check new version

roles/01-server_hardening/tasks/01-update-system.yml

@@ -1,9 +1,6 @@
 ---
-- name: Update apt cache and upgrade system packages (Debian/Ubuntu)
+- name: Update apt cache for Debian/Ubuntu
   ansible.builtin.apt:
-    update_cache: true
-    upgrade: dist
-    autoremove: true
-    autoclean: true
-  when: ansible_os_family == "Debian"
-  register: system_update_result
+    update_cache: yes
+    cache_valid_time: 3600
+  when: ansible_os_family == "Debian"

roles/01-server_hardening/tasks/02-install-packages.yml

@@ -0,0 +1,14 @@
+---
+- name: Upgrade all packages
+  ansible.builtin.apt:
+    upgrade: dist
+    autoremove: yes
+    autoclean: yes
+  when: ansible_os_family == "Debian"
+  register: system_upgraded
+
+- name: Install security packages
+  ansible.builtin.apt:
+    name: "{{ security_packages }}"
+    state: present
+  when: ansible_os_family == "Debian"

roles/01-server_hardening/tasks/02-ssh-hardening.yml

@@ -1,10 +0,0 @@
----
-- name: Configure SSH daemon
-  ansible.builtin.template:
-    src: sshd_config.j2
-    dest: /etc/ssh/sshd_config
-    owner: root
-    group: root
-    mode: '0644'
-    backup: true
-  notify: "restart ssh service"

roles/01-server_hardening/tasks/03-configure-ssh.yml

@@ -0,0 +1,11 @@
+---
+- name: Configure SSH daemon
+  ansible.builtin.template:
+    src: sshd_config.j2
+    dest: "{{ ssh_config_file }}"
+    owner: root
+    group: root
+    mode: '0600'
+    backup: yes
+    validate: '/usr/sbin/sshd -t -f %s'
+  notify: restart ssh service

roles/01-server_hardening/tasks/03-firewall-setup.yml

@@ -1,32 +0,0 @@
----
-- name: Install UFW
-  ansible.builtin.apt:
-    name: ufw
-    state: present
-  when: firewall_enabled | bool
-
-- name: Reset UFW rules
-  community.general.ufw:
-    state: reset
-  when: firewall_enabled | bool
-
-- name: Allow SSH port
-  community.general.ufw:
-    rule: allow
-    port: "{{ ssh_port }}"
-    proto: tcp
-  when: firewall_enabled | bool
-
-- name: Allow Minecraft port
-  community.general.ufw:
-    rule: allow
-    port: "25565"
-    proto: tcp
-  when: firewall_enabled | bool
-
-- name: Enable UFW
-  community.general.ufw:
-    state: enabled
-    policy: deny
-  when: firewall_enabled | bool
-  notify: "reload firewall"

roles/01-server_hardening/tasks/04-configure-firewall.yml

@@ -0,0 +1,27 @@
+---
+- name: Install UFW firewall
+  ansible.builtin.apt:
+    name: ufw
+    state: present
+  when: ansible_os_family == "Debian"
+
+- name: Configure UFW defaults
+  community.general.ufw:
+    direction: "{{ item.direction }}"
+    policy: "{{ item.policy }}"
+  loop:
+    - { direction: 'incoming', policy: 'deny' }
+    - { direction: 'outgoing', policy: 'allow' }
+  notify: reload firewall
+
+- name: Allow TCP ports
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop: "{{ firewall_allowed_tcp_ports }}"
+  notify: reload firewall
+
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled

roles/01-server_hardening/tasks/05-additional-security.yml

@@ -1,20 +0,0 @@
----
-- name: Install security packages
-  ansible.builtin.apt:
-    name:
-      - unattended-upgrades
-      - logwatch
-      - rkhunter
-      - chkrootkit
-    state: present
-
-- name: Configure automatic security updates
-  ansible.builtin.copy:
-    content: |
-      APT::Periodic::Update-Package-Lists "1";
-      APT::Periodic::Unattended-Upgrade "1";
-      APT::Periodic::AutocleanInterval "7";
-    dest: /etc/apt/apt.conf.d/20auto-upgrades
-    owner: root
-    group: root
-    mode: '0644'

roles/01-server_hardening/tasks/05-configure-fail2ban.yml

@@ -3,21 +3,21 @@
   ansible.builtin.apt:
     name: fail2ban
     state: present
-  when: fail2ban_enabled | bool
+  when: ansible_os_family == "Debian"
 
 - name: Configure fail2ban jail
   ansible.builtin.template:
-    src: fail2ban-jail.local.j2
-    dest: /etc/fail2ban/jail.local
+    src: fail2ban.jail.local.j2
+    dest: "{{ fail2ban_config_dir }}/jail.local"
     owner: root
     group: root
     mode: '0644'
-  when: fail2ban_enabled | bool
-  notify: "restart fail2ban service"
+    backup: yes
+  notify: restart fail2ban service
 
-- name: Start and enable fail2ban
+- name: Ensure fail2ban is started and enabled
   ansible.builtin.systemd:
     name: fail2ban
     state: started
-    enabled: true
-  when: fail2ban_enabled | bool
+    enabled: yes
+    daemon_reload: yes

roles/01-server_hardening/tasks/06-manage-ssh-keys.yml

@@ -0,0 +1,17 @@
+---
+- name: Create .ssh directory for ansible user
+  ansible.builtin.file:
+    path: /home/ansible/.ssh
+    state: directory
+    owner: ansible
+    group: ansible
+    mode: '0700'
+
+- name: Add SSH keys for administrators
+  ansible.posix.authorized_key:
+    user: ansible
+    state: present
+    key: "{{ item.key }}"
+    comment: "{{ item.name }}"
+  loop: "{{ admin_ssh_keys | default([]) }}"
+  when: admin_ssh_keys is defined

roles/01-server_hardening/tasks/06-ssh-keys-management.yml

@@ -1,17 +0,0 @@
----
-- name: Create ansible user if not exists
-  ansible.builtin.user:
-    name: ansible
-    groups: sudo
-    shell: /bin/bash
-    create_home: true
-    state: present
-
-- name: Add authorized keys for admin users
-  ansible.posix.authorized_key:
-    user: ansible
-    key: "{{ item.key }}"
-    comment: "{{ item.comment | default('') }}"
-    state: present
-  loop: "{{ admin_users }}"
-  when: admin_users is defined and admin_users | length > 0

roles/01-server_hardening/tasks/07-additional-security.yml

@@ -0,0 +1,9 @@
+---
+- name: Configure kernel parameters for security
+  ansible.posix.sysctl:
+    name: "{{ item.name }}"
+    value: "{{ item.value }}"
+    state: present
+    reload: yes
+  loop: "{{ hardening_sysctl_settings }}"
+  notify: reload sysctl settings

roles/01-server_hardening/tasks/main.yml

@@ -1,18 +1,23 @@
 ---
-- name: Include system update tasks
-  ansible.builtin.include_tasks: 01-system-update.yml
+- name: restart ssh
+  ansible.builtin.systemd:
+    name: sshd
+    state: restarted
+    daemon_reload: true
+  listen: restart ssh service
 
-- name: Include SSH hardening tasks
-  ansible.builtin.include_tasks: 02-ssh-hardening.yml
+- name: restart fail2ban
+  ansible.builtin.systemd:
+    name: fail2ban
+    state: restarted
+    daemon_reload: true
+  listen: restart fail2ban service
 
-- name: Include firewall setup tasks
-  ansible.builtin.include_tasks: 03-firewall-setup.yml
+- name: reload ufw
+  community.general.ufw:
+    state: reloaded
+  listen: reload firewall
 
-- name: Include fail2ban setup tasks
-  ansible.builtin.include_tasks: 04-fail2ban-setup.yml
-
-- name: Include additional security tasks
-  ansible.builtin.include_tasks: 05-additional-security.yml
-
-- name: Include SSH keys management tasks
-  ansible.builtin.include_tasks: 06-ssh-keys-management.yml
+- name: reload sysctl
+  ansible.builtin.command: sysctl -p
+  listen: reload sysctl settings