corelab2/security.yaml at master · coregenomics/corelab2 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
---
- name: 'Security and memory management'
  hosts: 'all'

  tasks:
  - name: 'Enable out-of-memory killer'
    become: true
    copy:
      content: |
        vm.oom_kill_allocating_task = 0
      dest: '/etc/sysctl.d/60-oom-killer.conf'

  - name: 'Query out-of-memory killer'
    become: true
    command: 'sysctl vm.oom_kill_allocating_task'
    changed_when: false
    register: oom

  - name: 'Start out-of-memory killer'
    become: true
    command: 'sysctl vm.oom_kill_allocating_task=0'
    when: oom.stdout[-1] | default('0') == '0'
    check_mode: no

  - name: 'Install firewall'
    become: true
    apt:
      name:
        - 'ufw'

  - name: 'Allow OpenSSH'
    become: true
    ufw:
      rule: 'allow'
      name: 'OpenSSH'

  - name: 'Enable firewall'
    become: true
    ufw:
      state: 'enabled'
      logging: 'on'
      policy: 'reject'