Add reusable Debian and Ubuntu hardening playbooks

playbooks/bootstrap-admin.yml

@@ -0,0 +1,23 @@
+---
+- name: Create the password-protected sudo admin account
+  hosts: debian_servers
+  become: true
+  gather_facts: true
+  serial: 1
+
+  pre_tasks:
+    - name: Check that this host is a supported Debian-family system
+      ansible.builtin.assert:
+        that:
+          - ansible_distribution in ["Debian", "Ubuntu"]
+          - ansible_service_mgr == "systemd"
+          - admin_user != "root"
+          - admin_user_password_hash is match('^\\$6\\$')
+          - admin_user_authorized_keys is defined
+          - admin_user_authorized_keys | length > 0
+        fail_msg: >-
+          Set an admin username, a SHA-512 crypt password hash in Ansible Vault,
+          and at least one authorized public key before bootstrapping.
+
+  roles:
+    - role: admin_user

playbooks/discover.yml

@@ -0,0 +1,32 @@
+---
+- name: Read-only host discovery
+  hosts: debian_servers
+  gather_facts: true
+
+  tasks:
+    - name: Show platform facts
+      ansible.builtin.debug:
+        msg:
+          - "Host: {{ inventory_hostname }} ({{ ansible_host | default(inventory_hostname) }})"
+          - "Distribution: {{ ansible_distribution }} {{ ansible_distribution_version }}"
+          - "Kernel: {{ ansible_kernel }}"
+          - "Architecture: {{ ansible_architecture }}"
+          - "Memory: {{ ansible_memtotal_mb }} MiB"
+          - "Default interface: {{ ansible_default_ipv4.interface | default('unknown') }}"
+
+    - name: Read filesystem capacity
+      ansible.builtin.command: df -h /
+      register: root_fs
+      changed_when: false
+
+    - name: Read listening TCP and UDP sockets
+      ansible.builtin.command: ss -H -tulpn
+      register: listeners
+      changed_when: false
+      become: true
+
+    - name: Report non-secret discovery results
+      ansible.builtin.debug:
+        msg:
+          filesystem: "{{ root_fs.stdout_lines }}"
+          listeners: "{{ listeners.stdout_lines }}"

playbooks/harden.yml

@@ -0,0 +1,52 @@
+---
+- name: Apply operating-system, SSH, Fail2ban, and UFW hardening
+  hosts: debian_servers
+  become: true
+  gather_facts: true
+  serial: 1
+
+  pre_tasks:
+    - name: Require a supported Debian or Ubuntu system
+      ansible.builtin.assert:
+        that:
+          - ansible_distribution in ["Debian", "Ubuntu"]
+          - ansible_service_mgr == "systemd"
+        fail_msg: >-
+          This playbook targets Debian or Ubuntu hosts using systemd. Review
+          the inventory and platform facts before applying it elsewhere.
+
+    - name: Confirm UFW is configured to preserve the current SSH path
+      ansible.builtin.assert:
+        that:
+          - ansible_port | default(22) | int == ssh_port | int or (ssh_keep_legacy_port | bool and ansible_port | default(22) | int == ssh_legacy_port | int)
+        fail_msg: >-
+          Keep the current Ansible connection port in sshd and UFW during the
+          first run. After confirming the new port works, update ansible_port
+          and rerun with ssh_keep_legacy_port=false.
+
+  roles:
+    - role: baseline
+      tags: [baseline]
+    - role: hardening
+      tags: [hardening, ssh, fail2ban, ufw]
+
+  handlers:
+    - name: Restart active SSH socket after reloading systemd
+      ansible.builtin.systemd_service:
+        name: ssh.socket
+        daemon_reload: true
+        state: restarted
+      listen: Apply SSH changes
+      when: hardening_ssh_socket.rc == 0
+
+    - name: Reload ssh
+      ansible.builtin.service:
+        name: ssh
+        state: reloaded
+      listen: Apply SSH changes
+      when: hardening_ssh_socket.rc != 0 or hardening_ssh_service.rc == 0
+
+    - name: Restart fail2ban
+      ansible.builtin.service:
+        name: fail2ban
+        state: restarted