diff --git a/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-017-PLAN_Samba-NFS-Export.md b/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-017-PLAN_Samba-NFS-Export.md index 0583f9d..82d6917 100644 --- a/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-017-PLAN_Samba-NFS-Export.md +++ b/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-017-PLAN_Samba-NFS-Export.md @@ -223,7 +223,15 @@ GNENC-002 Abschnitt 4): `input/`, `jd/`, `queue/`, `work/`, `output/`, außerhalb des Home (UID 1002); die Gruppe `users` enthält es nicht mehr. (f) Der private `ghost`-SSH-Key erhielt am 27.10.2026 eine Passphrase (GNAI-011 Abschnitt - 3.3); Entsperrung über den lokalen ssh-agent. (g) Mount-Topologie und + 3.3); Entsperrung über den lokalen ssh-agent. **Key-Rotation 29.10.2026:** + Der Betreiber konnte sich die Passphrase nicht merken; das Paar + `id_ed25519_ghostnet_ct101_ghost` wurde daher neu erzeugt (neue Passphrase, + nur lokal beim Betreiber, nirgends protokolliert), der Public Key in + `files/ssh/samba-ghost.pub` aktualisiert und auf CT 101 in + `/home/ghost/.ssh/authorized_keys` ausgetauscht (Restrictions beibehalten, + alte Zeile entfernt). Das alte Paar liegt bis zur erfolgreichen + Audit-Anmeldung lokal als `id_ed25519_ghostnet_ct101_ghost.old` und wird + danach gelöscht. (g) Mount-Topologie und Ressourcen-Profil erfasst (27.10.2026, nach dem Reboot): Sechs Medien-Mounts sind produktiv eingehängt — `/media/daten1`, `/media/daten2`, `/media/daten3` (btrfs), `/media/datenhdd1` (ext4, leer, Verzeichnis auf der diff --git a/proxmox/lxc/ct-101-samba/ansible/files/ssh/samba-ghost.pub b/proxmox/lxc/ct-101-samba/ansible/files/ssh/samba-ghost.pub index c138742..ee734c8 100644 --- a/proxmox/lxc/ct-101-samba/ansible/files/ssh/samba-ghost.pub +++ b/proxmox/lxc/ct-101-samba/ansible/files/ssh/samba-ghost.pub @@ -1 +1 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICBlIsYEO2YSZVsWvLg891kh6JbMyS1eU+ypSVqXOId+ ghost@ghostnet-ct101 +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIChqL4SbGGBf0cnGyciE4RMvqpua/GoYcmz++BR2bdqW ghost@ghostnet-ct101 diff --git a/proxmox/lxc/ct-101-samba/ansible/playbooks/audit-production.yml b/proxmox/lxc/ct-101-samba/ansible/playbooks/audit-production.yml index cc591f2..435e983 100644 --- a/proxmox/lxc/ct-101-samba/ansible/playbooks/audit-production.yml +++ b/proxmox/lxc/ct-101-samba/ansible/playbooks/audit-production.yml @@ -93,7 +93,7 @@ - name: Read the productive Samba user database ansible.builtin.command: argv: - - /usr/sbin/pdbedit + - /usr/bin/pdbedit - -L check_mode: false changed_when: false @@ -105,7 +105,7 @@ - samba_audit_pdbedit.rc == 0 - >- samba_media_users | map(attribute='name') | list is - subset(samba_audit_pdbedit.stdout_lines) + subset(samba_audit_pdbedit.stdout_lines | map('regex_replace', '(:.*)$', '') | list) fail_msg: >- The productive SMB users ghost, daidalaw and debugofen are missing from the passdb. Stop the adoption; the passdb must not @@ -268,6 +268,7 @@ - "{{ item }}" check_mode: false changed_when: false + failed_when: false loop: - ssh.service - smbd.service diff --git a/proxmox/lxc/ct-101-samba/ansible/playbooks/backup.yml b/proxmox/lxc/ct-101-samba/ansible/playbooks/backup.yml index 218d7e2..729ecda 100644 --- a/proxmox/lxc/ct-101-samba/ansible/playbooks/backup.yml +++ b/proxmox/lxc/ct-101-samba/ansible/playbooks/backup.yml @@ -120,7 +120,7 @@ - name: Read the Samba user list ansible.builtin.command: argv: - - /usr/sbin/pdbedit + - /usr/bin/pdbedit - -L check_mode: false changed_when: false diff --git a/proxmox/lxc/ct-101-samba/ansible/playbooks/preflight.yml b/proxmox/lxc/ct-101-samba/ansible/playbooks/preflight.yml index 22b8ee7..4bb6ecc 100644 --- a/proxmox/lxc/ct-101-samba/ansible/playbooks/preflight.yml +++ b/proxmox/lxc/ct-101-samba/ansible/playbooks/preflight.yml @@ -172,6 +172,7 @@ - "{{ item }}" check_mode: false changed_when: false + failed_when: false loop: - ssh.service - smbd.service diff --git a/proxmox/lxc/ct-101-samba/ansible/playbooks/verify-production.yml b/proxmox/lxc/ct-101-samba/ansible/playbooks/verify-production.yml index 7205df8..a632f33 100644 --- a/proxmox/lxc/ct-101-samba/ansible/playbooks/verify-production.yml +++ b/proxmox/lxc/ct-101-samba/ansible/playbooks/verify-production.yml @@ -374,7 +374,7 @@ - name: Read the Samba user database ansible.builtin.command: argv: - - /usr/sbin/pdbedit + - /usr/bin/pdbedit - -L check_mode: false changed_when: false @@ -385,7 +385,7 @@ that: - >- samba_media_users | map(attribute='name') | list is - subset(samba_production_pdbedit.stdout_lines) + subset(samba_production_pdbedit.stdout_lines | map('regex_replace', '(:.*)$', '') | list) fail_msg: >- The productive SMB users ghost, daidalaw and debugofen are missing from the passdb (GNAI-018 R5). On a fresh-state rebuild, @@ -546,6 +546,7 @@ - "{{ item }}" check_mode: false changed_when: false + failed_when: false loop: - ssh.service - nftables.service diff --git a/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/README.md b/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/README.md index 7011565..0de7047 100644 --- a/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/README.md +++ b/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/README.md @@ -2,8 +2,10 @@ Declaratively manages the CT 101 Samba LXC baseline: guest identity (hostname `Samba`, Debian 13, `10.0.0.9`, LXC guest, systemd), the unprivileged -ID-mapping premise, baseline administration packages, the `Europe/Berlin` -timezone and the protected Ghostnet configuration/data/backup directories. +ID-mapping premise, baseline administration packages (afterwards +`unattended-upgrades.service` is enabled and started — CT 100/102 convention), +the `Europe/Berlin` timezone and the protected Ghostnet configuration/data/ +backup directories. It also masks `sys-kernel-config.mount` (configfs is unavailable in unprivileged LXC; CT 100/102/103 convention) and clears a stale failed state, so the no-failed-units gate of `playbooks/preflight.yml` holds. diff --git a/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/tasks/main.yml b/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/tasks/main.yml index cd0fc4e..42286de 100644 --- a/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/tasks/main.yml +++ b/proxmox/lxc/ct-101-samba/ansible/roles/samba_lxc_baseline/tasks/main.yml @@ -92,6 +92,13 @@ cache_valid_time: 3600 install_recommends: false +- name: Enable and start the unattended-upgrades service (CT 100/102 convention) + ansible.builtin.systemd_service: + name: unattended-upgrades.service + enabled: true + state: started + daemon_reload: true + - name: Set the local timezone database link ansible.builtin.file: src: "/usr/share/zoneinfo/{{ samba_lxc_baseline_timezone }}" diff --git a/proxmox/lxc/ct-101-samba/ansible/roles/samba_smb/tasks/main.yml b/proxmox/lxc/ct-101-samba/ansible/roles/samba_smb/tasks/main.yml index 5f2d073..5fd8d70 100644 --- a/proxmox/lxc/ct-101-samba/ansible/roles/samba_smb/tasks/main.yml +++ b/proxmox/lxc/ct-101-samba/ansible/roles/samba_smb/tasks/main.yml @@ -30,7 +30,7 @@ - name: Read the Samba user database before convergence ansible.builtin.command: argv: - - /usr/sbin/pdbedit + - /usr/bin/pdbedit - -L check_mode: false changed_when: false @@ -96,7 +96,7 @@ - name: Read the Samba user database after convergence ansible.builtin.command: argv: - - /usr/sbin/pdbedit + - /usr/bin/pdbedit - -L check_mode: false changed_when: false @@ -111,7 +111,7 @@ samba_smb_passdb_before.stdout_lines | sort - >- samba_media_users | map(attribute='name') | list is - subset(samba_smb_passdb_after.stdout_lines) + subset(samba_smb_passdb_after.stdout_lines | map('regex_replace', '(:.*)$', '') | list) fail_msg: >- The Samba user database changed during convergence. The productive users ghost, daidalaw and debugofen must be preserved @@ -155,6 +155,7 @@ - "{{ item }}" check_mode: false changed_when: false + failed_when: false loop: "{{ samba_smb_service_units }}" loop_control: label: "{{ item }}"