remove findings
This commit is contained in:
parent
6b7ef92c5b
commit
c5b658d653
1 changed files with 0 additions and 105 deletions
|
|
@ -1,105 +0,0 @@
|
|||
# Ansible Repo Audit — Findings
|
||||
|
||||
> Generated 2026-06-04 after auditing ~70 role files, 7 playbooks/configs, 21 host_vars, and 50+ templates.
|
||||
|
||||
## Completed Fixes
|
||||
|
||||
- **Removed all Forgejo references** — deleted `roles/forgejo/`, removed forgejo play from `playbook.yml`, removed `forgejo_servers` group from `hosts`, removed forgejo vars from `host_vars/git.mcintire.me.yml`, removed docker-mirror CNAME from DNS zone.
|
||||
- **Fixed hardcoded SSH private key paths** — replaced all 20 occurrences of `/Users/graham/.ssh/id_ed25519` and `/Users/graham/.ssh/ansible` with `ansible_ssh_private_key_file: "{{ lookup('env', 'ANSIBLE_SSH_PRIVATE_KEY_FILE') | default('~/.ssh/ansible', true) }}"` in `group_vars/all/all.yml`. Set `ANSIBLE_SSH_PRIVATE_KEY_FILE` env var to override.
|
||||
- **Fixed `community.mysql` collection** — added to `requirements.yml` and installed (fixes monitor role crash).
|
||||
- **Removed broken `setup-user` Makefile target** — referenced non-existent `setup-user.sh`.
|
||||
- **Fixed tracking issues** — `git rm --cached` for 5 `.DS_Store` files and `.vscode/settings.json`; added `.ansible/` to `.gitignore`.
|
||||
- **Fixed stale documentation** — updated `CLAUDE.md` and `README.md` to reflect actual playbook structure, roles, inventory groups, and collections.
|
||||
- **Fixed non-FQCN module references** — converted ~290 short module names (`apt:`, `service:`, `template:`, etc.) to FQCNs (`ansible.builtin.apt:`, etc.) across all roles and playbooks.
|
||||
- **Fixed `become:`/`gather_facts:` boolean forms** — `become: yes` → `become: true`, `gather_facts: no` → `gather_facts: false` in all plays.
|
||||
- **Removed deprecated `inject_facts_as_vars`** from `ansible.cfg`.
|
||||
- **Added missing task names** — `import_tasks`/`include_role` calls in `base/tasks/main.yml` and `general/tasks/main.yml` now have descriptive names.
|
||||
- **Fixed `partial-become` bug** — added `become: yes` to librenms clone task.
|
||||
- **Added `pipefail`** to risky shell command in `udp-gro-fix.yml`.
|
||||
- **Quoted octal mode values** — `mode: 0755` → `mode: '0755'`, etc.
|
||||
- **Hardened `.ansible-lint` config** — set `profile: production`, added exclude paths, removed all skip_list entries.
|
||||
- **Added defaults for 4 undefined template variables** — `ntpserver`, `template_run_date`, `deb_mirror`, `sshd.*` all have safe fallbacks now.
|
||||
- **Removed Alpine role reference** — `include_role: name=alpine` in `roles/base/tasks/main.yml` was pointing to a non-existent role.
|
||||
- **Fixed SSH `-t` flag placement** — Moved before hostname in both `bootstrap-reboot` and `reboot` Makefile targets.
|
||||
- **Fixed `general.yml` references** — `bootstrap-network`, `run-all`, `qc-web` Makefile targets now use `playbook.yml`; removed `qc-web` target (`qc_web` group doesn't exist).
|
||||
- **Removed all Docker targets** — `build-*`, `run-*`, `push-*`, `base-*`, `latest`, `local`, `clean`, `dirs` — no Dockerfile at repo root ever existed.
|
||||
- **Fixed `install-collections`** — removed references to deleted `roles/requirements.yml` and `scripts/fix-deprecated-imports.sh`.
|
||||
- **Deleted orphaned `host_vars/db.aprs.me.yml`** — host not in inventory; `db.w5isp.com` already serves as the single database server.
|
||||
- **Deleted unreferenced roles** — removed `icinga2-container/`, `debug/`, `mailcow/`, `syncthing/` (no plays applied them).
|
||||
- **Removed unused Galaxy dependencies** — deleted `geerlingguy.docker`, `geerlingguy.kubernetes` from `requirements.yml`; deleted entire `roles/requirements.yml` (graylog2.graylog, bertvv.bind, artis3n.tailscale); merged `netbox.netbox` into root file.
|
||||
- **Cleaned fact_cache** — removed 56 stale files.
|
||||
- **Removed unused inventory groups** — `home_cluster` and `dns_servers` (defined but never targeted).
|
||||
|
||||
---
|
||||
|
||||
## 🔴 Security (fix immediately)
|
||||
|
||||
| # | Issue | Location |
|
||||
|---|-------|----------|
|
||||
| 1 | **Plaintext secrets in `.envrc`** — Tailscale auth key, PowerDNS API key, PostgreSQL password, Proxmox root password in plaintext on disk. Use `ansible-vault` or a secrets manager. | `.envrc:3,6,9,14` |
|
||||
| 2 | **Hardcoded cloud-init password** — `cipassword` in plaintext for BIND9 VM. Anyone with repo access can SSH in as `debian`. | `playbook.yml:159` |
|
||||
| 3 | **Hardcoded SSH public key** — Same `ed25519` key in playbook, `setup-host.sh`, and `base/files/ansible.pub`. Not vaulted. Rotate + move to vault. | `playbook.yml:106`, `setup-host.sh:17`, `base/files/ansible.pub` |
|
||||
|
||||
---
|
||||
|
||||
## 🔴 Broken Infrastructure (will fail at runtime)
|
||||
|
||||
---
|
||||
|
||||
## 🔴 Runtime Crashes (undefined template variables)
|
||||
|
||||
All template variable defaults have been added. See Completed Fixes for details.
|
||||
|
||||
---
|
||||
|
||||
## 🟡 Previously Fixed
|
||||
|
||||
| # | Issue | Fix |
|
||||
|---|-------|-----|
|
||||
| 4 | Hardcoded Forgejo runner token in host_vars | Deleted with forgejo cleanup |
|
||||
| 7 | `setup-user.sh` doesn't exist | Removed broken Makefile target |
|
||||
| 11 | `community.mysql.mysql_db` module not found | Added `community.mysql` to `requirements.yml` and installed |
|
||||
| 45 | 5 `.DS_Store` files tracked by git | `git rm --cached` |
|
||||
| 46 | `.vscode/settings.json` tracked despite gitignore | `git rm --cached` |
|
||||
| 47 | `.ansible/` directory not in `.gitignore` | Added to `.gitignore` |
|
||||
| 48 | Stale `CLAUDE.md` (references `general.yml`, missing roles, wrong commands) | Rewritten with accurate playbooks, roles, collections, commands |
|
||||
| 49 | Stale `README.md` (wrong directory tree, incomplete groups) | Rewritten with accurate structure and inventory groups |
|
||||
| 29 | Non-FQCN module references (~290 instances) | Converted all to FQCNs across all roles and playbooks |
|
||||
| 30 | Unquoted octal mode values (9 instances) | All quoted with single quotes |
|
||||
| 31 | `become: yes` / `gather_facts: no` | Changed to `become: true` / `gather_facts: false` |
|
||||
| 32 | `inject_facts_as_vars` deprecated | Removed from `ansible.cfg` |
|
||||
| 33 | Missing task names on `import_tasks`/`include_role` | Added descriptive names |
|
||||
| 34 | `partial-become` bug in librenms | Added `become: yes` |
|
||||
| 35 | `risky-shell-pipe` without pipefail | Added `set -o pipefail` |
|
||||
| 36 | Minimal `.ansible-lint` config | Set `profile: production`, added exclude paths, empty skip_list |
|
||||
| 37 | Unreferenced `icinga2-container/` and `debug/` roles | Deleted |
|
||||
| 38 | Unreferenced `mailcow/` and `syncthing/` roles | Deleted |
|
||||
| 39 | `geerlingguy.docker` and `geerlingguy.kubernetes` never used | Removed from `requirements.yml` |
|
||||
| 40 | `graylog2.graylog` and `bertvv.bind` never used | Deleted `roles/requirements.yml` |
|
||||
| 41 | `collections/requirements.yml` redundant | Merged into root file, deleted |
|
||||
| 42 | Stale fact_cache files (56 files) | Deleted all |
|
||||
| 43 | `home_cluster` and `dns_servers` groups never targeted | Removed from `hosts` |
|
||||
| 9 | `alpine` role referenced but doesn't exist | Removed `include_role` from `roles/base/tasks/main.yml` |
|
||||
| 5 | `general.yml` does not exist | Makefile targets updated to use `playbook.yml`; docker/build targets removed |
|
||||
| 6 | No `Dockerfile` at repo root | All docker/build/push targets removed from Makefile |
|
||||
| 8 | `geerlingguy.postgresql` not in `requirements.yml` | Added with version pin 3.4.3 |
|
||||
| 10 | Orphaned `host_vars/db.aprs.me.yml` with no inventory entry | Deleted (superseded by `db.w5isp.com`) |
|
||||
| 12-15 | Undefined template variables (ntpserver, template_run_date, deb_mirror, sshd.*) | Added `| default()` fallbacks |
|
||||
| -- | SSH `-t` flag after hostname in Makefile | Moved before hostname |
|
||||
| 18 | Firewall role runs twice on non-Proxmox hosts | Removed duplicate `include_role` from `base` role |
|
||||
| 19 | SSH `-t` flag in wrong position | Already fixed above (same as `--` entry) |
|
||||
| 20 | `ansible_user` in `[ssh_connection]` silently ignored | Moved `remote_user = ansible` to `[defaults]` |
|
||||
| 21 | `run.sh` masks playbook failures via `tee` | Added `set -euo pipefail` |
|
||||
| 22 | `playbook_handlers.yml` orphaned and never imported | Deleted file |
|
||||
| 23 | `changed_when: true` on idempotent commands | Changed to `changed_when: false` in debian role; udp-gro-fix fixed; mailcow deleted |
|
||||
| 24 | `run-local` mounts wrong path | Target no longer exists (docker targets removed) |
|
||||
| 25 | `TAILSCALE_AUTHKEY` vs `TAILSCALE_KEY` mismatch | Added env var lookup fallback in `group_vars/all/all.yml` |
|
||||
| 26 | `bootstrap.yml` second play unconditional `become_method: sudo` | Documented `-K` requirement |
|
||||
| 27 | `mail.mcintire.me` and `git.mcintire.me` bare `ansible_host` | Replaced with IP addresses |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Fix
|
||||
|
||||
1. **Rotate all 4 plaintext secrets in `.envrc`** and move to `ansible-vault`
|
||||
|
||||
Loading…
Add table
Reference in a new issue