mg/homeserver
1
0
Fork 0
Code Issues 1 Pull requests 3 Activity Actions

rotate ansibe-user ssh key (#544)

Browse source 
Co-authored-by: Michael Grote <michael.grote@posteo.de>
Reviewed-on: #544
This commit is contained in:
Michael Grote 2023-07-03 22:42:46 +02:00
parent 8e9465e0b9
commit ce813a881b
7 changed files with 11 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
.gitignore vendored
View file

@ -2,6 +2,9 @@
vault-pass.yml vault-pass.yml
id_rsa_ansible_user id_rsa_ansible_user
id_rsa_ansible_user_pub id_rsa_ansible_user_pub
id_rsa_ansible_user.pub
plugins/lookup/__pycache__/** plugins/lookup/__pycache__/**
plugins/callback/__pycache__/ plugins/callback/__pycache__/
trace/**json trace/**json
id_ed25519
id_ed25519.pub

2
ansible.cfg
View file

@ -5,7 +5,7 @@ retry_files_enabled = False
roles_path = ./roles roles_path = ./roles
lookup_plugins = ./plugins/lookup lookup_plugins = ./plugins/lookup
collections_paths = ./ansible_collections collections_paths = ./ansible_collections
private_key_file = ./id_rsa_ansible_user private_key_file = ./id_ed25519
vault_password_file = vault-pass.yml vault_password_file = vault-pass.yml
gathering = smart gathering = smart
#display_ok_hosts = no # zeigt nur noch changed und error tasks/hosts an #display_ok_hosts = no # zeigt nur noch changed und error tasks/hosts an

2
group_vars/all.yml
View file

@ -43,7 +43,7 @@
update_password: on_create update_password: on_create
groups: ssh, sudo groups: ssh, sudo
state: present state: present
public_ssh_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyqs0OE5RVqs6tIzyuGQWvq/OVDa/tfdSEqMIwcthFt+pwCCjpqtNc8L8FSXgphSwuNosFakqhMLDFD3pmII+t61NRExsoR3nGTDuCAQnTvTKXTEfhnunN3pwgXWVTI68j9pRzmSy+hMkSFbgN9EGMSXxGcNunY7ewS3ZkVe08SWFpiX9giYq6uiOiMHsZKdcP6s2QRXUhZlTx2cOc/9gJ5lD82EUXQRZzT6ww2xVrceIW9c3CZFmSmYWxvrR7dPcHrke90FPPd5WhU+Anz++6GsT6+OhZTk+uQnBHllFXn9NoFQIEUDO4zV+gFXITaAbTkLAcCwuKB2QcDZ6C2mhf ansible-generated on ansible-v2 public_ssh_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcBwOjanQV6sFWaTetqpl20SVe3aRzGjKbsp7hKkDCE mg@irantu
allow_sudo: true allow_sudo: true
allow_passwordless_sudo: true allow_passwordless_sudo: true
### mgrote.munin-node ### mgrote.munin-node

2
group_vars/docker.yml
View file

@ -39,7 +39,7 @@
update_password: on_create update_password: on_create
groups: ssh, sudo groups: ssh, sudo
state: present state: present
public_ssh_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyqs0OE5RVqs6tIzyuGQWvq/OVDa/tfdSEqMIwcthFt+pwCCjpqtNc8L8FSXgphSwuNosFakqhMLDFD3pmII+t61NRExsoR3nGTDuCAQnTvTKXTEfhnunN3pwgXWVTI68j9pRzmSy+hMkSFbgN9EGMSXxGcNunY7ewS3ZkVe08SWFpiX9giYq6uiOiMHsZKdcP6s2QRXUhZlTx2cOc/9gJ5lD82EUXQRZzT6ww2xVrceIW9c3CZFmSmYWxvrR7dPcHrke90FPPd5WhU+Anz++6GsT6+OhZTk+uQnBHllFXn9NoFQIEUDO4zV+gFXITaAbTkLAcCwuKB2QcDZ6C2mhf ansible-generated on ansible-v2 public_ssh_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcBwOjanQV6sFWaTetqpl20SVe3aRzGjKbsp7hKkDCE mg@irantu
allow_sudo: true allow_sudo: true
allow_passwordless_sudo: true allow_passwordless_sudo: true
### geerlingguy.docker ### geerlingguy.docker

2
group_vars/pbs.yml
View file

@ -24,7 +24,7 @@
update_password: on_create update_password: on_create
groups: ssh, sudo groups: ssh, sudo
state: present state: present
public_ssh_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyqs0OE5RVqs6tIzyuGQWvq/OVDa/tfdSEqMIwcthFt+pwCCjpqtNc8L8FSXgphSwuNosFakqhMLDFD3pmII+t61NRExsoR3nGTDuCAQnTvTKXTEfhnunN3pwgXWVTI68j9pRzmSy+hMkSFbgN9EGMSXxGcNunY7ewS3ZkVe08SWFpiX9giYq6uiOiMHsZKdcP6s2QRXUhZlTx2cOc/9gJ5lD82EUXQRZzT6ww2xVrceIW9c3CZFmSmYWxvrR7dPcHrke90FPPd5WhU+Anz++6GsT6+OhZTk+uQnBHllFXn9NoFQIEUDO4zV+gFXITaAbTkLAcCwuKB2QcDZ6C2mhf ansible-generated on ansible-v2 public_ssh_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcBwOjanQV6sFWaTetqpl20SVe3aRzGjKbsp7hKkDCE mg@irantu
allow_sudo: true allow_sudo: true
allow_passwordless_sudo: true allow_passwordless_sudo: true

3
group_vars/pve.yml
View file

@ -23,9 +23,10 @@
update_password: on_create update_password: on_create
groups: ssh, sudo groups: ssh, sudo
state: present state: present
public_ssh_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyqs0OE5RVqs6tIzyuGQWvq/OVDa/tfdSEqMIwcthFt+pwCCjpqtNc8L8FSXgphSwuNosFakqhMLDFD3pmII+t61NRExsoR3nGTDuCAQnTvTKXTEfhnunN3pwgXWVTI68j9pRzmSy+hMkSFbgN9EGMSXxGcNunY7ewS3ZkVe08SWFpiX9giYq6uiOiMHsZKdcP6s2QRXUhZlTx2cOc/9gJ5lD82EUXQRZzT6ww2xVrceIW9c3CZFmSmYWxvrR7dPcHrke90FPPd5WhU+Anz++6GsT6+OhZTk+uQnBHllFXn9NoFQIEUDO4zV+gFXITaAbTkLAcCwuKB2QcDZ6C2mhf ansible-generated on ansible-v2 public_ssh_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcBwOjanQV6sFWaTetqpl20SVe3aRzGjKbsp7hKkDCE mg@irantu
allow_sudo: true allow_sudo: true
allow_passwordless_sudo: true allow_passwordless_sudo: true
### mgrote.apt_manage_packages ### mgrote.apt_manage_packages
apt_packages_extra: apt_packages_extra:
- ifupdown2 - ifupdown2

4
playbooks/on-off/remove_old_ssh_key.yml
View file

@ -6,7 +6,7 @@
- name: Set authorized key taken from file - name: Set authorized key taken from file
become: yes become: yes
ansible.posix.authorized_key: ansible.posix.authorized_key:
user: mg user: ansible-user
state: present state: present
key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKL8opSQ0rWVw9uCfbuiqmXq188OP4xh66MBTO3zV5jo heimserver_mg_v3 key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcBwOjanQV6sFWaTetqpl20SVe3aRzGjKbsp7hKkDCE mg@irantu
exclusive: true #entferne alle keys bis auf diesen exclusive: true #entferne alle keys bis auf diesen