mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-17 10:22:54 +02:00
Ruben Hensen
89 lines
2.3 KiB
YAML
89 lines
2.3 KiB
YAML
---
|
|
- name: Update apt cache and upgrade packages
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
upgrade: safe
|
|
cache_valid_time: 3600
|
|
|
|
- name: Install essential packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- unattended-upgrades
|
|
- apt-listchanges
|
|
- logrotate
|
|
- curl
|
|
- tar
|
|
state: present
|
|
|
|
- name: Enable unattended upgrades
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
APT::Periodic::AutocleanInterval "7";
|
|
mode: "0644"
|
|
|
|
- name: Set timezone
|
|
community.general.timezone:
|
|
name: "{{ base_timezone }}"
|
|
|
|
- name: Deploy sysctl hardening config
|
|
ansible.builtin.copy:
|
|
dest: /etc/sysctl.d/99-hardening.conf
|
|
content: |
|
|
# Prevent IP spoofing
|
|
net.ipv4.conf.all.rp_filter = 1
|
|
net.ipv4.conf.default.rp_filter = 1
|
|
# Ignore ICMP redirects
|
|
net.ipv4.conf.all.accept_redirects = 0
|
|
net.ipv6.conf.all.accept_redirects = 0
|
|
net.ipv4.conf.all.send_redirects = 0
|
|
# Ignore source-routed packets
|
|
net.ipv4.conf.all.accept_source_route = 0
|
|
net.ipv6.conf.all.accept_source_route = 0
|
|
# SYN flood protection
|
|
net.ipv4.tcp_syncookies = 1
|
|
# Log martians
|
|
net.ipv4.conf.all.log_martians = 1
|
|
mode: "0644"
|
|
notify: reload sysctl
|
|
|
|
- name: Create swap file
|
|
when: base_swap_enabled
|
|
block:
|
|
- name: Check if swap file exists
|
|
ansible.builtin.stat:
|
|
path: /swapfile
|
|
register: swap_file
|
|
|
|
- name: Create swap file
|
|
ansible.builtin.command:
|
|
cmd: "fallocate -l {{ base_swap_size }} /swapfile"
|
|
when: not swap_file.stat.exists
|
|
changed_when: true
|
|
|
|
- name: Set swap file permissions
|
|
ansible.builtin.file:
|
|
path: /swapfile
|
|
mode: "0600"
|
|
when: not swap_file.stat.exists
|
|
|
|
- name: Format swap file
|
|
ansible.builtin.command:
|
|
cmd: mkswap /swapfile
|
|
when: not swap_file.stat.exists
|
|
changed_when: true
|
|
|
|
- name: Enable swap file
|
|
ansible.builtin.command:
|
|
cmd: swapon /swapfile
|
|
when: not swap_file.stat.exists
|
|
changed_when: true
|
|
|
|
- name: Add swap to fstab
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/fstab
|
|
line: "/swapfile none swap sw 0 0"
|
|
state: present
|