Merge pull request #9 from a13labs/feature/encryption-at-rest

Add infrastructure bucket for storing assets

.github/workflows/ansible-apply.yaml

@@ -80,9 +80,10 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           cd ansible
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_hardening.yml --skip-tags roles::cis::suid
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml
-          sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_m3uproxy.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_cis.yml --skip-tags roles::cis::suid
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_wordpress.yml
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_m3uproxy.yml

.github/workflows/terraform-iac-apply.yaml

@@ -0,0 +1,41 @@
+name: Terraform Apply
+
+on:
+  schedule:
+    - cron: "0 1 * * 0"
+  push:
+    branches:
+      - main
+    paths:
+      - "terraform/iac/**"
+      - .github/workflows/terraform-iac-apply.yaml
+
+jobs:
+  terraform-apply:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: 1.9.6
+
+      - name: Setup Sectool
+        uses: a13labs/setup-sectool@v1
+
+      - name: Terraform Init
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec terraform init
+
+      - name: Terraform Apply
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec terraform apply --auto-approve

.github/workflows/terraform-iac-validate.yaml

@@ -0,0 +1,36 @@
+name: Terraform Validate
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "terraform/iac/**"
+      - .github/workflows/terraform-iac-validate.yaml
+    types:
+      - opened
+      - synchronize
+      - reopened
+jobs:
+  terraform-validate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: 1.9.6
+
+      - name: Setup Sectool
+        uses: a13labs/setup-sectool@v1
+
+      - name: Terraform Init and Validate
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec terraform init
+          terraform validate

.github/workflows/terraform-k8apps-validate.yaml

@@ -82,21 +82,10 @@ jobs:
           mkdir -p ~/.kube
           ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
 
-      - name: Terraform Init
+      - name: Terraform Init and Validate
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |
           cd terraform/k8sapps
           sectool exec terraform init
-
-      - name: Terraform Plan
-        env:
-          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
-        run: |
-          cd terraform/k8sapps
-          sectool exec -n terraform plan -out=tfplan
-
-      - name: Show Terraform Plan
-        run: |
-          cd terraform/k8sapps
-          terraform show tfplan
+          terraform validate

ansible/.ansible-lint

@@ -4,7 +4,8 @@ exclude_paths:
   - .github/
   - tests/
 enable_list:
-  - fqcn-builtins  # opt-in
+  - fqcn-builtins # opt-in
 warn_list:
   - line-length
   - yaml[line-length]
+  - var-naming[no-role-prefix]

ansible/host_vars/contabo01.a13labs.pt.yaml

@@ -11,7 +11,7 @@ sshd_permit_root_login: "no"
 sshd_password_authentication: "no"
 sshd_allow_tcp_forwarding: "yes"
 ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
-ssh_users:
+login_users:
   - username: operator
     comment: "Managed by Ansible"
     sudoer: true
@@ -57,9 +57,11 @@ custom_hosts_acls: true
 
 # GeoIP subscription
 geoip_sshd_enabled: true
-ssh_allowed_zones:
+geoip_ssh_allowed_zones:
   - "BE"
   - "PT"
+geoip_ssh_allowed_networks:
+  - "0.0.0.0/0"
 
 # fail2ban
 fail2ban_jails:
@@ -77,20 +79,22 @@ unattended_reboot: true
 unattended_reboot_time: "04:30"
 
 # Kubernetes specific settings
-microk8s_alt_names: "{{ hostname }}"
-k8s_version: 1.29
-k8s_allowed_hosts:
+microk8s_version: 1.29
+microk8s_allowed_hosts:
   - 87.67.163.177
+microk8s_alt_names: "{{ hostname }}"
 
-k8s_users:
+# Let's encrypt issuer
+microk8s_issuer_email: c.alexandre.pires@alexpires.me
+microk8s_encryption_cfg: /a13labs/microk8s_encryption.yaml
+microk8s_encryption_secret: "{{ lookup('env', 'MICROK8S_ENCRYPTION_SECRET') }}"
+microk8s_users:
   - username: operator
     enabled: true
   - username: git
     namespace: "gitea"
     enabled: true
 
-# Let's encrypt issuer
-issuer_email: c.alexandre.pires@alexpires.me
-
+# Duo Security
 duo_users: ["*", "!provision", "!git"]
 duo_api_hostname: api-7cda1654.duosecurity.com

ansible/playbook_cis.yml

@@ -8,14 +8,11 @@
       tags:
         - roles
         - roles::bootstrap
-    - role: "manage_users"
+    - role: "login"
       tags:
         - roles
         - roles::users
-    - role: "cis_hardening"
-      vars:
-        # currently aide is failing
-        install_aide: false
+    - role: "cis"
       tags:
         - roles
         - roles::cis
@@ -27,8 +24,7 @@
       tags:
         - roles
         - roles::geoip
-    - role: "duo_security"
+    - role: "duo"
       tags:
         - roles
         - roles::duosecurity
-

ansible/playbook_encryption.yml

@@ -0,0 +1,151 @@
+---
+- name: Setup encrypted volume for a13labs
+  hosts: contabo
+  become: true
+  vars:
+    disk_image_path: /a13labs.img
+    disk_image_size: 1G
+    luks_device_name: a13labs
+    mount_point: /a13labs
+    key_file_path: /root/a13labs.key
+    key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud
+    key_fetch_service: a13labs-key.service
+
+  tasks:
+    - name: Install cryptsetup and curl
+      ansible.builtin.apt:
+        name:
+          - cryptsetup
+          - curl
+        state: present
+      when: ansible_os_family == 'Debian'
+
+    - name: Get mac address
+      ansible.builtin.shell: |
+        set -o pipefail
+        ip link show eth0 | awk '/ether/ {print $2}'
+      args:
+        executable: /bin/bash
+      register: mac_address
+      changed_when: false
+
+    - name: Sanitize mac address
+      ansible.builtin.set_fact:
+        mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '_') }}"
+      changed_when: false
+
+    - name: Create disk image
+      ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
+      args:
+        creates: "{{ disk_image_path }}"
+      register: disk_image
+
+    - name: Create bucket URL
+      ansible.builtin.set_fact:
+        key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
+      changed_when: false
+
+    - name: Create encrypted volume # noqa no-handler
+      when: disk_image is changed
+      block:
+
+        - name: Download key file from Key server
+          ansible.builtin.uri:
+            url: "{{ key_file_url }}"
+            dest: "{{ key_file_path }}"
+            mode: '0600'
+          args:
+            creates: "{{ key_file_path }}"
+
+        - name: Set up LUKS encryption with key file
+          ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
+          changed_when: false
+
+        - name: Open LUKS device with key file
+          ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
+          register: luks_device
+          changed_when: false
+
+        - name: Create file system
+          ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
+          changed_when: false
+
+        - name: Close LUKS device
+          ansible.builtin.command: cryptsetup close {{ luks_device_name }}
+          changed_when: false
+
+        - name: Delete key file
+          ansible.builtin.file:
+            path: "{{ key_file_path }}"
+            state: absent
+
+    - name: Create mount point
+      ansible.builtin.file:
+        path: "{{ mount_point }}"
+        state: directory
+        mode: "0750"
+
+    - name: Create systemd service to fetch key file and open LUKS device
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/{{ key_fetch_service }}
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Open LUKS device
+          After=network-online.target
+          Before=snap.microk8s.daemon-kubelite.service
+
+          [Service]
+          Type=oneshot
+          RemainAfterExit=true
+          ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}"
+          ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
+          ExecStartPost=/bin/rm -f {{ key_file_path }}
+          ExecStop=/usr/sbin/cryptsetup close {{ luks_device_name }}
+
+          [Install]
+          WantedBy=snap.microk8s.daemon-kubelite.service
+
+    - name: Create systemd service to mount the file system
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/{{ mount_point | basename }}.mount
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Mount LUKS device
+          After={{ key_fetch_service }}
+          Requires={{ key_fetch_service }}
+          Before=snap.microk8s.daemon-kubelite.service
+
+          [Mount]
+          What=/dev/mapper/{{ luks_device_name }}
+          Where={{ mount_point }}
+          Type=ext4
+          Options=defaults
+
+          [Install]
+          WantedBy=snap.microk8s.daemon-kubelite.service
+
+    - name: Reload systemd daemon
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: Enable the key fetch service
+      ansible.builtin.systemd:
+        name: "{{ key_fetch_service }}"
+        enabled: true
+
+    - name: Enable the mount device
+      ansible.builtin.systemd:
+        name: "{{ mount_point | basename }}.mount"
+        enabled: true
+
+    - name: Start the key fetch service
+      ansible.builtin.systemd:
+        name: "{{ key_fetch_service }}"
+        state: started
+
+    - name: Start the mount device
+      ansible.builtin.systemd:
+        name: "{{ mount_point | basename }}.mount"
+        state: started

ansible/playbook_gitea.yml

@@ -8,6 +8,7 @@
     - name: Set required facts
       ansible.builtin.set_fact:
         gitea_home: "/var/lib/gitea"
+        gitea_config_dir: "/a13labs/gitea"
         gitea_mysql_home: "/var/lib/mysql.gitea"
         gitea_user_id: 1000
         gitea_group_id: 1000
@@ -57,6 +58,18 @@
         - tasks
         - tasks::folders
 
+    - name: Create required gitea config folder
+      become: true
+      ansible.builtin.file:
+        state: directory
+        path: "{{ gitea_config_dir }}"
+        mode: "0750"
+        owner: "{{ gitea_user_id }}"
+        group: "{{ gitea_group_id }}"
+      tags:
+        - tasks
+        - tasks::folders
+
     - name: Create required mysql data folder
       become: true
       ansible.builtin.file:

ansible/playbook_kvm.yml

@@ -1,36 +0,0 @@
----
-- name: Virtualization Server
-  hosts: kvm
-  gather_facts: true
-
-  roles:
-    - role: "bootstrap"
-      tags:
-        - roles
-        - roles::bootstrap
-    - role: "manage_users"
-      tags:
-        - roles
-        - roles::users
-    - role: "cis_hardening"
-      vars:
-        # currently aide is failing
-        install_aide: false
-      tags:
-        - roles
-        - roles::cis
-    - role: "fail2ban"
-      tags:
-        - roles
-        - roles::fail2ban
-    - role: "geoip"
-      tags:
-        - roles
-        - roles::geoip
-    - role: "duo_security"
-      tags:
-        - roles
-        - roles::duosecurity
-    - role: "virtualization"
-      tags:
-        - role::virtualization

ansible/playbook_microk8s.yml

@@ -1,13 +1,9 @@
 ---
-- name: Microk8s Setup 
-  hosts: microk8s 
+- name: Microk8s Setup
+  hosts: microk8s
   gather_facts: true
 
   roles:
-    - role: "manage_users"
-      tags:
-        - roles
-        - roles::users
     - role: "microk8s"
       tags:
         - role::microk8s

ansible/requirements.yml

@@ -2,4 +2,3 @@
 collections:
   - ansible.posix
   - community.general
-  - community.libvirt

ansible/roles/cis/.ansible-lint

@@ -4,9 +4,10 @@ exclude_paths:
   - .github/
   - tests/
 enable_list:
-  - fqcn-builtins  # opt-in
+  - fqcn-builtins # opt-in
 warn_list:
   - line-length
   - yaml[line-length]
 skip_list:
   - yaml[comments]
+  - var-naming[no-role-prefix]

ansible/roles/cis/defaults/main/misc.yml

@@ -1,5 +1,5 @@
 ---
-install_aide: true
+install_aide: false
 reboot_ubuntu: false
 redhat_signing_keys:
   - 567E347AD0044ADE55BA8A5F199E2F91FD431D51
@@ -10,4 +10,3 @@ epel8_signing_keys:
   - 94E279EB8D8F25B21810ADF121EA45AB2F86D6A1
 epel9_signing_keys:
   - FF8AD1344597106ECE813B918A3872BF3228467C
-...

ansible/roles/cis/tasks/sshconfig.yml

@@ -13,6 +13,7 @@
 - name: Set ssh version as fact
   ansible.builtin.set_fact:
     ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing]
+  when: ssh_version.stderr != ""
   tags:
     - roles::cis::sshd
     - sshd