Shared Ansible roles for multi-OS infrastructure management. 43 roles covering base system, security, networking, package management, user management, editors, and more.
- Arch Linux (rolling)
- Debian Trixie (13)
- EL 9 (Rocky, Alma, RHEL)
- EL 10 (Rocky, Alma, RHEL)
- ansible-core >= 2.19
| Role | Description |
|---|---|
| base | Hostname, timezone, locale, kernel, systemd |
| users | User/group management with SSH keys |
| sudo | Sudo configuration |
| editors | Text editors (nano, vim, neovim) with per-user config |
| multiplexer | Terminal multiplexers (tmux, zellij) with per-user config |
| shell | Shells (zsh, bash, fish), Starship prompt, modern CLI |
| utils | CLI utilities and monitoring tools |
| fonts | System and Nerd Fonts |
| energy_management | Power management (logind, PPD/TLP/tuned) |
| graphics | GPU drivers (Intel, NVIDIA, AMD) |
| Role | Description |
|---|---|
| package_management | pacman, APT, DNF, AUR helper (paru), reflector |
| nodejs | Node.js and NVM |
| php | PHP interpreter and extensions |
| python | Python interpreter and tools |
| ansible | Ansible, Molecule and linting tools |
| Role | Description |
|---|---|
| resolved | systemd-resolved DNS resolver |
| networkmanager | NetworkManager configuration |
| firewalld | Firewall management |
| wireguard | WireGuard VPN |
| unbound | DNS resolver with DNSSEC |
| avahi | mDNS/DNS-SD service discovery |
| openssh | OpenSSH server and client |
| Role | Description |
|---|---|
| hardening | Kernel and filesystem hardening |
| sysctl | Kernel parameter tuning |
| pam_hardening | PAM security (pwquality, faillock) |
| apparmor | AppArmor mandatory access control |
| firejail | Application sandboxing |
| fail2ban | Intrusion prevention |
| auditd | Linux audit daemon |
| aide | Advanced Intrusion Detection Environment |
| lynis | Security auditing |
| rkhunter | Rootkit detection |
| clamav | ClamAV antivirus |
| Role | Description |
|---|---|
| gnupg | GnuPG encryption and signing |
| pki | PKI certificate management |
| hardware_tokens | Nitrokey/YubiKey support |
| Role | Description |
|---|---|
| chrony | NTP time synchronization |
| logrotate | Log rotation |
| mta | Send-only mail (Postfix) |
| docker | Docker container runtime |
| podman | Podman container runtime |
| snmp | SNMP monitoring agent |
| restic | Backup with restic |
ansible-galaxy collection install marcstraube.commonansible-galaxy collection install git+https://github.com/marcstraube/ansible-collection-common.git,main# requirements.yml
collections:
- name: marcstraube.common
version: ">=2.0.0"All roles use include_role with boolean toggles:
- name: Configure system
hosts: all
become: true
tasks:
- name: Include base role
ansible.builtin.include_role:
name: marcstraube.common.base
when: base_enabled | default(true) | bool
- name: Include openssh role
ansible.builtin.include_role:
name: marcstraube.common.openssh
when: openssh_enabled | default(true) | boolEach role documents its variables in defaults/main.yml and roles/<role>/README.md.
Roles are tested with Molecule using Podman containers across all supported platforms.
cd roles/<role>
molecule testSee CONTRIBUTING.md for development setup and guidelines.
If you find this collection useful, consider supporting its development.
MIT
Marc Straube (email@marcstraube.de)