Add reusable Debian and Ubuntu hardening playbooks

inventory/group_vars/all.yml.example

@@ -0,0 +1,36 @@
+---
+stack_root: /opt/stacks
+traefik_network: traefik
+diun_watch_root: "{{ stack_root }}/diun/watch"
+
+# Start with an existing account. After bootstrapping and verifying this one,
+# change ansible_user in hosts.yml to the account named here.
+admin_user: ops
+admin_sudo_group: sudo
+admin_user_shell: /bin/bash
+admin_user_password_hash: "{{ vault_admin_user_password_hash | default('') }}"
+
+# Keep the current SSH port open through the first hardening run. After a
+# successful login on ssh_port, update ansible_port and set this to false.
+ssh_port: 2222
+ssh_legacy_port: 22
+ssh_keep_legacy_port: true
+ssh_max_auth_tries: 4
+ssh_login_grace_time: 30
+ssh_password_authentication: false
+ssh_kbd_interactive_authentication: false
+
+ufw_enabled: true
+ufw_logging: low
+ufw_default_incoming: deny
+ufw_default_outgoing: allow
+ufw_default_routed: deny
+ufw_allowed_rules: []
+ufw_remove_rules: []
+
+fail2ban_ssh_maxretry: 5
+fail2ban_ssh_findtime: 10m
+fail2ban_ssh_bantime: 1h
+fail2ban_ignore_ips: []
+
+compose_stacks: []

inventory/group_vars/all/vault.yml.example

@@ -0,0 +1,4 @@
+---
+# Copy to vault.yml, replace this value with the output of `openssl passwd -6`,
+# then encrypt vault.yml with `ansible-vault encrypt inventory/group_vars/all/vault.yml`.
+vault_admin_user_password_hash: "$6$REPLACE_WITH_A_REAL_SHA512_CRYPT_HASH"

inventory/host_vars/server1.yml.example

@@ -0,0 +1,12 @@
+---
+# Rename this file to match the host alias in hosts.yml.
+admin_user_authorized_keys:
+  - "ssh-ed25519 REPLACE_WITH_YOUR_PUBLIC_KEY admin@laptop"
+
+# Add only inbound ports required by this host's services. SSH is managed by
+# ssh_port and ssh_keep_legacy_port, so do not duplicate it here.
+ufw_allowed_rules: []
+
+# To retire an existing UFW rule, list it here for one deployment, then remove
+# it from this cleanup list.
+ufw_remove_rules: []

inventory/hosts.yml.example

@@ -0,0 +1,9 @@
+---
+all:
+  children:
+    debian_servers:
+      hosts:
+        server1:
+          ansible_host: 192.0.2.10
+          ansible_user: existing_admin
+          ansible_port: 22