ansible-role-security VS ansible-role-docker

My playbook is only doing some software installation (openzfs, ...) and some SSH configuration (something really similar to jeff geerling : https://github.com/geerlingguy/ansible-role-security ), and it works perfectly without the tasks where I create groups and add user to these groups.

I suggest these resources: - Some fundamentals: https://www.cyberciti.biz/tips/linux-security.html - One of the best imho ( exhaustive list ): https://github.com/imthenachoman/How-To-Secure-A-Linux-Server - Ansible playbook to harden security by Jeff Geerling: https://github.com/geerlingguy/ansible-role-security - OAWSP Check list ( targeted for web apps... and honestly a bit overkill ): https://github.com/0xRadi/OWASP-Web-Checklist

THAT all being said. Check out this: https://github.com/geerlingguy/ansible-role-security. YOu can see everything Jeff Does. My guy is a mad genious :).

Solid advice, most of it is now covered by GeerlingGuy's Security Ansible role (https://github.com/geerlingguy/ansible-role-security) and the Firewall one (https://github.com/geerlingguy/ansible-role-firewall).

yea, what jessel0l said (or vlan) plus you could use something like chroot or podman to separate privileges. Remember to set up fail2ban sane and easy starting point might be https://github.com/geerlingguy/ansible-role-security

In this case, yeah sure, go ahead. Looks fine. But is the package really not available at all or rather called differently? (from my perspective packages named equally across a wide range of distros / package managers aren't to common) In the later case you would / could load a var file with a variable which contains distro-specific package names for Redhat and just reference the variable in your install task. (see for example https://github.com/geerlingguy/ansible-role-docker/blob/master/tasks/main.yml#L2 and https://github.com/geerlingguy/ansible-role-docker/tree/master/vars)

To install docker, there's multiple examples to find, I'd start with this role : https://github.com/geerlingguy/ansible-role-docker

You might want to check out https://github.com/geerlingguy/ansible-role-docker

before writing a playbook, check for an existing role to do the work for you

This might not be the answer you're looking for, but geerlingguy.docker is pretty good

I mark bugs, security-related issues, and planned features with appropriate labels, and the stale bot ignores those: https://github.com/geerlingguy/ansible-role-docker/blob/mast...

Not all maintainers do the same. And some even _lock issues_, which I hate, because even closed issues can have a very fruitful discussion long after the issue was originally posted.

As a teaching example, installing your own docker this way might be good.But it would be better to install using a role. One you design yourself, or even better use an existing role like geerlingguy.docker.

I use ansible to setup the docker VMs after provisioning (https://github.com/geerlingguy/ansible-role-docker)

PS. As a slight sidenote, I just wanted to thank you for your (many!) Ansible roles - today I was able to run Docker in Ansible in my side project because of your docker ansible role to investigate Opensearch. Just wanted to say thanks you very much