mrcharles
6eedfb7344
Add two playbooks: - hello_world.yml: AWX smoke test that asserts Debian-family OS and reports facts. Use this as the first Job Template to confirm AWX can reach hosts, become root, and gather facts. - setup_new_system.yml: Full host provisioning playbook that mirrors the function call order of SetupNewSystem.sh. Each role is gated by a run_* feature toggle so the same template can do partial runs. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
90 lines
2.3 KiB
YAML
90 lines
2.3 KiB
YAML
---
|
|
# Full host provisioning — Ansible port of PFVCluster/provisioning/SetupNewSystem.sh
|
|
#
|
|
# The role order below matches the function call order at the bottom of the
|
|
# legacy bash script:
|
|
#
|
|
# PreflightCheck -> roles/preflight
|
|
# global-oam -> roles/oam
|
|
# global-installPackages -> roles/packages
|
|
# global-systemServiceConfigurationFiles -> roles/system_config (phase 1)
|
|
# global-postPackageConfiguration -> roles/system_config (phase 2)
|
|
# secharden-ssh -> roles/security_ssh
|
|
# secharden-wazuh -> roles/security_wazuh
|
|
# secharden-scap-stig -> roles/security_scap_stig
|
|
# secharden-2fa -> roles/security_2fa
|
|
#
|
|
# Each role is gated by a feature toggle (see group_vars/all.yml) so the same
|
|
# Job Template can be reused for partial runs.
|
|
|
|
- name: Preflight — verify we may provision this host
|
|
hosts: all
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: preflight
|
|
|
|
- name: OAM — LibreNMS / check_mk agent
|
|
hosts: all
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: oam
|
|
when: run_oam | bool
|
|
|
|
- name: Packages — up2date, install fleet toolset, remove unwanted packages
|
|
hosts: all
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: packages
|
|
when: run_packages | bool
|
|
|
|
- name: System configuration — service config files + post-package tuning
|
|
hosts: all
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: system_config
|
|
when: run_system_config | bool
|
|
|
|
- name: Security hardening — SSH
|
|
hosts: all
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: security_ssh
|
|
when: run_security_ssh | bool
|
|
|
|
- name: Security hardening — Wazuh agent
|
|
hosts: all
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: security_wazuh
|
|
when: run_security_wazuh | bool
|
|
|
|
- name: Security hardening — SCAP/STIG baseline
|
|
hosts: all
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: security_scap_stig
|
|
when: run_security_scap_stig | bool
|
|
|
|
- name: Security hardening — two-factor authentication
|
|
hosts: all
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: security_2fa
|
|
when: run_security_2fa | bool
|
|
|
|
- name: Security hardening — auditd / journald / logrotate
|
|
hosts: all
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: security_audit
|
|
when: run_security_audit | bool
|