nog een update

ansible.cfg

@@ -5,6 +5,7 @@ editor=vim
 nocows=1
 remote_user=nerevar
 interpreter_python=auto_silent
+vault_password_file = vault-password.sh
 
 # (path) Option for connections using a certificate or key file to authenticate, rather than an agent or passwords, you can set the default value here to avoid re-specifying ``--private-key`` with every invocation.
 ;private_key_file=

handlers/main.yml

@@ -0,0 +1,13 @@
+- name: restart sshd
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+
+- name: restart docker
+  service:
+    name: docker
+    state: restarted
+
+- name: reload systemd
+  systemd:
+    daemon_reload: yes

playbook.yml

@@ -1,3 +1,10 @@
+- name: Preprovisioning
+  hosts: all
+  become: true
+  tasks:
+    - import_tasks: tasks/preprovision.yml
+  handlers:
+    - import_tasks: handlers/main.yml
 - name: Provision all hosts
   hosts: all
   become: true
@@ -5,26 +12,14 @@
     - name: Set hostname
       hostname:
         name: "{{ inventory_hostname }}"
-    - name: Print distribution
+    # - name: Print distribution
-      ansible.builtin.debug:
+    #   ansible.builtin.debug:
-        #var: ansible_facts ansible_distribution_release
+    #     var: ansible_distribution_release
-        var: ansible_distribution_release
     - name: Add aurbis group
       ansible.builtin.group:
         name: aurbis
         state: present
-    - name: Create users
+    - import_tasks: tasks/create_users.yml
-      ansible.builtin.user:
-        name: "{{ item }}"
-        groups:
-          - aurbis
-          - sudo
-          - wheel
-        append: true
-        shell: /bin/bash
-        state: present
-      when: users is defined
-      loop: "{{ users }}"
     - name: Add IP address of relevant hosts to /etc/hosts
       lineinfile:
         dest: /etc/hosts
@@ -58,18 +53,11 @@
   hosts: all
   become: true
   tasks:
-    - name: Git clone
+    - import_tasks: tasks/scripts.yml
-      ansible.builtin.git:
+- name: Add Nocturnal SMB share
-        repo: https://git.hoekveen.net/mark/scripts.git
+  hosts: home
-        dest: /opt/scripts
+  vars_files:
-        force: true
+    - vault/nocturnal.yml
-    - name: Set permissions and ownership for scripts folder
+  become: true
-      file:
+  tasks:
-        path: /opt/scripts
+    - import_tasks: tasks/nocturnal_smb.yml
-        state: directory
-        recurse: true
-        group: aurbis
-        mode: "0775"
-    - name: Add scripts directory to safe.directory
-      ansible.builtin.command:
-        cmd: git config --system --add safe.directory /opt/scripts

preprovision.yml

@@ -9,53 +9,9 @@
   vars:
     ansible_user: root
     # Put root password in here temporarily, just don't commit it
-    ansible_password: root
     # Root password will be cleared later
+    ansible_password: root
   tasks:
-    # - name: Print all available facts
+    - import_tasks: tasks/preprovision.yml
-    #   ansible.builtin.debug:
-    #     var: ansible_facts
-    - name: Add sudo group
-      ansible.builtin.group:
-        name: sudo
-        state: present
-    - name: Add wheel group
-      ansible.builtin.group:
-        name: wheel
-        state: present
-    - name: Add ansible user
-      ansible.builtin.user:
-        name: nerevar
-        append: true
-        generate_ssh_key: true
-        groups:
-          - sudo
-          - wheel
-    - name: Add local user key
-      ansible.posix.authorized_key:
-        user: nerevar
-        state: present
-        key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}"
-    - name: >-
-        Allow ansible user to passwordless sudo all commands.
-      community.general.sudoers:
-        name: nerevar-sudo
-        state: present
-        user: nerevar
-        commands: ALL
-    - name: Lock root password
-      ansible.builtin.user:
-        name: root
-        password_lock: true
-    - name: Disable root SSH login
-      ansible.builtin.lineinfile:
-        path: /etc/ssh/sshd_config
-        regexp: "^PermitRootLogin"
-        line: "PermitRootLogin no"
-        validate: "/usr/sbin/sshd -t -f %s"
-      notify: Restart sshd
   handlers:
-    - name: Restart sshd
+    - import_tasks: handlers/main.yml
-      ansible.builtin.service:
-        name: ssh
-        state: restarted

tasks/create_users.yml

@@ -0,0 +1,21 @@
+- name: Create users
+  ansible.builtin.user:
+    name: "{{ item }}"
+    groups:
+      - aurbis
+      - sudo
+      - wheel
+    append: true
+    shell: /bin/bash
+    state: present
+  when: users is defined
+  loop: "{{ users }}"
+- name: Copy local keys (if available)
+  ansible.posix.authorized_key:
+    user: "{{ item }}"
+    state: present
+    key: "{{ lookup('file', '/home/{{ item }}/.ssh/id_rsa.pub')}}"
+  when:
+    - users is defined
+    - lookup('first_found', '/home/{{ item }}/.ssh/id_rsa.pub', errors='ignore')
+  loop: "{{ users }}"

tasks/nocturnal_smb.yml

@@ -0,0 +1,20 @@
+- name: Get aurbis group gid
+  getent:
+    database: group
+    key: aurbis
+- name: Mount (1)
+  ansible.posix.mount:
+    src: //{{ hostvars['nocturnal']['ansible_host']}}/nocturnal
+    path: /mnt/nocturnal/share
+    state: mounted
+    opts: "_netdev,username={{ nocturnal_smb_username }},password={{ nocturnal_smb_password }},file_mode=0775,dir_mode=0775,uid=0,gid={{ getent_group['aurbis'][1] }}"
+    fstype: cifs
+  when: inventory_hostname != 'nocturnal'
+- name: Mount (2)
+  ansible.posix.mount:
+    src: //{{ hostvars['nocturnal']['ansible_host']}}/nocturnalocal
+    path: /mnt/nocturnal/local
+    state: mounted
+    opts: "_netdev,username={{ nocturnal_smb_username }},password={{ nocturnal_smb_password }},file_mode=0775,dir_mode=0775,uid=0,gid={{ getent_group['aurbis'][1] }}"
+    fstype: cifs
+  when: inventory_hostname != 'nocturnal'

tasks/preprovision.yml

@@ -0,0 +1,40 @@
+- name: Add sudo group
+  ansible.builtin.group:
+    name: sudo
+    state: present
+- name: Add wheel group
+  ansible.builtin.group:
+    name: wheel
+    state: present
+- name: Add ansible user
+  ansible.builtin.user:
+    name: nerevar
+    append: true
+    generate_ssh_key: true
+    shell: /bin/bash
+    groups:
+      - sudo
+      - wheel
+- name: Add local user key
+  ansible.posix.authorized_key:
+    user: nerevar
+    state: present
+    key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}"
+- name: >-
+    Allow ansible user to passwordless sudo all commands.
+  community.general.sudoers:
+    name: nerevar-sudo
+    state: present
+    user: nerevar
+    commands: ALL
+- name: Lock root password
+  ansible.builtin.user:
+    name: root
+    password_lock: true
+- name: Disable root SSH login
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^PermitRootLogin"
+    line: "PermitRootLogin no"
+    validate: "/usr/sbin/sshd -t -f %s"
+  notify: restart sshd

tasks/scripts.yml

@@ -0,0 +1,15 @@
+- name: Git clone
+  ansible.builtin.git:
+    repo: https://git.hoekveen.net/mark/scripts.git
+    dest: /opt/scripts
+    force: true
+- name: Set permissions and ownership for scripts folder
+  file:
+    path: /opt/scripts
+    state: directory
+    recurse: true
+    group: aurbis
+    mode: "0775"
+- name: Add scripts directory to safe.directory
+  ansible.builtin.command:
+    cmd: git config --system --add safe.directory /opt/scripts

vault-password.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+pass show ansible/vault

vault/nocturnal.yml

@@ -0,0 +1,9 @@
+$ANSIBLE_VAULT;1.1;AES256
+62343164653332363039613065656238616461626663383262373132623432333263323138633834
+3231626235323039316539326138643339643565303934610a393864623132336134393734326263
+65623338663837353032373732393935316661333965376266323835316630393734666234323835
+6232666333613630660a666464626661646339306230303631653431303765353764623663646636
+30616462613831363364306334616262323865613333383631346334393937383332396232336563
+30313361346438666365366633613062343964616233303130396436313862363264366637366630
+35613161383232626336343133626239346264626135366265343838643164613761656262356261
+61353761333833343965