sjat/MakerFLOSS_Mikrotik
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
MakerFLOSS_Mikrotik/group_vars/mikrotik.vault.yml

26 lines
1.9 KiB
YAML
Raw Normal View History

feat: bootstrap CRS310 on-site (sjat user + key + vaulted password) Recorded device facts (CRS310-8G+2S+IN, serial HM40B8TDNDD, RouterOS 7.19.6, pinned firmware_target 7.19.6). Added encrypted makerfloss-vault admin password and excluded *.vault.yml from linters. Device bootstrapped over SSH: identity set to crs310-maker, named user sjat (full) with operator ed25519 key + vaulted password; key-based login verified from the controller. Default admin still enabled (hardening + VLANs deferred to the day-2 task files). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-08 19:13:53 +02:00
$ANSIBLE_VAULT;1.2;AES256;makerfloss
feat(users): model operators as accounts; add claus Replace the single `switch_admin_user` day-2 task with a `switch_operators` list in host_vars: one RouterOS user per person, each with the public keys that may log in as it. Logins become attributable and revocable per person instead of accreting as extra keys on `sjat`. Adds claus@stjerno.dk as user `claus` (group full), and codifies the two keys already on the device (sjat's mamba seat, the claude@ubongo automation seat that was hand-imported earlier today). Two things the mechanism has to get right: - Idempotency: query /user/ssh-keys first and upload only missing keys. An unconditional net_put reports changed on every run. - No passwordless accounts: WinBox/console accept an empty password and WinBox is deliberately left on for recovery, so each operator gets a vaulted password. users.yml asserts one exists before touching anything. Verified: yamllint, ansible-lint (production), syntax-check, and the play run twice against crs310-maker — second run changed=0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EyYJWABgSEHzbjsZGrkxVE
2026-09-01 20:29:18 +02:00
32653033396232323333353737313334656237356163386433626333646461376534396131636134
6632363938393232613364383937643631303934383464380a316537663466383735363633316238
33363930316631643666383266613936393031616261316263363234306631343736643265393663
6430363337326230640a303164306430376666626432303838316134663363656631386330613831
32623635333964613033353733653066623863616536633861643763613532373661376331653065
33313630313561343561643262613962343366346631353865633462366532643739396330346466
35636537396137373432353036356536333931396537356536353863653435323431633639343932
65356531373032373764643664643866623236333162323335353431623165666537653234393564
35313235623362636337373138616433626130313535613831363431316366626439306666643734
65623861323966356435656637333632306463393934303065636337373163373639326364343466
38336230313634353330353162313064646338623436366263386364303239366636373064663662
66636161343539656331633064373965626434623066333036383030383161363263633261376562
38326661393161643132666337366231633338633634633165643130343461623130383163363865
35613837353263666536316337363965396138656461386265623132333236616635306137333765
66633334356231303565616535353335366232623631323733623531633564303633313030656239
64323165396634353834643236303334303234633739616561336635373133343935303135313636
34613932336338636163663531383665356662633465333762383063393138383035653235663838
38643166333433346632396666336137656166656130333237303237333433356263323638363664
37363566353762626238343866336239633461613536333834623433356532333739663665336262
31626536336464613666353732343434616464663135633535313864653032383537386662653834
30663832336366333035663163646334356533356339323262383538386338353961323235363165
33616338303231323463376165633437653362393664393033353236333635346430373761613862
37383338366238616335333632666134306663663236366331613261396363373866636665313161
35646239323236353036
Reference in a new issue Copy permalink