From 77f9b802e9c7c926a4b2957e76dbdf68c9cbc80a Mon Sep 17 00:00:00 2001 From: Mark Hoekveen Date: Sun, 5 Jan 2025 20:12:01 +0100 Subject: [PATCH] nog een update --- ansible.cfg | 1 + handlers/main.yml | 13 +++++++++++ playbook.yml | 50 ++++++++++++++++------------------------- preprovision.yml | 50 +++-------------------------------------- tasks/create_users.yml | 21 +++++++++++++++++ tasks/nocturnal_smb.yml | 20 +++++++++++++++++ tasks/preprovision.yml | 40 +++++++++++++++++++++++++++++++++ tasks/scripts.yml | 15 +++++++++++++ vault-password.sh | 2 ++ vault/nocturnal.yml | 9 ++++++++ 10 files changed, 143 insertions(+), 78 deletions(-) create mode 100644 handlers/main.yml create mode 100644 tasks/create_users.yml create mode 100644 tasks/nocturnal_smb.yml create mode 100644 tasks/preprovision.yml create mode 100644 tasks/scripts.yml create mode 100755 vault-password.sh create mode 100644 vault/nocturnal.yml diff --git a/ansible.cfg b/ansible.cfg index 52f073b..8b08cf7 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -5,6 +5,7 @@ editor=vim nocows=1 remote_user=nerevar interpreter_python=auto_silent +vault_password_file = vault-password.sh # (path) Option for connections using a certificate or key file to authenticate, rather than an agent or passwords, you can set the default value here to avoid re-specifying ``--private-key`` with every invocation. ;private_key_file= diff --git a/handlers/main.yml b/handlers/main.yml new file mode 100644 index 0000000..905b6d6 --- /dev/null +++ b/handlers/main.yml @@ -0,0 +1,13 @@ +- name: restart sshd + ansible.builtin.service: + name: ssh + state: restarted + +- name: restart docker + service: + name: docker + state: restarted + +- name: reload systemd + systemd: + daemon_reload: yes diff --git a/playbook.yml b/playbook.yml index a334004..b724ace 100644 --- a/playbook.yml +++ b/playbook.yml @@ -1,3 +1,10 @@ +- name: Preprovisioning + hosts: all + become: true + tasks: + - import_tasks: tasks/preprovision.yml + handlers: + - import_tasks: handlers/main.yml - name: Provision all hosts hosts: all become: true @@ -5,26 +12,14 @@ - name: Set hostname hostname: name: "{{ inventory_hostname }}" - - name: Print distribution - ansible.builtin.debug: - #var: ansible_facts ansible_distribution_release - var: ansible_distribution_release + # - name: Print distribution + # ansible.builtin.debug: + # var: ansible_distribution_release - name: Add aurbis group ansible.builtin.group: name: aurbis state: present - - name: Create users - ansible.builtin.user: - name: "{{ item }}" - groups: - - aurbis - - sudo - - wheel - append: true - shell: /bin/bash - state: present - when: users is defined - loop: "{{ users }}" + - import_tasks: tasks/create_users.yml - name: Add IP address of relevant hosts to /etc/hosts lineinfile: dest: /etc/hosts @@ -58,18 +53,11 @@ hosts: all become: true tasks: - - name: Git clone - ansible.builtin.git: - repo: https://git.hoekveen.net/mark/scripts.git - dest: /opt/scripts - force: true - - name: Set permissions and ownership for scripts folder - file: - path: /opt/scripts - state: directory - recurse: true - group: aurbis - mode: "0775" - - name: Add scripts directory to safe.directory - ansible.builtin.command: - cmd: git config --system --add safe.directory /opt/scripts + - import_tasks: tasks/scripts.yml +- name: Add Nocturnal SMB share + hosts: home + vars_files: + - vault/nocturnal.yml + become: true + tasks: + - import_tasks: tasks/nocturnal_smb.yml diff --git a/preprovision.yml b/preprovision.yml index 424aa5b..13cc329 100644 --- a/preprovision.yml +++ b/preprovision.yml @@ -9,53 +9,9 @@ vars: ansible_user: root # Put root password in here temporarily, just don't commit it - ansible_password: root # Root password will be cleared later + ansible_password: root tasks: - # - name: Print all available facts - # ansible.builtin.debug: - # var: ansible_facts - - name: Add sudo group - ansible.builtin.group: - name: sudo - state: present - - name: Add wheel group - ansible.builtin.group: - name: wheel - state: present - - name: Add ansible user - ansible.builtin.user: - name: nerevar - append: true - generate_ssh_key: true - groups: - - sudo - - wheel - - name: Add local user key - ansible.posix.authorized_key: - user: nerevar - state: present - key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}" - - name: >- - Allow ansible user to passwordless sudo all commands. - community.general.sudoers: - name: nerevar-sudo - state: present - user: nerevar - commands: ALL - - name: Lock root password - ansible.builtin.user: - name: root - password_lock: true - - name: Disable root SSH login - ansible.builtin.lineinfile: - path: /etc/ssh/sshd_config - regexp: "^PermitRootLogin" - line: "PermitRootLogin no" - validate: "/usr/sbin/sshd -t -f %s" - notify: Restart sshd + - import_tasks: tasks/preprovision.yml handlers: - - name: Restart sshd - ansible.builtin.service: - name: ssh - state: restarted + - import_tasks: handlers/main.yml diff --git a/tasks/create_users.yml b/tasks/create_users.yml new file mode 100644 index 0000000..37c4ee7 --- /dev/null +++ b/tasks/create_users.yml @@ -0,0 +1,21 @@ +- name: Create users + ansible.builtin.user: + name: "{{ item }}" + groups: + - aurbis + - sudo + - wheel + append: true + shell: /bin/bash + state: present + when: users is defined + loop: "{{ users }}" +- name: Copy local keys (if available) + ansible.posix.authorized_key: + user: "{{ item }}" + state: present + key: "{{ lookup('file', '/home/{{ item }}/.ssh/id_rsa.pub')}}" + when: + - users is defined + - lookup('first_found', '/home/{{ item }}/.ssh/id_rsa.pub', errors='ignore') + loop: "{{ users }}" diff --git a/tasks/nocturnal_smb.yml b/tasks/nocturnal_smb.yml new file mode 100644 index 0000000..6cc91ef --- /dev/null +++ b/tasks/nocturnal_smb.yml @@ -0,0 +1,20 @@ +- name: Get aurbis group gid + getent: + database: group + key: aurbis +- name: Mount (1) + ansible.posix.mount: + src: //{{ hostvars['nocturnal']['ansible_host']}}/nocturnal + path: /mnt/nocturnal/share + state: mounted + opts: "_netdev,username={{ nocturnal_smb_username }},password={{ nocturnal_smb_password }},file_mode=0775,dir_mode=0775,uid=0,gid={{ getent_group['aurbis'][1] }}" + fstype: cifs + when: inventory_hostname != 'nocturnal' +- name: Mount (2) + ansible.posix.mount: + src: //{{ hostvars['nocturnal']['ansible_host']}}/nocturnalocal + path: /mnt/nocturnal/local + state: mounted + opts: "_netdev,username={{ nocturnal_smb_username }},password={{ nocturnal_smb_password }},file_mode=0775,dir_mode=0775,uid=0,gid={{ getent_group['aurbis'][1] }}" + fstype: cifs + when: inventory_hostname != 'nocturnal' diff --git a/tasks/preprovision.yml b/tasks/preprovision.yml new file mode 100644 index 0000000..6fb49c2 --- /dev/null +++ b/tasks/preprovision.yml @@ -0,0 +1,40 @@ +- name: Add sudo group + ansible.builtin.group: + name: sudo + state: present +- name: Add wheel group + ansible.builtin.group: + name: wheel + state: present +- name: Add ansible user + ansible.builtin.user: + name: nerevar + append: true + generate_ssh_key: true + shell: /bin/bash + groups: + - sudo + - wheel +- name: Add local user key + ansible.posix.authorized_key: + user: nerevar + state: present + key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}" +- name: >- + Allow ansible user to passwordless sudo all commands. + community.general.sudoers: + name: nerevar-sudo + state: present + user: nerevar + commands: ALL +- name: Lock root password + ansible.builtin.user: + name: root + password_lock: true +- name: Disable root SSH login + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: "^PermitRootLogin" + line: "PermitRootLogin no" + validate: "/usr/sbin/sshd -t -f %s" + notify: restart sshd diff --git a/tasks/scripts.yml b/tasks/scripts.yml new file mode 100644 index 0000000..19f3cf0 --- /dev/null +++ b/tasks/scripts.yml @@ -0,0 +1,15 @@ +- name: Git clone + ansible.builtin.git: + repo: https://git.hoekveen.net/mark/scripts.git + dest: /opt/scripts + force: true +- name: Set permissions and ownership for scripts folder + file: + path: /opt/scripts + state: directory + recurse: true + group: aurbis + mode: "0775" +- name: Add scripts directory to safe.directory + ansible.builtin.command: + cmd: git config --system --add safe.directory /opt/scripts diff --git a/vault-password.sh b/vault-password.sh new file mode 100755 index 0000000..1c9685a --- /dev/null +++ b/vault-password.sh @@ -0,0 +1,2 @@ +#!/bin/bash +pass show ansible/vault diff --git a/vault/nocturnal.yml b/vault/nocturnal.yml new file mode 100644 index 0000000..de55504 --- /dev/null +++ b/vault/nocturnal.yml @@ -0,0 +1,9 @@ +$ANSIBLE_VAULT;1.1;AES256 +62343164653332363039613065656238616461626663383262373132623432333263323138633834 +3231626235323039316539326138643339643565303934610a393864623132336134393734326263 +65623338663837353032373732393935316661333965376266323835316630393734666234323835 +6232666333613630660a666464626661646339306230303631653431303765353764623663646636 +30616462613831363364306334616262323865613333383631346334393937383332396232336563 +30313361346438666365366633613062343964616233303130396436313862363264366637366630 +35613161383232626336343133626239346264626135366265343838643164613761656262356261 +61353761333833343965