Martin Schurz
38791f0199
* Update testing and remove old, unsupported OS versions Signed-off-by: Martin Schurz <[email protected]> * Update Arch OS Signed-off-by: Martin Schurz <[email protected]> * Fix SuSE login.defs issues Signed-off-by: Martin Schurz <[email protected]> * Debug ... Signed-off-by: Martin Schurz <[email protected]> * Fix SuSE stuff Signed-off-by: Martin Schurz <[email protected]> * Fix SuSE stuff Signed-off-by: Martin Schurz <[email protected]> * Update OS Support Signed-off-by: Martin Schurz <[email protected]> * Use Ansible mysql module Signed-off-by: Martin Schurz <[email protected]> * Update OS Support Signed-off-by: Martin Schurz <[email protected]> * Use existing Fedora images Signed-off-by: Martin Schurz <[email protected]> * Fix VM tests Signed-off-by: Martin Schurz <[email protected]> * fix last errors Signed-off-by: Martin Schurz <[email protected]> * Final fixes Signed-off-by: Martin Schurz <[email protected]> --------- Signed-off-by: Martin Schurz <[email protected]>
54 lines
1.8 KiB
YAML
54 lines
1.8 KiB
YAML
---
|
|
- name: Wrapper playbook for kitchen testing "ansible-os-hardening" with custom vars for testing
|
|
hosts: all
|
|
become: true
|
|
environment:
|
|
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
|
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
|
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
|
tasks:
|
|
- name: Override for arch
|
|
ansible.builtin.set_fact:
|
|
os_mnt_boot_enabled: false
|
|
os_mnt_tmp_enabled: true
|
|
os_mnt_tmp_src: tmpfs
|
|
os_mnt_tmp_filesystem: tmpfs
|
|
when: ansible_facts.os_family == 'Archlinux'
|
|
|
|
- name: Overrides for Fedora image
|
|
ansible.builtin.set_fact:
|
|
os_mnt_tmp_enabled: true
|
|
os_mnt_tmp_src: tmpfs
|
|
os_mnt_tmp_filesystem: tmpfs
|
|
when: ansible_facts.distribution == 'Fedora'
|
|
|
|
- name: Overrides for Fedora 40 image
|
|
ansible.builtin.set_fact:
|
|
os_mnt_var_enabled: true
|
|
os_mnt_var_src: UUID=282c6d73-afc2-4113-9856-c7679ad51920
|
|
os_mnt_var_filesystem: btrfs
|
|
os_mnt_var_options: rw,nosuid,nodev,compress=zstd:1,subvol=var
|
|
when:
|
|
- ansible_facts.distribution == 'Fedora'
|
|
- ansible_facts.distribution_major_version|int == 40
|
|
|
|
- name: Overrides for Debian 13 image
|
|
ansible.builtin.set_fact:
|
|
os_mnt_tmp_enabled: true
|
|
os_mnt_tmp_src: tmpfs
|
|
os_mnt_tmp_filesystem: tmpfs
|
|
when:
|
|
- ansible_facts.distribution == 'Debian'
|
|
- ansible_facts.distribution_major_version|int == 13
|
|
|
|
- name: Include os_hardening role
|
|
ansible.builtin.include_role:
|
|
name: devsec.hardening.os_hardening
|
|
vars:
|
|
os_auth_pam_passwdqc_enable: false
|
|
os_auth_lockout_time: 15
|
|
os_yum_repo_file_whitelist: [foo.repo]
|
|
os_mnt_boot_enabled: true
|
|
os_mnt_home_enabled: true
|
|
os_mnt_boot_src: /dev/vda1
|