ansible: linting bastion

ansible/.ansible-lint

@@ -0,0 +1,4 @@
+---
+
+skip_list:
+  - yaml[line-length]

ansible/roles/bastion/defaults/main.yml

@@ -1,10 +1,10 @@
 ---
 
-private_networks: ""
-allowed_networks: ""
-fail2ban_ignore_ips: ""
+bastion_private_networks: ""
+bastion_allowed_networks: ""
+bastion_fail2ban_ignore_ips: ""
 
-dev_users: []
-admin_users: []
-rundeck_users: []
-log_server: ""
+bastion_dev_users: []
+bastion_admin_users: []
+bastion_rundeck_users: []
+bastion_log_server: ""

ansible/roles/bastion/handlers/main.yml

@@ -1,25 +1,25 @@
 ---
-- name: reload nftables
+- name: Reload nftables
   ansible.builtin.systemd:
     name: nftables
     state: reloaded
 
-- name: reload fail2ban
+- name: Reload fail2ban
   ansible.builtin.systemd:
     name: fail2ban
     state: reloaded
 
-- name: restart fail2ban
+- name: Restart fail2ban
   ansible.builtin.systemd:
     name: fail2ban
-    state: restart
+    state: restarted
 
-- name: restart ssh
+- name: Restart ssh
   ansible.builtin.systemd:
     service: sshd
     state: restarted
 
-- name: restart rsyslog
+- name: Restart rsyslog
   ansible.builtin.systemd:
     service: rsyslog
     state: restarted

ansible/roles/bastion/tasks/firewall.yml

@@ -1,44 +1,46 @@
-- name: ensure nftables service is started and enabled
+---
+
+- name: Ensure nftables service is started and enabled
   ansible.builtin.systemd:
     name: nftables
     state: started
     enabled: true
   tags: all,firewall
 
-- name: deploying nftables configuration
+- name: Deploying nftables configuration
   ansible.builtin.template:
     src: nftables.conf.j2
     dest: /etc/nftables.conf
     owner: root
     group: root
-    mode: '0755'
+    mode: "0755"
     backup: true
     validate: "nft -c -f %s"
   notify:
-    - reload nftables
-    - restart fail2ban
+    - Reload nftables
+    - Restart fail2ban
   tags: all,firewall
 
-- name: ensure fail2ban is installed
+- name: Ensure fail2ban is installed
   ansible.builtin.apt:
     name: fail2ban
     state: present
     update_cache: true
   tags: all,firewall
 
-- name: ensure fail2ban is enabled and running
+- name: Ensure fail2ban is enabled and running
   ansible.builtin.systemd:
     name: fail2ban
     state: started
     enabled: true
   tags: all,firewall
 
-- name: deploying fail2ban ssh conf
+- name: Deploying fail2ban ssh conf
   ansible.builtin.template:
     src: sshd.conf.j2
     dest: /etc/fail2ban/jail.d/sshd.conf
     owner: root
     group: root
-    mode: '0644'
+    mode: "0644"
   notify: reload fail2ban
   tags: all,firewall

ansible/roles/bastion/tasks/main.yml

@@ -1,13 +1,13 @@
 ---
 
-- name: user deployment related tasks
-  include_tasks: users.yml
+- name: User deployment related tasks
+  ansible.builtin.include_tasks: users.yml
   tags: all,users,rootonly
 
-- name: firewall deployment related tasks
-  include_tasks: firewall.yml
+- name: Firewall deployment related tasks
+  ansible.builtin.include_tasks: firewall.yml
   tags: all,firewall
 
-- name: ssh deployment related tasks
-  include_tasks: ssh.yml
+- name: Ssh deployment related tasks
+  ansible.builtin.include_tasks: ssh.yml
   tags: all,ssh

ansible/roles/bastion/tasks/ssh.yml

@@ -1,28 +1,28 @@
 ---
 
-- name: ensure sshd is enabled
+- name: Ensure sshd is enabled
   ansible.builtin.systemd:
     name: sshd
     enabled: true
   tags: all,ssh
 
-- name: deploy sshd_config
+- name: Deploy sshd_config
   ansible.builtin.template:
     src: sshd_config.j2
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
     validate: "sshd -T -f %s"
-  notify: restart ssh
+  notify: Restart ssh
   tags: all,ssh
 
-- name: deploy rsyslog conf
+- name: Deploy rsyslog conf
   ansible.builtin.template:
     src: auth.conf.j2
     dest: /etc/rsyslog.d/auth.conf
     owner: root
     group: root
-    mode: 0644
-  notify: restart rsyslog
+    mode: "0644"
+  notify: Restart rsyslog
   tags: all,ssh

ansible/roles/bastion/tasks/users.yml

@@ -1,13 +1,13 @@
 ---
 
-- name: installing sudo
+- name: Installing sudo
   ansible.builtin.apt:
     name: sudo
     update_cache: true
     state: present
   tags: all,users
 
-- name: adding targetpw directive for sudo
+- name: Adding targetpw directive for sudo
   ansible.builtin.lineinfile:
     path: /etc/sudoers
     line: "{{ item }}"
@@ -17,37 +17,37 @@
     - "Defaults        insults"
   tags: all,users
 
-- name: creating admin users
+- name: Creating admin users
   ansible.builtin.user:
     name: "{{ item.username }}"
     shell: /bin/bash
     groups: sudo
-  with_items: "{{ admin_users }}"
+  with_items: "{{ bastion_admin_users }}"
   tags: all,users
 
-- name: creating dev users
+- name: Creating dev users
   ansible.builtin.user:
     name: "{{ item.username }}"
     shell: /bin/bash
     groups: sudo
-  with_items: "{{ dev_users }}"
+  with_items: "{{ bastion_dev_users }}"
   tags: all,users
 
-- name: adding authorized_keys for regular users
-  ansible.builtin.authorized_key:
+- name: Adding authorized_keys for regular users
+  ansible.posix.authorized_key:
     user: "{{ item.username }}"
     key: "{{ item.public_key }}"
     state: "{{ item.state | default('present') }}"
   with_items:
-    - "{{ admin_users }}"
-    - "{{ dev_users }}"
+    - "{{ bastion_admin_users }}"
+    - "{{ bastion_dev_users }}"
   tags: all,users
 
-- name: adding authorized_keys for root users
-  ansible.builtin.authorized_key:
+- name: Adding authorized_keys for root users
+  ansible.posix.authorized_key:
     user: "root"
     key: "{{ item.public_key }}"
-    key_options: 'from="{{ private_networks }}"'
+    key_options: 'from="{{ bastion_private_networks }}"'
     state: "{{ item.state }}"
-  with_items: "{{ admin_users }}"
+  with_items: "{{ bastion_admin_users }}"
   tags: all,users,rootonly