
tags:
- roles::cis::sshd
- sshd
- sshd_config
- M1041
@@ -53,6 +58,7 @@
path: /etc/ssh/sshd_config.d
register: sshd_config_d
tags:
- roles::cis::sshd
- sshd
- sshd_config
- M1041
@@ -65,6 +71,7 @@
group: root
mode: "0600"
tags:
- roles::cis::sshd
- sshd
- sshd_config
@@ -83,6 +90,7 @@
- Restart sshd service
- Restart ssh service
tags:
- roles::cis::sshd
- sshd
- sshd_config
- CCE-80895-6
@@ -137,6 +145,7 @@
- Restart sshd service
- Restart ssh service
tags:
- roles::cis::sshd
- sshd
- sshd_config
- CCE-80895-6
@@ -184,6 +193,7 @@
state: absent
when: sshd_config_d.stat.exists and grep_include.rc == 0
tags:
- roles::cis::sshd
- sshd
- sshd_config
@@ -196,6 +206,7 @@
excludes: "*.pub"
register: ssh_host_keys
tags:
- roles::cis::sshd
- sshd
- M1022
- M1041
@@ -211,6 +222,7 @@
loop_control:
label: "{{ item.path }}"
tags:
- roles::cis::sshd
- sshd
- CCE-82424-3
- CIS-UBUNTU2004-5.3.2
@@ -222,6 +234,7 @@
path: /etc/ssh/ssh_config.d
register: ssh_config_d
tags:
- roles::cis::ssh
- ssh
- ssh_config
- M1041
@@ -236,6 +249,7 @@
owner: root
group: root
tags:
- roles::cis::ssh
- ssh
- ssh_config
- CCE-82880-6
ansible/roles/microk8s/tasks/microk8s/install.yml
+1 -1
View File
@@ -57,7 +57,7 @@
- name: Microk8s | Required plugins (microk8s)
ansible.builtin.include_tasks: microk8s/plugins.yml
loop:
- { plugin: "ha-cluster", wait: 90, args: "", enabled: false }
- { plugin: "ha-cluster", wait: 30, args: "--force", enabled: false }
- { plugin: "rbac", wait: 30, args: "", enabled: true }
- { plugin: "dns", wait: 30, args: "", enabled: true }
- { plugin: "storage", wait: 10, args: "", enabled: true }
ansible/roles/microk8s/tasks/microk8s/plugins.yml
+1 -1
View File
@@ -27,7 +27,7 @@
ansible.builtin.set_fact:
micro_k8s_args: "{{ (item.args | length > 0) | ternary(item.plugin + ':' + item.args, item.plugin) }}"
- name: Enabling plugin '{{ item.plugin }}' # noqa no-changed-when
- name: Disable plugin '{{ item.plugin }}' # noqa no-changed-when
ansible.builtin.command:
cmd: "microk8s.disable {{ micro_k8s_args }}"
ansible/roles/microk8s/tasks/roles.yml
View File
ansible/roles/microk8s/tasks/setupenv/main.yml
+1
View File
@@ -33,6 +33,7 @@
tags:
- k8s::users
changed_when: false
ignore_errors: true
- name: Configure user access
when: item.enabled and secret_exists.stdout != "0"
repository.vault
+1 -1
View File
@@ -1 +1 @@
/d5vNW1DFG3lFVC+8zR2YFny516calEaKZT1BCxb5azvJd6DL7j39gmPUPXzMzJpNf022gf77mMt+RrsbpZnBEEiYzvurYf03wcnWKID0PdIGctXwdPzH1eqAVHJUvyBnSHxB60E+Kcl+ao/0Al2ZoqgFwtjYVlrdHK3poNeO0WcP59RftBKWEBbw8ru/pht3KaDtgU+u3loNna/vIcf7gUmE7ue/u/pMC5s7rWHjuTKlcaaAOvLLKafjdrcVC9Bw6YrC3/b1qtS8xxSu4MZD97Jemeg2jmtyovDSq1JtwypzeCfctYwirEBVT++pnw75tNqa4iOTWxPTM1+HAi9EFFlIrJG6j3M3QZTsDsu4agEDyB5Mq6/PxaKT0qXKz+KUlLQRzJ6UHE9RjeQY5rOgTy4uB1C4pDMasjesRrlQ0Id2USk/KCRaCGdOe/7xO3D2Fdn1Tpls0H7zBfPjIkzrytuDHbfdWos/aMnPP6Kc4Lta6p+5Vmkpo96/MBJTlrBPHucpTBqYtzzm2O4SXg6/NF/isCZ8+vBQuNg/vTO1cF+j4Z217Oiq+nLJcmrdxBwaHpEsmFtAos7vt3gH6/6kXM7vb92u5EIzlQce9IJcWQbmNH+E3hHjO9Tcj0NOn6ccvhOp4yEe+N0OXeNrW0VF0SMsXCVD+fPaE1EJUBVLFhaMDYR0QLe8Ti6LWI10b5wa4xw4yElu4X5mocw4GgiwzJtqKWH54mvF3eeCgs8aGS+Z7QmnampNrxUialWlV4hZdB/SXt4D0RgsQApyfowUNROwa68rLG7Re/SOefO9K7Hy+M4fMUEaasHT3hV/abkRf2I393FubM/wAOYX8wDQTgSqW97ZcGy3aRVh0h4KXzEa1h/rx3OHiFMHkQMxph3ScG0BRYM+LJmirI5v3LZ9hxnq2aZBekJG9lR88tYgwlZYsp8iyPcctlp8WDs+wVDuTj6pm0fZexrOweLz5VzlEm/jUJUaV0KFQHg7xmwi2RJqP3u8wofktEyYxEKbD3P18nyCCSmPJhIA8QDwwtKyGIFM6s9U1W6nZIR5HVqRzo/bL1y90VQEeOsIKgnrIoRIDfSqKX4fyK/Gdbxxz8kOB/WZtHCFrnQfqhT4dYK+zY9RA04n5PZzRmbbv9RtBYduYDW0zEBxT5+iBsophtMjMZ5jpiZ9AtErMuW6xP4mO8IPoLbId/8ktRm0R655r96soTas1+LlT1LDFUv6cO+S9f0n5kibjwPM3hKt5/U69wY4Qqo3Oey+ghVNXHGbuc4DgjF0lizkl9qU4hhsbr3A6G99uWVGcTI+cospKT064Xi4icZcUJcfBdxLoA09rtHkb+7ZbFDVXNWrAHTqByn30k7fY4FBjMcGuV7JJNyGbDz1zXIsP8J7XUcNuLEP6A4fFxzOn/jQcojgiSVTaLMXfNE02ER7jiYvbF/tDOkqDlpQE5qlGhsvtyPkILBDyVrT4KGiTzNE4rT+WfopIYea1SXUE4WI6/xWkCYpedrqduLYnfl+Rqwmg31GomNfO3NVu6n+Gv5BGOW4Ssg+1DSdOZudFChA7jTzZCbj13VhIGUg67qxCZqvWIkymoKSpgmstsq0ChU+xAYlfkGEuAalIgAITHWov1xyY0qjVXJ988csuIoGZWXaCDMbqBxZHmz5XiUuyZghyQ00h2gUcHPvKSq/dDGaW0AfdX/N8qLVL9pmZLK/uUfaBYte0RYwacR5zoFdIUurhSVitVSn6rIOEIOJv2Ej0gDop/xgl1/n0hKQ8/Zk0We/VU9XAE2VTxLsgAalDgwtt2W7W2IhmkdM4pj1MAZxisU45js0Yh5T2APEB7brnsNi1LDFvLoYsoYqyVi5uFqnM1yKUUGU+jc0ug90Wi1EBgkOy/aK3JDwW/Db7Twk9EdHupepcIAeggbsNa4KOSGPS5U5zxhjshwuMfw0MyZrZHrVTDqAI6VQxniMk6uK8xu+bfP98CMljX3oV9MhSRey7+Ko+474RahmnQmljcik/VPDNMVq2tlNXxZnnI6/sy/Orc1Ecq18+xMtcwVrCY5se974J8ag1g71YK+bP63CQXuMbG3r83s2T8t8ScLtui9EFx0JOXNbGHJrRoomdgISBLoHEAulaiTWUaXpmXOtNCSXSQ42lQ=
lZE/F/Ng+kqQG65u5afRAODt626sHUV/sS13AsWpx6AlWOf40hrq9QNnkjAq1fF8FVctnyY+ltBjwc7fAmvqlwWmbVclahnwQFbgjQ24c6IYuMMmULEy9PN6iPBFH1EstA8lrSVNCz+AN1NR0yxctAMMv7/XoAo6e6nOsn3Ko5F4M57L8QSdoEI/Giz2UvVm46teibFDivnfgjKji3oWO5xIcy7ggZsDF4pYZLci3THfgonoBPZUxyehVl/uyarT0k0LIUD6QUCNXaxxQXa2rDsgyoglLOUZRvitdoThXJsW4VjKYD/joJdR1bELwJ41Nh6IPcWsUSJrEJHhr3IEBMk6DKkC96Ie1kOvW8GkHOKkmFdZkhr2gj9ol6xB8XD/x6K6hZnW/BdJnD3F1JX05km3UHW4uSgvrN1l4x1nNZ5w84BQ/mw1M90ZoiCDjFBtQUOIYciFMQTkbUNnnvDigRXzLhcqxEMJnZ1saz6YXA86WDTxNU5AlOAiwtn4MpO7obXOaiclscB1smpFosjVUqKPpuJrNC5RehhXYVsSdqLk5nRYokv866/RQmXOXzNeig9DrJvj0+Da5kcQ12gWEKr6gSG4O8QLcUcP+YnDtPOaq6OpzEzVmYB9XboOZQyumiUn3QL0jwINBwbNM2GLvXHt5Mmhd16dcHbabZAqLzHRy5T2bh8jhcgRVORem9IOVOSIhCnv7szt+mfEzem5ipUx8dQljOFodNRf5YiJHuWS4yEsbsvV4dLdIqWwMasA1YsOjzRnu5w0AJjd5mo3v9zFW/1kop+tFcsPbglr/Tm9uH9a7D1gZnkZLlUILhC+edRPde5upIyQkrdm7WLECkXsBqQz3QhbcD9BW2krFgvdjyDJYGSpFnXXtsOoo/+NnQd+IRiSe2aevVQH6MrUqfeQ0l/Wxi2cpxTIMLhKnmkRkrSqOn3/EpVL62eJPCmW4OSyCISexIxVvsx72WhvlAMLDXfPxC7zTObUtlrd3w+kzIF8K3ZduRUHWwtCSSekhzTJ3JZyGxKZ88sPfUtk7n1J/lmFVCmHmkuU+Rw21PEVPepPL1tkBURk12uH/+uyRFfR7zFEXXC39nXyKN/Yxa+z0Tdhj2mynLbuZ6ygwfEqXM1hyScqTh1J4z6CDLMelE+kEgvNxG1n8fXC75KPsaxzsqwqlo90CDNNrs2loJrxm3kQcqXxowy/sLtupHpdufEPP6hHnPptqsndmiNiqZjLgmCGuMR3KZBxrv2nsmwdnT4V/aDf80m3lRSuhjZD4zhRIhxsIRKlMjjAi7qgeHFBrOS61J/VVwtzxgLZFfEnPM8M3nf3wh/gAEzTa1uWiJxO26UDUymoW18YWOoIQDn0vjN3acLtGcy+mbjHYWHoJ2So0hjuDJ6ItGKfvrqDwjKX6grGXi955JhVPdR4wh6K+zoYqNS0uFVXc4hJZnr9R7xfPE5QjjNQqJLCZzgkX0sA28qL/5lzzr7XNkfotz0muyvO5OvfBJdcYyjTg5A7fZT0OvbM1dc8pmXzU1+dZnf/ByVemm81rBGBxhlcLIszqGhQzL9Is6dWzHChLA5moQSlKDvcjgUhuB/nV2FKi6kXqp5xU07i1kcbG6b4JL2fA4+ad71odxmE8SYmXt3PZFqJJIAmdVIAXdHeUQZlaA/wEbB9RdlD7XrGVc30BnYg2UA5AO2ijPECuScsZ+QmGBU/pzgp5mLZ691CyvnS9YtDuK3t1c1aNAOMpw9ZLmY5DINzmXuKtLHCw/HCUAH8+Zj94IXJKWYl1CmcxWH2prTDdbjOv5FpckQq04YCykx9qEr8tlq+LBkYB5r7DzzZfemb9YPKapqDXOTJVYBZP35QWPd2xHJVSE9KnYUpgfPxrYpEeJRBvPODOt1pxu+HOiiljSB3H5WBPlS91w1TcQZCE0g9VL+ERmoCOOso0PSI9F2LquLPA6sVlcxMXP9ouZ5BkkSxrOkc/3iLrINHaXRHirfNJLzDePe+xxLJCzXVDeFqUzd8iZO71E5fiGBzwpefnBnfa/bEF/SXfiFl491rYx8Wrur11QmaiHpMPdTsF1YknrE9HU4eYu3wT+7GgeIpX0KN3iT2RFPj9BztT5JBj8LefK3KSzRqc4E3Oak6WEfulkAOguOPJI3FOoXod/trve2kiReSTJlCEcK1FtOStE9yN0vRLM8=
requirements-dev.txt
+8
View File
@@ -0,0 +1,8 @@
ansible
ansible-lint
molecule
molecule-podman
molecule-vagrant
ansible-playbook-grapher
passlib
pytest-molecule
requirements.txt
-4
View File
@@ -1,8 +1,4 @@
ansible
ansible-lint
molecule
molecule-podman
molecule-vagrant
ansible-playbook-grapher
passlib
pytest-molecule
resources/iac_user,yaml
+141
View File
@@ -0,0 +1,141 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: collabora
name: admin-collabora
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: gitea
name: admin-gitea
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: m3uproxy
name: admin-m3uproxy
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: nextcloud
name: admin-nextcloud
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: wordpress
name: admin-wordpress
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: namespace-creator
rules:
- apiGroups: [""]
resources: ["namespaces"]
verbs: ["create", "get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: admin-collabora-binding
namespace: collabora
subjects:
- kind: User
name: iac
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: admin-collabora
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: admin-gitea-binding
namespace: gitea
subjects:
- kind: User
name: iac
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: admin-gitea
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: admin-m3uproxy-binding
namespace: m3uproxy
subjects:
- kind: User
name: iac
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: admin-m3uproxy
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: admin-nextcloud-binding
namespace: nextcloud
subjects:
- kind: User
name: iac
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: admin-nextcloud
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: admin-wordpress-binding
namespace: wordpress
subjects:
- kind: User
name: iac
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: admin-wordpress
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: namespace-creator-binding
subjects:
- kind: User
name: iac
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: namespace-creator
apiGroup: rbac.authorization.k8s.io
ssh-keys/ansible/id_ecdsa.key
+1
View File
@@ -0,0 +1 @@
AbAGmrKt/ehNzz1RmUMMH22raJzBuhX8uRd9BAJwpE/VH4xAzNYDRwQETAvhBJxMxBSIU41nxAMkuKGnNK7uMccH4QmtganmzB0E6OqoHafDZ103Pbj4P51nHhOX9RuIHuYqiMMWYW23zweXCTJeOtSGee+LlSisUiDacwrgWbhvaV0PdAkXu4hsxl3DdMUiwd9rYwWTKVTZGqAMk/MljuWkihZd4/uvxH2H0rJLmTyiCIpIuLAiGHkUzmVZN0rQ2TLn12L0ocxBvtZBYWIg8BobgvjS9gFCBrjVfCGNPDI9OVsGPNhvLGfui2Wbq5vrbb74S4K3v6KxsjtCH4b1QHi70L4J8MZlR5b/kYELt411pWjujBZLx0l5KG8wwu/5tUac5e50fgfHJyGRCqyo4TaljZf1m5VXLq2/CYS/q2Q06bJP8NHgy3o7V/O8SsEVWMJC9rW22yXhnytiSkYNdiOPKNmzabg6H0zL7ugIU0g4vBjNEwVHSFP0n6VHQXtaDeDQhFHLWqmvR1jh8cDAApAMRYrf8ALZL14PHUWdEytGDY4KJVOj5Ht8NBAzEhPE5dLIy9S/UpHewQm4J0gvtaUuCffU2GXkmw2BhcvTNcdP9nUJ4i4YoA==
ssh-keys/ansible/id_ecdsa.pub
+1
View File
@@ -0,0 +1 @@
ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAEFj7rNbTqpVSlp1eZgXcZvKrzORkIudgpP6Q6bsDzq/WYEki20p6i8o/QdQVgae6KJP2cfAkxVBUU3Qxlm1Z/ETQGpLEWicy1QE57VIu2d4CWGFsvgVbevJ4vmITnnh0UBQgeAmEL2r8sIl7EwILuevk3GLVtf1E04AFJ08t56mIVMEg==
ssh-keys/ansible/id_rsa.key
-1
View File
@@ -1 +0,0 @@
+Sc6FDhSEm+ANyq0s2rxgkFLiF1kWuRdt8HjlZR6b5rYh6EcYXXkKBrRapCTqzpXNROOcXxyGU9sZBSB9O0PJMWPQEitx722sSSt9W5poFRhIUGXnK00BN0K4M/Ng0RFKXaGcOef0iDL99jsAVh3ladg642Ccy7rDZebmojdsCfFo6W8QuM4FHiTJdp1IFNSVNmd58fL9NHDPg8sBblt5Q1hagHXSliz26xa6j1eK0T5YsiAsV7J19zpTRTsnXi/vZuTdtGIuQZUv3DC2PGxhu/iiA2G9AY/HC1bDuqUL+UOX8SUEtO7kWDFlqMODoJcVYjxSE3pmG0sdrsXk6GE7xFMvhYAA3/KIDTm5YLqmxrA5A7uDzCo6fDHBBjKQO9JapOCaF7y+rmLDaCt1zZj4D7ne3RjVtxCWyUmb/3vnJfcW3ZZ44PlGPoBME6UTB0RQCXgJp3tLD8A92v7VPkNImP6+/AwhLZjlMFKSjU9YilWMOQKcgctkPX6dEpyUPi/PvVDzS96r0GfHIbfqq+670KWatWzw6ihmyt0Uf/eNd2FNaAOQ6gKmdIsqjnHjQEWhFNy0W2OMQsMfYARK57jx0yTQRtJ6bMYJW4Ua8/ZqM3miXO+0ZyMSgDAKHdfqh00xykY832Ju0fnOt6INCdugUfMpZeHLvLdja1rSmFurOq1geJD9vZtRiga5jl793rCE6mrqGEZ0+j9FKGTwuXsQEvPIXmp1CMEovFQ/Q7lQH0NDjEXI9VIwx7chqIDPFQXdG5LHLZ+3kMlOZrIs4XUAfJgxIHmY+BUi2kDbFwY3nNoumUvulWB3Fx+6cU/F3gX4aSbxe7wGPiySd0any6k0JeUyZLfd+wT2I3Xg7QUY8zoWVIqrkW4eT/Elgou7ud3OCzJ0lvQ/IHC+CkTIMYwpc8P6agzqXUG05C+cbjQ14TGaidkOXHrqn2QWb701C1aslJLlcbX7p0rWlt7anM0ncqBS8iZvCKPvANzqPyx12rLh4tU/KzfOx33vS22Ez5eK/qsTwmzROnRCn/4RxQpCIxEBLHyEIzA4RnxG4Y3ILC0H47KCjCRiXPgmCUI/zId5IjzU1rqUCUddPSroSE4NjwNBKcsm7vM1D50rRPQJK9aCPRq3fvIuaUOpDxphCH2FbQHEr5QTx6h3ZdtdquaHEcgD+2RCc2XJ1whYhheSzCb+BV+AkPc0XKjDVJPLQr/fuHzbsZbqL62ftjgdsSWriYSAouJlW1GYdm4m4FmmZY7J9FoCCCxkZe0Yt4nCWNEYjYItHrSUZk3SIb/ogzO5UMC5HRki/wW15pD1Zeht7Tuo0Kd7GKtL84uvYk+YKUyIZCcqrRWoS3Edzbs4aJfHVnF/QEnDng/r1v49OmvEa16SXe/HOG/PUp/BVdXrFgbsRdMTp1UBwCuASy5IN60hDzG05+kkvoz7rQEj4ucUFqT6lziD2cO8e/WnN4yBaT+hDMEd1swJFTfqa0PXwvaA49EI89s0LNkdQqeQPd8+8RUfageWTJbSYbjOBSJMB+NBBeeLTcWzib8MDVXyCQ7Gbe3rH06FoY/SaART61GkfNqWN/ez+32FQve0bws5jr13+498rdxwu7MZCgjRUyFJZBPg8LM9mt4pj54XbyPdsEcNdrMezofNSj537ub0Yb09zAO0amBCBr9OxLD1VELX0k9JX8FvashiNUMiD8FtDKcYS1opKilQDfJfLv7hnqdwSDeljt0v/FgUoLeRqPoV4k0L7yZQUjAnpB3/GHJBT0Z94SaQxscEeqjxdbI4mAse+3Y1SUBQSD88jtBCQyouDbBlDMTlqXs5t1DrWXuOUEfSrvsx8ToY6CAPxNF5DK0+ZLbSOLp6N1yAQCToceZDbhwgRqlw8JZFEXKIr8IZhuJWoXArAg3QVp9TRH3M4SzeeRajAqIHGOOzmP1IweZ1Zmulen0naUKPQaGIr6GD1zEEGBTzvAMwZTVbgnUzbcBXGraKk9wbbp8Gd2l2GHhAeSJd4A6EnNLacO+6FY2GV+UgBlP7K/EVgU4mXSG6pktPqwUlNRfgPqQ8hzRElKknsEQ/hZRlRmjkLxcTuPV/GYzPMjnEdp6EdCERLxsvwYynH4RAxAclWkGIjRNljwRpsI1Xrgk752kmev0Kpc7oMG2yrIrnfKRrd3F/MueRA2ithzM62lFw9V5qjrDe85J7MsoVJA9RlyF15FNul4nDUEe3EHN6apL2i8XoOl0j1B7rku9fr0ygWiYCQgcI4WFuQyU5fom4CT1d+KMeMncicfUlVsc9kixMiRsluErMlhj09XY//Dl9npKEdUvIZqBNMr96HuQCCreUbQCvx2CUvsUQO+r988EzwiHtideJOlZwzf5cXjC9ROjvnO8A9nc2BhCnrJwkcaupkS40b3EgbmUMbxbWttTFusE4tdMMWt/f7JXORBze5dtqV17ilWL0iEfoYUPis6dvgHhAD54pi8EoQ7ysiUwR0aEU3oKT1DV59B//zn4vHjCMtfNzQCQV5/58heVPZOo5ft8IIegubj/8tux02OqnamxKOLTOGlpTK2yH2vP2v48B6Huysuk6zmOf2BCBfT6CJL1v1ehu4QbK60f7TvVle4pNXma4/c7IFAUfLiwCAycKzQQ5ueuaRFOMmWZ1tVQWFh4uZjAybiMl0TR9OAj9A+LGOijcY7UfUDB6ryOXBjLzQW/pV+jlpqUr66IWWRRMA7KJ3CS5tPFM3kq/LwFSJqv96JG3bSvHCt3wittUivrd1QbvoWKjEs4+o2oAQ4vXQDMJmQfbzXHwkzKKxahxnbJeVrtzS2RWk/0HihH+ZGjNDcp7g8kFpboKmwcg6e/pDc5Ibl+Ip4FLbRd4BxiCvIuvAFU13bjR58lqYQBegtemn2Lq3ppK4OTGx0q770eFuR0MzHi3tAWXHX4l24HkTlQZabEOeTTuKuOhTMN7YFmc9MzdttX6Idk9hM5eI75p5vfjt+dN8b2+QeR0hGSgjk/f1DO7j5YFY8kAZCdI0s/Uy88WJXr8M7XtojxBF4f7ie6lgq/FbZBOTReQ8LU0WuKe5LvMnPvscmX5iLadEaeWXAGCONjGVDzkgbEar3LAc79fpvBtKIsrNKTzIfYwKiFoCC2vZNF/FXx5siaeP0B0Ah8PHqbsX5PmadbAY7iaB75tSiQ+rsKLGpt/Dc+Em0pop95dUCB1bNAIQeBBzvNm1b8Qg5V4ynBNtar/fWTHLUgXL5eNX68Swu4l2s0ZDivVaFYP1V7sd0ovAgb7yvbZdIzlw1IsU+iBcxj5HSAJpnzA0G4SCLtismcKq58Qw6AXV+ZUFGsa/bER65JlpHXwokiJSP7zSFIMZDOCZulJXzxxkrUnio3Fi2gHjZFRr9ihxIv4sxif0oEvKQtkNDQPF3zdYJ+8AIz3GNRt6vGC7WzqswItF75+VlEjUM//TtAH/aUn7Uo4uyktPOZpc/7aQkUMpptYu6kY704tkIRuwnVBE/tU7860N79CUN3G2mRuprIlYpXXnGWAXn+7Rus+kslztVJ5Aqw+HQAAk34zOT+B7A432YwhwDA6bppZOzZi92HiaXTlHzaCM6E69UXatcc8//aU/8YVAjnVXH6cWOt+5gABGB8LL6e8N7TZhYmiFYyIAZQrMNvtZWJBZYvgr2zXfWQSYS8qsOoudh3sCvU9IcRC8p1+NGsFTGiCCohrubn+9IBkKwVr1EEkwMpm1ed1z9+3ND6V89h73Vd7F2RQp+dxSX8+tEYIMLXzYOR2Eh0RjUqUn1YSwBhS7lFUu6mNFN1K1ml/fMG5CtGYAOce61RXqyDfUPRRraG64JksKiuga3sM11WYqEDFOtllWerhlkp7FrnJoIpZys7fQFItCcOwVaCQBzNjHUNYhWaUEm2V49i4qhcsiXEzn/2Bhn9UoxJNknclUn4QkzihSD2l7E1aukeQJQpxIG5ViLbsdQUY1IVIjaJ+M0y8v2bAOFmZ7JyEWDaMj5Qatd5AW4NfKYf0xct4alXJ1AZPqhF5swx+Y8lPqniYeeO93My0Oyv7mVnY89raDfJ9mM9+gH6SaB/gO/22/Gic4kPuPCbshZAaW5uDemhncK8aJVOcINw2IM5iTCd7QxbY/ane8bkmPh3gYggsNYIGc2I+gveLX9YlnVNVy8OxWyMNBOzAM2pSQ1xImfam96yIrG/2SKTRnGJ7+h8bqZmNbMS8coFT5uEbSYcMffrfPK20UprdtZH1r1W75j5muaKZPBXjo8Dz5FJMii4fs+4wsMquf5H7NPq8AO9/0d4V7TPte+z5xLiOAJSQe+rt4sijQ7/QKx7dZVumKOgSzaLtcPLZTtwXT15p7l9f72c3LsP/0tMdO/gKgs9tlXaryoT+cww2wKPnId7duaOri0rpKpCkUlgThBoeDcbOafMrZElcoExGBQFkKvZ0eArj73lxxFbrt0wkR33TfmUDZoMBMwbrIZap6P1nmkgXKqE3+TuqKTxQmTBRAMor2S2F3t89Pa9BJfoFG0B494ZM3gZVUNcaOn309gSfJrYFcLaoQnBwfcwFIibv8+oELTjC+h8
ssh-keys/ansible/id_rsa.pub
-1
View File
@@ -1 +0,0 @@
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6+Pa5P2WrLsI/BVsM5MxvUWjvGOAcevBuu3XMvVG5dzjepyQlkIg+XV6O4+1ej8SZYXFXNhdEe49hKkw0j/2cH28/1caAMl8BUlIYMBoTKzEfEyXBHw+1QLdvWBlLH8uPoXnVrvPkAx8twVWXF9CPVD6EsBh6tmYen0GwR8rQAOLj0ZEWSzeKZP5XU7ls1IYTtt0ila1Njb3q4bt4AjMdPpstFKknta4vkXr1C/Mn6lnqHRqY9lVyItmzF6EBaCO1JoKbjpOpQ3eKMS9fZrpapr9oCCSV9tcVd3vWxOSJsBeru9WIHFltEEF5lgp2OWqO8E0SS9jYGGvFqfYGyNrBBXwElzI0NiWFlaq+rYR9/5KS6YEnfLYsR+pl1L79QDqGdptGzfEfWkPvge+dRVFtBUwcmcss7F3KoznCm0unULjtjqiDZBv6NG2B/i9l3W5Q9Sfy4BaCYxaLKL5RePFFFSsEosUcrCwT38I52rjNpkZcU8wUK3rdncS+OKJLlOzuM28yXSH4FhFTP8L+7io9EVfESpjUqbtFb55ahyr79hAkT/0NLrcv/dIMmXx3K56Z4hG6QtavmhinPOLsYdGWiK9wLYhq0jBqaKqwQ+lBKwuViV6gVcxCcqlnYxTZuQsXbNSnwp/VABa0J5QoqpF+VSRAj6MzbdWfNkL/RZ6KjQ==