Sebastian Gumprich
bb588bd777
* linting Signed-off-by: Sebastian Gumprich <[email protected]> * more linting Signed-off-by: Sebastian Gumprich <[email protected]> * change line length issues Signed-off-by: Sebastian Gumprich <[email protected]> * replace yes with true in tasks Signed-off-by: Sebastian Gumprich <[email protected]> * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 Signed-off-by: Sebastian Gumprich <[email protected]> * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 Signed-off-by: Sebastian Gumprich <[email protected]> * add exception for task Signed-off-by: Sebastian Gumprich <[email protected]> * remove trailing whitespace * add back deleted params Signed-off-by: Sebastian Gumprich <[email protected]> * add back deleted params Signed-off-by: Sebastian Gumprich <[email protected]> * add back tasks Signed-off-by: Sebastian Gumprich <[email protected]>
65 lines
1.8 KiB
YAML
65 lines
1.8 KiB
YAML
---
|
|
- name: Protect my.cnf
|
|
ansible.builtin.file:
|
|
path: "{{ mysql_hardening_mysql_conf_file }}"
|
|
mode: "0640"
|
|
owner: "{{ mysql_cnf_owner }}"
|
|
group: "{{ mysql_cnf_group }}"
|
|
follow: true
|
|
state: file
|
|
|
|
- name: Ensure permissions on mysql-datadir are correct
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ mysql_hardening_user }}"
|
|
group: "{{ mysql_hardening_user }}"
|
|
mode: "0750"
|
|
when: item is defined and item != ""
|
|
loop:
|
|
- "{{ mysql_settings.settings.datadir }}"
|
|
- '{{ mysql_datadir | default("") }}'
|
|
|
|
- name: Ensure permissions on mysql-logfile are correct
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: file
|
|
owner: "{{ mysql_hardening_user }}"
|
|
group: "{{ mysql_hardening_group }}"
|
|
mode: "0640"
|
|
when: item is defined and item != ""
|
|
loop:
|
|
- "{{ mysql_settings.settings.log_error }}"
|
|
- '{{ mysql_hardening_log_file | default("") }}'
|
|
|
|
- name: Check mysql configuration-directory exists and has right permissions
|
|
ansible.builtin.file:
|
|
path: "{{ mysql_hardening_mysql_confd_dir }}"
|
|
state: directory
|
|
owner: "{{ mysql_hardening_user }}"
|
|
group: "{{ mysql_hardening_group }}"
|
|
mode: "0750"
|
|
|
|
- name: Check include-dir directive is present in my.cnf
|
|
ansible.builtin.lineinfile:
|
|
dest: "{{ mysql_hardening_mysql_conf_file }}"
|
|
line: "!includedir {{ mysql_hardening_mysql_confd_dir }}"
|
|
insertafter: EOF
|
|
state: present
|
|
backup: true
|
|
notify: Restart mysql
|
|
|
|
- name: Apply hardening configuration
|
|
ansible.builtin.template:
|
|
src: hardening.cnf.j2
|
|
dest: "{{ mysql_hardening_mysql_hardening_conf_file }}"
|
|
owner: "{{ mysql_cnf_owner }}"
|
|
group: "{{ mysql_cnf_group }}"
|
|
mode: "0640"
|
|
notify: Restart mysql
|
|
|
|
- name: Enable mysql
|
|
ansible.builtin.service:
|
|
name: "{{ mysql_daemon }}"
|
|
enabled: "{{ mysql_daemon_enabled }}"
|