feat(aegis): harden Fedora IoT services

AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora CoreOS, WSL, and servers.
+Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora IoT, WSL, and servers.
 
 ## Source Of Truth
 - Main orchestration: `ansible/site.yml`
@@ -17,7 +17,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
 - Workstation: `deadalus` is Windows + Fedora WSL.
 - Ubuntu server: `prometheus`
 - NAS: `atlas` (Rocky Linux 9, reached through SSH)
-- Always-on LAN node: `aegis` (Fedora CoreOS on Raspberry Pi 4, reached through SSH)
+- Always-on LAN node: `aegis` (Fedora IoT on Raspberry Pi 4, reached through SSH)
 - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions.
 - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents.
 
@@ -46,7 +46,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
   - WSL workstation dev: `ansible-playbook ansible/site.yml --limit deadalus --check --diff`
   - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff`
   - Atlas NAS: `ansible-playbook ansible/site.yml --limit atlas --check --diff`
-  - Aegis CoreOS: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
+  - Aegis IoT: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
 - Focused checks:
   - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit <host> --tags emacs --check --diff -e emacs_enabled=true`
   - AI coding agents: `ansible-playbook ansible/site.yml --limit <host> --tags ai_agents --check --diff`
@@ -154,16 +154,19 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - If you add a new operational area, also add the narrowest validation command for it.
 - Call out checks you could not run and any follow-up verification needed.
 
-## Aegis Fedora CoreOS Notes
+## Aegis Fedora IoT Notes
-- `aegis` is a remote Fedora CoreOS Raspberry Pi 4 node. Bootstrap it once with
+- `aegis` is a remote Fedora IoT Raspberry Pi 4 node. Bootstrap it once with
   `ansible/bootstrap/aegis.bu`; the remaining configuration is applied by `profile_aegis` over SSH.
-- Fedora CoreOS is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
+- Fedora IoT is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
 - `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, the
   Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep
   `aegis_lan_subnet` and `aegis_adguard_web_port` host-specific; SSH permits only the declared
   key-authenticated users, never root or password authentication. Keep Apple IDs and other
   credentials in Vault and use `no_log` for their rendering.
-- The initial AdGuard Home wizard uses `aegis_adguard_web_port: 3000`. After selecting a different
+- `aegis_adguard_web_port` defaults to `80`; the playbook also permits HTTPS on `443` and DNS-over-TLS on `853/tcp`. The initial AdGuard
-  UI port, update that host variable and rerun the playbook to close the previous port.
+  Home wizard port `3000` is intentionally unmanaged: open and close it manually only while
+  completing initial setup. Disable the local systemd-resolved stub through `profile_aegis` before
+  AdGuard binds port 53; keep
+  `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf` so Aegis retains router-provided DNS.
 - iCloudPD requires post-deployment interactive MFA initialization; its cookie/configuration state is
   persisted in `/var/lib/icloudpd/config`.

README.md

@@ -36,7 +36,7 @@ infra/
 
 ## Managed machines
 
-The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora CoreOS LAN
+The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora IoT LAN
 node, an Ubuntu server, and a Rocky Linux 9 NAS. Configuration is layered instead of being tied to
 host names:
 
@@ -53,7 +53,7 @@ common user environment
 | `ikaros` | Fedora | Personal workstation | GNOME |
 | `nymph` | Fedora | Desktop laptop | GNOME |
 | `deadalus` | Fedora WSL | Development workstation | — |
-| `aegis` | Fedora CoreOS | Always-on LAN node | — |
+| `aegis` | Fedora IoT | Always-on LAN node | — |
 | `prometheus` | Ubuntu | Server | — |
 | `atlas` | Rocky 9 | NAS | — |
 
@@ -116,7 +116,7 @@ ansible-playbook ansible/site.yml --limit prometheus \
 
 ## Aegis
 
-`aegis` is a Raspberry Pi 4 running Fedora CoreOS. Generate Ignition from
+`aegis` is a Raspberry Pi 4 running Fedora IoT. Generate Ignition from
 `ansible/bootstrap/aegis.bu` with the included Podman/Butane helper, then write the SD card with
 `arm-image-installer`:
 
@@ -128,9 +128,11 @@ The controller manages it remotely as `pi@aegis`; unlike local desktop profiles,
 intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Quadlets for AdGuard
 Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, LAN-restricted
 firewalld rules, SSH key-only access for `pi`, and `wake-ikaros`. Set the host-local
-`aegis_lan_subnet` and `aegis_adguard_web_port` values before applying it. The initial AdGuard Home
+`aegis_lan_subnet` and `aegis_adguard_web_port` values before applying it. The playbook permits
-wizard uses port `3000`; after choosing another web port, update `aegis_adguard_web_port` and rerun
+AdGuard Home on ports `80`, `443`, and DNS-over-TLS on `853/tcp`; the initial wizard port `3000` is intentionally unmanaged and must be
-the playbook so the firewall only permits the selected port. Define
+opened and closed manually during initial setup. The profile disables the local systemd-resolved DNS
+stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53
+for AdGuard while retaining DNS learned from the router. Define
 `vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still requires interactive MFA
 initialization after its first deployment.
 
@@ -251,7 +253,7 @@ ansible-playbook ansible/site.yml --limit deadalus --tags ai_agents --check --di
 | `profile_workstation_dev_wsl` | WSL development setup. |
 | `profile_server` | Server setup. |
 | `profile_atlas` | Rocky Linux 9 NAS setup. |
-| `profile_aegis` | Fedora CoreOS always-on LAN node. |
+| `profile_aegis` | Fedora IoT always-on LAN node. |
 | `dotfiles_common` | Shared user dotfiles. |
 
 ## What `site.yml` runs
@@ -277,7 +279,7 @@ So, in practice:
 - `deadalus` gets the Fedora development layer followed by the WSL layer.
 - `ubuntu_server` configures `prometheus`.
 - `atlas` receives the Rocky platform layer and the NAS profile through SSH.
-- `aegis` receives only the immutable Fedora CoreOS profile through SSH; it does not receive
+- `aegis` receives only the immutable Fedora IoT profile through SSH; it does not receive
   mutable Fedora package or common dotfile roles.
 - Empty `platform_void` groups do nothing until they get a host.
 - The playbook never restarts the display manager during a run.

ansible/bootstrap/aegis.bu

@@ -1,12 +1,12 @@
-# One-time bootstrap for Fedora CoreOS on Aegis (Raspberry Pi 4).
+# One-time bootstrap for Fedora IoT on Aegis (Raspberry Pi 4).
 # Generate only: ./generate-aegis-ign.sh
 # Generate and write an SD card: ./generate-aegis-ign.sh --write IMAGE DEVICE
 # The write mode uses arm-image-installer with the RPi4 target and embeds
 # config.ign; it prompts for Wi-Fi credentials unless supplied through its
 # WIFI_SSID and WIFI_PASS environment variables.
 # For WiFi, the UEFI 'System Table Selection' must be DeviceTree (Esc at boot).
-variant: fcos
+variant: fiot
-version: 1.6.0
+version: 1.0.0
 passwd:
   users:
     - name: pi

ansible/inventory/group_vars/platform_fedora_coreos.yml

@@ -1,2 +0,0 @@
----
-# Fedora CoreOS is immutable: do not attach the mutable Fedora package roles.

ansible/inventory/group_vars/platform_fedora_iot.yml

@@ -0,0 +1,2 @@
+---
+# Fedora IoT is immutable: do not attach the mutable Fedora package roles.

ansible/inventory/host_vars/aegis.yml

@@ -4,8 +4,10 @@ ansible_connection: ssh
 ansible_user: pi
 ansible_become: true
 ansible_python_interpreter: /usr/bin/python3
+# Avoid PTY framing around module JSON on this remote Fedora IoT host.
+ansible_ssh_use_tty: false
 
 aegis_lan_subnet: 192.168.178.0/24
-aegis_adguard_web_port: 3000
+aegis_adguard_web_port: 80
 
 aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}"

ansible/inventory/hosts.yml

@@ -13,7 +13,7 @@ all:
         deadalus:
           ansible_connection: local
 
-    platform_fedora_coreos:
+    platform_fedora_iot:
       hosts:
         aegis:
 
@@ -28,7 +28,7 @@ all:
     fedora:
       children:
         platform_fedora:
-        platform_fedora_coreos:
+        platform_fedora_iot:
 
     rocky:
       children:

ansible/roles/profile_aegis/defaults/main.yml

@@ -10,6 +10,7 @@ aegis_wol_port: 9
 
 aegis_lan_subnet: CHANGEME_LAN_SUBNET
 aegis_firewalld_zone: public
-aegis_adguard_web_port: 3000
+aegis_adguard_web_port: 80
 aegis_ssh_allowed_users:
   - pi
+aegis_ssh_user_home: "/var/home/{{ ansible_user }}"

ansible/roles/profile_aegis/handlers/main.yml

@@ -1,4 +1,9 @@
 ---
+- name: Restart Aegis systemd-resolved
+  ansible.builtin.systemd:
+    name: systemd-resolved.service
+    state: restarted
+
 - name: Reload Aegis SSH
   ansible.builtin.systemd:
     name: sshd.service

ansible/roles/profile_aegis/tasks/main.yml

@@ -64,6 +64,36 @@
   no_log: "{{ item.dest == 'icloudpd.container' }}"
   notify: Restart Aegis Quadlet services
 
+- name: Create Aegis systemd-resolved configuration directory
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    path: /etc/systemd/resolved.conf.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Disable Aegis systemd-resolved DNS stub listener
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.template:
+    src: 10-adguard-dns.conf.j2
+    dest: /etc/systemd/resolved.conf.d/10-adguard-dns.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart Aegis systemd-resolved
+    - Restart Aegis Quadlet services
+
+- name: Point Aegis resolver at the full systemd-resolved configuration
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    src: ../run/systemd/resolve/resolv.conf
+    dest: /etc/resolv.conf
+    state: link
+    force: true
+  notify: Restart Aegis systemd-resolved
+
 - name: Enable Aegis firewalld
   tags: [aegis, firewall, services]
   ansible.builtin.systemd:
@@ -116,6 +146,7 @@
   loop:
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="ssh" accept'
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="dns" accept'
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" port port="853" protocol="tcp" accept'
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="aegis-adguard-web" accept'
   loop_control:
     label: "{{ item }}"
@@ -123,13 +154,13 @@
 - name: Check the standard Aegis SSH authorized keys file
   tags: [aegis, ssh, services]
   ansible.builtin.stat:
-    path: "{{ ansible_user_dir }}/.ssh/authorized_keys"
+    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys"
   register: aegis_authorized_keys
 
 - name: Find Aegis SSH authorized key fragments
   tags: [aegis, ssh, services]
   ansible.builtin.find:
-    paths: "{{ ansible_user_dir }}/.ssh/authorized_keys.d"
+    paths: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d"
     file_type: file
     recurse: false
   register: aegis_authorized_key_fragments

ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2

@@ -0,0 +1,3 @@
+# Managed by Ansible. Do not edit manually.
+[Resolve]
+DNSStubListener=no

ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2

@@ -3,4 +3,5 @@
   <short>Aegis AdGuard Home web interface</short>
   <description>AdGuard Home administrative web interface on Aegis.</description>
   <port protocol="tcp" port="{{ aegis_adguard_web_port }}"/>
+  <port protocol="tcp" port="443"/>
 </service>

ansible/site.yml

@@ -35,7 +35,7 @@
     - role: dotfiles_common
       when:
         - "'platform_rocky' not in group_names"
-        - "'platform_fedora_coreos' not in group_names"
+        - "'platform_fedora_iot' not in group_names"
 
 - name: Configure Void platform
   hosts: platform_void
@@ -71,7 +71,7 @@
     - packages_rocky
     - services_systemd
 
-- name: Configure Aegis Fedora CoreOS profile
+- name: Configure Aegis Fedora IoT profile
   hosts: role_aegis
   become: true