Updated a lot of stuff and now the playbook uses standard debian repos

.gitignore

@@ -0,0 +1,7 @@
+hosts
+playbook.retry
+playbook-custom.yml
+*.kate-swp
+group_vars/all
+custom*
+.directory

README.md

@@ -19,7 +19,18 @@ Playbooks for debian server
 - [fail2ban](roles/fail2ban)
 - [zsh](roles/zsh)
 
+(Check for more on the [roles](roles) directory)
+
 ### Launch ansible : 
 
-  ansible-playbook playbook.yml -i hosts --user username --ask-pass --ask-sudo-pass
+```
+ansible-playbook playbook.yml -i hosts --user username --ask-pass --ask-sudo-pass
+```
+
+### Launch specific role in a host:
+
+```
+  ansible-playbook run_role.yml  -i 'hostname1,[hostname2, ...]' -e "ROLE={rolename}" --user {username} [--ask-pass] [--become] [--ask-become-pass]
+```
 
+Please note that at least one comma is required inside the -i arg. Example: `-i '192.168.1.10,'`

group_vars/all.example

@@ -0,0 +1,19 @@
+distribution_name: stretch
+
+ntp_server_a: es.pool.ntp.org
+ntp_server_b: pool.ntp.org
+
+email_contact: root@locahost
+
+nginx_processes: 4
+
+safeips: 127.0.0.1
+
+mysql_root_password: temporalMysqlRootPasswd
+
+bacula_director_fqdn: bacula.server.domain
+bacula_director_name: bacula-director.server
+bacula_director_pass: achoquedices
+bacula_monitor_name: bacula-monitor.server
+bacula_monitor_pass: achoquedices
+

hosts.example

@@ -0,0 +1,8 @@
+[host1]
+127.0.0.1
+
+[minimal]
+127.0.1.1
+
+[fullapache2]
+127.0.1.2

playbook.yml

@@ -1,16 +1,45 @@
 ---
-  - hosts: all
+
+  - hosts: minimal
+    remote_user: root
     sudo: true
     roles:
       - base
+      - cron-apt
       - ntp
       - git
+      - ipv4harden
+      - ipv6disable
+
+  - hosts: fullapache2
+    remote_user: root
+    sudo: true
+    roles:
+      - base
+      - cron-apt
+      - ntp
+      - git
+      - ipv4harden
+      - ipv6disable
+      - apache
+      - php-fpm
+      - apache-fastcgi
       - mysql
-      - logwatch
+      - modsecurity
       - fail2ban
-      - nginx
-      - php-fpm
-      - composer
-      - zsh
-      - node
-      - openvpn
+
+  - hosts: apache2simple
+    remote_user: root
+    sudo: true
+    roles:
+      - base
+      - cron-apt
+      - ntp
+      - git
+      - ipv4harden
+      - ipv6disable
+      - fail2ban
+      - php
+      - mysql
+      - apache
+

roles/apache-fastcgi/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+- name: Checking for previously added repositories
+  stat: path=/etc/apt/sources.list.d/ftp_debian_org_debian.list
+  register: repos_present_nonfree
+
+- name: Add contrib & non free repositories
+  apt_repository: repo='deb http://ftp.debian.org/debian/ {{ distribution_name }} contrib non-free' state=present
+  when: repos_present_nonfree.stat.exists == false
+
+- name: Update apt cache
+  apt: update_cache=yes
+  when: repos_present_nonfree.stat.exists == false
+
+- name: Install libapache2-mod-fastcgi
+  apt: pkg=libapache2-mod-fastcgi state=latest
+
+- name: Enable fastcgi mod
+  action: command a2enmod fastcgi
+  notify: Restart apache2

roles/apache/tasks/main.yml

@@ -3,9 +3,14 @@
   apt: pkg=apache2 state=latest
 
 - name: Enable rewrite mod
-  action: command a2enmod rewrite
-  notify: Restart apache2
+  apache2_module: state=present name=rewrite
+
+- name: Deploy restrictive security configuration
+  template: src=security-strict.conf.j2 dest=/etc/apache2/conf-available/security-strict.conf owner=root group=root mode=0640
 
-- name: Copy apache2 config file
-  template: src=apache2.conf.j2 dest=/etc/apache2/apache2.conf
+- name: Disable old security configuration
+  command: /usr/sbin/a2disconf security
+
+- name: Enable new configuration
+  command: /usr/sbin/a2enconf security-strict
   notify: Restart apache2