Add reusable Debian and Ubuntu hardening playbooks

playbooks/bootstrap-admin.yml

@@ -0,0 +1,23 @@
+---
+- name: Create the password-protected sudo admin account
+  hosts: debian_servers
+  become: true
+  gather_facts: true
+  serial: 1
+
+  pre_tasks:
+    - name: Check that this host is a supported Debian-family system
+      ansible.builtin.assert:
+        that:
+          - ansible_distribution in ["Debian", "Ubuntu"]
+          - ansible_service_mgr == "systemd"
+          - admin_user != "root"
+          - admin_user_password_hash is match('^\\$6\\$')
+          - admin_user_authorized_keys is defined
+          - admin_user_authorized_keys | length > 0
+        fail_msg: >-
+          Set an admin username, a SHA-512 crypt password hash in Ansible Vault,
+          and at least one authorized public key before bootstrapping.
+
+  roles:
+    - role: admin_user