chore(deps): update dependency jmespath to v1.1.0 (#930 )

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
update changelog
2026-01-22 22:29:59 +01:00 · 2026-01-22 09:10:00 +00:00 · 2026-01-22 07:02:40 +00:00 · 2026-01-22 08:01:08 +01:00 · 2026-01-18 18:58:41 +00:00 · 2026-01-18 19:57:44 +01:00
56 changed files with 318 additions and 146 deletions
@@ -26,7 +26,7 @@ jobs:
    runs-on: ubuntu-22.04

    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Lint Ansible Playbook
-        uses: ansible/ansible-lint@06f616d6e86e9ce4c74393318d1cbb2d016af413 # v25
+        uses: ansible/ansible-lint@7f6abc5ef97d0fb043a0f3d416dfbc74399fbda0 # v26
@@ -14,6 +14,6 @@ jobs:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
@@ -11,18 +11,18 @@ jobs:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      # deploy the collection first, because if it fails, we don't want
      # to update the galaxy.yml
      - name: Deploy the collection
-        uses: artis3n/ansible_galaxy_collection@f6110aef877db4caaa7e9a192975fb006dea61fe # v2
+        uses: artis3n/ansible_galaxy_collection@415a92b829b5898b6e8ca1dd7a69fe2a1e5fd4c0 # v2
        with:
          api_key: ${{ secrets.GALAXY_API_KEY }}
          galaxy_version: ${{ github.event.release.tag_name }}

      # checkout master instead of the release-tag so we can push the galaxy.yml
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          ref: master

@@ -37,29 +37,34 @@ jobs:
      fail-fast: false
      matrix:
        molecule_distro:
+          - almalinux8
+          - almalinux9
+          # - almalinux10  # problem with baseline
          - centosstream9
          - rocky8
          - rocky9
+          # - rocky10 # problem with baseline
          - ubuntu2004
          - ubuntu2204
          - ubuntu2404
          - debian11
          - debian12
+          - debian13
          # - amazon  # geerlingguy.mysql does not support fedora
          # - arch  # geerlingguy.mysql does not support arch
          - opensuse_tumbleweed
          # - fedora  # geerlingguy.mysql does not support fedora
    steps:
      - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -70,8 +75,9 @@ jobs:
        run: |
            pip install "ansible-core<2.17"
            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'

      # that was a hard one to fix. robert did it thankfully
      # https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
@@ -36,29 +36,34 @@ jobs:
      fail-fast: false
      matrix:
        molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
          - centosstream9
          - rocky8
          - rocky9
+          - rocky10
          - ubuntu2004
          - ubuntu2204
          - ubuntu2404
          - debian11
          - debian12
+          - debian13
          - amazon2023
          # - arch  # needs to be fixed
          # - opensuse_tumbleweed  # needs to be fixed
          # - fedora  # no support from geerlingguy role
    steps:
      - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -69,8 +74,9 @@ jobs:
        run: |
            pip install "ansible-core<2.17"
            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'

      # Molecule has problems detecting the proper location for installing roles
      # https://github.com/ansible/molecule/issues/3806
@@ -39,9 +39,13 @@ jobs:
          - molecule_distro: opensuse_tumbleweed
            molecule_docker_command: "/usr/lib/systemd/systemd"
        molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
          - centosstream9
          - rocky8
          - rocky9
+          - rocky10
          - fedora39
          - fedora40
          - ubuntu2004
@@ -49,21 +53,22 @@ jobs:
          - ubuntu2404
          - debian11
          - debian12
+          - debian13
          - amazon2023
          - arch
        molecule_docker_command:
          - "/lib/systemd/systemd"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -74,8 +79,9 @@ jobs:
        run: |
            pip install "ansible-core<2.17"
            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'

      - name: Test with molecule
        run: molecule test -s os_hardening
@@ -9,6 +9,7 @@ on:  # yamllint disable-line rule:truthy
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
      - 'requirements.txt'
+      - 'requirements-vm.txt'
  pull_request:
    branches: [master]
    paths:
@@ -16,6 +17,7 @@ on:  # yamllint disable-line rule:truthy
      - 'molecule/os_hardening_vm/**'
      - '.github/workflows/os_hardening_vm.yml'
      - 'requirements.txt'
+      - 'requirements-vm.txt'
  schedule:
    - cron: '0 6 * * 2'

@@ -36,6 +38,9 @@ jobs:
      fail-fast: false
      matrix:
        molecule_distro:
+          - almalinux/8
+          - almalinux/9
+          # - almalinux/10  # boot loop
          - generic/centos9s
          - generic/rocky8
          - generic/rocky9
@@ -50,7 +55,7 @@ jobs:
          - generic/arch
    steps:
      - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
@@ -60,7 +65,7 @@ jobs:
          source ~/.venv/ansible-collection-hardening/bin/activate
          python -m pip install --no-cache-dir --upgrade pip
          pip install -r requirements.txt
-          pip install python-vagrant
+          pip install -r requirements-vm.txt
        working-directory: ansible_collections/devsec/hardening

      - name: Downgrade Ansible for Rocky 8 tests
@@ -68,8 +73,12 @@ jobs:
          source ~/.venv/ansible-collection-hardening/bin/activate
          pip install "ansible-core<2.17"
          ansible-galaxy collection install 'community.crypto:<3.0.0'
+          ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'generic/rocky8' || matrix.molecule_distro == 'generic/opensuse15'
+        if: >
+          matrix.molecule_distro == 'generic/rocky8' ||
+          matrix.molecule_distro == 'almalinux/8' ||
+          matrix.molecule_distro == 'generic/opensuse15'

      - name: Update Vagrant Box
        run: |
@@ -78,6 +87,8 @@ jobs:
      - name: Test with molecule
        run: |
          source ~/.venv/ansible-collection-hardening/bin/activate
+          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
          molecule test -s os_hardening_vm
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
@@ -16,7 +16,7 @@ jobs:

    steps:
      - name: Git checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          ref: ${{ github.head_ref }}

@@ -13,7 +13,7 @@ jobs:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          fetch-depth: 0
          ref: master
@@ -63,7 +63,7 @@ jobs:
          path: ./CHANGELOGRELEASE.md

      - name: Delete old drafts
-        uses: hugo19941994/delete-draft-releases@1bdca1ea7ffb25ae7f468a7bdb40056dae98175e # v1.0.1
+        uses: hugo19941994/delete-draft-releases@d375ad67d25fed7520a8020c3a6561fff5260c1e # v2.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

@@ -27,12 +27,12 @@ jobs:
          - ssh_hardening
    steps:
      - name: Check out code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -42,9 +42,13 @@ jobs:
          - molecule_distro: alpine
            molecule_docker_command: "/sbin/init"
        molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
          - centosstream9
          - rocky8
          - rocky9
+          - rocky10
          - fedora39
          - fedora40
          - ubuntu2004
@@ -52,21 +56,22 @@ jobs:
          - ubuntu2404
          - debian11
          - debian12
+          - debian13
          - amazon2023
          - arch
        molecule_docker_command:
          - "/lib/systemd/systemd"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -77,8 +82,9 @@ jobs:
        run: |
            pip install "ansible-core<2.17"
            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'

      - name: Test with molecule
        run: molecule test -s ssh_hardening
@@ -9,6 +9,7 @@ on:  # yamllint disable-line rule:truthy
      - 'molecule/ssh_hardening_bsd/**'
      - '.github/workflows/ssh_hardening_bsd.yml'
      - 'requirements.txt'
+      - 'requirements-vm.txt'
  pull_request:
    branches: [master]
    paths:
@@ -16,6 +17,7 @@ on:  # yamllint disable-line rule:truthy
      - 'molecule/ssh_hardening_bsd/**'
      - '.github/workflows/ssh_hardening_bsd.yml'
      - 'requirements.txt'
+      - 'requirements-vm.txt'
  schedule:
    - cron: '0 6 * * 5'

@@ -41,7 +43,7 @@ jobs:
          - freebsd14
    steps:
      - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true
@@ -51,7 +53,7 @@ jobs:
          source ~/.venv/ansible-collection-hardening/bin/activate
          python -m pip install --no-cache-dir --upgrade pip
          pip install -r requirements.txt
-          pip install python-vagrant
+          pip install -r requirements-vm.txt
        working-directory: ansible_collections/devsec/hardening

      - name: Update Vagrant Box
@@ -61,6 +63,8 @@ jobs:
      - name: Test with molecule
        run: |
          source ~/.venv/ansible-collection-hardening/bin/activate
+          # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+          export MOLECULE_VAGRANT_PLUGIN_DIR=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')/molecule_plugins/vagrant
          molecule test -s ssh_hardening_bsd
        env:
          MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
@@ -42,9 +42,13 @@ jobs:
          - molecule_distro: alpine
            molecule_docker_command: "/sbin/init"
        molecule_distro:
+          - almalinux8
+          - almalinux9
+          - almalinux10
          - centosstream9
          - rocky8
          - rocky9
+          - rocky10
          - fedora39
          - fedora40
          - ubuntu2004
@@ -52,21 +56,22 @@ jobs:
          - ubuntu2404
          - debian11
          - debian12
+          - debian13
          - amazon2023
          - arch
        molecule_docker_command:
          - "/lib/systemd/systemd"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          path: ansible_collections/devsec/hardening
          submodules: true

      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: 3.12
+          python-version: 3.13
          cache: 'pip'

      - name: Install dependencies
@@ -77,8 +82,9 @@ jobs:
        run: |
            pip install "ansible-core<2.17"
            ansible-galaxy collection install 'community.crypto:<3.0.0'
+            ansible-galaxy collection install 'community.general:<12.0.0'
        working-directory: ansible_collections/devsec/hardening
-        if: matrix.molecule_distro == 'rocky8'
+        if: matrix.molecule_distro == 'rocky8' || matrix.molecule_distro == 'almalinux8'

      - name: Test with molecule
        run: molecule test -s ssh_hardening_custom_tests
@@ -1,5 +1,64 @@
 # Changelog

+## [Unreleased](https://github.com/dev-sec/ansible-collection-hardening/tree/HEAD)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.4.0...HEAD)
+
+**Implemented enhancements:**
+
+- fix: replace deprecated community.general.yaml callback plugin [\#918](https://github.com/dev-sec/ansible-collection-hardening/pull/918) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
+- Consistently access facts via the ansible\_facts.\* namespace [\#917](https://github.com/dev-sec/ansible-collection-hardening/pull/917) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([Normo](https://github.com/Normo))
+- disable systemd audit logging [\#902](https://github.com/dev-sec/ansible-collection-hardening/pull/902) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([z-bsod](https://github.com/z-bsod))
+
+**Fixed bugs:**
+
+- /etc/sysctl.conf is no longer honored in Debian 13 [\#905](https://github.com/dev-sec/ansible-collection-hardening/issues/905)
+
+**Merged pull requests:**
+
+- chore\(deps\): update actions/setup-python digest to a309ff8 [\#929](https://github.com/dev-sec/ansible-collection-hardening/pull/929) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint action to v26 [\#928](https://github.com/dev-sec/ansible-collection-hardening/pull/928) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to 415a92b - autoclosed [\#927](https://github.com/dev-sec/ansible-collection-hardening/pull/927) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to a2bc8b8 [\#924](https://github.com/dev-sec/ansible-collection-hardening/pull/924) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/setup-python digest to 83679a8 [\#920](https://github.com/dev-sec/ansible-collection-hardening/pull/920) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout action to v6 [\#919](https://github.com/dev-sec/ansible-collection-hardening/pull/919) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency molecule to v25.12.0 [\#914](https://github.com/dev-sec/ansible-collection-hardening/pull/914) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 40f24c2 [\#913](https://github.com/dev-sec/ansible-collection-hardening/pull/913) ([renovate[bot]](https://github.com/apps/renovate))
+- Update test environments to current Ansible version [\#909](https://github.com/dev-sec/ansible-collection-hardening/pull/909) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update ansible/ansible-lint digest to d7cd7cf [\#903](https://github.com/dev-sec/ansible-collection-hardening/pull/903) ([renovate[bot]](https://github.com/apps/renovate))
+
+## [10.4.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.4.0) (2025-10-22)
+
+[Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.1...10.4.0)
+
+**Implemented enhancements:**
+
+- Support Debian 13 [\#891](https://github.com/dev-sec/ansible-collection-hardening/issues/891)
+- Support EL10 [\#870](https://github.com/dev-sec/ansible-collection-hardening/issues/870)
+- Add support for current versions of Debian and EL [\#893](https://github.com/dev-sec/ansible-collection-hardening/pull/893) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
+- Add SSH config for EL/AlmaLinux 10 [\#888](https://github.com/dev-sec/ansible-collection-hardening/pull/888) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([jonathanspw](https://github.com/jonathanspw))
+
+**Fixed bugs:**
+
+- Write sysctl config to separate file [\#907](https://github.com/dev-sec/ansible-collection-hardening/pull/907) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+
+**Closed issues:**
+
+- sysctl-34 - fs.protected\_regular not set [\#536](https://github.com/dev-sec/ansible-collection-hardening/issues/536)
+
+**Merged pull requests:**
+
+- Update ArchLinux test environment before testing [\#908](https://github.com/dev-sec/ansible-collection-hardening/pull/908) [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] ([schurzi](https://github.com/schurzi))
+- chore\(deps\): update actions/setup-python action to v6 [\#901](https://github.com/dev-sec/ansible-collection-hardening/pull/901) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/labeler action to v6 [\#900](https://github.com/dev-sec/ansible-collection-hardening/pull/900) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 8861a73 [\#899](https://github.com/dev-sec/ansible-collection-hardening/pull/899) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update actions/checkout action to v5 [\#895](https://github.com/dev-sec/ansible-collection-hardening/pull/895) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency python to 3.13 [\#892](https://github.com/dev-sec/ansible-collection-hardening/pull/892) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update dependency aar-doc to v2.3.0 [\#890](https://github.com/dev-sec/ansible-collection-hardening/pull/890) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 9765b87 [\#889](https://github.com/dev-sec/ansible-collection-hardening/pull/889) ([renovate[bot]](https://github.com/apps/renovate))
+- Improve OS support accuracy [\#887](https://github.com/dev-sec/ansible-collection-hardening/pull/887) ([jonathanspw](https://github.com/jonathanspw))
+- chore\(deps\): update hugo19941994/delete-draft-releases action to v2 [\#885](https://github.com/dev-sec/ansible-collection-hardening/pull/885) ([renovate[bot]](https://github.com/apps/renovate))
+
 ## [10.3.1](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.1) (2025-07-24)

 [Full Changelog](https://github.com/dev-sec/ansible-collection-hardening/compare/10.3.0...10.3.1)
@@ -14,6 +73,7 @@
 - Downgrade community.crypto for rocky8 [\#882](https://github.com/dev-sec/ansible-collection-hardening/pull/882) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([schurzi](https://github.com/schurzi))
 - chore\(deps\): update dependency aar-doc to v2.2.0 [\#877](https://github.com/dev-sec/ansible-collection-hardening/pull/877) ([renovate[bot]](https://github.com/apps/renovate))
 - chore\(deps\): update creyd/prettier\_action action to v4.6 [\#876](https://github.com/dev-sec/ansible-collection-hardening/pull/876) ([renovate[bot]](https://github.com/apps/renovate))
+- chore\(deps\): update ansible/ansible-lint digest to 06f616d [\#873](https://github.com/dev-sec/ansible-collection-hardening/pull/873) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
 - chore\(deps\): update dependency ansible-core to v2.18.6 [\#872](https://github.com/dev-sec/ansible-collection-hardening/pull/872) ([renovate[bot]](https://github.com/apps/renovate))
 - chore\(deps\): update creyd/prettier\_action action to v4.5 [\#869](https://github.com/dev-sec/ansible-collection-hardening/pull/869) ([renovate[bot]](https://github.com/apps/renovate))
 - chore\(ssh\_hardening\): ansible 2.19 compatibility [\#868](https://github.com/dev-sec/ansible-collection-hardening/pull/868) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([Nemental](https://github.com/Nemental))
@@ -25,7 +85,7 @@
 - chore\(deps\): update dependency aar-doc to v2.1.0 [\#861](https://github.com/dev-sec/ansible-collection-hardening/pull/861) ([renovate[bot]](https://github.com/apps/renovate))
 - chore\(deps\): update dependency ansible-core to v2.18.4 [\#860](https://github.com/dev-sec/ansible-collection-hardening/pull/860) ([renovate[bot]](https://github.com/apps/renovate))
 - chore\(deps\): update actions/setup-python digest to 8d9ed9a [\#859](https://github.com/dev-sec/ansible-collection-hardening/pull/859) [[mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/mysql_hardening)] [[os_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/os_hardening)] [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] [[nginx_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/nginx_hardening)] ([renovate[bot]](https://github.com/apps/renovate))
- Fix: ForwardAgent j2 template space  [\#856](https://github.com/dev-sec/ansible-collection-hardening/pull/856) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([AliMehraji](https://github.com/AliMehraji))
+- Fix: ForwardAgent j2 template space  [\#856](https://github.com/dev-sec/ansible-collection-hardening/pull/856) [[ssh_hardening](https://github.com/dev-sec/ansible-collection-hardening/labels/ssh_hardening)] ([cod3mas0n](https://github.com/cod3mas0n))
 - chore\(deps\): update artis3n/ansible\_galaxy\_collection digest to f6110ae [\#853](https://github.com/dev-sec/ansible-collection-hardening/pull/853) ([renovate[bot]](https://github.com/apps/renovate))

 ## [10.3.0](https://github.com/dev-sec/ansible-collection-hardening/tree/10.3.0) (2025-02-25)
@@ -1032,7 +1092,7 @@
 - remove prelink package, control package-09 [\#135](https://github.com/dev-sec/ansible-collection-hardening/pull/135) ([rndmh3ro](https://github.com/rndmh3ro))
 - style update [\#134](https://github.com/dev-sec/ansible-collection-hardening/pull/134) ([rndmh3ro](https://github.com/rndmh3ro))
 - Remove deprecated include for static tasks and use instead import\_tasks fix \#131 [\#132](https://github.com/dev-sec/ansible-collection-hardening/pull/132) ([HelioCampos](https://github.com/HelioCampos))
- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([fazlearefin](https://github.com/fazlearefin))
+- Fix ansible.cfg and use comment filter [\#130](https://github.com/dev-sec/ansible-collection-hardening/pull/130) ([FazleArefin](https://github.com/FazleArefin))
 - install initramfs-tools [\#114](https://github.com/dev-sec/ansible-collection-hardening/pull/114) ([rndmh3ro](https://github.com/rndmh3ro))
 - omit empty variables [\#106](https://github.com/dev-sec/ansible-collection-hardening/pull/106) ([rndmh3ro](https://github.com/rndmh3ro))
 - Supports --check mode [\#93](https://github.com/dev-sec/ansible-collection-hardening/pull/93) ([conorsch](https://github.com/conorsch))
@@ -13,9 +13,10 @@
 This collection provides battle tested hardening for:

 - Linux operating systems:
-  - CentOS 9
-  - Rocky Linux 8/9
-  - Debian 11/12
+  - CentOS Stream 9
+  - AlmaLinux 8/9/10
+  - Rocky Linux 8/9/10
+  - Debian 11/12/13
  - Ubuntu 20.04/22.04/24.04
  - Amazon Linux (some roles supported)
  - Arch Linux (some roles supported)
@@ -1,6 +1,6 @@
 namespace: devsec
 name: hardening
-version: 10.3.0
+version: 10.4.0
 readme: README.md
 authors:
  - dev-sec <[email protected]>
@@ -12,22 +12,22 @@
        mysql_python_package_debian: python3-pymysql
      when:
        - mysql_python_package_debian is not defined
-        - ansible_distribution == "Ubuntu"
-        - ansible_distribution_major_version|int > 19
+        - ansible_facts.distribution == "Ubuntu"
+        - ansible_facts.distribution_major_version|int > 19

    - name: Determine required MySQL Python libraries.
      ansible.builtin.set_fact:
        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
      when:
        - mysql_python_package_debian is not defined
-        - ansible_distribution != "Ubuntu"
-        - ansible_distribution_major_version|int < 20
+        - ansible_facts.distribution != "Ubuntu"
+        - ansible_facts.distribution_major_version|int < 20

    - name: Use Python 3 on Suse
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
-        - ansible_os_family == 'Suse'
+        - ansible_facts.os_family == 'Suse'

    - name: Include mysql_hardening role
      ansible.builtin.include_role:
@@ -22,7 +22,9 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Currently not supported by dev-sec.mysql role
+      # inject_facts_as_vars: false
 verifier:
  name: ansible

@@ -17,25 +17,25 @@
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
-        - ansible_distribution == 'Debian'
-        - ansible_distribution_major_version|int >= 11
+        - ansible_facts.distribution == 'Debian'
+        - ansible_facts.distribution_major_version|int >= 11

    - name: Use Python 3 on Suse
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
-        - ansible_os_family == 'Suse'
+        - ansible_facts.os_family == 'Suse'

    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    - name: Install required python packages on Suse
      ansible.builtin.command: zypper -n install python311-rpm python311-PyMySQL
      changed_when: false
-      when: ansible_os_family == 'Suse'
+      when: ansible_facts.os_family == 'Suse'

    - name: Create missing directory
      ansible.builtin.file:
@@ -48,23 +48,23 @@
        mysql_python_package_debian: python3-pymysql
      when:
        - mysql_python_package_debian is not defined
-        - ansible_distribution == "Ubuntu"
-        - ansible_distribution_major_version|int > 19
+        - ansible_facts.distribution == "Ubuntu"
+        - ansible_facts.distribution_major_version|int > 19

    - name: Determine required MySQL Python libraries.
      ansible.builtin.set_fact:
        mysql_python_package_debian: "{% if 'python3' in ansible_python_interpreter | default('') %}python3-mysqldb{% else %}python-mysqldb{% endif %}"
      when:
        - mysql_python_package_debian is not defined
-        - ansible_distribution != "Ubuntu"
-        - ansible_distribution_major_version|int < 20
+        - ansible_facts.distribution != "Ubuntu"
+        - ansible_facts.distribution_major_version|int < 20

    - name: Install required MySQL Python libraries on RHEL
      ansible.builtin.dnf:
        name: "{% if 'python3' in ansible_python_interpreter | default('') %}python36-PyMySQL{% else %}python2-PyMySQL{% endif %}"
      when:
-        - ansible_os_family == "RedHat"
-        - ansible_distribution_major_version == "7"
+        - ansible_facts.os_family == "RedHat"
+        - ansible_facts.distribution_major_version == "7"

    - name: Install mysql with a generic Ansible role
      ansible.builtin.include_role:
@@ -11,14 +11,14 @@
      ansible.builtin.set_fact:
        ansible_python_interpreter: /usr/bin/python3
      when:
-        - ansible_os_family == 'Suse'
+        - ansible_facts.os_family == 'Suse'

    - name: Install procps for debian systems
      ansible.builtin.apt:
        name: procps
        state: present
        update_cache: true
-      when: ansible_distribution == 'Debian'
+      when: ansible_facts.distribution == 'Debian'

    - name: Include tests for the service
      ansible.builtin.include_tasks: verify_tasks/service.yml
@@ -21,7 +21,9 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Currently not supported by geerlingguy.nginx role
+      # inject_facts_as_vars: false
 verifier:
  name: ansible

@@ -16,7 +16,7 @@
    - name: Set correct distribution Version for Amazon Linux
      ansible.builtin.set_fact:
        ansible_distribution_major_version: 7
-      when: ansible_distribution == 'Amazon'
+      when: ansible_facts.distribution == 'Amazon'

    - name: Install nginx with a generic Ansible role
      ansible.builtin.include_role:
@@ -12,7 +12,7 @@
        name: procps
        state: present
        update_cache: true
-      when: ansible_distribution == 'Debian'
+      when: ansible_facts.distribution == 'Debian'

 - name: Verify
  hosts: localhost
@@ -17,7 +17,8 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      inject_facts_as_vars: false
 verifier:
  name: ansible

@@ -16,7 +16,7 @@
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    - name: Install required tools on SuSE
      # cannot use zypper module, since it depends on python-xml
@@ -19,7 +19,7 @@
    # this uses the date from the expire_date variable and subtracts the current date.
    # it should be bigger that the password_expire_min of the user "pw_no_ageing"
    that:
-      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_date_time.date | to_datetime('%Y-%m-%d')).days == 60
+      - ( expiry_date.stdout | trim | to_datetime('%b %d, %Y') - ansible_facts.date_time.date | to_datetime('%Y-%m-%d')).days == 60

 - name: Get Password Expiry warning days for pw_ageing
  ansible.builtin.shell: chage -l pw_ageing | grep "warning before password expires" | cut -d ":" -f 2
@@ -6,4 +6,4 @@
 - name: Check that shell_sys_acc's shell is still bash
  ansible.builtin.assert:
    that:
-      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"
+      - ansible_facts.getent_passwd['shell_sys_acc'][5] == "/bin/bash"
@@ -30,7 +30,7 @@
        os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
      when:
        - ansible_facts.distribution == 'Fedora'
-        - ansible_distribution_major_version|int == 40
+        - ansible_facts.distribution_major_version|int == 40

    - name: Include os_hardening role
      ansible.builtin.include_role:
@@ -24,7 +24,10 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+      library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
+      inject_facts_as_vars: false
 verifier:
  name: ansible
  env:
@@ -26,7 +26,7 @@
      ansible.builtin.dpkg_selections:
        name: grub-pc
        selection: hold
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    # we need to free up space, since the /boot partition in some Vagrant images is
    # pretty small and system updates might fail
@@ -35,20 +35,20 @@
        paths: /boot
        patterns: "initrd.img*"
      register: find_results
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    - name: Delete all initrd.img to free space on /boot
      ansible.builtin.file:
        path: "{{ item['path'] }}"
        state: absent
      with_items: "{{ find_results['files'] }}"
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    - name: Run the equivalent of "apt-get update && apt-get upgrade"
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
-      when: ansible_os_family == 'Debian'
+      when: ansible_facts.os_family == 'Debian'

    - name: Install required tools on fedora
      ansible.builtin.dnf:
@@ -59,14 +59,27 @@
          - python3-libselinux
      when: ansible_facts.distribution == 'Fedora'

+    - name: Install required tools on AlmaLinux
+      ansible.builtin.dnf:
+        name:
+          - initscripts
+      when: ansible_facts.distribution == 'AlmaLinux'
+
    - name: Install required tools on Arch
      community.general.pacman:
        name:
          - awk
-        state: present
+          - archlinux-keyring
+        state: latest
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

+    - name: Run the equivalent of "pacman -Syu"
+      community.general.pacman:
+        update_cache: true
+        upgrade: true
+      when: ansible_facts.os_family == 'Archlinux'
+
    - name: Install required tools on RHEL # noqa ignore-errors
      ansible.builtin.dnf:
        name:
@@ -84,7 +97,6 @@
      ansible.posix.mount:
        path: /boot/efi
        state: unmounted
-      when: ansible_facts.distribution == 'Fedora'

    - name: Include YUM prepare tasks
      ansible.builtin.include_tasks: prepare_tasks/yum.yml
@@ -5,5 +5,5 @@
    - name: Make sure environment variable for MOLECULE_DISTRO is set
      ansible.builtin.assert:
        that:
-          - "lookup('env','MOLECULE_DISTRO')"
+          - "lookup('env','MOLECULE_DISTRO') | length > 0"
        fail_msg: "You need to set MOLECULE_DISTRO to a supported image name. See CONTRIBUTING.md"
@@ -17,7 +17,8 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      inject_facts_as_vars: false
  inventory:
    host_vars:
      # https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
@@ -75,11 +75,6 @@
        update_cache: true
      when: ansible_facts.os_family == 'Archlinux'

-    - name: Create ssh host keys # noqa ignore-errors
+    - name: Create ssh host keys # noqa ignore-errors no-changed-when
      ansible.builtin.command: ssh-keygen -A
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-        or ansible_facts.distribution == "Fedora"
-        or ansible_facts.distribution == "Amazon"
-        or ansible_facts.os_family == "Suse"
-      changed_when: false
      ignore_errors: true
@@ -20,7 +20,10 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      # Workaround for https://github.com/ansible-community/molecule-plugins/issues/301
+      library: "${MOLECULE_PROJECT_DIRECTORY}/plugins/modules:/usr/share/ansible:${MOLECULE_VAGRANT_PLUGIN_DIR}"
+      inject_facts_as_vars: false
 verifier:
  name: ansible
  env:
@@ -17,7 +17,8 @@ provisioner:
  config_options:
    defaults:
      interpreter_python: auto_silent
-      callbacks_enabled: profile_tasks, timer, yaml
+      callbacks_enabled: profile_tasks, timer
+      inject_facts_as_vars: false
 verifier:
  name: ansible

@@ -75,11 +75,6 @@
        update_cache: true
      when: ansible_facts.os_family == 'Alpine'

-    - name: Create ssh host keys # noqa ignore-errors
+    - name: Create ssh host keys # noqa ignore-errors no-changed-when
      ansible.builtin.command: ssh-keygen -A
-      when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7')
-        or ansible_facts.distribution == "Fedora"
-        or ansible_facts.distribution == "Amazon"
-        or ansible_facts.os_family == "Suse"
-      changed_when: false
      ignore_errors: true
@@ -0,0 +1 @@
+molecule-plugins[vagrant]==25.8.12
@@ -1,7 +1,7 @@
-molecule==25.1.0
-molecule-plugins[docker]==23.7.0
-ansible-core==2.18.6
+molecule==25.12.0
+molecule-plugins[docker]==25.8.12
+ansible-core==2.19.3
 docker==7.1.0
-jmespath==1.0.1
-aar-doc==2.2.0
+jmespath==1.1.0
+aar-doc==2.3.0
 passlib==1.7.4
@@ -24,13 +24,12 @@ Further information is available at [Deutsche Telekom (German)](http://www.telek
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
  - focal, jammy, noble
 - Debian
-  - bullseye, bookworm
+  - trixie, bookworm, bullseye
 - Amazon
 - opensuse

@@ -10,6 +10,7 @@ galaxy_info:
      versions:
        - "8"
        - "9"
+        - "10"
    - name: Ubuntu
      versions:
        - focal
@@ -17,8 +18,9 @@ galaxy_info:
        - noble
    - name: Debian
      versions:
-        - bullseye
+        - trixie
        - bookworm
+        - bullseye
    - name: Amazon
    - name: opensuse
  galaxy_tags:
@@ -17,13 +17,12 @@ It works with the following nginx-roles, including, but not limited to:
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
  - focal, jammy, noble
 - Debian
-  - bookworm, bullseye
+  - trixie, bookworm, bullseye
 - Amazon

 ## Role Variables
@@ -10,6 +10,7 @@ galaxy_info:
      versions:
        - "8"
        - "9"
+        - "10"
    - name: Ubuntu
      versions:
        - focal
@@ -17,6 +18,7 @@ galaxy_info:
        - noble
    - name: Debian
      versions:
+        - trixie
        - bookworm
        - bullseye
    - name: Amazon
@@ -157,13 +157,12 @@ This role is mostly based on guides by:
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
  - focal, jammy, noble
 - Debian
-  - bookworm, bullseye
+  - trixie, bookworm, bullseye
 - Amazon
 - Fedora
 - ArchLinux
@@ -27,3 +27,8 @@
    path: "{{ item }}"
    state: remounted
  loop: "{{ mountpoints_changed }}"
+
+- name: Restart journald
+  ansible.builtin.systemd:
+    name: systemd-journald.service
+    state: restarted
@@ -10,6 +10,7 @@ galaxy_info:
      versions:
        - "8"
        - "9"
+        - "10"
    - name: Ubuntu
      versions:
        - focal
@@ -17,6 +18,7 @@ galaxy_info:
        - noble
    - name: Debian
      versions:
+        - trixie
        - bookworm
        - bullseye
    - name: Amazon
@@ -16,3 +16,15 @@
    - Restart auditd via service
    - Restart auditd via systemd
  tags: auditd
+
+- name: Disable systemd-journald.audit
+  when:
+    - ansible_facts.os_family != 'Suse'  # socket doesn't seem to exist on suse
+  ansible.builtin.systemd:
+    name: systemd-journald-audit.socket
+    state: stopped
+    enabled: false
+    masked: true
+  notify:
+    - Restart journald
+  tags: auditd
@@ -4,4 +4,4 @@
    name: ctrl-alt-del.target
    masked: true
    daemon_reload: true
-  when: ansible_service_mgr == "systemd"
+  when: ansible_facts.service_mgr == "systemd"
@@ -37,7 +37,7 @@
        group: root
        mode: "0755"
        state: directory
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"

    - name: Create custom.conf for disabling coredumps
      ansible.builtin.template:
@@ -46,7 +46,7 @@
        owner: root
        group: root
        mode: "0644"
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"
      notify: Reload systemd

 - name: Enable coredumps
@@ -56,7 +56,7 @@
      ansible.builtin.file:
        path: /etc/systemd/coredump.conf.d
        state: absent
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"
      notify: Reload systemd

    - name: Remove 10.hardcore.conf config file
@@ -89,7 +89,7 @@

 - name: Generate list of current available mounted filesystems on the system
  ansible.builtin.set_fact:
-    mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}"
+    mountpoints_list: "{{ ansible_facts.mounts | map(attribute='mount') | list }}"

 - name: Append special devices list to valid mountpoint list
  ansible.builtin.set_fact:
@@ -13,7 +13,7 @@
    - mount.enabled | bool
    - mount.path in mountpoints_list
  vars:
-    mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
+    mountinfo: "{{ ansible_facts.mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
  notify: Remount filesystems

 - name: "Check for existence of mount {{ mount.path }}"
@@ -18,7 +18,7 @@

 - name: Remove used filesystems from fs-list
  ansible.builtin.set_fact:
-    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_mounts | map(attribute='fstype') | list) }}"
+    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_facts.mounts | map(attribute='fstype') | list) }}"

 - name: Disable unused filesystems | os-10
  ansible.builtin.template:
@@ -1,14 +1,4 @@
 ---
- name: Protect sysctl.conf
-  ansible.builtin.file:
-    path: /etc/sysctl.conf
-    owner: root
-    group: root
-    mode: "0440"
-    state: touch
-    modification_time: preserve
-    access_time: preserve
-
 - name: Set Daemon umask, do config for rhel-family | NSA 2.2.4.1
  ansible.builtin.template:
    src: etc/sysconfig/rhel_sysconfig_init.j2
@@ -19,13 +9,24 @@
  when: ansible_facts.os_family == 'RedHat'

 - name: Change sysctls
-  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
+  when: ansible_facts.virtualization_type not in ['docker', 'lxc', 'openvz']
  block:
+    - name: Protect sysctl.conf
+      ansible.builtin.file:
+        path: /etc/sysctl.d/90-dev-sec.conf
+        owner: root
+        group: root
+        mode: "0440"
+        state: touch
+        modification_time: preserve
+        access_time: preserve
+
    - name: Change various sysctl-settings, look at the sysctl-vars file for documentation
      ansible.posix.sysctl:
        name: "{{ item.key }}"
        value: "{{ item.value }}"
        sysctl_set: true
+        sysctl_file: /etc/sysctl.d/90-dev-sec.conf
        state: present
        reload: true
        ignoreerrors: true
@@ -4,28 +4,28 @@
    database: passwd
    # creates a dict for each user containing UID/HOMEDIR etc...
  # skip this task if getent was run before without specifying a key (single entry)
-  when: getent_passwd is undefined or
-        getent_passwd | length <= 1
+  when: ansible_facts.getent_passwd is undefined or
+        ansible_facts.getent_passwd | length <= 1

 - name: Read local linux shadow database
  ansible.builtin.getent:
    database: shadow

 - name: Extract system accounts from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
  when:
-    - getent_passwd[item][1]|int > 0
-    - getent_passwd[item][1]|int <= os_auth_sys_uid_max|int
+    - ansible_facts.getent_passwd[item][1]|int > 0
+    - ansible_facts.getent_passwd[item][1]|int <= os_auth_sys_uid_max|int
    - item is not in os_always_ignore_users     # skip users from "os_always_ignore_users" list (taken from role "vars")
    - item is not in os_ignore_users            # skip users from "os_ignore_users"        list (taken from role "defaults")
  ansible.builtin.set_fact:
    system_users: "{{ system_users | default([]) + [item] }}"

 - name: Extract regular (non-system, non-root) accounts from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
  when:
-    - getent_passwd[item][1]|int >= os_auth_uid_min|int
-    - getent_passwd[item][1]|int <= os_auth_uid_max|int
+    - ansible_facts.getent_passwd[item][1]|int >= os_auth_uid_min|int
+    - ansible_facts.getent_passwd[item][1]|int <= os_auth_uid_max|int
    - item is not in os_always_ignore_users # skip users from "os_always_ignore_users" list (taken from role "vars")
    - item is not in os_ignore_users # skip users from "os_ignore_users"        list (taken from role "defaults")
  ansible.builtin.set_fact:
@@ -42,13 +42,14 @@
    - os_user_pw_ageing
    - regular_users is defined and (regular_users | length > 0)
    - item not in os_users_without_password_ageing
-    - getent_shadow[item][0] is not match("\*") # password hashes containing illegal characters like "*" are unusable (locked) and don't need to age
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable (locked) and don't need to age
+    # password hashes with illegal characters like "*" or "!" are unusable (locked) and don't need to age
+    - ansible_facts.getent_shadow[item][0] is not match("\*")
+    - ansible_facts.getent_shadow[item][0] is not match("\!")

 - name: Extract root account(s) from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
  when:
-    - getent_passwd[item][1]|int == 0
+    - ansible_facts.getent_passwd[item][1]|int == 0
  ansible.builtin.set_fact:
    root_users: "{{ root_users | default([]) + [item] }}"

@@ -56,7 +57,7 @@
  ansible.builtin.file:
    mode: "0700"
    owner: "{{ item }}"
-    path: "{{ getent_passwd[item][4] }}"
+    path: "{{ ansible_facts.getent_passwd[item][4] }}"
    state: directory
  loop: "{{ root_users }}"
  when:
@@ -71,8 +72,9 @@
  loop: "{{ root_users }}"
  when:
    - os_rootuser_pw_ageing | bool
-    - getent_shadow[item][0] is not match("\*") # password hashes containing illegal characters like "*" are unusable (locked) and don't need to age
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable (locked) and don't need to age
+    # password hashes with illegal characters like "*" or "!" are unusable (locked) and don't need to age
+    - ansible_facts.getent_shadow[item][0] is not match("\*")
+    - ansible_facts.getent_shadow[item][0] is not match("\!")

 - name: Remove additional users with UID=0 ("root" user is not touched)
  ansible.builtin.user:
@@ -98,13 +100,13 @@
    createhome: false
  loop: "{{ system_users }}"
  when:
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable already (locked)
+    - ansible_facts.getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable already (locked)

 - name: Limit access to home directories of regular (non-system, non-root) accounts
  ansible.builtin.file:
    mode: "0700"
    owner: "{{ item }}"
-    path: "{{ getent_passwd[item][4] }}"
+    path: "{{ ansible_facts.getent_passwd[item][4] }}"
    state: directory
  loop: "{{ regular_users }}"
  when:
@@ -46,13 +46,12 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
 <!-- BEGIN_ANSIBLE_DOCS -->

 ## Supported Operating Systems
-
 - EL
-  - 8, 9
+  - 8, 9, 10
 - Ubuntu
  - focal, jammy, noble
 - Debian
-  - bookworm, bullseye
+  - trixie, bookworm, bullseye
 - Alpine
 - Amazon
 - Fedora
@@ -10,6 +10,7 @@ galaxy_info:
      versions:
        - "8"
        - "9"
+        - "10"
    - name: Ubuntu
      versions:
        - focal
@@ -17,6 +18,7 @@ galaxy_info:
        - noble
    - name: Debian
      versions:
+        - trixie
        - bookworm
        - bullseye
    - name: Alpine
@@ -0,0 +1,26 @@
+---
+ssh_pkgs:
+  - openssh
+sshd_path: /usr/sbin/sshd
+ssh_host_keys_dir: /etc/ssh
+sshd_service_name: sshd
+ssh_owner: root
+ssh_group: root
+ssh_host_keys_owner: root
+ssh_host_keys_group: root
+ssh_host_keys_mode: "0600"
+ssh_selinux_packages:
+  - policycoreutils-python-utils
+  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: /etc/ssh/moduli
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
Author	SHA1	Message	Date
renovate[bot]	83167cdd4c	chore(deps): update dependency jmespath to v1.1.0 (#930 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-01-22 22:29:59 +01:00
dev-sec CI	7bf49663dd	update changelog	2026-01-22 09:10:00 +00:00
dev-sec CI	c751768731	update changelog	2026-01-22 07:02:40 +00:00
renovate[bot]	05cf135b52	chore(deps): update actions/setup-python digest to a309ff8 (#929 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-01-22 08:01:08 +01:00
dev-sec CI	2341043c79	update changelog	2026-01-18 18:58:41 +00:00
renovate[bot]	7c99aa19e0	chore(deps): update artis3n/ansible_galaxy_collection digest to 415a92b (#927 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-01-18 19:57:44 +01:00
renovate[bot]	745931444a	chore(deps): update ansible/ansible-lint action to v26 (#928 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-01-18 19:57:26 +01:00
dev-sec CI	8f7f3f0695	update changelog	2025-12-23 11:03:34 +00:00
renovate[bot]	a97cc1d6ce	chore(deps): update ansible/ansible-lint digest to a2bc8b8 (#924 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-12-23 12:02:13 +01:00
dev-sec CI	ebbbde5ea8	update changelog	2025-12-14 11:20:20 +00:00
renovate[bot]	8826a81a74	chore(deps): update dependency molecule to v25.12.0 (#914 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-12-14 12:19:19 +01:00
renovate[bot]	fdfb86b6bb	chore(deps): update actions/setup-python digest to 83679a8 (#920 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-12-14 12:19:05 +01:00
dev-sec CI	1328c7ae93	update changelog	2025-12-13 12:47:30 +00:00
renovate[bot]	43b6402acf	chore(deps): update actions/checkout action to v6 (#919 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-12-13 13:44:59 +01:00
renovate[bot]	c4acd62225	chore(deps): update ansible/ansible-lint digest to 40f24c2 (#913 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-12-13 13:42:47 +01:00
dev-sec CI	936240fc7a	update changelog	2025-12-13 12:39:19 +00:00
Norman Ziegner	209ba1dabf	Consistently access facts via the ansible_facts.* namespace (#917 ) * ci: disable injecting facts as own vars in the main namespace Signed-off-by: Norman Ziegner <[email protected]> * Consistently access facts via the ansible_facts.* namespace Signed-off-by: Norman Ziegner <[email protected]> --------- Signed-off-by: Norman Ziegner <[email protected]>	2025-12-13 13:38:02 +01:00
dev-sec CI	db998ef8c5	update changelog	2025-11-28 17:38:08 +00:00
Norman Ziegner	4e5c4478d8	fix: remove yaml callback entirely for EL8 compatibility (#918 ) Signed-off-by: Norman Ziegner <[email protected]>	2025-11-28 18:36:51 +01:00
dev-sec CI	f6b52d55fc	update changelog	2025-10-27 21:25:00 +00:00
ChristophandChristoph Sieber	940ed980b3	disable systemd audit logging (#902 ) * os_hardening: disable systemd audit logging disable audit logging via systemd-journald when enabling auditd as this leads to duplicate logs in the journal or even /var/log/messages depending on the configuration Signed-off-by: Christoph Sieber <[email protected]> * Don't disable systemd-journald-audit.socket on Suse it seems the socket doesn't exist on this OS Signed-off-by: Christoph Sieber <[email protected]> --------- Signed-off-by: Christoph Sieber <[email protected]> Co-authored-by: Christoph Sieber <[email protected]>	2025-10-27 22:23:39 +01:00
dev-sec CI	9976169cad	update changelog	2025-10-27 09:37:20 +00:00
Martin Schurz	24d4d04840	Update test environments to current Ansible version (#909 ) * Update test environments to current Ansible version Signed-off-by: Martin Schurz <[email protected]> * Add Workaround for vagrant Signed-off-by: Martin Schurz <[email protected]> --------- Signed-off-by: Martin Schurz <[email protected]>	2025-10-27 10:32:41 +01:00
dev-sec CI	95e50cb69d	update changelog	2025-10-26 16:17:56 +00:00
renovate[bot]	2484831bca	chore(deps): update ansible/ansible-lint digest to d7cd7cf (#903 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-10-26 17:15:44 +01:00
dev-sec CI	76b0ae3000	update galaxy.yml with new version	2025-10-22 10:35:43 +00:00
dev-sec CI	1e40024850	update changelog	2025-10-22 09:02:34 +00:00
Martin Schurz	1512111726	Write sysctl config to separate file (#907 ) * Write sysctl config to separate file Write our sysctl config to separate file, since newer distributions no longer use the global /etc/sysctl.conf file. All older distributions seem to already support reading from /etc/sysctl.d so this should be no breaking change.	2025-10-22 11:01:01 +02:00
dev-sec CI	328644e1fe	update changelog	2025-10-22 08:22:11 +00:00
Martin Schurz	f377395e00	Update ArchLinux test environment before testing (#908 ) * Update ArchLinux test environment before testing Update Arch packages and Keyrings to avoid problems when installing Ansible and dependencies.	2025-10-22 10:20:40 +02:00
dev-sec CI	e4d736cde2	update changelog	2025-09-25 16:37:46 +00:00
renovate[bot]	548e888c40	chore(deps): update actions/setup-python action to v6 (#901 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-09-25 18:36:52 +02:00
renovate[bot]	77f0d32af7	chore(deps): update actions/labeler action to v6 (#900 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-09-25 18:36:33 +02:00
renovate[bot]	5701f291db	chore(deps): update ansible/ansible-lint digest to 8861a73 (#899 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-09-25 18:36:24 +02:00
dev-sec CI	50befb5fe8	update changelog	2025-08-13 13:24:28 +00:00
renovate[bot]	afdfdb065f	chore(deps): update actions/checkout action to v5 (#895 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-08-13 15:19:49 +02:00
dev-sec CI	4075c453a9	update changelog	2025-08-12 19:20:05 +00:00
renovate[bot]	306903b19d	chore(deps): update hugo19941994/delete-draft-releases action to v2 (#885 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-08-12 21:18:50 +02:00
dev-sec CI	61c7c9a823	update ssh_hardening readme	2025-08-12 10:57:52 +00:00
dev-sec CI	1876ee1bf5	update nginx_hardening readme	2025-08-12 10:55:17 +00:00
dev-sec CI	91f8dada4c	update mysql_hardening readme	2025-08-12 10:51:39 +00:00
dev-sec CI	ae3cbf27a6	update os_hardening readme	2025-08-12 10:50:37 +00:00
dev-sec CI	734f2d205e	update changelog	2025-08-12 10:49:32 +00:00
Martin SchurzandJonathan Wright	b87188c619	Add support for current versions of Debian and EL (#893 ) * Add support for current versions of Debian and EL Signed-off-by: Martin Schurz <[email protected]> * Add conditions for EL8 Signed-off-by: Martin Schurz <[email protected]> * Fix Audit in AlmaLinux Signed-off-by: Martin Schurz <[email protected]> * Fix broken SSH host key config in rhel/almalinux 10 Signed-off-by: Jonathan Wright <[email protected]> * Generate SSH Keys on EL10 Signed-off-by: Martin Schurz <[email protected]> * Generate SSH Keys for tests via Systemd Signed-off-by: Martin Schurz <[email protected]> * Fixup tests Signed-off-by: Martin Schurz <[email protected]> * Remove auditd conditions Signed-off-by: Martin Schurz <[email protected]> * Add path to audit handler Signed-off-by: Martin Schurz <[email protected]> * Install init scripts Signed-off-by: Martin Schurz <[email protected]> * Update main README --------- Signed-off-by: Martin Schurz <[email protected]> Signed-off-by: Jonathan Wright <[email protected]> Co-authored-by: Jonathan Wright <[email protected]>	2025-08-12 12:48:46 +02:00
Martin Schurz	f14460514d	Merge pull request #888 from jonathanspw/almalinux10 Add SSH config for EL/AlmaLinux 10	2025-08-12 12:48:21 +02:00
dev-sec CI	311cf40c50	update changelog	2025-08-10 15:46:58 +00:00
renovate[bot]	a2d64b5642	chore(deps): update dependency python to 3.13 (#892 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-08-10 15:43:12 +00:00
dev-sec CI	1f92bc7f6a	update changelog	2025-08-05 12:43:06 +00:00
renovate[bot]	41618f14f4	chore(deps): update dependency aar-doc to v2.3.0 (#890 ) Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-08-05 12:41:52 +00:00
dev-sec CI	33c7bbdec3	update changelog	2025-08-04 06:22:35 +00:00
Martin Schurz	e234ac57e3	Merge pull request #889 from dev-sec/renovate/ansible-ansible-lint-digest chore(deps): update ansible/ansible-lint digest to 9765b87	2025-08-04 08:21:18 +02:00
dev-sec CI	6edcedc9b6	update changelog	2025-08-04 06:00:35 +00:00
renovate[bot]	0eb6fbeae3	chore(deps): update ansible/ansible-lint digest to 9765b87 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-08-04 06:00:10 +00:00
Martin Schurz	9634efbdff	Merge pull request #887 from jonathanspw/patch-1 Improve OS support accuracy	2025-08-04 07:59:19 +02:00
Jonathan Wright	157832e472	Fix broken SSH host key config in rhel/almalinux 10 Signed-off-by: Jonathan Wright <[email protected]>	2025-07-31 09:50:38 -05:00
Jonathan Wright	3d076bb92e	Improve OS support accuracy These roles are used/tested extensively within AlmaLinux's own infrastructure. Signed-off-by: Jonathan Wright <[email protected]>	2025-07-31 09:49:21 -05:00
dev-sec CI	db61a1d4c5	update galaxy.yml with new version	2025-07-25 07:39:59 +00:00
dev-sec CI	f4d4246ddf	update changelog	2025-07-24 15:18:32 +00:00