handbook.yml

@@ -1,8 +1,9 @@
 ---
 
-- name: "Setup a GNU/Linux target with standards or defined tags"
+- name: "Unitoo Handbook"
   hosts: "{{ target if target is defined else 'planets' }}"
 
+  tags: always
   roles:
     # --- Hardening ---
     # Basic rules or good practises to apply

roles/auditd/tasks/main.yml

@@ -1,8 +1,10 @@
 ---
 # tasks file for auditd
 
-- name: Install and setup rules Auditd if enabled
-  when:
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ auditd_enabled }}; auditd role"
+
+- when:
     - 'auditd_enabled is true'
     - "'global.update_only' not in ansible_run_tags"
   block:

roles/dns-filter/tasks/main.yml

@@ -1,9 +1,25 @@
 ---
 # tasks file for dns-filter
 
-- name: Install selected DNS filter if enabled
-  when:
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ dns_filter_enabled }}; FILTER = {{ dns_filter_selected }}; dns-filter role; setup the target as DNS server"
+
+- when:
     - "dns_filter_enabled is true"
     - "dns_filter_selected in dns_filter_list"
   ansible.builtin.include_role:
     name: "{{ dns_filter_selected }}"
+
+- name: Allow/ disallow port 53 for DNS querying
+  ansible.builtin.iptables:
+    chain: INPUT
+    state: "{{ 'present' if dns_filter_enabled is true else 'absent' }}"
+    protocol: '{{ item }}'
+    destination_port: 53
+    jump: ACCEPT
+    comment: Accept DNS connections
+  loop: [tcp,udp]
+
+- name: iptables-persistent
+  ansible.builtin.include_role:
+    name: iptables-persistent

roles/fail2ban-basic/tasks/main.yml

@@ -1,9 +1,11 @@
 ---
 # tasks file for fail2ban-basic
-#
-- name: Fail2ban Configuration
-  when:
-    - fail2ban_enabled is true
+
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ fail2ban_enabled }}; fail2ban-basic role"
+
+- when:
+    - 'fail2ban_enabled is true'
     - "'global.update_only' not in ansible_run_tags"
   block:
     - name: Install Fail2ban

roles/hardening-basic/tasks/main.yml

@@ -1,61 +1,61 @@
 ---
 # tasks file for hardening-basic
 
-- name: Basic Hardening
+- ansible.builtin.debug:
+    msg: "hardening-basic role"
+
+- name: Create directory structure
+  ansible.builtin.file:
+    path: '/etc/{{ item.path }}'
+    state: directory
+    mode: '{{ item.mode }}'
+  with_community.general.filetree: '../templates/basic/etc/'
+  when: item.state == 'directory'
+
+- name: Create and copy hardening files
+  ansible.builtin.template:
+    src: '{{ item.src }}'
+    dest: '/etc/{{ item.path }}'
+  with_community.general.filetree: '../templates/basic/etc/'
+  when: item.state == 'file'
+
+- name: ENABLED = {{ hardening_sshd_enabled }}; Harden SSH Config
+  when: 'hardening_sshd_enabled is true'
   block:
     - name: Create directory structure
       ansible.builtin.file:
         path: '/etc/{{ item.path }}'
         state: directory
         mode: '{{ item.mode }}'
-      with_community.general.filetree: '../templates/basic/etc/'
+      with_community.general.filetree: '../templates/ssh/etc/'
       when: item.state == 'directory'
 
     - name: Create and copy hardening files
       ansible.builtin.template:
         src: '{{ item.src }}'
         dest: '/etc/{{ item.path }}'
-      with_community.general.filetree: '../templates/basic/etc/'
+      with_community.general.filetree: '../templates/ssh/etc/'
       when: item.state == 'file'
 
-    - name: Harden SSH Config
-      when: 'hardening_sshd_enabled is true'
-      block:
-        - name: Create directory structure
-          ansible.builtin.file:
-            path: '/etc/{{ item.path }}'
-            state: directory
-            mode: '{{ item.mode }}'
-          with_community.general.filetree: '../templates/ssh/etc/'
-          when: item.state == 'directory'
+    - name: Give 1700 permissions to .ssh folder
+      ansible.builtin.file:
+        path: /root/.ssh
+        owner: root
+        group: root
+        mode: "{{ '1' if hardening_sshd_permissions_set_sticky_bit }}700"
 
-        - name: Create and copy hardening files
-          ansible.builtin.template:
-            src: '{{ item.src }}'
-            dest: '/etc/{{ item.path }}'
-          with_community.general.filetree: '../templates/ssh/etc/'
-          when: item.state == 'file'
+    - name: Give 1600 permissions to .ssh/authorized_keys file
+      ansible.builtin.file:
+        path: /root/.ssh/authorized_keys
+        owner: root
+        group: root
+        mode: "{{ '1' if hardening_sshd_permissions_set_sticky_bit }}600"
 
-        - name: Give 1700 permissions to .ssh folder
-          ansible.builtin.file:
-            path: /root/.ssh
-            owner: root
-            group: root
-            mode: "{{ '1' if hardening_sshd_permissions_set_sticky_bit }}700"
+    - name: Restart sshd
+      when: "is_docker is not true"
+      ansible.builtin.systemd:
+        state: restarted
+        name: sshd
 
-        - name: Give 1600 permissions to .ssh/authorized_keys file
-          ansible.builtin.file:
-            path: /root/.ssh/authorized_keys
-            owner: root
-            group: root
-            mode: "{{ '1' if hardening_sshd_permissions_set_sticky_bit }}600"
-
-        - name: Restart sshd
-          when: "is_docker is not true"
-          ansible.builtin.systemd:
-            state: restarted
-            name: sshd
-
-    - name: Harden Service Manager (like Systemd)
-      block:
-        - include_tasks: "harden_{{ ansible_service_mgr }}.yml"
+- name: Harden Service Manager (like Systemd)
+  include_tasks: "harden_{{ ansible_service_mgr }}.yml"

roles/ipfs/tasks/main.yml

@@ -1,12 +1,16 @@
 ---
 # tasks file for ipfs
 
-- name: Install IPFS if enabled
-  when:
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ ipfs_enabled }}; ipfs role; setup the target as IPFS node"
+
+- when:
     - 'ipfs_enabled is true'
   block:
     - name: Setup ipfs-update
-      when: 'ipfs_setup is true'
+      when:
+        - 'ipfs_setup is true'
+        - "'global.update_only' not in ansible_run_tags"
       block:
         - name: Create ipfs group
           group:
@@ -72,6 +76,6 @@
 
         - include_tasks: "install_{{ ansible_service_mgr }}_service.yml"
 
-    - name: Setup firewall
-      ansible.builtin.include_role:
-        name: iptables-ipfs
+- name: Setup IPFS firewall
+  ansible.builtin.include_role:
+    name: iptables-ipfs

roles/iptables-basic/tasks/main.yml

@@ -1,14 +1,16 @@
 ---
 # tasks file for firewall
 
-- name: Setup iptables to standard configuration
-  when:
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ iptables_basic_enabled }}; iptables-basic role; setup iptables with standard/ good-default configuration"
+
+- when:
     - "is_docker is not true"
     - "iptables_basic_enabled is true"
   block:
     - name: Reset configuration if requested
       when:
-        - "iptables_basic_reset_enabled is true"
+        - "'global.uninstall' in ansible_run_tags"
       block:
         - name: Open Firewall just for a moment to flush iptables rules
           ansible.builtin.iptables:

roles/iptables-ipfs/tasks/main.yml

@@ -1,14 +1,17 @@
 ---
 # tasks file for iptables-ipfs
 
-- name: setup iptables for IPFS
-  when:
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ ipfs_enabled }}; iptables-ipfs role"
+
+- when:
     - "is_docker is not true"
   block:
-    - name: Allow new, established packets on TCP/UDP port 4001 (IPFS)
+    - name: allow/ disallow established packets on TCP/UDP port 4001 (IPFS)
       ansible.builtin.iptables:
         chain: INPUT
         protocol: tcp
+        state: "{{ 'present' if ipfs_enabled is true else 'absent' }}"
         destination_port: "{{ ipfs_port }}"
         ctstate: NEW,ESTABLISHED
         jump: ACCEPT

roles/iptables-kdeconnect/tasks/main.yml

@@ -1,24 +1,27 @@
 ---
 # tasks file for iptables-kdeconnect
-- name: Setup iptables for kdeconnect
-  when: 'kdeconnect_enabled is true'
-  block:
-    - name: Allow new, established packets on TCP Kdeconnect ports
-      ansible.builtin.iptables:
-        chain: INPUT
-        protocol: tcp
-        destination_port: "{{ kdeconnect_ports }}"
-        ctstate: NEW,ESTABLISHED
-        jump: ACCEPT
 
-    - name: Allow new, established packets on UDP Kdeconnect ports
-      ansible.builtin.iptables:
-        chain: INPUT
-        protocol: udp
-        destination_port: "{{ kdeconnect_ports }}"
-        ctstate: NEW,ESTABLISHED
-        jump: ACCEPT
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ kdeconnect_enabled }}; iptables-kdeconnect role"
 
-    - name: iptables-persistent
-      ansible.builtin.include_role:
-        name: iptables-persistent
+- name: Allow/ disallow new, established packets on TCP Kdeconnect ports
+  ansible.builtin.iptables:
+    chain: INPUT
+    protocol: tcp
+    state: "{{ 'present' if kdeconnect_enabled is true else 'absent' }}"
+    destination_port: "{{ kdeconnect_ports }}"
+    ctstate: NEW,ESTABLISHED
+    jump: ACCEPT
+
+- name: Allow/ disallow new, established packets on UDP Kdeconnect ports
+  ansible.builtin.iptables:
+    chain: INPUT
+    protocol: udp
+    state: "{{ 'present' if kdeconnect_enabled is true else 'absent' }}"
+    destination_port: "{{ kdeconnect_ports }}"
+    ctstate: NEW,ESTABLISHED
+    jump: ACCEPT
+
+- name: iptables-persistent
+  ansible.builtin.include_role:
+    name: iptables-persistent

roles/iptables-persistent/tasks/main.yml

@@ -1,5 +1,9 @@
-- name: Handle iptables-persistent
-  when:
+---
+
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ iptables_persistent_save_to_file }}; iptables-persistent role"
+
+- when:
     - "is_docker is not true"
     - "iptables_persistent_save_to_file is true"
   block:

roles/iptables-persistent/tasks/save_rules_for_Debian.yml

@@ -1,3 +1,5 @@
+---
+
 - name: Save iptables rules
   block:
     - name: Save rules with iptables-persistent v4

roles/iptables-samba/tasks/main.yml

@@ -1,26 +1,29 @@
 ---
 # tasks file for iptables-samba
-- name: Setup iptables for Samba
-  when: 'samba_enabled is true'
-  block:
-    - name: Allow new, established packets on TCP Samba ports
-      ansible.builtin.iptables:
-        chain: INPUT
-        protocol: tcp
-        destination_port: "{{ item }}"
-        ctstate: NEW,ESTABLISHED
-        jump: ACCEPT
-      with_items: '{{ samba_ports }}'
 
-    - name: Allow new, established packets on UDP Samba ports
-      ansible.builtin.iptables:
-        chain: INPUT
-        protocol: udp
-        destination_port: "{{ item }}"
-        ctstate: NEW,ESTABLISHED
-        jump: ACCEPT
-      with_items: '{{ samba_ports }}'
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ samba_enabled }}; iptables-samba role"
 
-    - name: iptables-persistent
-      ansible.builtin.include_role:
-        name: iptables-persistent
+- name: Allow/ disallow new, established packets on TCP Samba ports
+  ansible.builtin.iptables:
+    chain: INPUT
+    protocol: tcp
+    state: "{{ 'present' if samba_enabled is true else 'absent' }}"
+    destination_port: "{{ item }}"
+    ctstate: NEW,ESTABLISHED
+    jump: ACCEPT
+  with_items: '{{ samba_ports }}'
+
+- name: Allow/ disallow new, established packets on UDP Samba ports
+  ansible.builtin.iptables:
+    chain: INPUT
+    protocol: udp
+    state: "{{ 'present' if samba_enabled is true else 'absent' }}"
+    destination_port: "{{ item }}"
+    ctstate: NEW,ESTABLISHED
+    jump: ACCEPT
+  with_items: '{{ samba_ports }}'
+
+- name: iptables-persistent
+  ansible.builtin.include_role:
+    name: iptables-persistent

roles/iptables-webserver/tasks/main.yml

@@ -1,15 +1,17 @@
 ---
 # tasks file for iptables-webserver
 
-- name: Setup iptables for webserver 80 and 443
-  when:
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ iptables_webserver_enabled }}; PORTS = {{ iptables_webserver_ports }}; iptables-webserver role"
+
+- when:
     - "is_docker is not true"
-    - "iptables_webserver_enabled is true"
   block:
     - name: Allow new, established packets on TCP ports 80/443 (Webserver)
       ansible.builtin.iptables:
         chain: INPUT
         protocol: tcp
+        state: "{{ 'present' if iptables_webserver_enabled is true else 'absent' }}"
         destination_port: "{{ item }}"
         ctstate: NEW,ESTABLISHED
         jump: ACCEPT

roles/pi-hole/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 # tasks file for pi-hole
 
-- name: Pi-Hole setup
+- name: pi-hole role; setup the target as DNS server with Pi-Hole
   when: "'global.update_only' not in ansible_run_tags"
   block:
     - name: Populate service facts
@@ -22,15 +22,6 @@
       ansible.builtin.include_role:
         name: iptables-webserver
 
-    - name: Setup iptables rules
-      ansible.builtin.iptables:
-        chain: INPUT
-        protocol: '{{ item }}'
-        destination_port: 53
-        jump: ACCEPT
-        comment: Accept DNS connections
-      loop: [tcp,udp]
-
     - name: iptables-persistent
       ansible.builtin.include_role:
         name: iptables-persistent

roles/samba/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: Setup target as a Samba server
+- name: samba role; setup the target as SMB server using an external role
   when: 'samba_enabled is true'
   include_role:
     name: vladgh.samba.server

roles/snort-community/tasks/main.yml

@@ -1,8 +1,10 @@
 ---
 # tasks file for snort-community
 
-- name: Snort Community Edition setup
-  when:
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ snort_community_enabled }}; Snort Community Edition setup"
+
+- when:
     - "snort_community_enabled is true"
   block:
     - name: Gather package facts

roles/unattended-upgrades/tasks/main.yml

@@ -1,9 +1,7 @@
 ---
 # tasks file for unattended-upgrades
 
-- name: Check if host need unattended-upgrades
+- name: Check if host need unattended-upgrades and install package
   when: "unattended_upgrades_enabled is true"
-  block:
-    - name: Install unattended-upgrades
-      ansible.builtin.package:
-        name: unattended-upgrades
+  ansible.builtin.package:
+    name: unattended-upgrades

roles/wakeonlan/tasks/main.yml

@@ -1,8 +1,10 @@
 ---
 # tasks file for wakeonlan
 
-- name: Install and configure wakeonlan
-  when:
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ wakeonlan_enabled }}; wakeonlan role; install and configure wakeonlan on target; REQUIRES BIOS CONFIGURATION ON TARGET itself"
+
+- when:
     - "wakeonlan_enabled is true"
   block:
     - name: Gather package facts

roles/yggdrasil/tasks/main.yml

@@ -1,5 +1,9 @@
-- name: Install and configure yggdrasil
-  when:
+---
+
+- ansible.builtin.debug:
+    msg: "ENABLED = {{ yggdrasil_enabled }}; yggdrasil-role; install and configure yggdrasil overlay network"
+
+- when:
     - "yggdrasil_enabled is true"
     - "'global.update_only' not in ansible_run_tags"
   block:
@@ -64,6 +68,7 @@
 - name: Remove yggdrasil if not enabled
   when:
     - "yggdrasil_enabled is false"
+    - "'yggdrasil' in ansible_run_tags"
     - "'global.uninstall' in ansible_run_tags"
     - "'global.update_only' not in ansible_run_tags"
   block:
@@ -79,5 +84,4 @@
 
 - when:
     - "yggdrasil_enabled is true"
-  block:
-    - include_tasks: "update_peers.yml"
+  include_tasks: "update_peers.yml"

roles/zabov/README.md

@@ -1,16 +1,19 @@
 zabov
 =========
 
-This role setup Zabov DNS filter
+This role setup Zabov DNS filter. More information here: https://git.keinpfusch.net/loweel/zabov
+
 
 Requirements
 ------------
 
-.
+- golang >= 1.13
 
 Role Variables
 --------------
 
+- **go_path** (string)
+
 - **zabov_git_url** (string): Git valid url of Zabov
 - **zabov_git_branch** (string): Zabov Git branch
 - **zabov_installation_path** (string): Zabov installation path

roles/zabov/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 # tasks file for zabov
 
-- name: Install zabov from sources
+- name: zabov role; install zabov from sources
   when: 'go_path is defined'
   block:
     - name: Install git if needed