Verify WireGuard handshakes and restore Podman networking

AGENTS.md

@@ -134,8 +134,8 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - `atlas_manage_storage`, `atlas_manage_sharing`, and `atlas_manage_firewall` are enabled in Atlas host vars as
   the declared steady state; set one false only for a deliberate suspension. `atlas_manage_media_stack` remains false
   until the future rootful Immich stack has its required Vault inputs and target validation.
-- Atlas requires `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` for Cockpit
-  and, while sharing is enabled, `vault_atlas_samba_password`. The future rootful media stack also requires
+- Atlas requires `vault_atlas_admin_password_hash` for Cockpit and, while sharing is enabled,
+  `vault_atlas_samba_password`. The future rootful media stack also requires
   `vault_atlas_immich_db_password`. Never print these values.
 - Atlas creates the complete declared hierarchy only under the verified existing or explicitly bootstrapped pool: `work`, `archive`,
   `archive/app_data`, `archive/app_data/navidrome`, `archive/app_data/syncthing`, `media`, `media/music`,
@@ -161,8 +161,11 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
   use `10.0.0.2:4533` for Navidrome and `10.0.0.2:8384` for the Syncthing GUI. Syncthing does not use host networking:
   its GUI, transfer, QUIC and discovery ports are explicitly published only on `10.0.0.2`; native transfer/discovery does not use the HTTP proxy.
 - `wireguard_overlay` manages the required `wg0` path between Prometheus and Atlas, persists private keys only on their
-  respective hosts, and exchanges only derived public keys. The initial run must include both hosts. Prometheus
-  opens `51820/udp`; the Atlas backend role admits service ports only in the WireGuard firewalld zone.
+  respective hosts, exchanges only derived public keys, and verifies a real peer handshake. The initial run must
+  include both hosts. Prometheus
+  opens `51820/udp`; after creating the WireGuard firewalld zone, restore Prometheus' rootful Podman networking with
+  `podman network reload --all` so the existing proxy stack retains container DNS. The Atlas backend role admits
+  service ports only in the WireGuard firewalld zone.
 
 ## Atlas NAS TODO
 - Provide the required Vault variables and validate the first remote bootstrap on the real Rocky Linux 9 host.
@@ -178,8 +181,9 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
   or API access for the selected clients.
 - Validate the managed WireGuard path and its LAN/VPN-only firewalld rules before enabling remote services;
   never expose SSH, Cockpit, NFS, SMB or Syncthing through public port forwarding.
-- Add the least-privilege Prometheus backup flow: remote dump generation, dedicated SSH identity,
-  pinned host key, atomic pull, verification, retention and an Atlas systemd service/timer.
+- Add the Atlas-initiated least-privilege Prometheus backup pull: Prometheus exposes only prepared
+  read-only dumps through a dedicated account and Atlas retains the private SSH key, pinned host key,
+  atomic pull, verification, retention and systemd service/timer.
 - Add the encrypted offsite backup with Borg to a Hetzner Storage Box: use a dedicated SSH identity,
   pin the host key, keep Borg repository credentials and encryption material in Vault, use
   snapshot-consistent sources, and manage retries, logging, pruning, repository checks and restores.

README.md

@@ -133,6 +133,8 @@ ansible-playbook ansible/site.yml --limit prometheus \
 ```
 
 The target must already provide `server_username` with local sudo access.
+Prometheus authorizes its declared SSH public keys through separate files below
+`~/.ssh/authorized_keys.d/`, while `sshd` is configured to read those files directly.
 
 ### DuckDNS
 
@@ -196,6 +198,10 @@ for AdGuard while retaining DNS learned from the router. Define
 `vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still requires interactive MFA
 initialization after its first deployment.
 
+New Aegis images create the `admin` account in Butane. Before configuring a newly imaged node, run its
+first playbook execution with `-e ansible_user=admin`; the SSH hardening role then permits that same
+account. Keep the inventory on `pi` until the existing node has been replaced.
+
 Validate the profile before deployment:
 
 ```bash
@@ -211,20 +217,26 @@ only manages child datasets. A one-time RAIDZ2 bootstrap is available only with
 It never partitions, forces, destroys, rolls back, or changes the vdev layout of an existing pool. Linux
 clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the configured LAN.
 
-For the first run, provide `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`,
-`vault_atlas_samba_password`, and `vault_atlas_immich_db_password`. Bootstrap the host through its
-existing administrator:
+For the first run, provide `vault_atlas_admin_password_hash`, `vault_atlas_samba_password`, and
+`vault_atlas_immich_db_password`. Bootstrap the host through its
+existing administrator. Open `51820/udp` towards Prometheus in the provider firewall first, then
+include both WireGuard peers in the same idempotent playbook run:
 
 ```bash
-ansible-playbook ansible/site.yml --limit atlas \
-  -e atlas_connection_username=<existing-admin>
+ansible-playbook ansible/site.yml --limit prometheus,atlas \
+  -e atlas_connection_username=<existing-admin> \
+  -e atlas_create_pool=true
 ```
 
+The explicit pool gate is safe to repeat: the role creates the RAIDZ2 pool only when it is absent.
+WireGuard waits for a real peer handshake before the play continues.
+
 `vault_atlas_admin_password_hash` must be an `/etc/shadow`-compatible hash, not a clear-text
 Cockpit password. Subsequent runs use `atlas_admin_username`. Atlas declares storage, sharing, and its
 LAN firewall rules enabled. Before the first apply, check the existing pool and mountpoints, LAN subnet,
 and active firewalld zone. `atlas_manage_media_stack` remains disabled until `/dev/dri`, the container
-paths, and the Immich database secret are validated.
+paths, and the Immich database secret are validated. Atlas reads its declared SSH public keys from
+separate files below `~/.ssh/authorized_keys.d/`.
 
 With storage management enabled, Atlas creates the complete dataset hierarchy below the existing or
 explicitly bootstrapped `zpool`: `work`, `archive`, `archive/app_data`, the separate `archive/app_data/navidrome` and
@@ -255,7 +267,9 @@ storage paths from the `zpool` mounted at `/zpool`: music is read-only at
 containers. The backend role never creates the pool. The separate `wireguard_overlay` role manages `wg0`
 between Prometheus (`10.0.0.1`) and Atlas (`10.0.0.2`), generating private keys once
 on their respective hosts and exchanging only public keys through Ansible. Prometheus alone opens
-`51820/udp` publicly. Backend ports are admitted only in the WireGuard firewalld zone.
+`51820/udp` publicly. When the WireGuard zone is created, Ansible reloads firewalld and immediately
+reloads Prometheus' rootful Podman networks so the existing proxy stack retains container DNS and
+connectivity. Backend ports are admitted only in the WireGuard firewalld zone.
 
 `backend_phase1_start_services` stays false during the application-state transfer, so the first real
 backend run renders the Quadlets without creating an empty Atlas database. After stopping Navidrome

ansible/bootstrap/aegis.bu

@@ -9,12 +9,14 @@ variant: fiot
 version: 1.0.0
 passwd:
   users:
-    - name: pi
+    - name: admin
       password_hash: "$6$bNDsU0XC5BxNJS5U$ENDGpdOUPJM3wcXBgNESCQkOqqQ9gN72/xEQoJsAI6QdsaY6mD4G5DBVIv7nHwHQOP35IH1oGRl.Uy3R2iUYQ1"
       groups:
         - wheel
       ssh_authorized_keys:
         - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 systemd:
   units:
     - name: sshd.service

ansible/inventory/group_vars/platform_rocky.yml

@@ -5,6 +5,9 @@ platform_package_manager: dnf
 platform_service_manager: systemd
 
 rocky_openzfs_release_rpm: https://zfsonlinux.org/epel/zfs-release-3-0.el9.noarch.rpm
+rocky_openzfs_gpg_key_url: >-
+  https://raw.githubusercontent.com/zfsonlinux/zfsonlinux.github.com/master/zfs-release/RPM-GPG-KEY-openzfs-key2
+rocky_openzfs_gpg_key_fingerprint: 7DC7 299D CF7C 7FD9 CD87 701B A599 FD5E 9DB8 4141
 rocky_syncthing_version: 2.1.3
 rocky_syncthing_archive_checksum: sha256:f929eb8e5b72a85543eeeefb2c38f34a68e0c530e70758a2905b78840c76602c
 rocky_syncthing_archive_url: >-

ansible/inventory/group_vars/server.yml

@@ -95,3 +95,5 @@ server_sshd_settings:
 
 server_sshd_allow_users:
   - "{{ server_username }}"
+server_ssh_authorized_keys: []
+server_ssh_authorized_key_directory: "{{ server_user_home }}/.ssh/authorized_keys.d"

ansible/inventory/host_vars/aegis.yml

@@ -9,5 +9,12 @@ ansible_ssh_use_tty: false
 
 aegis_lan_subnet: 192.168.178.0/24
 aegis_adguard_web_port: 80
+aegis_ssh_authorized_keys:
+  - name: ikaros
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+  - name: nymph
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+  - name: siren
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 
 aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}"

ansible/inventory/host_vars/atlas.yml

@@ -12,7 +12,13 @@ atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"
 atlas_admin_uid: 1000
 atlas_admin_gid: 1000
-atlas_admin_ssh_keys: "{{ vault_atlas_authorized_ssh_keys | default([]) }}"
+atlas_admin_ssh_keys:
+  - name: ikaros
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+  - name: nymph
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+  - name: siren
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}"
 atlas_ssh_allow_tcp_forwarding: local
 
@@ -22,8 +28,12 @@ atlas_manage_firewall: true
 atlas_firewalld_zone: public
 atlas_zfs_pool: zpool
 # Populate only for the first pool bootstrap with four real persistent disk paths.
-# Example: /dev/disk/by-id/ata-Seagate_IronWolf_...
-atlas_zpool_disks: []
+# Confirmed empty 4 TB IronWolf data disks; the NVMe system disk is intentionally excluded.
+atlas_zpool_disks:
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1XM
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A73T2
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A6VJK
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1LM
 atlas_create_pool: false
 atlas_zfs_dataset_work: work
 atlas_zfs_dataset_archive: archive

ansible/inventory/host_vars/prometheus.yml

@@ -7,11 +7,19 @@ ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 
 server_username: rocky
 server_duckdns_domain: fscotto
+server_ssh_authorized_keys:
+  - name: ikaros
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+  - name: nymph
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+  - name: siren
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 
 wireguard_overlay_enabled: true
 wireguard_address: 10.0.0.1/24
 wireguard_listen_port: 51820
 wireguard_enable_ipv4_forwarding: true
+wireguard_reload_rootful_podman_networks: true
 wireguard_peers:
   - name: atlas
     host: atlas

ansible/roles/packages_rocky/tasks/main.yml

@@ -27,6 +27,14 @@
     name: epel-release
     state: present
 
+- name: Import official OpenZFS EL9+ signing key
+  tags: [packages, storage]
+  ansible.builtin.rpm_key:
+    state: present
+    key: "{{ rocky_openzfs_gpg_key_url }}"
+    fingerprint: "{{ rocky_openzfs_gpg_key_fingerprint }}"
+  when: rocky_manage_openzfs_repo | bool
+
 - name: Install official OpenZFS repository package
   tags: [packages, storage]
   ansible.builtin.dnf:

ansible/roles/profile_aegis/defaults/main.yml

@@ -12,5 +12,6 @@ aegis_lan_subnet: CHANGEME_LAN_SUBNET
 aegis_firewalld_zone: public
 aegis_adguard_web_port: 80
 aegis_ssh_allowed_users:
-  - pi
+  - "{{ ansible_user }}"
 aegis_ssh_user_home: "/var/home/{{ ansible_user }}"
+aegis_ssh_authorized_keys: []

ansible/roles/profile_aegis/tasks/main.yml

@@ -165,6 +165,29 @@
     path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys"
   register: aegis_authorized_keys
 
+- name: Ensure Aegis SSH authorized key fragments directory exists
+  tags: [aegis, ssh, services]
+  ansible.builtin.file:
+    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0700"
+  when: aegis_ssh_authorized_keys | length > 0
+
+- name: Manage Aegis SSH authorized key fragments
+  tags: [aegis, ssh, services]
+  ansible.builtin.copy:
+    content: "{{ item.key }}\n"
+    dest: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d/{{ item.name }}"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0600"
+  loop: "{{ aegis_ssh_authorized_keys }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when: aegis_ssh_authorized_keys | length > 0
+
 - name: Find Aegis SSH authorized key fragments
   tags: [aegis, ssh, services]
   ansible.builtin.find:
@@ -178,7 +201,8 @@
   ansible.builtin.assert:
     that:
       - >-
-        (aegis_authorized_keys.stat.exists and aegis_authorized_keys.stat.size | int > 0)
+        (aegis_ssh_authorized_keys | length > 0)
+        or (aegis_authorized_keys.stat.exists and aegis_authorized_keys.stat.size | int > 0)
         or aegis_authorized_key_fragments.matched | int > 0
     fail_msg: Add a public key for the Ansible SSH user before disabling password authentication.
 

ansible/roles/profile_atlas/defaults/main.yml

@@ -10,6 +10,7 @@ atlas_admin_home: "/home/{{ atlas_admin_username }}"
 atlas_admin_uid: 1000
 atlas_admin_gid: 1000
 atlas_admin_ssh_keys: []
+atlas_admin_ssh_key_directory: "{{ atlas_admin_home }}/.ssh/authorized_keys.d"
 atlas_admin_password_hash: "!"
 # Local forwarding permits an administrator to tunnel a private service without allowing remote forwards.
 atlas_ssh_allow_tcp_forwarding: local

ansible/roles/profile_atlas/tasks/account.yml

@@ -9,8 +9,8 @@
       - atlas_ssh_allow_tcp_forwarding in ['no', 'yes', 'local', 'remote', 'all']
       - "'wheel' not in atlas_immich_supplementary_groups"
     fail_msg: >-
-      Define atlas_admin_username, vault_atlas_authorized_ssh_keys and
-      vault_atlas_admin_password_hash before applying the Atlas profile.
+      Define atlas_admin_username, atlas_admin_ssh_keys and vault_atlas_admin_password_hash
+      before applying the Atlas profile.
   no_log: true
 
 - name: Create Atlas administrator group
@@ -78,13 +78,26 @@
     mode: "0440"
     validate: "visudo -cf %s"
 
-- name: Manage Atlas administrator authorized SSH keys exclusively
+- name: Ensure Atlas administrator SSH authorized key fragments directory exists
   tags: [atlas, services]
-  ansible.posix.authorized_key:
-    user: "{{ atlas_admin_username }}"
-    key: "{{ atlas_admin_ssh_keys | join('\n') }}"
-    state: present
-    exclusive: true
+  ansible.builtin.file:
+    path: "{{ atlas_admin_ssh_key_directory }}"
+    state: directory
+    owner: "{{ atlas_admin_username }}"
+    group: "{{ atlas_admin_group }}"
+    mode: "0700"
+
+- name: Manage Atlas administrator SSH authorized key fragments
+  tags: [atlas, services]
+  ansible.builtin.copy:
+    content: "{{ item.key }}\n"
+    dest: "{{ atlas_admin_ssh_key_directory }}/{{ item.name }}"
+    owner: "{{ atlas_admin_username }}"
+    group: "{{ atlas_admin_group }}"
+    mode: "0600"
+  loop: "{{ atlas_admin_ssh_keys }}"
+  loop_control:
+    label: "{{ item.name }}"
 
 - name: Check whether the Atlas SSH host key exists
   tags: [atlas, services]

ansible/roles/profile_atlas/tasks/pool.yml

@@ -16,6 +16,7 @@
     - name: Inspect declared Atlas pool disks
       ansible.builtin.stat:
         path: "{{ item }}"
+        follow: true
       loop: "{{ atlas_zpool_disks }}"
       loop_control:
         label: "{{ item }}"

ansible/roles/profile_atlas/tasks/sharing.yml

@@ -56,6 +56,16 @@
   notify: Reload NFS exports
   when: atlas_manage_sharing | bool
 
+- name: Ensure Atlas NFS configuration drop-in directory exists
+  tags: [atlas, sharing]
+  ansible.builtin.file:
+    path: /etc/nfs.conf.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: atlas_manage_sharing | bool
+
 - name: Configure Atlas NFSv4-only service
   tags: [atlas, sharing]
   ansible.builtin.template:
@@ -214,9 +224,22 @@
     - atlas_manage_sharing | bool
     - not ansible_check_mode
 
-- name: Read Atlas file-sharing service state
+- name: Check active Atlas file-sharing services
   tags: [atlas, sharing, services, security]
-  ansible.builtin.service_facts:
+  ansible.builtin.command:
+    argv:
+      - systemctl
+      - is-active
+      - --quiet
+      - "{{ item }}"
+  loop:
+    - nfs-server.service
+    - smb.service
+  loop_control:
+    label: "{{ item }}"
+  register: atlas_file_sharing_service_activity
+  changed_when: false
+  failed_when: false
   when:
     - atlas_manage_sharing | bool
     - not ansible_check_mode
@@ -225,10 +248,7 @@
   tags: [atlas, sharing, services, security]
   ansible.builtin.assert:
     that:
-      - ansible_facts.services['nfs-server.service'] is defined
-      - ansible_facts.services['nfs-server.service'].state == 'running'
-      - ansible_facts.services['smb.service'] is defined
-      - ansible_facts.services['smb.service'].state == 'running'
+      - atlas_file_sharing_service_activity.results | map(attribute='rc') | list == [0, 0]
     fail_msg: Atlas NFSv4 or SMB3 did not start after its managed configuration was applied.
   when:
     - atlas_manage_sharing | bool

ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2

@@ -4,6 +4,12 @@ PubkeyAuthentication yes
 PasswordAuthentication no
 KbdInteractiveAuthentication no
 AuthenticationMethods publickey
+AuthorizedKeysFile {{
+  atlas_admin_ssh_keys
+  | map(attribute='name')
+  | map('regex_replace', '^', '%h/.ssh/authorized_keys.d/')
+  | join(' ')
+}}
 X11Forwarding no
 AllowTcpForwarding {{ atlas_ssh_allow_tcp_forwarding }}
 AllowAgentForwarding no

ansible/roles/profile_server/tasks/main.yml

@@ -61,6 +61,42 @@
   tags: [services, podman]
   ansible.builtin.include_tasks: podman-compose.yml
 
+- name: Ensure server SSH authorized key fragments directory exists
+  tags: [services, ssh]
+  ansible.builtin.file:
+    path: "{{ server_ssh_authorized_key_directory }}"
+    state: directory
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0700"
+  when: server_ssh_authorized_keys | length > 0
+
+- name: Manage server SSH authorized key fragments
+  tags: [services, ssh]
+  ansible.builtin.copy:
+    content: "{{ item.key }}\n"
+    dest: "{{ server_ssh_authorized_key_directory }}/{{ item.name }}"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0600"
+  loop: "{{ server_ssh_authorized_keys }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when: server_ssh_authorized_keys | length > 0
+
+- name: Configure server SSH authorized key fragments
+  tags: [services, ssh]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*AuthorizedKeysFile\s+'
+    line: >-
+      AuthorizedKeysFile {{ server_ssh_authorized_keys | map(attribute='name')
+      | map('regex_replace', '^', '%h/.ssh/authorized_keys.d/') | join(' ') }}
+    state: present
+    validate: "sshd -t -f %s"
+  notify: Reload SSH service
+  when: server_ssh_authorized_keys | length > 0
+
 - name: Disable SSH root login on server
   tags: [services]
   ansible.builtin.lineinfile:

ansible/roles/wireguard_overlay/defaults/main.yml

@@ -10,6 +10,9 @@ wireguard_mtu: 1420
 wireguard_firewalld_zone: wireguard
 wireguard_public_firewalld_zone: public
 wireguard_enable_ipv4_forwarding: false
+wireguard_reload_rootful_podman_networks: false
+wireguard_handshake_retries: 12
+wireguard_handshake_delay: 5
 wireguard_peers: []
 wireguard_packages:
   - wireguard-tools

ansible/roles/wireguard_overlay/tasks/main.yml

@@ -132,6 +132,20 @@
         - wireguard_firewalld_zone_result is changed
         - not ansible_check_mode
 
+    - name: Restore rootful Podman networking after firewalld reload
+      ansible.builtin.command:
+        argv:
+          - podman
+          - network
+          - reload
+          - --all
+      register: wireguard_podman_network_reload
+      changed_when: wireguard_podman_network_reload.stdout_lines | length > 0
+      when:
+        - wireguard_firewalld_zone_result is changed
+        - wireguard_reload_rootful_podman_networks | bool
+        - not ansible_check_mode
+
     - name: Assign the WireGuard interface to its firewalld zone
       ansible.posix.firewalld:
         interface: "{{ wireguard_interface }}"
@@ -156,3 +170,23 @@
         state: started
         daemon_reload: true
       when: not ansible_check_mode
+
+    - name: Apply pending WireGuard handlers before verification
+      ansible.builtin.meta: flush_handlers
+      when: not ansible_check_mode
+
+    - name: Wait for every WireGuard peer handshake
+      ansible.builtin.command:
+        argv:
+          - wg
+          - show
+          - "{{ wireguard_interface }}"
+          - latest-handshakes
+      register: wireguard_latest_handshakes
+      changed_when: false
+      retries: "{{ wireguard_handshake_retries }}"
+      delay: "{{ wireguard_handshake_delay }}"
+      until:
+        - wireguard_latest_handshakes.stdout_lines | length == wireguard_peers | length
+        - wireguard_latest_handshakes.stdout_lines | select('search', '\t0$') | list | length == 0
+      when: not ansible_check_mode

secrets/vault.yml

@@ -1,92 +1,78 @@
 $ANSIBLE_VAULT;1.1;AES256
-39613737656234646631643933343136616133616631646435313739613739646232323939643939
-3530316437326161653531626464633034643332343539390a353161623661366434386339336533
-64646239383036373863623866633532666433626165326662633935383961316636653462316664
-3338313762363130310a643765656337316664323531343666346331383835666664383936393161
-65623631643438333837353638613934353766656334616565363430373462323466663963306564
-37333436633266336163396566373530326636303537313864306637323462346461656366373234
-63383330633836393534646665613966646435656438303230636364616538646438643132623166
-61646237313835336363333733343634386536356436643131386630656431363238666330646633
-65316261363639346231613364303939303334623832353766613736336434306336656636336366
-33643563343961306164326466323730613334613330306133373139636235646238366334626233
-33306161613436313337663133393664643663336635623536366137613462633532316636313730
-65633433393431383661653933376563633234373763666334633339376133373733623233643034
-64643265333539396531366539303861393837303037363832353763323438306639303865663239
-32333635616236363131356163343366343862353735356563663733346535646663613862643162
-32313635343932396362623138393036633262303963623763643736333337333730306531613164
-31353934323238336663386633616232653162616338373136373635343139343337656138623037
-64616161633564393863633564386665306462646234663162646136656430313835386137333939
-39626561616135663638633261356335366431653230633264383939363033363632386562616534
-35303465383562383233353463313733393662353036393936346134376430313761653861636136
-30333136356331303066336336366433653165393731353732313533653431363634666266663433
-31323266333665393739363339333463633463623836646161633633316164336161386636633666
-64323039653261333731643033383166653334646661626434323234346638353531653731633733
-65363335363236653935323130643662336636343734383231343433626261353363333330396661
-30336133663364363064623066303266343732383538346162656465663361626236316166326466
-66366536316533633339336666363836636138396133366534366365616430376632636563306464
-36643334393565363363626339343061333433383133613865323831653034303432323439646439
-37353235613662346633613461373137626131336164393832383235663939613366303733333663
-32396334653336353534346338306637386361326334313032366636636636666265633534393033
-66356430333866383332343132656635303262336661313735656632626561373938366265666265
-32653630366166313736396464613638396465616362386363346539326464313632306136346538
-66663839626639323033313236343162643632323039636563643166623364643063393064356364
-38356662353965313239356339326563303562353735623236396332333035326138353162333961
-31303562616166393964363233393564366666613331316263363838316635653631636436343537
-65666434356438383365353539333339616162643737626163353866663336336165626430636562
-35643563646562323938396464303339613265633132623862396561666665653032653531393065
-35623761623230643434313133346639383438613934306631616366656534333561333337323938
-37643533306361373137376433383334306137613034623665386638303738386337616365313762
-35386138366630306534346538333637303135643262313638323466623937623366663938613461
-61303439326665306139323039613032343436313966623862306464623966343362633761323135
-31623262646166303235633935663034363139393737353737353538336662313833396639326562
-61386539383430623462353264306566633562373030656639386163646534653035633064623738
-39616665666334613537366362376235336630393066316563323832636632326165646635366331
-64346239323033303665326533393038303236663736653435643662346330373166306435646430
-36303136623466396234336232366234633235313234346239356435633533356264386236353432
-61613264656664633035376331366131613865633462616161613763353239323765366438323266
-39383034303130316339663431366263376631343131633362623566633638393164393232396266
-66663637623637613831653463383532323539623361656466383634623131633962396561633361
-66376164613665306239336164356564616230306335343363326433376237646330613263323534
-33303663396239633934613864633433313264336431363732333038343766663835666636643438
-36376638396539313063646464386537656330613537343462386563643135323363383537643232
-32323930646338326564316635326463623063373161623338623865353837626135326438343961
-32323236363936373564646530323165616664393166313135626630346166363261353538656365
-31633161393739643339303830313731386333393138346437666130333565653439626165303636
-66623466663534333039343738363130383234373638333362383135396239633763343264316333
-39623135663636313565643633383232616531623431383438383730643035356666313065373431
-66646239643333646630623364616439323836346334633336343434323162363865653761356539
-31336136626337643862313938363762393263303565326135333465393633303366336531373130
-32366163333638393337323438316633626365646238663035646538393638363637323034653430
-39613434633730363461373338376232376630376134653333313634303862373839663039303265
-64616264616134643432353431356139653965356131623862633061326236346631306166656661
-63616531386564663261313566646565396439363762313438393339383165333936653230613230
-63666335376431316435313535626137313662633137376635396365306565346465373631306462
-36393066373065313934366161616431626463623130663133346534303437643834383837333938
-35366530303962383230386531653334336632363439306633303330343638316161636264646661
-33623239396234653562663332313465353239323339366632643138663363393130653037316430
-65383936313937303531366632306538626661626531636638643662623333376335343866623662
-31363130643037663032323739353436356430383462656633336238336462346563666538383166
-65653932663262656331356136663130333365636564316537353037383430333464663037323637
-36666337306261313533666233653735363639393164373339313137393337636534323966386466
-32633633346131656164353562616430643262376466316437356135366330366564356432616539
-36643337626664333731383939393662376162333161656534656432306263653438373137373563
-39343739373663363539616666663364646133393437383631346630643733656333323131643361
-32643165646130313637373561613938383565393838663965616339666663353538386262613831
-62653362373738373562646430313335623439346233663264326638306131306161623963636639
-35636139376338323530666633363437353931343438303639333835656135633038323336653261
-64393164326638336434393061383565653631356361653661373363363361366538333434383939
-65303139386262373330393865323965333937313434633261653962336630346234663766313537
-61323662633739363538393730326161616365346439343038613266613165373434613864626139
-35393261363237656665343962343035306332336630313138376661663938393336626336636662
-33653732393933646639323739303565616630356262613263363165376139363039316166653964
-61316630623139656331313864626261363232623765396139313339393564373935323132363837
-61363432633932393634383762316565393065323430333533363538353539663237313037643433
-64303430386262626135353739633038633837393037313135346334643231636163633463626234
-36336337633462613435346434643932303463396265653933306464336132323961656363353235
-64336332613035306564383066363936326133383630343230653238303762393166626563353833
-39316335303361303466623463393162333663636333363432393661656638306564356435363661
-30666664386633376439623864336366363338633330663066343563663066363562313239323030
-63353865366638663666363032616234343437613330353739336332326139323534356439376165
-63303938643039363330643363633632333864613639663838643432326237616665626434353464
-34363737366133323037656234643534373835346166363534653635323930313430343337623833
-386535373562653337356164376531646433
+31386434333363613930316363393564373332303236306233643365386639346631336232373361
+3732633931376438313835373537666438383664306266380a633531316432343166323361303465
+39306136386664356163346266303963373839373763343136346135633236333333326331313063
+6264306265373865310a373735393632373861333433326632303931633732636535326264346537
+39633766326361666432396432623132616666363462373237623664363664373362346366383230
+65326665303762356233356531306331333231376163353638363936626562623937323166623065
+62633165383033303362336238343037353930396430336537363565333132666532323662653262
+65373531313264353938666161373064393239653165666462336665323962336134343432316134
+32373361613539356262313333663964623034313230356439626139383539326261663765373034
+36633933366662656464306561393130373238313730336638663932633935313037363133636266
+36663935303735623132663464376633306431396662306166393831313566323238363865303162
+66303732376530653435613966373832333161333137366230613166303061333433336461386234
+63393030616662373666643164663862653037383336323766646330653131623930353265336231
+39646335353635616465663763306262353931316562616437313362616136623735646535616431
+33363439623361343231363663363535663265366166346439623935323632366336363135373462
+62646662316538323734333334393566333463653833326162663065646634363336373865623932
+33646533636638386534366561663930613536663935663638313137646537626431393035653466
+36623435613966323166363630383531656436373366343364346439343034333934623836336636
+38653534343563393434646430306662343435653465363439326261373537666233353731306436
+35323739336361343665633239366633393530346335396635316238323435663466316235376536
+38303839313433643038353236616632626363653339346334303136306138336461383831626536
+39303966393034333739363061363865326165303236656438316537396463383935393764346135
+66323632323833353833643434316566326366633562666262386232653730303038613336663264
+62636332383834393861373665393364653362636339346632303463386565633830336363393065
+31383530613161366436323163393366386635316562633436383134623061353937326363396439
+38636438396637616362373937666361303536376164636533653536306338356263313965623336
+32633461623861643138613734313164633562613932386163643062353636376266633166373838
+39613438653531316333663736366161313832613830353566356461393435656234383037353335
+32343661376266353538643531313239306432646335383734623233373063316430383362643531
+35393263343534363936373361316265653934383735663933663365363564663966646335353337
+63366365383466393765336533363130643236313331633537346237353631623334633330376164
+32616530623032663761643437336536323332343130393339313232623364656334613233323833
+64346637343738386335343631333035636337633732333662663763326362636432646136353064
+30393061326435323837633632333765623931663265326137373135303035623464333366653566
+66613133396339376264313964353932396136613538383264363865633536373839663465333437
+37613765626131343330653063663764346364316264363635653438396331363263623562333735
+30646563303439663639376430336336383761363365353838613036333032306434623661636138
+63616439636437663732386164346365643834376631303263376563323662373734653631613730
+31373039656238303462643930303531613931373065316435303661343862623034653364653736
+37613835616630316133333130633631653639336266313438633166316539373433333661613839
+32356139366232313336343062323265366563633735383661393335386163653133313664613264
+63303739323863333439316461366137656434666366306466356633306663623730653939663430
+39313764663534316562326435316264633236373834323665356266346532323565323532333438
+33306237623430613463393164383332356533303433343465343930636563363862373330613632
+38643937613263313435626166313464316133373338373261666331653436373063393162636339
+66356434663239646334383433626566336433653265336332323866633666646132663836313537
+66663766306438396131623533613834626331653731323137303539303835306632663132616363
+64303438353836613136623562626664326364656133383865383730373762666539383036396337
+66393636343561333435313032353939316138306336316337353861383238326136373265663433
+62366566343866626336646466386561353061343735306565383437333931613635393034363430
+37633765663239643435623066313331353862393966306563393838386334393162306562363062
+61633363386564373834383432323861323364623365306439353631323463326461383039356466
+34396464653233626435656463326439303665633532656639376633353932666630626564616564
+34326638383634353033326232646339393638663637313136653763336265616635326666336530
+33663261376262626136346265656130653831636662306132393837306135643831353534626636
+34383762386665666363313932336632326230646439663366663037323562633630373137333232
+37393164656137303131313738396131613561306332356436303436636338623233343637363332
+36613137316337666461333237373266326238303531396432383461616239316630346230303735
+63636535383766353338643932366339333130663632386337643932636630316432313465393766
+39613065623631316165313134386231616165366266323634643632626230303861376461323433
+35346137326563646332303334313530383464373838373633363635373766333362386466323836
+32613236646561343365656239346239353866663336393930356238653463336361333033643331
+61323430663031383239353363616666336637666230663633616464616638303966343631386632
+32333735643936353638666336303133356435396338653465323234316234626536666635333238
+38313661303466333464666538363938656631396666643566343763396638336663376430646532
+38666234653330646262633062356238343536336637356432313137313561363937363936383364
+30643937383833663339643862363234643765386164316138636565643434373734383339363138
+36323163633837326132393365333236633264386664373234313061373835346634663137383837
+62666561353532303663346365343131316233633163323938623066656332383030393864363536
+38383939383935613432613837333863313239653831333438383133343763633838353964353161
+61323462343835613937653465633563306462613631323762656437626133336638396663646362
+30323661383134653336366234663333336261353162373030626266656336356233316265636661
+34303865313433633138363936373561636537353831373033303163646436303932626138356633
+63656364353163313037613262396338636230646330666331616534313466306361363433656132
+66633231626665303165346339373764666264313838313063323732653837383736633235363064
+37353632336238623366313432376163653535656134633634313065356533343933666135396633
+30613134646132613637656461303431613064393438363231383464663765316638

secrets/vault.yml.example

@@ -11,8 +11,6 @@ vault_git_work_gpg: "REPLACE_ME"
 vault_openai_api_key: "REPLACE_ME"
 vault_ikaros_authorized_ssh_keys:
   - "ssh-ed25519 REPLACE_ME"
-vault_atlas_authorized_ssh_keys:
-  - "ssh-ed25519 REPLACE_ME atlas-admin"
 vault_atlas_admin_password_hash: "REPLACE_WITH_A_SHADOW_COMPATIBLE_HASH"
 vault_atlas_samba_password: "REPLACE_ME"
 vault_atlas_immich_db_password: "REPLACE_ME"