mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 19:03:47 +00:00
eab66b6d3d
* Add dormant Rocky server profile * feat: activate Rocky server profile for prometheus * fix: complete Rocky server migration tooling * Remove FreeBSD profile * feat: add Aegis Fedora CoreOS profile * docs: define Git Flow branch prefixes * Add Aegis TPM-backed btrfs storage Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com> * Preserve existing Aegis filesystem tables Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com> * Remove unsupported Aegis TPM storage Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com> * Configure Aegis pi Btrfs storage Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com> * Mount Aegis Btrfs as root Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com> * Handle Maven on Mise * Feature/aegis coreos (#7) * feat(aegis): add ARM image bootstrap workflow * feat(aegis): manage firewall and SSH hardening * feat(aegis): harden Fedora IoT services * chore(aegis): remove local TLS configuration * fix(aegis): restore supported Fedora IoT bootstrap --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com>
121 lines
2.6 KiB
YAML
121 lines
2.6 KiB
YAML
---
|
|
server_username: "{{ username }}"
|
|
server_user_group: "{{ server_username }}"
|
|
server_user_home: "/home/{{ server_username }}"
|
|
effective_username: "{{ server_username }}"
|
|
effective_user_group: "{{ server_user_group }}"
|
|
effective_user_home: "{{ server_user_home }}"
|
|
server_container_stack_dir: /opt/docker/server
|
|
ai_agents: {}
|
|
vim_plugins_enabled: false
|
|
|
|
profile_packages:
|
|
- avahi-daemon
|
|
- dmidecode
|
|
- dosfstools
|
|
- gh
|
|
- gnupg
|
|
- gpg-agent
|
|
- netcat-openbsd
|
|
- openssh-server
|
|
- parted
|
|
- pciutils
|
|
- pinentry-curses
|
|
- ranger
|
|
- rsync
|
|
|
|
server_dotfiles:
|
|
- src: .bashrc.d/20-editor-server.sh
|
|
dest: .bashrc.d/20-editor-server.sh
|
|
mode: "0644"
|
|
- src: .gnupg/gpg-agent.conf
|
|
dest: .gnupg/gpg-agent.conf
|
|
mode: "0600"
|
|
- src: .gitignore_global
|
|
dest: .gitignore_global
|
|
mode: "0644"
|
|
- src: .themes.gitignore
|
|
dest: .themes.gitignore
|
|
mode: "0644"
|
|
- src: duckdns/
|
|
dest: duckdns/
|
|
mode: preserve
|
|
|
|
server_templates:
|
|
- src: server/.gitconfig.j2
|
|
dest: .gitconfig
|
|
mode: "0644"
|
|
- src: server/docker-compose.yml.j2
|
|
dest: "{{ server_container_stack_dir }}/docker-compose.yml"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
server_directories:
|
|
- path: "{{ server_user_home }}/.bashrc.d"
|
|
owner: "{{ server_username }}"
|
|
group: "{{ server_user_group }}"
|
|
mode: "0755"
|
|
- path: "{{ server_user_home }}/.gnupg"
|
|
owner: "{{ server_username }}"
|
|
group: "{{ server_user_group }}"
|
|
mode: "0700"
|
|
- path: "{{ server_container_stack_dir }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: /opt/navidrome/data
|
|
owner: "{{ server_username }}"
|
|
group: "{{ server_user_group }}"
|
|
mode: "0755"
|
|
- path: /opt/music
|
|
owner: "{{ server_username }}"
|
|
group: "{{ server_user_group }}"
|
|
mode: "0755"
|
|
- path: /opt/npm/data
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: /opt/npm/letsencrypt
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: /opt/postgres/data
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: /opt/gitea/data
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: /srv/nextcloud
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: /srv/nextcloud/data
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
server_syncthing_enabled: true
|
|
server_syncthing_directories:
|
|
- path: /opt/syncthing/config
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: /srv/syncthing
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: /srv/syncthing/data
|
|
owner: "1000"
|
|
group: "1000"
|
|
mode: "0755"
|
|
|
|
server_sshd_settings:
|
|
PermitRootLogin: "no"
|
|
|
|
server_sshd_allow_users:
|
|
- "{{ server_username }}"
|