From 8e23c090d97d4a336996c51b5ca827a17b27f984 Mon Sep 17 00:00:00 2001 From: Thomas von Dein Date: Mon, 18 Nov 2024 18:33:33 +0100 Subject: [PATCH] added: - set file permissions - setup sysctls - set root password from vault var - added doas + config --- Makefile | 15 +++++++---- README.md | 3 +-- TODO.md | 10 ++++++++ group_vars/all/all.yaml | 49 ++++++++++++++++++++++++++++++++++++ group_vars/all/vars.yaml | 20 ++++++++------- roles/server/files/doas.conf | 1 + roles/server/tasks/main.yaml | 30 ++++++++++++++++++++++ 7 files changed, 112 insertions(+), 16 deletions(-) create mode 100644 roles/server/files/doas.conf diff --git a/Makefile b/Makefile index 8351c4e..b5fa8ca 100644 --- a/Makefile +++ b/Makefile @@ -1,11 +1,11 @@ -.PHONY: all deploy check clean create debug +.PHONY: all deploy check clean create debug editvars -TOKEN = $(shell ansible-vault decrypt --vault-password-file \ - ~/.config/ansible/hcloud.secret --output - \ - group_vars/all/vars.yaml | cut -d' ' -f2) +VARS = group_vars/all/vars.yaml +VALL = group_vars/all/all.yaml +TOKEN = $(shell ansible-vault decrypt --output - $(VARS) | grep hetzner_cloud_token | cut -d' ' -f2) -SNAPNAME = $(shell cat group_vars/all/all.yaml | yq .snapshot) +SNAPNAME = $(shell cat $(VALL) | yq .snapshot) SNAPSHOT = $(shell hcloud image list -t snapshot -o yaml | \ yq '. | map(select(.description == "$(SNAPNAME)")) | .[].id') @@ -41,3 +41,8 @@ clean: check: ansible-playbook -vvv --ask-vault-pass deploy.yaml -i inventory --syntax-check + +editvars: + ansible-vault decrypt $(VARS) + vi $(VARS) + ansible-vault encrypt $(VARS) diff --git a/README.md b/README.md index 06f1bb8..c6ac781 100644 --- a/README.md +++ b/README.md @@ -35,8 +35,7 @@ dynamic inventory to discover your vps. `pwgen -ys 32 1 > ~/.config/ansible/hcloud.secret` - Encrypt the vars file: - `ansible-vault encrypt --vault-password-file - ~/.config/ansible/hcloud.secret group_vars/all/vars.yaml` + `ansible-vault encrypt group_vars/all/vars.yaml` Now the hetzner ansible plugin is able to call hcloud with the appropriate token, no need to enter it manually anymore. Also, while diff --git a/TODO.md b/TODO.md index e6141e2..893a753 100644 --- a/TODO.md +++ b/TODO.md @@ -22,3 +22,13 @@ https://github.com/bodsch/ansible-collection-dns/blob/main/roles/knot/README.md or using e3 using wrapper script around `jaildk exec dns knotc ...` + +### Cleanup release snapshot + +- remove /home symlink +- remove pkg function from root .bashrc + + +## Add users with authorized_keys files + +## Add quota config and enable/configure rctl diff --git a/group_vars/all/all.yaml b/group_vars/all/all.yaml index 853f5ce..ee975a2 100644 --- a/group_vars/all/all.yaml +++ b/group_vars/all/all.yaml @@ -7,6 +7,7 @@ image: "{{ lookup('ansible.builtin.env', 'SNAPSHOT') }}" packages: - cpdup - bash + - doas # used by bastille to build a base release: 14.1-RELEASE @@ -36,3 +37,51 @@ storage: name: /home - mount: /var/cron/tabs name: /crontabs + + +kernel: + sysctls: + security.bsd.see_other_uids: 0 + security.bsd.see_other_gids: 0 + security.bsd.see_jail_proc: 0 + security.bsd.unprivileged_read_msgbuf: 0 + security.bsd.unprivileged_proc_debug: 0 + kern.randompid: 1 + net.inet.ip.random_id: 1 + hw.spec_store_bypass_disable: 1 + kern.elf64.allow_wx: 0 + kern.elf32.aslr.stack: 3 + kern.elf32.aslr.pie_enable: 1 + vfs.zfs.min_auto_ashift: 12 + kern.securelevel: 2 + + +permissions: + - name: /home + owner: root + group: wheel + mode: '0711' + - name: /etc + owner: root + group: wheel + mode: '0711' + - name: /usr/local/etc + owner: root + group: wheel + mode: '0711' + - name: /root + owner: root + group: wheel + mode: '0700' + - name: /var/log + owner: root + group: wheel + mode: '0711' + - name: /var/cron/tabs + owner: root + group: wheel + mode: '0700' + - name: /var/log + owner: root + group: wheel + mode: '0711' diff --git a/group_vars/all/vars.yaml b/group_vars/all/vars.yaml index 6331d18..1f57ba4 100644 --- a/group_vars/all/vars.yaml +++ b/group_vars/all/vars.yaml @@ -1,10 +1,12 @@ $ANSIBLE_VAULT;1.1;AES256 -34666232626536653339373961383331363035343266633232643930663733386466663933356138 -6366653166656465373634306461643236333162383138380a626430626631626133373330646361 -31303163343637626130393237666333643965646431306134643039363233386235623463633862 -3334363233313532310a323965363364646362343937653534623930376461356633656135646533 -37343162333634373963366433393231626136353832613937343363623565303561663461333431 -30353831376134336663643534383535656638663931626665336638353432626330356561643439 -61303638336365636233353937626461643263383435353561303831363531653935386435316562 -35363833383732656261643765323432363430636564626166653263643632373731323637663165 -6437 +66323661356665373037316136353833646231623531323031306336613065326431643138336430 +3438323839633335333963306638323137333664366466310a623862636139366336393835353238 +38613934383631633134386564616233326234333637636162626632633762656366303036313539 +3365646662386263650a333636366132363662376362383737383233646531616632376234303062 +32366464613630396463326236643361386637616664663066326337663037663639613433316462 +33636665653930346265323237363238626463666163616439393332313639343863343764323639 +34353834393236643530346238323164656339653365393563383938316461393730333536343365 +63303865626534653237383634633937613039663761313038303461303837643066306161383661 +65326237366536306632633539656335373536336231303330386332646363333131393664656365 +36366539616230623338396434376565346435636331353963366438376437343233373735393730 +346162343166373762626664363866663536 diff --git a/roles/server/files/doas.conf b/roles/server/files/doas.conf new file mode 100644 index 0000000..83418b4 --- /dev/null +++ b/roles/server/files/doas.conf @@ -0,0 +1 @@ +permit persist :wheel as root diff --git a/roles/server/tasks/main.yaml b/roles/server/tasks/main.yaml index 04db006..e724182 100644 --- a/roles/server/tasks/main.yaml +++ b/roles/server/tasks/main.yaml @@ -44,3 +44,33 @@ args: creates: "{{ item.mount }}" +- name: Change permissions + loop: "{{ permissions }}" + ansible.builtin.file: + path: "{{ item.name }}" + owner: "{{ item.owner }}" + group: "{{ item.group }}" + mode: "{{ item.mode }}" + +- name: Change root password + user: + name: root + password: "{{ root_password | password_hash('sha512') }}" + +- name: Setup sysctls + loop: "{{ kernel.sysctls | dict2items }}" + ansible.posix.sysctl: + name: "{{ item.key }}" + value: "{{ item.value }}" + sysctl_set: true + state: present + reload: true + +- name: Install doas config + ansible.builtin.copy: + src: roles/server/files/doas.conf + dest: /usr/local/etc/doas.conf + owner: root + group: wheel + mode: '0600' +