railiance-infra/goss/baseline.yaml.j2

# Rendered from the executable spec/server-baseline.yaml profile selected by
# inventory/servers.yaml. Package, service, SSH, user, security, and firewall
# controls below consume baseline_* variables resolved by inventory_from_yaml.py.

package:
{% for package_name in baseline_required_packages %}
  {{ package_name }}:
    installed: true
{% endfor %}

service:
{% for service_name in baseline_required_services %}
  {{ service_name }}:
    enabled: true
    running: true
{% endfor %}

file:
  /etc/ssh/sshd_config.d/10-hardening.conf:
    exists: true
    contents:
{% for directive in baseline_ssh_directives | dict2items %}
      - "{{ directive.key }} {{ directive.value }}"
{% endfor %}

user:
  {{ baseline_user.name }}:
    exists: true
    shell: {{ baseline_user.shell }}

command:
  "{{ baseline_firewall.verification.command }}":
    exit-status: 0
    stdout:
{% for pattern in baseline_firewall.verification.stdout %}
      - '/{{ pattern }}/'
{% endfor %}

{% if baseline_firewall.mode == 'ufw' %}
{% for src in k3s_api_allowed_sources | default([]) %}
      - '/6443\/tcp\s+ALLOW\s+{{ src.address | regex_escape }}/'
{% endfor %}
{% for src in flannel_vxlan_allowed_sources | default([]) %}
      - '/8472\/udp\s+ALLOW\s+{{ src.address | regex_escape }}/'
{% endfor %}
{% for rule in ufw_extra_allowed | default([]) %}
      - '/{{ rule.port }}\/{{ rule.proto | default("tcp") }}\s+ALLOW/'
{% endfor %}
{% for port in public_web_ports | default([]) %}
      - '/{{ port }}\/tcp\s+ALLOW\s+Anywhere/'
{% endfor %}

  "ufw status | grep -Ec '6443/tcp[[:space:]]+ALLOW[[:space:]]+Anywhere' || true":
    exit-status: 0
    stdout:
      - "0"
  "ufw status | grep -E '6443/tcp[[:space:]]+ALLOW' | grep -vc 'Anywhere' || true":
    exit-status: 0
    stdout:
      - "{{ k3s_api_allowed_sources | default([]) | length }}"
  "ufw status | grep -Ec '8472/udp[[:space:]]+ALLOW[[:space:]]+Anywhere' || true":
    exit-status: 0
    stdout:
      - "0"
  "ufw status | grep -E '8472/udp[[:space:]]+ALLOW' | grep -vc 'Anywhere' || true":
    exit-status: 0
    stdout:
      - "{{ flannel_vxlan_allowed_sources | default([]) | length }}"

{% for src in k3s_api_revoked_sources | default([]) %}
  "ufw status | grep -Ec '6443/tcp[[:space:]]+ALLOW[[:space:]]+{{ src.address }}' || true":
    exit-status: 0
    stdout:
      - "0"
{% endfor %}
{% endif %}

  "grep NOPASSWD /etc/sudoers.d/{{ baseline_user.name }}":
    exit-status: 0
    stdout:
      - "NOPASSWD"
  "grep -r HISTCONTROL /etc/profile.d/":
    exit-status: 0
    stdout:
      - "{{ baseline_security.histcontrol }}"
{% for jail in baseline_security.fail2ban_jails %}
  "fail2ban-client status {{ jail }}":
    exit-status: 0
    stdout:
      - "Status for the jail: {{ jail }}"
{% endfor %}
  "test -x /usr/local/bin/age":
    exit-status: 0
  "test -x /usr/local/bin/sops":
    exit-status: 0