.gitignore

@@ -1,3 +1 @@
-ansible/.ansible
-ansible/.ansible-lint
 *.swp

ansible/ansible-lint

@@ -1,4 +0,0 @@
----
-
-skip_list:
-  - yaml[line-length]

ansible/roles/bastion/defaults/main.yml

@@ -1,10 +1,10 @@
 ---
 
-bastion_private_networks: ""
-bastion_allowed_networks: ""
-bastion_fail2ban_ignore_ips: ""
+private_networks: ""
+allowed_networks: ""
+fail2ban_ignore_ips: ""
 
-bastion_dev_users: []
-bastion_admin_users: []
-bastion_rundeck_users: []
-bastion_log_server: ""
+dev_users: []
+admin_users: []
+rundeck_users: []
+log_server: ""

ansible/roles/bastion/handlers/main.yml

@@ -1,25 +1,25 @@
 ---
-- name: Reload nftables
+- name: reload nftables
   ansible.builtin.systemd:
     name: nftables
     state: reloaded
 
-- name: Reload fail2ban
+- name: reload fail2ban
   ansible.builtin.systemd:
     name: fail2ban
     state: reloaded
 
-- name: Restart fail2ban
+- name: restart fail2ban
   ansible.builtin.systemd:
     name: fail2ban
-    state: restarted
+    state: restart
 
-- name: Restart ssh
+- name: restart ssh
   ansible.builtin.systemd:
     service: sshd
     state: restarted
 
-- name: Restart rsyslog
+- name: restart rsyslog
   ansible.builtin.systemd:
     service: rsyslog
     state: restarted

ansible/roles/bastion/tasks/firewall.yml

@@ -1,46 +1,44 @@
----
-
-- name: Ensure nftables service is started and enabled
+- name: ensure nftables service is started and enabled
   ansible.builtin.systemd:
     name: nftables
     state: started
     enabled: true
   tags: all,firewall
 
-- name: Deploying nftables configuration
+- name: deploying nftables configuration
   ansible.builtin.template:
     src: nftables.conf.j2
     dest: /etc/nftables.conf
     owner: root
     group: root
-    mode: "0755"
+    mode: '0755'
     backup: true
     validate: "nft -c -f %s"
   notify:
-    - Reload nftables
-    - Restart fail2ban
+    - reload nftables
+    - restart fail2ban
   tags: all,firewall
 
-- name: Ensure fail2ban is installed
+- name: ensure fail2ban is installed
   ansible.builtin.apt:
     name: fail2ban
     state: present
     update_cache: true
   tags: all,firewall
 
-- name: Ensure fail2ban is enabled and running
+- name: ensure fail2ban is enabled and running
   ansible.builtin.systemd:
     name: fail2ban
     state: started
     enabled: true
   tags: all,firewall
 
-- name: Deploying fail2ban ssh conf
+- name: deploying fail2ban ssh conf
   ansible.builtin.template:
     src: sshd.conf.j2
     dest: /etc/fail2ban/jail.d/sshd.conf
     owner: root
     group: root
-    mode: "0644"
+    mode: '0644'
   notify: reload fail2ban
   tags: all,firewall

ansible/roles/bastion/tasks/main.yml

@@ -1,13 +1,13 @@
 ---
 
-- name: User deployment related tasks
-  ansible.builtin.include_tasks: users.yml
+- name: user deployment related tasks
+  include_tasks: users.yml
   tags: all,users,rootonly
 
-- name: Firewall deployment related tasks
-  ansible.builtin.include_tasks: firewall.yml
+- name: firewall deployment related tasks
+  include_tasks: firewall.yml
   tags: all,firewall
 
-- name: Ssh deployment related tasks
-  ansible.builtin.include_tasks: ssh.yml
+- name: ssh deployment related tasks
+  include_tasks: ssh.yml
   tags: all,ssh

ansible/roles/bastion/tasks/ssh.yml

@@ -1,28 +1,28 @@
 ---
 
-- name: Ensure sshd is enabled
+- name: ensure sshd is enabled
   ansible.builtin.systemd:
     name: sshd
     enabled: true
   tags: all,ssh
 
-- name: Deploy sshd_config
+- name: deploy sshd_config
   ansible.builtin.template:
     src: sshd_config.j2
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: "0644"
+    mode: 0644
     validate: "sshd -T -f %s"
-  notify: Restart ssh
+  notify: restart ssh
   tags: all,ssh
 
-- name: Deploy rsyslog conf
+- name: deploy rsyslog conf
   ansible.builtin.template:
     src: auth.conf.j2
     dest: /etc/rsyslog.d/auth.conf
     owner: root
     group: root
-    mode: "0644"
-  notify: Restart rsyslog
+    mode: 0644
+  notify: restart rsyslog
   tags: all,ssh

ansible/roles/bastion/tasks/users.yml

@@ -1,13 +1,13 @@
 ---
 
-- name: Installing sudo
+- name: installing sudo
   ansible.builtin.apt:
     name: sudo
     update_cache: true
     state: present
   tags: all,users
 
-- name: Adding targetpw directive for sudo
+- name: adding targetpw directive for sudo
   ansible.builtin.lineinfile:
     path: /etc/sudoers
     line: "{{ item }}"
@@ -17,37 +17,37 @@
     - "Defaults        insults"
   tags: all,users
 
-- name: Creating admin users
+- name: creating admin users
   ansible.builtin.user:
     name: "{{ item.username }}"
     shell: /bin/bash
     groups: sudo
-  with_items: "{{ bastion_admin_users }}"
+  with_items: "{{ admin_users }}"
   tags: all,users
 
-- name: Creating dev users
+- name: creating dev users
   ansible.builtin.user:
     name: "{{ item.username }}"
     shell: /bin/bash
     groups: sudo
-  with_items: "{{ bastion_dev_users }}"
+  with_items: "{{ dev_users }}"
   tags: all,users
 
-- name: Adding authorized_keys for regular users
-  ansible.posix.authorized_key:
+- name: adding authorized_keys for regular users
+  ansible.builtin.authorized_key:
     user: "{{ item.username }}"
     key: "{{ item.public_key }}"
     state: "{{ item.state | default('present') }}"
   with_items:
-    - "{{ bastion_admin_users }}"
-    - "{{ bastion_dev_users }}"
+    - "{{ admin_users }}"
+    - "{{ dev_users }}"
   tags: all,users
 
-- name: Adding authorized_keys for root users
-  ansible.posix.authorized_key:
+- name: adding authorized_keys for root users
+  ansible.builtin.authorized_key:
     user: "root"
     key: "{{ item.public_key }}"
-    key_options: 'from="{{ bastion_private_networks }}"'
+    key_options: 'from="{{ private_networks }}"'
     state: "{{ item.state }}"
-  with_items: "{{ bastion_admin_users }}"
+  with_items: "{{ admin_users }}"
   tags: all,users,rootonly

ansible/roles/docker/handlers/main.yml

@@ -1,16 +1,16 @@
 ---
 
-- name: Restart containerd
+- name: restart containerd
   ansible.builtin.systemd:
     name: containerd
     state: restarted
 
-- name: Restart docker
+- name: restart docker
   ansible.builtin.systemd:
     name: docker
     state: restarted
 
-- name: Restart multipathd
+- name: restart multipathd
   ansible.builtin.systemd:
     name: multipathd
     state: restarted

ansible/roles/docker/tasks/main.yml

@@ -1,7 +1,5 @@
----
-
-- name: Set specific variables for distributions
-  ansible.builtin.include_vars: '{{ item }}'
+- name: set specific variables for distributions
+  include_vars: '{{ item }}'
   with_first_found:
     - '{{ ansible_distribution }}-{{ ansible_distribution_version }}.yml'
     - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml'
@@ -11,7 +9,7 @@
     - default.yml
 
 - name: Suppression anciennes versions de docker
-  ansible.builtin.apt:
+  apt:
     pkg:
       - docker
       - docker-engine
@@ -19,7 +17,7 @@
     state: absent
 
 - name: Installation des prérequis
-  ansible.builtin.apt:
+  apt:
     pkg:
       - apt-transport-https
       - ca-certificates
@@ -28,46 +26,40 @@
       - software-properties-common
       - nfs-common
     state: present
-    update_cache: true
+    update_cache: yes
 
 - name: Ajout de la clef GPG docker.com
-  ansible.builtin.apt_key:
+  apt_key:
     url: https://download.docker.com/linux/ubuntu/gpg
     state: present
 
 - name: Ajout du repo APT docker.com
-  ansible.builtin.apt_repository:
+  apt_repository:
     repo: deb [arch=amd64] https://download.docker.com/linux/{{ ansible_distribution|lower }} {{ ansible_distribution_release }} stable
     state: present
     filename: docker
 
-- name: Installation de docker dans la version {{ docker_target_version }}
-  ansible.builtin.apt:
+- name: Installation de docker dans la version {{ target_version }}
+  apt:
     pkg:
-      - docker-ce={{ docker_target_version }}
-      - docker-ce-cli={{ docker_target_version }}
+      - docker-ce={{ target_version }}
+      - docker-ce-cli={{ target_version }}
     state: present
-    update_cache: true
+    update_cache: yes
   register: apt_out
 
 - name: Affichage sortie du module apt
-  ansible.builtin.debug:
+  debug:
     msg:
       - "{{ apt_out.stdout_lines }}"
       - "{{ apt_out.stderr_lines }}"
-  failed_when: apt_out.rc != 0
+  ignore_errors: yes
 
 - name: Verrouillage des paquets docker-ce
-  ansible.builtin.dpkg_selections:
-    name: "{{ item }}"
-    selection: hold
-  with_items:
-    - docker-ce
-    - docker-ce-cli
-    - containerd.io
+  command: apt-mark hold docker-ce docker-ce-cli containerd.io
 
-- name: Adding cleaning cron
-  ansible.builtin.cron:
+- name: adding cleaning cron
+  cron:
     minute: "0"
     hour: "0"
     job: "/usr/bin/docker image prune -a -f >/dev/null 2>&1"
@@ -105,8 +97,8 @@
     dest: /etc/containerd/config.toml
     owner: root
     group: root
-    mode: "0755"
-  notify: Restart containerd
+    mode: '0755'
+  notify: restart containerd
 
 - name: Customise docker file daemon.json
   ansible.builtin.copy:
@@ -114,8 +106,8 @@
     dest: /etc/docker/daemon.json
     owner: root
     group: root
-    mode: "0755"
-  notify: Restart docker
+    mode: '0755'
+  notify: restart docker
 
 - name: Adding Multipathd blacklist for longhorn support
   ansible.builtin.blockinfile:
@@ -125,15 +117,15 @@
       blacklist {
           devnode "^sd[a-z0-9]+"
       }
-  notify: Restart multipathd
+  notify: restart multipathd
 
-- name: Start and enable iscsi daemon for longhorn support
+- name: start and enable iscsi daemon for longhorn support
   ansible.builtin.systemd_service:
     name: iscsid
     enabled: true
     state: started
 
-- name: Enable iscsi_tcp kernel module for longhorn support
+- name: enable iscsi_tcp kernel module for longhorn support
   community.general.modprobe:
     name: iscsi_tcp
     state: present

ansible/roles/docker/vars/Debian-12.yml

@@ -1,3 +1,3 @@
 ---
 
-docker_target_version: "5:24.0.7-1~debian.12~bookworm"
+target_version: "5:24.0.7-1~debian.12~bookworm"

ansible/roles/docker/vars/Ubuntu-18.04.yml

@@ -1,3 +1,3 @@
 ---
 
-docker_target_version: "5:18.09.9~3-0~ubuntu-bionic"
+target_version: "5:18.09.9~3-0~ubuntu-bionic"

ansible/roles/docker/vars/Ubuntu-20.04.yml

@@ -1,3 +1,3 @@
 ---
 
-docker_target_version: "5:20.10.9~3-0~ubuntu-focal"
+target_version: "5:20.10.9~3-0~ubuntu-focal"

ansible/roles/docker/vars/Ubuntu-22.04.yml

@@ -1,3 +1,3 @@
 ---
 
-docker_target_version: "5:20.10.23~3-0~ubuntu-jammy"
+target_version: "5:20.10.23~3-0~ubuntu-jammy"

ansible/roles/docker/vars/Ubuntu-24.04.yml

@@ -1,3 +1,3 @@
 ---
 
-docker_target_version: "5:27.5.1-1~ubuntu.24.04~noble"
+target_version: "5:27.5.1-1~ubuntu.24.04~noble"