mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 10:14:31 +00:00
7b391ab5ed
Problem: 'defaults write' is not an onboarding path, it's a support
incident waiting to happen. Browser SPNEGO must be deployed via managed
policy at machine provisioning time, not per-user.
Changes:
etc/init_knoe_users.sh
- _op_ensure_auth(): tries OP_SERVICE_ACCOUNT_TOKEN env, k8s secret
'op-service-account-token', existing interactive session, and op-run
inheritance — in that order. Gives actionable instructions when none
work, including the correct 'op run --' invocation documented in k3s.cfg.
- gitea_ensure_password(): calls _op_ensure_auth() at entry; eliminates
the silent 'op not authenticated' failure path.
- Script header: documents 'op run -- bash etc/init_knoe_users.sh' as
the intended invocation for admin's laptop.
- 'Next steps' output: replaces 'defaults write' with reference to
workstation_kerberos.yml Ansible playbook.
infrastructure/playbooks/workstation_kerberos.yml (new)
- Deploys /etc/krb5.conf (PROLE.ORG realm, myrddin KDC) to all managed
endpoints.
- Deploys Chrome + Edge managed policy (AuthServerAllowlist) on macOS
and Linux — no per-user browser configuration ever required.
- Idempotent; run during laptop provisioning or re-run at any time.
- Targets 'workstations' Ansible group.
infrastructure/inventory/hosts.ini
- Adds [workstations] group with example entries and onboarding notes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
70 lines
1.5 KiB
INI
70 lines
1.5 KiB
INI
[iscsi]
|
|
pi.prole.org
|
|
raspberry.prole.org
|
|
myrddin.prole.org
|
|
retropie.prole.org
|
|
merlin.prole.org
|
|
gandalf.prole.org
|
|
|
|
[pihole]
|
|
pi.prole.org
|
|
raspberry.prole.org
|
|
|
|
[ad_dc]
|
|
myrddin.prole.org
|
|
|
|
[k3s_servers]
|
|
myrddin.prole.org
|
|
|
|
[k3s_agents]
|
|
merlin.prole.org
|
|
gandalf.prole.org
|
|
|
|
[k3s_hosts:children]
|
|
k3s_servers
|
|
k3s_agents
|
|
|
|
[linux_hosts]
|
|
pi.prole.org
|
|
raspberry.prole.org
|
|
myrddin.prole.org
|
|
retropie.prole.org
|
|
merlin.prole.org
|
|
gandalf.prole.org
|
|
|
|
[ssl_hosts]
|
|
myrddin.prole.org
|
|
|
|
[mariadb_primary]
|
|
merlin.prole.org
|
|
|
|
[mariadb_replica]
|
|
raspberry.prole.org
|
|
|
|
[mariadb:children]
|
|
mariadb_primary
|
|
mariadb_replica
|
|
|
|
[tailscale]
|
|
merlin.prole.org
|
|
gandalf.prole.org
|
|
|
|
[merlin_bootstrap]
|
|
merlin ansible_host=10.0.0.36 ansible_user=ansible
|
|
|
|
# ── Engineer workstations ────────────────────────────────────────────────────
|
|
# Add each engineer's laptop here when they join.
|
|
# The workstation_kerberos.yml playbook targets this group to deploy:
|
|
# - /etc/krb5.conf pointing to myrddin.prole.org PROLE.ORG KDC
|
|
# - Chrome/Edge managed policy for automatic SPNEGO (no per-user browser config)
|
|
#
|
|
# Example entries:
|
|
# chrisfu-mbp.prole.org ansible_user=chrisfu ansible_connection=ssh
|
|
# ron-mbp.prole.org ansible_user=ron ansible_connection=ssh
|
|
#
|
|
# For macOS targets, ensure the ansible user has sudo rights (via sudoers or
|
|
# the local_user role run during initial provisioning).
|
|
[workstations]
|
|
# chrisfu-mbp.prole.org ansible_user=chrisfu
|
|
|