Use 'inventory_hostname' instead of 'ansible_fqdn'
While 'ansible_fdqn' can be changed by a compromised host, 'inventory_hostname' can't (hopefully). It should therefore no longer be possible for the said host to access the backups of another host.
This commit is contained in:
parent
243ec1fe9d
commit
cb3ec07121
1 changed files with 2 additions and 27 deletions
|
@ -51,7 +51,7 @@
|
||||||
group: root
|
group: root
|
||||||
mode: u=rw,g=r,o=
|
mode: u=rw,g=r,o=
|
||||||
vars:
|
vars:
|
||||||
borg_host_dir: "/borg/{{ ansible_fqdn }}"
|
borg_host_dir: "/borg/{{ inventory_hostname }}"
|
||||||
|
|
||||||
- name: Create SSH key
|
- name: Create SSH key
|
||||||
openssh_keypair:
|
openssh_keypair:
|
||||||
|
@ -63,36 +63,11 @@
|
||||||
mode: u=rw,g=,o=
|
mode: u=rw,g=,o=
|
||||||
register: ssh_key
|
register: ssh_key
|
||||||
|
|
||||||
#- name: Gather server facts
|
|
||||||
# delegate_to: "{{ borg_server_host }}"
|
|
||||||
# delegate_facts: true
|
|
||||||
# setup:
|
|
||||||
# gather_subset:
|
|
||||||
# - all
|
|
||||||
# register: server_facts
|
|
||||||
#
|
|
||||||
#- name: Add server key to known hosts
|
|
||||||
# known_hosts:
|
|
||||||
# hash_host: true
|
|
||||||
# host: "{{ hostname }}"
|
|
||||||
# key: "{{ hostname }} {{ facts['ansible_ssh_host_key_' + item + '_public_keytype'] }} {{ facts['ansible_ssh_host_key_' + item + '_public'] }}"
|
|
||||||
# loop:
|
|
||||||
# - ecdsa
|
|
||||||
# - ed25519
|
|
||||||
# - rsa
|
|
||||||
# vars:
|
|
||||||
# hostname: {{ borg_server_host }}
|
|
||||||
# facts: {{ server_facts['ansible_facts'] }}
|
|
||||||
|
|
||||||
- name: Gather SSH host keys
|
- name: Gather SSH host keys
|
||||||
delegate_to: "{{ borg_server_host }}"
|
delegate_to: "{{ borg_server_host }}"
|
||||||
command: "ssh-keyscan {{ borg_server_host }}"
|
command: "ssh-keyscan {{ borg_server_host }}"
|
||||||
register: keys
|
register: keys
|
||||||
|
|
||||||
- name: DEBUG
|
|
||||||
debug:
|
|
||||||
var: keys.stdout_lines
|
|
||||||
|
|
||||||
- name: Add server key to known hosts
|
- name: Add server key to known hosts
|
||||||
known_hosts:
|
known_hosts:
|
||||||
hash_host: true
|
hash_host: true
|
||||||
|
@ -109,7 +84,7 @@
|
||||||
key: "{{ ssh_key.public_key }}"
|
key: "{{ ssh_key.public_key }}"
|
||||||
key_options: "{{ options | join(',') }}"
|
key_options: "{{ options | join(',') }}"
|
||||||
vars:
|
vars:
|
||||||
borg_host_dir: "/borg/{{ ansible_fqdn }}"
|
borg_host_dir: "/borg/{{ inventory_hostname }}"
|
||||||
options:
|
options:
|
||||||
- 'command="borg serve --restrict-to-path {{ borg_host_dir }}"'
|
- 'command="borg serve --restrict-to-path {{ borg_host_dir }}"'
|
||||||
- no-agent-forwarding
|
- no-agent-forwarding
|
||||||
|
|
Loading…
Reference in a new issue