62 lines
1.7 KiB
YAML
62 lines
1.7 KiB
YAML
# Creates ansible user with passwordless sudo
|
|
# Needs root ssh access
|
|
# ensures that login is possible
|
|
# disables root user.
|
|
- name: >-
|
|
Pre-provision a bare host.
|
|
Adds execution user.
|
|
hosts: all
|
|
vars:
|
|
ansible_user: root
|
|
# Put root password in here temporarily, just don't commit it
|
|
ansible_password: root
|
|
# Root password will be cleared later
|
|
tasks:
|
|
# - name: Print all available facts
|
|
# ansible.builtin.debug:
|
|
# var: ansible_facts
|
|
- name: Add sudo group
|
|
ansible.builtin.group:
|
|
name: sudo
|
|
state: present
|
|
- name: Add wheel group
|
|
ansible.builtin.group:
|
|
name: wheel
|
|
state: present
|
|
- name: Add ansible user
|
|
ansible.builtin.user:
|
|
name: nerevar
|
|
append: true
|
|
generate_ssh_key: true
|
|
groups:
|
|
- sudo
|
|
- wheel
|
|
- name: Add local user key
|
|
ansible.posix.authorized_key:
|
|
user: nerevar
|
|
state: present
|
|
key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}"
|
|
- name: >-
|
|
Allow ansible user to passwordless sudo all commands.
|
|
community.general.sudoers:
|
|
name: nerevar-sudo
|
|
state: present
|
|
user: nerevar
|
|
commands: ALL
|
|
- name: Lock root password
|
|
ansible.builtin.user:
|
|
name: root
|
|
password_lock: true
|
|
- name: Disable root SSH login
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^PermitRootLogin"
|
|
line: "PermitRootLogin no"
|
|
validate: "/usr/sbin/sshd -t -f %s"
|
|
notify: Restart sshd
|
|
handlers:
|
|
- name: Restart sshd
|
|
ansible.builtin.service:
|
|
name: ssh
|
|
state: restarted
|