mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 14:34:43 +02:00
00d10234f9
- SOUL.md funk-ai : tableaux détaillés system vs monitor (quand appeler chaque agent avec exemples concrets), section delegate_task vs ask-agent - SOUL.md system : rôle clarifié (traitement texte, PAS analyse santé), format de réponse explicite (verdict direct, pas de préambule) - hermes-agent.service : SupplementaryGroups=systemd-journal pour que journalctl fonctionne sans sudo depuis le Terminal de Hermes - Ansible common : admin_user (alkatrazz) ajouté au groupe systemd-journal - admin/hermes.md : section SOUL.md complète (déploiement, contenu, profils) - admin/ask-agent.md : distinction system vs monitor documentée avec tableau et exemples, note /no_think, monitor réservé supervision Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
78 lines
1.9 KiB
YAML
78 lines
1.9 KiB
YAML
---
|
|
- name: Set hostname
|
|
ansible.builtin.hostname:
|
|
name: "{{ inventory_hostname }}"
|
|
|
|
- name: Set timezone
|
|
community.general.timezone:
|
|
name: "{{ timezone }}"
|
|
|
|
- name: Enable EPEL repository
|
|
ansible.builtin.dnf:
|
|
name: epel-release
|
|
state: present
|
|
|
|
- name: Upgrade all packages
|
|
ansible.builtin.dnf:
|
|
name: "*"
|
|
state: latest
|
|
update_cache: true
|
|
tags: update
|
|
notify: Reboot if kernel updated
|
|
|
|
- name: Install base packages
|
|
ansible.builtin.dnf:
|
|
name: "{{ base_packages }}"
|
|
state: present
|
|
|
|
- name: Enable and start chrony
|
|
ansible.builtin.systemd:
|
|
name: chronyd
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Create ansible group
|
|
ansible.builtin.group:
|
|
name: "{{ ansible_service_user }}"
|
|
state: present
|
|
|
|
- name: Create ansible user
|
|
ansible.builtin.user:
|
|
name: "{{ ansible_service_user }}"
|
|
group: "{{ ansible_service_user }}"
|
|
groups: wheel
|
|
shell: /bin/bash
|
|
create_home: true
|
|
state: present
|
|
|
|
- name: Allow ansible user passwordless sudo
|
|
ansible.builtin.copy:
|
|
dest: /etc/sudoers.d/ansible
|
|
content: "{{ ansible_service_user }} ALL=(ALL) NOPASSWD:ALL\n"
|
|
mode: '0440'
|
|
validate: /usr/sbin/visudo -cf %s
|
|
|
|
- name: Set up SSH authorized key for ansible user
|
|
ansible.posix.authorized_key:
|
|
user: "{{ ansible_service_user }}"
|
|
key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}"
|
|
state: present
|
|
|
|
- name: Add admin user to systemd-journal group
|
|
ansible.builtin.user:
|
|
name: "{{ admin_user }}"
|
|
groups: systemd-journal
|
|
append: true
|
|
when: admin_user is defined
|
|
|
|
- name: Harden sshd
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
state: present
|
|
loop:
|
|
- { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin no' }
|
|
- { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication no' }
|
|
- { regexp: '^#?X11Forwarding', line: 'X11Forwarding no' }
|
|
notify: Restart sshd
|