README.md

@@ -17,9 +17,8 @@ Bootstrap checklist:
 sudo tee /etc/sudoers.d/30-ansible <<<"ansible ALL=(ALL) NOPASSWD:ALL"
 ```
 
-5. Change the UID/GID of the `ansible` user/group to `1400` with these commands:
+5. Change the UID of the `ansible` user to `1400` with this command:
 
 ```bash
 sudo usermod -u 1400 ansible
-sudo groupmod -g 1400 ansible
 ```

inventory.yaml

@@ -32,89 +32,86 @@ en1:
         skylab_targets: [cluster, datastore]
         skylab_roles:
           - server
-          - docker-swarm
+          - docker-swarm-manager
           - datastore
 
       hosts:
         pegasus:  # jupiter
           ansible_host: 10.42.101.100
-          skylab_hostname: pegasus.skylab.enp.one
           skylab_description: Arbiter Node
           skylab_cluster:
             address: 10.42.101.10/24
             interface: bond0
           skylab_networking:
+            hostname: pegasus.skylab.enp.one
+            dns: [10.42.101.1]
+            gateway: 10.42.101.1/24
+            interfaces:
               eno1:
                 bond: bond0
               eno2:
                 bond: bond0
               bond0:
                 type: bond
-              gateway: 10.42.101.1/24
-              dns:
-                - 10.42.101.1
                 addresses:
                   - 10.42.101.100/24
                   - 192.168.255.255/32
                 dhcp: false
               bond0.99:
                 type: vlan
-              addresses:
-                - 192.168.42.10/24
+                addresses: [192.168.42.10/24]
                 dhcp: false
 
         saturn:  # remus
           ansible_host: 10.42.101.110
-          skylab_hostname: saturn.skylab.enp.one
           skylab_description: Operational Node
           skylab_cluster:
             address: 10.42.101.11/24
             interface: bond0
           skylab_networking:
+            hostname: saturn.skylab.enp.one
+            dns: [10.42.101.1]
+            gateway: 10.42.101.1/24
+            interfaces:
               eno1:
                 bond: bond0
               eno2:
                 bond: bond0
               bond0:
                 type: bond
-              dhcp: false
-              gateway: 10.42.101.1/24
                 addresses:
                   - 10.42.101.110/24
                   - 192.168.255.255/32
-              dns:
-                - 10.42.101.1
+                dhcp: false
               bond0.99:
                 type: vlan
+                addresses: [192.168.42.20/24]
                 dhcp: false
-              addresses:
-                - 192.168.42.20/24
 
         orion:  # romulus
           ansible_host: 10.42.101.120
-          skylab_hostname: orion.skylab.enp.one
           skylab_description: Operational Node
           skylab_cluster:
             address: 10.42.101.12/24
             interface: bond0
           skylab_networking:
+            hostname: orion.skylab.enp.one
+            dns: [10.42.101.1]
+            gateway: 10.42.101.1/24
+            interfaces:
               eno1:
                 bond: bond0
               eno2:
                 bond: bond0
               bond0:
                 type: bond
-              gateway: 10.42.101.1/24
-              dns:
-                - 10.42.101.1
                 addresses:
                   - 10.42.101.120/24
                   - 192.168.255.255/32
                 dhcp: false
               bond0.99:
                 type: vlan
-              addresses:
-                - 192.168.42.30/24
+                addresses: [192.168.42.30/24]
                 dhcp: false
 
 en2:
@@ -124,7 +121,5 @@ en2:
   hosts:
     hubble:
       ansible_host: en2a.enp.one
-      skylab_hostname: hubble.en2.enp.one
       skylab_description: Cloud Web Server
       skylab_targets: [cloud]
-      skylab_roles: [server]

playbooks/provision.yaml

@@ -23,7 +23,7 @@
     - name: Set hostname
       become: true
       ansible.builtin.hostname:
-        name: "{{ skylab_hostname | default(inventory_hostname) }}"
+        name: "{{ skylab_networking.hostname | default(inventory_hostname) }}"
         use: systemd
 
     - name: Disable case-sensitive tab-completion

roles/server/tasks/networkd.yaml

@@ -22,19 +22,19 @@
         mode: 0644
         owner: root
         group: "{{ ansible_user }}"
-      loop: "{{ skylab_networking | dict2items }}"
+      loop: "{{ skylab_networking.interfaces | dict2items }}"
       loop_control:
         label: "{{ item.key }}"
 
     - name: Create netdev files
-      when: item.value.device is defined
+      when: item.value.type is defined
       ansible.builtin.template:
         src: netdev.j2
         dest: /etc/systemd/network/{{ item.key }}.netdev
         mode: 0644
         owner: root
         group: "{{ ansible_user }}"
-      loop: "{{ skylab_networking | dict2items }}"
+      loop: "{{ skylab_networking.interfaces | dict2items }}"
       loop_control:
         label: "{{ item.key }}"
 
@@ -45,7 +45,7 @@
       register: _network_config_dir_raw
 
     - name: Remove legacy network config files
-      when: item.strip().replace('.netdev', '').replace('.network', '') not in skylab_networking
+      when: item.strip().replace('.netdev', '').replace('.network', '') not in skylab_networking.interfaces
       ansible.builtin.file:
         path: /etc/systemd/network/{{ item }}
         state: absent

roles/server/tasks/sshd.yaml

@@ -7,16 +7,20 @@
     replace: "{{ item.value }}"
   notify: [restart-sshd]
   loop:
-    - regex: "^.*PermitRootLogin (yes|no).*$"
+    - name: disable root login
+      regex: "^.*PermitRootLogin (yes|no).*$"
       value: PermitRootLogin no
-    - regex: "^.*PasswordAuthentication (yes|no).*$"
+    - name: disable password auth
+      regex: "^.*PasswordAuthentication (yes|no).*$"
       value: PasswordAuthentication no
-    - regex: "^.*ChallengeResponseAuthentication (yes|no).*$"
+    - name: disable challenge response auth
+      regex: "^.*ChallengeResponseAuthentication (yes|no).*$"
       value: ChallengeResponseAuthentication no
-    - regex: "^.*GSSAPIAuthentication (yes|no).*$"
+    - name: disable GSSAPI auth
+      regex: "^.*GSSAPIAuthentication (yes|no).*$"
       value: GSSAPIAuthentication no
   loop_control:
-    label: "{{ item.value }}"
+    label: "{{ item.name }}"
 
 - name: Disable dynamic MOTD on debian systems
   when: ansible_os_family == "Debian"

roles/server/templates/motd.j2

@@ -1,11 +1,11 @@
 
-    /########  /##   /##  /##  /##   /##  /#######   /#####
-   /##        /##___/##  /##__/##   /##  /##___/##  /##__/##
-  /##____    /#######   /######    /##  /########  /######
-  \#######  /##   |##   |##       /##  /##   /##  /##__/##
-      /##  /##    |##    \###    /##  /##   /##  /######
-  ___/##                        /##_____
- /#####  ```````````````````   /########  ``````````````
+      ########  ###   ###  ###  ###   ###   #######   ######
+    ###        ###   ###  ###  ###   ###  ###   ###  ###  ###
+   ###        ########   #######    ###  #########  #######
+   #######   ###   ###  ###        ###  ###   ###  ###  ###
+       ###  ###    ###   ####     ###  ###   ###  #######
+      ###                        ###
+ ######   ///////////////////   #########  /////////////
 
  ✨ {{ skylab_description }} @{{ skylab_location }}
 {{ ' ' }}

roles/server/templates/netdev.j2

@@ -2,15 +2,15 @@
 #
 [NetDev]
 Name={{ item.key }}
-Kind={{ item.value.device }}
+type={{ item.value.type }}
 
-{% if item.value.device.lower() == 'bond' %}
+{% if item.value.type.lower() == 'bond' %}
 [Bond]
 Mode={{ item.value.bond_mode | default('balance-rr') }}
 PrimaryReselectPolicy=always
 MIIMonitorSec=1s
 {% endif %}
-{% if item.value.device.lower() == 'vlan' %}
+{% if item.value.type.lower() == 'vlan' %}
 [VLAN]
 Id={{ item.key.partition('.')[2] }}
 {% endif %}

roles/server/templates/network.j2

@@ -14,16 +14,14 @@ DNS={{ server }}
 {% if item.value.bond is defined %}
 Bond={{ item.value.bond }}
 {% endif %}
-{% if not item.value.dhcp | default(false) %}
+{% if item.value.dhcp | default(false) %}
 
-{% if item.value.gateway is defined %}
 Gateway={{ item.value.gateway | ansible.netcommon.ipaddr('address') }}
-{% endif %}
-{% for address in item.value.addresses | default([]) %}
+{% for address in item.value.addresses %}
 Address={{ address | ansible.netcommon.ipaddr('host/prefix') }}
 {% endfor %}
 {% endif %}
-{% for interface in skylab_networking.keys() %}
+{% for interface in skylab_networking.interfaces.keys() %}
 {% if interface.startswith(item.key) and interface.partition('.')[2] | regex_search('^[0-9]{1,4}$') and interface != item.key %}
 VLAN={{ interface }}
 {% endif %}

vars/access.yaml

@@ -3,16 +3,16 @@ skylab_accounts:
   - name: enpaul
     uid: 1300
     fullname: Ethan N. Paul
-    targets: [network, datastore, cluster, cloud]
+    targets: [network, datastore, cluster]
     admin: true
-    password: $6$H7jZEL2Ey93zfMTD$CzUlZkXDudPHgUMU/OFUn8/Yhzo8nBxoSI8thD15toIFlWN.iUfq/Jp5z3KpDCGTxyv.IbRTvE8dOVWjoRfgJ.
+    password: $y$j9T$cWkd9aGj4sNepyJm5NVZl0$yBhFy3cN3syM8r4doGYnsLZhsaTLQVoDIBs2kkXtxY2
 
   - name: ansible
     uid: 1400
-    targets: [network, datastore, cluster, cloud]
+    targets: [network, datastore, cluster]
     admin: true
     service: true
-    password: $6$qNKmYg4y9YS4f5Gr$m0mAqEVbymPguj.1cS.pfclt33Okfmn1KhFC0r1iQ3eVvz/OIZY3x0qGmPnJ1zOXDWyKKs5hnlGTAeZgCh49C.
+    password: $y$j9T$w/pIBtZIMo3PmXccZ.LHi1$AbMVIks.P10CyuK8tWt21O4JuLpKGpWTFgX0WlTbiw6
 
 skylab_group:
   name: skylab
@@ -26,4 +26,4 @@ skylab_group_automation:
   name: skylab_auto
   gid: 1202
 
-skylab_root_password: $6$FDwVi2DUVPg.LSrC$vRMIW6ah0x5cSZFLDrV2FuiwoUtYgcnJJV06gn2HxLsUnkXJ0/Sv1hjRn8v6bZy1AmkDCyQCtT6DHRRBuQspx.
+skylab_root_password: $y$j9T$vcNKa2vbTBQLGsU7QZfkM0$4.gw4YqknZJSZJ/uRKFI36G8JtK/MJPsxFdTTmzQoL6