second commit

ansible/roles/jumphost_app/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+- name: reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: restart jumphost-app service
+  ansible.builtin.service:
+    name: jumphost-app
+    state: restarted

ansible/roles/jumphost_app/tasks/main.yml

@@ -0,0 +1,76 @@
+---
+# Deployt die eigentliche Jumphost-Anwendung als gehaertete systemd-Unit.
+# KEK und Session-Secret werden ueber systemd-creds verschluesselt abgelegt
+# (Konzept 6.4) -- niemals als Klartext-Env-Variable im Unit-File.
+
+- name: Konfigurationsverzeichnis anlegen
+  ansible.builtin.file:
+    path: /etc/jumphost
+    state: directory
+    owner: root
+    group: "{{ jumphost_app_group }}"
+    mode: "0750"
+
+- name: Pruefen ob systemd-creds verfuegbar ist (systemd >= 250 empfohlen)
+  ansible.builtin.command: systemd-creds --version
+  register: _creds_check
+  changed_when: false
+  failed_when: false
+
+- name: Warnung ausgeben, falls systemd-creds fehlt
+  ansible.builtin.debug:
+    msg: >
+      WARNUNG: systemd-creds nicht verfuegbar. Fallback auf Env-Variablen
+      (JUMPHOST_KEK/JUMPHOST_SESSION_SECRET) in einer 0600-EnvironmentFile --
+      weniger sicher als LoadCredentialEncrypted=, siehe Konzept 6.4.
+  when: _creds_check.rc != 0
+
+- name: KEK verschluesselt ablegen (systemd-creds)
+  ansible.builtin.shell: |
+    set -o pipefail
+    echo -n '{{ vault_jumphost_kek }}' | systemd-creds encrypt --name=jumphost_kek - /etc/jumphost/jumphost_kek.cred
+  args:
+    creates: /etc/jumphost/jumphost_kek.cred
+    executable: /bin/bash
+  when: _creds_check.rc == 0
+  no_log: true
+
+- name: Session-Secret verschluesselt ablegen (systemd-creds)
+  ansible.builtin.shell: |
+    set -o pipefail
+    echo -n '{{ vault_jumphost_session_secret }}' | systemd-creds encrypt --name=jumphost_session_secret - /etc/jumphost/jumphost_session_secret.cred
+  args:
+    creates: /etc/jumphost/jumphost_session_secret.cred
+    executable: /bin/bash
+  when: _creds_check.rc == 0
+  no_log: true
+
+- name: Fallback-EnvironmentFile (nur falls systemd-creds fehlt)
+  ansible.builtin.copy:
+    dest: /etc/jumphost/env
+    owner: root
+    group: "{{ jumphost_app_group }}"
+    mode: "0640"
+    content: |
+      JUMPHOST_KEK={{ vault_jumphost_kek }}
+      JUMPHOST_SESSION_SECRET={{ vault_jumphost_session_secret }}
+  when: _creds_check.rc != 0
+  no_log: true
+
+- name: systemd-Unit fuer die Jumphost-App ausrollen
+  ansible.builtin.template:
+    src: jumphost-app.service.j2
+    dest: /etc/systemd/system/jumphost-app.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - reload systemd
+    - restart jumphost-app service
+
+- name: Jumphost-App aktivieren und starten
+  ansible.builtin.systemd:
+    name: jumphost-app
+    daemon_reload: true
+    enabled: true
+    state: started

ansible/roles/jumphost_app/templates/jumphost-app.service.j2

@@ -0,0 +1,58 @@
+[Unit]
+Description=Jumphost Gateway Application
+After=network.target guacd.service
+Wants=guacd.service
+
+[Service]
+Type=simple
+User={{ jumphost_app_user }}
+Group={{ jumphost_app_group }}
+WorkingDirectory={{ jumphost_home }}
+Environment=JUMPHOST_ENV=production
+Environment=JUMPHOST_DATA_DIR={{ jumphost_data_dir }}
+Environment=JUMPHOST_LISTEN_UDS={{ jumphost_listen_uds }}
+Environment=JUMPHOST_GUACD_HOST=127.0.0.1
+Environment=JUMPHOST_GUACD_PORT={{ guacd_port }}
+{% if not enable_nginx_proxy %}
+Environment=JUMPHOST_DIRECT_TLS=1
+{% endif %}
+
+{% if _creds_check.rc == 0 %}
+LoadCredentialEncrypted=jumphost_kek:/etc/jumphost/jumphost_kek.cred
+LoadCredentialEncrypted=jumphost_session_secret:/etc/jumphost/jumphost_session_secret.cred
+{% else %}
+EnvironmentFile=/etc/jumphost/env
+{% endif %}
+
+{% if enable_nginx_proxy %}
+ExecStart={{ jumphost_venv }}/bin/uvicorn app.main:app --uds {{ jumphost_listen_uds }}
+{% else %}
+ExecStart={{ jumphost_venv }}/bin/uvicorn app.main:app --host 0.0.0.0 --port {{ jumphost_app_port }} \
+    --ssl-certfile /etc/jumphost/tls/server.crt --ssl-keyfile /etc/jumphost/tls/server.key
+{% endif %}
+
+Restart=on-failure
+RestartSec=5
+
+# --- Hardening (Konzept 6.7/8.1) ---------------------------------------------
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictNamespaces=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictSUIDSGID=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+CapabilityBoundingSet=
+ReadWritePaths={{ jumphost_data_dir }} /run/jumphost /var/log/jumphost
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target