added for legacy pipeline while new pipeline implemented

Signed-off-by: Mark Bolwell <[email protected]>

.github/workflows/AMAZON2.tfvars

@@ -0,0 +1,9 @@
+# Amazon Linux 2
+ami_id         = "ami-03e0b06f01d45a4eb"
+ami_os         = "AmazonLinux2"
+ami_username   = "ec2-user"
+ami_user_home  = "/home/ec2-user"
+benchmark_os   = "Amazon2"
+privsubnet_id  = "subnet-0ce2cd3c739f6421c"
+vpc_secgrp_id  = "sg-0c0593968712e684d"
+benchmark_type = "CIS"

.github/workflows/github_network.tf

@@ -0,0 +1,53 @@
+resource "aws_vpc" "Main" {
+  cidr_block = var.main_vpc_cidr
+  instance_tenancy = "default"
+  tags       = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-VPC"
+    }
+}
+
+resource "aws_internet_gateway" "IGW" {
+  vpc_id = aws_vpc.Main.id
+  tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-IGW"
+  }
+}
+
+resource "aws_subnet" "publicsubnets" {
+  vpc_id =  aws_vpc.Main.id
+  cidr_block = var.public_subnets
+  availability_zone = var.availability_zone
+  tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-pubsub"
+  }
+}
+
+resource "aws_subnet" "Main" {
+  vpc_id =  aws_vpc.Main.id
+  availability_zone = var.availability_zone
+  cidr_block = var.private_subnets
+  tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-prvsub"
+  }
+}
+
+resource "aws_route_table" "PublicRT" {
+   vpc_id =  aws_vpc.Main.id
+   route {
+   cidr_block = "0.0.0.0/0"
+   gateway_id = aws_internet_gateway.IGW.id
+   }
+   tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-publicRT"
+  }
+}
+
+resource "aws_route_table_association" "rt_associate_public" {
+  subnet_id = aws_subnet.Main.id
+  route_table_id = aws_route_table.PublicRT.id
+}

.github/workflows/linux_benchmark_testing.yml

@@ -0,0 +1,111 @@
+i# This is a basic workflow to help you get started with Actions
+
+name: linux_benchmark_pipeline
+
+# Controls when the action will run.
+# Triggers the workflow on push or pull request
+# events but only for the devel branch
+on:  # yamllint disable-line rule:truthy
+    pull_request_target:
+        types: [opened, reopened, synchronize]
+        branches:
+            - devel
+            - main
+        paths:
+            - '**.yml'
+            - '**.sh'
+            - '**.j2'
+            - '**.ps1'
+            - '**.cfg'
+
+# A workflow run is made up of one or more jobs
+# that can run sequentially or in parallel
+jobs:
+  # This will create messages for first time contributers and direct them to the Discord server
+    welcome:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/first-interaction@main
+              with:
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  pr-message: |-
+                      Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
+                      Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
+    # This workflow contains a single job called "build"
+    build:
+        # The type of runner that the job will run on
+        runs-on: ubuntu-latest
+
+        env:
+            ENABLE_DEBUG: false
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+        steps:
+            # Checks-out your repository under $GITHUB_WORKSPACE,
+            # so your job can access it
+            - uses: actions/checkout@v3
+              with:
+                  ref: ${{ github.event.pull_request.head.sha }}
+
+            - name: Add_ssh_key
+              working-directory: .github/workflows
+              env:
+                  SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+                  PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
+              run: |
+                  mkdir .ssh
+                  chmod 700 .ssh
+                  echo $PRIVATE_KEY > .ssh/github_actions.pem
+                  chmod 600 .ssh/github_actions.pem
+
+            ### Build out the server
+            - name: Terraform_Init
+              working-directory: .github/workflows
+              run: terraform init
+
+            - name: Terraform_Validate
+              working-directory: .github/workflows
+              run: terraform validate
+
+            - name: Terraform_Apply
+              working-directory: .github/workflows
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+              run: terraform apply -var-file "OS.tfvars" -var-file "github_vars.tfvars" --auto-approve -input=false
+
+            ## Debug Section
+            - name: DEBUG - Show Ansible hostfile
+              if: env.ENABLE_DEBUG == 'true'
+              working-directory: .github/workflows
+              run: cat hosts.yml
+
+            # Aws deployments taking a while to come up insert sleep or playbook fails
+
+            - name: Sleep for 60 seconds
+              run: sleep 60s
+              shell: bash
+
+            # Run the ansible playbook
+            - name: Run_Ansible_Playbook
+              uses: arillso/action.playbook@master
+              with:
+                  playbook: site.yml
+                  inventory: .github/workflows/hosts.yml
+                  galaxy_file: collections/requirements.yml
+                  private_key: ${{ secrets.SSH_PRV_KEY }}
+        #          verbose: 3
+              env:
+                  ANSIBLE_HOST_KEY_CHECKING: "false"
+                  ANSIBLE_DEPRECATION_WARNINGS: "false"
+
+            # Remove test system - User secrets to keep if necessary
+
+            - name: Terraform_Destroy
+              working-directory: .github/workflows
+              if: always() && env.ENABLE_DEBUG == 'false'
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+              run: terraform destroy -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false

.github/workflows/main.tf

@@ -0,0 +1,81 @@
+provider "aws" {
+  profile = ""
+  region  = var.aws_region
+}
+
+// Create a security group with access to port 22 and port 80 open to serve HTTP traffic
+
+
+resource "random_id" "server" {
+  keepers = {
+    # Generate a new id each time we switch to a new AMI id
+    ami_id = "${var.ami_id}"
+  }
+
+  byte_length = 8
+}
+
+resource "aws_security_group" "github_actions" {
+  name   = "${var.namespace}-${random_id.server.hex}-SG"
+  vpc_id = aws_vpc.Main.id
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+  tags = {
+    Environment = "${var.environment}"
+    Name = "${var.namespace}-SG"
+ }
+}
+
+// instance setup
+
+resource "aws_instance" "testing_vm" {
+  ami                         = var.ami_id
+  availability_zone           = var.availability_zone
+  associate_public_ip_address = true
+  key_name                    = var.ami_key_pair_name # This is the key as known in the ec2 key_pairs
+  instance_type               = var.instance_type
+  tags                        = var.instance_tags
+  vpc_security_group_ids      = [aws_security_group.github_actions.id]
+  subnet_id                   = aws_subnet.Main.id
+  root_block_device {
+        delete_on_termination = true
+  }
+}
+
+// generate inventory file
+resource "local_file" "inventory" {
+  filename = "./hosts.yml"
+  directory_permission = "0755"
+  file_permission      = "0644"
+  content  = <<EOF
+    # benchmark host
+    all:
+      hosts:
+        ${var.ami_os}:
+          ansible_host: ${aws_instance.testing_vm.public_ip}
+          ansible_user: ${var.ami_username}
+      vars:
+        setup_audit: true
+        run_audit: true
+        system_is_ec2: true
+    EOF
+}

.github/workflows/terraform.tfvars

@@ -0,0 +1,6 @@
+// vars should be loaded by OSname.tfvars
+availability_zone      = "us-east-1b"
+aws_region    = "us-east-1"
+ami_os        = var.ami_os
+ami_username  = var.ami_username
+instance_tags = var.instance_tags

.github/workflows/variables.tfvars

@@ -0,0 +1,76 @@
+i// Taken from the OSname.tfvars
+
+variable "aws_region" {
+  description = "AWS region"
+  default     = "us-east-1"
+  type        = string
+}
+
+variable "availability_zone" {
+  description = "List of availability zone in the region"
+  default     = "us-east-1b"
+  type        = string
+}
+
+variable "instance_type" {
+  description = "EC2 Instance Type"
+  default     = "t3.micro"
+  type        = string
+}
+
+variable "instance_tags" {
+  description = "Tags to set for instances"
+  type        = map(string)
+}
+
+variable "ami_key_pair_name" {
+  description = "Name of key pair in AWS thats used"
+  type        = string
+}
+
+variable "ami_os" {
+  description = "AMI OS Type"
+  type        = string
+}
+
+variable "ami_id" {
+  description = "AMI ID reference"
+  type = string
+}
+
+variable "ami_username" {
+  description = "Username for the ami id"
+  type        = string
+}
+
+variable "ami_user_home" {
+  description = "home dir for the username"
+  type        = string
+}
+
+variable "namespace" {
+  description = "Name used across all tags"
+  type        = string
+}
+
+variable "environment" {
+  description = "Env Name used across all tags"
+  type        = string
+}
+
+// taken from github_vars.tfvars &
+
+variable "main_vpc_cidr" {
+  description = "Private cidr block to be used for vpc"
+  type        = string
+}
+
+variable "public_subnets" {
+  description = "public subnet cidr block"
+  type        = string
+}
+
+variable "private_subnets" {
+  description = "private subnet cidr block"
+  type        = string
+}