Instead of one role for hardening, I try to write my roles with secure defaults: https://github.com/liv-io/ansible-roles-centos