---
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
  hosts: all
  become: true
  environment:
    http_proxy: "{{ lookup('env', 'http_proxy') | default(omit)  }}"
    https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
    no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
  tasks:
    - name: Workaround for https://github.com/ansible/ansible/issues/66304
      ansible.builtin.set_fact:
        ansible_virtualization_type: docker
    - name: Include os_hardening role
      ansible.builtin.include_role:
        name: devsec.hardening.os_hardening
  vars:
    os_security_users_allow: change_user
    os_security_kernel_enable_core_dump: false
    os_auditd_num_logs: 10
    os_security_suid_sgid_remove_from_unknown: true
    os_auth_pam_passwdqc_enable: false
    os_auth_lockout_time: 15
    os_env_extra_user_paths: [/home]
    os_auth_allow_homeless: true
    os_security_suid_sgid_blacklist: [/bin/umount]
    os_security_suid_sgid_whitelist: [/usr/bin/rlogin]
    os_filesystem_whitelist: []
    os_yum_repo_file_whitelist: [foo.repo]
    os_users_without_password_ageing: [pw_no_ageing]
    os_auth_pw_warn_age: 7
    os_netrc_enabled: false
    os_ignore_users: [shell_sys_acc]
    os_ignore_home_folder_users: [user_with_777_home]
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
      net.ipv6.conf.all.accept_ra: 0
      net.ipv6.conf.default.accept_ra: 0
      net.ipv4.conf.all.rp_filter: 1
      net.ipv4.conf.default.rp_filter: 1
      net.ipv4.icmp_echo_ignore_broadcasts: 1
      net.ipv4.icmp_ignore_bogus_error_responses: 1
      net.ipv4.icmp_ratelimit: 100
      net.ipv4.icmp_ratemask: 88089
      net.ipv4.conf.all.arp_ignore: 1
      net.ipv4.conf.all.arp_announce: 2
      net.ipv4.conf.all.shared_media: 1
      net.ipv4.conf.default.shared_media: 1
      net.ipv4.conf.all.accept_source_route: 0
      net.ipv4.conf.default.accept_source_route: 0
      net.ipv4.conf.default.accept_redirects: 0
      net.ipv4.conf.all.accept_redirects: 0
      net.ipv4.conf.all.secure_redirects: 0
      net.ipv4.conf.default.secure_redirects: 0
      net.ipv6.conf.default.accept_redirects: 0
      net.ipv6.conf.all.accept_redirects: 0
      net.ipv4.conf.all.send_redirects: 0
      net.ipv4.conf.default.send_redirects: 0
      net.ipv4.conf.all.log_martians: 1
      net.ipv6.conf.default.router_solicitations: 0
      net.ipv6.conf.default.accept_ra_rtr_pref: 0
      net.ipv6.conf.default.accept_ra_pinfo: 0
      net.ipv6.conf.default.accept_ra_defrtr: 0
      net.ipv6.conf.default.conf: 0
      net.ipv6.conf.default.dad_transmits: 0
      net.ipv6.conf.default.max_addresses: 1
      kernel.sysrq: 0
      fs.suid_dumpable: 0
      kernel.randomize_va_space: 2

# - name: wrapper playbook for kitchen testing "ansible-os-hardening"
#  hosts: all
#  become: true
#  vars:
#    os_auditd_enabled: false
#  tasks:
#    - name: set ansible_python_interpreter to "/usr/bin/python3" on fedora
#      set_fact:
#        ansible_python_interpreter: "/usr/bin/python3"
#      when: ansible_facts.distribution == 'Fedora'
#
#    - name: Run the equivalent of "apt-get update" as a separate step
#      ansible.builtin.apt:
#        update_cache: yes
#      when: ansible_facts.os_family == 'Debian'
#
#    - include_role:
#        name: devsec.hardening.os_hardening