Fix ssh auth config settings labels

Update inventory to support hubble

README.md

@@ -17,8 +17,9 @@ Bootstrap checklist:
 sudo tee /etc/sudoers.d/30-ansible <<<"ansible ALL=(ALL) NOPASSWD:ALL"
 ```
 
-5. Change the UID of the `ansible` user to `1400` with this command:
+5. Change the UID/GID of the `ansible` user/group to `1400` with these commands:
 
 ```bash
 sudo usermod -u 1400 ansible
+sudo groupmod -g 1400 ansible
 ```

inventory.yaml

@@ -32,86 +32,89 @@ en1:
         skylab_targets: [cluster, datastore]
         skylab_roles:
           - server
-          - docker-swarm-manager
+          - docker-swarm
           - datastore
 
       hosts:
         pegasus:  # jupiter
           ansible_host: 10.42.101.100
+          skylab_hostname: pegasus.skylab.enp.one
           skylab_description: Arbiter Node
           skylab_cluster:
             address: 10.42.101.10/24
             interface: bond0
           skylab_networking:
-            hostname: pegasus.skylab.enp.one
-            dns: [10.42.101.1]
-            gateway: 10.42.101.1/24
-            interfaces:
             eno1:
               bond: bond0
             eno2:
               bond: bond0
             bond0:
               type: bond
+              gateway: 10.42.101.1/24
+              dns:
+                - 10.42.101.1
               addresses:
                 - 10.42.101.100/24
                 - 192.168.255.255/32
               dhcp: false
             bond0.99:
               type: vlan
-                addresses: [192.168.42.10/24]
+              addresses:
+                - 192.168.42.10/24
               dhcp: false
 
         saturn:  # remus
           ansible_host: 10.42.101.110
+          skylab_hostname: saturn.skylab.enp.one
           skylab_description: Operational Node
           skylab_cluster:
             address: 10.42.101.11/24
             interface: bond0
           skylab_networking:
-            hostname: saturn.skylab.enp.one
-            dns: [10.42.101.1]
-            gateway: 10.42.101.1/24
-            interfaces:
             eno1:
               bond: bond0
             eno2:
               bond: bond0
             bond0:
               type: bond
+              dhcp: false
+              gateway: 10.42.101.1/24
               addresses:
                 - 10.42.101.110/24
                 - 192.168.255.255/32
-                dhcp: false
+              dns:
+                - 10.42.101.1
             bond0.99:
               type: vlan
-                addresses: [192.168.42.20/24]
               dhcp: false
+              addresses:
+                - 192.168.42.20/24
 
         orion:  # romulus
           ansible_host: 10.42.101.120
+          skylab_hostname: orion.skylab.enp.one
           skylab_description: Operational Node
           skylab_cluster:
             address: 10.42.101.12/24
             interface: bond0
           skylab_networking:
-            hostname: orion.skylab.enp.one
-            dns: [10.42.101.1]
-            gateway: 10.42.101.1/24
-            interfaces:
             eno1:
               bond: bond0
             eno2:
               bond: bond0
             bond0:
               type: bond
+              gateway: 10.42.101.1/24
+              dns:
+                - 10.42.101.1
               addresses:
                 - 10.42.101.120/24
                 - 192.168.255.255/32
               dhcp: false
             bond0.99:
               type: vlan
-                addresses: [192.168.42.30/24]
+              addresses:
+                - 192.168.42.30/24
               dhcp: false
 
 en2:
@@ -121,5 +124,7 @@ en2:
   hosts:
     hubble:
       ansible_host: en2a.enp.one
+      skylab_hostname: hubble.en2.enp.one
       skylab_description: Cloud Web Server
       skylab_targets: [cloud]
+      skylab_roles: [server]

playbooks/provision.yaml

@@ -23,7 +23,7 @@
     - name: Set hostname
       become: true
       ansible.builtin.hostname:
-        name: "{{ skylab_networking.hostname | default(inventory_hostname) }}"
+        name: "{{ skylab_hostname | default(inventory_hostname) }}"
         use: systemd
 
     - name: Disable case-sensitive tab-completion

roles/server/tasks/networkd.yaml

@@ -22,19 +22,19 @@
         mode: 0644
         owner: root
         group: "{{ ansible_user }}"
-      loop: "{{ skylab_networking.interfaces | dict2items }}"
+      loop: "{{ skylab_networking | dict2items }}"
       loop_control:
         label: "{{ item.key }}"
 
     - name: Create netdev files
-      when: item.value.type is defined
+      when: item.value.device is defined
       ansible.builtin.template:
         src: netdev.j2
         dest: /etc/systemd/network/{{ item.key }}.netdev
         mode: 0644
         owner: root
         group: "{{ ansible_user }}"
-      loop: "{{ skylab_networking.interfaces | dict2items }}"
+      loop: "{{ skylab_networking | dict2items }}"
       loop_control:
         label: "{{ item.key }}"
 
@@ -45,7 +45,7 @@
       register: _network_config_dir_raw
 
     - name: Remove legacy network config files
-      when: item.strip().replace('.netdev', '').replace('.network', '') not in skylab_networking.interfaces
+      when: item.strip().replace('.netdev', '').replace('.network', '') not in skylab_networking
       ansible.builtin.file:
         path: /etc/systemd/network/{{ item }}
         state: absent

roles/server/tasks/sshd.yaml

@@ -7,20 +7,16 @@
     replace: "{{ item.value }}"
   notify: [restart-sshd]
   loop:
-    - name: disable root login
-      regex: "^.*PermitRootLogin (yes|no).*$"
+    - regex: "^.*PermitRootLogin (yes|no).*$"
       value: PermitRootLogin no
-    - name: disable password auth
-      regex: "^.*PasswordAuthentication (yes|no).*$"
+    - regex: "^.*PasswordAuthentication (yes|no).*$"
       value: PasswordAuthentication no
-    - name: disable challenge response auth
-      regex: "^.*ChallengeResponseAuthentication (yes|no).*$"
+    - regex: "^.*ChallengeResponseAuthentication (yes|no).*$"
       value: ChallengeResponseAuthentication no
-    - name: disable GSSAPI auth
-      regex: "^.*GSSAPIAuthentication (yes|no).*$"
+    - regex: "^.*GSSAPIAuthentication (yes|no).*$"
       value: GSSAPIAuthentication no
   loop_control:
-    label: "{{ item.name }}"
+    label: "{{ item.value }}"
 
 - name: Disable dynamic MOTD on debian systems
   when: ansible_os_family == "Debian"

roles/server/templates/motd.j2

@@ -1,11 +1,11 @@
 
-      ########  ###   ###  ###  ###   ###   #######   ######
-    ###        ###   ###  ###  ###   ###  ###   ###  ###  ###
-   ###        ########   #######    ###  #########  #######
-   #######   ###   ###  ###        ###  ###   ###  ###  ###
-       ###  ###    ###   ####     ###  ###   ###  #######
-      ###                        ###
- ######   ///////////////////   #########  /////////////
+    /########  /##   /##  /##  /##   /##  /#######   /#####
+   /##        /##___/##  /##__/##   /##  /##___/##  /##__/##
+  /##____    /#######   /######    /##  /########  /######
+  \#######  /##   |##   |##       /##  /##   /##  /##__/##
+      /##  /##    |##    \###    /##  /##   /##  /######
+  ___/##                        /##_____
+ /#####  ```````````````````   /########  ``````````````
 
  ✨ {{ skylab_description }} @{{ skylab_location }}
 {{ ' ' }}

roles/server/templates/netdev.j2

@@ -2,15 +2,15 @@
 #
 [NetDev]
 Name={{ item.key }}
-type={{ item.value.type }}
+Kind={{ item.value.device }}
 
-{% if item.value.type.lower() == 'bond' %}
+{% if item.value.device.lower() == 'bond' %}
 [Bond]
 Mode={{ item.value.bond_mode | default('balance-rr') }}
 PrimaryReselectPolicy=always
 MIIMonitorSec=1s
 {% endif %}
-{% if item.value.type.lower() == 'vlan' %}
+{% if item.value.device.lower() == 'vlan' %}
 [VLAN]
 Id={{ item.key.partition('.')[2] }}
 {% endif %}

roles/server/templates/network.j2

@@ -14,14 +14,16 @@ DNS={{ server }}
 {% if item.value.bond is defined %}
 Bond={{ item.value.bond }}
 {% endif %}
-{% if item.value.dhcp | default(false) %}
+{% if not item.value.dhcp | default(false) %}
 
+{% if item.value.gateway is defined %}
 Gateway={{ item.value.gateway | ansible.netcommon.ipaddr('address') }}
-{% for address in item.value.addresses %}
+{% endif %}
+{% for address in item.value.addresses | default([]) %}
 Address={{ address | ansible.netcommon.ipaddr('host/prefix') }}
 {% endfor %}
 {% endif %}
-{% for interface in skylab_networking.interfaces.keys() %}
+{% for interface in skylab_networking.keys() %}
 {% if interface.startswith(item.key) and interface.partition('.')[2] | regex_search('^[0-9]{1,4}$') and interface != item.key %}
 VLAN={{ interface }}
 {% endif %}

vars/access.yaml

@@ -3,16 +3,16 @@ skylab_accounts:
   - name: enpaul
     uid: 1300
     fullname: Ethan N. Paul
-    targets: [network, datastore, cluster]
+    targets: [network, datastore, cluster, cloud]
     admin: true
-    password: $y$j9T$cWkd9aGj4sNepyJm5NVZl0$yBhFy3cN3syM8r4doGYnsLZhsaTLQVoDIBs2kkXtxY2
+    password: $6$H7jZEL2Ey93zfMTD$CzUlZkXDudPHgUMU/OFUn8/Yhzo8nBxoSI8thD15toIFlWN.iUfq/Jp5z3KpDCGTxyv.IbRTvE8dOVWjoRfgJ.
 
   - name: ansible
     uid: 1400
-    targets: [network, datastore, cluster]
+    targets: [network, datastore, cluster, cloud]
     admin: true
     service: true
-    password: $y$j9T$w/pIBtZIMo3PmXccZ.LHi1$AbMVIks.P10CyuK8tWt21O4JuLpKGpWTFgX0WlTbiw6
+    password: $6$qNKmYg4y9YS4f5Gr$m0mAqEVbymPguj.1cS.pfclt33Okfmn1KhFC0r1iQ3eVvz/OIZY3x0qGmPnJ1zOXDWyKKs5hnlGTAeZgCh49C.
 
 skylab_group:
   name: skylab
@@ -26,4 +26,4 @@ skylab_group_automation:
   name: skylab_auto
   gid: 1202
 
-skylab_root_password: $y$j9T$vcNKa2vbTBQLGsU7QZfkM0$4.gw4YqknZJSZJ/uRKFI36G8JtK/MJPsxFdTTmzQoL6
+skylab_root_password: $6$FDwVi2DUVPg.LSrC$vRMIW6ah0x5cSZFLDrV2FuiwoUtYgcnJJV06gn2HxLsUnkXJ0/Sv1hjRn8v6bZy1AmkDCyQCtT6DHRRBuQspx.