File size: 3,988 Bytes
9425aed | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 | ---
- name: SOV-KERNEL-MONSTER | Bootstrap Sovereign Infrastructure
hosts: sov-kernel-monster
gather_facts: true
vars_files:
- ../inventory/sov-local.yml
tasks:
# PHASE 1: WORM VOLUME
- name: Ensure Sovereign Root Directory
file:
path: "{{ sov_root }}"
state: directory
mode: '0700'
owner: root
group: root
- name: Create Sparse WORM Disk Image ({{ worm_size_gib }}GiB)
command: "truncate -s {{ worm_size_gib }}G {{ worm_disk_image }}"
args:
creates: "{{ worm_disk_image }}"
register: disk_created
- name: Format WORM Volume (ext4 + metadata checksums)
command: "mkfs.ext4 -O metadata_csum,dir_index -L SOV_GIT_WORM {{ worm_disk_image }}"
when: disk_created.changed
- name: Ensure loop module loaded
modprobe:
name: loop
state: present
- name: Mount WORM Volume
mount:
path: "{{ worm_mount_point }}"
src: "{{ worm_loop_device }}"
fstype: ext4
opts: "rw,noatime,errors=remount-ro"
state: mounted
- name: Apply immutable flag to mount point
command: "chattr +i {{ worm_mount_point }}"
changed_when: false
failed_when: false
# PHASE 2: ED25519 KEY GENERATION
- name: Create Sovereign Key Directory (0700)
file:
path: "{{ key_dir }}"
state: directory
mode: '0700'
owner: "{{ ansible_user_id }}"
- name: Generate Ed25519 Keypairs
community.crypto.openssh_keypair:
path: "{{ key_dir }}/{{ item.id }}"
type: ed25519
comment: "sov-{{ item.role }}-{{ item.id }}@sov-kernel-monster"
force: false
loop: "{{ identities }}"
no_log: true
- name: Set private key permissions (0400)
file:
path: "{{ key_dir }}/{{ item.id }}"
mode: '0400'
loop: "{{ identities }}"
- name: Write consolidated authorized_keys.sov
copy:
content: "{{ identities | map(attribute='id') | map('regex_replace', '^(.*)$', key_dir + '/\\1.pub') | map('lookup', 'file') | join('\n') }}"
dest: "{{ key_dir }}/authorized_keys.sov"
mode: '0440'
# PHASE 3: PROLOG RULES
- name: Deploy Prolog verification logic
copy:
src: "../../.sov/prolog/"
dest: "{{ sov_root }}/.sov/prolog/"
mode: '0500'
# PHASE 4: GIT HOOKS
- name: Deploy server-side hooks
copy:
src: "../../infra/hooks/"
dest: "{{ worm_mount_point }}/gitea/hooks/"
mode: '0500'
owner: "1000"
group: "1000"
# PHASE 5: TRUST DEED IMMUTABILITY
- name: Copy Trust Deed to WORM root
copy:
src: "../../TRUST_DEED.xml"
dest: "{{ worm_mount_point }}/TRUST_DEED.xml"
mode: '0400'
owner: "1000"
- name: Apply immutable flag to Trust Deed
command: "chattr +i {{ worm_mount_point }}/TRUST_DEED.xml"
# PHASE 6: ATTESTATION REPORT
- name: Generate provisioning attestation report
copy:
content: |
SOV-KERNEL-MONSTER PROVISIONING ATTESTATION
Timestamp: {{ ansible_date_time.iso8601 }}
Host: {{ inventory_hostname }}
WORM Volume: {{ worm_disk_image }} ({{ worm_size_gib }}GiB)
Mount: {{ worm_mount_point }}
Identities:
{% for i in identities %}
- {{ i.id }} ({{ i.role }}) [{{ i.constraint }}]
{% endfor %}
Trust Deed: {{ worm_mount_point }}/TRUST_DEED.xml [IMMUTABLE]
dest: "{{ sov_root }}/.sov/attestation_{{ ansible_date_time.iso8601_basic }}.log"
mode: '0400'
post_tasks:
- name: Display sovereign key fingerprints
debug:
msg: "{{ item.id }}: {{ lookup('pipe', 'ssh-keygen -lf ' + key_dir + '/' + item.id + '.pub') }}"
loop: "{{ identities }}"
tags: [audit]
|