Capture current Ansible control plane state
Commit the accumulated infrastructure work that was living only in the working tree: monitoring stack, emergency access/bot, gyro allocator, grimmory, adguard, backup audit and the OpenCode agent definitions. Also ignore Python bytecode, local archives and Nix/direnv artifacts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
This commit is contained in:
Dmitry
@@ -0,0 +1,11 @@
|
||||
---
|
||||
emergency_reverse_user: homelab-rescue
|
||||
emergency_reverse_port: 22010
|
||||
emergency_reverse_bind_address: 127.0.0.1
|
||||
emergency_reverse_tunnel_user: emergency-tunnel
|
||||
emergency_control_user: emergency-control
|
||||
emergency_control_key_path: /etc/emergency-access/control_ed25519
|
||||
emergency_tunnel_state_dir: /var/lib/emergency-reverse-ssh
|
||||
emergency_reverse_key_path: /var/lib/emergency-reverse-ssh/reverse_ed25519
|
||||
emergency_access_dir: /etc/emergency-access
|
||||
emergency_tunnel_ttl: 60m
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd_service:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Validate and reload SSH
|
||||
ansible.builtin.shell: sshd -t && systemctl reload ssh
|
||||
changed_when: true
|
||||
@@ -0,0 +1,134 @@
|
||||
---
|
||||
- name: Validate emergency access client inputs
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- emergency_vps_host_key is match('^ssh-(ed25519|rsa|ecdsa-[^ ]+) [A-Za-z0-9+/=]+( [A-Za-z0-9@._:-]+)?$')
|
||||
- emergency_bot_control_public_key | length > 0
|
||||
fail_msg: Set EMERGENCY_VPS_HOST_KEY and provision the emergency-bot control key first.
|
||||
no_log: true
|
||||
|
||||
- name: Install reverse SSH client
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- openssh-client
|
||||
- sudo
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Create emergency access service accounts
|
||||
ansible.builtin.user:
|
||||
name: "{{ item }}"
|
||||
system: true
|
||||
# SSHD must start the forced command under a valid shell; authorized_keys
|
||||
# still prevents this account from receiving an arbitrary command or PTY.
|
||||
shell: "{{ '/bin/sh' if item == emergency_control_user else '/usr/sbin/nologin' }}"
|
||||
create_home: true
|
||||
loop:
|
||||
- "{{ emergency_reverse_tunnel_user }}"
|
||||
- "{{ emergency_control_user }}"
|
||||
|
||||
- name: Create emergency access configuration directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ emergency_access_dir }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
|
||||
- name: Create reverse SSH state directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ emergency_tunnel_state_dir }}"
|
||||
state: directory
|
||||
owner: "{{ emergency_reverse_tunnel_user }}"
|
||||
group: "{{ emergency_reverse_tunnel_user }}"
|
||||
mode: "0700"
|
||||
|
||||
- name: Generate dedicated reverse SSH key
|
||||
ansible.builtin.command:
|
||||
cmd: "ssh-keygen -q -t ed25519 -N '' -f {{ emergency_reverse_key_path }}"
|
||||
creates: "{{ emergency_reverse_key_path }}"
|
||||
become_user: "{{ emergency_reverse_tunnel_user }}"
|
||||
no_log: true
|
||||
|
||||
- name: Read reverse SSH public key
|
||||
ansible.builtin.slurp:
|
||||
src: "{{ emergency_reverse_key_path }}.pub"
|
||||
register: emergency_reverse_key
|
||||
no_log: true
|
||||
|
||||
- name: Store reverse SSH public key for VPS configuration
|
||||
ansible.builtin.set_fact:
|
||||
emergency_reverse_public_key: "{{ emergency_reverse_key.content | b64decode | trim }}"
|
||||
no_log: true
|
||||
|
||||
- name: Pin ru-vps SSH host key for the tunnel user
|
||||
ansible.builtin.copy:
|
||||
dest: "{{ emergency_tunnel_state_dir }}/known_hosts"
|
||||
content: "ru-vps-emergency {{ emergency_vps_host_key }}\n"
|
||||
owner: "{{ emergency_reverse_tunnel_user }}"
|
||||
group: "{{ emergency_reverse_tunnel_user }}"
|
||||
mode: "0600"
|
||||
no_log: true
|
||||
|
||||
- name: Install reverse SSH systemd unit
|
||||
ansible.builtin.template:
|
||||
src: emergency-reverse-ssh.service.j2
|
||||
dest: /etc/systemd/system/emergency-reverse-ssh.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Reload systemd
|
||||
|
||||
- name: Install emergency tunnel expiry unit
|
||||
ansible.builtin.template:
|
||||
src: emergency-reverse-ssh-expire.service.j2
|
||||
dest: /etc/systemd/system/emergency-reverse-ssh-expire.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Reload systemd
|
||||
|
||||
- name: Install emergency tunnel expiry timer
|
||||
ansible.builtin.template:
|
||||
src: emergency-reverse-ssh.timer.j2
|
||||
dest: /etc/systemd/system/emergency-reverse-ssh.timer
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Reload systemd
|
||||
|
||||
- name: Install restricted emergency control helper
|
||||
ansible.builtin.template:
|
||||
src: emergency-control.j2
|
||||
dest: /usr/local/libexec/emergency-control
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
|
||||
- name: Install emergency control sudo policy
|
||||
ansible.builtin.template:
|
||||
src: emergency-control.sudoers.j2
|
||||
dest: /etc/sudoers.d/emergency-control
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0440"
|
||||
validate: visudo -cf %s
|
||||
|
||||
- name: Authorize emergency-bot control key with forced command
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ emergency_control_user }}"
|
||||
key: "command=\"/usr/local/libexec/emergency-control\",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty {{ emergency_bot_control_public_key }}"
|
||||
state: present
|
||||
exclusive: true
|
||||
no_log: true
|
||||
|
||||
- name: Reload systemd before managing emergency units
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: Keep emergency tunnel disabled at boot
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ item }}"
|
||||
enabled: false
|
||||
loop:
|
||||
- emergency-reverse-ssh.service
|
||||
- emergency-reverse-ssh.timer
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
- name: Validate emergency access endpoint input
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- emergency_reverse_public_key | length > 0
|
||||
fail_msg: Configure the mini-pc reverse SSH client before ru-vps.
|
||||
no_log: true
|
||||
|
||||
- name: Create restricted reverse SSH endpoint user
|
||||
ansible.builtin.user:
|
||||
name: "{{ emergency_reverse_user }}"
|
||||
system: true
|
||||
# Remote forwarding is accepted before a session exists. A valid shell is
|
||||
# required by SSHD; the forced command below rejects every session.
|
||||
shell: /bin/sh
|
||||
create_home: true
|
||||
|
||||
- name: Authorize only the dedicated reverse SSH key
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ emergency_reverse_user }}"
|
||||
key: "command=\"/usr/bin/false\",restrict,port-forwarding,permitlisten=\"{{ emergency_reverse_bind_address }}:{{ emergency_reverse_port }}\" {{ emergency_reverse_public_key }}"
|
||||
state: present
|
||||
exclusive: true
|
||||
no_log: true
|
||||
@@ -0,0 +1,27 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
case "${SSH_ORIGINAL_COMMAND:-}" in
|
||||
start)
|
||||
/usr/bin/sudo /usr/bin/systemctl start emergency-reverse-ssh.service
|
||||
/usr/bin/sudo /usr/bin/systemctl restart emergency-reverse-ssh.timer
|
||||
/usr/bin/systemctl is-active --quiet emergency-reverse-ssh.service
|
||||
printf 'started; expires in {{ emergency_tunnel_ttl }}\nConnect:\nssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -J vps -p 22010 ansible@127.0.0.1\n'
|
||||
;;
|
||||
stop)
|
||||
/usr/bin/sudo /usr/bin/systemctl stop emergency-reverse-ssh.timer
|
||||
/usr/bin/sudo /usr/bin/systemctl stop emergency-reverse-ssh.service
|
||||
printf 'stopped\n'
|
||||
;;
|
||||
status)
|
||||
if /usr/bin/systemctl is-active --quiet emergency-reverse-ssh.service; then
|
||||
/usr/bin/systemctl show --property=ActiveState --property=ActiveEnterTimestamp --value emergency-reverse-ssh.service
|
||||
else
|
||||
printf 'stopped\n'
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
printf 'unsupported command\n' >&2
|
||||
exit 64
|
||||
;;
|
||||
esac
|
||||
@@ -0,0 +1 @@
|
||||
{{ emergency_control_user }} ALL=(root) NOPASSWD: /usr/bin/systemctl start emergency-reverse-ssh.service, /usr/bin/systemctl restart emergency-reverse-ssh.timer, /usr/bin/systemctl stop emergency-reverse-ssh.timer, /usr/bin/systemctl stop emergency-reverse-ssh.service
|
||||
@@ -0,0 +1,6 @@
|
||||
[Unit]
|
||||
Description=Close expired HomeLab reverse SSH rescue tunnel
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/bin/systemctl stop emergency-reverse-ssh.service
|
||||
@@ -0,0 +1,19 @@
|
||||
[Unit]
|
||||
Description=Temporary HomeLab reverse SSH rescue tunnel
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User={{ emergency_reverse_tunnel_user }}
|
||||
ExecStart=/usr/bin/ssh -N -i {{ emergency_reverse_key_path }} -o BatchMode=yes -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o StrictHostKeyChecking=yes -o UserKnownHostsFile={{ emergency_tunnel_state_dir }}/known_hosts -o HostKeyAlias=ru-vps-emergency -p 3422 -R {{ emergency_reverse_bind_address }}:{{ emergency_reverse_port }}:127.0.0.1:22 {{ emergency_reverse_user }}@157.22.231.198
|
||||
Restart=on-failure
|
||||
RestartSec=10
|
||||
NoNewPrivileges=yes
|
||||
PrivateTmp=yes
|
||||
ProtectSystem=strict
|
||||
ProtectHome=yes
|
||||
ReadWritePaths={{ emergency_tunnel_state_dir }}
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,10 @@
|
||||
[Unit]
|
||||
Description=Expire HomeLab reverse SSH rescue tunnel after {{ emergency_tunnel_ttl }}
|
||||
|
||||
[Timer]
|
||||
OnActiveSec={{ emergency_tunnel_ttl }}
|
||||
AccuracySec=1s
|
||||
Unit=emergency-reverse-ssh-expire.service
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
Reference in New Issue
Block a user