update

2025-01-05 17:02:29 +01:00
parent ebec1869cc
commit ca15a298d0
9 changed files with 192 additions and 12 deletions
@@ -0,0 +1,61 @@
+# Creates ansible user with passwordless sudo
+# Needs root ssh access
+# ensures that login is possible
+# disables root user.
+- name: >-
+    Pre-provision a bare host.
+    Adds execution user.
+  hosts: all
+  vars:
+    ansible_user: root
+    # Put root password in here temporarily, just don't commit it
+    ansible_password: root
+    # Root password will be cleared later
+  tasks:
+    # - name: Print all available facts
+    #   ansible.builtin.debug:
+    #     var: ansible_facts
+    - name: Add sudo group
+      ansible.builtin.group:
+        name: sudo
+        state: present
+    - name: Add wheel group
+      ansible.builtin.group:
+        name: wheel
+        state: present
+    - name: Add ansible user
+      ansible.builtin.user:
+        name: nerevar
+        append: true
+        generate_ssh_key: true
+        groups:
+          - sudo
+          - wheel
+    - name: Add local user key
+      ansible.posix.authorized_key:
+        user: nerevar
+        state: present
+        key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}"
+    - name: >-
+        Allow ansible user to passwordless sudo all commands.
+      community.general.sudoers:
+        name: nerevar-sudo
+        state: present
+        user: nerevar
+        commands: ALL
+    - name: Lock root password
+      ansible.builtin.user:
+        name: root
+        password_lock: true
+    - name: Disable root SSH login
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^PermitRootLogin"
+        line: "PermitRootLogin no"
+        validate: "/usr/sbin/sshd -t -f %s"
+      notify: Restart sshd
+  handlers:
+    - name: Restart sshd
+      ansible.builtin.service:
+        name: ssh
+        state: restarted