Update initial_install/roles/freeipa_client/tasks/main.yml

initial_install/collections/requirements.yml

@@ -0,0 +1,2 @@
+collections:
+  - name: freeipa.ansible_freeipa

initial_install/playbook.yml

@@ -0,0 +1,35 @@
+---
+- name: Baseline system setup
+  hosts: all
+  become: true
+
+  roles:
+    - role: baseline_sudo
+      tags: sudo
+
+    - role: users
+      tags: users
+
+# ==============================
+# FREEIPA / SSSD (optional)
+# ==============================
+
+- name: FreeIPA client setup
+  hosts: all
+  become: true
+  tags: never,sssd
+
+  roles:
+    - role: freeipa_client
+
+# ==============================
+# SSH HARDENING (run last!)
+# ==============================
+
+- name: SSH hardening
+  hosts: all
+  become: true
+  tags: never,hardening
+
+  roles:
+    - role: ssh_hardening

initial_install/roles/baseline_sudo/tasks/main.yml

@@ -0,0 +1,23 @@
+---
+- name: Ensure sudo package is installed
+  ansible.builtin.package:
+    name: sudo
+    state: present
+
+- name: Ensure automation user has passwordless sudo
+  ansible.builtin.copy:
+    dest: /etc/sudoers.d/automation
+    owner: root
+    group: root
+    mode: '0440'
+    content: |
+      automation ALL=(ALL:ALL) NOPASSWD: ALL
+    validate: 'visudo -cf %s'
+
+- name: Ensure sudo binary has correct permissions
+  ansible.builtin.file:
+    path: /usr/bin/sudo
+    owner: root
+    group: root
+    mode: '4755'
+  when: ansible_facts.os_family in ["Debian", "RedHat"]

initial_install/roles/freeipa_client/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart SSSD
+  ansible.builtin.service:
+    name: sssd
+    state: restarted

initial_install/roles/freeipa_client/tasks/main.yml

@@ -0,0 +1,57 @@
+---
+- name: Install FreeIPA client packages
+  ansible.builtin.package:
+    name:
+      - freeipa-client
+      - sssd
+      - sssd-tools
+      - oddjob
+      - oddjob-mkhomedir
+    state: present
+
+- name: Set hostname FQDN
+  ansible.builtin.hostname:
+    name: "{{ inventory_hostname }}.im.lab"
+
+- name: Check if FreeIPA client is already configured
+  ansible.builtin.stat:
+    path: /etc/ipa/default.conf
+  register: ipa_client_conf
+
+- name: Enroll to FreeIPA
+  ansible.builtin.command:
+    argv:
+      - ipa-client-install
+      - --domain=im.lab
+      - --realm=IM.LAB
+      - --server=ipa.im.lab
+      - "--hostname={{ inventory_hostname }}.im.lab"
+      - --mkhomedir
+      - --principal=admin
+      - --password={{ ipa_admin_password }}
+      - --unattended
+      - --force-join
+  no_log: false
+  when: not ipa_client_conf.stat.exists
+
+- name: Enable mkhomedir
+  ansible.builtin.command:
+    argv:
+      - authselect
+      - enable-feature
+      - with-mkhomedir
+  register: authselect_mkhomedir
+  changed_when: "'already enabled' not in authselect_mkhomedir.stdout"
+  failed_when: false
+
+- name: Enable and start oddjobd
+  ansible.builtin.service:
+    name: oddjobd
+    state: started
+    enabled: true
+
+- name: Enable and start SSSD
+  ansible.builtin.service:
+    name: sssd
+    state: started
+    enabled: true

initial_install/roles/ssh_hardening/handlers/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Restart SSH
+  ansible.builtin.service:
+    name: "{{ 'sshd'
+              if ansible_facts.os_family in
+              ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse']
+              else 'ssh' }}"
+    state: restarted

initial_install/roles/ssh_hardening/tasks/main.yml

@@ -0,0 +1,29 @@
+---
+- name: Detect if system is Proxmox
+  ansible.builtin.stat:
+    path: /usr/bin/pveversion
+  register: proxmox_check
+
+- name: Ensure sshd_config.d exists
+  ansible.builtin.file:
+    path: /etc/ssh/sshd_config.d
+    state: directory
+
+- name: Deploy SSH hardening config
+  ansible.builtin.copy:
+    dest: /etc/ssh/sshd_config.d/99-ansible-hardening.conf
+    mode: '0644'
+    content: |
+      PasswordAuthentication no
+      ChallengeResponseAuthentication no
+      PubkeyAuthentication yes
+      AuthenticationMethods publickey
+      UsePAM yes
+
+      {% if not proxmox_check.stat.exists %}
+      PermitRootLogin no
+      {% else %}
+      PermitRootLogin prohibit-password
+      {% endif %}
+    validate: 'sshd -t -f %s'
+  notify: Restart SSH

initial_install/roles/users/tasks/main.yml

@@ -0,0 +1,62 @@
+---
+- name: Define users
+  ansible.builtin.set_fact:
+    users:
+      - name: automation
+        shell: /bin/bash
+        sudo_nopasswd: true
+        ssh_keys:
+          - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEx+ltCKNIEM7F4PzGLv22cIu7N0Fpn5gxwV02xq0GS9 automation@internet-master.cz"
+
+      - name: hellsos
+        shell: /bin/bash
+        sudo_nopasswd: true
+        ssh_keys:
+          - "ssh-ed25519 AAAAC3..."
+
+      - name: jim
+        shell: /bin/bash
+        sudo_nopasswd: true
+        ssh_keys:
+          - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPFS4fsqMjMMu/Bi/884bw7yJBqvWusDRESvanH6Owco jakub@jimbuntu"
+
+# --------------------------------------------------
+# Create users
+# --------------------------------------------------
+- name: Ensure users exist
+  ansible.builtin.user:
+    name: "{{ item.name }}"
+    shell: "{{ item.shell }}"
+    create_home: true
+  loop: "{{ users }}"
+
+# --------------------------------------------------
+# Configure passwordless sudo safely
+# --------------------------------------------------
+- name: Configure passwordless sudo
+  ansible.builtin.copy:
+    dest: "/etc/sudoers.d/{{ item.name }}"
+    mode: '0440'
+    owner: root
+    group: root
+    content: |
+      {{ item.name }} ALL=(ALL:ALL) NOPASSWD: ALL
+    validate: 'visudo -cf %s'
+  loop: "{{ users }}"
+  when: item.sudo_nopasswd | default(false)
+
+# --------------------------------------------------
+# Install SSH keys
+# --------------------------------------------------
+- name: Install authorized SSH keys
+  ansible.builtin.authorized_key:
+    user: "{{ item.name }}"
+    key: "{{ item.ssh_keys | join('\n') }}"
+    exclusive: true
+  loop: "{{ users }}"
+
+# --------------------------------------------------
+# Reset connection so sudo rules take effect immediately
+# --------------------------------------------------
+- name: Reset SSH connection
+  meta: reset_connection

initial_setup.yml

@@ -10,7 +10,7 @@
         groups: []
         sudo_nopasswd: true
         ssh_keys:
-          - "ssh-ed25519 AAAAC3..."
+          - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEx+ltCKNIEM7F4PzGLv22cIu7N0Fpn5gxwV02xq0GS9 automation@internet-master.cz"
 
       - name: hellsos
         shell: /bin/bash
@@ -24,7 +24,7 @@
         groups: []
         sudo_nopasswd: true
         ssh_keys:
-          - "ssh-ed25519 AAAAC3..."
+          - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPFS4fsqMjMMu/Bi/884bw7yJBqvWusDRESvanH6Owco jakub@jimbuntu"
 
   tasks:
 

inv_linuxes

@@ -4,6 +4,9 @@ jim_storage ansible_host=192.168.19.7
 portainer2_hellsos ansible_host=192.168.52.9
 portainernode_hellsos ansible_host=192.168.52.21
 portainernode2_jim ansible_host=192.168.19.8
+galera3 ansible_host=192.168.19.92
+galera2 ansible_host=192.168.19.91
+testipaclient ansible_host=192.168.19.98
 
 [local]
 localhost ansible_connection=local

mikrotikbackup_clean.yml

@@ -41,20 +41,20 @@
         state: directory
         mode: "0755"
       delegate_to: localhost
-      tags: backup
+      tags: [backup, never]
 
     - name: Export router config
       community.routeros.command:
         commands: /export terse show-sensitive
       register: export_cfg
-      tags: backup
+      tags: [backup, never]
 
     - name: Save export locally
       ansible.builtin.copy:
         content: "{{ export_cfg.stdout[0] }}"
         dest: "{{ backup_dir }}/{{ router_name }}-{{ ts }}.rsc"
       delegate_to: localhost
-      tags: backup
+      tags: [backup, never]
 
     # ----------------------------
     # Upgrade (tag: upgrade)
@@ -63,46 +63,84 @@
       community.routeros.command:
         commands: /system package update check-for-updates
       register: update_check
-      tags: upgrade
+      tags: [upgrade, never]
+
+    - name: Normalize update output
+      set_fact:
+        _update_text: "{{ update_check.stdout[0] | replace('\r', '') }}"
+      tags: [upgrade, never]
+
+    # ⬇️  Add this to see exactly what RouterOS returns before parsing
+    - name: Debug raw update output
+      ansible.builtin.debug:
+        msg: "{{ _update_text }}"
+      tags: [upgrade, never]
 
     - name: Parse installed and latest versions
       set_fact:
-        installed_version: "{{ update_check.stdout[0] | regex_search('installed-version: ([\\d.]+)', '\\1') | first }}"
+        installed_version: >-
-        latest_version: "{{ update_check.stdout[0] | regex_search('latest-version: ([\\d.]+)', '\\1') | first }}"
+          {{
-      tags: upgrade
+            (_update_text | regex_findall('(?:installed|current)-version:[ ]*([0-9A-Za-z.]+)'))[0]
+            if (_update_text | regex_findall('(?:installed|current)-version:[ ]*([0-9A-Za-z.]+)'))
+            else 'unknown'
+          }}
+        latest_version: >-
+          {{
+            (_update_text | regex_findall('(?:latest|newest)-version:[ ]*([0-9A-Za-z.]+)'))[0]
+            if (_update_text | regex_findall('(?:latest|newest)-version:[ ]*([0-9A-Za-z.]+)'))
+            else 'unknown'
+          }}
+      tags: [upgrade, never]
+
+    - name: Fail if versions could not be parsed
+      ansible.builtin.fail:
+        msg: >
+          Could not parse versions from update output.
+          Raw text was: {{ _update_text }}
+      when: installed_version == 'unknown' or latest_version == 'unknown'
+      tags: [upgrade, never]
+
+    - name: Debug parsed versions
+      ansible.builtin.debug:
+        msg:
+          - "Installed: {{ installed_version }}"
+          - "Latest: {{ latest_version }}"
+      tags: [upgrade, never]
 
     - name: Skip upgrade if already on latest
       ansible.builtin.debug:
         msg: "Router {{ router_name }} is already on latest version {{ installed_version }}. Skipping upgrade."
       when: installed_version == latest_version
-      tags: upgrade
+      tags: [upgrade, never]
 
     - name: Trigger package download and install
       community.routeros.command:
         commands: /system package update install
       register: upgrade_result
       when: installed_version != latest_version
-      tags: upgrade
+      tags: [upgrade, never]
 
     - name: Wait for router to come back online after reboot
-      ansible.builtin.wait_for_connection:
+      community.routeros.command:
-        delay: 180
+        commands: /system resource print
-        timeout: 300
+      register: reboot_wait
-        sleep: 10
+      until: reboot_wait is not failed
+      retries: 30
+      delay: 15
       when:
         - installed_version != latest_version
         - upgrade_result is not failed
-      tags: upgrade
+      tags: [upgrade, never]
 
     - name: Confirm upgraded version
       community.routeros.command:
         commands: /system resource print
       register: post_upgrade_info
       when: installed_version != latest_version
-      tags: upgrade
+      tags: [upgrade, never]
 
     - name: Show post-upgrade RouterOS version
       ansible.builtin.debug:
         msg: "{{ post_upgrade_info.stdout[0] | regex_search('version: .+') }}"
       when: installed_version != latest_version
-      tags: upgrade
+      tags: [upgrade, never]

test_sms.yml

@@ -7,7 +7,7 @@
     sms_username: "mikrotik"
     sms_password_send: "jdkotzHJIOPWhjtr32D"
     sms_password_recv: "jdkotzHJIOPWhjtr32D"
-    sms_wait_seconds: 120   # Wait 2 minutes for delivery
+    sms_wait_seconds: 15   # Wait 15s for delivery
 
   tasks:
     - name: Generate random test string