Merge pull request #16 from ansible-lockdown/devel

devel to main

.ansible-lint

@@ -1,13 +1,21 @@
 parseable: true
 quiet: true
 skip_list:
-  - '204'
-  - '208'
-  - '305'
-  - '303'
-  - '403'
-  - '306'
-  - '602'
-  - 'ignore-errors'
+    - 'schema'
+    - 'no-changed-when'
+    - 'var-spacing'
+    - 'fqcn-builtins'
+    - 'experimental'
+    - 'name[play]'
+    - 'name[casing]'
+    - 'name[template]'
+    - 'fqcn[action]'
+    - '204'
+    - '305'
+    - '303'
+    - '403'
+    - '306'
+    - '602'
+    - '208'
 use_default_rules: true
 verbosity: 0

.github/workflows/github_networks.tf

@@ -1,11 +1,53 @@
 resource "aws_vpc" "Main" {
   cidr_block = var.main_vpc_cidr
-  tags = var.instance_tags
+  instance_tenancy = "default"
+  tags       = { 
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-VPC"
+    }
 }
 
 resource "aws_internet_gateway" "IGW" {
   vpc_id = aws_vpc.Main.id
   tags = {
-    Name      = "${var.namespace}-IGW"
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-IGW"
   }
 }
+
+resource "aws_subnet" "publicsubnets" {
+  vpc_id =  aws_vpc.Main.id
+  cidr_block = var.public_subnets
+  availability_zone = var.availability_zone
+  tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-pubsub"
+  }
+}
+
+resource "aws_subnet" "Main" {
+  vpc_id =  aws_vpc.Main.id
+  availability_zone = var.availability_zone
+  cidr_block = var.private_subnets
+  tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-prvsub"
+  }
+}
+
+resource "aws_route_table" "PublicRT" {
+   vpc_id =  aws_vpc.Main.id
+   route {
+   cidr_block = "0.0.0.0/0"
+   gateway_id = aws_internet_gateway.IGW.id
+   }
+   tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-publicRT"
+  }
+}
+
+resource "aws_route_table_association" "rt_associate_public" {
+  subnet_id = aws_subnet.Main.id
+  route_table_id = aws_route_table.PublicRT.id
+}

.github/workflows/github_vars.tfvars

@@ -3,10 +3,11 @@
 // Declared in variables.tf
 // 
 
-namespace         = "github_actions"
+namespace = "github_actions"
+environment = "lockdown_github_repo_workflow"
 
 // Matching pair name found in AWS for keypairs PEM key
 ami_key_pair_name = "github_actions"
 main_vpc_cidr     = "172.22.0.0/24"
 public_subnets    = "172.22.0.128/26"
-private_subnets   = "172.22.0.192/26"
+private_subnets   = "172.22.0.192/26"

.github/workflows/linux_benchmark_testing.yml

@@ -26,12 +26,12 @@ jobs:
       runs-on: ubuntu-latest
 
       steps:
-          - uses: actions/first-interaction@v1.1.0
+          - uses: actions/first-interaction@main
             with:
                 repo-token: ${{ secrets.GITHUB_TOKEN }}
                 pr-message: |-
                   Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown! 
-                  Please join in the conversation happening on the [Discord Server](https://discord.gg/JFxpSgPFEJ) as well.
+                  Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
   # This workflow contains a single job called "build"
   build:
     # The type of runner that the job will run on
@@ -44,7 +44,7 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, 
       # so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -81,18 +81,9 @@ jobs:
         working-directory: .github/workflows
         run: cat hosts.yml
 
-# Centos 7 images take a while to come up insert sleep or playbook fails
+# Aws deployments taking a while to come up insert sleep or playbook fails
 
-      - name: Check if test os is rhel7
-        working-directory: .github/workflows
-        id: test_os
-        run: >-
-          echo "::set-output name=RHEL7::$(
-          grep -c RHEL7 OS.tfvars
-          )"
-
-      - name: if RHEL7 - Sleep for 60 seconds
-        if: steps.test_os.outputs.RHEL7 >= 1
+      - name: Sleep for 60 seconds
         run: sleep 60s
         shell: bash
 
@@ -117,4 +108,4 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        run: terraform destroy -var-file "OS.tfvars" -var-file "github_vars.tfvars" --auto-approve -input=false
+        run: terraform destroy -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false

.github/workflows/main.tf

@@ -5,9 +5,6 @@ provider "aws" {
 
 // Create a security group with access to port 22 and port 80 open to serve HTTP traffic
 
-data "aws_vpc" "default" {
-  default = true
-}
 
 resource "random_id" "server" {
   keepers = {
@@ -19,8 +16,8 @@ resource "random_id" "server" {
 }
 
 resource "aws_security_group" "github_actions" {
-  name   = "${var.namespace}-${random_id.server.hex}"
-  vpc_id = data.aws_vpc.default.id
+  name   = "${var.namespace}-${random_id.server.hex}-SG"
+  vpc_id = aws_vpc.Main.id
 
   ingress {
     from_port   = 22
@@ -43,6 +40,7 @@ resource "aws_security_group" "github_actions" {
     cidr_blocks = ["0.0.0.0/0"]
   }
   tags = {
+    Environment = "${var.environment}"
     Name = "${var.namespace}-SG"
  }
 }
@@ -51,11 +49,13 @@ resource "aws_security_group" "github_actions" {
 
 resource "aws_instance" "testing_vm" {
   ami                         = var.ami_id
+  availability_zone           = var.availability_zone
   associate_public_ip_address = true
   key_name                    = var.ami_key_pair_name # This is the key as known in the ec2 key_pairs
   instance_type               = var.instance_type
   tags                        = var.instance_tags
   vpc_security_group_ids      = [aws_security_group.github_actions.id]
+  subnet_id                   = aws_subnet.Main.id
   root_block_device {
         delete_on_termination = true
   }
@@ -77,7 +77,6 @@ resource "local_file" "inventory" {
         setup_audit: true
         run_audit: true
         system_is_ec2: true
-        audit_git_version: devel
     EOF
 }
 

.github/workflows/terraform.tfvars

@@ -1,4 +1,5 @@
 // vars should be loaded by OSname.tfvars
+availability_zone      = "us-east-1b"
 aws_region    = "us-east-1"
 ami_os        = var.ami_os
 ami_username  = var.ami_username

.github/workflows/variables.tf

@@ -6,6 +6,12 @@ variable "aws_region" {
   type        = string
 }
 
+variable "availability_zone" {
+  description = "List of availability zone in the region"
+  default     = "us-east-1b"
+  type        = string
+}
+
 variable "instance_type" {
   description = "EC2 Instance Type"
   default     = "t3.micro"
@@ -47,6 +53,11 @@ variable "namespace" {
   type        = string
 }
 
+variable "environment" {
+  description = "Env Name used across all tags"
+  type        = string
+}
+
 // taken from github_vars.tfvars &
 
 variable "main_vpc_cidr" {
@@ -62,4 +73,4 @@ variable "public_subnets" {
 variable "private_subnets" {
   description = "private subnet cidr block"
   type        = string
-}
+}

.gitignore

@@ -0,0 +1,47 @@
+.env
+*.log
+*.retry
+.vagrant
+.cache
+tests/*redhat-subscription
+tests/Dockerfile
+*.iso
+*.box
+packer_cache
+delete*
+ignore*
+# VSCode
+.vscode
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# DS_Store
+.DS_Store
+._*
+
+# Linux Editors
+*~
+\#*\#
+/.emacs.desktop
+/.emacs.desktop.lock
+.elc
+auto-save-list
+tramp
+.\#*
+*.swp
+*.swo
+rh-creds.env
+travis.env
+
+# Lockdown-specific
+benchparse/
+*xccdf.xml
+*.retry
+test_inv
+
+# ignore refactr pipeline test conf
+.github/
+

.yamllint

@@ -1,22 +1,32 @@
+---
 ignore: |
   tests/
   molecule/
+  .github/
   .gitlab-ci.yml
   *molecule.yml
 
 extends: default
 
 rules:
   indentation:
-    # Requiring 2 space indentation
+    # Requiring 4 space indentation
     spaces: 4
     # Requiring consistent indentation within a file, either indented or not
     indent-sequences: consistent
-  truthy: disable
+  #truthy: disable
   braces:
     max-spaces-inside: 1
     level: error
   brackets:
     max-spaces-inside: 1
     level: error
   line-length: disable
+  key-duplicates: enable
+  new-line-at-end-of-file: enable
+  new-lines:
+    type: unix
+  trailing-spaces: enable
+  truthy:
+    allowed-values: ['true', 'false']
+    check-keys: true

ansible.cfg

@@ -0,0 +1,31 @@
+[defaults]
+host_key_checking=False
+display_skipped_hosts=True
+system_warnings=False
+command_warnings=False
+nocows=1
+retry_files_save_path=/dev/null
+pipelining=true
+
+# Use the YAML callback plugin.
+stdout_callback = yaml
+# Use the stdout_callback when running ad-hoc commands.
+#bin_ansible_callbacks = True
+
+
+[privilege_escalation]
+
+[paramiko_connection]
+record_host_keys=False
+
+[ssh_connection]
+transfer_method=scp
+ssh_args = -o ControlMaster=auto -o ControlPersist=60s
+
+[accelerate]
+
+[selinux]
+
+[colors]
+
+[diff]

collections/requirements.yml

@@ -0,0 +1,8 @@
+---
+
+collections:
+- name: community.general
+
+- name: community.crypto
+
+- name: ansible.posix