ada/infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move SSH transport to ssh_config and shared group_vars

Browse Source 
hosts.yml repeated the same authentication block for 13 LXC hosts and
carried 13 byte-identical copies of the ru-vps ProxyCommand. Describe the
transport once in ansible/ssh_config instead: jump host, per-host users,
keys, and the fact that pbs and ovpn-mini are reached directly rather
than through ru-vps.

Ansible loads that file through ansible_ssh_common_args in
group_vars/all/main.yml, where the path is derived from inventory_dir so
it depends on neither the current directory nor the clone location.
The same file makes `ssh gitea` work from a plain terminal once
~/.ssh/config includes it.

hosts.yml drops from 209 to 137 lines and now holds only addresses and
per-host facts. Verified equivalent: ansible-inventory --list before and
after differ only by the removed ansible_ssh_common_args, with group
membership and ordering byte-identical.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
This commit is contained in:
Dmitry
2026-08-26 22:10:16 +03:00
co-authored by Claude Opus 5
parent a7b0635830
commit ec3b736250
5 changed files with 147 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/ansible.cfg
+3
View File
@@ -6,4 +6,7 @@ retry_files_enabled = false
[ssh_connection]
pipelining = true
# Транспорт (ProxyJump, порты, пользователи, ключи) описан в ansible/ssh_config.
# Он подключается через ansible_ssh_common_args в group_vars/all/main.yml,
# где путь вычисляется от inventory_dir и потому не зависит ни от cwd, ни от места клона.
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=accept-new
ansible/inventory/group_vars/all/main.yml
+23
View File
@@ -0,0 +1,23 @@
---
# Общие переменные для всех управляемых хостов.
# SSH-транспорт (ProxyJump, порты, ключи по хостам) описан в ansible/ssh_config.
# Путь считается от каталога inventory, поэтому работает из любого cwd
# и не ломается при клоне репозитория в другое место.
ansible_ssh_common_args: "-F {{ inventory_dir }}/../ssh_config"
ansible_python_interpreter: /usr/bin/python3
ansible_user: ansible
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab_ansible
ansible_become: true
homelab_lan_cidr: 192.168.1.0/24
homelab_service_range: 192.168.1.5-192.168.1.40
openvpn_network_cidr: 10.78.0.0/30
openvpn_listen_port: 8443
openvpn_forwarded_services:
- name: satisfactory
protocol: udp
public_port: 7777
target_host: 192.168.1.100
target_port: 7777
ansible/inventory/group_vars/lxc_infra/main.yml
+6
View File
@@ -0,0 +1,6 @@
---
# LXC-контейнеры управляются напрямую под root, sudo не требуется.
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible/inventory/hosts.yml
+9 -81
View File
@@ -1,20 +1,11 @@
# Каноничный список хостов HomeLab.
#
# Общие переменные: inventory/group_vars/all/main.yml
# Переменные LXC: inventory/group_vars/lxc_infra/main.yml
# SSH-транспорт: ../ssh_config (подключён через ssh_args в ansible.cfg)
#
# Здесь у хоста остаются только адрес и его индивидуальные факты.
all:
vars:
ansible_python_interpreter: /usr/bin/python3
ansible_user: ansible
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab_ansible
ansible_become: true
homelab_lan_cidr: 192.168.1.0/24
homelab_service_range: 192.168.1.5-192.168.1.40
openvpn_network_cidr: 10.78.0.0/30
openvpn_listen_port: 8443
openvpn_forwarded_services:
- name: satisfactory
protocol: udp
public_port: 7777
target_host: 192.168.1.100
target_port: 7777
children:
homelab:
hosts:
@@ -29,8 +20,6 @@ all:
hosts:
cloud-pc:
ansible_host: 192.168.1.5
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.5
storage_mounts:
- src: UUID=ae278333-4116-4225-9b95-595496fadd26
@@ -42,128 +31,67 @@ all:
mini-pc:
ansible_host: 192.168.1.10
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.10
lxc_infra:
hosts:
# Доступны напрямую по LAN (без ProxyJump через ru-vps)
pbs:
ansible_host: 192.168.1.20
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
expected_lan_ip: 192.168.1.20
ovpn-mini:
ansible_host: 192.168.1.23
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
expected_lan_ip: 192.168.1.23
openvpn_local_ip: 10.78.0.2
openvpn_peer_ip: 10.78.0.1
openvpn_role: gateway
# Остальные LXC — через ru-vps (см. ssh_config)
adguard:
ansible_host: 192.168.1.28
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.28
docker-test:
ansible_host: 192.168.1.29
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.29
vaultwarden:
ansible_host: 192.168.1.24
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.24
gitea:
ansible_host: 192.168.1.25
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.25
memoir-bot:
ansible_host: 192.168.1.26
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.26
mihomo:
ansible_host: 192.168.1.27
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.27
monitoring:
ansible_host: 192.168.1.30
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.30
hermes-ai:
ansible_host: 192.168.1.31
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.31
bash_config_proxy_http_url: http://192.168.1.27:7890
bash_config_proxy_socks_url: socks5h://192.168.1.27:7890
emergency-bot:
ansible_host: 192.168.1.32
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.32
grimmory:
ansible_host: 192.168.1.34
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.34
gyro:
ansible_host: 192.168.1.35
ansible_user: root
ansible_become: false
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
ansible_ssh_common_args: >-
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
expected_lan_ip: 192.168.1.35
monitoring_exporters:
ansible/ssh_config
+106
View File
@@ -0,0 +1,106 @@
# ════════════════════════════════════════════════════════════════════════
# HomeLab SSH config — единый источник правды по SSH-доступу
#
# Файл управляется репозиторием infras. Правь его здесь, а не в ~/.ssh/.
#
# Как подключить (один раз), первой строкой ~/.ssh/config:
#
# Include /home/ada/Documents/Projects/HomeLab/infras/ansible/ssh_config
#
# После этого из обычного терминала работает: ssh gitea, ssh pbs, ssh cloud-pc
#
# SSH берёт ПЕРВОЕ найденное значение опции, поэтому:
# - Include в начале ~/.ssh/config -> побеждают настройки репозитория;
# - Include в конце ~/.ssh/config -> побеждают личные записи из config.d/*
# (личные vps/cloud-pc/mini-pc/pbs остаются под пользователем ada,
# а LXC-хосты всё равно резолвятся отсюда).
#
# Ansible использует этот же файл: ansible.cfg -> [ssh_connection] ssh_args
# содержит -F <абсолютный путь к этому файлу>. Поэтому каждая запись
# указана и по имени (ssh gitea), и по IP (Ansible ходит по ansible_host).
# ════════════════════════════════════════════════════════════════════════
# ── Jump host: публичная VPS ────────────────────────────────────────────
Host ru-vps vps 157.22.231.198
HostName 157.22.231.198
Port 3422
User ansible
IdentityFile ~/.ssh/id_ed25519_homelab_ansible
# ── Proxmox VE ноды (через ru-vps) ──────────────────────────────────────
Host cloud-pc 192.168.1.5
HostName 192.168.1.5
Host mini-pc 192.168.1.10
HostName 192.168.1.10
Host cloud-pc mini-pc 192.168.1.5 192.168.1.10
User ansible
IdentityFile ~/.ssh/id_ed25519_homelab_ansible
ProxyJump ru-vps
# ── LXC, доступные напрямую по LAN (без ProxyJump) ──────────────────────
Host pbs 192.168.1.20
HostName 192.168.1.20
Host ovpn-mini 192.168.1.23
HostName 192.168.1.23
# ── LXC за jump-хостом ──────────────────────────────────────────────────
Host vaultwarden 192.168.1.24
HostName 192.168.1.24
Host gitea 192.168.1.25
HostName 192.168.1.25
Host memoir-bot 192.168.1.26
HostName 192.168.1.26
Host mihomo 192.168.1.27
HostName 192.168.1.27
Host adguard 192.168.1.28
HostName 192.168.1.28
Host docker-test 192.168.1.29
HostName 192.168.1.29
Host monitoring 192.168.1.30
HostName 192.168.1.30
Host hermes-ai 192.168.1.31
HostName 192.168.1.31
Host emergency-bot 192.168.1.32
HostName 192.168.1.32
Host grimmory 192.168.1.34
HostName 192.168.1.34
Host gyro 192.168.1.35
HostName 192.168.1.35
# ── Групповые опции. ssh_config не поддерживает перенос строк, поэтому
# списки паттернов длинные: имя хоста (для `ssh gitea`) + IP (Ansible
# подключается по ansible_host). ─────────────────────────────────────
# ProxyJump только для LXC, до которых нет прямого доступа
Host vaultwarden gitea memoir-bot mihomo adguard docker-test monitoring hermes-ai emergency-bot grimmory gyro 192.168.1.24 192.168.1.25 192.168.1.26 192.168.1.27 192.168.1.28 192.168.1.29 192.168.1.30 192.168.1.31 192.168.1.32 192.168.1.34 192.168.1.35
ProxyJump ru-vps
# Все LXC — под root с ключом id_ed25519_homelab
Host pbs ovpn-mini vaultwarden gitea memoir-bot mihomo adguard docker-test monitoring hermes-ai emergency-bot grimmory gyro 192.168.1.20 192.168.1.23 192.168.1.24 192.168.1.25 192.168.1.26 192.168.1.27 192.168.1.28 192.168.1.29 192.168.1.30 192.168.1.31 192.168.1.32 192.168.1.34 192.168.1.35
User root
IdentityFile ~/.ssh/id_ed25519_homelab
# Общие опции для хостов HomeLab (намеренно не `Host *`, чтобы не влиять
# на остальные записи ~/.ssh/config пользователя)
Host ru-vps vps cloud-pc mini-pc pbs ovpn-mini vaultwarden gitea memoir-bot mihomo adguard docker-test monitoring hermes-ai emergency-bot grimmory gyro 157.22.231.198 192.168.1.5 192.168.1.10 192.168.1.20 192.168.1.23 192.168.1.24 192.168.1.25 192.168.1.26 192.168.1.27 192.168.1.28 192.168.1.29 192.168.1.30 192.168.1.31 192.168.1.32 192.168.1.34 192.168.1.35
IdentitiesOnly yes
StrictHostKeyChecking accept-new
ControlMaster auto
ControlPath ~/.ssh/sockets/%C
ControlPersist 60s
ServerAliveInterval 30
ServerAliveCountMax 3