Close P3 findings for Molecule matrix, CI lint, and systemd sandboxing.

Run Debian 12/13 Molecule in CI, lint molecule playbooks, migrate the health
watchdog to a sandboxed systemd timer, and harden monitoring/deploy units.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: HecFranco

.github/workflows/ci.yml

@@ -38,21 +38,29 @@ jobs:
           # Satisfy profile assert for syntax-check (runtime still needs -e @profiles/…)
           printf '\nharden_profile: lab\n' >> group_vars/all/vars.yml
 
-      - name: Yamllint playbooks and roles
-        run: yamllint -d "{extends: relaxed, rules: {line-length: {max: 160}}}" playbooks roles group_vars inventories profiles
+      - name: Yamllint playbooks, roles, and Molecule
+        run: yamllint -d "{extends: relaxed, rules: {line-length: {max: 160}}}" playbooks roles group_vars inventories profiles molecule
 
       - name: Syntax-check playbooks
         run: |
           ansible-playbook --syntax-check playbooks/01-bootstrap.yml
           ansible-playbook --syntax-check playbooks/02-harden.yml
           ansible-playbook --syntax-check playbooks/03-audit.yml
 
-      - name: Ansible-lint
-        run: ansible-lint -c .ansible-lint --nocolor playbooks roles
+      - name: Ansible-lint (playbooks, roles, Molecule)
+        run: ansible-lint -c .ansible-lint --nocolor playbooks roles molecule
 
   molecule:
-    name: Molecule smoke (Docker)
+    name: Molecule (${{ matrix.distro }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: debian13
+            image: geerlingguy/docker-debian13-ansible@sha256:66663f77a975012e9da0ff3896d402a412db97c1db20b1cf703f3a6dd169ccf1
+          - distro: debian12
+            image: geerlingguy/docker-debian12-ansible@sha256:b4344c8d4985d92b6bad512dd8f230a08851aa75bc68da1c315a4a296bab6b67
     defaults:
       run:
         working-directory: ansible
@@ -73,4 +81,6 @@ jobs:
         run: ansible-galaxy collection install -r requirements.yml -p ./collections
 
       - name: Molecule test
+        env:
+          MOLECULE_IMAGE: ${{ matrix.image }}
         run: molecule test

ansible/.ansible-lint

@@ -4,7 +4,12 @@ skip_list:
   - yaml[line-length]
   - name[casing]
   - experimental
+  # Kit-wide harden_* vars (not role-prefixed)
+  - var-naming[no-role-prefix]
+  # lineinfile create: on /etc drop-ins; mode set by package defaults
+  - risky-file-permissions
+  # Molecule verify intentionally uses systemctl/curl for exact smoke asserts
+  - command-instead-of-module
 exclude_paths:
   - collections/
   - profiles/
-  - molecule/

ansible/README.md

@@ -96,9 +96,11 @@ Optional smoke test (Docker required; also runs in CI):
 cd ansible
 pip install 'molecule' 'molecule-plugins[docker]'
 molecule test
+# Optional: Debian 12 image (CI runs both)
+MOLECULE_IMAGE=geerlingguy/docker-debian12-ansible@sha256:b4344c8d4985d92b6bad512dd8f230a08851aa75bc68da1c315a4a296bab6b67 molecule test
 ```
 
-Default scenario also enables **node_exporter + health_watchdog + Monit**, proves **disable uninstalls** them, exercises **webhook deploy** (healthz + bad HMAC → 401 + non-push → 202), then re-enables for verify. GHA runner stays off in CI (needs a real registration token).
+Default scenario also enables **node_exporter + health_watchdog + Monit**, proves **disable uninstalls** them, exercises **webhook deploy** (healthz + bad HMAC → 401 + non-push → 202), then re-enables for verify. GHA runner stays off in CI (needs a real registration token). CI matrix runs the same scenario on **Debian 12 and 13**; ansible-lint/yamllint also cover `molecule/`.
 
 ## Directory map
 

ansible/group_vars/all/vars.yml.example

@@ -86,7 +86,8 @@ harden_node_exporter_allow_from: []
 
 harden_enable_health_watchdog: false
 harden_health_disk_threshold_pct: 90
-harden_health_watchdog_cron: "*/5 * * * *"
+# systemd OnCalendar (replaces the old cron schedule)
+harden_health_watchdog_oncalendar: "*:0/5"
 harden_health_watchdog_mail: true
 harden_health_probe_urls: []
 harden_health_probe_timeout: 10

ansible/molecule/default/converge.yml

@@ -197,10 +197,16 @@
         path: /usr/local/sbin/nowo-health-watchdog
       register: wd
 
+    - name: Watchdog timer must be absent
+      ansible.builtin.stat:
+        path: /etc/systemd/system/nowo-health-watchdog.timer
+      register: wd_timer
+
     - name: Require watchdog gone
       ansible.builtin.assert:
         that:
           - not wd.stat.exists
+          - not wd_timer.stat.exists
 
     - name: Monit must be removed
       ansible.builtin.command: dpkg -s monit

ansible/molecule/default/molecule.yml

@@ -1,17 +1,18 @@
 ---
-# Debian 13 Docker smoke: identity, SSH, MFA enforce, UFW/IDS, SMTP sink, Lynis --quick.
+# Debian Docker smoke (12 + 13 via CI matrix / MOLECULE_IMAGE).
 # Requires: pip install molecule molecule-plugins[docker] ansible-core
 # Run from ansible/: molecule test
+# Override image: MOLECULE_IMAGE=geerlingguy/docker-debian12-ansible@sha256:… molecule test
 dependency:
   name: galaxy
   options:
     requirements-file: requirements.yml
 driver:
   name: docker
 platforms:
-  - name: debian13-harden
+  - name: harden-target
     # Pin digest for supply-chain stability (bump intentionally when refreshing)
-    image: geerlingguy/docker-debian13-ansible@sha256:66663f77a975012e9da0ff3896d402a412db97c1db20b1cf703f3a6dd169ccf1
+    image: ${MOLECULE_IMAGE:-geerlingguy/docker-debian13-ansible@sha256:66663f77a975012e9da0ff3896d402a412db97c1db20b1cf703f3a6dd169ccf1}
     pre_build_image: true
     command: ""
     volumes:
@@ -24,7 +25,7 @@ provisioner:
     hosts:
       all:
         hosts:
-          debian13-harden:
+          harden-target:
             ansible_user: root
   playbooks:
     converge: converge.yml

ansible/molecule/default/verify.yml

@@ -176,21 +176,39 @@
         path: /usr/local/sbin/nowo-health-watchdog
       register: watchdog
 
-    - name: Require watchdog script and cron
+    - name: Health watchdog timer present
+      ansible.builtin.stat:
+        path: /etc/systemd/system/nowo-health-watchdog.timer
+      register: watchdog_timer
+
+    - name: Require watchdog script and timer
       ansible.builtin.assert:
         that:
           - watchdog.stat.exists
           - watchdog.stat.mode == '0755'
+          - watchdog_timer.stat.exists
+
+    - name: Health watchdog timer is active
+      ansible.builtin.command: systemctl is-active nowo-health-watchdog.timer
+      changed_when: false
 
-    - name: Health watchdog cron present
+    - name: Legacy watchdog cron must be absent
       ansible.builtin.stat:
         path: /etc/cron.d/nowo-health-watchdog
       register: watchdog_cron
 
-    - name: Require watchdog cron
+    - name: Require no legacy cron
       ansible.builtin.assert:
         that:
-          - watchdog_cron.stat.exists
+          - not watchdog_cron.stat.exists
+
+    - name: node_exporter systemd hardening drop-in present
+      ansible.builtin.command: grep -F 'ProtectSystem=strict' /etc/systemd/system/prometheus-node-exporter.service.d/nowo-hardening.conf
+      changed_when: false
+
+    - name: Monit systemd hardening drop-in present
+      ansible.builtin.command: grep -F 'ProtectSystem=full' /etc/systemd/system/monit.service.d/nowo-hardening.conf
+      changed_when: false
 
     - name: Monit package present
       ansible.builtin.command: dpkg -s monit
@@ -218,6 +236,14 @@
       ansible.builtin.command: grep -E '^User=webhook-deploy' /etc/systemd/system/nowo-webhook-deploy.service
       changed_when: false
 
+    - name: Webhook unit has ProtectSystem=strict
+      ansible.builtin.command: grep -E '^ProtectSystem=strict' /etc/systemd/system/nowo-webhook-deploy.service
+      changed_when: false
+
+    - name: Webhook unit has MemoryDenyWriteExecute
+      ansible.builtin.command: grep -E '^MemoryDenyWriteExecute=true' /etc/systemd/system/nowo-webhook-deploy.service
+      changed_when: false
+
     - name: Webhook healthz responds
       ansible.builtin.command: curl -fsS --max-time 5 http://127.0.0.1:9000/hooks/deploy/healthz
       register: wh_health

ansible/roles/deploy_agents/tasks/gha_runner.yml

@@ -175,6 +175,19 @@
       KillMode=process
       KillSignal=SIGTERM
       TimeoutStopSec=5min
+      # Conservative sandbox — relax if jobs need Docker/privileged helpers
+      PrivateTmp=true
+      ProtectHome=true
+      ProtectSystem=full
+      ProtectKernelTunables=true
+      ProtectKernelModules=true
+      ProtectControlGroups=true
+      NoNewPrivileges=true
+      RestrictSUIDSGID=true
+      LockPersonality=true
+      SystemCallArchitectures=native
+      RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+      UMask=027
 
       [Install]
       WantedBy=multi-user.target

ansible/roles/deploy_agents/tasks/webhook_deploy.yml

@@ -279,10 +279,18 @@
       PrivateTmp=true
       ProtectHome=true
       ProtectSystem=strict
+      ProtectKernelTunables=true
+      ProtectKernelModules=true
+      ProtectControlGroups=true
       ReadWritePaths={{ harden_webhook_deploy_repo_path }}
       RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+      RestrictNamespaces=true
+      RestrictSUIDSGID=true
+      MemoryDenyWriteExecute=true
       CapabilityBoundingSet=
       LockPersonality=true
+      SystemCallArchitectures=native
+      UMask=027
 
       [Install]
       WantedBy=multi-user.target

ansible/roles/monitoring_stack/handlers/main.yml

@@ -9,6 +9,17 @@
     name: monit
     state: reloaded
 
+- name: Reload systemd daemon
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Reload systemd and enable health watchdog timer
+  ansible.builtin.systemd:
+    name: nowo-health-watchdog.timer
+    state: started
+    enabled: true
+    daemon_reload: true
+
 - name: Reload ufw
   ansible.builtin.shell: |
     set -euo pipefail