mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
ca8dd6a525
Secure and configure the SG2428LP managed switch (10.0.0.10) as repeatable Ansible, driven from the control node over SSH by an expect engine. - tplink_switch_harden role (verified JetStream CLI syntax): HTTP off/ HTTPS-only, Telnet off, SSH v2, SNMP off, RSTP + loopback-detection, then copy running-config startup-config (persist). - playbooks/harden_switch.yml + [switches] inventory group; dry by default, -e switch_apply=true to apply, -e switch_apply_network=true for addressing. - Static mgmt IP 10.0.0.10/24 (off DHCP, below the .20-.199 pool), gw 10.0.0.1, hostname sg2428lp. - op -> ansible-vault bridge (etc/set-switch-1password.sh); admin password in group_vars/switches/vault.yml. - DNS: A/PTR sg2428lp.prole.org -> 10.0.0.10 (records added to dns.yml/ptr_records). - Fix: tag the samba_reverse_dns zone-list set_fact so tag-limited runs define samba_reverse_zones. Engine notes (hard-won): forces password-only SSH auth (the switch drops publickey-first logins); always saves config (unsaved changes revert on reboot). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
12 lines
683 B
YAML
12 lines
683 B
YAML
---
|
|
# Managed-switch admin password — DO NOT EDIT BY HAND.
|
|
# Source of truth: op://knoey/TP-Link SG2428LP/password
|
|
# Regenerate with: etc/set-switch-1password.sh
|
|
vault_sg2428lp_admin_password: !vault |
|
|
$ANSIBLE_VAULT;1.1;AES256
|
|
61356331346534643937343732303265376438343536653933393630323963613636313261313662
|
|
3134636433393836363032346161303462653631373963350a336363333436323735326230353133
|
|
38343464393263393536356435333464393436313635363062633639323362386432653436343063
|
|
3931656237356665640a626134363939643763386661313666303238653632373738626163386565
|
|
30383162633432376366326436663064666463353139623465393966323561353038
|