aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--roles/debian/tasks/sshd.yml8
-rw-r--r--roles/fedora/tasks/main.yml2
-rw-r--r--roles/fedora/tasks/sshd.yml (renamed from roles/space_server/tasks/sshd.yml)17
-rwxr-xr-xroles/space_server/bootstrap.sh5
-rw-r--r--roles/space_server/tasks/main.yml2
-rw-r--r--space.yml5
6 files changed, 14 insertions, 25 deletions
diff --git a/roles/debian/tasks/sshd.yml b/roles/debian/tasks/sshd.yml
index 4c257fe..c342604 100644
--- a/roles/debian/tasks/sshd.yml
+++ b/roles/debian/tasks/sshd.yml
@@ -6,10 +6,10 @@
owner: root
group: ssh_keys
mode: 0640
- with_dict: '{{ ssh_host_keys }}'
+ with_dict: '{{ ssh_host_keys[hostname] }}'
loop_control:
label: '/etc/ssh/{{ item.key }}'
- when: ssh_host_keys is defined
+ when: ssh_host_keys is defined and hostname in ssh_host_keys
- name: Create public host keys
copy:
@@ -18,10 +18,10 @@
owner: root
group: root
mode: 0644
- with_dict: '{{ ssh_host_keys }}'
+ with_dict: '{{ ssh_host_keys[hostname] }}'
loop_control:
label: '/etc/ssh/{{ item.key }}.pub'
- when: ssh_host_keys is defined
+ when: ssh_host_keys is defined and hostname in ssh_host_keys
- name: Configure SSH daemon
lineinfile:
diff --git a/roles/fedora/tasks/main.yml b/roles/fedora/tasks/main.yml
index 4492df5..de4c160 100644
--- a/roles/fedora/tasks/main.yml
+++ b/roles/fedora/tasks/main.yml
@@ -20,5 +20,7 @@
tags: networkd
- import_tasks: timesyncd.yml
tags: timesyncd
+- import_tasks: sshd.yml
+ tags: sshd
# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/tasks/sshd.yml b/roles/fedora/tasks/sshd.yml
index 14597b4..603fbf9 100644
--- a/roles/space_server/tasks/sshd.yml
+++ b/roles/fedora/tasks/sshd.yml
@@ -6,10 +6,10 @@
owner: root
group: ssh_keys
mode: 0640
- with_dict: '{{ ssh_host_keys }}'
+ with_dict: '{{ ssh_host_keys[hostname] }}'
loop_control:
label: '/etc/ssh/{{ item.key }}'
- when: ssh_host_keys is defined
+ when: ssh_host_keys is defined and hostname in ssh_host_keys
- name: Create public host keys
copy:
@@ -18,12 +18,12 @@
owner: root
group: root
mode: 0644
- with_dict: '{{ ssh_host_keys }}'
+ with_dict: '{{ ssh_host_keys[hostname] }}'
loop_control:
label: '/etc/ssh/{{ item.key }}.pub'
- when: ssh_host_keys is defined
+ when: ssh_host_keys is defined and hostname in ssh_host_keys
-- name: Configure sshd
+- name: Configure SSH daemon
lineinfile:
path: '/etc/ssh/sshd_config'
regexp: '{{ item.regexp }}'
@@ -35,10 +35,9 @@
line: 'PasswordAuthentication no'
- regexp: '^[# ]*GSSAPIAuthentication'
line: 'GSSAPIAuthentication no'
- notify:
- - restart sshd
+ notify: restart sshd
-- name: Enable sshd service
+- name: Enable SSH daemon
systemd:
name: sshd.service
enabled: yes
@@ -47,8 +46,6 @@
when: not chroot
- name: '- when in chroot'
command: systemctl enable sshd.service
- args:
- creates: '/etc/systemd/system/multi-user.target.wants/sshd.service'
when: chroot|bool
# vim: set ts=2 sw=2 et:
diff --git a/roles/space_server/bootstrap.sh b/roles/space_server/bootstrap.sh
index 6d09592..218815e 100755
--- a/roles/space_server/bootstrap.sh
+++ b/roles/space_server/bootstrap.sh
@@ -41,7 +41,6 @@ set -e
set -x
release=29
-secrets='/etc/ansible/secrets.yml'
dest="/mnt/fedora$release"
if [[ -e "$dest" ]]; then
echo "Destination '$dest' already exists. Aborting." >&2
@@ -61,10 +60,6 @@ dnf \
--enablerepo=updates \
install glibc-langpack-en dnf git ansible python-unversioned-command
-if [[ -f "$secrets" ]]; then
- install -m660 "$secrets" "$dest$secrets"
-fi
-
for i in /var/lib/machines /var/lib/portables; do
if [[ -d "$dest$i" ]]; then
btrfs subvolume delete "$dest$i"
diff --git a/roles/space_server/tasks/main.yml b/roles/space_server/tasks/main.yml
index 374a8b6..1c5ae7c 100644
--- a/roles/space_server/tasks/main.yml
+++ b/roles/space_server/tasks/main.yml
@@ -19,8 +19,6 @@
tags: networkd
- import_tasks: nftables.yml
tags: nftables
-- import_tasks: sshd.yml
- tags: sshd
- import_tasks: bird.yml
tags: bird
- import_tasks: dhcpd.yml
diff --git a/space.yml b/space.yml
index 1243bad..cb935c9 100644
--- a/space.yml
+++ b/space.yml
@@ -6,10 +6,7 @@
chroot: "{{ ansible_connection == 'chroot' or 'container' in ansible_env }}"
tags: always
- name: Load secrets
- include_vars: '{{ item }}'
- with_first_found:
- - /etc/ansible/secrets.yml
- - secrets.yml
+ include_vars: 'secrets.yml'
ignore_errors: yes
tags: always
roles: