From 2b45174f0f83306ed11fc52ea7ad131f84b862a3 Mon Sep 17 00:00:00 2001 From: Raphael Dannecker Date: Wed, 17 Dec 2025 18:23:10 +0100 Subject: [PATCH 1/4] Prevent luks-detection task from aborting on unencrypted devices --- roles/lmn_encrypt/tasks/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/lmn_encrypt/tasks/main.yml b/roles/lmn_encrypt/tasks/main.yml index 83196c8..6c81e7b 100644 --- a/roles/lmn_encrypt/tasks/main.yml +++ b/roles/lmn_encrypt/tasks/main.yml @@ -7,6 +7,7 @@ when: - item.value.partitions is defined - item.value.partitions | dict2items | length > 0 + - item.value.partitions | dict2items | selectattr('value.holders', 'search', 'luks|crypt') | length > 0 loop: "{{ ansible_devices | dict2items }}" - name: Get luks slots From 194fbbc735659b29e73610e5e4eb83475db380b8 Mon Sep 17 00:00:00 2001 From: Raphael Dannecker Date: Wed, 17 Dec 2025 18:28:09 +0100 Subject: [PATCH 2/4] Fix a syntax error in the `var` section of a task --- roles/lmn_sssd/tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/lmn_sssd/tasks/main.yml b/roles/lmn_sssd/tasks/main.yml index 0ff5b60..6dcd0a0 100644 --- a/roles/lmn_sssd/tasks/main.yml +++ b/roles/lmn_sssd/tasks/main.yml @@ -27,8 +27,8 @@ echo "{{ ad_passwd }}" | adcli join --stdin-password -U {{ ad_user }} {{ domain | upper }} no_log: true vars: - - ad_user: "{{ 'global-admin' if (adpw.user_input | default(ansible_cmdline.adpw) | default('') | length > 0) else sssd_domjoin_user }}" - - ad_passwd: "{{ adpw.user_input | default('') if adpw.user_input | length > 0 else ansible_cmdline.adpw | default(sssd_domjoin_passwd) | default('') }}" + ad_user: "{{ 'global-admin' if (adpw.user_input | default(ansible_cmdline.adpw) | default('') | length > 0) else sssd_domjoin_user }}" + ad_passwd: "{{ adpw.user_input | default('') if adpw.user_input | length > 0 else ansible_cmdline.adpw | default(sssd_domjoin_passwd) | default('') }}" when: - adpw.user_input | length > 0 or ansible_cmdline.adpw | default(sssd_domjoin_passwd) | default('') | length > 0 From f89b113049deb36cbc755398adc275ad76b6cc4b Mon Sep 17 00:00:00 2001 From: Raphael Dannecker Date: Wed, 17 Dec 2025 18:50:16 +0100 Subject: [PATCH 3/4] Enable ARP support in nftable for outbound restriction in exam_mode --- roles/lmn_exam/templates/no-way-out-nftable.j2 | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/roles/lmn_exam/templates/no-way-out-nftable.j2 b/roles/lmn_exam/templates/no-way-out-nftable.j2 index 2c6efb8..93305a9 100644 --- a/roles/lmn_exam/templates/no-way-out-nftable.j2 +++ b/roles/lmn_exam/templates/no-way-out-nftable.j2 @@ -13,15 +13,17 @@ ${filterchain} chain filterin_${interface} { type filter hook ingress device ${interface} priority filter; policy drop; ip saddr \$allowed_ipv4 accept - ip saddr ${gateway} accept; - ip saddr 255.255.255.255 accept; + ip saddr ${gateway} accept + ip saddr 255.255.255.255 accept + ether type arp accept } chain filterout_${interface} { type filter hook egress device ${interface} priority filter; policy drop; ip daddr \$allowed_ipv4 accept - ip daddr ${gateway} accept; - ip daddr 255.255.255.255 accept; + ip daddr ${gateway} accept + ip daddr 255.255.255.255 accept + ether type arp accept } EOF ) From e02add04aea46ed2c51e8ac3f5d8799b2399dab7 Mon Sep 17 00:00:00 2001 From: Raphael Dannecker Date: Wed, 17 Dec 2025 19:41:38 +0100 Subject: [PATCH 4/4] Set the environment variable for the path to KiCad's 3D models (NFS) --- roles/custom/fvs/tasks/main.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/roles/custom/fvs/tasks/main.yml b/roles/custom/fvs/tasks/main.yml index d374870..b5e1094 100644 --- a/roles/custom/fvs/tasks/main.yml +++ b/roles/custom/fvs/tasks/main.yml @@ -260,5 +260,12 @@ KERNEL=="mmcblk[0-9]", ENV{ID_NAME}=="?*", ENV{ID_SERIAL}=="?*", GROUP="domain users" KERNEL=="mmcblk[0-9]p[0-9]*", ENV{ID_NAME}=="?*", ENV{ID_SERIAL}=="?*", GROUP="domain users" +- name: Set KiCad 3Dmodel path + ansible.builtin.lineinfile: + path: /etc/environment.d/90lmn-kicad.conf + create: true + mode: '0644' + line: KICAD9_3DMODEL_DIR=/lmn/tools/KiCad/kicad-packages3D + - name: Include sync ansible.builtin.include_tasks: sync.yml