Files

T

DerLinkman 30f3e9a4c6 rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

2026-09-09 14:14:18 +02:00

1.6 KiB

Raw Blame History

id, type, status, title, created, updated, tags, related, source_paths, confidence

type

status

title

created

updated

Manage SSH Keys Role

Responsibility

Harden SSH access by enforcing an allow list (good_keys) and removing deny-listed keys (bad_keys) from the target user's authorized keys.

Source Paths

roles/manage-ssh-keys/tasks/main.yml → validate-authorized-keys.yml, add-goodkeys.yml, remove-badkeys.yml
Handlers: roles/manage-ssh-keys/handlers/main.yml

Public Interfaces

Playbook: playbooks/hardening/manage-ssh-keys.yml (binds the role directly; no Debian guard, no become)
Key variables: ssh_user (admin), good_keys (allow list), bad_keys (deny list; supports env-provided JSON overrides via commented vars in the playbook).
Conditional execution: good_keys.defined and good_keys | length > 0 (same for bad_keys).

Important Flows

Validate/ensure ~/.ssh of the logged-in user (0700).
Add good_keys to authorized keys.
Remove bad_keys from authorized keys.

Dependencies

None (ansible.builtin).

Tests

None automated.

Notes For Agents

The playbook deviates from the documented convention (Debian guard, become: true); treat as an intentional gap to confirm before adding more hardening playbooks.
Keys in defaults/main.yml are public keys (not secrets); the same allow list also exists in roles/bootstrap/defaults/main.yml.

1.6 KiB Raw Blame History