konairius/homelab
10
0
Fork 0
Code Issues 11 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

[safety][medium] Archived-but-executable destructive plays (fleet-wide zfs destroy, gitea cleanup) #207

New Issue
Closed
opened 2026-07-14 09:48:50 +00:00 by claude-bot · 1 comment
claude-bot commented 2026-07-14 09:48:50 +00:00
Member
Copy Link
Copy Source

Finding

ansible/plays/archived/ contains still-runnable destructive plays:

  • remove_ceph_cpool.yml:43-44 — 'zfs destroy -rf' looped over matching volumes on hosts: pve_cluster (whole Proxmox cluster), guarded only by a discovery-command rc, no confirmation var/allowlist.
  • cleanup-gitea-mess.yml:19-39 — deletes gitea service/binary/config/user on hosts: all:!gitea..., no when: guard.

Verified

Cited lines; files are in an 'archived' dir but not disabled — they execute if invoked.

Impact

An accidental or mistaken invocation is fleet-wide destructive.

Fix

Move to a non-runnable location, add explicit opt-in guards (a required confirmation var), or delete.

Automated security review 2026-07-14. Verified present.

## Finding ansible/plays/archived/ contains still-runnable destructive plays: - remove_ceph_cpool.yml:43-44 — 'zfs destroy -rf' looped over matching volumes on hosts: pve_cluster (whole Proxmox cluster), guarded only by a discovery-command rc, no confirmation var/allowlist. - cleanup-gitea-mess.yml:19-39 — deletes gitea service/binary/config/user on hosts: all:!gitea..., no when: guard. ## Verified Cited lines; files are in an 'archived' dir but not disabled — they execute if invoked. ## Impact An accidental or mistaken invocation is fleet-wide destructive. ## Fix Move to a non-runnable location, add explicit opt-in guards (a required confirmation var), or delete. --- _Automated security review 2026-07-14. Verified present._
claude-bot commented 2026-07-14 10:06:38 +00:00
Author
Member
Copy Link
Copy Source

Fixed. Added the confirm_destroy safety-switch pattern (same as plays/update-dist-upgrade.yml's confirm_upgrade) to both archived plays: remove_ceph_cpool.yml and cleanup-gitea-mess.yml now fail immediately with a clear message unless run with -e 'confirm_destroy=true'. Verified both files with ansible-playbook --syntax-check. PR: gitea_admin/homelab#219

Fixed. Added the confirm_destroy safety-switch pattern (same as plays/update-dist-upgrade.yml's confirm_upgrade) to both archived plays: remove_ceph_cpool.yml and cleanup-gitea-mess.yml now fail immediately with a clear message unless run with -e 'confirm_destroy=true'. Verified both files with ansible-playbook --syntax-check. PR: https://gitea.renner.uno/gitea_admin/homelab/pulls/219
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#207