36 lines
1 KiB
YAML
36 lines
1 KiB
YAML
# §37.10 — Secrets file hygiene.
|
|
---
|
|
- name: Ensure /etc/morphit is 0750 owned by morphit group
|
|
ansible.builtin.file:
|
|
path: /etc/morphit
|
|
state: directory
|
|
owner: root
|
|
group: "{{ morphit_service_group }}"
|
|
mode: '0750'
|
|
|
|
- name: Ensure relay env file is 0640
|
|
ansible.builtin.file:
|
|
path: /etc/morphit/relay.env
|
|
state: file
|
|
owner: root
|
|
group: "{{ morphit_service_group }}"
|
|
mode: '0640'
|
|
failed_when: false # Created by morphit role; may not exist yet on first run
|
|
|
|
- name: Ensure indexer env file is 0640
|
|
ansible.builtin.file:
|
|
path: /etc/morphit/indexer.env
|
|
state: file
|
|
owner: root
|
|
group: "{{ morphit_service_group }}"
|
|
mode: '0640'
|
|
failed_when: false
|
|
|
|
- name: Ensure relay keystore is 0600 owned by morphit user
|
|
ansible.builtin.file:
|
|
path: "{{ morphit_relay_keystore_path }}"
|
|
state: file
|
|
owner: "{{ morphit_service_user }}"
|
|
group: "{{ morphit_service_group }}"
|
|
mode: '0600'
|
|
failed_when: false # Operator must place this manually before first run
|