From 9b3b54bd998924a7b0d1fd0cb55096e252a53fc9 Mon Sep 17 00:00:00 2001 From: spektr Date: Mon, 26 Oct 2026 19:20:36 +0100 Subject: [PATCH] CT-100 DNS: Lookup-Pfade in audit-production.yml und verify-production.yml korrigiert MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 5 template/file-Lookups verwendeten relative Pfade (roles/..., files/...), die sich aus playbooks/ nicht auflösen; auf playbook_dir ~ '/../...' umgestellt - dns_pihole_container_name, dns_pihole_data_directory und dns_pihole_quadlet_path aus den Rollen-Defaults in alle 3 Inventories gespiegelt (self-contained inventory) - Verifiziert: gerendertes Quadlet byte-identisch mit Live-Datei, nftables weicht nur um die Managed-Kennung ab, 18/18 Syntax-Checks Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .../ct-100-dns/GNAI-012-PLAN_Pi-hole-DNS-Handoff.md | 13 ++++++++++++- .../inventories/agent/group_vars/dns_hosts.yml | 6 ++++++ .../inventories/bootstrap/group_vars/dns_hosts.yml | 6 ++++++ .../inventories/production/group_vars/dns_hosts.yml | 6 ++++++ .../ansible/playbooks/audit-production.yml | 6 +++--- .../ansible/playbooks/verify-production.yml | 4 ++-- 6 files changed, 35 insertions(+), 6 deletions(-) diff --git a/docs/platform/proxmox-server/lxc/ct-100-dns/GNAI-012-PLAN_Pi-hole-DNS-Handoff.md b/docs/platform/proxmox-server/lxc/ct-100-dns/GNAI-012-PLAN_Pi-hole-DNS-Handoff.md index 4222310..8c92a9b 100644 --- a/docs/platform/proxmox-server/lxc/ct-100-dns/GNAI-012-PLAN_Pi-hole-DNS-Handoff.md +++ b/docs/platform/proxmox-server/lxc/ct-100-dns/GNAI-012-PLAN_Pi-hole-DNS-Handoff.md @@ -3,7 +3,7 @@ **Dokumenten-ID:** GNAI-012-PLAN **Titel:** Pi-hole-LXC, FRITZ!Box-DNS und Split-DNS für interne Dienste **Status:** Implementiert und im LAN produktiv; Ansible-Sollzustand als CT-Projekt angelegt, privilegierte Live-Adoption und klar ausgewiesene Folgepunkte offen -**Stand:** 14.10.2026 +**Stand:** 21.10.2026 **Referenzen:** [Projekt-Roadmap](../../../../GNAI-001-PLAN_Project-Roadmap.md), [Zugriffskonzept](../../../GNAI-005-SEC_Access-Control.md), [LXC-SSH-Architektur](../../GNAI-011-SEC_LXC-SSH-Architecture.md), [Reverse Proxy](../ct-103-reverse-proxy/GNAI-006-SEC_Reverse-Proxy.md), [WireGuard](../ct-105-wireguard/GNAI-007-SEC_VPN.md) ## 1. Auftrag und Umsetzungsergebnis @@ -494,6 +494,17 @@ Projekt als bewusster Aufräumschritt deklariert. Die LXC-eigene Host-Namensauflösung funktioniert aktuell, der Aufbau bleibt aber schleifenempfindlich und ist als Folgepunkt erfasst. +Korrektur am 21.10.2026: Die `template`- und `file`-Lookups in +`audit-production.yml` und `verify-production.yml` verwendeten relative Pfade +(`roles/...`, `files/...`), die sich aus dem Playbook-Verzeichnis nicht +auflösen. Die Pfade wurden auf `playbook_dir ~ '/../...'` umgestellt, und die +dafür benötigten Variablen (`dns_pihole_container_name`, +`dns_pihole_data_directory`, `dns_pihole_quadlet_path`) wurden aus den +Rollen-Defaults in alle drei Inventories gespiegelt (self-contained inventory). +Lokal verifiziert: Der Lookup-Render des Quadlet-Templates ist byte-identisch +mit der Live-Datei, die nftables-Vorlage weicht nur um die Managed-Kennung +ab; alle 18 Syntax-Checks (6 Playbooks × 3 Inventories) bestehen. + ## 11. Primärquellen - [Pi-hole – Voraussetzungen](https://docs.pi-hole.net/main/prerequisites/) diff --git a/proxmox/lxc/ct-100-dns/ansible/inventories/agent/group_vars/dns_hosts.yml b/proxmox/lxc/ct-100-dns/ansible/inventories/agent/group_vars/dns_hosts.yml index 48ec1a9..a0de1cd 100644 --- a/proxmox/lxc/ct-100-dns/ansible/inventories/agent/group_vars/dns_hosts.yml +++ b/proxmox/lxc/ct-100-dns/ansible/inventories/agent/group_vars/dns_hosts.yml @@ -33,5 +33,11 @@ dns_pihole_hosts_records: dns_pihole_timezone: Europe/Berlin dns_pihole_database_max_db_days: 30 dns_pihole_secret_name: pihole_web_password +# Mirrored from the role defaults so that verify-production.yml and +# audit-production.yml can render the templates via lookup and compare them +# with the live files (self-contained inventory): +dns_pihole_container_name: pihole +dns_pihole_data_directory: /opt/pihole/etc-pihole +dns_pihole_quadlet_path: /etc/containers/systemd/pihole.container dns_pihole_stale_quadlet_files: - pihole.container.before-password-fix-20261001 diff --git a/proxmox/lxc/ct-100-dns/ansible/inventories/bootstrap/group_vars/dns_hosts.yml b/proxmox/lxc/ct-100-dns/ansible/inventories/bootstrap/group_vars/dns_hosts.yml index 48ec1a9..a0de1cd 100644 --- a/proxmox/lxc/ct-100-dns/ansible/inventories/bootstrap/group_vars/dns_hosts.yml +++ b/proxmox/lxc/ct-100-dns/ansible/inventories/bootstrap/group_vars/dns_hosts.yml @@ -33,5 +33,11 @@ dns_pihole_hosts_records: dns_pihole_timezone: Europe/Berlin dns_pihole_database_max_db_days: 30 dns_pihole_secret_name: pihole_web_password +# Mirrored from the role defaults so that verify-production.yml and +# audit-production.yml can render the templates via lookup and compare them +# with the live files (self-contained inventory): +dns_pihole_container_name: pihole +dns_pihole_data_directory: /opt/pihole/etc-pihole +dns_pihole_quadlet_path: /etc/containers/systemd/pihole.container dns_pihole_stale_quadlet_files: - pihole.container.before-password-fix-20261001 diff --git a/proxmox/lxc/ct-100-dns/ansible/inventories/production/group_vars/dns_hosts.yml b/proxmox/lxc/ct-100-dns/ansible/inventories/production/group_vars/dns_hosts.yml index 48ec1a9..a0de1cd 100644 --- a/proxmox/lxc/ct-100-dns/ansible/inventories/production/group_vars/dns_hosts.yml +++ b/proxmox/lxc/ct-100-dns/ansible/inventories/production/group_vars/dns_hosts.yml @@ -33,5 +33,11 @@ dns_pihole_hosts_records: dns_pihole_timezone: Europe/Berlin dns_pihole_database_max_db_days: 30 dns_pihole_secret_name: pihole_web_password +# Mirrored from the role defaults so that verify-production.yml and +# audit-production.yml can render the templates via lookup and compare them +# with the live files (self-contained inventory): +dns_pihole_container_name: pihole +dns_pihole_data_directory: /opt/pihole/etc-pihole +dns_pihole_quadlet_path: /etc/containers/systemd/pihole.container dns_pihole_stale_quadlet_files: - pihole.container.before-password-fix-20261001 diff --git a/proxmox/lxc/ct-100-dns/ansible/playbooks/audit-production.yml b/proxmox/lxc/ct-100-dns/ansible/playbooks/audit-production.yml index bd3d4c8..8285729 100644 --- a/proxmox/lxc/ct-100-dns/ansible/playbooks/audit-production.yml +++ b/proxmox/lxc/ct-100-dns/ansible/playbooks/audit-production.yml @@ -56,7 +56,7 @@ - >- dns_audit_quadlet['content'] | b64decode == lookup('ansible.builtin.template', - 'roles/dns_pihole/templates/pihole.container.j2') + playbook_dir ~ '/../roles/dns_pihole/templates/pihole.container.j2') success_msg: The live Pi-hole Quadlet matches the declared state. fail_msg: >- The live Pi-hole Quadlet differs from the declared template. @@ -72,7 +72,7 @@ {{ 'managed-marker-only' if dns_audit_nft['content'] | b64decode == lookup('ansible.builtin.template', - 'roles/dns_firewall/templates/nftables.conf.j2') + playbook_dir ~ '/../roles/dns_firewall/templates/nftables.conf.j2') else 'nftables.conf differs from the template' }} - name: Validate the effective SSH policy @@ -117,7 +117,7 @@ that: - >- lookup('ansible.builtin.file', - 'files/ssh/dns-ghost.pub') | trim in + playbook_dir ~ '/../files/ssh/dns-ghost.pub') | trim in dns_audit_admin_keys['content'] | b64decode fail_msg: >- The declared personal admin key is not present in the live ghost diff --git a/proxmox/lxc/ct-100-dns/ansible/playbooks/verify-production.yml b/proxmox/lxc/ct-100-dns/ansible/playbooks/verify-production.yml index 219d3dc..c3c7a15 100644 --- a/proxmox/lxc/ct-100-dns/ansible/playbooks/verify-production.yml +++ b/proxmox/lxc/ct-100-dns/ansible/playbooks/verify-production.yml @@ -138,7 +138,7 @@ - >- dns_production_nft_config['content'] | b64decode == lookup('ansible.builtin.template', - 'roles/dns_firewall/templates/nftables.conf.j2') + playbook_dir ~ '/../roles/dns_firewall/templates/nftables.conf.j2') fail_msg: >- /etc/nftables.conf differs from the declared template. @@ -153,7 +153,7 @@ - >- dns_production_quadlet['content'] | b64decode == lookup('ansible.builtin.template', - 'roles/dns_pihole/templates/pihole.container.j2') + playbook_dir ~ '/../roles/dns_pihole/templates/pihole.container.j2') fail_msg: >- The Pi-hole Quadlet differs from the declared template.