Ansible hardening

Skill scoobydont-666/shared-claude-skills/skills/ansible-hardening

10 production-tested Claude Code skills — model routing, security hardening, code quality, tax advisory, cost optimization. Install: clone to ~/.claude/skills/

Install

npx -y skills add scoobydont-666/shared-claude-skills --skill ansible-hardening

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Codify security hardening into reusable Ansible roles — CrowdSec IDS, fail2ban, auditd, Tailscale VPN, Semaphore UI, scoped sudoers, systemd sandboxing, and UFW firewall management. Trigger on: "harden with Ansible", "Ansible security", "CrowdSec role", "fail2ban role", "auditd role", "Tailscale Ansible", "Semaphore role", "sudoers role", "security playbook", "fleet hardening", or any request to automate security configurations that were done manually.

SKILL.md

3.2 KB, as published. Nobody here has run it

Ansible Hardening

Codify manual security work into idempotent Ansible roles. Every hardening step performed by hand should eventually become a role in this collection.

Roles Needed (from manual work done 2026-03-21)

crowdsec

Installs CrowdSec agent + firewall bouncer, configures collections, whitelists LAN.

# defaults
crowdsec_lapi_port: 8088          # moved from 8080 for OpenShell
crowdsec_collections:
  - crowdsecurity/sshd
  - crowdsecurity/linux
crowdsec_whitelist_cidrs:
  - "{{ lan_subnet }}"

fail2ban

Installs fail2ban, configures SSH jail.

# defaults
fail2ban_maxretry: 3
fail2ban_bantime: 3600
fail2ban_findtime: 600

auditd

Installs auditd, deploys audit rules for sensitive files.

# defaults
auditd_watch_paths:
  - { path: /etc/sudoers, key: sudoers_changes }
  - { path: /etc/sudoers.d/, key: sudoers_changes }
  - { path: /etc/ssh/sshd_config, key: ssh_config }
  - { path: /etc/monero/, key: monero_config }

tailscale

Installs Tailscale, configures serve endpoints.

# defaults
tailscale_serve_ports: []         # list of {local_port, description}
tailscale_funnel: false           # never enable funnel by default

Note: tailscale up requires interactive auth — role should detect and prompt.

semaphore

Installs Semaphore binary, creates config + systemd unit.

# defaults
semaphore_version: "2.17.27"
semaphore_port: 3001
semaphore_bind: "127.0.0.1"
semaphore_db: bolt                # bolt or postgres

sudoers-scope

Replaces blanket NOPASSWD with scoped command list.

# defaults
sudoers_nopasswd_commands:
  - /usr/bin/systemctl
  - /usr/bin/journalctl
  - /usr/bin/apt
  - /usr/bin/apt-get
  # ... full list from /etc/sudoers.d/admin_user

Implementation Pattern

Each role follows monero-farm conventions:

defaults/main.yml — all variables with safe defaults
tasks/main.yml — idempotent tasks
handlers/main.yml — restart/reload handlers
templates/ — config file templates (Jinja2)

Rules

Always --check --diff before real runs
Never remove existing security controls — only add/tighten
Whitelist LAN subnet before enabling firewall bouncers
Tailscale auth is interactive — can't be fully automated
Test on a primary host first, then roll to fleet

Where To Build

These roles belong in your project's ansible/roles/ directory alongside existing roles (base, application-specific, monitoring). The security roles extend the base role's hardening.

Alternatively, create a standalone ansible-hardening collection at <your-repo-root>/ansible-hardening/ if the scope grows and needs to be reused across multiple projects.