A

ansible

Ansible baseline for FreeBSD hosts: OS defaults, users, sysctl, chrony, ZFS boot environments, and a single-owner pf firewall that apps extend.

Ansible hardening for FreeBSD: SSH and 2FA, sshguard, CrowdSec, OpenBSM audit, AIDE, Lynis. Runs after ansible-base-freebsd, with an at(1) rollback to avoid lockouts.

Ansible that turns a stock Debian/Ubuntu VPS into an Arch Linux (optional CachyOS) desktop: kexec + pacstrap install, LUKS2 root unlocked over WireGuard from the initrd, NoMachine/xrdp reachable only via the tunnel.

openSUSE Leap Ansible hardening collection: SSH + 2FA, auditd, AIDE, CrowdSec, fail2ban, rootkit scanners, Lynis, with a systemd-timer rollback dead-man's-switch

Ansible hardening for Enterprise Linux hosts: SSH/2FA, auditd, AIDE, CrowdSec, fail2ban, scanners, reporting, and rollback safety.

Ansible hardening for Debian 13 hosts: SSH, CrowdSec/fail2ban, auditd/AIDE, sysctl, and PAM 2FA-- lockout-safe, runs after ansible-base-debian

Ansible baseline for Debian 13 hosts: users, packages, sysctl, auto-updates, and a single-owner nftables firewall apps extend