From 5b341c9430a55932308adfc7ad3a099c6049589b Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Fri, 2 May 2025 14:24:08 +0200 Subject: [PATCH] feat: Update Ansible playbooks and host variables for improved organization and functionality --- .../workflows/ansible-apply-hosts-changes.yml | 7 +- .github/workflows/ansible-apply-playbook.yml | 1 + ansible/host_vars/dev-01.alexpires.dev.yml | 76 +++++++++++++++++++ ansible/playbook_cis.yml | 22 ------ ansible/playbook_duo_security.yml | 4 +- ansible/playbook_encryption.yml | 2 +- ansible/playbook_fail2ban.yml | 2 +- ansible/playbook_geoip.yml | 2 +- ...k_local.yml => playbook_hardening_cis.yml} | 2 +- ...login.yml => playbook_hardening_login.yml} | 2 +- ansible/playbook_mail.yml | 4 +- ansible/playbook_wordpress.yml | 40 ---------- ansible/roles/encryption/tasks/volume.yml | 1 + inventory/hosts | 11 ++- 14 files changed, 101 insertions(+), 75 deletions(-) create mode 100644 ansible/host_vars/dev-01.alexpires.dev.yml delete mode 100644 ansible/playbook_cis.yml rename ansible/{playbook_local.yml => playbook_hardening_cis.yml} (84%) rename ansible/{playbook_login.yml => playbook_hardening_login.yml} (89%) delete mode 100644 ansible/playbook_wordpress.yml diff --git a/.github/workflows/ansible-apply-hosts-changes.yml b/.github/workflows/ansible-apply-hosts-changes.yml index 7ea1aea..191e64d 100644 --- a/.github/workflows/ansible-apply-hosts-changes.yml +++ b/.github/workflows/ansible-apply-hosts-changes.yml @@ -4,7 +4,9 @@ on: branches: - main paths: - - ansible/host_vars/*.yml + - ansible/host_vars/*.alexpires.me.yml + - ansible/host_vars/*.a13labs.me.yml + - ansible/host_vars/*.a13labs.pt.yml jobs: ansible-apply: runs-on: ubuntu-latest @@ -38,7 +40,6 @@ jobs: CHANGED_FILES: ${{ steps.setup_env.outputs.CHANGED_FILES }} run: | cd ansible - sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_login.yml sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_fail2ban.yml sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_geoip.yml sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_duo_security.yml @@ -46,7 +47,7 @@ jobs: sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml - sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_wordpress.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_websites.yml sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_m3uproxy.yml sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_monitoring.yml sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_rustdesk.yml diff --git a/.github/workflows/ansible-apply-playbook.yml b/.github/workflows/ansible-apply-playbook.yml index 1032c23..6bddc0b 100644 --- a/.github/workflows/ansible-apply-playbook.yml +++ b/.github/workflows/ansible-apply-playbook.yml @@ -6,6 +6,7 @@ on: paths: - ansible/playbook_*.yml - '!ansible/playbook_websites.yml' + - '!ansible/playbook_hardening*.yml' jobs: ansible-apply: runs-on: ubuntu-latest diff --git a/ansible/host_vars/dev-01.alexpires.dev.yml b/ansible/host_vars/dev-01.alexpires.dev.yml new file mode 100644 index 0000000..244e224 --- /dev/null +++ b/ansible/host_vars/dev-01.alexpires.dev.yml @@ -0,0 +1,76 @@ +hostname: dev-01.alexpires.local +ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}" + +# Users +login_users: + - username: "{{ ansible_user }}" + comment: "Managed by Ansible" + sudoer: true + sudoer_root_only: true + sudoer_no_password: true + pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}" + password_disabled: true + - username: operator + comment: "Managed by Ansible" + sudoer: true + pubkey: "{{ lookup('file', 'keys/operator.pub') }}" + +# SSH Connection and security +sshd_port: 22 +ssh_allowed_networks: + - "0.0.0.0/0" +sshd_admin_net: "0.0.0.0/0" +sshd_allow_groups: "{{ ansible_user }} users" +sshd_permit_root_login: "no" +sshd_password_authentication: "no" +sshd_allow_tcp_forwarding: "yes" + +# Due to an issue increase the number of max auth tries +sshd_max_auth_tries: 10 + +# Firewall ports +ufw_enable: true +fw_allowed_ports: + - { rule: "allow", port: "80", proto: "tcp" } + - { rule: "allow", port: "443", proto: "tcp" } + - { rule: "allow", port: "22", proto: "tcp" } + +ufw_outgoing_traffic: + - 22 # SSH + - 53 # DNS + - 80 # HTTP + - 123 # NTP + - 443 # HTTPS + - 853 # DNS over TLS + +ufw_default_forward_policy: "ACCEPT" + +ipv4_sysctl_settings: + net.ipv4.ip_forward: 1 + +disable_ipv6: true + +# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening) +custom_hosts_acls: true + +# fail2ban +fail2ban_jails: + ssh: + enabled: true + port: "{{ sshd_port }}" + filter: "sshd" + logpath: "/var/log/auth.log" + maxretry: 5 + findtime: 600 + bantime: 3600 + +# aide +install_aide: false + +# Unattended upgrades +unattended_reboot: true +unattended_reboot_time: "04:30" + +# Duo Security +duo_users: ["*", "!provision"] +duo_api_hostname: api-7cda1654.duosecurity.com diff --git a/ansible/playbook_cis.yml b/ansible/playbook_cis.yml deleted file mode 100644 index 55557bb..0000000 --- a/ansible/playbook_cis.yml +++ /dev/null @@ -1,22 +0,0 @@ ---- -- name: CIS Hardening - hosts: linux - gather_facts: true - - roles: - - role: "cis" - tags: - - roles - - roles::cis - - role: "fail2ban" - tags: - - roles - - roles::fail2ban - - role: "geoip" - tags: - - roles - - roles::geoip - - role: "duo" - tags: - - roles - - roles::duosecurity diff --git a/ansible/playbook_duo_security.yml b/ansible/playbook_duo_security.yml index 522cf5b..7a3ba49 100644 --- a/ansible/playbook_duo_security.yml +++ b/ansible/playbook_duo_security.yml @@ -1,6 +1,6 @@ --- -- name: Duo Security - hosts: linux +- name: Duo Security + hosts: public gather_facts: true roles: diff --git a/ansible/playbook_encryption.yml b/ansible/playbook_encryption.yml index 029bb10..c9f129d 100644 --- a/ansible/playbook_encryption.yml +++ b/ansible/playbook_encryption.yml @@ -1,6 +1,6 @@ --- - name: Setup encrypted volumes - hosts: linux + hosts: public gather_facts: true roles: diff --git a/ansible/playbook_fail2ban.yml b/ansible/playbook_fail2ban.yml index 7d7533a..d468ce8 100644 --- a/ansible/playbook_fail2ban.yml +++ b/ansible/playbook_fail2ban.yml @@ -1,6 +1,6 @@ --- - name: Fail2Ban - hosts: linux + hosts: public gather_facts: true roles: diff --git a/ansible/playbook_geoip.yml b/ansible/playbook_geoip.yml index e701c73..03b41bc 100644 --- a/ansible/playbook_geoip.yml +++ b/ansible/playbook_geoip.yml @@ -1,6 +1,6 @@ --- - name: Fail2Ban - hosts: linux + hosts: public gather_facts: true roles: diff --git a/ansible/playbook_local.yml b/ansible/playbook_hardening_cis.yml similarity index 84% rename from ansible/playbook_local.yml rename to ansible/playbook_hardening_cis.yml index 13c94fa..2e6ab75 100644 --- a/ansible/playbook_local.yml +++ b/ansible/playbook_hardening_cis.yml @@ -1,6 +1,6 @@ --- - name: CIS Hardening - hosts: localnetwork + hosts: hardening gather_facts: true roles: diff --git a/ansible/playbook_login.yml b/ansible/playbook_hardening_login.yml similarity index 89% rename from ansible/playbook_login.yml rename to ansible/playbook_hardening_login.yml index 87f91b7..47f2260 100644 --- a/ansible/playbook_login.yml +++ b/ansible/playbook_hardening_login.yml @@ -1,6 +1,6 @@ --- - name: Login setup - hosts: linux + hosts: all gather_facts: true roles: diff --git a/ansible/playbook_mail.yml b/ansible/playbook_mail.yml index 94cb6e3..6e1f1be 100644 --- a/ansible/playbook_mail.yml +++ b/ansible/playbook_mail.yml @@ -16,7 +16,7 @@ - name: Set required facts ansible.builtin.set_fact: - mail_folders: + mail_folders: - "{{ mail_home }}/getmail" - "{{ mail_home }}/mailboxes" tags: always @@ -54,7 +54,7 @@ mode: "0750" owner: "{{ postfix_user_id }}" group: "{{ postfix_group_id }}" - loop: + loop: - "{{ mail_home }}/postfix" tags: - tasks diff --git a/ansible/playbook_wordpress.yml b/ansible/playbook_wordpress.yml deleted file mode 100644 index 324652a..0000000 --- a/ansible/playbook_wordpress.yml +++ /dev/null @@ -1,40 +0,0 @@ ---- -- name: Wordpress Playbook (K8s) - hosts: wordpress - gather_facts: true - -# Specific tasks for this playbook - tasks: - - name: Set required facts - ansible.builtin.set_fact: - wordpress_home: "{{ persistent_data | default('/var/lib') }}/wordpress" - wordpress_mysql_home: "{{ database_path | default('/var/lib') }}/mysql.wordpress" - wordpress_user_id: 33 - wordpress_group_id: 26 - mysql_user_id: 999 - mysql_group_id: 107 - tags: always - - - name: Create required wordpress data folder - become: true - ansible.builtin.file: - state: directory - path: "{{ wordpress_home }}" - mode: "0750" - owner: "{{ wordpress_user_id }}" - group: "{{ wordpress_group_id }}" - tags: - - tasks - - tasks::folders - - - name: Create required mysql data folder - become: true - ansible.builtin.file: - state: directory - path: "{{ wordpress_mysql_home }}" - mode: "0750" - owner: "{{ mysql_user_id }}" - group: "{{ mysql_group_id }}" - tags: - - tasks - - tasks::folders diff --git a/ansible/roles/encryption/tasks/volume.yml b/ansible/roles/encryption/tasks/volume.yml index 3c3d7b2..e45d6dd 100644 --- a/ansible/roles/encryption/tasks/volume.yml +++ b/ansible/roles/encryption/tasks/volume.yml @@ -44,6 +44,7 @@ - name: Read system id ansible.builtin.command: | read_system_id + changed_when: false register: system_id - name: Download key file from Key server diff --git a/inventory/hosts b/inventory/hosts index 7fe6924..b05d67a 100644 --- a/inventory/hosts +++ b/inventory/hosts @@ -1,11 +1,20 @@ [all] prod-01.alexpires.me +dev-01.alexpires.dev -[linux] +[hardening] prod-01.alexpires.me +dev-01.alexpires.dev [ubuntu] prod-01.alexpires.me +dev-01.alexpires.dev + +[public] +prod-01.alexpires.me + +[private] +dev-01.alexpires.me [gitea] prod-01.alexpires.me