mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 11:02:47 +00:00
160d63c02d
* Add Atlas media and storage services * Document Atlas backend phase one and WireGuard deployment * Enable Atlas NAS management and document bootstrap workflow * Harden Atlas network, SSH, firewall, and sharing * Rotate Ansible Vault secrets * Allow configurable Aegis SSH users and authorized keys * Manage Aegis SSH authorized key fragments * Manage SSH authorized key fragments for infrastructure hosts * Harden Rocky storage and sharing configuration * Verify WireGuard handshakes and restore Podman networking
272 lines
7.8 KiB
YAML
272 lines
7.8 KiB
YAML
- name: Require completed Atlas firewall placeholders
|
|
tags: [atlas, sharing, services]
|
|
ansible.builtin.assert:
|
|
that:
|
|
- atlas_lan_subnet != 'CHANGEME_LAN_SUBNET'
|
|
- atlas_aegis_ip != 'CHANGEME_AEGIS_IP'
|
|
- atlas_firewalld_zone | length > 0
|
|
- ansible_facts.default_ipv4.interface | default('') | length > 0
|
|
fail_msg: Replace the Atlas LAN, Aegis and firewall-zone placeholders.
|
|
when: atlas_manage_firewall | bool
|
|
|
|
- name: Apply Atlas firewalld rich rules
|
|
tags: [atlas, sharing, services]
|
|
ansible.posix.firewalld:
|
|
rich_rule: "{{ item }}"
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
zone: "{{ atlas_firewalld_zone }}"
|
|
loop: "{{ atlas_firewalld_rich_rules }}"
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
when: atlas_manage_firewall | bool
|
|
|
|
- name: Assign primary Atlas LAN interface to managed firewalld zone
|
|
tags: [atlas, sharing, services]
|
|
ansible.posix.firewalld:
|
|
interface: "{{ ansible_facts.default_ipv4.interface }}"
|
|
zone: "{{ atlas_firewalld_zone }}"
|
|
state: enabled
|
|
permanent: true
|
|
immediate: true
|
|
when: atlas_manage_firewall | bool
|
|
|
|
- name: Remove unrestricted Atlas services from firewalld zone
|
|
tags: [atlas, sharing, services]
|
|
ansible.posix.firewalld:
|
|
service: "{{ item }}"
|
|
permanent: true
|
|
immediate: true
|
|
state: disabled
|
|
zone: "{{ atlas_firewalld_zone }}"
|
|
loop: "{{ atlas_firewalld_restricted_services }}"
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
when: atlas_manage_firewall | bool
|
|
|
|
- name: Render Atlas NFS exports
|
|
tags: [atlas, sharing]
|
|
ansible.builtin.template:
|
|
src: atlas.exports.j2
|
|
dest: /etc/exports.d/atlas.exports
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Reload NFS exports
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Ensure Atlas NFS configuration drop-in directory exists
|
|
tags: [atlas, sharing]
|
|
ansible.builtin.file:
|
|
path: /etc/nfs.conf.d
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Configure Atlas NFSv4-only service
|
|
tags: [atlas, sharing]
|
|
ansible.builtin.template:
|
|
src: atlas-nfs.conf.j2
|
|
dest: /etc/nfs.conf.d/atlas.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart NFS server
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Mask Atlas NFSv3 RPC services
|
|
tags: [atlas, sharing, services]
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
enabled: false
|
|
state: stopped
|
|
masked: true
|
|
loop:
|
|
- rpc-statd.service
|
|
- rpcbind.service
|
|
- rpcbind.socket
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Ensure Atlas NFS mount daemon drop-in directory exists
|
|
tags: [atlas, sharing, services]
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/nfs-mountd.service.d
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Disable Atlas NFSv3 mount daemon listeners
|
|
tags: [atlas, sharing, services]
|
|
ansible.builtin.template:
|
|
src: nfs-mountd-v4only.conf.j2
|
|
dest: /etc/systemd/system/nfs-mountd.service.d/v4only.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart NFS mount daemon
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Enable SELinux access for Atlas file sharing
|
|
tags: [atlas, sharing, services]
|
|
ansible.posix.seboolean:
|
|
name: "{{ item }}"
|
|
state: true
|
|
persistent: true
|
|
loop: "{{ atlas_selinux_booleans }}"
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
when:
|
|
- atlas_manage_sharing | bool
|
|
- (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
|
|
|
|
- name: Render Atlas Samba configuration
|
|
tags: [atlas, sharing]
|
|
ansible.builtin.template:
|
|
src: smb.conf.j2
|
|
dest: /etc/samba/smb.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
validate: "testparm --suppress-prompt %s"
|
|
notify: Restart Samba service
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Require Vault-backed Atlas Samba accounts
|
|
tags: [atlas, sharing]
|
|
ansible.builtin.assert:
|
|
that:
|
|
- atlas_samba_encryption in ['required', 'desired']
|
|
- atlas_samba_accounts | length > 0
|
|
- >-
|
|
atlas_samba_accounts | map(attribute='username') | list
|
|
| difference(atlas_samba_valid_users) | length == 0
|
|
- >-
|
|
atlas_samba_valid_users
|
|
| difference(atlas_samba_accounts | map(attribute='username') | list) | length == 0
|
|
- atlas_samba_accounts | selectattr('password', 'equalto', '') | list | length == 0
|
|
fail_msg: Define every authorized Samba account and its Vault-backed password.
|
|
no_log: true
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Ensure Atlas Samba private state directory exists
|
|
tags: [atlas, sharing]
|
|
ansible.builtin.file:
|
|
path: "{{ atlas_samba_password_marker_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Manage Vault-backed Atlas Samba credentials
|
|
tags: [atlas, sharing]
|
|
ansible.builtin.include_tasks: samba_account.yml
|
|
loop: "{{ atlas_samba_accounts }}"
|
|
loop_control:
|
|
loop_var: atlas_samba_account
|
|
label: "{{ atlas_samba_account.username }}"
|
|
no_log: true
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Enable Atlas file-sharing services
|
|
tags: [atlas, sharing, services]
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
enabled: true
|
|
state: started
|
|
loop:
|
|
- nfs-server.service
|
|
- smb.service
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
when: atlas_manage_sharing | bool
|
|
|
|
- name: Gather effective Atlas firewalld zone configuration
|
|
tags: [atlas, sharing, services, security]
|
|
ansible.posix.firewalld_info:
|
|
zones:
|
|
- "{{ atlas_firewalld_zone }}"
|
|
register: atlas_firewalld_info
|
|
when:
|
|
- atlas_manage_firewall | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: Verify effective Atlas firewalld restrictions
|
|
tags: [atlas, sharing, services, security]
|
|
ansible.builtin.assert:
|
|
that:
|
|
- atlas_firewalld_zone in atlas_firewalld_info.firewalld_info.zones
|
|
- >-
|
|
ansible_facts.default_ipv4.interface
|
|
in atlas_firewalld_info.firewalld_info.zones[atlas_firewalld_zone].interfaces
|
|
- >-
|
|
atlas_firewalld_restricted_services
|
|
| intersect(atlas_firewalld_info.firewalld_info.zones[atlas_firewalld_zone].services)
|
|
| length == 0
|
|
fail_msg: >-
|
|
The effective Atlas firewalld zone does not restrict the primary LAN
|
|
interface and unmanaged service exposure as declared.
|
|
when:
|
|
- atlas_manage_firewall | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: Apply pending Atlas sharing handlers before verification
|
|
tags: [atlas, sharing, services, security]
|
|
ansible.builtin.meta: flush_handlers
|
|
when:
|
|
- atlas_manage_sharing | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: Check active Atlas file-sharing services
|
|
tags: [atlas, sharing, services, security]
|
|
ansible.builtin.command:
|
|
argv:
|
|
- systemctl
|
|
- is-active
|
|
- --quiet
|
|
- "{{ item }}"
|
|
loop:
|
|
- nfs-server.service
|
|
- smb.service
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
register: atlas_file_sharing_service_activity
|
|
changed_when: false
|
|
failed_when: false
|
|
when:
|
|
- atlas_manage_sharing | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: Require active Atlas file-sharing services
|
|
tags: [atlas, sharing, services, security]
|
|
ansible.builtin.assert:
|
|
that:
|
|
- atlas_file_sharing_service_activity.results | map(attribute='rc') | list == [0, 0]
|
|
fail_msg: Atlas NFSv4 or SMB3 did not start after its managed configuration was applied.
|
|
when:
|
|
- atlas_manage_sharing | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: Require Atlas file-sharing TCP listeners
|
|
tags: [atlas, sharing, services, security]
|
|
ansible.builtin.wait_for:
|
|
host: 127.0.0.1
|
|
port: "{{ item }}"
|
|
state: started
|
|
timeout: 15
|
|
loop:
|
|
- 2049
|
|
- 445
|
|
loop_control:
|
|
label: "{{ item }}/tcp"
|
|
when:
|
|
- atlas_manage_sharing | bool
|
|
- not ansible_check_mode
|