Tang Disk-Unlock Keys, Thumbprint Ready For Clevis
Tang from AppStream, the server half of network-bound disk encryption: keys made once, the socket moved off port 80 to the addresses you list, and the signing thumbprint computed for clevis to pin. The live test encrypts with clevis, decrypts through the server, and sees a wrong thumbprint and a stopped server both refused. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-10-03 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-tang?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [Tang Disk-Unlock Keys, Thumbprint Ready For Clevis](https://www.iac-bazaar.com/catalog/ansible-tang?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# Tang Disk-Unlock Keys, Thumbprint Ready For Clevis: https://www.iac-bazaar.com/catalog/ansible-tang (download from your IaC Bazaar account)
```Preview:
Documentation
tang
Tang from AppStream: the server half of network-bound disk encryption. A client encrypts a disk key with clevis, pinned to this server's thumbprint, and can only decrypt it while it can reach the server. The role makes the keys, moves the socket to the addresses you list, and hands you the thumbprint. Original role for EL 10, live-tested with podman on Rocky Linux 10.
No download, and no version to pin. EL 10 packages tang in AppStream, so
the role installs it by name and takes what the distribution ships: a security
update arrives through dnf, not through a new release of this role. What the
role owns is the configuration and the proof that the service works.
The distribution's socket, our addresses. The package's tangd.socket
listens on port 80 on every address; the role's drop-in replaces that with
127.0.0.1:7500 by default plus any you list in tang_extra_listen - the
clients are other hosts, so list the address they reach. Each connection starts
tangd@ as the tang user. The socket's own start hands /var/db/tang to tang;
its chmod of the keys names a glob systemd does not expand, so it changes
nothing (measured). The live test reads the sockets and expects loopback only.
The thumbprint, computed where tang-show-keys cannot. tang-show-keys
takes only a port and always asks localhost, so it fails for a server that
listens elsewhere. The role reads the signing key itself (the key whose
key_ops holds verify) and computes its SHA-256 thumbprint with jose - the
same value tang-show-keys prints (measured) - then shows it and sets it as
tang_thumbprint for the plays that bind clients. Pin it: unpinned, clevis asks
for confirmation on /dev/tty, which automation does not have.
Proven by clevis. The live test encrypts a secret pinned to the role's thumbprint and decrypts it through the server; a wrong thumbprint is refused ("Unable to fetch advertisement"); with the socket stopped, the same decrypt fails ("Error communicating with server").
The keys belong to tang, in either mode. tangd-keygen writes them 0440
tang:tang, and the package's own tmpfiles rule (Z /var/db/tang 0700 tang tang)
resets them to 0700 whenever systemd-tmpfiles --create runs - at every boot,
and after a package install that triggers it (both measured; tangd serves them
either way). The live test asserts what both modes share: owned by tang, with
no permission for anyone else.
Back the keys up. An empty key directory is not an error to tang: the next
request makes NEW keys (measured), and every client bound to the old ones can
no longer decrypt. /var/db/tang is the thing to back up. Rotation
(/usr/libexec/tangd-rotate-keys -d /var/db/tang) hides the old keys instead;
old secrets still decrypt until the hidden keys are deleted (measured).
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-lynis
Lynis from EPEL on a systemd timer, with the units the package keeps only in its docs, your skipped tests in custom.prf, and a minimum hardening index below which the audit unit fails, so a falling score shows as a failed unit. The live test runs the audit, reads the index and the tests that ran, and finds the timer enabled. Original role, live-tested on Rocky Linux 10.
ansible-suricata
Suricata from EPEL watching the default-route interface as the suricata user, ET Open fetched at install and refreshed daily, plus a canary rule that proves the sensor is alive. A root-run check left root-owned logs and a daemon recording nothing; the role prevents it. The live test raises the canary alert while a second lookup is logged, not alerted. Original role, live-tested on Rocky Linux 10.
ansible-aide
AIDE from AppStream on EL 10: a watched tree, a baseline database built once, and the oneshot unit and timer the package does not ship. The live test passes on an unchanged host, FAILS when a file appears inside a watched path and names it, ignores one inside an excluded path, and passes again once the change is gone. Original role, live-tested on Rocky Linux 10.
ansible-389-ds
389 Directory Server from AppStream. A fresh instance listens on every interface and lets anonymous clients read the tree; this role binds both listeners to loopback and limits anonymous clients to the rootDSE. The live test adds a user who binds, sees a wrong password and an anonymous search refused, and reads the LDAPS certificate. Original role, live-tested on Rocky Linux 10.
ansible-krb5-kdc
An MIT Kerberos KDC: the realm created once with a stash, kadmind behind an ACL, a default policy that locks an account after five wrong passwords, every listener on loopback. The KDC starts on a broken config without a word, so the live test proves each setting by behaviour: the ticket lifetime, the refusals, the lockout. Original role, live-tested on Rocky Linux 10.
ansible-authelia
Authelia from the upstream release (sha256-verified) as a hardened system service on loopback with file users and sqlite; its secrets are generated once on the host and reach the service as AUTHELIA_*_FILE variables. The live test hashes a password with Authelia's hasher, logs in, sees a wrong password refused and an anonymous visitor sent to the portal. Original role, live-tested on Rocky 10.