T

mrcharles fa41137eb4 feat(security): add SCAP/STIG baseline hardening role

Port Modules/Security/secharden-scap-stig.sh.

Applies baseline STIG controls:
- GRUB config permission hardening (root:root, mode 0400), skipped on Pi
- Disable and purge autofs service
- Blacklist unused filesystem/kernel modules (usb-storage, dccp, rds,
  sctp, tipc, cramfs, freevxfs, hfs, hfsplus, jffs2, squashfs, udf)
- Deploy login banners (/etc/issue, /etc/issue.net, /etc/motd)
- Harden cron permissions (cron.allow 0600, cron.deny removed)
- Harden at permissions (at.allow 0600, at.deny removed)

This role is the seed for the full DISA STIG/CMMC compliance library.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

2026-07-30 12:16:25 -05:00

inventory

feat(inventory): add fleet inventory with all host groups

2026-07-30 12:15:36 -05:00

playbooks

feat(playbooks): add hello world and setup new system playbooks

2026-07-30 12:15:43 -05:00

roles

feat(security): add SCAP/STIG baseline hardening role

2026-07-30 12:16:25 -05:00

.ansible-lint

chore: add Ansible project scaffolding