WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore!: separated galaxy deps and own collections; modified ansible script generation to use two paths for collections

Browse source 
REQUIRES REGENERATING ansible.cfg!
This commit is contained in:
NaeiKinDus 2025-02-23 00:00:00 +00:00
parent 4af69c31ce
commit 888590ed9f
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
188 changed files with 30 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/limits.conf.j2 Normal file
View file

@ -0,0 +1,2 @@
* soft core 0
* hard core 0

40
ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/login.defs.j2 Normal file
View file

@ -0,0 +1,40 @@
# Based on Debian 12 manual
CHFN_RESTRICT rwh
DEFAULT_HOME yes
ENCRYPT_METHOD YESCRYPT
ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ERASECHAR 0177
FAILLOG_ENAB yes
FTMP_FILE /var/log/btmp
GID_MAX 60000
GID_MIN 1000
HOME_MODE 0700
HUSHLOGIN_FILE .hushlogin
KILLCHAR 025
LOGIN_RETRIES 3
LOGIN_TIMEOUT 60
LOG_OK_LOGINS yes
LOG_UNKFAIL_ENAB no
MAIL_DIR /var/mail
NONEXISTENT /nonexistent
PASS_MAX_DAYS 99999
PASS_MIN_DAYS 0
PASS_WARN_AGE 7
PREVENT_NO_AUTH yes
SUB_GID_COUNT 65536
SUB_GID_MAX 600100000
SUB_GID_MIN 100000
SUB_UID_COUNT 65536
SUB_UID_MAX 600100000
SUB_UID_MIN 100000
SU_NAME su
SYSLOG_SG_ENAB yes
SYSLOG_SU_ENAB yes
TTYGROUP tty
TTYPERM 0600
UID_MAX 60000
UID_MIN 1000
UMASK 027
USERGROUPS_ENAB yes
YESCRYPT_COST_FACTOR 10

36
ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/nftables.conf.j2 Normal file
View file

@ -0,0 +1,36 @@
#!/usr/sbin/nft -f
flush ruleset
define ansible_controllers_ip4 = {
{{ security_firewall_supervisors_ip4 | join(", ") | wordwrap(40, wrapstring="\n ", break_long_words=False) }}
}
{% if security_firewall_supervisors_ip6 %}
define ansible_controllers_ip6 = {
{{ security_firewall_supervisors_ip6 | join(", ") | wordwrap(40, wrapstring="\n ", break_long_words=False) }}
}
{% endif %}
{% if security_firewall_dns4_servers -%}
define dns_servers = {
{{ security_firewall_dns4_servers | join(", ") | wordwrap(40, wrapstring="\n\t", break_long_words=False) }}
}
{% endif -%}
{% if security_firewall_dns6_servers -%}
define dns_servers6 = {
{{ security_firewall_dns6_servers | join(", ") | wordwrap(40, wrapstring="\n\t", break_long_words=False) }}
}
{% endif -%}
define private_nets = {
10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12,
192.0.0.0/24, 192.168.0.0/16, 198.18.0.0/15
}
define reserved_nets = {
{{ security_firewall_reserved_nets_ip4 | join(", ") | wordwrap(40, wrapstring="\n\t", break_long_words=False) }}
}
define ssh_localport = {{ security_ssh_port }}
include "/etc/nftables.d/01-nat.table"
include "/etc/nftables.d/02-mangle.table"
include "/etc/nftables.d/03-filter.table"
include "/etc/nftables.d/*.nft"

12
ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/resolv.conf.j2 Normal file
View file

@ -0,0 +1,12 @@
{% set dns4_servers = hostvars[inventory_hostname]["global_dns_{}_dns4".format(global_dns_type)] | default([]) %}
{% set dns6_servers = hostvars[inventory_hostname]["global_dns_{}_dns6".format(global_dns_type)] | default([]) %}
{% if dns4_servers is defined and dns4_servers | length > 0 -%}
{% for server in dns4_servers -%}
nameserver {{ server }}
{% endfor %}
{% endif %}
{% if global_ip_dualstack | default(false) and dns6_servers is defined and dns6_servers | length > 0 -%}
{% for server in dns6_servers -%}
nameserver {{ server }}
{% endfor %}
{% endif %}

3
ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/sysctld.local.conf.j2 Normal file
View file

@ -0,0 +1,3 @@
{% for item in security_sysctl_configuration.keys() -%}
{{ item }} = {{ security_sysctl_configuration[item] }}
{% endfor %}