Graham McIntire
fb5803c866
- bootstrap.yml: support pkg for FreeBSD sudo/python3 install - base role: FreeBSD package sets, sudoers paths, host key regen, admin group, usermod process-in-use tolerance - freebsd role: pkg update/upgrade tasks - general role: standalone hostname tasks (ungated from network.skip), hostname_override support - inspircd role: deploy configs for ca/us manero.org irc servers with vault-backed secrets - uisp role: download and run installer on fresh hosts, skip if already running - netbox role: stop services before usermod to avoid process-in-use failures - hosts: add irc_servers group, ca/us.manero.org (Tailscale), drop staging.towerops.net - all.yml: graham user gets static ed25519 key alongside github keys
98 lines
No EOL
3 KiB
YAML
98 lines
No EOL
3 KiB
YAML
---
|
|
# System configuration tasks
|
|
|
|
# SSH host key regeneration for cloned VMs
|
|
# Only runs once per host (marker file prevents re-running)
|
|
- name: Check if SSH host keys have been regenerated
|
|
ansible.builtin.stat:
|
|
path: /etc/ssh/.host_keys_regenerated
|
|
register: ssh_keys_marker
|
|
|
|
- name: Regenerate SSH host keys (first boot after clone)
|
|
when: not ssh_keys_marker.stat.exists
|
|
block:
|
|
- name: Remove existing SSH host keys
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- /etc/ssh/ssh_host_rsa_key
|
|
- /etc/ssh/ssh_host_rsa_key.pub
|
|
- /etc/ssh/ssh_host_ecdsa_key
|
|
- /etc/ssh/ssh_host_ecdsa_key.pub
|
|
- /etc/ssh/ssh_host_ed25519_key
|
|
- /etc/ssh/ssh_host_ed25519_key.pub
|
|
- /etc/ssh/ssh_host_dsa_key
|
|
- /etc/ssh/ssh_host_dsa_key.pub
|
|
|
|
- name: Regenerate SSH host keys
|
|
ansible.builtin.command:
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
notify: restart ssh
|
|
|
|
- name: Regenerate SSH host keys (RHEL)
|
|
ansible.builtin.shell:
|
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
|
|
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
|
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
notify: restart ssh
|
|
|
|
- name: Regenerate SSH host keys (Alpine)
|
|
ansible.builtin.shell:
|
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
|
|
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
|
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_facts['os_family'] == "Alpine"
|
|
notify: restart ssh
|
|
|
|
- name: Regenerate SSH host keys (FreeBSD)
|
|
ansible.builtin.shell:
|
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
|
|
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
|
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_facts['os_family'] == "FreeBSD"
|
|
notify: restart ssh
|
|
|
|
- name: Create marker file to prevent re-running
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/.host_keys_regenerated
|
|
state: touch
|
|
mode: '0644'
|
|
|
|
- name: Install SSH banner
|
|
ansible.builtin.template:
|
|
src: issue.net.j2
|
|
dest: /etc/issue.net
|
|
mode: '0644'
|
|
tags:
|
|
- ssh
|
|
|
|
- name: Configure SSH to use banner
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^Banner'
|
|
line: 'Banner /etc/issue.net'
|
|
state: present
|
|
notify: restart ssh
|
|
tags:
|
|
- ssh
|
|
|
|
# Uncomment if you want to disable root SSH access
|
|
# - name: Disallow root SSH access
|
|
# lineinfile:
|
|
# path: /etc/ssh/sshd_config
|
|
# regexp: "^PermitRootLogin"
|
|
# line: "PermitRootLogin no"
|
|
# state: present
|
|
# notify: restart ssh
|
|
# tags:
|
|
# - ssh |