72 lines
1.7 KiB
YAML
72 lines
1.7 KiB
YAML
# Alliance Boréale - Rôle Common
|
|
# Couche: C1 (Physique)
|
|
# Objectif: Hardening post-création VM
|
|
# Date: 2025-10-31
|
|
|
|
---
|
|
- name: "🔍 Gather facts"
|
|
ansible.builtin.setup:
|
|
tags: always
|
|
|
|
- name: "📦 Update apt cache"
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
tags: packages
|
|
|
|
- name: "📦 Install base packages"
|
|
ansible.builtin.apt:
|
|
name: "{{ base_packages }}"
|
|
state: present
|
|
tags: packages
|
|
|
|
- name: "🕐 Configure timezone"
|
|
community.general.timezone:
|
|
name: "{{ system.timezone }}"
|
|
tags: system
|
|
|
|
- name: "🕐 Configure NTP (chrony)"
|
|
ansible.builtin.import_tasks: ntp.yml
|
|
when: ntp.enabled | default(true)
|
|
tags: ntp
|
|
|
|
- name: "👤 Create ansible user"
|
|
ansible.builtin.user:
|
|
name: "{{ users.ansible.name }}"
|
|
groups: "{{ users.ansible.groups }}"
|
|
shell: "{{ users.ansible.shell }}"
|
|
create_home: true
|
|
state: present
|
|
tags: users
|
|
|
|
- name: "👤 Configure sudo for ansible user"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/sudoers.d/ansible
|
|
line: "{{ users.ansible.name }} ALL=(ALL) NOPASSWD:ALL"
|
|
create: true
|
|
mode: '0440'
|
|
validate: 'visudo -cf %s'
|
|
when: users.ansible.sudo_nopasswd | default(true)
|
|
tags: users
|
|
|
|
- name: "🔐 Configure SSH"
|
|
ansible.builtin.import_tasks: ssh.yml
|
|
tags: ssh
|
|
|
|
- name: "🔥 Configure firewall (nftables)"
|
|
ansible.builtin.import_tasks: nftables.yml
|
|
when: security.firewall == 'nftables'
|
|
tags: firewall
|
|
|
|
- name: "📊 Configure logging"
|
|
ansible.builtin.import_tasks: logging.yml
|
|
tags: logging
|
|
|
|
- name: "🔒 Security hardening"
|
|
ansible.builtin.import_tasks: security.yml
|
|
tags: security
|
|
|
|
- name: "✅ Common role completed"
|
|
ansible.builtin.debug:
|
|
msg: "✅ VM {{ inventory_hostname }} hardened successfully"
|
|
tags: always
|