Add reusable Debian and Ubuntu hardening playbooks

inventory/group_vars/all.yml.example

@@ -0,0 +1,36 @@
+---
+stack_root: /opt/stacks
+traefik_network: traefik
+diun_watch_root: "{{ stack_root }}/diun/watch"
+
+# Start with an existing account. After bootstrapping and verifying this one,
+# change ansible_user in hosts.yml to the account named here.
+admin_user: ops
+admin_sudo_group: sudo
+admin_user_shell: /bin/bash
+admin_user_password_hash: "{{ vault_admin_user_password_hash | default('') }}"
+
+# Keep the current SSH port open through the first hardening run. After a
+# successful login on ssh_port, update ansible_port and set this to false.
+ssh_port: 2222
+ssh_legacy_port: 22
+ssh_keep_legacy_port: true
+ssh_max_auth_tries: 4
+ssh_login_grace_time: 30
+ssh_password_authentication: false
+ssh_kbd_interactive_authentication: false
+
+ufw_enabled: true
+ufw_logging: low
+ufw_default_incoming: deny
+ufw_default_outgoing: allow
+ufw_default_routed: deny
+ufw_allowed_rules: []
+ufw_remove_rules: []
+
+fail2ban_ssh_maxretry: 5
+fail2ban_ssh_findtime: 10m
+fail2ban_ssh_bantime: 1h
+fail2ban_ignore_ips: []
+
+compose_stacks: []