Idempotency

Idempotent hardening

All lockdown Ansible playbooks are idempotent: running a playbook against an already-hardened, unchanged system makes no changes and reports none. A correctly hardened, unchanged system produces zero changed tasks on subsequent runs.

This property makes the playbooks safe for:

• Repeated runs - re-running after an interruption or failure completes the remaining work without repeating or undoing what already succeeded.
• Configuration-drift remediation - re-apply the baseline on a schedule; only drifted settings are touched.
• Compliance enforcement pipelines - run from CI/CD or automation platforms without special-casing already-hardened hosts.

Verifying idempotency

Run the playbook twice; the second run's recap should report changed=0:

Run from inside your scaffolded working directory (see Quick Start):

# First run - applies hardening
ansible-playbook ctrliq.rlch9_lockdown.rlch9_stig

# Second run - verifies idempotency
ansible-playbook ctrliq.rlch9_lockdown.rlch9_stig 2>&1 | grep -E "changed=|failed="

Expected second-run recap:

server1  : ok=612  changed=0  unreachable=0  failed=0  skipped=214  rescued=0  ignored=0

Drift remediation

For ongoing maintenance of hardened systems, the shipped collection's drift workflow is audit, then remediate:

# Audit only - reports failing rules, makes no changes
ansible-playbook ctrliq.rlch9_lockdown.drift_audit -e "ciq_audit_profile=stig"

# Remediate - re-run the same standalone playbook that hardened the system.
# Idempotency (above) means only the drifted items actually change.
ansible-playbook ctrliq.rlch9_lockdown.rlch9_stig

drift_audit scans against the RLCH9 SCAP datastream and lists every failing rule ID without judging whether it's expected drift for your environment; its own summary output points you at the matching rlch9_<profile> playbook to remediate. Swap ciq_audit_profile for cis or cui to audit those frameworks (there's no single combined profile - audit STIG and CIS separately for rlch9_combined deployments, and don't run this against rlch9_hardened, which has no SCAP profile of its own).

Faster re-runs with state files (experimental)

The wrapper can track completion of expensive one-time operations (repository configuration, authselect initialization, crypto policy setup) in state files at /var/lib/ciq-lockdown/.state/ on the target. When enabled, completed operations are skipped on subsequent runs, saving roughly 60–90 seconds per run:

ansible-playbook ctrliq.rlch9_lockdown.rlch9_combined -e "ciq_use_state_files=true"

To force a full reconfiguration, remove the state files on the target:

sudo rm -rf /var/lib/ciq-lockdown/.state/*

Reset state files after switching repository versions, changing authselect or crypto-policy configuration, or major system upgrades.