play_01_essentials.yml

---
# Dieses Playbook dient zur initialen, sicheren Konfiguration eines Servers.
#
#
- name: Essentials Sysctl.conf, Firewall, Git, Python, Apt-Update
  hosts: all
  vars_files:
    - vars
    - vault
  vars:
    # common settings for role "sysctl"
    sysctl_settings:
    - name: net.ipv4.conf.all.rp_filter
      value: 1
    - name: net.ipv4.conf.default.rp_filter
      value: 1
    - name: net.ipv4.icmp_echo_ignore_broadcasts
      value: 1
    - name: net.ipv4.conf.all.accept_source_route
      value: 0
    - name: net.ipv6.conf.all.accept_source_route
      value: 0
    - name: net.ipv4.conf.default.accept_source_route
      value: 0
    - name: net.ipv6.conf.default.accept_source_route
      value: 0
    - name: net.ipv4.conf.all.send_redirects
      value: 0
    - name: net.ipv4.conf.default.send_redirects
      value: 0
    - name: net.ipv4.tcp_syncookies
      value: 1
    - name: net.ipv4.tcp_max_syn_backlog
      value: 2048
    - name: net.ipv4.tcp_synack_retries
      value: 2
    - name: net.ipv4.tcp_syn_retries
      value: 5
    - name: net.ipv4.conf.all.log_martians
      value: 1
    - name: net.ipv4.icmp_ignore_bogus_error_responses
      value: 1
    - name: net.ipv4.conf.all.accept_redirects
      value: 0
    - name: net.ipv6.conf.all.accept_redirects
      value: 0
    - name: net.ipv4.conf.default.accept_redirects
      value: 0
    - name: net.ipv6.conf.default.accept_redirects
      value: 0
    - name: net.ipv4.icmp_echo_ignore_all # pings aktiv lassen
      value: 1
    # common settings for role "firewall"
    ufw_ipv6: "yes"
    ufw_default_input_policy: "DROP"
    ufw_default_output_policy: "ACCEPT"
    ufw_default_forward_policy: "DROP"
    ufw_default_application_policy: "SKIP"
    ufw_ssh_port: "{{ host_port }}"

  pre_tasks:
    - apt:
       update_cache: yes
       upgrade: full
       autoclean: yes
       autoremove: yes
    - setup:
      tags: python
    - locale_gen:
       name: "{{ item }}"
       state: present
      loop:
        - de_DE.UTF-8
        - en_US.UTF-8
  roles:
   - hostname
   - timezone
   - sysctl
   - git
   - firewall
   - unattended-upgrades