DmitryandClaude Opus 5
c676be81ec
Commit the accumulated infrastructure work that was living only in the working tree: monitoring stack, emergency access/bot, gyro allocator, grimmory, adguard, backup audit and the OpenCode agent definitions. Also ignore Python bytecode, local archives and Nix/direnv artifacts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
25 lines
912 B
YAML
25 lines
912 B
YAML
---
|
|
- name: Validate emergency access endpoint input
|
|
ansible.builtin.assert:
|
|
that:
|
|
- emergency_reverse_public_key | length > 0
|
|
fail_msg: Configure the mini-pc reverse SSH client before ru-vps.
|
|
no_log: true
|
|
|
|
- name: Create restricted reverse SSH endpoint user
|
|
ansible.builtin.user:
|
|
name: "{{ emergency_reverse_user }}"
|
|
system: true
|
|
# Remote forwarding is accepted before a session exists. A valid shell is
|
|
# required by SSHD; the forced command below rejects every session.
|
|
shell: /bin/sh
|
|
create_home: true
|
|
|
|
- name: Authorize only the dedicated reverse SSH key
|
|
ansible.posix.authorized_key:
|
|
user: "{{ emergency_reverse_user }}"
|
|
key: "command=\"/usr/bin/false\",restrict,port-forwarding,permitlisten=\"{{ emergency_reverse_bind_address }}:{{ emergency_reverse_port }}\" {{ emergency_reverse_public_key }}"
|
|
state: present
|
|
exclusive: true
|
|
no_log: true
|