mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
ca8dd6a525
Secure and configure the SG2428LP managed switch (10.0.0.10) as repeatable Ansible, driven from the control node over SSH by an expect engine. - tplink_switch_harden role (verified JetStream CLI syntax): HTTP off/ HTTPS-only, Telnet off, SSH v2, SNMP off, RSTP + loopback-detection, then copy running-config startup-config (persist). - playbooks/harden_switch.yml + [switches] inventory group; dry by default, -e switch_apply=true to apply, -e switch_apply_network=true for addressing. - Static mgmt IP 10.0.0.10/24 (off DHCP, below the .20-.199 pool), gw 10.0.0.1, hostname sg2428lp. - op -> ansible-vault bridge (etc/set-switch-1password.sh); admin password in group_vars/switches/vault.yml. - DNS: A/PTR sg2428lp.prole.org -> 10.0.0.10 (records added to dns.yml/ptr_records). - Fix: tag the samba_reverse_dns zone-list set_fact so tag-limited runs define samba_reverse_zones. Engine notes (hard-won): forces password-only SSH auth (the switch drops publickey-first logins); always saves config (unsaved changes revert on reboot). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
36 lines
1.5 KiB
YAML
36 lines
1.5 KiB
YAML
---
|
||
# Managed-switch group — non-secret facts + connection model.
|
||
#
|
||
# The switch is NOT a Linux host: we don't sudo, and we don't use the global
|
||
# ansible_user/key. The hardening role connects FROM the control node TO the
|
||
# switch over SSH via an expect engine (delegated, connection: local).
|
||
#
|
||
# Secret (vault_sg2428lp_admin_password) lives in this group's vault.yml,
|
||
# populated from 1Password by etc/set-switch-1password.sh.
|
||
|
||
ansible_connection: local
|
||
ansible_become: false
|
||
|
||
# Management endpoint + credentials (password resolved from vault).
|
||
switch_mgmt_ip: "{{ ansible_host }}"
|
||
switch_admin_user: "admin"
|
||
switch_admin_password: "{{ vault_sg2428lp_admin_password }}"
|
||
|
||
# 1Password source-of-truth reference (used by the op -> vault bridge script).
|
||
switch_op_account: "VM7LPYA4XFF4TE2DEI7ZHMZWEA"
|
||
switch_op_reference: "op://knoey/TP-Link SG2428LP/password"
|
||
|
||
# ── Desired identity + management addressing ─────────────────────────────────
|
||
# Static management IP, OFF DHCP. 10.0.0.10 sits below the DHCP pool
|
||
# (10.0.0.20–10.0.0.199), so it never collides with a lease.
|
||
switch_hostname: "sg2428lp"
|
||
switch_fqdn: "{{ switch_hostname }}.{{ prole_domain }}" # sg2428lp.prole.org
|
||
switch_mgmt_ip_static: "10.0.0.10"
|
||
switch_mgmt_netmask: "255.255.255.0"
|
||
switch_mgmt_gateway: "10.0.0.1"
|
||
switch_mgmt_vlan: 1
|
||
|
||
# One-time migration source: the DHCP address the switch currently answers on.
|
||
# After cutover, set this host's ansible_host to switch_mgmt_ip_static (.10).
|
||
switch_dhcp_ip: "10.0.0.153"
|