DerLinkman/ansible-playbooks
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
30f3e9a4c66fdc6e863734e543437470c5dd65f1
ansible-playbooks/.project-wiki/technical/security.md
T
DerLinkman 30f3e9a4c6 rename dmc12 inventory to cloudlorean and vault admin_password 
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions
2026-09-09 14:14:18 +02:00

2.3 KiB
Raw Blame History

id, type, status, title, created, updated, tags, related, source_paths, confidence
id type status title created updated tags related source_paths confidence
TECH-SECURITY technical active Security 2026-09-09 2026-09-09
technical
security
ALERT-20260909-001
ALERT-20260909-002
NFR-002
MOD-003
MOD-007
vault.yml
roles/monitoring/tasks/configure-psk.yml
roles/bootstrap/defaults/main.yml
ansible.cfg
confirmed

Security

Secrets Handling

  • vault.yml (tracked, encrypted) holds admin_password (SHA-512 hash), monitoring_zabbix_api_password, and Proxmox credentials (PROXMOX_USER_NAME, PROXMOX_USER_PASS); it is loaded via playbook-level vars_files in bootstrap.yml and playbooks/monitoring.yml.
  • Git-ignored (verified): .vault_pass, setenv.sh (Proxmox credentials), .zabbix-psk/ (per-host PSKs), logs/.
  • Resolved 2026-09-09: the admin_password SHA-512 hash that was committed in plaintext in roles/bootstrap/defaults/main.yml and inventory/group_vars/external.yml was moved to encrypted vault.yml (see ALERT-20260909-001).

SSH Posture

  • Controller/transport: host_key_checking = False, StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null (ansible.cfg, execute.sh, Dockerfile). Deliberate for first-time provisioning; README explicitly warns to restrict this in production.
  • Host hardening: manage-ssh-keys role enforces allow/deny key lists; bootstrap deploys hardened sshd.conf.j2 and per-host authorized keys.
  • Per-host exceptions: ssh_service_name: ssh on gitea/ipam.

Zabbix Agent TLS

  • PSK-only encryption (TLS connect + accept), 256-bit PSKs generated with openssl rand -hex 32 on the controller, persisted with umask 077 in a 0700 directory, deployed 0600 to the agent host. Identity = host name.

Risky Defaults (documented trade-offs)

  • hawser_allow_insecure_no_auth: true - Hawser standard mode without token on non-loopback addresses; comment in defaults demands other network protections.
  • execute.sh disables host key checking inside the runtime container.
  • Mirror rewrite runs with ignore_errors: true in os-updates.

Git Hygiene

  • Resolved 2026-09-09: the previously uncommitted change set (including the dmc12 → cloudlorean inventory rename and stale documentation) was committed as one coherent change; see ALERT-20260909-002.
Reference in New Issue View Git Blame Copy Permalink