Migrate Gitea to rootless Podman / SELinux

- Front git-over-SSH with host sshd and live key lookup
- Build and load custom SELinux policies oci_log and gitea_ssh

roles/base/tasks/firewall.yml

@@ -8,6 +8,17 @@
     name: fail2ban
     state: present
 
+- name: Ensure Fail2ban's log file is correctly labelled
+  ansible.builtin.file:
+    path: /var/log/fail2ban.log
+    state: touch
+    mode: "0640"
+    access_time: preserve
+    modification_time: preserve
+    setype: fail2ban_log_t
+  when: selinux is defined and selinux is not false
+  notify: restart_fail2ban
+
 - name: Deny incoming traffic by default
   community.general.ufw:
     default: deny

roles/base/tasks/system.yml

@@ -16,6 +16,13 @@
     policy: "{{ selinux.policy | default('default') }}"
   when: selinux is defined and selinux is not false
 
+- name: Set SELinux permissive domains
+  community.general.selinux_permissive:
+    domain: "{{ item }}"
+    permissive: true
+  loop: "{{ selinux.permissive_domains | default([]) }}"
+  when: selinux is defined and selinux is not false
+
 - name: Check for GRUB
   ansible.builtin.stat:
     path: /etc/default/grub
@@ -100,7 +107,7 @@
   community.crypto.openssh_keypair:
     path: "{{ base_scripts }}/.keys/id_ed25519"
     type: ed25519
-    comment: "{{ ansible_hostname }}-deploy-key"
+    comment: "{{ ansible_facts['hostname'] }}-deploy-key"
     mode: "400"
     state: present
   when: scripts is defined

roles/base/templates/smb.conf.j2

@@ -1,7 +1,7 @@
 [global]
    workgroup = WORKGROUP
    server string = Samba Server %v
-   netbios name = {{ ansible_hostname }}
+   netbios name = {{ ansible_facts['hostname'] }}
    security = user
    map to guest = bad user
    dns proxy = no

roles/base/templates/wireguard.j2

@@ -1,6 +1,6 @@
 # {{ ansible_managed }}
 
-[Interface] # {{ ansible_hostname }}
+[Interface] # {{ ansible_facts['hostname'] }}
 PrivateKey = {{ wgkey['content'] | b64decode | trim }}
 Address = {{ wireguard.address }}
 {% if wireguard.listenport is defined %}