Hotfix/duckdns token (#8)

* fix: source DuckDNS token from Vault

* chore: rotate DuckDNS Vault token

ansible/roles/profile_server/tasks/duckdns.yml

@@ -0,0 +1,33 @@
+---
+- name: Require DuckDNS domain and Vault token before deployment
+  ansible.builtin.assert:
+    that:
+      - >-
+        server_duckdns_domain | default('') is
+        regex('[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?', match_type='fullmatch')
+      - >-
+        vault_duckdns_token | default('') is
+        regex('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}', match_type='fullmatch')
+    fail_msg: >-
+      Define server_duckdns_domain in host_vars and the rotated vault_duckdns_token
+      in encrypted Vault or an untracked local vars file before deploying DuckDNS.
+  no_log: true
+
+- name: Ensure private DuckDNS directory exists
+  ansible.builtin.file:
+    path: "{{ server_user_home }}/duckdns"
+    state: directory
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0700"
+
+- name: Render DuckDNS updater with the Vault token
+  ansible.builtin.template:
+    src: duck.sh.j2
+    dest: "{{ server_user_home }}/duckdns/duck.sh"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0700"
+    validate: /bin/sh -n %s
+  no_log: true
+  diff: false

ansible/roles/profile_server/tasks/main.yml

@@ -18,6 +18,10 @@
       Server container secrets are missing. Define vault_navidrome_db_password and
       vault_postgres_root_password in secrets/vault.yml or another vars source.
 
+- name: Configure DuckDNS updater
+  tags: [dotfiles, dotfiles:server, duckdns]
+  ansible.builtin.import_tasks: duckdns.yml
+
 - name: Ensure server directories exist
   tags: [dotfiles, services]
   ansible.builtin.file:

ansible/roles/profile_server/templates/duck.sh.j2

@@ -0,0 +1,24 @@
+#!/bin/sh
+# Managed by Ansible. Contains a Vault token; never copy this file into Git.
+set -eu
+umask 077
+
+log_file={{ (server_user_home ~ '/duckdns/duck.log') | quote }}
+
+# Keep the token out of process arguments and verify the HTTPS certificate.
+if ! response=$(curl --fail --silent --show-error --connect-timeout 10 --max-time 30 --config - <<'DUCKDNS_CONFIG'
+url = "https://www.duckdns.org/update?domains={{ server_duckdns_domain }}&token={{ vault_duckdns_token }}&ip="
+DUCKDNS_CONFIG
+); then
+  printf 'ERROR\n' > "$log_file"
+  exit 1
+fi
+
+case "$response" in
+  OK) printf 'OK\n' > "$log_file" ;;
+  *)
+    printf 'KO\n' > "$log_file"
+    printf 'DuckDNS update failed.\n' >&2
+    exit 1
+    ;;
+esac