nog een update

tasks/create_users.yml

@@ -0,0 +1,21 @@
+- name: Create users
+  ansible.builtin.user:
+    name: "{{ item }}"
+    groups:
+      - aurbis
+      - sudo
+      - wheel
+    append: true
+    shell: /bin/bash
+    state: present
+  when: users is defined
+  loop: "{{ users }}"
+- name: Copy local keys (if available)
+  ansible.posix.authorized_key:
+    user: "{{ item }}"
+    state: present
+    key: "{{ lookup('file', '/home/{{ item }}/.ssh/id_rsa.pub')}}"
+  when:
+    - users is defined
+    - lookup('first_found', '/home/{{ item }}/.ssh/id_rsa.pub', errors='ignore')
+  loop: "{{ users }}"

tasks/nocturnal_smb.yml

@@ -0,0 +1,20 @@
+- name: Get aurbis group gid
+  getent:
+    database: group
+    key: aurbis
+- name: Mount (1)
+  ansible.posix.mount:
+    src: //{{ hostvars['nocturnal']['ansible_host']}}/nocturnal
+    path: /mnt/nocturnal/share
+    state: mounted
+    opts: "_netdev,username={{ nocturnal_smb_username }},password={{ nocturnal_smb_password }},file_mode=0775,dir_mode=0775,uid=0,gid={{ getent_group['aurbis'][1] }}"
+    fstype: cifs
+  when: inventory_hostname != 'nocturnal'
+- name: Mount (2)
+  ansible.posix.mount:
+    src: //{{ hostvars['nocturnal']['ansible_host']}}/nocturnalocal
+    path: /mnt/nocturnal/local
+    state: mounted
+    opts: "_netdev,username={{ nocturnal_smb_username }},password={{ nocturnal_smb_password }},file_mode=0775,dir_mode=0775,uid=0,gid={{ getent_group['aurbis'][1] }}"
+    fstype: cifs
+  when: inventory_hostname != 'nocturnal'

tasks/preprovision.yml

@@ -0,0 +1,40 @@
+- name: Add sudo group
+  ansible.builtin.group:
+    name: sudo
+    state: present
+- name: Add wheel group
+  ansible.builtin.group:
+    name: wheel
+    state: present
+- name: Add ansible user
+  ansible.builtin.user:
+    name: nerevar
+    append: true
+    generate_ssh_key: true
+    shell: /bin/bash
+    groups:
+      - sudo
+      - wheel
+- name: Add local user key
+  ansible.posix.authorized_key:
+    user: nerevar
+    state: present
+    key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}"
+- name: >-
+    Allow ansible user to passwordless sudo all commands.
+  community.general.sudoers:
+    name: nerevar-sudo
+    state: present
+    user: nerevar
+    commands: ALL
+- name: Lock root password
+  ansible.builtin.user:
+    name: root
+    password_lock: true
+- name: Disable root SSH login
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^PermitRootLogin"
+    line: "PermitRootLogin no"
+    validate: "/usr/sbin/sshd -t -f %s"
+  notify: restart sshd

tasks/scripts.yml

@@ -0,0 +1,15 @@
+- name: Git clone
+  ansible.builtin.git:
+    repo: https://git.hoekveen.net/mark/scripts.git
+    dest: /opt/scripts
+    force: true
+- name: Set permissions and ownership for scripts folder
+  file:
+    path: /opt/scripts
+    state: directory
+    recurse: true
+    group: aurbis
+    mode: "0775"
+- name: Add scripts directory to safe.directory
+  ansible.builtin.command:
+    cmd: git config --system --add safe.directory /opt/scripts