# ansible-lockdown/rhel10-cis architecture

> Architecture diagram of the GitHub repository ansible-lockdown/rhel10-cis, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ansible-lockdown/rhel10-cis
- Repository: https://github.com/ansible-lockdown/rhel10-cis

## Overview

RHEL10-CIS is an Ansible role for remediating a RHEL 10 host against the CIS benchmark. The principal workflow is an operator applying the role to a host, with controls organized into seven benchmark sections; optional auditing checks enabled controls and can use Goss. Defaults configure audit and control selection, while templates and platform variables support system configuration. The tree and README establish these capabilities, but the task files were not sampled, so internal task dispatch and most implementation links are omitted. The standalone GRUB hash filter is included without an asserted connection to the role workflow.

Main entry points: [`tasks/main.yml`](https://github.com/ansible-lockdown/rhel10-cis/blob/devel/tasks/main.yml) (Role entry), [`tasks/audit_only.yml`](https://github.com/ansible-lockdown/rhel10-cis/blob/devel/tasks/audit_only.yml) (Audit tasks), [`defaults/main`](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/defaults/main) (Role defaults), [`tasks/section_1`](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_1) (Section 1)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_execution["Role execution"]
  node_entry["Role entry<br/>[main.yml]"]
  node_prelim["Preparation<br/>[prelim.yml]"]
  node_post["Post-remediation<br/>[post.yml]"]
end

subgraph group_controls["CIS controls"]
  node_section1["Section 1"]
  node_section2["Section 2"]
  node_section3["Section 3"]
  node_section4["Section 4"]
  node_section5["Section 5"]
  node_section6["Section 6"]
  node_section7["Section 7"]
end

subgraph group_audit["Audit"]
  node_defaults["Role defaults"]
  node_audit_tasks["Audit tasks<br/>[audit_only.yml]"]
  node_goss["Goss checker"]
end

subgraph group_config["System configuration"]
  node_templates["Config templates"]
  node_platform_vars["Platform settings"]
end

subgraph group_helpers["Role helpers"]
  node_grub_filter["GRUB hash filter<br/>[grub_hash.py]"]
end

node_operator(("Ansible operator"))
node_target(("RHEL 10 host"))

node_operator -->|"applies role"| node_entry
node_entry -->|"remediates host"| node_target
node_defaults -->|"configures audit"| node_audit_tasks
node_audit_tasks -->|"uses checker"| node_goss
node_entry -.-> node_section1
node_entry -.-> node_section2
node_entry -.-> node_section3
node_entry -.-> node_section4
node_entry -.-> node_section5
node_entry -.-> node_section6
node_entry -.-> node_section7

click node_entry "https://github.com/ansible-lockdown/rhel10-cis/blob/devel/tasks/main.yml"
click node_prelim "https://github.com/ansible-lockdown/rhel10-cis/blob/devel/tasks/prelim.yml"
click node_post "https://github.com/ansible-lockdown/rhel10-cis/blob/devel/tasks/post.yml"
click node_section1 "https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_1"
click node_section2 "https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_2"
click node_section3 "https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_3"
click node_section4 "https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_4"
click node_section5 "https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_5"
click node_section6 "https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_6"
click node_section7 "https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_7"
click node_defaults "https://github.com/ansible-lockdown/rhel10-cis/tree/devel/defaults/main"
click node_audit_tasks "https://github.com/ansible-lockdown/rhel10-cis/blob/devel/tasks/audit_only.yml"
click node_templates "https://github.com/ansible-lockdown/rhel10-cis/tree/devel/templates"
click node_platform_vars "https://github.com/ansible-lockdown/rhel10-cis/tree/devel/vars"
click node_grub_filter "https://github.com/ansible-lockdown/rhel10-cis/blob/devel/filter_plugins/grub_hash.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_entry,node_prelim,node_post toneBlue
class node_section1,node_section2,node_section3,node_section4,node_section5,node_section6,node_section7 toneAmber
class node_defaults,node_audit_tasks,node_goss toneMint
class node_templates,node_platform_vars toneRose
class node_grub_filter,node_operator,node_target toneIndigo
```

## Components

### Role execution

- [Role entry](https://github.com/ansible-lockdown/rhel10-cis/blob/devel/tasks/main.yml): `tasks/main.yml`
- [Preparation](https://github.com/ansible-lockdown/rhel10-cis/blob/devel/tasks/prelim.yml): `tasks/prelim.yml`
- [Post-remediation](https://github.com/ansible-lockdown/rhel10-cis/blob/devel/tasks/post.yml): `tasks/post.yml`

### CIS controls

- [Section 1](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_1): `tasks/section_1`
- [Section 2](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_2): `tasks/section_2`
- [Section 3](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_3): `tasks/section_3`
- [Section 4](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_4): `tasks/section_4`
- [Section 5](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_5): `tasks/section_5`
- [Section 6](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_6): `tasks/section_6`
- [Section 7](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/tasks/section_7): `tasks/section_7`

### Audit

- [Role defaults](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/defaults/main): `defaults/main`
- [Audit tasks](https://github.com/ansible-lockdown/rhel10-cis/blob/devel/tasks/audit_only.yml): `tasks/audit_only.yml`
- **Goss checker**

### System configuration

- [Config templates](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/templates): `templates`
- [Platform settings](https://github.com/ansible-lockdown/rhel10-cis/tree/devel/vars): `vars`

### Role helpers

- [GRUB hash filter](https://github.com/ansible-lockdown/rhel10-cis/blob/devel/filter_plugins/grub_hash.py): `filter_plugins/grub_hash.py`

### Other components

- **Ansible operator**
- **RHEL 10 host**

## Connections

- Ansible operator → Role entry: applies role (evidence: `README.md`)
- Role entry → RHEL 10 host: remediates host (evidence: `README.md`)
- Role defaults → Audit tasks: configures audit (evidence: `README.md`)
- Audit tasks → Goss checker: uses checker (evidence: `README.md`)
- Role entry → Section 1
- Role entry → Section 2
- Role entry → Section 3
- Role entry → Section 4
- Role entry → Section 5
- Role entry → Section 6
- Role entry → Section 7