Refactor AIDE configuration and add exclusion paths

ansible/host_vars/contabo01.a13labs.pt.yml

@@ -84,6 +84,13 @@ fail2ban_jails:
     findtime: 600
     bantime: 3600
 
+# aide
+install_aide: true
+aide_exclude:
+  - "!/var/lib/snapd"
+  - "!/mnt/microk8s_persistent"
+  - "!/var/lib/encrypted_volumes"
+
 # Unattended upgrades
 unattended_reboot: true
 unattended_reboot_time: "04:30"

ansible/roles/cis/defaults/main/aide.yml

@@ -0,0 +1,10 @@
+install_aide: true
+aide_exclude: []
+_default_aide_exclude:
+  - "!/var/lib/docker"
+  - "!/var/lib/lxcfs"
+  - "!/var/lib/private/systemd"
+  - "!/var/log/audit"
+  - "!/var/log/journal"
+
+_aide_exclude: "{{ _default_aide_exclude + aide_exclude }}"

ansible/roles/cis/defaults/main/misc.yml

@@ -1,5 +1,4 @@
 ---
-install_aide: false
 reboot_ubuntu: false
 redhat_signing_keys:
   - 567E347AD0044ADE55BA8A5F199E2F91FD431D51

ansible/roles/cis/tasks/aide.yml

@@ -69,11 +69,9 @@
     backup: true
     insertafter: EOF
     block: |
-      !/var/lib/docker
+      {% for exclude in _aide_exclude %}
-      !/var/lib/lxcfs
+      {{ exclude }}
-      !/var/lib/private/systemd
+      {% endfor %}
-      !/var/log/audit
-      !/var/log/journal
   when: ansible_os_family == "Debian"
   tags:
     - aide

ansible/roles/cis/tasks/main.yml

@@ -221,6 +221,13 @@
   tags:
     - roles::cis::extras
 
+- name: Configure aide
+  ansible.builtin.include_tasks: aide.yml
+  when: install_aide
+  tags:
+    - roles::cis::aide
+
+
 - name: Miscellaneous tasks after all handlers
   ansible.builtin.include_tasks: post.yml
   tags:

terraform/k8sapps/chronograf.tf

@@ -145,7 +145,7 @@ resource "kubernetes_deployment" "chronograf" {
         volume {
           name = "persistent-storage"
           host_path {
-            path = "/mnt/microk8s_persistent/chronograf.data"
+            path = "${local.persistent_folder}/chronograf.data"
           }
         }
         volume {

terraform/k8sapps/config.tf

@@ -44,6 +44,9 @@ locals {
   # notification
   scaleway_smtp_host = "smtp.tem.scw.cloud"
   scaleway_smtp_port = 587
+
+  # storage
+  persistent_folder = "/mnt/microk8s_persistent"
 }
 
 data "scaleway_account_project" "default" {

terraform/k8sapps/gitea.tf

@@ -37,8 +37,8 @@ locals {
     }
   }
 
-  gitea_path       = "/mnt/microk8s_persistent/gitea"
+  gitea_path       = "${local.persistent_folder}/gitea"
-  gitea_mysql_path = "/mnt/microk8s_persistent/mysql.gitea"
+  gitea_mysql_path = "${local.persistent_folder}/mysql.gitea"
 }
 
 #
@@ -108,8 +108,9 @@ module "gitea_backup" {
   secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
   bucket_name              = scaleway_object_bucket.backup.name
 
-  retention_days = local.local_backup_retention_days
+  retention_days    = local.local_backup_retention_days
-  cron_schedule  = local.gitea_files_backup_cron_schedule
+  cron_schedule     = local.gitea_files_backup_cron_schedule
+  host_storage_path = local.persistent_folder
 }
 
 # 

terraform/k8sapps/m3uproxy.tf

@@ -1,5 +1,5 @@
 locals {
-  m3uproxy_path       = "/mnt/microk8s_persistent/m3uproxy"
+  m3uproxy_path       = "${local.persistent_folder}/m3uproxy"
   m3uproxy_cache_path = "${local.m3uproxy_path}/cache"
   squid_app_path      = "${local.m3uproxy_path}/squid"
   geoip_path          = "${local.m3uproxy_path}/geoip"

terraform/k8sapps/modules/k8s_mariadb/variables.tf

@@ -24,7 +24,6 @@ variable "app_password" {
 
 variable "host_storage_path" {
   description = "host storage path"
-  default     = "/srv"
   type        = string
 }
 

terraform/k8sapps/modules/scw_backup_job/variables.tf

@@ -39,7 +39,6 @@ variable "cron_schedule" {
 
 variable "host_storage_path" {
   description = "Host path"
-  default     = "/var/lib"
   type        = string
 }
 

terraform/k8sapps/nextcloud.tf

@@ -74,8 +74,8 @@ locals {
     }
   }
 
-  nextcloud_path       = "/mnt/microk8s_persistent/nextcloud"
+  nextcloud_path       = "${local.persistent_folder}/nextcloud"
-  nextcloud_mysql_path = "/mnt/microk8s_persistent/mysql.nextcloud"
+  nextcloud_mysql_path = "${local.persistent_folder}/mysql.nextcloud"
 }
 
 #
@@ -170,8 +170,9 @@ module "nextcloud_backup" {
   secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
   bucket_name              = scaleway_object_bucket.backup.name
 
-  retention_days = local.local_backup_retention_days
+  retention_days    = local.local_backup_retention_days
-  cron_schedule  = local.nextcloud_files_backup_cron_schedule
+  cron_schedule     = local.nextcloud_files_backup_cron_schedule
+  host_storage_path = local.persistent_folder
 }
 
 # 

terraform/k8sapps/wordpress.tf

@@ -1,6 +1,6 @@
 locals {
-  wordpress_path       = "/mnt/microk8s_persistent/wordpress"
+  wordpress_path       = "${local.persistent_folder}/wordpress"
-  wordpress_mysql_path = "/mnt/microk8s_persistent/mysql.wordpress"
+  wordpress_mysql_path = "${local.persistent_folder}/mysql.wordpress"
 }
 
 resource "kubernetes_namespace" "wordpress" {
@@ -54,8 +54,9 @@ module "wordpress_backup" {
   secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
   bucket_name              = scaleway_object_bucket.backup.name
 
-  retention_days = local.local_backup_retention_days
+  retention_days    = local.local_backup_retention_days
-  cron_schedule  = local.wordpress_files_backup_cron_schedule
+  cron_schedule     = local.wordpress_files_backup_cron_schedule
+  host_storage_path = local.persistent_folder
 }
 
 #