ghostnet.ai/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CT-100 DNS: Lookup-Pfade in audit-production.yml und verify-production.yml korrigiert

Browse Source 
- 5 template/file-Lookups verwendeten relative Pfade (roles/..., files/...),
  die sich aus playbooks/ nicht auflösen; auf playbook_dir ~ '/../...' umgestellt
- dns_pihole_container_name, dns_pihole_data_directory und dns_pihole_quadlet_path
  aus den Rollen-Defaults in alle 3 Inventories gespiegelt (self-contained inventory)
- Verifiziert: gerendertes Quadlet byte-identisch mit Live-Datei, nftables weicht
  nur um die Managed-Kennung ab, 18/18 Syntax-Checks

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
This commit is contained in:
spektr
2026-10-26 19:20:36 +01:00
parent 220d921e09
commit 9b3b54bd99
6 changed files with 35 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/platform/proxmox-server/lxc/ct-100-dns/GNAI-012-PLAN_Pi-hole-DNS-Handoff.md
+12 -1
View File
@@ -3,7 +3,7 @@
**Dokumenten-ID:** GNAI-012-PLAN
**Titel:** Pi-hole-LXC, FRITZ!Box-DNS und Split-DNS für interne Dienste
**Status:** Implementiert und im LAN produktiv; Ansible-Sollzustand als CT-Projekt angelegt, privilegierte Live-Adoption und klar ausgewiesene Folgepunkte offen
**Stand:** 14.10.2026
**Stand:** 21.10.2026
**Referenzen:** [Projekt-Roadmap](../../../../GNAI-001-PLAN_Project-Roadmap.md), [Zugriffskonzept](../../../GNAI-005-SEC_Access-Control.md), [LXC-SSH-Architektur](../../GNAI-011-SEC_LXC-SSH-Architecture.md), [Reverse Proxy](../ct-103-reverse-proxy/GNAI-006-SEC_Reverse-Proxy.md), [WireGuard](../ct-105-wireguard/GNAI-007-SEC_VPN.md)
## 1. Auftrag und Umsetzungsergebnis
@@ -494,6 +494,17 @@ Projekt als bewusster Aufräumschritt deklariert. Die LXC-eigene
Host-Namensauflösung funktioniert aktuell, der Aufbau bleibt aber
schleifenempfindlich und ist als Folgepunkt erfasst.
Korrektur am 21.10.2026: Die `template`- und `file`-Lookups in
`audit-production.yml` und `verify-production.yml` verwendeten relative Pfade
(`roles/...`, `files/...`), die sich aus dem Playbook-Verzeichnis nicht
auflösen. Die Pfade wurden auf `playbook_dir ~ '/../...'` umgestellt, und die
dafür benötigten Variablen (`dns_pihole_container_name`,
`dns_pihole_data_directory`, `dns_pihole_quadlet_path`) wurden aus den
Rollen-Defaults in alle drei Inventories gespiegelt (self-contained inventory).
Lokal verifiziert: Der Lookup-Render des Quadlet-Templates ist byte-identisch
mit der Live-Datei, die nftables-Vorlage weicht nur um die Managed-Kennung
ab; alle 18 Syntax-Checks (6 Playbooks × 3 Inventories) bestehen.
## 11. Primärquellen
- [Pi-hole – Voraussetzungen](https://docs.pi-hole.net/main/prerequisites/)
proxmox/lxc/ct-100-dns/ansible/inventories/agent/group_vars/dns_hosts.yml
+6
View File
@@ -33,5 +33,11 @@ dns_pihole_hosts_records:
dns_pihole_timezone: Europe/Berlin
dns_pihole_database_max_db_days: 30
dns_pihole_secret_name: pihole_web_password
# Mirrored from the role defaults so that verify-production.yml and
# audit-production.yml can render the templates via lookup and compare them
# with the live files (self-contained inventory):
dns_pihole_container_name: pihole
dns_pihole_data_directory: /opt/pihole/etc-pihole
dns_pihole_quadlet_path: /etc/containers/systemd/pihole.container
dns_pihole_stale_quadlet_files:
- pihole.container.before-password-fix-20261001
proxmox/lxc/ct-100-dns/ansible/inventories/bootstrap/group_vars/dns_hosts.yml
+6
View File
@@ -33,5 +33,11 @@ dns_pihole_hosts_records:
dns_pihole_timezone: Europe/Berlin
dns_pihole_database_max_db_days: 30
dns_pihole_secret_name: pihole_web_password
# Mirrored from the role defaults so that verify-production.yml and
# audit-production.yml can render the templates via lookup and compare them
# with the live files (self-contained inventory):
dns_pihole_container_name: pihole
dns_pihole_data_directory: /opt/pihole/etc-pihole
dns_pihole_quadlet_path: /etc/containers/systemd/pihole.container
dns_pihole_stale_quadlet_files:
- pihole.container.before-password-fix-20261001
proxmox/lxc/ct-100-dns/ansible/inventories/production/group_vars/dns_hosts.yml
+6
View File
@@ -33,5 +33,11 @@ dns_pihole_hosts_records:
dns_pihole_timezone: Europe/Berlin
dns_pihole_database_max_db_days: 30
dns_pihole_secret_name: pihole_web_password
# Mirrored from the role defaults so that verify-production.yml and
# audit-production.yml can render the templates via lookup and compare them
# with the live files (self-contained inventory):
dns_pihole_container_name: pihole
dns_pihole_data_directory: /opt/pihole/etc-pihole
dns_pihole_quadlet_path: /etc/containers/systemd/pihole.container
dns_pihole_stale_quadlet_files:
- pihole.container.before-password-fix-20261001
proxmox/lxc/ct-100-dns/ansible/playbooks/audit-production.yml
+3 -3
View File
@@ -56,7 +56,7 @@
- >-
dns_audit_quadlet['content'] | b64decode ==
lookup('ansible.builtin.template',
'roles/dns_pihole/templates/pihole.container.j2')
playbook_dir ~ '/../roles/dns_pihole/templates/pihole.container.j2')
success_msg: The live Pi-hole Quadlet matches the declared state.
fail_msg: >-
The live Pi-hole Quadlet differs from the declared template.
@@ -72,7 +72,7 @@
{{ 'managed-marker-only' if
dns_audit_nft['content'] | b64decode ==
lookup('ansible.builtin.template',
'roles/dns_firewall/templates/nftables.conf.j2')
playbook_dir ~ '/../roles/dns_firewall/templates/nftables.conf.j2')
else 'nftables.conf differs from the template' }}
- name: Validate the effective SSH policy
@@ -117,7 +117,7 @@
that:
- >-
lookup('ansible.builtin.file',
'files/ssh/dns-ghost.pub') | trim in
playbook_dir ~ '/../files/ssh/dns-ghost.pub') | trim in
dns_audit_admin_keys['content'] | b64decode
fail_msg: >-
The declared personal admin key is not present in the live ghost
proxmox/lxc/ct-100-dns/ansible/playbooks/verify-production.yml
+2 -2
View File
@@ -138,7 +138,7 @@
- >-
dns_production_nft_config['content'] | b64decode ==
lookup('ansible.builtin.template',
'roles/dns_firewall/templates/nftables.conf.j2')
playbook_dir ~ '/../roles/dns_firewall/templates/nftables.conf.j2')
fail_msg: >-
/etc/nftables.conf differs from the declared template.
@@ -153,7 +153,7 @@
- >-
dns_production_quadlet['content'] | b64decode ==
lookup('ansible.builtin.template',
'roles/dns_pihole/templates/pihole.container.j2')
playbook_dir ~ '/../roles/dns_pihole/templates/pihole.container.j2')
fail_msg: >-
The Pi-hole Quadlet differs from the declared template.