Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
88 lines
No EOL
2.6 KiB
YAML
88 lines
No EOL
2.6 KiB
YAML
---
|
|
# System configuration tasks
|
|
|
|
# SSH host key regeneration for cloned VMs
|
|
# Only runs once per host (marker file prevents re-running)
|
|
- name: Check if SSH host keys have been regenerated
|
|
ansible.builtin.stat:
|
|
path: /etc/ssh/.host_keys_regenerated
|
|
register: ssh_keys_marker
|
|
|
|
- name: Regenerate SSH host keys (first boot after clone)
|
|
when: not ssh_keys_marker.stat.exists
|
|
block:
|
|
- name: Remove existing SSH host keys
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- /etc/ssh/ssh_host_rsa_key
|
|
- /etc/ssh/ssh_host_rsa_key.pub
|
|
- /etc/ssh/ssh_host_ecdsa_key
|
|
- /etc/ssh/ssh_host_ecdsa_key.pub
|
|
- /etc/ssh/ssh_host_ed25519_key
|
|
- /etc/ssh/ssh_host_ed25519_key.pub
|
|
- /etc/ssh/ssh_host_dsa_key
|
|
- /etc/ssh/ssh_host_dsa_key.pub
|
|
|
|
- name: Regenerate SSH host keys
|
|
ansible.builtin.command:
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
notify: restart ssh
|
|
|
|
- name: Regenerate SSH host keys (RHEL)
|
|
ansible.builtin.shell:
|
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
|
|
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
|
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
notify: restart ssh
|
|
|
|
- name: Regenerate SSH host keys (Alpine)
|
|
ansible.builtin.shell:
|
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
|
|
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
|
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_facts['os_family'] == "Alpine"
|
|
notify: restart ssh
|
|
|
|
- name: Create marker file to prevent re-running
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/.host_keys_regenerated
|
|
state: touch
|
|
mode: '0644'
|
|
|
|
- name: Install SSH banner
|
|
ansible.builtin.template:
|
|
src: issue.net.j2
|
|
dest: /etc/issue.net
|
|
mode: '0644'
|
|
tags:
|
|
- ssh
|
|
|
|
- name: Configure SSH to use banner
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^Banner'
|
|
line: 'Banner /etc/issue.net'
|
|
state: present
|
|
notify: restart ssh
|
|
tags:
|
|
- ssh
|
|
|
|
# Uncomment if you want to disable root SSH access
|
|
# - name: Disallow root SSH access
|
|
# lineinfile:
|
|
# path: /etc/ssh/sshd_config
|
|
# regexp: "^PermitRootLogin"
|
|
# line: "PermitRootLogin no"
|
|
# state: present
|
|
# notify: restart ssh
|
|
# tags:
|
|
# - ssh |