update

ansible.cfg

@@ -3,6 +3,7 @@ inventory=inventory.yml
 host_key_checking=False
 editor=vim
 nocows=1
+remote_user=nerevar
 
 # (string) Path to the Python interpreter to be used for module execution on remote targets, or an automatic discovery mode. Supported discovery modes are ``auto`` (the default), ``auto_silent``, ``auto_legacy``, and ``auto_legacy_silent``. All discovery modes employ a lookup table to use the included system Python (on distributions known to include one), falling back to a fixed ordered list of well-known Python interpreter locations if a platform-specific default is not available. The fallback behavior will issue a warning that the interpreter should be set explicitly (since interpreters installed later may change which one is used). This warning behavior can be disabled by setting ``auto_silent`` or ``auto_legacy_silent``. The value of ``auto_legacy`` provides all the same behavior, but for backward-compatibility with older Ansible releases that always defaulted to ``/usr/bin/python``, will use that interpreter if present.
 interpreter_python=auto_silent

group_vars/cloud.yml

@@ -0,0 +1,6 @@
+users:
+  - mark
+  - martijn
+  - jp
+  - lourens
+  - guus

group_vars/debian.yml

@@ -1,5 +1,8 @@
 common_packages:
   - vim
+  - git
+  - ca-certificates
+  - curl
   - tmux
   - python3
   - python3-pip

group_vars/home.yml

@@ -0,0 +1,2 @@
+users:
+  - mark

host_vars/todd-test.yml

@@ -0,0 +1,2 @@
+users:
+  - mark

inventory.yml

@@ -1,19 +1,31 @@
 rpi:
   hosts:
     vaermina:
+      ansible_host: 192.168.178.95
     azura:
+      ansible_host: 192.168.178.94
     kynareth:
+      ansible_host: 192.168.178.96
     nocturnal:
+      ansible_host: 192.168.178.56
 x86:
   hosts:
     talos:
+      ansible_host: 192.168.178.64
     meridia:
+      ansible_host: 62.171.176.43
     dibella:
+      ansible_host: 45.88.188.77
+    todd-test:
 debian:
   hosts:
     vaermina:
     talos:
     nocturnal:
+    todd-test:
+      # Local test VM
+      ansible_port: 3022
+      ansible_host: 127.0.0.1
 arch:
   hosts:
     azura:
@@ -27,6 +39,9 @@ home:
     kynareth:
     nocturnal:
     talos:
+virtual:
+  hosts:
+    todd-test:
 cloud:
   hosts:
     meridia:

playbook.yml

@@ -2,20 +2,74 @@
   hosts: all
   become: true
   tasks:
-    - name: >-
-        Allow mark to passwordless sudo all commands.
-        (First run should be with --ask-become-pass)
-      community.general.sudoers:
-        name: mark-sudo
-        state: present
-        user: mark
-        commands: ALL
     - name: Set hostname
       hostname:
         name: "{{ inventory_hostname }}"
-    - name: Update debian
+    - name: Print distribution
+      ansible.builtin.debug:
+        #var: ansible_facts ansible_distribution_release
+        var: ansible_distribution_release
+    - name: Add aurbis group
+      ansible.builtin.group:
+        name: aurbis
+        state: present
+    - name: Create users
+      ansible.builtin.user:
+        name: "{{ item }}"
+        groups:
+          - aurbis
+          - sudo
+          - wheel
+        append: true
+        shell: /bin/bash
+        state: present
+      when: users is defined
+      loop: "{{ users }}"
+    - name: Add IP address of relevant hosts to /etc/hosts
+      lineinfile:
+        dest: /etc/hosts
+        regexp: ".*{{ item }}$"
+        line: "{{ hostvars[item].ansible_host }} {{item}}"
+        state: present
+      when:
+        - hostvars[item].ansible_host is defined
+        - (inventory_hostname in groups['home'] and (item in groups['home'] or item in groups['cloud'])) or
+          (inventory_hostname not in groups['home'] and item in groups['cloud'])
+      with_items: "{{ groups.all }}"
+- name: Update Debian hosts
+  hosts: debian
+  become: true
+  tasks:
+    - name: Update
       include_tasks: tasks/update_debian.yml
-      when: ansible_os_family == "Debian"
+- name: Update Arch hosts
-    - name: Update arch
+  hosts: arch
+  become: true
+  tasks:
+    - name: Update
       include_tasks: tasks/update_arch.yml
-      when: ansible_os_family == "Archlinux"
+- name: Docker
+  hosts: debian
+  become: true
+  tasks:
+    - name: Update
+      include_tasks: tasks/install_docker_debian.yml
+- name: Add utility scripts
+  hosts: all
+  become: true
+  tasks:
+    - name: Git clone
+      ansible.builtin.git:
+        repo: https://git.hoekveen.net/mark/scripts.git
+        dest: /opt/scripts
+        force: true
+    - name: Set permissions and ownership for scripts folder
+      file:
+        path: /opt/scripts
+        state: directory
+        recurse: true
+        group: aurbis
+        mode: "0775"
+    - name: Add scripts directory to safe.directory
+      ansible.builtin.command:
+        cmd: git config --system --add safe.directory /opt/scripts

preprovision.yml

@@ -0,0 +1,61 @@
+# Creates ansible user with passwordless sudo
+# Needs root ssh access
+# ensures that login is possible
+# disables root user.
+- name: >-
+    Pre-provision a bare host.
+    Adds execution user.
+  hosts: all
+  vars:
+    ansible_user: root
+    # Put root password in here temporarily, just don't commit it
+    ansible_password: root
+    # Root password will be cleared later
+  tasks:
+    # - name: Print all available facts
+    #   ansible.builtin.debug:
+    #     var: ansible_facts
+    - name: Add sudo group
+      ansible.builtin.group:
+        name: sudo
+        state: present
+    - name: Add wheel group
+      ansible.builtin.group:
+        name: wheel
+        state: present
+    - name: Add ansible user
+      ansible.builtin.user:
+        name: nerevar
+        append: true
+        generate_ssh_key: true
+        groups:
+          - sudo
+          - wheel
+    - name: Add local user key
+      ansible.posix.authorized_key:
+        user: nerevar
+        state: present
+        key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}"
+    - name: >-
+        Allow ansible user to passwordless sudo all commands.
+      community.general.sudoers:
+        name: nerevar-sudo
+        state: present
+        user: nerevar
+        commands: ALL
+    - name: Lock root password
+      ansible.builtin.user:
+        name: root
+        password_lock: true
+    - name: Disable root SSH login
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^PermitRootLogin"
+        line: "PermitRootLogin no"
+        validate: "/usr/sbin/sshd -t -f %s"
+      notify: Restart sshd
+  handlers:
+    - name: Restart sshd
+      ansible.builtin.service:
+        name: ssh
+        state: restarted

tasks/install_docker_debian.yml

@@ -0,0 +1,36 @@
+- name: Install required system packages
+  apt:
+    name:
+      - ca-certificates
+      - curl
+    state: latest
+    update_cache: true
+- name: Create /etc/apt/keyrings directory
+  file:
+    path: /etc/apt/keyrings
+    state: directory
+    mode: "0755"
+- name: Add Docker GPG apt Key
+  get_url:
+    url: https://download.docker.com/linux/debian/gpg
+    dest: /etc/apt/keyrings/docker.asc
+    mode: "0755"
+- name: Add Docker Repository
+  apt_repository:
+    repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian {{ansible_distribution_release}} stable
+    state: present
+- name: Update apt and install Docker packages
+  apt:
+    name:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-buildx-plugin
+      - docker-compose-plugin
+    state: latest
+    update_cache: true
+- name: Add mark to the Docker group
+  user:
+    name: mark
+    groups: docker
+    append: yes