Encryption and major changes

.github/workflows/ansible-apply.yaml

@@ -80,7 +80,7 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           cd ansible
-          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_hardening.yml --skip-tags roles::cis::suid
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_cis.yml --skip-tags roles::cis::suid
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml

ansible/host_vars/contabo01.a13labs.pt.yaml

@@ -11,7 +11,7 @@ sshd_permit_root_login: "no"
 sshd_password_authentication: "no"
 sshd_allow_tcp_forwarding: "yes"
 ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
-ssh_users:
+login_users:
   - username: operator
     comment: "Managed by Ansible"
     sudoer: true
@@ -57,9 +57,11 @@ custom_hosts_acls: true
 
 # GeoIP subscription
 geoip_sshd_enabled: true
-ssh_allowed_zones:
+geoip_ssh_allowed_zones:
   - "BE"
   - "PT"
+geoip_ssh_allowed_networks:
+  - "0.0.0.0/0"
 
 # fail2ban
 fail2ban_jails:
@@ -77,20 +79,22 @@ unattended_reboot: true
 unattended_reboot_time: "04:30"
 
 # Kubernetes specific settings
-microk8s_alt_names: "{{ hostname }}"
-k8s_version: 1.29
-k8s_allowed_hosts:
+microk8s_version: 1.29
+microk8s_allowed_hosts:
   - 87.67.163.177
+microk8s_alt_names: "{{ hostname }}"
 
-k8s_users:
+# Let's encrypt issuer
+microk8s_issuer_email: c.alexandre.pires@alexpires.me
+microk8s_encryption_cfg: /a13labs/microk8s_encryption.yaml
+microk8s_encryption_secret: "{{ lookup('env', 'MICROK8S_ENCRYPTION_SECRET') }}"
+microk8s_users:
   - username: operator
     enabled: true
   - username: git
     namespace: "gitea"
     enabled: true
 
-# Let's encrypt issuer
-issuer_email: c.alexandre.pires@alexpires.me
-
+# Duo Security
 duo_users: ["*", "!provision", "!git"]
 duo_api_hostname: api-7cda1654.duosecurity.com

ansible/playbook_cis.yml

@@ -8,11 +8,11 @@
       tags:
         - roles
         - roles::bootstrap
-    - role: "manage_users"
+    - role: "login"
       tags:
         - roles
         - roles::users
-    - role: "cis_hardening"
+    - role: "cis"
       vars:
         # currently aide is failing
         install_aide: false
@@ -27,7 +27,7 @@
       tags:
         - roles
         - roles::geoip
-    - role: "duo_security"
+    - role: "duo"
       tags:
         - roles
         - roles::duosecurity

ansible/playbook_microk8s.yml

@@ -4,10 +4,6 @@
   gather_facts: true
 
   roles:
-    - role: "manage_users"
-      tags:
-        - roles
-        - roles::users
     - role: "microk8s"
       tags:
         - role::microk8s

ansible/roles/cis/.ansible-lint

@@ -4,9 +4,10 @@ exclude_paths:
   - .github/
   - tests/
 enable_list:
-  - fqcn-builtins  # opt-in
+  - fqcn-builtins # opt-in
 warn_list:
   - line-length
   - yaml[line-length]
 skip_list:
   - yaml[comments]
+  - var-naming[no-role-prefix]