Close remaining coverage gaps for lab/prod readiness.

Add lab/prod profiles, Fail2Ban ignoreip guards, exclusive SSH keys,
AppArmor/FIDO2 docs, Molecule smoke skeleton, and pre-commit hooks.

Author: HecFranco

.github/workflows/ci.yml

@@ -44,4 +44,4 @@ jobs:
           ansible-playbook --syntax-check playbooks/03-audit.yml
 
       - name: Ansible-lint
-        run: ansible-lint --nocolor playbooks
+        run: ansible-lint -c .ansible-lint --nocolor playbooks roles

.pre-commit-config.yaml

@@ -0,0 +1,24 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+      - id: check-added-large-files
+      - id: detect-private-key
+
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.35.1
+    hooks:
+      - id: yamllint
+        args: [-d, "{extends: relaxed, rules: {line-length: {max: 160}}}"]
+        files: ^(ansible/.*\.ya?ml|\.github/.*\.ya?ml)$
+
+  - repo: https://github.com/ansible/ansible-lint
+    rev: v25.1.3
+    hooks:
+      - id: ansible-lint
+        files: ^ansible/(playbooks|roles)/
+        args: [-c, ansible/.ansible-lint]

README.md

@@ -84,7 +84,9 @@ cp inventories/lab/hosts.yml.example inventories/lab/hosts.yml
 cp group_vars/all/vars.yml.example group_vars/all/vars.yml
 cp group_vars/all/vault.yml.example group_vars/all/vault.yml
 # Prefer passworded sudo in production (default). For disposable labs only:
-# harden_passwordless_sudo: true
+#   -e @profiles/lab.yml
+# For production overlays (set ignoreip inside the file first):
+#   -e @profiles/prod.yml
 ansible-vault encrypt group_vars/all/vault.yml
 # Before harden: set harden_fail2ban_ignoreip to your admin/VPN CIDRs
 

ansible/.ansible-lint

@@ -0,0 +1,13 @@
+---
+# Soften ansible-lint for a didactic kit; tighten over time.
+skip_list:
+  - yaml[line-length]
+  - name[casing]
+  - risky-shell-pipe
+  - command-instead-of-shell
+  - no-changed-when
+  - ignore-errors
+  - experimental
+exclude_paths:
+  - collections/
+  - profiles/

ansible/README.md

@@ -33,18 +33,36 @@ ansible-vault encrypt group_vars/all/vault.yml
 | `02-harden.yml` | `hosts.yml` (admin + port) | Baseline hardening |
 | `03-audit.yml` | `hosts.yml` | Lynis report (forces audit run) |
 
-## Safer defaults
+## Profiles (lab vs production)
 
-Passwordless sudo, automatic reboot, PSAD auto-block, ClamAV, AIDE, and chkrootkit are **off** unless you opt in. See `group_vars/all/vars.yml.example`.
+```bash
+# Disposable lab convenience knobs
+ansible-playbook -i inventories/lab/hosts.yml playbooks/02-harden.yml \
+  --ask-vault-pass --ask-become-pass -e @profiles/lab.yml
+
+# Explicit production overlay (set ignoreip inside profiles/prod.yml first)
+ansible-playbook -i inventories/lab/hosts.yml playbooks/02-harden.yml \
+  --ask-vault-pass --ask-become-pass -e @profiles/prod.yml
+```
+
+See `profiles/lab.yml` and `profiles/prod.yml`.
 
 ## Tags
 
 `packages`, `ntp`, `sysctl`, `ssh`, `mfa`, `passwords`, `updates`, `firewall`, `ids`, `mail`, `malware`, `integrity`, `chkrootkit`, `aide`, `auditd`, `logwatch`, `lynis`.
 
-## Check mode
+## Check mode / Molecule
 
 `--check` is best-effort. Tasks that shell out (moduli trim, aideinit, lynis, psad signature update, test mail) are not fully check-safe.
 
+Optional smoke test (Docker required):
+
+```bash
+cd ansible
+pip install 'molecule' 'molecule-plugins[docker]'
+molecule test
+```
+
 ## Directory map
 
 ```text

ansible/group_vars/all/vars.yml.example

@@ -46,6 +46,11 @@ harden_fail2ban_bantime: 1h
 harden_fail2ban_maxretry: 5
 # Put your static admin/VPN CIDRs here to reduce Fail2Ban lockout risk
 harden_fail2ban_ignoreip: ""
+# Set true in production overlays to refuse empty ignoreip
+harden_fail2ban_require_ignoreip: false
+
+# When true, authorized_keys is replaced by the single configured key (rotation)
+harden_ssh_keys_exclusive: false
 
 harden_enable_psad: true
 # Auto-block can lock out admins/CI — opt in deliberately

ansible/molecule/default/converge.yml

@@ -0,0 +1,22 @@
+---
+- name: Converge — bootstrap identity only (safe smoke path)
+  hosts: all
+  become: true
+  gather_facts: true
+  vars:
+    harden_admin_user: molecule
+    harden_groups:
+      ssh: sshaccess
+      sudo: elevated
+      su: switchroot
+    harden_passwordless_sudo: true
+    harden_ssh_public_key_path: "{{ playbook_dir }}/files/molecule.pub"
+    vault_admin_password: "MoleculeTestPassw0rd!"
+  pre_tasks:
+    - name: Install openssh-server for identity tasks
+      ansible.builtin.apt:
+        name: openssh-server
+        state: present
+        update_cache: true
+  roles:
+    - role: admin_user

ansible/molecule/default/files/molecule.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOg4nybRVtPvtYid3NPHkvIW1DwiqbMUe9c8w2cgyocf molecule@linux-server-hardening

ansible/molecule/default/molecule.yml

@@ -0,0 +1,43 @@
+---
+# Minimal Molecule skeleton for Debian converge smoke tests.
+# Requires: pip install molecule molecule-plugins[docker] ansible-core
+# Run from ansible/: molecule test
+dependency:
+  name: galaxy
+  options:
+    requirements-file: requirements.yml
+driver:
+  name: docker
+platforms:
+  - name: debian13-harden
+    image: geerlingguy/docker-debian13-ansible:latest
+    pre_build_image: true
+    command: ""
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+provisioner:
+  name: ansible
+  inventory:
+    hosts:
+      all:
+        hosts:
+          debian13-harden:
+            ansible_user: root
+  playbooks:
+    converge: converge.yml
+  env:
+    ANSIBLE_ROLES_PATH: ../roles
+verifier:
+  name: ansible
+scenario:
+  name: default
+  test_sequence:
+    - dependency
+    - syntax
+    - create
+    - prepare
+    - converge
+    - verify
+    - destroy

ansible/molecule/default/prepare.yml

@@ -0,0 +1,9 @@
+---
+# No-op prepare; image already has Python.
+- name: Prepare
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Placeholder
+      ansible.builtin.debug:
+        msg: prepare ok