sjat/boma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
boma/roles/base/tasks/main.yml

40 lines
995 B
YAML
Raw Permalink Normal View History

feat(base): scaffold role + meta/README (firewall concern incoming) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-06 18:48:35 +02:00
---
fix(base): propagate hardening tag to included tasks; check-mode-safe fail2ban Two bugs caught by the live make check/deploy on askari: - include_tasks with a tag selects the include but NOT its tasks, so --tags hardening ran nothing. Use apply: {tags:} to propagate (also fixed the firewall include). - fail2ban service start + restart handler fail in a first-run --check (package not installed yet); guard both with when: not ansible_check_mode so check is clean. Applied to askari: SSH hardened, fail2ban active, ping still works (no lockout). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-14 16:54:23 +02:00
# `apply: tags:` propagates the concern tag to the INCLUDED tasks — without it a tag on
# a dynamic include_tasks only selects the include itself, not its contents, so
# `--tags <concern>` would run nothing (Ansible gotcha).
feat(base): render nftables ruleset from catalog (+ molecule fixture) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-06 18:57:44 +02:00
- name: Configure host firewall (nftables)
fix(base): propagate hardening tag to included tasks; check-mode-safe fail2ban Two bugs caught by the live make check/deploy on askari: - include_tasks with a tag selects the include but NOT its tasks, so --tags hardening ran nothing. Use apply: {tags:} to propagate (also fixed the firewall include). - fail2ban service start + restart handler fail in a first-run --check (package not installed yet); guard both with when: not ansible_check_mode so check is clean. Applied to askari: SSH hardened, fail2ban active, ping still works (no lockout). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-14 16:54:23 +02:00
ansible.builtin.include_tasks:
file: firewall.yml
apply:
tags: [firewall]
feat(base): render nftables ruleset from catalog (+ molecule fixture) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-06 18:57:44 +02:00
tags: [firewall]
feat(base): ssh hardening + fail2ban (hardening concern, ADR-002) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-14 16:42:56 +02:00
- name: SSH hardening
fix(base): propagate hardening tag to included tasks; check-mode-safe fail2ban Two bugs caught by the live make check/deploy on askari: - include_tasks with a tag selects the include but NOT its tasks, so --tags hardening ran nothing. Use apply: {tags:} to propagate (also fixed the firewall include). - fail2ban service start + restart handler fail in a first-run --check (package not installed yet); guard both with when: not ansible_check_mode so check is clean. Applied to askari: SSH hardened, fail2ban active, ping still works (no lockout). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-14 16:54:23 +02:00
ansible.builtin.include_tasks:
file: ssh.yml
apply:
tags: [hardening]
feat(base): ssh hardening + fail2ban (hardening concern, ADR-002) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-14 16:42:56 +02:00
tags: [hardening]
- name: Fail2ban intrusion deterrence
fix(base): propagate hardening tag to included tasks; check-mode-safe fail2ban Two bugs caught by the live make check/deploy on askari: - include_tasks with a tag selects the include but NOT its tasks, so --tags hardening ran nothing. Use apply: {tags:} to propagate (also fixed the firewall include). - fail2ban service start + restart handler fail in a first-run --check (package not installed yet); guard both with when: not ansible_check_mode so check is clean. Applied to askari: SSH hardened, fail2ban active, ping still works (no lockout). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-14 16:54:23 +02:00
ansible.builtin.include_tasks:
file: fail2ban.yml
apply:
tags: [hardening]
feat(base): ssh hardening + fail2ban (hardening concern, ADR-002) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-14 16:42:56 +02:00
tags: [hardening]
feat(base): NetBird agent enrollment concern (mesh) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-17 16:04:46 +02:00
feat(base): codify AI-worker NOPASSWD sudo (ADR-015 amended) Add base__ai_worker_user var (default empty), a new operational_access.yml task file that drops a validated sudoers file for the named user, and wire it into base/tasks/main.yml after the hardening includes under the `users` tag. Set base__ai_worker_user: claude in group_vars/control so that applying base to ubongo is idempotent with the manual /etc/sudoers.d/claude-ai-worker drop-in already in place. Password remains locked; NOPASSWD is the only sudo path; actions are attributed via auditd (ADR-021). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-18 21:36:31 +02:00
- name: AI-worker operational access (sudoers drop-in)
ansible.builtin.include_tasks:
file: operational_access.yml
apply:
tags: [users]
tags: [users]
feat(base): NetBird agent enrollment concern (mesh) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-17 16:04:46 +02:00
- name: NetBird mesh enrollment
ansible.builtin.include_tasks:
file: mesh.yml
apply:
tags: [mesh]
when: base__mesh_enabled | bool
tags: [mesh]
Reference in a new issue Copy permalink