DerLinkman
30f3e9a4c6
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
70 lines
2.3 KiB
Markdown
70 lines
2.3 KiB
Markdown
---
|
|
id: TECH-SECURITY
|
|
type: technical
|
|
status: active
|
|
title: Security
|
|
created: '2026-09-09'
|
|
updated: '2026-09-09'
|
|
tags:
|
|
- technical
|
|
- security
|
|
related:
|
|
- ALERT-20260909-001
|
|
- ALERT-20260909-002
|
|
- NFR-002
|
|
- MOD-003
|
|
- MOD-007
|
|
source_paths:
|
|
- vault.yml
|
|
- roles/monitoring/tasks/configure-psk.yml
|
|
- roles/bootstrap/defaults/main.yml
|
|
- ansible.cfg
|
|
confidence: confirmed
|
|
---
|
|
|
|
# Security
|
|
|
|
## Secrets Handling
|
|
|
|
- `vault.yml` (tracked, encrypted) holds `admin_password` (SHA-512 hash),
|
|
`monitoring_zabbix_api_password`, and Proxmox credentials
|
|
(`PROXMOX_USER_NAME`, `PROXMOX_USER_PASS`); it is loaded via playbook-level
|
|
`vars_files` in `bootstrap.yml` and `playbooks/monitoring.yml`.
|
|
- Git-ignored (verified): `.vault_pass`, `setenv.sh` (Proxmox credentials),
|
|
`.zabbix-psk/` (per-host PSKs), `logs/`.
|
|
- Resolved 2026-09-09: the `admin_password` SHA-512 hash that was committed
|
|
in plaintext in `roles/bootstrap/defaults/main.yml` and
|
|
`inventory/group_vars/external.yml` was moved to encrypted `vault.yml`
|
|
(see [ALERT-20260909-001](../alerts/ALERT-20260909-001.md)).
|
|
|
|
## SSH Posture
|
|
|
|
- Controller/transport: `host_key_checking = False`,
|
|
`StrictHostKeyChecking=no`, `UserKnownHostsFile=/dev/null` (ansible.cfg,
|
|
execute.sh, Dockerfile). Deliberate for first-time provisioning; README
|
|
explicitly warns to restrict this in production.
|
|
- Host hardening: `manage-ssh-keys` role enforces allow/deny key lists;
|
|
bootstrap deploys hardened `sshd.conf.j2` and per-host authorized keys.
|
|
- Per-host exceptions: `ssh_service_name: ssh` on `gitea`/`ipam`.
|
|
|
|
## Zabbix Agent TLS
|
|
|
|
- PSK-only encryption (TLS connect + accept), 256-bit PSKs generated with
|
|
`openssl rand -hex 32` on the controller, persisted with umask 077 in a
|
|
0700 directory, deployed 0600 to the agent host. Identity = host name.
|
|
|
|
## Risky Defaults (documented trade-offs)
|
|
|
|
- `hawser_allow_insecure_no_auth: true` - Hawser standard mode without token
|
|
on non-loopback addresses; comment in defaults demands other network
|
|
protections.
|
|
- `execute.sh` disables host key checking inside the runtime container.
|
|
- Mirror rewrite runs with `ignore_errors: true` in os-updates.
|
|
|
|
## Git Hygiene
|
|
|
|
- Resolved 2026-09-09: the previously uncommitted change set (including the
|
|
`dmc12` → `cloudlorean` inventory rename and stale documentation) was
|
|
committed as one coherent change; see
|
|
[ALERT-20260909-002](../alerts/ALERT-20260909-002.md).
|