Initial VPS operations handbook

ansible/roles/matrix_secret_contract/defaults/main.yml

@@ -0,0 +1,21 @@
+---
+matrix_namespace: matrix-system
+matrix_bootstrap_dir: /etc/matrix-bootstrap
+# This role validates only names, keys, types, ownership and modes. It never reads
+# bootstrap values or emits Kubernetes Secret contents.
+matrix_required_bootstrap_files:
+  - smtp-password
+  - synapse-db-password
+  - mas-db-password
+  - synapse-signing-key
+  - synapse-macaroon-secret
+  - synapse-form-secret
+  - mas-encryption-secret
+  - mas-signing-key
+matrix_required_kubernetes_secrets:
+  - name: matrix-synapse-master-config
+    keys: [homeserver.yaml, log.config, signing.key]
+  - name: matrix-authentication-config
+    keys: [mas-config.yaml]
+  - name: matrix-pgbouncer-userlist
+    keys: [userlist.txt]

ansible/roles/matrix_secret_contract/tasks/main.yml

@@ -0,0 +1,61 @@
+---
+- name: Inspect Matrix bootstrap directory without reading secrets
+  ansible.builtin.stat:
+    path: "{{ matrix_bootstrap_dir }}"
+  register: matrix_secret_bootstrap_dir
+
+- name: Assert Matrix bootstrap directory is root-only
+  ansible.builtin.assert:
+    that:
+      - matrix_secret_bootstrap_dir.stat.exists
+      - matrix_secret_bootstrap_dir.stat.isdir
+      - matrix_secret_bootstrap_dir.stat.pw_name == 'root'
+      - matrix_secret_bootstrap_dir.stat.gr_name == 'root'
+      - matrix_secret_bootstrap_dir.stat.mode == '0700'
+    fail_msg: "{{ matrix_bootstrap_dir }} must be a root:root 0700 directory."
+
+- name: Inspect required individual bootstrap secret files without reading them
+  ansible.builtin.stat:
+    path: "{{ matrix_bootstrap_dir }}/{{ item }}"
+  loop: "{{ matrix_required_bootstrap_files }}"
+  register: matrix_secret_bootstrap_files
+  no_log: true
+
+- name: Assert required bootstrap secret file permissions
+  ansible.builtin.assert:
+    that:
+      - item.stat.exists
+      - item.stat.isreg
+      - item.stat.pw_name == 'root'
+      - item.stat.gr_name == 'root'
+      - item.stat.mode == '0600'
+    fail_msg: A required root-only Matrix bootstrap file is missing or has unsafe permissions.
+  loop: "{{ matrix_secret_bootstrap_files.results }}"
+  no_log: true
+
+- name: Inspect Kubernetes Secret metadata without retrieving values
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - describe
+      - secret
+      - "{{ item.name }}"
+      - --namespace={{ matrix_namespace }}
+  changed_when: false
+  loop: "{{ matrix_required_kubernetes_secrets }}"
+  register: matrix_secret_kubernetes_metadata
+  no_log: true
+
+- name: Assert required Kubernetes Secret keys exist
+  ansible.builtin.assert:
+    that:
+      - item.stdout is search('(?m)^' ~ key ~ ':')
+    fail_msg: Required Matrix Kubernetes Secret key is missing.
+  loop: "{{ matrix_secret_kubernetes_metadata.results | subelements('item.keys') }}"
+  loop_control:
+    loop_var: matrix_secret_key_check
+  vars:
+    item: "{{ matrix_secret_key_check.0 }}"
+    key: "{{ matrix_secret_key_check.1 }}"
+  no_log: true