mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 19:03:47 +00:00
160d63c02d
* Add Atlas media and storage services * Document Atlas backend phase one and WireGuard deployment * Enable Atlas NAS management and document bootstrap workflow * Harden Atlas network, SSH, firewall, and sharing * Rotate Ansible Vault secrets * Allow configurable Aegis SSH users and authorized keys * Manage Aegis SSH authorized key fragments * Manage SSH authorized key fragments for infrastructure hosts * Harden Rocky storage and sharing configuration * Verify WireGuard handshakes and restore Podman networking
46 lines
1.4 KiB
YAML
46 lines
1.4 KiB
YAML
---
|
|
- name: Enforce targeted SELinux on Atlas
|
|
tags: [atlas, hardening, security]
|
|
ansible.posix.selinux:
|
|
policy: targeted
|
|
state: enforcing
|
|
update_kernel_param: true
|
|
register: atlas_selinux_enforcement
|
|
|
|
- name: Report when Atlas requires a reboot for SELinux enforcement
|
|
tags: [atlas, hardening, security]
|
|
ansible.builtin.debug:
|
|
msg: Reboot Atlas before relying on SELinux enforcement.
|
|
when: atlas_selinux_enforcement.reboot_required | default(false)
|
|
|
|
- name: Apply Atlas network-kernel hardening
|
|
tags: [atlas, hardening, security]
|
|
ansible.posix.sysctl:
|
|
name: "{{ item.key }}"
|
|
value: "{{ item.value }}"
|
|
state: present
|
|
sysctl_set: true
|
|
reload: true
|
|
loop: "{{ atlas_hardening_sysctls | dict2items }}"
|
|
loop_control:
|
|
label: "{{ item.key }}={{ item.value }}"
|
|
|
|
- name: Read active Atlas SELinux mode
|
|
tags: [atlas, hardening, security]
|
|
ansible.builtin.command:
|
|
argv:
|
|
- getenforce
|
|
register: atlas_selinux_mode
|
|
changed_when: false
|
|
when: not ansible_check_mode
|
|
|
|
- name: Require active SELinux enforcement on Atlas
|
|
tags: [atlas, hardening, security]
|
|
ansible.builtin.assert:
|
|
that:
|
|
- atlas_selinux_mode.stdout == 'Enforcing'
|
|
fail_msg: >-
|
|
Atlas SELinux is not enforcing. Reboot if requested by the preceding
|
|
SELinux task, then rerun the hardening role before enabling services.
|
|
when: not ansible_check_mode
|