sr2/ansible-collection-core
4
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

feat(baseline): move freeipa related lockdown overrides to role from playbook
Some checks failed
Ansible Lint Check / lint (push) Failing after 57s
Details

Browse source
This commit is contained in:
Iain Learmonth 2025-11-08 21:00:18 +00:00
parent ec972f9470
commit 78aad663e6
2 changed files with 8 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

20
playbooks/core_services.yml
View file

@ -16,18 +16,8 @@
- python3-acme
- python3-zipp
- python3-pyOpenSSL
# 2.1 Configure Server Services
# These services are required by FreeIPA.
rhel9cis_autofs_services: true # TODO: can we mask it? This is required by FreeIPA but we don't use it.
rhel9cis_dns_server: true
rhel9cis_httpd_server: true
# 2.2 Configure Client Services
# These services are required by FreeIPA.
rhel9cis_openldap_clients_required: true
# 5.3.2 Configure authselect
# ipaservers are part of Linux Identity Management. Joining your host to an IdM
# domain automatically configures SSSD authentication on your host.
rhel9cis_allow_authselect_updates: false
# TODO: Restricted umask breaks FreeIPA roles
rhel9cis_rule_5_4_2_6: false
rhel9cis_rule_5_4_3_3: false
@ -41,16 +31,6 @@
hosts:
- keycloak
become: true
vars:
rhel9cis_autofs_services: true # TODO: can we mask it? This is required by FreeIPA but we don't use it.
# 2.2 Configure Client Services
# These services are required by FreeIPA.
rhel9cis_openldap_clients_required: true
# 5.3.2 Configure authselect
# ipaservers are part of Linux Identity Management. Joining your host to an IdM
# domain automatically configures SSSD authentication on your host.
rhel9cis_allow_authselect_updates: false
podman_host_rootless_users: ["identity"]
roles:
- role: sr2c.core.baseline
tags: bootstrap