Refactor requirements-dev.txt and remove molecule-vagrant

ansible/Vagrantfile

@@ -1,54 +0,0 @@
-Vagrant.require_version ">= 1.8.0"
-
-Vagrant.configure(2) do |config|
-
-  config.vm.define "jammy.simple_server" do |web|
-    config.vm.box = "jaredeh/ubuntu2204-server"
-    config.vm.box_version = "0.1.1"
-
-    config.vm.provider :libvirt do |libvirt|
-      libvirt.video_type = 'vga'
-      libvirt.host = 'localhost'
-      libvirt.uri = 'qemu:///system'
-      libvirt.nested = false
-      libvirt.memory = 4096
-      libvirt.cpus = 4
-      libvirt.cpuset = '1-4,^3,6'
-      libvirt.cputopology :sockets => '2', :cores => '2', :threads => '1'
-    end
-
-    config.vm.provision "ansible" do |ansible|
-      ansible.playbook = "playbooks/simple_server.yml"
-      ansible.groups = { "vagrant" => ["jammy.simple_server"] }    
-      ansible.extra_vars = {
-        target: "jammy.simple_server",
-      }
-    end
-  end
-
-  config.vm.define "jammy.virtualization_server" do |web|
-    config.vm.box = "jaredeh/ubuntu2204-server"
-    config.vm.box_version = "0.1.1"
-
-    config.vm.provider :libvirt do |libvirt|
-      libvirt.video_type = 'vga'
-      libvirt.host = 'localhost'
-      libvirt.uri = 'qemu:///system'
-      libvirt.nested = true
-      libvirt.memory = 4096
-      libvirt.cpus = 4
-      libvirt.cpuset = '1-4,^3,6'
-      libvirt.cputopology :sockets => '2', :cores => '2', :threads => '1'
-    end
-
-    config.vm.provision "ansible" do |ansible|
-      ansible.playbook = "playbooks/virtualization_server.yml"
-      ansible.groups = { "vagrant" => ["jammy.virtualization_server"] }    
-      ansible.extra_vars = {
-        target: "jammy.virtualization_server",
-      }
-    end
-  end
-
-
-end

ansible/host_vars/contabo01.a13labs.pt.yml

@@ -92,7 +92,7 @@ unattended_reboot_time: "04:30"
 encryption_volumes:
   - name: "microk8s_config"
     size: "0.1G"
-    key_file_url: https://a13labs-infra-53d7as6g1sh19k.s3.fr-par.scw.cloud/keys/00_50_56_52_8c_74.key
+    key_server: https://a13labs-infra-53d7as6g1sh19k.s3.fr-par.scw.cloud/keys
     fetch_key_service_before: snap.microk8s.daemon-kubelite.service
     fetch_key_service_after: network-online.target
     fetch_key_service_wantedby: snap.microk8s.daemon-kubelite.service
@@ -100,7 +100,7 @@ encryption_volumes:
     mount_service_wantedby: snap.microk8s.daemon-kubelite.service
   - name: "microk8s_persistent"
     size: "150G"
-    key_file_url: https://a13labs-infra-53d7as6g1sh19k.s3.fr-par.scw.cloud/keys/00_50_56_52_8c_74.key
+    key_server: https://a13labs-infra-53d7as6g1sh19k.s3.fr-par.scw.cloud/keys
     fetch_key_service_before: snap.microk8s.daemon-kubelite.service
     fetch_key_service_after: network-online.target
     fetch_key_service_wantedby: snap.microk8s.daemon-kubelite.service

ansible/host_vars/jammy.simple_server.yml

@@ -1,3 +0,0 @@
-# Hostname and other host settings
-hostname: jammy.local
-

ansible/host_vars/jammy.virtualization_server.yml

@@ -1,3 +0,0 @@
-# Hostname and other host settings
-hostname: jammy.local
-

ansible/roles/cis/molecule/default/converge.yml

@@ -3,6 +3,6 @@
   hosts: all
   any_errors_fatal: true
   tasks:
-    - name: "Include cis_hardening"
+    - name: "Include cis"
       ansible.builtin.include_role:
-        name: "cis_hardening"
+        name: "cis"

ansible/roles/cis/molecule/default/molecule.yml

@@ -3,9 +3,12 @@ dependency:
   name: galaxy
   enabled: true
 driver:
-  name: vagrant
+  name: podman
-  provider:
+platforms:
-    name: libvirt
+  - name: instance
+    image: ubuntu:20.04
+    pre_build_image: true
+    privileged: true
 provisioner:
   name: ansible
   config_options:
@@ -19,71 +22,8 @@ provisioner:
         ssh_allowed_networks: "0.0.0.0/0"
         sshd_allow_groups: "vagrant sudo"
         suid_sgid_permissions: false
-platforms:
-  - name: jammy
-    box: "jaredeh/ubuntu2204-server"
-    box_version: "0.1.1"
-    interfaces:
-      - auto_config: true
-        network_name: private_network
-        type: dhcp
-    instance_raw_config_args:
-      # use single quotes to avoid YAML parsing as dict due to ':'
-      - 'vm.synced_folder ".", "/vagrant", type: "rsync"'
-      # Run 'uname' a provisionning step **needs 'provision: true' to work**
-      - 'vm.provision :shell, inline: "uname"'
-    # Dictionary of `config` options. Note that string values need to be
-    # explicitly enclosed in quotes.
-    config_options:
-      vm.boot_timeout: 600
-      ssh.keep_alive: true
-      ssh.remote_user: 'ansible'
-      synced_folder: true
-    provider_options:
-      video_type: 'vga'
-      host: 'localhost'
-      uri: 'qemu:///system'
-    memory: 4096
 verifier:
   name: ansible
 lint: |
   set -e
   ansible-lint
-scenario:
-  name: default
-  create_sequence:
-    - dependency
-    - create
-    - prepare
-  check_sequence:
-    - dependency
-    - cleanup
-    - destroy
-    - create
-    - prepare
-    - converge
-    - check
-    - destroy
-  converge_sequence:
-    - dependency
-    - create
-    - prepare
-    - converge
-  destroy_sequence:
-    - dependency
-    - cleanup
-    - destroy
-  test_sequence:
-    - dependency
-    - lint
-    - cleanup
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    - idempotence
-    - side_effect
-    - verify
-    - cleanup
-    - destroy

ansible/roles/cis/molecule/default/prepare.yml

@@ -0,0 +1,10 @@
+---
+- name: Prepare
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Update cache # noqa no-changed-when
+      ansible.builtin.raw: apt update
+
+    - name: Install required packages # noqa no-changed-when
+      ansible.builtin.raw: apt install -y python3 sudo cron kmod

ansible/roles/cis/molecule/redhat/molecule.yml

@@ -1,76 +0,0 @@
----
-# https://access.redhat.com/solutions/253273
-# sudo subscription-manager register --username=USER --password=PASSWORD --auto-attach
-# sudo subscription-manager unregister
-dependency:
-  name: galaxy
-  enabled: true
-driver:
-  name: vagrant
-  provider:
-    name: virtualbox
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      callbacks_enabled: profile_tasks
-  playbooks:
-    converge: ../default/converge.yml
-    verify: ../default/verify.yml
-  log: true
-  inventory:
-    host_vars:
-      redhat:
-        ssh_allowed_networks: "0.0.0.0/0"
-        sshd_allow_groups: "vagrant sudo"
-platforms:
-  - name: redhat
-    box: "generic/rhel8"
-    config_options:
-      vm.boot_timeout: 600
-    instance_raw_config_args:
-      - 'vbguest.auto_update = false'
-    memory: 1024
-verifier:
-  name: ansible
-lint: |
-  set -e
-  ansible-lint
-scenario:
-  name: redhat
-  create_sequence:
-    - dependency
-    - create
-    - prepare
-  check_sequence:
-    - dependency
-    - cleanup
-    - destroy
-    - create
-    - prepare
-    - converge
-    - check
-    - destroy
-  converge_sequence:
-    - dependency
-    - create
-    - prepare
-    - converge
-  destroy_sequence:
-    - dependency
-    - cleanup
-    - destroy
-  test_sequence:
-    - dependency
-    - lint
-    - cleanup
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    - idempotence
-    - side_effect
-    - verify
-    - cleanup
-    - destroy

ansible/roles/cis/molecule/ubuntu/molecule.yml

@@ -1,113 +0,0 @@
----
-dependency:
-  name: galaxy
-  enabled: true
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      callbacks_enabled: profile_tasks
-  playbooks:
-    converge: ../default/converge.yml
-    verify: ../default/verify.yml
-  log: true
-  inventory:
-    host_vars:
-      jammy:
-        ssh_allowed_networks: "0.0.0.0/0"
-        sshd_allow_groups: "vagrant sudo"
-platforms:
-  - name: focal
-    box: "jaredeh/ubuntu2004-server"
-    box_version: "0.1.5"
-    interfaces:
-      - auto_config: true
-        network_name: private_network
-        type: dhcp
-    instance_raw_config_args:
-      # use single quotes to avoid YAML parsing as dict due to ':'
-      - 'vm.synced_folder ".", "/vagrant", type: "rsync"'
-      # Run 'uname' a provisionning step **needs 'provision: true' to work**
-      - 'vm.provision :shell, inline: "uname"'
-    # Dictionary of `config` options. Note that string values need to be
-    # explicitly enclosed in quotes.
-    config_options:
-      vm.boot_timeout: 600
-      ssh.keep_alive: true
-      ssh.remote_user: 'ansible'
-      synced_folder: true
-    provider_options:
-      video_type: 'vga'
-      host: 'localhost'
-      uri: 'qemu:///system'
-    memory: 4096
-  - name: jammy
-    box: "techchad2022/ubuntu2204"
-    interfaces:
-      - auto_config: true
-        network_name: private_network
-        type: dhcp
-    instance_raw_config_args:
-      # use single quotes to avoid YAML parsing as dict due to ':'
-      - 'vm.synced_folder ".", "/vagrant", type: "rsync"'
-      # Run 'uname' a provisionning step **needs 'provision: true' to work**
-      - 'vm.provision :shell, inline: "uname"'
-    # Dictionary of `config` options. Note that string values need to be
-    # explicitly enclosed in quotes.
-    config_options:
-      vm.boot_timeout: 600
-      ssh.keep_alive: true
-      ssh.remote_user: 'ansible'
-      synced_folder: true
-    provider_options:
-      video_type: 'vga'
-      host: 'localhost'
-      uri: 'qemu:///system'
-    memory: 4096
-verifier:
-  name: ansible
-lint: |
-  set -e
-  ansible-lint
-scenario:
-  name: ubuntu
-  create_sequence:
-    - dependency
-    - create
-    - prepare
-  check_sequence:
-    - dependency
-    - cleanup
-    - destroy
-    - create
-    - prepare
-    - converge
-    - check
-    - destroy
-  converge_sequence:
-    - dependency
-    - create
-    - prepare
-    - converge
-  destroy_sequence:
-    - dependency
-    - cleanup
-    - destroy
-  test_sequence:
-    - dependency
-    - lint
-    - cleanup
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    - idempotence
-    - side_effect
-    - verify
-    - cleanup
-    - destroy

ansible/roles/cis/tasks/sysctl.yml

@@ -19,7 +19,7 @@
     state: present
     sysctl_set: true
     sysctl_file: "{{ sysctl_conf_dir }}/zz-hardening.conf"
-  when: system_has_ipv6
+  when: ansible_default_ipv4 is defined and system_has_ipv6
   tags:
     - ipv6
     - sysctl
@@ -91,4 +91,3 @@
     - CIS-UBUNTU2004-3.3.9
     - UBTU-20-010412
     - UBTU-20-010448
-...

ansible/roles/encryption/files/open_volume

@@ -1,6 +1,6 @@
 #!/bin/bash
 if [ "$#" -ne 3 ]; then
-    echo "Usage: $0 <keyserver>"
+    echo "Usage: $0 <keyserver>" "<image>" "<device>"
     exit 1
 fi
 
@@ -9,19 +9,19 @@ IMAGE=$2
 DEVICE=$3
 
 if [ ! -e $IMAGE ]; then
-    logger "open_volume: Image file not found"
+    logger "open_volume: ($DEVICE) Image file not found"
     exit 1
 fi
 
 # if keyserver is not reachable, exit
 if ! curl -s -I $KEYSERVER > /dev/null; then
-    logger "open_volume: Key server not reachable, exiting."
+    logger "open_volume: ($DEVICE) Key server not reachable, exiting."
     exit 1
 fi
 
 # If device is already open, exit
 if [ -e /dev/mapper/$DEVICE ]; then
-    echo "open_volume: Device already open, exiting."
+    echo "open_volume: ($DEVICE) Device already open, exiting."
     exit 1
 fi
 
@@ -30,21 +30,21 @@ uuid+=$(ip link show eth0 | grep ether | awk '{print $2}')
 uuid+=$(sudo dmidecode -s system-uuid)
 KEYID=$(echo -n "$uuid" | md5sum | awk '{print $1}')
 
-logger "open_volume: Downloading key from key server,"
+logger "open_volume: ($DEVICE) Downloading key from key server,"
 LOCALKEYFILE=$(mktemp)
 curl -s -o $LOCALKEYFILE $KEYSERVER/$KEYID
 if [ $? -ne 0 ]; then
-    logger "open_volume: Failed to download key from key server"
+    logger "open_volume: ($DEVICE) Failed to download key from key server"
     rm $LOCALKEYFILE
     exit 1
 fi
-logger "open_volume: Key downloaded successfully, opening volume"
+logger "open_volume:'$DEVICE' Key downloaded successfully, opening volume"
 /usr/sbin/cryptsetup luksOpen $IMAGE $DEVICE -d $LOCALKEYFILE
 if [ $? -ne 0 ]; then
-    logger "open_volume: Failed to open volume"
+    logger "open_volume: ($DEVICE) Failed to open volume"
     rm $LOCALKEYFILE
     exit 1
 fi
-logger "open_volume: Volume opened successfully, removing key file"
+logger "open_volume: ($DEVICE) Volume opened successfully, removing key file"
 rm $LOCALKEYFILE
 exit 0

ansible/roles/encryption/tasks/volume.yml

@@ -1,10 +1,10 @@
 - name: Check for required variables
   ansible.builtin.fail:
-    msg: "The following variables are required: size, name, key_file_url, mount_point"
+    msg: "The following variables are required: size, name, key_server, mount_point"
   when:
     - item.size is not defined
     - item.name is not defined
-    - item.key_file_url is not defined
+    - item.key_server is not defined
     - item.mount_point is not defined
 
 - name: Set required facts
@@ -12,7 +12,7 @@
     encryption_volumes_path: "{{ encryption_volumes_path | default('/var/lib/encrypted_volumes') }}"
     size: "{{ item.size | default(encryption_volumes_default_size) }}"
     fstype: "{{ item.fstype | default('ext4') }}"
-    key_file_url: "{{ item.key_file_url }}"
+    key_server: "{{ item.key_server }}"
     key_file_path: "{{ ansible_env.TMPDIR }}/{{ item.name }}.key"
     disk_image_path: "{{ encryption_volumes_path }}/{{ item.name }}.img"
     device_name: "{{ item.name }}_luks"
@@ -41,9 +41,14 @@
   when: disk_image is changed
   become: true
   block:
+    - name: Read system id
+      ansible.builtin.command: |
+        read_system_id
+      register: system_id
+
     - name: Download key file from Key server
       ansible.builtin.uri:
-        url: "{{ key_file_url }}"
+        url: "{{ key_server }}/{{ system_id.stdout }}"
         dest: "{{ key_file_path }}"
         mode: "0600"
       args:
@@ -95,9 +100,7 @@
       [Service]
       Type=oneshot
       RemainAfterExit=true
-      ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}"
+      ExecStart=/usr/local/bin/open_volume "{{ key_server }}" {{ disk_image_path }} {{ device_name }}
-      ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ device_name }} -d {{ key_file_path }}
-      ExecStartPost=/bin/rm -f {{ key_file_path }}
       ExecStop=/usr/sbin/cryptsetup close {{ device_name }}
 
       [Install]

ansible/roles/geoip/molecule/default/INSTALL.rst

@@ -1,23 +0,0 @@
-*********************************
-Vagrant driver installation guide
-*********************************
-
-Requirements
-============
-
-* Vagrant
-* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
-
-Install
-=======
-
-Please refer to the `Virtual environment`_ documentation for installation best
-practices. If not using a virtual environment, please consider passing the
-widely recommended `'--user' flag`_ when invoking ``pip``.
-
-.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
-.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
-
-.. code-block:: bash
-
-    $ pip install 'molecule_vagrant'

requirements-dev.txt

@@ -2,7 +2,6 @@ ansible
 ansible-lint
 molecule
 molecule-podman
-molecule-vagrant
 ansible-playbook-grapher
 passlib
 pytest-molecule