Add Atlas media and storage services [Phase 1] (#9)

* Add Atlas media and storage services

* Document Atlas backend phase one and WireGuard deployment

* Enable Atlas NAS management and document bootstrap workflow

* Harden Atlas network, SSH, firewall, and sharing

* Rotate Ansible Vault secrets

* Allow configurable Aegis SSH users and authorized keys

* Manage Aegis SSH authorized key fragments

* Manage SSH authorized key fragments for infrastructure hosts

* Harden Rocky storage and sharing configuration

* Verify WireGuard handshakes and restore Podman networking

ansible/inventory/host_vars/atlas.yml

@@ -1,10 +1,10 @@
 ---
-# Replace every CHANGEME value before enabling Atlas storage management.
+# Atlas declares its intended steady state; set a feature flag false only for a deliberate suspension.
 hostname: atlas
-ansible_host: CHANGEME_ATLAS_HOST
+ansible_host: 192.168.178.55
 ansible_user: "{{ atlas_connection_username }}"
 ansible_port: 22
-ansible_ssh_private_key_file: CHANGEME_ATLAS_SSH_PRIVATE_KEY_PATH
+ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 
 atlas_admin_username: admin
 atlas_connection_username: "{{ atlas_admin_username }}"
@@ -12,49 +12,105 @@ atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"
 atlas_admin_uid: 1000
 atlas_admin_gid: 1000
-atlas_admin_ssh_keys: "{{ vault_atlas_authorized_ssh_keys | default([]) }}"
+atlas_admin_ssh_keys:
+  - name: ikaros
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+  - name: nymph
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+  - name: siren
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}"
+atlas_ssh_allow_tcp_forwarding: local
 
-atlas_lan_subnet: CHANGEME_LAN_SUBNET
-atlas_manage_firewall: false
+atlas_lan_subnet: 192.168.178.0/24
+atlas_aegis_ip: 192.168.178.54
+atlas_manage_firewall: true
 atlas_firewalld_zone: public
-atlas_zfs_pool: CHANGEME_ZFS_POOL
+atlas_zfs_pool: zpool
+# Populate only for the first pool bootstrap with four real persistent disk paths.
+# Confirmed empty 4 TB IronWolf data disks; the NVMe system disk is intentionally excluded.
+atlas_zpool_disks:
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1XM
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A73T2
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A6VJK
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1LM
+atlas_create_pool: false
 atlas_zfs_dataset_work: work
-atlas_zfs_dataset_syncthing: syncthing
+atlas_zfs_dataset_archive: archive
+atlas_zfs_dataset_app_data: archive/app_data
+atlas_zfs_dataset_navidrome: archive/app_data/navidrome
+atlas_zfs_dataset_syncthing: archive/app_data/syncthing
+atlas_zfs_dataset_media: media
+atlas_zfs_dataset_music: media/music
 atlas_zfs_dataset_backup_prometheus: backup_prometheus
-atlas_zfs_dataset_icloud_photos: icloud_photos
-atlas_mount_root: /CHANGEME_ATLAS_MOUNT_ROOT
-atlas_manage_storage: false
+atlas_zfs_dataset_photobook: media/photobook
+atlas_zfs_dataset_backups: backups
+atlas_zfs_dataset_service_backups: backups/services
+atlas_mount_root: /zpool
+atlas_manage_storage: true
+atlas_manage_sharing: true
+atlas_manage_media_stack: false
+
+wireguard_overlay_enabled: true
+wireguard_address: 10.0.0.2/24
+wireguard_peers:
+  - name: prometheus
+    host: prometheus
+    endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
+    allowed_ips:
+      - 10.0.0.0/24
+    persistent_keepalive: 25
+
+backend_phase1_enabled: true
+backend_phase1_start_services: false
+backend_phase1_wireguard_address: 10.0.0.2
 
 rocky_manage_openzfs_repo: true
-rocky_manage_syncthing_binary: true
+rocky_manage_syncthing_binary: false
+rocky_manage_podman: true
+rocky_podman_packages:
+  - podman
 
 host_packages:
   - cockpit
   - nfs-utils
+  - policycoreutils
   - policycoreutils-python-utils
+  - python3-libselinux
   - samba
+  - samba-client
+  - samba-common-tools
   - zfs
 
 atlas_nfs_exports:
-  - path: "{{ atlas_work_mountpoint }}"
-    clients: "{{ atlas_lan_subnet }}(rw,sync,no_subtree_check,root_squash)"
+  - path: "{{ atlas_photobook_mountpoint }}"
+    client: "{{ atlas_aegis_ip }}"
+    options:
+      - rw
+      - sync
+      - no_subtree_check
+      - all_squash
+      - "anonuid={{ atlas_immich_uid }}"
+      - "anongid={{ atlas_immich_gid }}"
 
-atlas_samba_share_name: work
+atlas_samba_share_name: Archive
 atlas_samba_workgroup: WORKGROUP
-atlas_samba_valid_users:
-  - "{{ atlas_admin_username }}"
-atlas_samba_password: "{{ vault_atlas_samba_password | default('') }}"
+atlas_samba_encryption: required
+# Append any pre-existing laptop Unix account here and keep its Samba password in Vault.
+atlas_samba_accounts:
+  - username: "{{ atlas_admin_username }}"
+    password: "{{ vault_atlas_samba_password | default('') }}"
+atlas_samba_valid_users: "{{ atlas_samba_accounts | map(attribute='username') | list }}"
+
+atlas_immich_db_password: "{{ vault_atlas_immich_db_password | default('') }}"
 
 atlas_firewalld_rich_rules:
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="ssh" accept'
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="cockpit" accept'
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="2049" protocol="tcp" accept'
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="samba" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="22" protocol="tcp" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="9090" protocol="tcp" accept'
+  - 'rule family="ipv4" source address="{{ atlas_aegis_ip }}" port port="2049" protocol="tcp" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="445" protocol="tcp" accept'
 
 host_enabled_services:
   - sshd
   - cockpit.socket
-  - nfs-server
-  - smb
   - zfs.target