new default: coredump hardening sysctl.d; better swappiness default

roles/hardening-basic/defaults/main.yml

@@ -7,7 +7,7 @@ hardening_sshd_tcp_forward: false
 hardening_sshd_legal_banner: false
 hardening_sshd_permissions_set_sticky_bit: true
 
-hardening_sysctl_vm_swappiness: 15
+hardening_sysctl_vm_swappiness: 0
 hardening_sysctl_disable_ipv6: false
 
 hardening_modprobe_disable_list:

roles/hardening-basic/templates/basic/etc/sysctl.d/50-coredump.conf

@@ -0,0 +1 @@
+kernel.core_pattern=|/bin/false

roles/zoreide/tasks/main.yml

@@ -84,18 +84,15 @@
 
 - name: Configure iptables
   when:
-    - "zoreide_enabled is true"
+    - 'zoreide_enabled is true'
     - "ansible_facts.services['iptables.service'] is defined"
-  block:
+  ansible.builtin.iptables:
-    - name: Allow related and established connections
+    chain: INPUT
-      ansible.builtin.iptables:
+    protocol: udp
-        chain: INPUT
+    destination_port: "{{ zoreide_ha_port }}"
-        protocol: udp
+    ctstate: NEW
-        destination_port: "{{ zoreide_ha_port }}"
+    jump: ACCEPT
-        ctstate: NEW
+    comment: Zoreide HA Port
-        syn: match
-        jump: ACCEPT
-        comment: Zoreide HA Port
 
 - name: Save rules with iptables-persistent v6
   ansible.builtin.shell: iptables-save > /etc/iptables/rules.v4