ansible-playbooks/.project-wiki/technical/security.md

id, type, status, title, created, updated, tags, related, source_paths, confidence

id	type	status	title	created	updated	tags	related	source_paths	confidence
TECH-SECURITY	technical	active	Security	2026-09-09	2026-10-11	technical security	ALERT-20260909-001 ALERT-20260909-002 NFR-002 MOD-003 MOD-007	vault.yml roles/monitoring/tasks/configure-psk.yml roles/bootstrap/defaults/main.yml ansible.cfg execute.sh	confirmed

Security

Secrets Handling

• vault.yml (tracked, encrypted) holds admin_password (SHA-512 hash), monitoring_zabbix_api_password, and Proxmox credentials (PROXMOX_USER_NAME, PROXMOX_USER_PASS); it is loaded via playbook-level vars_files in bootstrap.yml and playbooks/monitoring.yml.
• Git-ignored (verified): .vault_pass, setenv.sh (Proxmox credentials), .zabbix-psk/ (per-host PSKs), logs/.
• Resolved 2026-09-09: the admin_password SHA-512 hash that was committed in plaintext in roles/bootstrap/defaults/main.yml and inventory/group_vars/external.yml was moved to encrypted vault.yml (see ALERT-20260909-001).

SSH Posture

• Runtime key access: execute.sh bind-mounts the caller's $HOME/.ssh (or SSH_KEY_DIR) read-only at /root/.ssh. It does not rewrite the host SSH configuration or permissions. Private keys are not baked into the image.
• Controller/transport: host_key_checking = False, StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null (ansible.cfg, execute.sh, Dockerfile). Deliberate for first-time provisioning; README explicitly warns to restrict this in production.
• Host hardening: manage-ssh-keys role enforces allow/deny key lists; bootstrap deploys hardened sshd.conf.j2 and per-host authorized keys.
• Per-host exceptions: ssh_service_name: ssh on gitea/ipam.

Zabbix Agent TLS

• PSK-only encryption (TLS connect + accept), 256-bit PSKs generated with openssl rand -hex 32 on the controller, persisted with umask 077 in a 0700 directory, deployed 0600 to the agent host. Identity = host name.

Risky Defaults (documented trade-offs)

• hawser_allow_insecure_no_auth: true - Hawser standard mode without token on non-loopback addresses; comment in defaults demands other network protections.
• execute.sh disables host key checking inside the runtime container.
• Mirror rewrite runs with ignore_errors: true in os-updates.

Git Hygiene

• Resolved 2026-09-09: the previously uncommitted change set (including the dmc12 → cloudlorean inventory rename and stale documentation) was committed as one coherent change; see ALERT-20260909-002.