mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 19:03:47 +00:00
Add Atlas media and storage services [Phase 1] (#9)
* Add Atlas media and storage services * Document Atlas backend phase one and WireGuard deployment * Enable Atlas NAS management and document bootstrap workflow * Harden Atlas network, SSH, firewall, and sharing * Rotate Ansible Vault secrets * Allow configurable Aegis SSH users and authorized keys * Manage Aegis SSH authorized key fragments * Manage SSH authorized key fragments for infrastructure hosts * Harden Rocky storage and sharing configuration * Verify WireGuard handshakes and restore Podman networking
This commit is contained in:
Fabio Scotto di Santolo
committed by
GitHub
GitHub
parent
73bf2cd62a
commit
160d63c02d
@@ -1,187 +1,12 @@
|
||||
---
|
||||
- name: Render Atlas NFS exports
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.template:
|
||||
src: atlas.exports.j2
|
||||
dest: /etc/exports.d/atlas.exports
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Reload NFS exports
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Configure Atlas NFSv4-only service
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.template:
|
||||
src: atlas-nfs.conf.j2
|
||||
dest: /etc/nfs.conf.d/atlas.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Restart NFS server
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Mask Atlas NFSv3 RPC services
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.builtin.systemd:
|
||||
name: "{{ item }}"
|
||||
enabled: false
|
||||
state: stopped
|
||||
masked: true
|
||||
loop:
|
||||
- rpc-statd.service
|
||||
- rpcbind.service
|
||||
- rpcbind.socket
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Ensure Atlas NFS mount daemon drop-in directory exists
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/nfs-mountd.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Disable Atlas NFSv3 mount daemon listeners
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.builtin.template:
|
||||
src: nfs-mountd-v4only.conf.j2
|
||||
dest: /etc/systemd/system/nfs-mountd.service.d/v4only.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Restart NFS mount daemon
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Enable SELinux access for Atlas file sharing
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.posix.seboolean:
|
||||
name: "{{ item }}"
|
||||
state: true
|
||||
persistent: true
|
||||
loop: "{{ atlas_selinux_booleans }}"
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
when:
|
||||
- atlas_manage_storage | bool
|
||||
- (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
|
||||
|
||||
- name: Render Atlas Samba configuration
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.template:
|
||||
src: smb.conf.j2
|
||||
dest: /etc/samba/smb.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
validate: "testparm --suppress-prompt %s"
|
||||
notify: Restart Samba service
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Require Atlas Samba password
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- atlas_samba_password | length > 0
|
||||
fail_msg: Define vault_atlas_samba_password before enabling Atlas storage.
|
||||
no_log: true
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Read Atlas Samba account
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- pdbedit
|
||||
- --list
|
||||
- --user
|
||||
- "{{ atlas_admin_username }}"
|
||||
register: atlas_samba_account
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Ensure Atlas Samba private state directory exists
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.file:
|
||||
path: "{{ atlas_samba_password_marker | dirname }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0700"
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Check Atlas Samba password marker
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.stat:
|
||||
path: "{{ atlas_samba_password_marker }}"
|
||||
register: atlas_samba_password_marker_stat
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Read Atlas Samba password marker
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.slurp:
|
||||
src: "{{ atlas_samba_password_marker }}"
|
||||
register: atlas_samba_password_marker_content
|
||||
no_log: true
|
||||
when:
|
||||
- atlas_manage_storage | bool
|
||||
- atlas_samba_password_marker_stat.stat.exists
|
||||
|
||||
- name: Determine whether Atlas Samba credentials must change
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.set_fact:
|
||||
atlas_samba_password_digest: "{{ atlas_samba_password | hash('sha256') }}"
|
||||
atlas_samba_password_update_required: >-
|
||||
{{
|
||||
atlas_samba_account.rc != 0
|
||||
or not atlas_samba_password_marker_stat.stat.exists
|
||||
or (
|
||||
atlas_samba_password_marker_content.content | default('')
|
||||
| b64decode | trim
|
||||
) != (atlas_samba_password | hash('sha256'))
|
||||
}}
|
||||
no_log: true
|
||||
when: atlas_manage_storage | bool
|
||||
|
||||
- name: Set Atlas Samba account password
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- smbpasswd
|
||||
- -s
|
||||
- -a
|
||||
- "{{ atlas_admin_username }}"
|
||||
stdin: "{{ atlas_samba_password }}\n{{ atlas_samba_password }}"
|
||||
changed_when: true
|
||||
no_log: true
|
||||
when:
|
||||
- atlas_manage_storage | bool
|
||||
- atlas_samba_password_update_required | bool
|
||||
|
||||
- name: Record managed Atlas Samba password digest
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.copy:
|
||||
content: "{{ atlas_samba_password_digest }}\n"
|
||||
dest: "{{ atlas_samba_password_marker }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
no_log: true
|
||||
when:
|
||||
- atlas_manage_storage | bool
|
||||
- atlas_samba_password_update_required | bool
|
||||
|
||||
- name: Require completed Atlas firewall placeholders
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- atlas_lan_subnet != 'CHANGEME_LAN_SUBNET'
|
||||
- atlas_aegis_ip != 'CHANGEME_AEGIS_IP'
|
||||
- atlas_firewalld_zone | length > 0
|
||||
fail_msg: Replace the Atlas LAN subnet and firewall zone placeholders.
|
||||
- ansible_facts.default_ipv4.interface | default('') | length > 0
|
||||
fail_msg: Replace the Atlas LAN, Aegis and firewall-zone placeholders.
|
||||
when: atlas_manage_firewall | bool
|
||||
|
||||
- name: Apply Atlas firewalld rich rules
|
||||
@@ -197,6 +22,16 @@
|
||||
label: "{{ item }}"
|
||||
when: atlas_manage_firewall | bool
|
||||
|
||||
- name: Assign primary Atlas LAN interface to managed firewalld zone
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.posix.firewalld:
|
||||
interface: "{{ ansible_facts.default_ipv4.interface }}"
|
||||
zone: "{{ atlas_firewalld_zone }}"
|
||||
state: enabled
|
||||
permanent: true
|
||||
immediate: true
|
||||
when: atlas_manage_firewall | bool
|
||||
|
||||
- name: Remove unrestricted Atlas services from firewalld zone
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.posix.firewalld:
|
||||
@@ -209,3 +44,228 @@
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
when: atlas_manage_firewall | bool
|
||||
|
||||
- name: Render Atlas NFS exports
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.template:
|
||||
src: atlas.exports.j2
|
||||
dest: /etc/exports.d/atlas.exports
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Reload NFS exports
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Ensure Atlas NFS configuration drop-in directory exists
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.file:
|
||||
path: /etc/nfs.conf.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Configure Atlas NFSv4-only service
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.template:
|
||||
src: atlas-nfs.conf.j2
|
||||
dest: /etc/nfs.conf.d/atlas.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Restart NFS server
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Mask Atlas NFSv3 RPC services
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.builtin.systemd:
|
||||
name: "{{ item }}"
|
||||
enabled: false
|
||||
state: stopped
|
||||
masked: true
|
||||
loop:
|
||||
- rpc-statd.service
|
||||
- rpcbind.service
|
||||
- rpcbind.socket
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Ensure Atlas NFS mount daemon drop-in directory exists
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/nfs-mountd.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Disable Atlas NFSv3 mount daemon listeners
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.builtin.template:
|
||||
src: nfs-mountd-v4only.conf.j2
|
||||
dest: /etc/systemd/system/nfs-mountd.service.d/v4only.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Restart NFS mount daemon
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Enable SELinux access for Atlas file sharing
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.posix.seboolean:
|
||||
name: "{{ item }}"
|
||||
state: true
|
||||
persistent: true
|
||||
loop: "{{ atlas_selinux_booleans }}"
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
when:
|
||||
- atlas_manage_sharing | bool
|
||||
- (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
|
||||
|
||||
- name: Render Atlas Samba configuration
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.template:
|
||||
src: smb.conf.j2
|
||||
dest: /etc/samba/smb.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
validate: "testparm --suppress-prompt %s"
|
||||
notify: Restart Samba service
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Require Vault-backed Atlas Samba accounts
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- atlas_samba_encryption in ['required', 'desired']
|
||||
- atlas_samba_accounts | length > 0
|
||||
- >-
|
||||
atlas_samba_accounts | map(attribute='username') | list
|
||||
| difference(atlas_samba_valid_users) | length == 0
|
||||
- >-
|
||||
atlas_samba_valid_users
|
||||
| difference(atlas_samba_accounts | map(attribute='username') | list) | length == 0
|
||||
- atlas_samba_accounts | selectattr('password', 'equalto', '') | list | length == 0
|
||||
fail_msg: Define every authorized Samba account and its Vault-backed password.
|
||||
no_log: true
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Ensure Atlas Samba private state directory exists
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.file:
|
||||
path: "{{ atlas_samba_password_marker_dir }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0700"
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Manage Vault-backed Atlas Samba credentials
|
||||
tags: [atlas, sharing]
|
||||
ansible.builtin.include_tasks: samba_account.yml
|
||||
loop: "{{ atlas_samba_accounts }}"
|
||||
loop_control:
|
||||
loop_var: atlas_samba_account
|
||||
label: "{{ atlas_samba_account.username }}"
|
||||
no_log: true
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Enable Atlas file-sharing services
|
||||
tags: [atlas, sharing, services]
|
||||
ansible.builtin.systemd:
|
||||
name: "{{ item }}"
|
||||
enabled: true
|
||||
state: started
|
||||
loop:
|
||||
- nfs-server.service
|
||||
- smb.service
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
when: atlas_manage_sharing | bool
|
||||
|
||||
- name: Gather effective Atlas firewalld zone configuration
|
||||
tags: [atlas, sharing, services, security]
|
||||
ansible.posix.firewalld_info:
|
||||
zones:
|
||||
- "{{ atlas_firewalld_zone }}"
|
||||
register: atlas_firewalld_info
|
||||
when:
|
||||
- atlas_manage_firewall | bool
|
||||
- not ansible_check_mode
|
||||
|
||||
- name: Verify effective Atlas firewalld restrictions
|
||||
tags: [atlas, sharing, services, security]
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- atlas_firewalld_zone in atlas_firewalld_info.firewalld_info.zones
|
||||
- >-
|
||||
ansible_facts.default_ipv4.interface
|
||||
in atlas_firewalld_info.firewalld_info.zones[atlas_firewalld_zone].interfaces
|
||||
- >-
|
||||
atlas_firewalld_restricted_services
|
||||
| intersect(atlas_firewalld_info.firewalld_info.zones[atlas_firewalld_zone].services)
|
||||
| length == 0
|
||||
fail_msg: >-
|
||||
The effective Atlas firewalld zone does not restrict the primary LAN
|
||||
interface and unmanaged service exposure as declared.
|
||||
when:
|
||||
- atlas_manage_firewall | bool
|
||||
- not ansible_check_mode
|
||||
|
||||
- name: Apply pending Atlas sharing handlers before verification
|
||||
tags: [atlas, sharing, services, security]
|
||||
ansible.builtin.meta: flush_handlers
|
||||
when:
|
||||
- atlas_manage_sharing | bool
|
||||
- not ansible_check_mode
|
||||
|
||||
- name: Check active Atlas file-sharing services
|
||||
tags: [atlas, sharing, services, security]
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- systemctl
|
||||
- is-active
|
||||
- --quiet
|
||||
- "{{ item }}"
|
||||
loop:
|
||||
- nfs-server.service
|
||||
- smb.service
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
register: atlas_file_sharing_service_activity
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
when:
|
||||
- atlas_manage_sharing | bool
|
||||
- not ansible_check_mode
|
||||
|
||||
- name: Require active Atlas file-sharing services
|
||||
tags: [atlas, sharing, services, security]
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- atlas_file_sharing_service_activity.results | map(attribute='rc') | list == [0, 0]
|
||||
fail_msg: Atlas NFSv4 or SMB3 did not start after its managed configuration was applied.
|
||||
when:
|
||||
- atlas_manage_sharing | bool
|
||||
- not ansible_check_mode
|
||||
|
||||
- name: Require Atlas file-sharing TCP listeners
|
||||
tags: [atlas, sharing, services, security]
|
||||
ansible.builtin.wait_for:
|
||||
host: 127.0.0.1
|
||||
port: "{{ item }}"
|
||||
state: started
|
||||
timeout: 15
|
||||
loop:
|
||||
- 2049
|
||||
- 445
|
||||
loop_control:
|
||||
label: "{{ item }}/tcp"
|
||||
when:
|
||||
- atlas_manage_sharing | bool
|
||||
- not ansible_check_mode
|
||||
|
||||
Reference in New Issue
Block a user