Initial ansible onboard

2024-09-24 15:19:51 +02:00
parent 7366659355
commit f445996797
492 changed files with 2214589 additions and 0 deletions
@@ -0,0 +1,87 @@
+---
+- name: Configure systemd journald.conf
+  become: true
+  ansible.builtin.template:
+    src: etc/systemd/journald.conf.j2
+    dest: /etc/systemd/journald.conf
+    backup: true
+    mode: "0644"
+    owner: root
+    group: root
+  notify:
+    - Reload systemd
+  tags:
+    - systemd
+    - journald
+    - CIS-UBUNTU2004-4.2.2.1
+    - CIS-UBUNTU2004-4.2.2.2
+    - CIS-UBUNTU2004-4.2.2.3
+
+- name: Configure logrotate(8)
+  become: true
+  ansible.builtin.template:
+    src: etc/logrotate.conf.j2
+    dest: /etc/logrotate.conf
+    backup: true
+    mode: "0644"
+    owner: root
+    group: root
+  tags:
+    - logrotate
+
+- name: Configure cron.daily logrotate
+  become: true
+  ansible.builtin.lineinfile:
+    line: "/usr/sbin/logrotate /etc/logrotate.conf"
+    dest: /etc/cron.daily/logrotate
+    mode: "0750"
+    state: present
+    create: true
+  tags:
+    - cron
+    - logrotate
+
+- name: Stat rsyslog.conf
+  become: true
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: rsyslogconf
+  tags:
+    - rsyslog
+
+- name: Stat rsyslog.conf FileCreateMode
+  become: true
+  environment:
+    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+  ansible.builtin.shell: grep "^$FileCreateMode" /etc/rsyslog.conf
+  register: rsyslog_filecreatemode
+  changed_when: false
+  when: rsyslogconf.stat.exists
+  tags:
+    - rsyslog
+
+- name: Configure rsyslog.conf FileCreateMode
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: '^\$FileCreateMode'
+    line: "$FileCreateMode 0600"
+    dest: /etc/rsyslog.conf
+    mode: "0640"
+    state: present
+    create: false
+  when: rsyslogconf.stat.exists and rsyslog_filecreatemode.stdout.find('FileCreateMode') != -1
+  tags:
+    - rsyslog
+    - CIS-UBUNTU2004-4.2.1.4
+
+- name: Add FileCreateMode file to the rsyslog.d directory
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: '^\$FileCreateMode'
+    line: "$FileCreateMode 0600"
+    dest: /etc/rsyslog.d/99-filecreatemode.conf
+    mode: "0644"
+    state: present
+    create: true
+  tags:
+    - rsyslog