b93af8cc78
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
95 lines
2.8 KiB
Django/Jinja
95 lines
2.8 KiB
Django/Jinja
# Rendered from the executable spec/server-baseline.yaml profile selected by
|
|
# inventory/servers.yaml. Package, service, SSH, user, security, and firewall
|
|
# controls below consume baseline_* variables resolved by inventory_from_yaml.py.
|
|
|
|
package:
|
|
{% for package_name in baseline_required_packages %}
|
|
{{ package_name }}:
|
|
installed: true
|
|
{% endfor %}
|
|
|
|
service:
|
|
{% for service_name in baseline_required_services %}
|
|
{{ service_name }}:
|
|
enabled: true
|
|
running: true
|
|
{% endfor %}
|
|
|
|
file:
|
|
/etc/ssh/sshd_config.d/10-hardening.conf:
|
|
exists: true
|
|
contents:
|
|
{% for directive in baseline_ssh_directives | dict2items %}
|
|
- "{{ directive.key }} {{ directive.value }}"
|
|
{% endfor %}
|
|
|
|
user:
|
|
{{ baseline_user.name }}:
|
|
exists: true
|
|
shell: {{ baseline_user.shell }}
|
|
|
|
command:
|
|
"{{ baseline_firewall.verification.command }}":
|
|
exit-status: 0
|
|
stdout:
|
|
{% for pattern in baseline_firewall.verification.stdout %}
|
|
- '/{{ pattern }}/'
|
|
{% endfor %}
|
|
|
|
{% if baseline_firewall.mode == 'ufw' %}
|
|
{% for src in k3s_api_allowed_sources | default([]) %}
|
|
- '/6443\/tcp\s+ALLOW\s+{{ src.address | regex_escape }}/'
|
|
{% endfor %}
|
|
{% for src in flannel_vxlan_allowed_sources | default([]) %}
|
|
- '/8472\/udp\s+ALLOW\s+{{ src.address | regex_escape }}/'
|
|
{% endfor %}
|
|
{% for rule in ufw_extra_allowed | default([]) %}
|
|
- '/{{ rule.port }}\/{{ rule.proto | default("tcp") }}\s+ALLOW/'
|
|
{% endfor %}
|
|
{% for port in public_web_ports | default([]) %}
|
|
- '/{{ port }}\/tcp\s+ALLOW\s+Anywhere/'
|
|
{% endfor %}
|
|
|
|
"ufw status | grep -Ec '6443/tcp[[:space:]]+ALLOW[[:space:]]+Anywhere' || true":
|
|
exit-status: 0
|
|
stdout:
|
|
- "0"
|
|
"ufw status | grep -E '6443/tcp[[:space:]]+ALLOW' | grep -vc 'Anywhere' || true":
|
|
exit-status: 0
|
|
stdout:
|
|
- "{{ k3s_api_allowed_sources | default([]) | length }}"
|
|
"ufw status | grep -Ec '8472/udp[[:space:]]+ALLOW[[:space:]]+Anywhere' || true":
|
|
exit-status: 0
|
|
stdout:
|
|
- "0"
|
|
"ufw status | grep -E '8472/udp[[:space:]]+ALLOW' | grep -vc 'Anywhere' || true":
|
|
exit-status: 0
|
|
stdout:
|
|
- "{{ flannel_vxlan_allowed_sources | default([]) | length }}"
|
|
|
|
{% for src in k3s_api_revoked_sources | default([]) %}
|
|
"ufw status | grep -Ec '6443/tcp[[:space:]]+ALLOW[[:space:]]+{{ src.address }}' || true":
|
|
exit-status: 0
|
|
stdout:
|
|
- "0"
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
"grep NOPASSWD /etc/sudoers.d/{{ baseline_user.name }}":
|
|
exit-status: 0
|
|
stdout:
|
|
- "NOPASSWD"
|
|
"grep -r HISTCONTROL /etc/profile.d/":
|
|
exit-status: 0
|
|
stdout:
|
|
- "{{ baseline_security.histcontrol }}"
|
|
{% for jail in baseline_security.fail2ban_jails %}
|
|
"fail2ban-client status {{ jail }}":
|
|
exit-status: 0
|
|
stdout:
|
|
- "Status for the jail: {{ jail }}"
|
|
{% endfor %}
|
|
"test -x /usr/local/bin/age":
|
|
exit-status: 0
|
|
"test -x /usr/local/bin/sops":
|
|
exit-status: 0
|