From c5b658d653386e12181b54bfccbee24d399a4d4f Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Thu, 4 Jun 2026 15:25:00 -0500 Subject: [PATCH] remove findings --- ansible/findings.md | 105 -------------------------------------------- 1 file changed, 105 deletions(-) delete mode 100644 ansible/findings.md diff --git a/ansible/findings.md b/ansible/findings.md deleted file mode 100644 index 89fe8d1..0000000 --- a/ansible/findings.md +++ /dev/null @@ -1,105 +0,0 @@ -# Ansible Repo Audit — Findings - -> Generated 2026-06-04 after auditing ~70 role files, 7 playbooks/configs, 21 host_vars, and 50+ templates. - -## Completed Fixes - -- **Removed all Forgejo references** — deleted `roles/forgejo/`, removed forgejo play from `playbook.yml`, removed `forgejo_servers` group from `hosts`, removed forgejo vars from `host_vars/git.mcintire.me.yml`, removed docker-mirror CNAME from DNS zone. -- **Fixed hardcoded SSH private key paths** — replaced all 20 occurrences of `/Users/graham/.ssh/id_ed25519` and `/Users/graham/.ssh/ansible` with `ansible_ssh_private_key_file: "{{ lookup('env', 'ANSIBLE_SSH_PRIVATE_KEY_FILE') | default('~/.ssh/ansible', true) }}"` in `group_vars/all/all.yml`. Set `ANSIBLE_SSH_PRIVATE_KEY_FILE` env var to override. -- **Fixed `community.mysql` collection** — added to `requirements.yml` and installed (fixes monitor role crash). -- **Removed broken `setup-user` Makefile target** — referenced non-existent `setup-user.sh`. -- **Fixed tracking issues** — `git rm --cached` for 5 `.DS_Store` files and `.vscode/settings.json`; added `.ansible/` to `.gitignore`. -- **Fixed stale documentation** — updated `CLAUDE.md` and `README.md` to reflect actual playbook structure, roles, inventory groups, and collections. -- **Fixed non-FQCN module references** — converted ~290 short module names (`apt:`, `service:`, `template:`, etc.) to FQCNs (`ansible.builtin.apt:`, etc.) across all roles and playbooks. -- **Fixed `become:`/`gather_facts:` boolean forms** — `become: yes` → `become: true`, `gather_facts: no` → `gather_facts: false` in all plays. -- **Removed deprecated `inject_facts_as_vars`** from `ansible.cfg`. -- **Added missing task names** — `import_tasks`/`include_role` calls in `base/tasks/main.yml` and `general/tasks/main.yml` now have descriptive names. -- **Fixed `partial-become` bug** — added `become: yes` to librenms clone task. -- **Added `pipefail`** to risky shell command in `udp-gro-fix.yml`. -- **Quoted octal mode values** — `mode: 0755` → `mode: '0755'`, etc. -- **Hardened `.ansible-lint` config** — set `profile: production`, added exclude paths, removed all skip_list entries. -- **Added defaults for 4 undefined template variables** — `ntpserver`, `template_run_date`, `deb_mirror`, `sshd.*` all have safe fallbacks now. -- **Removed Alpine role reference** — `include_role: name=alpine` in `roles/base/tasks/main.yml` was pointing to a non-existent role. -- **Fixed SSH `-t` flag placement** — Moved before hostname in both `bootstrap-reboot` and `reboot` Makefile targets. -- **Fixed `general.yml` references** — `bootstrap-network`, `run-all`, `qc-web` Makefile targets now use `playbook.yml`; removed `qc-web` target (`qc_web` group doesn't exist). -- **Removed all Docker targets** — `build-*`, `run-*`, `push-*`, `base-*`, `latest`, `local`, `clean`, `dirs` — no Dockerfile at repo root ever existed. -- **Fixed `install-collections`** — removed references to deleted `roles/requirements.yml` and `scripts/fix-deprecated-imports.sh`. -- **Deleted orphaned `host_vars/db.aprs.me.yml`** — host not in inventory; `db.w5isp.com` already serves as the single database server. -- **Deleted unreferenced roles** — removed `icinga2-container/`, `debug/`, `mailcow/`, `syncthing/` (no plays applied them). -- **Removed unused Galaxy dependencies** — deleted `geerlingguy.docker`, `geerlingguy.kubernetes` from `requirements.yml`; deleted entire `roles/requirements.yml` (graylog2.graylog, bertvv.bind, artis3n.tailscale); merged `netbox.netbox` into root file. -- **Cleaned fact_cache** — removed 56 stale files. -- **Removed unused inventory groups** — `home_cluster` and `dns_servers` (defined but never targeted). - ---- - -## 🔴 Security (fix immediately) - -| # | Issue | Location | -|---|-------|----------| -| 1 | **Plaintext secrets in `.envrc`** — Tailscale auth key, PowerDNS API key, PostgreSQL password, Proxmox root password in plaintext on disk. Use `ansible-vault` or a secrets manager. | `.envrc:3,6,9,14` | -| 2 | **Hardcoded cloud-init password** — `cipassword` in plaintext for BIND9 VM. Anyone with repo access can SSH in as `debian`. | `playbook.yml:159` | -| 3 | **Hardcoded SSH public key** — Same `ed25519` key in playbook, `setup-host.sh`, and `base/files/ansible.pub`. Not vaulted. Rotate + move to vault. | `playbook.yml:106`, `setup-host.sh:17`, `base/files/ansible.pub` | - ---- - -## 🔴 Broken Infrastructure (will fail at runtime) - ---- - -## 🔴 Runtime Crashes (undefined template variables) - -All template variable defaults have been added. See Completed Fixes for details. - ---- - -## 🟡 Previously Fixed - -| # | Issue | Fix | -|---|-------|-----| -| 4 | Hardcoded Forgejo runner token in host_vars | Deleted with forgejo cleanup | -| 7 | `setup-user.sh` doesn't exist | Removed broken Makefile target | -| 11 | `community.mysql.mysql_db` module not found | Added `community.mysql` to `requirements.yml` and installed | -| 45 | 5 `.DS_Store` files tracked by git | `git rm --cached` | -| 46 | `.vscode/settings.json` tracked despite gitignore | `git rm --cached` | -| 47 | `.ansible/` directory not in `.gitignore` | Added to `.gitignore` | -| 48 | Stale `CLAUDE.md` (references `general.yml`, missing roles, wrong commands) | Rewritten with accurate playbooks, roles, collections, commands | -| 49 | Stale `README.md` (wrong directory tree, incomplete groups) | Rewritten with accurate structure and inventory groups | -| 29 | Non-FQCN module references (~290 instances) | Converted all to FQCNs across all roles and playbooks | -| 30 | Unquoted octal mode values (9 instances) | All quoted with single quotes | -| 31 | `become: yes` / `gather_facts: no` | Changed to `become: true` / `gather_facts: false` | -| 32 | `inject_facts_as_vars` deprecated | Removed from `ansible.cfg` | -| 33 | Missing task names on `import_tasks`/`include_role` | Added descriptive names | -| 34 | `partial-become` bug in librenms | Added `become: yes` | -| 35 | `risky-shell-pipe` without pipefail | Added `set -o pipefail` | -| 36 | Minimal `.ansible-lint` config | Set `profile: production`, added exclude paths, empty skip_list | -| 37 | Unreferenced `icinga2-container/` and `debug/` roles | Deleted | -| 38 | Unreferenced `mailcow/` and `syncthing/` roles | Deleted | -| 39 | `geerlingguy.docker` and `geerlingguy.kubernetes` never used | Removed from `requirements.yml` | -| 40 | `graylog2.graylog` and `bertvv.bind` never used | Deleted `roles/requirements.yml` | -| 41 | `collections/requirements.yml` redundant | Merged into root file, deleted | -| 42 | Stale fact_cache files (56 files) | Deleted all | -| 43 | `home_cluster` and `dns_servers` groups never targeted | Removed from `hosts` | -| 9 | `alpine` role referenced but doesn't exist | Removed `include_role` from `roles/base/tasks/main.yml` | -| 5 | `general.yml` does not exist | Makefile targets updated to use `playbook.yml`; docker/build targets removed | -| 6 | No `Dockerfile` at repo root | All docker/build/push targets removed from Makefile | -| 8 | `geerlingguy.postgresql` not in `requirements.yml` | Added with version pin 3.4.3 | -| 10 | Orphaned `host_vars/db.aprs.me.yml` with no inventory entry | Deleted (superseded by `db.w5isp.com`) | -| 12-15 | Undefined template variables (ntpserver, template_run_date, deb_mirror, sshd.*) | Added `| default()` fallbacks | -| -- | SSH `-t` flag after hostname in Makefile | Moved before hostname | -| 18 | Firewall role runs twice on non-Proxmox hosts | Removed duplicate `include_role` from `base` role | -| 19 | SSH `-t` flag in wrong position | Already fixed above (same as `--` entry) | -| 20 | `ansible_user` in `[ssh_connection]` silently ignored | Moved `remote_user = ansible` to `[defaults]` | -| 21 | `run.sh` masks playbook failures via `tee` | Added `set -euo pipefail` | -| 22 | `playbook_handlers.yml` orphaned and never imported | Deleted file | -| 23 | `changed_when: true` on idempotent commands | Changed to `changed_when: false` in debian role; udp-gro-fix fixed; mailcow deleted | -| 24 | `run-local` mounts wrong path | Target no longer exists (docker targets removed) | -| 25 | `TAILSCALE_AUTHKEY` vs `TAILSCALE_KEY` mismatch | Added env var lookup fallback in `group_vars/all/all.yml` | -| 26 | `bootstrap.yml` second play unconditional `become_method: sudo` | Documented `-K` requirement | -| 27 | `mail.mcintire.me` and `git.mcintire.me` bare `ansible_host` | Replaced with IP addresses | - ---- - -## Recommended Fix - -1. **Rotate all 4 plaintext secrets in `.envrc`** and move to `ansible-vault` -