update gitignore

.gitignore

@@ -1 +1,3 @@
+ansible/.ansible
+ansible/.ansible-lint
 *.swp

ansible/ansible-lint

@@ -0,0 +1,4 @@
+---
+
+skip_list:
+  - yaml[line-length]

ansible/roles/bastion/defaults/main.yml

@@ -1,10 +1,10 @@
 ---
 
-private_networks: ""
-allowed_networks: ""
-fail2ban_ignore_ips: ""
+bastion_private_networks: ""
+bastion_allowed_networks: ""
+bastion_fail2ban_ignore_ips: ""
 
-dev_users: []
-admin_users: []
-rundeck_users: []
-log_server: ""
+bastion_dev_users: []
+bastion_admin_users: []
+bastion_rundeck_users: []
+bastion_log_server: ""

ansible/roles/bastion/handlers/main.yml

@@ -1,25 +1,25 @@
 ---
-- name: reload nftables
+- name: Reload nftables
   ansible.builtin.systemd:
     name: nftables
     state: reloaded
 
-- name: reload fail2ban
+- name: Reload fail2ban
   ansible.builtin.systemd:
     name: fail2ban
     state: reloaded
 
-- name: restart fail2ban
+- name: Restart fail2ban
   ansible.builtin.systemd:
     name: fail2ban
-    state: restart
+    state: restarted
 
-- name: restart ssh
+- name: Restart ssh
   ansible.builtin.systemd:
     service: sshd
     state: restarted
 
-- name: restart rsyslog
+- name: Restart rsyslog
   ansible.builtin.systemd:
     service: rsyslog
     state: restarted

ansible/roles/bastion/tasks/firewall.yml

@@ -1,44 +1,46 @@
-- name: ensure nftables service is started and enabled
+---
+
+- name: Ensure nftables service is started and enabled
   ansible.builtin.systemd:
     name: nftables
     state: started
     enabled: true
   tags: all,firewall
 
-- name: deploying nftables configuration
+- name: Deploying nftables configuration
   ansible.builtin.template:
     src: nftables.conf.j2
     dest: /etc/nftables.conf
     owner: root
     group: root
-    mode: '0755'
+    mode: "0755"
     backup: true
     validate: "nft -c -f %s"
   notify:
-    - reload nftables
-    - restart fail2ban
+    - Reload nftables
+    - Restart fail2ban
   tags: all,firewall
 
-- name: ensure fail2ban is installed
+- name: Ensure fail2ban is installed
   ansible.builtin.apt:
     name: fail2ban
     state: present
     update_cache: true
   tags: all,firewall
 
-- name: ensure fail2ban is enabled and running
+- name: Ensure fail2ban is enabled and running
   ansible.builtin.systemd:
     name: fail2ban
     state: started
     enabled: true
   tags: all,firewall
 
-- name: deploying fail2ban ssh conf
+- name: Deploying fail2ban ssh conf
   ansible.builtin.template:
     src: sshd.conf.j2
     dest: /etc/fail2ban/jail.d/sshd.conf
     owner: root
     group: root
-    mode: '0644'
+    mode: "0644"
   notify: reload fail2ban
   tags: all,firewall

ansible/roles/bastion/tasks/main.yml

@@ -1,13 +1,13 @@
 ---
 
-- name: user deployment related tasks
-  include_tasks: users.yml
+- name: User deployment related tasks
+  ansible.builtin.include_tasks: users.yml
   tags: all,users,rootonly
 
-- name: firewall deployment related tasks
-  include_tasks: firewall.yml
+- name: Firewall deployment related tasks
+  ansible.builtin.include_tasks: firewall.yml
   tags: all,firewall
 
-- name: ssh deployment related tasks
-  include_tasks: ssh.yml
+- name: Ssh deployment related tasks
+  ansible.builtin.include_tasks: ssh.yml
   tags: all,ssh

ansible/roles/bastion/tasks/ssh.yml

@@ -1,28 +1,28 @@
 ---
 
-- name: ensure sshd is enabled
+- name: Ensure sshd is enabled
   ansible.builtin.systemd:
     name: sshd
     enabled: true
   tags: all,ssh
 
-- name: deploy sshd_config
+- name: Deploy sshd_config
   ansible.builtin.template:
     src: sshd_config.j2
     dest: /etc/ssh/sshd_config
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
     validate: "sshd -T -f %s"
-  notify: restart ssh
+  notify: Restart ssh
   tags: all,ssh
 
-- name: deploy rsyslog conf
+- name: Deploy rsyslog conf
   ansible.builtin.template:
     src: auth.conf.j2
     dest: /etc/rsyslog.d/auth.conf
     owner: root
     group: root
-    mode: 0644
-  notify: restart rsyslog
+    mode: "0644"
+  notify: Restart rsyslog
   tags: all,ssh

ansible/roles/bastion/tasks/users.yml

@@ -1,13 +1,13 @@
 ---
 
-- name: installing sudo
+- name: Installing sudo
   ansible.builtin.apt:
     name: sudo
     update_cache: true
     state: present
   tags: all,users
 
-- name: adding targetpw directive for sudo
+- name: Adding targetpw directive for sudo
   ansible.builtin.lineinfile:
     path: /etc/sudoers
     line: "{{ item }}"
@@ -17,37 +17,37 @@
     - "Defaults        insults"
   tags: all,users
 
-- name: creating admin users
+- name: Creating admin users
   ansible.builtin.user:
     name: "{{ item.username }}"
     shell: /bin/bash
     groups: sudo
-  with_items: "{{ admin_users }}"
+  with_items: "{{ bastion_admin_users }}"
   tags: all,users
 
-- name: creating dev users
+- name: Creating dev users
   ansible.builtin.user:
     name: "{{ item.username }}"
     shell: /bin/bash
     groups: sudo
-  with_items: "{{ dev_users }}"
+  with_items: "{{ bastion_dev_users }}"
   tags: all,users
 
-- name: adding authorized_keys for regular users
-  ansible.builtin.authorized_key:
+- name: Adding authorized_keys for regular users
+  ansible.posix.authorized_key:
     user: "{{ item.username }}"
     key: "{{ item.public_key }}"
     state: "{{ item.state | default('present') }}"
   with_items:
-    - "{{ admin_users }}"
-    - "{{ dev_users }}"
+    - "{{ bastion_admin_users }}"
+    - "{{ bastion_dev_users }}"
   tags: all,users
 
-- name: adding authorized_keys for root users
-  ansible.builtin.authorized_key:
+- name: Adding authorized_keys for root users
+  ansible.posix.authorized_key:
     user: "root"
     key: "{{ item.public_key }}"
-    key_options: 'from="{{ private_networks }}"'
+    key_options: 'from="{{ bastion_private_networks }}"'
     state: "{{ item.state }}"
-  with_items: "{{ admin_users }}"
+  with_items: "{{ bastion_admin_users }}"
   tags: all,users,rootonly

ansible/roles/docker/handlers/main.yml

@@ -1,16 +1,16 @@
 ---
 
-- name: restart containerd
+- name: Restart containerd
   ansible.builtin.systemd:
     name: containerd
     state: restarted
 
-- name: restart docker
+- name: Restart docker
   ansible.builtin.systemd:
     name: docker
     state: restarted
 
-- name: restart multipathd
+- name: Restart multipathd
   ansible.builtin.systemd:
     name: multipathd
     state: restarted

ansible/roles/docker/tasks/main.yml

@@ -1,5 +1,7 @@
-- name: set specific variables for distributions
-  include_vars: '{{ item }}'
+---
+
+- name: Set specific variables for distributions
+  ansible.builtin.include_vars: '{{ item }}'
   with_first_found:
     - '{{ ansible_distribution }}-{{ ansible_distribution_version }}.yml'
     - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml'
@@ -9,7 +11,7 @@
     - default.yml
 
 - name: Suppression anciennes versions de docker
-  apt:
+  ansible.builtin.apt:
     pkg:
       - docker
       - docker-engine
@@ -17,7 +19,7 @@
     state: absent
 
 - name: Installation des prérequis
-  apt:
+  ansible.builtin.apt:
     pkg:
       - apt-transport-https
       - ca-certificates
@@ -26,40 +28,46 @@
       - software-properties-common
       - nfs-common
     state: present
-    update_cache: yes
+    update_cache: true
 
 - name: Ajout de la clef GPG docker.com
-  apt_key:
+  ansible.builtin.apt_key:
     url: https://download.docker.com/linux/ubuntu/gpg
     state: present
 
 - name: Ajout du repo APT docker.com
-  apt_repository:
+  ansible.builtin.apt_repository:
     repo: deb [arch=amd64] https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable
     state: present
     filename: docker
 
-- name: Installation de docker dans la version {{ target_version }}
-  apt:
+- name: Installation de docker dans la version {{ docker_target_version }}
+  ansible.builtin.apt:
     pkg:
-      - docker-ce={{ target_version }}
-      - docker-ce-cli={{ target_version }}
+      - docker-ce={{ docker_target_version }}
+      - docker-ce-cli={{ docker_target_version }}
     state: present
-    update_cache: yes
+    update_cache: true
   register: apt_out
 
 - name: Affichage sortie du module apt
-  debug:
+  ansible.builtin.debug:
     msg:
       - "{{ apt_out.stdout_lines }}"
       - "{{ apt_out.stderr_lines }}"
-  ignore_errors: yes
+  failed_when: apt_out.rc != 0
 
 - name: Verrouillage des paquets docker-ce
-  command: apt-mark hold docker-ce docker-ce-cli containerd.io
+  ansible.builtin.dpkg_selections:
+    name: "{{ item }}"
+    selection: hold
+  with_items:
+    - docker-ce
+    - docker-ce-cli
+    - containerd.io
 
-- name: adding cleaning cron
-  cron:
+- name: Adding cleaning cron
+  ansible.builtin.cron:
     minute: "0"
     hour: "0"
     job: "/usr/bin/docker image prune -a -f >/dev/null 2>&1"
@@ -97,8 +105,8 @@
     dest: /etc/containerd/config.toml
     owner: root
     group: root
-    mode: '0755'
-  notify: restart containerd
+    mode: "0755"
+  notify: Restart containerd
 
 - name: Customise docker file daemon.json
   ansible.builtin.copy:
@@ -106,8 +114,8 @@
     dest: /etc/docker/daemon.json
     owner: root
     group: root
-    mode: '0755'
-  notify: restart docker
+    mode: "0755"
+  notify: Restart docker
 
 - name: Adding Multipathd blacklist for longhorn support
   ansible.builtin.blockinfile:
@@ -117,15 +125,15 @@
       blacklist {
           devnode "^sd[a-z0-9]+"
       }
-  notify: restart multipathd
+  notify: Restart multipathd
 
-- name: start and enable iscsi daemon for longhorn support
+- name: Start and enable iscsi daemon for longhorn support
   ansible.builtin.systemd_service:
     name: iscsid
     enabled: true
     state: started
 
-- name: enable iscsi_tcp kernel module for longhorn support
+- name: Enable iscsi_tcp kernel module for longhorn support
   community.general.modprobe:
     name: iscsi_tcp
     state: present

ansible/roles/docker/vars/Debian-12.yml

@@ -1,3 +1,3 @@
 ---
 
-target_version: "5:24.0.7-1~debian.12~bookworm"
+docker_target_version: "5:24.0.7-1~debian.12~bookworm"

ansible/roles/docker/vars/Ubuntu-18.04.yml

@@ -1,3 +1,3 @@
 ---
 
-target_version: "5:18.09.9~3-0~ubuntu-bionic"
+docker_target_version: "5:18.09.9~3-0~ubuntu-bionic"

ansible/roles/docker/vars/Ubuntu-20.04.yml

@@ -1,3 +1,3 @@
 ---
 
-target_version: "5:20.10.9~3-0~ubuntu-focal"
+docker_target_version: "5:20.10.9~3-0~ubuntu-focal"

ansible/roles/docker/vars/Ubuntu-22.04.yml

@@ -1,3 +1,3 @@
 ---
 
-target_version: "5:20.10.23~3-0~ubuntu-jammy"
+docker_target_version: "5:20.10.23~3-0~ubuntu-jammy"

ansible/roles/docker/vars/Ubuntu-24.04.yml

@@ -1,3 +1,3 @@
 ---
 
-target_version: "5:27.5.1-1~ubuntu.24.04~noble"
+docker_target_version: "5:27.5.1-1~ubuntu.24.04~noble"