feat(aegis): harden Fedora IoT services

ansible/roles/profile_aegis/defaults/main.yml

@@ -10,6 +10,7 @@ aegis_wol_port: 9
 
 aegis_lan_subnet: CHANGEME_LAN_SUBNET
 aegis_firewalld_zone: public
-aegis_adguard_web_port: 3000
+aegis_adguard_web_port: 80
 aegis_ssh_allowed_users:
   - pi
+aegis_ssh_user_home: "/var/home/{{ ansible_user }}"

ansible/roles/profile_aegis/handlers/main.yml

@@ -1,4 +1,9 @@
 ---
+- name: Restart Aegis systemd-resolved
+  ansible.builtin.systemd:
+    name: systemd-resolved.service
+    state: restarted
+
 - name: Reload Aegis SSH
   ansible.builtin.systemd:
     name: sshd.service

ansible/roles/profile_aegis/tasks/main.yml

@@ -64,6 +64,36 @@
   no_log: "{{ item.dest == 'icloudpd.container' }}"
   notify: Restart Aegis Quadlet services
 
+- name: Create Aegis systemd-resolved configuration directory
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    path: /etc/systemd/resolved.conf.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Disable Aegis systemd-resolved DNS stub listener
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.template:
+    src: 10-adguard-dns.conf.j2
+    dest: /etc/systemd/resolved.conf.d/10-adguard-dns.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart Aegis systemd-resolved
+    - Restart Aegis Quadlet services
+
+- name: Point Aegis resolver at the full systemd-resolved configuration
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    src: ../run/systemd/resolve/resolv.conf
+    dest: /etc/resolv.conf
+    state: link
+    force: true
+  notify: Restart Aegis systemd-resolved
+
 - name: Enable Aegis firewalld
   tags: [aegis, firewall, services]
   ansible.builtin.systemd:
@@ -116,6 +146,7 @@
   loop:
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="ssh" accept'
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="dns" accept'
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" port port="853" protocol="tcp" accept'
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="aegis-adguard-web" accept'
   loop_control:
     label: "{{ item }}"
@@ -123,13 +154,13 @@
 - name: Check the standard Aegis SSH authorized keys file
   tags: [aegis, ssh, services]
   ansible.builtin.stat:
-    path: "{{ ansible_user_dir }}/.ssh/authorized_keys"
+    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys"
   register: aegis_authorized_keys
 
 - name: Find Aegis SSH authorized key fragments
   tags: [aegis, ssh, services]
   ansible.builtin.find:
-    paths: "{{ ansible_user_dir }}/.ssh/authorized_keys.d"
+    paths: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d"
     file_type: file
     recurse: false
   register: aegis_authorized_key_fragments

ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2

@@ -0,0 +1,3 @@
+# Managed by Ansible. Do not edit manually.
+[Resolve]
+DNSStubListener=no

ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2

@@ -3,4 +3,5 @@
   <short>Aegis AdGuard Home web interface</short>
   <description>AdGuard Home administrative web interface on Aegis.</description>
   <port protocol="tcp" port="{{ aegis_adguard_web_port }}"/>
+  <port protocol="tcp" port="443"/>
 </service>