Feature/aegis coreos (#7)

* feat(aegis): add ARM image bootstrap workflow

* feat(aegis): manage firewall and SSH hardening

* feat(aegis): harden Fedora IoT services

* chore(aegis): remove local TLS configuration

* fix(aegis): restore supported Fedora IoT bootstrap

AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora CoreOS, WSL, and servers.
+Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora IoT, WSL, and servers.
 
 ## Source Of Truth
 - Main orchestration: `ansible/site.yml`
@@ -17,7 +17,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
 - Workstation: `deadalus` is Windows + Fedora WSL.
 - Ubuntu server: `prometheus`
 - NAS: `atlas` (Rocky Linux 9, reached through SSH)
-- Always-on LAN node: `aegis` (Fedora CoreOS on Raspberry Pi 4, reached through SSH)
+- Always-on LAN node: `aegis` (Fedora IoT on Raspberry Pi 4, reached through SSH)
 - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions.
 - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents.
 
@@ -46,7 +46,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
   - WSL workstation dev: `ansible-playbook ansible/site.yml --limit deadalus --check --diff`
   - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff`
   - Atlas NAS: `ansible-playbook ansible/site.yml --limit atlas --check --diff`
-  - Aegis CoreOS: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
+  - Aegis IoT: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
 - Focused checks:
   - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit <host> --tags emacs --check --diff -e emacs_enabled=true`
   - AI coding agents: `ansible-playbook ansible/site.yml --limit <host> --tags ai_agents --check --diff`
@@ -154,12 +154,18 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - If you add a new operational area, also add the narrowest validation command for it.
 - Call out checks you could not run and any follow-up verification needed.
 
-## Aegis Fedora CoreOS Notes
-- `aegis` is a remote Fedora CoreOS Raspberry Pi 4 node. Bootstrap it once with
+## Aegis Fedora IoT Notes
+- `aegis` is a remote Fedora IoT Raspberry Pi 4 node. Bootstrap it once with
   `ansible/bootstrap/aegis.bu`; the remaining configuration is applied by `profile_aegis` over SSH.
-- Fedora CoreOS is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
-- `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, and the
-  Podman auto-update timer. Keep Apple IDs and other credentials in Vault and use `no_log` for their
-  rendering.
+- Fedora IoT is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
+- `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, the
+  Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep
+  `aegis_lan_subnet` and `aegis_adguard_web_port` host-specific; SSH permits only the declared
+  key-authenticated users, never root or password authentication. Keep Apple IDs and other
+  credentials in Vault and use `no_log` for their rendering.
+- `aegis_adguard_web_port` defaults to `80`. The initial AdGuard Home wizard port `3000` is intentionally unmanaged: open and close it manually only while
+  completing initial setup. Disable the local systemd-resolved stub through `profile_aegis` before
+  AdGuard binds port 53; keep
+  `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf` so Aegis retains router-provided DNS.
 - iCloudPD requires post-deployment interactive MFA initialization; its cookie/configuration state is
   persisted in `/var/lib/icloudpd/config`.

README.md

@@ -36,7 +36,7 @@ infra/
 
 ## Managed machines
 
-The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora CoreOS LAN
+The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora IoT LAN
 node, an Ubuntu server, and a Rocky Linux 9 NAS. Configuration is layered instead of being tied to
 host names:
 
@@ -53,7 +53,7 @@ common user environment
 | `ikaros` | Fedora | Personal workstation | GNOME |
 | `nymph` | Fedora | Desktop laptop | GNOME |
 | `deadalus` | Fedora WSL | Development workstation | — |
-| `aegis` | Fedora CoreOS | Always-on LAN node | — |
+| `aegis` | Fedora IoT | Always-on LAN node | — |
 | `prometheus` | Ubuntu | Server | — |
 | `atlas` | Rocky 9 | NAS | — |
 
@@ -116,22 +116,32 @@ ansible-playbook ansible/site.yml --limit prometheus \
 
 ## Aegis
 
-`aegis` is a Raspberry Pi 4 running Fedora CoreOS. Provision it once with
-`ansible/bootstrap/aegis.bu`, after replacing the SSH public-key placeholder:
+`aegis` is a Raspberry Pi 4 running Fedora IoT. Generate Ignition from
+`ansible/bootstrap/aegis.bu` with the included Podman/Butane helper, then write the SD card with
+`arm-image-installer`:
 
 ```bash
-butane --strict --pretty --output aegis.ign ansible/bootstrap/aegis.bu
+ansible/bootstrap/generate-aegis-ign.sh --write IMAGE DEVICE
 ```
 
-The `pi` user receives the configured SSH key, and partition 5 on `/dev/mmcblk0` is formatted as
-Btrfs and mounted as the root filesystem (`/`) on first boot. Formatting is destructive for that
-partition.
-
-The controller then manages it remotely as `pi@aegis`; unlike local desktop profiles, Aegis is
+The controller manages it remotely as `pi@aegis`; unlike local desktop profiles, Aegis is
 intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Quadlets for AdGuard
-Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, and
-`wake-ikaros`. Define `vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still
-requires interactive MFA initialization after its first deployment.
+Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, LAN-restricted
+firewalld rules, SSH key-only access for `pi`, and `wake-ikaros`. Set the host-local
+`aegis_lan_subnet` and `aegis_adguard_web_port` values before applying it. The playbook permits
+AdGuard Home HTTP on port `80`; the initial wizard port `3000` is intentionally unmanaged and must be
+opened and closed manually during initial setup. The profile disables the local systemd-resolved DNS
+stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53
+for AdGuard while retaining DNS learned from the router. Define
+`vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still requires interactive MFA
+initialization after its first deployment.
+
+Validate the profile before deployment:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit aegis --check --diff --ask-become-pass
+```
 
 ## NAS
 
@@ -243,7 +253,7 @@ ansible-playbook ansible/site.yml --limit deadalus --tags ai_agents --check --di
 | `profile_workstation_dev_wsl` | WSL development setup. |
 | `profile_server` | Server setup. |
 | `profile_atlas` | Rocky Linux 9 NAS setup. |
-| `profile_aegis` | Fedora CoreOS always-on LAN node. |
+| `profile_aegis` | Fedora IoT always-on LAN node. |
 | `dotfiles_common` | Shared user dotfiles. |
 
 ## What `site.yml` runs
@@ -269,7 +279,7 @@ So, in practice:
 - `deadalus` gets the Fedora development layer followed by the WSL layer.
 - `ubuntu_server` configures `prometheus`.
 - `atlas` receives the Rocky platform layer and the NAS profile through SSH.
-- `aegis` receives only the immutable Fedora CoreOS profile through SSH; it does not receive
+- `aegis` receives only the immutable Fedora IoT profile through SSH; it does not receive
   mutable Fedora package or common dotfile roles.
 - Empty `platform_void` groups do nothing until they get a host.
 - The playbook never restarts the display manager during a run.

ansible/bootstrap/aegis.bu

@@ -1,32 +1,55 @@
-# Bootstrap monouso per Fedora CoreOS su Aegis.
-# Sostituire le chiavi SSH prima di generare Ignition con butane --strict.
-variant: fcos
-version: 1.6.0
+# One-time bootstrap for Fedora IoT on Aegis (Raspberry Pi 4).
+# Generate only: ./generate-aegis-ign.sh
+# Generate and write an SD card: ./generate-aegis-ign.sh --write IMAGE DEVICE
+# The write mode uses arm-image-installer with the RPi4 target and embeds
+# config.ign; it prompts for Wi-Fi credentials unless supplied through its
+# WIFI_SSID and WIFI_PASS environment variables.
+# For WiFi, the UEFI 'System Table Selection' must be DeviceTree (Esc at boot).
+variant: fiot
+version: 1.0.0
 passwd:
   users:
     - name: pi
+      password_hash: "$6$bNDsU0XC5BxNJS5U$ENDGpdOUPJM3wcXBgNESCQkOqqQ9gN72/xEQoJsAI6QdsaY6mD4G5DBVIv7nHwHQOP35IH1oGRl.Uy3R2iUYQ1"
+      groups:
+        - wheel
       ssh_authorized_keys:
-        - "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY"
+        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+systemd:
+  units:
+    - name: sshd.service
+      enabled: true
+    - name: rpm-ostree-install-wifi.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Layer WiFi packages (driver, firmware, NetworkManager-wifi)
+        Wants=network-online.target
+        After=network-online.target
+        Before=zincati.service
+        ConditionPathExists=!/var/lib/%N.stamp
+
+        [Service]
+        Type=oneshot
+        RemainAfterExit=yes
+        ExecStart=/usr/bin/rpm-ostree install -y --allow-inactive NetworkManager-wifi NetworkManager-wwan wpa_supplicant wireless-regdb iw brcmfmac-firmware
+        ExecStart=/bin/touch /var/lib/%N.stamp
+        ExecStart=/bin/systemctl --no-block reboot
+
+        [Install]
+        WantedBy=multi-user.target
 storage:
-  disks:
-    - device: /dev/mmcblk0
-      wipe_table: false
-      partitions:
-        - label: aegis-data
-          number: 5
-          size_mib: 0
-  filesystems:
-    - device: /dev/disk/by-partlabel/aegis-data
-      format: btrfs
-      label: aegis-data
-      wipe_filesystem: false
-      mount:
-        path: /
-        options:
-          - compress=zstd
   files:
     - path: /etc/hostname
       mode: 0644
       contents:
         inline: |
           aegis
+    - path: /etc/sysctl.d/99-ip-forward.conf
+      mode: 0644
+      contents:
+        inline: |
+          net.ipv4.ip_forward = 1
+  links:
+    - path: /etc/localtime
+      target: ../usr/share/zoneinfo/Europe/Rome

ansible/bootstrap/generate-aegis-ign.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env sh
+
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname "$0")" && pwd)
+BUTANE_IMAGE=${BUTANE_IMAGE:-quay.io/coreos/butane:release}
+BUTANE_SOURCE=${BUTANE_SOURCE:-"$SCRIPT_DIR/aegis.bu"}
+IGNITION_OUTPUT=${IGNITION_OUTPUT:-"$SCRIPT_DIR/config.ign"}
+SSH_PUBLIC_KEY=${SSH_PUBLIC_KEY:-"$HOME/.ssh/id_ed25519.pub"}
+WIFI_SECURITY=${WIFI_SECURITY:-wpa-psk}
+
+usage() {
+  cat <<'USAGE'
+Usage:
+  generate-aegis-ign.sh
+  generate-aegis-ign.sh --write IMAGE DEVICE
+
+Environment overrides:
+  BUTANE_IMAGE       Butane container image (default: quay.io/coreos/butane:release)
+  BUTANE_SOURCE      Butane source path (default: aegis.bu beside this script)
+  IGNITION_OUTPUT    Ignition output path (default: config.ign beside this script)
+  SSH_PUBLIC_KEY     SSH public key passed to arm-image-installer
+  WIFI_SSID          Wi-Fi SSID; prompted if unset in --write mode
+  WIFI_PASS          Wi-Fi password; prompted if unset in --write mode
+  WIFI_SECURITY      Wi-Fi security type (default: wpa-psk)
+USAGE
+}
+
+require_command() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    printf 'Error: required command not found: %s\n' "$1" >&2
+    exit 1
+  fi
+}
+
+read_required() {
+  prompt=$1
+  value=$2
+
+  if [ -z "$value" ]; then
+    printf '%s' "$prompt" >&2
+    IFS= read -r value
+  fi
+
+  if [ -z "$value" ]; then
+    printf '%s\n' 'Error: a value is required.' >&2
+    exit 1
+  fi
+
+  printf '%s' "$value"
+}
+
+read_secret() {
+  value=$1
+
+  if [ -z "$value" ]; then
+    printf '%s' 'Wi-Fi password: ' >&2
+    stty -echo
+    IFS= read -r value
+    stty echo
+    printf '\n' >&2
+  fi
+
+  if [ -z "$value" ]; then
+    printf '%s\n' 'Error: a value is required.' >&2
+    exit 1
+  fi
+
+  printf '%s' "$value"
+}
+
+write_image=false
+case $# in
+  0)
+    ;;
+  3)
+    if [ "$1" != '--write' ]; then
+      usage >&2
+      exit 2
+    fi
+    write_image=true
+    IMAGE=$2
+    DEVICE=$3
+    ;;
+  *)
+    usage >&2
+    exit 2
+    ;;
+esac
+
+require_command podman
+
+if [ ! -f "$BUTANE_SOURCE" ]; then
+  printf 'Error: Butane source not found: %s\n' "$BUTANE_SOURCE" >&2
+  exit 1
+fi
+
+OUTPUT_DIR=$(dirname "$IGNITION_OUTPUT")
+if [ ! -d "$OUTPUT_DIR" ]; then
+  printf 'Error: output directory not found: %s\n' "$OUTPUT_DIR" >&2
+  exit 1
+fi
+
+umask 077
+TEMP_OUTPUT=$(mktemp "$OUTPUT_DIR/.config.ign.XXXXXX")
+trap 'rm -f "$TEMP_OUTPUT"' EXIT HUP INT TERM
+
+podman run --rm -i "$BUTANE_IMAGE" --strict < "$BUTANE_SOURCE" > "$TEMP_OUTPUT"
+mv "$TEMP_OUTPUT" "$IGNITION_OUTPUT"
+trap - EXIT HUP INT TERM
+
+printf 'Generated Ignition config: %s\n' "$IGNITION_OUTPUT"
+
+if [ "$write_image" = false ]; then
+  exit 0
+fi
+
+if [ ! -f "$IMAGE" ]; then
+  printf 'Error: image not found: %s\n' "$IMAGE" >&2
+  exit 1
+fi
+
+if [ ! -b "$DEVICE" ]; then
+  printf 'Error: target is not a block device: %s\n' "$DEVICE" >&2
+  exit 1
+fi
+
+if [ ! -f "$SSH_PUBLIC_KEY" ]; then
+  printf 'Error: SSH public key not found: %s\n' "$SSH_PUBLIC_KEY" >&2
+  exit 1
+fi
+
+require_command arm-image-installer
+WIFI_SSID=$(read_required 'Wi-Fi SSID: ' "${WIFI_SSID:-}")
+WIFI_PASS=$(read_secret "${WIFI_PASS:-}")
+
+printf 'Writing %s to %s.\n' "$IMAGE" "$DEVICE" >&2
+sudo arm-image-installer \
+  --image="$IMAGE" \
+  --target=rpi4 \
+  --media="$DEVICE" \
+  --ignition="$IGNITION_OUTPUT" \
+  --addkey="$SSH_PUBLIC_KEY" \
+  --resizefs \
+  --wifi-ssid="$WIFI_SSID" \
+  --wifi-pass="$WIFI_PASS" \
+  --wifi-security="$WIFI_SECURITY"

ansible/inventory/group_vars/desktop_gnome.yml

@@ -11,6 +11,7 @@ fedora_desktop_packages:
   # Fedora equivalents of the development/tooling packages previously pulled by
   # the Void desktop profile.
   - 7zip
+  - arm-image-installer
   - nodejs-bash-language-server
   - bluez
   - bridge-utils

ansible/inventory/group_vars/platform_fedora_coreos.yml

@@ -1,2 +0,0 @@
----
-# Fedora CoreOS is immutable: do not attach the mutable Fedora package roles.

ansible/inventory/group_vars/platform_fedora_iot.yml

@@ -0,0 +1,2 @@
+---
+# Fedora IoT is immutable: do not attach the mutable Fedora package roles.

ansible/inventory/host_vars/aegis.yml

@@ -4,5 +4,10 @@ ansible_connection: ssh
 ansible_user: pi
 ansible_become: true
 ansible_python_interpreter: /usr/bin/python3
+# Avoid PTY framing around module JSON on this remote Fedora IoT host.
+ansible_ssh_use_tty: false
+
+aegis_lan_subnet: 192.168.178.0/24
+aegis_adguard_web_port: 80
 
 aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}"

ansible/inventory/hosts.yml

@@ -13,7 +13,7 @@ all:
         deadalus:
           ansible_connection: local
 
-    platform_fedora_coreos:
+    platform_fedora_iot:
       hosts:
         aegis:
 
@@ -28,7 +28,7 @@ all:
     fedora:
       children:
         platform_fedora:
-        platform_fedora_coreos:
+        platform_fedora_iot:
 
     rocky:
       children:

ansible/roles/profile_aegis/defaults/main.yml

@@ -7,3 +7,10 @@ aegis_icloudpd_synchronisation_interval: 86400
 aegis_icloudpd_apple_id: ""
 aegis_ikaros_mac_address: aa:bb:cc:dd:ee:ff
 aegis_wol_port: 9
+
+aegis_lan_subnet: CHANGEME_LAN_SUBNET
+aegis_firewalld_zone: public
+aegis_adguard_web_port: 80
+aegis_ssh_allowed_users:
+  - pi
+aegis_ssh_user_home: "/var/home/{{ ansible_user }}"

ansible/roles/profile_aegis/handlers/main.yml

@@ -1,4 +1,14 @@
 ---
+- name: Restart Aegis systemd-resolved
+  ansible.builtin.systemd:
+    name: systemd-resolved.service
+    state: restarted
+
+- name: Reload Aegis SSH
+  ansible.builtin.systemd:
+    name: sshd.service
+    state: reloaded
+
 - name: Restart Aegis Quadlet services
   ansible.builtin.systemd:
     name: "{{ item }}"

ansible/roles/profile_aegis/tasks/main.yml

@@ -7,6 +7,17 @@
     fail_msg: Define vault_aegis_icloudpd_apple_id before applying the Aegis profile.
   no_log: true
 
+- name: Require completed Aegis network placeholders
+  tags: [aegis, firewall, services]
+  ansible.builtin.assert:
+    that:
+      - aegis_lan_subnet != 'CHANGEME_LAN_SUBNET'
+      - aegis_firewalld_zone | length > 0
+      - aegis_adguard_web_port | int > 0
+      - aegis_adguard_web_port | int < 65536
+      - aegis_ssh_allowed_users | length > 0
+    fail_msg: Define the Aegis LAN subnet, firewalld zone, AdGuard web port, and SSH users.
+
 - name: Set Aegis hostname
   tags: [aegis, services]
   ansible.builtin.hostname:
@@ -53,6 +64,185 @@
   no_log: "{{ item.dest == 'icloudpd.container' }}"
   notify: Restart Aegis Quadlet services
 
+- name: Create Aegis systemd-resolved configuration directory
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    path: /etc/systemd/resolved.conf.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Disable Aegis systemd-resolved DNS stub listener
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.template:
+    src: 10-adguard-dns.conf.j2
+    dest: /etc/systemd/resolved.conf.d/10-adguard-dns.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart Aegis systemd-resolved
+    - Restart Aegis Quadlet services
+
+- name: Point Aegis resolver at the full systemd-resolved configuration
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    src: ../run/systemd/resolve/resolv.conf
+    dest: /etc/resolv.conf
+    state: link
+    force: true
+  notify: Restart Aegis systemd-resolved
+
+- name: Enable Aegis firewalld
+  tags: [aegis, firewall, services]
+  ansible.builtin.systemd:
+    name: firewalld.service
+    enabled: true
+    state: started
+
+- name: Render Aegis AdGuard web firewalld service
+  tags: [aegis, firewall]
+  ansible.builtin.template:
+    src: aegis-adguard-web.xml.j2
+    dest: /etc/firewalld/services/aegis-adguard-web.xml
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Reload firewalld custom services
+  tags: [aegis, firewall]
+  ansible.builtin.command:
+    argv:
+      - firewall-cmd
+      - --reload
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Remove unrestricted Aegis services from firewalld zone
+  tags: [aegis, firewall]
+  ansible.posix.firewalld:
+    service: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: disabled
+    zone: "{{ aegis_firewalld_zone }}"
+  loop:
+    - ssh
+    - dns
+    - http
+    - aegis-adguard-web
+  loop_control:
+    label: "{{ item }}"
+
+- name: Remove retired Aegis TLS access rule
+  tags: [aegis, firewall]
+  ansible.posix.firewalld:
+    rich_rule: 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" port port="853" protocol="tcp" accept'
+    permanent: true
+    immediate: true
+    state: disabled
+    zone: "{{ aegis_firewalld_zone }}"
+
+- name: Allow Aegis services from the LAN only
+  tags: [aegis, firewall]
+  ansible.posix.firewalld:
+    rich_rule: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+    zone: "{{ aegis_firewalld_zone }}"
+  loop:
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="ssh" accept'
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="dns" accept'
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="aegis-adguard-web" accept'
+  loop_control:
+    label: "{{ item }}"
+
+- name: Check the standard Aegis SSH authorized keys file
+  tags: [aegis, ssh, services]
+  ansible.builtin.stat:
+    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys"
+  register: aegis_authorized_keys
+
+- name: Find Aegis SSH authorized key fragments
+  tags: [aegis, ssh, services]
+  ansible.builtin.find:
+    paths: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d"
+    file_type: file
+    recurse: false
+  register: aegis_authorized_key_fragments
+
+- name: Require an Aegis SSH authorized key before hardening
+  tags: [aegis, ssh, services]
+  ansible.builtin.assert:
+    that:
+      - >-
+        (aegis_authorized_keys.stat.exists and aegis_authorized_keys.stat.size | int > 0)
+        or aegis_authorized_key_fragments.matched | int > 0
+    fail_msg: Add a public key for the Ansible SSH user before disabling password authentication.
+
+- name: Ensure Aegis SSH configuration drop-in directory exists
+  tags: [aegis, ssh, services]
+  ansible.builtin.file:
+    path: /etc/ssh/sshd_config.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Ensure Aegis SSH drop-ins are loaded before other settings
+  tags: [aegis, ssh, services]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*Include\s+/etc/ssh/sshd_config\.d/\*\.conf\s*$'
+    line: Include /etc/ssh/sshd_config.d/*.conf
+    insertbefore: BOF
+    state: present
+    validate: "sshd -t -f %s"
+
+- name: Render Aegis SSH hardening drop-in
+  tags: [aegis, ssh, services]
+  ansible.builtin.template:
+    src: 00-aegis-hardening.conf.j2
+    dest: /etc/ssh/sshd_config.d/00-aegis-hardening.conf
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Reload Aegis SSH
+
+- name: Validate Aegis SSH configuration
+  tags: [aegis, ssh, services]
+  ansible.builtin.command:
+    argv:
+      - sshd
+      - -t
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Read effective Aegis SSH daemon configuration
+  tags: [aegis, ssh, services]
+  ansible.builtin.command:
+    argv:
+      - sshd
+      - -T
+      - -C
+      - "user={{ ansible_user }},host={{ aegis_hostname }},addr=127.0.0.1"
+  register: aegis_sshd_effective_configuration
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Verify effective Aegis SSH hardening
+  tags: [aegis, ssh, services]
+  ansible.builtin.assert:
+    that:
+      - "'permitrootlogin no' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'pubkeyauthentication yes' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'passwordauthentication no' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'kbdinteractiveauthentication no' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'allowusers ' + (aegis_ssh_allowed_users | join(' ')) in aegis_sshd_effective_configuration.stdout_lines"
+  when: not ansible_check_mode
+
 - name: Install Wake-on-LAN helper for Ikaros
   tags: [aegis, wol]
   ansible.builtin.template:

ansible/roles/profile_aegis/templates/00-aegis-hardening.conf.j2

@@ -0,0 +1,6 @@
+# Managed by Ansible. Do not edit manually.
+PermitRootLogin no
+PubkeyAuthentication yes
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+AllowUsers {{ aegis_ssh_allowed_users | join(' ') }}

ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2

@@ -0,0 +1,3 @@
+# Managed by Ansible. Do not edit manually.
+[Resolve]
+DNSStubListener=no

ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<service>
+  <short>Aegis AdGuard Home web interface</short>
+  <description>AdGuard Home administrative web interface on Aegis.</description>
+  <port protocol="tcp" port="{{ aegis_adguard_web_port }}"/>
+</service>

ansible/site.yml

@@ -35,7 +35,7 @@
     - role: dotfiles_common
       when:
         - "'platform_rocky' not in group_names"
-        - "'platform_fedora_coreos' not in group_names"
+        - "'platform_fedora_iot' not in group_names"
 
 - name: Configure Void platform
   hosts: platform_void
@@ -71,7 +71,7 @@
     - packages_rocky
     - services_systemd
 
-- name: Configure Aegis Fedora CoreOS profile
+- name: Configure Aegis Fedora IoT profile
   hosts: role_aegis
   become: true
 

secrets/vault.yml

@@ -1,37 +1,40 @@
 $ANSIBLE_VAULT;1.1;AES256
-36346638633530653262306466326434346237313965643039643837623233313037363163346338
-3165386461353334393464616362333033613231313865340a313731623439626633303566333239
-63363166666663376365613034643663373937613162643935366333313438373365346539663161
-6663343762336130350a306336613962353931306230363564626538346163623936363064383964
-61333734633635326630383339306539643537316665666666643533333364613030613265313032
-62643363383464303836376266633962313666396630313361303039343133316237643164616666
-30376433323330363033643231643861383234336362383432633665313566336537633631303133
-66656363613165333666383432623435626339666364643936653037663839643262393664653564
-37373465373663376537616532656434316435623734656265363536336333633537626435303635
-65623036613631386464646335653862396232326163623130396133643935363135393934333638
-37626664353131613336353130366566383238623031636366333036643161626564613965613233
-63336138393161306565623466383763663664323864633430626561313939336434363462656361
-33343433636562653138613233343030333362383661633536616564313662353231343966386466
-63633032643432343337303131656465373039646235653335353239633865353533626632336366
-32386430623035626533346463333230663735353632356530643635386336393235646461303064
-37316265613233303537373631613265636435343631363930323234366332613966346262336531
-36646566393036636363333733613433353561363639616139626331336234353334303739643061
-32333062383164373435666166386263663438666364636239383731313863386361363035313333
-30656363306565623035303462363637353839343665393934613733613532313237613134313466
-61336335616631666430393364363864306632663462393733656539386431313864333265393265
-33626630643863306632363835353238376631626335313566666264343664656136316337376432
-36653534336232303361663966663366343637663432316533643766636339313339643430336531
-34303430336333663364306432363461326465396533376263336131323639393737666632623363
-36656438616230663566633061383135633937613530346636396630656135663639396235373965
-31396536376666333839336166653734303362633263643039353838393431393463303337313263
-62653036346666393930646536653235326566303465333666646534643935663734643063613762
-63336334646336343537386133383138363932616662376131393530633565353935613566306563
-30643338613065393731623534656431373235353837383963383262323939343061326531303536
-38303731633265376334393465656334353265656633336231326636636339626461616533323533
-39326663336431353633313265353736356435393761613163386665623865346132333537666336
-32366564363739386339343835393966623161656165643232643535616536633762666530623466
-63636336386563373032663939373237383639623938616336653235663430613863616537326666
-65346464326138646435353033303831383732623133393666663533303564613835323334333632
-65366138613266313261646134303165333265366134373362333433653734653038646538363566
-31373137643331373734353038643833333966663161633561653533333338353230393838336434
-35346533356463666466
+65623833316230316230376465656261383230643661393032396462643232383334383236653134
+3964353234623165633736303035623132643565393461660a323930623462323635613361373836
+37613164656538353734333932326136303532346161663238613466616236636432346534626331
+3434663266366637650a336235363033333562626135333962626265666332386261643666306638
+64343262353661346435326662633833656533643464653665356233316466333432303536356539
+32623430303663616261386636613534326231613366636536303761646335396132623231336361
+61656337313766353533643266396230626439353033373630666336616230316362616135323462
+30306633373234386639633932393437323931613739383135353835393630623937636639343338
+35636530643330376538393262383738333735656230363633383463386366343065633961663562
+37653264326565376166666262643136616333656233386564333030663532353836306131316530
+62633738306434303236623239646638613230323434393761656265393064373235333435393264
+36363936336330636433643133346164643733356239616530653831626165316238643834356236
+36333262313764653137633930663131306132306434376433306230306564366633363738313634
+35316230623134623932396132316530366662643366643439643334366233646334633764346266
+35373764633138343235323931346134613265356238616138323134326338633335336339313862
+61653939366263386431636334333661306538643166353661336561396365366434353830643465
+31626136626336633363653531363064643534396336623331363130313966653966373636663232
+65653132363139653239383636333861323435613362666637366162323062376139633033373563
+66656134313931313965303134613836383534636438363936353836326639346565653031363839
+63623738366261363734376536646532396231616233303061363364383238616434333366613933
+63616539613336393863633361303466353738313666393164343638373530376666663666666235
+33666234353736633335343639623664326566333162333539636235346663663737366432366665
+66373831303666666533343234373466333132343135326261663532663062313939623963383437
+34653732653830313638343631313437623931623531323566306232373165636662316633333438
+66666537623966623932323463323330316337613637383339613637653637333832623965636434
+34653330336663323263353636353139323337646166623862343565646637616136646232373633
+33356134373464646664303865353763323531383661323930353038646333386366353665396431
+64303739643735376235626134663566343165646433393966373961393738323036353437346436
+66656166306561353637623462303039393465363261343164393062643130383736623261383232
+38623036626464613138363635646233323737653137633830316138663835656633336663626338
+33386232633862616432396662343738343462623263303337393533313264396637356134373739
+61323266623665353631316461633462646536386266343934356235363065653162363566623661
+35643332303333306362303538333034316461326363653632313765396664643533373862333533
+37306536356465393933366238663031653630386239383839316365323761316236326330306637
+36373434643864343064646437323736393330326361663231373933613864303339653661616139
+36356134636136333830663031656132656237383331663362313238653133366538323462376632
+63373766383939656265313934636462626633376162623931333363393837303336363036303439
+32643730383735383535633439326564376261343937343934366366373039653761383934316162
+383035326562353431616536646238323164