Harden Rocky storage and sharing configuration

ansible/inventory/group_vars/platform_rocky.yml

@@ -5,6 +5,9 @@ platform_package_manager: dnf
 platform_service_manager: systemd
 
 rocky_openzfs_release_rpm: https://zfsonlinux.org/epel/zfs-release-3-0.el9.noarch.rpm
+rocky_openzfs_gpg_key_url: >-
+  https://raw.githubusercontent.com/zfsonlinux/zfsonlinux.github.com/master/zfs-release/RPM-GPG-KEY-openzfs-key2
+rocky_openzfs_gpg_key_fingerprint: 7DC7 299D CF7C 7FD9 CD87 701B A599 FD5E 9DB8 4141
 rocky_syncthing_version: 2.1.3
 rocky_syncthing_archive_checksum: sha256:f929eb8e5b72a85543eeeefb2c38f34a68e0c530e70758a2905b78840c76602c
 rocky_syncthing_archive_url: >-

ansible/inventory/host_vars/atlas.yml

@@ -28,8 +28,12 @@ atlas_manage_firewall: true
 atlas_firewalld_zone: public
 atlas_zfs_pool: zpool
 # Populate only for the first pool bootstrap with four real persistent disk paths.
-# Example: /dev/disk/by-id/ata-Seagate_IronWolf_...
-atlas_zpool_disks: []
+# Confirmed empty 4 TB IronWolf data disks; the NVMe system disk is intentionally excluded.
+atlas_zpool_disks:
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1XM
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A73T2
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A6VJK
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1LM
 atlas_create_pool: false
 atlas_zfs_dataset_work: work
 atlas_zfs_dataset_archive: archive

ansible/roles/packages_rocky/tasks/main.yml

@@ -27,6 +27,14 @@
     name: epel-release
     state: present
 
+- name: Import official OpenZFS EL9+ signing key
+  tags: [packages, storage]
+  ansible.builtin.rpm_key:
+    state: present
+    key: "{{ rocky_openzfs_gpg_key_url }}"
+    fingerprint: "{{ rocky_openzfs_gpg_key_fingerprint }}"
+  when: rocky_manage_openzfs_repo | bool
+
 - name: Install official OpenZFS repository package
   tags: [packages, storage]
   ansible.builtin.dnf:

ansible/roles/profile_atlas/tasks/pool.yml

@@ -16,6 +16,7 @@
     - name: Inspect declared Atlas pool disks
       ansible.builtin.stat:
         path: "{{ item }}"
+        follow: true
       loop: "{{ atlas_zpool_disks }}"
       loop_control:
         label: "{{ item }}"

ansible/roles/profile_atlas/tasks/sharing.yml

@@ -56,6 +56,16 @@
   notify: Reload NFS exports
   when: atlas_manage_sharing | bool
 
+- name: Ensure Atlas NFS configuration drop-in directory exists
+  tags: [atlas, sharing]
+  ansible.builtin.file:
+    path: /etc/nfs.conf.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: atlas_manage_sharing | bool
+
 - name: Configure Atlas NFSv4-only service
   tags: [atlas, sharing]
   ansible.builtin.template:
@@ -214,9 +224,22 @@
     - atlas_manage_sharing | bool
     - not ansible_check_mode
 
-- name: Read Atlas file-sharing service state
+- name: Check active Atlas file-sharing services
   tags: [atlas, sharing, services, security]
-  ansible.builtin.service_facts:
+  ansible.builtin.command:
+    argv:
+      - systemctl
+      - is-active
+      - --quiet
+      - "{{ item }}"
+  loop:
+    - nfs-server.service
+    - smb.service
+  loop_control:
+    label: "{{ item }}"
+  register: atlas_file_sharing_service_activity
+  changed_when: false
+  failed_when: false
   when:
     - atlas_manage_sharing | bool
     - not ansible_check_mode
@@ -225,10 +248,7 @@
   tags: [atlas, sharing, services, security]
   ansible.builtin.assert:
     that:
-      - ansible_facts.services['nfs-server.service'] is defined
-      - ansible_facts.services['nfs-server.service'].state == 'running'
-      - ansible_facts.services['smb.service'] is defined
-      - ansible_facts.services['smb.service'].state == 'running'
+      - atlas_file_sharing_service_activity.results | map(attribute='rc') | list == [0, 0]
     fail_msg: Atlas NFSv4 or SMB3 did not start after its managed configuration was applied.
   when:
     - atlas_manage_sharing | bool

ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2

@@ -4,7 +4,12 @@ PubkeyAuthentication yes
 PasswordAuthentication no
 KbdInteractiveAuthentication no
 AuthenticationMethods publickey
-AuthorizedKeysFile {% for key in atlas_admin_ssh_keys %}%h/.ssh/authorized_keys.d/{{ key.name }}{% if not loop.last %} {% endif %}{% endfor %}
+AuthorizedKeysFile {{
+  atlas_admin_ssh_keys
+  | map(attribute='name')
+  | map('regex_replace', '^', '%h/.ssh/authorized_keys.d/')
+  | join(' ')
+}}
 X11Forwarding no
 AllowTcpForwarding {{ atlas_ssh_allow_tcp_forwarding }}
 AllowAgentForwarding no