From 6248286ad2986b3d9d19187f6460d421e2354ad8 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sat, 28 Sep 2024 23:12:19 +0200 Subject: [PATCH] Encryption and major changes --- .github/workflows/ansible-apply.yaml | 2 +- ansible/host_vars/contabo01.a13labs.pt.yaml | 22 +++-- ...laybook_hardening.yml => playbook_cis.yml} | 6 +- ansible/playbook_microk8s.yml | 4 - .../{cis_hardening => cis}/.ansible-lint | 3 +- .../{cis_hardening => cis}/.yamllint.yml | 0 .../defaults/main/auditd.yml | 0 .../defaults/main/compilers.yml | 0 .../defaults/main/disablewireless.yml | 0 .../defaults/main/dns.yml | 0 .../defaults/main/ipv6.yml | 0 .../defaults/main/limits.yml | 0 .../defaults/main/misc.yml | 0 .../defaults/main/module_blocklists.yml | 0 .../defaults/main/mount.yml | 0 .../defaults/main/ntp.yml | 0 .../defaults/main/packages.yml | 0 .../defaults/main/password.yml | 0 .../defaults/main/sshd.yml | 0 .../defaults/main/suid_sgid_blocklist.yml | 0 .../defaults/main/sysctl.yml | 0 .../defaults/main/ufw.yml | 0 .../defaults/main/umask.yml | 0 .../defaults/main/users.yml | 0 .../files/usr/share/dict/passwords.list | 0 .../{cis_hardening => cis}/handlers/main.yml | 0 .../molecule/default/converge.yml | 0 .../molecule/default/molecule.yml | 0 .../molecule/default/verify.yml | 0 .../molecule/redhat/molecule.yml | 0 .../molecule/ubuntu/molecule.yml | 0 .../{cis_hardening => cis}/requirements.yml | 0 .../{cis_hardening => cis}/tasks/adduser.yml | 0 .../{cis_hardening => cis}/tasks/aide.yml | 0 .../{cis_hardening => cis}/tasks/apparmor.yml | 0 .../{cis_hardening => cis}/tasks/apport.yml | 0 .../{cis_hardening => cis}/tasks/auditd.yml | 0 .../tasks/compilers.yml | 0 .../{cis_hardening => cis}/tasks/cron.yml | 0 .../tasks/ctrlaltdel.yml | 0 .../tasks/disablefs.yml | 0 .../tasks/disablemod.yml | 0 .../tasks/disablenet.yml | 0 .../tasks/disablewireless.yml | 0 .../{cis_hardening => cis}/tasks/extras.yml | 0 .../{cis_hardening => cis}/tasks/facts.yml | 0 .../{cis_hardening => cis}/tasks/fstab.yml | 0 .../{cis_hardening => cis}/tasks/hosts.yml | 0 .../{cis_hardening => cis}/tasks/ipv6.yml | 0 .../{cis_hardening => cis}/tasks/issue.yml | 0 .../tasks/journalconf.yml | 0 .../{cis_hardening => cis}/tasks/limits.yml | 0 .../{cis_hardening => cis}/tasks/lockroot.yml | 0 .../tasks/logindconf.yml | 0 .../tasks/logindefs.yml | 0 .../{cis_hardening => cis}/tasks/main.yml | 0 .../{cis_hardening => cis}/tasks/motdnews.yml | 0 .../{cis_hardening => cis}/tasks/mount.yml | 0 .../tasks/packagemgmt.yml | 0 .../{cis_hardening => cis}/tasks/packages.yml | 0 .../{cis_hardening => cis}/tasks/password.yml | 0 .../{cis_hardening => cis}/tasks/path.yml | 0 .../{cis_hardening => cis}/tasks/post.yml | 0 .../{cis_hardening => cis}/tasks/postfix.yml | 0 .../{cis_hardening => cis}/tasks/pre.yml | 0 .../{cis_hardening => cis}/tasks/prelink.yml | 0 .../tasks/resolvedconf.yml | 0 .../{cis_hardening => cis}/tasks/rkhunter.yml | 0 .../tasks/rootaccess.yml | 0 .../tasks/sshconfig.yml | 0 .../{cis_hardening => cis}/tasks/sudo.yml | 0 .../{cis_hardening => cis}/tasks/suid.yml | 0 .../{cis_hardening => cis}/tasks/sysctl.yml | 0 .../tasks/systemdconf.yml | 0 .../tasks/timesyncd.yml | 0 .../{cis_hardening => cis}/tasks/ufw.yml | 0 .../{cis_hardening => cis}/tasks/umask.yml | 0 .../{cis_hardening => cis}/tasks/users.yml | 0 .../templates/etc/adduser.conf.j2 | 0 .../etc/ansible/facts.d/cpuinfo.fact | 0 .../etc/ansible/facts.d/sshkeys.fact | 0 .../etc/ansible/facts.d/systemd.fact | 0 .../etc/audit/rules.d/hardening.rules.j2 | 0 .../templates/etc/default/rkhunter.j2 | 0 .../templates/etc/default/useradd.j2 | 0 .../templates/etc/hosts.allow.j2 | 0 .../templates/etc/hosts.deny.j2 | 0 .../templates/etc/issue.j2 | 0 .../templates/etc/login.defs.j2 | 0 .../templates/etc/logrotate.conf.j2 | 0 .../templates/etc/motd.j2 | 0 .../templates/etc/pam.d/common-account.j2 | 0 .../templates/etc/pam.d/common-auth.j2 | 0 .../templates/etc/pam.d/common-password.j2 | 0 .../templates/etc/pam.d/login.j2 | 0 .../templates/etc/profile.d/initpath.sh.j2 | 0 .../templates/etc/security/limits.conf.j2 | 0 .../templates/etc/ssh/ssh_config.j2 | 0 .../templates/etc/ssh/sshd_config.j2 | 0 .../templates/etc/systemd/coredump.conf.j2 | 0 .../templates/etc/systemd/journald.conf.j2 | 0 .../templates/etc/systemd/logind.conf.j2 | 0 .../templates/etc/systemd/resolved.conf.j2 | 0 .../templates/etc/systemd/system.conf.j2 | 0 .../templates/etc/systemd/timesyncd.conf.j2 | 0 .../templates/etc/systemd/tmp.mount.j2 | 0 .../templates/etc/systemd/user.conf.j2 | 0 .../lib/systemd/system/aidecheck.service.j2 | 0 .../lib/systemd/system/aidecheck.timer.j2 | 0 .../tests/debug_facts.yml | 0 .../{cis_hardening => cis}/tests/inventory | 0 .../{cis_hardening => cis}/tests/test.yml | 0 .../roles/{duo_security => duo}/.ansible-lint | 0 .../roles/{duo_security => duo}/.yamllint.yml | 0 ansible/roles/{duo_security => duo}/README.md | 0 .../{duo_security => duo}/defaults/main.yml | 0 .../{duo_security => duo}/handlers/main.yml | 0 .../roles/{duo_security => duo}/meta/main.yml | 0 .../molecule/default/converge.yml | 0 .../molecule/default/molecule.yml | 0 .../molecule/default/prepare.yml | 0 .../molecule/default/verify.yml | 0 .../{duo_security => duo}/tasks/main.yml | 0 .../templates/duo-security.conf.j2 | 0 .../templates/login_duo.conf.j2 | 0 .../{duo_security => duo}/tests/inventory | 0 .../{duo_security => duo}/tests/test.yml | 0 .../roles/{duo_security => duo}/vars/main.yml | 0 ansible/roles/geoip/defaults/main.yml | 4 +- .../roles/geoip/molecule/default/molecule.yml | 4 +- .../geoip/templates/usr/bin/sshfilter.sh.j2 | 4 +- .../{manage_users => login}/.ansible-lint | 0 .../{manage_users => login}/.yamllint.yml | 0 .../roles/{manage_users => login}/README.md | 0 ansible/roles/login/defaults/main.yml | 2 + .../{manage_users => login}/handlers/main.yml | 0 .../{manage_users => login}/meta/main.yml | 0 .../molecule/default/converge.yml | 0 .../molecule/default/molecule.yml | 2 +- .../molecule/default/prepare.yml | 0 .../molecule/default/verify.yml | 0 .../{manage_users => login}/tasks/main.yml | 6 +- .../{manage_users => login}/tests/inventory | 0 .../{manage_users => login}/tests/test.yml | 0 .../{manage_users => login}/vars/main.yml | 0 ansible/roles/manage_users/defaults/main.yml | 3 - ansible/roles/microk8s/defaults/main.yml | 39 ++++---- ansible/roles/microk8s/tasks/certmanager.yml | 6 +- ansible/roles/microk8s/tasks/iac.yml | 90 ++++++++++--------- ansible/roles/microk8s/tasks/loadbalancer.yml | 8 +- .../microk8s/tasks/loadbalancer/metallb.yaml | 4 +- ansible/roles/microk8s/tasks/main.yml | 6 +- .../microk8s/tasks/microk8s/encryption.yml | 0 .../roles/microk8s/tasks/microk8s/install.yml | 36 +++++--- ansible/roles/microk8s/tasks/microk8s/ufw.yml | 10 +-- .../roles/microk8s/tasks/setupenv/main.yml | 2 +- .../molecule/default/molecule.yml | 16 ++-- ansible/sectool.env | 1 + repository.vault | 2 +- 159 files changed, 153 insertions(+), 129 deletions(-) rename ansible/{playbook_hardening.yml => playbook_cis.yml} (86%) rename ansible/roles/{cis_hardening => cis}/.ansible-lint (71%) rename ansible/roles/{cis_hardening => cis}/.yamllint.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/auditd.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/compilers.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/disablewireless.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/dns.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/ipv6.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/limits.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/misc.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/module_blocklists.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/mount.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/ntp.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/packages.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/password.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/sshd.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/suid_sgid_blocklist.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/sysctl.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/ufw.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/umask.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/users.yml (100%) rename ansible/roles/{cis_hardening => cis}/files/usr/share/dict/passwords.list (100%) rename ansible/roles/{cis_hardening => cis}/handlers/main.yml (100%) rename ansible/roles/{cis_hardening => cis}/molecule/default/converge.yml (100%) rename ansible/roles/{cis_hardening => cis}/molecule/default/molecule.yml (100%) rename ansible/roles/{cis_hardening => cis}/molecule/default/verify.yml (100%) rename ansible/roles/{cis_hardening => cis}/molecule/redhat/molecule.yml (100%) rename ansible/roles/{cis_hardening => cis}/molecule/ubuntu/molecule.yml (100%) rename ansible/roles/{cis_hardening => cis}/requirements.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/adduser.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/aide.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/apparmor.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/apport.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/auditd.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/compilers.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/cron.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/ctrlaltdel.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/disablefs.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/disablemod.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/disablenet.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/disablewireless.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/extras.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/facts.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/fstab.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/hosts.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/ipv6.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/issue.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/journalconf.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/limits.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/lockroot.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/logindconf.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/logindefs.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/main.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/motdnews.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/mount.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/packagemgmt.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/packages.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/password.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/path.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/post.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/postfix.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/pre.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/prelink.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/resolvedconf.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/rkhunter.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/rootaccess.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/sshconfig.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/sudo.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/suid.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/sysctl.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/systemdconf.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/timesyncd.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/ufw.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/umask.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/users.yml (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/adduser.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/ansible/facts.d/cpuinfo.fact (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/ansible/facts.d/sshkeys.fact (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/ansible/facts.d/systemd.fact (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/audit/rules.d/hardening.rules.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/default/rkhunter.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/default/useradd.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/hosts.allow.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/hosts.deny.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/issue.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/login.defs.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/logrotate.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/motd.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/pam.d/common-account.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/pam.d/common-auth.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/pam.d/common-password.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/pam.d/login.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/profile.d/initpath.sh.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/security/limits.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/ssh/ssh_config.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/ssh/sshd_config.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/coredump.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/journald.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/logind.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/resolved.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/system.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/timesyncd.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/tmp.mount.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/user.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/lib/systemd/system/aidecheck.service.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/lib/systemd/system/aidecheck.timer.j2 (100%) rename ansible/roles/{cis_hardening => cis}/tests/debug_facts.yml (100%) rename ansible/roles/{cis_hardening => cis}/tests/inventory (100%) rename ansible/roles/{cis_hardening => cis}/tests/test.yml (100%) rename ansible/roles/{duo_security => duo}/.ansible-lint (100%) rename ansible/roles/{duo_security => duo}/.yamllint.yml (100%) rename ansible/roles/{duo_security => duo}/README.md (100%) rename ansible/roles/{duo_security => duo}/defaults/main.yml (100%) rename ansible/roles/{duo_security => duo}/handlers/main.yml (100%) rename ansible/roles/{duo_security => duo}/meta/main.yml (100%) rename ansible/roles/{duo_security => duo}/molecule/default/converge.yml (100%) rename ansible/roles/{duo_security => duo}/molecule/default/molecule.yml (100%) rename ansible/roles/{duo_security => duo}/molecule/default/prepare.yml (100%) rename ansible/roles/{duo_security => duo}/molecule/default/verify.yml (100%) rename ansible/roles/{duo_security => duo}/tasks/main.yml (100%) rename ansible/roles/{duo_security => duo}/templates/duo-security.conf.j2 (100%) rename ansible/roles/{duo_security => duo}/templates/login_duo.conf.j2 (100%) rename ansible/roles/{duo_security => duo}/tests/inventory (100%) rename ansible/roles/{duo_security => duo}/tests/test.yml (100%) rename ansible/roles/{duo_security => duo}/vars/main.yml (100%) rename ansible/roles/{manage_users => login}/.ansible-lint (100%) rename ansible/roles/{manage_users => login}/.yamllint.yml (100%) rename ansible/roles/{manage_users => login}/README.md (100%) create mode 100644 ansible/roles/login/defaults/main.yml rename ansible/roles/{manage_users => login}/handlers/main.yml (100%) rename ansible/roles/{manage_users => login}/meta/main.yml (100%) rename ansible/roles/{manage_users => login}/molecule/default/converge.yml (100%) rename ansible/roles/{manage_users => login}/molecule/default/molecule.yml (96%) rename ansible/roles/{manage_users => login}/molecule/default/prepare.yml (100%) rename ansible/roles/{manage_users => login}/molecule/default/verify.yml (100%) rename ansible/roles/{manage_users => login}/tasks/main.yml (93%) rename ansible/roles/{manage_users => login}/tests/inventory (100%) rename ansible/roles/{manage_users => login}/tests/test.yml (100%) rename ansible/roles/{manage_users => login}/vars/main.yml (100%) delete mode 100644 ansible/roles/manage_users/defaults/main.yml delete mode 100644 ansible/roles/microk8s/tasks/microk8s/encryption.yml diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 568112d..5180edf 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -80,7 +80,7 @@ jobs: SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | cd ansible - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_hardening.yml --skip-tags roles::cis::suid + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_cis.yml --skip-tags roles::cis::suid sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml diff --git a/ansible/host_vars/contabo01.a13labs.pt.yaml b/ansible/host_vars/contabo01.a13labs.pt.yaml index 87eeb8f..41c6882 100644 --- a/ansible/host_vars/contabo01.a13labs.pt.yaml +++ b/ansible/host_vars/contabo01.a13labs.pt.yaml @@ -11,7 +11,7 @@ sshd_permit_root_login: "no" sshd_password_authentication: "no" sshd_allow_tcp_forwarding: "yes" ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}" -ssh_users: +login_users: - username: operator comment: "Managed by Ansible" sudoer: true @@ -57,9 +57,11 @@ custom_hosts_acls: true # GeoIP subscription geoip_sshd_enabled: true -ssh_allowed_zones: +geoip_ssh_allowed_zones: - "BE" - "PT" +geoip_ssh_allowed_networks: + - "0.0.0.0/0" # fail2ban fail2ban_jails: @@ -77,20 +79,22 @@ unattended_reboot: true unattended_reboot_time: "04:30" # Kubernetes specific settings -microk8s_alt_names: "{{ hostname }}" -k8s_version: 1.29 -k8s_allowed_hosts: +microk8s_version: 1.29 +microk8s_allowed_hosts: - 87.67.163.177 +microk8s_alt_names: "{{ hostname }}" -k8s_users: +# Let's encrypt issuer +microk8s_issuer_email: c.alexandre.pires@alexpires.me +microk8s_encryption_cfg: /a13labs/microk8s_encryption.yaml +microk8s_encryption_secret: "{{ lookup('env', 'MICROK8S_ENCRYPTION_SECRET') }}" +microk8s_users: - username: operator enabled: true - username: git namespace: "gitea" enabled: true -# Let's encrypt issuer -issuer_email: c.alexandre.pires@alexpires.me - +# Duo Security duo_users: ["*", "!provision", "!git"] duo_api_hostname: api-7cda1654.duosecurity.com diff --git a/ansible/playbook_hardening.yml b/ansible/playbook_cis.yml similarity index 86% rename from ansible/playbook_hardening.yml rename to ansible/playbook_cis.yml index 985c785..a6b6091 100644 --- a/ansible/playbook_hardening.yml +++ b/ansible/playbook_cis.yml @@ -8,11 +8,11 @@ tags: - roles - roles::bootstrap - - role: "manage_users" + - role: "login" tags: - roles - roles::users - - role: "cis_hardening" + - role: "cis" vars: # currently aide is failing install_aide: false @@ -27,7 +27,7 @@ tags: - roles - roles::geoip - - role: "duo_security" + - role: "duo" tags: - roles - roles::duosecurity diff --git a/ansible/playbook_microk8s.yml b/ansible/playbook_microk8s.yml index 7640605..0fe2045 100644 --- a/ansible/playbook_microk8s.yml +++ b/ansible/playbook_microk8s.yml @@ -4,10 +4,6 @@ gather_facts: true roles: - - role: "manage_users" - tags: - - roles - - roles::users - role: "microk8s" tags: - role::microk8s diff --git a/ansible/roles/cis_hardening/.ansible-lint b/ansible/roles/cis/.ansible-lint similarity index 71% rename from ansible/roles/cis_hardening/.ansible-lint rename to ansible/roles/cis/.ansible-lint index cbb696b..241659f 100644 --- a/ansible/roles/cis_hardening/.ansible-lint +++ b/ansible/roles/cis/.ansible-lint @@ -4,9 +4,10 @@ exclude_paths: - .github/ - tests/ enable_list: - - fqcn-builtins # opt-in + - fqcn-builtins # opt-in warn_list: - line-length - yaml[line-length] skip_list: - yaml[comments] + - var-naming[no-role-prefix] diff --git a/ansible/roles/cis_hardening/.yamllint.yml b/ansible/roles/cis/.yamllint.yml similarity index 100% rename from ansible/roles/cis_hardening/.yamllint.yml rename to ansible/roles/cis/.yamllint.yml diff --git a/ansible/roles/cis_hardening/defaults/main/auditd.yml b/ansible/roles/cis/defaults/main/auditd.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/auditd.yml rename to ansible/roles/cis/defaults/main/auditd.yml diff --git a/ansible/roles/cis_hardening/defaults/main/compilers.yml b/ansible/roles/cis/defaults/main/compilers.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/compilers.yml rename to ansible/roles/cis/defaults/main/compilers.yml diff --git a/ansible/roles/cis_hardening/defaults/main/disablewireless.yml b/ansible/roles/cis/defaults/main/disablewireless.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/disablewireless.yml rename to ansible/roles/cis/defaults/main/disablewireless.yml diff --git a/ansible/roles/cis_hardening/defaults/main/dns.yml b/ansible/roles/cis/defaults/main/dns.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/dns.yml rename to ansible/roles/cis/defaults/main/dns.yml diff --git a/ansible/roles/cis_hardening/defaults/main/ipv6.yml b/ansible/roles/cis/defaults/main/ipv6.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/ipv6.yml rename to ansible/roles/cis/defaults/main/ipv6.yml diff --git a/ansible/roles/cis_hardening/defaults/main/limits.yml b/ansible/roles/cis/defaults/main/limits.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/limits.yml rename to ansible/roles/cis/defaults/main/limits.yml diff --git a/ansible/roles/cis_hardening/defaults/main/misc.yml b/ansible/roles/cis/defaults/main/misc.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/misc.yml rename to ansible/roles/cis/defaults/main/misc.yml diff --git a/ansible/roles/cis_hardening/defaults/main/module_blocklists.yml b/ansible/roles/cis/defaults/main/module_blocklists.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/module_blocklists.yml rename to ansible/roles/cis/defaults/main/module_blocklists.yml diff --git a/ansible/roles/cis_hardening/defaults/main/mount.yml b/ansible/roles/cis/defaults/main/mount.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/mount.yml rename to ansible/roles/cis/defaults/main/mount.yml diff --git a/ansible/roles/cis_hardening/defaults/main/ntp.yml b/ansible/roles/cis/defaults/main/ntp.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/ntp.yml rename to ansible/roles/cis/defaults/main/ntp.yml diff --git a/ansible/roles/cis_hardening/defaults/main/packages.yml b/ansible/roles/cis/defaults/main/packages.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/packages.yml rename to ansible/roles/cis/defaults/main/packages.yml diff --git a/ansible/roles/cis_hardening/defaults/main/password.yml b/ansible/roles/cis/defaults/main/password.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/password.yml rename to ansible/roles/cis/defaults/main/password.yml diff --git a/ansible/roles/cis_hardening/defaults/main/sshd.yml b/ansible/roles/cis/defaults/main/sshd.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/sshd.yml rename to ansible/roles/cis/defaults/main/sshd.yml diff --git a/ansible/roles/cis_hardening/defaults/main/suid_sgid_blocklist.yml b/ansible/roles/cis/defaults/main/suid_sgid_blocklist.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/suid_sgid_blocklist.yml rename to ansible/roles/cis/defaults/main/suid_sgid_blocklist.yml diff --git a/ansible/roles/cis_hardening/defaults/main/sysctl.yml b/ansible/roles/cis/defaults/main/sysctl.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/sysctl.yml rename to ansible/roles/cis/defaults/main/sysctl.yml diff --git a/ansible/roles/cis_hardening/defaults/main/ufw.yml b/ansible/roles/cis/defaults/main/ufw.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/ufw.yml rename to ansible/roles/cis/defaults/main/ufw.yml diff --git a/ansible/roles/cis_hardening/defaults/main/umask.yml b/ansible/roles/cis/defaults/main/umask.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/umask.yml rename to ansible/roles/cis/defaults/main/umask.yml diff --git a/ansible/roles/cis_hardening/defaults/main/users.yml b/ansible/roles/cis/defaults/main/users.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/users.yml rename to ansible/roles/cis/defaults/main/users.yml diff --git a/ansible/roles/cis_hardening/files/usr/share/dict/passwords.list b/ansible/roles/cis/files/usr/share/dict/passwords.list similarity index 100% rename from ansible/roles/cis_hardening/files/usr/share/dict/passwords.list rename to ansible/roles/cis/files/usr/share/dict/passwords.list diff --git a/ansible/roles/cis_hardening/handlers/main.yml b/ansible/roles/cis/handlers/main.yml similarity index 100% rename from ansible/roles/cis_hardening/handlers/main.yml rename to ansible/roles/cis/handlers/main.yml diff --git a/ansible/roles/cis_hardening/molecule/default/converge.yml b/ansible/roles/cis/molecule/default/converge.yml similarity index 100% rename from ansible/roles/cis_hardening/molecule/default/converge.yml rename to ansible/roles/cis/molecule/default/converge.yml diff --git a/ansible/roles/cis_hardening/molecule/default/molecule.yml b/ansible/roles/cis/molecule/default/molecule.yml similarity index 100% rename from ansible/roles/cis_hardening/molecule/default/molecule.yml rename to ansible/roles/cis/molecule/default/molecule.yml diff --git a/ansible/roles/cis_hardening/molecule/default/verify.yml b/ansible/roles/cis/molecule/default/verify.yml similarity index 100% rename from ansible/roles/cis_hardening/molecule/default/verify.yml rename to ansible/roles/cis/molecule/default/verify.yml diff --git a/ansible/roles/cis_hardening/molecule/redhat/molecule.yml b/ansible/roles/cis/molecule/redhat/molecule.yml similarity index 100% rename from ansible/roles/cis_hardening/molecule/redhat/molecule.yml rename to ansible/roles/cis/molecule/redhat/molecule.yml diff --git a/ansible/roles/cis_hardening/molecule/ubuntu/molecule.yml b/ansible/roles/cis/molecule/ubuntu/molecule.yml similarity index 100% rename from ansible/roles/cis_hardening/molecule/ubuntu/molecule.yml rename to ansible/roles/cis/molecule/ubuntu/molecule.yml diff --git a/ansible/roles/cis_hardening/requirements.yml b/ansible/roles/cis/requirements.yml similarity index 100% rename from ansible/roles/cis_hardening/requirements.yml rename to ansible/roles/cis/requirements.yml diff --git a/ansible/roles/cis_hardening/tasks/adduser.yml b/ansible/roles/cis/tasks/adduser.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/adduser.yml rename to ansible/roles/cis/tasks/adduser.yml diff --git a/ansible/roles/cis_hardening/tasks/aide.yml b/ansible/roles/cis/tasks/aide.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/aide.yml rename to ansible/roles/cis/tasks/aide.yml diff --git a/ansible/roles/cis_hardening/tasks/apparmor.yml b/ansible/roles/cis/tasks/apparmor.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/apparmor.yml rename to ansible/roles/cis/tasks/apparmor.yml diff --git a/ansible/roles/cis_hardening/tasks/apport.yml b/ansible/roles/cis/tasks/apport.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/apport.yml rename to ansible/roles/cis/tasks/apport.yml diff --git a/ansible/roles/cis_hardening/tasks/auditd.yml b/ansible/roles/cis/tasks/auditd.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/auditd.yml rename to ansible/roles/cis/tasks/auditd.yml diff --git a/ansible/roles/cis_hardening/tasks/compilers.yml b/ansible/roles/cis/tasks/compilers.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/compilers.yml rename to ansible/roles/cis/tasks/compilers.yml diff --git a/ansible/roles/cis_hardening/tasks/cron.yml b/ansible/roles/cis/tasks/cron.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/cron.yml rename to ansible/roles/cis/tasks/cron.yml diff --git a/ansible/roles/cis_hardening/tasks/ctrlaltdel.yml b/ansible/roles/cis/tasks/ctrlaltdel.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/ctrlaltdel.yml rename to ansible/roles/cis/tasks/ctrlaltdel.yml diff --git a/ansible/roles/cis_hardening/tasks/disablefs.yml b/ansible/roles/cis/tasks/disablefs.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/disablefs.yml rename to ansible/roles/cis/tasks/disablefs.yml diff --git a/ansible/roles/cis_hardening/tasks/disablemod.yml b/ansible/roles/cis/tasks/disablemod.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/disablemod.yml rename to ansible/roles/cis/tasks/disablemod.yml diff --git a/ansible/roles/cis_hardening/tasks/disablenet.yml b/ansible/roles/cis/tasks/disablenet.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/disablenet.yml rename to ansible/roles/cis/tasks/disablenet.yml diff --git a/ansible/roles/cis_hardening/tasks/disablewireless.yml b/ansible/roles/cis/tasks/disablewireless.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/disablewireless.yml rename to ansible/roles/cis/tasks/disablewireless.yml diff --git a/ansible/roles/cis_hardening/tasks/extras.yml b/ansible/roles/cis/tasks/extras.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/extras.yml rename to ansible/roles/cis/tasks/extras.yml diff --git a/ansible/roles/cis_hardening/tasks/facts.yml b/ansible/roles/cis/tasks/facts.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/facts.yml rename to ansible/roles/cis/tasks/facts.yml diff --git a/ansible/roles/cis_hardening/tasks/fstab.yml b/ansible/roles/cis/tasks/fstab.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/fstab.yml rename to ansible/roles/cis/tasks/fstab.yml diff --git a/ansible/roles/cis_hardening/tasks/hosts.yml b/ansible/roles/cis/tasks/hosts.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/hosts.yml rename to ansible/roles/cis/tasks/hosts.yml diff --git a/ansible/roles/cis_hardening/tasks/ipv6.yml b/ansible/roles/cis/tasks/ipv6.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/ipv6.yml rename to ansible/roles/cis/tasks/ipv6.yml diff --git a/ansible/roles/cis_hardening/tasks/issue.yml b/ansible/roles/cis/tasks/issue.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/issue.yml rename to ansible/roles/cis/tasks/issue.yml diff --git a/ansible/roles/cis_hardening/tasks/journalconf.yml b/ansible/roles/cis/tasks/journalconf.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/journalconf.yml rename to ansible/roles/cis/tasks/journalconf.yml diff --git a/ansible/roles/cis_hardening/tasks/limits.yml b/ansible/roles/cis/tasks/limits.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/limits.yml rename to ansible/roles/cis/tasks/limits.yml diff --git a/ansible/roles/cis_hardening/tasks/lockroot.yml b/ansible/roles/cis/tasks/lockroot.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/lockroot.yml rename to ansible/roles/cis/tasks/lockroot.yml diff --git a/ansible/roles/cis_hardening/tasks/logindconf.yml b/ansible/roles/cis/tasks/logindconf.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/logindconf.yml rename to ansible/roles/cis/tasks/logindconf.yml diff --git a/ansible/roles/cis_hardening/tasks/logindefs.yml b/ansible/roles/cis/tasks/logindefs.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/logindefs.yml rename to ansible/roles/cis/tasks/logindefs.yml diff --git a/ansible/roles/cis_hardening/tasks/main.yml b/ansible/roles/cis/tasks/main.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/main.yml rename to ansible/roles/cis/tasks/main.yml diff --git a/ansible/roles/cis_hardening/tasks/motdnews.yml b/ansible/roles/cis/tasks/motdnews.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/motdnews.yml rename to ansible/roles/cis/tasks/motdnews.yml diff --git a/ansible/roles/cis_hardening/tasks/mount.yml b/ansible/roles/cis/tasks/mount.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/mount.yml rename to ansible/roles/cis/tasks/mount.yml diff --git a/ansible/roles/cis_hardening/tasks/packagemgmt.yml b/ansible/roles/cis/tasks/packagemgmt.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/packagemgmt.yml rename to ansible/roles/cis/tasks/packagemgmt.yml diff --git a/ansible/roles/cis_hardening/tasks/packages.yml b/ansible/roles/cis/tasks/packages.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/packages.yml rename to ansible/roles/cis/tasks/packages.yml diff --git a/ansible/roles/cis_hardening/tasks/password.yml b/ansible/roles/cis/tasks/password.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/password.yml rename to ansible/roles/cis/tasks/password.yml diff --git a/ansible/roles/cis_hardening/tasks/path.yml b/ansible/roles/cis/tasks/path.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/path.yml rename to ansible/roles/cis/tasks/path.yml diff --git a/ansible/roles/cis_hardening/tasks/post.yml b/ansible/roles/cis/tasks/post.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/post.yml rename to ansible/roles/cis/tasks/post.yml diff --git a/ansible/roles/cis_hardening/tasks/postfix.yml b/ansible/roles/cis/tasks/postfix.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/postfix.yml rename to ansible/roles/cis/tasks/postfix.yml diff --git a/ansible/roles/cis_hardening/tasks/pre.yml b/ansible/roles/cis/tasks/pre.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/pre.yml rename to ansible/roles/cis/tasks/pre.yml diff --git a/ansible/roles/cis_hardening/tasks/prelink.yml b/ansible/roles/cis/tasks/prelink.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/prelink.yml rename to ansible/roles/cis/tasks/prelink.yml diff --git a/ansible/roles/cis_hardening/tasks/resolvedconf.yml b/ansible/roles/cis/tasks/resolvedconf.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/resolvedconf.yml rename to ansible/roles/cis/tasks/resolvedconf.yml diff --git a/ansible/roles/cis_hardening/tasks/rkhunter.yml b/ansible/roles/cis/tasks/rkhunter.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/rkhunter.yml rename to ansible/roles/cis/tasks/rkhunter.yml diff --git a/ansible/roles/cis_hardening/tasks/rootaccess.yml b/ansible/roles/cis/tasks/rootaccess.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/rootaccess.yml rename to ansible/roles/cis/tasks/rootaccess.yml diff --git a/ansible/roles/cis_hardening/tasks/sshconfig.yml b/ansible/roles/cis/tasks/sshconfig.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/sshconfig.yml rename to ansible/roles/cis/tasks/sshconfig.yml diff --git a/ansible/roles/cis_hardening/tasks/sudo.yml b/ansible/roles/cis/tasks/sudo.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/sudo.yml rename to ansible/roles/cis/tasks/sudo.yml diff --git a/ansible/roles/cis_hardening/tasks/suid.yml b/ansible/roles/cis/tasks/suid.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/suid.yml rename to ansible/roles/cis/tasks/suid.yml diff --git a/ansible/roles/cis_hardening/tasks/sysctl.yml b/ansible/roles/cis/tasks/sysctl.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/sysctl.yml rename to ansible/roles/cis/tasks/sysctl.yml diff --git a/ansible/roles/cis_hardening/tasks/systemdconf.yml b/ansible/roles/cis/tasks/systemdconf.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/systemdconf.yml rename to ansible/roles/cis/tasks/systemdconf.yml diff --git a/ansible/roles/cis_hardening/tasks/timesyncd.yml b/ansible/roles/cis/tasks/timesyncd.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/timesyncd.yml rename to ansible/roles/cis/tasks/timesyncd.yml diff --git a/ansible/roles/cis_hardening/tasks/ufw.yml b/ansible/roles/cis/tasks/ufw.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/ufw.yml rename to ansible/roles/cis/tasks/ufw.yml diff --git a/ansible/roles/cis_hardening/tasks/umask.yml b/ansible/roles/cis/tasks/umask.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/umask.yml rename to ansible/roles/cis/tasks/umask.yml diff --git a/ansible/roles/cis_hardening/tasks/users.yml b/ansible/roles/cis/tasks/users.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/users.yml rename to ansible/roles/cis/tasks/users.yml diff --git a/ansible/roles/cis_hardening/templates/etc/adduser.conf.j2 b/ansible/roles/cis/templates/etc/adduser.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/adduser.conf.j2 rename to ansible/roles/cis/templates/etc/adduser.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/ansible/facts.d/cpuinfo.fact b/ansible/roles/cis/templates/etc/ansible/facts.d/cpuinfo.fact similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/ansible/facts.d/cpuinfo.fact rename to ansible/roles/cis/templates/etc/ansible/facts.d/cpuinfo.fact diff --git a/ansible/roles/cis_hardening/templates/etc/ansible/facts.d/sshkeys.fact b/ansible/roles/cis/templates/etc/ansible/facts.d/sshkeys.fact similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/ansible/facts.d/sshkeys.fact rename to ansible/roles/cis/templates/etc/ansible/facts.d/sshkeys.fact diff --git a/ansible/roles/cis_hardening/templates/etc/ansible/facts.d/systemd.fact b/ansible/roles/cis/templates/etc/ansible/facts.d/systemd.fact similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/ansible/facts.d/systemd.fact rename to ansible/roles/cis/templates/etc/ansible/facts.d/systemd.fact diff --git a/ansible/roles/cis_hardening/templates/etc/audit/rules.d/hardening.rules.j2 b/ansible/roles/cis/templates/etc/audit/rules.d/hardening.rules.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/audit/rules.d/hardening.rules.j2 rename to ansible/roles/cis/templates/etc/audit/rules.d/hardening.rules.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/default/rkhunter.j2 b/ansible/roles/cis/templates/etc/default/rkhunter.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/default/rkhunter.j2 rename to ansible/roles/cis/templates/etc/default/rkhunter.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/default/useradd.j2 b/ansible/roles/cis/templates/etc/default/useradd.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/default/useradd.j2 rename to ansible/roles/cis/templates/etc/default/useradd.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/hosts.allow.j2 b/ansible/roles/cis/templates/etc/hosts.allow.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/hosts.allow.j2 rename to ansible/roles/cis/templates/etc/hosts.allow.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/hosts.deny.j2 b/ansible/roles/cis/templates/etc/hosts.deny.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/hosts.deny.j2 rename to ansible/roles/cis/templates/etc/hosts.deny.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/issue.j2 b/ansible/roles/cis/templates/etc/issue.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/issue.j2 rename to ansible/roles/cis/templates/etc/issue.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/login.defs.j2 b/ansible/roles/cis/templates/etc/login.defs.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/login.defs.j2 rename to ansible/roles/cis/templates/etc/login.defs.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/logrotate.conf.j2 b/ansible/roles/cis/templates/etc/logrotate.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/logrotate.conf.j2 rename to ansible/roles/cis/templates/etc/logrotate.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/motd.j2 b/ansible/roles/cis/templates/etc/motd.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/motd.j2 rename to ansible/roles/cis/templates/etc/motd.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/common-account.j2 b/ansible/roles/cis/templates/etc/pam.d/common-account.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/pam.d/common-account.j2 rename to ansible/roles/cis/templates/etc/pam.d/common-account.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/common-auth.j2 b/ansible/roles/cis/templates/etc/pam.d/common-auth.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/pam.d/common-auth.j2 rename to ansible/roles/cis/templates/etc/pam.d/common-auth.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/common-password.j2 b/ansible/roles/cis/templates/etc/pam.d/common-password.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/pam.d/common-password.j2 rename to ansible/roles/cis/templates/etc/pam.d/common-password.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/login.j2 b/ansible/roles/cis/templates/etc/pam.d/login.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/pam.d/login.j2 rename to ansible/roles/cis/templates/etc/pam.d/login.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/profile.d/initpath.sh.j2 b/ansible/roles/cis/templates/etc/profile.d/initpath.sh.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/profile.d/initpath.sh.j2 rename to ansible/roles/cis/templates/etc/profile.d/initpath.sh.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/security/limits.conf.j2 b/ansible/roles/cis/templates/etc/security/limits.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/security/limits.conf.j2 rename to ansible/roles/cis/templates/etc/security/limits.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/ssh/ssh_config.j2 b/ansible/roles/cis/templates/etc/ssh/ssh_config.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/ssh/ssh_config.j2 rename to ansible/roles/cis/templates/etc/ssh/ssh_config.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/ssh/sshd_config.j2 b/ansible/roles/cis/templates/etc/ssh/sshd_config.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/ssh/sshd_config.j2 rename to ansible/roles/cis/templates/etc/ssh/sshd_config.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/coredump.conf.j2 b/ansible/roles/cis/templates/etc/systemd/coredump.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/coredump.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/coredump.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/journald.conf.j2 b/ansible/roles/cis/templates/etc/systemd/journald.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/journald.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/journald.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/logind.conf.j2 b/ansible/roles/cis/templates/etc/systemd/logind.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/logind.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/logind.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/resolved.conf.j2 b/ansible/roles/cis/templates/etc/systemd/resolved.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/resolved.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/resolved.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/system.conf.j2 b/ansible/roles/cis/templates/etc/systemd/system.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/system.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/system.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/timesyncd.conf.j2 b/ansible/roles/cis/templates/etc/systemd/timesyncd.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/timesyncd.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/timesyncd.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/tmp.mount.j2 b/ansible/roles/cis/templates/etc/systemd/tmp.mount.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/tmp.mount.j2 rename to ansible/roles/cis/templates/etc/systemd/tmp.mount.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/user.conf.j2 b/ansible/roles/cis/templates/etc/systemd/user.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/user.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/user.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.service.j2 b/ansible/roles/cis/templates/lib/systemd/system/aidecheck.service.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.service.j2 rename to ansible/roles/cis/templates/lib/systemd/system/aidecheck.service.j2 diff --git a/ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.timer.j2 b/ansible/roles/cis/templates/lib/systemd/system/aidecheck.timer.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.timer.j2 rename to ansible/roles/cis/templates/lib/systemd/system/aidecheck.timer.j2 diff --git a/ansible/roles/cis_hardening/tests/debug_facts.yml b/ansible/roles/cis/tests/debug_facts.yml similarity index 100% rename from ansible/roles/cis_hardening/tests/debug_facts.yml rename to ansible/roles/cis/tests/debug_facts.yml diff --git a/ansible/roles/cis_hardening/tests/inventory b/ansible/roles/cis/tests/inventory similarity index 100% rename from ansible/roles/cis_hardening/tests/inventory rename to ansible/roles/cis/tests/inventory diff --git a/ansible/roles/cis_hardening/tests/test.yml b/ansible/roles/cis/tests/test.yml similarity index 100% rename from ansible/roles/cis_hardening/tests/test.yml rename to ansible/roles/cis/tests/test.yml diff --git a/ansible/roles/duo_security/.ansible-lint b/ansible/roles/duo/.ansible-lint similarity index 100% rename from ansible/roles/duo_security/.ansible-lint rename to ansible/roles/duo/.ansible-lint diff --git a/ansible/roles/duo_security/.yamllint.yml b/ansible/roles/duo/.yamllint.yml similarity index 100% rename from ansible/roles/duo_security/.yamllint.yml rename to ansible/roles/duo/.yamllint.yml diff --git a/ansible/roles/duo_security/README.md b/ansible/roles/duo/README.md similarity index 100% rename from ansible/roles/duo_security/README.md rename to ansible/roles/duo/README.md diff --git a/ansible/roles/duo_security/defaults/main.yml b/ansible/roles/duo/defaults/main.yml similarity index 100% rename from ansible/roles/duo_security/defaults/main.yml rename to ansible/roles/duo/defaults/main.yml diff --git a/ansible/roles/duo_security/handlers/main.yml b/ansible/roles/duo/handlers/main.yml similarity index 100% rename from ansible/roles/duo_security/handlers/main.yml rename to ansible/roles/duo/handlers/main.yml diff --git a/ansible/roles/duo_security/meta/main.yml b/ansible/roles/duo/meta/main.yml similarity index 100% rename from ansible/roles/duo_security/meta/main.yml rename to ansible/roles/duo/meta/main.yml diff --git a/ansible/roles/duo_security/molecule/default/converge.yml b/ansible/roles/duo/molecule/default/converge.yml similarity index 100% rename from ansible/roles/duo_security/molecule/default/converge.yml rename to ansible/roles/duo/molecule/default/converge.yml diff --git a/ansible/roles/duo_security/molecule/default/molecule.yml b/ansible/roles/duo/molecule/default/molecule.yml similarity index 100% rename from ansible/roles/duo_security/molecule/default/molecule.yml rename to ansible/roles/duo/molecule/default/molecule.yml diff --git a/ansible/roles/duo_security/molecule/default/prepare.yml b/ansible/roles/duo/molecule/default/prepare.yml similarity index 100% rename from ansible/roles/duo_security/molecule/default/prepare.yml rename to ansible/roles/duo/molecule/default/prepare.yml diff --git a/ansible/roles/duo_security/molecule/default/verify.yml b/ansible/roles/duo/molecule/default/verify.yml similarity index 100% rename from ansible/roles/duo_security/molecule/default/verify.yml rename to ansible/roles/duo/molecule/default/verify.yml diff --git a/ansible/roles/duo_security/tasks/main.yml b/ansible/roles/duo/tasks/main.yml similarity index 100% rename from ansible/roles/duo_security/tasks/main.yml rename to ansible/roles/duo/tasks/main.yml diff --git a/ansible/roles/duo_security/templates/duo-security.conf.j2 b/ansible/roles/duo/templates/duo-security.conf.j2 similarity index 100% rename from ansible/roles/duo_security/templates/duo-security.conf.j2 rename to ansible/roles/duo/templates/duo-security.conf.j2 diff --git a/ansible/roles/duo_security/templates/login_duo.conf.j2 b/ansible/roles/duo/templates/login_duo.conf.j2 similarity index 100% rename from ansible/roles/duo_security/templates/login_duo.conf.j2 rename to ansible/roles/duo/templates/login_duo.conf.j2 diff --git a/ansible/roles/duo_security/tests/inventory b/ansible/roles/duo/tests/inventory similarity index 100% rename from ansible/roles/duo_security/tests/inventory rename to ansible/roles/duo/tests/inventory diff --git a/ansible/roles/duo_security/tests/test.yml b/ansible/roles/duo/tests/test.yml similarity index 100% rename from ansible/roles/duo_security/tests/test.yml rename to ansible/roles/duo/tests/test.yml diff --git a/ansible/roles/duo_security/vars/main.yml b/ansible/roles/duo/vars/main.yml similarity index 100% rename from ansible/roles/duo_security/vars/main.yml rename to ansible/roles/duo/vars/main.yml diff --git a/ansible/roles/geoip/defaults/main.yml b/ansible/roles/geoip/defaults/main.yml index ba2f186..c8e6760 100644 --- a/ansible/roles/geoip/defaults/main.yml +++ b/ansible/roles/geoip/defaults/main.yml @@ -6,8 +6,8 @@ geoip_editions_ids: - GeoLite2-ASN - GeoLite2-City - GeoLite2-Country -ssh_allowed_zones: +geoip_ssh_allowed_zones: - "ALL" -ssh_allowed_networks: +geoip_ssh_allowed_networks: - "0.0.0.0/0" geoip_sshd_enabled: true diff --git a/ansible/roles/geoip/molecule/default/molecule.yml b/ansible/roles/geoip/molecule/default/molecule.yml index cdb2d6a..170746e 100644 --- a/ansible/roles/geoip/molecule/default/molecule.yml +++ b/ansible/roles/geoip/molecule/default/molecule.yml @@ -20,9 +20,9 @@ provisioner: inventory: group_vars: all: - ssh_allowed_zones: + geoip_ssh_allowed_zones: - "ALL" - ssh_allowed_networks: + geoip_ssh_allowed_networks: - "0.0.0.0/0" geoip_ufw_enabled: true geoip_sshd_enabled: true diff --git a/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2 b/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2 index 92b7d5e..eca979a 100644 --- a/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2 +++ b/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2 @@ -6,8 +6,8 @@ if [ $# -ne 1 ]; then exit 0 # return true in case of config issue fi -NETWORKS="{{ ssh_allowed_networks | join(" ") }}" -ALLOW_COUNTRIES="{{ ssh_allowed_zones | join(" ") }}" +NETWORKS="{{ geoip_ssh_allowed_networks | join(" ") }}" +ALLOW_COUNTRIES="{{ geoip_ssh_allowed_zones | join(" ") }}" GEOIPTOOL=$(which geoiplookup) # Fetch the GitHub runner IP ranges diff --git a/ansible/roles/manage_users/.ansible-lint b/ansible/roles/login/.ansible-lint similarity index 100% rename from ansible/roles/manage_users/.ansible-lint rename to ansible/roles/login/.ansible-lint diff --git a/ansible/roles/manage_users/.yamllint.yml b/ansible/roles/login/.yamllint.yml similarity index 100% rename from ansible/roles/manage_users/.yamllint.yml rename to ansible/roles/login/.yamllint.yml diff --git a/ansible/roles/manage_users/README.md b/ansible/roles/login/README.md similarity index 100% rename from ansible/roles/manage_users/README.md rename to ansible/roles/login/README.md diff --git a/ansible/roles/login/defaults/main.yml b/ansible/roles/login/defaults/main.yml new file mode 100644 index 0000000..bc3a5f5 --- /dev/null +++ b/ansible/roles/login/defaults/main.yml @@ -0,0 +1,2 @@ +--- +login_users: [] diff --git a/ansible/roles/manage_users/handlers/main.yml b/ansible/roles/login/handlers/main.yml similarity index 100% rename from ansible/roles/manage_users/handlers/main.yml rename to ansible/roles/login/handlers/main.yml diff --git a/ansible/roles/manage_users/meta/main.yml b/ansible/roles/login/meta/main.yml similarity index 100% rename from ansible/roles/manage_users/meta/main.yml rename to ansible/roles/login/meta/main.yml diff --git a/ansible/roles/manage_users/molecule/default/converge.yml b/ansible/roles/login/molecule/default/converge.yml similarity index 100% rename from ansible/roles/manage_users/molecule/default/converge.yml rename to ansible/roles/login/molecule/default/converge.yml diff --git a/ansible/roles/manage_users/molecule/default/molecule.yml b/ansible/roles/login/molecule/default/molecule.yml similarity index 96% rename from ansible/roles/manage_users/molecule/default/molecule.yml rename to ansible/roles/login/molecule/default/molecule.yml index 5dece31..484c4fd 100644 --- a/ansible/roles/manage_users/molecule/default/molecule.yml +++ b/ansible/roles/login/molecule/default/molecule.yml @@ -16,7 +16,7 @@ provisioner: inventory: host_vars: instance: - ssh_users: + login_users: - username: testuser comment: Test User enabled: true diff --git a/ansible/roles/manage_users/molecule/default/prepare.yml b/ansible/roles/login/molecule/default/prepare.yml similarity index 100% rename from ansible/roles/manage_users/molecule/default/prepare.yml rename to ansible/roles/login/molecule/default/prepare.yml diff --git a/ansible/roles/manage_users/molecule/default/verify.yml b/ansible/roles/login/molecule/default/verify.yml similarity index 100% rename from ansible/roles/manage_users/molecule/default/verify.yml rename to ansible/roles/login/molecule/default/verify.yml diff --git a/ansible/roles/manage_users/tasks/main.yml b/ansible/roles/login/tasks/main.yml similarity index 93% rename from ansible/roles/manage_users/tasks/main.yml rename to ansible/roles/login/tasks/main.yml index e62c852..23de699 100644 --- a/ansible/roles/manage_users/tasks/main.yml +++ b/ansible/roles/login/tasks/main.yml @@ -11,7 +11,7 @@ password: "{{ lookup('env', 'USER_PASSWORD_' + (item.username | upper)) | password_hash('sha512', user_password_salt) }}" state: "{{ 'absent' if item.enabled is defined and not item.enabled else 'present' }}" shell: "{{ item.shell if item.shell is defined else '/bin/bash' }}" - loop: "{{ ssh_users }}" + loop: "{{ login_users }}" - name: "Add SSH Authorized key" become: true @@ -20,7 +20,7 @@ key: "{{ item.pubkey }}" state: "{{ 'present' if item.pubkey is defined else 'absent' }}" when: item.pubkey is defined - loop: "{{ ssh_users }}" + loop: "{{ login_users }}" - name: Create sudoers.d entry if user allowed become: true @@ -32,4 +32,4 @@ group: root mode: "0600" when: item.sudoer is defined and item.sudoer - loop: "{{ ssh_users }}" + loop: "{{ login_users }}" diff --git a/ansible/roles/manage_users/tests/inventory b/ansible/roles/login/tests/inventory similarity index 100% rename from ansible/roles/manage_users/tests/inventory rename to ansible/roles/login/tests/inventory diff --git a/ansible/roles/manage_users/tests/test.yml b/ansible/roles/login/tests/test.yml similarity index 100% rename from ansible/roles/manage_users/tests/test.yml rename to ansible/roles/login/tests/test.yml diff --git a/ansible/roles/manage_users/vars/main.yml b/ansible/roles/login/vars/main.yml similarity index 100% rename from ansible/roles/manage_users/vars/main.yml rename to ansible/roles/login/vars/main.yml diff --git a/ansible/roles/manage_users/defaults/main.yml b/ansible/roles/manage_users/defaults/main.yml deleted file mode 100644 index ca90990..0000000 --- a/ansible/roles/manage_users/defaults/main.yml +++ /dev/null @@ -1,3 +0,0 @@ ---- -# defaults file for manage_users -ssh_users: [] diff --git a/ansible/roles/microk8s/defaults/main.yml b/ansible/roles/microk8s/defaults/main.yml index 25b1682..1ddd90c 100644 --- a/ansible/roles/microk8s/defaults/main.yml +++ b/ansible/roles/microk8s/defaults/main.yml @@ -1,38 +1,41 @@ -k8s_version: "1.29" -kubectl_version: "1.29.0" +microk8s_k8s_version: "1.29" +microk8s_kubectl_version: "1.29.0" # load balancer configuration -lb_provider: "metallb" -lb_ips: "10.2.0.40-10.2.0.49" -lb_http_port: 80 -lb_https_port: 443 -metallb_version: 0.14.5 +microk8s_lb_provider: "metallb" +microk8s_lb_ips: "10.2.0.40-10.2.0.49" +microk8s_lb_http_port: 80 +microk8s_lb_https_port: 443 +microk8s_metallb_version: 0.14.5 # certificate manager -issuer_email: webmaster@localhost.localdomain -certmgr_version: 1.14.5 +microk8s_issuer_email: webmaster@localhost.localdomain +microk8s_certmgr_version: 1.14.5 # microk8s specific -microk8s_channel: "{{ k8s_version }}/stable" +microk8s_channel: "{{ microk8s_k8s_version }}/stable" microk8s_privileged: true microk8s_alt_names: "localhost.localdomain" microk8s_status_timeout: 300 -k8s_users: [] +microk8s_users: [] -k8s_host_public_ip: "{{ ansible_default_ipv4.address }}" +microk8s_host_public_ip: "{{ ansible_default_ipv4.address }}" -k8s_net_devices: +microk8s_net_devices: - "cni+" - "flannel+" -k8s_incoming_traffic: +microk8s_incoming_traffic: - { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" } - { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" } - - { rule: "allow", port: "10254", proto: "tcp", from: "{{ k8s_host_public_ip }}" } + - { rule: "allow", port: "10254", proto: "tcp", from: "{{ microk8s_host_public_ip }}" } -k8s_outgoing_traffic: [] +microk8s_outgoing_traffic: [] -k8s_allowed_hosts: [] +microk8s_allowed_hosts: [] -k8s_iac_user: "provision" \ No newline at end of file +microk8s_iac_user: "provision" + +microk8s_encryption_secret: "a13labs" +microk8s_encryption_cfg: "/etc/microk8s_encryption.yaml" diff --git a/ansible/roles/microk8s/tasks/certmanager.yml b/ansible/roles/microk8s/tasks/certmanager.yml index ad3aa96..84f75ec 100644 --- a/ansible/roles/microk8s/tasks/certmanager.yml +++ b/ansible/roles/microk8s/tasks/certmanager.yml @@ -1,6 +1,6 @@ - name: CertManager | Copy latest manifest ansible.builtin.get_url: - url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ certmgr_version }}/cert-manager.yaml" + url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ microk8s_certmgr_version }}/cert-manager.yaml" dest: "{{ k8s_etc }}/k8s-certmanager.yaml" mode: "0600" @@ -35,7 +35,7 @@ # The ACME server URL server: https://acme-v02.api.letsencrypt.org/directory # Email address used for ACME registration - email: "{{ issuer_email }}" + email: "{{ microk8s_issuer_email }}" # Name of a secret used to store the ACME account private key privateKeySecretRef: name: letsencrypt-prod @@ -65,7 +65,7 @@ # The ACME server URL server: https://acme-staging-v02.api.letsencrypt.org/directory # Email address used for ACME registration - email: "{{ issuer_email }}" + email: "{{ microk8s_issuer_email }}" # Name of a secret used to store the ACME account private key privateKeySecretRef: name: letsencrypt-staging diff --git a/ansible/roles/microk8s/tasks/iac.yml b/ansible/roles/microk8s/tasks/iac.yml index d6af39f..a71e7f6 100644 --- a/ansible/roles/microk8s/tasks/iac.yml +++ b/ansible/roles/microk8s/tasks/iac.yml @@ -11,7 +11,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: "{{ k8s_iac_user }}" + name: "{{ microk8s_iac_user }}" namespace: default tags: - k8s::iac @@ -29,10 +29,10 @@ apiVersion: v1 kind: Secret metadata: - name: "{{ k8s_iac_user }}-token" + name: "{{ microk8s_iac_user }}-token" namespace: default annotations: - kubernetes.io/service-account.name: "{{ k8s_iac_user }}" + kubernetes.io/service-account.name: "{{ microk8s_iac_user }}" type: kubernetes.io/service-account-token tags: - k8s::iac @@ -58,14 +58,14 @@ subjects: - kind: ServiceAccount namespace: default - name: "{{ k8s_iac_user }}" + name: "{{ microk8s_iac_user }}" tags: - k8s::iac - name: Get the secret name ansible.builtin.shell: | set -o pipefail - microk8s.kubectl -n default get secret | grep {{ k8s_iac_user }} | awk '{ print $1 }' + microk8s.kubectl -n default get secret | grep {{ microk8s_iac_user }} | awk '{ print $1 }' args: executable: /bin/bash register: secret_name @@ -98,44 +98,48 @@ tags: - k8s::iac -- name: Patch kubeconfig with user token - ansible.builtin.set_fact: - patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}" - vars: - new_kubeconfig: - contexts: - - context: - cluster: microk8s-cluster - user: "{{ k8s_iac_user }}" - name: microk8s - users: - - name: "{{ k8s_iac_user }}" - user: - token: "{{ token.stdout }}" - tags: - - k8s::iac +- name: Render kubeconfig + when: kubeconfig.stdout != "" + block: + - name: Patch kubeconfig with user token + ansible.builtin.set_fact: + patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}" + vars: + new_kubeconfig: + contexts: + - context: + cluster: microk8s-cluster + user: "{{ microk8s_iac_user }}" + name: microk8s + users: + - name: "{{ microk8s_iac_user }}" + user: + token: "{{ token.stdout }}" + tags: + - k8s::iac -- name: Check if a config already exists and its SHA1 - become: true - ansible.builtin.stat: - path: "{{ k8s_kubeconfig }}" - register: kubeconfig_exists - tags: - - k8s::iac + - name: Check if a config already exists and its SHA1 + become: true + ansible.builtin.stat: + path: "{{ k8s_kubeconfig }}" + register: kubeconfig_exists + tags: + - k8s::iac -- name: Get new config SHA1 - ansible.builtin.set_fact: - patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}" - tags: - - k8s::iac + - name: Get new config SHA1 + ansible.builtin.set_fact: + patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}" + tags: + - k8s::iac -- name: Write kubeconfig - become: true - ansible.builtin.copy: - content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}" - dest: "{{ k8s_kubeconfig }}" - owner: "{{ k8s_iac_user }}" - mode: "0600" - when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum - tags: - - k8s::iac + - name: Write kubeconfig + become: true + ansible.builtin.copy: + content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}" + dest: "{{ k8s_kubeconfig }}" + owner: "{{ microk8s_iac_user }}" + mode: "0600" + when: + - not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum + tags: + - k8s::iac diff --git a/ansible/roles/microk8s/tasks/loadbalancer.yml b/ansible/roles/microk8s/tasks/loadbalancer.yml index 35dad36..18d70ac 100644 --- a/ansible/roles/microk8s/tasks/loadbalancer.yml +++ b/ansible/roles/microk8s/tasks/loadbalancer.yml @@ -1,5 +1,5 @@ -- name: Loadbalancer | Setup '{{ lb_provider }}' - ansible.builtin.include_tasks: "loadbalancer/{{ lb_provider }}.yaml" +- name: Loadbalancer | Setup '{{ microk8s_lb_provider }}' + ansible.builtin.include_tasks: "loadbalancer/{{ microk8s_lb_provider }}.yaml" - name: Loadbalancer | Create Loadbalancer for Nginx ingress environment: @@ -23,9 +23,9 @@ ports: - name: http protocol: TCP - port: "{{ lb_http_port }}" + port: "{{ microk8s_lb_http_port }}" targetPort: 80 - name: https protocol: TCP - port: "{{ lb_https_port }}" + port: "{{ microk8s_lb_https_port }}" targetPort: 443 diff --git a/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml b/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml index f7a369c..f8505b5 100644 --- a/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml +++ b/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml @@ -1,6 +1,6 @@ - name: MetalLB | Copy manifest files to host ansible.builtin.get_url: - url: "https://raw.githubusercontent.com/metallb/metallb/v{{ metallb_version }}/config/manifests/metallb-native.yaml" + url: "https://raw.githubusercontent.com/metallb/metallb/v{{ microk8s_metallb_version }}/config/manifests/metallb-native.yaml" dest: "{{ k8s_etc }}/metallb.yaml" mode: "0600" @@ -32,7 +32,7 @@ namespace: metallb-system spec: addresses: - - "{{ lb_ips }}" + - "{{ microk8s_lb_ips }}" - name: MetalLB | Create L2Advertisement environment: diff --git a/ansible/roles/microk8s/tasks/main.yml b/ansible/roles/microk8s/tasks/main.yml index 22fe283..5dc060c 100644 --- a/ansible/roles/microk8s/tasks/main.yml +++ b/ansible/roles/microk8s/tasks/main.yml @@ -53,7 +53,7 @@ - name: Download kubectl become: true ansible.builtin.get_url: - url: "https://dl.k8s.io/release/v{{ kubectl_version }}/bin/linux/amd64/kubectl" + url: "https://dl.k8s.io/release/v{{ microk8s_kubectl_version }}/bin/linux/amd64/kubectl" dest: "/usr/local/bin/kubectl" mode: "0755" owner: "root" @@ -78,7 +78,7 @@ - name: "Setup local user access to k8s - {{ item.username }}" ansible.builtin.include_tasks: "setupenv/main.yml" - loop: "{{ k8s_users }}" - when: k8s_users is defined + loop: "{{ microk8s_users }}" + when: microk8s_users is defined tags: - k8s::users diff --git a/ansible/roles/microk8s/tasks/microk8s/encryption.yml b/ansible/roles/microk8s/tasks/microk8s/encryption.yml deleted file mode 100644 index e69de29..0000000 diff --git a/ansible/roles/microk8s/tasks/microk8s/install.yml b/ansible/roles/microk8s/tasks/microk8s/install.yml index 0f40dcf..0977b47 100644 --- a/ansible/roles/microk8s/tasks/microk8s/install.yml +++ b/ansible/roles/microk8s/tasks/microk8s/install.yml @@ -1,4 +1,3 @@ -# Install a snap with classic confinement - name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}' become: true community.general.snap: @@ -6,6 +5,25 @@ channel: "{{ microk8s_channel }}" classic: true +- name: Create encryption configuration + become: true + ansible.builtin.copy: + content: | + --- + apiVersion: apiserver.config.k8s.io/v1 + kind: EncryptionConfiguration + resources: + - resources: + - secrets + providers: + - aescbc: + keys: + - name: k8s-crypto + secret: {{ microk8s_encryption_secret }} + - identity: {} + dest: "{{ microk8s_encryption_cfg }}" + mode: "0600" + - name: Microk8s | Patch microk8s configuration notify: ["Restart microk8s"] block: @@ -16,6 +34,13 @@ line: "--allow-privileged=true" insertafter: "^--insecure-port=0$" + - name: Microk8s | Enable encryption provider + become: true + ansible.builtin.lineinfile: + path: /var/snap/microk8s/current/args/kube-apiserver + line: "--encryption-provider-config=/a13labs/microk8s/encryption.yaml" + insertafter: "^--insecure-port=0$" + - name: Microk8s | Fixing Disk Pressure become: true ansible.builtin.lineinfile: @@ -64,17 +89,8 @@ - { plugin: "ingress", wait: 60, args: "", enabled: true } - { plugin: "hostpath-storage", wait: 10, args: "", enabled: true } -- name: Microk8s | Check if ufw is enabled - become: true - ansible.builtin.shell: - cmd: "ufw status" - register: ufw_status - changed_when: false - - name: Microk8s | Configure required ufw rules ansible.builtin.include_tasks: microk8s/ufw.yml - when: - - ufw_status.stdout.find("Status: active") != -1 - name: Microk8s | Store kubeconfig ansible.builtin.shell: diff --git a/ansible/roles/microk8s/tasks/microk8s/ufw.yml b/ansible/roles/microk8s/tasks/microk8s/ufw.yml index b7c7527..d55a81b 100644 --- a/ansible/roles/microk8s/tasks/microk8s/ufw.yml +++ b/ansible/roles/microk8s/tasks/microk8s/ufw.yml @@ -6,7 +6,7 @@ interface: "{{ item }}" comment: ansible managed with_items: - - "{{ k8s_net_devices }}" + - "{{ microk8s_net_devices }}" retries: 5 delay: 10 @@ -18,7 +18,7 @@ interface: "{{ item }}" comment: ansible managed with_items: - - "{{ k8s_net_devices }}" + - "{{ microk8s_net_devices }}" retries: 5 delay: 10 @@ -31,7 +31,7 @@ proto: "{{ item.proto }}" comment: ansible managed with_items: - - "{{ k8s_incoming_traffic }}" + - "{{ microk8s_incoming_traffic }}" retries: 5 delay: 10 @@ -43,7 +43,7 @@ direction: out comment: ansible managed with_items: - - "{{ k8s_outgoing_traffic }}" + - "{{ microk8s_outgoing_traffic }}" retries: 5 delay: 10 @@ -56,6 +56,6 @@ proto: tcp comment: ansible managed with_items: - - "{{ k8s_allowed_hosts }}" + - "{{ microk8s_allowed_hosts }}" retries: 5 delay: 10 diff --git a/ansible/roles/microk8s/tasks/setupenv/main.yml b/ansible/roles/microk8s/tasks/setupenv/main.yml index 05f3866..78aa1a8 100644 --- a/ansible/roles/microk8s/tasks/setupenv/main.yml +++ b/ansible/roles/microk8s/tasks/setupenv/main.yml @@ -36,7 +36,7 @@ ignore_errors: true - name: Configure user access - when: item.enabled and secret_exists.stdout != "0" + when: item.enabled and secret_exists.stdout != "0" and secret_exists.stdout != "" block: - name: Get the secret name ansible.builtin.shell: | diff --git a/ansible/roles/virtualization/molecule/default/molecule.yml b/ansible/roles/virtualization/molecule/default/molecule.yml index f9d54f3..d873be3 100644 --- a/ansible/roles/virtualization/molecule/default/molecule.yml +++ b/ansible/roles/virtualization/molecule/default/molecule.yml @@ -15,11 +15,11 @@ provisioner: inventory: group_vars: all: - ssh_allowed_zones: + geoip_ssh_allowed_zones: - "ALL" - ssh_allowed_networks: + geoip_ssh_allowed_networks: - "0.0.0.0/0" - host_vars: {} + host_vars: {} platforms: - name: jammy box: "jaredeh/ubuntu2204-server" @@ -38,12 +38,12 @@ platforms: config_options: vm.boot_timeout: 600 ssh.keep_alive: yes - ssh.remote_user: 'ansible' + ssh.remote_user: "ansible" synced_folder: true provider_options: - video_type: 'vga' - host: 'localhost' - uri: 'qemu:///system' + video_type: "vga" + host: "localhost" + uri: "qemu:///system" nested: true memory: 4096 verifier: @@ -52,4 +52,4 @@ lint: | set -e ansible-lint scenario: - name: default \ No newline at end of file + name: default diff --git a/ansible/sectool.env b/ansible/sectool.env index 85c7294..766eecb 100644 --- a/ansible/sectool.env +++ b/ansible/sectool.env @@ -6,3 +6,4 @@ USER_PASSWORD_SALT=$USER_PASSWORD_SALT USER_PASSWORD_OPERATOR=$USER_PASSWORD_OPERATOR ANSIBLE_FORCE_COLOR=True BUCKET_SUFFIX=$BUCKET_SUFFIX +MICROK8S_ENCRYPTION_SECRET=$MICROK8S_ENCRYPTION_SECRET diff --git a/repository.vault b/repository.vault index 030cb64..d4b7b89 100644 --- a/repository.vault +++ b/repository.vault @@ -1 +1 @@ -bCt1NV1R5FDMa9kEhZTJVefbnHPE4zqzKrfwqkqxoO1JVIkMsnAQCr79i4TeMme4wRop+GX08GkJQq5gp8nLSnz5r+y+RckUVTuA1LMg4mEuwVkQ8lyy9lMY3K/KHtzjRAfR2zlOZ+V02BelHos1KApzdoMfWg5SsLqntvxkexXiZH7Z6BahniWLldC3mE9lBwuTU8epJS0v9ngerj+MMK9DwSHvPHrCs6iGbHVo18iboO561mnvLVV6YOQ7ub3oTwYmGaYmWvn+vRVpFQmLw7Cp9T2IwLdadgcLoKrbzLf6ee8wo0IBW765d16krBh1L7p2tpHcyIUE9gTCkylXVApX3oslQlgtzMoTOaWZ6hmjP0rD8kzn6XceFcpx1dEOd5a9j+tb4EIP0HJoFVdGb/MQnmmumyla+aGJY0VtHbx3b2TICvgwr45RUHRKDI1UgA02rXKeklfcXvoOpq5kweV4DxckElzLjGohZHESWdbY1y2knMVIuCImRv01jbP1rwrwdKt1LGlWBX5OsOujS5qxBeHZNqnKrLbn1mkM1k5PtCnfLfn0NINA/lEs+VDK84RMmzz+s9rAyGNkTJpnbjfU2xhy0IQrXRJf+DGpCkhKRjzBLLnzwfeB5Ki6tjfFygphhkKMAofQ3wlpQ8ppMt93eZ5LONQg3ttdja41uPnPV68dgGhv92Rtx+ByisEhsoIAu2wJZ+jKPTCiVpru46dQDEwf7rGFu+RXK94LG7wg6YA2yJz3QooHcAPFvxaKCfnrfB9oY/qbElueZyvZr1unfE4BigHIfPkf4gRDVq8GiqRiypP+/Cxio1Wc3sLLJkOQmHW0+ZDeoqxHEsRfjHbb00FP+7QtFG2v7wJNH6FZxpDz/vRpoZRe2BlPKLQKbAXVWQHFXgP4Q9NikrQ3o32yMpTeUgSTv8lwk1dvUijEDEweudti3RWAlG6LOj5pYp8z4DY04s8Hz6ZEmYji1LPDl6jsRbjOM1bpZTjORLmYza757KhzMHPbjwUtR+sVfnIjUODVtdOnzRMRzBNufQPat+uHlZ/AxB3Gq+6AX46q6fC/moKu7d5vO2tVgZr8rQuYYa6hclkilp5Tt/WEXQB6EQ1VzDnMAe4AfQVJwNkjw/NXfTSvzro2qreHLNyLbxtgHOEOP1E7lvQqcSM9zm9DUhPx61LDe3WkRBoPcKZr0Lx8LvAwpENNOLyIZ7k5BcJNlhMbO4BPH3HRrDGIM+Bg9x2HkbDaLeBi9A7F2ueACXH+6a/ZqBG8jGBKbcXm3AqHqgYXKNhAwV2NmdV2awePEJ5byb4x2/2flrE4kO3LGIz98KXzBugJsY9+0Ox3V6X6jdHXkG29A5JdcfszhtsBVFQyk73GwZtMJxpTC8QJjykaKx/6lPm5QghbTXxDIHzEPFenUdssLx6JMJRcPWuKDXkK9pRkYamcEgxSjtCHRJI/luhWvSniPka4b5oGssl+VtQXmkpk9ntALUA+2zhhn5Us1AVNkDlPcGxAL+20Kx5K7gJ9RNAYznlZvRAYH4gKjNNOZiu52X4XSTKMaNgvK1bfM66UcslbviEfbUs0IGTT6wf1HrKKENoSb/EdP50hCWV+vOPUYxENS16J+oX2Xw2rz2EYeg0nWVsl2PXctuXlTf4HaVMKdm5XV7uNmla9hchRCUYh6C5jS763HZI0DVgGMPcxraImG0yaBZVT3NEZPeGqplrDrTcesCvGgybgSSjbvVhcMMN7WjlhQeuTvJQhvw8DhYgEyaKnX46DoEm3LKGu6TrA2m2VI7J1BwRAauu7yU0aHkJZ9FfeVZTzKcUy/1Cp+3mW1czego1PPA7TIPkaqT5QCJDB6Jlbk5yEEw1yA/z7H4k/y2h4HSVpG9m9+8ASTvHXwTuvTtvqJp3Xw+e6tXzF8eNXiki7/y3psxfROY3hsidsLg/kAYcOPhYmyQ8vb+gawATbgIf2gp6zRIjBXXmJ5chUzzszP9uxm/va/UE9o2Ntp8907sogYq2xOMPIP9NP30x9YRxsxvYKuzJD6fgEtWLdzy4G77mbsGT3Lajv4I8JKIKTjmOR+ah0GN9xadueTlVVqPXAaSYM40pKXPN9LcVCdYgQj3msV56hFRL0qOKs4gIiqvWD3bgE3bvQdkEThY2XhZ9U0DtIyvIW5Lw+EapzWfFY3TEVzzjxJN0f5lwoRnIOmIO9lJKKN/4ZOAPidZoCfz3HeRtzTRNZyY6WE7STtA05wI/zoV/K6SEeLyod02XfLFIa4TaoZoVpC+g/Kr7bG8TC30eDc31AhhN0Tfj/ID47t4oD6jeS2+3z1Ztn/Kfu63c8oCKp0trDV4SAsWs4qHPDrTDH2aJ6GlZZaaJuw5EBwAPuWqEVdJfr368XUYU506ToCOH3BMtuAuONoiR/wT/W5uei4K3kf+zvC2cOz8vAV+AIRY3yQK3mKg0b33CSE+GtcTpfBP+Q9PvPWL3JuhAap2pqXdEMDYfmV9Jn0h8izOFErVP/odPrvD9J51GenR0EVmsPq7p/DmmQHT7HF5GADEDHdkrwesBurAB5/M63l9WIzXQA8LIX6ksMy5ZLCEfg6IYNKoX/H6c9XXakSEQ6riZdBAXVzoozXEDmHankTPGurD6TEy1H2oFtBiYAB1PCaTJfPOC3iSaGClyQ7baTBTz7IrheaNKy/WT6dk8c7SYToidad3Bx+64zKpNwHP2/KjIUXJqZHSc1BaBdDk1fDHREHLlkHsq2A3rDSYYvhcG8gLLjkfD3lupLWO0kzfoynb/dCdn2HNVUog+/ \ No newline at end of file +FRbk2McaxArlE39vc3B7gyVWhqe8ejiDkZEWShEHC6YXLFYeGWE4EybXOntql6B9RWt3xhqKvpSOoEBlkXW9uB/efH2G1Wv4g5BhG1uwQsFIIfp5oRe2wYVT1p8EcQ59nESaJhk8KrUNFg2pUTyBXmMzMMIJOaO2NDwXX6j+y0fWH+hgjhI5putRK8I5tbMRLLpLH97Q90Ot11XUZPouiQm5wr1emOIZ3626oxAwCO4e6X8YnhuIhLXJgRuSvLnJCq1ClQCwvspPcwHzUZ2/p11eMhsjwbxAr2crUBj3MX1iSllAkA5HAIOkI2XOW58gWMZgHxDhfC/kkKYraEEMeSyVvmpZKnnn7A5xKQV699+TaEpI6sKSqIZbMRjYTuzlDGJRvlg8d5H8JxjLJ1l0wHTIEE0sdLGObaEjL8cRsOeoxBsRnqwwvDo/tS9OfLTt39Py4vylWJeEqLDJXvxKHJ5Dp35gxdEE+DDmS5WzhBUTVivke6pRbD9hHDC6VhwFjnCxh1gSVAsTK6gdn1MHglvAVyQwD1VyTa3+po0gXtVsyCpLv/o1FA/CTeZvc+xY5At2KjlZbo/huhJ96sUPDMlznNDgXJsviM19FH1eNPmCxLnPFx+2a9JPvRUeIrhuizHucBJPdXjyEnaowU/yjBXHh05dUuhClV9i/7dCuohR6kN7tm1RaQtUfjp6yWb9Y6+gZXQI+s0b7ePprrsjRFF8l84Ahvyn503esYAYy6/c/4400N3bIxaZ6AGoYpMuNItQZZsCC6s3hmhXL745AUOmkhwBS5VqXO1iQl71h0FGgPA/XD2ftUSpdH9on9xCCdPooGzR1L+fGLlVQIotb4kdXYJg8uC9nHtHWvQ7cfwBXORHUAQCOO1Qv3vk4G48JVjWvr5G03wtUn7Ph8DLUp2orjzzK4o8pCmHTy2allkYCOEeGZ9GXRKGNPZpjxhi5/lB6oM06urIPWFeQgZGQtt1xWrhmvZnwVEDIcdlWdz68imCBnimrV1eNBpGRiZzW7mKQ2seFWdwCZ3Gpvdco355jbMj7xetAISfaT2dMUH0YSJAp80d7XPXl7eB5nXUIRnqFnQGg5yCeSqpg/5YeLthwMhgylanJN72eVl5yiuWc7fJbJRu2r7cUcXS0WT6yYKcdDjVF0dIj/W44Y7jRjaoZ0zcMaFXlteNlKYpaSLknZ6PaF15G63YifGjHsHreZsXrUrhASBMBWcAiicAoTpEoC9yleZi+pzys8xW3q+zOl2WFOVo9wk3NNrblvL65yjKl0r/A/DMP8k8N7v2+KFeT5qNCKfSaCw1VxKvjPVMQcKnqdE9a7VZVAAQjm35pSA9jKUBJ6rJeNY/xUrvjtfQslKOVlBRQFHEl6mcfSc23fOAqx76AUFdfQWsWG+rrOFrr6Y3HERH/+kEOWHuF6U+vxIrGrJYhF2hkz0wvXE0tni5oi3UZB5b58gd9jQShQIaOwLHco/iJIo1z9aa3rl/wkdjM3OGvubC2gbVeQ1YVgKREH83NaHWxUNDEamuxBHzEL+uNj79uWGLvD9s0wJMD/OD2HXGaUD+yUj3vS11V9XqZ71aNG6qg9I5Pwx50togX9LOfiMemkPuGuN1HscXnVFca+tQ1z+oGrPT4BLVW6LF0DnpooQZmdbYytvMi3O1ZYktvxPQY8UB2Om6fwDwWE5q3Hbyv3ji1c3m4Cnr5SHUeZYl2jujKl5E0Remjz3B3LNGTKncdUq4pW/8qZ8Obz4KXsEgkpNBVJhK1W/8gy/lLEl/Rkr2ustuZnRx8QiGkW13MSRr0r3U/Y94UdzmKrvldsdA1D19EDj+RSHdMzrJd6AHwBIzrqM33gF4SF1nF6tSUqBj2ylnHebU3ynUI5axaU5yfqSduiCPCTylnmYb/AqaMk/hlIIx2M9BTCgfbMNSeDdLDerPSmptM7cQ6GU0W4dZvJSvAy3oloyG9bwTpRMhHzWW059nicJyCCCJMUrpKSRTqJypw8iSa71TtjT9Du5gGsgZHS9ATNOutQ60+9lAEtK6UPEcMU2MNfN+em3m9GxAJ/zorfrdg131Tqu6csZ2lN9M+WxrRaRlGHIS89xgWsOZ3E7EKjGm0RY0yj4e2Z6JPT6KvEMVZS0y23/33GW4SSysfvGKEA4/62IuueyPllrQZZS1qB3BiWHZjUUf+GSFRQlMapOTaEsOUMeny5K9Wgdm0utlrmbTlFdGMCdv/dJ4lb/vUynSVq6BopJ3nUfetxTjOoT/B0fmhvwy6ddYibh3AgCfZD9UHPGbiFum1/9Tbb2MvMM1M6LQ988bcqbFGio9exzgySaWL5lYjQTqCICPn7I4uQRf+rZHUeMfHYXzQbWsfNyRH75NSPakhdVSss1dFtl/d3jGzlb83I5CdbttznSKsGd3bmHimfCodlyJuIjI2XhW7WK6RbeUoRnqKnRNANFTa2BaXDZUCVhpZB4DcMboNisIxNF/QiH+3u+b6ba0xAXtLXNl1gITmA04UG3yTfx44jF9s6Xpt60nEH/oMeW1kiL02oV26BYT9MTx9neh5WMMNLBHhWw/98v0LeJX3imlM7tTjPgF/eE6z12ndeFQrQiFILN3jClbkKwS+yliXCpeO6+akKraSTGUcrUXxWMrfc9xkvR2fjUzWHBSqXSQMFPoJBrYfQbtFuNcGebQwwYmorTpa96p5uE2Ro9goOoeElG1bkCBcyBiXlQJo10/d84YAMQMsDLb2q19GGFT/itiO2scxTwec+8APRE9oL8bMdhOeDA5kOeC/HQaeOKkPEt8K5qALAWTjWHVQTEAOoHdv+HE5g7yacuAAecIodmJQbynQTXi8u27KJJBQOdUblJ8c3u4b5/HnkQLGe2/RYnVv5qhvT/KQNzwXPdXKVfcsE+gyye4Th2WqmI= \ No newline at end of file