| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Restore now uses /var/cache/git-restore (root-owned),
backup keeps /var/cache/git-backup (backup-owned)
Co-Authored-By: Claude.ai
|
|
authorized_keys lived under /srv/git (git's $HOME), the same tree
restic backs up and restores. backup couldn't even read it (0700,
unreadable by the backup user), and restore --delete treated it as
extraneous and deleted it, breaking push access after every restore.
git now gets a normal separate home; clone-prefix in cgitrc serves the
repos dir by absolute path instead of the ~-relative form, since that
relied on $HOME being the repos dir. Drops the sshd_config.d Include/
Match-block/AllowUsers approach tried first — it directly conflicted
with pve-lxc-ssh's sshd_config push, which fully overwrites the file
on every run and has no way to know about cgit's edits.
Co-Authored-By: Claude.ai
|
|
pve_lxc_ssh_check.rc != 0 gated the entire block, so once openssh was
installed, sshd_config pushes, host key deploys, and service enable/
restart never ran again on reconverge — template changes (e.g. sshd
hardening) silently never reached already-provisioned containers.
Narrow the conditional to just the package-install step; everything
else already idempotent, runs unconditionally now.
Co-Authored-By: Claude.ai
|
|
Restore (restic --delete) was wiping git's authorized_keys because it
lived under the same tree as the backed-up repos, and the backup user
couldn't even read it in the first place (0700, permission denied).
authorized_keys now lives at /etc/ssh/authorized_keys/git, decoupled
from backup/restore entirely.
Also add AllowUsers allowlists (pve-lxc-ssh baseline + cgit override)
and a Match block restricting the git user to key auth only, no TCP/
agent forwarding or TTY.
Co-Authored-By: Claude.ai
|
|
|
|
Co-Authored-By: Claude.ai
|
|
|
|
Co-Authored-By: Claude.ai
|
|
|
|
|
|
New collaborators:
8B329B4CA58513705BAD1262C3A28FB43A6B6226
Ahmed Abdelhalim <[email protected]>
|
|
|
|
Co-Authored-By: Claude.ai
|
|
|
|
|
|
|
|
Co-Authored-By: Claude.ai
|
|
|
|
|
|
|
|
Co-Authored-By: Claude.ai
|
|
|
|
pacman 7.0+'s alpm sandbox runs package download/extraction under a
restricted user + seccomp filter. That filter needs syscalls QEMU's
user-mode emulation doesn't support, so building this amd64 image on an
arm64 host (e.g. Apple Silicon) fails immediately on the first pacman
call:
error: error restricting syscalls via seccomp: 22!
error: switching to sandbox user 'alpm' failed!
Confirmed directly: `pacman -Sy` fails with the sandbox enabled and
succeeds cleanly with `DisableSandbox` set in pacman.conf.
Scoped entirely to this test image, not any real role/target this repo
manages. Safe for CI too — the sandbox is a defense-in-depth layer
protecting the host from a compromised download during package fetch,
irrelevant to a container that's destroyed immediately after each test
run; disabling it changes no package-resolution or install behavior,
only removes that extra isolation layer. Native (non-emulated) CI
runners were never affected by the underlying bug either way.
Co-Authored-By: Claude.ai
|
|
dhcpcd is installed (and enabled by its package's default preset) in the
raspberrypi/debian/ubuntu/proxmox molecule images to mimic each distro's
default boot environment. Inside podman's virtual network there's no
real DHCP server for it to negotiate with, so it only ever gets a
link-local address and overwrites /etc/resolv.conf with an empty file
(just dhcpcd's template comments, no nameserver line). This happens
within the first minute or two of container boot — fast enough to break
DNS resolution for apt-get tasks later in the same converge run.
Reproduced and confirmed on all four affected scenarios (raspberrypi,
debian, ubuntu, proxmox — each installs dhcpcd the same way): apt-get
tasks failed with repeated "Temporary failure resolving" errors at
varying points in the play depending on timing. archlinux/archlinux-gnome
and git (Alpine) don't install dhcpcd and are unaffected.
The network role already intends to remove dhcpcd/avahi-daemon entirely
(replacing them with NetworkManager/systemd-resolved), but that removal
task runs after earlier package-install steps — so the very service
being phased out was sabotaging tasks that ran before it got purged.
Masking dhcpcd.service at image-build time prevents it from ever running
in these test containers, closing the race without touching any role's
actual task order or logic (which reflects real hardware, where dhcpcd
does get a valid lease from an actual router).
Co-Authored-By: Claude.ai
|
|
domain = {{ pihole_domain }} rendered as an unquoted bareword containing
a dot (e.g. "pi.hole"), which is invalid TOML. TOML parsing is
all-or-nothing, not line-by-line, so pihole-FTL rejected the entire
config file on that one line and silently fell back to its compiled-in
defaults — including binding its webserver directly to ports 80/443.
That collided with caddy, which wants the same ports, causing caddy to
crash-loop and get reported as "changed" (needing a restart) on every
subsequent ansible run.
Quoting the domain value lets the file parse successfully, which in turn
surfaces a second, previously-unreachable bug: the custom webserver port
(pihole_port) was rendered as a bare number, but Pi-hole v6 FTL requires
each listener address to carry a trailing flag character (o = optional,
s = TLS). Without it FTL rejects the value the same way and reverts to
the 80/443 default. Appending "o" fixes that.
Both bugs had to be fixed together: the quoting bug was blocking the
parser from ever reaching the port line, so the port fix alone had no
effect until parsing succeeded end-to-end.
Co-Authored-By: Claude.ai
|
|
dhcpcd is installed (and enabled by its package's default preset) in the
test container to mimic Raspberry Pi OS's default boot environment. Inside
podman's virtual network there's no real DHCP server for it to negotiate
with, so it only ever gets a link-local address and overwrites
/etc/resolv.conf with an empty file (just dhcpcd's template comments, no
nameserver line). This happens within the first ~1-2 minutes of container
boot, which is fast enough to break DNS resolution for later apt-get
tasks in the same converge run — observed failing on "network : Ensure
network_packages are installed" with repeated "Temporary failure
resolving 'deb.debian.org'".
The network role already intends to remove dhcpcd/avahi-daemon entirely
(replacing them with NetworkManager/systemd-resolved), but that removal
task runs after the package-install step that was failing — so the very
service being phased out was sabotaging the install of its replacement.
Masking dhcpcd.service at image-build time prevents it from ever running
in the test container, closing the race without touching the network
role's actual task order or logic (which reflects real hardware, where
dhcpcd does get a valid lease from an actual router).
Confidence in this is medium
Co-Authored-By: Claude.ai
|
|
|
|
|
|
|
|
|
|
Co-Authored-By: Claude.ai
|
|
The APK approach never existed
AI made that up
Co-Authored-By: Claude.ai
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
