mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-12-02 15:39:57 +00:00

Files

Kevin Veen-Birkenbach e09f561f0b Refactor run-once orchestration and bootstrap Mailu/Mastodon in a single deploy

- Replace legacy utils/run_once.yml with the new helpers utils/once_flag.yml and utils/once_finalize.yml
- Introduce utils/compose_up.yml to ensure docker-compose stacks are up and to flush handlers safely without coupling to run-once flags
- Migrate all affected roles (desk-*, dev-*, sys-ctl-*, sys-svc-*, web-app-*, web-svc-*, util-*) to the new run-once helpers
- Rework sys-svc-msmtp to auto-load Mailu once per deploy, check reachability, and reuse the running stack instead of requiring multiple playbook passes
- Adjust web-app-mailu to integrate cert deployment, handler flushing, and run-once handling so Mailu is fully initialized in a single deploy
- Improve Matomo, CDN, logout and CSP/health-check related roles to cooperate with the new compose_up / once_* pattern
- Simplify alarm/backup/timer/service orchestration (sys-ctl-alm-*, sys-bkp-provider, sys-timer-cln-bkps, etc.) by moving run-once logic into dedicated 01_core.yml files
- Update integration tests so utils/once_flag.yml and utils/once_finalize.yml are recognised as valid run-once providers, keeping the global run_once_* guarantees consistent
- Align frontend injection and service dependencies so Mastodon- and Mailu-related services can be brought up coherently within a single deployment cycle rather than several iterations

2025-12-01 13:30:50 +01:00

handlers

…

README.md

sshd

Description

This Ansible role configures the OpenSSH daemon (sshd) by deploying a templated sshd_config file. It applies secure, best-practice settings—such as disabling root login, enforcing public-key authentication, and setting appropriate logging levels—to harden remote access and reduce the risk of misconfiguration or lockout.

Overview

Renders sshd_config.j2 into /etc/ssh/sshd_config with customizable options
Sets file ownership (root:root) and permissions (0644)
Automatically reloads and restarts the SSH service via a Systemd handler
Uses a run_once_sys_svc_sshd fact to ensure idempotent execution

Features

Templated Configuration
Delivers a Jinja2-based sshd_config with variables for debug logging and PAM support.
Security Defaults
- Disables password (PasswordAuthentication no) and root login (PermitRootLogin no)
- Enforces public-key authentication (PubkeyAuthentication yes)
- Conditionally sets LogLevel to DEBUG3 when MODE_DEBUG is true
Systemd Integration
Handles daemon reload and service restart seamlessly on configuration changes.
Idempotency
Ensures tasks run only once per play by setting the run_once_sys_svc_sshd fact.

README.md

sshd

Description

Overview

Features

Further Resources