suricata mount certs subvolume

deploy.yml

@@ -198,7 +198,7 @@
     # todo: use less hardcoding
     - name: make a more permanent lbu backup
       copy:
-        src: "{{ lbu_backupdir }}/{{ ansible_hostname }}.apkovl.tar.gz.aes-256-cbc"
+        src: "/media/mmcblk0p2/{{ ansible_hostname }}.apkovl.tar.gz.aes-256-cbc"
         dest: "/mnt/backups/lbu/{{ ansible_hostname }}.apkovl.tar.gz.aes-256-cbc.{{ ansible_date_time.iso8601 }}"
         remote_src: true
 

hosts.yml

@@ -36,7 +36,6 @@ all:
 
       lbu_encrypt: true
       lbu_media: mmcblk0p2
-      lbu_backupdir: /media/mmcblk0p2
 
       apk_cache_dir: /media/mmcblk0p2/cache
 
@@ -60,7 +59,7 @@ all:
         - src: "/dev/mmcblk0p1"
           path: "/media/mmcblk0p1"
           fstype: "vfat"
-          opts: "noauto,defaults"
+          opts: "noauto,defaults,ro"
           passno: "0"
 
         - src: "/media/mmcblk0p1/boot"
@@ -72,7 +71,7 @@ all:
         - src: "/dev/mmcblk0p2"
           path: "/media/mmcblk0p2"
           fstype: "ext4"
-          opts: "defaults"
+          opts: "defaults,ro"
           passno: "0"
 
         - src: "/dev/mapper/disk0"
@@ -135,6 +134,12 @@ all:
           opts: "subvol=containers,noatime,compress=zstd"
           passno: "0"
 
+        - src: "/dev/mapper/disk0"
+          path: "/mnt/certs"
+          fstype: "btrfs"
+          opts: "subvol=certs,noatime,compress=zstd"
+          passno: "0"
+
       rpi_cfg:
         - "enable_uart=1"
         - "otg_mode=1"