diff options
| author | Christian Pointner <equinox@spreadspace.org> | 2024-01-24 15:09:06 +0100 |
|---|---|---|
| committer | Christian Pointner <equinox@spreadspace.org> | 2024-01-24 15:09:06 +0100 |
| commit | fa8ab1026ee131ab8d68808bd7ebab3c5657f5bb (patch) | |
| tree | 3ec18c95b8d946fdfd36a48a30e0c6050898f000 | |
| parent | whawty/auth/store role mostly done (diff) | |
whawty/auth/store: fix permission handling and add know-hosts file
| -rw-r--r-- | inventory/host_vars/ch-testvm-prometheus.yml | 26 | ||||
| -rw-r--r-- | roles/whawty/auth/store/tasks/sync-client.yml | 5 | ||||
| -rw-r--r-- | roles/whawty/auth/store/templates/systemd.service.j2 | 2 |
3 files changed, 31 insertions, 2 deletions
diff --git a/inventory/host_vars/ch-testvm-prometheus.yml b/inventory/host_vars/ch-testvm-prometheus.yml index 415e6774..91a55830 100644 --- a/inventory/host_vars/ch-testvm-prometheus.yml +++ b/inventory/host_vars/ch-testvm-prometheus.yml @@ -35,3 +35,29 @@ network: - *_network_primary_ ntp_variant: systemd-timesyncd + + + +### +whawty_auth_store: + name: foo + config: + basedir: "/var/lib/whawty/auth/foo" + default: 1 + params: + - id: 1 + argon2id: + time: 1 + memory: 65536 ## 64 MB + threads: 4 + length: 32 + permissions: + owner: root + group: foo + file-mode: "0640" + dir-mode: "0750" + sync: + type: client + hostname: 192.168.32.1 + port: 3022 + user: sync diff --git a/roles/whawty/auth/store/tasks/sync-client.yml b/roles/whawty/auth/store/tasks/sync-client.yml index 106e347b..92657312 100644 --- a/roles/whawty/auth/store/tasks/sync-client.yml +++ b/roles/whawty/auth/store/tasks/sync-client.yml @@ -24,7 +24,10 @@ type: ed25519 comment: "whawty-auth-sync-{{ whawty_auth_store.name }}@{{ inventory_hostname }}" -## TODO: known-hosts file... +- name: generate known_hosts file + shell: "ssh-keyscan{% if 'port' in whawty_auth_store.sync %} -p {{ whawty_auth_store.sync.port }}{% endif %} {{ whawty_auth_store.sync.hostname }} > /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts" + args: + creates: "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts" - name: install systemd units for whawty-auth store sync client loop: diff --git a/roles/whawty/auth/store/templates/systemd.service.j2 b/roles/whawty/auth/store/templates/systemd.service.j2 index 1081df60..5b1db6b2 100644 --- a/roles/whawty/auth/store/templates/systemd.service.j2 +++ b/roles/whawty/auth/store/templates/systemd.service.j2 @@ -12,7 +12,7 @@ Description=sync for whawty-auth store {{ whawty_auth_store.name }} [Service] Type=oneshot -ExecStart=/usr/bin/rsync -rtpW --delete --delete-delay --delay-updates --partial-dir=.tmp{{ rsync_args | join('') }} -e 'ssh -F "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/ssh_config"' 'rsync://whawty-auth-server/store' '{{ whawty_auth_store.config.basedir }}' +ExecStart=/usr/bin/rsync -rtW --delete --delete-delay --delay-updates --partial-dir=.tmp{{ rsync_args | join('') }} -e 'ssh -F "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/ssh_config"' 'rsync://whawty-auth-server/store' '{{ whawty_auth_store.config.basedir }}' TimeoutStartSec=40s # systemd hardening-options |