Skip to content

Commit dd6f9d1

Browse files
uk-bollyuk-bolly
authored
Merge pull request #420 from ansible-lockdown/devel
Stig v3r10 to main
2 parents 81b2deb + dce069d commit dd6f9d1

39 files changed

+1391
-1330
lines changed

‎.ansible-lint‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
parseable: true
22
quiet: true
33
skip_list:
4-
- '204'
5-
- '208'
6-
- '305'
7-
- '303'
8-
- '403'
9-
- '306'
10-
- '602'
4+
- 'schema'
5+
- 'no-changed-when'
6+
- 'var-spacing'
7+
- 'experimental'
8+
- 'name[play]'
9+
- 'name[casing]'
10+
- 'name[template]'
11+
- 'fqcn[action]'
12+
- '204'
13+
- '305'
14+
- '303'
15+
- '403'
16+
- '306'
17+
- '602'
18+
- '208'
1119
use_default_rules: true
1220
verbosity: 0

‎.github/workflows/OS.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ ami_username = "centos"
55
ami_user_home = "/home/centos"
66
instance_tags = {
77
Name = "RHEL7-STIG"
8-
Environment = "lockdown_github_repo_workflow"
8+
Environment = "github_test_pipeline"
99
}

‎.github/workflows/github_networks.tf‎

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,53 @@
11
resource "aws_vpc" "Main" {
2-
cidr_block = var.main_vpc_cidr
3-
tags = var.instance_tags
2+
cidr_block = var.main_vpc_cidr
3+
instance_tenancy = "default"
4+
tags = {
5+
Environment = "${var.environment}"
6+
Name = "${var.namespace}-VPC"
7+
}
48
}
59

610
resource "aws_internet_gateway" "IGW" {
711
vpc_id = aws_vpc.Main.id
812
tags = {
9-
Name = "${var.namespace}-IGW"
13+
Environment = "${var.environment}"
14+
Name = "${var.namespace}-IGW"
15+
}
16+
}
17+
18+
resource "aws_subnet" "publicsubnets" {
19+
vpc_id = aws_vpc.Main.id
20+
cidr_block = var.public_subnets
21+
availability_zone = var.availability_zone
22+
tags = {
23+
Environment = "${var.environment}"
24+
Name = "${var.namespace}-pubsub"
25+
}
26+
}
27+
28+
resource "aws_subnet" "Main" {
29+
vpc_id = aws_vpc.Main.id
30+
cidr_block = var.private_subnets
31+
availability_zone = var.availability_zone
32+
tags = {
33+
Environment = "${var.environment}"
34+
Name = "${var.namespace}-prvsub"
35+
}
36+
}
37+
38+
resource "aws_route_table" "PublicRT" {
39+
vpc_id = aws_vpc.Main.id
40+
route {
41+
cidr_block = "0.0.0.0/0"
42+
gateway_id = aws_internet_gateway.IGW.id
43+
}
44+
tags = {
45+
Environment = "${var.environment}"
46+
Name = "${var.namespace}-publicRT"
1047
}
1148
}
49+
50+
resource "aws_route_table_association" "rt_associate_public" {
51+
subnet_id = aws_subnet.Main.id
52+
route_table_id = aws_route_table.PublicRT.id
53+
}

‎.github/workflows/github_vars.tfvars‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@
33
// Declared in variables.tf
44
//
55

6-
namespace = "github_actions"
6+
namespace = "github_actions"
7+
environment = "lockdown_github_repo_workflow"
78

89
// Matching pair name found in AWS for keypairs PEM key
910
ami_key_pair_name = "github_actions"
11+
private_key = ".ssh/github_actions.pem"
1012
main_vpc_cidr = "172.22.0.0/24"
1113
public_subnets = "172.22.0.128/26"
12-
private_subnets = "172.22.0.192/26"
14+
private_subnets = "172.22.0.192/26"

‎.github/workflows/linux_benchmark_testing.yml‎

Lines changed: 96 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -5,116 +5,107 @@ name: linux_benchmark_pipeline
55
# Controls when the action will run.
66
# Triggers the workflow on push or pull request
77
# events but only for the devel branch
8-
on:
9-
pull_request_target:
10-
types: [opened, reopened, synchronize]
11-
branches:
12-
- devel
13-
- main
14-
paths:
15-
- '**.yml'
16-
- '**.sh'
17-
- '**.j2'
18-
- '**.ps1'
19-
- '**.cfg'
8+
on: # yamllint disable-line rule:truthy
9+
pull_request_target:
10+
types: [opened, reopened, synchronize]
11+
branches:
12+
- devel
13+
- main
14+
paths:
15+
- '**.yml'
16+
- '**.sh'
17+
- '**.j2'
18+
- '**.ps1'
19+
- '**.cfg'
2020

2121
# A workflow run is made up of one or more jobs
2222
# that can run sequentially or in parallel
2323
jobs:
2424
# This will create messages for first time contributers and direct them to the Discord server
25-
welcome:
26-
runs-on: ubuntu-latest
27-
28-
steps:
29-
- uses: actions/first-interaction@v1.1.0
30-
with:
31-
repo-token: ${{ secrets.GITHUB_TOKEN }}
32-
pr-message: |-
33-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
34-
Please join in the conversation happening on the [Discord Server](https://discord.gg/JFxpSgPFEJ) as well.
25+
welcome:
26+
runs-on: ubuntu-latest
27+
28+
steps:
29+
- uses: actions/first-interaction@main
30+
with:
31+
repo-token: ${{ secrets.GITHUB_TOKEN }}
32+
pr-message: |-
33+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
34+
Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
3535
# This workflow contains a single job called "build"
36-
build:
37-
# The type of runner that the job will run on
38-
runs-on: ubuntu-latest
39-
40-
env:
41-
ENABLE_DEBUG: false
42-
43-
# Steps represent a sequence of tasks that will be executed as part of the job
44-
steps:
45-
# Checks-out your repository under $GITHUB_WORKSPACE,
46-
# so your job can access it
47-
- uses: actions/checkout@v2
48-
with:
49-
ref: ${{ github.event.pull_request.head.sha }}
50-
51-
- name: Add_ssh_key
52-
working-directory: .github/workflows
53-
env:
54-
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
55-
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
56-
run: |
57-
mkdir .ssh
58-
chmod 700 .ssh
59-
echo $PRIVATE_KEY > .ssh/github_actions.pem
60-
chmod 600 .ssh/github_actions.pem
61-
62-
### Build out the server
63-
- name: Terraform_Init
64-
working-directory: .github/workflows
65-
run: terraform init
66-
67-
- name: Terraform_Validate
68-
working-directory: .github/workflows
69-
run: terraform validate
70-
71-
- name: Terraform_Apply
72-
working-directory: .github/workflows
73-
env:
74-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
75-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
76-
run: terraform apply -var-file "OS.tfvars" -var-file "github_vars.tfvars" --auto-approve -input=false
77-
78-
## Debug Section
79-
- name: DEBUG - Show Ansible hostfile
80-
if: env.ENABLE_DEBUG == 'true'
81-
working-directory: .github/workflows
82-
run: cat hosts.yml
83-
84-
# Centos 7 images take a while to come up insert sleep or playbook fails
85-
86-
- name: Check if test os is rhel7
87-
working-directory: .github/workflows
88-
id: test_os
89-
run: >-
90-
echo "::set-output name=RHEL7::$(
91-
grep -c RHEL7 OS.tfvars
92-
)"
93-
94-
- name: if RHEL7 - Sleep for 60 seconds
95-
if: steps.test_os.outputs.RHEL7 >= 1
96-
run: sleep 60s
97-
shell: bash
98-
99-
# Run the ansible playbook
100-
- name: Run_Ansible_Playbook
101-
uses: arillso/action.playbook@master
102-
with:
103-
playbook: site.yml
104-
inventory: .github/workflows/hosts.yml
105-
galaxy_file: collections/requirements.yml
106-
private_key: ${{ secrets.SSH_PRV_KEY }}
107-
# verbose: 3
108-
env:
109-
ANSIBLE_HOST_KEY_CHECKING: "false"
110-
ANSIBLE_DEPRECATION_WARNINGS: "false"
111-
112-
# Remove test system - User secrets to keep if necessary
36+
build:
37+
# The type of runner that the job will run on
38+
runs-on: ubuntu-latest
11339

114-
- name: Terraform_Destroy
115-
working-directory: .github/workflows
116-
if: always() && env.ENABLE_DEBUG == 'false'
11740
env:
118-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
119-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
120-
run: terraform destroy -var-file "OS.tfvars" -var-file "github_vars.tfvars" --auto-approve -input=false
41+
ENABLE_DEBUG: false
42+
43+
# Steps represent a sequence of tasks that will be executed as part of the job
44+
steps:
45+
# Checks-out your repository under $GITHUB_WORKSPACE,
46+
# so your job can access it
47+
- uses: actions/checkout@v3
48+
with:
49+
ref: ${{ github.event.pull_request.head.sha }}
50+
51+
- name: Add_ssh_key
52+
working-directory: .github/workflows
53+
env:
54+
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
55+
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
56+
run: |
57+
mkdir .ssh
58+
chmod 700 .ssh
59+
echo $PRIVATE_KEY > .ssh/github_actions.pem
60+
chmod 600 .ssh/github_actions.pem
61+
62+
### Build out the server
63+
- name: Terraform_Init
64+
working-directory: .github/workflows
65+
run: terraform init
66+
67+
- name: Terraform_Validate
68+
working-directory: .github/workflows
69+
run: terraform validate
70+
71+
- name: Terraform_Apply
72+
working-directory: .github/workflows
73+
env:
74+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
75+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
76+
run: terraform apply -var-file "OS.tfvars" -var-file "github_vars.tfvars" --auto-approve -input=false
77+
78+
## Debug Section
79+
- name: DEBUG - Show Ansible hostfile
80+
if: env.ENABLE_DEBUG == 'true'
81+
working-directory: .github/workflows
82+
run: cat hosts.yml
83+
84+
# Aws deployments taking a while to come up insert sleep or playbook fails
85+
86+
- name: Sleep for 60 seconds
87+
run: sleep 60s
88+
shell: bash
89+
90+
# Run the ansible playbook
91+
- name: Run_Ansible_Playbook
92+
uses: arillso/action.playbook@master
93+
with:
94+
playbook: site.yml
95+
inventory: .github/workflows/hosts.yml
96+
galaxy_file: collections/requirements.yml
97+
private_key: ${{ secrets.SSH_PRV_KEY }}
98+
# verbose: 3
99+
env:
100+
ANSIBLE_HOST_KEY_CHECKING: "false"
101+
ANSIBLE_DEPRECATION_WARNINGS: "false"
102+
103+
# Remove test system - User secrets to keep if necessary
104+
105+
- name: Terraform_Destroy
106+
working-directory: .github/workflows
107+
if: always() && env.ENABLE_DEBUG == 'false'
108+
env:
109+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
110+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
111+
run: terraform destroy -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false

‎.github/workflows/main.tf‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ provider "aws" {
55

66
// Create a security group with access to port 22 and port 80 open to serve HTTP traffic
77

8-
data "aws_vpc" "default" {
9-
default = true
10-
}
118

129
resource "random_id" "server" {
1310
keepers = {
@@ -19,8 +16,8 @@ resource "random_id" "server" {
1916
}
2017

2118
resource "aws_security_group" "github_actions" {
22-
name = "${var.namespace}-${random_id.server.hex}"
23-
vpc_id = data.aws_vpc.default.id
19+
name = "${var.namespace}-${random_id.server.hex}-SG"
20+
vpc_id = aws_vpc.Main.id
2421

2522
ingress {
2623
from_port = 22
@@ -43,6 +40,7 @@ resource "aws_security_group" "github_actions" {
4340
cidr_blocks = ["0.0.0.0/0"]
4441
}
4542
tags = {
43+
Environment = "${var.environment}"
4644
Name = "${var.namespace}-SG"
4745
}
4846
}
@@ -51,11 +49,13 @@ resource "aws_security_group" "github_actions" {
5149

5250
resource "aws_instance" "testing_vm" {
5351
ami = var.ami_id
52+
availability_zone = var.availability_zone
5453
associate_public_ip_address = true
5554
key_name = var.ami_key_pair_name # This is the key as known in the ec2 key_pairs
5655
instance_type = var.instance_type
5756
tags = var.instance_tags
5857
vpc_security_group_ids = [aws_security_group.github_actions.id]
58+
subnet_id = aws_subnet.Main.id
5959
root_block_device {
6060
delete_on_termination = true
6161
}
@@ -77,7 +77,8 @@ resource "local_file" "inventory" {
7777
setup_audit: true
7878
run_audit: true
7979
system_is_ec2: true
80-
audit_git_version: devel
80+
rhel_07_010340: false
81+
rhel7stig_bootloader_password_hash: 'grub.pbkdf2.sha512.somethingnewhere'
8182
EOF
8283
}
8384

‎.github/workflows/terraform.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
// vars should be loaded by OSname.tfvars
2+
availability_zone = "us-east-1b"
23
aws_region = "us-east-1"
34
ami_os = var.ami_os
45
ami_username = var.ami_username

‎.github/workflows/test.sh‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

0 commit comments

Comments
 (0)