mates
a102c83db8
Playbooky (novy nazev -> co dela):
- priprav-novy-server.yml (kompletni setup noveho serveru)
- nasad-sluzby.yml (nasadi Docker sluzby z docker-services/)
- aktualizuj-sluzby.yml (docker compose pull && up -d)
- zabezpec-server.yml (sysctl, auditd, unattended-upgrades)
- bootstrap-server.yml SMAZAN (duplicitni s priprav-novy-server)
Role (novy nazev -> co dela):
- zaklad (update + base baliky + timezone)
- uzivatel-deploy (vytvori deploy usera UID 1000)
- ssh-klice (authorized_keys deployment)
- docker (Docker Engine + Compose plugin) - ponechan anglicky (IT konvence)
- adresare (/home/deploy/{docker,scripts,backups,logs,...})
- firewall SMAZAN (nepouziva se)
Reference v playbooku aktualizovany na nove nazvy roli.
README.md kompletne prepracovan v cestine pro zacatecniky - vysvetluje
co Ansible je, jak nainstalovat, jak vytvorit inventory, jak spustit
playbook, jak overit ze vse funguje.
59 lines
1.9 KiB
YAML
59 lines
1.9 KiB
YAML
---
|
||
# Security hardening – sysctl, AppArmor, auditd, auto-updates
|
||
#
|
||
# Pouziti:
|
||
# ansible-playbook -i inventory.yml playbooks/security-hardening.yml
|
||
#
|
||
- name: Security hardening
|
||
hosts: homeservers
|
||
become: true
|
||
|
||
tasks:
|
||
- name: Kernel hardening pres sysctl
|
||
ansible.posix.sysctl:
|
||
name: "{{ item.key }}"
|
||
value: "{{ item.value }}"
|
||
state: present
|
||
reload: true
|
||
loop:
|
||
- { key: "net.ipv4.conf.all.rp_filter", value: "1" }
|
||
- { key: "net.ipv4.conf.default.rp_filter", value: "1" }
|
||
- { key: "net.ipv4.icmp_echo_ignore_broadcasts", value: "1" }
|
||
- { key: "net.ipv4.conf.all.accept_redirects", value: "0" }
|
||
- { key: "net.ipv4.conf.default.accept_redirects", value: "0" }
|
||
- { key: "net.ipv6.conf.all.accept_redirects", value: "0" }
|
||
- { key: "net.ipv4.conf.all.send_redirects", value: "0" }
|
||
- { key: "net.ipv4.conf.all.accept_source_route", value: "0" }
|
||
- { key: "net.ipv4.conf.default.accept_source_route", value: "0" }
|
||
- { key: "net.ipv4.tcp_syncookies", value: "1" }
|
||
- { key: "net.ipv4.conf.all.log_martians", value: "1" }
|
||
|
||
- name: Instalace unattended-upgrades
|
||
ansible.builtin.apt:
|
||
name:
|
||
- unattended-upgrades
|
||
- apt-listchanges
|
||
state: present
|
||
|
||
- name: Povol automaticke security updaty
|
||
ansible.builtin.copy:
|
||
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
||
content: |
|
||
APT::Periodic::Update-Package-Lists "1";
|
||
APT::Periodic::Unattended-Upgrade "1";
|
||
APT::Periodic::AutocleanInterval "7";
|
||
mode: "0644"
|
||
|
||
- name: Instalace auditd
|
||
ansible.builtin.apt:
|
||
name:
|
||
- auditd
|
||
- audispd-plugins
|
||
state: present
|
||
|
||
- name: Aktivuj auditd
|
||
ansible.builtin.service:
|
||
name: auditd
|
||
state: started
|
||
enabled: true
|