diff --git a/ansible/inventory/group_vars/platform_rocky.yml b/ansible/inventory/group_vars/platform_rocky.yml index 3d4e6bf..c197672 100644 --- a/ansible/inventory/group_vars/platform_rocky.yml +++ b/ansible/inventory/group_vars/platform_rocky.yml @@ -5,6 +5,9 @@ platform_package_manager: dnf platform_service_manager: systemd rocky_openzfs_release_rpm: https://zfsonlinux.org/epel/zfs-release-3-0.el9.noarch.rpm +rocky_openzfs_gpg_key_url: >- + https://raw.githubusercontent.com/zfsonlinux/zfsonlinux.github.com/master/zfs-release/RPM-GPG-KEY-openzfs-key2 +rocky_openzfs_gpg_key_fingerprint: 7DC7 299D CF7C 7FD9 CD87 701B A599 FD5E 9DB8 4141 rocky_syncthing_version: 2.1.3 rocky_syncthing_archive_checksum: sha256:f929eb8e5b72a85543eeeefb2c38f34a68e0c530e70758a2905b78840c76602c rocky_syncthing_archive_url: >- diff --git a/ansible/inventory/host_vars/atlas.yml b/ansible/inventory/host_vars/atlas.yml index af086b8..0b3b129 100644 --- a/ansible/inventory/host_vars/atlas.yml +++ b/ansible/inventory/host_vars/atlas.yml @@ -28,8 +28,12 @@ atlas_manage_firewall: true atlas_firewalld_zone: public atlas_zfs_pool: zpool # Populate only for the first pool bootstrap with four real persistent disk paths. -# Example: /dev/disk/by-id/ata-Seagate_IronWolf_... -atlas_zpool_disks: [] +# Confirmed empty 4 TB IronWolf data disks; the NVMe system disk is intentionally excluded. +atlas_zpool_disks: + - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1XM + - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A73T2 + - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A6VJK + - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1LM atlas_create_pool: false atlas_zfs_dataset_work: work atlas_zfs_dataset_archive: archive diff --git a/ansible/roles/packages_rocky/tasks/main.yml b/ansible/roles/packages_rocky/tasks/main.yml index fb4c016..e9bcf8a 100644 --- a/ansible/roles/packages_rocky/tasks/main.yml +++ b/ansible/roles/packages_rocky/tasks/main.yml @@ -27,6 +27,14 @@ name: epel-release state: present +- name: Import official OpenZFS EL9+ signing key + tags: [packages, storage] + ansible.builtin.rpm_key: + state: present + key: "{{ rocky_openzfs_gpg_key_url }}" + fingerprint: "{{ rocky_openzfs_gpg_key_fingerprint }}" + when: rocky_manage_openzfs_repo | bool + - name: Install official OpenZFS repository package tags: [packages, storage] ansible.builtin.dnf: diff --git a/ansible/roles/profile_atlas/tasks/pool.yml b/ansible/roles/profile_atlas/tasks/pool.yml index 6f71fbc..7a1bc91 100644 --- a/ansible/roles/profile_atlas/tasks/pool.yml +++ b/ansible/roles/profile_atlas/tasks/pool.yml @@ -16,6 +16,7 @@ - name: Inspect declared Atlas pool disks ansible.builtin.stat: path: "{{ item }}" + follow: true loop: "{{ atlas_zpool_disks }}" loop_control: label: "{{ item }}" diff --git a/ansible/roles/profile_atlas/tasks/sharing.yml b/ansible/roles/profile_atlas/tasks/sharing.yml index a44ae63..7015d0f 100644 --- a/ansible/roles/profile_atlas/tasks/sharing.yml +++ b/ansible/roles/profile_atlas/tasks/sharing.yml @@ -56,6 +56,16 @@ notify: Reload NFS exports when: atlas_manage_sharing | bool +- name: Ensure Atlas NFS configuration drop-in directory exists + tags: [atlas, sharing] + ansible.builtin.file: + path: /etc/nfs.conf.d + state: directory + owner: root + group: root + mode: "0755" + when: atlas_manage_sharing | bool + - name: Configure Atlas NFSv4-only service tags: [atlas, sharing] ansible.builtin.template: @@ -214,9 +224,22 @@ - atlas_manage_sharing | bool - not ansible_check_mode -- name: Read Atlas file-sharing service state +- name: Check active Atlas file-sharing services tags: [atlas, sharing, services, security] - ansible.builtin.service_facts: + ansible.builtin.command: + argv: + - systemctl + - is-active + - --quiet + - "{{ item }}" + loop: + - nfs-server.service + - smb.service + loop_control: + label: "{{ item }}" + register: atlas_file_sharing_service_activity + changed_when: false + failed_when: false when: - atlas_manage_sharing | bool - not ansible_check_mode @@ -225,10 +248,7 @@ tags: [atlas, sharing, services, security] ansible.builtin.assert: that: - - ansible_facts.services['nfs-server.service'] is defined - - ansible_facts.services['nfs-server.service'].state == 'running' - - ansible_facts.services['smb.service'] is defined - - ansible_facts.services['smb.service'].state == 'running' + - atlas_file_sharing_service_activity.results | map(attribute='rc') | list == [0, 0] fail_msg: Atlas NFSv4 or SMB3 did not start after its managed configuration was applied. when: - atlas_manage_sharing | bool diff --git a/ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2 b/ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2 index a81114d..0420b2e 100644 --- a/ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2 +++ b/ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2 @@ -4,7 +4,12 @@ PubkeyAuthentication yes PasswordAuthentication no KbdInteractiveAuthentication no AuthenticationMethods publickey -AuthorizedKeysFile {% for key in atlas_admin_ssh_keys %}%h/.ssh/authorized_keys.d/{{ key.name }}{% if not loop.last %} {% endif %}{% endfor %} +AuthorizedKeysFile {{ + atlas_admin_ssh_keys + | map(attribute='name') + | map('regex_replace', '^', '%h/.ssh/authorized_keys.d/') + | join(' ') +}} X11Forwarding no AllowTcpForwarding {{ atlas_ssh_allow_tcp_forwarding }} AllowAgentForwarding no diff --git a/secrets/vault.yml b/secrets/vault.yml index 019ea49..e7edd8e 100644 --- a/secrets/vault.yml +++ b/secrets/vault.yml @@ -1,71 +1,78 @@ $ANSIBLE_VAULT;1.1;AES256 -34663237313764396365646239613936373362306636663862373964343131636362333265306564 -3739343661336433303637343066626263646530663464380a636363303065643130336239663335 -64323265303964383635366235656163353333393166363635333831343531356339363939333530 -6266306339323862300a353530623639643836323135363566653161356630316565323233333937 -34343637383766623036633435346131393935303736613963653762663336383336366666333961 -39346336356563383464306364373438666638353731616566656164386365373966623230313933 -61343237373034616163363733326139306665366339383866316666396138373164366363613164 -34313638373435623439326164396264393838316263633630653935626635333362386132313864 -34643937653730336637633137623937346131396330356665626564666561343630383562646563 -65393532656162323931663266323635343437613639373731623631636533326533396662373032 -61386436613235353638613731313835373137643533363936326566316165636137653438393238 -37343765356366626666363162663262313663393038323531346461343731396334623339323865 -65323464323465326364633263346561316364336431323763386138383132643136663630636439 -66393564343462663933626464623866613563376234663430353837343139346363313539313839 -65386134653932393464356562346238336535323130373235303964313664363031623137383365 -39356530666564383334626330613039303135626237393233353362363033653239343634356261 -35356533643937393834383930336633623932363435646261633837663536356462356535613030 -63626438393466616238383030643631343661613630623738323933386434636461383136376261 -39616137336134663130613234633266383434336133353334373063366232663839316536376565 -62643766316464393135633564373062663335633533626631326534333232323364343133393534 -63396465363066643261303334363966343935323635383938616539323838393235373730313832 -37313235316264643932343062353162353534653963336634373264343937653035333735393766 -32393765643535383535616335613136336566653637343835366538633737313962336531333533 -32376163613861313139393863646331386133363435373364316134376533316136396533353161 -39353737633439656466396561623938646438636664373438323866613636653963393938346363 -63616366313030623464613832336566356339343931643436393138346463356161653039666632 -63396465306630336634316632663930613637643331363236353363383162333865383536623235 -33306232333439383135306266656666616135363433636332663865633234653530666435356164 -34336338343831633966666334643436373162336333313666613766656638656530373663383036 -39366134326134323435326434383637313334336562386638346333303666396336653231396463 -37633131393564656265646530373262393231373663303133323566666630366530626439353062 -37323138656431653235303439653133303831383864376562353363373466396334373063616561 -34343932383433323331363633643432303633323337656261386339653263393832396539633938 -36303634336162613366376435366530663632656263363436666532663561636465613736303962 -35663035303437313933373533336639323563376539303730323933346636626462336530303135 -65623036326663363130326438376161303463363839653564623462663561346236393262643035 -63363631663834303734393330353730333234626236616636326236376133633635376435326630 -33383035363466326139336431353937363236303134633662653066356164656366353038366264 -63343261393865303163633166663433373362663261343166303932313061393463346662366165 -31396333633964636265326539396533343932363433636438363137356430663764373835373566 -63633265323537353666653862623030646661366531646163303261363035356138346538623466 -63323235393835353864303362356465393739303531653139316338643136346164366630383635 -64376261376465303134383938346639386563363532313532663532656462663362643339353733 -61356566613638336639323235393132623032303639393065363238366337333237363863326365 -32383563313062363166656137626639363138363236383763663262363531646133356434633636 -39653666626539356538313234636634386438386434303336313337323638383863376163356365 -32346330306361343337373636376239643538396334303038636664633666306562316435303332 -33663238336336353237396139633133386439376162616439313862323462613636646262326162 -62653237636161393938336435333730636237313363663835323932613933373466343163646331 -37383466386437303433616162323433343761623831323163363331613164376565623633356335 -61366336393938383036623962353031333735376266643866363562653965306335636531376138 -64303764343565376561623933663035646163343235646565666465323864323065636462383962 -66633336313032323333366237366561613734376132346537373136376639623163313837613235 -37393332323539303338353365373766383537626162613738343534396339613336323437646466 -61623636303665623262633632653633373931373933366138316565353938656232313961373865 -66393230663532616532666561666465313361316432376432313034343333636566626564323066 -34613331633439626233333939303461393239623262376265393132313134653537396165343262 -39303135366566623037646265616630313638383732323064303237626334383261303230383162 -66633164353330666436376666316236363164373230633062636430663632393837366630643539 -33663233306464616165613337633030656661393336613036333036666565356232333966616361 -62353465643839373266333866353135396262303461666465393736636638636462666136613461 -31373130663563393833633930323766656530616261323363383333306631653563363734343034 -64383962346463663861356362346437346630353835383062373433396335343931343462386165 -33636266306563346431376438333463653165663962346262633037393238393135323536633866 -65623663323365643233346232613936373562363532373162613533316335376138366432316362 -30303662363436636263313064363235393632353430386438663833666665316561323431396430 -64623435323461313763613730643762633535393533333635313435613665383535633161353539 -37666665313730663366646537363963636631363836353437663963656566353962633935383263 -38663930373135353336326530396636373938333934326630303138643563633934656566663963 -6461373661386230356262643732373861366139323261303961 +31386434333363613930316363393564373332303236306233643365386639346631336232373361 +3732633931376438313835373537666438383664306266380a633531316432343166323361303465 +39306136386664356163346266303963373839373763343136346135633236333333326331313063 +6264306265373865310a373735393632373861333433326632303931633732636535326264346537 +39633766326361666432396432623132616666363462373237623664363664373362346366383230 +65326665303762356233356531306331333231376163353638363936626562623937323166623065 +62633165383033303362336238343037353930396430336537363565333132666532323662653262 +65373531313264353938666161373064393239653165666462336665323962336134343432316134 +32373361613539356262313333663964623034313230356439626139383539326261663765373034 +36633933366662656464306561393130373238313730336638663932633935313037363133636266 +36663935303735623132663464376633306431396662306166393831313566323238363865303162 +66303732376530653435613966373832333161333137366230613166303061333433336461386234 +63393030616662373666643164663862653037383336323766646330653131623930353265336231 +39646335353635616465663763306262353931316562616437313362616136623735646535616431 +33363439623361343231363663363535663265366166346439623935323632366336363135373462 +62646662316538323734333334393566333463653833326162663065646634363336373865623932 +33646533636638386534366561663930613536663935663638313137646537626431393035653466 +36623435613966323166363630383531656436373366343364346439343034333934623836336636 +38653534343563393434646430306662343435653465363439326261373537666233353731306436 +35323739336361343665633239366633393530346335396635316238323435663466316235376536 +38303839313433643038353236616632626363653339346334303136306138336461383831626536 +39303966393034333739363061363865326165303236656438316537396463383935393764346135 +66323632323833353833643434316566326366633562666262386232653730303038613336663264 +62636332383834393861373665393364653362636339346632303463386565633830336363393065 +31383530613161366436323163393366386635316562633436383134623061353937326363396439 +38636438396637616362373937666361303536376164636533653536306338356263313965623336 +32633461623861643138613734313164633562613932386163643062353636376266633166373838 +39613438653531316333663736366161313832613830353566356461393435656234383037353335 +32343661376266353538643531313239306432646335383734623233373063316430383362643531 +35393263343534363936373361316265653934383735663933663365363564663966646335353337 +63366365383466393765336533363130643236313331633537346237353631623334633330376164 +32616530623032663761643437336536323332343130393339313232623364656334613233323833 +64346637343738386335343631333035636337633732333662663763326362636432646136353064 +30393061326435323837633632333765623931663265326137373135303035623464333366653566 +66613133396339376264313964353932396136613538383264363865633536373839663465333437 +37613765626131343330653063663764346364316264363635653438396331363263623562333735 +30646563303439663639376430336336383761363365353838613036333032306434623661636138 +63616439636437663732386164346365643834376631303263376563323662373734653631613730 +31373039656238303462643930303531613931373065316435303661343862623034653364653736 +37613835616630316133333130633631653639336266313438633166316539373433333661613839 +32356139366232313336343062323265366563633735383661393335386163653133313664613264 +63303739323863333439316461366137656434666366306466356633306663623730653939663430 +39313764663534316562326435316264633236373834323665356266346532323565323532333438 +33306237623430613463393164383332356533303433343465343930636563363862373330613632 +38643937613263313435626166313464316133373338373261666331653436373063393162636339 +66356434663239646334383433626566336433653265336332323866633666646132663836313537 +66663766306438396131623533613834626331653731323137303539303835306632663132616363 +64303438353836613136623562626664326364656133383865383730373762666539383036396337 +66393636343561333435313032353939316138306336316337353861383238326136373265663433 +62366566343866626336646466386561353061343735306565383437333931613635393034363430 +37633765663239643435623066313331353862393966306563393838386334393162306562363062 +61633363386564373834383432323861323364623365306439353631323463326461383039356466 +34396464653233626435656463326439303665633532656639376633353932666630626564616564 +34326638383634353033326232646339393638663637313136653763336265616635326666336530 +33663261376262626136346265656130653831636662306132393837306135643831353534626636 +34383762386665666363313932336632326230646439663366663037323562633630373137333232 +37393164656137303131313738396131613561306332356436303436636338623233343637363332 +36613137316337666461333237373266326238303531396432383461616239316630346230303735 +63636535383766353338643932366339333130663632386337643932636630316432313465393766 +39613065623631316165313134386231616165366266323634643632626230303861376461323433 +35346137326563646332303334313530383464373838373633363635373766333362386466323836 +32613236646561343365656239346239353866663336393930356238653463336361333033643331 +61323430663031383239353363616666336637666230663633616464616638303966343631386632 +32333735643936353638666336303133356435396338653465323234316234626536666635333238 +38313661303466333464666538363938656631396666643566343763396638336663376430646532 +38666234653330646262633062356238343536336637356432313137313561363937363936383364 +30643937383833663339643862363234643765386164316138636565643434373734383339363138 +36323163633837326132393365333236633264386664373234313061373835346634663137383837 +62666561353532303663346365343131316233633163323938623066656332383030393864363536 +38383939383935613432613837333863313239653831333438383133343763633838353964353161 +61323462343835613937653465633563306462613631323762656437626133336638396663646362 +30323661383134653336366234663333336261353162373030626266656336356233316265636661 +34303865313433633138363936373561636537353831373033303163646436303932626138356633 +63656364353163313037613262396338636230646330666331616534313466306361363433656132 +66633231626665303165346339373764666264313838313063323732653837383736633235363064 +37353632336238623366313432376163653535656134633634313065356533343933666135396633 +30613134646132613637656461303431613064393438363231383464663765316638