Refactor AIDE configuration and add exclusion paths

ansible/roles/cis/defaults/main/aide.yml

@@ -0,0 +1,10 @@
+install_aide: true
+aide_exclude: []
+_default_aide_exclude:
+  - "!/var/lib/docker"
+  - "!/var/lib/lxcfs"
+  - "!/var/lib/private/systemd"
+  - "!/var/log/audit"
+  - "!/var/log/journal"
+
+_aide_exclude: "{{ _default_aide_exclude + aide_exclude }}"

ansible/roles/cis/defaults/main/misc.yml

@@ -1,5 +1,4 @@
 ---
-install_aide: false
 reboot_ubuntu: false
 redhat_signing_keys:
   - 567E347AD0044ADE55BA8A5F199E2F91FD431D51

ansible/roles/cis/tasks/aide.yml

@@ -69,11 +69,9 @@
     backup: true
     insertafter: EOF
     block: |
-      !/var/lib/docker
-      !/var/lib/lxcfs
-      !/var/lib/private/systemd
-      !/var/log/audit
-      !/var/log/journal
+      {% for exclude in _aide_exclude %}
+      {{ exclude }}
+      {% endfor %}
   when: ansible_os_family == "Debian"
   tags:
     - aide

ansible/roles/cis/tasks/main.yml

@@ -221,6 +221,13 @@
   tags:
     - roles::cis::extras
 
+- name: Configure aide
+  ansible.builtin.include_tasks: aide.yml
+  when: install_aide
+  tags:
+    - roles::cis::aide
+
+
 - name: Miscellaneous tasks after all handlers
   ansible.builtin.include_tasks: post.yml
   tags: