Sebastian GumprichandSebastian Gumprich
f295397611
* add role argument spec for os, ssh, mysql Signed-off-by: Sebastian Gumprich <[email protected]> * add role argument spec for os, ssh, mysql Signed-off-by: Sebastian Gumprich <[email protected]> * remove variable in variable as it cannot be used in argument spec Signed-off-by: Sebastian Gumprich <[email protected]> * fix wrong syntax * fix spelling errors Signed-off-by: Sebastian Gumprich <[email protected]> * cannot use vars before arg-spec validation Signed-off-by: Sebastian Gumprich <[email protected]> * yamllint the arg-spec Signed-off-by: Sebastian Gumprich <[email protected]> * add back variable Signed-off-by: Sebastian Gumprich <[email protected]> * remove redundant setting in tests * fix descriptions in mysql hardening to betterreflect what they do Signed-off-by: Sebastian Gumprich <[email protected]> * remove duplicate empty line Signed-off-by: Sebastian Gumprich <[email protected]> * set correct defaults on to ssl options Signed-off-by: Sebastian Gumprich <[email protected]> * remove left-over hidepid argument spec Signed-off-by: Sebastian Gumprich <[email protected]> * remove license and author infos, this lives in the collection readme Signed-off-by: Sebastian Gumprich <[email protected]> * fix styling Signed-off-by: Sebastian Gumprich <[email protected]> * update some descriptions and sort them in the readme Signed-off-by: Sebastian Gumprich <[email protected]> * some more linting Signed-off-by: Sebastian Gumprich <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>
69 lines
1.9 KiB
YAML
69 lines
1.9 KiB
YAML
---
|
|
- name: Protect my.cnf
|
|
ansible.builtin.file:
|
|
path: "{{ mysql_hardening_mysql_conf_file }}"
|
|
mode: "0640"
|
|
owner: "{{ mysql_cnf_owner }}"
|
|
group: "{{ mysql_cnf_group }}"
|
|
follow: true
|
|
state: file
|
|
|
|
- name: Ensure permissions on mysql-datadir are correct
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ mysql_hardening_user }}"
|
|
group: "{{ mysql_hardening_user }}"
|
|
mode: "0750"
|
|
when: item is defined and item != ""
|
|
loop:
|
|
- "{{ mysql_settings.settings.datadir }}"
|
|
- '{{ mysql_datadir | default("") }}'
|
|
|
|
- name: Ensure permissions on mysql-logfile are correct
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: file
|
|
owner: "{{ mysql_hardening_user }}"
|
|
group: "{{ mysql_hardening_group }}"
|
|
mode: "0640"
|
|
when:
|
|
- item is defined
|
|
- item != ""
|
|
- item != "stderr"
|
|
- item != "stdout"
|
|
loop:
|
|
- "{{ mysql_settings.settings.log_error }}"
|
|
- '{{ mysql_hardening_log_file | default("") }}'
|
|
|
|
- name: Check mysql configuration-directory exists and has right permissions
|
|
ansible.builtin.file:
|
|
path: "{{ mysql_hardening_mysql_confd_dir }}"
|
|
state: directory
|
|
owner: "{{ mysql_hardening_user }}"
|
|
group: "{{ mysql_hardening_group }}"
|
|
mode: "0750"
|
|
|
|
- name: Check include-dir directive is present in my.cnf
|
|
ansible.builtin.lineinfile:
|
|
dest: "{{ mysql_hardening_mysql_conf_file }}"
|
|
line: "!includedir {{ mysql_hardening_mysql_confd_dir }}"
|
|
insertafter: EOF
|
|
state: present
|
|
backup: true
|
|
notify: Restart mysql
|
|
|
|
- name: Apply hardening configuration
|
|
ansible.builtin.template:
|
|
src: hardening.cnf.j2
|
|
dest: "{{ mysql_hardening_mysql_confd_dir + '/hardening.cnf' }}"
|
|
owner: "{{ mysql_cnf_owner }}"
|
|
group: "{{ mysql_cnf_group }}"
|
|
mode: "0640"
|
|
notify: Restart mysql
|
|
|
|
- name: Enable mysql
|
|
ansible.builtin.service:
|
|
name: "{{ mysql_daemon }}"
|
|
enabled: "{{ mysql_daemon_enabled }}"
|