build.yml

---
- name: Tasks for "jenkins" hosts
  hosts: build
  become: true
  vars:
    hostname: build.galaxyproject.eu
  vars_files:
    - "secret_group_vars/jenkins.yml"
    - "secret_group_vars/all.yml"
  pre_tasks:
    - name: Install Dependencies
      package:
        enablerepo: crb
        name: ["policycoreutils-python-utils", "python3-wheel-wheel"]
      become: true
    - name: permit traffic in default zone for http and https service
      ansible.posix.firewalld:
        service: "{{ item }}"
        permanent: true
        state: enabled
      loop:
        - http
        - https
  collections:
    - devsec.hardening
  roles:
    - hostname
    - usegalaxy-eu.dynmotd
    - geerlingguy.repo-epel
    - hxr.admin-tools
    - influxdata.chrony
    - hxr.monitor-email
    - usegalaxy-eu.autoupdates
    - galaxyproject.nginx
    - ssh-host-sign
    # - hxr.autofs-format-n-mount
    # CUSTOM
    - geerlingguy.java
    - geerlingguy.jenkins
    - usegalaxy-eu.jenkins-ssh-key
    ## END CUSTOM
    - dj-wasabi.telegraf
    - galaxyproject.miniconda
    - os_hardening
    # - nginx_hardening
    - ssh_hardening