mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 11:02:47 +00:00
160d63c02d
* Add Atlas media and storage services * Document Atlas backend phase one and WireGuard deployment * Enable Atlas NAS management and document bootstrap workflow * Harden Atlas network, SSH, firewall, and sharing * Rotate Ansible Vault secrets * Allow configurable Aegis SSH users and authorized keys * Manage Aegis SSH authorized key fragments * Manage SSH authorized key fragments for infrastructure hosts * Harden Rocky storage and sharing configuration * Verify WireGuard handshakes and restore Podman networking
117 lines
4.0 KiB
YAML
117 lines
4.0 KiB
YAML
---
|
|
# Atlas declares its intended steady state; set a feature flag false only for a deliberate suspension.
|
|
hostname: atlas
|
|
ansible_host: 192.168.178.55
|
|
ansible_user: "{{ atlas_connection_username }}"
|
|
ansible_port: 22
|
|
ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
|
|
|
|
atlas_admin_username: admin
|
|
atlas_connection_username: "{{ atlas_admin_username }}"
|
|
atlas_admin_group: "{{ atlas_admin_username }}"
|
|
atlas_admin_home: "/home/{{ atlas_admin_username }}"
|
|
atlas_admin_uid: 1000
|
|
atlas_admin_gid: 1000
|
|
atlas_admin_ssh_keys:
|
|
- name: ikaros
|
|
key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
|
|
- name: nymph
|
|
key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
|
|
- name: siren
|
|
key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
|
|
atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}"
|
|
atlas_ssh_allow_tcp_forwarding: local
|
|
|
|
atlas_lan_subnet: 192.168.178.0/24
|
|
atlas_aegis_ip: 192.168.178.54
|
|
atlas_manage_firewall: true
|
|
atlas_firewalld_zone: public
|
|
atlas_zfs_pool: zpool
|
|
# Populate only for the first pool bootstrap with four real persistent disk paths.
|
|
# Confirmed empty 4 TB IronWolf data disks; the NVMe system disk is intentionally excluded.
|
|
atlas_zpool_disks:
|
|
- /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1XM
|
|
- /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A73T2
|
|
- /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A6VJK
|
|
- /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1LM
|
|
atlas_create_pool: false
|
|
atlas_zfs_dataset_work: work
|
|
atlas_zfs_dataset_archive: archive
|
|
atlas_zfs_dataset_app_data: archive/app_data
|
|
atlas_zfs_dataset_navidrome: archive/app_data/navidrome
|
|
atlas_zfs_dataset_syncthing: archive/app_data/syncthing
|
|
atlas_zfs_dataset_media: media
|
|
atlas_zfs_dataset_music: media/music
|
|
atlas_zfs_dataset_backup_prometheus: backup_prometheus
|
|
atlas_zfs_dataset_photobook: media/photobook
|
|
atlas_zfs_dataset_backups: backups
|
|
atlas_zfs_dataset_service_backups: backups/services
|
|
atlas_mount_root: /zpool
|
|
atlas_manage_storage: true
|
|
atlas_manage_sharing: true
|
|
atlas_manage_media_stack: false
|
|
|
|
wireguard_overlay_enabled: true
|
|
wireguard_address: 10.0.0.2/24
|
|
wireguard_peers:
|
|
- name: prometheus
|
|
host: prometheus
|
|
endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
|
|
allowed_ips:
|
|
- 10.0.0.0/24
|
|
persistent_keepalive: 25
|
|
|
|
backend_phase1_enabled: true
|
|
backend_phase1_start_services: false
|
|
backend_phase1_wireguard_address: 10.0.0.2
|
|
|
|
rocky_manage_openzfs_repo: true
|
|
rocky_manage_syncthing_binary: false
|
|
rocky_manage_podman: true
|
|
rocky_podman_packages:
|
|
- podman
|
|
|
|
host_packages:
|
|
- cockpit
|
|
- nfs-utils
|
|
- policycoreutils
|
|
- policycoreutils-python-utils
|
|
- python3-libselinux
|
|
- samba
|
|
- samba-client
|
|
- samba-common-tools
|
|
- zfs
|
|
|
|
atlas_nfs_exports:
|
|
- path: "{{ atlas_photobook_mountpoint }}"
|
|
client: "{{ atlas_aegis_ip }}"
|
|
options:
|
|
- rw
|
|
- sync
|
|
- no_subtree_check
|
|
- all_squash
|
|
- "anonuid={{ atlas_immich_uid }}"
|
|
- "anongid={{ atlas_immich_gid }}"
|
|
|
|
atlas_samba_share_name: Archive
|
|
atlas_samba_workgroup: WORKGROUP
|
|
atlas_samba_encryption: required
|
|
# Append any pre-existing laptop Unix account here and keep its Samba password in Vault.
|
|
atlas_samba_accounts:
|
|
- username: "{{ atlas_admin_username }}"
|
|
password: "{{ vault_atlas_samba_password | default('') }}"
|
|
atlas_samba_valid_users: "{{ atlas_samba_accounts | map(attribute='username') | list }}"
|
|
|
|
atlas_immich_db_password: "{{ vault_atlas_immich_db_password | default('') }}"
|
|
|
|
atlas_firewalld_rich_rules:
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="22" protocol="tcp" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="9090" protocol="tcp" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_aegis_ip }}" port port="2049" protocol="tcp" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="445" protocol="tcp" accept'
|
|
|
|
host_enabled_services:
|
|
- sshd
|
|
- cockpit.socket
|
|
- zfs.target
|