Compliance - spreading out tasks

linux/compliance.yaml

@@ -9,10 +9,82 @@
         ansible_become_method: doas
       when: "ansible_distribution == 'Alpine'"
     
-    - name: "Set become to true"
+    - name: "Set become to true if we are not root"
       set_fact:
         ansible_become: true
       when: "ansible_user_id != 'root'"
 
+    # User account (ansible) configuration
+    - name: Add deployment user.
+      user:
+        name: ansible
+      state: present
+
+    # Ansible user SSH pub key
+    # This is a really stupid way to do it, but alas.
+    # This uses an environment variable named ansiblesvc_key in Semaphore which has the ssh-rsa pubkey.
+    - name: Create ssh directory for deployment user.
+      file:
+        path: /home/ansible/.ssh
+        state: directory
+        owner: ansible
+        group: ansible
+    - name: Add deployment user's SSH key.
+      copy:
+        content: "{{ ansiblesvc_key }}"
+        dest: /home/ansible/.ssh/authorized_keys
+        owner: ansible
+        group: ansible
+
+    # User account (nhadmin) configuration, for sysadmin use
+    - name: Create user nhadmin.
+      user:
+        name: nhadmin
+        state: present
+        password: "{{ nhadmin_password | password_hash('sha512') }}"
+        shell: /bin/bash
+
+    # Sysadmin user SSH pub key
+    # This is a really stupid way to do it, but alas.
+    # This uses an environment variable named nhadmin_key in Semaphore which has the ssh-rsa pubkey.
+    - name: Create ssh directory for nhadmin.
+      file:
+        path: /home/nhadmin/.ssh
+        state: directory
+        owner: nhadmin
+        group: nhadmin
+    - name: Add nhadmin user's SSH key.
+      copy:
+        content: "{{ nhadmin_key }}"
+        dest: /home/nhadmin/.ssh/authorized_keys
+        owner: nhadmin
+        group: nhadmin
+        
+    # SSH config updating
+    - name: Update SSH configuration to disallow root login and disable password authentication.
+      lineinfile:
+        dest: /etc/ssh/sshd_config
+        regexp: "{{ item.regexp }}"
+        line: "{{ item.line }}"
+        state: present
+        validate: 'sshd -t -f %s'
+      with_items:
+        - regexp: "^PermitRootLogin"
+          line: "PermitRootLogin no"
+        - regexp: "^PasswordAuthentication"
+          line: "PasswordAuthentication no"
+        - regexp: "^PubkeyAuthentication"
+          line: "PubkeyAuthentication yes"
+    - name: Restart SSH service.
+      service:
+        name: sshd
+        state: restarted
+
+    # Delete our network ansible key from the root user.
+    - name: Delete our network ansible key (and other keys) from the root user.
+      file:
+        path: /root/.ssh/authorized_keys
+        state: absent
+    
     - name: "Include OS specific tasks"
       ansible.builtin.include_tasks: "compliance_{{ ansible_distribution }}.yaml"

linux/compliance_Alpine.yaml

@@ -1,50 +1,11 @@
 ---
-## Checks/deploys a Linux system to be managed with Ansible.
+## Checks/deploys an Alpine Linux system to be managed with Ansible.
-
-- name: Gather all system groups
-  ansible.builtin.getent:
-    database: group
-    split: ':'
-
-# Add doas package
-- name: Install doas (for Alpine systems).
-  ansible.builtin.package:
-    name:
-      - doas
-    state: present
-
-# User account (ansible) configuration
-- name: Add deployment user.
-  user:
-    name: ansible
-    state: present
-- name: Add deployment user to wheel group.
-  user:
-    name: ansible
-    groups: wheel
-    append: yes
-  # when: "'wheel' in ansible_facts.getent_group"
-
-# Ansible user SSH pub key
-# This is a really stupid way to do it, but alas.
-# This uses an environment variable named ansiblesvc_key in Semaphore which has the ssh-rsa pubkey.
-- name: Create ssh directory for deployment user.
-  file:
-    path: /home/ansible/.ssh
-    state: directory
-    owner: ansible
-    group: ansible
-- name: Add deployment user's SSH key.
-  copy:
-    content: "{{ ansiblesvc_key }}"
-    dest: /home/ansible/.ssh/authorized_keys
-    owner: ansible
-    group: ansible
 
 - name: Install standard packages if not already installed.
   # Looking at you LXCs. >.>
   ansible.builtin.package:
     name:
+      - doas
       - curl
       - net-tools
       - wget
@@ -54,63 +15,17 @@
     state: present
 
 # Give ansible doas rights with no password required.
-- name: Add doas rights with no password for deployment user (Alpine only)
+- name: Add doas rights with no password for deployment user
   lineinfile:
     dest: /etc/doas.conf
     regexp: '^ansible'
     line: 'permit keepenv nopass :ansible'
     state: present
     validate: 'doas -C %s'
-# User account (nhadmin) configuration, for sysadmin use
+
-- name: Create user nhadmin.
-  user:
-    name: nhadmin
-    state: present
-    password: "{{ nhadmin_password | password_hash('sha512') }}"
-    shell: /bin/bash
 - name: Add nhadmin to wheel group.
   user:
     name: nhadmin
     groups: wheel
     append: yes
-  # when: "'wheel' in ansible_facts.getent_group"
+  when: "'wheel' in ansible_facts.getent_group"
-
-# Sysadmin user SSH pub key
-# This is a really stupid way to do it, but alas.
-# This uses an environment variable named nhadmin_key in Semaphore which has the ssh-rsa pubkey.
-- name: Create ssh directory for nhadmin.
-  file:
-    path: /home/nhadmin/.ssh
-    state: directory
-    owner: nhadmin
-    group: nhadmin
-- name: Add nhadmin user's SSH key.
-  copy:
-    content: "{{ nhadmin_key }}"
-    dest: /home/nhadmin/.ssh/authorized_keys
-    owner: nhadmin
-    group: nhadmin
-# SSH config updating
-- name: Update SSH configuration to disallow root login and disable password authentication.
-  lineinfile:
-    dest: /etc/ssh/sshd_config
-    regexp: "{{ item.regexp }}"
-    line: "{{ item.line }}"
-    state: present
-    validate: 'sshd -t -f %s'
-  with_items:
-    - regexp: "^PermitRootLogin"
-      line: "PermitRootLogin no"
-    - regexp: "^PasswordAuthentication"
-      line: "PasswordAuthentication no"
-    - regexp: "^PubkeyAuthentication"
-      line: "PubkeyAuthentication yes"
-- name: Restart SSH service.
-  service:
-    name: sshd
-    state: restarted
-# Delete our network ansible key from the root user.
-- name: Delete our network ansible key (and other keys) from the root user.
-  file:
-    path: /root/.ssh/authorized_keys
-    state: absent

linux/compliance_Debian.yaml

@@ -1,17 +1,5 @@
 ---
-## Checks/deploys a Linux system to be managed with Ansible.
+## Checks/deploys a Debian Linux system to be managed with Ansible.
-
-- hosts: all
-  gather_facts: yes
-  become: yes
-
-  tasks:
-
-    # Gather system groups
-    - name: Gather all system groups
-      ansible.builtin.getent:
-        database: group
-        split: ':'
 
 # Add sudo package
 - name: Install sudo if not already installed.
@@ -26,7 +14,6 @@
   copy:
     content: "{{ aptcacher_config }}"
     dest: /etc/apt/apt.conf.d/proxy
-
 - name: Remove redundant APT configuration
   file:
     path: /etc/apt/apt.conf
@@ -36,41 +23,15 @@
 - name: Update apt repo package lists from cacher
   apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
     
-    # User account (ansible) configuration
-    - name: Add deployment user.
-      user:
-        name: ansible
-        state: present
-
-    # Ansible user SSH pub key
-    # This is a really stupid way to do it, but alas.
-    # This uses an environment variable named ansiblesvc_key in Semaphore which has the ssh-rsa pubkey.
-    - name: Create ssh directory for deployment user.
-      file:
-        path: /home/ansible/.ssh
-        state: directory
-        owner: ansible
-        group: ansible
-
-    - name: Add deployment user's SSH key.
-      copy:
-        content: "{{ ansiblesvc_key }}"
-        dest: /home/ansible/.ssh/authorized_keys
-        owner: ansible
-        group: ansible
-      # shell:
-        # cmd: echo "{{ ansiblesvc_key }}" > /home/ansible/.ssh/authorized_keys
-        # creates: /home/ansible/.ssh/authorized_keys
-
 # Add required packages because Debian is lame
 - name: Install standard packages if not already installed.
-      # Looking at you LXCs. >.>
   ansible.builtin.package:
     name:
       - curl
       - net-tools
       - wget
       - iftop
+      - htop
     state: present
 
 # Give ansible sudo rights with no password required.
@@ -82,14 +43,6 @@
     state: present
     validate: 'visudo -cf %s'
 
-    # User account (nhadmin) configuration, for sysadmin use
-    - name: Create user nhadmin.
-      user:
-        name: nhadmin
-        state: present
-        password: "{{ nhadmin_password | password_hash('sha512') }}"
-        shell: /bin/bash
-
 - name: Add nhadmin to sudo group.
   user:
     name: nhadmin
@@ -103,53 +56,3 @@
     groups: systemd-journal
     append: yes
   when: "'systemd-journal' in ansible_facts.getent_group"
-
-      
-    # Sysadmin user SSH pub key
-    # This is a really stupid way to do it, but alas.
-    # This uses an environment variable named nhadmin_key in Semaphore which has the ssh-rsa pubkey.
-    - name: Create ssh directory for nhadmin.
-      file:
-        path: /home/nhadmin/.ssh
-        state: directory
-        owner: nhadmin
-        group: nhadmin
-    - name: Add nhadmin user's SSH key.
-      copy:
-        content: "{{ nhadmin_key }}"
-        dest: /home/nhadmin/.ssh/authorized_keys
-        owner: nhadmin
-        group: nhadmin
-      # shell:
-        # cmd: echo "{{ nhadmin_key }}" > /home/nhadmin/.ssh/authorized_keys
-        # creates: /home/nhadmin/.ssh/authorized_keys
-
-    # SSH config updating
-    - name: Update SSH configuration to disallow root login and disable password authentication.
-      lineinfile:
-        dest: /etc/ssh/sshd_config
-        regexp: "{{ item.regexp }}"
-        line: "{{ item.line }}"
-        state: present
-        validate: 'sshd -t -f %s'
-      with_items:
-        - regexp: "^PermitRootLogin"
-          line: "PermitRootLogin no"
-        - regexp: "^PasswordAuthentication"
-          line: "PasswordAuthentication no"
-        - regexp: "^PubkeyAuthentication"
-          line: "PubkeyAuthentication yes"
-    - name: Restart SSH service.
-      service:
-        name: sshd
-        state: restarted
-
-    # Delete our network ansible key from the root user.
-    - name: Delete our network ansible key (and other keys) from the root user.
-      file:
-        path: /root/.ssh/authorized_keys
-        state: absent
-
-    # Upgrade all apt packages for good measure.
-    - name: Upgrade all apt packages
-      apt: upgrade=dist force_apt_get=yes