sr2/ansible-collection-core
4
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

feat(baseline): move freeipa related lockdown overrides to role from playbook
Some checks failed
Ansible Lint Check / lint (push) Failing after 57s
Details

Browse source
This commit is contained in:
Iain Learmonth 2025-11-08 21:00:18 +00:00
parent ec972f9470
commit 78aad663e6
2 changed files with 8 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

20
playbooks/core_services.yml
View file

@ -16,18 +16,8 @@
- python3-acme - python3-acme
- python3-zipp - python3-zipp
- python3-pyOpenSSL - python3-pyOpenSSL
# 2.1 Configure Server Services
# These services are required by FreeIPA.
rhel9cis_autofs_services: true # TODO: can we mask it? This is required by FreeIPA but we don't use it.
rhel9cis_dns_server: true rhel9cis_dns_server: true
rhel9cis_httpd_server: true rhel9cis_httpd_server: true
# 2.2 Configure Client Services
# These services are required by FreeIPA.
rhel9cis_openldap_clients_required: true
# 5.3.2 Configure authselect
# ipaservers are part of Linux Identity Management. Joining your host to an IdM
# domain automatically configures SSSD authentication on your host.
rhel9cis_allow_authselect_updates: false
# TODO: Restricted umask breaks FreeIPA roles # TODO: Restricted umask breaks FreeIPA roles
rhel9cis_rule_5_4_2_6: false rhel9cis_rule_5_4_2_6: false
rhel9cis_rule_5_4_3_3: false rhel9cis_rule_5_4_3_3: false
@ -41,16 +31,6 @@
hosts: hosts:
- keycloak - keycloak
become: true become: true
vars:
rhel9cis_autofs_services: true # TODO: can we mask it? This is required by FreeIPA but we don't use it.
# 2.2 Configure Client Services
# These services are required by FreeIPA.
rhel9cis_openldap_clients_required: true
# 5.3.2 Configure authselect
# ipaservers are part of Linux Identity Management. Joining your host to an IdM
# domain automatically configures SSSD authentication on your host.
rhel9cis_allow_authselect_updates: false
podman_host_rootless_users: ["identity"]
roles: roles:
- role: sr2c.core.baseline - role: sr2c.core.baseline
tags: bootstrap tags: bootstrap

8
roles/baseline/tasks/lockdown.yml
View file

@ -22,4 +22,12 @@
rhel9cis_syslog: rsyslog rhel9cis_syslog: rsyslog
rhel9cis_time_synchronization_servers: "{{ baseline_ntp_servers }}" rhel9cis_time_synchronization_servers: "{{ baseline_ntp_servers }}"
rhel9cis_warning_banner: "{{ baseline_warning_banner }}" rhel9cis_warning_banner: "{{ baseline_warning_banner }}"
rhel9cis_autofs_services: true # TODO: can we mask it? This is required by FreeIPA but we don't use it.
# 2.2 Configure Client Services
# These services are required by FreeIPA.
rhel9cis_openldap_clients_required: true
# 5.3.2 Configure authselect
# ipaservers are part of Linux Identity Management. Joining your host to an IdM
# domain automatically configures SSSD authentication on your host.
rhel9cis_allow_authselect_updates: false
when: (ansible_distribution == "Rocky") and (ansible_distribution_major_version == "9") when: (ansible_distribution == "Rocky") and (ansible_distribution_major_version == "9")