thesabear
c05c7164c8
rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.
Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.
124 lines
2.7 KiB
YAML
124 lines
2.7 KiB
YAML
roles_metadata:
|
|
# Bootstrap roles
|
|
base_users:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: false
|
|
description: "Base user creation tasks"
|
|
|
|
disk_resize:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: true
|
|
description: "Disk resizing tasks"
|
|
|
|
docker_gitlab_setup:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: false
|
|
description: "Docker runtime files moving and homelab repo copy"
|
|
|
|
endlessh:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: false
|
|
description: "Endlessh setup"
|
|
|
|
firewall_ssh:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: true
|
|
description: "Firewall and SSH configuration"
|
|
|
|
hostname_network:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: false
|
|
description: "Set hostname and networking"
|
|
|
|
packages:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: true
|
|
description: "base packages and update tasks"
|
|
|
|
portainer_agent:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: true
|
|
description: "Portainer agent setup"
|
|
|
|
root_password:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: false
|
|
description: "Root password setup"
|
|
|
|
zsh_custom:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: false
|
|
description: "Custom Zsh setup"
|
|
|
|
# CIS Hardening roles
|
|
banners:
|
|
initialization: false
|
|
provisioning: false
|
|
compliance: true
|
|
description: "Login banners setup"
|
|
|
|
file_permissions:
|
|
initialization: false
|
|
provisioning: false
|
|
compliance: true
|
|
description: "File permissions hardening"
|
|
|
|
filesystem_hardening:
|
|
initialization: false
|
|
provisioning: false
|
|
compliance: true
|
|
description: "filesystems hardening"
|
|
|
|
kernel_hardening:
|
|
initialization: false
|
|
provisioning: false
|
|
compliance: true
|
|
description: "Kernel hardening tasks"
|
|
|
|
password_policy:
|
|
initialization: false
|
|
provisioning: false
|
|
compliance: true
|
|
description: "Password policy enforcement"
|
|
|
|
service_disable:
|
|
initialization: false
|
|
provisioning: false
|
|
compliance: true
|
|
description: "Disable unnecessary services"
|
|
|
|
ssh_hardening:
|
|
initialization: false
|
|
provisioning: false
|
|
compliance: true
|
|
description: "SSH hardening"
|
|
|
|
# SecureVault roles
|
|
haproxy:
|
|
initialization: false
|
|
provisioning: true
|
|
compliance: true
|
|
description: "haproxy deployment"
|
|
|
|
vault_agent:
|
|
initialization: true
|
|
provisioning: false
|
|
compliance: false
|
|
description: "vault_agent deployment"
|
|
|
|
technitium:
|
|
initialization: false
|
|
provisioning: true
|
|
compliance: false
|
|
description: "technitium deployment"
|