Use 'inventory_hostname' instead of 'ansible_fqdn'

While 'ansible_fdqn' can be changed by a compromised host,
'inventory_hostname' can't (hopefully).

It should therefore no longer be possible for the said host to access
the backups of another host.
This commit is contained in:
jeltz 2021-03-15 07:25:09 +01:00
parent 243ec1fe9d
commit cb3ec07121

View file

@ -51,7 +51,7 @@
group: root group: root
mode: u=rw,g=r,o= mode: u=rw,g=r,o=
vars: vars:
borg_host_dir: "/borg/{{ ansible_fqdn }}" borg_host_dir: "/borg/{{ inventory_hostname }}"
- name: Create SSH key - name: Create SSH key
openssh_keypair: openssh_keypair:
@ -63,36 +63,11 @@
mode: u=rw,g=,o= mode: u=rw,g=,o=
register: ssh_key register: ssh_key
#- name: Gather server facts
# delegate_to: "{{ borg_server_host }}"
# delegate_facts: true
# setup:
# gather_subset:
# - all
# register: server_facts
#
#- name: Add server key to known hosts
# known_hosts:
# hash_host: true
# host: "{{ hostname }}"
# key: "{{ hostname }} {{ facts['ansible_ssh_host_key_' + item + '_public_keytype'] }} {{ facts['ansible_ssh_host_key_' + item + '_public'] }}"
# loop:
# - ecdsa
# - ed25519
# - rsa
# vars:
# hostname: {{ borg_server_host }}
# facts: {{ server_facts['ansible_facts'] }}
- name: Gather SSH host keys - name: Gather SSH host keys
delegate_to: "{{ borg_server_host }}" delegate_to: "{{ borg_server_host }}"
command: "ssh-keyscan {{ borg_server_host }}" command: "ssh-keyscan {{ borg_server_host }}"
register: keys register: keys
- name: DEBUG
debug:
var: keys.stdout_lines
- name: Add server key to known hosts - name: Add server key to known hosts
known_hosts: known_hosts:
hash_host: true hash_host: true
@ -109,7 +84,7 @@
key: "{{ ssh_key.public_key }}" key: "{{ ssh_key.public_key }}"
key_options: "{{ options | join(',') }}" key_options: "{{ options | join(',') }}"
vars: vars:
borg_host_dir: "/borg/{{ ansible_fqdn }}" borg_host_dir: "/borg/{{ inventory_hostname }}"
options: options:
- 'command="borg serve --restrict-to-path {{ borg_host_dir }}"' - 'command="borg serve --restrict-to-path {{ borg_host_dir }}"'
- no-agent-forwarding - no-agent-forwarding