ansible-role-hardening VS debops

Many thanks u/pixelavenger. While I did not (yet) find the specific CIS recommendation, but I did find this which indicates that disabling SCTP module is perhaps too strong a reaction if the only justification is disabling those networking features that are usually not used frequently (to reduce attack surface). Apparently there was a vulnerability in WebRTC's user-space SCTP implementation, which has hence been fixed. There seem to be no known vulnerabilities in linux kernel SCTP implementation. Do you think Azure Support might be requested to optionally enable SCTP kernel module in the images ? Thanks also for the idea about using Daemon-set approach, perhaps a bit kludgy for the needs, as one'd need to invent a way to synchronize the completion of Daemon-set's task of enabling SCTP and startup of application that needs SCTP. Still better than nothing at all.

I'm planning on adding to the litany of tutorials on this soon. My process is to use debops to provision and secure a VPS and install the docker service. The app is spun up with docker-compose and the appropriate containers - if you use something like cookiecutter-django you can get a basis for the docker compose files you need. This uses traefik as the proxy for gunicorn instead of nginx, and then you'll need to serve static and media either with whitenoise or with S3.

I wrote a set of Ansible roles in DebOps that let you build and install LXD from source on Debian. You can check out the role itself and it's documentation. It's not a perfect solution, but it can enable you to use LXD without snaps on Debian.

If you are committed to Debian environment, perhaps DebOps would be an interesting alternative (disclaimer: I'm the maintainer of the project). DebOps is a set of Ansible playbooks and roles + some scripts that let you deploy and manage Debian-based clusters. It has extensive documentation, supports LDAP deployment and is actively maintained.

GitHub: https://github.com/debops/debops/releases/tag/v2.3.0

It's not strictly for Azure, but you can check out DebOps (disclaimer: I'm the maintainer). It's a set of Ansible playbooks and roles to manage Debian-based infrastructure, created completely in the open. You can use it as a base to build up your own infrastructure. Roles are designed to be reusable and can pass configuration between them using dependent variables, everything can be configured through Ansible inventory since you are not expected to modify the roles themselves.

Looks like that apt role has a Linuxmint dictionary key missing, somewhere where OS distributions are specified. You can look at the apt role defaults and add it in a few places where Debian, Devuan and Ubuntu are specified. The role's fact script could also be fixed to handle cases like that gracefully. I'll see what I can do.

DebOps has you covered - there are roles for slapd, nslcd, nscd, ldap role can be used to manage objects in the LDAP directory itself from other roles, and so on. Check the slapd role documentation for the server-side details, and the ldap role documentation for the client-side details.