70 lines
2.2 KiB
YAML
70 lines
2.2 KiB
YAML
---
|
|
# collect-luks-keys.yml — fetch LUKS backup keys from enrolled clients.
|
|
#
|
|
# When a client was installed with disk encryption via the M-Archy installer,
|
|
# a backup LUKS key is stored at /_LUKS_BACKUP_KEY inside the encrypted root.
|
|
# This playbook fetches those keys to the controller and names each copy
|
|
# <HOSTNAME>_LUKS_BACKUP_KEY so they can be archived securely.
|
|
#
|
|
# Keys are stored in luks-keys/ relative to the playbook directory.
|
|
# Protect that directory carefully — keys can unlock client root partitions.
|
|
#
|
|
# Usage:
|
|
# ansible-playbook -i inventory collect-luks-keys.yml
|
|
# ansible-playbook -i inventory collect-luks-keys.yml -e luks_keys_store=/secure/path
|
|
#
|
|
# To run automatically, add a cron job on the Ansible controller:
|
|
# 0 3 * * * cd /path/to/playbooks && ansible-playbook -i inventory collect-luks-keys.yml
|
|
|
|
- name: Collect LUKS backup keys from enrolled clients
|
|
hosts: all
|
|
become: yes
|
|
|
|
vars:
|
|
luks_key_path: /_LUKS_BACKUP_KEY
|
|
luks_keys_store: "{{ playbook_dir }}/luks-keys"
|
|
|
|
tasks:
|
|
|
|
- name: Ensure local key store directory exists
|
|
file:
|
|
path: "{{ luks_keys_store }}"
|
|
state: directory
|
|
mode: '0700'
|
|
delegate_to: localhost
|
|
run_once: true
|
|
become: false
|
|
|
|
- name: Check for LUKS backup key on client
|
|
stat:
|
|
path: "{{ luks_key_path }}"
|
|
register: luks_key_stat
|
|
|
|
- name: Fetch LUKS backup key to controller
|
|
fetch:
|
|
src: "{{ luks_key_path }}"
|
|
dest: "{{ luks_keys_store }}/{{ inventory_hostname }}_LUKS_BACKUP_KEY"
|
|
flat: yes
|
|
when: luks_key_stat.stat.exists
|
|
register: luks_key_fetch
|
|
|
|
- name: Secure fetched key permissions
|
|
file:
|
|
path: "{{ luks_keys_store }}/{{ inventory_hostname }}_LUKS_BACKUP_KEY"
|
|
mode: '0400'
|
|
delegate_to: localhost
|
|
become: false
|
|
when:
|
|
- luks_key_stat.stat.exists
|
|
- luks_key_fetch is changed
|
|
|
|
- name: Report key status
|
|
debug:
|
|
msg: >-
|
|
{{ inventory_hostname }}:
|
|
{% if luks_key_stat.stat.exists %}
|
|
key found and fetched to {{ luks_keys_store }}/{{ inventory_hostname }}_LUKS_BACKUP_KEY
|
|
{% else %}
|
|
no /_LUKS_BACKUP_KEY present (unencrypted or already collected)
|
|
{% endif %}
|