diff --git a/AGENTS.md b/AGENTS.md index f4798c9..2713ee7 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,6 +1,6 @@ # AGENTS.md -Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora CoreOS, WSL, and servers. +Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora IoT, WSL, and servers. ## Source Of Truth - Main orchestration: `ansible/site.yml` @@ -17,7 +17,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora - Workstation: `deadalus` is Windows + Fedora WSL. - Ubuntu server: `prometheus` - NAS: `atlas` (Rocky Linux 9, reached through SSH) -- Always-on LAN node: `aegis` (Fedora CoreOS on Raspberry Pi 4, reached through SSH) +- Always-on LAN node: `aegis` (Fedora IoT on Raspberry Pi 4, reached through SSH) - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions. - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents. @@ -46,7 +46,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora - WSL workstation dev: `ansible-playbook ansible/site.yml --limit deadalus --check --diff` - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff` - Atlas NAS: `ansible-playbook ansible/site.yml --limit atlas --check --diff` - - Aegis CoreOS: `ansible-playbook ansible/site.yml --limit aegis --check --diff` + - Aegis IoT: `ansible-playbook ansible/site.yml --limit aegis --check --diff` - Focused checks: - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit --tags emacs --check --diff -e emacs_enabled=true` - AI coding agents: `ansible-playbook ansible/site.yml --limit --tags ai_agents --check --diff` @@ -154,16 +154,19 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i - If you add a new operational area, also add the narrowest validation command for it. - Call out checks you could not run and any follow-up verification needed. -## Aegis Fedora CoreOS Notes -- `aegis` is a remote Fedora CoreOS Raspberry Pi 4 node. Bootstrap it once with +## Aegis Fedora IoT Notes +- `aegis` is a remote Fedora IoT Raspberry Pi 4 node. Bootstrap it once with `ansible/bootstrap/aegis.bu`; the remaining configuration is applied by `profile_aegis` over SSH. -- Fedora CoreOS is immutable. Do not add it to mutable Fedora package or shared dotfile roles. +- Fedora IoT is immutable. Do not add it to mutable Fedora package or shared dotfile roles. - `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, the Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep `aegis_lan_subnet` and `aegis_adguard_web_port` host-specific; SSH permits only the declared key-authenticated users, never root or password authentication. Keep Apple IDs and other credentials in Vault and use `no_log` for their rendering. -- The initial AdGuard Home wizard uses `aegis_adguard_web_port: 3000`. After selecting a different - UI port, update that host variable and rerun the playbook to close the previous port. +- `aegis_adguard_web_port` defaults to `80`; the playbook also permits HTTPS on `443` and DNS-over-TLS on `853/tcp`. The initial AdGuard + Home wizard port `3000` is intentionally unmanaged: open and close it manually only while + completing initial setup. Disable the local systemd-resolved stub through `profile_aegis` before + AdGuard binds port 53; keep + `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf` so Aegis retains router-provided DNS. - iCloudPD requires post-deployment interactive MFA initialization; its cookie/configuration state is persisted in `/var/lib/icloudpd/config`. diff --git a/README.md b/README.md index fa50c45..e9ca171 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ infra/ ## Managed machines -The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora CoreOS LAN +The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora IoT LAN node, an Ubuntu server, and a Rocky Linux 9 NAS. Configuration is layered instead of being tied to host names: @@ -53,7 +53,7 @@ common user environment | `ikaros` | Fedora | Personal workstation | GNOME | | `nymph` | Fedora | Desktop laptop | GNOME | | `deadalus` | Fedora WSL | Development workstation | — | -| `aegis` | Fedora CoreOS | Always-on LAN node | — | +| `aegis` | Fedora IoT | Always-on LAN node | — | | `prometheus` | Ubuntu | Server | — | | `atlas` | Rocky 9 | NAS | — | @@ -116,7 +116,7 @@ ansible-playbook ansible/site.yml --limit prometheus \ ## Aegis -`aegis` is a Raspberry Pi 4 running Fedora CoreOS. Generate Ignition from +`aegis` is a Raspberry Pi 4 running Fedora IoT. Generate Ignition from `ansible/bootstrap/aegis.bu` with the included Podman/Butane helper, then write the SD card with `arm-image-installer`: @@ -128,9 +128,11 @@ The controller manages it remotely as `pi@aegis`; unlike local desktop profiles, intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Quadlets for AdGuard Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, LAN-restricted firewalld rules, SSH key-only access for `pi`, and `wake-ikaros`. Set the host-local -`aegis_lan_subnet` and `aegis_adguard_web_port` values before applying it. The initial AdGuard Home -wizard uses port `3000`; after choosing another web port, update `aegis_adguard_web_port` and rerun -the playbook so the firewall only permits the selected port. Define +`aegis_lan_subnet` and `aegis_adguard_web_port` values before applying it. The playbook permits +AdGuard Home on ports `80`, `443`, and DNS-over-TLS on `853/tcp`; the initial wizard port `3000` is intentionally unmanaged and must be +opened and closed manually during initial setup. The profile disables the local systemd-resolved DNS +stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53 +for AdGuard while retaining DNS learned from the router. Define `vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still requires interactive MFA initialization after its first deployment. @@ -251,7 +253,7 @@ ansible-playbook ansible/site.yml --limit deadalus --tags ai_agents --check --di | `profile_workstation_dev_wsl` | WSL development setup. | | `profile_server` | Server setup. | | `profile_atlas` | Rocky Linux 9 NAS setup. | -| `profile_aegis` | Fedora CoreOS always-on LAN node. | +| `profile_aegis` | Fedora IoT always-on LAN node. | | `dotfiles_common` | Shared user dotfiles. | ## What `site.yml` runs @@ -277,7 +279,7 @@ So, in practice: - `deadalus` gets the Fedora development layer followed by the WSL layer. - `ubuntu_server` configures `prometheus`. - `atlas` receives the Rocky platform layer and the NAS profile through SSH. -- `aegis` receives only the immutable Fedora CoreOS profile through SSH; it does not receive +- `aegis` receives only the immutable Fedora IoT profile through SSH; it does not receive mutable Fedora package or common dotfile roles. - Empty `platform_void` groups do nothing until they get a host. - The playbook never restarts the display manager during a run. diff --git a/ansible/bootstrap/aegis.bu b/ansible/bootstrap/aegis.bu index b69826d..b11c126 100644 --- a/ansible/bootstrap/aegis.bu +++ b/ansible/bootstrap/aegis.bu @@ -1,12 +1,12 @@ -# One-time bootstrap for Fedora CoreOS on Aegis (Raspberry Pi 4). +# One-time bootstrap for Fedora IoT on Aegis (Raspberry Pi 4). # Generate only: ./generate-aegis-ign.sh # Generate and write an SD card: ./generate-aegis-ign.sh --write IMAGE DEVICE # The write mode uses arm-image-installer with the RPi4 target and embeds # config.ign; it prompts for Wi-Fi credentials unless supplied through its # WIFI_SSID and WIFI_PASS environment variables. # For WiFi, the UEFI 'System Table Selection' must be DeviceTree (Esc at boot). -variant: fcos -version: 1.6.0 +variant: fiot +version: 1.0.0 passwd: users: - name: pi diff --git a/ansible/inventory/group_vars/platform_fedora_coreos.yml b/ansible/inventory/group_vars/platform_fedora_coreos.yml deleted file mode 100644 index bccea1e..0000000 --- a/ansible/inventory/group_vars/platform_fedora_coreos.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -# Fedora CoreOS is immutable: do not attach the mutable Fedora package roles. diff --git a/ansible/inventory/group_vars/platform_fedora_iot.yml b/ansible/inventory/group_vars/platform_fedora_iot.yml new file mode 100644 index 0000000..698d165 --- /dev/null +++ b/ansible/inventory/group_vars/platform_fedora_iot.yml @@ -0,0 +1,2 @@ +--- +# Fedora IoT is immutable: do not attach the mutable Fedora package roles. diff --git a/ansible/inventory/host_vars/aegis.yml b/ansible/inventory/host_vars/aegis.yml index 725df5d..298afa6 100644 --- a/ansible/inventory/host_vars/aegis.yml +++ b/ansible/inventory/host_vars/aegis.yml @@ -4,8 +4,10 @@ ansible_connection: ssh ansible_user: pi ansible_become: true ansible_python_interpreter: /usr/bin/python3 +# Avoid PTY framing around module JSON on this remote Fedora IoT host. +ansible_ssh_use_tty: false aegis_lan_subnet: 192.168.178.0/24 -aegis_adguard_web_port: 3000 +aegis_adguard_web_port: 80 aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}" diff --git a/ansible/inventory/hosts.yml b/ansible/inventory/hosts.yml index ceb697e..664d83d 100644 --- a/ansible/inventory/hosts.yml +++ b/ansible/inventory/hosts.yml @@ -13,7 +13,7 @@ all: deadalus: ansible_connection: local - platform_fedora_coreos: + platform_fedora_iot: hosts: aegis: @@ -28,7 +28,7 @@ all: fedora: children: platform_fedora: - platform_fedora_coreos: + platform_fedora_iot: rocky: children: diff --git a/ansible/roles/profile_aegis/defaults/main.yml b/ansible/roles/profile_aegis/defaults/main.yml index 8c9257f..bb8c5c5 100644 --- a/ansible/roles/profile_aegis/defaults/main.yml +++ b/ansible/roles/profile_aegis/defaults/main.yml @@ -10,6 +10,7 @@ aegis_wol_port: 9 aegis_lan_subnet: CHANGEME_LAN_SUBNET aegis_firewalld_zone: public -aegis_adguard_web_port: 3000 +aegis_adguard_web_port: 80 aegis_ssh_allowed_users: - pi +aegis_ssh_user_home: "/var/home/{{ ansible_user }}" diff --git a/ansible/roles/profile_aegis/handlers/main.yml b/ansible/roles/profile_aegis/handlers/main.yml index 09db386..26fd306 100644 --- a/ansible/roles/profile_aegis/handlers/main.yml +++ b/ansible/roles/profile_aegis/handlers/main.yml @@ -1,4 +1,9 @@ --- +- name: Restart Aegis systemd-resolved + ansible.builtin.systemd: + name: systemd-resolved.service + state: restarted + - name: Reload Aegis SSH ansible.builtin.systemd: name: sshd.service diff --git a/ansible/roles/profile_aegis/tasks/main.yml b/ansible/roles/profile_aegis/tasks/main.yml index 04d8845..55895b5 100644 --- a/ansible/roles/profile_aegis/tasks/main.yml +++ b/ansible/roles/profile_aegis/tasks/main.yml @@ -64,6 +64,36 @@ no_log: "{{ item.dest == 'icloudpd.container' }}" notify: Restart Aegis Quadlet services +- name: Create Aegis systemd-resolved configuration directory + tags: [aegis, adguard, dns, services] + ansible.builtin.file: + path: /etc/systemd/resolved.conf.d + state: directory + owner: root + group: root + mode: "0755" + +- name: Disable Aegis systemd-resolved DNS stub listener + tags: [aegis, adguard, dns, services] + ansible.builtin.template: + src: 10-adguard-dns.conf.j2 + dest: /etc/systemd/resolved.conf.d/10-adguard-dns.conf + owner: root + group: root + mode: "0644" + notify: + - Restart Aegis systemd-resolved + - Restart Aegis Quadlet services + +- name: Point Aegis resolver at the full systemd-resolved configuration + tags: [aegis, adguard, dns, services] + ansible.builtin.file: + src: ../run/systemd/resolve/resolv.conf + dest: /etc/resolv.conf + state: link + force: true + notify: Restart Aegis systemd-resolved + - name: Enable Aegis firewalld tags: [aegis, firewall, services] ansible.builtin.systemd: @@ -116,6 +146,7 @@ loop: - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="ssh" accept' - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="dns" accept' + - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" port port="853" protocol="tcp" accept' - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="aegis-adguard-web" accept' loop_control: label: "{{ item }}" @@ -123,13 +154,13 @@ - name: Check the standard Aegis SSH authorized keys file tags: [aegis, ssh, services] ansible.builtin.stat: - path: "{{ ansible_user_dir }}/.ssh/authorized_keys" + path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys" register: aegis_authorized_keys - name: Find Aegis SSH authorized key fragments tags: [aegis, ssh, services] ansible.builtin.find: - paths: "{{ ansible_user_dir }}/.ssh/authorized_keys.d" + paths: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d" file_type: file recurse: false register: aegis_authorized_key_fragments diff --git a/ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2 b/ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2 new file mode 100644 index 0000000..e6cd210 --- /dev/null +++ b/ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2 @@ -0,0 +1,3 @@ +# Managed by Ansible. Do not edit manually. +[Resolve] +DNSStubListener=no diff --git a/ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2 b/ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2 index 4c52d30..937e6bc 100644 --- a/ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2 +++ b/ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2 @@ -3,4 +3,5 @@ Aegis AdGuard Home web interface AdGuard Home administrative web interface on Aegis. + diff --git a/ansible/site.yml b/ansible/site.yml index b2faafb..8498440 100644 --- a/ansible/site.yml +++ b/ansible/site.yml @@ -35,7 +35,7 @@ - role: dotfiles_common when: - "'platform_rocky' not in group_names" - - "'platform_fedora_coreos' not in group_names" + - "'platform_fedora_iot' not in group_names" - name: Configure Void platform hosts: platform_void @@ -71,7 +71,7 @@ - packages_rocky - services_systemd -- name: Configure Aegis Fedora CoreOS profile +- name: Configure Aegis Fedora IoT profile hosts: role_aegis become: true