Initial VPS operations handbook

2026-08-03 12:26:42 +08:00
commit b73125e5bc
97 changed files with 3641 additions and 0 deletions
@@ -0,0 +1,61 @@
+---
+- name: Inspect Matrix bootstrap directory without reading secrets
+  ansible.builtin.stat:
+    path: "{{ matrix_bootstrap_dir }}"
+  register: matrix_secret_bootstrap_dir
+
+- name: Assert Matrix bootstrap directory is root-only
+  ansible.builtin.assert:
+    that:
+      - matrix_secret_bootstrap_dir.stat.exists
+      - matrix_secret_bootstrap_dir.stat.isdir
+      - matrix_secret_bootstrap_dir.stat.pw_name == 'root'
+      - matrix_secret_bootstrap_dir.stat.gr_name == 'root'
+      - matrix_secret_bootstrap_dir.stat.mode == '0700'
+    fail_msg: "{{ matrix_bootstrap_dir }} must be a root:root 0700 directory."
+
+- name: Inspect required individual bootstrap secret files without reading them
+  ansible.builtin.stat:
+    path: "{{ matrix_bootstrap_dir }}/{{ item }}"
+  loop: "{{ matrix_required_bootstrap_files }}"
+  register: matrix_secret_bootstrap_files
+  no_log: true
+
+- name: Assert required bootstrap secret file permissions
+  ansible.builtin.assert:
+    that:
+      - item.stat.exists
+      - item.stat.isreg
+      - item.stat.pw_name == 'root'
+      - item.stat.gr_name == 'root'
+      - item.stat.mode == '0600'
+    fail_msg: A required root-only Matrix bootstrap file is missing or has unsafe permissions.
+  loop: "{{ matrix_secret_bootstrap_files.results }}"
+  no_log: true
+
+- name: Inspect Kubernetes Secret metadata without retrieving values
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - describe
+      - secret
+      - "{{ item.name }}"
+      - --namespace={{ matrix_namespace }}
+  changed_when: false
+  loop: "{{ matrix_required_kubernetes_secrets }}"
+  register: matrix_secret_kubernetes_metadata
+  no_log: true
+
+- name: Assert required Kubernetes Secret keys exist
+  ansible.builtin.assert:
+    that:
+      - item.stdout is search('(?m)^' ~ key ~ ':')
+    fail_msg: Required Matrix Kubernetes Secret key is missing.
+  loop: "{{ matrix_secret_kubernetes_metadata.results | subelements('item.keys') }}"
+  loop_control:
+    loop_var: matrix_secret_key_check
+  vars:
+    item: "{{ matrix_secret_key_check.0 }}"
+    key: "{{ matrix_secret_key_check.1 }}"
+  no_log: true