From ae1ca44aa758a50343c264ae0d342e624502179a Mon Sep 17 00:00:00 2001 From: Fabio Scotto di Santolo Date: Sat, 5 Sep 2026 16:58:53 +0200 Subject: [PATCH] Feature/aegis coreos (#7) * feat(aegis): add ARM image bootstrap workflow * feat(aegis): manage firewall and SSH hardening * feat(aegis): harden Fedora IoT services * chore(aegis): remove local TLS configuration * fix(aegis): restore supported Fedora IoT bootstrap --- AGENTS.md | 24 ++- README.md | 40 ++-- ansible/bootstrap/aegis.bu | 65 ++++-- ansible/bootstrap/generate-aegis-ign.sh | 147 ++++++++++++++ .../inventory/group_vars/desktop_gnome.yml | 1 + .../group_vars/platform_fedora_coreos.yml | 2 - .../group_vars/platform_fedora_iot.yml | 2 + ansible/inventory/host_vars/aegis.yml | 5 + ansible/inventory/hosts.yml | 4 +- ansible/roles/profile_aegis/defaults/main.yml | 7 + ansible/roles/profile_aegis/handlers/main.yml | 10 + ansible/roles/profile_aegis/tasks/main.yml | 190 ++++++++++++++++++ .../templates/00-aegis-hardening.conf.j2 | 6 + .../templates/10-adguard-dns.conf.j2 | 3 + .../templates/aegis-adguard-web.xml.j2 | 6 + ansible/site.yml | 4 +- secrets/vault.yml | 75 +++---- 17 files changed, 504 insertions(+), 87 deletions(-) create mode 100755 ansible/bootstrap/generate-aegis-ign.sh delete mode 100644 ansible/inventory/group_vars/platform_fedora_coreos.yml create mode 100644 ansible/inventory/group_vars/platform_fedora_iot.yml create mode 100644 ansible/roles/profile_aegis/templates/00-aegis-hardening.conf.j2 create mode 100644 ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2 create mode 100644 ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2 diff --git a/AGENTS.md b/AGENTS.md index 49bf2ad..b44f523 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,6 +1,6 @@ # AGENTS.md -Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora CoreOS, WSL, and servers. +Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora IoT, WSL, and servers. ## Source Of Truth - Main orchestration: `ansible/site.yml` @@ -17,7 +17,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora - Workstation: `deadalus` is Windows + Fedora WSL. - Ubuntu server: `prometheus` - NAS: `atlas` (Rocky Linux 9, reached through SSH) -- Always-on LAN node: `aegis` (Fedora CoreOS on Raspberry Pi 4, reached through SSH) +- Always-on LAN node: `aegis` (Fedora IoT on Raspberry Pi 4, reached through SSH) - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions. - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents. @@ -46,7 +46,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora - WSL workstation dev: `ansible-playbook ansible/site.yml --limit deadalus --check --diff` - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff` - Atlas NAS: `ansible-playbook ansible/site.yml --limit atlas --check --diff` - - Aegis CoreOS: `ansible-playbook ansible/site.yml --limit aegis --check --diff` + - Aegis IoT: `ansible-playbook ansible/site.yml --limit aegis --check --diff` - Focused checks: - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit --tags emacs --check --diff -e emacs_enabled=true` - AI coding agents: `ansible-playbook ansible/site.yml --limit --tags ai_agents --check --diff` @@ -154,12 +154,18 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i - If you add a new operational area, also add the narrowest validation command for it. - Call out checks you could not run and any follow-up verification needed. -## Aegis Fedora CoreOS Notes -- `aegis` is a remote Fedora CoreOS Raspberry Pi 4 node. Bootstrap it once with +## Aegis Fedora IoT Notes +- `aegis` is a remote Fedora IoT Raspberry Pi 4 node. Bootstrap it once with `ansible/bootstrap/aegis.bu`; the remaining configuration is applied by `profile_aegis` over SSH. -- Fedora CoreOS is immutable. Do not add it to mutable Fedora package or shared dotfile roles. -- `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, and the - Podman auto-update timer. Keep Apple IDs and other credentials in Vault and use `no_log` for their - rendering. +- Fedora IoT is immutable. Do not add it to mutable Fedora package or shared dotfile roles. +- `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, the + Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep + `aegis_lan_subnet` and `aegis_adguard_web_port` host-specific; SSH permits only the declared + key-authenticated users, never root or password authentication. Keep Apple IDs and other + credentials in Vault and use `no_log` for their rendering. +- `aegis_adguard_web_port` defaults to `80`. The initial AdGuard Home wizard port `3000` is intentionally unmanaged: open and close it manually only while + completing initial setup. Disable the local systemd-resolved stub through `profile_aegis` before + AdGuard binds port 53; keep + `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf` so Aegis retains router-provided DNS. - iCloudPD requires post-deployment interactive MFA initialization; its cookie/configuration state is persisted in `/var/lib/icloudpd/config`. diff --git a/README.md b/README.md index 745bcb6..478ae0a 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ infra/ ## Managed machines -The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora CoreOS LAN +The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora IoT LAN node, an Ubuntu server, and a Rocky Linux 9 NAS. Configuration is layered instead of being tied to host names: @@ -53,7 +53,7 @@ common user environment | `ikaros` | Fedora | Personal workstation | GNOME | | `nymph` | Fedora | Desktop laptop | GNOME | | `deadalus` | Fedora WSL | Development workstation | — | -| `aegis` | Fedora CoreOS | Always-on LAN node | — | +| `aegis` | Fedora IoT | Always-on LAN node | — | | `prometheus` | Ubuntu | Server | — | | `atlas` | Rocky 9 | NAS | — | @@ -116,22 +116,32 @@ ansible-playbook ansible/site.yml --limit prometheus \ ## Aegis -`aegis` is a Raspberry Pi 4 running Fedora CoreOS. Provision it once with -`ansible/bootstrap/aegis.bu`, after replacing the SSH public-key placeholder: +`aegis` is a Raspberry Pi 4 running Fedora IoT. Generate Ignition from +`ansible/bootstrap/aegis.bu` with the included Podman/Butane helper, then write the SD card with +`arm-image-installer`: ```bash -butane --strict --pretty --output aegis.ign ansible/bootstrap/aegis.bu +ansible/bootstrap/generate-aegis-ign.sh --write IMAGE DEVICE ``` -The `pi` user receives the configured SSH key, and partition 5 on `/dev/mmcblk0` is formatted as -Btrfs and mounted as the root filesystem (`/`) on first boot. Formatting is destructive for that -partition. - -The controller then manages it remotely as `pi@aegis`; unlike local desktop profiles, Aegis is +The controller manages it remotely as `pi@aegis`; unlike local desktop profiles, Aegis is intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Quadlets for AdGuard -Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, and -`wake-ikaros`. Define `vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still -requires interactive MFA initialization after its first deployment. +Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, LAN-restricted +firewalld rules, SSH key-only access for `pi`, and `wake-ikaros`. Set the host-local +`aegis_lan_subnet` and `aegis_adguard_web_port` values before applying it. The playbook permits +AdGuard Home HTTP on port `80`; the initial wizard port `3000` is intentionally unmanaged and must be +opened and closed manually during initial setup. The profile disables the local systemd-resolved DNS +stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53 +for AdGuard while retaining DNS learned from the router. Define +`vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still requires interactive MFA +initialization after its first deployment. + +Validate the profile before deployment: + +```bash +ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \ +ansible-playbook ansible/site.yml --limit aegis --check --diff --ask-become-pass +``` ## NAS @@ -243,7 +253,7 @@ ansible-playbook ansible/site.yml --limit deadalus --tags ai_agents --check --di | `profile_workstation_dev_wsl` | WSL development setup. | | `profile_server` | Server setup. | | `profile_atlas` | Rocky Linux 9 NAS setup. | -| `profile_aegis` | Fedora CoreOS always-on LAN node. | +| `profile_aegis` | Fedora IoT always-on LAN node. | | `dotfiles_common` | Shared user dotfiles. | ## What `site.yml` runs @@ -269,7 +279,7 @@ So, in practice: - `deadalus` gets the Fedora development layer followed by the WSL layer. - `ubuntu_server` configures `prometheus`. - `atlas` receives the Rocky platform layer and the NAS profile through SSH. -- `aegis` receives only the immutable Fedora CoreOS profile through SSH; it does not receive +- `aegis` receives only the immutable Fedora IoT profile through SSH; it does not receive mutable Fedora package or common dotfile roles. - Empty `platform_void` groups do nothing until they get a host. - The playbook never restarts the display manager during a run. diff --git a/ansible/bootstrap/aegis.bu b/ansible/bootstrap/aegis.bu index 8b154b8..b11c126 100644 --- a/ansible/bootstrap/aegis.bu +++ b/ansible/bootstrap/aegis.bu @@ -1,32 +1,55 @@ -# Bootstrap monouso per Fedora CoreOS su Aegis. -# Sostituire le chiavi SSH prima di generare Ignition con butane --strict. -variant: fcos -version: 1.6.0 +# One-time bootstrap for Fedora IoT on Aegis (Raspberry Pi 4). +# Generate only: ./generate-aegis-ign.sh +# Generate and write an SD card: ./generate-aegis-ign.sh --write IMAGE DEVICE +# The write mode uses arm-image-installer with the RPi4 target and embeds +# config.ign; it prompts for Wi-Fi credentials unless supplied through its +# WIFI_SSID and WIFI_PASS environment variables. +# For WiFi, the UEFI 'System Table Selection' must be DeviceTree (Esc at boot). +variant: fiot +version: 1.0.0 passwd: users: - name: pi + password_hash: "$6$bNDsU0XC5BxNJS5U$ENDGpdOUPJM3wcXBgNESCQkOqqQ9gN72/xEQoJsAI6QdsaY6mD4G5DBVIv7nHwHQOP35IH1oGRl.Uy3R2iUYQ1" + groups: + - wheel ssh_authorized_keys: - - "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY" + - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros" +systemd: + units: + - name: sshd.service + enabled: true + - name: rpm-ostree-install-wifi.service + enabled: true + contents: | + [Unit] + Description=Layer WiFi packages (driver, firmware, NetworkManager-wifi) + Wants=network-online.target + After=network-online.target + Before=zincati.service + ConditionPathExists=!/var/lib/%N.stamp + + [Service] + Type=oneshot + RemainAfterExit=yes + ExecStart=/usr/bin/rpm-ostree install -y --allow-inactive NetworkManager-wifi NetworkManager-wwan wpa_supplicant wireless-regdb iw brcmfmac-firmware + ExecStart=/bin/touch /var/lib/%N.stamp + ExecStart=/bin/systemctl --no-block reboot + + [Install] + WantedBy=multi-user.target storage: - disks: - - device: /dev/mmcblk0 - wipe_table: false - partitions: - - label: aegis-data - number: 5 - size_mib: 0 - filesystems: - - device: /dev/disk/by-partlabel/aegis-data - format: btrfs - label: aegis-data - wipe_filesystem: false - mount: - path: / - options: - - compress=zstd files: - path: /etc/hostname mode: 0644 contents: inline: | aegis + - path: /etc/sysctl.d/99-ip-forward.conf + mode: 0644 + contents: + inline: | + net.ipv4.ip_forward = 1 + links: + - path: /etc/localtime + target: ../usr/share/zoneinfo/Europe/Rome diff --git a/ansible/bootstrap/generate-aegis-ign.sh b/ansible/bootstrap/generate-aegis-ign.sh new file mode 100755 index 0000000..e978714 --- /dev/null +++ b/ansible/bootstrap/generate-aegis-ign.sh @@ -0,0 +1,147 @@ +#!/usr/bin/env sh + +set -eu + +SCRIPT_DIR=$(CDPATH= cd -- "$(dirname "$0")" && pwd) +BUTANE_IMAGE=${BUTANE_IMAGE:-quay.io/coreos/butane:release} +BUTANE_SOURCE=${BUTANE_SOURCE:-"$SCRIPT_DIR/aegis.bu"} +IGNITION_OUTPUT=${IGNITION_OUTPUT:-"$SCRIPT_DIR/config.ign"} +SSH_PUBLIC_KEY=${SSH_PUBLIC_KEY:-"$HOME/.ssh/id_ed25519.pub"} +WIFI_SECURITY=${WIFI_SECURITY:-wpa-psk} + +usage() { + cat <<'USAGE' +Usage: + generate-aegis-ign.sh + generate-aegis-ign.sh --write IMAGE DEVICE + +Environment overrides: + BUTANE_IMAGE Butane container image (default: quay.io/coreos/butane:release) + BUTANE_SOURCE Butane source path (default: aegis.bu beside this script) + IGNITION_OUTPUT Ignition output path (default: config.ign beside this script) + SSH_PUBLIC_KEY SSH public key passed to arm-image-installer + WIFI_SSID Wi-Fi SSID; prompted if unset in --write mode + WIFI_PASS Wi-Fi password; prompted if unset in --write mode + WIFI_SECURITY Wi-Fi security type (default: wpa-psk) +USAGE +} + +require_command() { + if ! command -v "$1" >/dev/null 2>&1; then + printf 'Error: required command not found: %s\n' "$1" >&2 + exit 1 + fi +} + +read_required() { + prompt=$1 + value=$2 + + if [ -z "$value" ]; then + printf '%s' "$prompt" >&2 + IFS= read -r value + fi + + if [ -z "$value" ]; then + printf '%s\n' 'Error: a value is required.' >&2 + exit 1 + fi + + printf '%s' "$value" +} + +read_secret() { + value=$1 + + if [ -z "$value" ]; then + printf '%s' 'Wi-Fi password: ' >&2 + stty -echo + IFS= read -r value + stty echo + printf '\n' >&2 + fi + + if [ -z "$value" ]; then + printf '%s\n' 'Error: a value is required.' >&2 + exit 1 + fi + + printf '%s' "$value" +} + +write_image=false +case $# in + 0) + ;; + 3) + if [ "$1" != '--write' ]; then + usage >&2 + exit 2 + fi + write_image=true + IMAGE=$2 + DEVICE=$3 + ;; + *) + usage >&2 + exit 2 + ;; +esac + +require_command podman + +if [ ! -f "$BUTANE_SOURCE" ]; then + printf 'Error: Butane source not found: %s\n' "$BUTANE_SOURCE" >&2 + exit 1 +fi + +OUTPUT_DIR=$(dirname "$IGNITION_OUTPUT") +if [ ! -d "$OUTPUT_DIR" ]; then + printf 'Error: output directory not found: %s\n' "$OUTPUT_DIR" >&2 + exit 1 +fi + +umask 077 +TEMP_OUTPUT=$(mktemp "$OUTPUT_DIR/.config.ign.XXXXXX") +trap 'rm -f "$TEMP_OUTPUT"' EXIT HUP INT TERM + +podman run --rm -i "$BUTANE_IMAGE" --strict < "$BUTANE_SOURCE" > "$TEMP_OUTPUT" +mv "$TEMP_OUTPUT" "$IGNITION_OUTPUT" +trap - EXIT HUP INT TERM + +printf 'Generated Ignition config: %s\n' "$IGNITION_OUTPUT" + +if [ "$write_image" = false ]; then + exit 0 +fi + +if [ ! -f "$IMAGE" ]; then + printf 'Error: image not found: %s\n' "$IMAGE" >&2 + exit 1 +fi + +if [ ! -b "$DEVICE" ]; then + printf 'Error: target is not a block device: %s\n' "$DEVICE" >&2 + exit 1 +fi + +if [ ! -f "$SSH_PUBLIC_KEY" ]; then + printf 'Error: SSH public key not found: %s\n' "$SSH_PUBLIC_KEY" >&2 + exit 1 +fi + +require_command arm-image-installer +WIFI_SSID=$(read_required 'Wi-Fi SSID: ' "${WIFI_SSID:-}") +WIFI_PASS=$(read_secret "${WIFI_PASS:-}") + +printf 'Writing %s to %s.\n' "$IMAGE" "$DEVICE" >&2 +sudo arm-image-installer \ + --image="$IMAGE" \ + --target=rpi4 \ + --media="$DEVICE" \ + --ignition="$IGNITION_OUTPUT" \ + --addkey="$SSH_PUBLIC_KEY" \ + --resizefs \ + --wifi-ssid="$WIFI_SSID" \ + --wifi-pass="$WIFI_PASS" \ + --wifi-security="$WIFI_SECURITY" diff --git a/ansible/inventory/group_vars/desktop_gnome.yml b/ansible/inventory/group_vars/desktop_gnome.yml index 3453ecb..37e1cd1 100644 --- a/ansible/inventory/group_vars/desktop_gnome.yml +++ b/ansible/inventory/group_vars/desktop_gnome.yml @@ -11,6 +11,7 @@ fedora_desktop_packages: # Fedora equivalents of the development/tooling packages previously pulled by # the Void desktop profile. - 7zip + - arm-image-installer - nodejs-bash-language-server - bluez - bridge-utils diff --git a/ansible/inventory/group_vars/platform_fedora_coreos.yml b/ansible/inventory/group_vars/platform_fedora_coreos.yml deleted file mode 100644 index bccea1e..0000000 --- a/ansible/inventory/group_vars/platform_fedora_coreos.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -# Fedora CoreOS is immutable: do not attach the mutable Fedora package roles. diff --git a/ansible/inventory/group_vars/platform_fedora_iot.yml b/ansible/inventory/group_vars/platform_fedora_iot.yml new file mode 100644 index 0000000..698d165 --- /dev/null +++ b/ansible/inventory/group_vars/platform_fedora_iot.yml @@ -0,0 +1,2 @@ +--- +# Fedora IoT is immutable: do not attach the mutable Fedora package roles. diff --git a/ansible/inventory/host_vars/aegis.yml b/ansible/inventory/host_vars/aegis.yml index 2232f68..298afa6 100644 --- a/ansible/inventory/host_vars/aegis.yml +++ b/ansible/inventory/host_vars/aegis.yml @@ -4,5 +4,10 @@ ansible_connection: ssh ansible_user: pi ansible_become: true ansible_python_interpreter: /usr/bin/python3 +# Avoid PTY framing around module JSON on this remote Fedora IoT host. +ansible_ssh_use_tty: false + +aegis_lan_subnet: 192.168.178.0/24 +aegis_adguard_web_port: 80 aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}" diff --git a/ansible/inventory/hosts.yml b/ansible/inventory/hosts.yml index ceb697e..664d83d 100644 --- a/ansible/inventory/hosts.yml +++ b/ansible/inventory/hosts.yml @@ -13,7 +13,7 @@ all: deadalus: ansible_connection: local - platform_fedora_coreos: + platform_fedora_iot: hosts: aegis: @@ -28,7 +28,7 @@ all: fedora: children: platform_fedora: - platform_fedora_coreos: + platform_fedora_iot: rocky: children: diff --git a/ansible/roles/profile_aegis/defaults/main.yml b/ansible/roles/profile_aegis/defaults/main.yml index 34a7525..bb8c5c5 100644 --- a/ansible/roles/profile_aegis/defaults/main.yml +++ b/ansible/roles/profile_aegis/defaults/main.yml @@ -7,3 +7,10 @@ aegis_icloudpd_synchronisation_interval: 86400 aegis_icloudpd_apple_id: "" aegis_ikaros_mac_address: aa:bb:cc:dd:ee:ff aegis_wol_port: 9 + +aegis_lan_subnet: CHANGEME_LAN_SUBNET +aegis_firewalld_zone: public +aegis_adguard_web_port: 80 +aegis_ssh_allowed_users: + - pi +aegis_ssh_user_home: "/var/home/{{ ansible_user }}" diff --git a/ansible/roles/profile_aegis/handlers/main.yml b/ansible/roles/profile_aegis/handlers/main.yml index 304f675..26fd306 100644 --- a/ansible/roles/profile_aegis/handlers/main.yml +++ b/ansible/roles/profile_aegis/handlers/main.yml @@ -1,4 +1,14 @@ --- +- name: Restart Aegis systemd-resolved + ansible.builtin.systemd: + name: systemd-resolved.service + state: restarted + +- name: Reload Aegis SSH + ansible.builtin.systemd: + name: sshd.service + state: reloaded + - name: Restart Aegis Quadlet services ansible.builtin.systemd: name: "{{ item }}" diff --git a/ansible/roles/profile_aegis/tasks/main.yml b/ansible/roles/profile_aegis/tasks/main.yml index a1915e5..03b4e44 100644 --- a/ansible/roles/profile_aegis/tasks/main.yml +++ b/ansible/roles/profile_aegis/tasks/main.yml @@ -7,6 +7,17 @@ fail_msg: Define vault_aegis_icloudpd_apple_id before applying the Aegis profile. no_log: true +- name: Require completed Aegis network placeholders + tags: [aegis, firewall, services] + ansible.builtin.assert: + that: + - aegis_lan_subnet != 'CHANGEME_LAN_SUBNET' + - aegis_firewalld_zone | length > 0 + - aegis_adguard_web_port | int > 0 + - aegis_adguard_web_port | int < 65536 + - aegis_ssh_allowed_users | length > 0 + fail_msg: Define the Aegis LAN subnet, firewalld zone, AdGuard web port, and SSH users. + - name: Set Aegis hostname tags: [aegis, services] ansible.builtin.hostname: @@ -53,6 +64,185 @@ no_log: "{{ item.dest == 'icloudpd.container' }}" notify: Restart Aegis Quadlet services +- name: Create Aegis systemd-resolved configuration directory + tags: [aegis, adguard, dns, services] + ansible.builtin.file: + path: /etc/systemd/resolved.conf.d + state: directory + owner: root + group: root + mode: "0755" + +- name: Disable Aegis systemd-resolved DNS stub listener + tags: [aegis, adguard, dns, services] + ansible.builtin.template: + src: 10-adguard-dns.conf.j2 + dest: /etc/systemd/resolved.conf.d/10-adguard-dns.conf + owner: root + group: root + mode: "0644" + notify: + - Restart Aegis systemd-resolved + - Restart Aegis Quadlet services + +- name: Point Aegis resolver at the full systemd-resolved configuration + tags: [aegis, adguard, dns, services] + ansible.builtin.file: + src: ../run/systemd/resolve/resolv.conf + dest: /etc/resolv.conf + state: link + force: true + notify: Restart Aegis systemd-resolved + +- name: Enable Aegis firewalld + tags: [aegis, firewall, services] + ansible.builtin.systemd: + name: firewalld.service + enabled: true + state: started + +- name: Render Aegis AdGuard web firewalld service + tags: [aegis, firewall] + ansible.builtin.template: + src: aegis-adguard-web.xml.j2 + dest: /etc/firewalld/services/aegis-adguard-web.xml + owner: root + group: root + mode: "0644" + +- name: Reload firewalld custom services + tags: [aegis, firewall] + ansible.builtin.command: + argv: + - firewall-cmd + - --reload + changed_when: false + when: not ansible_check_mode + +- name: Remove unrestricted Aegis services from firewalld zone + tags: [aegis, firewall] + ansible.posix.firewalld: + service: "{{ item }}" + permanent: true + immediate: true + state: disabled + zone: "{{ aegis_firewalld_zone }}" + loop: + - ssh + - dns + - http + - aegis-adguard-web + loop_control: + label: "{{ item }}" + +- name: Remove retired Aegis TLS access rule + tags: [aegis, firewall] + ansible.posix.firewalld: + rich_rule: 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" port port="853" protocol="tcp" accept' + permanent: true + immediate: true + state: disabled + zone: "{{ aegis_firewalld_zone }}" + +- name: Allow Aegis services from the LAN only + tags: [aegis, firewall] + ansible.posix.firewalld: + rich_rule: "{{ item }}" + permanent: true + immediate: true + state: enabled + zone: "{{ aegis_firewalld_zone }}" + loop: + - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="ssh" accept' + - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="dns" accept' + - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="aegis-adguard-web" accept' + loop_control: + label: "{{ item }}" + +- name: Check the standard Aegis SSH authorized keys file + tags: [aegis, ssh, services] + ansible.builtin.stat: + path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys" + register: aegis_authorized_keys + +- name: Find Aegis SSH authorized key fragments + tags: [aegis, ssh, services] + ansible.builtin.find: + paths: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d" + file_type: file + recurse: false + register: aegis_authorized_key_fragments + +- name: Require an Aegis SSH authorized key before hardening + tags: [aegis, ssh, services] + ansible.builtin.assert: + that: + - >- + (aegis_authorized_keys.stat.exists and aegis_authorized_keys.stat.size | int > 0) + or aegis_authorized_key_fragments.matched | int > 0 + fail_msg: Add a public key for the Ansible SSH user before disabling password authentication. + +- name: Ensure Aegis SSH configuration drop-in directory exists + tags: [aegis, ssh, services] + ansible.builtin.file: + path: /etc/ssh/sshd_config.d + state: directory + owner: root + group: root + mode: "0755" + +- name: Ensure Aegis SSH drop-ins are loaded before other settings + tags: [aegis, ssh, services] + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: '^\s*Include\s+/etc/ssh/sshd_config\.d/\*\.conf\s*$' + line: Include /etc/ssh/sshd_config.d/*.conf + insertbefore: BOF + state: present + validate: "sshd -t -f %s" + +- name: Render Aegis SSH hardening drop-in + tags: [aegis, ssh, services] + ansible.builtin.template: + src: 00-aegis-hardening.conf.j2 + dest: /etc/ssh/sshd_config.d/00-aegis-hardening.conf + owner: root + group: root + mode: "0600" + notify: Reload Aegis SSH + +- name: Validate Aegis SSH configuration + tags: [aegis, ssh, services] + ansible.builtin.command: + argv: + - sshd + - -t + changed_when: false + when: not ansible_check_mode + +- name: Read effective Aegis SSH daemon configuration + tags: [aegis, ssh, services] + ansible.builtin.command: + argv: + - sshd + - -T + - -C + - "user={{ ansible_user }},host={{ aegis_hostname }},addr=127.0.0.1" + register: aegis_sshd_effective_configuration + changed_when: false + when: not ansible_check_mode + +- name: Verify effective Aegis SSH hardening + tags: [aegis, ssh, services] + ansible.builtin.assert: + that: + - "'permitrootlogin no' in aegis_sshd_effective_configuration.stdout_lines" + - "'pubkeyauthentication yes' in aegis_sshd_effective_configuration.stdout_lines" + - "'passwordauthentication no' in aegis_sshd_effective_configuration.stdout_lines" + - "'kbdinteractiveauthentication no' in aegis_sshd_effective_configuration.stdout_lines" + - "'allowusers ' + (aegis_ssh_allowed_users | join(' ')) in aegis_sshd_effective_configuration.stdout_lines" + when: not ansible_check_mode + - name: Install Wake-on-LAN helper for Ikaros tags: [aegis, wol] ansible.builtin.template: diff --git a/ansible/roles/profile_aegis/templates/00-aegis-hardening.conf.j2 b/ansible/roles/profile_aegis/templates/00-aegis-hardening.conf.j2 new file mode 100644 index 0000000..6f4b432 --- /dev/null +++ b/ansible/roles/profile_aegis/templates/00-aegis-hardening.conf.j2 @@ -0,0 +1,6 @@ +# Managed by Ansible. Do not edit manually. +PermitRootLogin no +PubkeyAuthentication yes +PasswordAuthentication no +KbdInteractiveAuthentication no +AllowUsers {{ aegis_ssh_allowed_users | join(' ') }} diff --git a/ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2 b/ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2 new file mode 100644 index 0000000..e6cd210 --- /dev/null +++ b/ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2 @@ -0,0 +1,3 @@ +# Managed by Ansible. Do not edit manually. +[Resolve] +DNSStubListener=no diff --git a/ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2 b/ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2 new file mode 100644 index 0000000..4c52d30 --- /dev/null +++ b/ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2 @@ -0,0 +1,6 @@ + + + Aegis AdGuard Home web interface + AdGuard Home administrative web interface on Aegis. + + diff --git a/ansible/site.yml b/ansible/site.yml index b2faafb..8498440 100644 --- a/ansible/site.yml +++ b/ansible/site.yml @@ -35,7 +35,7 @@ - role: dotfiles_common when: - "'platform_rocky' not in group_names" - - "'platform_fedora_coreos' not in group_names" + - "'platform_fedora_iot' not in group_names" - name: Configure Void platform hosts: platform_void @@ -71,7 +71,7 @@ - packages_rocky - services_systemd -- name: Configure Aegis Fedora CoreOS profile +- name: Configure Aegis Fedora IoT profile hosts: role_aegis become: true diff --git a/secrets/vault.yml b/secrets/vault.yml index 945ea29..410ac30 100644 --- a/secrets/vault.yml +++ b/secrets/vault.yml @@ -1,37 +1,40 @@ $ANSIBLE_VAULT;1.1;AES256 -36346638633530653262306466326434346237313965643039643837623233313037363163346338 -3165386461353334393464616362333033613231313865340a313731623439626633303566333239 -63363166666663376365613034643663373937613162643935366333313438373365346539663161 -6663343762336130350a306336613962353931306230363564626538346163623936363064383964 -61333734633635326630383339306539643537316665666666643533333364613030613265313032 -62643363383464303836376266633962313666396630313361303039343133316237643164616666 -30376433323330363033643231643861383234336362383432633665313566336537633631303133 -66656363613165333666383432623435626339666364643936653037663839643262393664653564 -37373465373663376537616532656434316435623734656265363536336333633537626435303635 -65623036613631386464646335653862396232326163623130396133643935363135393934333638 -37626664353131613336353130366566383238623031636366333036643161626564613965613233 -63336138393161306565623466383763663664323864633430626561313939336434363462656361 -33343433636562653138613233343030333362383661633536616564313662353231343966386466 -63633032643432343337303131656465373039646235653335353239633865353533626632336366 -32386430623035626533346463333230663735353632356530643635386336393235646461303064 -37316265613233303537373631613265636435343631363930323234366332613966346262336531 -36646566393036636363333733613433353561363639616139626331336234353334303739643061 -32333062383164373435666166386263663438666364636239383731313863386361363035313333 -30656363306565623035303462363637353839343665393934613733613532313237613134313466 -61336335616631666430393364363864306632663462393733656539386431313864333265393265 -33626630643863306632363835353238376631626335313566666264343664656136316337376432 -36653534336232303361663966663366343637663432316533643766636339313339643430336531 -34303430336333663364306432363461326465396533376263336131323639393737666632623363 -36656438616230663566633061383135633937613530346636396630656135663639396235373965 -31396536376666333839336166653734303362633263643039353838393431393463303337313263 -62653036346666393930646536653235326566303465333666646534643935663734643063613762 -63336334646336343537386133383138363932616662376131393530633565353935613566306563 -30643338613065393731623534656431373235353837383963383262323939343061326531303536 -38303731633265376334393465656334353265656633336231326636636339626461616533323533 -39326663336431353633313265353736356435393761613163386665623865346132333537666336 -32366564363739386339343835393966623161656165643232643535616536633762666530623466 -63636336386563373032663939373237383639623938616336653235663430613863616537326666 -65346464326138646435353033303831383732623133393666663533303564613835323334333632 -65366138613266313261646134303165333265366134373362333433653734653038646538363566 -31373137643331373734353038643833333966663161633561653533333338353230393838336434 -35346533356463666466 +65623833316230316230376465656261383230643661393032396462643232383334383236653134 +3964353234623165633736303035623132643565393461660a323930623462323635613361373836 +37613164656538353734333932326136303532346161663238613466616236636432346534626331 +3434663266366637650a336235363033333562626135333962626265666332386261643666306638 +64343262353661346435326662633833656533643464653665356233316466333432303536356539 +32623430303663616261386636613534326231613366636536303761646335396132623231336361 +61656337313766353533643266396230626439353033373630666336616230316362616135323462 +30306633373234386639633932393437323931613739383135353835393630623937636639343338 +35636530643330376538393262383738333735656230363633383463386366343065633961663562 +37653264326565376166666262643136616333656233386564333030663532353836306131316530 +62633738306434303236623239646638613230323434393761656265393064373235333435393264 +36363936336330636433643133346164643733356239616530653831626165316238643834356236 +36333262313764653137633930663131306132306434376433306230306564366633363738313634 +35316230623134623932396132316530366662643366643439643334366233646334633764346266 +35373764633138343235323931346134613265356238616138323134326338633335336339313862 +61653939366263386431636334333661306538643166353661336561396365366434353830643465 +31626136626336633363653531363064643534396336623331363130313966653966373636663232 +65653132363139653239383636333861323435613362666637366162323062376139633033373563 +66656134313931313965303134613836383534636438363936353836326639346565653031363839 +63623738366261363734376536646532396231616233303061363364383238616434333366613933 +63616539613336393863633361303466353738313666393164343638373530376666663666666235 +33666234353736633335343639623664326566333162333539636235346663663737366432366665 +66373831303666666533343234373466333132343135326261663532663062313939623963383437 +34653732653830313638343631313437623931623531323566306232373165636662316633333438 +66666537623966623932323463323330316337613637383339613637653637333832623965636434 +34653330336663323263353636353139323337646166623862343565646637616136646232373633 +33356134373464646664303865353763323531383661323930353038646333386366353665396431 +64303739643735376235626134663566343165646433393966373961393738323036353437346436 +66656166306561353637623462303039393465363261343164393062643130383736623261383232 +38623036626464613138363635646233323737653137633830316138663835656633336663626338 +33386232633862616432396662343738343462623263303337393533313264396637356134373739 +61323266623665353631316461633462646536386266343934356235363065653162363566623661 +35643332303333306362303538333034316461326363653632313765396664643533373862333533 +37306536356465393933366238663031653630386239383839316365323761316236326330306637 +36373434643864343064646437323736393330326361663231373933613864303339653661616139 +36356134636136333830663031656132656237383331663362313238653133366538323462376632 +63373766383939656265313934636462626633376162623931333363393837303336363036303439 +32643730383735383535633439326564376261343937343934366366373039653761383934316162 +383035326562353431616536646238323164