feat(aegis): harden Fedora IoT services

ansible/roles/profile_aegis/tasks/main.yml

@@ -64,6 +64,36 @@
   no_log: "{{ item.dest == 'icloudpd.container' }}"
   notify: Restart Aegis Quadlet services
 
+- name: Create Aegis systemd-resolved configuration directory
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    path: /etc/systemd/resolved.conf.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Disable Aegis systemd-resolved DNS stub listener
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.template:
+    src: 10-adguard-dns.conf.j2
+    dest: /etc/systemd/resolved.conf.d/10-adguard-dns.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart Aegis systemd-resolved
+    - Restart Aegis Quadlet services
+
+- name: Point Aegis resolver at the full systemd-resolved configuration
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    src: ../run/systemd/resolve/resolv.conf
+    dest: /etc/resolv.conf
+    state: link
+    force: true
+  notify: Restart Aegis systemd-resolved
+
 - name: Enable Aegis firewalld
   tags: [aegis, firewall, services]
   ansible.builtin.systemd:
@@ -116,6 +146,7 @@
   loop:
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="ssh" accept'
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="dns" accept'
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" port port="853" protocol="tcp" accept'
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="aegis-adguard-web" accept'
   loop_control:
     label: "{{ item }}"
@@ -123,13 +154,13 @@
 - name: Check the standard Aegis SSH authorized keys file
   tags: [aegis, ssh, services]
   ansible.builtin.stat:
-    path: "{{ ansible_user_dir }}/.ssh/authorized_keys"
+    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys"
   register: aegis_authorized_keys
 
 - name: Find Aegis SSH authorized key fragments
   tags: [aegis, ssh, services]
   ansible.builtin.find:
-    paths: "{{ ansible_user_dir }}/.ssh/authorized_keys.d"
+    paths: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d"
     file_type: file
     recurse: false
   register: aegis_authorized_key_fragments