feat(ansible): nas-1 and nas-2 trust the SSH user CA #1520

2026-10-29T10:01:00Z

claude-bot commented

2026-10-29 10:01:00 +00:00

nas-1 (Synology RS1221+, on again) and nas-2 (Synology DS1522+) join [ssh_ca] under [synology_nas], reached as root with the owner certificate like every other host. Only the SSH onboarding comes back for nas-1; the roles and plays removed in 9c9e45d1 stay removed.

The ssh-ca role now covers what DSM lacks:

Python 3.8 only: plays/configure-synology-python.yml installs Synology's Python3.9 package via raw; group_vars/synology_nas points the interpreter at it and pipes transfers.
No getent: admin logins are read from /etc/passwd on every host.
No useradd: the account is created with synouser and added to administrators, the only group DSM admits over SSH. synogroup --member replaces the list, so the current members are passed along and the run stops if the owner login is missing from them.
No visudo: the sudo rules are checked with visudo -c -f - on the controller, then written.
No Include in sshd_config: the role inserts it as the first line so the drop-in wins.

ssh_ca_claude_sudo_all (default false) gives claude-bot passwordless sudo; synology_nas sets it, since the DSM administrators rule asks for a password nobody knows.

site.yml also runs clean now:

ssh-ca reloads sshd only when the CA key, the Include or the drop-in changed.
Facts are read through ansible_facts (INJECT_FACTS_AS_VARS deprecation).
common masks systemd-timesyncd on guests only, not on KVM hosts such as a NAS running VMM.
netbird-client uses deb822_repository (apt_repository deprecation).

🤖 Generated with Claude Code

nas-1 (Synology RS1221+, on again) and nas-2 (Synology DS1522+) join `[ssh_ca]` under `[synology_nas]`, reached as root with the owner certificate like every other host. Only the SSH onboarding comes back for nas-1; the roles and plays removed in 9c9e45d1 stay removed. The ssh-ca role now covers what DSM lacks: - **Python 3.8 only**: `plays/configure-synology-python.yml` installs Synology's Python3.9 package via `raw`; `group_vars/synology_nas` points the interpreter at it and pipes transfers. - **No getent**: admin logins are read from `/etc/passwd` on every host. - **No useradd**: the account is created with `synouser` and added to `administrators`, the only group DSM admits over SSH. `synogroup --member` replaces the list, so the current members are passed along and the run stops if the owner login is missing from them. - **No visudo**: the sudo rules are checked with `visudo -c -f -` on the controller, then written. - **No Include in sshd_config**: the role inserts it as the first line so the drop-in wins. `ssh_ca_claude_sudo_all` (default `false`) gives claude-bot passwordless sudo; `synology_nas` sets it, since the DSM administrators rule asks for a password nobody knows. `site.yml` also runs clean now: - ssh-ca reloads sshd only when the CA key, the Include or the drop-in changed. - Facts are read through `ansible_facts` (INJECT_FACTS_AS_VARS deprecation). - `common` masks systemd-timesyncd on guests only, not on KVM hosts such as a NAS running VMM. - netbird-client uses `deb822_repository` (apt_repository deprecation). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-10-29 10:01:01 +00:00

feat(ansible): nas-2 trusts the SSH user CA

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

5c416f8578

nas-2 (Synology DSM 7.3) joins [ssh_ca] under a new [synology_nas] group,
so claude-bot reaches it with its 1h certificate like every other host.

DSM differs from the fleet in ways the ssh-ca role now handles:
- Python 3.8 only; plays/configure-synology-python.yml installs Synology's
  Python3.9 package via raw, and group_vars point the interpreter at it.
- No getent: admin logins come from /etc/passwd on every host.
- No useradd: the account is made with synouser and added to
  administrators (the only group DSM lets in over SSH). synogroup --member
  replaces the list, so the current members are read and passed along,
  and the run stops if the owner login is not among them.
- No visudo: the sudo rules are rendered and checked on the controller.
- sshd_config has no Include; the role puts it first.
- No sftp/scp for ladmin: transfers are piped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot added 1 commit 2026-10-29 10:20:27 +00:00

feat(ansible): claude-bot has full sudo on nas-2

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

c32dd3bdfd

On DSM claude-bot is in administrators, whose sudo rule asks for a
password nobody knows. ssh_ca_claude_sudo_all (default false) adds a
passwordless rule; synology_nas sets it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot added 1 commit 2026-10-29 10:27:35 +00:00

feat(ansible): nas-1 back in the inventory

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

2c22f66539

nas-1 is powered on again. It joins [synology_nas] and [ssh_ca] like
nas-2; the roles and plays dropped with it in 9c9e45d1 stay dropped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot changed title from ~~feat(ansible): nas-2 trusts the SSH user CA~~ to feat(ansible): nas-1 and nas-2 trust the SSH user CA

2026-10-29 10:27:41 +00:00

claude-bot added 1 commit 2026-10-29 10:30:02 +00:00

feat(ansible): Synology hosts are reached as root

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

3b1bd4cd2e

With the SSH CA in place, root accepts the owner certificate on DSM
(PermitRootLogin without-password), so runs need no become password,
as on every other host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot added 1 commit 2026-10-29 10:40:40 +00:00

fix(ansible): reach nas-1 as ladmin until it trusts the SSH CA

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

6dede6c422

root on nas-1 accepts no owner key or certificate yet, so the first
run has to go through ladmin with its become password.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot added 1 commit 2026-10-29 10:54:27 +00:00

feat(ansible): reach nas-1 as root

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

4d97dd6e1f

nas-1 trusts the SSH CA now; root accepts the owner certificate there,
as on nas-2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot added 1 commit 2026-10-29 11:04:40 +00:00

fix(ansible): site.yml runs without warnings or no-op changes

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

41cadcb3ac

- ssh-ca reloads sshd only when the CA key, the Include or the drop-in
  changed; principals and revoked keys are read per login.
- On DSM the sudo rules are checked with visudo -c -f - on the
  controller instead of a temporary file, which reported three changes
  per run.
- Facts are read through ansible_facts (INJECT_FACTS_AS_VARS
  deprecation) in common, qemu-guest-agent and keepalived-ntp.
- common masks systemd-timesyncd on guests only; a KVM host such as a
  NAS running VMM has no such unit.
- netbird-client uses deb822_repository (apt_repository deprecation) and
  removes the old one-line source.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot added 1 commit 2026-10-29 11:46:00 +00:00

fix(crowdsec-edge-bouncer): cache the release outside /tmp

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

9cb8e65d85

The archive was fetched into the controller's /tmp, so every run after a
/tmp cleanup downloaded it again and reported a change. It now lives in
~/.cache/ansible/crowdsec, like the netbird-client download.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 70bca9ed52 into main

2026-10-29 12:06:19 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1520