x

bootstrap.yml

@@ -25,255 +25,287 @@
 
 #### System Software
 
-  - name: Update repositories
-    become: true
-    ansible.builtin.apt:
-      update_cache: true
+    - name: Update repositories
+      become: true
+      ansible.builtin.apt:
+        update_cache: true
 
-  - name: Install bootstrap packages
-    become: true
-    ansible.builtin.apt:
-      state: present
-      pkg:
-        - bash
-        - curl
-        - python3
-        - python3-pip
-        - python3-venv
-        - python3-virtualenv
+    - name: Install bootstrap packages
+      become: true
+      ansible.builtin.apt:
+        state: present
+        pkg:
+          - bash
+          - curl
+          - python3
+          - python3-pip
+          - python3-venv
+          - python3-virtualenv
 
 
 #### Configure sudo
 
-  - name: Create system group hpf-sudo for normal sudo users
-    become: true
-    ansible.builtin.group:
-      name: hpf-sudo
-      state: present
-      system: true
-      gid: 700
+    - name: Create system group hpf-sudo for normal sudo users
+      become: true
+      ansible.builtin.group:
+        name: hpf-sudo
+        state: present
+        system: true
+        gid: 700
 
-  - name: Create system group hpf-sudo-np for special sudo users that don't require a password
-    become: true
-    ansible.builtin.group:
-      name: hpf-sudo-np
-      state: present
-      system: true
-      gid: 701
+    - name: Create system group hpf-sudo-np for special sudo users that don't require a password
+      become: true
+      ansible.builtin.group:
+        name: hpf-sudo-np
+        state: present
+        system: true
+        gid: 701
 
-  - name: Make sure /etc/sudoers.d exists
-    become: true
-    ansible.builtin.file:
-      path: /etc/sudoers.d
-      state: directory
-      owner: root
-      group: root
-      mode: u=rwx,go=
+    - name: Make sure /etc/sudoers.d exists
+      become: true
+      ansible.builtin.file:
+        path: /etc/sudoers.d
+        state: directory
+        owner: root
+        group: root
+        mode: u=rwx,go=
 
-  - name: Get /etc/sudoers.d/hpf
-    become: true
-    ansible.builtin.copy:
-      src: etc/sudoers.d/hpf
-      dest: /etc/sudoers.d/hpf
-      owner: root
-      group: root
-      mode: u=rw,go=
-      backup: true
-      validate: /usr/sbin/visudo -csf %s
+    - name: Get /etc/sudoers.d/hpf
+      become: true
+      ansible.builtin.copy:
+        src: etc/sudoers.d/hpf
+        dest: /etc/sudoers.d/hpf
+        owner: root
+        group: root
+        mode: u=rw,go=
+        backup: true
+        validate: /usr/sbin/visudo -csf %s
 
 
 #### Configure sshd
 
-  - name: Make sure /etc/ssh/sshd_config.d exists
-    become: true
-    ansible.builtin.file:
-      path: /etc/ssh/sshd_config.d
-      state: directory
-      owner: root
-      group: root
-      mode: u=rwx,go=rx
+    - name: Make sure /etc/ssh/sshd_config.d exists
+      become: true
+      ansible.builtin.file:
+        path: /etc/ssh/sshd_config.d
+        state: directory
+        owner: root
+        group: root
+        mode: u=rwx,go=rx
 
-  - name: Get /etc/ssh/sshd_config.d/hpf.conf
-    become: true
-    ansible.builtin.copy:
-      src: etc/ssh/sshd_config.d/hpf.conf
-      dest: /etc/ssh/sshd_config.d/hpf.conf
-      owner: root
-      group: root
-      mode: u=rwx,go=rx
-      backup: true
-      validate: /usr/sbin/sshd -t -f %s
-    notify: Restart sshd
+    - name: Get /etc/ssh/sshd_config.d/hpf.conf
+      become: true
+      ansible.builtin.copy:
+        src: etc/ssh/sshd_config.d/hpf.conf
+        dest: /etc/ssh/sshd_config.d/hpf.conf
+        owner: root
+        group: root
+        mode: u=rwx,go=rx
+        backup: true
+        validate: /usr/sbin/sshd -t -f %s
+      notify: Restart sshd
 
 
 #### Configure /etc/skel
 
-  - name: Make sure /etc/skel/.profile.d exists
-    become: true
-    ansible.builtin.file:
-      path: /etc/skel/.profile.d
-      state: directory
-      owner: root
-      group: root
-      mode: u=rwx,go=
+    - name: Make sure /etc/skel/.profile.d exists
+      become: true
+      ansible.builtin.file:
+        path: /etc/skel/.profile.d
+        state: directory
+        owner: root
+        group: root
+        mode: u=rwx,go=
 
-  - name: Get /etc/skel/.profile.d/ansible-venv.sh
-    become: true
-    ansible.builtin.copy:
-      src: etc/skel/.profile.d/ansible-venv.sh
-      dest: /etc/skel/.profile.d/ansible-venv.sh
-      owner: root
-      group: root
-      mode: u=rw,go=
-      backup: true
+    - name: Get /etc/skel/.profile.d/ansible-venv.sh
+      become: true
+      ansible.builtin.copy:
+        src: etc/skel/.profile.d/ansible-venv.sh
+        dest: /etc/skel/.profile.d/ansible-venv.sh
+        owner: root
+        group: root
+        mode: u=rw,go=
+        backup: true
 
-  - name: Get /etc/skel/.profile
-    become: true
-    ansible.builtin.copy:
-      src: etc/skel/.profile
-      dest: /etc/skel/.profile
-      owner: root
-      group: root
-      mode: u=rw,go=
-      backup: true
+    - name: Get /etc/skel/.profile
+      become: true
+      ansible.builtin.copy:
+        src: etc/skel/.profile
+        dest: /etc/skel/.profile
+        owner: root
+        group: root
+        mode: u=rw,go=
+        backup: true
 
 
 #### User: root
 
-  - name: Set root's authorized_keys
-    become: true
-    ansible.posix.authorized_key:
-      user: root
-      state: present
-      key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}"
+    - name: Set root's authorized_keys
+      become: true
+      ansible.posix.authorized_key:
+        user: root
+        state: present
+        key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}"
 
 
 #### User: hpf-ans
 
-  - name: Create the hpf-ans group
-    become: true
-    ansible.builtin.group:
-      name: hpf-ans
-      state: present
-      system: true
-      gid: 800
+    - name: Create the hpf-ans group
+      become: true
+      ansible.builtin.group:
+        name: hpf-ans
+        state: present
+        system: true
+        gid: 800
 
-  - name: Create the hpf-ans user
-    become: true
-    ansible.builtin.user:
-      name: hpf-ans
-      state: present
-      system: true
-      uid: 800
-      group: hpf-ans
-      groups: hpf-sudo-np
-      append: true
-      create_home: true
-      shell: /usr/bin/bash
+    - name: Create the hpf-ans user
+      become: true
+      ansible.builtin.user:
+        name: hpf-ans
+        state: present
+        system: true
+        uid: 800
+        group: hpf-ans
+        groups: hpf-sudo-np
+        append: true
+        create_home: true
+        shell: /usr/bin/bash
 
-  - name: Set hpf-ans's authorized_keys
-    become: true
-    ansible.posix.authorized_key:
-      user: hpf-ans
-      state: present
-      key: "{{ lookup('file', item) }}"
-    loop:
-      - files/ssh-keys/hpf-ans.pub
-      - files/ssh-keys/heath.pub
+    - name: Set hpf-ans's authorized_keys
+      become: true
+      ansible.posix.authorized_key:
+        user: hpf-ans
+        state: present
+        key: "{{ lookup('file', item) }}"
+      loop:
+        - files/ssh-keys/hpf-ans.pub
+        - files/ssh-keys/heath.pub
 
-  - name: Make sure pip is up to date
-    become: true
-    become_user: hpf-ans
-    ansible.builtin.pip:
-      name: pip
-      virtualenv: $HOME/.ansible-venv
-      extra_args: --upgrade
+    - name: Make sure pip is up to date
+      become: true
+      become_user: hpf-ans
+      ansible.builtin.pip:
+        name: pip
+        virtualenv: $HOME/.ansible-venv
+        extra_args: --upgrade
 
-  - name: Make sure ansible is up to date
-    become: true
-    become_user: hpf-ans
-    ansible.builtin.pip:
-      name: ansible
-      virtualenv: $HOME/.ansible-venv
-      extra_args: --upgrade
+    - name: Make sure ansible is up to date
+      become: true
+      become_user: hpf-ans
+      ansible.builtin.pip:
+        name: ansible
+        virtualenv: $HOME/.ansible-venv
+        extra_args: --upgrade
 
-  - name: Make sure /home/hpf-ans/bin exists
-    become: true
-    become_user: hpf-ans
-    ansible.builtin.file:
-      path: $HOME/bin
-      state: directory
-      owner: hpf-ans
-      group: hpf-ans
-      mode: u=rwx,go=
+    - name: Make sure /home/hpf-ans/bin exists
+      become: true
+      become_user: hpf-ans
+      ansible.builtin.file:
+        path: $HOME/bin
+        state: directory
+        owner: hpf-ans
+        group: hpf-ans
+        mode: u=rwx,go=
 
-  - name: Get /home/hpf-ans/bin/ansible-pull.sh
-    become: true
-    become_user: hpf-ans
-    ansible.builtin.copy:
-      src: home/hpf-ans/bin/ansible-pull.sh
-      dest: $HOME/bin/ansible-pull.sh
-      owner: hpf-ans
-      group: hpf-ans
-      mode: u=rwx,go=
-      backup: true
+    - name: Get /home/hpf-ans/bin/ansible-pull.sh
+      become: true
+      become_user: hpf-ans
+      ansible.builtin.copy:
+        src: home/hpf-ans/bin/ansible-pull.sh
+        dest: $HOME/bin/ansible-pull.sh
+        owner: hpf-ans
+        group: hpf-ans
+        mode: u=rwx,go=
+        backup: true
 
 
 #### User: first
 
-  - name: Set first's authorized_keys
-    become: true
-    ansible.posix.authorized_key:
-      user: first
-      state: present
-      key: "{{ lookup('file', item) }}"
-    loop:
-      - files/ssh-keys/first.pub
-      - files/ssh-keys/heath.pub
+#    - name: Create the first user
+#      become: true
+#      ansible.builtin.user:
+#        name: first
+#        comment: First User
+#        state: present
+#        system: false
+#        create_home: true
+#        shell: /usr/bin/bash
+
+#    - name: Set first's authorized_keys
+#      become: true
+#      ansible.posix.authorized_key:
+#        user: first
+#        state: present
+#        key: "{{ lookup('file', item) }}"
+#      loop:
+#        - files/ssh-keys/first.pub
+#        - files/ssh-keys/heath.pub
 
 
 #### User: heath
 
-  - name: Set heath's authorized_keys
-    become: true
-    ansible.posix.authorized_key:
-      user: heath
-      state: present
-      key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}"
+#    - name: Create the heath group
+#      become: true
+#      ansible.builtin.group:
+#        name: heath
+#        state: present
+#        system: false
+#        gid: 8000
+
+#    - name: Create the heath user
+#      become: true
+#      ansible.builtin.user:
+#        name: heath
+#        comment: Heath Petersen
+#        state: present
+#        system: false
+#        uid: 8000
+#        group: heath
+#        groups: hpf-sudo
+#        append: true
+#        create_home: true
+#        shell: /usr/bin/bash
+
+    - name: Set heath's authorized_keys
+      become: true
+      ansible.posix.authorized_key:
+        user: heath
+        state: present
+        key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}"
 
 
 #### Schedule ansible-pull.sh
 
-  - name: Make sure log directory exists
-    become: true
-    ansible.builtin.file:
-      path: /var/log/ansible-pull.sh
-      state: directory
-      owner: hpf-ans
-      group: root
-      mode: u=rwx,go=
+    - name: Make sure log directory exists
+      become: true
+      ansible.builtin.file:
+        path: /var/log/ansible-pull.sh
+        state: directory
+        owner: hpf-ans
+        group: root
+        mode: u=rwx,go=
 
-# - name: Create ansible-pull.sh crontab entry
-#   become: true
-#   ansible.builtin.cron:
-#     name: "ansible-pull"
-#     minute: "*/27"
-#     job: $HOME/bin/ansible-pull.sh
-#     backup: true
+#   - name: Create ansible-pull.sh crontab entry
+#     become: true
+#     ansible.builtin.cron:
+#       name: "ansible-pull"
+#       minute: "*/27"
+#       job: $HOME/bin/ansible-pull.sh
+#       backup: true
 
 
 #### Clean System Software
 
-  - name: Remove packages installed as dependencies that are no longer required and purge their configuration files
-    become: true
-    ansible.builtin.apt:
-      autoremove: true
-      purge: true
+    - name: Remove packages installed as dependencies that are no longer required and purge their configuration files
+      become: true
+      ansible.builtin.apt:
+        autoremove: true
+        purge: true
 
-  - name: Remove old downloaded packages
-    become: true
-    ansible.builtin.apt:
-      autoclean: true
+    - name: Remove old downloaded packages
+      become: true
+      ansible.builtin.apt:
+        autoclean: true
 
 
 #### Handlers