mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
ca8dd6a525
Secure and configure the SG2428LP managed switch (10.0.0.10) as repeatable Ansible, driven from the control node over SSH by an expect engine. - tplink_switch_harden role (verified JetStream CLI syntax): HTTP off/ HTTPS-only, Telnet off, SSH v2, SNMP off, RSTP + loopback-detection, then copy running-config startup-config (persist). - playbooks/harden_switch.yml + [switches] inventory group; dry by default, -e switch_apply=true to apply, -e switch_apply_network=true for addressing. - Static mgmt IP 10.0.0.10/24 (off DHCP, below the .20-.199 pool), gw 10.0.0.1, hostname sg2428lp. - op -> ansible-vault bridge (etc/set-switch-1password.sh); admin password in group_vars/switches/vault.yml. - DNS: A/PTR sg2428lp.prole.org -> 10.0.0.10 (records added to dns.yml/ptr_records). - Fix: tag the samba_reverse_dns zone-list set_fact so tag-limited runs define samba_reverse_zones. Engine notes (hard-won): forces password-only SSH auth (the switch drops publickey-first logins); always saves config (unsaved changes revert on reboot). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
42 lines
1.0 KiB
YAML
42 lines
1.0 KiB
YAML
---
|
|
ansible_user: ansible
|
|
ansible_ssh_private_key_file: "~/.ssh/id_ed25519_ansible"
|
|
|
|
ansible_become: true
|
|
ansible_become_method: sudo
|
|
|
|
# DNS topology vars shared across roles
|
|
prole_domain: "prole.org"
|
|
ad_dc_ip: "10.0.0.3"
|
|
lan_reverse_zone: "0.0.10.in-addr.arpa"
|
|
|
|
# k3s default Pod/Service CIDR reverse zones
|
|
k3s_reverse_zones:
|
|
- "42.10.in-addr.arpa"
|
|
- "43.10.in-addr.arpa"
|
|
|
|
# Seed PTRs (adjust octets to match your actual IPs)
|
|
ptr_records:
|
|
- last_octet: "3"
|
|
fqdn: "myrddin.prole.org"
|
|
- last_octet: "4"
|
|
fqdn: "raspberry.prole.org"
|
|
- last_octet: "5"
|
|
fqdn: "pi.prole.org"
|
|
- last_octet: "10"
|
|
fqdn: "sg2428lp.prole.org"
|
|
- last_octet: "207"
|
|
fqdn: "retropie.prole.org"
|
|
|
|
rsyslog_server: myrddin.prole.org
|
|
|
|
# name.com API credentials for acme.sh DNS-01 (values from vault)
|
|
acme_namecom_username: "{{ vault_namecom_username }}"
|
|
acme_namecom_token: "{{ vault_namecom_token }}"
|
|
|
|
# Prole management
|
|
prole_home: "/opt/prole"
|
|
prole_repo_url: "https://github.com/prole-org/prole.git"
|
|
prole_version: "main"
|
|
prole_logs_dir: "/opt/prole/logs/chrisfu"
|