exterrestris / ansible-role-sanoid Goto Github PK

Syncoid allows to set a --sshport flag to specify connecting to SSH hosts using non-standard ports.

This is currently not surfaced in:

• https://github.com/exterrestris/ansible-role-sanoid/blob/main/templates/syncoid.service.j2

The current workaround is to create a /root/.ssh/config file which contains host aliases with the desired configuration.

Reference:

• https://github.com/jimsalterjrs/sanoid/blob/master/README.md

Useful when a package is outdated or unavailable in repos. Current HEAD is significantly newer than latest release

Only two of the flags Syncoid offers are currently supported:

• --recursive
• --force-delete

When I run the role against a computer that already has configured the /etc/sanoid/sanoid.conf file, the role overwrites this file with the default template.

I guess this task should be changed in main.yaml from:

- name: generate sanoid config
  ansible.builtin.template:
    src: ../templates/sanoid.conf.j2
    dest: "{{ sanoid_conf }}"
    owner: root
    group: root
    mode: '0600'

to:

- name: generate sanoid config
  ansible.builtin.template:
    src: ../templates/sanoid.conf.j2
    dest: "{{ sanoid_conf }}"
    owner: root
    group: root
    mode: '0600'
    force: false

Need to investigate potential permissions issues

In some situations it can be useful to have syncoid configured, but not enabled. This is currently not possible - if configurations exist, the timer will be enabled.

Source files are typically kept in /usr/local/src - downloaded to this directory by default would therefore be more appropriate than /tmp

This Ubuntu 16.04 machine didn't have /usr/lib/systemd/system, why the installation broke.

This could be taken care of with a dependency check with automatic resolution depending on the outcome.

Manually creating the directory worked just fine.

jimsalterjrs/sanoid#513 implements an insecure mode for syncoid which doesn't use SSH for transfers. This is useful when replicating to devices like a Raspberry Pi which doesn't support hardware AES and is therefore transfer speed is CPU limited.

Additional software (socat and busybox) is required on both ends for the transfer to work, along with firewall rules to allow traffic

Currently this role generates RSA keys for Syncoid to pull the contents.

OpenSSH 9.5 uses the Ed25519 curve by default. It is considered more secure than RSA keys, while being more convenient and easier to handle, due to their shorter length.

It is suggested to add (optional) ed25519 key generation in a first step and to make it the default later, when proven stable.

Sync will fail initially because the host is unknown

Adding a healthcheck command to syncoid timers would be beneficial for monitoring purposes

Depends on #8

All Syncoid tasks are currently run in the same timer, meaning there is no way to selectively change frequency for some tasks

Nominally supports RHEL/CentOS for both installing from source/package manager, but this is untested