74 lines
2.0 KiB
YAML
74 lines
2.0 KiB
YAML
|
---
|
||
|
|
# Read-only control-plane audit. This play intentionally contains no package,
|
||
|
|
# file, service, container, or configuration mutation tasks.
|
||
|
|
- name: Audit managed VPS hosts without changes
|
||
|
|
hosts: managed
|
||
|
|
gather_facts: true
|
||
|
|
become: false
|
||
|
|
any_errors_fatal: false
|
||
|
|
tasks:
|
||
|
|
- name: Verify Docker Compose command is available
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- docker
|
||
|
|
- compose
|
||
|
|
- version
|
||
|
|
changed_when: false
|
||
|
|
|
||
|
|
- name: Inspect configured Compose project
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- docker
|
||
|
|
- compose
|
||
|
|
- --project-directory
|
||
|
|
- "{{ compose_project_dir }}"
|
||
|
|
- ps
|
||
|
|
- --all
|
||
|
|
register: audit_compose_ps
|
||
|
|
changed_when: false
|
||
|
|
failed_when: false
|
||
|
|
|
||
|
|
- name: Inspect failed systemd units
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- systemctl
|
||
|
|
- --failed
|
||
|
|
- --no-legend
|
||
|
|
- --no-pager
|
||
|
|
register: audit_failed_units
|
||
|
|
changed_when: false
|
||
|
|
failed_when: false
|
||
|
|
|
||
|
|
- name: Inspect filesystem capacity
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- df
|
||
|
|
- -P
|
||
|
|
- -x
|
||
|
|
- tmpfs
|
||
|
|
- -x
|
||
|
|
- devtmpfs
|
||
|
|
register: audit_filesystems
|
||
|
|
changed_when: false
|
||
|
|
|
||
|
|
- name: Inspect active listeners
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- ss
|
||
|
|
- -lntup
|
||
|
|
register: audit_listeners
|
||
|
|
changed_when: false
|
||
|
|
failed_when: false
|
||
|
|
|
||
|
|
- name: Report sanitized audit summary
|
||
|
|
ansible.builtin.debug:
|
||
|
|
msg:
|
||
|
|
host: "{{ inventory_hostname }}"
|
||
|
|
profile: "{{ healthcheck_profile }}"
|
||
|
|
os: "{{ ansible_distribution }} {{ ansible_distribution_version }}"
|
||
|
|
kernel: "{{ ansible_kernel }}"
|
||
|
|
compose_rc: "{{ audit_compose_ps.rc }}"
|
||
|
|
failed_units: "{{ audit_failed_units.stdout_lines | default([]) }}"
|
||
|
|
filesystem_lines: "{{ audit_filesystems.stdout_lines | default([]) }}"
|
||
|
|
listener_lines: "{{ audit_listeners.stdout_lines | default([]) }}"
|