fix: add template defaults, remove alpine ref, fix ssh -t flag

- Add |default() fallbacks for ntpserver, template_run_date,
  deb_mirror, and sshd.* to prevent template crash
- Remove include_role: name=alpine from base tasks (no such role)
- Fix SSH -t flag placement in Makefile reboot targets
- Update findings.md

ansible/Makefile

@@ -40,7 +40,7 @@ bootstrap-network:
 	$(ANSIBLE_CMD) -l $(HOSTNAME) -e ansible_host=$(ANSIBLE_HOST) -t network --skip-tags network_restart general.yml
 
 bootstrap-reboot:
-	ssh -i ~/.ssh/ansible ansible@$(ANSIBLE_HOST) -t "sudo reboot" || true
+	ssh -t -i ~/.ssh/ansible ansible@$(ANSIBLE_HOST) "sudo reboot" || true
 
 bootstrap-init:
 	$(ANSIBLE_CMD) -l $(HOSTNAME) -e ansible_user=graham -e ansible_host=$(ANSIBLE_HOST) -k -K bootstrap.yml
@@ -59,7 +59,7 @@ install-ssh-key:
 	ssh-copy-id $(ANSIBLE_HOST)
 
 reboot:
-	ssh -i ~/.ssh/ansible ansible@$(ANSIBLE_HOST) -t "sudo reboot"
+	ssh -t -i ~/.ssh/ansible ansible@$(ANSIBLE_HOST) "sudo reboot"
 
 qc-web:
 	$(ANSIBLE_CMD) -l qc_web -t caddy general.yml

ansible/findings.md

@@ -18,6 +18,9 @@
 - **Added `pipefail`** to risky shell command in `udp-gro-fix.yml`.
 - **Quoted octal mode values** — `mode: 0755` → `mode: '0755'`, etc.
 - **Hardened `.ansible-lint` config** — set `profile: production`, added exclude paths, removed all skip_list entries.
+- **Added defaults for 4 undefined template variables** — `ntpserver`, `template_run_date`, `deb_mirror`, `sshd.*` all have safe fallbacks now.
+- **Removed Alpine role reference** — `include_role: name=alpine` in `roles/base/tasks/main.yml` was pointing to a non-existent role.
+- **Fixed SSH `-t` flag placement** — Moved before hostname in both `bootstrap-reboot` and `reboot` Makefile targets.
 - **Deleted unreferenced roles** — removed `icinga2-container/`, `debug/`, `mailcow/`, `syncthing/` (no plays applied them).
 - **Removed unused Galaxy dependencies** — deleted `geerlingguy.docker`, `geerlingguy.kubernetes` from `requirements.yml`; deleted entire `roles/requirements.yml` (graylog2.graylog, bertvv.bind, artis3n.tailscale); merged `netbox.netbox` into root file.
 - **Cleaned fact_cache** — removed 56 stale files.
@@ -49,14 +52,7 @@
 
 ## 🔴 Runtime Crashes (undefined template variables)
 
-| # | Issue | Location |
+All template variable defaults have been added. See Completed Fixes for details.
-|---|-------|----------|
-| 12 | **`ntpserver` undefined** — No default. Inconsistent with `base.ntp.server` used elsewhere. | `roles/base/templates/ntp.conf.j2:45` |
-| 13 | **`template_run_date` undefined** — No default on `.strftime()` call. MOTD template crashes. | `roles/general/templates/etc/motd.j2:2` |
-| 14 | **`deb_mirror` undefined** — No default, 4 references across the template. | `roles/general/templates/etc/apt/sources.list.j2` |
-| 15 | **`sshd.*` dict entirely undefined** — 5 nested references (`permit_root_login`, `forwarding.*`) with no defaults. | `roles/general/templates/etc/ssh/sshd_config.j2:25,61-64` |
-| 16 | **`interfaces` undefined** — No default guard on `{% if interfaces | length > 0 %}`. | `roles/general/templates/etc/network/interfaces.j2:8` |
-| 17 | **`nfs_exports` undefined** — No default. Only defined in `skippy.w5isp.com.yml`. Crashes on other hosts. | `roles/general/templates/etc/exports.j2:3` |
 
 ---
 
@@ -117,15 +113,13 @@ All items in this section have been fixed.
 | 41 | `collections/requirements.yml` redundant | Merged into root file, deleted |
 | 42 | Stale fact_cache files (56 files) | Deleted all |
 | 43 | `home_cluster` and `dns_servers` groups never targeted | Removed from `hosts` |
+| 12-15 | Undefined template variables (ntpserver, template_run_date, deb_mirror, sshd.*) | Added `| default()` fallbacks |
+| -- | Alpine role reference to non-existent role | Removed from `roles/base/tasks/main.yml` |
+| -- | SSH `-t` flag after hostname in Makefile | Moved before hostname |
 
 ---
 
-## Recommended Top 5 Fixes
+## Recommended Top 2 Fixes
-
-## Recommended Top 5 Fixes
 
 1. **Rotate all 4 plaintext secrets in `.envrc`** and move to `ansible-vault`
 2. **Add `geerlingguy.postgresql` to `requirements.yml`** — will crash otherwise
-3. **Add defaults for 4 undefined template variables** (`ntpserver`, `template_run_date`, `deb_mirror`, `sshd.*`) — will crash at runtime
-4. **Remove `alpine` role reference** in `roles/base/tasks/main.yml` or create the role
-5. **Fix SSH `-t` flag placement** in Makefile reboot targets

ansible/roles/base/tasks/main.yml

@@ -44,11 +44,6 @@
     name: debian
   when: ansible_facts['os_family'] == "Debian"
 
-- name: Apply Alpine-specific configuration
-  ansible.builtin.include_role:
-    name: alpine
-  when: ansible_facts['os_family'] == "Alpine"
-
 # Firewall configuration
 - include_role:
     name: firewall

ansible/roles/base/templates/ntp.conf.j2

@@ -42,7 +42,7 @@ restrict -6 default kod notrap nomodify nopeer noquery limited
 restrict 127.0.0.1
 restrict ::1
 
-server {{ ntpserver }}
+server {{ ntpserver | default('0.us.pool.ntp.org') }}
 
 # Needed for adding pool entries
 restrict source notrap nomodify noquery

ansible/roles/general/templates/etc/apt/sources.list.j2

@@ -1,11 +1,11 @@
 # Main
-deb http://{{ deb_mirror }}/debian/ {{ ansible_distribution_release }} main
+deb http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }} main
-deb-src http://{{ deb_mirror }}/debian/ {{ ansible_distribution_release }} main
+deb-src http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }} main
 
 # Security
 deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main
 deb-src http://security.debian.org/debian-security {{ ansible_distribution_release }}-security main
 
 # Updates
-deb http://{{ deb_mirror }}/debian/ {{ ansible_distribution_release }}-updates main
+deb http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }}-updates main
-deb-src http://{{ deb_mirror }}/debian/ {{ ansible_distribution_release }}-updates main
+deb-src http://{{ deb_mirror | default('deb.debian.org') }}/debian/ {{ ansible_distribution_release }}-updates main

ansible/roles/general/templates/etc/motd.j2

@@ -1,3 +1,3 @@
  --MOTD------------------------------------------------------------------------
- > Last Ansible run: {{ template_run_date.strftime("%Y-%m-%d %H:%M:%S") }}
+ > Last Ansible run: {{ (template_run_date | default(now())).strftime("%Y-%m-%d %H:%M:%S") }}
 

ansible/roles/general/templates/etc/ssh/sshd_config.j2

@@ -22,7 +22,7 @@ Include /etc/ssh/sshd_config.d/*.conf
 
 # Authentication:
 #LoginGraceTime 2m
-PermitRootLogin {{ sshd.permit_root_login }}
+PermitRootLogin {{ sshd.permit_root_login | default('prohibit-password') }}
 #StrictModes yes
 #MaxAuthTries 6
 #MaxSessions 10
@@ -58,10 +58,10 @@ KbdInteractiveAuthentication no
 
 UsePAM yes
 
-AllowAgentForwarding {{ sshd.forwarding.agent }}
+AllowAgentForwarding {{ sshd.forwarding.agent | default('no') }}
-AllowTcpForwarding {{ sshd.forwarding.tcp }}
+AllowTcpForwarding {{ sshd.forwarding.tcp | default('yes') }}
-GatewayPorts {{ sshd.forwarding.gateway }}
+GatewayPorts {{ sshd.forwarding.gateway | default('no') }}
-X11Forwarding {{ sshd.forwarding.x11 }}
+X11Forwarding {{ sshd.forwarding.x11 | default('no') }}
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes