Skip to content

Commit 9cceb77

Browse files
professormahiprofessormahi
committed
Feat: Add basis for postgres-hardening
Signed-off-by: Mahdi Fooladgar (professormahi) <professormahi_f@yahoo.com>
1 parent 6b11603 commit 9cceb77

File tree

14 files changed

+296
-0
lines changed

14 files changed

+296
-0
lines changed

‎.github/labeler.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,11 @@ nginx_hardening:
2828
- roles/nginx_hardening/**
2929
- molecule/nginx_hardening/**
3030
- .github/workflows/nginx_hardening.yml
31+
32+
33+
postgres_hardening:
34+
- changed-files:
35+
- any-glob-to-any-file:
36+
- "roles/postgres_hardening/**"
37+
- "molecule/postgres_hardening/**"
38+
- ".github/workflows/postgres_hardening.yml"

‎.github/workflows/postgres_hardening.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
name: "devsec.postgres_hardening"
3+
on: # yamllint disable-line rule:truthy
4+
workflow_dispatch:
5+
push:
6+
branches: [master]
7+
paths:
8+
- "roles/postgres_hardening/**"
9+
- "molecule/postgres_hardening/**"
10+
- ".github/workflows/postgres_hardening.yml"
11+
- "requirements.txt"
12+
pull_request:
13+
branches: [master]
14+
paths:
15+
- "roles/postgres_hardening/**"
16+
- "molecule/postgres_hardening/**"
17+
- ".github/workflows/postgres_hardening.yml"
18+
- "requirements.txt"
19+
schedule:
20+
- cron: "0 6 * * 1"
21+
22+
concurrency:
23+
group: >-
24+
${{ github.workflow }}-${{
25+
github.event.pull_request.number || github.sha
26+
}}
27+
cancel-in-progress: true
28+
29+
jobs:
30+
build:
31+
runs-on: ubuntu-latest
32+
env:
33+
PY_COLORS: 1
34+
ANSIBLE_FORCE_COLOR: 1
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
molecule_distro:
39+
# - centos7
40+
# - centosstream8
41+
# - centosstream9
42+
# - rocky8
43+
# - rocky9
44+
- ubuntu1804
45+
- ubuntu2004
46+
- ubuntu2204
47+
# - debian10
48+
# - debian11
49+
# - debian12
50+
# - amazon2023
51+
# - arch # needs to be fixed
52+
# - opensuse_tumbleweed # needs to be fixed
53+
# - fedora # no support from geerlingguy role
54+
steps:
55+
- name: Checkout repo
56+
uses: actions/checkout@v4
57+
with:
58+
path: ansible_collections/devsec/hardening
59+
submodules: true
60+
61+
- name: Set up Python
62+
uses: actions/setup-python@v4
63+
with:
64+
python-version: 3.12
65+
66+
- name: Install dependencies
67+
run: |
68+
sudo apt install git
69+
python -m pip install --no-cache-dir --upgrade pip
70+
pip install -r requirements.txt
71+
working-directory: ansible_collections/devsec/hardening
72+
73+
# Molecule has problems detecting the proper location for installing roles
74+
# https://github.com/ansible/molecule/issues/3806
75+
# we do not set a custom role path, but the automatically determined install path used is not compatible with the location molecule expects the role
76+
# see CI logs of this action "INFO Set ANSIBLE_ROLES_PATH" should not be present, since we do not set a custom path
77+
# we have to find a proper way to configure this
78+
- name: Temporary fix for roles
79+
run: |
80+
mkdir -p /home/runner/.ansible
81+
ln -s /home/runner/work/ansible-collection-hardening/ansible-collection-hardening/ansible_collections/devsec/hardening/roles /home/runner/.ansible/roles
82+
83+
- name: Test with molecule
84+
run: |
85+
molecule --version
86+
molecule test -s postgres_hardening
87+
env:
88+
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
89+
working-directory: ansible_collections/devsec/hardening

‎molecule/postgres_hardening/converge.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
- name: wrapper playbook for kitchen testing "ansible-postgres-hardening" with custom settings
3+
become: true
4+
hosts: all
5+
collections:
6+
- devsec.hardening
7+
environment:
8+
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
9+
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
10+
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
11+
tasks:
12+
- include_role:
13+
name: postgres_hardening

‎molecule/postgres_hardening/molecule.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
driver:
3+
name: docker
4+
platforms:
5+
- name: instance
6+
image: "rndmh3ro/docker-${MOLECULE_DISTRO}-ansible:latest"
7+
command: ${MOLECULE_DOCKER_COMMAND:-/lib/systemd/systemd}
8+
volumes:
9+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
10+
privileged: true
11+
cgroupns_mode: host
12+
pre_build_image: true
13+
provisioner:
14+
name: ansible
15+
options:
16+
diff: true
17+
config_options:
18+
defaults:
19+
interpreter_python: auto_silent
20+
callbacks_enabled: profile_tasks, timer, yaml
21+
inventory:
22+
host_vars:
23+
# https://molecule.readthedocs.io/en/latest/examples.html#docker-with-non-privileged-user
24+
# setting for the platform instance named 'instance'
25+
instance:
26+
ansible_user: ansible
27+
verifier:
28+
name: ansible
29+
30+
scenario:
31+
create_sequence:
32+
- dependency
33+
- create
34+
- prepare
35+
check_sequence:
36+
- dependency
37+
- destroy
38+
- create
39+
- prepare
40+
- converge
41+
- check
42+
- destroy
43+
converge_sequence:
44+
- dependency
45+
- create
46+
- prepare
47+
- converge
48+
destroy_sequence:
49+
- destroy
50+
test_sequence:
51+
- dependency
52+
- destroy
53+
- syntax
54+
- create
55+
- prepare
56+
- check
57+
- converge
58+
- idempotence
59+
- verify
60+
- destroy

‎molecule/postgres_hardening/prepare.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
- name: prepare playbook for kitchen testing "ansible-postgres-hardening" with custom settings
3+
become: true
4+
hosts: all
5+
environment:
6+
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
7+
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
8+
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
9+
tasks:
10+
- name: install required packages
11+
package:
12+
name: "python3-apt"
13+
update_cache: true
14+
ignore_errors: true # noqa ignore-errors
15+
16+
- include_role:
17+
name: geerlingguy.postgres

‎molecule/postgres_hardening/verify.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
- name: Verify
3+
hosts: all
4+
become: true
5+
environment:
6+
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
7+
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
8+
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
9+
10+
- name: Verify
11+
hosts: localhost
12+
environment:
13+
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
14+
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
15+
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
16+
tasks:
17+
- name: Execute cinc-auditor tests
18+
command: >
19+
docker run
20+
--volume /run/docker.sock:/run/docker.sock
21+
docker.io/cincproject/auditor exec
22+
-t docker://instance
23+
--no-show-progress --no-color
24+
--no-distinct-exit https://github.com/dev-sec/postgres-baseline/archive/refs/heads/master.zip
25+
register: test_results
26+
changed_when: false
27+
ignore_errors: true
28+
29+
- name: Display details about the cinc-auditor results
30+
debug:
31+
msg: "{{ test_results.stdout_lines }}"
32+
33+
- name: Fail when tests fail
34+
fail:
35+
msg: "Inspec failed to validate"
36+
when: test_results.rc != 0

‎roles/postgres_hardening/CHANGELOG.md‎

Whitespace-only changes.

‎roles/postgres_hardening/README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# devsec.postgres_hardening
2+
3+
[![devsec.postgres_hardening](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/postgres_hardening.yml/badge.svg)](https://github.com/dev-sec/ansible-collection-hardening/actions/workflows/postgres_hardening.yml)
4+
5+
## Description
6+
7+
This role provides secure postgres configuration. It is intended to be compliant with the [DevSec Postgres Baseline](https://github.com/dev-sec/postgres-baseline).
8+
9+
10+
**NOTE: This role does not work with postgres 1.0.15 or older! Please use the latest version from the official postgres repositories!**
11+
12+
<!-- BEGIN_ANSIBLE_DOCS -->
13+
14+
## Supported Operating Systems [For Now]
15+
- Ubuntu
16+
- bionic, focal, jammy
17+
18+
## Role Variables

‎roles/postgres_hardening/defaults/main.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
# switcher to enable/disable role
3+
postgres_hardening_enabled: true
4+
5+
postgres_daemon_enabled: true
6+
7+
postgres_hardening_restart_postgres: true

‎roles/postgres_hardening/handlers/main.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
- name: Restart postgres
3+
ansible.builtin.service:
4+
name: "{{ postgres_daemon }}"
5+
state: restarted
6+
when: postgres_hardening_restart_postgres | bool

0 commit comments

Comments
 (0)