From 4de62d73341fbd5a5aa6adf35fee8ba05f1aeac0 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sat, 28 Sep 2024 19:15:56 +0200 Subject: [PATCH 1/7] Add infrastructure bucket for storing assets --- .github/workflows/ansible-apply.yaml | 13 +- .github/workflows/terraform-iac-apply.yaml | 39 ++++++ .github/workflows/terraform-iac-validate.yaml | 47 +++++++ ansible/playbook_encryption.yml | 118 ++++++++++++++++++ ansible/requirements.yml | 1 - ansible/sectool.env | 1 + repository.vault | 2 +- terraform/iac/.vault | 1 + terraform/iac/backend.tf | 7 ++ terraform/iac/buckets.tf | 52 ++++++++ terraform/iac/config.tf | 5 + terraform/iac/contabo.tf | 3 + terraform/iac/provider.tf | 52 ++++++++ terraform/iac/sectool.env | 13 ++ terraform/iac/terraform.rc | 0 terraform/iac/variables.tf | 65 ++++++++++ terraform/k8sapps/backend.tf | 23 +--- 17 files changed, 414 insertions(+), 28 deletions(-) create mode 100644 .github/workflows/terraform-iac-apply.yaml create mode 100644 .github/workflows/terraform-iac-validate.yaml create mode 100644 ansible/playbook_encryption.yml create mode 100644 terraform/iac/.vault create mode 100644 terraform/iac/backend.tf create mode 100644 terraform/iac/buckets.tf create mode 100644 terraform/iac/config.tf create mode 100644 terraform/iac/contabo.tf create mode 100644 terraform/iac/provider.tf create mode 100644 terraform/iac/sectool.env create mode 100644 terraform/iac/terraform.rc create mode 100644 terraform/iac/variables.tf diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 0de8c31..066c28c 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -80,9 +80,10 @@ jobs: SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | cd ansible - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_hardening.yml --skip-tags roles::cis::suid - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_m3uproxy.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_hardening.yml --skip-tags roles::cis::suid + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_wordpress.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_m3uproxy.yml diff --git a/.github/workflows/terraform-iac-apply.yaml b/.github/workflows/terraform-iac-apply.yaml new file mode 100644 index 0000000..5626332 --- /dev/null +++ b/.github/workflows/terraform-iac-apply.yaml @@ -0,0 +1,39 @@ +name: Terraform Apply + +on: + push: + branches: + - main + paths: + - "terraform/iac/**" + - .github/workflows/terraform-iac-apply.yaml + +jobs: + terraform-apply: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v1 + with: + terraform_version: 1.9.6 + + - name: Setup Sectool + uses: a13labs/setup-sectool@v1 + + - name: Terraform Init + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + cd terraform/iac + sectool exec terraform init + + - name: Terraform Apply + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + cd terraform/iac + sectool exec terraform apply --auto-approve diff --git a/.github/workflows/terraform-iac-validate.yaml b/.github/workflows/terraform-iac-validate.yaml new file mode 100644 index 0000000..818e230 --- /dev/null +++ b/.github/workflows/terraform-iac-validate.yaml @@ -0,0 +1,47 @@ +name: Terraform Validate + +on: + pull_request: + branches: + - main + paths: + - "terraform/iac/**" + - .github/workflows/terraform-iac-validate.yaml + types: + - opened + - synchronize + - reopened +jobs: + terraform-validate: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v1 + with: + terraform_version: 1.9.6 + + - name: Setup Sectool + uses: a13labs/setup-sectool@v1 + + - name: Terraform Init + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + cd terraform/iac + sectool exec terraform init + + - name: Terraform Plan + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + cd terraform/iac + sectool exec -n terraform plan -out=tfplan + + - name: Show Terraform Plan + run: | + cd terraform/iac + terraform show tfplan diff --git a/ansible/playbook_encryption.yml b/ansible/playbook_encryption.yml new file mode 100644 index 0000000..b646585 --- /dev/null +++ b/ansible/playbook_encryption.yml @@ -0,0 +1,118 @@ +--- +- name: Create LUKS encrypted file system with key file fetched from HTTP server + hosts: contabo + become: yes + vars: + disk_image_path: /a13labs.img + disk_image_size: 1G + luks_device_name: luks_device + mount_point: /a13labs + key_file_path: /root/luks_keyfile + key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud + key_fetch_service: fetch-a13labs-key.service + + tasks: + - name: Install cryptsetup and curl + apt: + name: + - cryptsetup + - curl + state: present + when: ansible_os_family == 'Debian' + + - name: Create disk image + ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }} + args: + creates: "{{ disk_image_path }}" + register: disk_image + + - name: Create encrypted volume + when: disk_image is changed + block: + - name: Get mac address + ansible.builtin.shell: | + set -o pipefail + ip link show eth0 | awk '/ether/ {print $2}' + args: + executable: /bin/bash + register: mac_address + changed_when: false + + - name: Sanitize mac address + set_fact: + mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '%3A') }}" + changed_when: false + + - name: Create bucket URL + set_fact: + key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key" + changed_when: false + + - name: Download key file from HTTP server + ansible.builtin.uri: + url: "{{ key_file_url }}" + dest: "{{ key_file_path }}" + mode: '0600' + args: + creates: "{{ key_file_path }}" + + - name: Set up LUKS encryption with key file + ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }} + + - name: Open LUKS device with key file + ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }} + register: luks_device + + - name: Delete key file + ansible.builtin.file: + path: "{{ key_file_path }}" + state: absent + + - name: Create file system + ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }} + + - name: Create mount point + file: + path: "{{ mount_point }}" + state: directory + + - name: Mount the file system + ansible.builtin.command: mount /dev/mapper/{{ luks_device_name }} {{ mount_point }} + + - name: Ensure the file system is mounted + mount: + path: "{{ mount_point }}" + src: /dev/mapper/{{ luks_device_name }} + fstype: ext4 + state: mounted + + - name: Create systemd service to fetch key file and open LUKS device + copy: + dest: /etc/systemd/system/{{ key_fetch_service }} + content: | + [Unit] + Description=Fetch LUKS key file from HTTP server and open LUKS device + After=network-online.target + Before=cryptsetup.target + + [Service] + Type=oneshot + ExecStartPre=/usr/bin/curl -o {{ key_file_path }} {{ key_file_url }} + ExecStart=/usr/bin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }} + ExecStartPost=/bin/rm -f {{ key_file_path }} + + [Install] + WantedBy=multi-user.target + + - name: Reload systemd daemon + ansible.builtin.command: systemctl daemon-reload + + - name: Enable the key fetch service + ansible.builtin.command: systemctl enable {{ key_fetch_service }} + + - name: Add entry to /etc/fstab + lineinfile: + path: /etc/fstab + line: "/dev/mapper/{{ luks_device_name }} {{ mount_point }} ext4 defaults 0 2" + create: yes + diff --git a/ansible/requirements.yml b/ansible/requirements.yml index 115ff93..a6b0fd8 100644 --- a/ansible/requirements.yml +++ b/ansible/requirements.yml @@ -2,4 +2,3 @@ collections: - ansible.posix - community.general - - community.libvirt diff --git a/ansible/sectool.env b/ansible/sectool.env index f960350..85c7294 100644 --- a/ansible/sectool.env +++ b/ansible/sectool.env @@ -5,3 +5,4 @@ MAXMIND_LICENSE_KEY=$MAXMIND_LICENSE_KEY USER_PASSWORD_SALT=$USER_PASSWORD_SALT USER_PASSWORD_OPERATOR=$USER_PASSWORD_OPERATOR ANSIBLE_FORCE_COLOR=True +BUCKET_SUFFIX=$BUCKET_SUFFIX diff --git a/repository.vault b/repository.vault index 66be9f3..030cb64 100644 --- a/repository.vault +++ b/repository.vault @@ -1 +1 @@ -lZE/F/Ng+kqQG65u5afRAODt626sHUV/sS13AsWpx6AlWOf40hrq9QNnkjAq1fF8FVctnyY+ltBjwc7fAmvqlwWmbVclahnwQFbgjQ24c6IYuMMmULEy9PN6iPBFH1EstA8lrSVNCz+AN1NR0yxctAMMv7/XoAo6e6nOsn3Ko5F4M57L8QSdoEI/Giz2UvVm46teibFDivnfgjKji3oWO5xIcy7ggZsDF4pYZLci3THfgonoBPZUxyehVl/uyarT0k0LIUD6QUCNXaxxQXa2rDsgyoglLOUZRvitdoThXJsW4VjKYD/joJdR1bELwJ41Nh6IPcWsUSJrEJHhr3IEBMk6DKkC96Ie1kOvW8GkHOKkmFdZkhr2gj9ol6xB8XD/x6K6hZnW/BdJnD3F1JX05km3UHW4uSgvrN1l4x1nNZ5w84BQ/mw1M90ZoiCDjFBtQUOIYciFMQTkbUNnnvDigRXzLhcqxEMJnZ1saz6YXA86WDTxNU5AlOAiwtn4MpO7obXOaiclscB1smpFosjVUqKPpuJrNC5RehhXYVsSdqLk5nRYokv866/RQmXOXzNeig9DrJvj0+Da5kcQ12gWEKr6gSG4O8QLcUcP+YnDtPOaq6OpzEzVmYB9XboOZQyumiUn3QL0jwINBwbNM2GLvXHt5Mmhd16dcHbabZAqLzHRy5T2bh8jhcgRVORem9IOVOSIhCnv7szt+mfEzem5ipUx8dQljOFodNRf5YiJHuWS4yEsbsvV4dLdIqWwMasA1YsOjzRnu5w0AJjd5mo3v9zFW/1kop+tFcsPbglr/Tm9uH9a7D1gZnkZLlUILhC+edRPde5upIyQkrdm7WLECkXsBqQz3QhbcD9BW2krFgvdjyDJYGSpFnXXtsOoo/+NnQd+IRiSe2aevVQH6MrUqfeQ0l/Wxi2cpxTIMLhKnmkRkrSqOn3/EpVL62eJPCmW4OSyCISexIxVvsx72WhvlAMLDXfPxC7zTObUtlrd3w+kzIF8K3ZduRUHWwtCSSekhzTJ3JZyGxKZ88sPfUtk7n1J/lmFVCmHmkuU+Rw21PEVPepPL1tkBURk12uH/+uyRFfR7zFEXXC39nXyKN/Yxa+z0Tdhj2mynLbuZ6ygwfEqXM1hyScqTh1J4z6CDLMelE+kEgvNxG1n8fXC75KPsaxzsqwqlo90CDNNrs2loJrxm3kQcqXxowy/sLtupHpdufEPP6hHnPptqsndmiNiqZjLgmCGuMR3KZBxrv2nsmwdnT4V/aDf80m3lRSuhjZD4zhRIhxsIRKlMjjAi7qgeHFBrOS61J/VVwtzxgLZFfEnPM8M3nf3wh/gAEzTa1uWiJxO26UDUymoW18YWOoIQDn0vjN3acLtGcy+mbjHYWHoJ2So0hjuDJ6ItGKfvrqDwjKX6grGXi955JhVPdR4wh6K+zoYqNS0uFVXc4hJZnr9R7xfPE5QjjNQqJLCZzgkX0sA28qL/5lzzr7XNkfotz0muyvO5OvfBJdcYyjTg5A7fZT0OvbM1dc8pmXzU1+dZnf/ByVemm81rBGBxhlcLIszqGhQzL9Is6dWzHChLA5moQSlKDvcjgUhuB/nV2FKi6kXqp5xU07i1kcbG6b4JL2fA4+ad71odxmE8SYmXt3PZFqJJIAmdVIAXdHeUQZlaA/wEbB9RdlD7XrGVc30BnYg2UA5AO2ijPECuScsZ+QmGBU/pzgp5mLZ691CyvnS9YtDuK3t1c1aNAOMpw9ZLmY5DINzmXuKtLHCw/HCUAH8+Zj94IXJKWYl1CmcxWH2prTDdbjOv5FpckQq04YCykx9qEr8tlq+LBkYB5r7DzzZfemb9YPKapqDXOTJVYBZP35QWPd2xHJVSE9KnYUpgfPxrYpEeJRBvPODOt1pxu+HOiiljSB3H5WBPlS91w1TcQZCE0g9VL+ERmoCOOso0PSI9F2LquLPA6sVlcxMXP9ouZ5BkkSxrOkc/3iLrINHaXRHirfNJLzDePe+xxLJCzXVDeFqUzd8iZO71E5fiGBzwpefnBnfa/bEF/SXfiFl491rYx8Wrur11QmaiHpMPdTsF1YknrE9HU4eYu3wT+7GgeIpX0KN3iT2RFPj9BztT5JBj8LefK3KSzRqc4E3Oak6WEfulkAOguOPJI3FOoXod/trve2kiReSTJlCEcK1FtOStE9yN0vRLM8= \ No newline at end of file +bCt1NV1R5FDMa9kEhZTJVefbnHPE4zqzKrfwqkqxoO1JVIkMsnAQCr79i4TeMme4wRop+GX08GkJQq5gp8nLSnz5r+y+RckUVTuA1LMg4mEuwVkQ8lyy9lMY3K/KHtzjRAfR2zlOZ+V02BelHos1KApzdoMfWg5SsLqntvxkexXiZH7Z6BahniWLldC3mE9lBwuTU8epJS0v9ngerj+MMK9DwSHvPHrCs6iGbHVo18iboO561mnvLVV6YOQ7ub3oTwYmGaYmWvn+vRVpFQmLw7Cp9T2IwLdadgcLoKrbzLf6ee8wo0IBW765d16krBh1L7p2tpHcyIUE9gTCkylXVApX3oslQlgtzMoTOaWZ6hmjP0rD8kzn6XceFcpx1dEOd5a9j+tb4EIP0HJoFVdGb/MQnmmumyla+aGJY0VtHbx3b2TICvgwr45RUHRKDI1UgA02rXKeklfcXvoOpq5kweV4DxckElzLjGohZHESWdbY1y2knMVIuCImRv01jbP1rwrwdKt1LGlWBX5OsOujS5qxBeHZNqnKrLbn1mkM1k5PtCnfLfn0NINA/lEs+VDK84RMmzz+s9rAyGNkTJpnbjfU2xhy0IQrXRJf+DGpCkhKRjzBLLnzwfeB5Ki6tjfFygphhkKMAofQ3wlpQ8ppMt93eZ5LONQg3ttdja41uPnPV68dgGhv92Rtx+ByisEhsoIAu2wJZ+jKPTCiVpru46dQDEwf7rGFu+RXK94LG7wg6YA2yJz3QooHcAPFvxaKCfnrfB9oY/qbElueZyvZr1unfE4BigHIfPkf4gRDVq8GiqRiypP+/Cxio1Wc3sLLJkOQmHW0+ZDeoqxHEsRfjHbb00FP+7QtFG2v7wJNH6FZxpDz/vRpoZRe2BlPKLQKbAXVWQHFXgP4Q9NikrQ3o32yMpTeUgSTv8lwk1dvUijEDEweudti3RWAlG6LOj5pYp8z4DY04s8Hz6ZEmYji1LPDl6jsRbjOM1bpZTjORLmYza757KhzMHPbjwUtR+sVfnIjUODVtdOnzRMRzBNufQPat+uHlZ/AxB3Gq+6AX46q6fC/moKu7d5vO2tVgZr8rQuYYa6hclkilp5Tt/WEXQB6EQ1VzDnMAe4AfQVJwNkjw/NXfTSvzro2qreHLNyLbxtgHOEOP1E7lvQqcSM9zm9DUhPx61LDe3WkRBoPcKZr0Lx8LvAwpENNOLyIZ7k5BcJNlhMbO4BPH3HRrDGIM+Bg9x2HkbDaLeBi9A7F2ueACXH+6a/ZqBG8jGBKbcXm3AqHqgYXKNhAwV2NmdV2awePEJ5byb4x2/2flrE4kO3LGIz98KXzBugJsY9+0Ox3V6X6jdHXkG29A5JdcfszhtsBVFQyk73GwZtMJxpTC8QJjykaKx/6lPm5QghbTXxDIHzEPFenUdssLx6JMJRcPWuKDXkK9pRkYamcEgxSjtCHRJI/luhWvSniPka4b5oGssl+VtQXmkpk9ntALUA+2zhhn5Us1AVNkDlPcGxAL+20Kx5K7gJ9RNAYznlZvRAYH4gKjNNOZiu52X4XSTKMaNgvK1bfM66UcslbviEfbUs0IGTT6wf1HrKKENoSb/EdP50hCWV+vOPUYxENS16J+oX2Xw2rz2EYeg0nWVsl2PXctuXlTf4HaVMKdm5XV7uNmla9hchRCUYh6C5jS763HZI0DVgGMPcxraImG0yaBZVT3NEZPeGqplrDrTcesCvGgybgSSjbvVhcMMN7WjlhQeuTvJQhvw8DhYgEyaKnX46DoEm3LKGu6TrA2m2VI7J1BwRAauu7yU0aHkJZ9FfeVZTzKcUy/1Cp+3mW1czego1PPA7TIPkaqT5QCJDB6Jlbk5yEEw1yA/z7H4k/y2h4HSVpG9m9+8ASTvHXwTuvTtvqJp3Xw+e6tXzF8eNXiki7/y3psxfROY3hsidsLg/kAYcOPhYmyQ8vb+gawATbgIf2gp6zRIjBXXmJ5chUzzszP9uxm/va/UE9o2Ntp8907sogYq2xOMPIP9NP30x9YRxsxvYKuzJD6fgEtWLdzy4G77mbsGT3Lajv4I8JKIKTjmOR+ah0GN9xadueTlVVqPXAaSYM40pKXPN9LcVCdYgQj3msV56hFRL0qOKs4gIiqvWD3bgE3bvQdkEThY2XhZ9U0DtIyvIW5Lw+EapzWfFY3TEVzzjxJN0f5lwoRnIOmIO9lJKKN/4ZOAPidZoCfz3HeRtzTRNZyY6WE7STtA05wI/zoV/K6SEeLyod02XfLFIa4TaoZoVpC+g/Kr7bG8TC30eDc31AhhN0Tfj/ID47t4oD6jeS2+3z1Ztn/Kfu63c8oCKp0trDV4SAsWs4qHPDrTDH2aJ6GlZZaaJuw5EBwAPuWqEVdJfr368XUYU506ToCOH3BMtuAuONoiR/wT/W5uei4K3kf+zvC2cOz8vAV+AIRY3yQK3mKg0b33CSE+GtcTpfBP+Q9PvPWL3JuhAap2pqXdEMDYfmV9Jn0h8izOFErVP/odPrvD9J51GenR0EVmsPq7p/DmmQHT7HF5GADEDHdkrwesBurAB5/M63l9WIzXQA8LIX6ksMy5ZLCEfg6IYNKoX/H6c9XXakSEQ6riZdBAXVzoozXEDmHankTPGurD6TEy1H2oFtBiYAB1PCaTJfPOC3iSaGClyQ7baTBTz7IrheaNKy/WT6dk8c7SYToidad3Bx+64zKpNwHP2/KjIUXJqZHSc1BaBdDk1fDHREHLlkHsq2A3rDSYYvhcG8gLLjkfD3lupLWO0kzfoynb/dCdn2HNVUog+/ \ No newline at end of file diff --git a/terraform/iac/.vault b/terraform/iac/.vault new file mode 100644 index 0000000..7007d14 --- /dev/null +++ b/terraform/iac/.vault @@ -0,0 +1 @@ +../../repository.vault \ No newline at end of file diff --git a/terraform/iac/backend.tf b/terraform/iac/backend.tf new file mode 100644 index 0000000..9848ece --- /dev/null +++ b/terraform/iac/backend.tf @@ -0,0 +1,7 @@ +terraform { + backend "s3" { + bucket = "a13labs.infra" + key = "a13labs-iac.tfstate" + region = "us-east-1" + } +} diff --git a/terraform/iac/buckets.tf b/terraform/iac/buckets.tf new file mode 100644 index 0000000..cd3ffba --- /dev/null +++ b/terraform/iac/buckets.tf @@ -0,0 +1,52 @@ +resource "scaleway_object_bucket" "infra_assets" { + name = "a13labs-infra-${var.bucket_suffix}" + project_id = var.scaleway_project_id + region = "fr-par" +} + +resource "scaleway_object_bucket_policy" "policy" { + bucket = scaleway_object_bucket.infra_assets.name + policy = jsonencode({ + Version = "2023-04-17", + Id = "AllowMachineDownload", + Statement = [ + { + Effect = "Allow" + Action = [ + "s3:ListBucket", + "s3:GetObject", + ] + Principal = "*" + Resource = [ + scaleway_object_bucket.infra_assets.name, + "${scaleway_object_bucket.infra_assets.name}/*", + ] + Condition = { + IpAddress = { + "aws:SourceIp" = local.instance_ips + } + }, + }, + { + Effect = "Allow" + Action = [ + "s3:*", + ] + Principal = { + SCW = "user_id:${var.scaleway_user_id}" + } + Resource = [ + scaleway_object_bucket.infra_assets.name, + "${scaleway_object_bucket.infra_assets.name}/*", + ] + }, + ] + }) +} + +resource "scaleway_object" "encryption_key" { + bucket = scaleway_object_bucket.infra_assets.id + key = "keys/${data.contabo_instance.microk8s.mac_address}.key" + + content_base64 = base64encode(var.encryption_key) +} diff --git a/terraform/iac/config.tf b/terraform/iac/config.tf new file mode 100644 index 0000000..e6e8092 --- /dev/null +++ b/terraform/iac/config.tf @@ -0,0 +1,5 @@ +locals { + instance_ips = [ + "${data.contabo_instance.microk8s.ip_config[0].v4[0].ip}/32", + ] +} diff --git a/terraform/iac/contabo.tf b/terraform/iac/contabo.tf new file mode 100644 index 0000000..a284a36 --- /dev/null +++ b/terraform/iac/contabo.tf @@ -0,0 +1,3 @@ +data "contabo_instance" "microk8s" { + id = "201912751" +} diff --git a/terraform/iac/provider.tf b/terraform/iac/provider.tf new file mode 100644 index 0000000..3a163b7 --- /dev/null +++ b/terraform/iac/provider.tf @@ -0,0 +1,52 @@ + +terraform { + required_version = "~>1.8" + required_providers { + random = { + source = "hashicorp/random" + version = "~>3.4" + } + null = { + source = "hashicorp/null" + version = "~>3.2" + } + external = { + source = "hashicorp/external" + version = "~>2.2" + } + time = { + source = "hashicorp/time" + version = "~>0.9" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = "~>2.18" + } + scaleway = { + source = "scaleway/scaleway" + version = "~>2.13" + } + contabo = { + source = "contabo/contabo" + version = "~>0.1" + } + } +} + + +provider "scaleway" { + zone = "fr-par-2" + region = "fr-par" + access_key = var.scaleway_access_key + secret_key = var.scaleway_secret_key + organization_id = var.scaleway_organization_id +} + + +# Configure your Contabo API credentials +provider "contabo" { + oauth2_client_id = var.contabo_client_id + oauth2_client_secret = var.contabo_client_secret + oauth2_user = var.contabo_api_user + oauth2_pass = var.contabo_api_password +} diff --git a/terraform/iac/sectool.env b/terraform/iac/sectool.env new file mode 100644 index 0000000..cf59094 --- /dev/null +++ b/terraform/iac/sectool.env @@ -0,0 +1,13 @@ +AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY +AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY +TF_VAR_scaleway_access_key=$SCALEWAY_ACCESS_KEY +TF_VAR_scaleway_secret_key=$SCALEWAY_SECRET_KEY +TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID +TF_VAR_scaleway_organization_id=$SCALEWAY_ORGANIZATION_ID +TF_VAR_scaleway_user_id=$SCALEWAY_USER_ID +TF_VAR_contabo_client_id=$CONTABO_CLIENT_ID +TF_VAR_contabo_client_secret=$CONTABO_CLIENT_SECRET +TF_VAR_contabo_api_password=$CONTABO_API_PASSWORD +TF_VAR_contabo_api_user=$CONTABO_USER_NAME +TF_VAR_bucket_suffix=$BUCKET_SUFFIX +TF_VAR_encryption_key=$ENCRYPT_KEY diff --git a/terraform/iac/terraform.rc b/terraform/iac/terraform.rc new file mode 100644 index 0000000..e69de29 diff --git a/terraform/iac/variables.tf b/terraform/iac/variables.tf new file mode 100644 index 0000000..582068b --- /dev/null +++ b/terraform/iac/variables.tf @@ -0,0 +1,65 @@ +variable "scaleway_access_key" { + description = "Scaleway Access key" + type = string + sensitive = true +} + +variable "scaleway_secret_key" { + description = "Scaleway Secret key" + type = string + sensitive = true +} + +variable "scaleway_project_id" { + description = "Scaleway Project Id" + type = string + sensitive = true +} + +variable "scaleway_organization_id" { + description = "Scaleway Organization Id" + type = string + sensitive = true +} + +variable "scaleway_user_id" { + description = "Scaleway User Id" + type = string + sensitive = true +} + + +variable "contabo_client_id" { + description = "Contabo Client ID" + type = string + sensitive = true +} + +variable "contabo_client_secret" { + description = "Contabo Client Secret" + type = string + sensitive = true +} + +variable "contabo_api_password" { + description = "Contabo API Password" + type = string + sensitive = true +} + +variable "contabo_api_user" { + description = "Contabo API User" + type = string +} + +variable "encryption_key" { + description = "Encryption key for sensitive data" + type = string + sensitive = true +} + +variable "bucket_suffix" { + description = "Suffix for bucket names" + type = string + sensitive = true +} diff --git a/terraform/k8sapps/backend.tf b/terraform/k8sapps/backend.tf index 38df914..5f133c7 100644 --- a/terraform/k8sapps/backend.tf +++ b/terraform/k8sapps/backend.tf @@ -1,24 +1,7 @@ -# -# Copyright 2019 Alexandre Pires (alexandre.pires@mov.ai) -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# File: backend.tf - terraform { backend "s3" { - bucket = "a13labs.infra" - key = "scaleway-apps.tfstate" - region = "us-east-1" + bucket = "a13labs.infra" + key = "scaleway-apps.tfstate" + region = "us-east-1" } } From bad166811560ac1ac8c20e69b7359bcb8a112467 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sat, 28 Sep 2024 19:19:18 +0200 Subject: [PATCH 2/7] Refactor Terraform validation workflow to use 'terraform validate' command --- .github/workflows/terraform-iac-validate.yaml | 13 +------------ .github/workflows/terraform-k8apps-validate.yaml | 13 +------------ 2 files changed, 2 insertions(+), 24 deletions(-) diff --git a/.github/workflows/terraform-iac-validate.yaml b/.github/workflows/terraform-iac-validate.yaml index 818e230..b48139a 100644 --- a/.github/workflows/terraform-iac-validate.yaml +++ b/.github/workflows/terraform-iac-validate.yaml @@ -33,15 +33,4 @@ jobs: run: | cd terraform/iac sectool exec terraform init - - - name: Terraform Plan - env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} - run: | - cd terraform/iac - sectool exec -n terraform plan -out=tfplan - - - name: Show Terraform Plan - run: | - cd terraform/iac - terraform show tfplan + terraform validate diff --git a/.github/workflows/terraform-k8apps-validate.yaml b/.github/workflows/terraform-k8apps-validate.yaml index 51c5bc8..3018882 100644 --- a/.github/workflows/terraform-k8apps-validate.yaml +++ b/.github/workflows/terraform-k8apps-validate.yaml @@ -88,15 +88,4 @@ jobs: run: | cd terraform/k8sapps sectool exec terraform init - - - name: Terraform Plan - env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} - run: | - cd terraform/k8sapps - sectool exec -n terraform plan -out=tfplan - - - name: Show Terraform Plan - run: | - cd terraform/k8sapps - terraform show tfplan + terraform validate From 1f060541c33d94f7b5b7da1fbec87daf775ebd94 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sat, 28 Sep 2024 21:27:24 +0200 Subject: [PATCH 3/7] Refactor playbook_microk8s.yml and ansible-apply.yaml Simplify playbook_microk8s.yml by removing duplicate lines and whitespace changes. Update ansible-apply.yaml to include a scheduled job for Terraform Apply. --- .github/workflows/ansible-apply.yaml | 2 +- .github/workflows/terraform-iac-apply.yaml | 2 + .github/workflows/terraform-iac-validate.yaml | 2 +- .../workflows/terraform-k8apps-validate.yaml | 2 +- ansible/playbook_encryption.yml | 186 ++++++++++-------- ansible/playbook_microk8s.yml | 4 +- ansible/roles/microk8s/tasks/iac.yml | 6 +- .../microk8s/tasks/microk8s/encryption.yml | 0 .../roles/microk8s/tasks/setupenv/main.yml | 10 +- .../roles/microk8s/templates/microk8s.yml.j2 | 12 ++ resources/iac_user,yaml | 141 ------------- terraform/iac/buckets.tf | 2 +- 12 files changed, 136 insertions(+), 233 deletions(-) create mode 100644 ansible/roles/microk8s/tasks/microk8s/encryption.yml create mode 100644 ansible/roles/microk8s/templates/microk8s.yml.j2 delete mode 100644 resources/iac_user,yaml diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 066c28c..568112d 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -80,8 +80,8 @@ jobs: SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | cd ansible - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml sectool exec ansible-playbook -u $ANSIBLE_USER playbook_hardening.yml --skip-tags roles::cis::suid + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml diff --git a/.github/workflows/terraform-iac-apply.yaml b/.github/workflows/terraform-iac-apply.yaml index 5626332..c02c8c5 100644 --- a/.github/workflows/terraform-iac-apply.yaml +++ b/.github/workflows/terraform-iac-apply.yaml @@ -1,6 +1,8 @@ name: Terraform Apply on: + schedule: + - cron: "0 1 * * 0" push: branches: - main diff --git a/.github/workflows/terraform-iac-validate.yaml b/.github/workflows/terraform-iac-validate.yaml index b48139a..8cfe460 100644 --- a/.github/workflows/terraform-iac-validate.yaml +++ b/.github/workflows/terraform-iac-validate.yaml @@ -27,7 +27,7 @@ jobs: - name: Setup Sectool uses: a13labs/setup-sectool@v1 - - name: Terraform Init + - name: Terraform Init and Validate env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | diff --git a/.github/workflows/terraform-k8apps-validate.yaml b/.github/workflows/terraform-k8apps-validate.yaml index 3018882..55f1493 100644 --- a/.github/workflows/terraform-k8apps-validate.yaml +++ b/.github/workflows/terraform-k8apps-validate.yaml @@ -82,7 +82,7 @@ jobs: mkdir -p ~/.kube ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s - - name: Terraform Init + - name: Terraform Init and Validate env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | diff --git a/ansible/playbook_encryption.yml b/ansible/playbook_encryption.yml index b646585..1203c45 100644 --- a/ansible/playbook_encryption.yml +++ b/ansible/playbook_encryption.yml @@ -1,118 +1,148 @@ --- -- name: Create LUKS encrypted file system with key file fetched from HTTP server +- name: Setup encrypted volume for a13labs hosts: contabo - become: yes + become: true vars: disk_image_path: /a13labs.img disk_image_size: 1G - luks_device_name: luks_device + luks_device_name: a13labs mount_point: /a13labs - key_file_path: /root/luks_keyfile + key_file_path: /root/a13labs.key key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud - key_fetch_service: fetch-a13labs-key.service + key_fetch_service: a13labs-key.service tasks: - name: Install cryptsetup and curl - apt: + ansible.builtin.apt: name: - cryptsetup - curl state: present when: ansible_os_family == 'Debian' + - name: Get mac address + ansible.builtin.shell: | + set -o pipefail + ip link show eth0 | awk '/ether/ {print $2}' + args: + executable: /bin/bash + register: mac_address + changed_when: false + + - name: Sanitize mac address + ansible.builtin.set_fact: + mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '_') }}" + changed_when: false + - name: Create disk image ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }} args: creates: "{{ disk_image_path }}" register: disk_image - - name: Create encrypted volume + - name: Create bucket URL + ansible.builtin.set_fact: + key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key" + changed_when: false + + - name: Create encrypted volume # noqa no-handler when: disk_image is changed - block: - - name: Get mac address - ansible.builtin.shell: | - set -o pipefail - ip link show eth0 | awk '/ether/ {print $2}' - args: - executable: /bin/bash - register: mac_address - changed_when: false + block: - - name: Sanitize mac address - set_fact: - mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '%3A') }}" - changed_when: false + - name: Download key file from Key server + ansible.builtin.uri: + url: "{{ key_file_url }}" + dest: "{{ key_file_path }}" + mode: '0600' + args: + creates: "{{ key_file_path }}" - - name: Create bucket URL - set_fact: - key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key" - changed_when: false + - name: Set up LUKS encryption with key file + ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }} + changed_when: false - - name: Download key file from HTTP server - ansible.builtin.uri: - url: "{{ key_file_url }}" - dest: "{{ key_file_path }}" - mode: '0600' - args: - creates: "{{ key_file_path }}" + - name: Open LUKS device with key file + ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }} + register: luks_device + changed_when: false - - name: Set up LUKS encryption with key file - ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }} + - name: Create file system + ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }} + changed_when: false - - name: Open LUKS device with key file - ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }} - register: luks_device + - name: Close LUKS device + ansible.builtin.command: cryptsetup close {{ luks_device_name }} + changed_when: false - - name: Delete key file - ansible.builtin.file: - path: "{{ key_file_path }}" - state: absent + - name: Delete key file + ansible.builtin.file: + path: "{{ key_file_path }}" + state: absent - - name: Create file system - ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }} + - name: Create mount point + ansible.builtin.file: + path: "{{ mount_point }}" + state: directory + mode: "0750" - - name: Create mount point - file: - path: "{{ mount_point }}" - state: directory + - name: Create systemd service to fetch key file and open LUKS device + ansible.builtin.copy: + dest: /etc/systemd/system/{{ key_fetch_service }} + mode: '0644' + content: | + [Unit] + Description=Open LUKS device + After=network-online.target - - name: Mount the file system - ansible.builtin.command: mount /dev/mapper/{{ luks_device_name }} {{ mount_point }} + [Service] + Type=oneshot + RemainAfterExit=true + ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}" + ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }} + ExecStartPost=/bin/rm -f {{ key_file_path }} + ExecStop=/usr/sbin/cryptsetup close {{ luks_device_name }} - - name: Ensure the file system is mounted - mount: - path: "{{ mount_point }}" - src: /dev/mapper/{{ luks_device_name }} - fstype: ext4 - state: mounted + [Install] + WantedBy=remote-fs.target - - name: Create systemd service to fetch key file and open LUKS device - copy: - dest: /etc/systemd/system/{{ key_fetch_service }} - content: | - [Unit] - Description=Fetch LUKS key file from HTTP server and open LUKS device - After=network-online.target - Before=cryptsetup.target + - name: Create systemd service to mount the file system + ansible.builtin.copy: + dest: /etc/systemd/system/{{ mount_point | basename }}.mount + mode: '0644' + content: | + [Unit] + Description=Mount LUKS device + After=remote-fs.target - [Service] - Type=oneshot - ExecStartPre=/usr/bin/curl -o {{ key_file_path }} {{ key_file_url }} - ExecStart=/usr/bin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }} - ExecStartPost=/bin/rm -f {{ key_file_path }} + [Mount] + What=/dev/mapper/{{ luks_device_name }} + Where={{ mount_point }} + Type=ext4 + Options=defaults - [Install] - WantedBy=multi-user.target + [Install] + WantedBy=multi-user.target - - name: Reload systemd daemon - ansible.builtin.command: systemctl daemon-reload + - name: Reload systemd daemon + ansible.builtin.systemd: + daemon_reload: true - - name: Enable the key fetch service - ansible.builtin.command: systemctl enable {{ key_fetch_service }} + - name: Enable the key fetch service + ansible.builtin.systemd: + name: "{{ key_fetch_service }}" + enabled: true - - name: Add entry to /etc/fstab - lineinfile: - path: /etc/fstab - line: "/dev/mapper/{{ luks_device_name }} {{ mount_point }} ext4 defaults 0 2" - create: yes + - name: Enable the mount device + ansible.builtin.systemd: + name: "{{ mount_point | basename }}.mount" + enabled: true + - name: Start the key fetch service + ansible.builtin.systemd: + name: "{{ key_fetch_service }}" + state: started + + - name: Start the mount device + ansible.builtin.systemd: + name: "{{ mount_point | basename }}.mount" + state: started diff --git a/ansible/playbook_microk8s.yml b/ansible/playbook_microk8s.yml index 19beff6..7640605 100644 --- a/ansible/playbook_microk8s.yml +++ b/ansible/playbook_microk8s.yml @@ -1,6 +1,6 @@ --- -- name: Microk8s Setup - hosts: microk8s +- name: Microk8s Setup + hosts: microk8s gather_facts: true roles: diff --git a/ansible/roles/microk8s/tasks/iac.yml b/ansible/roles/microk8s/tasks/iac.yml index c9c5448..d6af39f 100644 --- a/ansible/roles/microk8s/tasks/iac.yml +++ b/ansible/roles/microk8s/tasks/iac.yml @@ -124,7 +124,7 @@ - k8s::iac - name: Get new config SHA1 - set_fact: + ansible.builtin.set_fact: patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}" tags: - k8s::iac @@ -136,6 +136,6 @@ dest: "{{ k8s_kubeconfig }}" owner: "{{ k8s_iac_user }}" mode: "0600" - when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum + when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum tags: - - k8s::iac \ No newline at end of file + - k8s::iac diff --git a/ansible/roles/microk8s/tasks/microk8s/encryption.yml b/ansible/roles/microk8s/tasks/microk8s/encryption.yml new file mode 100644 index 0000000..e69de29 diff --git a/ansible/roles/microk8s/tasks/setupenv/main.yml b/ansible/roles/microk8s/tasks/setupenv/main.yml index 3a29c3b..05f3866 100644 --- a/ansible/roles/microk8s/tasks/setupenv/main.yml +++ b/ansible/roles/microk8s/tasks/setupenv/main.yml @@ -25,7 +25,7 @@ - name: Check if secret exists ansible.builtin.shell: | set -o pipefail - microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | wc -l | awk '{ print $1 }' + microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | wc -l | awk '{ print $1 }' args: executable: /bin/bash register: secret_exists @@ -41,7 +41,7 @@ - name: Get the secret name ansible.builtin.shell: | set -o pipefail - microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | awk '{ print $1 }' + microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | awk '{ print $1 }' args: executable: /bin/bash register: secret_name @@ -53,7 +53,7 @@ - name: Describe the secret and extract the token ansible.builtin.shell: | set -o pipefail - microk8s.kubectl -n {{ item.namespace | default('default') }} describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }' + microk8s.kubectl -n {{ item.namespace | default('default') }} describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }' args: executable: /bin/bash register: token @@ -103,7 +103,7 @@ - k8s::users - name: Get new config SHA1 - set_fact: + ansible.builtin.set_fact: patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}" tags: - k8s::users @@ -115,6 +115,6 @@ dest: "{{ user_registered.home }}/.kube/config" owner: "{{ item.username }}" mode: "0600" - when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum + when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum tags: - k8s::users diff --git a/ansible/roles/microk8s/templates/microk8s.yml.j2 b/ansible/roles/microk8s/templates/microk8s.yml.j2 new file mode 100644 index 0000000..7782af9 --- /dev/null +++ b/ansible/roles/microk8s/templates/microk8s.yml.j2 @@ -0,0 +1,12 @@ +--- +apiVersion: apiserver.config.k8s.io/v1 +kind: EncryptionConfiguration +resources: + - resources: + - secrets + providers: + - aescbc: + keys: + - name: k8s-crypto + secret: {{ secret }} + - identity: {} diff --git a/resources/iac_user,yaml b/resources/iac_user,yaml deleted file mode 100644 index a0486d2..0000000 --- a/resources/iac_user,yaml +++ /dev/null @@ -1,141 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - namespace: collabora - name: admin-collabora -rules: - - apiGroups: ["*"] - resources: ["*"] - verbs: ["*"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - namespace: gitea - name: admin-gitea -rules: - - apiGroups: ["*"] - resources: ["*"] - verbs: ["*"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - namespace: m3uproxy - name: admin-m3uproxy -rules: - - apiGroups: ["*"] - resources: ["*"] - verbs: ["*"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - namespace: nextcloud - name: admin-nextcloud -rules: - - apiGroups: ["*"] - resources: ["*"] - verbs: ["*"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - namespace: wordpress - name: admin-wordpress -rules: - - apiGroups: ["*"] - resources: ["*"] - verbs: ["*"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: namespace-creator -rules: - - apiGroups: [""] - resources: ["namespaces"] - verbs: ["create", "get", "list"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: admin-collabora-binding - namespace: collabora -subjects: - - kind: User - name: iac - apiGroup: rbac.authorization.k8s.io -roleRef: - kind: Role - name: admin-collabora - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: admin-gitea-binding - namespace: gitea -subjects: - - kind: User - name: iac - apiGroup: rbac.authorization.k8s.io -roleRef: - kind: Role - name: admin-gitea - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: admin-m3uproxy-binding - namespace: m3uproxy -subjects: - - kind: User - name: iac - apiGroup: rbac.authorization.k8s.io -roleRef: - kind: Role - name: admin-m3uproxy - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: admin-nextcloud-binding - namespace: nextcloud -subjects: - - kind: User - name: iac - apiGroup: rbac.authorization.k8s.io -roleRef: - kind: Role - name: admin-nextcloud - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: admin-wordpress-binding - namespace: wordpress -subjects: - - kind: User - name: iac - apiGroup: rbac.authorization.k8s.io -roleRef: - kind: Role - name: admin-wordpress - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: namespace-creator-binding -subjects: - - kind: User - name: iac - apiGroup: rbac.authorization.k8s.io -roleRef: - kind: ClusterRole - name: namespace-creator - apiGroup: rbac.authorization.k8s.io diff --git a/terraform/iac/buckets.tf b/terraform/iac/buckets.tf index cd3ffba..9ab2533 100644 --- a/terraform/iac/buckets.tf +++ b/terraform/iac/buckets.tf @@ -46,7 +46,7 @@ resource "scaleway_object_bucket_policy" "policy" { resource "scaleway_object" "encryption_key" { bucket = scaleway_object_bucket.infra_assets.id - key = "keys/${data.contabo_instance.microk8s.mac_address}.key" + key = "keys/${replace(data.contabo_instance.microk8s.mac_address, ":", "_")}.key" content_base64 = base64encode(var.encryption_key) } From 6248286ad2986b3d9d19187f6460d421e2354ad8 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sat, 28 Sep 2024 23:12:19 +0200 Subject: [PATCH 4/7] Encryption and major changes --- .github/workflows/ansible-apply.yaml | 2 +- ansible/host_vars/contabo01.a13labs.pt.yaml | 22 +++-- ...laybook_hardening.yml => playbook_cis.yml} | 6 +- ansible/playbook_microk8s.yml | 4 - .../{cis_hardening => cis}/.ansible-lint | 3 +- .../{cis_hardening => cis}/.yamllint.yml | 0 .../defaults/main/auditd.yml | 0 .../defaults/main/compilers.yml | 0 .../defaults/main/disablewireless.yml | 0 .../defaults/main/dns.yml | 0 .../defaults/main/ipv6.yml | 0 .../defaults/main/limits.yml | 0 .../defaults/main/misc.yml | 0 .../defaults/main/module_blocklists.yml | 0 .../defaults/main/mount.yml | 0 .../defaults/main/ntp.yml | 0 .../defaults/main/packages.yml | 0 .../defaults/main/password.yml | 0 .../defaults/main/sshd.yml | 0 .../defaults/main/suid_sgid_blocklist.yml | 0 .../defaults/main/sysctl.yml | 0 .../defaults/main/ufw.yml | 0 .../defaults/main/umask.yml | 0 .../defaults/main/users.yml | 0 .../files/usr/share/dict/passwords.list | 0 .../{cis_hardening => cis}/handlers/main.yml | 0 .../molecule/default/converge.yml | 0 .../molecule/default/molecule.yml | 0 .../molecule/default/verify.yml | 0 .../molecule/redhat/molecule.yml | 0 .../molecule/ubuntu/molecule.yml | 0 .../{cis_hardening => cis}/requirements.yml | 0 .../{cis_hardening => cis}/tasks/adduser.yml | 0 .../{cis_hardening => cis}/tasks/aide.yml | 0 .../{cis_hardening => cis}/tasks/apparmor.yml | 0 .../{cis_hardening => cis}/tasks/apport.yml | 0 .../{cis_hardening => cis}/tasks/auditd.yml | 0 .../tasks/compilers.yml | 0 .../{cis_hardening => cis}/tasks/cron.yml | 0 .../tasks/ctrlaltdel.yml | 0 .../tasks/disablefs.yml | 0 .../tasks/disablemod.yml | 0 .../tasks/disablenet.yml | 0 .../tasks/disablewireless.yml | 0 .../{cis_hardening => cis}/tasks/extras.yml | 0 .../{cis_hardening => cis}/tasks/facts.yml | 0 .../{cis_hardening => cis}/tasks/fstab.yml | 0 .../{cis_hardening => cis}/tasks/hosts.yml | 0 .../{cis_hardening => cis}/tasks/ipv6.yml | 0 .../{cis_hardening => cis}/tasks/issue.yml | 0 .../tasks/journalconf.yml | 0 .../{cis_hardening => cis}/tasks/limits.yml | 0 .../{cis_hardening => cis}/tasks/lockroot.yml | 0 .../tasks/logindconf.yml | 0 .../tasks/logindefs.yml | 0 .../{cis_hardening => cis}/tasks/main.yml | 0 .../{cis_hardening => cis}/tasks/motdnews.yml | 0 .../{cis_hardening => cis}/tasks/mount.yml | 0 .../tasks/packagemgmt.yml | 0 .../{cis_hardening => cis}/tasks/packages.yml | 0 .../{cis_hardening => cis}/tasks/password.yml | 0 .../{cis_hardening => cis}/tasks/path.yml | 0 .../{cis_hardening => cis}/tasks/post.yml | 0 .../{cis_hardening => cis}/tasks/postfix.yml | 0 .../{cis_hardening => cis}/tasks/pre.yml | 0 .../{cis_hardening => cis}/tasks/prelink.yml | 0 .../tasks/resolvedconf.yml | 0 .../{cis_hardening => cis}/tasks/rkhunter.yml | 0 .../tasks/rootaccess.yml | 0 .../tasks/sshconfig.yml | 0 .../{cis_hardening => cis}/tasks/sudo.yml | 0 .../{cis_hardening => cis}/tasks/suid.yml | 0 .../{cis_hardening => cis}/tasks/sysctl.yml | 0 .../tasks/systemdconf.yml | 0 .../tasks/timesyncd.yml | 0 .../{cis_hardening => cis}/tasks/ufw.yml | 0 .../{cis_hardening => cis}/tasks/umask.yml | 0 .../{cis_hardening => cis}/tasks/users.yml | 0 .../templates/etc/adduser.conf.j2 | 0 .../etc/ansible/facts.d/cpuinfo.fact | 0 .../etc/ansible/facts.d/sshkeys.fact | 0 .../etc/ansible/facts.d/systemd.fact | 0 .../etc/audit/rules.d/hardening.rules.j2 | 0 .../templates/etc/default/rkhunter.j2 | 0 .../templates/etc/default/useradd.j2 | 0 .../templates/etc/hosts.allow.j2 | 0 .../templates/etc/hosts.deny.j2 | 0 .../templates/etc/issue.j2 | 0 .../templates/etc/login.defs.j2 | 0 .../templates/etc/logrotate.conf.j2 | 0 .../templates/etc/motd.j2 | 0 .../templates/etc/pam.d/common-account.j2 | 0 .../templates/etc/pam.d/common-auth.j2 | 0 .../templates/etc/pam.d/common-password.j2 | 0 .../templates/etc/pam.d/login.j2 | 0 .../templates/etc/profile.d/initpath.sh.j2 | 0 .../templates/etc/security/limits.conf.j2 | 0 .../templates/etc/ssh/ssh_config.j2 | 0 .../templates/etc/ssh/sshd_config.j2 | 0 .../templates/etc/systemd/coredump.conf.j2 | 0 .../templates/etc/systemd/journald.conf.j2 | 0 .../templates/etc/systemd/logind.conf.j2 | 0 .../templates/etc/systemd/resolved.conf.j2 | 0 .../templates/etc/systemd/system.conf.j2 | 0 .../templates/etc/systemd/timesyncd.conf.j2 | 0 .../templates/etc/systemd/tmp.mount.j2 | 0 .../templates/etc/systemd/user.conf.j2 | 0 .../lib/systemd/system/aidecheck.service.j2 | 0 .../lib/systemd/system/aidecheck.timer.j2 | 0 .../tests/debug_facts.yml | 0 .../{cis_hardening => cis}/tests/inventory | 0 .../{cis_hardening => cis}/tests/test.yml | 0 .../roles/{duo_security => duo}/.ansible-lint | 0 .../roles/{duo_security => duo}/.yamllint.yml | 0 ansible/roles/{duo_security => duo}/README.md | 0 .../{duo_security => duo}/defaults/main.yml | 0 .../{duo_security => duo}/handlers/main.yml | 0 .../roles/{duo_security => duo}/meta/main.yml | 0 .../molecule/default/converge.yml | 0 .../molecule/default/molecule.yml | 0 .../molecule/default/prepare.yml | 0 .../molecule/default/verify.yml | 0 .../{duo_security => duo}/tasks/main.yml | 0 .../templates/duo-security.conf.j2 | 0 .../templates/login_duo.conf.j2 | 0 .../{duo_security => duo}/tests/inventory | 0 .../{duo_security => duo}/tests/test.yml | 0 .../roles/{duo_security => duo}/vars/main.yml | 0 ansible/roles/geoip/defaults/main.yml | 4 +- .../roles/geoip/molecule/default/molecule.yml | 4 +- .../geoip/templates/usr/bin/sshfilter.sh.j2 | 4 +- .../{manage_users => login}/.ansible-lint | 0 .../{manage_users => login}/.yamllint.yml | 0 .../roles/{manage_users => login}/README.md | 0 ansible/roles/login/defaults/main.yml | 2 + .../{manage_users => login}/handlers/main.yml | 0 .../{manage_users => login}/meta/main.yml | 0 .../molecule/default/converge.yml | 0 .../molecule/default/molecule.yml | 2 +- .../molecule/default/prepare.yml | 0 .../molecule/default/verify.yml | 0 .../{manage_users => login}/tasks/main.yml | 6 +- .../{manage_users => login}/tests/inventory | 0 .../{manage_users => login}/tests/test.yml | 0 .../{manage_users => login}/vars/main.yml | 0 ansible/roles/manage_users/defaults/main.yml | 3 - ansible/roles/microk8s/defaults/main.yml | 39 ++++---- ansible/roles/microk8s/tasks/certmanager.yml | 6 +- ansible/roles/microk8s/tasks/iac.yml | 90 ++++++++++--------- ansible/roles/microk8s/tasks/loadbalancer.yml | 8 +- .../microk8s/tasks/loadbalancer/metallb.yaml | 4 +- ansible/roles/microk8s/tasks/main.yml | 6 +- .../microk8s/tasks/microk8s/encryption.yml | 0 .../roles/microk8s/tasks/microk8s/install.yml | 36 +++++--- ansible/roles/microk8s/tasks/microk8s/ufw.yml | 10 +-- .../roles/microk8s/tasks/setupenv/main.yml | 2 +- .../molecule/default/molecule.yml | 16 ++-- ansible/sectool.env | 1 + repository.vault | 2 +- 159 files changed, 153 insertions(+), 129 deletions(-) rename ansible/{playbook_hardening.yml => playbook_cis.yml} (86%) rename ansible/roles/{cis_hardening => cis}/.ansible-lint (71%) rename ansible/roles/{cis_hardening => cis}/.yamllint.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/auditd.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/compilers.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/disablewireless.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/dns.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/ipv6.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/limits.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/misc.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/module_blocklists.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/mount.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/ntp.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/packages.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/password.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/sshd.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/suid_sgid_blocklist.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/sysctl.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/ufw.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/umask.yml (100%) rename ansible/roles/{cis_hardening => cis}/defaults/main/users.yml (100%) rename ansible/roles/{cis_hardening => cis}/files/usr/share/dict/passwords.list (100%) rename ansible/roles/{cis_hardening => cis}/handlers/main.yml (100%) rename ansible/roles/{cis_hardening => cis}/molecule/default/converge.yml (100%) rename ansible/roles/{cis_hardening => cis}/molecule/default/molecule.yml (100%) rename ansible/roles/{cis_hardening => cis}/molecule/default/verify.yml (100%) rename ansible/roles/{cis_hardening => cis}/molecule/redhat/molecule.yml (100%) rename ansible/roles/{cis_hardening => cis}/molecule/ubuntu/molecule.yml (100%) rename ansible/roles/{cis_hardening => cis}/requirements.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/adduser.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/aide.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/apparmor.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/apport.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/auditd.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/compilers.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/cron.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/ctrlaltdel.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/disablefs.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/disablemod.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/disablenet.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/disablewireless.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/extras.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/facts.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/fstab.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/hosts.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/ipv6.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/issue.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/journalconf.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/limits.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/lockroot.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/logindconf.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/logindefs.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/main.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/motdnews.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/mount.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/packagemgmt.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/packages.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/password.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/path.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/post.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/postfix.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/pre.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/prelink.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/resolvedconf.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/rkhunter.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/rootaccess.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/sshconfig.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/sudo.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/suid.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/sysctl.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/systemdconf.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/timesyncd.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/ufw.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/umask.yml (100%) rename ansible/roles/{cis_hardening => cis}/tasks/users.yml (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/adduser.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/ansible/facts.d/cpuinfo.fact (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/ansible/facts.d/sshkeys.fact (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/ansible/facts.d/systemd.fact (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/audit/rules.d/hardening.rules.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/default/rkhunter.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/default/useradd.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/hosts.allow.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/hosts.deny.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/issue.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/login.defs.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/logrotate.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/motd.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/pam.d/common-account.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/pam.d/common-auth.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/pam.d/common-password.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/pam.d/login.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/profile.d/initpath.sh.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/security/limits.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/ssh/ssh_config.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/ssh/sshd_config.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/coredump.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/journald.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/logind.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/resolved.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/system.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/timesyncd.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/tmp.mount.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/etc/systemd/user.conf.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/lib/systemd/system/aidecheck.service.j2 (100%) rename ansible/roles/{cis_hardening => cis}/templates/lib/systemd/system/aidecheck.timer.j2 (100%) rename ansible/roles/{cis_hardening => cis}/tests/debug_facts.yml (100%) rename ansible/roles/{cis_hardening => cis}/tests/inventory (100%) rename ansible/roles/{cis_hardening => cis}/tests/test.yml (100%) rename ansible/roles/{duo_security => duo}/.ansible-lint (100%) rename ansible/roles/{duo_security => duo}/.yamllint.yml (100%) rename ansible/roles/{duo_security => duo}/README.md (100%) rename ansible/roles/{duo_security => duo}/defaults/main.yml (100%) rename ansible/roles/{duo_security => duo}/handlers/main.yml (100%) rename ansible/roles/{duo_security => duo}/meta/main.yml (100%) rename ansible/roles/{duo_security => duo}/molecule/default/converge.yml (100%) rename ansible/roles/{duo_security => duo}/molecule/default/molecule.yml (100%) rename ansible/roles/{duo_security => duo}/molecule/default/prepare.yml (100%) rename ansible/roles/{duo_security => duo}/molecule/default/verify.yml (100%) rename ansible/roles/{duo_security => duo}/tasks/main.yml (100%) rename ansible/roles/{duo_security => duo}/templates/duo-security.conf.j2 (100%) rename ansible/roles/{duo_security => duo}/templates/login_duo.conf.j2 (100%) rename ansible/roles/{duo_security => duo}/tests/inventory (100%) rename ansible/roles/{duo_security => duo}/tests/test.yml (100%) rename ansible/roles/{duo_security => duo}/vars/main.yml (100%) rename ansible/roles/{manage_users => login}/.ansible-lint (100%) rename ansible/roles/{manage_users => login}/.yamllint.yml (100%) rename ansible/roles/{manage_users => login}/README.md (100%) create mode 100644 ansible/roles/login/defaults/main.yml rename ansible/roles/{manage_users => login}/handlers/main.yml (100%) rename ansible/roles/{manage_users => login}/meta/main.yml (100%) rename ansible/roles/{manage_users => login}/molecule/default/converge.yml (100%) rename ansible/roles/{manage_users => login}/molecule/default/molecule.yml (96%) rename ansible/roles/{manage_users => login}/molecule/default/prepare.yml (100%) rename ansible/roles/{manage_users => login}/molecule/default/verify.yml (100%) rename ansible/roles/{manage_users => login}/tasks/main.yml (93%) rename ansible/roles/{manage_users => login}/tests/inventory (100%) rename ansible/roles/{manage_users => login}/tests/test.yml (100%) rename ansible/roles/{manage_users => login}/vars/main.yml (100%) delete mode 100644 ansible/roles/manage_users/defaults/main.yml delete mode 100644 ansible/roles/microk8s/tasks/microk8s/encryption.yml diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 568112d..5180edf 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -80,7 +80,7 @@ jobs: SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | cd ansible - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_hardening.yml --skip-tags roles::cis::suid + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_cis.yml --skip-tags roles::cis::suid sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml diff --git a/ansible/host_vars/contabo01.a13labs.pt.yaml b/ansible/host_vars/contabo01.a13labs.pt.yaml index 87eeb8f..41c6882 100644 --- a/ansible/host_vars/contabo01.a13labs.pt.yaml +++ b/ansible/host_vars/contabo01.a13labs.pt.yaml @@ -11,7 +11,7 @@ sshd_permit_root_login: "no" sshd_password_authentication: "no" sshd_allow_tcp_forwarding: "yes" ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}" -ssh_users: +login_users: - username: operator comment: "Managed by Ansible" sudoer: true @@ -57,9 +57,11 @@ custom_hosts_acls: true # GeoIP subscription geoip_sshd_enabled: true -ssh_allowed_zones: +geoip_ssh_allowed_zones: - "BE" - "PT" +geoip_ssh_allowed_networks: + - "0.0.0.0/0" # fail2ban fail2ban_jails: @@ -77,20 +79,22 @@ unattended_reboot: true unattended_reboot_time: "04:30" # Kubernetes specific settings -microk8s_alt_names: "{{ hostname }}" -k8s_version: 1.29 -k8s_allowed_hosts: +microk8s_version: 1.29 +microk8s_allowed_hosts: - 87.67.163.177 +microk8s_alt_names: "{{ hostname }}" -k8s_users: +# Let's encrypt issuer +microk8s_issuer_email: c.alexandre.pires@alexpires.me +microk8s_encryption_cfg: /a13labs/microk8s_encryption.yaml +microk8s_encryption_secret: "{{ lookup('env', 'MICROK8S_ENCRYPTION_SECRET') }}" +microk8s_users: - username: operator enabled: true - username: git namespace: "gitea" enabled: true -# Let's encrypt issuer -issuer_email: c.alexandre.pires@alexpires.me - +# Duo Security duo_users: ["*", "!provision", "!git"] duo_api_hostname: api-7cda1654.duosecurity.com diff --git a/ansible/playbook_hardening.yml b/ansible/playbook_cis.yml similarity index 86% rename from ansible/playbook_hardening.yml rename to ansible/playbook_cis.yml index 985c785..a6b6091 100644 --- a/ansible/playbook_hardening.yml +++ b/ansible/playbook_cis.yml @@ -8,11 +8,11 @@ tags: - roles - roles::bootstrap - - role: "manage_users" + - role: "login" tags: - roles - roles::users - - role: "cis_hardening" + - role: "cis" vars: # currently aide is failing install_aide: false @@ -27,7 +27,7 @@ tags: - roles - roles::geoip - - role: "duo_security" + - role: "duo" tags: - roles - roles::duosecurity diff --git a/ansible/playbook_microk8s.yml b/ansible/playbook_microk8s.yml index 7640605..0fe2045 100644 --- a/ansible/playbook_microk8s.yml +++ b/ansible/playbook_microk8s.yml @@ -4,10 +4,6 @@ gather_facts: true roles: - - role: "manage_users" - tags: - - roles - - roles::users - role: "microk8s" tags: - role::microk8s diff --git a/ansible/roles/cis_hardening/.ansible-lint b/ansible/roles/cis/.ansible-lint similarity index 71% rename from ansible/roles/cis_hardening/.ansible-lint rename to ansible/roles/cis/.ansible-lint index cbb696b..241659f 100644 --- a/ansible/roles/cis_hardening/.ansible-lint +++ b/ansible/roles/cis/.ansible-lint @@ -4,9 +4,10 @@ exclude_paths: - .github/ - tests/ enable_list: - - fqcn-builtins # opt-in + - fqcn-builtins # opt-in warn_list: - line-length - yaml[line-length] skip_list: - yaml[comments] + - var-naming[no-role-prefix] diff --git a/ansible/roles/cis_hardening/.yamllint.yml b/ansible/roles/cis/.yamllint.yml similarity index 100% rename from ansible/roles/cis_hardening/.yamllint.yml rename to ansible/roles/cis/.yamllint.yml diff --git a/ansible/roles/cis_hardening/defaults/main/auditd.yml b/ansible/roles/cis/defaults/main/auditd.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/auditd.yml rename to ansible/roles/cis/defaults/main/auditd.yml diff --git a/ansible/roles/cis_hardening/defaults/main/compilers.yml b/ansible/roles/cis/defaults/main/compilers.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/compilers.yml rename to ansible/roles/cis/defaults/main/compilers.yml diff --git a/ansible/roles/cis_hardening/defaults/main/disablewireless.yml b/ansible/roles/cis/defaults/main/disablewireless.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/disablewireless.yml rename to ansible/roles/cis/defaults/main/disablewireless.yml diff --git a/ansible/roles/cis_hardening/defaults/main/dns.yml b/ansible/roles/cis/defaults/main/dns.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/dns.yml rename to ansible/roles/cis/defaults/main/dns.yml diff --git a/ansible/roles/cis_hardening/defaults/main/ipv6.yml b/ansible/roles/cis/defaults/main/ipv6.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/ipv6.yml rename to ansible/roles/cis/defaults/main/ipv6.yml diff --git a/ansible/roles/cis_hardening/defaults/main/limits.yml b/ansible/roles/cis/defaults/main/limits.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/limits.yml rename to ansible/roles/cis/defaults/main/limits.yml diff --git a/ansible/roles/cis_hardening/defaults/main/misc.yml b/ansible/roles/cis/defaults/main/misc.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/misc.yml rename to ansible/roles/cis/defaults/main/misc.yml diff --git a/ansible/roles/cis_hardening/defaults/main/module_blocklists.yml b/ansible/roles/cis/defaults/main/module_blocklists.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/module_blocklists.yml rename to ansible/roles/cis/defaults/main/module_blocklists.yml diff --git a/ansible/roles/cis_hardening/defaults/main/mount.yml b/ansible/roles/cis/defaults/main/mount.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/mount.yml rename to ansible/roles/cis/defaults/main/mount.yml diff --git a/ansible/roles/cis_hardening/defaults/main/ntp.yml b/ansible/roles/cis/defaults/main/ntp.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/ntp.yml rename to ansible/roles/cis/defaults/main/ntp.yml diff --git a/ansible/roles/cis_hardening/defaults/main/packages.yml b/ansible/roles/cis/defaults/main/packages.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/packages.yml rename to ansible/roles/cis/defaults/main/packages.yml diff --git a/ansible/roles/cis_hardening/defaults/main/password.yml b/ansible/roles/cis/defaults/main/password.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/password.yml rename to ansible/roles/cis/defaults/main/password.yml diff --git a/ansible/roles/cis_hardening/defaults/main/sshd.yml b/ansible/roles/cis/defaults/main/sshd.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/sshd.yml rename to ansible/roles/cis/defaults/main/sshd.yml diff --git a/ansible/roles/cis_hardening/defaults/main/suid_sgid_blocklist.yml b/ansible/roles/cis/defaults/main/suid_sgid_blocklist.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/suid_sgid_blocklist.yml rename to ansible/roles/cis/defaults/main/suid_sgid_blocklist.yml diff --git a/ansible/roles/cis_hardening/defaults/main/sysctl.yml b/ansible/roles/cis/defaults/main/sysctl.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/sysctl.yml rename to ansible/roles/cis/defaults/main/sysctl.yml diff --git a/ansible/roles/cis_hardening/defaults/main/ufw.yml b/ansible/roles/cis/defaults/main/ufw.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/ufw.yml rename to ansible/roles/cis/defaults/main/ufw.yml diff --git a/ansible/roles/cis_hardening/defaults/main/umask.yml b/ansible/roles/cis/defaults/main/umask.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/umask.yml rename to ansible/roles/cis/defaults/main/umask.yml diff --git a/ansible/roles/cis_hardening/defaults/main/users.yml b/ansible/roles/cis/defaults/main/users.yml similarity index 100% rename from ansible/roles/cis_hardening/defaults/main/users.yml rename to ansible/roles/cis/defaults/main/users.yml diff --git a/ansible/roles/cis_hardening/files/usr/share/dict/passwords.list b/ansible/roles/cis/files/usr/share/dict/passwords.list similarity index 100% rename from ansible/roles/cis_hardening/files/usr/share/dict/passwords.list rename to ansible/roles/cis/files/usr/share/dict/passwords.list diff --git a/ansible/roles/cis_hardening/handlers/main.yml b/ansible/roles/cis/handlers/main.yml similarity index 100% rename from ansible/roles/cis_hardening/handlers/main.yml rename to ansible/roles/cis/handlers/main.yml diff --git a/ansible/roles/cis_hardening/molecule/default/converge.yml b/ansible/roles/cis/molecule/default/converge.yml similarity index 100% rename from ansible/roles/cis_hardening/molecule/default/converge.yml rename to ansible/roles/cis/molecule/default/converge.yml diff --git a/ansible/roles/cis_hardening/molecule/default/molecule.yml b/ansible/roles/cis/molecule/default/molecule.yml similarity index 100% rename from ansible/roles/cis_hardening/molecule/default/molecule.yml rename to ansible/roles/cis/molecule/default/molecule.yml diff --git a/ansible/roles/cis_hardening/molecule/default/verify.yml b/ansible/roles/cis/molecule/default/verify.yml similarity index 100% rename from ansible/roles/cis_hardening/molecule/default/verify.yml rename to ansible/roles/cis/molecule/default/verify.yml diff --git a/ansible/roles/cis_hardening/molecule/redhat/molecule.yml b/ansible/roles/cis/molecule/redhat/molecule.yml similarity index 100% rename from ansible/roles/cis_hardening/molecule/redhat/molecule.yml rename to ansible/roles/cis/molecule/redhat/molecule.yml diff --git a/ansible/roles/cis_hardening/molecule/ubuntu/molecule.yml b/ansible/roles/cis/molecule/ubuntu/molecule.yml similarity index 100% rename from ansible/roles/cis_hardening/molecule/ubuntu/molecule.yml rename to ansible/roles/cis/molecule/ubuntu/molecule.yml diff --git a/ansible/roles/cis_hardening/requirements.yml b/ansible/roles/cis/requirements.yml similarity index 100% rename from ansible/roles/cis_hardening/requirements.yml rename to ansible/roles/cis/requirements.yml diff --git a/ansible/roles/cis_hardening/tasks/adduser.yml b/ansible/roles/cis/tasks/adduser.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/adduser.yml rename to ansible/roles/cis/tasks/adduser.yml diff --git a/ansible/roles/cis_hardening/tasks/aide.yml b/ansible/roles/cis/tasks/aide.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/aide.yml rename to ansible/roles/cis/tasks/aide.yml diff --git a/ansible/roles/cis_hardening/tasks/apparmor.yml b/ansible/roles/cis/tasks/apparmor.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/apparmor.yml rename to ansible/roles/cis/tasks/apparmor.yml diff --git a/ansible/roles/cis_hardening/tasks/apport.yml b/ansible/roles/cis/tasks/apport.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/apport.yml rename to ansible/roles/cis/tasks/apport.yml diff --git a/ansible/roles/cis_hardening/tasks/auditd.yml b/ansible/roles/cis/tasks/auditd.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/auditd.yml rename to ansible/roles/cis/tasks/auditd.yml diff --git a/ansible/roles/cis_hardening/tasks/compilers.yml b/ansible/roles/cis/tasks/compilers.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/compilers.yml rename to ansible/roles/cis/tasks/compilers.yml diff --git a/ansible/roles/cis_hardening/tasks/cron.yml b/ansible/roles/cis/tasks/cron.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/cron.yml rename to ansible/roles/cis/tasks/cron.yml diff --git a/ansible/roles/cis_hardening/tasks/ctrlaltdel.yml b/ansible/roles/cis/tasks/ctrlaltdel.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/ctrlaltdel.yml rename to ansible/roles/cis/tasks/ctrlaltdel.yml diff --git a/ansible/roles/cis_hardening/tasks/disablefs.yml b/ansible/roles/cis/tasks/disablefs.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/disablefs.yml rename to ansible/roles/cis/tasks/disablefs.yml diff --git a/ansible/roles/cis_hardening/tasks/disablemod.yml b/ansible/roles/cis/tasks/disablemod.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/disablemod.yml rename to ansible/roles/cis/tasks/disablemod.yml diff --git a/ansible/roles/cis_hardening/tasks/disablenet.yml b/ansible/roles/cis/tasks/disablenet.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/disablenet.yml rename to ansible/roles/cis/tasks/disablenet.yml diff --git a/ansible/roles/cis_hardening/tasks/disablewireless.yml b/ansible/roles/cis/tasks/disablewireless.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/disablewireless.yml rename to ansible/roles/cis/tasks/disablewireless.yml diff --git a/ansible/roles/cis_hardening/tasks/extras.yml b/ansible/roles/cis/tasks/extras.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/extras.yml rename to ansible/roles/cis/tasks/extras.yml diff --git a/ansible/roles/cis_hardening/tasks/facts.yml b/ansible/roles/cis/tasks/facts.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/facts.yml rename to ansible/roles/cis/tasks/facts.yml diff --git a/ansible/roles/cis_hardening/tasks/fstab.yml b/ansible/roles/cis/tasks/fstab.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/fstab.yml rename to ansible/roles/cis/tasks/fstab.yml diff --git a/ansible/roles/cis_hardening/tasks/hosts.yml b/ansible/roles/cis/tasks/hosts.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/hosts.yml rename to ansible/roles/cis/tasks/hosts.yml diff --git a/ansible/roles/cis_hardening/tasks/ipv6.yml b/ansible/roles/cis/tasks/ipv6.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/ipv6.yml rename to ansible/roles/cis/tasks/ipv6.yml diff --git a/ansible/roles/cis_hardening/tasks/issue.yml b/ansible/roles/cis/tasks/issue.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/issue.yml rename to ansible/roles/cis/tasks/issue.yml diff --git a/ansible/roles/cis_hardening/tasks/journalconf.yml b/ansible/roles/cis/tasks/journalconf.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/journalconf.yml rename to ansible/roles/cis/tasks/journalconf.yml diff --git a/ansible/roles/cis_hardening/tasks/limits.yml b/ansible/roles/cis/tasks/limits.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/limits.yml rename to ansible/roles/cis/tasks/limits.yml diff --git a/ansible/roles/cis_hardening/tasks/lockroot.yml b/ansible/roles/cis/tasks/lockroot.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/lockroot.yml rename to ansible/roles/cis/tasks/lockroot.yml diff --git a/ansible/roles/cis_hardening/tasks/logindconf.yml b/ansible/roles/cis/tasks/logindconf.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/logindconf.yml rename to ansible/roles/cis/tasks/logindconf.yml diff --git a/ansible/roles/cis_hardening/tasks/logindefs.yml b/ansible/roles/cis/tasks/logindefs.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/logindefs.yml rename to ansible/roles/cis/tasks/logindefs.yml diff --git a/ansible/roles/cis_hardening/tasks/main.yml b/ansible/roles/cis/tasks/main.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/main.yml rename to ansible/roles/cis/tasks/main.yml diff --git a/ansible/roles/cis_hardening/tasks/motdnews.yml b/ansible/roles/cis/tasks/motdnews.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/motdnews.yml rename to ansible/roles/cis/tasks/motdnews.yml diff --git a/ansible/roles/cis_hardening/tasks/mount.yml b/ansible/roles/cis/tasks/mount.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/mount.yml rename to ansible/roles/cis/tasks/mount.yml diff --git a/ansible/roles/cis_hardening/tasks/packagemgmt.yml b/ansible/roles/cis/tasks/packagemgmt.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/packagemgmt.yml rename to ansible/roles/cis/tasks/packagemgmt.yml diff --git a/ansible/roles/cis_hardening/tasks/packages.yml b/ansible/roles/cis/tasks/packages.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/packages.yml rename to ansible/roles/cis/tasks/packages.yml diff --git a/ansible/roles/cis_hardening/tasks/password.yml b/ansible/roles/cis/tasks/password.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/password.yml rename to ansible/roles/cis/tasks/password.yml diff --git a/ansible/roles/cis_hardening/tasks/path.yml b/ansible/roles/cis/tasks/path.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/path.yml rename to ansible/roles/cis/tasks/path.yml diff --git a/ansible/roles/cis_hardening/tasks/post.yml b/ansible/roles/cis/tasks/post.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/post.yml rename to ansible/roles/cis/tasks/post.yml diff --git a/ansible/roles/cis_hardening/tasks/postfix.yml b/ansible/roles/cis/tasks/postfix.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/postfix.yml rename to ansible/roles/cis/tasks/postfix.yml diff --git a/ansible/roles/cis_hardening/tasks/pre.yml b/ansible/roles/cis/tasks/pre.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/pre.yml rename to ansible/roles/cis/tasks/pre.yml diff --git a/ansible/roles/cis_hardening/tasks/prelink.yml b/ansible/roles/cis/tasks/prelink.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/prelink.yml rename to ansible/roles/cis/tasks/prelink.yml diff --git a/ansible/roles/cis_hardening/tasks/resolvedconf.yml b/ansible/roles/cis/tasks/resolvedconf.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/resolvedconf.yml rename to ansible/roles/cis/tasks/resolvedconf.yml diff --git a/ansible/roles/cis_hardening/tasks/rkhunter.yml b/ansible/roles/cis/tasks/rkhunter.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/rkhunter.yml rename to ansible/roles/cis/tasks/rkhunter.yml diff --git a/ansible/roles/cis_hardening/tasks/rootaccess.yml b/ansible/roles/cis/tasks/rootaccess.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/rootaccess.yml rename to ansible/roles/cis/tasks/rootaccess.yml diff --git a/ansible/roles/cis_hardening/tasks/sshconfig.yml b/ansible/roles/cis/tasks/sshconfig.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/sshconfig.yml rename to ansible/roles/cis/tasks/sshconfig.yml diff --git a/ansible/roles/cis_hardening/tasks/sudo.yml b/ansible/roles/cis/tasks/sudo.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/sudo.yml rename to ansible/roles/cis/tasks/sudo.yml diff --git a/ansible/roles/cis_hardening/tasks/suid.yml b/ansible/roles/cis/tasks/suid.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/suid.yml rename to ansible/roles/cis/tasks/suid.yml diff --git a/ansible/roles/cis_hardening/tasks/sysctl.yml b/ansible/roles/cis/tasks/sysctl.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/sysctl.yml rename to ansible/roles/cis/tasks/sysctl.yml diff --git a/ansible/roles/cis_hardening/tasks/systemdconf.yml b/ansible/roles/cis/tasks/systemdconf.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/systemdconf.yml rename to ansible/roles/cis/tasks/systemdconf.yml diff --git a/ansible/roles/cis_hardening/tasks/timesyncd.yml b/ansible/roles/cis/tasks/timesyncd.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/timesyncd.yml rename to ansible/roles/cis/tasks/timesyncd.yml diff --git a/ansible/roles/cis_hardening/tasks/ufw.yml b/ansible/roles/cis/tasks/ufw.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/ufw.yml rename to ansible/roles/cis/tasks/ufw.yml diff --git a/ansible/roles/cis_hardening/tasks/umask.yml b/ansible/roles/cis/tasks/umask.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/umask.yml rename to ansible/roles/cis/tasks/umask.yml diff --git a/ansible/roles/cis_hardening/tasks/users.yml b/ansible/roles/cis/tasks/users.yml similarity index 100% rename from ansible/roles/cis_hardening/tasks/users.yml rename to ansible/roles/cis/tasks/users.yml diff --git a/ansible/roles/cis_hardening/templates/etc/adduser.conf.j2 b/ansible/roles/cis/templates/etc/adduser.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/adduser.conf.j2 rename to ansible/roles/cis/templates/etc/adduser.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/ansible/facts.d/cpuinfo.fact b/ansible/roles/cis/templates/etc/ansible/facts.d/cpuinfo.fact similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/ansible/facts.d/cpuinfo.fact rename to ansible/roles/cis/templates/etc/ansible/facts.d/cpuinfo.fact diff --git a/ansible/roles/cis_hardening/templates/etc/ansible/facts.d/sshkeys.fact b/ansible/roles/cis/templates/etc/ansible/facts.d/sshkeys.fact similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/ansible/facts.d/sshkeys.fact rename to ansible/roles/cis/templates/etc/ansible/facts.d/sshkeys.fact diff --git a/ansible/roles/cis_hardening/templates/etc/ansible/facts.d/systemd.fact b/ansible/roles/cis/templates/etc/ansible/facts.d/systemd.fact similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/ansible/facts.d/systemd.fact rename to ansible/roles/cis/templates/etc/ansible/facts.d/systemd.fact diff --git a/ansible/roles/cis_hardening/templates/etc/audit/rules.d/hardening.rules.j2 b/ansible/roles/cis/templates/etc/audit/rules.d/hardening.rules.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/audit/rules.d/hardening.rules.j2 rename to ansible/roles/cis/templates/etc/audit/rules.d/hardening.rules.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/default/rkhunter.j2 b/ansible/roles/cis/templates/etc/default/rkhunter.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/default/rkhunter.j2 rename to ansible/roles/cis/templates/etc/default/rkhunter.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/default/useradd.j2 b/ansible/roles/cis/templates/etc/default/useradd.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/default/useradd.j2 rename to ansible/roles/cis/templates/etc/default/useradd.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/hosts.allow.j2 b/ansible/roles/cis/templates/etc/hosts.allow.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/hosts.allow.j2 rename to ansible/roles/cis/templates/etc/hosts.allow.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/hosts.deny.j2 b/ansible/roles/cis/templates/etc/hosts.deny.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/hosts.deny.j2 rename to ansible/roles/cis/templates/etc/hosts.deny.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/issue.j2 b/ansible/roles/cis/templates/etc/issue.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/issue.j2 rename to ansible/roles/cis/templates/etc/issue.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/login.defs.j2 b/ansible/roles/cis/templates/etc/login.defs.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/login.defs.j2 rename to ansible/roles/cis/templates/etc/login.defs.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/logrotate.conf.j2 b/ansible/roles/cis/templates/etc/logrotate.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/logrotate.conf.j2 rename to ansible/roles/cis/templates/etc/logrotate.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/motd.j2 b/ansible/roles/cis/templates/etc/motd.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/motd.j2 rename to ansible/roles/cis/templates/etc/motd.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/common-account.j2 b/ansible/roles/cis/templates/etc/pam.d/common-account.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/pam.d/common-account.j2 rename to ansible/roles/cis/templates/etc/pam.d/common-account.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/common-auth.j2 b/ansible/roles/cis/templates/etc/pam.d/common-auth.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/pam.d/common-auth.j2 rename to ansible/roles/cis/templates/etc/pam.d/common-auth.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/common-password.j2 b/ansible/roles/cis/templates/etc/pam.d/common-password.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/pam.d/common-password.j2 rename to ansible/roles/cis/templates/etc/pam.d/common-password.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/pam.d/login.j2 b/ansible/roles/cis/templates/etc/pam.d/login.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/pam.d/login.j2 rename to ansible/roles/cis/templates/etc/pam.d/login.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/profile.d/initpath.sh.j2 b/ansible/roles/cis/templates/etc/profile.d/initpath.sh.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/profile.d/initpath.sh.j2 rename to ansible/roles/cis/templates/etc/profile.d/initpath.sh.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/security/limits.conf.j2 b/ansible/roles/cis/templates/etc/security/limits.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/security/limits.conf.j2 rename to ansible/roles/cis/templates/etc/security/limits.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/ssh/ssh_config.j2 b/ansible/roles/cis/templates/etc/ssh/ssh_config.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/ssh/ssh_config.j2 rename to ansible/roles/cis/templates/etc/ssh/ssh_config.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/ssh/sshd_config.j2 b/ansible/roles/cis/templates/etc/ssh/sshd_config.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/ssh/sshd_config.j2 rename to ansible/roles/cis/templates/etc/ssh/sshd_config.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/coredump.conf.j2 b/ansible/roles/cis/templates/etc/systemd/coredump.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/coredump.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/coredump.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/journald.conf.j2 b/ansible/roles/cis/templates/etc/systemd/journald.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/journald.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/journald.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/logind.conf.j2 b/ansible/roles/cis/templates/etc/systemd/logind.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/logind.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/logind.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/resolved.conf.j2 b/ansible/roles/cis/templates/etc/systemd/resolved.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/resolved.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/resolved.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/system.conf.j2 b/ansible/roles/cis/templates/etc/systemd/system.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/system.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/system.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/timesyncd.conf.j2 b/ansible/roles/cis/templates/etc/systemd/timesyncd.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/timesyncd.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/timesyncd.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/tmp.mount.j2 b/ansible/roles/cis/templates/etc/systemd/tmp.mount.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/tmp.mount.j2 rename to ansible/roles/cis/templates/etc/systemd/tmp.mount.j2 diff --git a/ansible/roles/cis_hardening/templates/etc/systemd/user.conf.j2 b/ansible/roles/cis/templates/etc/systemd/user.conf.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/etc/systemd/user.conf.j2 rename to ansible/roles/cis/templates/etc/systemd/user.conf.j2 diff --git a/ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.service.j2 b/ansible/roles/cis/templates/lib/systemd/system/aidecheck.service.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.service.j2 rename to ansible/roles/cis/templates/lib/systemd/system/aidecheck.service.j2 diff --git a/ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.timer.j2 b/ansible/roles/cis/templates/lib/systemd/system/aidecheck.timer.j2 similarity index 100% rename from ansible/roles/cis_hardening/templates/lib/systemd/system/aidecheck.timer.j2 rename to ansible/roles/cis/templates/lib/systemd/system/aidecheck.timer.j2 diff --git a/ansible/roles/cis_hardening/tests/debug_facts.yml b/ansible/roles/cis/tests/debug_facts.yml similarity index 100% rename from ansible/roles/cis_hardening/tests/debug_facts.yml rename to ansible/roles/cis/tests/debug_facts.yml diff --git a/ansible/roles/cis_hardening/tests/inventory b/ansible/roles/cis/tests/inventory similarity index 100% rename from ansible/roles/cis_hardening/tests/inventory rename to ansible/roles/cis/tests/inventory diff --git a/ansible/roles/cis_hardening/tests/test.yml b/ansible/roles/cis/tests/test.yml similarity index 100% rename from ansible/roles/cis_hardening/tests/test.yml rename to ansible/roles/cis/tests/test.yml diff --git a/ansible/roles/duo_security/.ansible-lint b/ansible/roles/duo/.ansible-lint similarity index 100% rename from ansible/roles/duo_security/.ansible-lint rename to ansible/roles/duo/.ansible-lint diff --git a/ansible/roles/duo_security/.yamllint.yml b/ansible/roles/duo/.yamllint.yml similarity index 100% rename from ansible/roles/duo_security/.yamllint.yml rename to ansible/roles/duo/.yamllint.yml diff --git a/ansible/roles/duo_security/README.md b/ansible/roles/duo/README.md similarity index 100% rename from ansible/roles/duo_security/README.md rename to ansible/roles/duo/README.md diff --git a/ansible/roles/duo_security/defaults/main.yml b/ansible/roles/duo/defaults/main.yml similarity index 100% rename from ansible/roles/duo_security/defaults/main.yml rename to ansible/roles/duo/defaults/main.yml diff --git a/ansible/roles/duo_security/handlers/main.yml b/ansible/roles/duo/handlers/main.yml similarity index 100% rename from ansible/roles/duo_security/handlers/main.yml rename to ansible/roles/duo/handlers/main.yml diff --git a/ansible/roles/duo_security/meta/main.yml b/ansible/roles/duo/meta/main.yml similarity index 100% rename from ansible/roles/duo_security/meta/main.yml rename to ansible/roles/duo/meta/main.yml diff --git a/ansible/roles/duo_security/molecule/default/converge.yml b/ansible/roles/duo/molecule/default/converge.yml similarity index 100% rename from ansible/roles/duo_security/molecule/default/converge.yml rename to ansible/roles/duo/molecule/default/converge.yml diff --git a/ansible/roles/duo_security/molecule/default/molecule.yml b/ansible/roles/duo/molecule/default/molecule.yml similarity index 100% rename from ansible/roles/duo_security/molecule/default/molecule.yml rename to ansible/roles/duo/molecule/default/molecule.yml diff --git a/ansible/roles/duo_security/molecule/default/prepare.yml b/ansible/roles/duo/molecule/default/prepare.yml similarity index 100% rename from ansible/roles/duo_security/molecule/default/prepare.yml rename to ansible/roles/duo/molecule/default/prepare.yml diff --git a/ansible/roles/duo_security/molecule/default/verify.yml b/ansible/roles/duo/molecule/default/verify.yml similarity index 100% rename from ansible/roles/duo_security/molecule/default/verify.yml rename to ansible/roles/duo/molecule/default/verify.yml diff --git a/ansible/roles/duo_security/tasks/main.yml b/ansible/roles/duo/tasks/main.yml similarity index 100% rename from ansible/roles/duo_security/tasks/main.yml rename to ansible/roles/duo/tasks/main.yml diff --git a/ansible/roles/duo_security/templates/duo-security.conf.j2 b/ansible/roles/duo/templates/duo-security.conf.j2 similarity index 100% rename from ansible/roles/duo_security/templates/duo-security.conf.j2 rename to ansible/roles/duo/templates/duo-security.conf.j2 diff --git a/ansible/roles/duo_security/templates/login_duo.conf.j2 b/ansible/roles/duo/templates/login_duo.conf.j2 similarity index 100% rename from ansible/roles/duo_security/templates/login_duo.conf.j2 rename to ansible/roles/duo/templates/login_duo.conf.j2 diff --git a/ansible/roles/duo_security/tests/inventory b/ansible/roles/duo/tests/inventory similarity index 100% rename from ansible/roles/duo_security/tests/inventory rename to ansible/roles/duo/tests/inventory diff --git a/ansible/roles/duo_security/tests/test.yml b/ansible/roles/duo/tests/test.yml similarity index 100% rename from ansible/roles/duo_security/tests/test.yml rename to ansible/roles/duo/tests/test.yml diff --git a/ansible/roles/duo_security/vars/main.yml b/ansible/roles/duo/vars/main.yml similarity index 100% rename from ansible/roles/duo_security/vars/main.yml rename to ansible/roles/duo/vars/main.yml diff --git a/ansible/roles/geoip/defaults/main.yml b/ansible/roles/geoip/defaults/main.yml index ba2f186..c8e6760 100644 --- a/ansible/roles/geoip/defaults/main.yml +++ b/ansible/roles/geoip/defaults/main.yml @@ -6,8 +6,8 @@ geoip_editions_ids: - GeoLite2-ASN - GeoLite2-City - GeoLite2-Country -ssh_allowed_zones: +geoip_ssh_allowed_zones: - "ALL" -ssh_allowed_networks: +geoip_ssh_allowed_networks: - "0.0.0.0/0" geoip_sshd_enabled: true diff --git a/ansible/roles/geoip/molecule/default/molecule.yml b/ansible/roles/geoip/molecule/default/molecule.yml index cdb2d6a..170746e 100644 --- a/ansible/roles/geoip/molecule/default/molecule.yml +++ b/ansible/roles/geoip/molecule/default/molecule.yml @@ -20,9 +20,9 @@ provisioner: inventory: group_vars: all: - ssh_allowed_zones: + geoip_ssh_allowed_zones: - "ALL" - ssh_allowed_networks: + geoip_ssh_allowed_networks: - "0.0.0.0/0" geoip_ufw_enabled: true geoip_sshd_enabled: true diff --git a/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2 b/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2 index 92b7d5e..eca979a 100644 --- a/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2 +++ b/ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2 @@ -6,8 +6,8 @@ if [ $# -ne 1 ]; then exit 0 # return true in case of config issue fi -NETWORKS="{{ ssh_allowed_networks | join(" ") }}" -ALLOW_COUNTRIES="{{ ssh_allowed_zones | join(" ") }}" +NETWORKS="{{ geoip_ssh_allowed_networks | join(" ") }}" +ALLOW_COUNTRIES="{{ geoip_ssh_allowed_zones | join(" ") }}" GEOIPTOOL=$(which geoiplookup) # Fetch the GitHub runner IP ranges diff --git a/ansible/roles/manage_users/.ansible-lint b/ansible/roles/login/.ansible-lint similarity index 100% rename from ansible/roles/manage_users/.ansible-lint rename to ansible/roles/login/.ansible-lint diff --git a/ansible/roles/manage_users/.yamllint.yml b/ansible/roles/login/.yamllint.yml similarity index 100% rename from ansible/roles/manage_users/.yamllint.yml rename to ansible/roles/login/.yamllint.yml diff --git a/ansible/roles/manage_users/README.md b/ansible/roles/login/README.md similarity index 100% rename from ansible/roles/manage_users/README.md rename to ansible/roles/login/README.md diff --git a/ansible/roles/login/defaults/main.yml b/ansible/roles/login/defaults/main.yml new file mode 100644 index 0000000..bc3a5f5 --- /dev/null +++ b/ansible/roles/login/defaults/main.yml @@ -0,0 +1,2 @@ +--- +login_users: [] diff --git a/ansible/roles/manage_users/handlers/main.yml b/ansible/roles/login/handlers/main.yml similarity index 100% rename from ansible/roles/manage_users/handlers/main.yml rename to ansible/roles/login/handlers/main.yml diff --git a/ansible/roles/manage_users/meta/main.yml b/ansible/roles/login/meta/main.yml similarity index 100% rename from ansible/roles/manage_users/meta/main.yml rename to ansible/roles/login/meta/main.yml diff --git a/ansible/roles/manage_users/molecule/default/converge.yml b/ansible/roles/login/molecule/default/converge.yml similarity index 100% rename from ansible/roles/manage_users/molecule/default/converge.yml rename to ansible/roles/login/molecule/default/converge.yml diff --git a/ansible/roles/manage_users/molecule/default/molecule.yml b/ansible/roles/login/molecule/default/molecule.yml similarity index 96% rename from ansible/roles/manage_users/molecule/default/molecule.yml rename to ansible/roles/login/molecule/default/molecule.yml index 5dece31..484c4fd 100644 --- a/ansible/roles/manage_users/molecule/default/molecule.yml +++ b/ansible/roles/login/molecule/default/molecule.yml @@ -16,7 +16,7 @@ provisioner: inventory: host_vars: instance: - ssh_users: + login_users: - username: testuser comment: Test User enabled: true diff --git a/ansible/roles/manage_users/molecule/default/prepare.yml b/ansible/roles/login/molecule/default/prepare.yml similarity index 100% rename from ansible/roles/manage_users/molecule/default/prepare.yml rename to ansible/roles/login/molecule/default/prepare.yml diff --git a/ansible/roles/manage_users/molecule/default/verify.yml b/ansible/roles/login/molecule/default/verify.yml similarity index 100% rename from ansible/roles/manage_users/molecule/default/verify.yml rename to ansible/roles/login/molecule/default/verify.yml diff --git a/ansible/roles/manage_users/tasks/main.yml b/ansible/roles/login/tasks/main.yml similarity index 93% rename from ansible/roles/manage_users/tasks/main.yml rename to ansible/roles/login/tasks/main.yml index e62c852..23de699 100644 --- a/ansible/roles/manage_users/tasks/main.yml +++ b/ansible/roles/login/tasks/main.yml @@ -11,7 +11,7 @@ password: "{{ lookup('env', 'USER_PASSWORD_' + (item.username | upper)) | password_hash('sha512', user_password_salt) }}" state: "{{ 'absent' if item.enabled is defined and not item.enabled else 'present' }}" shell: "{{ item.shell if item.shell is defined else '/bin/bash' }}" - loop: "{{ ssh_users }}" + loop: "{{ login_users }}" - name: "Add SSH Authorized key" become: true @@ -20,7 +20,7 @@ key: "{{ item.pubkey }}" state: "{{ 'present' if item.pubkey is defined else 'absent' }}" when: item.pubkey is defined - loop: "{{ ssh_users }}" + loop: "{{ login_users }}" - name: Create sudoers.d entry if user allowed become: true @@ -32,4 +32,4 @@ group: root mode: "0600" when: item.sudoer is defined and item.sudoer - loop: "{{ ssh_users }}" + loop: "{{ login_users }}" diff --git a/ansible/roles/manage_users/tests/inventory b/ansible/roles/login/tests/inventory similarity index 100% rename from ansible/roles/manage_users/tests/inventory rename to ansible/roles/login/tests/inventory diff --git a/ansible/roles/manage_users/tests/test.yml b/ansible/roles/login/tests/test.yml similarity index 100% rename from ansible/roles/manage_users/tests/test.yml rename to ansible/roles/login/tests/test.yml diff --git a/ansible/roles/manage_users/vars/main.yml b/ansible/roles/login/vars/main.yml similarity index 100% rename from ansible/roles/manage_users/vars/main.yml rename to ansible/roles/login/vars/main.yml diff --git a/ansible/roles/manage_users/defaults/main.yml b/ansible/roles/manage_users/defaults/main.yml deleted file mode 100644 index ca90990..0000000 --- a/ansible/roles/manage_users/defaults/main.yml +++ /dev/null @@ -1,3 +0,0 @@ ---- -# defaults file for manage_users -ssh_users: [] diff --git a/ansible/roles/microk8s/defaults/main.yml b/ansible/roles/microk8s/defaults/main.yml index 25b1682..1ddd90c 100644 --- a/ansible/roles/microk8s/defaults/main.yml +++ b/ansible/roles/microk8s/defaults/main.yml @@ -1,38 +1,41 @@ -k8s_version: "1.29" -kubectl_version: "1.29.0" +microk8s_k8s_version: "1.29" +microk8s_kubectl_version: "1.29.0" # load balancer configuration -lb_provider: "metallb" -lb_ips: "10.2.0.40-10.2.0.49" -lb_http_port: 80 -lb_https_port: 443 -metallb_version: 0.14.5 +microk8s_lb_provider: "metallb" +microk8s_lb_ips: "10.2.0.40-10.2.0.49" +microk8s_lb_http_port: 80 +microk8s_lb_https_port: 443 +microk8s_metallb_version: 0.14.5 # certificate manager -issuer_email: webmaster@localhost.localdomain -certmgr_version: 1.14.5 +microk8s_issuer_email: webmaster@localhost.localdomain +microk8s_certmgr_version: 1.14.5 # microk8s specific -microk8s_channel: "{{ k8s_version }}/stable" +microk8s_channel: "{{ microk8s_k8s_version }}/stable" microk8s_privileged: true microk8s_alt_names: "localhost.localdomain" microk8s_status_timeout: 300 -k8s_users: [] +microk8s_users: [] -k8s_host_public_ip: "{{ ansible_default_ipv4.address }}" +microk8s_host_public_ip: "{{ ansible_default_ipv4.address }}" -k8s_net_devices: +microk8s_net_devices: - "cni+" - "flannel+" -k8s_incoming_traffic: +microk8s_incoming_traffic: - { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" } - { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" } - - { rule: "allow", port: "10254", proto: "tcp", from: "{{ k8s_host_public_ip }}" } + - { rule: "allow", port: "10254", proto: "tcp", from: "{{ microk8s_host_public_ip }}" } -k8s_outgoing_traffic: [] +microk8s_outgoing_traffic: [] -k8s_allowed_hosts: [] +microk8s_allowed_hosts: [] -k8s_iac_user: "provision" \ No newline at end of file +microk8s_iac_user: "provision" + +microk8s_encryption_secret: "a13labs" +microk8s_encryption_cfg: "/etc/microk8s_encryption.yaml" diff --git a/ansible/roles/microk8s/tasks/certmanager.yml b/ansible/roles/microk8s/tasks/certmanager.yml index ad3aa96..84f75ec 100644 --- a/ansible/roles/microk8s/tasks/certmanager.yml +++ b/ansible/roles/microk8s/tasks/certmanager.yml @@ -1,6 +1,6 @@ - name: CertManager | Copy latest manifest ansible.builtin.get_url: - url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ certmgr_version }}/cert-manager.yaml" + url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ microk8s_certmgr_version }}/cert-manager.yaml" dest: "{{ k8s_etc }}/k8s-certmanager.yaml" mode: "0600" @@ -35,7 +35,7 @@ # The ACME server URL server: https://acme-v02.api.letsencrypt.org/directory # Email address used for ACME registration - email: "{{ issuer_email }}" + email: "{{ microk8s_issuer_email }}" # Name of a secret used to store the ACME account private key privateKeySecretRef: name: letsencrypt-prod @@ -65,7 +65,7 @@ # The ACME server URL server: https://acme-staging-v02.api.letsencrypt.org/directory # Email address used for ACME registration - email: "{{ issuer_email }}" + email: "{{ microk8s_issuer_email }}" # Name of a secret used to store the ACME account private key privateKeySecretRef: name: letsencrypt-staging diff --git a/ansible/roles/microk8s/tasks/iac.yml b/ansible/roles/microk8s/tasks/iac.yml index d6af39f..a71e7f6 100644 --- a/ansible/roles/microk8s/tasks/iac.yml +++ b/ansible/roles/microk8s/tasks/iac.yml @@ -11,7 +11,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: "{{ k8s_iac_user }}" + name: "{{ microk8s_iac_user }}" namespace: default tags: - k8s::iac @@ -29,10 +29,10 @@ apiVersion: v1 kind: Secret metadata: - name: "{{ k8s_iac_user }}-token" + name: "{{ microk8s_iac_user }}-token" namespace: default annotations: - kubernetes.io/service-account.name: "{{ k8s_iac_user }}" + kubernetes.io/service-account.name: "{{ microk8s_iac_user }}" type: kubernetes.io/service-account-token tags: - k8s::iac @@ -58,14 +58,14 @@ subjects: - kind: ServiceAccount namespace: default - name: "{{ k8s_iac_user }}" + name: "{{ microk8s_iac_user }}" tags: - k8s::iac - name: Get the secret name ansible.builtin.shell: | set -o pipefail - microk8s.kubectl -n default get secret | grep {{ k8s_iac_user }} | awk '{ print $1 }' + microk8s.kubectl -n default get secret | grep {{ microk8s_iac_user }} | awk '{ print $1 }' args: executable: /bin/bash register: secret_name @@ -98,44 +98,48 @@ tags: - k8s::iac -- name: Patch kubeconfig with user token - ansible.builtin.set_fact: - patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}" - vars: - new_kubeconfig: - contexts: - - context: - cluster: microk8s-cluster - user: "{{ k8s_iac_user }}" - name: microk8s - users: - - name: "{{ k8s_iac_user }}" - user: - token: "{{ token.stdout }}" - tags: - - k8s::iac +- name: Render kubeconfig + when: kubeconfig.stdout != "" + block: + - name: Patch kubeconfig with user token + ansible.builtin.set_fact: + patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}" + vars: + new_kubeconfig: + contexts: + - context: + cluster: microk8s-cluster + user: "{{ microk8s_iac_user }}" + name: microk8s + users: + - name: "{{ microk8s_iac_user }}" + user: + token: "{{ token.stdout }}" + tags: + - k8s::iac -- name: Check if a config already exists and its SHA1 - become: true - ansible.builtin.stat: - path: "{{ k8s_kubeconfig }}" - register: kubeconfig_exists - tags: - - k8s::iac + - name: Check if a config already exists and its SHA1 + become: true + ansible.builtin.stat: + path: "{{ k8s_kubeconfig }}" + register: kubeconfig_exists + tags: + - k8s::iac -- name: Get new config SHA1 - ansible.builtin.set_fact: - patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}" - tags: - - k8s::iac + - name: Get new config SHA1 + ansible.builtin.set_fact: + patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}" + tags: + - k8s::iac -- name: Write kubeconfig - become: true - ansible.builtin.copy: - content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}" - dest: "{{ k8s_kubeconfig }}" - owner: "{{ k8s_iac_user }}" - mode: "0600" - when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum - tags: - - k8s::iac + - name: Write kubeconfig + become: true + ansible.builtin.copy: + content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}" + dest: "{{ k8s_kubeconfig }}" + owner: "{{ microk8s_iac_user }}" + mode: "0600" + when: + - not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum + tags: + - k8s::iac diff --git a/ansible/roles/microk8s/tasks/loadbalancer.yml b/ansible/roles/microk8s/tasks/loadbalancer.yml index 35dad36..18d70ac 100644 --- a/ansible/roles/microk8s/tasks/loadbalancer.yml +++ b/ansible/roles/microk8s/tasks/loadbalancer.yml @@ -1,5 +1,5 @@ -- name: Loadbalancer | Setup '{{ lb_provider }}' - ansible.builtin.include_tasks: "loadbalancer/{{ lb_provider }}.yaml" +- name: Loadbalancer | Setup '{{ microk8s_lb_provider }}' + ansible.builtin.include_tasks: "loadbalancer/{{ microk8s_lb_provider }}.yaml" - name: Loadbalancer | Create Loadbalancer for Nginx ingress environment: @@ -23,9 +23,9 @@ ports: - name: http protocol: TCP - port: "{{ lb_http_port }}" + port: "{{ microk8s_lb_http_port }}" targetPort: 80 - name: https protocol: TCP - port: "{{ lb_https_port }}" + port: "{{ microk8s_lb_https_port }}" targetPort: 443 diff --git a/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml b/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml index f7a369c..f8505b5 100644 --- a/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml +++ b/ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml @@ -1,6 +1,6 @@ - name: MetalLB | Copy manifest files to host ansible.builtin.get_url: - url: "https://raw.githubusercontent.com/metallb/metallb/v{{ metallb_version }}/config/manifests/metallb-native.yaml" + url: "https://raw.githubusercontent.com/metallb/metallb/v{{ microk8s_metallb_version }}/config/manifests/metallb-native.yaml" dest: "{{ k8s_etc }}/metallb.yaml" mode: "0600" @@ -32,7 +32,7 @@ namespace: metallb-system spec: addresses: - - "{{ lb_ips }}" + - "{{ microk8s_lb_ips }}" - name: MetalLB | Create L2Advertisement environment: diff --git a/ansible/roles/microk8s/tasks/main.yml b/ansible/roles/microk8s/tasks/main.yml index 22fe283..5dc060c 100644 --- a/ansible/roles/microk8s/tasks/main.yml +++ b/ansible/roles/microk8s/tasks/main.yml @@ -53,7 +53,7 @@ - name: Download kubectl become: true ansible.builtin.get_url: - url: "https://dl.k8s.io/release/v{{ kubectl_version }}/bin/linux/amd64/kubectl" + url: "https://dl.k8s.io/release/v{{ microk8s_kubectl_version }}/bin/linux/amd64/kubectl" dest: "/usr/local/bin/kubectl" mode: "0755" owner: "root" @@ -78,7 +78,7 @@ - name: "Setup local user access to k8s - {{ item.username }}" ansible.builtin.include_tasks: "setupenv/main.yml" - loop: "{{ k8s_users }}" - when: k8s_users is defined + loop: "{{ microk8s_users }}" + when: microk8s_users is defined tags: - k8s::users diff --git a/ansible/roles/microk8s/tasks/microk8s/encryption.yml b/ansible/roles/microk8s/tasks/microk8s/encryption.yml deleted file mode 100644 index e69de29..0000000 diff --git a/ansible/roles/microk8s/tasks/microk8s/install.yml b/ansible/roles/microk8s/tasks/microk8s/install.yml index 0f40dcf..0977b47 100644 --- a/ansible/roles/microk8s/tasks/microk8s/install.yml +++ b/ansible/roles/microk8s/tasks/microk8s/install.yml @@ -1,4 +1,3 @@ -# Install a snap with classic confinement - name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}' become: true community.general.snap: @@ -6,6 +5,25 @@ channel: "{{ microk8s_channel }}" classic: true +- name: Create encryption configuration + become: true + ansible.builtin.copy: + content: | + --- + apiVersion: apiserver.config.k8s.io/v1 + kind: EncryptionConfiguration + resources: + - resources: + - secrets + providers: + - aescbc: + keys: + - name: k8s-crypto + secret: {{ microk8s_encryption_secret }} + - identity: {} + dest: "{{ microk8s_encryption_cfg }}" + mode: "0600" + - name: Microk8s | Patch microk8s configuration notify: ["Restart microk8s"] block: @@ -16,6 +34,13 @@ line: "--allow-privileged=true" insertafter: "^--insecure-port=0$" + - name: Microk8s | Enable encryption provider + become: true + ansible.builtin.lineinfile: + path: /var/snap/microk8s/current/args/kube-apiserver + line: "--encryption-provider-config=/a13labs/microk8s/encryption.yaml" + insertafter: "^--insecure-port=0$" + - name: Microk8s | Fixing Disk Pressure become: true ansible.builtin.lineinfile: @@ -64,17 +89,8 @@ - { plugin: "ingress", wait: 60, args: "", enabled: true } - { plugin: "hostpath-storage", wait: 10, args: "", enabled: true } -- name: Microk8s | Check if ufw is enabled - become: true - ansible.builtin.shell: - cmd: "ufw status" - register: ufw_status - changed_when: false - - name: Microk8s | Configure required ufw rules ansible.builtin.include_tasks: microk8s/ufw.yml - when: - - ufw_status.stdout.find("Status: active") != -1 - name: Microk8s | Store kubeconfig ansible.builtin.shell: diff --git a/ansible/roles/microk8s/tasks/microk8s/ufw.yml b/ansible/roles/microk8s/tasks/microk8s/ufw.yml index b7c7527..d55a81b 100644 --- a/ansible/roles/microk8s/tasks/microk8s/ufw.yml +++ b/ansible/roles/microk8s/tasks/microk8s/ufw.yml @@ -6,7 +6,7 @@ interface: "{{ item }}" comment: ansible managed with_items: - - "{{ k8s_net_devices }}" + - "{{ microk8s_net_devices }}" retries: 5 delay: 10 @@ -18,7 +18,7 @@ interface: "{{ item }}" comment: ansible managed with_items: - - "{{ k8s_net_devices }}" + - "{{ microk8s_net_devices }}" retries: 5 delay: 10 @@ -31,7 +31,7 @@ proto: "{{ item.proto }}" comment: ansible managed with_items: - - "{{ k8s_incoming_traffic }}" + - "{{ microk8s_incoming_traffic }}" retries: 5 delay: 10 @@ -43,7 +43,7 @@ direction: out comment: ansible managed with_items: - - "{{ k8s_outgoing_traffic }}" + - "{{ microk8s_outgoing_traffic }}" retries: 5 delay: 10 @@ -56,6 +56,6 @@ proto: tcp comment: ansible managed with_items: - - "{{ k8s_allowed_hosts }}" + - "{{ microk8s_allowed_hosts }}" retries: 5 delay: 10 diff --git a/ansible/roles/microk8s/tasks/setupenv/main.yml b/ansible/roles/microk8s/tasks/setupenv/main.yml index 05f3866..78aa1a8 100644 --- a/ansible/roles/microk8s/tasks/setupenv/main.yml +++ b/ansible/roles/microk8s/tasks/setupenv/main.yml @@ -36,7 +36,7 @@ ignore_errors: true - name: Configure user access - when: item.enabled and secret_exists.stdout != "0" + when: item.enabled and secret_exists.stdout != "0" and secret_exists.stdout != "" block: - name: Get the secret name ansible.builtin.shell: | diff --git a/ansible/roles/virtualization/molecule/default/molecule.yml b/ansible/roles/virtualization/molecule/default/molecule.yml index f9d54f3..d873be3 100644 --- a/ansible/roles/virtualization/molecule/default/molecule.yml +++ b/ansible/roles/virtualization/molecule/default/molecule.yml @@ -15,11 +15,11 @@ provisioner: inventory: group_vars: all: - ssh_allowed_zones: + geoip_ssh_allowed_zones: - "ALL" - ssh_allowed_networks: + geoip_ssh_allowed_networks: - "0.0.0.0/0" - host_vars: {} + host_vars: {} platforms: - name: jammy box: "jaredeh/ubuntu2204-server" @@ -38,12 +38,12 @@ platforms: config_options: vm.boot_timeout: 600 ssh.keep_alive: yes - ssh.remote_user: 'ansible' + ssh.remote_user: "ansible" synced_folder: true provider_options: - video_type: 'vga' - host: 'localhost' - uri: 'qemu:///system' + video_type: "vga" + host: "localhost" + uri: "qemu:///system" nested: true memory: 4096 verifier: @@ -52,4 +52,4 @@ lint: | set -e ansible-lint scenario: - name: default \ No newline at end of file + name: default diff --git a/ansible/sectool.env b/ansible/sectool.env index 85c7294..766eecb 100644 --- a/ansible/sectool.env +++ b/ansible/sectool.env @@ -6,3 +6,4 @@ USER_PASSWORD_SALT=$USER_PASSWORD_SALT USER_PASSWORD_OPERATOR=$USER_PASSWORD_OPERATOR ANSIBLE_FORCE_COLOR=True BUCKET_SUFFIX=$BUCKET_SUFFIX +MICROK8S_ENCRYPTION_SECRET=$MICROK8S_ENCRYPTION_SECRET diff --git a/repository.vault b/repository.vault index 030cb64..d4b7b89 100644 --- a/repository.vault +++ b/repository.vault @@ -1 +1 @@ -bCt1NV1R5FDMa9kEhZTJVefbnHPE4zqzKrfwqkqxoO1JVIkMsnAQCr79i4TeMme4wRop+GX08GkJQq5gp8nLSnz5r+y+RckUVTuA1LMg4mEuwVkQ8lyy9lMY3K/KHtzjRAfR2zlOZ+V02BelHos1KApzdoMfWg5SsLqntvxkexXiZH7Z6BahniWLldC3mE9lBwuTU8epJS0v9ngerj+MMK9DwSHvPHrCs6iGbHVo18iboO561mnvLVV6YOQ7ub3oTwYmGaYmWvn+vRVpFQmLw7Cp9T2IwLdadgcLoKrbzLf6ee8wo0IBW765d16krBh1L7p2tpHcyIUE9gTCkylXVApX3oslQlgtzMoTOaWZ6hmjP0rD8kzn6XceFcpx1dEOd5a9j+tb4EIP0HJoFVdGb/MQnmmumyla+aGJY0VtHbx3b2TICvgwr45RUHRKDI1UgA02rXKeklfcXvoOpq5kweV4DxckElzLjGohZHESWdbY1y2knMVIuCImRv01jbP1rwrwdKt1LGlWBX5OsOujS5qxBeHZNqnKrLbn1mkM1k5PtCnfLfn0NINA/lEs+VDK84RMmzz+s9rAyGNkTJpnbjfU2xhy0IQrXRJf+DGpCkhKRjzBLLnzwfeB5Ki6tjfFygphhkKMAofQ3wlpQ8ppMt93eZ5LONQg3ttdja41uPnPV68dgGhv92Rtx+ByisEhsoIAu2wJZ+jKPTCiVpru46dQDEwf7rGFu+RXK94LG7wg6YA2yJz3QooHcAPFvxaKCfnrfB9oY/qbElueZyvZr1unfE4BigHIfPkf4gRDVq8GiqRiypP+/Cxio1Wc3sLLJkOQmHW0+ZDeoqxHEsRfjHbb00FP+7QtFG2v7wJNH6FZxpDz/vRpoZRe2BlPKLQKbAXVWQHFXgP4Q9NikrQ3o32yMpTeUgSTv8lwk1dvUijEDEweudti3RWAlG6LOj5pYp8z4DY04s8Hz6ZEmYji1LPDl6jsRbjOM1bpZTjORLmYza757KhzMHPbjwUtR+sVfnIjUODVtdOnzRMRzBNufQPat+uHlZ/AxB3Gq+6AX46q6fC/moKu7d5vO2tVgZr8rQuYYa6hclkilp5Tt/WEXQB6EQ1VzDnMAe4AfQVJwNkjw/NXfTSvzro2qreHLNyLbxtgHOEOP1E7lvQqcSM9zm9DUhPx61LDe3WkRBoPcKZr0Lx8LvAwpENNOLyIZ7k5BcJNlhMbO4BPH3HRrDGIM+Bg9x2HkbDaLeBi9A7F2ueACXH+6a/ZqBG8jGBKbcXm3AqHqgYXKNhAwV2NmdV2awePEJ5byb4x2/2flrE4kO3LGIz98KXzBugJsY9+0Ox3V6X6jdHXkG29A5JdcfszhtsBVFQyk73GwZtMJxpTC8QJjykaKx/6lPm5QghbTXxDIHzEPFenUdssLx6JMJRcPWuKDXkK9pRkYamcEgxSjtCHRJI/luhWvSniPka4b5oGssl+VtQXmkpk9ntALUA+2zhhn5Us1AVNkDlPcGxAL+20Kx5K7gJ9RNAYznlZvRAYH4gKjNNOZiu52X4XSTKMaNgvK1bfM66UcslbviEfbUs0IGTT6wf1HrKKENoSb/EdP50hCWV+vOPUYxENS16J+oX2Xw2rz2EYeg0nWVsl2PXctuXlTf4HaVMKdm5XV7uNmla9hchRCUYh6C5jS763HZI0DVgGMPcxraImG0yaBZVT3NEZPeGqplrDrTcesCvGgybgSSjbvVhcMMN7WjlhQeuTvJQhvw8DhYgEyaKnX46DoEm3LKGu6TrA2m2VI7J1BwRAauu7yU0aHkJZ9FfeVZTzKcUy/1Cp+3mW1czego1PPA7TIPkaqT5QCJDB6Jlbk5yEEw1yA/z7H4k/y2h4HSVpG9m9+8ASTvHXwTuvTtvqJp3Xw+e6tXzF8eNXiki7/y3psxfROY3hsidsLg/kAYcOPhYmyQ8vb+gawATbgIf2gp6zRIjBXXmJ5chUzzszP9uxm/va/UE9o2Ntp8907sogYq2xOMPIP9NP30x9YRxsxvYKuzJD6fgEtWLdzy4G77mbsGT3Lajv4I8JKIKTjmOR+ah0GN9xadueTlVVqPXAaSYM40pKXPN9LcVCdYgQj3msV56hFRL0qOKs4gIiqvWD3bgE3bvQdkEThY2XhZ9U0DtIyvIW5Lw+EapzWfFY3TEVzzjxJN0f5lwoRnIOmIO9lJKKN/4ZOAPidZoCfz3HeRtzTRNZyY6WE7STtA05wI/zoV/K6SEeLyod02XfLFIa4TaoZoVpC+g/Kr7bG8TC30eDc31AhhN0Tfj/ID47t4oD6jeS2+3z1Ztn/Kfu63c8oCKp0trDV4SAsWs4qHPDrTDH2aJ6GlZZaaJuw5EBwAPuWqEVdJfr368XUYU506ToCOH3BMtuAuONoiR/wT/W5uei4K3kf+zvC2cOz8vAV+AIRY3yQK3mKg0b33CSE+GtcTpfBP+Q9PvPWL3JuhAap2pqXdEMDYfmV9Jn0h8izOFErVP/odPrvD9J51GenR0EVmsPq7p/DmmQHT7HF5GADEDHdkrwesBurAB5/M63l9WIzXQA8LIX6ksMy5ZLCEfg6IYNKoX/H6c9XXakSEQ6riZdBAXVzoozXEDmHankTPGurD6TEy1H2oFtBiYAB1PCaTJfPOC3iSaGClyQ7baTBTz7IrheaNKy/WT6dk8c7SYToidad3Bx+64zKpNwHP2/KjIUXJqZHSc1BaBdDk1fDHREHLlkHsq2A3rDSYYvhcG8gLLjkfD3lupLWO0kzfoynb/dCdn2HNVUog+/ \ No newline at end of file +FRbk2McaxArlE39vc3B7gyVWhqe8ejiDkZEWShEHC6YXLFYeGWE4EybXOntql6B9RWt3xhqKvpSOoEBlkXW9uB/efH2G1Wv4g5BhG1uwQsFIIfp5oRe2wYVT1p8EcQ59nESaJhk8KrUNFg2pUTyBXmMzMMIJOaO2NDwXX6j+y0fWH+hgjhI5putRK8I5tbMRLLpLH97Q90Ot11XUZPouiQm5wr1emOIZ3626oxAwCO4e6X8YnhuIhLXJgRuSvLnJCq1ClQCwvspPcwHzUZ2/p11eMhsjwbxAr2crUBj3MX1iSllAkA5HAIOkI2XOW58gWMZgHxDhfC/kkKYraEEMeSyVvmpZKnnn7A5xKQV699+TaEpI6sKSqIZbMRjYTuzlDGJRvlg8d5H8JxjLJ1l0wHTIEE0sdLGObaEjL8cRsOeoxBsRnqwwvDo/tS9OfLTt39Py4vylWJeEqLDJXvxKHJ5Dp35gxdEE+DDmS5WzhBUTVivke6pRbD9hHDC6VhwFjnCxh1gSVAsTK6gdn1MHglvAVyQwD1VyTa3+po0gXtVsyCpLv/o1FA/CTeZvc+xY5At2KjlZbo/huhJ96sUPDMlznNDgXJsviM19FH1eNPmCxLnPFx+2a9JPvRUeIrhuizHucBJPdXjyEnaowU/yjBXHh05dUuhClV9i/7dCuohR6kN7tm1RaQtUfjp6yWb9Y6+gZXQI+s0b7ePprrsjRFF8l84Ahvyn503esYAYy6/c/4400N3bIxaZ6AGoYpMuNItQZZsCC6s3hmhXL745AUOmkhwBS5VqXO1iQl71h0FGgPA/XD2ftUSpdH9on9xCCdPooGzR1L+fGLlVQIotb4kdXYJg8uC9nHtHWvQ7cfwBXORHUAQCOO1Qv3vk4G48JVjWvr5G03wtUn7Ph8DLUp2orjzzK4o8pCmHTy2allkYCOEeGZ9GXRKGNPZpjxhi5/lB6oM06urIPWFeQgZGQtt1xWrhmvZnwVEDIcdlWdz68imCBnimrV1eNBpGRiZzW7mKQ2seFWdwCZ3Gpvdco355jbMj7xetAISfaT2dMUH0YSJAp80d7XPXl7eB5nXUIRnqFnQGg5yCeSqpg/5YeLthwMhgylanJN72eVl5yiuWc7fJbJRu2r7cUcXS0WT6yYKcdDjVF0dIj/W44Y7jRjaoZ0zcMaFXlteNlKYpaSLknZ6PaF15G63YifGjHsHreZsXrUrhASBMBWcAiicAoTpEoC9yleZi+pzys8xW3q+zOl2WFOVo9wk3NNrblvL65yjKl0r/A/DMP8k8N7v2+KFeT5qNCKfSaCw1VxKvjPVMQcKnqdE9a7VZVAAQjm35pSA9jKUBJ6rJeNY/xUrvjtfQslKOVlBRQFHEl6mcfSc23fOAqx76AUFdfQWsWG+rrOFrr6Y3HERH/+kEOWHuF6U+vxIrGrJYhF2hkz0wvXE0tni5oi3UZB5b58gd9jQShQIaOwLHco/iJIo1z9aa3rl/wkdjM3OGvubC2gbVeQ1YVgKREH83NaHWxUNDEamuxBHzEL+uNj79uWGLvD9s0wJMD/OD2HXGaUD+yUj3vS11V9XqZ71aNG6qg9I5Pwx50togX9LOfiMemkPuGuN1HscXnVFca+tQ1z+oGrPT4BLVW6LF0DnpooQZmdbYytvMi3O1ZYktvxPQY8UB2Om6fwDwWE5q3Hbyv3ji1c3m4Cnr5SHUeZYl2jujKl5E0Remjz3B3LNGTKncdUq4pW/8qZ8Obz4KXsEgkpNBVJhK1W/8gy/lLEl/Rkr2ustuZnRx8QiGkW13MSRr0r3U/Y94UdzmKrvldsdA1D19EDj+RSHdMzrJd6AHwBIzrqM33gF4SF1nF6tSUqBj2ylnHebU3ynUI5axaU5yfqSduiCPCTylnmYb/AqaMk/hlIIx2M9BTCgfbMNSeDdLDerPSmptM7cQ6GU0W4dZvJSvAy3oloyG9bwTpRMhHzWW059nicJyCCCJMUrpKSRTqJypw8iSa71TtjT9Du5gGsgZHS9ATNOutQ60+9lAEtK6UPEcMU2MNfN+em3m9GxAJ/zorfrdg131Tqu6csZ2lN9M+WxrRaRlGHIS89xgWsOZ3E7EKjGm0RY0yj4e2Z6JPT6KvEMVZS0y23/33GW4SSysfvGKEA4/62IuueyPllrQZZS1qB3BiWHZjUUf+GSFRQlMapOTaEsOUMeny5K9Wgdm0utlrmbTlFdGMCdv/dJ4lb/vUynSVq6BopJ3nUfetxTjOoT/B0fmhvwy6ddYibh3AgCfZD9UHPGbiFum1/9Tbb2MvMM1M6LQ988bcqbFGio9exzgySaWL5lYjQTqCICPn7I4uQRf+rZHUeMfHYXzQbWsfNyRH75NSPakhdVSss1dFtl/d3jGzlb83I5CdbttznSKsGd3bmHimfCodlyJuIjI2XhW7WK6RbeUoRnqKnRNANFTa2BaXDZUCVhpZB4DcMboNisIxNF/QiH+3u+b6ba0xAXtLXNl1gITmA04UG3yTfx44jF9s6Xpt60nEH/oMeW1kiL02oV26BYT9MTx9neh5WMMNLBHhWw/98v0LeJX3imlM7tTjPgF/eE6z12ndeFQrQiFILN3jClbkKwS+yliXCpeO6+akKraSTGUcrUXxWMrfc9xkvR2fjUzWHBSqXSQMFPoJBrYfQbtFuNcGebQwwYmorTpa96p5uE2Ro9goOoeElG1bkCBcyBiXlQJo10/d84YAMQMsDLb2q19GGFT/itiO2scxTwec+8APRE9oL8bMdhOeDA5kOeC/HQaeOKkPEt8K5qALAWTjWHVQTEAOoHdv+HE5g7yacuAAecIodmJQbynQTXi8u27KJJBQOdUblJ8c3u4b5/HnkQLGe2/RYnVv5qhvT/KQNzwXPdXKVfcsE+gyye4Th2WqmI= \ No newline at end of file From d2bf2ed418de4e86ffe46b0b060c028ac30d0ef7 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sat, 28 Sep 2024 23:24:08 +0200 Subject: [PATCH 5/7] Refactor sshconfig.yml to set ssh version as fact only when ssh_version.stderr is not empty --- ansible/roles/cis/tasks/sshconfig.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/ansible/roles/cis/tasks/sshconfig.yml b/ansible/roles/cis/tasks/sshconfig.yml index 1e2fa03..c3dd06d 100644 --- a/ansible/roles/cis/tasks/sshconfig.yml +++ b/ansible/roles/cis/tasks/sshconfig.yml @@ -13,6 +13,7 @@ - name: Set ssh version as fact ansible.builtin.set_fact: ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing] + when: ssh_version.stderr != "" tags: - roles::cis::sshd - sshd From abf28888fbd41fd69b223d1fe593458d3a5f90c3 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sat, 28 Sep 2024 23:30:41 +0200 Subject: [PATCH 6/7] Refactor ansible-lint configuration --- ansible/.ansible-lint | 3 +- ansible/playbook_cis.yml | 4 -- ansible/playbook_kvm.yml | 36 ------------ ansible/roles/cis/defaults/main/misc.yml | 3 +- .../roles/microk8s/templates/microk8s.yml.j2 | 12 ---- ansible/roles/virtualization/.ansible-lint | 10 ---- ansible/roles/virtualization/.yamllint | 33 ----------- .../roles/virtualization/defaults/main.yml | 18 ------ .../molecule/default/INSTALL.rst | 23 -------- .../molecule/default/converge.yml | 28 ---------- .../molecule/default/molecule.yml | 55 ------------------- .../molecule/default/verify.yml | 10 ---- ansible/roles/virtualization/requirements.yml | 4 -- ansible/roles/virtualization/tasks/init.yml | 14 ----- .../roles/virtualization/tasks/install.yml | 25 --------- ansible/roles/virtualization/tasks/main.yml | 19 ------- .../virtualization/tasks/manage_config.yml | 16 ------ .../virtualization/tasks/manage_service.yml | 6 -- 18 files changed, 3 insertions(+), 316 deletions(-) delete mode 100644 ansible/playbook_kvm.yml delete mode 100644 ansible/roles/microk8s/templates/microk8s.yml.j2 delete mode 100644 ansible/roles/virtualization/.ansible-lint delete mode 100644 ansible/roles/virtualization/.yamllint delete mode 100644 ansible/roles/virtualization/defaults/main.yml delete mode 100644 ansible/roles/virtualization/molecule/default/INSTALL.rst delete mode 100644 ansible/roles/virtualization/molecule/default/converge.yml delete mode 100644 ansible/roles/virtualization/molecule/default/molecule.yml delete mode 100644 ansible/roles/virtualization/molecule/default/verify.yml delete mode 100644 ansible/roles/virtualization/requirements.yml delete mode 100644 ansible/roles/virtualization/tasks/init.yml delete mode 100644 ansible/roles/virtualization/tasks/install.yml delete mode 100644 ansible/roles/virtualization/tasks/main.yml delete mode 100644 ansible/roles/virtualization/tasks/manage_config.yml delete mode 100644 ansible/roles/virtualization/tasks/manage_service.yml diff --git a/ansible/.ansible-lint b/ansible/.ansible-lint index ef6405d..181f3a7 100644 --- a/ansible/.ansible-lint +++ b/ansible/.ansible-lint @@ -4,7 +4,8 @@ exclude_paths: - .github/ - tests/ enable_list: - - fqcn-builtins # opt-in + - fqcn-builtins # opt-in warn_list: - line-length - yaml[line-length] + - var-naming[no-role-prefix] diff --git a/ansible/playbook_cis.yml b/ansible/playbook_cis.yml index a6b6091..f10119e 100644 --- a/ansible/playbook_cis.yml +++ b/ansible/playbook_cis.yml @@ -13,9 +13,6 @@ - roles - roles::users - role: "cis" - vars: - # currently aide is failing - install_aide: false tags: - roles - roles::cis @@ -31,4 +28,3 @@ tags: - roles - roles::duosecurity - diff --git a/ansible/playbook_kvm.yml b/ansible/playbook_kvm.yml deleted file mode 100644 index 1d4f932..0000000 --- a/ansible/playbook_kvm.yml +++ /dev/null @@ -1,36 +0,0 @@ ---- -- name: Virtualization Server - hosts: kvm - gather_facts: true - - roles: - - role: "bootstrap" - tags: - - roles - - roles::bootstrap - - role: "manage_users" - tags: - - roles - - roles::users - - role: "cis_hardening" - vars: - # currently aide is failing - install_aide: false - tags: - - roles - - roles::cis - - role: "fail2ban" - tags: - - roles - - roles::fail2ban - - role: "geoip" - tags: - - roles - - roles::geoip - - role: "duo_security" - tags: - - roles - - roles::duosecurity - - role: "virtualization" - tags: - - role::virtualization diff --git a/ansible/roles/cis/defaults/main/misc.yml b/ansible/roles/cis/defaults/main/misc.yml index 55e3389..1b8cc82 100644 --- a/ansible/roles/cis/defaults/main/misc.yml +++ b/ansible/roles/cis/defaults/main/misc.yml @@ -1,5 +1,5 @@ --- -install_aide: true +install_aide: false reboot_ubuntu: false redhat_signing_keys: - 567E347AD0044ADE55BA8A5F199E2F91FD431D51 @@ -10,4 +10,3 @@ epel8_signing_keys: - 94E279EB8D8F25B21810ADF121EA45AB2F86D6A1 epel9_signing_keys: - FF8AD1344597106ECE813B918A3872BF3228467C -... diff --git a/ansible/roles/microk8s/templates/microk8s.yml.j2 b/ansible/roles/microk8s/templates/microk8s.yml.j2 deleted file mode 100644 index 7782af9..0000000 --- a/ansible/roles/microk8s/templates/microk8s.yml.j2 +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: apiserver.config.k8s.io/v1 -kind: EncryptionConfiguration -resources: - - resources: - - secrets - providers: - - aescbc: - keys: - - name: k8s-crypto - secret: {{ secret }} - - identity: {} diff --git a/ansible/roles/virtualization/.ansible-lint b/ansible/roles/virtualization/.ansible-lint deleted file mode 100644 index ef6405d..0000000 --- a/ansible/roles/virtualization/.ansible-lint +++ /dev/null @@ -1,10 +0,0 @@ ---- -exclude_paths: - - .git/ - - .github/ - - tests/ -enable_list: - - fqcn-builtins # opt-in -warn_list: - - line-length - - yaml[line-length] diff --git a/ansible/roles/virtualization/.yamllint b/ansible/roles/virtualization/.yamllint deleted file mode 100644 index 8827676..0000000 --- a/ansible/roles/virtualization/.yamllint +++ /dev/null @@ -1,33 +0,0 @@ ---- -# Based on ansible-lint config -extends: default - -rules: - braces: - max-spaces-inside: 1 - level: error - brackets: - max-spaces-inside: 1 - level: error - colons: - max-spaces-after: -1 - level: error - commas: - max-spaces-after: -1 - level: error - comments: disable - comments-indentation: disable - document-start: disable - empty-lines: - max: 3 - level: error - hyphens: - level: error - indentation: disable - key-duplicates: enable - line-length: disable - new-line-at-end-of-file: disable - new-lines: - type: unix - trailing-spaces: disable - truthy: disable diff --git a/ansible/roles/virtualization/defaults/main.yml b/ansible/roles/virtualization/defaults/main.yml deleted file mode 100644 index e0ed417..0000000 --- a/ansible/roles/virtualization/defaults/main.yml +++ /dev/null @@ -1,18 +0,0 @@ ---- -# Copyright 2019 Alexandre Pires ( c.alexandre.pires@gmail.com ) -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -libvirt_users: ["{{ ansible_env.SUDO_USER | d('root') }}"] -libvirt_pool__dir: "/srv/pools" -libvirt_ansible__pool__name: "default" diff --git a/ansible/roles/virtualization/molecule/default/INSTALL.rst b/ansible/roles/virtualization/molecule/default/INSTALL.rst deleted file mode 100644 index 0c4bf5c..0000000 --- a/ansible/roles/virtualization/molecule/default/INSTALL.rst +++ /dev/null @@ -1,23 +0,0 @@ -********************************* -Vagrant driver installation guide -********************************* - -Requirements -============ - -* Vagrant -* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop - -Install -======= - -Please refer to the `Virtual environment`_ documentation for installation best -practices. If not using a virtual environment, please consider passing the -widely recommended `'--user' flag`_ when invoking ``pip``. - -.. _Virtual environment: https://virtualenv.pypa.io/en/latest/ -.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site - -.. code-block:: bash - - $ pip install 'molecule_vagrant' diff --git a/ansible/roles/virtualization/molecule/default/converge.yml b/ansible/roles/virtualization/molecule/default/converge.yml deleted file mode 100644 index 8d52260..0000000 --- a/ansible/roles/virtualization/molecule/default/converge.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -- name: Converge - hosts: all - tasks: - - name: Update Package Cache (apt/Ubuntu) - become: true - ansible.builtin.apt: - update_cache: yes - changed_when: false - when: ansible_distribution == "Ubuntu" - - - name: Update Package Cache (dnf/CentOS) - become: true - ansible.builtin.dnf: - update_cache: yes - changed_when: false - when: ansible_distribution == "CentOS" - - - name: Update Package Cache (yum/Amazon) - become: true - ansible.builtin.yum: - update_cache: yes - changed_when: false - when: ansible_distribution == "Amazon" - - - name: "Include virtualization" - ansible.builtin.include_role: - name: "virtualization" diff --git a/ansible/roles/virtualization/molecule/default/molecule.yml b/ansible/roles/virtualization/molecule/default/molecule.yml deleted file mode 100644 index d873be3..0000000 --- a/ansible/roles/virtualization/molecule/default/molecule.yml +++ /dev/null @@ -1,55 +0,0 @@ ---- -dependency: - name: galaxy - enabled: true -driver: - name: vagrant - provider: - name: libvirt -provisioner: - name: ansible - config_options: - defaults: - callbacks_enabled: profile_tasks - log: true - inventory: - group_vars: - all: - geoip_ssh_allowed_zones: - - "ALL" - geoip_ssh_allowed_networks: - - "0.0.0.0/0" - host_vars: {} -platforms: - - name: jammy - box: "jaredeh/ubuntu2204-server" - box_version: "0.1.1" - interfaces: - - auto_config: true - network_name: private_network - type: dhcp - instance_raw_config_args: - # use single quotes to avoid YAML parsing as dict due to ':' - - 'vm.synced_folder ".", "/vagrant", type: "rsync"' - # Run 'uname' a provisionning step **needs 'provision: true' to work** - - 'vm.provision :shell, inline: "uname"' - # Dictionary of `config` options. Note that string values need to be - # explicitly enclosed in quotes. - config_options: - vm.boot_timeout: 600 - ssh.keep_alive: yes - ssh.remote_user: "ansible" - synced_folder: true - provider_options: - video_type: "vga" - host: "localhost" - uri: "qemu:///system" - nested: true - memory: 4096 -verifier: - name: ansible -lint: | - set -e - ansible-lint -scenario: - name: default diff --git a/ansible/roles/virtualization/molecule/default/verify.yml b/ansible/roles/virtualization/molecule/default/verify.yml deleted file mode 100644 index e707420..0000000 --- a/ansible/roles/virtualization/molecule/default/verify.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -# This is an example playbook to execute Ansible tests. - -- name: Verify - hosts: all - gather_facts: false - tasks: - - name: Example assertion - ansible.builtin.assert: - that: true diff --git a/ansible/roles/virtualization/requirements.yml b/ansible/roles/virtualization/requirements.yml deleted file mode 100644 index 04fb28e..0000000 --- a/ansible/roles/virtualization/requirements.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -collections: - - community.general - - community.libvirt diff --git a/ansible/roles/virtualization/tasks/init.yml b/ansible/roles/virtualization/tasks/init.yml deleted file mode 100644 index cba6e55..0000000 --- a/ansible/roles/virtualization/tasks/init.yml +++ /dev/null @@ -1,14 +0,0 @@ -- name: Ubuntu specific tasks - when: ansible_distribution == 'Ubuntu' - block: - - name: Update APT cache - become: true - ansible.builtin.apt: - update_cache: yes - cache_valid_time: 3600 - - - name: Install Dependencies - become: true - ansible.builtin.package: - pkg: "python3-pip" - state: present diff --git a/ansible/roles/virtualization/tasks/install.yml b/ansible/roles/virtualization/tasks/install.yml deleted file mode 100644 index bf85f25..0000000 --- a/ansible/roles/virtualization/tasks/install.yml +++ /dev/null @@ -1,25 +0,0 @@ - -- name: Install system packages for virtualization - become: true - ansible.builtin.package: - pkg: "{{ item }}" - state: present - loop: - - qemu-kvm - - libvirt-daemon-system - - virtinst - - libvirt-clients - - bridge-utils - - python3-libvirt - - dnsmasq - - qemu-utils - - bzip2 - - libxml2-utils - -- name: Install PIP packages for virtualization - become: true - ansible.builtin.pip: - name: "{{ item }}" - state: present - loop: - - lxml diff --git a/ansible/roles/virtualization/tasks/main.yml b/ansible/roles/virtualization/tasks/main.yml deleted file mode 100644 index 77bb48b..0000000 --- a/ansible/roles/virtualization/tasks/main.yml +++ /dev/null @@ -1,19 +0,0 @@ ---- -- name: 'Install required packages for virtualization' - ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml" - tags: - - 'role::virtualization' - - 'role::virtualization::install' - -- name: 'Config virtualization support on host' - ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_config.yml" - tags: - - 'role::virtualization' - - 'role::virtualization::config' - -- name: 'Restart and enable/disable virtualization service' - ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_service.yml" - tags: - - 'role::virtualization' - - 'role::virtualization::install' - - 'role::virtualization::service' diff --git a/ansible/roles/virtualization/tasks/manage_config.yml b/ansible/roles/virtualization/tasks/manage_config.yml deleted file mode 100644 index 6cc792e..0000000 --- a/ansible/roles/virtualization/tasks/manage_config.yml +++ /dev/null @@ -1,16 +0,0 @@ -- name: Adding required users to group libvirt - become: true - ansible.builtin.user: - name: "{{ item }}" - groups: - - libvirt - append: true - loop: "{{ libvirt_users }}" - -- name: Fix qemu.conf SE Linux driver - when: ansible_distribution == 'Ubuntu' - become: true - ansible.builtin.lineinfile: - dest: /etc/libvirt/qemu.conf - line: 'security_driver = "none"' - state: present diff --git a/ansible/roles/virtualization/tasks/manage_service.yml b/ansible/roles/virtualization/tasks/manage_service.yml deleted file mode 100644 index b070a67..0000000 --- a/ansible/roles/virtualization/tasks/manage_service.yml +++ /dev/null @@ -1,6 +0,0 @@ -- name: Service enable/disable - become: true - ansible.builtin.service: - name: libvirtd - enabled: yes - state: started \ No newline at end of file From 2206c2b67af59c7afe94dc4f74dd17c723e46f4d Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sun, 29 Sep 2024 00:16:51 +0200 Subject: [PATCH 7/7] Refactor systemd unit files for mounting and opening LUKS devices --- ansible/playbook_encryption.yml | 9 ++++++--- ansible/playbook_gitea.yml | 13 +++++++++++++ 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/ansible/playbook_encryption.yml b/ansible/playbook_encryption.yml index 1203c45..7cdbcae 100644 --- a/ansible/playbook_encryption.yml +++ b/ansible/playbook_encryption.yml @@ -93,6 +93,7 @@ [Unit] Description=Open LUKS device After=network-online.target + Before=snap.microk8s.daemon-kubelite.service [Service] Type=oneshot @@ -103,7 +104,7 @@ ExecStop=/usr/sbin/cryptsetup close {{ luks_device_name }} [Install] - WantedBy=remote-fs.target + WantedBy=snap.microk8s.daemon-kubelite.service - name: Create systemd service to mount the file system ansible.builtin.copy: @@ -112,7 +113,9 @@ content: | [Unit] Description=Mount LUKS device - After=remote-fs.target + After={{ key_fetch_service }} + Requires={{ key_fetch_service }} + Before=snap.microk8s.daemon-kubelite.service [Mount] What=/dev/mapper/{{ luks_device_name }} @@ -121,7 +124,7 @@ Options=defaults [Install] - WantedBy=multi-user.target + WantedBy=snap.microk8s.daemon-kubelite.service - name: Reload systemd daemon ansible.builtin.systemd: diff --git a/ansible/playbook_gitea.yml b/ansible/playbook_gitea.yml index 478c84a..c1e5fa9 100644 --- a/ansible/playbook_gitea.yml +++ b/ansible/playbook_gitea.yml @@ -8,6 +8,7 @@ - name: Set required facts ansible.builtin.set_fact: gitea_home: "/var/lib/gitea" + gitea_config_dir: "/a13labs/gitea" gitea_mysql_home: "/var/lib/mysql.gitea" gitea_user_id: 1000 gitea_group_id: 1000 @@ -57,6 +58,18 @@ - tasks - tasks::folders + - name: Create required gitea config folder + become: true + ansible.builtin.file: + state: directory + path: "{{ gitea_config_dir }}" + mode: "0750" + owner: "{{ gitea_user_id }}" + group: "{{ gitea_group_id }}" + tags: + - tasks + - tasks::folders + - name: Create required mysql data folder become: true ansible.builtin.file: