ramondevprivate.common.fleet_info module – Collect read-only server facts for the fleet inventory

Note

This module is part of the ramondevprivate.common collection (version 1.0.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install ramondevprivate.common.

To use it in a playbook, specify: ramondevprivate.common.fleet_info.

New in ramondevprivate.common 1.0.0

Synopsis

  • Collects how a Debian server is set up, for the ramondevprivate.common.fleet_inventory role. Never changes anything on the target; check mode is fully supported.

  • Collected: login accounts with their groups, sudo level and authorized keys; sshd key settings; UFW status and rules; listening sockets; Docker daemons and containers; fail2ban; unattended upgrades.

  • Needs root (become) for sshd settings, other users’ key files and sudo rules, UFW, socket processes, Docker sockets and fail2ban jails; without root those parts are reported as unknown and one warning is shown.

  • Never returned are key material, the content of forced commands, password hashes, and container environment variables, commands or labels other than the image version and compose directory.

  • How each part is read (sources, permission and socket checks) is described in the role README.

Parameters

Parameter

Comments

group_filter

list / elements=string

Supplementary groups that are not reported because every desktop-style account has them.

Groups like sudo, docker, lxd and adm grant privileges and should not be listed here.

Default: ["cdrom", "floppy", "audio", "dip", "video", "plugdev", "users", "netdev", "bluetooth"]

user_filter

list / elements=string

Accounts that are not collected at all, e.g. provider or image default accounts.

Filtering root also hides who can log in as root with a key.

Default: []

Attributes

Attribute

Support

Description

check_mode

Support: full

Can run in check_mode and return changed status prediction without modifying target, if not supported the action will be skipped.

diff_mode

Support: none

Will return details on what has changed (or possibly needs changing in check_mode), when in diff mode

platform

Platform: debian

Target OS/families that can be operated against

Examples

- name: Collect fleet info
  ramondevprivate.common.fleet_info:
  register: fleet_inventory_info

- name: Collect fleet info, also hiding the lpadmin group and the image's default account
  ramondevprivate.common.fleet_info:
    group_filter: [cdrom, floppy, audio, dip, video, plugdev, users, netdev, bluetooth, lpadmin]
    user_filter: [debian]

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

fleet

dictionary

Facts about the host. Null values mean unknown (not readable, tool missing or no root).

Returned: always

auto_updates

dictionary

Unattended-upgrades configuration and last successful run; null values are unknown.

Returned: always

installed

boolean

Whether the unattended-upgrades package is installed.

Returned: success

last_success

string

Last successful unattended-upgrade run (ISO 8601, UTC); empty if there is none.

Returned: success

timer

string

systemctl is-enabled apt-daily-upgrade.timer, for example enabled; empty if unknown.

Returned: success

unattended_upgrade

string

APT::Periodic::Unattended-Upgrade; empty if unset.

Returned: success

update_lists

string

APT::Periodic::Update-Package-Lists; empty if unset.

Returned: success

docker

list / elements=dictionary

Docker daemons found by their sockets, with their containers.

Returned: always

containers

list / elements=dictionary

All containers of the daemon, running or not.

Returned: success

compose_dir

string

Compose working directory label; empty if not started by compose.

Returned: success

image

string

Image reference as configured, for example traefik:v3.7.13.

Returned: success

name

string

Container name.

Returned: success

ports

list / elements=dictionary

Published ports; empty for a stopped container.

Returned: success

container_port

integer

Port in the container.

Returned: success

host_ip

string

Host address.

Returned: success

host_port

integer

Port on the host.

Returned: success

proto

string

tcp, udp or sctp.

Returned: success

state

string

Container state, for example running or exited.

Returned: success

version

string

The org.opencontainers.image.version label; empty if missing.

Returned: success

mode

string

rootful (/var/run/docker.sock) or rootless (/run/user/<uid>/docker.sock).

Returned: success

Can only return:

  • "rootful"

  • "rootless"

owner

string

Account that runs a rootless daemon; empty for the rootful one.

Returned: success

socket

string

Path of the daemon’s socket.

Returned: success

state

string

running answered, not running docker.service not active (rootful only, not queried).

unreachable the socket failed the owner checks or did not answer.

Returned: success

Can only return:

  • "running"

  • "not running"

  • "unreachable"

version

string

Engine version; empty if the daemon was not queried or did not answer.

Returned: success

fail2ban

dictionary

fail2ban service state and jails.

Returned: always

jails

list / elements=string

Jail names; null if unknown (not running, no root).

Returned: success

state

string

systemctl is-active state (active, failed, …), not installed or unknown.

Returned: success

listeners

list / elements=dictionary

Listening TCP and bound UDP sockets from ss; null if ss is not available.

Returned: always

address

string

Bind address without brackets; * means both address families.

Returned: success

interface

string

Interface from address%interface; empty if not bound to one.

Returned: success

port

integer

Port number.

Returned: success

processes

list / elements=string

Names of the processes holding the socket; empty without root.

Returned: success

proto

string

tcp or udp.

Returned: success

schema_version

integer

Version of the result format.

Returned: always

ssh

dictionary

Where sshd looks for authorized keys.

Returned: always

key_files

list / elements=string

AuthorizedKeysFile entries, relative ones relative to the home directory.

Returned: success

key_files_source

string

sshd from sshd -T, default if sshd -T failed and sshd’s defaults are assumed.

Returned: success

Can only return:

  • "sshd"

  • "default"

keys_command

boolean

Whether an AuthorizedKeysCommand is set (its keys are not collected).

Returned: success

ufw

dictionary

UFW status, default policies and rules.

Returned: always

default_incoming

string

Incoming default (deny, allow, reject, disabled); empty if unknown or inactive.

Returned: success

default_outgoing

string

Default outgoing policy, like fleet.ufw.default_incoming.

Returned: success

default_routed

string

Default routed policy, like fleet.ufw.default_incoming.

Returned: success

logging

string

Logging, for example on (low); empty if unknown.

Returned: success

rules

list / elements=dictionary

Rules added with ufw; null if the rule files are not readable.

Returned: success

action

string

allow, deny, reject or limit.

Returned: success

app

string

Destination-side application profile; its ports are already in fleet.ufw.rules[].to_port.

Returned: success

comment

string

Rule comment, decoded.

Returned: success

direction

string

in or out.

Returned: success

family

string

Address family of the rule set the rule comes from.

Returned: success

Can only return:

  • "ipv4"

  • "ipv6"

from_address

string

Source network, like fleet.ufw.rules[].to_address.

Returned: success

from_port

string

Source port, like fleet.ufw.rules[].to_port.

Returned: success

interface_in

string

Incoming interface; empty if not limited to one.

Returned: success

interface_out

string

Outgoing interface; empty if not limited to one.

Returned: success

proto

string

tcp, udp, any, …

Returned: success

route

boolean

Whether it is a ufw route rule (forwarded traffic).

Returned: success

to_address

string

Destination network, 0.0.0.0/0 or ::/0 for any.

Returned: success

to_port

string

Destination port, list (80,443), range (8000:8010) or any.

Returned: success

state

string

UFW state.

Returned: success

Can only return:

  • "active"

  • "inactive"

  • "not installed"

  • "unknown"

users

list / elements=dictionary

Root, accounts with a login shell and UID >= UID_MIN, and every account with authorized keys.

Returned: always

authorized_keys

list / elements=dictionary

Keys from the files sshd uses, without the key material; null if a key file is not readable.

Returned: success

allowed_from

string

The from= option; empty if not set.

Returned: success

comment

string

Key comment; empty if the key has none.

Returned: success

fingerprint

string

SHA256 fingerprint as shown by ssh-keygen -l.

Returned: success

forced_command

boolean

Whether the key has a command= option (its content is not returned).

Returned: success

key_type

string

Key type, for example ssh-ed25519.

Returned: success

groups

list / elements=string

Supplementary groups without the primary group and without group_filter.

Returned: success

last_login

string

Last login (ISO 8601); empty if there is no record, null if lslogins is not available.

Returned: success

name

string

Account name.

Returned: success

sudo

dictionary

What the account may run, from sudo -l -U.

Returned: success

level

string

full any command as root, limited anything else, none not allowed.

unknown without root, without sudo, or output that could not be classified.

Returned: success

Can only return:

  • "full"

  • "limited"

  • "none"

  • "unknown"

nopasswd

boolean

Whether a rule that makes up the level (the full ones, if any) has NOPASSWD.

Returned: success

rules

list / elements=string

The rules sudo -l lists, without duplicates.

Returned: success

uid

integer

Numeric user id.

Returned: success

Authors

  • Ramon (@RamonDevPrivate)