luke/ansible-roles/rpi-base/tasks, branch mainAnsible roles for nth.io infrastructure
https://src.nth.io/luke/ansible-roles/atom?h=main2026-08-01T14:53:44Zrpi-base: role-owned netplan replaces wpa_supplicant; auto-upgrades gain -updates and 04:00 reboot2026-08-01T14:53:44ZLuke Hoerstenluke@hoersten.org2026-08-01T14:53:44Zurn:sha1:a457c0932b697fd32febe79c473c7e06dccd355a
Networking: one 40-net.yaml (eth0 always, wifi via rpi_base_wifi_*) with
cloud-init's 50-cloud-init.yaml deleted after first boot. cloud-init still
renders it on an instance_id bump, and it sorts later, so editing the
card's network-config and bumping meta-data is the headless rescue path.
ssh_deletekeys off so a rescue bump keeps the host keys.
Auto-updates: periodic switches and local policy merged into one
52unattended-upgrades-local; 50unattended-upgrades stays a distro
conffile and debconf's 20auto-upgrades can no longer disable anything.
rpi-base: drop the duplicate cloud-init logrotate config2026-07-31T19:47:57ZLuke Hoerstenluke@hoersten.org2026-07-31T19:47:57Zurn:sha1:3ad4754b313d21d8969405e89f9b9aeb77d799ac
26.04 ships the same snippet from both cloud-init and cloud-init-base;
the duplicate log entry made every logrotate run exit 1 fleet-wide.
Keep the base one; dpkg remembers conffile deletions across upgrades.
install from the 26.04 archive instead of third-party sources2026-07-31T19:31:51ZLuke Hoerstenluke@hoersten.org2026-07-31T19:31:51Zurn:sha1:846782c44c1c65e7b755de76fd50d86fc7c9636e
- rpi-base: log2ram from the archive, drop the azlux repo (which still
pointed at debian buster)
- aws-s3-backup: apt awscli (v2) instead of pip v1; drop boto3, nothing
used it
- scrypted, koreader-sync: docker.io and docker-compose-v2 instead of
the docker.com repo pinned to noble; the docker-ce removal lives in
cleanup-third-party.yaml since the packages collide on files
- miniflux: the archive package with a dbconfig preseed; drops the
github binary download and the bundled unit
- prometheus/client: note the nginx and postgres exporters are in apt
- dendrite/build, nostr/build: unversioned golang-go instead of pinned
golang-1.21-go and a hand symlink that shadowed the real go
rpi-base: skip terminfo sync when the controller TERM has no entry2026-07-30T23:19:08ZLuke Hoerstenluke@hoersten.org2026-07-30T23:19:08Zurn:sha1:60a318263bb345b966e2d8e1ace658464150abf9
infocmp fails when ansible runs from a terminal without a compiled
terminfo entry (e.g. emacs eshell, TERM=emacs); treat that as skip
instead of failing the play.
Harden role security: file permissions, service binding, no_log, strict defaults2026-04-06T02:19:55ZLuke Hoerstenluke@hoersten.org2026-04-06T02:19:55Zurn:sha1:06b69bd8def0aae07d3fb565d19193be1a8dfe20
- Add no_log: true to tasks that handle passwords/secrets
- Tighten config file permissions (0644 -> 0600/0640 where appropriate)
- Bind pleroma to 127.0.0.1 instead of 0.0.0.0
- Tighten ergo unix socket mode 0777 -> 0770
- Remove weak defaults; roles now fail explicitly if required vars not set
Added soju role.2026-03-28T18:42:08ZLuke Hoerstenluke@hoersten.org2026-03-28T18:42:08Zurn:sha1:45da5bca82200af63b0ee16479b267eb209386f3Fixed log rotation and log2ram sizing.2026-03-24T03:22:36ZLuke Hoerstenluke@hoersten.org2026-03-24T03:22:36Zurn:sha1:1859f62813f0c586ea49f912944fb25efd60520fAdded task to ensure log2ram is running.2024-07-20T18:51:46ZLuke Hoerstenluke@hoersten.org2024-07-20T18:51:46Zurn:sha1:a13b976c683a4963cc129a4399e79698437e2f8dMinor cleanup.2024-01-18T22:04:11ZLuke Hoerstenluke@hoersten.org2024-01-18T22:04:11Zurn:sha1:5fcee5ab24ac6c70849ab6834ef52f18fc6d7081Added trusted keys and https2022-10-22T19:51:35ZLuke Hoerstenluke@hoersten.org2022-10-22T19:51:35Zurn:sha1:9da13ed7b10e79af734ad725e3649caf55b7255a