sjat
a111a20cc8
Add explicit base__ssh_authorised_keys: [] default to prevent undefined-var errors in Molecule. Extend verify.yml with sshd drop-in validation, PasswordAuthentication check, and fail2ban jail assertion. Pre-create /run/sshd in ssh.yml so sshd -t works in containers before the service has ever started. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
22 lines
1.3 KiB
YAML
22 lines
1.3 KiB
YAML
---
|
|
# Host firewall (nftables) behaviour knobs. Shared topology (firewall_catalog/
|
|
# firewall_zones) lives in group_vars/all, not here. See docs/decisions/020-firewall.md.
|
|
base__firewall_mgmt_interface: wt0 # SSH accepted only on this iface (NetBird, ADR-016)
|
|
base__firewall_control_addr: "" # control-node LAN address (ubongo); SSH allowed from it
|
|
# as the guaranteed-management-plane `ssh-from-control`
|
|
# source (ADR-021). Empty = no rule. Set in group_vars
|
|
# once ubongo exists.
|
|
base__firewall_ssh_port: 22
|
|
base__firewall_rollback_timeout: 45 # seconds before the auto-revert fires on a bad apply
|
|
base__firewall_confirm_timeout: 20 # seconds to re-establish a fresh connection post-apply
|
|
base__firewall_dropin_dir: /etc/nftables.d
|
|
base__firewall_apply: true # set false to render+validate without applying (CI/Molecule)
|
|
|
|
# SSH hardening + fail2ban (ADR-002) — `hardening` concern.
|
|
base__ssh_password_authentication: "no"
|
|
base__ssh_permit_root_login: "no"
|
|
base__fail2ban_maxretry: 5
|
|
base__fail2ban_bantime: 1h
|
|
base__fail2ban_findtime: 10m
|
|
# base__ssh_authorised_keys lives in group_vars/all/vars.yml (per-person control keys).
|
|
base__ssh_authorised_keys: []
|