A

ansible-collection

Ansible baseline for FreeBSD hosts: OS defaults, users, sysctl, chrony, ZFS boot environments, and a single-owner pf firewall that apps extend.

Ansible hardening for FreeBSD: SSH and 2FA, sshguard, CrowdSec, OpenBSM audit, AIDE, Lynis. Runs after ansible-base-freebsd, with an at(1) rollback to avoid lockouts.

Ansible hardening for Enterprise Linux hosts: SSH/2FA, auditd, AIDE, CrowdSec, fail2ban, scanners, reporting, and rollback safety.

openSUSE Leap Ansible hardening collection: SSH + 2FA, auditd, AIDE, CrowdSec, fail2ban, rootkit scanners, Lynis, with a systemd-timer rollback dead-man's-switch