The archive was fetched into the controller's /tmp, so every run after a
/tmp cleanup downloaded it again and reported a change. It now lives in
~/.cache/ansible/crowdsec, like the netbird-client download.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- ssh-ca reloads sshd only when the CA key, the Include or the drop-in
changed; principals and revoked keys are read per login.
- On DSM the sudo rules are checked with visudo -c -f - on the
controller instead of a temporary file, which reported three changes
per run.
- Facts are read through ansible_facts (INJECT_FACTS_AS_VARS
deprecation) in common, qemu-guest-agent and keepalived-ntp.
- common masks systemd-timesyncd on guests only; a KVM host such as a
NAS running VMM has no such unit.
- netbird-client uses deb822_repository (apt_repository deprecation) and
removes the old one-line source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
root on nas-1 accepts no owner key or certificate yet, so the first
run has to go through ladmin with its become password.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With the SSH CA in place, root accepts the owner certificate on DSM
(PermitRootLogin without-password), so runs need no become password,
as on every other host.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nas-1 is powered on again. It joins [synology_nas] and [ssh_ca] like
nas-2; the roles and plays dropped with it in 9c9e45d1 stay dropped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On DSM claude-bot is in administrators, whose sudo rule asks for a
password nobody knows. ssh_ca_claude_sudo_all (default false) adds a
passwordless rule; synology_nas sets it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nas-2 (Synology DSM 7.3) joins [ssh_ca] under a new [synology_nas] group,
so claude-bot reaches it with its 1h certificate like every other host.
DSM differs from the fleet in ways the ssh-ca role now handles:
- Python 3.8 only; plays/configure-synology-python.yml installs Synology's
Python3.9 package via raw, and group_vars point the interpreter at it.
- No getent: admin logins come from /etc/passwd on every host.
- No useradd: the account is made with synouser and added to
administrators (the only group DSM lets in over SSH). synogroup --member
replaces the list, so the current members are read and passed along,
and the run stops if the owner login is not among them.
- No visudo: the sudo rules are rendered and checked on the controller.
- sshd_config has no Include; the role puts it first.
- No sftp/scp for ladmin: transfers are piped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude-botandClaude Opus 5.5