63 lines
2.1 KiB
YAML
63 lines
2.1 KiB
YAML
|
---
|
||
|
|
# This owns the non-secret Compose declaration only. WireGuard key material
|
||
|
|
# remains under the server-local /opt/wireguard/config bind mount.
|
||
|
|
- name: Apply the reviewed WireGuard Compose hardening
|
||
|
|
hosts: wireguard
|
||
|
|
become: true
|
||
|
|
gather_facts: false
|
||
|
|
serial: 1
|
||
|
|
vars:
|
||
|
|
wireguard_harden_confirm: false
|
||
|
|
wireguard_compose_candidate: "{{ compose_project_dir }}/compose.yml.candidate"
|
||
|
|
tasks:
|
||
|
|
- name: Require explicit WireGuard hardening confirmation
|
||
|
|
ansible.builtin.assert:
|
||
|
|
that:
|
||
|
|
- wireguard_harden_confirm | bool
|
||
|
|
fail_msg: >-
|
||
|
|
This operation replaces the non-secret Compose declaration. Run only
|
||
|
|
during the approved maintenance window after a rollback archive exists.
|
||
|
|
|
||
|
|
- name: Verify that a protected pre-change archive exists
|
||
|
|
ansible.builtin.find:
|
||
|
|
paths: "{{ compose_project_dir }}/backups"
|
||
|
|
patterns: 'pre-hardening-*.tar.gz'
|
||
|
|
file_type: file
|
||
|
|
register: wireguard_pre_hardening_archives
|
||
|
|
|
||
|
|
- name: Require a pre-change rollback archive
|
||
|
|
ansible.builtin.assert:
|
||
|
|
that:
|
||
|
|
- wireguard_pre_hardening_archives.matched | int > 0
|
||
|
|
fail_msg: >-
|
||
|
|
Create a protected pre-hardening archive before replacing compose.yml.
|
||
|
|
|
||
|
|
- name: Render the candidate non-secret Compose declaration
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: ../templates/wireguard-compose.yml.j2
|
||
|
|
dest: "{{ wireguard_compose_candidate }}"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0644"
|
||
|
|
|
||
|
|
- name: Validate the candidate Compose declaration
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- docker
|
||
|
|
- compose
|
||
|
|
- --project-directory
|
||
|
|
- "{{ compose_project_dir }}"
|
||
|
|
- --file
|
||
|
|
- "{{ wireguard_compose_candidate }}"
|
||
|
|
- config
|
||
|
|
- --quiet
|
||
|
|
changed_when: false
|
||
|
|
|
||
|
|
- name: Atomically activate the validated Compose declaration
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- mv
|
||
|
|
- "{{ wireguard_compose_candidate }}"
|
||
|
|
- "{{ compose_project_dir }}/compose.yml"
|
||
|
|
changed_when: true
|