summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--configure.yml11
-rw-r--r--host_vars/git.home.arpa.ymlbin531 -> 555 bytes
-rw-r--r--host_vars/git.home.arpa.yml.example1
-rw-r--r--host_vars/proxy.home.arpa.ymlbin432 -> 456 bytes
-rw-r--r--host_vars/proxy.home.arpa.yml.example1
-rw-r--r--roles/pve-lxc-ssh/defaults/main.yml2
-rw-r--r--roles/pve-lxc-ssh/meta/argument_specs.yml12
-rw-r--r--roles/pve-lxc-ssh/meta/main.yml11
-rw-r--r--roles/pve-lxc-ssh/tasks/main.yml69
-rw-r--r--roles/pve-lxc-ssh/templates/sshd_config.j213
-rw-r--r--roles/pve-lxc/tasks/main.yml6
-rw-r--r--roles/ssh/tasks/main.yml15
12 files changed, 123 insertions, 18 deletions
diff --git a/configure.yml b/configure.yml
index 0da1b8bb..be1826c6 100644
--- a/configure.yml
+++ b/configure.yml
@@ -142,3 +142,14 @@
loop: "{{ groups['containers'] }}"
loop_control:
loop_var: "service_host"
+
+ - name: "Configure SSH on LXC containers"
+ tags: ["pve-lxc"]
+ ansible.builtin.include_role:
+ name: "pve-lxc-ssh"
+ vars:
+ pve_lxc_id: "{{ hostvars[service_host].pve_lxc_id }}"
+ pve_lxc_ssh_port: "{{ hostvars[service_host].pve_lxc_ssh_port }}"
+ loop: "{{ groups['containers'] }}"
+ loop_control:
+ loop_var: "service_host"
diff --git a/host_vars/git.home.arpa.yml b/host_vars/git.home.arpa.yml
index f3c35fa6..310774e1 100644
--- a/host_vars/git.home.arpa.yml
+++ b/host_vars/git.home.arpa.yml
Binary files differ
diff --git a/host_vars/git.home.arpa.yml.example b/host_vars/git.home.arpa.yml.example
index 518e4f5f..88264068 100644
--- a/host_vars/git.home.arpa.yml.example
+++ b/host_vars/git.home.arpa.yml.example
@@ -12,6 +12,7 @@ pve_lxc_memory: 256
pve_lxc_ip: "10.0.0.102/24"
pve_lxc_gateway: "10.0.0.254"
pve_lxc_dns: "10.0.0.254"
+pve_lxc_ssh_port: 2222
cgit_hostname: "git.home.arpa"
cgit_title: "git.a14m.dev"
diff --git a/host_vars/proxy.home.arpa.yml b/host_vars/proxy.home.arpa.yml
index c3a0d7ea..e7a64e7e 100644
--- a/host_vars/proxy.home.arpa.yml
+++ b/host_vars/proxy.home.arpa.yml
Binary files differ
diff --git a/host_vars/proxy.home.arpa.yml.example b/host_vars/proxy.home.arpa.yml.example
index 87ea12fc..8b7755c2 100644
--- a/host_vars/proxy.home.arpa.yml.example
+++ b/host_vars/proxy.home.arpa.yml.example
@@ -12,5 +12,6 @@ pve_lxc_memory: 128
pve_lxc_ip: "10.0.0.101/24"
pve_lxc_gateway: "10.0.0.254"
pve_lxc_dns: "10.0.0.254"
+pve_lxc_ssh_port: 2222
proxy_type: "caddy"
diff --git a/roles/pve-lxc-ssh/defaults/main.yml b/roles/pve-lxc-ssh/defaults/main.yml
new file mode 100644
index 00000000..621cf068
--- /dev/null
+++ b/roles/pve-lxc-ssh/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+pve_lxc_ssh_port: 2222
diff --git a/roles/pve-lxc-ssh/meta/argument_specs.yml b/roles/pve-lxc-ssh/meta/argument_specs.yml
new file mode 100644
index 00000000..6f03937d
--- /dev/null
+++ b/roles/pve-lxc-ssh/meta/argument_specs.yml
@@ -0,0 +1,12 @@
+---
+argument_specs:
+ main:
+ options:
+ pve_lxc_id:
+ type: "int"
+ required: true
+ description: "PVE LXC container ID"
+ pve_lxc_ssh_port:
+ type: "int"
+ default: 2222
+ description: "SSH port to configure inside the container"
diff --git a/roles/pve-lxc-ssh/meta/main.yml b/roles/pve-lxc-ssh/meta/main.yml
new file mode 100644
index 00000000..79d075ca
--- /dev/null
+++ b/roles/pve-lxc-ssh/meta/main.yml
@@ -0,0 +1,11 @@
+---
+dependencies: []
+galaxy_info:
+ author: "a14m"
+ description: "Harden SSH on PVE LXC containers via pct exec"
+ license: "MIT"
+ min_ansible_version: "2.18"
+ platforms:
+ - name: "Debian"
+ versions:
+ - "bookworm"
diff --git a/roles/pve-lxc-ssh/tasks/main.yml b/roles/pve-lxc-ssh/tasks/main.yml
new file mode 100644
index 00000000..7a6314cb
--- /dev/null
+++ b/roles/pve-lxc-ssh/tasks/main.yml
@@ -0,0 +1,69 @@
+---
+- name: "Install openssh"
+ become: true
+ ansible.builtin.command:
+ cmd: >
+ pct exec {{ pve_lxc_id }} -- sh -c
+ 'which sshd > /dev/null 2>&1 && exit 0;
+ . /etc/os-release;
+ case $ID in
+ alpine) apk add --no-cache openssh ;;
+ debian|ubuntu) apt-get install -y openssh-server ;;
+ *) echo "Unsupported distro: $ID" && exit 1 ;;
+ esac;
+ echo "installed"'
+ register: pve_lxc_ssh_install
+ changed_when: "'installed' in pve_lxc_ssh_install.stdout"
+ tags:
+ - "molecule-notest"
+
+- name: "Generate ssh host keys"
+ become: true
+ ansible.builtin.command:
+ cmd: >
+ pct exec {{ pve_lxc_id }} -- sh -c
+ '[ -f /etc/ssh/ssh_host_ed25519_key ] && exit 0;
+ ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C "" -N "";
+ echo "generated"'
+ register: pve_lxc_ssh_keygen
+ changed_when: "'generated' in pve_lxc_ssh_keygen.stdout"
+ tags:
+ - "molecule-notest"
+
+- name: "Render sshd_config"
+ ansible.builtin.template:
+ src: "sshd_config.j2"
+ dest: "/tmp/sshd_config_{{ pve_lxc_id }}"
+ mode: "0600"
+ tags:
+ - "molecule-notest"
+
+- name: "Push sshd_config into container"
+ become: true
+ ansible.builtin.command:
+ cmd: pct push {{ pve_lxc_id }} /tmp/sshd_config_{{ pve_lxc_id }} /etc/ssh/sshd_config --perms 0640
+ changed_when: true
+ tags:
+ - "molecule-notest"
+
+- name: "Remove temp sshd_config"
+ ansible.builtin.file:
+ path: "/tmp/sshd_config_{{ pve_lxc_id }}"
+ state: absent
+ tags:
+ - "molecule-notest"
+
+- name: "Enable and start sshd"
+ become: true
+ ansible.builtin.command:
+ cmd: >
+ pct exec {{ pve_lxc_id }} -- sh -c
+ '. /etc/os-release;
+ case $ID in
+ alpine) rc-update add sshd default; rc-service sshd restart ;;
+ debian|ubuntu) systemctl enable --now ssh; systemctl restart ssh ;;
+ *) echo "Unsupported distro: $ID" && exit 1 ;;
+ esac'
+ changed_when: false
+ tags:
+ - "molecule-notest"
diff --git a/roles/pve-lxc-ssh/templates/sshd_config.j2 b/roles/pve-lxc-ssh/templates/sshd_config.j2
new file mode 100644
index 00000000..d8ccc6d2
--- /dev/null
+++ b/roles/pve-lxc-ssh/templates/sshd_config.j2
@@ -0,0 +1,13 @@
+Port {{ pve_lxc_ssh_port }}
+PermitRootLogin prohibit-password
+PasswordAuthentication no
+AuthenticationMethods publickey
+PermitEmptyPasswords no
+KbdInteractiveAuthentication no
+ChallengeResponseAuthentication no
+UsePAM no
+X11Forwarding no
+PrintMotd yes
+AuthorizedKeysFile .ssh/authorized_keys
+HostKey /etc/ssh/ssh_host_ed25519_key
+Subsystem sftp /usr/lib/ssh/sftp-server
diff --git a/roles/pve-lxc/tasks/main.yml b/roles/pve-lxc/tasks/main.yml
index b719bfd0..12a2e814 100644
--- a/roles/pve-lxc/tasks/main.yml
+++ b/roles/pve-lxc/tasks/main.yml
@@ -64,9 +64,9 @@
debian|ubuntu) apt-get install -y python3 ;;
*) echo "Unsupported distro: $ID" && exit 1 ;;
esac;
- echo "python3 installed"'
- register: cgit_python_bootstrap
- changed_when: "'python3 installed' in cgit_python_bootstrap.stdout"
+ echo "installed"'
+ register: pve_lxc_bootstrap
+ changed_when: "'installed' in pve_lxc_bootstrap.stdout"
tags:
# PVE API not available in containers — requires proxmox-ve package
- "molecule-notest"
diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml
index 7df9efe8..f60c2640 100644
--- a/roles/ssh/tasks/main.yml
+++ b/roles/ssh/tasks/main.yml
@@ -8,18 +8,6 @@
name: "{{ ssh_package }}"
state: "present"
-- name: "Generate /etc/ssh/ RSA host key"
- become: true
- ansible.builtin.command:
- cmd: "ssh-keygen -q -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -C '' -N ''"
- creates: "/etc/ssh/ssh_host_rsa_key"
-
-- name: "Generate /etc/ssh/ ECDSA host key"
- become: true
- ansible.builtin.command:
- cmd: "ssh-keygen -q -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -C '' -N ''"
- creates: "/etc/ssh/ssh_host_ecdsa_key"
-
- name: "Generate /etc/ssh/ Ed25519 host key"
become: true
ansible.builtin.command:
@@ -52,9 +40,6 @@
UsePAM no # default installation is yes
PrintMotd yes # default installation is no
- # Host key configurations
- HostKey /etc/ssh/ssh_host_rsa_key
- HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
# Default sshd_config
generated by cgit v1.2.3 (git 2.25.1) at 2026-07-25 03:28:02 +0000