diff --git a/ansible/.ansible-lint b/ansible/.ansible-lint index ef6405d..181f3a7 100644 --- a/ansible/.ansible-lint +++ b/ansible/.ansible-lint @@ -4,7 +4,8 @@ exclude_paths: - .github/ - tests/ enable_list: - - fqcn-builtins # opt-in + - fqcn-builtins # opt-in warn_list: - line-length - yaml[line-length] + - var-naming[no-role-prefix] diff --git a/ansible/playbook_cis.yml b/ansible/playbook_cis.yml index a6b6091..f10119e 100644 --- a/ansible/playbook_cis.yml +++ b/ansible/playbook_cis.yml @@ -13,9 +13,6 @@ - roles - roles::users - role: "cis" - vars: - # currently aide is failing - install_aide: false tags: - roles - roles::cis @@ -31,4 +28,3 @@ tags: - roles - roles::duosecurity - diff --git a/ansible/playbook_kvm.yml b/ansible/playbook_kvm.yml deleted file mode 100644 index 1d4f932..0000000 --- a/ansible/playbook_kvm.yml +++ /dev/null @@ -1,36 +0,0 @@ ---- -- name: Virtualization Server - hosts: kvm - gather_facts: true - - roles: - - role: "bootstrap" - tags: - - roles - - roles::bootstrap - - role: "manage_users" - tags: - - roles - - roles::users - - role: "cis_hardening" - vars: - # currently aide is failing - install_aide: false - tags: - - roles - - roles::cis - - role: "fail2ban" - tags: - - roles - - roles::fail2ban - - role: "geoip" - tags: - - roles - - roles::geoip - - role: "duo_security" - tags: - - roles - - roles::duosecurity - - role: "virtualization" - tags: - - role::virtualization diff --git a/ansible/roles/cis/defaults/main/misc.yml b/ansible/roles/cis/defaults/main/misc.yml index 55e3389..1b8cc82 100644 --- a/ansible/roles/cis/defaults/main/misc.yml +++ b/ansible/roles/cis/defaults/main/misc.yml @@ -1,5 +1,5 @@ --- -install_aide: true +install_aide: false reboot_ubuntu: false redhat_signing_keys: - 567E347AD0044ADE55BA8A5F199E2F91FD431D51 @@ -10,4 +10,3 @@ epel8_signing_keys: - 94E279EB8D8F25B21810ADF121EA45AB2F86D6A1 epel9_signing_keys: - FF8AD1344597106ECE813B918A3872BF3228467C -... diff --git a/ansible/roles/microk8s/templates/microk8s.yml.j2 b/ansible/roles/microk8s/templates/microk8s.yml.j2 deleted file mode 100644 index 7782af9..0000000 --- a/ansible/roles/microk8s/templates/microk8s.yml.j2 +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: apiserver.config.k8s.io/v1 -kind: EncryptionConfiguration -resources: - - resources: - - secrets - providers: - - aescbc: - keys: - - name: k8s-crypto - secret: {{ secret }} - - identity: {} diff --git a/ansible/roles/virtualization/.ansible-lint b/ansible/roles/virtualization/.ansible-lint deleted file mode 100644 index ef6405d..0000000 --- a/ansible/roles/virtualization/.ansible-lint +++ /dev/null @@ -1,10 +0,0 @@ ---- -exclude_paths: - - .git/ - - .github/ - - tests/ -enable_list: - - fqcn-builtins # opt-in -warn_list: - - line-length - - yaml[line-length] diff --git a/ansible/roles/virtualization/.yamllint b/ansible/roles/virtualization/.yamllint deleted file mode 100644 index 8827676..0000000 --- a/ansible/roles/virtualization/.yamllint +++ /dev/null @@ -1,33 +0,0 @@ ---- -# Based on ansible-lint config -extends: default - -rules: - braces: - max-spaces-inside: 1 - level: error - brackets: - max-spaces-inside: 1 - level: error - colons: - max-spaces-after: -1 - level: error - commas: - max-spaces-after: -1 - level: error - comments: disable - comments-indentation: disable - document-start: disable - empty-lines: - max: 3 - level: error - hyphens: - level: error - indentation: disable - key-duplicates: enable - line-length: disable - new-line-at-end-of-file: disable - new-lines: - type: unix - trailing-spaces: disable - truthy: disable diff --git a/ansible/roles/virtualization/defaults/main.yml b/ansible/roles/virtualization/defaults/main.yml deleted file mode 100644 index e0ed417..0000000 --- a/ansible/roles/virtualization/defaults/main.yml +++ /dev/null @@ -1,18 +0,0 @@ ---- -# Copyright 2019 Alexandre Pires ( c.alexandre.pires@gmail.com ) -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -libvirt_users: ["{{ ansible_env.SUDO_USER | d('root') }}"] -libvirt_pool__dir: "/srv/pools" -libvirt_ansible__pool__name: "default" diff --git a/ansible/roles/virtualization/molecule/default/INSTALL.rst b/ansible/roles/virtualization/molecule/default/INSTALL.rst deleted file mode 100644 index 0c4bf5c..0000000 --- a/ansible/roles/virtualization/molecule/default/INSTALL.rst +++ /dev/null @@ -1,23 +0,0 @@ -********************************* -Vagrant driver installation guide -********************************* - -Requirements -============ - -* Vagrant -* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop - -Install -======= - -Please refer to the `Virtual environment`_ documentation for installation best -practices. If not using a virtual environment, please consider passing the -widely recommended `'--user' flag`_ when invoking ``pip``. - -.. _Virtual environment: https://virtualenv.pypa.io/en/latest/ -.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site - -.. code-block:: bash - - $ pip install 'molecule_vagrant' diff --git a/ansible/roles/virtualization/molecule/default/converge.yml b/ansible/roles/virtualization/molecule/default/converge.yml deleted file mode 100644 index 8d52260..0000000 --- a/ansible/roles/virtualization/molecule/default/converge.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -- name: Converge - hosts: all - tasks: - - name: Update Package Cache (apt/Ubuntu) - become: true - ansible.builtin.apt: - update_cache: yes - changed_when: false - when: ansible_distribution == "Ubuntu" - - - name: Update Package Cache (dnf/CentOS) - become: true - ansible.builtin.dnf: - update_cache: yes - changed_when: false - when: ansible_distribution == "CentOS" - - - name: Update Package Cache (yum/Amazon) - become: true - ansible.builtin.yum: - update_cache: yes - changed_when: false - when: ansible_distribution == "Amazon" - - - name: "Include virtualization" - ansible.builtin.include_role: - name: "virtualization" diff --git a/ansible/roles/virtualization/molecule/default/molecule.yml b/ansible/roles/virtualization/molecule/default/molecule.yml deleted file mode 100644 index d873be3..0000000 --- a/ansible/roles/virtualization/molecule/default/molecule.yml +++ /dev/null @@ -1,55 +0,0 @@ ---- -dependency: - name: galaxy - enabled: true -driver: - name: vagrant - provider: - name: libvirt -provisioner: - name: ansible - config_options: - defaults: - callbacks_enabled: profile_tasks - log: true - inventory: - group_vars: - all: - geoip_ssh_allowed_zones: - - "ALL" - geoip_ssh_allowed_networks: - - "0.0.0.0/0" - host_vars: {} -platforms: - - name: jammy - box: "jaredeh/ubuntu2204-server" - box_version: "0.1.1" - interfaces: - - auto_config: true - network_name: private_network - type: dhcp - instance_raw_config_args: - # use single quotes to avoid YAML parsing as dict due to ':' - - 'vm.synced_folder ".", "/vagrant", type: "rsync"' - # Run 'uname' a provisionning step **needs 'provision: true' to work** - - 'vm.provision :shell, inline: "uname"' - # Dictionary of `config` options. Note that string values need to be - # explicitly enclosed in quotes. - config_options: - vm.boot_timeout: 600 - ssh.keep_alive: yes - ssh.remote_user: "ansible" - synced_folder: true - provider_options: - video_type: "vga" - host: "localhost" - uri: "qemu:///system" - nested: true - memory: 4096 -verifier: - name: ansible -lint: | - set -e - ansible-lint -scenario: - name: default diff --git a/ansible/roles/virtualization/molecule/default/verify.yml b/ansible/roles/virtualization/molecule/default/verify.yml deleted file mode 100644 index e707420..0000000 --- a/ansible/roles/virtualization/molecule/default/verify.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -# This is an example playbook to execute Ansible tests. - -- name: Verify - hosts: all - gather_facts: false - tasks: - - name: Example assertion - ansible.builtin.assert: - that: true diff --git a/ansible/roles/virtualization/requirements.yml b/ansible/roles/virtualization/requirements.yml deleted file mode 100644 index 04fb28e..0000000 --- a/ansible/roles/virtualization/requirements.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -collections: - - community.general - - community.libvirt diff --git a/ansible/roles/virtualization/tasks/init.yml b/ansible/roles/virtualization/tasks/init.yml deleted file mode 100644 index cba6e55..0000000 --- a/ansible/roles/virtualization/tasks/init.yml +++ /dev/null @@ -1,14 +0,0 @@ -- name: Ubuntu specific tasks - when: ansible_distribution == 'Ubuntu' - block: - - name: Update APT cache - become: true - ansible.builtin.apt: - update_cache: yes - cache_valid_time: 3600 - - - name: Install Dependencies - become: true - ansible.builtin.package: - pkg: "python3-pip" - state: present diff --git a/ansible/roles/virtualization/tasks/install.yml b/ansible/roles/virtualization/tasks/install.yml deleted file mode 100644 index bf85f25..0000000 --- a/ansible/roles/virtualization/tasks/install.yml +++ /dev/null @@ -1,25 +0,0 @@ - -- name: Install system packages for virtualization - become: true - ansible.builtin.package: - pkg: "{{ item }}" - state: present - loop: - - qemu-kvm - - libvirt-daemon-system - - virtinst - - libvirt-clients - - bridge-utils - - python3-libvirt - - dnsmasq - - qemu-utils - - bzip2 - - libxml2-utils - -- name: Install PIP packages for virtualization - become: true - ansible.builtin.pip: - name: "{{ item }}" - state: present - loop: - - lxml diff --git a/ansible/roles/virtualization/tasks/main.yml b/ansible/roles/virtualization/tasks/main.yml deleted file mode 100644 index 77bb48b..0000000 --- a/ansible/roles/virtualization/tasks/main.yml +++ /dev/null @@ -1,19 +0,0 @@ ---- -- name: 'Install required packages for virtualization' - ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml" - tags: - - 'role::virtualization' - - 'role::virtualization::install' - -- name: 'Config virtualization support on host' - ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_config.yml" - tags: - - 'role::virtualization' - - 'role::virtualization::config' - -- name: 'Restart and enable/disable virtualization service' - ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_service.yml" - tags: - - 'role::virtualization' - - 'role::virtualization::install' - - 'role::virtualization::service' diff --git a/ansible/roles/virtualization/tasks/manage_config.yml b/ansible/roles/virtualization/tasks/manage_config.yml deleted file mode 100644 index 6cc792e..0000000 --- a/ansible/roles/virtualization/tasks/manage_config.yml +++ /dev/null @@ -1,16 +0,0 @@ -- name: Adding required users to group libvirt - become: true - ansible.builtin.user: - name: "{{ item }}" - groups: - - libvirt - append: true - loop: "{{ libvirt_users }}" - -- name: Fix qemu.conf SE Linux driver - when: ansible_distribution == 'Ubuntu' - become: true - ansible.builtin.lineinfile: - dest: /etc/libvirt/qemu.conf - line: 'security_driver = "none"' - state: present diff --git a/ansible/roles/virtualization/tasks/manage_service.yml b/ansible/roles/virtualization/tasks/manage_service.yml deleted file mode 100644 index b070a67..0000000 --- a/ansible/roles/virtualization/tasks/manage_service.yml +++ /dev/null @@ -1,6 +0,0 @@ -- name: Service enable/disable - become: true - ansible.builtin.service: - name: libvirtd - enabled: yes - state: started \ No newline at end of file