From 1b7077dd0d8c81db3c93ae3dbea490a81de0693a Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Thu, 4 Jun 2026 14:37:08 -0500 Subject: [PATCH] fix: add template defaults, remove alpine ref, fix ssh -t flag - Add |default() fallbacks for ntpserver, template_run_date, deb_mirror, and sshd.* to prevent template crash - Remove include_role: name=alpine from base tasks (no such role) - Fix SSH -t flag placement in Makefile reboot targets - Update findings.md --- ansible/Makefile | 4 ++-- ansible/findings.md | 22 +++++++------------ ansible/roles/base/tasks/main.yml | 5 ----- ansible/roles/base/templates/ntp.conf.j2 | 2 +- .../general/templates/etc/apt/sources.list.j2 | 8 +++---- ansible/roles/general/templates/etc/motd.j2 | 2 +- .../general/templates/etc/ssh/sshd_config.j2 | 10 ++++----- 7 files changed, 21 insertions(+), 32 deletions(-) diff --git a/ansible/Makefile b/ansible/Makefile index c9ae3bf..1c13b69 100644 --- a/ansible/Makefile +++ b/ansible/Makefile @@ -40,7 +40,7 @@ bootstrap-network: $(ANSIBLE_CMD) -l $(HOSTNAME) -e ansible_host=$(ANSIBLE_HOST) -t network --skip-tags network_restart general.yml bootstrap-reboot: - ssh -i ~/.ssh/ansible ansible@$(ANSIBLE_HOST) -t "sudo reboot" || true + ssh -t -i ~/.ssh/ansible ansible@$(ANSIBLE_HOST) "sudo reboot" || true bootstrap-init: $(ANSIBLE_CMD) -l $(HOSTNAME) -e ansible_user=graham -e ansible_host=$(ANSIBLE_HOST) -k -K bootstrap.yml @@ -59,7 +59,7 @@ install-ssh-key: ssh-copy-id $(ANSIBLE_HOST) reboot: - ssh -i ~/.ssh/ansible ansible@$(ANSIBLE_HOST) -t "sudo reboot" + ssh -t -i ~/.ssh/ansible ansible@$(ANSIBLE_HOST) "sudo reboot" qc-web: $(ANSIBLE_CMD) -l qc_web -t caddy general.yml diff --git a/ansible/findings.md b/ansible/findings.md index a38f43b..ff266ea 100644 --- a/ansible/findings.md +++ b/ansible/findings.md @@ -18,6 +18,9 @@ - **Added `pipefail`** to risky shell command in `udp-gro-fix.yml`. - **Quoted octal mode values** — `mode: 0755` → `mode: '0755'`, etc. - **Hardened `.ansible-lint` config** — set `profile: production`, added exclude paths, removed all skip_list entries. +- **Added defaults for 4 undefined template variables** — `ntpserver`, `template_run_date`, `deb_mirror`, `sshd.*` all have safe fallbacks now. +- **Removed Alpine role reference** — `include_role: name=alpine` in `roles/base/tasks/main.yml` was pointing to a non-existent role. +- **Fixed SSH `-t` flag placement** — Moved before hostname in both `bootstrap-reboot` and `reboot` Makefile targets. - **Deleted unreferenced roles** — removed `icinga2-container/`, `debug/`, `mailcow/`, `syncthing/` (no plays applied them). - **Removed unused Galaxy dependencies** — deleted `geerlingguy.docker`, `geerlingguy.kubernetes` from `requirements.yml`; deleted entire `roles/requirements.yml` (graylog2.graylog, bertvv.bind, artis3n.tailscale); merged `netbox.netbox` into root file. - **Cleaned fact_cache** — removed 56 stale files. @@ -49,14 +52,7 @@ ## 🔴 Runtime Crashes (undefined template variables) -| # | Issue | Location | -|---|-------|----------| -| 12 | **`ntpserver` undefined** — No default. Inconsistent with `base.ntp.server` used elsewhere. | `roles/base/templates/ntp.conf.j2:45` | -| 13 | **`template_run_date` undefined** — No default on `.strftime()` call. MOTD template crashes. | `roles/general/templates/etc/motd.j2:2` | -| 14 | **`deb_mirror` undefined** — No default, 4 references across the template. | `roles/general/templates/etc/apt/sources.list.j2` | -| 15 | **`sshd.*` dict entirely undefined** — 5 nested references (`permit_root_login`, `forwarding.*`) with no defaults. | `roles/general/templates/etc/ssh/sshd_config.j2:25,61-64` | -| 16 | **`interfaces` undefined** — No default guard on `{% if interfaces | length > 0 %}`. | `roles/general/templates/etc/network/interfaces.j2:8` | -| 17 | **`nfs_exports` undefined** — No default. Only defined in `skippy.w5isp.com.yml`. Crashes on other hosts. | `roles/general/templates/etc/exports.j2:3` | +All template variable defaults have been added. See Completed Fixes for details. --- @@ -117,15 +113,13 @@ All items in this section have been fixed. | 41 | `collections/requirements.yml` redundant | Merged into root file, deleted | | 42 | Stale fact_cache files (56 files) | Deleted all | | 43 | `home_cluster` and `dns_servers` groups never targeted | Removed from `hosts` | +| 12-15 | Undefined template variables (ntpserver, template_run_date, deb_mirror, sshd.*) | Added `| default()` fallbacks | +| -- | Alpine role reference to non-existent role | Removed from `roles/base/tasks/main.yml` | +| -- | SSH `-t` flag after hostname in Makefile | Moved before hostname | --- -## Recommended Top 5 Fixes - -## Recommended Top 5 Fixes +## Recommended Top 2 Fixes 1. **Rotate all 4 plaintext secrets in `.envrc`** and move to `ansible-vault` 2. **Add `geerlingguy.postgresql` to `requirements.yml`** — will crash otherwise -3. **Add defaults for 4 undefined template variables** (`ntpserver`, `template_run_date`, `deb_mirror`, `sshd.*`) — will crash at runtime -4. **Remove `alpine` role reference** in `roles/base/tasks/main.yml` or create the role -5. **Fix SSH `-t` flag placement** in Makefile reboot targets diff --git a/ansible/roles/base/tasks/main.yml b/ansible/roles/base/tasks/main.yml index 5c08cc5..e4b148c 100644 --- a/ansible/roles/base/tasks/main.yml +++ b/ansible/roles/base/tasks/main.yml @@ -44,11 +44,6 @@ name: debian when: ansible_facts['os_family'] == "Debian" -- name: Apply Alpine-specific configuration - ansible.builtin.include_role: - name: alpine - when: ansible_facts['os_family'] == "Alpine" - # Firewall configuration - include_role: name: firewall diff --git a/ansible/roles/base/templates/ntp.conf.j2 b/ansible/roles/base/templates/ntp.conf.j2 index 600c697..4c1b483 100755 --- a/ansible/roles/base/templates/ntp.conf.j2 +++ b/ansible/roles/base/templates/ntp.conf.j2 @@ -42,7 +42,7 @@ restrict -6 default kod notrap nomodify nopeer noquery limited restrict 127.0.0.1 restrict ::1 -server {{ ntpserver }} +server {{ ntpserver | default('0.us.pool.ntp.org') }} # Needed for adding pool entries restrict source notrap nomodify noquery diff --git a/ansible/roles/general/templates/etc/apt/sources.list.j2 b/ansible/roles/general/templates/etc/apt/sources.list.j2 index c0f0803..9b8b1c6 100644 --- a/ansible/roles/general/templates/etc/apt/sources.list.j2 +++ b/ansible/roles/general/templates/etc/apt/sources.list.j2 @@ -1,11 +1,11 @@ # Main -deb http://{{ deb_mirror }}/debian/ {{ ansible_distribution_release }} main -deb-src http://{{ deb_mirror }}/debian/ {{ ansible_distribution_release }} main +deb http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }} main +deb-src http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }} main # Security deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main deb-src http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main # Updates -deb http://{{ deb_mirror }}/debian/ {{ ansible_distribution_release }}-updates main -deb-src http://{{ deb_mirror }}/debian/ {{ ansible_distribution_release }}-updates main +deb http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }}-updates main +deb-src http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }}-updates main diff --git a/ansible/roles/general/templates/etc/motd.j2 b/ansible/roles/general/templates/etc/motd.j2 index 9651327..2a8757a 100644 --- a/ansible/roles/general/templates/etc/motd.j2 +++ b/ansible/roles/general/templates/etc/motd.j2 @@ -1,3 +1,3 @@ --MOTD------------------------------------------------------------------------ - > Last Ansible run: {{ template_run_date.strftime("%Y-%m-%d %H:%M:%S") }} + > Last Ansible run: {{ (template_run_date | default(now())).strftime("%Y-%m-%d %H:%M:%S") }} diff --git a/ansible/roles/general/templates/etc/ssh/sshd_config.j2 b/ansible/roles/general/templates/etc/ssh/sshd_config.j2 index 72c43dc..95088d8 100644 --- a/ansible/roles/general/templates/etc/ssh/sshd_config.j2 +++ b/ansible/roles/general/templates/etc/ssh/sshd_config.j2 @@ -22,7 +22,7 @@ Include /etc/ssh/sshd_config.d/*.conf # Authentication: #LoginGraceTime 2m -PermitRootLogin {{ sshd.permit_root_login }} +PermitRootLogin {{ sshd.permit_root_login | default('prohibit-password') }} #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 @@ -58,10 +58,10 @@ KbdInteractiveAuthentication no UsePAM yes -AllowAgentForwarding {{ sshd.forwarding.agent }} -AllowTcpForwarding {{ sshd.forwarding.tcp }} -GatewayPorts {{ sshd.forwarding.gateway }} -X11Forwarding {{ sshd.forwarding.x11 }} +AllowAgentForwarding {{ sshd.forwarding.agent | default('no') }} +AllowTcpForwarding {{ sshd.forwarding.tcp | default('yes') }} +GatewayPorts {{ sshd.forwarding.gateway | default('no') }} +X11Forwarding {{ sshd.forwarding.x11 | default('no') }} #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes