mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 19:03:47 +00:00
eab66b6d3d
* Add dormant Rocky server profile * feat: activate Rocky server profile for prometheus * fix: complete Rocky server migration tooling * Remove FreeBSD profile * feat: add Aegis Fedora CoreOS profile * docs: define Git Flow branch prefixes * Add Aegis TPM-backed btrfs storage Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com> * Preserve existing Aegis filesystem tables Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com> * Remove unsupported Aegis TPM storage Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com> * Configure Aegis pi Btrfs storage Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com> * Mount Aegis Btrfs as root Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com> * Handle Maven on Mise * Feature/aegis coreos (#7) * feat(aegis): add ARM image bootstrap workflow * feat(aegis): manage firewall and SSH hardening * feat(aegis): harden Fedora IoT services * chore(aegis): remove local TLS configuration * fix(aegis): restore supported Fedora IoT bootstrap --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: fscotto <17803710+fscotto@users.noreply.github.com>
61 lines
2.0 KiB
YAML
61 lines
2.0 KiB
YAML
---
|
|
# Replace every CHANGEME value before enabling Atlas storage management.
|
|
hostname: atlas
|
|
ansible_host: CHANGEME_ATLAS_HOST
|
|
ansible_user: "{{ atlas_connection_username }}"
|
|
ansible_port: 22
|
|
ansible_ssh_private_key_file: CHANGEME_ATLAS_SSH_PRIVATE_KEY_PATH
|
|
|
|
atlas_admin_username: admin
|
|
atlas_connection_username: "{{ atlas_admin_username }}"
|
|
atlas_admin_group: "{{ atlas_admin_username }}"
|
|
atlas_admin_home: "/home/{{ atlas_admin_username }}"
|
|
atlas_admin_uid: 1000
|
|
atlas_admin_gid: 1000
|
|
atlas_admin_ssh_keys: "{{ vault_atlas_authorized_ssh_keys | default([]) }}"
|
|
atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}"
|
|
|
|
atlas_lan_subnet: CHANGEME_LAN_SUBNET
|
|
atlas_manage_firewall: false
|
|
atlas_firewalld_zone: public
|
|
atlas_zfs_pool: CHANGEME_ZFS_POOL
|
|
atlas_zfs_dataset_work: work
|
|
atlas_zfs_dataset_syncthing: syncthing
|
|
atlas_zfs_dataset_backup_prometheus: backup_prometheus
|
|
atlas_zfs_dataset_icloud_photos: icloud_photos
|
|
atlas_mount_root: /CHANGEME_ATLAS_MOUNT_ROOT
|
|
atlas_manage_storage: false
|
|
|
|
rocky_manage_openzfs_repo: true
|
|
rocky_manage_syncthing_binary: true
|
|
|
|
host_packages:
|
|
- cockpit
|
|
- nfs-utils
|
|
- policycoreutils-python-utils
|
|
- samba
|
|
- zfs
|
|
|
|
atlas_nfs_exports:
|
|
- path: "{{ atlas_work_mountpoint }}"
|
|
clients: "{{ atlas_lan_subnet }}(rw,sync,no_subtree_check,root_squash)"
|
|
|
|
atlas_samba_share_name: work
|
|
atlas_samba_workgroup: WORKGROUP
|
|
atlas_samba_valid_users:
|
|
- "{{ atlas_admin_username }}"
|
|
atlas_samba_password: "{{ vault_atlas_samba_password | default('') }}"
|
|
|
|
atlas_firewalld_rich_rules:
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="ssh" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="cockpit" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="2049" protocol="tcp" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="samba" accept'
|
|
|
|
host_enabled_services:
|
|
- sshd
|
|
- cockpit.socket
|
|
- nfs-server
|
|
- smb
|
|
- zfs.target
|