Refactor SSH configuration and playbook execution in ansible-apply.yaml

.github/workflows/ansible-apply.yaml

@@ -78,6 +78,8 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           cd ansible
+          # Currently, the playbook_hardening.yml is failing due to the aide package and UFW
+          # sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_hardening.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml

ansible/playbook_microk8s.yml

@@ -4,33 +4,10 @@
   gather_facts: true
 
   roles:
-    - role: "bootstrap"
-      tags:
-        - roles
-        - roles::bootstrap
     - role: "manage_users"
       tags:
         - roles
         - roles::users
-    - role: "cis_hardening"
-      vars:
-        # currently aide is failing
-        install_aide: false
-      tags:
-        - roles
-        - roles::cis
-    - role: "fail2ban"
-      tags:
-        - roles
-        - roles::fail2ban
-    - role: "geoip"
-      tags:
-        - roles
-        - roles::geoip
-    - role: "duo_security"
-      tags:
-        - roles
-        - roles::duosecurity
     - role: "microk8s"
       tags:
         - role::microk8s

ansible/playbook_nextcloud.yml

@@ -10,9 +10,9 @@
         nextcloud_home: "/var/lib/nextcloud"
         nextcloud_mysql_home: "/var/lib/mysql.nextcloud"
         nextcloud_user_id: 33
-        nextcloud_group_id: 26
+        nextcloud_group_id: 33
-        mysql_user_id: 999
+        mysql_user_id: 0
-        mysql_group_id: 107
+        mysql_group_id: 0
       tags: always
 
     - name: Create required nextcloud data folder
@@ -32,7 +32,7 @@
       ansible.builtin.file:
         state: directory
         path: "{{ nextcloud_mysql_home }}"
-        mode: "0750"
+        mode: "0755"
         owner: "{{ mysql_user_id }}"
         group: "{{ mysql_group_id }}"
       tags: