Ansible playbook for hardening a Docker host

Project Discussions Collection Development
, , ,
1

Hi,

I’ve been wanting to automate the server setup I usually do manually on fresh ubuntu server for a while now. Repetitive stuff like SSH hardening, Docker setup, firewall rules, fail2ban, etc. Figured it was time to just automate it instead of doing it by hand every time.

I came across guillaumebriday/kamal-ansible-manager and used it as a starting point, then built on top of it. Added more hardening mapped to CIS benchmark, tested with Molecule, cleaned things up to use fully-qualified collection names (FQCN) throughout, and wrote out proper docs along the way.

Repository: jezmn/ansible-hardened-docker-host

Still pretty new, so any feedback is welcome. Thanks for reading.

3 Likes
2
  1. That is very nice ansible collection with single purpose. And that is great.

roles/bootstrap/defaults/main.yml

---
bootstrap_user:
  name: ansible

There is general recommendation to use plain (not nested) variables - bootstrap_user_name, bootstrap_user_ssh_public_key_path, not bootstrap_user dict with keys.
Imagine users want to set public key, but use default name for bootstrap user. They would have to define complete dict (name and public key). So default is basically useless here.

  1. There is no guarantee that all the playbooks will be executed with gather_facts: true, so I would add task to collect necessary facts to the roles (where required).

  2. ansible.builtin.command: swapoff {{ swap_file_path }}, there is injection possible with swap_file_path, it is better use argv:
    ansible.builtin.command module – Execute commands on targets — Ansible Community Documentation

  3. You have to get rid of ansible cfg and use FQCN for content (playbooks, roles). So playbook runs do not depend on your current working directory.

playbooks/site.yml
I would use fully qualified names for roles, so it is evident that they are from certain collection.

Above are my personal preferences, these are not hard stops.

This is a very good start!

3 Likes
3

Thanks for the detailed feedback, getting to it.

1 Like